@segmentstream-cloud/app 0.2.0 → 0.3.1

package/dist/cookies.d.ts

@@ -1,12 +1,16 @@
 import type { NextResponse } from "next/server";
+export { safeReturnTo } from "./return-to.js";
 export declare const REFRESH_COOKIE_MAX_AGE_SECONDS: number;
 export declare const AUTH_FLOW_COOKIE_MAX_AGE_SECONDS: number;
+/** Sign-ins one browser can have in progress at once; one more abandons them all. */
+export declare const MAX_PENDING_AUTH_FLOWS = 4;
 export interface CookieNames {
     readonly session: string;
     readonly refresh: string;
-    readonly authFlow: string;
+    /** Each sign-in in progress has its own cookie: this prefix followed by its `state`. */
+    readonly authFlowPrefix: string;
 }
-/** Cookie names and attributes for one request origin. */
+/** Cookie names and attributes for one app on one request origin. */
 export interface CookiePolicy {
     readonly secure: boolean;
     readonly names: CookieNames;
@@ -28,18 +32,23 @@ export declare function isLoopbackHostname(hostname: string): boolean;
  * Browsers reject `Secure` and `__Host-` cookies on plain-HTTP origins, except that
  * local development on http://localhost should still work. Every other origin uses
  * `__Host-` cookies, which cannot be set by sibling subdomains.
+ *
+ * Browsers share cookies between ports, so apps on `localhost:3000` and `localhost:3001`
+ * see one cookie jar. Names carry the workspace id to keep each app's session its own.
  */
-export declare function cookiePolicyFor(url: URL): CookiePolicy;
+export declare function cookiePolicyFor(url: URL, workspaceId: string): CookiePolicy;
 /** Candidate cookie names for code that only knows the request host (Server Components). */
-export declare function sessionCookieCandidates(hostname: string): readonly string[];
+export declare function sessionCookieCandidates(hostname: string, workspaceId: string): readonly string[];
+/** The cookie holding one sign-in's flow, or undefined for a `state` this SDK never issues. */
+export declare function authFlowCookieName(policy: CookiePolicy, state: string): string | undefined;
+/** The sign-in flow cookies a request carries, one per sign-in still in progress. */
+export declare function pendingAuthFlowCookies(policy: CookiePolicy, requestCookieNames: readonly string[]): string[];
 export declare function setSessionCookies(response: NextResponse, policy: CookiePolicy, tokens: SessionTokens): void;
 export declare function clearSessionCookies(response: NextResponse, policy: CookiePolicy): void;
 export declare function setAuthFlowCookie(response: NextResponse, policy: CookiePolicy, flow: AuthFlowState): void;
-export declare function clearAuthFlowCookie(response: NextResponse, policy: CookiePolicy): void;
+export declare function clearCookie(response: NextResponse, policy: CookiePolicy, name: string): void;
 export declare function encodeAuthFlowState(flow: AuthFlowState): string;
 export declare function decodeAuthFlowState(value: string | undefined): AuthFlowState | null;
-/** Reduces a return path to a same-origin relative path, falling back to `/`. */
-export declare function safeReturnTo(value: string | null | undefined): string;
 /**
  * Replaces the named cookies in a raw `Cookie` request header while preserving every
  * other cookie byte for byte.

