@segmentstream/app 0.0.0-stage → 0.38.0

package/dist/ui/components.js

@@ -0,0 +1,71 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from "react";
+import { safeReturnTo } from "../return-to.js";
+import { usePermissions, useSession, useUser } from "./hooks.js";
+import { navigate } from "./navigation.js";
+import { SIGN_IN_PAGE, endBrowserSession, clearSession, getSnapshot } from "./store.js";
+/** Renders its children when a Neon Auth session exists in this browser. */
+export function SignedIn({ children }) {
+    return useSession().status === "signed-in" ? children : null;
+}
+/** Renders its children when nobody is signed in. */
+export function SignedOut({ children }) {
+    return useSession().status === "signed-out" ? children : null;
+}
+/**
+ * Renders its children when the signed-in user holds the permission. It only hides controls: the
+ * ontology service checks every read and action itself.
+ */
+export function Can({ permission, children, fallback = null }) {
+    const { isLoading, can } = usePermissions();
+    if (isLoading) {
+        return null;
+    }
+    return can(permission) ? children : fallback;
+}
+/** Ends the selected session in this browser, then opens `redirectTo`. */
+export async function signOut(redirectTo = SIGN_IN_PAGE) {
+    const session = getSnapshot().session;
+    if (session.status === "signed-in" &&
+        (session.source === "channel" || session.source === "oidc")) {
+        await endBrowserSession();
+        clearSession();
+        navigate(safeReturnTo(redirectTo));
+        return;
+    }
+    try {
+        await endBrowserSession();
+    }
+    finally {
+        clearSession();
+        navigate(safeReturnTo(redirectTo));
+    }
+}
+/** The signed-in user's name, email and roles, and a sign-out button. */
+export function UserMenu({ signedOutPath = SIGN_IN_PAGE }) {
+    const session = useSession();
+    const state = useUser();
+    const [signingOut, setSigningOut] = useState(false);
+    if (session.status !== "signed-in") {
+        return null;
+    }
+    const user = state.status === "signed-in" ? state.user : null;
+    const name = user?.name ?? session.user.name;
+    const email = user?.email ?? session.user.email;
+    const label = name ?? email ?? "Account";
+    const roles = user?.roles ?? [];
+    return (_jsxs("details", { className: "ss-user-menu", children: [_jsxs("summary", { className: "ss-user-menu-trigger", children: [_jsx("span", { className: "ss-avatar", "aria-hidden": "true", children: initials(label) }), _jsx("span", { className: "ss-user-menu-label", children: label })] }), _jsxs("div", { className: "ss-user-menu-panel", children: [name !== null && _jsx("p", { className: "ss-user-menu-name", children: name }), email !== null && _jsx("p", { className: "ss-user-menu-email", children: email }), roles.length > 0 && (_jsx("ul", { className: "ss-badges", "aria-label": "Roles", children: roles.map((role) => (_jsx("li", { className: "ss-badge", children: role }, role))) })), state.status === "error" && (_jsx("p", { className: "ss-error", role: "alert", children: state.error.detail })), _jsx("button", { type: "button", className: "ss-button ss-button--secondary", disabled: signingOut, "aria-busy": signingOut, onClick: () => {
+                            setSigningOut(true);
+                            void signOut(signedOutPath).catch(() => setSigningOut(false));
+                        }, children: signingOut ? "Signing out…" : "Sign out" })] })] }));
+}
+function initials(label) {
+    const letters = label
+        .split(/[\s@._-]+/)
+        .filter((part) => part !== "")
+        .slice(0, 2)
+        .map((part) => part.charAt(0).toUpperCase())
+        .join("");
+    return letters === "" ? "?" : letters;
+}

package/dist/ui/hooks.d.ts

@@ -0,0 +1,19 @@
+import type { SessionState, UserState } from "./store.js";
+/** The Neon Auth session in this browser: `loading`, `signed-out`, `signed-in` or `unavailable`. */
+export declare function useSession(): SessionState;
+/**
+ * The signed-in user as the ontology knows them, from `GET /api/ontology/me`, loaded once per
+ * session. `status` is `loading`, `signed-out`, `signed-in` (with `user`) or `error` (with `error`;
+ * `error.code` is `not_invited` for people the app has not invited).
+ */
+export declare function useUser(): UserState;
+export interface Permissions {
+    /** True until the user's permissions are known. */
+    readonly isLoading: boolean;
+    readonly roles: ReadonlyArray<string>;
+    readonly permissions: ReadonlyArray<string>;
+    /** Whether the user's permissions cover `permission`, wildcards included. */
+    readonly can: (permission: string) => boolean;
+}
+/** The signed-in user's roles and permissions, from the same per-session answer as `useUser()`. */
+export declare function usePermissions(): Permissions;

