@segmentstream/app 0.0.0-stage → 0.38.1

package/dist/groups.d.ts

@@ -0,0 +1,95 @@
+/** Channel-independent group policy. All names and aliases are supplied by the workspace. */
+export interface SmartPolicyInput {
+    readonly model?: string;
+    readonly instructions?: string | {
+        readonly append?: string;
+        readonly replace?: string;
+        readonly file?: string;
+    };
+    readonly criteria?: {
+        readonly observe?: string;
+        readonly reply?: string;
+    };
+    readonly context?: {
+        readonly messages?: number;
+        readonly includeAgentDescription?: boolean;
+        /**
+         * @legacy agent.config-retired-keys
+         * @deprecated Accepted so that configurations written for agent 0.9 and 0.10 still deploy;
+         * it has no effect. The router no longer receives the agent's instructions.
+         */
+        readonly includeAgentInstructions?: boolean | {
+            readonly maxChars: number;
+        };
+        readonly includeChatGuidance?: boolean;
+        readonly includeParticipants?: boolean;
+    };
+    readonly engagement?: {
+        readonly policy?: string;
+        readonly agentAliases?: ReadonlyArray<string>;
+        readonly idleMinutes?: number;
+        readonly humanExchangeMinutes?: number;
+        readonly humanQuestionMinutes?: number;
+        readonly inferredMaxMinutes?: number;
+        readonly burst?: {
+            readonly quietSeconds?: number;
+            readonly maxSeconds?: number;
+            readonly gapSeconds?: number;
+        };
+        readonly followUpMinutes?: number;
+        readonly conversationMinutes?: number;
+        readonly openQuestionMinutes?: number | "unlimited";
+        readonly addresseeGate?: boolean;
+    };
+    readonly thresholds?: {
+        readonly continuation?: number;
+        readonly inferredContinuation?: number;
+        readonly contested?: number;
+        readonly ambient?: number;
+        readonly humanExchange?: number;
+        readonly engaged?: number;
+        readonly neutral?: number;
+        readonly humanThread?: number;
+        /**
+         * Conversation policy: the agent answers when the decision model gives at least this
+         * probability that it is addressed and that a reply is needed (0.5..1, default 0.5).
+         */
+        readonly reply?: number;
+        /**
+         * Conversation policy: a message below `reply` but at or above `defer` still reaches the
+         * agent, which answers or calls `no_reply`; so does a message the decision model could not
+         * classify. Defaults to `reply`, which leaves no such band.
+         */
+        readonly defer?: number;
+    };
+    readonly timeoutSeconds?: number;
+}
+export type Participants = Readonly<Record<string, {
+    readonly aliases: ReadonlyArray<string>;
+}>>;
+export interface ChatOverrideInput {
+    readonly mode?: string;
+    readonly smart?: Pick<SmartPolicyInput, "instructions" | "criteria" | "engagement" | "thresholds"> & {
+        readonly context?: Pick<NonNullable<SmartPolicyInput["context"]>, "messages" | "includeChatGuidance">;
+    };
+    readonly participants?: Participants;
+}
+export interface GroupPolicyInput {
+    readonly mode?: string;
+    readonly smart?: SmartPolicyInput;
+    /** Aliases of the people in every group chat; a chat's own `participants` add to them. */
+    readonly participants?: Participants;
+    readonly chats?: Readonly<Record<string, ChatOverrideInput>>;
+    readonly observability?: {
+        readonly storeRouterPayload?: boolean;
+        readonly shadow?: SmartPolicyInput;
+    };
+}
+export interface GroupPolicyIssue {
+    readonly message: string;
+    readonly path: ReadonlyArray<string>;
+}
+/** Strict validation of the `groups` section that `agent/segmentstream.json` authors. */
+export declare function groupPolicyIssues(value: unknown): ReadonlyArray<GroupPolicyIssue>;
+/** Expand authored files before bundling. The caller owns the workspace-relative filesystem boundary. */