package/dist/cookies.js

@@ -1,16 +1,12 @@
 import { base64UrlDecode, base64UrlEncode } from "./pkce.js";
+import { safeReturnTo } from "./return-to.js";
+export { safeReturnTo } from "./return-to.js";
 export const REFRESH_COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
 export const AUTH_FLOW_COOKIE_MAX_AGE_SECONDS = 10 * 60;
-const SECURE_NAMES = {
-    session: "__Host-ss_app_session",
-    refresh: "__Host-ss_app_refresh",
-    authFlow: "__Host-ss_app_auth",
-};
-const LOOPBACK_NAMES = {
-    session: "ss_app_session",
-    refresh: "ss_app_refresh",
-    authFlow: "ss_app_auth",
-};
+/** Sign-ins one browser can have in progress at once; one more abandons them all. */
+export const MAX_PENDING_AUTH_FLOWS = 4;
+const SECURE_PREFIX = "__Host-";
+const AUTH_FLOW_STATE = /^[A-Za-z0-9_-]{1,128}$/;
 export function isLoopbackHostname(hostname) {
     const normalized = hostname.toLowerCase();
     return (normalized === "localhost" ||
@@ -23,18 +19,38 @@ export function isLoopbackHostname(hostname) {
  * Browsers reject `Secure` and `__Host-` cookies on plain-HTTP origins, except that
  * local development on http://localhost should still work. Every other origin uses
  * `__Host-` cookies, which cannot be set by sibling subdomains.
+ *
+ * Browsers share cookies between ports, so apps on `localhost:3000` and `localhost:3001`
+ * see one cookie jar. Names carry the workspace id to keep each app's session its own.
  */
-export function cookiePolicyFor(url) {
+export function cookiePolicyFor(url, workspaceId) {
     const insecureLoopback = url.protocol === "http:" && isLoopbackHostname(url.hostname);
-    return insecureLoopback
-        ? { secure: false, names: LOOPBACK_NAMES }
-        : { secure: true, names: SECURE_NAMES };
+    return {
+        secure: !insecureLoopback,
+        names: cookieNames(insecureLoopback ? "" : SECURE_PREFIX, workspaceId),
+    };
 }
 /** Candidate cookie names for code that only knows the request host (Server Components). */
-export function sessionCookieCandidates(hostname) {
-    return isLoopbackHostname(hostname)
-        ? [SECURE_NAMES.session, LOOPBACK_NAMES.session]
-        : [SECURE_NAMES.session];
+export function sessionCookieCandidates(hostname, workspaceId) {
+    const secure = cookieNames(SECURE_PREFIX, workspaceId).session;
+    return isLoopbackHostname(hostname) ? [secure, cookieNames("", workspaceId).session] : [secure];
+}
+function cookieNames(prefix, workspaceId) {
+    // Workspace ids are UUIDs; anything else is kept to cookie-name characters.
+    const scope = workspaceId.replace(/[^A-Za-z0-9_-]/g, "_");
+    return {
+        session: `${prefix}ss_app_session.${scope}`,
+        refresh: `${prefix}ss_app_refresh.${scope}`,
+        authFlowPrefix: `${prefix}ss_app_auth.${scope}.`,
+    };
+}
+/** The cookie holding one sign-in's flow, or undefined for a `state` this SDK never issues. */
+export function authFlowCookieName(policy, state) {
+    return AUTH_FLOW_STATE.test(state) ? `${policy.names.authFlowPrefix}${state}` : undefined;
+}
+/** The sign-in flow cookies a request carries, one per sign-in still in progress. */
+export function pendingAuthFlowCookies(policy, requestCookieNames) {
+    return requestCookieNames.filter((name) => name.startsWith(policy.names.authFlowPrefix));
 }
 function cookieAttributes(policy, maxAge) {
     return {
@@ -55,13 +71,10 @@ export function clearSessionCookies(response, policy) {
     clearCookie(response, policy, policy.names.refresh);
 }
 export function setAuthFlowCookie(response, policy, flow) {
-    response.cookies.set(policy.names.authFlow, encodeAuthFlowState(flow), cookieAttributes(policy, AUTH_FLOW_COOKIE_MAX_AGE_SECONDS));
-}
-export function clearAuthFlowCookie(response, policy) {
-    clearCookie(response, policy, policy.names.authFlow);
+    response.cookies.set(`${policy.names.authFlowPrefix}${flow.state}`, encodeAuthFlowState(flow), cookieAttributes(policy, AUTH_FLOW_COOKIE_MAX_AGE_SECONDS));
 }
 // `__Host-` cookies are only replaced when the clearing cookie repeats Secure and Path=/.
-function clearCookie(response, policy, name) {
+export function clearCookie(response, policy, name) {
     response.cookies.set(name, "", { ...cookieAttributes(policy, 0), expires: new Date(0) });
 }
 export function encodeAuthFlowState(flow) {
@@ -98,30 +111,6 @@ function isAuthFlowState(value) {
         typeof record.redirectUri === "string" &&
         typeof record.returnTo === "string");
 }
-/** Reduces a return path to a same-origin relative path, falling back to `/`. */
-export function safeReturnTo(value) {
-    if (typeof value !== "string" ||
-        !value.startsWith("/") ||
-        value.startsWith("//") ||
-        value.startsWith("/\\")) {
-        return "/";
-    }
-    if (/[\u0000-\u001f\u007f]/.test(value)) {
-        return "/";
-    }
-    const placeholderOrigin = "https://return-to.invalid";
-    let url;
-    try {
-        url = new URL(value, placeholderOrigin);
-    }
-    catch {
-        return "/";
-    }
-    if (url.origin !== placeholderOrigin) {
-        return "/";
-    }
-    return `${url.pathname}${url.search}${url.hash}`;
-}
 /**
  * Replaces the named cookies in a raw `Cookie` request header while preserving every
  * other cookie byte for byte.

