@segmentstream-cloud/app 0.2.0 → 0.3.0

package/dist/ontology.d.ts

@@ -0,0 +1,217 @@
+/**
+ * The typed client for the app's ontology service, `/api/ontology`. The app imports its ontology as
+ * types only (`import type ontology from "../../ontology"`) and passes `typeof ontology` to
+ * `createSegmentStreamApp`; entity records, action inputs and action results are read from the
+ * ontology SDK's `Ontology`, `Entity` and `Action` types. The types are read structurally, so the
+ * app needs neither the ontology SDK nor Effect at runtime, and `app/` and `ontology/` may install
+ * their own copies.
+ */
+/** JSON as the ontology service sends and accepts it. */
+export type JsonValue = string | number | boolean | null | ReadonlyArray<JsonValue> | {
+    readonly [key: string]: JsonValue;
+};
+/** A record of an entity the client has no types for. */
+export type JsonRecord = {
+    readonly [field: string]: JsonValue;
+};
+/**
+ * Conditions on one field; all of them must hold. `contains` and `startsWith` ignore case;
+ * `between` includes both ends. In a `where`, a bare value stands for `{ eq: value }`.
+ */
+export interface FieldFilter {
+    readonly eq?: JsonValue;
+    readonly ne?: JsonValue;
+    readonly in?: ReadonlyArray<JsonValue>;
+    readonly isNull?: boolean;
+    readonly contains?: string;
+    readonly startsWith?: string;
+    readonly gt?: number | string;
+    readonly gte?: number | string;
+    readonly lt?: number | string;
+    readonly lte?: number | string;
+    readonly between?: readonly [number | string, number | string];
+}
+/** A filter on a to-many relationship: some, none or every related record matches. */
+export interface ManyFilter {
+    readonly some?: Where;
+    readonly none?: Where;
+    readonly every?: Where;
+}
+/** Conditions on a record by field or relationship name, with `and`, `or` and `not`. */
+export interface Where {
+    readonly and?: ReadonlyArray<Where>;
+    readonly or?: ReadonlyArray<Where>;
+    readonly not?: Where;
+    readonly [field: string]: FieldFilter | ManyFilter | Where | ReadonlyArray<Where> | JsonValue | undefined;
+}
+export interface OrderBy<Field extends string = string> {
+    readonly field: Field;
+    readonly direction?: "asc" | "desc";
+}
+/** A query: the same language for `find` (as URL parameters) and `query` (as a JSON body). */
+export interface OntologyQuery<Row = JsonRecord> {
+    readonly where?: Where;
+    readonly orderBy?: ReadonlyArray<OrderBy<keyof Row & string>>;
+    /** Related records to add to each record, by relationship name. */
+    readonly include?: {
+        readonly [relationship: string]: true;
+    };
+    /** The `nextCursor` of the previous page. */
+    readonly after?: string;
+    /** Records per page, 50 by default and at most 200. */
+    readonly limit?: number;
+}
+/** A page of records. `nextCursor` is `null` on the last page. */
+export interface OntologyPage<Row> {
+    readonly items: ReadonlyArray<Row>;
+    readonly nextCursor: string | null;
+}
+export type EditKind = "create" | "update" | "delete" | "link" | "unlink";
+export interface Change {
+    readonly before: JsonValue;
+    readonly after: JsonValue;
+}
+/** What one action changed on one record. */
+export interface Edit {
+    readonly entity: string;
+    readonly id: string;
+    readonly kind: EditKind;
+    readonly changes: {
+        readonly [field: string]: Change;
+    };
+}
+export interface HistoryEntry {
+    readonly id: string;
+    readonly recordId: string;
+    /** The qualified action, for example `lead.changeStatus`. */
+    readonly action: string;
+    /** Shared by every entry one run of an action wrote. */
+    readonly actionId: string;
+    readonly kind: EditKind;
+    /** The user who ran the action; `null` when the platform wrote. */
+    readonly principalId: string | null;
+    readonly at: string;
+    readonly changes: {
+        readonly [field: string]: Change;
+    };
+}
+export interface HistoryPage {
+    readonly items: ReadonlyArray<HistoryEntry>;
+    readonly nextCursor: string | null;
+}
+export interface ValidationIssue {
+    readonly path: ReadonlyArray<string | number>;
+    readonly message: string;
+}
+/** `POST /api/ontology/<entity>/actions/<action>` answers `{ result, validation, edits }`. */
+export interface ActionResponse<Result = unknown> {
+    /** What the action returned; `null` under `validateOnly` and for actions without a result. */
+    readonly result: Result | null;
+    readonly validation: {
+        readonly ok: boolean;
+        readonly issues: ReadonlyArray<ValidationIssue>;
+    };
+    /** The records the action changed, as their history records each change. */