+export declare function expandGroupFiles(input: GroupPolicyInput, read: (path: string) => string): GroupPolicyInput;

package/dist/groups.js

@@ -0,0 +1,280 @@
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** Strict validation of the `groups` section that `agent/segmentstream.json` authors. */
+export function groupPolicyIssues(value) {
+    const issues = [];
+    const issue = (path, message) => issues.push({ path, message });
+    function section(value, path, keys) {
+        if (value === undefined) {
+            return {};
+        }
+        if (!object(value)) {
+            issue(path, "must be an object");
+            return {};
+        }
+        for (const key of Object.keys(value)) {
+            if (!keys.includes(key)) {
+                issue([...path, key], "is not a known setting");
+            }
+        }
+        return value;
+    }
+    function number(value, path, min, max, integer = false) {
+        if (value !== undefined &&
+            (typeof value !== "number" ||
+                !Number.isFinite(value) ||
+                value < min ||
+                value > max ||
+                (integer && !Number.isInteger(value)))) {
+            issue(path, `must be ${integer ? "an integer" : "a number"} between ${min} and ${max}`);
+        }
+    }
+    function bool(value, path) {
+        if (value !== undefined && typeof value !== "boolean") {
+            issue(path, "must be a boolean");
+        }
+    }
+    function text(value, path, max = 8000) {
+        if (value !== undefined && (typeof value !== "string" || value.length > max)) {
+            issue(path, `must be text of at most ${max} characters`);
+        }
+    }
+    function smart(value, path, restricted = false) {
+        const s = section(value, path, [
+            "instructions",
+            "criteria",
+            "context",
+            "engagement",
+            "thresholds",
+            ...(restricted ? [] : ["model", "timeoutSeconds"]),
+        ]);
+        if (s.model !== undefined &&
+            (typeof s.model !== "string" || !/^[^\s/]+\/[^\s]+$/.test(s.model))) {
+            issue([...path, "model"], "must be a Gateway provider/model id");
+        }
+        number(s.timeoutSeconds, [...path, "timeoutSeconds"], 1, 30);
+        if (typeof s.instructions === "string") {
+            text(s.instructions, [...path, "instructions"]);
+        }
+        else if (s.instructions !== undefined) {
+            const instructions = section(s.instructions, [...path, "instructions"], ["append", "replace", "file"]);
+            if (Object.keys(instructions).length !== 1) {
+                issue([...path, "instructions"], "must specify exactly one of append, replace or file");
+            }
+            for (const [key, value] of Object.entries(instructions)) {
+                text(value, [...path, "instructions", key]);
+            }
+        }
+        const criteria = section(s.criteria, [...path, "criteria"], ["observe", "reply"]);
+        text(criteria.observe, [...path, "criteria", "observe"]);
+        text(criteria.reply, [...path, "criteria", "reply"]);
+        const instructionLength = typeof s.instructions === "string"
+            ? s.instructions.length
+            : object(s.instructions)
+                ? String(s.instructions.append ?? s.instructions.replace ?? "").length
+                : 0;
+        if (instructionLength +
+            String(criteria.observe ?? "").length +
+            String(criteria.reply ?? "").length >
+            8000) {
+            issue(path, "instructions and criteria must fit 8000 characters");
+        }
+        const c = section(s.context, [...path, "context"], [
+            "messages",
+            "includeChatGuidance",
+            ...(restricted
+                ? []
+                : ["includeAgentDescription", "includeAgentInstructions", "includeParticipants"]),
+        ]);
+        number(c.messages, [...path, "context", "messages"], 5, 60, true);
