@segmentstream/app 0.0.0-stage → 0.38.1

package/dist/storage.d.ts

@@ -0,0 +1,79 @@
+import type { OntologyTransport } from "./ontology.js";
+export interface BlobUploadTicket {
+    readonly uploadId: string;
+}
+export interface FileRevision {
+    readonly id: string;
+    readonly filename: string;
+    readonly contentType: string;
+    readonly size: number;
+    readonly createdAt: string;
+}
+export interface FileTransfer {
+    readonly url: string;
+    readonly method: "GET" | "PUT";
+    readonly headers: Readonly<Record<string, string>>;
+    readonly expiresAt: string;
+}
+export interface FileDownloadOptions {
+    /** A retained revision of this record's blob property; omitted for the current file. */
+    readonly revisionId?: string;
+    /** Request inline display when the ontology's content-type policy permits it. */
+    readonly inline?: boolean;
+    readonly signal?: AbortSignal;
+}
+export interface FileUploadTarget {
+    readonly entity: string;
+    readonly property: string;
+    readonly action: string;
+    readonly recordId?: string;
+    readonly createIntent?: string;
+}
+export interface UploadSession {
+    readonly id: string;
+    readonly state: string;
+    readonly expiresAt: string;
+    readonly ticket?: BlobUploadTicket;
+}
+export interface OpenUploadSession extends UploadSession {
+    readonly filename: string;
+    readonly contentType: string;
+    readonly size: number;
+    readonly entity: string;
+    readonly property: string;
+    readonly action: string;
+    readonly recordId: string | null;
+    readonly createIntent: string | null;
+    readonly createdAt: string;
+    /** The bytes are uploaded; a record-saving action must still consume the ticket. */
+    readonly awaitingAction: boolean;
+}
+export interface OpenUploadSessions {
+    readonly uploads: ReadonlyArray<OpenUploadSession>;
+    readonly pending: number;
+    readonly max: number;
+}
+export interface FileUploadOptions {
+    readonly signal?: AbortSignal;
+    /** Reuse this UUID when retrying an upload and its entity action. */
+    readonly idempotencyKey?: string;
+    /** Reports transfer start and completion; supply a transfer adapter for granular progress. */
+    readonly onProgress?: (transferred: number, total: number) => void;
+    /** Keep the ID as soon as it exists, including when a later transfer fails. */
+    readonly onSession?: (session: UploadSession) => void;
+}
+/** Portable client: ontology requests use the member transport; bytes use only a scoped grant. */
+export declare function createBlobStorageClient(transport: OntologyTransport, transfer?: typeof fetch): {
+    list(signal?: AbortSignal): Promise<OpenUploadSessions>;
+    status: (id: string, signal?: AbortSignal) => Promise<UploadSession>;
+    cancel: (id: string) => Promise<UploadSession>;
+    uploadForAction(target: FileUploadTarget, file: File, options?: FileUploadOptions): Promise<{
+        upload: UploadSession;
+        ticket: BlobUploadTicket;
+        options: {
+            createIntent?: string | undefined;
+            idempotencyKey: string;
+        };
+    }>;
+    download(entity: string, recordId: string, property: string, options?: FileDownloadOptions): Promise<FileTransfer>;
+};

