@segmentstream/app 0.0.0-stage → 0.38.0

package/dist/neon.js

@@ -0,0 +1,539 @@
+import { NEON_AUTH_SESSION_COOKIE_NAME, NEON_AUTH_SESSION_DATA_COOKIE_NAME, parseSetCookies, } from "@neondatabase/auth/server";
+import { decodeJwt } from "jose";
+import { cookies } from "next/headers";
+import { redirect } from "next/navigation";
+import { NextResponse } from "next/server";
+import { hasChannelApps } from "./config.js";
+import { replaceRequestCookies, safeReturnTo } from "./cookies.js";
+import { createChannelSession } from "./channel-session.js";
+import { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError, apiErrorFrom, readJson, } from "./errors.js";
+import { parseMe } from "./me.js";
+import { createOntologyTransport } from "./ontology-transport.js";
+import { isAllowed } from "./permissions.js";
+import { matchesPathPrefix, normalizePublicPath, wellKnownResponse } from "./proxy.js";
+import { isApiRequest, unauthenticatedResponse } from "./sign-in.js";
+/** The app's sign-in page, which renders `<SignIn />` from `@segmentstream/app/ui`. */
+export const SIGN_IN_PAGE = "/sign-in";
+/** Where `app/src/app/api/auth/[...path]/route.ts` serves the Neon Auth API. */
+export const AUTH_API_PATH = "/api/auth";
+/** The ontology's HTTP API and MCP transport; metadata probes are handled separately. */
+const ONTOLOGY_PATHS = ["/api/ontology", "/mcp"];
+/**
+ * Paths every visitor may open: the Neon Auth API, the sign-in page, the health check, and the
+ * Next.js assets and metadata files the sign-in page needs.
+ */
+export const OPEN_PATHS = [
+    AUTH_API_PATH,
+    SIGN_IN_PAGE,
+    "/api/segmentstream/configuration",
+    "/api/health",
+    "/_next",
+    "/favicon.ico",
+    "/robots.txt",
+    "/sitemap.xml",
+    "/manifest.webmanifest",
+];
+/**
+ * Better Auth answers a magic link that names a callback with a redirect to that path on Neon
+ * Auth's own origin; Neon's proxy follows it and loses the session cookie. Without them it answers
+ * JSON with the cookies, and the app's auth route redirects itself.
+ */
+const MAGIC_LINK_CALLBACK_PARAMETERS = ["callbackURL", "errorCallbackURL", "newUserCallbackURL"];
+/** How long a user's roles and permissions are reused before `/api/ontology/me` is asked again. */
+const USER_TTL_MS = 60_000;
+/** Neon Auth JWTs live 15 minutes; a cached one is replaced a minute before it expires. */
+const TOKEN_EARLY_REFRESH_MS = 60_000;
+const CACHE_LIMIT = 1000;
+/** Entries that expire, at most {@link CACHE_LIMIT} of them; the oldest go first. */
+class ExpiringCache {
+    now;
+    #entries = new Map();
+    constructor(now) {
+        this.now = now;
+    }
+    get(key) {
+        const entry = this.#entries.get(key);
+        if (entry === undefined) {
+            return undefined;
+        }
+        if (entry.expiresAt <= this.now()) {
+            this.#entries.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    set(key, value, expiresAt) {
+        this.#entries.delete(key);
+        this.#entries.set(key, { value, expiresAt });
+        for (const oldest of this.#entries.keys()) {
+            if (this.#entries.size <= CACHE_LIMIT) {
+                break;
+            }
+            this.#entries.delete(oldest);
+        }
+    }
+    delete(key) {
+        this.#entries.delete(key);
+    }
+}
+/**
+ * Neon Auth (Managed Better Auth) for the app's users: sessions in cookies through
+ * `@neondatabase/auth`, and roles and permissions from the ontology's `GET /api/ontology/me`.
