@hexclave/js 1.0.0 → 1.0.2

package/dist/esm/lib/stack-app/url-targets.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-targets.js","names":[],"sources":["../../../../src/lib/stack-app/url-targets.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { getCustomPagePrompts, type CustomPagePrompt } from \"@stackframe/stack-shared/dist/interface/handler-urls\";\nimport { HexclaveAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { getHostedHandlerUrlFromConfig } from \"@stackframe/stack-shared/dist/utils/redirect-urls\";\nimport { envVars } from \"../env\";\nimport { DefaultHandlerUrlTarget, HandlerPageUrls, HandlerUrlOptions, HandlerUrlTarget, HandlerUrls, ResolvedHandlerUrls } from \"./common\";\n\nconst localUrlPlaceholderOrigin = \"http://example.com\";\nconst schemePrefixRegex = /^[a-zA-Z][a-zA-Z\\d+\\-.]*:/;\n\nconst customPagePrompts: Record<keyof Omit<HandlerPageUrls, \"handler\">, CustomPagePrompt> = getCustomPagePrompts();\n\nconst joinHandlerComponentPath = (basePath: string, pagePath: string): string => {\n  const normalizedBasePath = basePath.endsWith(\"/\") && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n  if (pagePath.length === 0) {\n    return normalizedBasePath;\n  }\n  if (normalizedBasePath === \"/\") {\n    return `/${pagePath}`;\n  }\n  return `${normalizedBasePath}/${pagePath}`;\n};\n\nconst getHostedPagePathForHandlerName = (handlerName: keyof HandlerUrls): string => {\n  switch (handlerName) {\n    case \"handler\": {\n      return \"\";\n    }\n    case \"home\": {\n      return \"\";\n    }\n    case \"afterSignIn\": {\n      return \"\";\n    }\n    case \"afterSignUp\": {\n      return \"\";\n    }\n    case \"afterSignOut\": {\n      return \"\";\n    }\n    case \"signIn\": {\n      return \"sign-in\";\n    }\n    case \"signUp\": {\n      return \"sign-up\";\n    }\n    case \"signOut\": {\n      return \"sign-out\";\n    }\n    case \"emailVerification\": {\n      return \"email-verification\";\n    }\n    case \"passwordReset\": {\n      return \"password-reset\";\n    }\n    case \"forgotPassword\": {\n      return \"forgot-password\";\n    }\n    case \"oauthCallback\": {\n      return \"oauth-callback\";\n    }\n    case \"magicLinkCallback\": {\n      return \"magic-link-callback\";\n    }\n    case \"accountSettings\": {\n      return \"account-settings\";\n    }\n    case \"teamInvitation\": {\n      return \"team-invitation\";\n    }\n    case \"cliAuthConfirm\": {\n      return \"cli-auth-confirm\";\n    }\n    case \"mfa\": {\n      return \"mfa\";\n    }\n    case \"error\": {\n      return \"error\";\n    }\n    case \"onboarding\": {\n      return \"onboarding\";\n    }\n  }\n};\n\nconst resolveCustomTargetUrl = (options: {\n  target: { type: \"custom\", url: string, version: number },\n  handlerName: keyof HandlerUrls,\n}): string => {\n  const handlerName = options.handlerName;\n  if (handlerName in customPagePrompts) {\n    const customPagePrompt = customPagePrompts[handlerName as keyof typeof customPagePrompts];\n    if (options.target.version === 0 || options.target.version in customPagePrompt.versions) {\n      return options.target.url;\n    }\n\n    throw new Error(`Unsupported custom page version ${options.target.version} for ${options.handlerName} page at ${options.target.url}. The latest supported version of this page is ${Math.max(0, ...Object.keys(customPagePrompt.versions).map(Number))}. Please upgrade your Hexclave SDK to a version that supports this version.`);\n  } else {\n    throw new Error(`URL target ${options.handlerName} cannot be a custom page. Please specify the URL as a string instead.`);\n  }\n};\n\nexport const getHostedHandlerUrl = (options: { projectId: string, pagePath: string }): string => {\n  const normalizedPagePath = options.pagePath.replace(/^\\/+/, \"\");\n  const hostedPath = normalizedPagePath.length > 0 ? `handler/${normalizedPagePath}` : \"handler\";\n  return getHostedHandlerUrlFromConfig({\n    projectId: options.projectId,\n    hostedPath,\n    hostedHandlerDomainSuffix: envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX,\n    hostedHandlerUrlTemplate: envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE,\n    stackPortPrefix: envVars.NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX,\n  });\n};\n\nconst isRelativeUrlString = (url: string): boolean => {\n  if (url.startsWith(\"//\")) {\n    return false;\n  }\n  return !schemePrefixRegex.test(url);\n};\n\nexport const isLocalHandlerUrlTarget = (options: {\n  targetUrl: string,\n  handlerPath: string,\n  currentOrigin?: string,\n}): boolean => {\n  const urlObject = new URL(options.targetUrl, localUrlPlaceholderOrigin);\n  const isHandlerPathTarget = urlObject.pathname === options.handlerPath\n    || urlObject.pathname.startsWith(`${options.handlerPath}/`);\n  if (!isHandlerPathTarget) {\n    return false;\n  }\n\n  // On server we only have path information, so treat matching handler paths as local.\n  if (options.currentOrigin == null) {\n    return true;\n  }\n\n  return isRelativeUrlString(options.targetUrl) || urlObject.origin === options.currentOrigin;\n};\n\nconst resolveUrlTarget = (options: {\n  target: HandlerUrlTarget,\n  fallbackPath: string,\n  handlerName: keyof HandlerUrls,\n  projectId: string,\n}): string => {\n  if (typeof options.target === \"string\") {\n    return options.target;\n  }\n\n  switch (options.target.type) {\n    case \"handler-component\": {\n      return options.fallbackPath;\n    }\n    case \"hosted\": {\n      return getHostedHandlerUrl({\n        projectId: options.projectId,\n        pagePath: getHostedPagePathForHandlerName(options.handlerName),\n      });\n    }\n    case \"custom\": {\n      return resolveCustomTargetUrl({\n        target: options.target,\n        handlerName: options.handlerName,\n      });\n    }\n  }\n};\n\nconst assertOAuthCallbackTargetIsRelative = (target: HandlerUrlTarget): void => {\n  const url = typeof target === \"string\"\n    ? target\n    : target.type === \"custom\"\n      ? target.url\n      : null;\n  if (url != null && !isRelativeUrlString(url)) {\n    throw new HexclaveAssertionError(\"OAuth callback URLs must be relative.\", {\n      oauthCallbackUrl: url,\n      hint: \"Use a relative URL like '/handler/oauth-callback', or use { type: 'hosted' } to let Stack use the current page for hosted callbacks.\",\n    });\n  }\n};\n\nexport const resolveHandlerUrls = (options: { urls: HandlerUrlOptions | undefined, projectId: string }): ResolvedHandlerUrls => {\n  const configuredUrls = options.urls;\n  const defaultTarget = configuredUrls?.default ?? { type: \"handler-component\" } as const;\n  const oauthCallbackTarget: HandlerUrlTarget = configuredUrls?.oauthCallback ?? (\n    defaultTarget.type === \"hosted\"\n      ? defaultTarget\n      : { type: \"handler-component\" }\n  );\n  assertOAuthCallbackTargetIsRelative(oauthCallbackTarget);\n  let handlerComponentBasePath = \"/handler\";\n  if (typeof configuredUrls?.handler === \"string\") {\n    handlerComponentBasePath = configuredUrls.handler;\n  } else if (configuredUrls?.handler != null && configuredUrls.handler.type === \"custom\") {\n    handlerComponentBasePath = resolveCustomTargetUrl({\n      target: configuredUrls.handler,\n      handlerName: \"handler\",\n    });\n  }\n\n  const home = resolveUrlTarget({\n    target: configuredUrls?.home ?? defaultTarget,\n    fallbackPath: \"/\",\n    handlerName: \"home\",\n    projectId: options.projectId,\n  });\n  const afterSignIn = resolveUrlTarget({\n    target: configuredUrls?.afterSignIn ?? defaultTarget,\n    fallbackPath: home,\n    handlerName: \"afterSignIn\",\n    projectId: options.projectId,\n  });\n\n  return {\n    handler: resolveUrlTarget({\n      target: configuredUrls?.handler ?? defaultTarget,\n      fallbackPath: handlerComponentBasePath,\n      handlerName: \"handler\",\n      projectId: options.projectId,\n    }),\n    signIn: resolveUrlTarget({\n      target: configuredUrls?.signIn ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-in\"),\n      handlerName: \"signIn\",\n      projectId: options.projectId,\n    }),\n    signUp: resolveUrlTarget({\n      target: configuredUrls?.signUp ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-up\"),\n      handlerName: \"signUp\",\n      projectId: options.projectId,\n    }),\n    afterSignIn,\n    afterSignUp: resolveUrlTarget({\n      target: configuredUrls?.afterSignUp ?? defaultTarget,\n      fallbackPath: afterSignIn,\n      handlerName: \"afterSignUp\",\n      projectId: options.projectId,\n    }),\n    signOut: resolveUrlTarget({\n      target: configuredUrls?.signOut ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-out\"),\n      handlerName: \"signOut\",\n      projectId: options.projectId,\n    }),\n    afterSignOut: resolveUrlTarget({\n      target: configuredUrls?.afterSignOut ?? defaultTarget,\n      fallbackPath: home,\n      handlerName: \"afterSignOut\",\n      projectId: options.projectId,\n    }),\n    emailVerification: resolveUrlTarget({\n      target: configuredUrls?.emailVerification ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"email-verification\"),\n      handlerName: \"emailVerification\",\n      projectId: options.projectId,\n    }),\n    passwordReset: resolveUrlTarget({\n      target: configuredUrls?.passwordReset ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"password-reset\"),\n      handlerName: \"passwordReset\",\n      projectId: options.projectId,\n    }),\n    forgotPassword: resolveUrlTarget({\n      target: configuredUrls?.forgotPassword ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"forgot-password\"),\n      handlerName: \"forgotPassword\",\n      projectId: options.projectId,\n    }),\n    home,\n    oauthCallback: resolveUrlTarget({\n      target: oauthCallbackTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"oauth-callback\"),\n      handlerName: \"oauthCallback\",\n      projectId: options.projectId,\n    }),\n    magicLinkCallback: resolveUrlTarget({\n      target: configuredUrls?.magicLinkCallback ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"magic-link-callback\"),\n      handlerName: \"magicLinkCallback\",\n      projectId: options.projectId,\n    }),\n    accountSettings: resolveUrlTarget({\n      target: configuredUrls?.accountSettings ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"account-settings\"),\n      handlerName: \"accountSettings\",\n      projectId: options.projectId,\n    }),\n    teamInvitation: resolveUrlTarget({\n      target: configuredUrls?.teamInvitation ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"team-invitation\"),\n      handlerName: \"teamInvitation\",\n      projectId: options.projectId,\n    }),\n    cliAuthConfirm: resolveUrlTarget({\n      target: configuredUrls?.cliAuthConfirm ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"cli-auth-confirm\"),\n      handlerName: \"cliAuthConfirm\",\n      projectId: options.projectId,\n    }),\n    mfa: resolveUrlTarget({\n      target: configuredUrls?.mfa ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"mfa\"),\n      handlerName: \"mfa\",\n      projectId: options.projectId,\n    }),\n    error: resolveUrlTarget({\n      target: configuredUrls?.error ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"error\"),\n      handlerName: \"error\",\n      projectId: options.projectId,\n    }),\n    onboarding: resolveUrlTarget({\n      target: configuredUrls?.onboarding ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"onboarding\"),\n      handlerName: \"onboarding\",\n      projectId: options.projectId,\n    }),\n  };\n};\n\nexport const buildCliAuthConfirmUrl = (options: {\n  cliAuthConfirmUrl: string,\n  /** Used as the base URL only when cliAuthConfirmUrl is relative. */\n  appUrl: string,\n  loginCode: string,\n}): string => {\n  const url = new URL(options.cliAuthConfirmUrl, options.appUrl);\n  url.searchParams.set(\"login_code\", options.loginCode);\n  return url.toString();\n};\n\nexport const resolveUnknownHandlerPathFallbackUrl = (options: {\n  defaultTarget: DefaultHandlerUrlTarget | undefined,\n  projectId: string,\n  unknownPath: string,\n}): string | null => {\n  const defaultTarget = options.defaultTarget ?? { type: \"handler-component\" } satisfies DefaultHandlerUrlTarget;\n\n  switch (defaultTarget.type) {\n    case \"handler-component\": {\n      return null;\n    }\n    case \"hosted\": {\n      return getHostedHandlerUrl({\n        projectId: options.projectId,\n        pagePath: options.unknownPath,\n      });\n    }\n  }\n};\n\nexport function getPagePrompt(pageName: string, currentVersion?: number): { title: string; fullPrompt: string; upgradePrompt: string | null; latestVersion: number } | null {\n  if (!