@segmentstream-cloud/app 0.2.0 → 0.3.0

package/dist/sign-in.js

@@ -1,10 +1,12 @@
 import { NextResponse } from "next/server";
-import { clearSessionCookies, cookiePolicyFor, setAuthFlowCookie } from "./cookies.js";
+import { MAX_PENDING_AUTH_FLOWS, clearCookie, clearSessionCookies, cookiePolicyFor, pendingAuthFlowCookies, setAuthFlowCookie, } from "./cookies.js";
 import { createCodeChallenge, randomToken } from "./pkce.js";
 export const SDK_ROUTE_PREFIX = "/api/segmentstream";
 export const CALLBACK_PATH = `${SDK_ROUTE_PREFIX}/callback`;
 export const SIGN_IN_PATH = `${SDK_ROUTE_PREFIX}/sign-in`;
 export const SIGNED_OUT_PATH = `${SDK_ROUTE_PREFIX}/signed-out`;
+/** Longer return paths are dropped so several pending sign-ins still fit in request headers. */
+const MAX_RETURN_TO_LENGTH = 1024;
 /**
  * Requests that cannot follow a cross-origin sign-in redirect: anything other than a
  * top-level page navigation. They receive a 401 instead of a redirect.
@@ -27,17 +29,28 @@ export function isApiRequest(request) {
 export function unauthenticatedResponse() {
     return NextResponse.json({ error: "unauthenticated" }, { status: 401, headers: { "cache-control": "no-store" } });
 }
-/** Starts the authorization-code flow with PKCE by redirecting to SegmentStream. */
+/**
+ * Starts the authorization-code flow with PKCE by redirecting to SegmentStream. Each
+ * sign-in keeps its flow in a cookie named after its `state`, so tabs that start
+ * signing in at the same time do not overwrite each other.
+ */
 export async function signInRedirect(input) {
-    const { config, request, returnTo, clearSession } = input;
-    const policy = cookiePolicyFor(request.nextUrl);
+    const { config, request, clearSession } = input;
+    const policy = cookiePolicyFor(request.nextUrl, config.workspaceId);
     const state = randomToken();
     const codeVerifier = randomToken();
     const codeChallenge = await createCodeChallenge(codeVerifier);
     const redirectUri = `${request.nextUrl.origin}${CALLBACK_PATH}`;
+    const returnTo = input.returnTo.length <= MAX_RETURN_TO_LENGTH ? input.returnTo : "/";
     const authorizeUrl = authorizationUrl({ config, redirectUri, state, codeChallenge });
     const response = NextResponse.redirect(authorizeUrl, 307);
+    const pending = pendingAuthFlowCookies(policy, request.cookies.getAll().map((cookie) => cookie.name));
     response.headers.set("cache-control", "no-store");
+    if (pending.length >= MAX_PENDING_AUTH_FLOWS) {
+        for (const name of pending) {
+            clearCookie(response, policy, name);
+        }
+    }
     setAuthFlowCookie(response, policy, { state, codeVerifier, redirectUri, returnTo });
     if (clearSession) {
         clearSessionCookies(response, policy);

package/dist/tokens.d.ts

@@ -1,17 +1,36 @@
 import type { JWTVerifyGetKey } from "jose";
 import type { ResolvedConfig } from "./config.js";
-/** The signed-in SegmentStream user, as asserted by the app session token. */
-export interface AppUser {
+/** The SegmentStream member a legacy app session token names. */
+export interface TokenUser {
     readonly id: string;
     readonly email?: string;
     readonly name?: string;
     readonly organizationId: string;
     readonly workspaceId: string;
 }
+/**
+ * The signed-in user. With Neon Auth, the person's ontology `user` record with the roles and
+ * permissions from `GET /api/ontology/me`; with the legacy SegmentStream sign-in, the member the app
+ * session token names, without ontology roles.
+ */
+export interface AppUser extends TokenUser {
+    /** Neon Auth: the ontology `user` record's id. Legacy sign-in: the SegmentStream user id. */
+    readonly id: string;
+    /** The ontology roles the user holds, such as `sales`. Empty under the legacy sign-in. */
+    readonly roles: ReadonlyArray<string>;
+    /** The permissions the roles grant, wildcards included. Empty under the legacy sign-in. */
+    readonly permissions: ReadonlyArray<string>;
+    /** Neon Auth: the ontology user's kind, `member` for people. */
+    readonly kind?: string;
+    /** Neon Auth: whether the ontology user is active. */
+    readonly active?: boolean;
+    /** Neon Auth: the person's Neon Auth user id, the session JWT's `sub`. */
+    readonly authUserId?: string;
+}
 export type KeySet = JWTVerifyGetKey;
 export interface VerifiedToken {
     readonly status: "valid";
-    readonly user: AppUser;
+    readonly user: TokenUser;
     readonly token: string;
 }
 export type TokenVerification = VerifiedToken | {

