@segmentstream-cloud/app 0.17.1 → 0.18.0

package/dist/federation.js

@@ -1,14 +1,19 @@
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { NextResponse } from "next/server";
+import { hasChannelApps } from "./config.js";
 import { cookiePolicyFor, isLoopbackHostname, safeReturnTo } from "./cookies.js";
-import { isSameOrigin } from "./decision-pages.js";
+import { channelAppFraming } from "./telegram.js";
+import { createChannelSession } from "./channel-session.js";
+import { isSameOrigin, withUnframeablePages } from "./decision-pages.js";
+import { apiErrorFrom, SegmentStreamApiError } from "./errors.js";
 import { parseMe } from "./me.js";
 import { createOntologyTransport, ontologyOrigin } from "./ontology-transport.js";
 import { createOntologyClient } from "./ontology.js";
 import { createAgentAuthorizations } from "./oauth.js";
 import { createAgentIdentities } from "./agent.js";
 import { isAllowed } from "./permissions.js";
+import { matchesPathPrefix, normalizePublicPath } from "./proxy.js";
 import { base64UrlDecode, base64UrlEncode, constantTimeEqual, createCodeChallenge, randomToken, } from "./pkce.js";
 const PREFIX = "/api/segmentstream";
 const CALLBACK = `${PREFIX}/callback`;
@@ -34,6 +39,12 @@ export function withFederation(base, config, oidc, options) {
         oidc.issuer.endsWith("/")) {
         throw new Error("SEGMENTSTREAM_OIDC_ISSUER must be an HTTPS issuer without a trailing slash.");
     }
+    const channel = createChannelSession({
+        enabled: hasChannelApps(config.channels),
+        workspaceId: config.workspaceId,
+        ontologyUrl: options.ontologyUrl,
+        fetch: options.fetch,
+    });
     const token = async () => {
         const cookieStore = await cookies();
         const host = (await headers()).get("host") ?? "";
@@ -50,32 +61,71 @@ export function withFederation(base, config, oidc, options) {
         ontologyUrl: options.ontologyUrl,
         credentials: { token },
     });
+    const fallbackTransport = options.proofTransport ?? options.channelSession?.transport ?? transport;
     const ontologyTransport = {
-        fetch: async (path, init = {}) => (await token())
-            ? transport.fetch(path, init)
-            : options.proofTransport
-                ? options.proofTransport.fetch(path, init)
-                : transport.fetch(path, init),
+        fetch: async (path, init = {}) => (await channel.read())
+            ? channel.transport.fetch(path, init)
+            : (await token())
+                ? transport.fetch(path, init)
+                : fallbackTransport.fetch(path, init),
     };
     async function getUser() {
-        if (!(await token())) {
-            return options.neon ? base.getUser() : null;
-        }
-        const response = await transport.fetch("/me", { cache: "no-store" });
-        const user = response.ok ? parseMe(await response.json()) : null;
-        return user
-            ? {
-                id: user.id,
-                ...(user.email ? { email: user.email } : {}),
-                ...(user.name ? { name: user.name } : {}),
+        const channelUser = (await channel.read())?.user;
+        if (channelUser) {
+            return {
+                ...channelUser,
+                email: channelUser.email ?? undefined,
+                name: channelUser.name ?? undefined,
                 organizationId: config.organizationId,
                 workspaceId: config.workspaceId,
-                roles: user.roles,
-                permissions: user.permissions,
-                kind: user.kind,
-                active: user.active,
-            }
-            : null;
+            };
+        }
+        if (!(await token())) {
+            return options.neon ? base.getUser() : (options.channelSession?.getUser() ?? null);
+        }
+        return oidcUser();
+    }
+    async function oidcUser() {
+        return userFromResponse(await transport.fetch("/me", { cache: "no-store" }));
+    }
+    async function userFromResponse(response) {
+        if (response.status === 401 || response.status === 403) {
+            return null;
+        }
+        let payload;
+        try {
+            payload = await response.json();
+        }
+        catch (cause) {
+            throw new SegmentStreamApiError({
+                code: "ontology_invalid_response",
+                status: 502,
+                detail: "ontology_invalid_response",
+                cause,
+            });
+        }
+        if (!response.ok) {
+            throw apiErrorFrom(response.status, payload, "session_unavailable");
+        }
+        const user = parseMe(payload);
+        if (!user) {
+            throw new SegmentStreamApiError({
+                code: "ontology_invalid_response",
+                status: 502,
+                detail: "ontology_invalid_response",
+            });
+        }
+        return {
+            id: user.id,
+            ...(user.email ? { email: user.email } : {}),
+            ...(user.name ? { name: user.name } : {}),
+            organizationId: config.organizationId,
+            workspaceId: config.workspaceId,