(pageName in customPagePrompts)) return null;\n  const prompt = customPagePrompts[pageName as keyof typeof customPagePrompts];\n  const versionKeys = Object.keys(prompt.versions).map(Number);\n  const latestVersion = versionKeys.length > 0 ? Math.max(...versionKeys) : 0;\n\n  let upgradePrompt: string | null = null;\n  if (currentVersion != null) {\n    const relevantVersions = versionKeys\n      .filter(v => v > currentVersion)\n      .sort((a, b) => a - b);\n    const prompts = relevantVersions\n      .map(v => prompt.versions[v].upgradePrompt)\n      .filter(p => p.length > 0);\n    upgradePrompt = prompts.length > 0 ? prompts.join(\"\\n\\n\") : null;\n  } else {\n    const upgradeEntry = latestVersion > 0 ? prompt.versions[latestVersion] : undefined;\n    upgradePrompt = upgradeEntry?.upgradePrompt ?? null;\n  }\n\n  return { title: prompt.title, fullPrompt: prompt.fullPrompt, upgradePrompt, latestVersion };\n}\n\nexport const isHostedHandlerUrlForProject = (options: { url: string, projectId: string }): boolean => {\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(options.url);\n  } catch {\n    return false;\n  }\n\n  const hostedBaseUrl = new URL(getHostedHandlerUrl({ projectId: options.projectId, pagePath: \"\" }));\n  return parsedUrl.origin === hostedBaseUrl.origin\n    && (parsedUrl.pathname === hostedBaseUrl.pathname || parsedUrl.pathname.startsWith(`${hostedBaseUrl.pathname}/`));\n};\n"],"mappings":";;;;;;AAUA,MAAM,4BAA4B;AAClC,MAAM,oBAAoB;AAE1B,MAAM,oBAAsF,sBAAsB;AAElH,MAAM,4BAA4B,UAAkB,aAA6B;CAC/E,MAAM,qBAAqB,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IACnE,SAAS,MAAM,GAAG,GAAG,GACrB;AACJ,KAAI,SAAS,WAAW,EACtB,QAAO;AAET,KAAI,uBAAuB,IACzB,QAAO,IAAI;AAEb,QAAO,GAAG,mBAAmB,GAAG;;AAGlC,MAAM,mCAAmC,gBAA2C;AAClF,SAAQ,aAAR;EACE,KAAK,UACH,QAAO;EAET,KAAK,OACH,QAAO;EAET,KAAK,cACH,QAAO;EAET,KAAK,cACH,QAAO;EAET,KAAK,eACH,QAAO;EAET,KAAK,SACH,QAAO;EAET,KAAK,SACH,QAAO;EAET,KAAK,UACH,QAAO;EAET,KAAK,oBACH,QAAO;EAET,KAAK,gBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,gBACH,QAAO;EAET,KAAK,oBACH,QAAO;EAET,KAAK,kBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,MACH,QAAO;EAET,KAAK,QACH,QAAO;EAET,KAAK,aACH,QAAO;;;AAKb,MAAM,0BAA0B,YAGlB;CACZ,MAAM,cAAc,QAAQ;AAC5B,KAAI,eAAe,mBAAmB;EACpC,MAAM,mBAAmB,kBAAkB;AAC3C,MAAI,QAAQ,OAAO,YAAY,KAAK,QAAQ,OAAO,WAAW,iBAAiB,SAC7E,QAAO,QAAQ,OAAO;AAGxB,QAAM,IAAI,MAAM,mCAAmC,QAAQ,OAAO,QAAQ,OAAO,QAAQ,YAAY,WAAW,QAAQ,OAAO,IAAI,iDAAiD,KAAK,IAAI,GAAG,GAAG,OAAO,KAAK,iBAAiB,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,6EAA6E;OAEpU,OAAM,IAAI,MAAM,cAAc,QAAQ,YAAY,uEAAuE;;AAI7H,MAAa,uBAAuB,YAA6D;CAC/F,MAAM,qBAAqB,QAAQ,SAAS,QAAQ,QAAQ,GAAG;CAC/D,MAAM,aAAa,mBAAmB,SAAS,IAAI,WAAW,uBAAuB;AACrF,QAAO,8BAA8B;EACnC,WAAW,QAAQ;EACnB;EACA,2BAA2B,QAAQ;EACnC,0BAA0B,QAAQ;EAClC,iBAAiB,QAAQ;EAC1B,CAAC;;AAGJ,MAAM,uBAAuB,QAAyB;AACpD,KAAI,IAAI,WAAW,KAAK,CACtB,QAAO;AAET,QAAO,CAAC,kBAAkB,KAAK,IAAI;;AAGrC,MAAa,2BAA2B,YAIzB;CACb,MAAM,YAAY,IAAI,IAAI,QAAQ,WAAW,0BAA0B;AAGvE,KAAI,EAFwB,UAAU,aAAa,QAAQ,eACtD,UAAU,SAAS,WAAW,GAAG,QAAQ,YAAY,GAAG,EAE3D,QAAO;AAIT,KAAI,QAAQ,iBAAiB,KAC3B,QAAO;AAGT,QAAO,oBAAoB,QAAQ,UAAU,IAAI,UAAU,WAAW,QAAQ;;AAGhF,MAAM,oBAAoB,YAKZ;AACZ,KAAI,OAAO,QAAQ,WAAW,SAC5B,QAAO,QAAQ;AAGjB,SAAQ,QAAQ,OAAO,MAAvB;EACE,KAAK,oBACH,QAAO,QAAQ;EAEjB,KAAK,SACH,QAAO,oBAAoB;GACzB,WAAW,QAAQ;GACnB,UAAU,gCAAgC,QAAQ,YAAY;GAC/D,CAAC;EAEJ,KAAK,SACH,QAAO,uBAAuB;GAC5B,QAAQ,QAAQ;GAChB,aAAa,QAAQ;GACtB,CAAC;;;AAKR,MAAM,uCAAuC,WAAmC;CAC9E,MAAM,MAAM,OAAO,WAAW,WAC1B,SACA,OAAO,SAAS,WACd,OAAO,MACP;AACN,KAAI,OAAO,QAAQ,CAAC,oBAAoB,IAAI,CAC1C,OAAM,IAAI,uBAAuB,yCAAyC;EACxE,kBAAkB;EAClB,MAAM;EACP,CAAC;;AAIN,MAAa,sBAAsB,YAA6F;CAC9H,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,gBAAgB,gBAAgB,WAAW,EAAE,MAAM,qBAAqB;CAC9E,MAAM,sBAAwC,gBAAgB,kBAC5D,cAAc,SAAS,WACnB,gBACA,EAAE,MAAM,qBAAqB;AAEnC,qCAAoC,oBAAoB;CACxD,IAAI,2BAA2B;AAC/B,KAAI,OAAO,gBAAgB,YAAY,SACrC,4BAA2B,eAAe;UACjC,gBAAgB,WAAW,QAAQ,eAAe,QAAQ,SAAS,SAC5E,4BAA2B,uBAAuB;EAChD,QAAQ,eAAe;EACvB,aAAa;EACd,CAAC;CAGJ,MAAM,OAAO,iBAAiB;EAC5B,QAAQ,gBAAgB,QAAQ;EAChC,cAAc;EACd,aAAa;EACb,WAAW,QAAQ;EACpB,CAAC;CACF,MAAM,cAAc,iBAAiB;EACnC,QAAQ,gBAAgB,eAAe;EACvC,cAAc;EACd,aAAa;EACb,WAAW,QAAQ;EACpB,CAAC;AAEF,QAAO;EACL,SAAS,iBAAiB;GACxB,QAAQ,gBAAgB,WAAW;GACnC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,QAAQ,iBAAiB;GACvB,QAAQ,gBAAgB,UAAU;GAClC,cAAc,yBAAyB,0BAA0B,UAAU;GAC3E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,QAAQ,iBAAiB;GACvB,QAAQ,gBAAgB,UAAU;GAClC,cAAc,yBAAyB,0BAA0B,UAAU;GAC3E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF;EACA,aAAa,iBAAiB;GAC5B,QAAQ,gBAAgB,eAAe;GACvC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,SAAS,iBAAiB;GACxB,QAAQ,gBAAgB,WAAW;GACnC,cAAc,yBAAyB,0BAA0B,WAAW;GAC5E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,cAAc,iBAAiB;GAC7B,QAAQ,gBAAgB,gBAAgB;GACxC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,mBAAmB,iBAAiB;GAClC,QAAQ,gBAAgB,qBAAqB;GAC7C,cAAc,yBAAyB,0BAA0B,qBAAqB;GACtF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,eAAe,iBAAiB;GAC9B,QAAQ,gBAAgB,iBAAiB;GACzC,cAAc,yBAAyB,0BAA0B,iBAAiB;GAClF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,kBAAkB;GACnF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF;EACA,eAAe,iBAAiB;GAC9B,QAAQ;GACR,cAAc,yBAAyB,0BAA0B,iBAAiB;GAClF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,mBAAmB,iBAAiB;GAClC,QAAQ,gBAAgB,qBAAqB;GAC7C,cAAc,yBAAyB,0BAA0B,sBAAsB;GACvF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,iBAAiB,iBAAiB;GAChC,QAAQ,gBAAgB,mBAAmB;GAC3C,cAAc,yBAAyB,0BAA0B,mBAAmB;GACpF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,kBAAkB;GACnF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,mBAAmB;GACpF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,KAAK,iBAAiB;GACpB,QAAQ,gBAAgB,OAAO;GAC/B,cAAc,yBAAyB,0BAA0B,MAAM;GACvE,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,OAAO,iBAAiB;GACtB,QAAQ,gBAAgB,SAAS;GACjC,cAAc,yBAAyB,0BAA0B,QAAQ;GACzE,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,YAAY,iBAAiB;GAC3B,QAAQ,gBAAgB,cAAc;GACtC,cAAc,yBAAyB,0BAA0B,aAAa;GAC9E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACH;;AAGH,MAAa,0BAA0B,YAKzB;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ,mBAAmB,QAAQ,OAAO;AAC9D,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AACrD,QAAO,IAAI,UAAU;;AAGvB,MAAa,wCAAwC,YAIhC;AAGnB,UAFsB,QAAQ,iBAAiB,EAAE,MAAM,qBAAqB,EAEtD,MAAtB;EACE,KAAK,oBACH,QAAO;EAET,KAAK,SACH,QAAO,oBAAoB;GACzB,WAAW,QAAQ;GACnB,UAAU,QAAQ;GACnB,CAAC;;;AAKR,SAAgB,cAAc,UAAkB,gBAA4H;AAC1K,KAAI,EAAE,YAAY,mBAAoB,QAAO;CAC7C,MAAM,SAAS,kBAAkB;CACjC,MAAM,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC,IAAI,OAAO;CAC5D,MAAM,gBAAgB,YAAY,SAAS,IAAI,KAAK,IAAI,GAAG,YAAY,GAAG;CAE1E,IAAI,gBAA+B;AACnC,KAAI,kBAAkB,MAAM;EAI1B,MAAM,UAHmB,YACtB,QAAO,MAAK,IAAI,eAAe,CAC/B,MAAM,GAAG,MAAM,IAAI,EAAE,CAErB,KAAI,MAAK,OAAO,SAAS,GAAG,cAAc,CAC1C,QAAO,MAAK,EAAE,SAAS,EAAE;AAC5B,kBAAgB,QAAQ,SAAS,IAAI,QAAQ,KAAK,OAAO,GAAG;OAG5D,kBADqB,gBAAgB,IAAI,OAAO,SAAS,iBAAiB,SAC5C,iBAAiB;AAGjD,QAAO;EAAE,OAAO,OAAO;EAAO,YAAY,OAAO;EAAY;EAAe;EAAe;;AAG7F,MAAa,gCAAgC,YAAyD;CACpG,IAAI;AACJ,KAAI;AACF,cAAY,IAAI,IAAI,QAAQ,IAAI;SAC1B;AACN,SAAO;;CAGT,MAAM,gBAAgB,IAAI,IAAI,oBAAoB;EAAE,WAAW,QAAQ;EAAW,UAAU;EAAI,CAAC,CAAC;AAClG,QAAO,UAAU,WAAW,cAAc,WACpC,UAAU,aAAa,cAAc,YAAY,UAAU,SAAS,WAAW,GAAG,cAAc,SAAS,GAAG"}
+{"version":3,"file":"url-targets.js","names":[],"sources":["../../../../src/lib/stack-app/url-targets.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { getCustomPagePrompts, type CustomPagePrompt } from \"@hexclave/shared/dist/interface/handler-urls\";\nimport { HexclaveAssertionError } from \"@hexclave/shared/dist/utils/errors\";\nimport { getHostedHandlerUrlFromConfig } from \"@hexclave/shared/dist/utils/redirect-urls\";\nimport { envVars } from \"../env\";\nimport { DefaultHandlerUrlTarget, HandlerPageUrls, HandlerUrlOptions, HandlerUrlTarget, HandlerUrls, ResolvedHandlerUrls } from \"./common\";\n\nconst localUrlPlaceholderOrigin = \"http://example.com\";\nconst schemePrefixRegex = /^[a-zA-Z][a-zA-Z\\d+\\-.]*:/;\n\nconst customPagePrompts: Record<keyof Omit<HandlerPageUrls, \"handler\">, CustomPagePrompt> = getCustomPagePrompts();\n\nconst joinHandlerComponentPath = (basePath: string, pagePath: string): string => {\n  const normalizedBasePath = basePath.endsWith(\"/\") && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n  if (pagePath.length === 0) {\n    return normalizedBasePath;\n  }\n  if (normalizedBasePath === \"/\") {\n    return `/${pagePath}`;\n  }\n  return `${normalizedBasePath}/${pagePath}`;\n};\n\nconst getHostedPagePathForHandlerName = (handlerName: keyof HandlerUrls): string => {\n  switch (handlerName) {\n    case \"handler\": {\n      return \"\";\n    }\n    case \"home\": {\n      return \"\";\n    }\n    case \"afterSignIn\": {\n      return \"\";\n    }\n    case \"afterSignUp\": {\n      return \"\";\n    }\n    case \"afterSignOut\": {\n      return \"\";\n    }\n    case \"signIn\": {\n      return \"sign-in\";\n    }\n    case \"signUp\": {\n      return \"sign-up\";\n    }\n    case \"signOut\": {\n      return \"sign-out\";\n    }\n    case \"emailVerification\": {\n      return \"email-verification\";\n    }\n    case \"passwordReset\": {\n      return \"password-reset\";\n    }\n    case \"forgotPassword\": {\n      return \"forgot-password\";\n    }\n    case \"oauthCallback\": {\n      return \"oauth-callback\";\n    }\n    case \"magicLinkCallback\": {\n      return \"magic-link-callback\";\n    }\n    case \"accountSettings\": {\n      return \"account-settings\";\n    }\n    case \"teamInvitation\": {\n      return \"team-invitation\";\n    }\n    case \"cliAuthConfirm\": {\n      return \"cli-auth-confirm\";\n    }\n    case \"mfa\": {\n      return \"mfa\";\n    }\n    case \"error\": {\n      return \"error\";\n    }\n    case \"onboarding\": {\n      return \"onboarding\";\n    }\n  }\n};\n\nconst resolveCustomTargetUrl = (options: {\n  target: { type: \"custom\", url: string, version: number },\n  handlerName: keyof HandlerUrls,\n}): string => {\n  const handlerName = options.handlerName;\n  if (handlerName in customPagePrompts) {\n    const customPagePrompt = customPagePrompts[handlerName as keyof typeof customPagePrompts];\n    if (options.target.version === 0 || options.target.version in customPagePrompt.versions) {\n      return options.target.url;\n    }\n\n    throw new Error(`Unsupported custom page version ${options.target.version} for ${options.handlerName} page at ${options.target.url}. The latest supported version of this page is ${Math.max(0, ...Object.keys(customPagePrompt.versions).map(Number))}. Please upgrade your Hexclave SDK to a version that supports this version.`);\n  } else {\n    throw new Error(`URL target ${options.handlerName} cannot be a custom page. Please specify the URL as a string instead.`);\n  }\n};\n\nexport const getHostedHandlerUrl = (options: { projectId: string, pagePath: string }): string => {\n  const normalizedPagePath = options.pagePath.replace(/^\\/+/, \"\");\n  const hostedPath = normalizedPagePath.length > 0 ? `handler/${normalizedPagePath}` : \"handler\";\n  return getHostedHandlerUrlFromConfig({\n    projectId: options.projectId,\n    hostedPath,\n    hostedHandlerDomainSuffix: envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX,\n    hostedHandlerUrlTemplate: envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE,\n    stackPortPrefix: envVars.NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX,\n  });\n};\n\nconst isRelativeUrlString = (url: string): boolean => {\n  if (url.startsWith(\"//\")) {\n    return false;\n  }\n  return !schemePrefixRegex.test(url);\n};\n\nexport const isLocalHandlerUrlTarget = (options: {\n  targetUrl: string,\n  handlerPath: string,\n  currentOrigin?: string,\n}): boolean => {\n  const urlObject = new URL(options.targetUrl, localUrlPlaceholderOrigin);\n  const isHandlerPathTarget = urlObject.pathname === options.handlerPath\n    || urlObject.pathname.startsWith(`${options.handlerPath}/`);\n  if (!isHandlerPathTarget) {\n    return false;\n  }\n\n  // On server we only have path information, so treat matching handler paths as local.\n  if (options.currentOrigin == null) {\n    return true;\n  }\n\n  return isRelativeUrlString(options.targetUrl) || urlObject.origin === options.currentOrigin;\n};\n\nconst resolveUrlTarget = (options: {\n  target: HandlerUrlTarget,\n  fallbackPath: string,\n  handlerName: keyof HandlerUrls,\n  projectId: string,\n}): string => {\n  if (typeof options.target === \"string\") {\n    return options.target;\n  }\n\n  switch (options.target.type) {\n    case \"handler-component\": {\n      return options.fallbackPath;\n    }\n    case \"hosted\": {\n      return getHostedHandlerUrl({\n        projectId: options.projectId,\n        pagePath: getHostedPagePathForHandlerName(options.handlerName),\n      });\n    }\n    case \"custom\": {\n      return resolveCustomTargetUrl({\n        target: options.target,\n        handlerName: options.handlerName,\n      });\n    }\n  }\n};\n\nconst assertOAuthCallbackTargetIsRelative = (target: HandlerUrlTarget): void => {\n  const url = typeof target === \"string\"\n    ? target\n    : target.type === \"custom\"\n      ? target.url\n      : null;\n  if (url != null && !isRelativeUrlString(url)) {\n    throw new HexclaveAssertionError(\"OAuth callback URLs must be relative.\", {\n      oauthCallbackUrl: url,\n      hint: \"Use a relative URL like '/handler/oauth-callback', or use { type: 'hosted' } to let Stack use the current page for hosted callbacks.