package/dist/data.d.ts

@@ -1,24 +1,7 @@
 import type { ResolvedConfig } from "./config.js";
 import type { QueryParameters } from "./parameters.js";
 import type { Fetch } from "./sessions.js";
-/** A failed SegmentStream API request; `code` is the API error code. */
-export declare class SegmentStreamApiError extends Error {
-    readonly code: string;
-    readonly status: number;
-    readonly detail: string;
-    readonly requestId: string | undefined;
-    readonly retryable: boolean;
-    /** The warehouse query this error concerns, when one was started. */
-    readonly queryId: string | undefined;
-    constructor(input: {
-        readonly code: string;
-        readonly status: number;
-        readonly detail: string;
-        readonly requestId?: string | undefined;
-        readonly retryable?: boolean;
-        readonly queryId?: string | undefined;
-    });
-}
+export { SegmentStreamApiError } from "./errors.js";
 export type WarehouseValue = string | number | boolean | null;
 export type WarehouseRow = Record<string, WarehouseValue>;
 export interface WarehouseColumn {
@@ -127,6 +110,11 @@ export interface DataClientDependencies {
     readonly config: ResolvedConfig;
     readonly fetch: Fetch;
     readonly getAccessToken: () => Promise<string | null>;
+    /**
+     * The workspace app credential, `SEGMENTSTREAM_APP_CREDENTIAL`, read on every call. The API
+     * accepts it for warehouse queries and their results; without it they use the session token.
+     */
+    readonly getAppCredential?: () => string | undefined;
     readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
     readonly now?: () => number;
 }

package/dist/data.js

@@ -1,24 +1,6 @@
+import { SegmentStreamApiError, readJson } from "./errors.js";
 import { encodeParameters } from "./parameters.js";
-/** A failed SegmentStream API request; `code` is the API error code. */
-export class SegmentStreamApiError extends Error {
-    code;
-    status;
-    detail;
-    requestId;
-    retryable;
-    /** The warehouse query this error concerns, when one was started. */
-    queryId;
-    constructor(input) {
-        super(`${input.detail} (${input.code})`);
-        this.name = "SegmentStreamApiError";
-        this.code = input.code;
-        this.status = input.status;
-        this.detail = input.detail;
-        this.requestId = input.requestId;
-        this.retryable = input.retryable ?? false;
-        this.queryId = input.queryId;
-    }
-}
+export { SegmentStreamApiError } from "./errors.js";
 const REQUEST_TIMEOUT_MS = 45_000;
 const DEFAULT_MAX_ROWS = 10_000;
 const MAXIMUM_PAGE_SIZE = 1000;
@@ -32,11 +14,18 @@ export function createDataClient(dependencies) {
     const sleep = dependencies.sleep ?? defaultSleep;
     const now = dependencies.now ?? Date.now;
     /** Calls any SegmentStream API path as the signed-in member; the token never leaves the server. */
-    async function apiFetch(path, init = {}) {
+    function apiFetch(path, init = {}) {
+        return authorizedFetch(path, init, dependencies.getAccessToken);
+    }
+    /** Warehouse queries prefer the app's own credential, which needs no SegmentStream session. */
+    async function warehouseToken() {
+        return dependencies.getAppCredential?.() ?? dependencies.getAccessToken();
+    }
+    async function authorizedFetch(path, init, getToken) {
         if (!path.startsWith("/api/")) {
             throw new TypeError('SegmentStream API paths start with "/api/", for example "/api/v1/me".');
         }
-        const token = await dependencies.getAccessToken();
+        const token = await getToken();
         if (token === null) {
             throw new SegmentStreamApiError({
                 code: "app_session_missing",
@@ -71,14 +60,14 @@ export function createDataClient(dependencies) {
             });
         }
     }
-    async function call(method, path, body, signal) {
-        const response = await apiFetch(path, {
+    async function call(method, path, body, signal, getToken = dependencies.getAccessToken) {
+        const response = await authorizedFetch(path, {
             method,
             ...(body === undefined
                 ? {}
                 : { body: JSON.stringify(body), headers: { "content-type": "application/json" } }),
             ...(signal ? { signal } : {}),
-        });
+        }, getToken);
         const payload = await readJson(response);
         if (!response.ok) {
             throw errorFrom(response.status, payload);
@@ -133,7 +122,7 @@ export function createDataClient(dependencies) {
             parameters: encodeParameters(options.params),
             ...bytesLimit(options.maximumBytesBilled),
             pageSize: bounds.pageSize,
-        }, options.signal);
+        }, options.signal, warehouseToken);
         return collect(page, bounds, options.signal);
     }
     async function result(queryId, options = {}) {
@@ -146,7 +135,7 @@ export function createDataClient(dependencies) {
         if (pageToken !== undefined) {
             search.set("pageToken", pageToken);
         }
-        return call("GET", `${workspace}/warehouse/queries/${encodeURIComponent(queryId)}?${search.toString()}`, undefined, signal);
+        return call("GET", `${workspace}/warehouse/queries/${encodeURIComponent(queryId)}?${search.toString()}`, undefined, signal, warehouseToken);
     }
     const warehouse = {
         query,
@@ -157,7 +146,7 @@ export function createDataClient(dependencies) {
                 parameters: encodeParameters(options.params),
                 ...bytesLimit(options.maximumBytesBilled),
                 dryRun: true,
-            }, options.signal);
+            }, options.signal, warehouseToken);
             return {
                 columns: page.columns,
                 bytesProcessed: page.bytesProcessed ?? null,
@@ -188,14 +177,6 @@ function positiveInteger(value, name) {
     }
     return value;
 }
-async function readJson(response) {
-    try {
-        return await response.json();
-    }
-    catch {
-        return null;
-    }
-}
 function errorFrom(status, payload) {
     const body = typeof payload === "object" && payload !== null ? payload : {};
     return new SegmentStreamApiError({

