@segmentstream/app 0.0.0-stage → 0.38.0

package/dist/app.js

@@ -0,0 +1,434 @@
+import { createBrowserConfigurationCheck, resolveBrowserRevision } from "./browser-revision.js";
+import { createNeonAuth } from "@neondatabase/auth/next/server";
+import { deploymentFromEnv, DeploymentAdmissionError, requireDeploymentCapability, } from "./deployment.js";
+import { redirect } from "next/navigation";
+import { NextResponse } from "next/server";
+import { environmentValue, hasChannelApps, processEnvironment, resolveConfig, resolveNeonAuth, resolveBrowserAuth, } from "./config.js";
+import { createAgentIdentities } from "./agent.js";
+import { channelAppFraming } from "./telegram.js";
+import { withTelegramLaunch } from "./telegram-launch.js";
+import { createChannelSession } from "./channel-session.js";
+import { createDataClient } from "./data.js";
+import { withUnframeablePages } from "./decision-pages.js";
+import { SegmentStreamApiError } from "./errors.js";
+import { createHandlers } from "./handlers.js";
+import { createNeonSession } from "./neon.js";
+import { createAgentAuthorizations } from "./oauth.js";
+import { createOntologyClient } from "./ontology.js";
+import { createOntologyTransport } from "./ontology-transport.js";
+import { createProxy, matchesPathPrefix, normalizePublicPath, wellKnownResponse } from "./proxy.js";
+import { revisionUnavailableResponse, SDK_ROUTE_PREFIX } from "./sign-in.js";
+import { createServerSession } from "./server.js";
+import { createSessionClient } from "./sessions.js";
+import { withFederation } from "./federation.js";
+import { createTokenVerifier, remoteKeySet } from "./tokens.js";
+const NEON_AUTH_NOT_CONFIGURED = "email_sign_in_disabled";
+export function createApp(config, dependencies = {}) {
+    const environment = dependencies.environment ?? processEnvironment();
+    const deployment = deploymentFromEnv(environment);
+    const resolved = resolveConfig(deployment.target === "preview" ? { ...config, channels: undefined } : config, environment);
+    const browserAuth = resolveBrowserAuth(environment);
+    const neonAuth = browserAuth && !browserAuth.browser.methods.includes("email")
+        ? null
+        : resolveNeonAuth(environment);
+    if (!browserAuth &&
+        deployment.target === "preview" &&
+        (!neonAuth || !neonAuth.cookieSecret || neonAuth.cookieSecret.length < 32)) {
+        throw new DeploymentAdmissionError("preview_configuration_invalid");
+    }
+    if (browserAuth?.browser.methods.includes("email") && !neonAuth)
+        throw new Error("browser_auth_provider_unavailable");
+    const keySet = dependencies.keySet ?? remoteKeySet(resolved.baseUrl);
+    const rawFetch = dependencies.fetch ?? ((input, init) => fetch(input, init));
+    const fetchImplementation = async (input, init) => {
+        requireDeploymentCapability(deployment, undefined, (dependencies.now ?? Date.now)());
+        return rawFetch(input, init);
+    };
+    const sessionClient = createSessionClient(resolved, fetchImplementation);
+    const issuer = environmentValue(environment, "SEGMENTSTREAM_OIDC_ISSUER");
+    const clientId = environmentValue(environment, "SEGMENTSTREAM_OIDC_CLIENT_ID");
+    const browserRevision = browserAuth ? resolveBrowserRevision(environment, issuer) : undefined;
+    const withChannelLaunch = (app) => ({
+        ...app,
+        proxy: (options) => withTelegramLaunch(app.proxy(options), resolved.channels, options),
+    });
+    const emailOnly = (app) => {
+        if (!browserAuth)
+            return app;
+        const verify = createBrowserConfigurationCheck(fetchImplementation, browserAuth, browserRevision, environmentValue(environment, "SEGMENTSTREAM_ONTOLOGY_URL"));
+        const guardAuthHandler = (handler) => async (request, context) => {
+            try {
+                await verify();
+            }
+            catch (cause) {
+                return revisionUnavailableResponse(request, cause);
+            }
+            return handler(request, context);
+        };
+        return {
+            ...app,
+            authHandlers: () => {
+                const handlers = app.authHandlers();
+                return {
+                    GET: guardAuthHandler(handlers.GET),
+                    POST: guardAuthHandler(handlers.POST),
+                    PUT: guardAuthHandler(handlers.PUT),
+                    DELETE: guardAuthHandler(handlers.DELETE),
+                    PATCH: guardAuthHandler(handlers.PATCH),
+                };
+            },
+            getUser: async (options) => {
+                await verify();
+                return app.getUser(options);
+            },
+            requireUser: async (options) => {
+                await verify();
+                return app.requireUser(options);
+            },
+            can: async (permission, options) => {
+                await verify();
+                return app.can(permission, options);
+            },