+    readonly edits: ReadonlyArray<Edit>;
+}
+export interface RequestOptions {
+    readonly signal?: AbortSignal;
+}
+export interface ActionOptions extends RequestOptions {
+    /** Validate the input and report issues in `validation` without a write. */
+    readonly validateOnly?: boolean;
+}
+export interface HistoryOptions extends RequestOptions {
+    readonly after?: string;
+    /** Entries per page, at most 200. */
+    readonly limit?: number;
+}
+/** Runs one action: `lead.actions.changeStatus({ lead, status }, { validateOnly })`. */
+export type ActionCall<Input, Result> = (input: Input, options?: ActionOptions) => Promise<ActionResponse<Result>>;
+/** The generated actions every entity has; their inputs are not typed by the client. */
+export interface GeneratedActions {
+    readonly create: ActionCall<JsonRecord, JsonValue>;
+    readonly update: ActionCall<{
+        readonly id: string;
+    } & JsonRecord, JsonValue>;
+    readonly delete: ActionCall<{
+        readonly id: string;
+    }, JsonValue>;
+}
+export interface EntityClient<Row, Actions> {
+    /** `GET /api/ontology/<entity>`: filter, sort and page through records. */
+    readonly find: (query?: OntologyQuery<Row>, options?: RequestOptions) => Promise<OntologyPage<Row>>;
+    /** `POST /api/ontology/<entity>/query`: the same query as a JSON body. */
+    readonly query: (query?: OntologyQuery<Row>, options?: RequestOptions) => Promise<OntologyPage<Row>>;
+    /** `GET /api/ontology/<entity>/<id>`. */
+    readonly get: (id: string, options?: RequestOptions) => Promise<Row>;
+    /** `GET /api/ontology/<entity>/<id>/history`: what each action changed, newest first. */
+    readonly history: (id: string, options?: HistoryOptions) => Promise<HistoryPage>;
+    /** The entity's actions by name, authored and generated. */
+    readonly actions: Actions & GeneratedActions;
+    /** Any action by name, for generated actions such as `upsertByEmail`, `link` and `unlink`. */
+    readonly action: (name: string, input: JsonRecord, options?: ActionOptions) => Promise<ActionResponse<JsonValue>>;
+}
+type EntitiesOf<O> = O extends {
+    readonly config: {
+        readonly entities: ReadonlyArray<infer E>;
+    };
+} ? E : never;
+type NameOf<E> = E extends {
+    readonly name: infer N extends string;
+} ? N : never;
+type RecordOf<E> = E extends {
+    readonly Type: infer T;
+} ? T : JsonRecord;
+type ActionsOf<E> = E extends {
+    readonly actions: infer A;
+} ? A : never;
+type InputOf<A> = A extends {
+    readonly input: {
+        readonly Encoded: infer I;
+    };
+} ? I : JsonRecord;
+/** An Effect yields its success when iterated, as `yield*` in `Effect.gen` does. */
+type SuccessOf<F> = F extends {
+    [Symbol.iterator](): {
+        next(...args: ReadonlyArray<any>): IteratorResult<unknown, infer R>;
+    };
+} ? R : unknown;
+/** Actions without a result answer `result: null`. */
+type JsonResult<R> = [R] extends [void] ? null : R;
+type ResultOf<A> = A extends {
+    handler(context: never): infer F;
+} ? JsonResult<SuccessOf<F>> : unknown;
+type ActionClients<A> = {
+    readonly [K in keyof A & string]: ActionCall<InputOf<A[K]>, ResultOf<A[K]>>;
+};
+type TypedOntologyClient<O> = {
+    readonly [N in NameOf<EntitiesOf<O>>]: EntityClient<RecordOf<Extract<EntitiesOf<O>, {
+        readonly name: N;
+    }>>, ActionClients<ActionsOf<Extract<EntitiesOf<O>, {
+        readonly name: N;
+    }>>>>;
+};
+/** A client for any entity, when the app passes no ontology type. */
+export type UntypedOntologyClient = {
+    readonly [entity: string]: EntityClient<JsonRecord, {
+        readonly [action: string]: ActionCall<JsonRecord, JsonValue>;
+    }>;
+};
+/**
+ * `segmentstream.ontology`: one client per entity of `O`, the type of the app's ontology
+ * (`typeof ontology`). Without it, any entity name is accepted and records are untyped.
+ */
+export type OntologyClient<O = unknown> = unknown extends O ? UntypedOntologyClient : TypedOntologyClient<O>;
+/** Sends one ontology request with the caller's credentials. Paths are below `/api/ontology`. */
+export interface OntologyTransport {
+    readonly fetch: (path: string, init: RequestInit) => Promise<Response>;
+}
+/**
+ * Entities and actions exist only in the app's types, so the client resolves them by name when
+ * they are used: `ontology.lead.actions.changeStatus(…)` posts to `lead/actions/changeStatus`.
+ */
+export declare function createOntologyClient<O>(transport: OntologyTransport): OntologyClient<O>;
+/** `find` sends the query as URL parameters: `where` as JSON, `orderBy` as `field:direction`. */
+export declare function findParameters(query: OntologyQuery<JsonRecord>): URLSearchParams;
+export {};

