@hexclave/js 1.0.0

package/dist/esm/integrations/convex/component/convex.config.js

@@ -0,0 +1,8 @@
+import { defineComponent } from "convex/server";
+
+//#region src/integrations/convex/component/convex.config.ts
+const component = defineComponent("stack_auth");
+
+//#endregion
+export { component as default };
+//# sourceMappingURL=convex.config.js.map

package/dist/esm/integrations/convex/component/convex.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convex.config.js","names":[],"sources":["../../../../../src/integrations/convex/component/convex.config.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { defineComponent } from \"convex/server\";\n\nconst component = defineComponent(\"stack_auth\");\n\nexport default component;\n"],"mappings":";;;AAMA,MAAM,YAAY,gBAAgB,aAAa"}

package/dist/esm/integrations/convex.d.ts

@@ -0,0 +1,13 @@
+//#region src/integrations/convex.d.ts
+declare function getConvexProvidersConfig(options: {
+  baseUrl?: string;
+  projectId: string;
+}): {
+  type: string;
+  issuer: URL;
+  jwks: URL;
+  algorithm: string;
+}[];
+//#endregion
+export { getConvexProvidersConfig };
+//# sourceMappingURL=convex.d.ts.map

package/dist/esm/integrations/convex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"convex.d.ts","names":[],"sources":["../../../src/integrations/convex.ts"],"mappings":";iBAOgB,wBAAA,CAAyB,OAAA;EACvC,OAAA;EACA,SAAA;AAAA;;UAFsC,GAAA;QAAA,GAAA"}

package/dist/esm/integrations/convex.js

@@ -0,0 +1,23 @@
+import { urlString } from "@hexclave/shared/dist/utils/urls";
+import { defaultBaseUrl } from "../lib/stack-app/apps/implementations/common.js";
+
+//#region src/integrations/convex.ts
+function getConvexProvidersConfig(options) {
+	const baseUrl = options.baseUrl || defaultBaseUrl;
+	const projectId = options.projectId;
+	return [{
+		type: "customJwt",
+		issuer: new URL(urlString`/api/v1/projects/${projectId}`, baseUrl),
+		jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),
+		algorithm: "ES256"
+	}, {
+		type: "customJwt",
+		issuer: new URL(urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),
+		jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),
+		algorithm: "ES256"
+	}];
+}
+
+//#endregion
+export { getConvexProvidersConfig };
+//# sourceMappingURL=convex.js.map

package/dist/esm/integrations/convex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convex.js","names":[],"sources":["../../../src/integrations/convex.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { urlString } from \"@stackframe/stack-shared/dist/utils/urls\";\nimport { defaultBaseUrl } from \"../lib/stack-app/apps/implementations/common\";\n\nexport function getConvexProvidersConfig(options: {\n  baseUrl?: string,\n  projectId: string,\n}) {\n  const baseUrl = options.baseUrl || defaultBaseUrl;\n  const projectId = options.projectId;\n  return [\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),\n      algorithm: \"ES256\",\n    },\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),\n      algorithm: \"ES256\",\n    },\n  ];\n}\n"],"mappings":";;;;AAOA,SAAgB,yBAAyB,SAGtC;CACD,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,YAAY,QAAQ;AAC1B,QAAO,CACL;EACE,MAAM;EACN,QAAQ,IAAI,IAAI,SAAS,oBAAoB,aAAa,QAAQ;EAClE,MAAM,IAAI,IAAI,SAAS,oBAAoB,UAAU,yBAAyB,QAAQ;EACtF,WAAW;EACZ,EACD;EACE,MAAM;EACN,QAAQ,IAAI,IAAI,SAAS,oCAAoC,aAAa,QAAQ;EAClF,MAAM,IAAI,IAAI,SAAS,oBAAoB,UAAU,gDAAgD,QAAQ;EAC7G,WAAW;EACZ,CACF"}

package/dist/esm/internal/deprecation-warning.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/esm/internal/deprecation-warning.js