+            roles: user.roles,
+            permissions: user.permissions,
+            kind: user.kind,
+            active: user.active,
+        };
     }
     const setSession = (response, request, value) => {
         const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
@@ -87,7 +137,24 @@ export function withFederation(base, config, oidc, options) {
         const pendingName = cookieName(config.workspaceId, secure, "pending");
         const path = request.nextUrl.pathname;
         if (path === `${PREFIX}/configuration`) {
-            return NextResponse.json({ enabled: true }, { headers: { "cache-control": "no-store" } });
+            return NextResponse.json({ enabled: true, neon: options.neon, channels: config.channels ?? {} }, { headers: { "cache-control": "no-store" } });
+        }
+        if (path === `${PREFIX}/session`) {
+            const credential = await token();
+            if (!credential) {
+                return NextResponse.json(null, { status: 401, headers: { "cache-control": "no-store" } });
+            }
+            const user = await oidcUser();
+            return NextResponse.json(user
+                ? {
+                    session: { id: await createCodeChallenge(credential) },
+                    user,
+                    source: "oidc",
+                }
+                : { error: "unauthorized", source: "oidc" }, {
+                status: user ? 200 : 401,
+                headers: { "cache-control": "no-store" },
+            });
         }
         if (path === `${PREFIX}/sign-in`) {
             const state = randomToken();
@@ -261,6 +328,7 @@ export function withFederation(base, config, oidc, options) {
         oauth: createAgentAuthorizations(ontologyTransport),
         agent: createAgentIdentities(ontologyTransport),
         signOut: async (settings) => {
+            await options.channelSession?.signOut();
             if (await token()) {
                 await transport.fetch("/federation/logout", { method: "POST" }).catch(() => undefined);
             }
@@ -273,22 +341,28 @@ export function withFederation(base, config, oidc, options) {
             }
             redirect(safeReturnTo(settings?.redirectTo ?? "/sign-in"));
         },
-        proxy: (settings) => async (request) => {
+        proxy: (settings) => withUnframeablePages(async (request) => {
+            const forwardedOrPublic = [
+                PREFIX,
+                "/sign-in",
+                "/api/auth",
+                "/mcp",
+                "/api/ontology",
+                "/_next",
+                "/.well-known",
+                ...(settings?.publicPaths ?? []).map(normalizePublicPath),
+            ].some((path) => matchesPathPrefix(request.nextUrl.pathname, path));
+            const channelResponse = forwardedOrPublic ? undefined : await channel.proxy(request);
+            if (channelResponse) {
+                return channelResponse;
+            }
             const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
             const credential = request.cookies.get(cookieName(config.workspaceId, secure))?.value;
-            if (request.nextUrl.pathname.startsWith(PREFIX)) {
+            if (matchesPathPrefix(request.nextUrl.pathname, PREFIX)) {
                 return NextResponse.next();
             }
-            if (credential &&
-                ![
-                    "/sign-in",
-                    "/api/auth",
-                    "/mcp",
-                    "/api/ontology",
-                    "/_next",
-                    ...(settings?.publicPaths ?? []),
-                ].some((path) => request.nextUrl.pathname === path || request.nextUrl.pathname.startsWith(`${path}/`))) {
-                const origin = options.ontologyUrl ?? request.nextUrl.origin;
+            if (credential && !forwardedOrPublic) {
+                const origin = await ontologyOrigin(options.ontologyUrl ?? request.nextUrl.origin);
                 const response = await options.fetch(`${origin}/api/ontology/me`, {
                     headers: { authorization: `Bearer ${credential}` },
                     cache: "no-store",
@@ -296,14 +370,18 @@ export function withFederation(base, config, oidc, options) {
                     signal: AbortSignal.timeout(10000),
                 });
                 if (response.ok) {
+                    await userFromResponse(response);
                     return NextResponse.next();
                 }
+                if (response.status !== 401 && response.status !== 403) {
+                    return NextResponse.json({ error: "session_unavailable" }, { status: 503, headers: { "cache-control": "no-store", "retry-after": "5" } });
+                }
                 const denied = NextResponse.redirect(new URL("/sign-in", request.url));
                 denied.cookies.set(cookieName(config.workspaceId, secure), "", attributes(secure, 0));
                 return denied;
             }
             return base.proxy(settings)(request);
-        },
+        }, channelAppFraming(config.channels)),
     };
 }
 function protectResponse(response) {