+ */
+export function createNeonSession(dependencies) {
+    const { config, settings, now } = dependencies;
+    const channel = createChannelSession({
+        enabled: hasChannelApps(config.channels),
+        workspaceId: config.workspaceId,
+        ontologyUrl: settings.ontologyUrl,
+        fetch: dependencies.fetch,
+    });
+    const tokens = new ExpiringCache(now);
+    const users = new ExpiringCache(now);
+    const loadingUsers = new Map();
+    let server;
+    let routeHandlers;
+    let middleware;
+    /** Created on first use, so that builds without the cookie secret still succeed. */
+    function neonAuth() {
+        if (server !== undefined) {
+            return server;
+        }
+        const secret = settings.cookieSecret;
+        if (secret === undefined || secret.length < 32) {
+            throw new Error("SEGMENTSTREAM_APP_AUTH_COOKIE_SECRET must hold at least 32 characters when NEON_AUTH_BASE_URL is set. " +
+                "SegmentStream sets both on deploy; for local development copy them into app/.env.local.");
+        }
+        server = dependencies.createNeonAuth({
+            baseUrl: settings.baseUrl,
+            // Lax keeps the session on links followed from email and other sites.
+            cookies: { secret, sameSite: "lax" },
+        });
+        return server;
+    }
+    async function identity() {
+        // Reading cookies first marks the page dynamic, so prerendering at build time stops here
+        // before any configuration is needed. Thrown errors pass through untouched: Next.js signals
+        // dynamic rendering with them.
+        await cookies();
+        const channelSession = await channelIdentity();
+        if (channelSession) {
+            return channelSession;
+        }
+        const result = await neonAuth().getSession();
+        if (result.error !== null) {
+            if (result.error.status === 401) {
+                return channelIdentity();
+            }
+            const fallback = await channelIdentity();
+            if (fallback) {
+                return fallback;
+            }
+            throw authUnavailable(result.error);
+        }
+        const session = result.data?.session;
+        const user = result.data?.user;
+        if (session === null || session === undefined || user === null || user === undefined) {
+            return channelIdentity();
+        }
+        return {
+            sessionId: session.id,
+            userId: user.id,
+            email: user.email ?? undefined,
+            name: user.name ?? undefined,
+        };
+    }
+    async function channelIdentity() {
+        const session = await channel.read();
+        return session
+            ? {
+                sessionId: session.user.id,
+                userId: session.user.id,
+                name: session.user.name ?? undefined,
+                email: session.user.email ?? undefined,
+                channel: session,
+            }
+            : null;
+    }
+    /** The session's JWT for the ontology service, reused until shortly before it expires. */
+    async function sessionToken(session) {
+        if (session.channel) {
+            return session.channel.token;
+        }
+        const cached = tokens.get(session.sessionId);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const result = await neonAuth().token();
+        if (result.error !== null) {
+            if (result.error.status === 401) {
+                return channel.token();
+            }
+            throw authUnavailable(result.error);
+        }
+        const token = result.data?.token;
+        if (typeof token !== "string" || token === "") {
+            throw authUnavailable(new Error("Neon Auth returned no token."));
+        }
+        tokens.set(session.sessionId, token, tokenRefreshAt(token, now()));
+        return token;
+    }
+    function transportFor(session) {
+        return createOntologyTransport({
+            fetch: dependencies.fetch,
+            ontologyUrl: settings.ontologyUrl,
+            credentials: {
+                token: () => sessionToken(session),
+                rejected: () => tokens.delete(session.sessionId),
+            },
+        });
+    }
+    /** Ontology requests as the signed-in user. */
+    const ontologyTransport = {
+        async fetch(path, init) {
+            const session = await identity();
+            if (session === null) {
+                throw new SegmentStreamApiError({
+                    code: "app_session_missing",
+                    status: 401,
+                    detail: "No signed-in user for this request; call the ontology from Server Components, Route Handlers, or Server Functions behind the SegmentStream proxy.",
+                });
+            }
+            return transportFor(session).fetch(path, init);
+        },
+    };
+    async function askMe(session) {
+        const response = await transportFor(session).fetch("/me", {
+            method: "GET",
+            headers: { accept: "application/json" },
+        });
+        const payload = await readJson(response);
+        if (!response.ok) {
+            throw apiErrorFrom(response.status, payload, "The ontology service rejected the user.");
+        }
+        const user = parseMe(payload);
+        if (user === null) {
+            throw new SegmentStreamApiError({
+                code: "ontology_invalid_response",
+                status: 502,
+                detail: "GET /api/ontology/me did not answer { user, roles, permissions }.",
+                retryable: true,
+            });
+        }
+        return user;
+    }
+    async function currentUser(session, options = {}) {
+        if (session.channel) {
+            // Channel sessions are read from the service on every request.