package/dist/errors.d.ts

@@ -0,0 +1,38 @@
+/** One problem with a request's input, as the ontology service reports it. */
+export interface ApiIssue {
+    readonly path: ReadonlyArray<string | number>;
+    readonly message: string;
+}
+/**
+ * A failed SegmentStream or ontology request; `code` is the API error code, such as `not_invited`,
+ * `forbidden`, `action_rejected` or `query_timeout`.
+ */
+export declare class SegmentStreamApiError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly detail: string;
+    readonly requestId: string | undefined;
+    readonly retryable: boolean;
+    /** The warehouse query this error concerns, when one was started. */
+    readonly queryId: string | undefined;
+    /** What was wrong with the input, for `invalid_request`, `invalid_input` and `action_rejected`. */
+    readonly issues: ReadonlyArray<ApiIssue>;
+    constructor(input: {
+        readonly code: string;
+        readonly status: number;
+        readonly detail: string;
+        readonly requestId?: string | undefined;
+        readonly retryable?: boolean;
+        readonly queryId?: string | undefined;
+        readonly issues?: ReadonlyArray<ApiIssue>;
+        /** The underlying failure, kept for server logs. */
+        readonly cause?: unknown;
+    });
+}
+/** The person signed in, but the ontology has no member row for them. */
+export declare const NOT_INVITED = "not_invited";
+/** An emailed sign-in link that Neon Auth rejected: expired, already used or unknown. */
+export declare const SIGN_IN_LINK_INVALID = "sign_in_link_invalid";
+/** The error body of a failed response: `{ error, detail, requestId, issues? }`. */
+export declare function apiErrorFrom(status: number, payload: unknown, fallbackDetail: string): SegmentStreamApiError;
+export declare function readJson(response: Response): Promise<unknown>;