package/dist/handlers.d.ts

@@ -5,4 +5,6 @@ export interface SegmentStreamRouteHandlers {
     readonly GET: RouteHandler;
     readonly POST: RouteHandler;
 }
-export declare function createHandlers(context: AppContext): SegmentStreamRouteHandlers;
+export declare function createHandlers(context: AppContext, { neon }?: {
+    readonly neon?: boolean;
+}): SegmentStreamRouteHandlers;

package/dist/handlers.js

@@ -3,9 +3,13 @@ import { authFlowCookieName, clearCookie, clearSessionCookies, cookiePolicyFor,
 import { isSameOrigin } from "./decision-pages.js";
 import { constantTimeEqual } from "./pkce.js";
 import { CALLBACK_PATH, SIGNED_OUT_PATH, SIGN_IN_PATH, SDK_ROUTE_PREFIX, signInRedirect, } from "./sign-in.js";
-export function createHandlers(context) {
+export function createHandlers(context, { neon = false } = {}) {
     async function GET(request) {
         switch (request.nextUrl.pathname) {
+            case `${SDK_ROUTE_PREFIX}/configuration`:
+                return NextResponse.json({ enabled: false, neon, channels: context.config.channels ?? {} }, {
+                    headers: { "cache-control": "no-store" },
+                });
             case CALLBACK_PATH:
                 return handleCallback(context, request);
             case SIGN_IN_PATH:

package/dist/neon.js

@@ -3,7 +3,9 @@ import { decodeJwt } from "jose";
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
 import { NextResponse } from "next/server";
+import { hasChannelApps } from "./config.js";
 import { replaceRequestCookies, safeReturnTo } from "./cookies.js";
+import { createChannelSession } from "./channel-session.js";
 import { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError, apiErrorFrom, readJson, } from "./errors.js";
 import { parseMe } from "./me.js";
 import { createOntologyTransport } from "./ontology-transport.js";
@@ -23,6 +25,7 @@ const ONTOLOGY_PATHS = ["/api/ontology", "/mcp"];
 export const OPEN_PATHS = [
     AUTH_API_PATH,
     SIGN_IN_PAGE,
+    "/api/segmentstream/configuration",
     "/api/health",
     "/_next",
     "/favicon.ico",
@@ -79,6 +82,12 @@ class ExpiringCache {
  */
 export function createNeonSession(dependencies) {
     const { config, settings, now } = dependencies;
+    const channel = createChannelSession({
+        enabled: hasChannelApps(config.channels),
+        workspaceId: config.workspaceId,
+        ontologyUrl: settings.ontologyUrl,
+        fetch: dependencies.fetch,
+    });
     const tokens = new ExpiringCache(now);
     const users = new ExpiringCache(now);
     const loadingUsers = new Map();
@@ -107,17 +116,25 @@ export function createNeonSession(dependencies) {
         // before any configuration is needed. Thrown errors pass through untouched: Next.js signals
         // dynamic rendering with them.
         await cookies();
+        const channelSession = await channelIdentity();
+        if (channelSession) {
+            return channelSession;
+        }
         const result = await neonAuth().getSession();
         if (result.error !== null) {
             if (result.error.status === 401) {
-                return null;
+                return channelIdentity();
+            }
+            const fallback = await channelIdentity();
+            if (fallback) {
+                return fallback;
             }
             throw authUnavailable(result.error);
         }
         const session = result.data?.session;
         const user = result.data?.user;
         if (session === null || session === undefined || user === null || user === undefined) {
-            return null;
+            return channelIdentity();
         }
         return {
             sessionId: session.id,
@@ -126,8 +143,23 @@ export function createNeonSession(dependencies) {
             name: user.name ?? undefined,
         };
     }
+    async function channelIdentity() {
+        const session = await channel.read();
+        return session
+            ? {
+                sessionId: session.user.id,
+                userId: session.user.id,
+                name: session.user.name ?? undefined,
+                email: session.user.email ?? undefined,
+                channel: session,
+            }
+            : null;
+    }
     /** The session's JWT for the ontology service, reused until shortly before it expires. */
     async function sessionToken(session) {
+        if (session.channel) {
+            return session.channel.token;
+        }
         const cached = tokens.get(session.sessionId);
         if (cached !== undefined) {
             return cached;
@@ -135,7 +167,7 @@ export function createNeonSession(dependencies) {
         const result = await neonAuth().token();
         if (result.error !== null) {
             if (result.error.status === 401) {
-                return null;
+                return channel.token();
             }
             throw authUnavailable(result.error);
         }
@@ -171,6 +203,9 @@ export function createNeonSession(dependencies) {
         },
     };
     async function currentUser(session) {
+        if (session.channel) {
+            return session.channel.user;
+        }
         const cached = users.get(session.sessionId);
         if (cached !== undefined) {
             return cached;
@@ -262,6 +297,7 @@ export function createNeonSession(dependencies) {
         return user !== null && isAllowed(permission, user);
     }
     async function signOut(options = {}) {
+        await channel.signOut();
         const session = await identity().catch(() => null);
         if (session !== null) {
             tokens.delete(session.sessionId);
@@ -317,6 +353,10 @@ export function createNeonSession(dependencies) {
             if (publicPaths.some((path) => matchesPathPrefix(pathname, path))) {
                 return NextResponse.next();
             }
+            const channelResponse = await channel.proxy(request);
+            if (channelResponse) {
+                return channelResponse;
+            }
             middleware ??= neonAuth().middleware({ loginUrl: SIGN_IN_PAGE });
             const response = await middleware(request);
             if (!isSignInRedirect(request, response)) {

package/dist/ontology-transport.js

@@ -1,5 +1,4 @@
 import { headers } from "next/headers";
-import { trimTrailingSlashes } from "./config.js";
 import { isLoopbackHostname } from "./cookies.js";
 import { SegmentStreamApiError } from "./errors.js";
 /** Every ontology route lives under this path, beside the app on the same origin. */
@@ -15,6 +14,15 @@ export function createOntologyTransport(options) {
         const requestHeaders = new Headers(init.headers);
         const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
         requestHeaders.set("authorization", `Bearer ${token}`);
+        if (token.startsWith("sso_")) {
+            // Keep the browser's public app-session resource when a local proxy uses another origin.
+            const incoming = await headers();
+            const host = incoming.get("x-forwarded-host") ?? incoming.get("host");
+            if (host) {
+                requestHeaders.set("x-forwarded-host", host);
+                requestHeaders.set("x-forwarded-proto", incoming.get("x-forwarded-proto") ?? "https");
+            }
+        }
         try {
             return await options.fetch(url, {
                 ...init,
@@ -65,12 +73,14 @@ export function createOntologyTransport(options) {
 }
 export async function ontologyOrigin(configured) {
     if (configured !== undefined) {
-        return trimTrailingSlashes(configured);
+        return new URL(configured).origin;
     }
     // Vercel sets Host to the domain the request arrived on, which routes /api/ontology to the service.
     const headerStore = await headers();
-    const host = headerStore.get("host");
-    if (host === null || host === "") {
+    const host = (headerStore.get("x-forwarded-host") ?? headerStore.get("host"))
+        ?.split(",")[0]
+        ?.trim();
+    if (host === undefined || host === "") {
         throw new SegmentStreamApiError({
             code: "ontology_url_unknown",
             status: 500,
@@ -83,7 +93,7 @@ export async function ontologyOrigin(configured) {
         : isLoopbackHostname(hostnameOf(host))
             ? "http"
             : "https";
-    return `${protocol}://${host}`;
+    return new URL(`${protocol}://${host}`).origin;
 }
 function hostnameOf(host) {
     try {