+            proxy: (options) => async (request) => {
+                try {
+                    await verify();
+                }
+                catch (cause) {
+                    return revisionUnavailableResponse(request, cause);
+                }
+                return app.proxy(options)(request);
+            },
+            handlers: () => ({
+                ...app.handlers(),
+                GET: async (request) => {
+                    try {
+                        await verify();
+                    }
+                    catch (cause) {
+                        return revisionUnavailableResponse(request, cause);
+                    }
+                    if (request.nextUrl.pathname === `${SDK_ROUTE_PREFIX}/configuration`)
+                        return NextResponse.json({
+                            enabled: false,
+                            neon: true,
+                            channels: resolved.channels ?? {},
+                            browser: browserAuth.browser,
+                        }, { headers: { "cache-control": "no-store" } });
+                    return app.handlers().GET(request);
+                },
+                POST: async (request) => {
+                    try {
+                        await verify();
+                    }
+                    catch (cause) {
+                        return revisionUnavailableResponse(request, cause);
+                    }
+                    return app.handlers().POST(request);
+                },
+            }),
+        };
+    };
+    const federated = (app, proofTransport, identityToken, channelSession) => {
+        if (!browserAuth && deployment.target === "preview") {
+            return previewApp(app, deployment, dependencies.now ?? Date.now);
+        }
+        if (browserAuth?.browser.methods.includes("segmentstream") && (!issuer || !clientId)) {
+            throw new Error("browser_auth_provider_unavailable");
+        }
+        if (browserAuth && !browserAuth.browser.methods.includes("segmentstream"))
+            return withChannelLaunch(emailOnly(app));
+        if (!issuer && !clientId) {
+            return withChannelLaunch(app);
+        }
+        if (!issuer || !clientId) {
+            throw new Error("SEGMENTSTREAM_OIDC_ISSUER and SEGMENTSTREAM_OIDC_CLIENT_ID must be configured together.");
+        }
+        const federatedApp = withChannelLaunch(withFederation(app, resolved, { issuer, clientId }, {
+            fetch: fetchImplementation,
+            browserAuth,
+            browserRevision,
+            ontologyUrl: environmentValue(environment, "SEGMENTSTREAM_ONTOLOGY_URL"),
+            neon: neonAuth !== null,
+            proofTransport,
+            identityToken,
+            channelSession,
+        }));
+        return deployment.target === "preview"
+            ? previewApp(federatedApp, deployment, dependencies.now ?? Date.now, true)
+            : federatedApp;
+    };
+    const context = {
+        config: resolved,
+        verifyToken: createTokenVerifier(resolved, keySet),
+        requestToken: sessionClient.requestToken,
+        revokeSession: sessionClient.revoke,
+    };
+    const legacy = createServerSession(context);
+    const getAppCredential = () => environmentValue(environment, "SEGMENTSTREAM_APP_CREDENTIAL");
+    if (neonAuth === null) {
+        const data = createDataClient({
+            config: resolved,
+            fetch: fetchImplementation,
+            getAccessToken: legacy.getAccessToken,
+            getAppCredential,
+        });
+        const ontologyUrl = environmentValue(environment, "SEGMENTSTREAM_ONTOLOGY_URL");
+        const channel = createChannelSession({
+            enabled: hasChannelApps(resolved.channels),
+            workspaceId: resolved.workspaceId,
+            ontologyUrl,
+            fetch: fetchImplementation,
+        });
+        const getChannelUser = async () => {
+            const session = await channel.read();
+            return session
+                ? {
+                    ...session.user,
+                    email: session.user.email ?? undefined,
+                    name: session.user.name ?? undefined,
+                    organizationId: resolved.organizationId,
+                    workspaceId: resolved.workspaceId,
+                }
+                : null;
+        };
+        const getUser = async () => (await getChannelUser()) ?? legacy.getUser();
+        // @legacy app.legacy-segmentstream-sign-in
+        // The ontology service accepts SegmentStream app tokens while workspaces move to Neon Auth.
+        const ontologyTransport = createOntologyTransport({
+            fetch: fetchImplementation,
+            ontologyUrl: ontologyUrl === undefined ? undefined : new URL(ontologyUrl).origin,
+            credentials: { token: async () => (await channel.read())?.token ?? legacy.getAccessToken() },
+        });
+        return federated({
+            authentication: "segmentstream",