package/dist/ontology.js

@@ -0,0 +1,141 @@
+import { SegmentStreamApiError, apiErrorFrom, readJson } from "./errors.js";
+const ENTITY_NAME = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/;
+const ACTION_NAME = /^[a-z][a-zA-Z0-9]*$/;
+/** Names a caller may probe on any object; never an entity or an action. */
+const RESERVED = new Set([
+    "then",
+    "catch",
+    "finally",
+    "constructor",
+    "toString",
+    "toLocaleString",
+    "valueOf",
+    "hasOwnProperty",
+    "isPrototypeOf",
+    "propertyIsEnumerable",
+    "inspect",
+]);
+/**
+ * Entities and actions exist only in the app's types, so the client resolves them by name when
+ * they are used: `ontology.lead.actions.changeStatus(…)` posts to `lead/actions/changeStatus`.
+ */
+export function createOntologyClient(transport) {
+    const entities = new Map();
+    return new Proxy(Object.create(null), {
+        get(_target, property) {
+            if (typeof property !== "string" || RESERVED.has(property) || !ENTITY_NAME.test(property)) {
+                return undefined;
+            }
+            let client = entities.get(property);
+            if (client === undefined) {
+                client = entityClient(property, transport);
+                entities.set(property, client);
+            }
+            return client;
+        },
+    });
+}
+function entityClient(entity, transport) {
+    const base = `/${entity}`;
+    const actionCalls = new Map();
+    const runAction = (name, input, options = {}) => send(transport, "POST", `${base}/actions/${encodeURIComponent(name)}`, {
+        input,
+        ...(options.validateOnly === undefined
+            ? {}
+            : { options: { validateOnly: options.validateOnly } }),
+    }, options.signal);
+    const actions = new Proxy(Object.create(null), {
+        get(_target, property) {
+            if (typeof property !== "string" || RESERVED.has(property) || !ACTION_NAME.test(property)) {
+                return undefined;
+            }
+            let call = actionCalls.get(property);
+            if (call === undefined) {
+                call = (input, options) => runAction(property, input, options);
+                actionCalls.set(property, call);
+            }
+            return call;
+        },
+    });
+    return {
+        find: (query = {}, options = {}) => {
+            const search = findParameters(query).toString();
+            return send(transport, "GET", search === "" ? base : `${base}?${search}`, undefined, options.signal);
+        },
+        query: (query = {}, options = {}) => send(transport, "POST", `${base}/query`, query, options.signal),
+        get: (id, options = {}) => send(transport, "GET", `${base}/${recordId(id)}`, undefined, options.signal),
+        history: (id, options = {}) => {
+            const search = new URLSearchParams();
+            if (options.after !== undefined) {
+                search.set("after", options.after);
+            }
+            if (options.limit !== undefined) {
+                search.set("limit", String(options.limit));
+            }
+            const encoded = search.toString();
+            const suffix = encoded === "" ? "" : `?${encoded}`;
+            return send(transport, "GET", `${base}/${recordId(id)}/history${suffix}`, undefined, options.signal);
+        },
+        actions,