package/dist/ui/hooks.js

@@ -0,0 +1,56 @@
+"use client";
+import { useEffect, useMemo, useSyncExternalStore } from "react";
+import { SegmentStreamApiError } from "../errors.js";
+import { isAllowed } from "../permissions.js";
+import { LOADING_USER, SIGNED_OUT_USER, ensureUser, getServerSnapshot, getSnapshot, subscribe, } from "./store.js";
+const UNAVAILABLE_USER = {
+    status: "error",
+    user: null,
+    error: new SegmentStreamApiError({
+        code: "auth_unavailable",
+        status: 503,
+        detail: "Neon Auth could not be reached. Try again in a moment.",
+        retryable: true,
+    }),
+};
+/** The Neon Auth session in this browser: `loading`, `signed-out`, `signed-in` or `unavailable`. */
+export function useSession() {
+    return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot).session;
+}
+/**
+ * The signed-in user as the ontology knows them, from `GET /api/ontology/me`, loaded once per
+ * session. `status` is `loading`, `signed-out`, `signed-in` (with `user`) or `error` (with `error`;
+ * `error.code` is `not_invited` for people the app has not invited).
+ */
+export function useUser() {
+    const { session, users } = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
+    const sessionId = session.status === "signed-in" ? session.sessionId : null;
+    useEffect(() => {
+        if (sessionId !== null) {
+            ensureUser(sessionId, session.status === "signed-in" ? session.source : undefined);
+        }
+    }, [sessionId, session]);
+    switch (session.status) {
+        case "loading":
+            return LOADING_USER;
+        case "signed-out":
+            return SIGNED_OUT_USER;
+        case "unavailable":
+            return UNAVAILABLE_USER;
+        case "signed-in":
+            return users.get(session.sessionId) ?? LOADING_USER;
+    }
+}
+/** The signed-in user's roles and permissions, from the same per-session answer as `useUser()`. */
+export function usePermissions() {
+    const state = useUser();
+    return useMemo(() => {
+        const user = state.status === "signed-in" ? state.user : null;
+        return {
+            isLoading: state.status === "loading",
+            roles: user?.roles ?? [],
+            permissions: user?.permissions ?? [],
+            can: (permission) => user !== null && isAllowed(permission, user),
+        };
+    }, [state]);
+}

package/dist/ui/index.d.ts

@@ -0,0 +1,22 @@
+export { Can, SignedIn, SignedOut, UserMenu, signOut } from "./components.js";
+export type { CanProps, ChildrenProps, UserMenuProps } from "./components.js";
+export { AgentConnect } from "./agent-connect.js";
+export type { AgentConnectProps } from "./agent-connect.js";
+export { usePermissions, useSession, useUser } from "./hooks.js";
+export type { Permissions } from "./hooks.js";
+export { SignIn } from "./sign-in.js";
+export { TelegramSignIn, useTelegramSignIn } from "./telegram-sign-in.js";
+export type { TelegramSignInProps, TelegramSignInOptions } from "./telegram-sign-in.js";
+export type { SignInProps } from "./sign-in.js";
+export { SIGN_IN_ERROR_MESSAGES, signInErrorCode, signInCodeFromLink, signInErrorMessage, useSignIn, } from "./use-sign-in.js";
+export type { SignInController, SignInErrorCode, SignInNoticeCode, SignInOptions, } from "./use-sign-in.js";
+export type { SessionState, SessionUser, UserState } from "./store.js";
+export { isAllowed } from "../permissions.js";
+export type { CurrentUser, ScopedPermission } from "../me.js";
+export type { AgentPairing } from "../agent.js";
+export { SegmentStreamApiError, NOT_INVITED, SIGN_IN_LINK_INVALID } from "../errors.js";
+export { SegmentStreamLogo } from "./segmentstream-logo.js";
+export { useChannelSignIn } from "./use-channel-sign-in.js";
+export type { ChannelSignInState, ChannelSignInOptions } from "./use-channel-sign-in.js";
+export { useBrowserSignIn, useIdentityLink, useEmailIdentityLink } from "./use-browser-sign-in.js";
+export type { BrowserSignInMethod, BrowserSignInOptions, IdentityLinkState, LinkAccountIdentity, } from "./use-browser-sign-in.js";