\",\n    });\n  }\n};\n\nexport const resolveHandlerUrls = (options: { urls: HandlerUrlOptions | undefined, projectId: string }): ResolvedHandlerUrls => {\n  const configuredUrls = options.urls;\n  const defaultTarget = configuredUrls?.default ?? { type: \"handler-component\" } as const;\n  const oauthCallbackTarget: HandlerUrlTarget = configuredUrls?.oauthCallback ?? (\n    defaultTarget.type === \"hosted\"\n      ? defaultTarget\n      : { type: \"handler-component\" }\n  );\n  assertOAuthCallbackTargetIsRelative(oauthCallbackTarget);\n  let handlerComponentBasePath = \"/handler\";\n  if (typeof configuredUrls?.handler === \"string\") {\n    handlerComponentBasePath = configuredUrls.handler;\n  } else if (configuredUrls?.handler != null && configuredUrls.handler.type === \"custom\") {\n    handlerComponentBasePath = resolveCustomTargetUrl({\n      target: configuredUrls.handler,\n      handlerName: \"handler\",\n    });\n  }\n\n  const home = resolveUrlTarget({\n    target: configuredUrls?.home ?? defaultTarget,\n    fallbackPath: \"/\",\n    handlerName: \"home\",\n    projectId: options.projectId,\n  });\n  const afterSignIn = resolveUrlTarget({\n    target: configuredUrls?.afterSignIn ?? defaultTarget,\n    fallbackPath: home,\n    handlerName: \"afterSignIn\",\n    projectId: options.projectId,\n  });\n\n  return {\n    handler: resolveUrlTarget({\n      target: configuredUrls?.handler ?? defaultTarget,\n      fallbackPath: handlerComponentBasePath,\n      handlerName: \"handler\",\n      projectId: options.projectId,\n    }),\n    signIn: resolveUrlTarget({\n      target: configuredUrls?.signIn ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-in\"),\n      handlerName: \"signIn\",\n      projectId: options.projectId,\n    }),\n    signUp: resolveUrlTarget({\n      target: configuredUrls?.signUp ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-up\"),\n      handlerName: \"signUp\",\n      projectId: options.projectId,\n    }),\n    afterSignIn,\n    afterSignUp: resolveUrlTarget({\n      target: configuredUrls?.afterSignUp ?? defaultTarget,\n      fallbackPath: afterSignIn,\n      handlerName: \"afterSignUp\",\n      projectId: options.projectId,\n    }),\n    signOut: resolveUrlTarget({\n      target: configuredUrls?.signOut ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-out\"),\n      handlerName: \"signOut\",\n      projectId: options.projectId,\n    }),\n    afterSignOut: resolveUrlTarget({\n      target: configuredUrls?.afterSignOut ?? defaultTarget,\n      fallbackPath: home,\n      handlerName: \"afterSignOut\",\n      projectId: options.projectId,\n    }),\n    emailVerification: resolveUrlTarget({\n      target: configuredUrls?.emailVerification ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"email-verification\"),\n      handlerName: \"emailVerification\",\n      projectId: options.projectId,\n    }),\n    passwordReset: resolveUrlTarget({\n      target: configuredUrls?.passwordReset ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"password-reset\"),\n      handlerName: \"passwordReset\",\n      projectId: options.projectId,\n    }),\n    forgotPassword: resolveUrlTarget({\n      target: configuredUrls?.forgotPassword ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"forgot-password\"),\n      handlerName: \"forgotPassword\",\n      projectId: options.projectId,\n    }),\n    home,\n    oauthCallback: resolveUrlTarget({\n      target: oauthCallbackTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"oauth-callback\"),\n      handlerName: \"oauthCallback\",\n      projectId: options.projectId,\n    }),\n    magicLinkCallback: resolveUrlTarget({\n      target: configuredUrls?.magicLinkCallback ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"magic-link-callback\"),\n      handlerName: \"magicLinkCallback\",\n      projectId: options.projectId,\n    }),\n    accountSettings: resolveUrlTarget({\n      target: configuredUrls?.accountSettings ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"account-settings\"),\n      handlerName: \"accountSettings\",\n      projectId: options.projectId,\n    }),\n    teamInvitation: resolveUrlTarget({\n      target: configuredUrls?.teamInvitation ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"team-invitation\"),\n      handlerName: \"teamInvitation\",\n      projectId: options.projectId,\n    }),\n    cliAuthConfirm: resolveUrlTarget({\n      target: configuredUrls?.cliAuthConfirm ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"cli-auth-confirm\"),\n      handlerName: \"cliAuthConfirm\",\n      projectId: options.projectId,\n    }),\n    mfa: resolveUrlTarget({\n      target: configuredUrls?.mfa ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"mfa\"),\n      handlerName: \"mfa\",\n      projectId: options.projectId,\n    }),\n    error: resolveUrlTarget({\n      target: configuredUrls?.error ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"error\"),\n      handlerName: \"error\",\n      projectId: options.projectId,\n    }),\n    onboarding: resolveUrlTarget({\n      target: configuredUrls?.onboarding ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"onboarding\"),\n      handlerName: \"onboarding\",\n      projectId: options.projectId,\n    }),\n  };\n};\n\nexport const buildCliAuthConfirmUrl = (options: {\n  cliAuthConfirmUrl: string,\n  /** Used as the base URL only when cliAuthConfirmUrl is relative. */\n  appUrl: string,\n  loginCode: string,\n}): string => {\n  const url = new URL(options.cliAuthConfirmUrl, options.appUrl);\n  url.searchParams.set(\"login_code\", options.loginCode);\n  return url.toString();\n};\n\nexport const resolveUnknownHandlerPathFallbackUrl = (options: {\n  defaultTarget: DefaultHandlerUrlTarget | undefined,\n  projectId: string,\n  unknownPath: string,\n}): string | null => {\n  const defaultTarget = options.defaultTarget ?? { type: \"handler-component\" } satisfies DefaultHandlerUrlTarget;\n\n  switch (defaultTarget.type) {\n    case \"handler-component\": {\n      return null;\n    }\n    case \"hosted\": {\n      return getHostedHandlerUrl({\n        projectId: options.projectId,\n        pagePath: options.unknownPath,\n      });\n    }\n  }\n};\n\nexport function getPagePrompt(pageName: string, currentVersion?: number): { title: string; fullPrompt: string; upgradePrompt: string | null; latestVersion: number } | null {\n  if (!(pageName in customPagePrompts)) return null;\n  const prompt = customPagePrompts[pageName as keyof typeof customPagePrompts];\n  const versionKeys = Object.keys(prompt.versions).map(Number);\n  const latestVersion = versionKeys.length > 0 ? Math.max(...versionKeys) : 0;\n\n  let upgradePrompt: string | null = null;\n  if (currentVersion != null) {\n    const relevantVersions = versionKeys\n      .filter(v => v > currentVersion)\n      .sort((a, b) => a - b);\n    const prompts = relevantVersions\n      .map(v => prompt.versions[v].upgradePrompt)\n      .filter(p => p.length > 0);\n    upgradePrompt = prompts.length > 0 ? prompts.join(\"\\n\\n\") : null;\n  } else {\n    const upgradeEntry = latestVersion > 0 ? prompt.versions[latestVersion] : undefined;\n    upgradePrompt = upgradeEntry?.upgradePrompt ?? null;\n  }\n\n  return { title: prompt.title, fullPrompt: prompt.fullPrompt, upgradePrompt, latestVersion };\n}\n\nexport const isHostedHandlerUrlForProject = (options: { url: string, projectId: string }): boolean => {\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(options.url);\n  } catch {\n    return false;\n  }\n\n  const hostedBaseUrl = new URL(getHostedHandlerUrl({ projectId: options.projectId, pagePath: \"\" }));\n  return parsedUrl.origin === hostedBaseUrl.origin\n    && (parsedUrl.pathname === hostedBaseUrl.pathname || parsedUrl.pathname.startsWith(`${hostedBaseUrl.pathname}/`));\n};\n"],"mappings":";;;;;;AAUA,MAAM,4BAA4B;AAClC,MAAM,oBAAoB;AAE1B,MAAM,oBAAsF,sBAAsB;AAElH,MAAM,4BAA4B,UAAkB,aAA6B;CAC/E,MAAM,qBAAqB,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IACnE,SAAS,MAAM,GAAG,GAAG,GACrB;AACJ,KAAI,SAAS,WAAW,EACtB,QAAO;AAET,KAAI,uBAAuB,IACzB,QAAO,IAAI;AAEb,QAAO,GAAG,mBAAmB,GAAG;;AAGlC,MAAM,mCAAmC,gBAA2C;AAClF,SAAQ,aAAR;EACE,KAAK,UACH,QAAO;EAET,KAAK,OACH,QAAO;EAET,KAAK,cACH,QAAO;EAET,KAAK,cACH,QAAO;EAET,KAAK,eACH,QAAO;EAET,KAAK,SACH,QAAO;EAET,KAAK,SACH,QAAO;EAET,KAAK,UACH,QAAO;EAET,KAAK,oBACH,QAAO;EAET,KAAK,gBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,gBACH,QAAO;EAET,KAAK,oBACH,QAAO;EAET,KAAK,kBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,MACH,QAAO;EAET,KAAK,QACH,QAAO;EAET,KAAK,aACH,QAAO;;;AAKb,MAAM,0BAA0B,YAGlB;CACZ,MAAM,cAAc,QAAQ;AAC5B,KAAI,eAAe,mBAAmB;EACpC,MAAM,mBAAmB,kBAAkB;AAC3C,MAAI,QAAQ,OAAO,YAAY,KAAK,QAAQ,OAAO,WAAW,iBAAiB,SAC7E,QAAO,QAAQ,OAAO;AAGxB,QAAM,IAAI,MAAM,mCAAmC,QAAQ,OAAO,QAAQ,OAAO,QAAQ,YAAY,WAAW,QAAQ,OAAO,IAAI,iDAAiD,KAAK,IAAI,GAAG,GAAG,OAAO,KAAK,iBAAiB,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,6EAA6E;OAEpU,OAAM,IAAI,MAAM,cAAc,QAAQ,YAAY,uEAAuE;;AAI7H,MAAa,uBAAuB,YAA6D;CAC/F,MAAM,qBAAqB,QAAQ,SAAS,QAAQ,QAAQ,GAAG;CAC/D,MAAM,aAAa,mBAAmB,SAAS,IAAI,WAAW,uBAAuB;AACrF,QAAO,8BAA8B;EACnC,WAAW,QAAQ;EACnB;EACA,2BAA2B,QAAQ;EACnC,0BAA0B,QAAQ;EAClC,iBAAiB,QAAQ;EAC1B,CAAC;;AAGJ,MAAM,uBAAuB,QAAyB;AACpD,KAAI,IAAI,WAAW,KAAK,CACtB,QAAO;AAET,QAAO,CAAC,kBAAkB,KAAK,IAAI;;AAGrC,MAAa,2BAA2B,YAIzB;CACb,MAAM,YAAY,IAAI,IAAI,QAAQ,WAAW,0BAA0B;AAGvE,KAAI,EAFwB,UAAU,aAAa,QAAQ,eACtD,UAAU,SAAS,WAAW,GAAG,QAAQ,YAAY,GAAG,EAE3D,QAAO;AAIT,KAAI,QAAQ,iBAAiB,KAC3B,QAAO;AAGT,QAAO,oBAAoB,QAAQ,UAAU,IAAI,UAAU,WAAW,QAAQ;;AAGhF,MAAM,oBAAoB,YAKZ;AACZ,KAAI,OAAO,QAAQ,WAAW,SAC5B,QAAO,QAAQ;AAGjB,SAAQ,QAAQ,OAAO,MAAvB;EACE,KAAK,oBACH,QAAO,QAAQ;EAEjB,KAAK,SACH,QAAO,oBAAoB;GACzB,WAAW,QAAQ;GACnB,UAAU,gCAAgC,QAAQ,YAAY;GAC/D,CAAC;EAEJ,KAAK,SACH,QAAO,uBAAuB;GAC5B,QAAQ,QAAQ;GAChB,aAAa,QAAQ;GACtB,CAAC;;;AAKR,MAAM,uCAAuC,WAAmC;CAC9E,MAAM,MAAM,OAAO,WAAW,WAC1B,SACA,OAAO,SAAS,WACd,OAAO,MACP;AACN,KAAI,OAAO,QAAQ,CAAC,oBAAoB,IAAI,CAC1C,OAAM,IAAI,uBAAuB,yCAAyC;EACxE,kBAAkB;EAClB,MAAM;EACP,CAAC;;AAIN,MAAa,sBAAsB,YAA6F;CAC9H,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,gBAAgB,gBAAgB,WAAW,EAAE,MAAM,qBAAqB;CAC9E,MAAM,sBAAwC,gBAAgB,kBAC5D,cAAc,SAAS,WACnB,gBACA,EAAE,MAAM,qBAAqB;AAEnC,qCAAoC,oBAAoB;CACxD,IAAI,2BAA2B;AAC/B,KAAI,OAAO,gBAAgB,YAAY,SACrC,4BAA2B,eAAe;UACjC,gBAAgB,WAAW,QAAQ,eAAe,QAAQ,SAAS,SAC5E,4BAA2B,uBAAuB;EAChD,QAAQ,eAAe;EACvB,aAAa;EACd,CAAC;CAGJ,MAAM,OAAO,iBAAiB;EAC5B,QAAQ,gBAAgB,QAAQ;EAChC,cAAc;EACd,aAAa;EACb,WAAW,QAAQ;EACpB,CAAC;CACF,MAAM,cAAc,iBAAiB;EACnC,QAAQ,gBAAgB,eAAe;EACvC,cAAc;EACd,aAAa;EACb,WAAW,QAAQ;EACpB,CAAC;AAEF,QAAO;EACL,SAAS,iBAAiB;GACxB,QAAQ,gBAAgB,WAAW;GACnC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,QAAQ,iBAAiB;GACvB,QAAQ,gBAAgB,UAAU;GAClC,cAAc,yBAAyB,0BAA0B,UAAU;GAC3E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,QAAQ,iBAAiB;GACvB,QAAQ,gBAAgB,UAAU;GAClC,cAAc,yBAAyB,0BAA0B,UAAU;GAC3E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF;EACA,aAAa,iBAAiB;GAC5B,QAAQ,gBAAgB,eAAe;GACvC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,SAAS,iBAAiB;GACxB,QAAQ,gBAAgB,WAAW;GACnC,cAAc,yBAAyB,0BAA0B,WAAW;GAC5E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,cAAc,iBAAiB;GAC7B,QAAQ,gBAAgB,gBAAgB;GACxC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,mBAAmB,iBAAiB;GAClC,QAAQ,gBAAgB,qBAAqB;GAC7C,cAAc,yBAAyB,0BAA0B,qBAAqB;GACtF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,eAAe,iBAAiB;GAC9B,QAAQ,gBAAgB,iBAAiB;GACzC,cAAc,yBAAyB,0BAA0B,iBAAiB;GAClF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,kBAAkB;GACnF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF;EACA,eAAe,iBAAiB;GAC9B,QAAQ;GACR,cAAc,yBAAyB,0BAA0B,iBAAiB;GAClF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,mBAAmB,iBAAiB;GAClC,QAAQ,gBAAgB,qBAAqB;GAC7C,cAAc,yBAAyB,0BAA0B,sBAAsB;GACvF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,iBAAiB,iBAAiB;GAChC,QAAQ,gBAAgB,mBAAmB;GAC3C,cAAc,yBAAyB,0BAA0B,mBAAmB;GACpF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,kBAAkB;GACnF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,mBAAmB;GACpF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,KAAK,iBAAiB;GACpB,QAAQ,gBAAgB,OAAO;GAC/B,cAAc,yBAAyB,0BAA0B,MAAM;GACvE,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,OAAO,iBAAiB;GACtB,QAAQ,gBAAgB,SAAS;GACjC,cAAc,yBAAyB,0BAA0B,QAAQ;GACzE,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,YAAY,iBAAiB;GAC3B,QAAQ,gBAAgB,cAAc;GACtC,cAAc,yBAAyB,0BAA0B,aAAa;GAC9E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACH;;AAGH,MAAa,0BAA0B,YAKzB;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ,mBAAmB,QAAQ,OAAO;AAC9D,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AACrD,QAAO,IAAI,UAAU;;AAGvB,MAAa,wCAAwC,YAIhC;AAGnB,UAFsB,QAAQ,iBAAiB,EAAE,MAAM,qBAAqB,EAEtD,MAAtB;EACE,KAAK,oBACH,QAAO;EAET,KAAK,SACH,QAAO,oBAAoB;GACzB,WAAW,QAAQ;GACnB,UAAU,QAAQ;GACnB,CAAC;;;AAKR,SAAgB,cAAc,UAAkB,gBAA4H;AAC1K,KAAI,EAAE,YAAY,mBAAoB,QAAO;CAC7C,MAAM,SAAS,kBAAkB;CACjC,MAAM,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC,IAAI,OAAO;CAC5D,MAAM,gBAAgB,YAAY,SAAS,IAAI,KAAK,IAAI,GAAG,YAAY,GAAG;CAE1E,IAAI,gBAA+B;AACnC,KAAI,kBAAkB,MAAM;EAI1B,MAAM,UAHmB,YACtB,QAAO,MAAK,IAAI,eAAe,CAC/B,MAAM,GAAG,MAAM,IAAI,EAAE,CAErB,KAAI,MAAK,OAAO,SAAS,GAAG,cAAc,CAC1C,QAAO,MAAK,EAAE,SAAS,EAAE;AAC5B,kBAAgB,QAAQ,SAAS,IAAI,QAAQ,KAAK,OAAO,GAAG;OAG5D,kBADqB,gBAAgB,IAAI,OAAO,SAAS,iBAAiB,SAC5C,iBAAiB;AAGjD,QAAO;EAAE,OAAO,OAAO;EAAO,YAAY,OAAO;EAAY;EAAe;EAAe;;AAG7F,MAAa,gCAAgC,YAAyD;CACpG,IAAI;AACJ,KAAI;AACF,cAAY,IAAI,IAAI,QAAQ,IAAI;SAC1B;AACN,SAAO;;CAGT,MAAM,gBAAgB,IAAI,IAAI,oBAAoB;EAAE,WAAW,QAAQ;EAAW,UAAU;EAAI,CAAC,CAAC;AAClG,QAAO,UAAU,WAAW,cAAc,WACpC,UAAU,aAAa,cAAc,YAAY,UAAU,SAAS,WAAW,GAAG,cAAc,SAAS,GAAG"}