package/dist/ui/components.d.ts

@@ -0,0 +1,27 @@
+import type { ReactNode } from "react";
+export interface ChildrenProps {
+    readonly children?: ReactNode;
+}
+/** Renders its children when a Neon Auth session exists in this browser. */
+export declare function SignedIn({ children }: ChildrenProps): ReactNode;
+/** Renders its children when nobody is signed in. */
+export declare function SignedOut({ children }: ChildrenProps): ReactNode;
+export interface CanProps extends ChildrenProps {
+    /** A permission such as `lead:changeStatus`. The user's wildcards (`lead:*`, `*:*`) count. */
+    readonly permission: string;
+    /** Rendered when the user lacks the permission. Nothing renders while permissions load. */
+    readonly fallback?: ReactNode;
+}
+/**
+ * Renders its children when the signed-in user holds the permission. It only hides controls: the
+ * ontology service checks every read and action itself.
+ */
+export declare function Can({ permission, children, fallback }: CanProps): ReactNode;
+/** Ends the Neon Auth session in this browser, then opens `redirectTo`. */
+export declare function signOut(redirectTo?: string): Promise<void>;
+export interface UserMenuProps {
+    /** Where to go after signing out. Defaults to `/sign-in`. */
+    readonly signedOutPath?: string;
+}
+/** The signed-in user's name, email and roles, and a sign-out button. */
+export declare function UserMenu({ signedOutPath }: UserMenuProps): import("react").JSX.Element | null;

package/dist/ui/components.js

@@ -0,0 +1,63 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from "react";
+import { safeReturnTo } from "../return-to.js";
+import { usePermissions, useSession, useUser } from "./hooks.js";
+import { navigate } from "./navigation.js";
+import { SIGN_IN_PAGE, authClient, clearSession } from "./store.js";
+/** Renders its children when a Neon Auth session exists in this browser. */
+export function SignedIn({ children }) {
+    return useSession().status === "signed-in" ? children : null;
+}
+/** Renders its children when nobody is signed in. */
+export function SignedOut({ children }) {
+    return useSession().status === "signed-out" ? children : null;
+}
+/**
+ * Renders its children when the signed-in user holds the permission. It only hides controls: the
+ * ontology service checks every read and action itself.
+ */
+export function Can({ permission, children, fallback = null }) {
+    const { isLoading, can } = usePermissions();
+    if (isLoading) {
+        return null;
+    }
+    return can(permission) ? children : fallback;
+}
+/** Ends the Neon Auth session in this browser, then opens `redirectTo`. */
+export async function signOut(redirectTo = SIGN_IN_PAGE) {
+    try {
+        await authClient().signOut();
+    }
+    finally {
+        clearSession();
+        navigate(safeReturnTo(redirectTo));
+    }
+}
+/** The signed-in user's name, email and roles, and a sign-out button. */
+export function UserMenu({ signedOutPath = SIGN_IN_PAGE }) {
+    const session = useSession();
+    const state = useUser();
+    const [signingOut, setSigningOut] = useState(false);
+    if (session.status !== "signed-in") {
+        return null;
+    }
+    const user = state.status === "signed-in" ? state.user : null;
+    const name = user?.name ?? session.user.name;
+    const email = user?.email ?? session.user.email;
+    const label = name ?? email ?? "Account";
+    const roles = user?.roles ?? [];
+    return (_jsxs("details", { className: "ss-user-menu", children: [_jsxs("summary", { className: "ss-user-menu-trigger", children: [_jsx("span", { className: "ss-avatar", "aria-hidden": "true", children: initials(label) }), _jsx("span", { className: "ss-user-menu-label", children: label })] }), _jsxs("div", { className: "ss-user-menu-panel", children: [name !== null && _jsx("p", { className: "ss-user-menu-name", children: name }), email !== null && _jsx("p", { className: "ss-user-menu-email", children: email }), roles.length > 0 && (_jsx("ul", { className: "ss-badges", "aria-label": "Roles", children: roles.map((role) => (_jsx("li", { className: "ss-badge", children: role }, role))) })), state.status === "error" && (_jsx("p", { className: "ss-error", role: "alert", children: state.error.detail })), _jsx("button", { type: "button", className: "ss-button ss-button--secondary", disabled: signingOut, "aria-busy": signingOut, onClick: () => {
+                            setSigningOut(true);
+                            void signOut(signedOutPath).catch(() => setSigningOut(false));
+                        }, children: signingOut ? "Signing out…" : "Sign out" })] })] }));
+}
+function initials(label) {
+    const letters = label
+        .split(/[\s@._-]+/)
+        .filter((part) => part !== "")
+        .slice(0, 2)
+        .map((part) => part.charAt(0).toUpperCase())
+        .join("");
+    return letters === "" ? "?" : letters;
+}