+        action: (name, input, options) => {
+            if (!ACTION_NAME.test(name)) {
+                throw new TypeError(`"${name}" is not an action name.`);
+            }
+            return runAction(name, input, options);
+        },
+    };
+}
+function recordId(id) {
+    if (typeof id !== "string" || id === "") {
+        throw new TypeError("A record id is a non-empty string.");
+    }
+    return encodeURIComponent(id);
+}
+/** `find` sends the query as URL parameters: `where` as JSON, `orderBy` as `field:direction`. */
+export function findParameters(query) {
+    const search = new URLSearchParams();
+    if (query.where !== undefined) {
+        search.set("where", JSON.stringify(query.where));
+    }
+    if (query.orderBy !== undefined && query.orderBy.length > 0) {
+        search.set("orderBy", query.orderBy.map(({ field, direction }) => `${field}:${direction ?? "asc"}`).join(","));
+    }
+    if (query.include !== undefined) {
+        const relationships = Object.keys(query.include).filter((name) => query.include?.[name] === true);
+        if (relationships.length > 0) {
+            search.set("include", relationships.join(","));
+        }
+    }
+    if (query.after !== undefined) {
+        search.set("after", query.after);
+    }
+    if (query.limit !== undefined) {
+        search.set("limit", String(query.limit));
+    }
+    return search;
+}
+async function send(transport, method, path, body, signal) {
+    const headers = new Headers({ accept: "application/json" });
+    if (body !== undefined) {
+        headers.set("content-type", "application/json");
+    }
+    const response = await transport.fetch(path, {
+        method,
+        headers,
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        ...(signal === undefined ? {} : { signal }),
+    });
+    const payload = await readJson(response);
+    if (!response.ok) {
+        throw apiErrorFrom(response.status, payload, "The ontology service rejected the request.");
+    }
+    if (payload === null) {
+        throw new SegmentStreamApiError({
+            code: "ontology_invalid_response",
+            status: 502,
+            detail: "The ontology service answered without a JSON body.",
+            retryable: true,
+        });
+    }
+    return payload;
+}

package/dist/permissions.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Permissions are `<entity>:<verb>` strings, such as `lead:changeStatus`. A role may use `*` for the
+ * entity (`*:read`), the verb (`lead:*`) or both (`*:*`); what an action or a read requires never
+ * holds a wildcard.
+ *
+ * The matching rule is the ontology service's, copied from `@segmentstream-cloud/ontology`
+ * (`src/permissions.ts`) so that the app SDK and its browser components do not depend on the
+ * ontology runtime. Keep the two in step.
+ */
+/** Whether a granted permission, which may hold wildcards, covers the required one. */
+export declare function grants(granted: string, required: string): boolean;
+/** Anything that holds permissions, such as the signed-in user. */
+export interface PermissionHolder {
+    readonly permissions: ReadonlyArray<string>;
+}
+/** Whether one of the holder's permissions equals `required` or covers it through a wildcard. */
+export declare function isAllowed(required: string, holder: PermissionHolder): boolean;