package/dist/errors.js

@@ -0,0 +1,68 @@
+/**
+ * A failed SegmentStream or ontology request; `code` is the API error code, such as `not_invited`,
+ * `forbidden`, `action_rejected` or `query_timeout`.
+ */
+export class SegmentStreamApiError extends Error {
+    code;
+    status;
+    detail;
+    requestId;
+    retryable;
+    /** The warehouse query this error concerns, when one was started. */
+    queryId;
+    /** What was wrong with the input, for `invalid_request`, `invalid_input` and `action_rejected`. */
+    issues;
+    constructor(input) {
+        super(`${input.detail} (${input.code})`, input.cause === undefined ? undefined : { cause: input.cause });
+        this.name = "SegmentStreamApiError";
+        this.code = input.code;
+        this.status = input.status;
+        this.detail = input.detail;
+        this.requestId = input.requestId;
+        this.retryable = input.retryable ?? false;
+        this.queryId = input.queryId;
+        this.issues = input.issues ?? [];
+    }
+}
+/** The person signed in, but the ontology has no member row for them. */
+export const NOT_INVITED = "not_invited";
+/** An emailed sign-in link that Neon Auth rejected: expired, already used or unknown. */
+export const SIGN_IN_LINK_INVALID = "sign_in_link_invalid";
+/** The error body of a failed response: `{ error, detail, requestId, issues? }`. */
+export function apiErrorFrom(status, payload, fallbackDetail) {
+    const body = typeof payload === "object" && payload !== null ? payload : {};
+    return new SegmentStreamApiError({
+        code: typeof body.error === "string" ? body.error : `http_${status}`,
+        status,
+        detail: typeof body.detail === "string" ? body.detail : fallbackDetail,
+        requestId: typeof body.requestId === "string" ? body.requestId : undefined,
+        retryable: typeof body.retryable === "boolean" ? body.retryable : status >= 500 || status === 429,
+        issues: issuesFrom(body.issues),
+    });
+}
+function issuesFrom(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.flatMap((candidate) => {
+        if (typeof candidate !== "object" || candidate === null) {
+            return [];
+        }
+        const { path, message } = candidate;
+        if (typeof message !== "string") {
+            return [];
+        }
+        const segments = Array.isArray(path)
+            ? path.filter((segment) => typeof segment === "string" || typeof segment === "number")
+            : [];
+        return [{ path: segments, message }];
+    });
+}
+export async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}