+            deployment,
+            proxy: (options) => {
+                const primaryProxy = createProxy(context, options);
+                const publicPaths = [SDK_ROUTE_PREFIX, ...(options?.publicPaths ?? [])].map(normalizePublicPath);
+                return withUnframeablePages(async (request) => {
+                    const discovery = wellKnownResponse(request, ontologyUrl);
+                    if (discovery !== undefined) {
+                        return discovery;
+                    }
+                    if (request.nextUrl.pathname.startsWith("/api/ontology/")) {
+                        return ontologyUrl
+                            ? NextResponse.rewrite(new URL(`${request.nextUrl.pathname}${request.nextUrl.search}`, ontologyUrl))
+                            : NextResponse.next();
+                    }
+                    if (hasChannelApps(resolved.channels) && request.nextUrl.pathname === "/sign-in") {
+                        return NextResponse.next();
+                    }
+                    if (publicPaths.some((path) => matchesPathPrefix(request.nextUrl.pathname, path))) {
+                        return primaryProxy(request);
+                    }
+                    const response = (await channel.proxy(request)) ?? (await primaryProxy(request));
+                    if (hasChannelApps(resolved.channels) &&
+                        response.headers.has("location") &&
+                        !request.nextUrl.pathname.startsWith("/api/")) {
+                        const destination = new URL("/sign-in", request.url);
+                        destination.searchParams.set("returnTo", request.nextUrl.pathname + request.nextUrl.search);
+                        response.headers.set("location", destination.href);
+                    }
+                    return response;
+                }, channelAppFraming(resolved.channels));
+            },
+            authHandlers: notConfiguredHandlers,
+            handlers: () => createHandlers(context),
+            getUser,
+            requireUser: async () => {
+                if (!hasChannelApps(resolved.channels) && !(await channel.token())) {
+                    return legacy.requireUser();
+                }
+                const user = await getUser();
+                if (!user) {
+                    redirect("/sign-in");
+                }
+                return user;
+            },
+            can: async () => false,
+            signOut: async (options) => {
+                await channel.signOut();
+                return legacy.signOut(options);
+            },
+            getAccessToken: legacy.getAccessToken,
+            fetch: data.fetch,
+            warehouse: data.warehouse,
+            jobs: data.jobs,
+            ontology: createOntologyClient(ontologyTransport),
+            oauth: createAgentAuthorizations(ontologyTransport),
+            agent: createAgentIdentities(ontologyTransport),
+        }, undefined, undefined, { getUser: getChannelUser, signOut: channel.signOut, transport: channel.transport });
+    }
+    const neon = createNeonSession({
+        config: resolved,
+        settings: neonAuth,
+        createNeonAuth: dependencies.createNeonAuth ?? createNeonAuth,
+        fetch: fetchImplementation,
+        now: dependencies.now ?? Date.now,
+    });
+    const data = createDataClient({
+        config: resolved,
+        fetch: fetchImplementation,
+        getAccessToken: noSegmentStreamSession,
+        getAppCredential,
+    });
+    return federated({
+        authentication: "neon-auth",
+        deployment,
+        proxy: (options) => withUnframeablePages(neon.proxy(options), channelAppFraming(resolved.channels)),
+        authHandlers: neon.authHandlers,
+        handlers: () => createHandlers(context, { neon: true }),
+        getUser: neon.getUser,
+        requireUser: neon.requireUser,
+        can: neon.can,
+        signOut: neon.signOut,
+        getAccessToken: async () => null,
+        fetch: data.fetch,
+        warehouse: data.warehouse,
+        jobs: data.jobs,
+        ontology: createOntologyClient(neon.ontologyTransport),
+        oauth: createAgentAuthorizations(neon.ontologyTransport),
+        agent: createAgentIdentities(neon.ontologyTransport),
+    }, neon.ontologyTransport, neon.identityToken);
+}
+/** Guard every server method, including clients captured before the preview expires. */
+function previewApp(app, deployment, now, federationEnabled = false) {
+    const admit = (capability) => requireDeploymentCapability(deployment, capability, now());
+    const guarded = (client, capability) => new Proxy(client, {
+        get(target, key, receiver) {
+            const value = Reflect.get(target, key, receiver);
+            if (value && typeof value === "object")
+                return guarded(value, capability);
+            if (typeof value !== "function")
+                return value;