package/dist/permissions.js

@@ -0,0 +1,33 @@
+/**
+ * Permissions are `<entity>:<verb>` strings, such as `lead:changeStatus`. A role may use `*` for the
+ * entity (`*:read`), the verb (`lead:*`) or both (`*:*`); what an action or a read requires never
+ * holds a wildcard.
+ *
+ * The matching rule is the ontology service's, copied from `@segmentstream-cloud/ontology`
+ * (`src/permissions.ts`) so that the app SDK and its browser components do not depend on the
+ * ontology runtime. Keep the two in step.
+ */
+const WILDCARD = "*";
+/** `<entity>:<verb>` with lowercase snake_case entities and lower camelCase verbs, or `*` for either. */
+const PERMISSION = /^(\*|[a-z][a-z0-9]*(?:_[a-z0-9]+)*):(\*|[a-z][a-zA-Z0-9]*)$/;
+function parsePermission(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const match = PERMISSION.exec(value);
+    return match === null ? undefined : { entity: match[1], verb: match[2] };
+}
+/** Whether a granted permission, which may hold wildcards, covers the required one. */
+export function grants(granted, required) {
+    const held = parsePermission(granted);
+    const wanted = parsePermission(required);
+    if (held === undefined || wanted === undefined) {
+        return false;
+    }
+    return ((held.entity === WILDCARD || held.entity === wanted.entity) &&
+        (held.verb === WILDCARD || held.verb === wanted.verb));
+}
+/** Whether one of the holder's permissions equals `required` or covers it through a wildcard. */
+export function isAllowed(required, holder) {
+    return holder.permissions.some((granted) => grants(granted, required));
+}

package/dist/proxy.d.ts

@@ -11,3 +11,5 @@ export interface ProxyOptions {
 }
 export type SegmentStreamProxy = (request: NextRequest) => Promise<NextResponse>;
 export declare function createProxy(context: AppContext, options?: ProxyOptions): SegmentStreamProxy;
+export declare function normalizePublicPath(path: string): string;
+export declare function matchesPathPrefix(pathname: string, prefix: string): boolean;