+        for (const key of ["includeAgentDescription", "includeChatGuidance", "includeParticipants"]) {
+            bool(c[key], [...path, "context", key]);
+        }
+        if (object(c.includeAgentInstructions)) {
+            const a = section(c.includeAgentInstructions, [...path, "context", "includeAgentInstructions"], ["maxChars"]);
+            number(a.maxChars, [...path, "context", "includeAgentInstructions", "maxChars"], 1, 6000, true);
+            if (a.maxChars === undefined) {
+                issue([...path, "context", "includeAgentInstructions"], "maxChars is required");
+            }
+        }
+        else {
+            bool(c.includeAgentInstructions, [...path, "context", "includeAgentInstructions"]);
+        }
+        const e = section(s.engagement, [...path, "engagement"], [
+            "policy",
+            "followUpMinutes",
+            "conversationMinutes",
+            "openQuestionMinutes",
+            "addresseeGate",
+            "agentAliases",
+            "idleMinutes",
+            "humanExchangeMinutes",
+            "humanQuestionMinutes",
+            "inferredMaxMinutes",
+            "burst",
+        ]);
+        if (e.policy !== undefined &&
+            e.policy !== "legacy" &&
+            e.policy !== "engaged" &&
+            e.policy !== "conversation") {
+            issue([...path, "engagement", "policy"], "must be legacy, engaged or conversation");
+        }
+        if (e.agentAliases !== undefined &&
+            (!Array.isArray(e.agentAliases) ||
+                e.agentAliases.length > 20 ||
+                e.agentAliases.some((a) => typeof a !== "string" || a.length < 1 || a.length > 128))) {
+            issue([...path, "engagement", "agentAliases"], "must contain at most 20 names of 1..128 characters");
+        }
+        for (const key of [
+            "idleMinutes",
+            "humanExchangeMinutes",
+            "humanQuestionMinutes",
+            "inferredMaxMinutes",
+        ]) {
+            number(e[key], [...path, "engagement", key], 1, 180);
+        }
+        const burst = section(e.burst, [...path, "engagement", "burst"], ["quietSeconds", "maxSeconds", "gapSeconds"]);
+        for (const key of ["quietSeconds", "maxSeconds", "gapSeconds"]) {
+            number(burst[key], [...path, "engagement", "burst", key], 1, 60);
+        }
+        if (burst.quietSeconds !== undefined &&
+            burst.maxSeconds !== undefined &&
+            Number(burst.quietSeconds) > Number(burst.maxSeconds)) {
+            issue([...path, "engagement", "burst"], "quietSeconds must not exceed maxSeconds");
+        }
+        for (const key of ["followUpMinutes", "conversationMinutes"]) {
+            number(e[key], [...path, "engagement", key], 1, 180);
+        }
+        if (e.openQuestionMinutes !== "unlimited") {
+            number(e.openQuestionMinutes, [...path, "engagement", "openQuestionMinutes"], 0, 1440);
+        }
+        bool(e.addresseeGate, [...path, "engagement", "addresseeGate"]);
+        const t = section(s.thresholds, [...path, "thresholds"], [
+            "engaged",
+            "neutral",
+            "humanThread",
+            "continuation",
+            "inferredContinuation",
+            "contested",
+            "ambient",
+            "humanExchange",
+            "reply",
+            "defer",
+        ]);
+        for (const [key, value] of Object.entries(t)) {
+            number(value, [...path, "thresholds", key], key === "reply" ? 0.5 : 0, 1);
+        }
+        // The top level's policy defaults to legacy; a chat or shadow policy may inherit conversation.
+        if ((t.reply !== undefined || t.defer !== undefined) &&
+            (path.length === 1
+                ? e.policy !== "conversation"
+                : e.policy !== undefined && e.policy !== "conversation")) {
+            issue([...path, "thresholds"], "reply and defer apply only to engagement.policy conversation");
+        }
+        // A chat or shadow policy may inherit `reply`; the agent checks each chat after inheritance.