+            return (...args) => {
+                try {
+                    admit(capability);
+                }
+                catch (error) {
+                    return Promise.reject(error);
+                }
+                const result = Reflect.apply(value, target, args);
+                return result && typeof result === "object" && !(result instanceof Promise)
+                    ? guarded(result)
+                    : result;
+            };
+        },
+    });
+    const refusal = (error) => NextResponse.json({ error: error.code, ...(error.capability ? { capability: error.capability } : {}) }, { status: error.status, headers: { "cache-control": "no-store" } });
+    const authHandlers = () => Object.fromEntries(Object.entries(app.authHandlers()).map(([method, handler]) => [
+        method,
+        async (...args) => {
+            try {
+                admit();
+            }
+            catch (error) {
+                return refusal(error);
+            }
+            return handler(...args);
+        },
+    ]));
+    const deniedLegacy = async () => {
+        try {
+            admit();
+        }
+        catch (error) {
+            return refusal(error);
+        }
+        return refusal(new DeploymentAdmissionError("preview_authentication_unavailable"));
+    };
+    const server = guarded(app);
+    const deniedAgentHandler = async () => {
+        try {
+            admit("agents");
+        }
+        catch (error) {
+            return refusal(error);
+        }
+        return refusal(new DeploymentAdmissionError("preview_capability_unavailable", "agents"));
+    };
+    return {
+        ...app,
+        getUser: server.getUser,
+        requireUser: server.requireUser,
+        can: server.can,
+        signOut: server.signOut,
+        getAccessToken: server.getAccessToken,
+        fetch: async () => {
+            admit();
+            throw new DeploymentAdmissionError("preview_authentication_unavailable");
+        },
+        warehouse: guarded(app.warehouse),
+        jobs: guarded(app.jobs, "pipelineRuns"),
+        ontology: guarded(app.ontology),
+        oauth: {
+            ...guarded(app.oauth, "agents"),
+            consentHandler: () => ({ POST: deniedAgentHandler }),
+        },
+        agent: {
+            ...guarded(app.agent, "agents"),
+            connectHandler: () => ({ POST: deniedAgentHandler }),
+        },
+        authHandlers,
+        handlers: () => federationEnabled
+            ? {
+                GET: async (request) => {
+                    try {
+                        admit();
+                    }
+                    catch (error) {
+                        return refusal(error);
+                    }
+                    return app.handlers().GET(request);
+                },
+                POST: async (request) => {
+                    try {
+                        admit();
+                    }
+                    catch (error) {
+                        return refusal(error);
+                    }
+                    return app.handlers().POST(request);
+                },
+            }
+            : {
+                GET: async (request) => {
+                    if (request.nextUrl.pathname === `${SDK_ROUTE_PREFIX}/configuration`) {
+                        try {
+                            admit();
+                        }
+                        catch (error) {
+                            return refusal(error);
+                        }
+                        return NextResponse.json({ enabled: false, neon: true, channels: {}, deployment }, { headers: { "cache-control": "no-store" } });
+                    }
+                    return deniedLegacy();
+                },
+                POST: deniedLegacy,
+            },
+        proxy: (options) => {
+            const proxy = app.proxy(options);
+            return async (request) => {
+                try {
+                    admit();
+                }
+                catch (error) {
+                    return refusal(error);
+                }
+                return proxy(request);
+            };
+        },
+    };
+}
+/** Under Neon Auth the app has no SegmentStream session to call the API with. */
+async function noSegmentStreamSession() {
+    throw new SegmentStreamApiError({
+        code: "app_credential_missing",
+        status: 401,
+        detail: "Apps that sign in with Neon Auth have no SegmentStream session. Warehouse queries and opted-in job runs need SEGMENTSTREAM_APP_CREDENTIAL, which SegmentStream sets on deploy. Generic fetch requires a legacy SegmentStream session.",
+    });
+}
+function notConfiguredHandlers() {
+    const handler = async () => NextResponse.json({ error: "neon_auth_not_configured", detail: NEON_AUTH_NOT_CONFIGURED }, { status: 404, headers: { "cache-control": "no-store" } });
+    return { GET: handler, POST: handler, PUT: handler, DELETE: handler, PATCH: handler };
+}