package/dist/ui/hooks.d.ts

@@ -0,0 +1,19 @@
+import type { SessionState, UserState } from "./store.js";
+/** The Neon Auth session in this browser: `loading`, `signed-out`, `signed-in` or `unavailable`. */
+export declare function useSession(): SessionState;
+/**
+ * The signed-in user as the ontology knows them, from `GET /api/ontology/me`, loaded once per
+ * session. `status` is `loading`, `signed-out`, `signed-in` (with `user`) or `error` (with `error`;
+ * `error.code` is `not_invited` for people the app has not invited).
+ */
+export declare function useUser(): UserState;
+export interface Permissions {
+    /** True until the user's permissions are known. */
+    readonly isLoading: boolean;
+    readonly roles: ReadonlyArray<string>;
+    readonly permissions: ReadonlyArray<string>;
+    /** Whether the user's permissions cover `permission`, wildcards included. */
+    readonly can: (permission: string) => boolean;
+}
+/** The signed-in user's roles and permissions, from the same per-session answer as `useUser()`. */
+export declare function usePermissions(): Permissions;

package/dist/ui/hooks.js

@@ -0,0 +1,56 @@
+"use client";
+import { useEffect, useMemo, useSyncExternalStore } from "react";
+import { SegmentStreamApiError } from "../errors.js";
+import { isAllowed } from "../permissions.js";
+import { LOADING_USER, SIGNED_OUT_USER, ensureUser, getServerSnapshot, getSnapshot, subscribe, } from "./store.js";
+const UNAVAILABLE_USER = {
+    status: "error",
+    user: null,
+    error: new SegmentStreamApiError({
+        code: "auth_unavailable",
+        status: 503,
+        detail: "Neon Auth could not be reached. Try again in a moment.",
+        retryable: true,
+    }),
+};
+/** The Neon Auth session in this browser: `loading`, `signed-out`, `signed-in` or `unavailable`. */
+export function useSession() {
+    return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot).session;
+}
+/**
+ * The signed-in user as the ontology knows them, from `GET /api/ontology/me`, loaded once per
+ * session. `status` is `loading`, `signed-out`, `signed-in` (with `user`) or `error` (with `error`;
+ * `error.code` is `not_invited` for people the app has not invited).
+ */
+export function useUser() {
+    const { session, users } = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
+    const sessionId = session.status === "signed-in" ? session.sessionId : null;
+    useEffect(() => {
+        if (sessionId !== null) {
+            ensureUser(sessionId);
+        }
+    }, [sessionId]);
+    switch (session.status) {
+        case "loading":
+            return LOADING_USER;
+        case "signed-out":
+            return SIGNED_OUT_USER;
+        case "unavailable":
+            return UNAVAILABLE_USER;
+        case "signed-in":
+            return users.get(session.sessionId) ?? LOADING_USER;
+    }
+}
+/** The signed-in user's roles and permissions, from the same per-session answer as `useUser()`. */
+export function usePermissions() {
+    const state = useUser();
+    return useMemo(() => {
+        const user = state.status === "signed-in" ? state.user : null;
+        return {
+            isLoading: state.status === "loading",
+            roles: user?.roles ?? [],
+            permissions: user?.permissions ?? [],
+            can: (permission) => user !== null && isAllowed(permission, user),
+        };
+    }, [state]);
+}