+        if (path.length === 1
+            ? Number(t.defer ?? t.reply ?? 0.5) > Number(t.reply ?? 0.5)
+            : t.defer !== undefined && t.reply !== undefined && Number(t.defer) > Number(t.reply)) {
+            issue([...path, "thresholds"], "must satisfy defer <= reply");
+        }
+        const defaults = e.policy === "conversation"
+            ? [0.5, 0.9, 0.95]
+            : e.policy === "engaged"
+                ? [0.5, 0.75, 0.9]
+                : [0.5, 0.5, 0.5];
+        if ((!restricted &&
+            (Number(t.engaged ?? defaults[0]) > Number(t.neutral ?? defaults[1]) ||
+                Number(t.neutral ?? defaults[1]) > Number(t.humanThread ?? defaults[2]))) ||
+            (restricted &&
+                ((t.engaged !== undefined &&
+                    t.neutral !== undefined &&
+                    Number(t.engaged) > Number(t.neutral)) ||
+                    (t.neutral !== undefined &&
+                        t.humanThread !== undefined &&
+                        Number(t.neutral) > Number(t.humanThread))))) {
+            issue([...path, "thresholds"], "must satisfy engaged <= neutral <= humanThread");
+        }
+    }
+    function override(value, path, isChat) {
+        const v = section(value, path, isChat
+            ? ["mode", "smart", "participants"]
+            : ["mode", "smart", "participants", "chats", "observability"]);
+        if (v.mode !== undefined && v.mode !== "smart" && v.mode !== "mention") {
+            issue([...path, "mode"], "must be smart or mention");
+        }
+        smart(v.smart, [...path, "smart"], isChat);
+        if (v.participants !== undefined) {
+            if (!object(v.participants)) {
+                issue([...path, "participants"], "must be an object");
+            }
+            else {
+                for (const [id, participant] of Object.entries(v.participants)) {
+                    const p = section(participant, [...path, "participants", id], ["aliases"]);
+                    if (!Array.isArray(p.aliases) ||
+                        p.aliases.length > 10 ||
+                        p.aliases.some((a) => typeof a !== "string" || a.length < 1 || a.length > 32 || a.includes("@"))) {
+                        issue([...path, "participants", id, "aliases"], "must contain at most 10 names of 1..32 characters without @");
+                    }
+                }
+            }
+        }
+        if (!isChat) {
+            if (v.chats !== undefined) {
+                if (!object(v.chats)) {
+                    issue([...path, "chats"], "must be an object");
+                }
+                else {
+                    for (const [key, entry] of Object.entries(v.chats)) {
+                        if (!/^[a-z][a-z0-9_-]{0,31}:[^/\s]+(?:\/[^\s]+)?$/.test(key)) {
+                            issue([...path, "chats", key], "must be provider:externalId[/scope]");
+                        }
+                        override(entry, [...path, "chats", key], true);
+                    }
+                }
+            }
+            const o = section(v.observability, [...path, "observability"], ["storeRouterPayload", "shadow"]);
+            bool(o.storeRouterPayload, [...path, "observability", "storeRouterPayload"]);
+            smart(o.shadow, [...path, "observability", "shadow"]);
+        }
+    }
+    override(value, [], false);
+    return issues;
+}
+/** Expand authored files before bundling. The caller owns the workspace-relative filesystem boundary. */
+export function expandGroupFiles(input, read) {
+    if (groupPolicyIssues(input).length > 0) {
+        throw new Error("Group policy authoring is invalid.");
+    }
+    const smart = (value) => {
+        const instructions = value?.instructions;
+        if (typeof instructions !== "object" || instructions.file === undefined) {
+            return value;
+        }
+        const path = instructions.file;
+        if (!path ||
+            path.startsWith("/") ||
+            path.split(/[\\/]/).some((part) => part === "..") ||
+            path.includes("\0")) {
+            throw new Error("Group instruction files must stay within agent/.");
+        }
+        const text = read(path);
+        if (text.length > 8000) {
+            throw new Error("Group instruction files must fit 8000 characters.");
+        }
+        return { ...value, instructions: { replace: text } };
+    };
+    return {
+        ...input,
+        smart: smart(input.smart),
+        ...(input.chats === undefined
+            ? {}
+            : {