package/dist/browser-auth-capability.d.ts

@@ -0,0 +1,2 @@
+/** Deployment capability for source-declared browser authentication; not an SDK version. */
+export declare const browserAuthCapability: 1;

package/dist/browser-auth-capability.js

@@ -0,0 +1,2 @@
+/** Deployment capability for source-declared browser authentication; not an SDK version. */
+export const browserAuthCapability = 1;

package/dist/browser-revision.d.ts

@@ -0,0 +1,19 @@
+import type { BrowserAuthBinding, Environment } from "./config.js";
+import { SegmentStreamApiError } from "./errors.js";
+import type { Fetch } from "./sessions.js";
+export interface BrowserRevision {
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly deploymentId?: string;
+}
+export declare function resolveBrowserRevision(environment: Environment, fallbackIssuer?: string): BrowserRevision;
+export interface BrowserRevisionAdmission {
+    /** Only Cloud may authorize reconciling this revision with another exact manifest. */
+    readonly compatibleManifestDigest?: string;
+    readonly validUntil?: number;
+}
+export declare function deploymentRefreshRequired(): SegmentStreamApiError;
+/** Share in-flight reads only. A warm process must not extend a retiring revision's deadline. */
+export declare function createBrowserRevisionCheck(fetcher: Fetch, binding: BrowserAuthBinding, revision: BrowserRevision): () => Promise<BrowserRevisionAdmission>;
+/** Reconcile only with the exact live manifest Cloud admitted for this immutable client. */
+export declare function createBrowserConfigurationCheck(fetcher: Fetch, binding: BrowserAuthBinding, revision: BrowserRevision, ontologyUrl?: string): () => Promise<void>;