package/dist/ui/index.js

@@ -0,0 +1,15 @@
+"use client";
+// Client components for apps that sign in with Neon Auth. Import the stylesheet once, in the root
+// layout, when rendering the components: `import "@segmentstream/app/ui/styles.css";`. The
+// hooks, `useSignIn()` among them, need no stylesheet.
+export { Can, SignedIn, SignedOut, UserMenu, signOut } from "./components.js";
+export { AgentConnect } from "./agent-connect.js";
+export { usePermissions, useSession, useUser } from "./hooks.js";
+export { SignIn } from "./sign-in.js";
+export { TelegramSignIn, useTelegramSignIn } from "./telegram-sign-in.js";
+export { SIGN_IN_ERROR_MESSAGES, signInErrorCode, signInCodeFromLink, signInErrorMessage, useSignIn, } from "./use-sign-in.js";
+export { isAllowed } from "../permissions.js";
+export { SegmentStreamApiError, NOT_INVITED, SIGN_IN_LINK_INVALID } from "../errors.js";
+export { SegmentStreamLogo } from "./segmentstream-logo.js";
+export { useChannelSignIn } from "./use-channel-sign-in.js";
+export { useBrowserSignIn, useIdentityLink, useEmailIdentityLink } from "./use-browser-sign-in.js";

package/dist/ui/navigation.d.ts

@@ -0,0 +1,5 @@
+/**
+ * A full page load, so that the server renders the next page with the session cookies Neon Auth
+ * has just set or cleared.
+ */
+export declare function navigate(path: string): void;

package/dist/ui/navigation.js

@@ -0,0 +1,8 @@
+"use client";
+/**
+ * A full page load, so that the server renders the next page with the session cookies Neon Auth
+ * has just set or cleared.
+ */
+export function navigate(path) {
+    window.location.assign(path);
+}

package/dist/ui/segmentstream-logo.d.ts

@@ -0,0 +1,2 @@
+/** The official SegmentStream wordmark, also used on segmentstream.com. */
+export declare function SegmentStreamLogo(): import("react").JSX.Element;

package/dist/ui/segmentstream-logo.js

@@ -0,0 +1,7 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import Image from "next/image";
+import { SEGMENTSTREAM_LOGO_URI } from "../logo.js";
+/** The official SegmentStream wordmark, also used on segmentstream.com. */
+export function SegmentStreamLogo() {
+    return (_jsx(Image, { unoptimized: true, src: SEGMENTSTREAM_LOGO_URI, alt: "SegmentStream", width: 210, height: 45 }));
+}

package/dist/ui/sign-in-check.d.ts

@@ -0,0 +1,14 @@
+/** The ontology's sign-in check, which the deployment serves beside the app. */
+export declare const SIGN_IN_CHECK_PATH = "/api/ontology/sign-in/check";
+/**
+ * How an address signs in, or why it may not: `code` for a member with a Neon Auth account, `link`
+ * for a first sign-in, which the link's account creation needs; `not_invited`, `email_invalid` or
+ * `rate_limited` when the ontology refuses before any email is sent.
+ */
+export type SignInCheckOutcome = "code" | "link" | "not_invited" | "email_invalid" | "rate_limited";
+/**
+ * Asks the ontology how this address signs in, before any email is sent. An app without an
+ * ontology, an ontology deployed with an SDK before 0.4, an answer the SDK cannot read and a failed
+ * request all get `code`: the sign-in works as it did before the check existed.
+ */
+export declare function checkSignIn(email: string): Promise<SignInCheckOutcome>;