package/dist/proxy.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { trimTrailingSlashes } from "./config.js";
+import { hasChannelApps, trimTrailingSlashes } from "./config.js";
 import { clearSessionCookies, cookiePolicyFor, replaceRequestCookies, safeReturnTo, setSessionCookies, } from "./cookies.js";
 import { SDK_ROUTE_PREFIX, isApiRequest, signInRedirect, unauthenticatedResponse, } from "./sign-in.js";
 export function createProxy(context, options = {}) {
@@ -37,6 +37,9 @@ export function createProxy(context, options = {}) {
             if (verification.status === "valid") {
                 return NextResponse.next();
             }
+            if (verification.status === "unavailable" && hasChannelApps(context.config.channels)) {
+                return sessionUnavailable(context, request, policy);
+            }
         }
         const refreshToken = request.cookies.get(policy.names.refresh)?.value;
         if (refreshToken === undefined || refreshToken === "") {
@@ -83,11 +86,12 @@ export function wellKnownResponse(request, ontologyUrl) {
     return NextResponse.json({ error: "not_found" }, { status: 404 });
 }
 /**
- * SegmentStream is unreachable. API requests get a retryable 503; pages restart sign-in,
- * which ends on the callback's error page rather than looping. Session cookies are kept.
+ * SegmentStream is unreachable. APIs and opted-in channel apps get a retryable 503. Other legacy
+ * pages restart sign-in, which ends on the callback's error page. Channel apps must not exchange a
+ * different identity after failed verification. Session cookies are kept.
  */
 async function sessionUnavailable(context, request, policy) {
-    if (isApiRequest(request)) {
+    if (isApiRequest(request) || hasChannelApps(context.config.channels)) {
         return NextResponse.json({ error: "session_refresh_unavailable" }, { status: 503, headers: { "cache-control": "no-store", "retry-after": "5" } });
     }
     return startSignIn(context, request, policy, false);

package/dist/telegram-launch.d.ts

@@ -0,0 +1,6 @@
+import { type SegmentStreamProxy } from "./proxy.js";
+/**
+ * An unauthenticated Telegram Web iframe cannot visit the unframeable sign-in page. Keep the
+ * protected URL and return only an exchange script; never let the workspace render anonymously.
+ */
+export declare function withTelegramLaunch(proxy: SegmentStreamProxy, channels: Readonly<Record<string, boolean>> | undefined): SegmentStreamProxy;