package/dist/ui/index.d.ts

@@ -0,0 +1,10 @@
+export { Can, SignedIn, SignedOut, UserMenu, signOut } from "./components.js";
+export type { CanProps, ChildrenProps, UserMenuProps } from "./components.js";
+export { usePermissions, useSession, useUser } from "./hooks.js";
+export type { Permissions } from "./hooks.js";
+export { SignIn, signInErrorMessage } from "./sign-in.js";
+export type { SignInProps } from "./sign-in.js";
+export type { SessionState, SessionUser, UserState } from "./store.js";
+export { isAllowed } from "../permissions.js";
+export type { CurrentUser } from "../me.js";
+export { SegmentStreamApiError, NOT_INVITED } from "../errors.js";

package/dist/ui/index.js

@@ -0,0 +1,8 @@
+"use client";
+// Client components for apps that sign in with Neon Auth. Import the stylesheet once, in the root
+// layout: `import "@segmentstream-cloud/app/ui/styles.css";`.
+export { Can, SignedIn, SignedOut, UserMenu, signOut } from "./components.js";
+export { usePermissions, useSession, useUser } from "./hooks.js";
+export { SignIn, signInErrorMessage } from "./sign-in.js";
+export { isAllowed } from "../permissions.js";
+export { SegmentStreamApiError, NOT_INVITED } from "../errors.js";

package/dist/ui/navigation.d.ts

@@ -0,0 +1,5 @@
+/**
+ * A full page load, so that the server renders the next page with the session cookies Neon Auth
+ * has just set or cleared.
+ */
+export declare function navigate(path: string): void;

package/dist/ui/navigation.js

@@ -0,0 +1,8 @@
+"use client";
+/**
+ * A full page load, so that the server renders the next page with the session cookies Neon Auth
+ * has just set or cleared.
+ */
+export function navigate(path) {
+    window.location.assign(path);
+}

package/dist/ui/sign-in.d.ts

@@ -0,0 +1,19 @@
+export interface SignInProps {
+    /** Where to go once signed in. Defaults to the page's `returnTo` parameter, then `/`. */
+    readonly returnTo?: string;
+    /**
+     * Why the page was opened: `not_invited` when `requireUser()` found no invitation. Defaults to
+     * the page's `error` parameter.
+     */
+    readonly error?: string;
+    /** The heading. Defaults to "Sign in". */
+    readonly title?: string;
+}
+/**
+ * Email code sign-in with Neon Auth: the email address, then the six-digit code sent to it. New
+ * addresses get an account on first sign-in; whether they may use the app is the ontology's
+ * decision, which `requireUser()` reports as `not_invited`.
+ */
+export declare function SignIn({ returnTo, error: reason, title }: SignInProps): import("react").JSX.Element;
+/** A sentence for a Neon Auth (Better Auth) failure. */
+export declare function signInErrorMessage(error: unknown): string;