+            return session.channel.user;
+        }
+        if (options.fresh !== true) {
+            const cached = users.get(session.sessionId);
+            if (cached !== undefined) {
+                return cached;
+            }
+            const pending = loadingUsers.get(session.sessionId);
+            if (pending !== undefined) {
+                return pending;
+            }
+        }
+        // A fresh request replaces one in flight, which may have started before the change it is for.
+        const loading = askMe(session)
+            .then((user) => {
+            // Only the latest request caches its answer, so an older one cannot replace a fresh one.
+            if (loadingUsers.get(session.sessionId) === loading) {
+                users.set(session.sessionId, user, now() + USER_TTL_MS);
+            }
+            return user;
+        })
+            .finally(() => {
+            if (loadingUsers.get(session.sessionId) === loading) {
+                loadingUsers.delete(session.sessionId);
+            }
+        });
+        loadingUsers.set(session.sessionId, loading);
+        return loading;
+    }
+    function appUser(session, user) {
+        const email = user.email ?? session.email;
+        const name = user.name ?? session.name;
+        return {
+            id: user.id,
+            ...(email === undefined ? {} : { email }),
+            ...(name === undefined ? {} : { name }),
+            organizationId: config.organizationId,
+            workspaceId: config.workspaceId,
+            roles: user.roles,
+            permissions: user.permissions,
+            ...(user.scopes === undefined ? {} : { scopes: user.scopes }),
+            kind: user.kind,
+            active: user.active,
+            authUserId: session.userId,
+        };
+    }
+    async function getUser(options = {}) {
+        const session = await identity();
+        if (session === null) {
+            return null;
+        }
+        return appUser(session, await currentUser(session, options));
+    }
+    async function requireUser(options = {}) {
+        const session = await identity();
+        if (session === null) {
+            redirect(SIGN_IN_PAGE);
+        }
+        let user;
+        let notInvited = false;
+        try {
+            user = await currentUser(session, options);
+        }
+        catch (error) {
+            if (!(error instanceof SegmentStreamApiError) || error.code !== NOT_INVITED) {
+                throw error;
+            }
+            notInvited = true;
+        }
+        if (notInvited || user === undefined) {
+            // The sign-in page explains it and offers to sign out; redirect() must not run inside try.
+            redirect(`${SIGN_IN_PAGE}?error=${NOT_INVITED}`);
+        }
+        return appUser(session, user);
+    }
+    async function can(permission, options = {}) {
+        let user;
+        try {
+            user = await getUser(options);
+        }
+        catch (error) {
+            if (error instanceof SegmentStreamApiError && error.code === NOT_INVITED) {
+                return false;
+            }
+            throw error;
+        }
+        return user !== null && isAllowed(permission, user);
+    }
+    async function signOut(options = {}) {
+        await channel.signOut();
+        const session = await identity().catch(() => null);
+        if (session !== null) {
+            tokens.delete(session.sessionId);
+            users.delete(session.sessionId);
+        }
+        try {
+            await neonAuth().signOut();
+        }
+        catch {
+            // Ending the session upstream is best effort; the cookies below end it in this browser.