package/dist/ui/sign-in-check.js

@@ -0,0 +1,41 @@
+import { readJson } from "../errors.js";
+/** The ontology's sign-in check, which the deployment serves beside the app. */
+export const SIGN_IN_CHECK_PATH = "/api/ontology/sign-in/check";
+/**
+ * Asks the ontology how this address signs in, before any email is sent. An app without an
+ * ontology, an ontology deployed with an SDK before 0.4, an answer the SDK cannot read and a failed
+ * request all get `code`: the sign-in works as it did before the check existed.
+ */
+export async function checkSignIn(email) {
+    let response;
+    try {
+        response = await fetch(SIGN_IN_CHECK_PATH, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify({ email }),
+            credentials: "same-origin",
+            cache: "no-store",
+        });
+    }
+    catch {
+        return "code";
+    }
+    if (response.status === 429) {
+        return "rate_limited";
+    }
+    if (response.status === 400) {
+        return "email_invalid";
+    }
+    if (!response.ok) {
+        return "code";
+    }
+    const body = await readJson(response);
+    if (typeof body !== "object" || body === null) {
+        return "code";
+    }
+    const { allowed, method } = body;
+    if (allowed === false) {
+        return "not_invited";
+    }
+    return allowed === true && method === "link" ? "link" : "code";
+}

package/dist/ui/sign-in.d.ts

@@ -0,0 +1,17 @@
+import { type ReactNode } from "react";
+import type { ChannelSignInState } from "./use-channel-sign-in.js";
+import { useBrowserSignIn } from "./use-browser-sign-in.js";
+import type { SignInOptions } from "./use-sign-in.js";
+export interface SignInProps extends SignInOptions {
+    /** The heading. Defaults to "Sign in". */
+    readonly title?: string;
+    /** Workspace-owned browser method and recovery UI for declared SegmentStream sign-in. */
+    readonly renderBrowser?: (state: ReturnType<typeof useBrowserSignIn>) => ReactNode;
+    /** App-owned rendering for channel status/error codes; no SDK error copy is supplied. */
+    readonly renderTelegram?: (state: ChannelSignInState) => ReactNode;
+}
+/**
+ * Email sign-in with Neon Auth in the SDK's neutral styles: `useSignIn()` with markup. Apps
+ * with their own design system render `useSignIn()` themselves.
+ */
+export declare function SignIn({ renderTelegram, renderBrowser, ...options }: SignInProps): string | number | bigint | boolean | Iterable<ReactNode> | Promise<string | number | bigint | boolean | import("react").ReactPortal | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | import("react").JSX.Element | null;