@@ -0,0 +1,24 @@
+import { clientVersion } from "../lib/stack-app/apps/implementations/common.js";
+
+//#region src/internal/deprecation-warning.ts
+const WARNED_SYMBOL = Symbol.for("Hexclave--stackframe-package-deprecation-warned");
+function shouldWarn() {
+	return /^js @stackframe\//.test(clientVersion);
+}
+function warnOnce() {
+	const g = globalThis;
+	if (g[WARNED_SYMBOL]) return;
+	g[WARNED_SYMBOL] = true;
+	try {
+		if (typeof console !== "undefined" && typeof console.warn === "function") console.warn(`[Hexclave] You are using the legacy ${extractPackageName()} package. Please migrate to the @hexclave/* equivalent — the API surface is identical and the @stackframe/* packages are deprecated. See https://docs.hexclave.com/migration.`);
+	} catch {}
+}
+function extractPackageName() {
+	const match = clientVersion.match(/^js (@stackframe\/[^@]+)@/);
+	return match ? match[1] : "@stackframe/*";
+}
+if (shouldWarn()) warnOnce();
+
+//#endregion
+export {  };
+//# sourceMappingURL=deprecation-warning.js.map

package/dist/esm/internal/deprecation-warning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecation-warning.js","names":[],"sources":["../../../src/internal/deprecation-warning.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// PR 2 — Hexclave rebrand. When the SDK is loaded from a legacy `@stackframe/*`\n// package, emit a once-per-process console.warn pointing to the `@hexclave/*`\n// equivalent. The published `@hexclave/*` packages reuse the exact same built\n// artifacts, so we detect the package brand at runtime from `clientVersion`\n// (which the tsdown plugin stamps from package.json at build time).\n//\n// Repeated SDK imports within one process are de-duplicated via a Symbol on\n// globalThis — multiple bundlers / dynamic imports won't spam the console.\n\nimport { clientVersion } from \"../lib/stack-app/apps/implementations/common\";\n\nconst WARNED_SYMBOL = Symbol.for(\"Hexclave--stackframe-package-deprecation-warned\");\n\nfunction shouldWarn(): boolean {\n  // clientVersion is \"js <package-name>@<version>\" once the build-time sentinel\n  // is rewritten. In a built `@stackframe/*` artifact this looks like\n  // \"js @stackframe/stack@2.8.92\"; in `@hexclave/*` artifacts it looks like\n  // \"js @hexclave/next@1.0.0\". Anything else (template build, source mode) is\n  // a no-op.\n  return /^js @stackframe\\//.test(clientVersion);\n}\n\nfunction warnOnce() {\n  const g = globalThis as Record<symbol, unknown>;\n  if (g[WARNED_SYMBOL]) return;\n  g[WARNED_SYMBOL] = true;\n  // Best-effort advisory. Wrapped in try/catch because some sandboxed\n  // runtimes (older Workers, embedded JS hosts) stub or omit `console`;\n  // a throw here would break the consuming bundle on SDK import.\n  try {\n    if (typeof console !== \"undefined\" && typeof console.warn === \"function\") {\n      // eslint-disable-next-line no-console\n      console.warn(\n        `[Hexclave] You are using the legacy ${extractPackageName()} package. ` +\n        `Please migrate to the @hexclave/* equivalent — the API surface is identical ` +\n        `and the @stackframe/* packages are deprecated. See https://docs.hexclave.com/migration.`,\n      );\n    }\n  } catch {\n    // swallow: the warning is best-effort, never load-bearing.\n  }\n}\n\nfunction extractPackageName(): string {\n  // \"js @stackframe/stack@2.8.92\" → \"@stackframe/stack\"\n  const match = clientVersion.match(/^js (@stackframe\\/[^@]+)@/);\n  return match ? match[1] : \"@stackframe/*\";\n}\n\nif (shouldWarn()) {\n  warnOnce();\n}\n"],"mappings":";;;AAeA,MAAM,gBAAgB,OAAO,IAAI,kDAAkD;AAEnF,SAAS,aAAsB;AAM7B,QAAO,oBAAoB,KAAK,cAAc;;AAGhD,SAAS,WAAW;CAClB,MAAM,IAAI;AACV,KAAI,EAAE,eAAgB;AACtB,GAAE,iBAAiB;AAInB,KAAI;AACF,MAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,SAAS,WAE5D,SAAQ,KACN,uCAAuC,oBAAoB,CAAC,+KAG7D;SAEG;;AAKV,SAAS,qBAA6B;CAEpC,MAAM,QAAQ,cAAc,MAAM,4BAA4B;AAC9D,QAAO,QAAQ,MAAM,KAAK;;AAG5B,IAAI,YAAY,CACd,WAAU"}