+        }
+        const cookieStore = await cookies();
+        for (const name of [NEON_AUTH_SESSION_COOKIE_NAME, NEON_AUTH_SESSION_DATA_COOKIE_NAME]) {
+            cookieStore.set(name, "", {
+                httpOnly: true,
+                secure: true,
+                sameSite: "lax",
+                path: "/",
+                maxAge: 0,
+                expires: new Date(0),
+            });
+        }
+        redirect(safeReturnTo(options.redirectTo ?? SIGN_IN_PAGE));
+    }
+    function authHandlers() {
+        const handlers = () => (routeHandlers ??= neonAuth().handler());
+        return {
+            GET: async (request, context) => {
+                const { path } = await context.params;
+                return path.length === 2 && path[0] === "magic-link" && path[1] === "verify"
+                    ? completeMagicLink(request, context, () => handlers().GET)
+                    : handlers().GET(request, context);
+            },
+            POST: (request, context) => handlers().POST(request, context),
+            PUT: (request, context) => handlers().PUT(request, context),
+            DELETE: (request, context) => handlers().DELETE(request, context),
+            PATCH: (request, context) => handlers().PATCH(request, context),
+        };
+    }
+    function proxy(options = {}) {
+        const publicPaths = [...OPEN_PATHS, ...(options.publicPaths ?? [])].map(normalizePublicPath);
+        return async function neonProxy(request) {
+            const { pathname, search } = request.nextUrl;
+            const discovery = wellKnownResponse(request, settings.ontologyUrl);
+            if (discovery !== undefined) {
+                return discovery;
+            }
+            if (settings.ontologyUrl !== undefined &&
+                ONTOLOGY_PATHS.some((path) => matchesPathPrefix(pathname, path))) {
+                // Local development: the service runs elsewhere; deployed, its paths never reach the app.
+                return NextResponse.rewrite(new URL(`${pathname}${search}`, settings.ontologyUrl));
+            }
+            if (publicPaths.some((path) => matchesPathPrefix(pathname, path))) {
+                return NextResponse.next();
+            }
+            const channelResponse = await channel.proxy(request);
+            if (channelResponse) {
+                return channelResponse;
+            }
+            middleware ??= neonAuth().middleware({ loginUrl: SIGN_IN_PAGE });
+            const response = await middleware(request);
+            if (!isSignInRedirect(request, response)) {
+                return forwardSessionCookies(request, response);
+            }
+            const replacement = isApiRequest(request)
+                ? unauthenticatedResponse()
+                : signInPageRedirect(request);
+            // Neon Auth clears a stale session cache cookie on the way to sign-in.
+            for (const cookie of response.headers.getSetCookie()) {
+                replacement.headers.append("set-cookie", cookie);
+            }
+            return replacement;
+        };
+    }
+    return {
+        proxy,
+        authHandlers,
+        getUser,
+        requireUser,
+        can,
+        signOut,
+        ontologyTransport,
+        identityToken: async () => {
+            const session = await identity();
+            return session && !session.channel ? sessionToken(session) : null;
+        },
+    };
+}
+/** Neon Auth's middleware sends visitors without a session to the configured sign-in page. */
+function isSignInRedirect(request, response) {
+    const location = response.headers.get("location");
+    if (response.status < 300 || response.status >= 400 || location === null) {
+        return false;
+    }
+    try {
+        const target = new URL(location, request.nextUrl.origin);
+        return target.origin === request.nextUrl.origin && target.pathname === SIGN_IN_PAGE;
+    }
+    catch {
+        return false;
+    }
+}
+const MIDDLEWARE_REQUEST_HEADER = "x-middleware-request-";
+/**
+ * Neon Auth's middleware refreshes the session cookies on its response only, so the page this
+ * request renders would still read the old ones and ask Neon Auth again, which cannot set cookies
+ * from a Server Component. The refreshed cookies go into the request too: through
+ * `NextResponse.cookies`, which Next.js merges into `cookies()`, and the `Cookie` header, which
+ * Route Handlers read.
+ */
+function forwardSessionCookies(request, response) {
+    const setCookies = response.headers.getSetCookie();
+    if (response.headers.get("x-middleware-next") !== "1" || setCookies.length === 0) {
+        return response;
+    }
+    const refreshed = setCookies.flatMap((header) => parseSetCookies(header));
+    const expired = (cookie) => cookie.value === "" ||
+        (cookie.maxAge !== undefined && cookie.maxAge <= 0) ||
+        (cookie.expires !== undefined && cookie.expires.getTime() <= Date.now());
+    const requestHeaders = new Headers(request.headers);
+    // Keep the request headers Neon Auth's middleware added.