package/dist/storage.js

@@ -0,0 +1,180 @@
+import { apiErrorFrom, readJson } from "./errors.js";
+import { toSnakeCase } from "./ontology-names.js";
+function waitForGrantRetry(delay, signal) {
+    signal?.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", abort);
+            reject(signal?.reason);
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", abort);
+            resolve();
+        }, delay);
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}
+/** Portable client: ontology requests use the member transport; bytes use only a scoped grant. */
+export function createBlobStorageClient(transport, transfer = globalThis.fetch) {
+    const send = async (path, method, body, signal, retryGrant = false) => {
+        for (let attempt = 0;; attempt++) {
+            signal?.throwIfAborted();
+            const response = await transport.fetch(path, {
+                method,
+                ...(body === undefined
+                    ? {}
+                    : { headers: { "content-type": "application/json" }, body: JSON.stringify(body) }),
+                ...(signal ? { signal } : {}),
+            });
+            const data = await readJson(response);
+            if (!response.ok) {
+                const error = apiErrorFrom(response.status, data, "The ontology service rejected the file request.");
+                const retryAfter = response.headers.get("retry-after");
+                const seconds = Number(retryAfter);
+                const delay = retryAfter === null
+                    ? 500 * 2 ** attempt
+                    : Number.isFinite(seconds)
+                        ? Math.max(0, seconds * 1000)
+                        : Date.parse(retryAfter) - Date.now();
+                if (retryGrant &&
+                    attempt < 2 &&
+                    error.retryable &&
+                    [429, 502, 503, 504].includes(response.status) &&
+                    Number.isFinite(delay) &&
+                    delay >= 0 &&
+                    delay <= 5000) {
+                    await waitForGrantRetry(delay, signal);
+                    continue;
+                }
+                throw error;
+            }
+            return data;
+        }
+    };
+    const sessionPath = (id) => `/uploads/${encodeURIComponent(id)}`;
+    const readSession = async (path, method, body, signal) => {
+        const { expires_at, ticket, ...session } = await send(path, method, body, signal);
+        return {
+            ...session,
+            expiresAt: expires_at,
+            ...(ticket ? { ticket: { uploadId: ticket.upload_id } } : {}),
+        };
+    };
+    const readTransfer = async (path, body, signal, retryGrant = false) => {
+        const { expires_at, ...grant } = await send(path, "POST", body, signal, retryGrant);
+        return { ...grant, expiresAt: expires_at };
+    };
+    const cancel = (id) => readSession(`${sessionPath(id)}/cancel`, "POST");
+    return {
+        async list(signal) {
+            const page = await send("/uploads", "GET", undefined, signal);
+            return {
+                pending: page.pending,
+                max: page.max,
+                uploads: page.uploads.map((upload) => ({
+                    id: upload.id,
+                    state: upload.state,
+                    filename: upload.filename,
+                    contentType: upload.content_type,
+                    size: upload.size,
+                    entity: upload.entity,
+                    property: upload.property,
+                    action: upload.action,
+                    recordId: upload.record_id,
+                    createIntent: upload.create_intent,
+                    createdAt: upload.created_at,
+                    expiresAt: upload.expires_at,
+                    awaitingAction: upload.awaiting_action,
+                })),
+            };
+        },
+        status: (id, signal) => readSession(sessionPath(id), "GET", undefined, signal),
+        cancel,
+        async uploadForAction(target, file, options = {}) {
+            const idempotencyKey = options.idempotencyKey ?? crypto.randomUUID();
+            const createIntent = target.recordId ? undefined : (target.createIntent ?? idempotencyKey);