package/dist/esm/lib/stack-app/url-targets.test.js

@@ -149,7 +149,7 @@ describe("handler URL targets", () => {
 		})).toBe("https://project-id.example-stack-hosted.test/handler/custom-page");
 	});
 	it("uses the full hosted handler URL template when configured", () => {
-		vi.stubEnv("NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE", "http://{projectId}.localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09/{hostedPath}");
+		vi.stubEnv("NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE", "http://{projectId}.localhost:${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}09/{hostedPath}");
 		vi.stubEnv("NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX", "93");
 		const urls = resolveHandlerUrls({
 			projectId: "project-id",

package/dist/esm/lib/stack-app/url-targets.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-targets.test.js","names":[],"sources":["../../../../src/lib/stack-app/url-targets.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { buildCliAuthConfirmUrl, getPagePrompt, isLocalHandlerUrlTarget, resolveHandlerUrls, resolveUnknownHandlerPathFallbackUrl } from \"./url-targets\";\n\ndescribe(\"handler URL targets\", () => {\n  afterEach(() => {\n    vi.unstubAllEnvs();\n  });\n\n  it(\"treats handler-component targets the same as omitted values\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: \"/custom-handler\",\n        signIn: { type: \"handler-component\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"treats custom v0 page targets like legacy string targets\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: \"/custom-handler\",\n        signIn: { type: \"handler-component\" },\n        signUp: { type: \"custom\", url: \"/sign-up-explicit\", version: 0 },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-handler/sign-in\");\n    expect(urls.signUp).toBe(\"/sign-up-explicit\");\n  });\n\n  it(\"throws on v0 custom target for handler page\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: { type: \"custom\", url: \"/custom-handler\", version: 0 },\n      },\n    })).toThrowError(/cannot be a custom page/);\n  });\n\n  it(\"supports the latest documented custom target version\", () => {\n    const signInPrompt = getPagePrompt(\"signIn\");\n    if (signInPrompt == null) {\n      throw new Error(\"Expected signIn prompt metadata to exist\");\n    }\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signIn: { type: \"custom\", url: \"/custom-sign-in\", version: signInPrompt.latestVersion },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-sign-in\");\n  });\n\n  it(\"throws on custom target versions newer than the latest supported version\", () => {\n    const signInPrompt = getPagePrompt(\"signIn\");\n    if (signInPrompt == null) {\n      throw new Error(\"Expected signIn prompt metadata to exist\");\n    }\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signIn: { type: \"custom\", url: \"/custom-sign-in\", version: signInPrompt.latestVersion + 1 },\n      },\n    })).toThrowError(/Unsupported custom page version/);\n  });\n\n  it(\"throws on non-zero custom version for handler page\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: { type: \"custom\", url: \"/custom-handler\", version: 1 },\n      },\n    })).toThrowError(/cannot be a custom page/);\n  });\n\n  it(\"uses hosted defaults for unspecified URLs\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signUp: \"/sign-up\",\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signUp).toBe(\"/sign-up\");\n    expect(urls.signIn).toBe(\"https://project-id.example-stack-hosted.test/handler/sign-in\");\n    expect(urls.cliAuthConfirm).toBe(\"https://project-id.example-stack-hosted.test/handler/cli-auth-confirm\");\n  });\n\n  it(\"rejects absolute OAuth callback string targets\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        oauthCallback: \"https://app.example.test/oauth-callback\",\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [HexclaveAssertionError: OAuth callback URLs must be relative.\n\n      This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n    `);\n  });\n\n  it(\"rejects absolute OAuth callback custom targets\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        oauthCallback: { type: \"custom\", url: \"https://app.example.test/oauth-callback\", version: 0 },\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [HexclaveAssertionError: OAuth callback URLs must be relative.\n\n      This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n    `);\n  });\n\n  it(\"inherits a hosted default target for the OAuth callback\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"https://project-id.example-stack-hosted.test/handler/sign-in\");\n    expect(urls.oauthCallback).toBe(\"https://project-id.example-stack-hosted.test/handler/oauth-callback\");\n  });\n\n  it(\"supports custom CLI auth confirmation targets\", () => {\n    const cliAuthConfirmPrompt = getPagePrompt(\"cliAuthConfirm\");\n    if (cliAuthConfirmPrompt == null) {\n      throw new Error(\"Expected cliAuthConfirm prompt metadata to exist\");\n    }\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        cliAuthConfirm: { type: \"custom\", url: \"/cli/authorize\", version: cliAuthConfirmPrompt.latestVersion },\n      },\n    });\n\n    expect(urls.cliAuthConfirm).toBe(\"/cli/authorize\");\n  });\n\n  it(\"builds CLI auth login URLs from the resolved confirmation target\", () => {\n    expect(buildCliAuthConfirmUrl({\n      cliAuthConfirmUrl: \"/cli/authorize\",\n      appUrl: \"https://app.example.test/base\",\n      loginCode: \"login-code\",\n    })).toBe(\"https://app.example.test/cli/authorize?login_code=login-code\");\n  });\n\n  it(\"uses default target for unknown /handler/* pages\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const url = resolveUnknownHandlerPathFallbackUrl({\n      defaultTarget: { type: \"hosted\" },\n      projectId: \"project-id\",\n      unknownPath: \"custom-page\",\n    });\n\n    expect(url).toBe(\"https://project-id.example-stack-hosted.test/handler/custom-page\");\n  });\n\n  it(\"uses the full hosted handler URL template when configured\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://{projectId}.localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09/{hostedPath}\");\n    vi.stubEnv(\"NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX\", \"93\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"http://project-id.localhost:9309/handler/sign-in\");\n    expect(urls.accountSettings).toBe(\"http://project-id.localhost:9309/handler/account-settings\");\n  });\n\n  it(\"validates the hosted handler URL template placeholders\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://localhost:9309/{projectId}/handler\");\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    })).toThrowError(/\\{projectId\\} and \\{hostedPath\\}/);\n  });\n\n  it(\"rejects hosted handler URL templates that put the project ID in the path\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://localhost:9309/{projectId}/{hostedPath}\");\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [HexclaveAssertionError: The hosted handler URL template must put {projectId} in the hostname.\n\n      This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n    `);\n  });\n});\n\ndescribe(\"isLocalHandlerUrlTarget\", () => {\n  it(\"treats relative handler URLs as local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(true);\n  });\n\n  it(\"treats same-origin absolute handler URLs as local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"http://p91.localhost:9101/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(true);\n  });\n\n  it(\"treats cross-origin absolute handler URLs as non-local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"https://project-id.built-with-hexclave.com/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(false);\n  });\n\n  it(\"treats non-handler paths as non-local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"/projects\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(false);\n  });\n});\n"],"mappings":";;;;AAOA,SAAS,6BAA6B;AACpC,iBAAgB;AACd,KAAG,eAAe;GAClB;AAEF,IAAG,qEAAqE;AAStE,SARa,mBAAmB;GAC9B,WAAW;GACX,MAAM;IACJ,SAAS;IACT,QAAQ,EAAE,MAAM,qBAAqB;IACtC;GACF,CAAC,CAEU,OAAO,CAAC,KAAK,0BAA0B;GACnD;AAEF,IAAG,kEAAkE;EACnE,MAAM,OAAO,mBAAmB;GAC9B,WAAW;GACX,MAAM;IACJ,SAAS;IACT,QAAQ,EAAE,MAAM,qBAAqB;IACrC,QAAQ;KAAE,MAAM;KAAU,KAAK;KAAqB,SAAS;KAAG;IACjE;GACF,CAAC;AAEF,SAAO,KAAK,OAAO,CAAC,KAAK,0BAA0B;AACnD,SAAO,KAAK,OAAO,CAAC,KAAK,oBAAoB;GAC7C;AAEF,IAAG,qDAAqD;AACtD,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS;IAAG,EAChE;GACF,CAAC,CAAC,CAAC,aAAa,0BAA0B;GAC3C;AAEF,IAAG,8DAA8D;EAC/D,MAAM,eAAe,cAAc,SAAS;AAC5C,MAAI,gBAAgB,KAClB,OAAM,IAAI,MAAM,2CAA2C;AAU7D,SAPa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,QAAQ;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS,aAAa;IAAe,EACxF;GACF,CAAC,CAEU,OAAO,CAAC,KAAK,kBAAkB;GAC3C;AAEF,IAAG,kFAAkF;EACnF,MAAM,eAAe,cAAc,SAAS;AAC5C,MAAI,gBAAgB,KAClB,OAAM,IAAI,MAAM,2CAA2C;AAG7D,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,QAAQ;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS,aAAa,gBAAgB;IAAG,EAC5F;GACF,CAAC,CAAC,CAAC,aAAa,kCAAkC;GACnD;AAEF,IAAG,4DAA4D;AAC7D,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS;IAAG,EAChE;GACF,CAAC,CAAC,CAAC,aAAa,0BAA0B;GAC3C;AAEF,IAAG,mDAAmD;AACpD,KAAG,QAAQ,kDAAkD,6BAA6B;EAE1F,MAAM,OAAO,mBAAmB;GAC9B,WAAW;GACX,MAAM;IACJ,QAAQ;IACR,SAAS,EAAE,MAAM,UAAU;IAC5B;GACF,CAAC;AAEF,SAAO,KAAK,OAAO,CAAC,KAAK,WAAW;AACpC,SAAO,KAAK,OAAO,CAAC,KAAK,+DAA+D;AACxF,SAAO,KAAK,eAAe,CAAC,KAAK,wEAAwE;GACzG;AAEF,IAAG,wDAAwD;AACzD,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,eAAe,2CAChB;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;AAEF,IAAG,wDAAwD;AACzD,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,eAAe;IAAE,MAAM;IAAU,KAAK;IAA2C,SAAS;IAAG,EAC9F;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;AAEF,IAAG,iEAAiE;AAClE,KAAG,QAAQ,kDAAkD,6BAA6B;EAE1F,MAAM,OAAO,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC;AAEF,SAAO,KAAK,OAAO,CAAC,KAAK,+DAA+D;AACxF,SAAO,KAAK,cAAc,CAAC,KAAK,sEAAsE;GACtG;AAEF,IAAG,uDAAuD;EACxD,MAAM,uBAAuB,cAAc,iBAAiB;AAC5D,MAAI,wBAAwB,KAC1B,OAAM,IAAI,MAAM,mDAAmD;AAUrE,SAPa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,gBAAgB;IAAE,MAAM;IAAU,KAAK;IAAkB,SAAS,qBAAqB;IAAe,EACvG;GACF,CAAC,CAEU,eAAe,CAAC,KAAK,iBAAiB;GAClD;AAEF,IAAG,0EAA0E;AAC3E,SAAO,uBAAuB;GAC5B,mBAAmB;GACnB,QAAQ;GACR,WAAW;GACZ,CAAC,CAAC,CAAC,KAAK,+DAA+D;GACxE;AAEF,IAAG,0DAA0D;AAC3D,KAAG,QAAQ,kDAAkD,6BAA6B;AAQ1F,SANY,qCAAqC;GAC/C,eAAe,EAAE,MAAM,UAAU;GACjC,WAAW;GACX,aAAa;GACd,CAAC,CAES,CAAC,KAAK,mEAAmE;GACpF;AAEF,IAAG,mEAAmE;AACpE,KAAG,QAAQ,iDAAiD,mFAAmF;AAC/I,KAAG,QAAQ,oCAAoC,KAAK;EAEpD,MAAM,OAAO,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC;AAEF,SAAO,KAAK,OAAO,CAAC,KAAK,mDAAmD;AAC5E,SAAO,KAAK,gBAAgB,CAAC,KAAK,4DAA4D;GAC9F;AAEF,IAAG,gEAAgE;AACjE,KAAG,QAAQ,iDAAiD,4CAA4C;AAExG,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC,CAAC,CAAC,aAAa,mCAAmC;GACpD;AAEF,IAAG,kFAAkF;AACnF,KAAG,QAAQ,iDAAiD,iDAAiD;AAE7G,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;EACF;AAEF,SAAS,iCAAiC;AACxC,IAAG,uDAAuD;AACxD,SAAO,wBAAwB;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,KAAK;GACd;AAEF,IAAG,mEAAmE;AACpE,SAAO,wBAAwB;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,KAAK;GACd;AAEF,IAAG,wEAAwE;AACzE,SAAO,wBAAwB;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,MAAM;GACf;AAEF,IAAG,uDAAuD;AACxD,SAAO,wBAAwB;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,MAAM;GACf;EACF"}
+{"version":3,"file":"url-targets.test.js","names":[],"sources":["../../../../src/lib/stack-app/url-targets.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { buildCliAuthConfirmUrl, getPagePrompt, isLocalHandlerUrlTarget, resolveHandlerUrls, resolveUnknownHandlerPathFallbackUrl } from \"./url-targets\";\n\ndescribe(\"handler URL targets\", () => {\n  afterEach(() => {\n    vi.unstubAllEnvs();\n  });\n\n  it(\"treats handler-component targets the same as omitted values\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: \"/custom-handler\",\n        signIn: { type: \"handler-component\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"treats custom v0 page targets like legacy string targets\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: \"/custom-handler\",\n        signIn: { type: \"handler-component\" },\n        signUp: { type: \"custom\", url: \"/sign-up-explicit\", version: 0 },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-handler/sign-in\");\n    expect(urls.signUp).toBe(\"/sign-up-explicit\");\n  });\n\n  it(\"throws on v0 custom target for handler page\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: { type: \"custom\", url: \"/custom-handler\", version: 0 },\n      },\n    })).toThrowError(/cannot be a custom page/);\n  });\n\n  it(\"supports the latest documented custom target version\", () => {\n    const signInPrompt = getPagePrompt(\"signIn\");\n    if (signInPrompt == null) {\n      throw new Error(\"Expected signIn prompt metadata to exist\");\n    }\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signIn: { type: \"custom\", url: \"/custom-sign-in\", version: signInPrompt.latestVersion },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-sign-in\");\n  });\n\n  it(\"throws on custom target versions newer than the latest supported version\", () => {\n    const signInPrompt = getPagePrompt(\"signIn\");\n    if (signInPrompt == null) {\n      throw new Error(\"Expected signIn prompt metadata to exist\");\n    }\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signIn: { type: \"custom\", url: \"/custom-sign-in\", version: signInPrompt.latestVersion + 1 },\n      },\n    })).toThrowError(/Unsupported custom page version/);\n  });\n\n  it(\"throws on non-zero custom version for handler page\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: { type: \"custom\", url: \"/custom-handler\", version: 1 },\n      },\n    })).toThrowError(/cannot be a custom page/);\n  });\n\n  it(\"uses hosted defaults for unspecified URLs\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signUp: \"/sign-up\",\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signUp).toBe(\"/sign-up\");\n    expect(urls.signIn).toBe(\"https://project-id.example-stack-hosted.test/handler/sign-in\");\n    expect(urls.cliAuthConfirm).toBe(\"https://project-id.example-stack-hosted.test/handler/cli-auth-confirm\");\n  });\n\n  it(\"rejects absolute OAuth callback string targets\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        oauthCallback: \"https://app.example.test/oauth-callback\",\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [HexclaveAssertionError: OAuth callback URLs must be relative.\n\n      This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n    `);\n  });\n\n  it(\"rejects absolute OAuth callback custom targets\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        oauthCallback: { type: \"custom\", url: \"https://app.example.test/oauth-callback\", version: 0 },\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [HexclaveAssertionError: OAuth callback URLs must be relative.\n\n      This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n    `);\n  });\n\n  it(\"inherits a hosted default target for the OAuth callback\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"https://project-id.example-stack-hosted.test/handler/sign-in\");\n    expect(urls.oauthCallback).toBe(\"https://project-id.example-stack-hosted.test/handler/oauth-callback\");\n  });\n\n  it(\"supports custom CLI auth confirmation targets\", () => {\n    const cliAuthConfirmPrompt = getPagePrompt(\"cliAuthConfirm\");\n    if (cliAuthConfirmPrompt == null) {\n      throw new Error(\"Expected cliAuthConfirm prompt metadata to exist\");\n    }\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        cliAuthConfirm: { type: \"custom\", url: \"/cli/authorize\", version: cliAuthConfirmPrompt.latestVersion },\n      },\n    });\n\n    expect(urls.cliAuthConfirm).toBe(\"/cli/authorize\");\n  });\n\n  it(\"builds CLI auth login URLs from the resolved confirmation target\", () => {\n    expect(buildCliAuthConfirmUrl({\n      cliAuthConfirmUrl: \"/cli/authorize\",\n      appUrl: \"https://app.example.test/base\",\n      loginCode: \"login-code\",\n    })).toBe(\"https://app.example.test/cli/authorize?login_code=login-code\");\n  });\n\n  it(\"uses default target for unknown /handler/* pages\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const url = resolveUnknownHandlerPathFallbackUrl({\n      defaultTarget: { type: \"hosted\" },\n      projectId: \"project-id\",\n      unknownPath: \"custom-page\",\n    });\n\n    expect(url).toBe(\"https://project-id.example-stack-hosted.test/handler/custom-page\");\n  });\n\n  it(\"uses the full hosted handler URL template when configured\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://{projectId}.localhost:${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}09/{hostedPath}\");\n    vi.stubEnv(\"NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX\", \"93\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"http://project-id.localhost:9309/handler/sign-in\");\n    expect(urls.accountSettings).toBe(\"http://project-id.localhost:9309/handler/account-settings\");\n  });\n\n  it(\"validates the hosted handler URL template placeholders\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://localhost:9309/{projectId}/handler\");\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    })).toThrowError(/\\{projectId\\} and \\{hostedPath\\}/);\n  });\n\n  it(\"rejects hosted handler URL templates that put the project ID in the path\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://localhost:9309/{projectId}/{hostedPath}\");\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [HexclaveAssertionError: The hosted handler URL template must put {projectId} in the hostname.\n\n      This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n    `);\n  });\n});\n\ndescribe(\"isLocalHandlerUrlTarget\", () => {\n  it(\"treats relative handler URLs as local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(true);\n  });\n\n  it(\"treats same-origin absolute handler URLs as local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"http://p91.localhost:9101/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(true);\n  });\n\n  it(\"treats cross-origin absolute handler URLs as non-local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"https://project-id.built-with-hexclave.com/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(false);\n  });\n\n  it(\"treats non-handler paths as non-local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"/projects\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(false);\n  });\n});\n"],"mappings":";;;;AAOA,SAAS,6BAA6B;AACpC,iBAAgB;AACd,KAAG,eAAe;GAClB;AAEF,IAAG,qEAAqE;AAStE,SARa,mBAAmB;GAC9B,WAAW;GACX,MAAM;IACJ,SAAS;IACT,QAAQ,EAAE,MAAM,qBAAqB;IACtC;GACF,CAAC,CAEU,OAAO,CAAC,KAAK,0BAA0B;GACnD;AAEF,IAAG,kEAAkE;EACnE,MAAM,OAAO,mBAAmB;GAC9B,WAAW;GACX,MAAM;IACJ,SAAS;IACT,QAAQ,EAAE,MAAM,qBAAqB;IACrC,QAAQ;KAAE,MAAM;KAAU,KAAK;KAAqB,SAAS;KAAG;IACjE;GACF,CAAC;AAEF,SAAO,KAAK,OAAO,CAAC,KAAK,0BAA0B;AACnD,SAAO,KAAK,OAAO,CAAC,KAAK,oBAAoB;GAC7C;AAEF,IAAG,qDAAqD;AACtD,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS;IAAG,EAChE;GACF,CAAC,CAAC,CAAC,aAAa,0BAA0B;GAC3C;AAEF,IAAG,8DAA8D;EAC/D,MAAM,eAAe,cAAc,SAAS;AAC5C,MAAI,gBAAgB,KAClB,OAAM,IAAI,MAAM,2CAA2C;AAU7D,SAPa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,QAAQ;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS,aAAa;IAAe,EACxF;GACF,CAAC,CAEU,OAAO,CAAC,KAAK,kBAAkB;GAC3C;AAEF,IAAG,kFAAkF;EACnF,MAAM,eAAe,cAAc,SAAS;AAC5C,MAAI,gBAAgB,KAClB,OAAM,IAAI,MAAM,2CAA2C;AAG7D,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,QAAQ;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS,aAAa,gBAAgB;IAAG,EAC5F;GACF,CAAC,CAAC,CAAC,aAAa,kCAAkC;GACnD;AAEF,IAAG,4DAA4D;AAC7D,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS;IAAG,EAChE;GACF,CAAC,CAAC,CAAC,aAAa,0BAA0B;GAC3C;AAEF,IAAG,mDAAmD;AACpD,KAAG,QAAQ,kDAAkD,6BAA6B;EAE1F,MAAM,OAAO,mBAAmB;GAC9B,WAAW;GACX,MAAM;IACJ,QAAQ;IACR,SAAS,EAAE,MAAM,UAAU;IAC5B;GACF,CAAC;AAEF,SAAO,KAAK,OAAO,CAAC,KAAK,WAAW;AACpC,SAAO,KAAK,OAAO,CAAC,KAAK,+DAA+D;AACxF,SAAO,KAAK,eAAe,CAAC,KAAK,wEAAwE;GACzG;AAEF,IAAG,wDAAwD;AACzD,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,eAAe,2CAChB;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;AAEF,IAAG,wDAAwD;AACzD,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,eAAe;IAAE,MAAM;IAAU,KAAK;IAA2C,SAAS;IAAG,EAC9F;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;AAEF,IAAG,iEAAiE;AAClE,KAAG,QAAQ,kDAAkD,6BAA6B;EAE1F,MAAM,OAAO,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC;AAEF,SAAO,KAAK,OAAO,CAAC,KAAK,+DAA+D;AACxF,SAAO,KAAK,cAAc,CAAC,KAAK,sEAAsE;GACtG;AAEF,IAAG,uDAAuD;EACxD,MAAM,uBAAuB,cAAc,iBAAiB;AAC5D,MAAI,wBAAwB,KAC1B,OAAM,IAAI,MAAM,mDAAmD;AAUrE,SAPa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,gBAAgB;IAAE,MAAM;IAAU,KAAK;IAAkB,SAAS,qBAAqB;IAAe,EACvG;GACF,CAAC,CAEU,eAAe,CAAC,KAAK,iBAAiB;GAClD;AAEF,IAAG,0EAA0E;AAC3E,SAAO,uBAAuB;GAC5B,mBAAmB;GACnB,QAAQ;GACR,WAAW;GACZ,CAAC,CAAC,CAAC,KAAK,+DAA+D;GACxE;AAEF,IAAG,0DAA0D;AAC3D,KAAG,QAAQ,kDAAkD,6BAA6B;AAQ1F,SANY,qCAAqC;GAC/C,eAAe,EAAE,MAAM,UAAU;GACjC,WAAW;GACX,aAAa;GACd,CAAC,CAES,CAAC,KAAK,mEAAmE;GACpF;AAEF,IAAG,mEAAmE;AACpE,KAAG,QAAQ,iDAAiD,sFAAsF;AAClJ,KAAG,QAAQ,oCAAoC,KAAK;EAEpD,MAAM,OAAO,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC;AAEF,SAAO,KAAK,OAAO,CAAC,KAAK,mDAAmD;AAC5E,SAAO,KAAK,gBAAgB,CAAC,KAAK,4DAA4D;GAC9F;AAEF,IAAG,gEAAgE;AACjE,KAAG,QAAQ,iDAAiD,4CAA4C;AAExG,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC,CAAC,CAAC,aAAa,mCAAmC;GACpD;AAEF,IAAG,kFAAkF;AACnF,KAAG,QAAQ,iDAAiD,iDAAiD;AAE7G,eAAa,mBAAmB;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;EACF;AAEF,SAAS,iCAAiC;AACxC,IAAG,uDAAuD;AACxD,SAAO,wBAAwB;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,KAAK;GACd;AAEF,IAAG,mEAAmE;AACpE,SAAO,wBAAwB;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,KAAK;GACd;AAEF,IAAG,wEAAwE;AACzE,SAAO,wBAAwB;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,MAAM;GACf;AAEF,IAAG,uDAAuD;AACxD,SAAO,wBAAwB;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,MAAM;GACf;EACF"}