package/dist/handlers.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { clearAuthFlowCookie, clearSessionCookies, cookiePolicyFor, decodeAuthFlowState, safeReturnTo, setSessionCookies, } from "./cookies.js";
+import { authFlowCookieName, clearCookie, clearSessionCookies, cookiePolicyFor, decodeAuthFlowState, pendingAuthFlowCookies, safeReturnTo, setSessionCookies, } from "./cookies.js";
 import { constantTimeEqual } from "./pkce.js";
 import { CALLBACK_PATH, SIGNED_OUT_PATH, SIGN_IN_PATH, SDK_ROUTE_PREFIX, signInRedirect, } from "./sign-in.js";
 export function createHandlers(context) {
@@ -29,19 +29,25 @@ export function createHandlers(context) {
     return { GET, POST };
 }
 async function handleCallback(context, request) {
-    const policy = cookiePolicyFor(request.nextUrl);
-    const flow = decodeAuthFlowState(request.cookies.get(policy.names.authFlow)?.value);
+    const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
     const code = request.nextUrl.searchParams.get("code");
     const state = request.nextUrl.searchParams.get("state");
+    const flowCookie = state === null ? undefined : authFlowCookieName(policy, state);
+    const flow = flowCookie === undefined ? null : decodeAuthFlowState(request.cookies.get(flowCookie)?.value);
     if (request.nextUrl.searchParams.get("error") === "access_denied") {
-        return callbackFailure(policy, 403, "You don't have access to this app.");
+        return callbackFailure(policy, flowCookie, 403, "You don't have access to this app.");
     }
-    if (flow === null ||
+    if (state === null ||
+        flowCookie === undefined ||
+        flow === null ||
         code === null ||
         code === "" ||
-        state === null ||
         !constantTimeEqual(state, flow.state)) {
-        return callbackFailure(policy, 400, "This sign-in link is invalid or has expired.");
+        // A replayed or abandoned sign-in whose browser has signed in since, for example in another tab.
+        if (await hasSession(context, request, policy)) {
+            return returnToApp(request, policy, flowCookie, "/");
+        }
+        return callbackFailure(policy, flowCookie, 400, "This sign-in link is invalid or has expired.");
     }
     const exchange = await context.requestToken({
         grantType: "authorization_code",
@@ -50,47 +56,65 @@ async function handleCallback(context, request) {
         redirectUri: flow.redirectUri,
     });
     if (exchange.status === "unavailable") {
-        return callbackFailure(policy, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
+        return callbackFailure(policy, flowCookie, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
     }
     if (exchange.status === "rejected") {
         const accessRevoked = exchange.httpStatus === 403 || exchange.code === "access_revoked";
         return accessRevoked
-            ? callbackFailure(policy, 403, "You don't have access to this app.")
-            : callbackFailure(policy, 400, "Sign-in could not be completed. Try again.");
+            ? callbackFailure(policy, flowCookie, 403, "You don't have access to this app.")
+            : callbackFailure(policy, flowCookie, 400, "Sign-in could not be completed. Try again.");
     }
     // A token this app would reject must not become a session, or sign-in would loop.
     const verification = await context.verifyToken(exchange.tokens.accessToken);
     if (verification.status === "unavailable") {
-        return callbackFailure(policy, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
+        return callbackFailure(policy, flowCookie, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
     }
     if (verification.status !== "valid") {
-        return callbackFailure(policy, 400, "Sign-in returned a session for a different app.");
+        return callbackFailure(policy, flowCookie, 400, "Sign-in returned a session for a different app.");
     }
-    const response = NextResponse.redirect(new URL(flow.returnTo, request.nextUrl.origin), 303);
-    response.headers.set("cache-control", "no-store");
-    clearAuthFlowCookie(response, policy);
+    const response = returnToApp(request, policy, flowCookie, flow.returnTo);
     setSessionCookies(response, policy, exchange.tokens);
     return response;
 }
+async function hasSession(context, request, policy) {
+    const accessToken = request.cookies.get(policy.names.session)?.value;
+    if (accessToken === undefined || accessToken === "") {
+        return false;
+    }
+    return (await context.verifyToken(accessToken)).status === "valid";
+}
+function returnToApp(request, policy, flowCookie, returnTo) {
+    const response = NextResponse.redirect(new URL(returnTo, request.nextUrl.origin), 303);
+    response.headers.set("cache-control", "no-store");
+    if (flowCookie !== undefined) {
+        clearCookie(response, policy, flowCookie);
+    }
+    return response;
+}
 async function handleSignOut(context, request) {
     const origin = request.headers.get("origin");
     if (origin !== null && origin !== request.nextUrl.origin) {
         return htmlResponse(403, "Sign-out refused", "Sign out from this app's own pages.", "Return to the app");
     }
-    const policy = cookiePolicyFor(request.nextUrl);
+    const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
     const refreshToken = request.cookies.get(policy.names.refresh)?.value;
     if (refreshToken !== undefined && refreshToken !== "") {
         await context.revokeSession(refreshToken);
     }
     const response = NextResponse.redirect(new URL(SIGNED_OUT_PATH, request.nextUrl.origin), 303);
+    const pendingFlows = pendingAuthFlowCookies(policy, request.cookies.getAll().map((cookie) => cookie.name));
     response.headers.set("cache-control", "no-store");
     clearSessionCookies(response, policy);
-    clearAuthFlowCookie(response, policy);
+    for (const name of pendingFlows) {
+        clearCookie(response, policy, name);
+    }
     return response;
 }
-function callbackFailure(policy, status, message) {
+function callbackFailure(policy, flowCookie, status, message) {
     const response = htmlResponse(status, "Sign-in failed", message, "Try again");
-    clearAuthFlowCookie(response, policy);
+    if (flowCookie !== undefined) {
+        clearCookie(response, policy, flowCookie);
+    }
     return response;
 }
 function notFound() {