+    for (const [name, value] of response.headers) {
+        if (name.startsWith(MIDDLEWARE_REQUEST_HEADER)) {
+            requestHeaders.set(name.slice(MIDDLEWARE_REQUEST_HEADER.length), value);
+        }
+    }
+    const removed = new Set(refreshed.filter(expired).map((cookie) => cookie.name));
+    const live = refreshed.filter((cookie) => !expired(cookie));
+    const cookieHeader = replaceRequestCookies(request.headers.get("cookie"), Object.fromEntries(live.map((cookie) => [cookie.name, cookie.value])))
+        .split("; ")
+        .filter((pair) => pair !== "" && !removed.has(pair.split("=", 1)[0] ?? ""))
+        .join("; ");
+    requestHeaders.set("cookie", cookieHeader);
+    const forwarded = NextResponse.next({ request: { headers: requestHeaders } });
+    for (const { name, value, ...options } of refreshed) {
+        forwarded.cookies.set(name, value, options);
+    }
+    return forwarded;
+}
+/**
+ * Signs in with an emailed magic link on the app's own domain: Neon Auth verifies the token
+ * without a callback and sets the session cookies, which go to the browser with a redirect to the
+ * link's `callbackURL` path. A link Neon Auth rejects leads to the sign-in page instead.
+ */
+async function completeMagicLink(request, context, verify) {
+    const url = new URL(request.url);
+    const destination = safeReturnTo(url.searchParams.get("callbackURL"));
+    const token = url.searchParams.get("token");
+    if (token === null || token === "") {
+        return invalidSignInLink(url.origin, destination);
+    }
+    for (const name of MAGIC_LINK_CALLBACK_PARAMETERS) {
+        url.searchParams.delete(name);
+    }
+    const handler = verify();
+    let response;
+    try {
+        response = await handler(new Request(url, request), context);
+    }
+    catch {
+        return invalidSignInLink(url.origin, destination);
+    }
+    // The body holds the session token; only the cookies go on to the browser.
+    void response.body?.cancel().catch(() => undefined);
+    if (!response.ok) {
+        return invalidSignInLink(url.origin, destination);
+    }
+    const redirect = NextResponse.redirect(new URL(destination, url.origin), 303);
+    for (const cookie of response.headers.getSetCookie()) {
+        redirect.headers.append("set-cookie", cookie);
+    }
+    redirect.headers.set("cache-control", "no-store");
+    return redirect;
+}
+/** An expired, used or unknown sign-in link: the sign-in page explains it and sends a code. */
+function invalidSignInLink(origin, destination) {
+    const url = new URL(SIGN_IN_PAGE, origin);
+    url.searchParams.set("error", SIGN_IN_LINK_INVALID);
+    if (destination !== "/") {
+        url.searchParams.set("returnTo", destination);
+    }
+    const response = NextResponse.redirect(url, 303);
+    response.headers.set("cache-control", "no-store");
+    return response;
+}
+/** Page navigations go to the sign-in page and come back to where they started. */
+function signInPageRedirect(request) {
+    const url = new URL(SIGN_IN_PAGE, request.nextUrl.origin);
+    const returnTo = safeReturnTo(`${request.nextUrl.pathname}${request.nextUrl.search}`);
+    if (returnTo !== "/" && returnTo.length <= 1024) {
+        url.searchParams.set("returnTo", returnTo);
+    }
+    const response = NextResponse.redirect(url, 307);
+    response.headers.set("cache-control", "no-store");
+    return response;
+}
+function tokenRefreshAt(token, now) {
+    try {
+        const { exp } = decodeJwt(token);
+        if (typeof exp === "number") {
+            return Math.max(now, exp * 1000 - TOKEN_EARLY_REFRESH_MS);
+        }
+    }
+    catch {
+        // Not a JWT the SDK can read; the service decides whether it is valid.