+            const session = await readSession("/uploads", "POST", {
+                entity: toSnakeCase(target.entity),
+                property: toSnakeCase(target.property),
+                action: toSnakeCase(target.action),
+                ...(target.recordId ? { record_id: target.recordId } : {}),
+                ...(createIntent ? { create_intent: createIntent } : {}),
+                idempotency_key: idempotencyKey,
+                filename: file.name,
+                content_type: file.type || "application/octet-stream",
+                size: file.size,
+            }, options.signal);
+            options.onSession?.(session);
+            if (session.ticket) {
+                return {
+                    upload: session,
+                    ticket: session.ticket,
+                    options: { idempotencyKey, ...(createIntent ? { createIntent } : {}) },
+                };
+            }
+            let completionStarted = false;
+            let transferRejected = false;
+            try {
+                if (session.state !== "completing") {
+                    const grant = await readTransfer(`${sessionPath(session.id)}/parts`, undefined, options.signal);
+                    options.onProgress?.(0, file.size);
+                    const response = await transfer(grant.url, {
+                        method: grant.method,
+                        headers: grant.headers,
+                        body: file,
+                        signal: options.signal,
+                        credentials: "omit",
+                        referrerPolicy: "no-referrer",
+                    });
+                    if (!response.ok) {
+                        transferRejected = true;
+                        throw new Error(`File transfer failed (${response.status}).`);
+                    }
+                    options.onProgress?.(file.size, file.size);
+                }
+                completionStarted = true;
+                const completed = await readSession(`${sessionPath(session.id)}/complete`, "POST", undefined, options.signal);
+                if (!completed.ticket) {
+                    throw new Error("The file upload is not ready.");
+                }
+                options.onSession?.(completed);
+                return {
+                    upload: completed,
+                    ticket: completed.ticket,
+                    options: { idempotencyKey, ...(createIntent ? { createIntent } : {}) },
+                };
+            }
+            catch (error) {
+                if (options.signal?.aborted || transferRejected) {
+                    // Deliberate cancellation uses a fresh request even when the signal was aborted.
+                    await cancel(session.id).catch((cause) => {
+                        console.warn("ontology.upload.cancel_failed", { uploadId: session.id, cause });
+                    });
+                }
+                else if (completionStarted) {
+                    // A lost completion response may already have produced a valid ticket.
+                    const recovered = await readSession(sessionPath(session.id), "GET").catch(() => undefined);
+                    if (recovered?.ticket) {
+                        options.onSession?.(recovered);
+                        return {
+                            upload: recovered,
+                            ticket: recovered.ticket,
+                            options: { idempotencyKey, ...(createIntent ? { createIntent } : {}) },
+                        };
+                    }
+                }
+                // Ambiguous network failures retain the session for an explicit retry or scheduled cleanup.
+                throw error;
+            }
+        },
+        download(entity, recordId, property, options = {}) {
+            const { signal } = options;
+            const input = {
+                ...(options.revisionId ? { revision_id: options.revisionId } : {}),
+                ...(options.inline === undefined ? {} : { inline: options.inline }),
+            };
+            return readTransfer(`/${encodeURIComponent(toSnakeCase(entity))}/${encodeURIComponent(recordId)}/blobs/${encodeURIComponent(toSnakeCase(property))}/download`, input, signal, true);
+        },
+    };
+}