package/dist/esm/lib/stack-app/users/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../../src/lib/stack-app/users/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@stackframe/stack-shared\";\nimport { CurrentUserCrud } from \"@stackframe/stack-shared/dist/interface/crud/current-user\";\nimport { UsersCrud } from \"@stackframe/stack-shared/dist/interface/crud/users\";\nimport type { RestrictedReason } from \"@stackframe/stack-shared/dist/schema-fields\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { encodeBase64 } from \"@stackframe/stack-shared/dist/utils/bytes\";\nimport { GeoInfo } from \"@stackframe/stack-shared/dist/utils/geo\";\nimport { ReadonlyJson } from \"@stackframe/stack-shared/dist/utils/json\";\nimport { ProviderType } from \"@stackframe/stack-shared/dist/utils/oauth\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from \"../api-keys\";\nimport { AsyncStoreProperty, AuthLike } from \"../common\";\nimport { DeprecatedOAuthConnection, OAuthConnection } from \"../connected-accounts\";\nimport { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from \"../contact-channels\";\nimport { Customer } from \"../customers\";\nimport { NotificationCategory } from \"../notification-categories\";\nimport { AdminTeamPermission, TeamPermission } from \"../permissions\";\nimport { AdminOwnedProject, AdminProjectCreateOptions } from \"../projects\";\nimport { EditableTeamMemberProfile, ReceivedTeamInvitation, ServerListTeamsOptions, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from \"../teams\";\n\nconst userGetterErrorMessage = \"Hexclave: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.\";\n\nexport function withUserDestructureGuard<T extends object>(target: T): T {\n  Object.freeze(target);\n  return new Proxy(target, {\n    get(target, prop, receiver) {\n      if (prop === \"user\") {\n        return guardGetter();\n      }\n      return target[prop as keyof T];\n    },\n  });\n}\n\nfunction guardGetter(): never {\n  throw new Error(userGetterErrorMessage);\n}\n\nexport type OAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId?: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\nexport type ServerOAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { accountId?: string, email?: string, allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\n\n/**\n * Contains everything related to the current user session.\n */\nexport type Auth = AuthLike<{}> & {\n  readonly _internalSession: InternalSession,\n  readonly currentSession: {\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  },\n};\n\n/**\n * ```\n * +----------+-------------+-------------------+\n * |    \\     |   !Server   |      Server       |\n * +----------+-------------+-------------------+\n * | !Session | User        | ServerUser        |\n * | Session  | CurrentUser | CurrentServerUser |\n * +----------+-------------+-------------------+\n * ```\n *\n * The fields on each of these types are available iff:\n * BaseUser: true\n * Auth: Session\n * ServerBaseUser: Server\n * UserExtra: Session OR Server\n *\n * The types are defined as follows (in the typescript manner):\n * User = BaseUser\n * CurrentUser = BaseUser & Auth & UserExtra\n * ServerUser = BaseUser & ServerBaseUser & UserExtra\n * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra\n **/\n\nexport type BaseUser = {\n  readonly id: string,\n\n  readonly displayName: string | null,\n\n  /**\n   * The user's email address.\n   *\n   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.\n   */\n  readonly primaryEmail: string | null,\n  readonly primaryEmailVerified: boolean,\n  readonly profileImageUrl: string | null,\n\n  readonly signedUpAt: Date,\n\n  readonly clientMetadata: any,\n  readonly clientReadOnlyMetadata: any,\n\n  /**\n   * Whether the user has a password set.\n   */\n  readonly hasPassword: boolean,\n  readonly otpAuthEnabled: boolean,\n  readonly passkeyAuthEnabled: boolean,\n\n  readonly isMultiFactorRequired: boolean,\n  readonly isAnonymous: boolean,\n  /**\n   * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).\n   * For example, if email verification is required but the user hasn't verified their email yet.\n   */\n  readonly isRestricted: boolean,\n  /**\n   * The reason why the user is restricted, e.g., { type: \"email_not_verified\" }, { type: \"anonymous\" }, or { type: \"restricted_by_administrator\" }.\n   * Null if the user is not restricted.\n   */\n  readonly restrictedReason: RestrictedReason | null,\n  toClientJson(): CurrentUserCrud[\"Client\"][\"Read\"],\n\n  /**\n   * @deprecated, use contact channel's usedForAuth instead\n   */\n  readonly emailAuthEnabled: boolean,\n  /**\n   * @deprecated\n   */\n  readonly oauthProviders: readonly { id: string }[],\n}\n\nexport type UserExtra = {\n  setDisplayName(displayName: string | null): Promise<void>,\n  /** @deprecated Use contact channel's sendVerificationEmail instead */\n  sendVerificationEmail(): Promise<KnownErrors[\"EmailAlreadyVerified\"] | void>,\n  setClientMetadata(metadata: any): Promise<void>,\n  updatePassword(options: { oldPassword: string, newPassword: string}): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n  setPassword(options: { password: string }): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n\n  /**\n   * A shorthand method to update multiple fields of the user at once.\n   */\n  update(update: UserUpdateOptions): Promise<void>,\n\n  listContactChannels(): Promise<ContactChannel[]>,\n  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>,\n\n  listNotificationCategories(): Promise<NotificationCategory[]>,\n\n  delete(): Promise<void>,\n\n  /** @deprecated Use `getOrLinkConnectedAccount` for redirect behavior, or `getConnectedAccount({ provider, providerAccountId })` for existence check. */\n  getConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): Promise<DeprecatedOAuthConnection>,\n  /** @deprecated Use `getConnectedAccount({ provider, providerAccountId })` for existence check, or `getOrLinkConnectedAccount` for redirect behavior. */\n  getConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): Promise<DeprecatedOAuthConnection | null>,\n  /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */\n  getConnectedAccount(account: { provider: string, providerAccountId: string }): Promise<OAuthConnection | null>,\n\n\n  /** List all connected accounts for this user (only those with allowConnectedAccounts enabled). */\n  listConnectedAccounts(): Promise<OAuthConnection[]>,\n  /** React hook to list all connected accounts. */\n  /** Redirect the user to the OAuth flow to link a new connected account. Always redirects, never returns. */\n  linkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<void>,\n  /** Get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n  getOrLinkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<OAuthConnection>,\n  /** React hook: get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  readonly selectedTeam: Team | null,\n  setSelectedTeam(teamOrId: string | Team | null): Promise<void>,\n  createTeam(data: TeamCreateOptions): Promise<Team>,\n  leaveTeam(team: Team): Promise<void>,\n\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * This allows the user to discover which teams have invited them, even if they haven't\n   * joined those teams yet. Only invitations sent to verified email addresses are included.\n   *\n   * @returns An array of `ReceivedTeamInvitation` objects, each containing the team ID, team\n   * display name, recipient email, and expiration date.\n   *\n   * @example\n   * ```ts\n   * const invitations = await user.listTeamInvitations();\n   * for (const invitation of invitations) {\n   *   console.log(`Invited to ${invitation.teamDisplayName} via ${invitation.recipientEmail}`);\n   * }\n   * ```\n   */\n  listTeamInvitations(): Promise<ReceivedTeamInvitation[]>,\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * React hook version of `listTeamInvitations()`. Automatically re-renders when invitations change.\n   */\n\n  getActiveSessions(): Promise<ActiveSession[]>,\n  revokeSession(sessionId: string): Promise<void>,\n  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>,\n\n  createApiKey(options: ApiKeyCreationOptions<\"user\">): Promise<UserApiKeyFirstView>,\n\n  listOAuthProviders(): Promise<OAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<OAuthProvider | null>,\n\n  registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n}\n& AsyncStoreProperty<\"apiKeys\", [], UserApiKey[], true>\n& AsyncStoreProperty<\"team\", [id: string], Team | null, false>\n& AsyncStoreProperty<\"teams\", [], Team[], true>\n& AsyncStoreProperty<\"teamInvitations\", [], ReceivedTeamInvitation[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { recursive?: boolean }], TeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { recursive?: boolean }], TeamPermission[], true>;\n\nexport type InternalUserExtra =\n  & {\n    createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>,\n    transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>,\n  }\n  & AsyncStoreProperty<\"ownedProjects\", [], AdminOwnedProject[], true>\n\nexport type User = BaseUser;\n\nexport type CurrentUser = BaseUser & Auth & UserExtra & Customer;\n\nexport type CurrentInternalUser = CurrentUser & InternalUserExtra;\n\nexport type ProjectCurrentUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalUser : CurrentUser;\n\nexport type TokenPartialUser = Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"isAnonymous\"\n  | \"isMultiFactorRequired\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>\n\nexport type SyncedPartialUser = TokenPartialUser & Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"profileImageUrl\"\n  | \"signedUpAt\"\n  | \"clientMetadata\"\n  | \"clientReadOnlyMetadata\"\n  | \"isAnonymous\"\n  | \"hasPassword\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>;\n\n\nexport type ActiveSession = {\n  id: string,\n  userId: string,\n  createdAt: Date,\n  isImpersonation: boolean,\n  lastUsedAt: Date | undefined,\n  isCurrentSession: boolean,\n  geoInfo?: GeoInfo,\n};\n\nexport type UserUpdateOptions = {\n  displayName?: string | null,\n  clientMetadata?: ReadonlyJson,\n  selectedTeamId?: string | null,\n  totpMultiFactorSecret?: Uint8Array | null,\n  profileImageUrl?: string | null,\n  otpAuthEnabled?: boolean,\n  passkeyAuthEnabled?: boolean,\n  primaryEmail?: string | null,\n}\nexport function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud[\"Client\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    client_metadata: options.clientMetadata,\n    selected_team_id: options.selectedTeamId,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n    profile_image_url: options.profileImageUrl,\n    otp_auth_enabled: options.otpAuthEnabled,\n    passkey_auth_enabled: options.passkeyAuthEnabled,\n    primary_email: options.primaryEmail,\n  };\n}\n\n\nexport type ServerBaseUser = {\n  setPrimaryEmail(email: string | null, options?: { verified?: boolean | undefined }): Promise<void>,\n\n  readonly lastActiveAt: Date,\n\n  readonly serverMetadata: any,\n  setServerMetadata(metadata: any): Promise<void>,\n  setClientReadOnlyMetadata(metadata: any): Promise<void>,\n\n  /** Whether the user is restricted by an administrator. Can be set manually or by sign-up rules. */\n  readonly restrictedByAdmin: boolean,\n  /** Public reason shown to the user explaining why they are restricted. Optional. */\n  readonly restrictedByAdminReason: string | null,\n  /** Private details about the restriction (e.g., which sign-up rule triggered). Only visible to server access and above. */\n  readonly restrictedByAdminPrivateDetails: string | null,\n  /** Best-effort ISO country code captured at sign-up time from request geo headers. */\n  readonly countryCode: string | null,\n  /** Server-only risk scores used during sign-up risk evaluation. */\n  readonly riskScores: {\n    readonly signUp: {\n      readonly bot: number,\n      readonly freeTrialAbuse: number,\n    },\n  },\n\n  createTeam(data: Omit<ServerTeamCreateOptions, \"creatorUserId\">): Promise<ServerTeam>,\n\n  listContactChannels(): Promise<ServerContactChannel[]>,\n  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>,\n\n  update(user: ServerUserUpdateOptions): Promise<void>,\n\n  grantPermission(scope: Team, permissionId: string): Promise<void>,\n  grantPermission(permissionId: string): Promise<void>,\n\n  revokePermission(scope: Team, permissionId: string): Promise<void>,\n  revokePermission(permissionId: string): Promise<void>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  listOAuthProviders(): Promise<ServerOAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>,\n\n  /**\n   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.\n   */\n  createSession(options?: { expiresInMillis?: number, isImpersonation?: boolean }): Promise<{\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  }>,\n}\n& AsyncStoreProperty<\"team\", [id: string], ServerTeam | null, false>\n& AsyncStoreProperty<\"teams\", [options?: ServerListTeamsOptions], ServerTeam[] & { nextCursor: string | null }, true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { direct?: boolean }], AdminTeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { direct?: boolean }], AdminTeamPermission[], true>;\n\n/**\n * A user including sensitive fields that should only be used on the server, never sent to the client\n * (such as sensitive information and serverMetadata).\n */\nexport type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;\n\nexport type CurrentServerUser = Auth & ServerUser;\n\nexport type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;\n\nexport type ProjectCurrentServerUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalServerUser : CurrentServerUser;\n\nexport type SyncedPartialServerUser = SyncedPartialUser & Pick<\n  ServerUser,\n  | \"serverMetadata\"\n>;\n\nexport type ServerUserUpdateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailVerified?: boolean,\n  primaryEmailAuthEnabled?: boolean,\n  clientReadOnlyMetadata?: ReadonlyJson,\n  serverMetadata?: ReadonlyJson,\n  password?: string,\n  restrictedByAdmin?: boolean,\n  restrictedByAdminReason?: string | null,\n  restrictedByAdminPrivateDetails?: string | null,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n} & UserUpdateOptions;\nexport function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud[\"Server\"][\"Update\"] {\n  // Base update options\n  const baseUpdate: CurrentUserCrud[\"Server\"][\"Update\"] = {\n    display_name: options.displayName,\n    primary_email: options.primaryEmail,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    selected_team_id: options.selectedTeamId,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    primary_email_verified: options.primaryEmailVerified,\n    password: options.password,\n    profile_image_url: options.profileImageUrl,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n  };\n  return {\n    ...baseUpdate,\n    restricted_by_admin: options.restrictedByAdmin,\n    restricted_by_admin_reason: options.restrictedByAdminReason,\n    restricted_by_admin_private_details: options.restrictedByAdminPrivateDetails,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n\n\nexport type ServerUserCreateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailAuthEnabled?: boolean,\n  password?: string,\n  otpAuthEnabled?: boolean,\n  displayName?: string,\n  primaryEmailVerified?: boolean,\n  clientMetadata?: any,\n  clientReadOnlyMetadata?: any,\n  serverMetadata?: any,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n}\nexport function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud[\"Server\"][\"Create\"] {\n  return {\n    primary_email: options.primaryEmail,\n    password: options.password,\n    otp_auth_enabled: options.otpAuthEnabled,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    display_name: options.displayName,\n    primary_email_verified: options.primaryEmailVerified,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n"],"mappings":";;;AAwBA,MAAM,yBAAyB;AAE/B,SAAgB,yBAA2C,QAAc;AACvE,QAAO,OAAO,OAAO;AACrB,QAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;AAC1B,MAAI,SAAS,OACX,QAAO,aAAa;AAEtB,SAAO,OAAO;IAEjB,CAAC;;AAGJ,SAAS,cAAqB;AAC5B,OAAM,IAAI,MAAM,uBAAuB;;AAkRzC,SAAgB,wBAAwB,SAAiE;AACvG,QAAO;EACL,cAAc,QAAQ;EACtB,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,sBAAsB,GAAG,QAAQ;EAClH,mBAAmB,QAAQ;EAC3B,kBAAkB,QAAQ;EAC1B,sBAAsB,QAAQ;EAC9B,eAAe,QAAQ;EACxB;;AAuGH,SAAgB,8BAA8B,SAAuE;AAenH,QAAO;EAZL,cAAc,QAAQ;EACtB,eAAe,QAAQ;EACvB,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,wBAAwB,QAAQ;EAChC,UAAU,QAAQ;EAClB,mBAAmB,QAAQ;EAC3B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,sBAAsB,GAAG,QAAQ;EAIlH,qBAAqB,QAAQ;EAC7B,4BAA4B,QAAQ;EACpC,qCAAqC,QAAQ;EAC7C,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;GAC7C,EACF,GAAG;EACL;;AAsBH,SAAgB,8BAA8B,SAAiE;AAC7G,QAAO;EACL,eAAe,QAAQ;EACvB,UAAU,QAAQ;EAClB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,cAAc,QAAQ;EACtB,wBAAwB,QAAQ;EAChC,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;GAC7C,EACF,GAAG;EACL"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../../src/lib/stack-app/users/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { CurrentUserCrud } from \"@hexclave/shared/dist/interface/crud/current-user\";\nimport { UsersCrud } from \"@hexclave/shared/dist/interface/crud/users\";\nimport type { RestrictedReason } from \"@hexclave/shared/dist/schema-fields\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport { encodeBase64 } from \"@hexclave/shared/dist/utils/bytes\";\nimport { GeoInfo } from \"@hexclave/shared/dist/utils/geo\";\nimport { ReadonlyJson } from \"@hexclave/shared/dist/utils/json\";\nimport { ProviderType } from \"@hexclave/shared/dist/utils/oauth\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from \"../api-keys\";\nimport { AsyncStoreProperty, AuthLike } from \"../common\";\nimport { DeprecatedOAuthConnection, OAuthConnection } from \"../connected-accounts\";\nimport { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from \"../contact-channels\";\nimport { Customer } from \"../customers\";\nimport { NotificationCategory } from \"../notification-categories\";\nimport { AdminTeamPermission, TeamPermission } from \"../permissions\";\nimport { AdminOwnedProject, AdminProjectCreateOptions } from \"../projects\";\nimport { EditableTeamMemberProfile, ReceivedTeamInvitation, ServerListTeamsOptions, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from \"../teams\";\n\nconst userGetterErrorMessage = \"Hexclave: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.\";\n\nexport function withUserDestructureGuard<T extends object>(target: T): T {\n  Object.freeze(target);\n  return new Proxy(target, {\n    get(target, prop, receiver) {\n      if (prop === \"user\") {\n        return guardGetter();\n      }\n      return target[prop as keyof T];\n    },\n  });\n}\n\nfunction guardGetter(): never {\n  throw new Error(userGetterErrorMessage);\n}\n\nexport type OAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId?: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\nexport type ServerOAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { accountId?: string, email?: string, allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\n\n/**\n * Contains everything related to the current user session.\n */\nexport type Auth = AuthLike<{}> & {\n  readonly _internalSession: InternalSession,\n  readonly currentSession: {\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  },\n};\n\n/**\n * ```\n * +----------+-------------+-------------------+\n * |    \\     |   !Server   |      Server       |\n * +----------+-------------+-------------------+\n * | !Session | User        | ServerUser        |\n * | Session  | CurrentUser | CurrentServerUser |\n * +----------+-------------+-------------------+\n * ```\n *\n * The fields on each of these types are available iff:\n * BaseUser: true\n * Auth: Session\n * ServerBaseUser: Server\n * UserExtra: Session OR Server\n *\n * The types are defined as follows (in the typescript manner):\n * User = BaseUser\n * CurrentUser = BaseUser & Auth & UserExtra\n * ServerUser = BaseUser & ServerBaseUser & UserExtra\n * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra\n **/\n\nexport type BaseUser = {\n  readonly id: string,\n\n  readonly displayName: string | null,\n\n  /**\n   * The user's email address.\n   *\n   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.\n   */\n  readonly primaryEmail: string | null,\n  readonly primaryEmailVerified: boolean,\n  readonly profileImageUrl: string | null,\n\n  readonly signedUpAt: Date,\n\n  readonly clientMetadata: any,\n  readonly clientReadOnlyMetadata: any,\n\n  /**\n   * Whether the user has a password set.\n   */\n  readonly hasPassword: boolean,\n  readonly otpAuthEnabled: boolean,\n  readonly passkeyAuthEnabled: boolean,\n\n  readonly isMultiFactorRequired: boolean,\n  readonly isAnonymous: boolean,\n  /**\n   * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).\n   * For example, if email verification is required but the user hasn't verified their email yet.\n   */\n  readonly isRestricted: boolean,\n  /**\n   * The reason why the user is restricted, e.g., { type: \"email_not_verified\" }, { type: \"anonymous\" }, or { type: \"restricted_by_administrator\" }.\n   * Null if the user is not restricted.\n   */\n  readonly restrictedReason: RestrictedReason | null,\n  toClientJson(): CurrentUserCrud[\"Client\"][\"Read\"],\n\n  /**\n   * @deprecated, use contact channel's usedForAuth instead\n   */\n  readonly emailAuthEnabled: boolean,\n  /**\n   * @deprecated\n   */\n  readonly oauthProviders: readonly { id: string }[],\n}\n\nexport type UserExtra = {\n  setDisplayName(displayName: string | null): Promise<void>,\n  /** @deprecated Use contact channel's sendVerificationEmail instead */\n  sendVerificationEmail(): Promise<KnownErrors[\"EmailAlreadyVerified\"] | void>,\n  setClientMetadata(metadata: any): Promise<void>,\n  updatePassword(options: { oldPassword: string, newPassword: string}): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n  setPassword(options: { password: string }): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n\n  /**\n   * A shorthand method to update multiple fields of the user at once.\n   */\n  update(update: UserUpdateOptions): Promise<void>,\n\n  listContactChannels(): Promise<ContactChannel[]>,\n  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>,\n\n  listNotificationCategories(): Promise<NotificationCategory[]>,\n\n  delete(): Promise<void>,\n\n  /** @deprecated Use `getOrLinkConnectedAccount` for redirect behavior, or `getConnectedAccount({ provider, providerAccountId })` for existence check. */\n  getConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): Promise<DeprecatedOAuthConnection>,\n  /** @deprecated Use `getConnectedAccount({ provider, providerAccountId })` for existence check, or `getOrLinkConnectedAccount` for redirect behavior. */\n  getConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): Promise<DeprecatedOAuthConnection | null>,\n  /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */\n  getConnectedAccount(account: { provider: string, providerAccountId: string }): Promise<OAuthConnection | null>,\n\n\n  /** List all connected accounts for this user (only those with allowConnectedAccounts enabled). */\n  listConnectedAccounts(): Promise<OAuthConnection[]>,\n  /** React hook to list all connected accounts. */\n  /** Redirect the user to the OAuth flow to link a new connected account. Always redirects, never returns. */\n  linkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<void>,\n  /** Get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n  getOrLinkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<OAuthConnection>,\n  /** React hook: get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  readonly selectedTeam: Team | null,\n  setSelectedTeam(teamOrId: string | Team | null): Promise<void>,\n  createTeam(data: TeamCreateOptions): Promise<Team>,\n  leaveTeam(team: Team): Promise<void>,\n\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * This allows the user to discover which teams have invited them, even if they haven't\n   * joined those teams yet. Only invitations sent to verified email addresses are included.\n   *\n   * @returns An array of `ReceivedTeamInvitation` objects, each containing the team ID, team\n   * display name, recipient email, and expiration date.\n   *\n   * @example\n   * ```ts\n   * const invitations = await user.listTeamInvitations();\n   * for (const invitation of invitations) {\n   *   console.log(`Invited to ${invitation.teamDisplayName} via ${invitation.recipientEmail}`);\n   * }\n   * ```\n   */\n  listTeamInvitations(): Promise<ReceivedTeamInvitation[]>,\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * React hook version of `listTeamInvitations()`. Automatically re-renders when invitations change.\n   */\n\n  getActiveSessions(): Promise<ActiveSession[]>,\n  revokeSession(sessionId: string): Promise<void>,\n  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>,\n\n  createApiKey(options: ApiKeyCreationOptions<\"user\">): Promise<UserApiKeyFirstView>,\n\n  listOAuthProviders(): Promise<OAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<OAuthProvider | null>,\n\n  registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n}\n& AsyncStoreProperty<\"apiKeys\", [], UserApiKey[], true>\n& AsyncStoreProperty<\"team\", [id: string], Team | null, false>\n& AsyncStoreProperty<\"teams\", [], Team[], true>\n& AsyncStoreProperty<\"teamInvitations\", [], ReceivedTeamInvitation[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { recursive?: boolean }], TeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { recursive?: boolean }], TeamPermission[], true>;\n\nexport type InternalUserExtra =\n  & {\n    createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>,\n    transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>,\n  }\n  & AsyncStoreProperty<\"ownedProjects\", [], AdminOwnedProject[], true>\n\nexport type User = BaseUser;\n\nexport type CurrentUser = BaseUser & Auth & UserExtra & Customer;\n\nexport type CurrentInternalUser = CurrentUser & InternalUserExtra;\n\nexport type ProjectCurrentUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalUser : CurrentUser;\n\nexport type TokenPartialUser = Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"isAnonymous\"\n  | \"isMultiFactorRequired\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>\n\nexport type SyncedPartialUser = TokenPartialUser & Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"profileImageUrl\"\n  | \"signedUpAt\"\n  | \"clientMetadata\"\n  | \"clientReadOnlyMetadata\"\n  | \"isAnonymous\"\n  | \"hasPassword\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>;\n\n\nexport type ActiveSession = {\n  id: string,\n  userId: string,\n  createdAt: Date,\n  isImpersonation: boolean,\n  lastUsedAt: Date | undefined,\n  isCurrentSession: boolean,\n  geoInfo?: GeoInfo,\n};\n\nexport type UserUpdateOptions = {\n  displayName?: string | null,\n  clientMetadata?: ReadonlyJson,\n  selectedTeamId?: string | null,\n  totpMultiFactorSecret?: Uint8Array | null,\n  profileImageUrl?: string | null,\n  otpAuthEnabled?: boolean,\n  passkeyAuthEnabled?: boolean,\n  primaryEmail?: string | null,\n}\nexport function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud[\"Client\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    client_metadata: options.clientMetadata,\n    selected_team_id: options.selectedTeamId,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n    profile_image_url: options.profileImageUrl,\n    otp_auth_enabled: options.otpAuthEnabled,\n    passkey_auth_enabled: options.passkeyAuthEnabled,\n    primary_email: options.primaryEmail,\n  };\n}\n\n\nexport type ServerBaseUser = {\n  setPrimaryEmail(email: string | null, options?: { verified?: boolean | undefined }): Promise<void>,\n\n  readonly lastActiveAt: Date,\n\n  readonly serverMetadata: any,\n  setServerMetadata(metadata: any): Promise<void>,\n  setClientReadOnlyMetadata(metadata: any): Promise<void>,\n\n  /** Whether the user is restricted by an administrator. Can be set manually or by sign-up rules. */\n  readonly restrictedByAdmin: boolean,\n  /** Public reason shown to the user explaining why they are restricted. Optional. */\n  readonly restrictedByAdminReason: string | null,\n  /** Private details about the restriction (e.g., which sign-up rule triggered). Only visible to server access and above. */\n  readonly restrictedByAdminPrivateDetails: string | null,\n  /** Best-effort ISO country code captured at sign-up time from request geo headers. */\n  readonly countryCode: string | null,\n  /** Server-only risk scores used during sign-up risk evaluation. */\n  readonly riskScores: {\n    readonly signUp: {\n      readonly bot: number,\n      readonly freeTrialAbuse: number,\n    },\n  },\n\n  createTeam(data: Omit<ServerTeamCreateOptions, \"creatorUserId\">): Promise<ServerTeam>,\n\n  listContactChannels(): Promise<ServerContactChannel[]>,\n  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>,\n\n  update(user: ServerUserUpdateOptions): Promise<void>,\n\n  grantPermission(scope: Team, permissionId: string): Promise<void>,\n  grantPermission(permissionId: string): Promise<void>,\n\n  revokePermission(scope: Team, permissionId: string): Promise<void>,\n  revokePermission(permissionId: string): Promise<void>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  listOAuthProviders(): Promise<ServerOAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>,\n\n  /**\n   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.\n   */\n  createSession(options?: { expiresInMillis?: number, isImpersonation?: boolean }): Promise<{\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  }>,\n}\n& AsyncStoreProperty<\"team\", [id: string], ServerTeam | null, false>\n& AsyncStoreProperty<\"teams\", [options?: ServerListTeamsOptions], ServerTeam[] & { nextCursor: string | null }, true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { direct?: boolean }], AdminTeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { direct?: boolean }], AdminTeamPermission[], true>;\n\n/**\n * A user including sensitive fields that should only be used on the server, never sent to the client\n * (such as sensitive information and serverMetadata).\n */\nexport type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;\n\nexport type CurrentServerUser = Auth & ServerUser;\n\nexport type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;\n\nexport type ProjectCurrentServerUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalServerUser : CurrentServerUser;\n\nexport type SyncedPartialServerUser = SyncedPartialUser & Pick<\n  ServerUser,\n  | \"serverMetadata\"\n>;\n\nexport type ServerUserUpdateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailVerified?: boolean,\n  primaryEmailAuthEnabled?: boolean,\n  clientReadOnlyMetadata?: ReadonlyJson,\n  serverMetadata?: ReadonlyJson,\n  password?: string,\n  restrictedByAdmin?: boolean,\n  restrictedByAdminReason?: string | null,\n  restrictedByAdminPrivateDetails?: string | null,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n} & UserUpdateOptions;\nexport function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud[\"Server\"][\"Update\"] {\n  // Base update options\n  const baseUpdate: CurrentUserCrud[\"Server\"][\"Update\"] = {\n    display_name: options.displayName,\n    primary_email: options.primaryEmail,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    selected_team_id: options.selectedTeamId,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    primary_email_verified: options.primaryEmailVerified,\n    password: options.password,\n    profile_image_url: options.profileImageUrl,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n  };\n  return {\n    ...baseUpdate,\n    restricted_by_admin: options.restrictedByAdmin,\n    restricted_by_admin_reason: options.restrictedByAdminReason,\n    restricted_by_admin_private_details: options.restrictedByAdminPrivateDetails,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n\n\nexport type ServerUserCreateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailAuthEnabled?: boolean,\n  password?: string,\n  otpAuthEnabled?: boolean,\n  displayName?: string,\n  primaryEmailVerified?: boolean,\n  clientMetadata?: any,\n  clientReadOnlyMetadata?: any,\n  serverMetadata?: any,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n}\nexport function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud[\"Server\"][\"Create\"] {\n  return {\n    primary_email: options.primaryEmail,\n    password: options.password,\n    otp_auth_enabled: options.otpAuthEnabled,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    display_name: options.displayName,\n    primary_email_verified: options.primaryEmailVerified,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n"],"mappings":";;;AAwBA,MAAM,yBAAyB;AAE/B,SAAgB,yBAA2C,QAAc;AACvE,QAAO,OAAO,OAAO;AACrB,QAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;AAC1B,MAAI,SAAS,OACX,QAAO,aAAa;AAEtB,SAAO,OAAO;IAEjB,CAAC;;AAGJ,SAAS,cAAqB;AAC5B,OAAM,IAAI,MAAM,uBAAuB;;AAkRzC,SAAgB,wBAAwB,SAAiE;AACvG,QAAO;EACL,cAAc,QAAQ;EACtB,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,sBAAsB,GAAG,QAAQ;EAClH,mBAAmB,QAAQ;EAC3B,kBAAkB,QAAQ;EAC1B,sBAAsB,QAAQ;EAC9B,eAAe,QAAQ;EACxB;;AAuGH,SAAgB,8BAA8B,SAAuE;AAenH,QAAO;EAZL,cAAc,QAAQ;EACtB,eAAe,QAAQ;EACvB,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,wBAAwB,QAAQ;EAChC,UAAU,QAAQ;EAClB,mBAAmB,QAAQ;EAC3B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,sBAAsB,GAAG,QAAQ;EAIlH,qBAAqB,QAAQ;EAC7B,4BAA4B,QAAQ;EACpC,qCAAqC,QAAQ;EAC7C,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;GAC7C,EACF,GAAG;EACL;;AAsBH,SAAgB,8BAA8B,SAAiE;AAC7G,QAAO;EACL,eAAe,QAAQ;EACvB,UAAU,QAAQ;EAClB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,cAAc,QAAQ;EACtB,wBAAwB,QAAQ;EAChC,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;GAC7C,EACF,GAAG;EACL"}