package/dist/index.d.ts

@@ -1,19 +1,29 @@
 import type { SegmentStreamApp } from "./app.js";
 import type { SegmentStreamAppConfig } from "./config.js";
 /**
- * Creates the SegmentStream sign-in integration for a Next.js workspace app.
+ * Creates the SegmentStream integration for a Next.js workspace app. Pass the type of the app's
+ * ontology to type `segmentstream.ontology`:
  *
  * ```ts
- * export const segmentstream = createSegmentStreamApp({
- *   workspaceId: "wsp_...",
- *   organizationId: "org_...",
- * });
+ * import type ontology from "../../ontology";
+ * import link from "../segmentstream.json";
+ *
+ * export const segmentstream = createSegmentStreamApp<typeof ontology>(link);
  * ```
+ *
+ * With `NEON_AUTH_BASE_URL` set, users sign in with Neon Auth and their roles and permissions come
+ * from the ontology. Without it, members sign in with their SegmentStream account, as in 0.2.
  */
-export declare function createSegmentStreamApp(config: SegmentStreamAppConfig): SegmentStreamApp;
-export { SegmentStreamApiError } from "./data.js";
+export declare function createSegmentStreamApp<O = unknown>(config: SegmentStreamAppConfig): SegmentStreamApp<O>;
+export { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError } from "./errors.js";
+export { grants, isAllowed } from "./permissions.js";
 export { sql } from "./parameters.js";
-export type { SegmentStreamApp } from "./app.js";
+export type { AuthenticationMethod, SegmentStreamApp } from "./app.js";
+export type { ApiIssue } from "./errors.js";
+export type { CurrentUser } from "./me.js";
+export type { AuthRouteHandler, AuthRouteHandlers, SignOutOptions } from "./neon.js";
+export type { ActionCall, ActionOptions, ActionResponse, Change, Edit, EditKind, EntityClient, FieldFilter, GeneratedActions, HistoryEntry, HistoryOptions, HistoryPage, JsonRecord, JsonValue, ManyFilter, OntologyClient, OntologyPage, OntologyQuery, OrderBy, RequestOptions, UntypedOntologyClient, ValidationIssue, Where, } from "./ontology.js";
+export type { PermissionHolder } from "./permissions.js";
 export type { SemanticClient, SemanticField, SemanticQueryRequest, SemanticQueryResult, WarehouseClient, WarehouseColumn, WarehouseDryRun, WarehouseQueryOptions, WarehouseReadOptions, WarehouseQueryResult, WarehouseRow, WarehouseValue, } from "./data.js";
 export type { ParameterType, QueryParameterValue, QueryParameters, TypedParameter, } from "./parameters.js";
 export type { SegmentStreamAppConfig } from "./config.js";

package/dist/index.js

@@ -1,16 +1,21 @@
 import { createApp } from "./app.js";
 /**
- * Creates the SegmentStream sign-in integration for a Next.js workspace app.
+ * Creates the SegmentStream integration for a Next.js workspace app. Pass the type of the app's
+ * ontology to type `segmentstream.ontology`:
  *
  * ```ts
- * export const segmentstream = createSegmentStreamApp({
- *   workspaceId: "wsp_...",
- *   organizationId: "org_...",
- * });
+ * import type ontology from "../../ontology";
+ * import link from "../segmentstream.json";
+ *
+ * export const segmentstream = createSegmentStreamApp<typeof ontology>(link);
  * ```
+ *
+ * With `NEON_AUTH_BASE_URL` set, users sign in with Neon Auth and their roles and permissions come
+ * from the ontology. Without it, members sign in with their SegmentStream account, as in 0.2.
  */
 export function createSegmentStreamApp(config) {
     return createApp(config);
 }
-export { SegmentStreamApiError } from "./data.js";
+export { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError } from "./errors.js";
+export { grants, isAllowed } from "./permissions.js";
 export { sql } from "./parameters.js";

package/dist/me.d.ts

@@ -0,0 +1,24 @@
+/** The ontology service's account of the caller: `GET /api/ontology/me`. */
+export declare const ME_PATH = "/api/ontology/me";
+/**
+ * The signed-in person as the ontology knows them: their `user` record, the roles they hold and the
+ * permissions those roles grant, wildcards included.
+ */
+export interface CurrentUser {
+    /** The ontology `user` record's id: what relationships such as `lead.ownerId` hold. */
+    readonly id: string;
+    readonly name: string | null;
+    readonly email: string | null;
+    /** `member` for people. */
+    readonly kind: string;
+    readonly active: boolean;
+    /** The ontology roles the user holds, such as `sales`. */
+    readonly roles: ReadonlyArray<string>;
+    /** The permissions the roles grant, such as `lead:changeStatus` or `*:read`. */
+    readonly permissions: ReadonlyArray<string>;
+}
+/**
+ * Reads `{ user: { id, name, email, kind, active }, roles, permissions }` tolerantly: unknown
+ * fields are ignored and only what the SDK presents is checked. `null` when it is not that shape.
+ */
+export declare function parseMe(payload: unknown): CurrentUser | null;