package/dist/esm/lib/auth.d.ts

@@ -0,0 +1,31 @@
+import { HexclaveClientInterface } from "@hexclave/shared";
+import { InternalSession } from "@hexclave/shared/dist/sessions";
+
+//#region src/lib/auth.d.ts
+declare function getNewOAuthProviderOrScopeUrl(iface: HexclaveClientInterface, options: {
+  provider: string;
+  redirectUrl: string;
+  errorRedirectUrl: string;
+  providerScope?: string;
+}, session: InternalSession): Promise<string>;
+declare function callOAuthCallback(iface: HexclaveClientInterface, redirectUrl: string, options?: {
+  dontWarnAboutMissingQueryParams?: boolean;
+}): Promise<({
+  status: "ok";
+  data: undefined;
+} & {
+  status: "ok";
+}) | ({
+  status: "ok";
+  data: {
+    newUser: boolean;
+    afterCallbackRedirectUrl?: string;
+    accessToken: string;
+    refreshToken: string;
+  };
+} & {
+  status: "ok";
+})>;
+//#endregion
+export { callOAuthCallback, getNewOAuthProviderOrScopeUrl };
+//# sourceMappingURL=auth.d.ts.map

package/dist/esm/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../../src/lib/auth.ts"],"mappings":";;;;iBAWsB,6BAAA,CACpB,KAAA,EAAO,uBAAA,EACP,OAAA;EACE,QAAA;EACA,WAAA;EACA,gBAAA;EACA,aAAA;AAAA,GAEF,OAAA,EAAS,eAAA,GACR,OAAA;AAAA,iBA0HmB,iBAAA,CACpB,KAAA,EAAO,uBAAA,EACP,WAAA,UACA,OAAA;EACE,+BAAA;AAAA,IACD,OAAA"}

package/dist/esm/lib/auth.js

@@ -0,0 +1,108 @@
+import { HexclaveAssertionError, throwErr } from "@hexclave/shared/dist/utils/errors";
+import { KnownError } from "@hexclave/shared";
+import { Result } from "@hexclave/shared/dist/utils/results";
+import { deindent } from "@hexclave/shared/dist/utils/strings";
+import { constructRedirectUrl } from "../utils/url.js";
+import { consumeVerifierAndStateCookie, saveVerifierAndState } from "./cookie.js";
+
+//#region src/lib/auth.ts
+async function getNewOAuthProviderOrScopeUrl(iface, options, session) {
+	const { codeChallenge, state } = await saveVerifierAndState();
+	return await iface.getOAuthUrl({
+		provider: options.provider,
+		redirectUrl: constructRedirectUrl(options.redirectUrl, "redirectUrl"),
+		errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, "errorRedirectUrl"),
+		afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, "afterCallbackRedirectUrl"),
+		codeChallenge,
+		state,
+		type: "link",
+		session,
+		providerScope: options.providerScope
+	});
+}
+function consumeOAuthCallbackQueryParams(options) {
+	const oauthErrorParams = [
+		"error",
+		"error_description",
+		"errorCode",
+		"message",
+		"details"
+	];
+	const requiredParams = ["code", "state"];
+	const originalUrl = new URL(window.location.href);
+	const knownErrorCode = originalUrl.searchParams.get("errorCode");
+	const knownErrorMessage = originalUrl.searchParams.get("message");
+	if (knownErrorCode && knownErrorMessage) {
+		const details = originalUrl.searchParams.get("details");
+		let detailsJson = {};
+		if (details) try {
+			detailsJson = JSON.parse(details);
+		} catch (error) {
+			throw new HexclaveAssertionError("OAuth callback returned malformed known-error details", {
+				details,
+				cause: error
+			});
+		}
+		const newUrl = new URL(originalUrl);
+		for (const param of oauthErrorParams) newUrl.searchParams.delete(param);
+		window.history.replaceState({}, "", newUrl.toString());
+		return {
+			type: "known-error",
+			error: KnownError.fromJson({
+				code: knownErrorCode,
+				message: knownErrorMessage,
+				details: detailsJson
+			})
+		};
+	}
+	for (const param of requiredParams) if (!originalUrl.searchParams.has(param)) {
+		if (!options?.dontWarnAboutMissingQueryParams) console.warn(/* @__PURE__ */ new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));
+		return null;
+	}
+	const expectedState = originalUrl.searchParams.get("state") ?? throwErr("This should never happen; isn't state required above?");
+	const cookieResult = consumeVerifierAndStateCookie(expectedState);
+	if (!cookieResult) {
+		console.warn(deindent`
+      Stack found an outer OAuth callback state in the query parameters, but not in cookies.
+
+      This could have multiple reasons:
+        - The cookie expired, because the OAuth flow took too long.
+        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.
+        - The cookie was already consumed by this page, and the user already logged in.
+        - You are using another OAuth client library with the same callback URL as Stack.
+        - The user opened the OAuth callback page from their history.
+
+      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.
+    `);
+		return null;
+	}
+	const newUrl = new URL(originalUrl);
+	for (const param of requiredParams) newUrl.searchParams.delete(param);
+	window.history.replaceState({}, "", newUrl.toString());
+	return {
+		type: "oauth-response",
+		originalUrl,
+		codeVerifier: cookieResult.codeVerifier,
+		state: expectedState
+	};
+}
+async function callOAuthCallback(iface, redirectUrl, options) {
+	const consumed = consumeOAuthCallbackQueryParams(options);
+	if (!consumed) return Result.ok(void 0);
+	if (consumed.type === "known-error") throw consumed.error;
+	try {
+		return Result.ok(await iface.callOAuthCallback({
+			oauthParams: consumed.originalUrl.searchParams,
+			redirectUri: constructRedirectUrl(redirectUrl, "redirectUri"),
+			codeVerifier: consumed.codeVerifier,
+			state: consumed.state
+		}));
+	} catch (e) {
+		if (KnownError.isKnownError(e)) throw e;
+		throw new HexclaveAssertionError("Error signing in during OAuth callback. Please try again.", { cause: e });
+	}
+}
+
+//#endregion
+export { callOAuthCallback, getNewOAuthProviderOrScopeUrl };
+//# sourceMappingURL=auth.js.map