package/dist/esm/utils/url.js.map

@@ -1 +1 @@
-{"version":3,"file":"url.js","names":[],"sources":["../../../src/utils/url.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { HexclaveAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\n\n\nexport function constructRedirectUrl(redirectUrl: URL | string | undefined, callbackUrlName: string) {\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n  if (typeof window === 'undefined' || !window.location) {\n    throw new HexclaveAssertionError(`${callbackUrlName} option is required in a non-browser environment.`, { redirectUrl });\n  }\n\n  const retainedQueryParams = [\"after_auth_return_to\"];\n  const currentUrl = new URL(window.location.href);\n  const url = redirectUrl ? new URL(redirectUrl, window.location.href) : new URL(window.location.href);\n  for (const param of retainedQueryParams) {\n    if (currentUrl.searchParams.has(param)) {\n      url.searchParams.set(param, currentUrl.searchParams.get(param)!);\n    }\n  }\n  url.hash = \"\";\n  return url.toString();\n}\n"],"mappings":";;;AAOA,SAAgB,qBAAqB,aAAuC,iBAAyB;AAEnG,KAAI,OAAO,WAAW,eAAe,CAAC,OAAO,SAC3C,OAAM,IAAI,uBAAuB,GAAG,gBAAgB,oDAAoD,EAAE,aAAa,CAAC;CAG1H,MAAM,sBAAsB,CAAC,uBAAuB;CACpD,MAAM,aAAa,IAAI,IAAI,OAAO,SAAS,KAAK;CAChD,MAAM,MAAM,cAAc,IAAI,IAAI,aAAa,OAAO,SAAS,KAAK,GAAG,IAAI,IAAI,OAAO,SAAS,KAAK;AACpG,MAAK,MAAM,SAAS,oBAClB,KAAI,WAAW,aAAa,IAAI,MAAM,CACpC,KAAI,aAAa,IAAI,OAAO,WAAW,aAAa,IAAI,MAAM,CAAE;AAGpE,KAAI,OAAO;AACX,QAAO,IAAI,UAAU"}
+{"version":3,"file":"url.js","names":[],"sources":["../../../src/utils/url.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { HexclaveAssertionError } from \"@hexclave/shared/dist/utils/errors\";\n\n\nexport function constructRedirectUrl(redirectUrl: URL | string | undefined, callbackUrlName: string) {\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n  if (typeof window === 'undefined' || !window.location) {\n    throw new HexclaveAssertionError(`${callbackUrlName} option is required in a non-browser environment.`, { redirectUrl });\n  }\n\n  const retainedQueryParams = [\"after_auth_return_to\"];\n  const currentUrl = new URL(window.location.href);\n  const url = redirectUrl ? new URL(redirectUrl, window.location.href) : new URL(window.location.href);\n  for (const param of retainedQueryParams) {\n    if (currentUrl.searchParams.has(param)) {\n      url.searchParams.set(param, currentUrl.searchParams.get(param)!);\n    }\n  }\n  url.hash = \"\";\n  return url.toString();\n}\n"],"mappings":";;;AAOA,SAAgB,qBAAqB,aAAuC,iBAAyB;AAEnG,KAAI,OAAO,WAAW,eAAe,CAAC,OAAO,SAC3C,OAAM,IAAI,uBAAuB,GAAG,gBAAgB,oDAAoD,EAAE,aAAa,CAAC;CAG1H,MAAM,sBAAsB,CAAC,uBAAuB;CACpD,MAAM,aAAa,IAAI,IAAI,OAAO,SAAS,KAAK;CAChD,MAAM,MAAM,cAAc,IAAI,IAAI,aAAa,OAAO,SAAS,KAAK,GAAG,IAAI,IAAI,OAAO,SAAS,KAAK;AACpG,MAAK,MAAM,SAAS,oBAClB,KAAI,WAAW,aAAa,IAAI,MAAM,CACpC,KAAI,aAAa,IAAI,OAAO,WAAW,aAAa,IAAI,MAAM,CAAE;AAGpE,KAAI,OAAO;AACX,QAAO,IAAI,UAAU"}

package/dist/index.d.ts

@@ -13,5 +13,5 @@ import { AdminOwnedProject, AdminProject, AdminProjectCreateOptions, AdminProjec
 import { HexclaveClientApp, HexclaveClientAppConstructor, HexclaveClientAppConstructorOptions, HexclaveClientAppJson, StackClientApp, StackClientAppConstructor, StackClientAppConstructorOptions, StackClientAppJson } from "./lib/stack-app/apps/interfaces/client-app.js";
 import { getPagePrompt } from "./lib/stack-app/url-targets.js";
 import { getConvexProvidersConfig } from "./integrations/convex.js";
-import { StackConfig, StackConfig as HexclaveConfig, defineStackConfig, defineStackConfig as defineHexclaveConfig } from "@hexclave/shared/config";
+import { HexclaveConfig, StackConfig, defineHexclaveConfig, defineStackConfig } from "@hexclave/shared/config";
 export { AdminDomainConfig, AdminEmailConfig, AdminEmailOutbox, AdminEmailOutboxRecipient, AdminEmailOutboxSimpleStatus, AdminEmailOutboxStatus, AdminOAuthProviderConfig, AdminOwnedProject, AdminProject, AdminProjectConfig, AdminProjectConfigUpdateOptions, AdminProjectCreateOptions, AdminProjectPermission, AdminProjectPermissionDefinition, AdminProjectPermissionDefinitionCreateOptions, AdminProjectPermissionDefinitionUpdateOptions, AdminProjectUpdateOptions, AdminSendAttemptError, AdminSentEmail, AdminTeamPermission, AdminTeamPermissionDefinition, AdminTeamPermissionDefinitionCreateOptions, AdminTeamPermissionDefinitionUpdateOptions, Auth, Connection, ContactChannel, CurrentInternalServerUser, CurrentInternalUser, CurrentServerUser, CurrentUser, EditableTeamMemberProfile, EmailOutboxListOptions, EmailOutboxListResult, EmailOutboxUpdateOptions, GetCurrentUserOptions, GetCurrentUserOptions as GetUserOptions, HandlerUrlOptions, HandlerUrls, HexclaveAdminApp, HexclaveAdminAppConstructor, HexclaveAdminAppConstructorOptions, HexclaveClientApp, HexclaveClientAppConstructor, HexclaveClientAppConstructorOptions, HexclaveClientAppJson, type HexclaveConfig, HexclaveServerApp, HexclaveServerAppConstructor, HexclaveServerAppConstructorOptions, InternalApiKey, InternalApiKeyBase, InternalApiKeyBaseCrudRead, InternalApiKeyCreateOptions, InternalApiKeyFirstView, OAuthConnection, OAuthProvider, OAuthProviderConfig, OAuthScopesOnSignIn, Project, ProjectConfig, PushedConfigSource, ReceivedTeamInvitation, ResolvedHandlerUrls, SentTeamInvitation, ServerContactChannel, ServerListUsersOptions, ServerOAuthProvider, ServerTeam, ServerTeamCreateOptions, ServerTeamMemberProfile, ServerTeamUpdateOptions, ServerTeamUser, ServerUser, StackAdminApp, StackAdminAppConstructor, StackAdminAppConstructorOptions, StackClientApp, StackClientAppConstructor, StackClientAppConstructorOptions, StackClientAppJson, type StackConfig, StackServerApp, StackServerAppConstructor, StackServerAppConstructorOptions, Team, TeamCreateOptions, TeamInvitation, TeamMemberProfile, TeamUpdateOptions, TeamUser, User, defineHexclaveConfig, defineStackConfig, getConvexProvidersConfig, getPagePrompt, stackAppInternalsSymbol };

package/dist/index.js

@@ -1,19 +1,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('./chunk-BE-pF4vm.js');
-require("./internal/deprecation-warning.js");
 let __integrations_convex_js = require("./integrations/convex.js");
-let _stackframe_stack_shared_config = require("@hexclave/shared/config");
+let _hexclave_shared_config = require("@hexclave/shared/config");
 