+                chats: Object.fromEntries(Object.entries(input.chats).map(([key, value]) => [
+                    key,
+                    { ...value, smart: smart(value.smart) },
+                ])),
+            }),
+        ...(input.observability === undefined
+            ? {}
+            : { observability: { ...input.observability, shadow: smart(input.observability.shadow) } }),
+    };
+}

package/dist/handlers.d.ts

@@ -0,0 +1,10 @@
+import type { NextRequest } from "next/server";
+import type { AppContext } from "./context.js";
+export type RouteHandler = (request: NextRequest) => Promise<Response>;
+export interface SegmentStreamRouteHandlers {
+    readonly GET: RouteHandler;
+    readonly POST: RouteHandler;
+}
+export declare function createHandlers(context: AppContext, { neon }?: {
+    readonly neon?: boolean;
+}): SegmentStreamRouteHandlers;

package/dist/handlers.js

@@ -0,0 +1,161 @@
+import { NextResponse } from "next/server";
+import { authFlowCookieName, clearCookie, clearSessionCookies, cookiePolicyFor, decodeAuthFlowState, pendingAuthFlowCookies, safeReturnTo, setSessionCookies, } from "./cookies.js";
+import { isSameOrigin } from "./decision-pages.js";
+import { constantTimeEqual } from "./pkce.js";
+import { CALLBACK_PATH, SIGNED_OUT_PATH, SIGN_IN_PATH, SDK_ROUTE_PREFIX, signInRedirect, } from "./sign-in.js";
+export function createHandlers(context, { neon = false } = {}) {
+    async function GET(request) {
+        switch (request.nextUrl.pathname) {
+            case `${SDK_ROUTE_PREFIX}/configuration`:
+                return NextResponse.json({ enabled: false, neon, channels: context.config.channels ?? {} }, {
+                    headers: { "cache-control": "no-store" },
+                });
+            case CALLBACK_PATH:
+                return handleCallback(context, request);
+            case SIGN_IN_PATH:
+                return signInRedirect({
+                    config: context.config,
+                    request,
+                    returnTo: safeReturnTo(request.nextUrl.searchParams.get("returnTo")),
+                    clearSession: false,
+                });
+            case SIGNED_OUT_PATH:
+                return htmlResponse(200, "You're signed out", "You have signed out of this app.", "Sign in again");
+            default:
+                return notFound();
+        }
+    }
+    async function POST(request) {
+        if (request.nextUrl.pathname === `${SDK_ROUTE_PREFIX}/sign-out`) {
+            return handleSignOut(context, request);
+        }
+        return notFound();
+    }
+    return { GET, POST };
+}
+async function handleCallback(context, request) {
+    const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
+    const code = request.nextUrl.searchParams.get("code");
+    const state = request.nextUrl.searchParams.get("state");
+    const flowCookie = state === null ? undefined : authFlowCookieName(policy, state);
+    const flow = flowCookie === undefined ? null : decodeAuthFlowState(request.cookies.get(flowCookie)?.value);
+    if (request.nextUrl.searchParams.get("error") === "access_denied") {
+        return callbackFailure(policy, flowCookie, 403, "You don't have access to this app.");
+    }
+    if (state === null ||
+        flowCookie === undefined ||
+        flow === null ||
+        code === null ||
+        code === "" ||
+        !constantTimeEqual(state, flow.state)) {
+        // A replayed or abandoned sign-in whose browser has signed in since, for example in another tab.
+        if (await hasSession(context, request, policy)) {
+            return returnToApp(request, policy, flowCookie, "/");
+        }
+        return callbackFailure(policy, flowCookie, 400, "This sign-in link is invalid or has expired.");
+    }
+    const exchange = await context.requestToken({
+        grantType: "authorization_code",
+        code,
+        codeVerifier: flow.codeVerifier,
+        redirectUri: flow.redirectUri,
+    });
+    if (exchange.status === "unavailable") {
+        return callbackFailure(policy, flowCookie, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
+    }
+    if (exchange.status === "rejected") {
+        const accessRevoked = exchange.httpStatus === 403 || exchange.code === "access_revoked";
+        return accessRevoked
+            ? callbackFailure(policy, flowCookie, 403, "You don't have access to this app.")
+            : callbackFailure(policy, flowCookie, 400, "Sign-in could not be completed. Try again.");
+    }
+    // A token this app would reject must not become a session, or sign-in would loop.