package/dist/ui/sign-in.js

@@ -0,0 +1,65 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useId, useRef } from "react";
+import { telegramInitData, useTelegramSignIn } from "./telegram-sign-in.js";
+import { useBrowserSignIn } from "./use-browser-sign-in.js";
+import { useSignIn } from "./use-sign-in.js";
+/**
+ * Email sign-in with Neon Auth in the SDK's neutral styles: `useSignIn()` with markup. Apps
+ * with their own design system render `useSignIn()` themselves.
+ */
+export function SignIn({ renderTelegram, renderBrowser, ...options }) {
+    const browser = useBrowserSignIn(options);
+    const destination = typeof window === "undefined"
+        ? "/"
+        : (new URLSearchParams(window.location.search).get("returnTo") ?? "/");
+    const telegram = useTelegramSignIn({ redirectTo: options.returnTo ?? destination });
+    const active = telegram.status !== "loading" &&
+        typeof window !== "undefined" &&
+        telegramInitData() !== undefined;
+    if (active && telegram.status !== "disabled") {
+        return renderTelegram?.(telegram) ?? null;
+    }
+    if (browser.status === "ready" && !browser.methods.includes("email"))
+        return renderBrowser?.(browser) ?? null;
+    return _jsx(EmailSignIn, { ...options });
+}
+function EmailSignIn({ title = "Sign in", ...options }) {
+    const ids = useId();
+    const { step, segmentstreamSignInUrl, email, setEmail, code, setCode, pending, error, notice, resendIn, codeLength, destination, signedIn, notInvited, linkInvalid, sessionEmail, submitEmail, submitCode, resend, changeEmail, switchAccount, } = useSignIn(options);
+    const codeInput = useRef(null);
+    // The code field takes focus when it appears and again after a wrong code.
+    useEffect(() => {
+        if (step === "code" && pending === null) {
+            codeInput.current?.focus();
+        }
+    }, [step, pending]);
+    const errorId = `${ids}-error`;
+    if (notInvited) {
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "Ask for an invitation" }), _jsxs("p", { className: "ss-text", children: [sessionEmail === null ? "You are signed in" : `You are signed in as ${sessionEmail}`, ", but this app has not invited you. Ask your administrator for an invitation, or sign in with another email address."] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), _jsx("button", { type: "button", className: "ss-button", onClick: () => void switchAccount(), disabled: pending !== null, "aria-busy": pending === "sign-out", children: pending === "sign-out" ? "Signing out…" : "Use another email" })] }));
+    }
+    if (signedIn && step === "email" && pending === null) {
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "You are signed in" }), _jsx("p", { className: "ss-text", children: sessionEmail === null ? "You already have a session." : `Signed in as ${sessionEmail}.` }), _jsxs("div", { className: "ss-actions", children: [_jsx("a", { className: "ss-button", href: destination, children: "Continue" }), _jsx("button", { type: "button", className: "ss-button ss-button--secondary", onClick: () => void switchAccount(), children: "Use another email" })] })] }));
+    }
+    if (step === "email") {
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: title }), _jsx("p", { className: "ss-text", children: "We will email you a code or a link to sign in." }), segmentstreamSignInUrl && (_jsx("a", { className: "ss-button ss-button--secondary", href: segmentstreamSignInUrl, children: "Continue with SegmentStream" })), _jsxs("form", { className: "ss-form", onSubmit: (event) => {
+                        event.preventDefault();
+                        void submitEmail();
+                    }, noValidate: true, children: [linkInvalid && (_jsx("p", { className: "ss-notice", role: "status", children: "This sign-in link is not valid anymore. Enter your email to get a new code." })), _jsxs("div", { className: "ss-field", children: [_jsx("label", { className: "ss-label", htmlFor: `${ids}-email`, children: "Email" }), _jsx("input", { id: `${ids}-email`, className: "ss-input", type: "email", name: "email", autoComplete: "email", inputMode: "email", required: true, value: email, onChange: (event) => setEmail(event.target.value), disabled: pending !== null, "aria-invalid": error !== null, "aria-describedby": error === null ? undefined : errorId })] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), _jsx("button", { type: "submit", className: "ss-button", disabled: pending !== null, "aria-busy": pending === "send", children: pending === "send" ? "Sending…" : "Continue" })] })] }));
+    }
+    const resendButton = (label) => (_jsx("button", { type: "button", className: "ss-link", onClick: () => void resend(), disabled: pending !== null || resendIn > 0, "aria-busy": pending === "resend", children: pending === "resend" ? "Sending…" : resendIn > 0 ? `${label} in ${resendIn} s` : label }));
+    const anotherEmail = (_jsx("button", { type: "button", className: "ss-link", onClick: changeEmail, disabled: pending !== null, children: "Use another email" }));
+    if (step === "link") {
+        return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "Check your email" }), _jsxs("p", { className: "ss-text", children: ["We sent a sign-in link to ", _jsx("strong", { children: email }), ". Open it on this device to sign in."] }), error !== null && (_jsx("p", { className: "ss-error", role: "alert", children: error })), notice !== null && (_jsx("p", { className: "ss-notice", role: "status", children: notice })), _jsxs("div", { className: "ss-actions", children: [resendButton("Resend link"), anotherEmail] })] }));
+    }
+    return (_jsxs("section", { className: "ss-card ss-sign-in", "aria-labelledby": `${ids}-title`, children: [_jsx("h1", { id: `${ids}-title`, className: "ss-title", children: "Check your email" }), _jsxs("p", { className: "ss-text", children: ["Enter the ", codeLength, "-digit code we sent to ", _jsx("strong", { children: email }), "."] }), _jsxs("form", { className: "ss-form", onSubmit: (event) => {
+                    event.preventDefault();
+                    void submitCode();
+                }, noValidate: true, children: [_jsxs("div", { className: "ss-field", children: [_jsx("label", { className: "ss-label", htmlFor: `${ids}-code`, children: "Code" }), _jsx("input", { ref: codeInput, id: `${ids}-code`, className: "ss-input ss-input--code", type: "text", name: "code", inputMode: "numeric", autoComplete: "one-time-code", pattern: "[0-9]*", maxLength: codeLength, required: true, value: code, onChange: (event) => {
+                                    const digits = event.target.value.replace(/\D/g, "").slice(0, codeLength);
+                                    setCode(digits);
+                                    if (digits.length === codeLength) {
+                                        void submitCode(digits);
+                                    }
+                                }, disabled: pending === "verify", "aria-invalid": error !== null, "aria-describedby": error === null ? undefined : errorId })] }), error !== null && (_jsx("p", { id: errorId, className: "ss-error", role: "alert", children: error })), notice !== null && (_jsx("p", { className: "ss-notice", role: "status", children: notice })), _jsx("button", { type: "submit", className: "ss-button", disabled: pending !== null, "aria-busy": pending === "verify", children: pending === "verify" ? "Signing in…" : "Sign in" })] }), _jsxs("div", { className: "ss-actions", children: [resendButton("Resend code"), anotherEmail] })] }));
+}