package/dist/browser-revision.js

@@ -0,0 +1,140 @@
+import { environmentValue } from "./config.js";
+import { apiErrorFrom, SegmentStreamApiError } from "./errors.js";
+import { ontologyOrigin } from "./ontology-transport.js";
+export function resolveBrowserRevision(environment, fallbackIssuer) {
+    const clientId = environmentValue(environment, "SEGMENTSTREAM_BROWSER_AUTH_REVISION_CLIENT_ID");
+    const issuer = environmentValue(environment, "SEGMENTSTREAM_BROWSER_AUTH_REVISION_ISSUER") ?? fallbackIssuer;
+    if (!clientId || !issuer)
+        throw new Error("browser_auth_revision_binding_missing");
+    const url = new URL(issuer);
+    if (url.protocol !== "https:" ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        issuer.endsWith("/"))
+        throw new Error("browser_auth_revision_binding_invalid");
+    const deploymentId = environment.SEGMENTSTREAM_BROWSER_AUTH_ENVIRONMENT === "local"
+        ? undefined
+        : environmentValue(environment, "SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID");
+    if (!deploymentId && environment.SEGMENTSTREAM_BROWSER_AUTH_ENVIRONMENT !== "local")
+        throw new Error("browser_auth_revision_binding_missing");
+    return { issuer, clientId, ...(deploymentId ? { deploymentId } : {}) };
+}
+export function deploymentRefreshRequired() {
+    return new SegmentStreamApiError({
+        code: "deployment_refresh_required",
+        status: 409,
+        detail: "deployment_refresh_required",
+        retryable: false,
+    });
+}
+/** Share in-flight reads only. A warm process must not extend a retiring revision's deadline. */
+export function createBrowserRevisionCheck(fetcher, binding, revision) {
+    let pending;
+    return () => {
+        if (!pending) {
+            const started = Date.now();
+            const check = (async () => {
+                try {
+                    const endpoint = new URL(`${revision.issuer}/revision-status`);
+                    endpoint.search = new URLSearchParams({
+                        client_id: revision.clientId,
+                        manifest_digest: binding.manifest_digest,
+                        ...(revision.deploymentId ? { deployment_id: revision.deploymentId } : {}),
+                    }).toString();
+                    const response = await fetcher(endpoint, {
+                        redirect: "error",
+                        cache: "no-store",
+                        signal: AbortSignal.timeout(4000),
+                    });
+                    const body = (await response.json());
+                    if (!response.ok) {
+                        throw apiErrorFrom(response.status, body, "browser_auth_revision_unavailable");
+                    }
+                    if (typeof body.active !== "boolean")
+                        throw new Error("revision_status_invalid");
+                    if (body.valid_until !== undefined &&
+                        (typeof body.valid_until !== "number" || !Number.isFinite(body.valid_until))) {
+                        throw new Error("revision_status_invalid");
+                    }
+                    if (body.compatible_manifest_digest !== undefined &&
+                        (typeof body.compatible_manifest_digest !== "string" ||
+                            !body.compatible_manifest_digest ||
+                            typeof body.valid_until !== "number" ||
+                            !Number.isFinite(body.valid_until))) {
+                        throw new Error("revision_status_invalid");
+                    }
+                    if (!body.active ||
+                        (typeof body.valid_until === "number" && body.valid_until <= Date.now())) {
+                        throw deploymentRefreshRequired();
+                    }
+                    if (Date.now() - started >= 4000)
+                        throw new Error("revision_status_expired");
+                    return {
+                        ...(typeof body.compatible_manifest_digest === "string"
+                            ? { compatibleManifestDigest: body.compatible_manifest_digest }
+                            : {}),
+                        ...(typeof body.valid_until === "number" ? { validUntil: body.valid_until } : {}),
+                    };
+                }
+                catch (cause) {
+                    if (cause instanceof SegmentStreamApiError)
+                        throw cause;
+                    throw new SegmentStreamApiError({
+                        code: "browser_auth_revision_unavailable",
+                        status: 503,
+                        detail: "browser_auth_revision_unavailable",
+                        retryable: true,
+                        cause,
+                    });
+                }
+            })();
+            pending = check;
+            const forget = () => {
+                if (pending === check)
+                    pending = undefined;
+            };
+            void check.then(forget, forget);
+        }
+        return pending;
+    };
+}
+/** Reconcile only with the exact live manifest Cloud admitted for this immutable client. */
+export function createBrowserConfigurationCheck(fetcher, binding, revision, ontologyUrl) {
+    const admitted = createBrowserRevisionCheck(fetcher, binding, revision);
+    return async () => {
+        const admission = await admitted();
+        let response;
+        let live;
+        try {
+            response = await fetcher(`${await ontologyOrigin(ontologyUrl)}/api/ontology/federation/configuration`, { cache: "no-store", redirect: "error", signal: AbortSignal.timeout(10000) });
+            live = (await response.json());
+        }
+        catch (cause) {
+            throw new SegmentStreamApiError({
+                code: "browser_auth_configuration_unavailable",
+                status: 503,
+                detail: "browser_auth_configuration_unavailable",
+                retryable: true,
+                cause,
+            });
+        }
+        if (!response.ok) {
+            throw apiErrorFrom(response.status, live, "browser_auth_configuration_unavailable");
+        }
+        if ((admission.validUntil !== undefined && admission.validUntil <= Date.now()) ||
+            live?.version !== binding.version ||
+            typeof live.manifest_digest !== "string" ||
+            !live.manifest_digest ||
+            (live.manifest_digest !== binding.manifest_digest &&
+                (admission.compatibleManifestDigest === undefined ||
+                    live.manifest_digest !== admission.compatibleManifestDigest)) ||
+            live.browser?.primary !== binding.browser.primary ||
+            live.browser?.auto_redirect !== binding.browser.auto_redirect ||
+            JSON.stringify(live.browser?.methods) !== JSON.stringify(binding.browser.methods) ||
+            live.browser?.local?.port !== binding.browser.local?.port) {
+            throw deploymentRefreshRequired();
+        }
+    };
+}