+    const verification = await context.verifyToken(exchange.tokens.accessToken);
+    if (verification.status === "unavailable") {
+        return callbackFailure(policy, flowCookie, 503, "Sign-in is temporarily unavailable. Try again in a moment.");
+    }
+    if (verification.status !== "valid") {
+        return callbackFailure(policy, flowCookie, 400, "Sign-in returned a session for a different app.");
+    }
+    const response = returnToApp(request, policy, flowCookie, flow.returnTo);
+    setSessionCookies(response, policy, exchange.tokens);
+    return response;
+}
+async function hasSession(context, request, policy) {
+    const accessToken = request.cookies.get(policy.names.session)?.value;
+    if (accessToken === undefined || accessToken === "") {
+        return false;
+    }
+    return (await context.verifyToken(accessToken)).status === "valid";
+}
+function returnToApp(request, policy, flowCookie, returnTo) {
+    const response = NextResponse.redirect(new URL(returnTo, request.nextUrl.origin), 303);
+    response.headers.set("cache-control", "no-store");
+    if (flowCookie !== undefined) {
+        clearCookie(response, policy, flowCookie);
+    }
+    return response;
+}
+async function handleSignOut(context, request) {
+    if (!isSameOrigin(request)) {
+        return htmlResponse(403, "Sign-out refused", "Sign out from this app's own pages.", "Return to the app");
+    }
+    const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);
+    const refreshToken = request.cookies.get(policy.names.refresh)?.value;
+    if (refreshToken !== undefined && refreshToken !== "") {
+        await context.revokeSession(refreshToken);
+    }
+    const response = NextResponse.redirect(new URL(SIGNED_OUT_PATH, request.nextUrl.origin), 303);
+    const pendingFlows = pendingAuthFlowCookies(policy, request.cookies.getAll().map((cookie) => cookie.name));
+    response.headers.set("cache-control", "no-store");
+    clearSessionCookies(response, policy);
+    for (const name of pendingFlows) {
+        clearCookie(response, policy, name);
+    }
+    return response;
+}
+function callbackFailure(policy, flowCookie, status, message) {
+    const response = htmlResponse(status, "Sign-in failed", message, "Try again");
+    if (flowCookie !== undefined) {
+        clearCookie(response, policy, flowCookie);
+    }
+    return response;
+}
+function notFound() {
+    return NextResponse.json({ error: "not_found" }, { status: 404, headers: { "cache-control": "no-store" } });
+}
+function htmlResponse(status, title, message, linkLabel) {
+    const body = [
+        "<!doctype html>",
+        '<html lang="en">',
+        "<head>",
+        '<meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width, initial-scale=1">',
+        '<meta name="robots" content="noindex">',
+        `<title>${escapeHtml(title)}</title>`,
+        "<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 1rem;}</style>",
+        "</head>",
+        "<body>",
+        `<h1>${escapeHtml(title)}</h1>`,
+        `<p>${escapeHtml(message)}</p>`,
+        `<p><a href="/">${escapeHtml(linkLabel)}</a></p>`,
+        "</body>",
+        "</html>",
+    ].join("\n");
+    return new NextResponse(body, {
+        status,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff",
+        },
+    });
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}

package/dist/index.d.ts

@@ -0,0 +1,46 @@
+import type { SegmentStreamApp } from "./app.js";
+import type { SegmentStreamAppConfig } from "./config.js";
+/**
+ * Creates the SegmentStream integration for a Next.js workspace app. Pass the type of the app's
+ * ontology to type `segmentstream.ontology`:
+ *
+ * ```ts
+ * import type ontology from "../../ontology";
+ * import link from "../segmentstream.json";
+ *
+ * export const segmentstream = createSegmentStreamApp<typeof ontology>(link);
+ * ```
+ *
+ * With `NEON_AUTH_BASE_URL` set, users sign in with Neon Auth and their roles and permissions come
+ * from the ontology. Without it, members sign in with their SegmentStream account, as in 0.2.