package/dist/telegram-launch.js

@@ -0,0 +1,98 @@
+import { NextResponse } from "next/server";
+import { CHANNEL_SESSION_PATH, channelSignInPath } from "./channel-protocol.js";
+import { isDecisionPage } from "./decision-pages.js";
+import { randomToken } from "./pkce.js";
+import { matchesPathPrefix } from "./proxy.js";
+import { channelAppFraming } from "./telegram.js";
+/**
+ * An unauthenticated Telegram Web iframe cannot visit the unframeable sign-in page. Keep the
+ * protected URL and return only an exchange script; never let the workspace render anonymously.
+ */
+export function withTelegramLaunch(proxy, channels) {
+    if (channels?.telegram !== true) {
+        return proxy;
+    }
+    return async (request) => {
+        const response = await proxy(request);
+        const pathname = request.nextUrl.pathname;
+        const location = response.headers.get("location");
+        const destination = location === null ? null : URL.parse(location, request.url);
+        if (request.method !== "GET" ||
+            request.headers.get("sec-fetch-dest") !== "iframe" ||
+            request.headers.get("sec-fetch-mode") !== "navigate" ||
+            isDecisionPage(pathname) ||
+            ["/api", "/mcp", "/.well-known", "/_next"].some((path) => matchesPathPrefix(pathname, path)) ||
+            response.status < 300 ||
+            response.status >= 400 ||
+            destination?.origin !== request.nextUrl.origin ||
+            destination.pathname !== "/sign-in") {
+            return response;
+        }
+        const nonce = randomToken();
+        // Only SDK-owned constants enter the script. Launch data stays in the browser until the POST.
+        const script = `
+void (async () => {
+  const state = document.documentElement.dataset;
+  const fail = (code) => {
+    state.channelSignIn = "error";
+    state.channelSignInError = code;
+  };
+  const assertion = new URLSearchParams(location.hash.slice(1)).get("tgWebAppData");
+  if (!assertion) {
+    state.channelSignIn = "idle";
+    return;
+  }
+  state.channelSignIn = "pending";
+  try {
+    // Persist only a digest, scoped to this tab and exact launch, before the one allowed reload.
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(location.href));
+    const reloadKey = "segmentstream:telegram-launch:" + Array.from(new Uint8Array(digest),
+      (byte) => byte.toString(16).padStart(2, "0")).join("");
+    if (sessionStorage.getItem(reloadKey)) {
+      fail("launch_loop");
+      return;
+    }
+    const exchanged = await fetch(${JSON.stringify(channelSignInPath("telegram"))}, {
+      method: "POST",
+      credentials: "same-origin",
+      redirect: "error",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ assertion }),
+    });
+    if (!exchanged.ok) {
+      const body = await exchanged.json();
+      fail(typeof body.error === "string" ? body.error : "sign_in_failed");
+      return;
+    }
+    const discovered = await fetch(${JSON.stringify(CHANNEL_SESSION_PATH)}, {
+      credentials: "same-origin",
+      cache: "no-store",
+      redirect: "error",
+    });
+    const body = discovered.ok ? await discovered.json() : null;
+    if (typeof body?.session?.id !== "string" || typeof body?.user?.id !== "string") {
+      fail("session_unavailable");
+      return;
+    }
+    sessionStorage.setItem(reloadKey, "1");
+    location.reload();
+  } catch {
+    fail("sign_in_unavailable");
+  }
+})();`;
+        const shell = new NextResponse(`<!doctype html><html><head><meta charset="utf-8"></head><body><script nonce="${nonce}">${script}</script></body></html>`, {
+            headers: {
+                "content-type": "text/html; charset=utf-8",
+                "cache-control": "no-store",
+                "referrer-policy": "no-referrer",
+                "x-content-type-options": "nosniff",
+                "content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors ${channelAppFraming(channels)}`,
+            },
+        });
+        // Preserve stale-session clearing without carrying redirect or middleware bypass headers.
+        for (const cookie of response.headers.getSetCookie()) {
+            shell.headers.append("set-cookie", cookie);
+        }
+        return shell;
+    };
+}

package/dist/telegram.d.ts

@@ -0,0 +1,2 @@
+/** Provider-specific embedding policy; decision pages always override this with DENY. */
+export declare function channelAppFraming(channels: Readonly<Record<string, boolean>> | undefined): string | undefined;

package/dist/telegram.js

@@ -0,0 +1,6 @@
+/** Provider-specific embedding policy; decision pages always override this with DENY. */
+export function channelAppFraming(channels) {
+    return channels?.telegram === true
+        ? "'self' https://web.telegram.org https://*.web.telegram.org"
+        : undefined;
+}

package/dist/ui/components.d.ts

@@ -17,7 +17,7 @@ export interface CanProps extends ChildrenProps {
  * ontology service checks every read and action itself.
  */
 export declare function Can({ permission, children, fallback }: CanProps): ReactNode;
-/** Ends the Neon Auth session in this browser, then opens `redirectTo`. */
+/** Ends the selected session in this browser, then opens `redirectTo`. */
 export declare function signOut(redirectTo?: string): Promise<void>;
 export interface UserMenuProps {
     /** Where to go after signing out. Defaults to `/sign-in`. */