package/dist/ui/sign-in.js

@@ -0,0 +1,198 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useId, useRef, useState, useSyncExternalStore } from "react";
+import { safeReturnTo } from "../return-to.js";
+import { useSession } from "./hooks.js";
+import { navigate } from "./navigation.js";
+import { NOT_INVITED, authClient, clearSession, refreshSession } from "./store.js";
+/** Seconds before another code may be requested. */
+const RESEND_AFTER_SECONDS = 30;
+const CODE_LENGTH = 6;
+const noSubscription = () => () => { };
+/** The page's own query string; empty during server rendering. */
+function useSearchParameter(name) {
+    const search = useSyncExternalStore(noSubscription, () => window.location.search, () => "");
+    return new URLSearchParams(search).get(name);
+}
+/**
+ * Email code sign-in with Neon Auth: the email address, then the six-digit code sent to it. New
+ * addresses get an account on first sign-in; whether they may use the app is the ontology's
+ * decision, which `requireUser()` reports as `not_invited`.
+ */
+export function SignIn({ returnTo, error: reason, title = "Sign in" }) {
+    const ids = useId();
+    const session = useSession();
+    const pageReturnTo = useSearchParameter("returnTo");
+    const pageError = useSearchParameter("error");
+    const [step, setStep] = useState("email");
+    const [email, setEmail] = useState("");
+    const [code, setCode] = useState("");
+    const [pending, setPending] = useState(null);
+    const [error, setError] = useState(null);
+    const [notice, setNotice] = useState(null);
+    /** Seconds until another code may be requested. */
+    const [resendIn, setResendIn] = useState(0);
+    const [switchingAccount, setSwitchingAccount] = useState(false);
+    const codeInput = useRef(null);
+    const verifying = useRef(false);
+    const resendTimer = useRef(undefined);
+    const destination = safeReturnTo(returnTo ?? pageReturnTo);
+    const notInvited = (reason ?? pageError) === NOT_INVITED && !switchingAccount;
+    useEffect(() => () => clearInterval(resendTimer.current), []);
+    useEffect(() => {
+        if (step === "code") {
+            codeInput.current?.focus();
+        }
+    }, [step]);
+    function holdResend() {
+        const deadline = Date.now() + RESEND_AFTER_SECONDS * 1000;
+        clearInterval(resendTimer.current);
+        setResendIn(RESEND_AFTER_SECONDS);
+        resendTimer.current = setInterval(() => {
+            const remaining = Math.max(0, Math.ceil((deadline - Date.now()) / 1000));
+            setResendIn(remaining);
+            if (remaining === 0) {
+                clearInterval(resendTimer.current);
+            }
+        }, 1000);
+    }
+    async function sendCode(address) {
+        const result = await attempt(() => authClient().emailOtp.sendVerificationOtp({ email: address, type: "sign-in" }));
+        if (result !== null) {
+            setError(signInErrorMessage(result));
+            return false;
+        }
+        holdResend();
+        return true;
+    }
+    async function submitEmail(event) {
+        event.preventDefault();
+        const address = email.trim();
+        if (address === "") {
+            setError("Enter your email address.");
+            return;
+        }
+        setPending("send");
+        setError(null);
+        setNotice(null);
+        if (await sendCode(address)) {
+            setEmail(address);
+            setCode("");
+            setStep("code");
+        }
+        setPending(null);
+    }
+    async function verify(value) {
+        // The sixth digit and the Enter key may both submit the same code.
+        if (verifying.current) {
+            return;
+        }
+        if (!new RegExp(`^[0-9]{${CODE_LENGTH}}$`).test(value)) {
+            setError(`Enter the ${CODE_LENGTH}-digit code from the email.`);
+            return;
+        }
+        verifying.current = true;
+        setPending("verify");
+        setError(null);
+        setNotice(null);
+        const result = await attempt(() => authClient().signIn.emailOtp({ email, otp: value }));
+        if (result !== null) {
+            verifying.current = false;
+            setError(signInErrorMessage(result));
+            setCode("");
+            setPending(null);
+            codeInput.current?.focus();
+            return;
+        }
+        navigate(destination);
+    }
+    async function resend() {
+        setPending("resend");
+        setError(null);
+        setNotice(null);
+        if (await sendCode(email)) {
+            setCode("");
+            setNotice(`We sent a new code to ${email}.`);
+        }
+        setPending(null);
+    }
+    function changeEmail() {
+        setStep("email");
+        setCode("");
+        setError(null);
+        setNotice(null);
+    }
+    async function switchAccount() {
+        setPending("sign-out");
+        setError(null);
+        await attempt(() => authClient().signOut());
+        clearSession();
+        await refreshSession();
+        setSwitchingAccount(true);
+        setStep("email");
+        setPending(null);
+    }
+    const errorId = `${ids}-error`;
+    const sessionEmail = session.status === "signed-in" ? (session.user.email ?? session.user.name) : null;
+    if (notInvited) {
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "Ask for an invitation" }), _jsxs("p", { className: "ss-text", children: [sessionEmail === null ? "You are signed in" : `You are signed in as ${sessionEmail}`, ", but this app has not invited you. Ask your administrator for an invitation, or sign in with another email address."] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), _jsx("button", { type: "button", className: "ss-button", onClick: () => void switchAccount(), disabled: pending !== null, "aria-busy": pending === "sign-out", children: pending === "sign-out" ? "Signing out…" : "Use another email" })] }));