package/dist/proxy.js

@@ -4,13 +4,29 @@ import { clearSessionCookies, cookiePolicyFor, replaceRequestCookies, safeReturn
 import { SDK_ROUTE_PREFIX, isApiRequest, signInRedirect, unauthenticatedResponse, } from "./sign-in.js";
 export function createProxy(context, options = {}) {
     const publicPaths = (options.publicPaths ?? []).map(normalizePublicPath);
+    const refreshes = new Map();
+    /**
+     * A page load and the prefetches it triggers arrive together with the same expired
+     * session. They share one refresh instead of each spending the refresh token.
+     */
+    function refreshSession(refreshToken) {
+        const pending = refreshes.get(refreshToken);
+        if (pending !== undefined) {
+            return pending;
+        }
+        const exchange = context
+            .requestToken({ grantType: "refresh_token", refreshToken })
+            .finally(() => refreshes.delete(refreshToken));
+        refreshes.set(refreshToken, exchange);
+        return exchange;
+    }
     return async function proxy(request) {
         const pathname = request.nextUrl.pathname;
         if (matchesPathPrefix(pathname, SDK_ROUTE_PREFIX) ||
             publicPaths.some((path) => matchesPathPrefix(pathname, path))) {
             return NextResponse.next();
         }
-        const policy = cookiePolicyFor(request.nextUrl);
+        const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
         const accessToken = request.cookies.get(policy.names.session)?.value;
         if (accessToken !== undefined && accessToken !== "") {
             const verification = await context.verifyToken(accessToken);
@@ -20,14 +36,14 @@ export function createProxy(context, options = {}) {
         }
         const refreshToken = request.cookies.get(policy.names.refresh)?.value;
         if (refreshToken === undefined || refreshToken === "") {
-            return startSignIn(context, request, accessToken !== undefined);
+            return startSignIn(context, request, policy, accessToken !== undefined);
         }
-        const exchange = await context.requestToken({ grantType: "refresh_token", refreshToken });
+        const exchange = await refreshSession(refreshToken);
         if (exchange.status === "rejected") {
-            return startSignIn(context, request, true);
+            return startSignIn(context, request, policy, true);
         }
         if (exchange.status === "unavailable") {
-            return sessionUnavailable(context, request);
+            return sessionUnavailable(context, request, policy);
         }
         const verification = await context.verifyToken(exchange.tokens.accessToken);
         if (verification.status === "valid") {
@@ -35,28 +51,28 @@ export function createProxy(context, options = {}) {
         }
         if (verification.status === "unavailable") {
             // The refresh token was rotated; keep the new one even though this request cannot proceed.
-            const response = await sessionUnavailable(context, request);
+            const response = await sessionUnavailable(context, request, policy);
             setSessionCookies(response, policy, exchange.tokens);
             return response;
         }
-        return startSignIn(context, request, true);
+        return startSignIn(context, request, policy, true);
     };
 }
 /**
  * SegmentStream is unreachable. API requests get a retryable 503; pages restart sign-in,
  * which ends on the callback's error page rather than looping. Session cookies are kept.
  */
-async function sessionUnavailable(context, request) {
+async function sessionUnavailable(context, request, policy) {
     if (isApiRequest(request)) {
         return NextResponse.json({ error: "session_refresh_unavailable" }, { status: 503, headers: { "cache-control": "no-store", "retry-after": "5" } });
     }
-    return startSignIn(context, request, false);
+    return startSignIn(context, request, policy, false);
 }
-async function startSignIn(context, request, clearSession) {
+async function startSignIn(context, request, policy, clearSession) {
     if (isApiRequest(request)) {
         const response = unauthenticatedResponse();
         if (clearSession) {
-            clearSessionCookies(response, cookiePolicyFor(request.nextUrl));
+            clearSessionCookies(response, policy);
         }
         return response;
     }
@@ -78,12 +94,12 @@ function continueWithSession(request, policy, tokens) {
     setSessionCookies(response, policy, tokens);
     return response;
 }
-function normalizePublicPath(path) {
+export function normalizePublicPath(path) {
     const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
     const trimmed = trimTrailingSlashes(withLeadingSlash);
     return trimmed === "" ? "/" : trimmed;
 }
-function matchesPathPrefix(pathname, prefix) {
+export function matchesPathPrefix(pathname, prefix) {
     if (prefix === "/") {
         return true;
     }

package/dist/return-to.d.ts

@@ -0,0 +1,2 @@
+/** Reduces a return path to a same-origin relative path, falling back to `/`. */
+export declare function safeReturnTo(value: string | null | undefined): string;

package/dist/return-to.js

@@ -0,0 +1,24 @@
+/** Reduces a return path to a same-origin relative path, falling back to `/`. */
+export function safeReturnTo(value) {
+    if (typeof value !== "string" ||
+        !value.startsWith("/") ||
+        value.startsWith("//") ||
+        value.startsWith("/\\")) {
+        return "/";
+    }
+    if (/[\u0000-\u001f\u007f]/.test(value)) {
+        return "/";
+    }
+    const placeholderOrigin = "https://return-to.invalid";
+    let url;
+    try {
+        url = new URL(value, placeholderOrigin);
+    }
+    catch {
+        return "/";
+    }
+    if (url.origin !== placeholderOrigin) {
+        return "/";
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+}