+    }
+    return now;
+}
+function authUnavailable(cause) {
+    const code = typeof cause === "object" && cause !== null && "code" in cause && typeof cause.code === "string"
+        ? cause.code
+        : undefined;
+    return new SegmentStreamApiError({
+        code: "auth_unavailable",
+        status: 503,
+        detail: code === undefined
+            ? "Neon Auth could not be reached. Try again in a moment."
+            : `Neon Auth could not be reached (${code}). Try again in a moment.`,
+        retryable: true,
+        cause,
+    });
+}

package/dist/oauth-completion.d.ts

@@ -0,0 +1,6 @@
+/** Keep a copyable PKCE-bound code visible while trying the client's loopback callback. */
+export declare function oauthCompletion(options: {
+    readonly redirect?: string;
+    readonly approved?: boolean;
+}): Response;
+export declare function loopbackRedirect(value: string): boolean;

package/dist/oauth-completion.js

@@ -0,0 +1,106 @@
+import { SEGMENTSTREAM_LOGO_URI } from "./logo.js";
+function escape(value) {
+    return value.replace(/[&<>"']/g, (character) => ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&#39;",
+    })[character]);
+}
+// The shadcn/ui tokens and Card, Input and Button styles of the workspace app template, inlined so
+// the page needs no external stylesheet under its strict CSP.
+const STYLE = `
+:root{color-scheme:light;--radius:0.625rem;--background:oklch(1 0 0);--foreground:oklch(0.145 0 0);
+--card:oklch(1 0 0);--primary:oklch(0.205 0 0);--primary-foreground:oklch(0.985 0 0);
+--muted:oklch(0.97 0 0);--muted-foreground:oklch(0.556 0 0);--accent:oklch(0.97 0 0);
+--border:oklch(0.922 0 0);--input:oklch(0.922 0 0);--ring:oklch(0.708 0 0);--field:transparent;
+--outline:var(--background);--outline-hover:var(--accent);--logo:none}
+@media (prefers-color-scheme:dark){:root{color-scheme:dark;--background:oklch(0.145 0 0);
+--foreground:oklch(0.985 0 0);--card:oklch(0.205 0 0);--primary:oklch(0.922 0 0);
+--primary-foreground:oklch(0.205 0 0);--muted:oklch(0.269 0 0);--muted-foreground:oklch(0.708 0 0);
+--accent:oklch(0.269 0 0);--border:oklch(1 0 0 / 10%);--input:oklch(1 0 0 / 15%);
+--ring:oklch(0.556 0 0);--field:oklch(1 0 0 / 4.5%);--outline:oklch(1 0 0 / 4.5%);
+--outline-hover:oklch(1 0 0 / 7.5%);--logo:invert(1)}}
+*{box-sizing:border-box}
+body{margin:0;font-family:ui-sans-serif,system-ui,sans-serif,"Apple Color Emoji","Segoe UI Emoji";
+color:var(--foreground);background:color-mix(in oklab,var(--muted) 40%,var(--background));
+-webkit-font-smoothing:antialiased}
+main{min-height:100svh;max-width:calc(28rem + 3rem);margin:0 auto;padding:1.5rem;display:flex;
+flex-direction:column;align-items:center;justify-content:center;gap:1.5rem}
+main>img{filter:var(--logo);height:auto;max-width:100%}
+.card{width:100%;display:flex;flex-direction:column;gap:1.5rem;padding:1.5rem;
+background:var(--card);border:1px solid var(--border);border-radius:calc(var(--radius) + 4px);
+box-shadow:0 1px 3px 0 rgb(0 0 0 / 0.1),0 1px 2px -1px rgb(0 0 0 / 0.1)}
+header,.content{display:grid;gap:0.5rem}
+h1{margin:0;font-size:1.25rem;line-height:1.75rem;font-weight:600;letter-spacing:-0.025em}
+p{margin:0}.muted{color:var(--muted-foreground);font-size:0.875rem;line-height:1.25rem}
+.status:empty{display:none}.secured{font-size:0.75rem;line-height:1rem;text-align:center}
+.field{display:flex;gap:0.5rem}
+input{flex:1;min-width:0;height:2.25rem;padding:0 0.75rem;border:1px solid var(--input);
+border-radius:calc(var(--radius) - 2px);background:var(--field);color:inherit;
+font:0.875rem/1 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;letter-spacing:0.025em;
+box-shadow:0 1px 2px 0 rgb(0 0 0 / 0.05);outline:none}
+.button{display:inline-flex;align-items:center;justify-content:center;flex-shrink:0;height:2.25rem;