package/dist/ui/components.js

@@ -4,7 +4,7 @@ import { useState } from "react";
 import { safeReturnTo } from "../return-to.js";
 import { usePermissions, useSession, useUser } from "./hooks.js";
 import { navigate } from "./navigation.js";
-import { SIGN_IN_PAGE, authClient, clearSession } from "./store.js";
+import { SIGN_IN_PAGE, endBrowserSession, clearSession, getSnapshot } from "./store.js";
 /** Renders its children when a Neon Auth session exists in this browser. */
 export function SignedIn({ children }) {
     return useSession().status === "signed-in" ? children : null;
@@ -24,10 +24,17 @@ export function Can({ permission, children, fallback = null }) {
     }
     return can(permission) ? children : fallback;
 }
-/** Ends the Neon Auth session in this browser, then opens `redirectTo`. */
+/** Ends the selected session in this browser, then opens `redirectTo`. */
 export async function signOut(redirectTo = SIGN_IN_PAGE) {
+    const session = getSnapshot().session;
+    if (session.status === "signed-in" && session.source === "channel") {
+        await endBrowserSession();
+        clearSession();
+        navigate(safeReturnTo(redirectTo));
+        return;
+    }
     try {
-        await authClient().signOut();
+        await endBrowserSession();
     }
     finally {
         clearSession();

package/dist/ui/hooks.js

@@ -27,9 +27,9 @@ export function useUser() {
     const sessionId = session.status === "signed-in" ? session.sessionId : null;
     useEffect(() => {
         if (sessionId !== null) {
-            ensureUser(sessionId);
+            ensureUser(sessionId, session.status === "signed-in" ? session.source : undefined);
         }
-    }, [sessionId]);
+    }, [sessionId, session]);
     switch (session.status) {
         case "loading":
             return LOADING_USER;

package/dist/ui/index.d.ts

@@ -5,6 +5,8 @@ export type { AgentConnectProps } from "./agent-connect.js";
 export { usePermissions, useSession, useUser } from "./hooks.js";
 export type { Permissions } from "./hooks.js";
 export { SignIn } from "./sign-in.js";
+export { TelegramSignIn, useTelegramSignIn } from "./telegram-sign-in.js";
+export type { TelegramSignInProps, TelegramSignInOptions } from "./telegram-sign-in.js";
 export type { SignInProps } from "./sign-in.js";
 export { SIGN_IN_ERROR_MESSAGES, signInErrorCode, signInErrorMessage, useSignIn, } from "./use-sign-in.js";
 export type { SignInController, SignInErrorCode, SignInNoticeCode, SignInOptions, } from "./use-sign-in.js";
@@ -14,3 +16,5 @@ export type { CurrentUser } from "../me.js";
 export type { AgentPairing } from "../agent.js";
 export { SegmentStreamApiError, NOT_INVITED, SIGN_IN_LINK_INVALID } from "../errors.js";
 export { SegmentStreamLogo } from "./segmentstream-logo.js";
+export { useChannelSignIn } from "./use-channel-sign-in.js";
+export type { ChannelSignInState, ChannelSignInOptions } from "./use-channel-sign-in.js";

package/dist/ui/index.js

@@ -6,7 +6,9 @@ export { Can, SignedIn, SignedOut, UserMenu, signOut } from "./components.js";
 export { AgentConnect } from "./agent-connect.js";
 export { usePermissions, useSession, useUser } from "./hooks.js";
 export { SignIn } from "./sign-in.js";
+export { TelegramSignIn, useTelegramSignIn } from "./telegram-sign-in.js";
 export { SIGN_IN_ERROR_MESSAGES, signInErrorCode, signInErrorMessage, useSignIn, } from "./use-sign-in.js";
 export { isAllowed } from "../permissions.js";
 export { SegmentStreamApiError, NOT_INVITED, SIGN_IN_LINK_INVALID } from "../errors.js";
 export { SegmentStreamLogo } from "./segmentstream-logo.js";
+export { useChannelSignIn } from "./use-channel-sign-in.js";