+ */
+export declare function createSegmentStreamApp<O = unknown>(config: SegmentStreamAppConfig): SegmentStreamApp<O>;
+export { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError } from "./errors.js";
+export { DeploymentAdmissionError } from "./deployment.js";
+export type { DeploymentObservation, DeploymentCapabilities, DeploymentAdmissionCode, } from "./deployment.js";
+export { grants, isAllowed } from "./permissions.js";
+export { sql } from "./parameters.js";
+export { withRequestTiming } from "./request-timing.js";
+export type { AuthenticationMethod, SegmentStreamApp } from "./app.js";
+export { CONSENT_PAGE } from "./oauth.js";
+export { AGENT_CONNECT_HANDLER, AGENT_CONNECT_PAGE } from "./agent.js";
+export type { AgentIdentities, AgentIdentity, AgentPairing } from "./agent.js";
+export type { AgentAuthorizationRequest, AgentAuthorizations, AgentScope, DeviceCodeUnavailable, DeviceLookup, } from "./oauth.js";
+export type { ApiIssue, ApiLimit } from "./errors.js";
+export type { JobReadOptions, JobRun, JobRunOptions, JobsClient } from "./jobs.js";
+export type { CurrentUser, ScopedPermission } from "./me.js";
+export type { AuthRouteHandler, AuthRouteHandlers, SignOutOptions, UserOptions } from "./neon.js";
+export type { ActionCall, ActionOptions, ActionResponse, Change, Edit, EditKind, EntityClient, EntityFilesClient, FieldFilter, GeneratedActions, UserGeneratedActions, HistoryEntry, HistoryOptions, HistoryPage, JsonRecord, JsonValue, ManyFilter, MetricQueryClient, OntologyClient, EntityMetricQueryClient, OntologyPage, OntologyQuery, SelectedRecord, OrderBy, RequestOptions, UntypedOntologyClient, ValidationIssue, Where, } from "./ontology.js";
+export type { PermissionHolder } from "./permissions.js";
+export type { EntityMetricQuery, MetricQuery, MetricQueryField, MetricQueryFilter, MetricQueryFilterOperator, MetricQueryGranularity, MetricQueryResult, RelativePeriod, WarehouseClient, WarehouseColumn, WarehouseDryRun, WarehouseQueryOptions, WarehouseReadOptions, WarehouseQueryResult, WarehouseRow, WarehouseValue, } from "./data.js";
+export type { ParameterType, QueryParameterValue, QueryParameters, TypedParameter, } from "./parameters.js";
+/** The earlier names of metric queries and their types, deprecated. */
+export type * from "./legacy.js";
+export type { SegmentStreamAppConfig } from "./config.js";
+export type { SegmentStreamRouteHandlers, RouteHandler } from "./handlers.js";
+export type { ProxyOptions, SegmentStreamProxy } from "./proxy.js";
+export type { AppUser } from "./tokens.js";
+export { createBlobStorageClient, type BlobUploadTicket, type FileRevision, type FileTransfer, type FileDownloadOptions, type FileUploadTarget, type UploadSession, type FileUploadOptions, } from "./storage.js";
+/** Whether a form post came from the app itself: the check the agent connect and consent handlers use. */
+export { isSameOrigin } from "./decision-pages.js";
+export { groupPolicyIssues, type GroupPolicyInput, type SmartPolicyInput, type ChatOverrideInput, type Participants, } from "./groups.js";

package/dist/index.js

@@ -0,0 +1,29 @@
+import { createApp } from "./app.js";
+/**
+ * Creates the SegmentStream integration for a Next.js workspace app. Pass the type of the app's
+ * ontology to type `segmentstream.ontology`:
+ *
+ * ```ts
+ * import type ontology from "../../ontology";
+ * import link from "../segmentstream.json";
+ *
+ * export const segmentstream = createSegmentStreamApp<typeof ontology>(link);
+ * ```
+ *
+ * With `NEON_AUTH_BASE_URL` set, users sign in with Neon Auth and their roles and permissions come
+ * from the ontology. Without it, members sign in with their SegmentStream account, as in 0.2.
+ */
+export function createSegmentStreamApp(config) {
+    return createApp(config);
+}
+export { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError } from "./errors.js";
+export { DeploymentAdmissionError } from "./deployment.js";
+export { grants, isAllowed } from "./permissions.js";
+export { sql } from "./parameters.js";
+export { withRequestTiming } from "./request-timing.js";
+export { CONSENT_PAGE } from "./oauth.js";
+export { AGENT_CONNECT_HANDLER, AGENT_CONNECT_PAGE } from "./agent.js";
+export { createBlobStorageClient, } from "./storage.js";
+/** Whether a form post came from the app itself: the check the agent connect and consent handlers use. */
+export { isSameOrigin } from "./decision-pages.js";
+export { groupPolicyIssues, } from "./groups.js";