package/dist/telegram-launch.d.ts

@@ -0,0 +1,7 @@
+import { type ProxyOptions, type SegmentStreamProxy } from "./proxy.js";
+/**
+ * An unauthenticated Telegram Web iframe cannot visit the unframeable sign-in page. Keep the
+ * protected URL and return only an exchange script; never let the workspace render anonymously.
+ * A failed launch stays inert, or opens the app's public failure page when the app names one.
+ */
+export declare function withTelegramLaunch(proxy: SegmentStreamProxy, channels: Readonly<Record<string, boolean>> | undefined, options?: ProxyOptions): SegmentStreamProxy;

package/dist/telegram-launch.js

@@ -0,0 +1,134 @@
+import { NextResponse } from "next/server";
+import { CHANNEL_SESSION_PATH, channelSignInPath } from "./channel-protocol.js";
+import { isDecisionPage } from "./decision-pages.js";
+import { randomToken } from "./pkce.js";
+import { matchesPathPrefix, normalizePublicPath, } from "./proxy.js";
+import { channelAppFraming } from "./telegram.js";
+const NON_PAGE_PATHS = ["/api", "/mcp", "/.well-known", "/_next"];
+/**
+ * The app's page for a failed launch: a plain path, never a decision page, which the proxy serves
+ * without a session so the frame does not return to the shell.
+ */
+function launchFailurePath(options) {
+    const path = options.channelLaunchFailurePath;
+    if (path === undefined) {
+        return undefined;
+    }
+    const url = URL.parse(path, "https://app.invalid");
+    if (!path.startsWith("/") ||
+        path.startsWith("//") ||
+        url?.origin !== "https://app.invalid" ||
+        url.pathname !== path ||
+        isDecisionPage(path) ||
+        NON_PAGE_PATHS.some((prefix) => matchesPathPrefix(path, prefix))) {
+        throw new Error("channelLaunchFailurePath must be an app page path such as /telegram-unavailable, without a query or fragment.");
+    }
+    if (!(options.publicPaths ?? [])
+        .map(normalizePublicPath)
+        .some((publicPath) => matchesPathPrefix(path, publicPath))) {
+        throw new Error("channelLaunchFailurePath must be covered by publicPaths.");
+    }
+    return path;
+}
+/**
+ * An unauthenticated Telegram Web iframe cannot visit the unframeable sign-in page. Keep the
+ * protected URL and return only an exchange script; never let the workspace render anonymously.
+ * A failed launch stays inert, or opens the app's public failure page when the app names one.
+ */
+export function withTelegramLaunch(proxy, channels, options = {}) {
+    const failurePath = launchFailurePath(options);
+    if (channels?.telegram !== true) {
+        return proxy;
+    }
+    return async (request) => {
+        const response = await proxy(request);
+        const pathname = request.nextUrl.pathname;
+        const location = response.headers.get("location");
+        const destination = location === null ? null : URL.parse(location, request.url);
+        if (request.method !== "GET" ||
+            request.headers.get("sec-fetch-dest") !== "iframe" ||
+            request.headers.get("sec-fetch-mode") !== "navigate" ||
+            isDecisionPage(pathname) ||
+            NON_PAGE_PATHS.some((path) => matchesPathPrefix(pathname, path)) ||
+            response.status < 300 ||
+            response.status >= 400 ||
+            destination?.origin !== request.nextUrl.origin ||
+            destination.pathname !== "/sign-in") {
+            return response;
+        }
+        const nonce = randomToken();
+        // Only SDK-owned constants and the validated failure path enter the script. Launch data stays
+        // in the browser until the POST and never enters the failure page's query.
+        const script = `
+void (async () => {
+  const state = document.documentElement.dataset;
+  const failurePath = ${JSON.stringify(failurePath ?? null)};
+  const fail = (code) => {
+    state.channelSignIn = "error";
+    state.channelSignInError = code;
+    if (failurePath) {
+      location.replace(failurePath + "?" + new URLSearchParams({
+        error: code,
+        returnTo: location.pathname + location.search,
+      }));
+    }
+  };
+  const assertion = new URLSearchParams(location.hash.slice(1)).get("tgWebAppData");
+  if (!assertion) {
+    state.channelSignIn = "idle";
+    return;
+  }
+  state.channelSignIn = "pending";
+  try {
+    // Persist only a digest, scoped to this tab and exact launch, before the one allowed reload.
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(location.href));
+    const reloadKey = "segmentstream:telegram-launch:" + Array.from(new Uint8Array(digest),
+      (byte) => byte.toString(16).padStart(2, "0")).join("");
+    if (sessionStorage.getItem(reloadKey)) {
+      fail("launch_loop");
+      return;
+    }
+    const exchanged = await fetch(${JSON.stringify(channelSignInPath("telegram"))}, {
+      method: "POST",
+      credentials: "same-origin",
+      redirect: "error",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ assertion }),
+    });
+    if (!exchanged.ok) {
+      const body = await exchanged.json();
+      fail(typeof body.error === "string" ? body.error : "sign_in_failed");
+      return;
+    }
+    const discovered = await fetch(${JSON.stringify(CHANNEL_SESSION_PATH)}, {
+      credentials: "same-origin",
+      cache: "no-store",
+      redirect: "error",
+    });
+    const body = discovered.ok ? await discovered.json() : null;
+    if (typeof body?.session?.id !== "string" || typeof body?.user?.id !== "string") {
+      fail("session_unavailable");
+      return;
+    }
+    sessionStorage.setItem(reloadKey, "1");
+    location.reload();
+  } catch {
+    fail("sign_in_unavailable");
+  }
+})();`;
+        const shell = new NextResponse(`<!doctype html><html><head><meta charset="utf-8"></head><body><script nonce="${nonce}">${script}</script></body></html>`, {
+            headers: {
+                "content-type": "text/html; charset=utf-8",
+                "cache-control": "no-store",
+                "referrer-policy": "no-referrer",
+                "x-content-type-options": "nosniff",
+                "content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors ${channelAppFraming(channels)}`,
+            },
+        });
+        // Preserve stale-session clearing without carrying redirect or middleware bypass headers.
+        for (const cookie of response.headers.getSetCookie()) {
+            shell.headers.append("set-cookie", cookie);
+        }
+        return shell;
+    };
+}

package/dist/telegram.d.ts

@@ -0,0 +1,2 @@
+/** Provider-specific embedding policy; decision pages always override this with DENY. */
+export declare function channelAppFraming(channels: Readonly<Record<string, boolean>> | undefined): string | undefined;

package/dist/telegram.js

@@ -0,0 +1,6 @@
+/** Provider-specific embedding policy; decision pages always override this with DENY. */
+export function channelAppFraming(channels) {
+    return channels?.telegram === true
+        ? "'self' https://web.telegram.org https://*.web.telegram.org"
+        : undefined;
+}