package/dist/channel-protocol.d.ts

@@ -0,0 +1,16 @@
+/** Browser-safe wire protocol shared by the ontology service and app SDK. */
+export declare const CHANNEL_SESSION_PATH = "/api/ontology/session";
+export declare const CHANNEL_LOGOUT_PATH = "/api/ontology/sign-in/logout";
+export declare const CHANNEL_SESSION_TTL_SECONDS = 3600;
+export declare const channelSignInPath: (provider: string) => string;
+export declare const channelClientId: (provider: string) => string;
+export declare const channelCookieName: (workspaceId: string) => string;
+export declare const CHANNEL_COOKIE_PATTERN: RegExp;
+export declare const channelCookieAttributes: {
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: "none";
+    partitioned: boolean;
+    path: string;
+};
+export declare const channelCookie: (name: string, token: string, maxAge: number) => string;

package/dist/channel-protocol.js

@@ -0,0 +1,17 @@
+// Generated from packages/ontology-sdk/src/channel-session.ts; do not edit.
+/** Browser-safe wire protocol shared by the ontology service and app SDK. */
+export const CHANNEL_SESSION_PATH = "/api/ontology/session";
+export const CHANNEL_LOGOUT_PATH = "/api/ontology/sign-in/logout";
+export const CHANNEL_SESSION_TTL_SECONDS = 3600;
+export const channelSignInPath = (provider) => `/api/ontology/sign-in/${encodeURIComponent(provider)}`;
+export const channelClientId = (provider) => `${provider}-mini-app`;
+export const channelCookieName = (workspaceId) => `__Host-ss_channel_session.${workspaceId.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+export const CHANNEL_COOKIE_PATTERN = /^__Host-ss_channel_session\.[A-Za-z0-9_-]+$/;
+export const channelCookieAttributes = {
+    httpOnly: true,
+    secure: true,
+    sameSite: "none",
+    partitioned: true,
+    path: "/",
+};
+export const channelCookie = (name, token, maxAge) => `${name}=${token}; HttpOnly; Secure; SameSite=None; Partitioned; Path=/; Max-Age=${maxAge}`;

package/dist/channel-session.d.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { type CurrentUser } from "./me.js";
+import type { Fetch } from "./sessions.js";
+export { channelCookieName } from "./channel-protocol.js";
+export interface ChannelSessionIdentity {
+    readonly token: string;
+    readonly user: CurrentUser;
+}
+/** Workspace-owned opaque app sessions; every discovery checks current membership and revocation. */
+export declare function createChannelSession(options: {
+    readonly enabled?: boolean;
+    readonly workspaceId: string;
+    readonly ontologyUrl: string | undefined;
+    readonly fetch: Fetch;
+}): {
+    token: () => Promise<string | null>;
+    transport: import("./ontology.js").OntologyTransport;
+    read: () => Promise<ChannelSessionIdentity | null>;
+    signOut: () => Promise<void>;
+    proxy: (request: NextRequest) => Promise<NextResponse | undefined>;
+};