package/dist/ui/store.d.ts

@@ -0,0 +1,80 @@
+import { createAuthClient } from "@neondatabase/auth/next";
+import { NOT_INVITED, SegmentStreamApiError } from "../errors.js";
+import type { CurrentUser } from "../me.js";
+/** The Neon Auth API the app serves from `app/src/app/api/auth/[...path]/route.ts`. */
+export declare const AUTH_API_PATH = "/api/auth";
+/** The app's sign-in page. */
+export declare const SIGN_IN_PAGE = "/sign-in";
+export { NOT_INVITED };
+/** The person Neon Auth has signed in, before the ontology is asked about them. */
+export interface SessionUser {
+    readonly id: string;
+    readonly email: string | null;
+    readonly name: string | null;
+}
+export type SessionState = {
+    readonly status: "loading";
+} | {
+    readonly status: "signed-out";
+    readonly source?: "oidc";
+} | {
+    readonly status: "signed-in";
+    readonly sessionId: string;
+    readonly user: SessionUser;
+    readonly source?: "channel" | "oidc";
+    readonly expiresAt?: string;
+} | {
+    readonly status: "unavailable";
+    readonly source?: "oidc";
+};
+/** `useUser()`: the `/api/ontology/me` answer for the session, loaded once per session. */
+export type UserState = {
+    readonly status: "loading";
+    readonly user: null;
+    readonly error: null;
+} | {
+    readonly status: "signed-out";
+    readonly user: null;
+    readonly error: null;
+} | {
+    readonly status: "signed-in";
+    readonly user: CurrentUser;
+    readonly error: null;
+} | {
+    readonly status: "error";
+    readonly user: null;
+    readonly error: SegmentStreamApiError;
+};
+interface Snapshot {
+    readonly session: SessionState;
+    /** `/me` answers by Neon Auth session id. */
+    readonly users: ReadonlyMap<string, UserState>;
+}
+export declare const LOADING_USER: UserState;
+export declare const SIGNED_OUT_USER: UserState;
+export declare function sessionWasEnded(): boolean;
+/** The Neon Auth browser client, created on first use. It talks to the app's `/api/auth`. */
+export declare function authClient(): ReturnType<typeof createAuthClient>;
+export declare function subscribe(listener: () => void): () => void;
+export declare function getSnapshot(): Snapshot;
+export declare function getServerSnapshot(): Snapshot;
+/** Reads the session again, after signing in or out. */
+export declare function refreshSession(): Promise<void>;
+/** Forgets the session and every `/me` answer, after signing out. */
+export declare function clearSession(): void;
+/** Ends the selected authentication session before any browser state is cleared. */
+export declare function endBrowserSession(): Promise<void>;
+export interface AppSignInConfiguration {
+    readonly enabled: boolean;
+    readonly neon: boolean;
+    readonly channels: Readonly<Record<string, boolean>>;
+    readonly browser?: {
+        readonly methods: readonly ("email" | "segmentstream")[];
+        readonly primary: "email" | "segmentstream";
+        readonly auto_redirect: boolean;
+    } | null;
+}
+/** Public, non-secret app opt-ins from the existing SDK handlers. No provider is enabled by default. */
+export declare function appSignInConfiguration(): Promise<AppSignInConfiguration | null>;
+/** Starts loading `/me` for a session unless it is loaded or loading. */
+export declare function ensureUser(sessionId: string, source?: "channel" | "oidc"): void;