 Object.defineProperty(exports, 'defineHexclaveConfig', {
   enumerable: true,
   get: function () {
-    return _stackframe_stack_shared_config.defineStackConfig;
+    return _hexclave_shared_config.defineHexclaveConfig;
   }
 });
 Object.defineProperty(exports, 'defineStackConfig', {
   enumerable: true,
   get: function () {
-    return _stackframe_stack_shared_config.defineStackConfig;
+    return _hexclave_shared_config.defineStackConfig;
   }
 });
 Object.defineProperty(exports, 'getConvexProvidersConfig', {

package/dist/integrations/convex.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../chunk-BE-pF4vm.js');
-let _stackframe_stack_shared_dist_utils_urls = require("@hexclave/shared/dist/utils/urls");
+let _hexclave_shared_dist_utils_urls = require("@hexclave/shared/dist/utils/urls");
 let ___lib_stack_app_apps_implementations_common_js = require("../lib/stack-app/apps/implementations/common.js");
 
 //#region src/integrations/convex.ts
@@ -9,13 +9,13 @@ function getConvexProvidersConfig(options) {
 	const projectId = options.projectId;
 	return [{
 		type: "customJwt",
-		issuer: new URL(_stackframe_stack_shared_dist_utils_urls.urlString`/api/v1/projects/${projectId}`, baseUrl),
-		jwks: new URL(_stackframe_stack_shared_dist_utils_urls.urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),
+		issuer: new URL(_hexclave_shared_dist_utils_urls.urlString`/api/v1/projects/${projectId}`, baseUrl),
+		jwks: new URL(_hexclave_shared_dist_utils_urls.urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),
 		algorithm: "ES256"
 	}, {
 		type: "customJwt",
-		issuer: new URL(_stackframe_stack_shared_dist_utils_urls.urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),
-		jwks: new URL(_stackframe_stack_shared_dist_utils_urls.urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),
+		issuer: new URL(_hexclave_shared_dist_utils_urls.urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),
+		jwks: new URL(_hexclave_shared_dist_utils_urls.urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),
 		algorithm: "ES256"
 	}];
 }

package/dist/integrations/convex.js.map

@@ -1 +1 @@
-{"version":3,"file":"convex.js","names":["defaultBaseUrl"],"sources":["../../src/integrations/convex.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { urlString } from \"@stackframe/stack-shared/dist/utils/urls\";\nimport { defaultBaseUrl } from \"../lib/stack-app/apps/implementations/common\";\n\nexport function getConvexProvidersConfig(options: {\n  baseUrl?: string,\n  projectId: string,\n}) {\n  const baseUrl = options.baseUrl || defaultBaseUrl;\n  const projectId = options.projectId;\n  return [\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),\n      algorithm: \"ES256\",\n    },\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),\n      algorithm: \"ES256\",\n    },\n  ];\n}\n"],"mappings":";;;;;;AAOA,SAAgB,yBAAyB,SAGtC;CACD,MAAM,UAAU,QAAQ,WAAWA;CACnC,MAAM,YAAY,QAAQ;AAC1B,QAAO,CACL;EACE,MAAM;EACN,QAAQ,IAAI,IAAI,kDAAS,oBAAoB,aAAa,QAAQ;EAClE,MAAM,IAAI,IAAI,kDAAS,oBAAoB,UAAU,yBAAyB,QAAQ;EACtF,WAAW;EACZ,EACD;EACE,MAAM;EACN,QAAQ,IAAI,IAAI,kDAAS,oCAAoC,aAAa,QAAQ;EAClF,MAAM,IAAI,IAAI,kDAAS,oBAAoB,UAAU,gDAAgD,QAAQ;EAC7G,WAAW;EACZ,CACF"}
+{"version":3,"file":"convex.js","names":["defaultBaseUrl"],"sources":["../../src/integrations/convex.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { urlString } from \"@hexclave/shared/dist/utils/urls\";\nimport { defaultBaseUrl } from \"../lib/stack-app/apps/implementations/common\";\n\nexport function getConvexProvidersConfig(options: {\n  baseUrl?: string,\n  projectId: string,\n}) {\n  const baseUrl = options.baseUrl || defaultBaseUrl;\n  const projectId = options.projectId;\n  return [\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),\n      algorithm: \"ES256\",\n    },\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),\n      algorithm: \"ES256\",\n    },\n  ];\n}\n"],"mappings":";;;;;;AAOA,SAAgB,yBAAyB,SAGtC;CACD,MAAM,UAAU,QAAQ,WAAWA;CACnC,MAAM,YAAY,QAAQ;AAC1B,QAAO,CACL;EACE,MAAM;EACN,QAAQ,IAAI,IAAI,0CAAS,oBAAoB,aAAa,QAAQ;EAClE,MAAM,IAAI,IAAI,0CAAS,oBAAoB,UAAU,yBAAyB,QAAQ;EACtF,WAAW;EACZ,EACD;EACE,MAAM;EACN,QAAQ,IAAI,IAAI,0CAAS,oCAAoC,aAAa,QAAQ;EAClF,MAAM,IAAI,IAAI,0CAAS,oBAAoB,UAAU,gDAAgD,QAAQ;EAC7G,WAAW;EACZ,CACF"}

package/dist/lib/auth.js

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../chunk-BE-pF4vm.js');
-let _stackframe_stack_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
-let _stackframe_stack_shared = require("@hexclave/shared");
-let _stackframe_stack_shared_dist_utils_results = require("@hexclave/shared/dist/utils/results");
-let _stackframe_stack_shared_dist_utils_strings = require("@hexclave/shared/dist/utils/strings");
+let _hexclave_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
+let _hexclave_shared = require("@hexclave/shared");
+let _hexclave_shared_dist_utils_results = require("@hexclave/shared/dist/utils/results");
+let _hexclave_shared_dist_utils_strings = require("@hexclave/shared/dist/utils/strings");
 let ___utils_url_js = require("../utils/url.js");
 let __cookie_js = require("./cookie.js");
 
@@ -40,7 +40,7 @@ function consumeOAuthCallbackQueryParams(options) {
 		if (details) try {
 			detailsJson = JSON.parse(details);
 		} catch (error) {
-			throw new _stackframe_stack_shared_dist_utils_errors.HexclaveAssertionError("OAuth callback returned malformed known-error details", {
+			throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("OAuth callback returned malformed known-error details", {
 				details,
 				cause: error
 			});
@@ -50,7 +50,7 @@ function consumeOAuthCallbackQueryParams(options) {
 		window.history.replaceState({}, "", newUrl.toString());
 		return {
 			type: "known-error",
-			error: _stackframe_stack_shared.KnownError.fromJson({
+			error: _hexclave_shared.KnownError.fromJson({
 				code: knownErrorCode,
 				message: knownErrorMessage,
 				details: detailsJson
@@ -61,10 +61,10 @@ function consumeOAuthCallbackQueryParams(options) {
 		if (!options?.dontWarnAboutMissingQueryParams) console.warn(/* @__PURE__ */ new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));
 		return null;
 	}
-	const expectedState = originalUrl.searchParams.get("state") ?? (0, _stackframe_stack_shared_dist_utils_errors.throwErr)("This should never happen; isn't state required above?");
+	const expectedState = originalUrl.searchParams.get("state") ?? (0, _hexclave_shared_dist_utils_errors.throwErr)("This should never happen; isn't state required above?");
 	const cookieResult = (0, __cookie_js.consumeVerifierAndStateCookie)(expectedState);
 	if (!cookieResult) {
-		console.warn(_stackframe_stack_shared_dist_utils_strings.deindent`
+		console.warn(_hexclave_shared_dist_utils_strings.deindent`
       Stack found an outer OAuth callback state in the query parameters, but not in cookies.
 
       This could have multiple reasons:
@@ -90,18 +90,18 @@ function consumeOAuthCallbackQueryParams(options) {
 }
 async function callOAuthCallback(iface, redirectUrl, options) {
 	const consumed = consumeOAuthCallbackQueryParams(options);
-	if (!consumed) return _stackframe_stack_shared_dist_utils_results.Result.ok(void 0);
+	if (!consumed) return _hexclave_shared_dist_utils_results.Result.ok(void 0);
 	if (consumed.type === "known-error") throw consumed.error;
 	try {
-		return _stackframe_stack_shared_dist_utils_results.Result.ok(await iface.callOAuthCallback({
+		return _hexclave_shared_dist_utils_results.Result.ok(await iface.callOAuthCallback({
 			oauthParams: consumed.originalUrl.searchParams,
 			redirectUri: (0, ___utils_url_js.constructRedirectUrl)(redirectUrl, "redirectUri"),
 			codeVerifier: consumed.codeVerifier,
 			state: consumed.state
 		}));
 	} catch (e) {
-		if (_stackframe_stack_shared.KnownError.isKnownError(e)) throw e;
-		throw new _stackframe_stack_shared_dist_utils_errors.HexclaveAssertionError("Error signing in during OAuth callback. Please try again.", { cause: e });
+		if (_hexclave_shared.KnownError.isKnownError(e)) throw e;
+		throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Error signing in during OAuth callback. Please try again.", { cause: e });
 	}
 }
 

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["HexclaveAssertionError","KnownError","Result"],"sources":["../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownError, HexclaveClientInterface } from \"@stackframe/stack-shared\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { HexclaveAssertionError, throwErr } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { deindent } from \"@stackframe/stack-shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\nexport async function getNewOAuthProviderOrScopeUrl(\n  iface: HexclaveClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n): Promise<string> {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  return await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, \"afterCallbackRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\ntype OAuthCallbackConsumptionResult =\n  | {\n    type: \"oauth-response\",\n    originalUrl: URL,\n    codeVerifier: string,\n    state: string,\n  }\n  | {\n    type: \"known-error\",\n    error: KnownError,\n  };\n\nfunction consumeOAuthCallbackQueryParams(options?: {\n  dontWarnAboutMissingQueryParams?: boolean,\n}): OAuthCallbackConsumptionResult | null {\n  const oauthErrorParams = [\"error\", \"error_description\", \"errorCode\", \"message\", \"details\"] as const;\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  const knownErrorCode = originalUrl.searchParams.get(\"errorCode\");\n  const knownErrorMessage = originalUrl.searchParams.get(\"message\");\n  if (knownErrorCode && knownErrorMessage) {\n    const details = originalUrl.searchParams.get(\"details\");\n    let detailsJson = {};\n    if (details) {\n      try {\n        detailsJson = JSON.parse(details);\n      } catch (error) {\n        throw new HexclaveAssertionError(\"OAuth callback returned malformed known-error details\", {\n          details,\n          cause: error,\n        });\n      }\n    }\n\n    const newUrl = new URL(originalUrl);\n    for (const param of oauthErrorParams) {\n      newUrl.searchParams.delete(param);\n    }\n    window.history.replaceState({}, \"\", newUrl.toString());\n\n    return {\n      type: \"known-error\",\n      error: KnownError.fromJson({\n        code: knownErrorCode,\n        message: knownErrorMessage,\n        details: detailsJson,\n      }),\n    };\n  }\n\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      if (!options?.dontWarnAboutMissingQueryParams) {\n        console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      }\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Stack found an outer OAuth callback state in the query parameters, but not in cookies.\n\n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Stack.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    type: \"oauth-response\",\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: HexclaveClientInterface,\n  redirectUrl: string,\n  options?: {\n    dontWarnAboutMissingQueryParams?: boolean,\n  },\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams(options);\n  if (!consumed) return Result.ok(undefined);\n  if (consumed.type === \"known-error\") {\n    throw consumed.error;\n  }\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new HexclaveAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;AAWA,eAAsB,8BACpB,OACA,SAMA,SACiB;CACjB,MAAM,EAAE,eAAe,UAAU,6CAA4B;AAC7D,QAAO,MAAM,MAAM,YAAY;EAC7B,UAAU,QAAQ;EAClB,uDAAkC,QAAQ,aAAa,cAAc;EACrE,4DAAuC,QAAQ,kBAAkB,mBAAmB;EACpF,oEAA+C,OAAO,SAAS,MAAM,2BAA2B;EAChG;EACA;EACA,MAAM;EACN;EACA,eAAe,QAAQ;EACxB,CAAC;;AAoBJ,SAAS,gCAAgC,SAEC;CACxC,MAAM,mBAAmB;EAAC;EAAS;EAAqB;EAAa;EAAW;EAAU;CAC1F,MAAM,iBAAiB,CAAC,QAAQ,QAAQ;CACxC,MAAM,cAAc,IAAI,IAAI,OAAO,SAAS,KAAK;CACjD,MAAM,iBAAiB,YAAY,aAAa,IAAI,YAAY;CAChE,MAAM,oBAAoB,YAAY,aAAa,IAAI,UAAU;AACjE,KAAI,kBAAkB,mBAAmB;EACvC,MAAM,UAAU,YAAY,aAAa,IAAI,UAAU;EACvD,IAAI,cAAc,EAAE;AACpB,MAAI,QACF,KAAI;AACF,iBAAc,KAAK,MAAM,QAAQ;WAC1B,OAAO;AACd,SAAM,IAAIA,kEAAuB,yDAAyD;IACxF;IACA,OAAO;IACR,CAAC;;EAIN,MAAM,SAAS,IAAI,IAAI,YAAY;AACnC,OAAK,MAAM,SAAS,iBAClB,QAAO,aAAa,OAAO,MAAM;AAEnC,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,OAAO,UAAU,CAAC;AAEtD,SAAO;GACL,MAAM;GACN,OAAOC,oCAAW,SAAS;IACzB,MAAM;IACN,SAAS;IACT,SAAS;IACV,CAAC;GACH;;AAGH,MAAK,MAAM,SAAS,eAClB,KAAI,CAAC,YAAY,aAAa,IAAI,MAAM,EAAE;AACxC,MAAI,CAAC,SAAS,gCACZ,SAAQ,qBAAK,IAAI,MAAM,uDAAuD,MAAM,2EAA2E,CAAC;AAElK,SAAO;;CAIX,MAAM,gBAAgB,YAAY,aAAa,IAAI,QAAQ,6DAAa,wDAAwD;CAChI,MAAM,8DAA6C,cAAc;AAEjE,KAAI,CAAC,cAAc;AAGjB,UAAQ,KAAK,oDAAQ;;;;;;;;;;;MAWnB;AACF,SAAO;;CAIT,MAAM,SAAS,IAAI,IAAI,YAAY;AACnC,MAAK,MAAM,SAAS,eAClB,QAAO,aAAa,OAAO,MAAM;AASnC,QAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,OAAO,UAAU,CAAC;AAEtD,QAAO;EACL,MAAM;EACN;EACA,cAAc,aAAa;EAC3B,OAAO;EACR;;AAGH,eAAsB,kBACpB,OACA,aACA,SAGA;CAIA,MAAM,WAAW,gCAAgC,QAAQ;AACzD,KAAI,CAAC,SAAU,QAAOC,mDAAO,GAAG,OAAU;AAC1C,KAAI,SAAS,SAAS,cACpB,OAAM,SAAS;AAMjB,KAAI;AACF,SAAOA,mDAAO,GAAG,MAAM,MAAM,kBAAkB;GAC7C,aAAa,SAAS,YAAY;GAClC,uDAAkC,aAAa,cAAc;GAC7D,cAAc,SAAS;GACvB,OAAO,SAAS;GACjB,CAAC,CAAC;UACI,GAAG;AACV,MAAID,oCAAW,aAAa,EAAE,CAC5B,OAAM;AAER,QAAM,IAAID,kEAAuB,6DAA6D,EAAE,OAAO,GAAG,CAAC"}
+{"version":3,"file":"auth.js","names":["HexclaveAssertionError","KnownError","Result"],"sources":["../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownError, HexclaveClientInterface } from \"@hexclave/shared\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport { HexclaveAssertionError, throwErr } from \"@hexclave/shared/dist/utils/errors\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { deindent } from \"@hexclave/shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\nexport async function getNewOAuthProviderOrScopeUrl(\n  iface: HexclaveClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n): Promise<string> {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  return await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, \"afterCallbackRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\ntype OAuthCallbackConsumptionResult =\n  | {\n    type: \"oauth-response\",\n    originalUrl: URL,\n    codeVerifier: string,\n    state: string,\n  }\n  | {\n    type: \"known-error\",\n    error: KnownError,\n  };\n\nfunction consumeOAuthCallbackQueryParams(options?: {\n  dontWarnAboutMissingQueryParams?: boolean,\n}): OAuthCallbackConsumptionResult | null {\n  const oauthErrorParams = [\"error\", \"error_description\", \"errorCode\", \"message\", \"details\"] as const;\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  const knownErrorCode = originalUrl.searchParams.get(\"errorCode\");\n  const knownErrorMessage = originalUrl.searchParams.get(\"message\");\n  if (knownErrorCode && knownErrorMessage) {\n    const details = originalUrl.searchParams.get(\"details\");\n    let detailsJson = {};\n    if (details) {\n      try {\n        detailsJson = JSON.parse(details);\n      } catch (error) {\n        throw new HexclaveAssertionError(\"OAuth callback returned malformed known-error details\", {\n          details,\n          cause: error,\n        });\n      }\n    }\n\n    const newUrl = new URL(originalUrl);\n    for (const param of oauthErrorParams) {\n      newUrl.searchParams.delete(param);\n    }\n    window.history.replaceState({}, \"\", newUrl.toString());\n\n    return {\n      type: \"known-error\",\n      error: KnownError.fromJson({\n        code: knownErrorCode,\n        message: knownErrorMessage,\n        details: detailsJson,\n      }),\n    };\n  }\n\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      if (!options?.dontWarnAboutMissingQueryParams) {\n        console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      }\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Stack found an outer OAuth callback state in the query parameters, but not in cookies.\n\n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Stack.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    type: \"oauth-response\",\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: HexclaveClientInterface,\n  redirectUrl: string,\n  options?: {\n    dontWarnAboutMissingQueryParams?: boolean,\n  },\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams(options);\n  if (!consumed) return Result.ok(undefined);\n  if (consumed.type === \"known-error\") {\n    throw consumed.error;\n  }\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new HexclaveAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;AAWA,eAAsB,8BACpB,OACA,SAMA,SACiB;CACjB,MAAM,EAAE,eAAe,UAAU,6CAA4B;AAC7D,QAAO,MAAM,MAAM,YAAY;EAC7B,UAAU,QAAQ;EAClB,uDAAkC,QAAQ,aAAa,cAAc;EACrE,4DAAuC,QAAQ,kBAAkB,mBAAmB;EACpF,oEAA+C,OAAO,SAAS,MAAM,2BAA2B;EAChG;EACA;EACA,MAAM;EACN;EACA,eAAe,QAAQ;EACxB,CAAC;;AAoBJ,SAAS,gCAAgC,SAEC;CACxC,MAAM,mBAAmB;EAAC;EAAS;EAAqB;EAAa;EAAW;EAAU;CAC1F,MAAM,iBAAiB,CAAC,QAAQ,QAAQ;CACxC,MAAM,cAAc,IAAI,IAAI,OAAO,SAAS,KAAK;CACjD,MAAM,iBAAiB,YAAY,aAAa,IAAI,YAAY;CAChE,MAAM,oBAAoB,YAAY,aAAa,IAAI,UAAU;AACjE,KAAI,kBAAkB,mBAAmB;EACvC,MAAM,UAAU,YAAY,aAAa,IAAI,UAAU;EACvD,IAAI,cAAc,EAAE;AACpB,MAAI,QACF,KAAI;AACF,iBAAc,KAAK,MAAM,QAAQ;WAC1B,OAAO;AACd,SAAM,IAAIA,0DAAuB,yDAAyD;IACxF;IACA,OAAO;IACR,CAAC;;EAIN,MAAM,SAAS,IAAI,IAAI,YAAY;AACnC,OAAK,MAAM,SAAS,iBAClB,QAAO,aAAa,OAAO,MAAM;AAEnC,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,OAAO,UAAU,CAAC;AAEtD,SAAO;GACL,MAAM;GACN,OAAOC,4BAAW,SAAS;IACzB,MAAM;IACN,SAAS;IACT,SAAS;IACV,CAAC;GACH;;AAGH,MAAK,MAAM,SAAS,eAClB,KAAI,CAAC,YAAY,aAAa,IAAI,MAAM,EAAE;AACxC,MAAI,CAAC,SAAS,gCACZ,SAAQ,qBAAK,IAAI,MAAM,uDAAuD,MAAM,2EAA2E,CAAC;AAElK,SAAO;;CAIX,MAAM,gBAAgB,YAAY,aAAa,IAAI,QAAQ,qDAAa,wDAAwD;CAChI,MAAM,8DAA6C,cAAc;AAEjE,KAAI,CAAC,cAAc;AAGjB,UAAQ,KAAK,4CAAQ;;;;;;;;;;;MAWnB;AACF,SAAO;;CAIT,MAAM,SAAS,IAAI,IAAI,YAAY;AACnC,MAAK,MAAM,SAAS,eAClB,QAAO,aAAa,OAAO,MAAM;AASnC,QAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,OAAO,UAAU,CAAC;AAEtD,QAAO;EACL,MAAM;EACN;EACA,cAAc,aAAa;EAC3B,OAAO;EACR;;AAGH,eAAsB,kBACpB,OACA,aACA,SAGA;CAIA,MAAM,WAAW,gCAAgC,QAAQ;AACzD,KAAI,CAAC,SAAU,QAAOC,2CAAO,GAAG,OAAU;AAC1C,KAAI,SAAS,SAAS,cACpB,OAAM,SAAS;AAMjB,KAAI;AACF,SAAOA,2CAAO,GAAG,MAAM,MAAM,kBAAkB;GAC7C,aAAa,SAAS,YAAY;GAClC,uDAAkC,aAAa,cAAc;GAC7D,cAAc,SAAS;GACvB,OAAO,SAAS;GACjB,CAAC,CAAC;UACI,GAAG;AACV,MAAID,4BAAW,aAAa,EAAE,CAC5B,OAAM;AAER,QAAM,IAAID,0DAAuB,6DAA6D,EAAE,OAAO,GAAG,CAAC"}