package/dist/tokens.d.ts

@@ -0,0 +1,51 @@
+import type { JWTVerifyGetKey } from "jose";
+import type { ResolvedConfig } from "./config.js";
+import type { ScopedPermission } from "./me.js";
+/** The SegmentStream member a legacy app session token names. */
+export interface TokenUser {
+    readonly id: string;
+    readonly email?: string;
+    readonly name?: string;
+    readonly organizationId: string;
+    readonly workspaceId: string;
+}
+/**
+ * The signed-in user. With Neon Auth, the person's ontology `user` record with the roles and
+ * permissions from `GET /api/ontology/me`; with the legacy SegmentStream sign-in, the member the app
+ * session token names, without ontology roles.
+ */
+export interface AppUser extends TokenUser {
+    /** Neon Auth: the ontology `user` record's id. Legacy sign-in: the SegmentStream user id. */
+    readonly id: string;
+    /** The ontology roles the user holds, such as `sales`. Empty under the legacy sign-in. */
+    readonly roles: ReadonlyArray<string>;
+    /** The permissions the roles grant, wildcards included. Empty under the legacy sign-in. */
+    readonly permissions: ReadonlyArray<string>;
+    /**
+     * The permissions of `permissions` held only for some records; see `CurrentUser.scopes`. Absent
+     * when none is scoped.
+     */
+    readonly scopes?: ReadonlyArray<ScopedPermission>;
+    /** Neon Auth: the ontology user's kind, `member` for people. */
+    readonly kind?: string;
+    /** Neon Auth: whether the ontology user is active. */
+    readonly active?: boolean;
+    /** Neon Auth: the person's Neon Auth user id, the session JWT's `sub`. */
+    readonly authUserId?: string;
+}
+export type KeySet = JWTVerifyGetKey;
+export interface VerifiedToken {
+    readonly status: "valid";
+    readonly user: TokenUser;
+    readonly token: string;
+}
+export type TokenVerification = VerifiedToken | {
+    readonly status: "expired";
+} | {
+    readonly status: "invalid";
+} | {
+    readonly status: "unavailable";
+};
+/** One remote JWKS per SegmentStream origin, shared by every app instance in the process. */
+export declare function remoteKeySet(baseUrl: string): KeySet;
+export declare function createTokenVerifier(config: ResolvedConfig, keySet: KeySet): (token: string) => Promise<TokenVerification>;

package/dist/tokens.js

@@ -0,0 +1,70 @@
+import { createRemoteJWKSet, errors, jwtVerify } from "jose";
+const CLOCK_TOLERANCE_SECONDS = 5;
+const remoteKeySets = new Map();
+/** One remote JWKS per SegmentStream origin, shared by every app instance in the process. */
+export function remoteKeySet(baseUrl) {
+    const existing = remoteKeySets.get(baseUrl);
+    if (existing !== undefined) {
+        return existing;
+    }
+    const keySet = createRemoteJWKSet(new URL(`${baseUrl}/api/v1/app-sessions/jwks`), {
+        timeoutDuration: 5_000,
+    });
+    remoteKeySets.set(baseUrl, keySet);
+    return keySet;
+}
+export function createTokenVerifier(config, keySet) {
+    return async function verifyToken(token) {
+        let payload;
+        try {
+            const verified = await jwtVerify(token, keySet, {
+                algorithms: ["ES256"],
+                issuer: config.issuer,
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                requiredClaims: ["sub", "exp", "iat", "org", "wsp"],
+            });
+            payload = verified.payload;
+        }
+        catch (error) {
+            return classifyVerificationFailure(error);
+        }
+        const user = appUserFromClaims(config, payload);
+        return user === null ? { status: "invalid" } : { status: "valid", user, token };
+    };
+}
+function classifyVerificationFailure(error) {
+    if (error instanceof errors.JWTExpired) {
+        return { status: "expired" };
+    }
+    if (error instanceof errors.JWKSTimeout) {
+        return { status: "unavailable" };
+    }
+    if (error instanceof errors.JOSEError) {
+        return { status: "invalid" };
+    }
+    // Network failures while fetching the key set are not token defects.
+    return { status: "unavailable" };
+}
+function appUserFromClaims(config, payload) {
+    const { sub, org, wsp, email, name } = payload;
+    if (typeof sub !== "string" ||
+        sub === "" ||
+        org !== config.organizationId ||
+        wsp !== config.workspaceId) {
+        return null;
+    }
+    if (!hasAppAudience(payload.aud)) {
+        return null;
+    }
+    return {
+        id: sub,
+        ...(typeof email === "string" ? { email } : {}),
+        ...(typeof name === "string" ? { name } : {}),
+        organizationId: org,
+        workspaceId: wsp,
+    };
+}
+function hasAppAudience(audience) {
+    const audiences = typeof audience === "string" ? [audience] : (audience ?? []);
+    return audiences.some((candidate) => candidate.startsWith("app:"));
+}