+padding:0 1rem;border:1px solid transparent;border-radius:calc(var(--radius) - 2px);
+background:var(--primary);color:var(--primary-foreground);font-family:inherit;font-size:0.875rem;
+font-weight:500;line-height:1.25rem;text-decoration:none;white-space:nowrap;cursor:pointer;outline:none;
+transition:background-color .15s,box-shadow .15s}
+.button:hover{background:color-mix(in oklab,var(--primary) 90%,transparent)}
+.outline{background:var(--outline);color:var(--foreground);border-color:var(--input);
+box-shadow:0 1px 2px 0 rgb(0 0 0 / 0.05)}.outline:hover{background:var(--outline-hover)}
+input:focus-visible,.button:focus-visible{border-color:var(--ring);
+box-shadow:0 0 0 3px color-mix(in oklab,var(--ring) 50%,transparent)}
+footer{display:flex;justify-content:flex-end}
+@media (max-width:30rem){.field{flex-direction:column}input{flex:none}.button{width:100%}}
+`;
+/** Keep a copyable PKCE-bound code visible while trying the client's loopback callback. */
+export function oauthCompletion(options) {
+    // Web Crypto keeps this module bundleable for client components (no node: imports).
+    const nonce = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(18))));
+    const redirect = options.redirect;
+    const code = redirect === undefined ? null : new URL(redirect).searchParams.get("code");
+    const title = options.approved === false ? "Request denied" : "Authorization complete";
+    const manual = code === null
+        ? `<header><h1>${title}</h1><p class="muted">You can return to your terminal.</p></header>`
+        : `<header><h1>${title}</h1>
+    <p class="muted">Return to your terminal. If it is still waiting, copy and paste this code:</p></header>
+    <div class="content"><div class="field">
+    <input id="code" aria-label="Authorization code" readonly value="${escape(code)}">
+    <button id="copy" class="button" type="button">Copy code</button></div>
+    <p id="status" class="muted status" role="status"></p></div>
+    <footer><a class="button outline" href="${escape(redirect)}">Continue to the client</a></footer>`;
+    const script = code === null
+        ? ""
+        : `
+    document.getElementById('copy').addEventListener('click', async () => {
+      const input = document.getElementById('code');
+      try { await navigator.clipboard.writeText(input.value);
+        document.getElementById('status').textContent = 'Copied';
+      } catch { input.select(); document.getElementById('status').textContent = 'Select and copy the code'; }
+    });
+    // A frame attempts loopback without losing the fallback page on connection failure.
+    const frame = document.createElement('iframe'); frame.hidden = true;
+    frame.src = ${JSON.stringify(redirect).replace(/</g, "\\u003c")}; document.body.appendChild(frame);`;
+    return new Response(`<!doctype html><html lang="en"><meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title>
+    <style nonce="${nonce}">${STYLE}</style>
+    <main><img src="${escape(SEGMENTSTREAM_LOGO_URI)}" alt="SegmentStream" width="210" height="45">
+    <section class="card">${manual}</section>
+    <p class="muted secured">Secured by SegmentStream</p></main>
+    <script nonce="${nonce}">${script}</script></html>`, {
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "referrer-policy": "no-referrer",
+            "x-frame-options": "DENY",
+            "content-security-policy": `default-src 'none'; img-src data:; style-src 'nonce-${nonce}'; ` +
+                `script-src 'nonce-${nonce}'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'; ` +
+                `frame-src ${redirect === undefined ? "'none'" : new URL(redirect).origin}`,
+        },
+    });
+}
+export function loopbackRedirect(value) {
+    const url = new URL(value);
+    return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}