package/dist/lib/auth.test.js

@@ -1,6 +1,6 @@
 const require_chunk = require('../chunk-BE-pF4vm.js');
 let vitest = require("vitest");
-let _stackframe_stack_shared = require("@hexclave/shared");
+let _hexclave_shared = require("@hexclave/shared");
 let __auth_js = require("./auth.js");
 
 //#region src/lib/auth.test.ts
@@ -17,7 +17,7 @@ vitest.vi.mock("./cookie", async (importOriginal) => {
 (0, vitest.describe)("getNewOAuthProviderOrScopeUrl", () => {
 	(0, vitest.it)("returns the OAuth URL without performing navigation", async () => {
 		window.history.replaceState({}, "", "/account?after_auth_return_to=%2Fsettings");
-		const iface = new _stackframe_stack_shared.HexclaveClientInterface({
+		const iface = new _hexclave_shared.HexclaveClientInterface({
 			clientVersion: "test",
 			getBaseUrl: () => "https://api.example.com",
 			getApiUrls: () => ["https://api.example.com"],

package/dist/lib/auth.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.test.js","names":["vi","HexclaveClientInterface"],"sources":["../../src/lib/auth.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { HexclaveClientInterface } from \"@stackframe/stack-shared\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { getNewOAuthProviderOrScopeUrl } from \"./auth\";\n\nvi.mock(\"./cookie\", async (importOriginal) => {\n  const actual = await importOriginal<typeof import(\"./cookie\")>();\n  return {\n    ...actual,\n    saveVerifierAndState: async () => ({\n      codeChallenge: \"<stripped code challenge>\",\n      state: \"<stripped state>\",\n    }),\n  };\n});\n\ndescribe(\"getNewOAuthProviderOrScopeUrl\", () => {\n  it(\"returns the OAuth URL without performing navigation\", async () => {\n    window.history.replaceState({}, \"\", \"/account?after_auth_return_to=%2Fsettings\");\n\n    const iface = new HexclaveClientInterface({\n      clientVersion: \"test\",\n      getBaseUrl: () => \"https://api.example.com\",\n      getApiUrls: () => [\"https://api.example.com\"],\n      extraRequestHeaders: {},\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"pck_test\",\n    });\n    const session = iface.createSession({ refreshToken: null, accessToken: null });\n\n    const location = await getNewOAuthProviderOrScopeUrl(\n      iface,\n      {\n        provider: \"github\",\n        redirectUrl: \"/handler/oauth-callback\",\n        errorRedirectUrl: \"/handler/error\",\n        providerScope: \"repo user\",\n      },\n      session,\n    );\n\n    const url = new URL(location);\n    expect(`${url.origin}${url.pathname}`).toBe(\"https://api.example.com/api/v1/auth/oauth/authorize/github\");\n    expect(Object.fromEntries(url.searchParams.entries())).toMatchInlineSnapshot(`\n      {\n        \"after_callback_redirect_url\": \"http://localhost:3000/account?after_auth_return_to=%2Fsettings\",\n        \"client_id\": \"00000000-0000-4000-8000-000000000000\",\n        \"client_secret\": \"pck_test\",\n        \"code_challenge\": \"<stripped code challenge>\",\n        \"code_challenge_method\": \"S256\",\n        \"error_redirect_url\": \"http://localhost:3000/handler/error?after_auth_return_to=%2Fsettings\",\n        \"grant_type\": \"authorization_code\",\n        \"provider_scope\": \"repo user\",\n        \"redirect_uri\": \"http://localhost:3000/handler/oauth-callback?after_auth_return_to=%2Fsettings\",\n        \"response_type\": \"code\",\n        \"scope\": \"legacy\",\n        \"state\": \"<stripped state>\",\n        \"type\": \"link\",\n      }\n    `);\n  });\n});\n"],"mappings":";;;;;;;AAUAA,UAAG,KAAK,YAAY,OAAO,mBAAmB;AAE5C,QAAO;EACL,GAFa,MAAM,gBAA2C;EAG9D,sBAAsB,aAAa;GACjC,eAAe;GACf,OAAO;GACR;EACF;EACD;qBAEO,uCAAuC;AAC9C,gBAAG,uDAAuD,YAAY;AACpE,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,4CAA4C;EAEhF,MAAM,QAAQ,IAAIC,iDAAwB;GACxC,eAAe;GACf,kBAAkB;GAClB,kBAAkB,CAAC,0BAA0B;GAC7C,qBAAqB,EAAE;GACvB,WAAW;GACX,sBAAsB;GACvB,CAAC;EAGF,MAAM,WAAW,mDACf,OACA;GACE,UAAU;GACV,aAAa;GACb,kBAAkB;GAClB,eAAe;GAChB,EATa,MAAM,cAAc;GAAE,cAAc;GAAM,aAAa;GAAM,CAAC,CAW7E;EAED,MAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,qBAAO,GAAG,IAAI,SAAS,IAAI,WAAW,CAAC,KAAK,6DAA6D;AACzG,qBAAO,OAAO,YAAY,IAAI,aAAa,SAAS,CAAC,CAAC,CAAC,sBAAsB;;;;;;;;;;;;;;;;MAgB3E;GACF;EACF"}
+{"version":3,"file":"auth.test.js","names":["vi","HexclaveClientInterface"],"sources":["../../src/lib/auth.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { HexclaveClientInterface } from \"@hexclave/shared\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { getNewOAuthProviderOrScopeUrl } from \"./auth\";\n\nvi.mock(\"./cookie\", async (importOriginal) => {\n  const actual = await importOriginal<typeof import(\"./cookie\")>();\n  return {\n    ...actual,\n    saveVerifierAndState: async () => ({\n      codeChallenge: \"<stripped code challenge>\",\n      state: \"<stripped state>\",\n    }),\n  };\n});\n\ndescribe(\"getNewOAuthProviderOrScopeUrl\", () => {\n  it(\"returns the OAuth URL without performing navigation\", async () => {\n    window.history.replaceState({}, \"\", \"/account?after_auth_return_to=%2Fsettings\");\n\n    const iface = new HexclaveClientInterface({\n      clientVersion: \"test\",\n      getBaseUrl: () => \"https://api.example.com\",\n      getApiUrls: () => [\"https://api.example.com\"],\n      extraRequestHeaders: {},\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"pck_test\",\n    });\n    const session = iface.createSession({ refreshToken: null, accessToken: null });\n\n    const location = await getNewOAuthProviderOrScopeUrl(\n      iface,\n      {\n        provider: \"github\",\n        redirectUrl: \"/handler/oauth-callback\",\n        errorRedirectUrl: \"/handler/error\",\n        providerScope: \"repo user\",\n      },\n      session,\n    );\n\n    const url = new URL(location);\n    expect(`${url.origin}${url.pathname}`).toBe(\"https://api.example.com/api/v1/auth/oauth/authorize/github\");\n    expect(Object.fromEntries(url.searchParams.entries())).toMatchInlineSnapshot(`\n      {\n        \"after_callback_redirect_url\": \"http://localhost:3000/account?after_auth_return_to=%2Fsettings\",\n        \"client_id\": \"00000000-0000-4000-8000-000000000000\",\n        \"client_secret\": \"pck_test\",\n        \"code_challenge\": \"<stripped code challenge>\",\n        \"code_challenge_method\": \"S256\",\n        \"error_redirect_url\": \"http://localhost:3000/handler/error?after_auth_return_to=%2Fsettings\",\n        \"grant_type\": \"authorization_code\",\n        \"provider_scope\": \"repo user\",\n        \"redirect_uri\": \"http://localhost:3000/handler/oauth-callback?after_auth_return_to=%2Fsettings\",\n        \"response_type\": \"code\",\n        \"scope\": \"legacy\",\n        \"state\": \"<stripped state>\",\n        \"type\": \"link\",\n      }\n    `);\n  });\n});\n"],"mappings":";;;;;;;AAUAA,UAAG,KAAK,YAAY,OAAO,mBAAmB;AAE5C,QAAO;EACL,GAFa,MAAM,gBAA2C;EAG9D,sBAAsB,aAAa;GACjC,eAAe;GACf,OAAO;GACR;EACF;EACD;qBAEO,uCAAuC;AAC9C,gBAAG,uDAAuD,YAAY;AACpE,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,4CAA4C;EAEhF,MAAM,QAAQ,IAAIC,yCAAwB;GACxC,eAAe;GACf,kBAAkB;GAClB,kBAAkB,CAAC,0BAA0B;GAC7C,qBAAqB,EAAE;GACvB,WAAW;GACX,sBAAsB;GACvB,CAAC;EAGF,MAAM,WAAW,mDACf,OACA;GACE,UAAU;GACV,aAAa;GACb,kBAAkB;GAClB,eAAe;GAChB,EATa,MAAM,cAAc;GAAE,cAAc;GAAM,aAAa;GAAM,CAAC,CAW7E;EAED,MAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,qBAAO,GAAG,IAAI,SAAS,IAAI,WAAW,CAAC,KAAK,6DAA6D;AACzG,qBAAO,OAAO,YAAY,IAAI,aAAa,SAAS,CAAC,CAAC,CAAC,sBAAsB;;;;;;;;;;;;;;;;MAgB3E;GACF;EACF"}

package/dist/lib/cookie.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../chunk-BE-pF4vm.js');
-let _stackframe_stack_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
-let _stackframe_stack_shared_dist_utils_env = require("@hexclave/shared/dist/utils/env");
+let _hexclave_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
+let _hexclave_shared_dist_utils_env = require("@hexclave/shared/dist/utils/env");
 let js_cookie = require("js-cookie");
 js_cookie = require_chunk.__toESM(js_cookie);
 
@@ -116,11 +116,11 @@ const token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
 //#endregion
 //#region src/lib/cookie.ts
 function ensureClient() {
-	if (!(0, _stackframe_stack_shared_dist_utils_env.isBrowserLike)()) throw new Error("cookieClient functions can only be called in a browser environment, yet window is undefined");
+	if (!(0, _hexclave_shared_dist_utils_env.isBrowserLike)()) throw new Error("cookieClient functions can only be called in a browser environment, yet window is undefined");
 }
 async function createPlaceholderCookieHelper() {
 	function throwError() {
-		throw new _stackframe_stack_shared_dist_utils_errors.HexclaveAssertionError("Throwing cookie helper is just a placeholder. This should never be called");
+		throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Throwing cookie helper is just a placeholder. This should never be called");
 	}
 	return {
 		get: throwError,
@@ -134,16 +134,16 @@ function requiresSecureAttribute(name) {
 	return name.startsWith("__Host-");
 }
 function validateCookieOptions(name, options) {
-	if (requiresSecureAttribute(name) && options.domain !== void 0) throw new _stackframe_stack_shared_dist_utils_errors.HexclaveAssertionError("__Host- cookies must not specify a Domain attribute");
+	if (requiresSecureAttribute(name) && options.domain !== void 0) throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("__Host- cookies must not specify a Domain attribute");
 }
 async function createCookieHelper() {
-	if ((0, _stackframe_stack_shared_dist_utils_env.isBrowserLike)()) return createBrowserCookieHelper();
+	if ((0, _hexclave_shared_dist_utils_env.isBrowserLike)()) return createBrowserCookieHelper();
 	else return await createPlaceholderCookieHelper();
 }
 function createCookieHelperSync() {
-	if ((0, _stackframe_stack_shared_dist_utils_env.isBrowserLike)()) return createBrowserCookieHelper();
+	if ((0, _hexclave_shared_dist_utils_env.isBrowserLike)()) return createBrowserCookieHelper();
 	function throwError() {
-		throw new _stackframe_stack_shared_dist_utils_errors.HexclaveAssertionError("Synchronous server cookie helpers are not available on this platform");
+		throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Synchronous server cookie helpers are not available on this platform");
 	}
 	return {
 		get: throwError,
@@ -181,7 +181,7 @@ async function getCookie(name) {
 	return (await createCookieHelper()).get(name);
 }
 async function isSecure() {
-	if ((0, _stackframe_stack_shared_dist_utils_env.isBrowserLike)()) return determineSecureFromClientContext();
+	if ((0, _hexclave_shared_dist_utils_env.isBrowserLike)()) return determineSecureFromClientContext();
 	return false;
 }
 function determineSecureFromClientContext() {