package/dist/ui/agent-connect.d.ts

@@ -0,0 +1,18 @@
+import type { AgentPairing } from "../agent.js";
+export interface AgentConnectProps {
+    /** The page's `code` query parameter, from the agent's link. */
+    readonly code: string | undefined;
+    /** `segmentstream.agent.pairing(code)`, or `null` when the code no longer works. */
+    readonly pairing: AgentPairing | null;
+    /** The page's `connected` query parameter: the channel just linked, after approval. */
+    readonly connected?: string | undefined;
+    /** Who is signed in, such as their email, so they see whom the chat account will act as. */
+    readonly member?: string | undefined;
+    /** Where the form posts. Defaults to `/api/agent/connect`, `segmentstream.agent.connectHandler()`. */
+    readonly action?: string;
+}
+/**
+ * The agent connect page in the SDK's neutral styles: what asks to be linked, an Approve button and
+ * the result. Render it from the Server Component at `/agent/connect` with the pairing it read.
+ */
+export declare function AgentConnect({ code, pairing, connected, member, action, }: AgentConnectProps): import("react").JSX.Element;

package/dist/ui/agent-connect.js

@@ -0,0 +1,23 @@
+"use client";
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+import { useId } from "react";
+import { AGENT_CONNECT_HANDLER } from "../pages.js";
+/**
+ * The agent connect page in the SDK's neutral styles: what asks to be linked, an Approve button and
+ * the result. Render it from the Server Component at `/agent/connect` with the pairing it read.
+ */
+export function AgentConnect({ code, pairing, connected, member = "you", action = AGENT_CONNECT_HANDLER, }) {
+    const titleId = `${useId()}-title`;
+    if (connected !== undefined) {
+        return (_jsxs("section", { className: "ss-card", "aria-labelledby": titleId, children: [_jsxs("h1", { id: titleId, className: "ss-title", children: [providerName(connected), " is connected"] }), _jsxs("p", { className: "ss-text", children: ["The agent now acts as ", _jsx("strong", { children: member }), " when you write to it there. Go back to the chat and send your message again."] })] }));
+    }
+    if (code === undefined || code === "" || pairing === null) {
+        return (_jsxs("section", { className: "ss-card", "aria-labelledby": titleId, children: [_jsx("h1", { id: titleId, className: "ss-title", children: "This link has expired" }), _jsx("p", { className: "ss-text", children: "The link was already used or is more than ten minutes old. Write to the agent again for a new one." })] }));
+    }
+    const provider = providerName(pairing.provider);
+    return (_jsxs("section", { className: "ss-card", "aria-labelledby": titleId, children: [_jsxs("h1", { id: titleId, className: "ss-title", children: ["Connect ", provider, " to this app?"] }), _jsxs("p", { className: "ss-text", children: [pairing.display === null ? (`A ${provider} account`) : (_jsxs(_Fragment, { children: [_jsx("strong", { children: pairing.display }), " on ", provider] })), " ", "asks to talk to the workspace agent as ", _jsx("strong", { children: member }), ". The agent answers it with your permissions, and history records its changes under your name. Approve only if this is your own account."] }), _jsxs("form", { className: "ss-form", method: "post", action: action, children: [_jsx("input", { type: "hidden", name: "code", value: code }), _jsx("button", { type: "submit", className: "ss-button", children: "Approve" })] })] }));
+}
+/** `telegram` reads as `Telegram`. */
+function providerName(provider) {
+    return provider.charAt(0).toUpperCase() + provider.slice(1);
+}

package/dist/ui/components.d.ts

@@ -0,0 +1,27 @@
+import type { ReactNode } from "react";
+export interface ChildrenProps {
+    readonly children?: ReactNode;
+}
+/** Renders its children when a Neon Auth session exists in this browser. */
+export declare function SignedIn({ children }: ChildrenProps): ReactNode;
+/** Renders its children when nobody is signed in. */
+export declare function SignedOut({ children }: ChildrenProps): ReactNode;
+export interface CanProps extends ChildrenProps {
+    /** A permission such as `lead:changeStatus`. The user's wildcards (`lead:*`, `*:*`) count. */
+    readonly permission: string;
+    /** Rendered when the user lacks the permission. Nothing renders while permissions load. */
+    readonly fallback?: ReactNode;
+}
+/**
+ * Renders its children when the signed-in user holds the permission. It only hides controls: the
+ * ontology service checks every read and action itself.
+ */
+export declare function Can({ permission, children, fallback }: CanProps): ReactNode;
+/** Ends the selected session in this browser, then opens `redirectTo`. */
+export declare function signOut(redirectTo?: string): Promise<void>;
+export interface UserMenuProps {
+    /** Where to go after signing out. Defaults to `/sign-in`. */
+    readonly signedOutPath?: string;
+}
+/** The signed-in user's name, email and roles, and a sign-out button. */
+export declare function UserMenu({ signedOutPath }: UserMenuProps): import("react").JSX.Element | null;