+    }
+    if (session.status === "signed-in" && step === "email" && pending === null && !switchingAccount) {
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "You are signed in" }), _jsx("p", { className: "ss-text", children: sessionEmail === null ? "You already have a session." : `Signed in as ${sessionEmail}.` }), _jsxs("div", { className: "ss-actions", children: [_jsx("a", { className: "ss-button", href: destination, children: "Continue" }), _jsx("button", { type: "button", className: "ss-button ss-button--secondary", onClick: () => void switchAccount(), children: "Use another email" })] })] }));
+    }
+    if (step === "email") {
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: title }), _jsxs("p", { className: "ss-text", children: ["We will email you a ", CODE_LENGTH, "-digit code to sign in."] }), _jsxs("form", { className: "ss-form", onSubmit: (event) => void submitEmail(event), noValidate: true, children: [_jsxs("div", { className: "ss-field", children: [_jsx("label", { className: "ss-label", htmlFor: `${ids}-email`, children: "Email" }), _jsx("input", { id: `${ids}-email`, className: "ss-input", type: "email", name: "email", autoComplete: "email", inputMode: "email", required: true, value: email, onChange: (event) => setEmail(event.target.value), disabled: pending !== null, "aria-invalid": error !== null, "aria-describedby": error === null ? undefined : errorId })] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), _jsx("button", { type: "submit", className: "ss-button", disabled: pending !== null, "aria-busy": pending === "send", children: pending === "send" ? "Sending code…" : "Send code" })] })] }));
+    }
+    return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "Check your email" }), _jsxs("p", { className: "ss-text", children: ["Enter the ", CODE_LENGTH, "-digit code we sent to ", _jsx("strong", { children: email }), "."] }), _jsxs("form", { className: "ss-form", onSubmit: (event) => {
+                    event.preventDefault();
+                    void verify(code);
+                }, noValidate: true, children: [_jsxs("div", { className: "ss-field", children: [_jsx("label", { className: "ss-label", htmlFor: `${ids}-code`, children: "Code" }), _jsx("input", { ref: codeInput, id: `${ids}-code`, className: "ss-input ss-input--code", type: "text", name: "code", inputMode: "numeric", autoComplete: "one-time-code", pattern: "[0-9]*", maxLength: CODE_LENGTH, required: true, value: code, onChange: (event) => {
+                                    const digits = event.target.value.replace(/\D/g, "").slice(0, CODE_LENGTH);
+                                    setCode(digits);
+                                    if (digits.length === CODE_LENGTH) {
+                                        void verify(digits);
+                                    }
+                                }, disabled: pending === "verify", "aria-invalid": error !== null, "aria-describedby": error === null ? undefined : errorId })] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), notice !== null && (_jsx("p", { className: "ss-notice", role: "status", children: notice })), _jsx("button", { type: "submit", className: "ss-button", disabled: pending !== null, "aria-busy": pending === "verify", children: pending === "verify" ? "Signing in…" : "Sign in" })] }), _jsxs("div", { className: "ss-actions", children: [_jsx("button", { type: "button", className: "ss-link", onClick: () => void resend(), disabled: pending !== null || resendIn > 0, "aria-busy": pending === "resend", children: pending === "resend"
+                            ? "Sending…"
+                            : resendIn > 0
+                                ? `Resend code in ${resendIn} s`
+                                : "Resend code" }), _jsx("button", { type: "button", className: "ss-link", onClick: changeEmail, disabled: pending !== null, children: "Use another email" })] })] }));
+}
+/** Runs a Neon Auth client call; its failure, returned or thrown, or `null` on success. */
+async function attempt(call) {
+    try {
+        const result = await call();
+        return result.error ?? null;
+    }
+    catch (error) {
+        return error ?? new Error("Sign-in failed.");
+    }
+}
+/** A sentence for a Neon Auth (Better Auth) failure. */
+export function signInErrorMessage(error) {
+    const details = typeof error === "object" && error !== null ? error : {};
+    const status = typeof details.status === "number" ? details.status : undefined;
+    const text = [details.code, details.message]
+        .filter((part) => typeof part === "string")
+        .join(" ")
+        .toLowerCase();
+    if (status === 429 || text.includes("rate limit") || text.includes("too many requests")) {
+        return "Too many requests. Wait a minute, then try again.";
+    }
+    if (text.includes("too many attempts") || text.includes("too_many_attempts")) {
+        return "Too many wrong codes. Send a new code.";
+    }
+    if (text.includes("expired")) {
+        return "That code has expired. Send a new one.";
+    }
+    if (text.includes("otp") || text.includes("code")) {
+        return "That code is not right. Check the email and try again.";
+    }
+    if (text.includes("email")) {
+        return "Enter a valid email address.";
+    }
+    if (status === undefined || status >= 500 || text.includes("network")) {
+        return "Sign-in is unavailable right now. Try again in a moment.";
+    }
+    return "Sign-in failed. Try again.";
+}