package/dist/server.d.ts

@@ -4,5 +4,8 @@ export interface ServerSession {
     readonly getUser: () => Promise<AppUser | null>;
     readonly requireUser: () => Promise<AppUser>;
     readonly getAccessToken: () => Promise<string | null>;
+    readonly signOut: (options?: {
+        readonly redirectTo?: string;
+    }) => Promise<never>;
 }
 export declare function createServerSession(context: AppContext): ServerSession;

package/dist/server.js

@@ -1,13 +1,13 @@
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
-import { sessionCookieCandidates } from "./cookies.js";
-import { SIGN_IN_PATH } from "./sign-in.js";
+import { cookiePolicyFor, isLoopbackHostname, safeReturnTo, sessionCookieCandidates, } from "./cookies.js";
+import { SIGNED_OUT_PATH, SIGN_IN_PATH } from "./sign-in.js";
 export function createServerSession(context) {
     async function verifiedSession() {
         const cookieStore = await cookies();
         const headerStore = await headers();
         const hostname = hostnameOf(headerStore.get("host"));
-        for (const name of sessionCookieCandidates(hostname)) {
+        for (const name of sessionCookieCandidates(hostname, context.config.workspaceId)) {
             const token = cookieStore.get(name)?.value;
             if (token === undefined || token === "") {
                 continue;
@@ -21,7 +21,8 @@ export function createServerSession(context) {
     }
     async function getUser() {
         const session = await verifiedSession();
-        return session?.user ?? null;
+        // Ontology roles come with Neon Auth; the legacy sign-in has none.
+        return session === null ? null : { ...session.user, roles: [], permissions: [] };
     }
     async function requireUser() {
         const user = await getUser();
@@ -35,7 +36,36 @@ export function createServerSession(context) {
         const session = await verifiedSession();
         return session?.token ?? null;
     }
-    return { getUser, requireUser, getAccessToken };
+    /** Revokes the app session and clears its cookies, as `POST /api/segmentstream/sign-out` does. */
+    async function signOut(options = {}) {
+        const cookieStore = await cookies();
+        const hostname = hostnameOf((await headers()).get("host"));
+        const policies = [
+            cookiePolicyFor(new URL("https://app.invalid"), context.config.workspaceId),
+            ...(isLoopbackHostname(hostname)
+                ? [cookiePolicyFor(new URL("http://localhost"), context.config.workspaceId)]
+                : []),
+        ];
+        for (const policy of policies) {
+            const refreshToken = cookieStore.get(policy.names.refresh)?.value;
+            if (refreshToken !== undefined && refreshToken !== "") {
+                await context.revokeSession(refreshToken);
+            }
+            for (const name of [policy.names.session, policy.names.refresh]) {
+                // `__Host-` cookies are only replaced when the clearing cookie repeats Secure and Path=/.
+                cookieStore.set(name, "", {
+                    httpOnly: true,
+                    secure: policy.secure,
+                    sameSite: "lax",
+                    path: "/",
+                    maxAge: 0,
+                    expires: new Date(0),
+                });
+            }
+        }
+        redirect(safeReturnTo(options.redirectTo ?? SIGNED_OUT_PATH));
+    }
+    return { getUser, requireUser, getAccessToken, signOut };
 }
 function hostnameOf(host) {
     if (host === null || host === "") {

package/dist/sign-in.d.ts

@@ -17,7 +17,11 @@ export interface SignInRedirectInput {
     readonly returnTo: string;
     readonly clearSession: boolean;
 }
-/** Starts the authorization-code flow with PKCE by redirecting to SegmentStream. */
+/**
+ * Starts the authorization-code flow with PKCE by redirecting to SegmentStream. Each
+ * sign-in keeps its flow in a cookie named after its `state`, so tabs that start
+ * signing in at the same time do not overwrite each other.
+ */
 export declare function signInRedirect(input: SignInRedirectInput): Promise<NextResponse>;
 export interface AuthorizationUrlInput {
     readonly config: ResolvedConfig;