package/dist/ui/store.d.ts

@@ -0,0 +1,61 @@
+import { createAuthClient } from "@neondatabase/auth/next";
+import { NOT_INVITED, SegmentStreamApiError } from "../errors.js";
+import type { CurrentUser } from "../me.js";
+/** The Neon Auth API the app serves from `app/src/app/api/auth/[...path]/route.ts`. */
+export declare const AUTH_API_PATH = "/api/auth";
+/** The app's sign-in page. */
+export declare const SIGN_IN_PAGE = "/sign-in";
+export { NOT_INVITED };
+/** The person Neon Auth has signed in, before the ontology is asked about them. */
+export interface SessionUser {
+    readonly id: string;
+    readonly email: string | null;
+    readonly name: string | null;
+}
+export type SessionState = {
+    readonly status: "loading";
+} | {
+    readonly status: "signed-out";
+} | {
+    readonly status: "signed-in";
+    readonly sessionId: string;
+    readonly user: SessionUser;
+} | {
+    readonly status: "unavailable";
+};
+/** `useUser()`: the `/api/ontology/me` answer for the session, loaded once per session. */
+export type UserState = {
+    readonly status: "loading";
+    readonly user: null;
+    readonly error: null;
+} | {
+    readonly status: "signed-out";
+    readonly user: null;
+    readonly error: null;
+} | {
+    readonly status: "signed-in";
+    readonly user: CurrentUser;
+    readonly error: null;
+} | {
+    readonly status: "error";
+    readonly user: null;
+    readonly error: SegmentStreamApiError;
+};
+interface Snapshot {
+    readonly session: SessionState;
+    /** `/me` answers by Neon Auth session id. */
+    readonly users: ReadonlyMap<string, UserState>;
+}
+export declare const LOADING_USER: UserState;
+export declare const SIGNED_OUT_USER: UserState;
+/** The Neon Auth browser client, created on first use. It talks to the app's `/api/auth`. */
+export declare function authClient(): ReturnType<typeof createAuthClient>;
+export declare function subscribe(listener: () => void): () => void;
+export declare function getSnapshot(): Snapshot;
+export declare function getServerSnapshot(): Snapshot;
+/** Reads the session again, after signing in or out. */
+export declare function refreshSession(): Promise<void>;
+/** Forgets the session and every `/me` answer, after signing out. */
+export declare function clearSession(): void;
+/** Starts loading `/me` for a session unless it is loaded or loading. */
+export declare function ensureUser(sessionId: string): void;