package/dist/esm/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":[],"sources":["../../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownError, HexclaveClientInterface } from \"@stackframe/stack-shared\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { HexclaveAssertionError, throwErr } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { deindent } from \"@stackframe/stack-shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\nexport async function getNewOAuthProviderOrScopeUrl(\n  iface: HexclaveClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n): Promise<string> {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  return await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, \"afterCallbackRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\ntype OAuthCallbackConsumptionResult =\n  | {\n    type: \"oauth-response\",\n    originalUrl: URL,\n    codeVerifier: string,\n    state: string,\n  }\n  | {\n    type: \"known-error\",\n    error: KnownError,\n  };\n\nfunction consumeOAuthCallbackQueryParams(options?: {\n  dontWarnAboutMissingQueryParams?: boolean,\n}): OAuthCallbackConsumptionResult | null {\n  const oauthErrorParams = [\"error\", \"error_description\", \"errorCode\", \"message\", \"details\"] as const;\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  const knownErrorCode = originalUrl.searchParams.get(\"errorCode\");\n  const knownErrorMessage = originalUrl.searchParams.get(\"message\");\n  if (knownErrorCode && knownErrorMessage) {\n    const details = originalUrl.searchParams.get(\"details\");\n    let detailsJson = {};\n    if (details) {\n      try {\n        detailsJson = JSON.parse(details);\n      } catch (error) {\n        throw new HexclaveAssertionError(\"OAuth callback returned malformed known-error details\", {\n          details,\n          cause: error,\n        });\n      }\n    }\n\n    const newUrl = new URL(originalUrl);\n    for (const param of oauthErrorParams) {\n      newUrl.searchParams.delete(param);\n    }\n    window.history.replaceState({}, \"\", newUrl.toString());\n\n    return {\n      type: \"known-error\",\n      error: KnownError.fromJson({\n        code: knownErrorCode,\n        message: knownErrorMessage,\n        details: detailsJson,\n      }),\n    };\n  }\n\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      if (!options?.dontWarnAboutMissingQueryParams) {\n        console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      }\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Stack found an outer OAuth callback state in the query parameters, but not in cookies.\n\n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Stack.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    type: \"oauth-response\",\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: HexclaveClientInterface,\n  redirectUrl: string,\n  options?: {\n    dontWarnAboutMissingQueryParams?: boolean,\n  },\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams(options);\n  if (!consumed) return Result.ok(undefined);\n  if (consumed.type === \"known-error\") {\n    throw consumed.error;\n  }\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new HexclaveAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;AAWA,eAAsB,8BACpB,OACA,SAMA,SACiB;CACjB,MAAM,EAAE,eAAe,UAAU,MAAM,sBAAsB;AAC7D,QAAO,MAAM,MAAM,YAAY;EAC7B,UAAU,QAAQ;EAClB,aAAa,qBAAqB,QAAQ,aAAa,cAAc;EACrE,kBAAkB,qBAAqB,QAAQ,kBAAkB,mBAAmB;EACpF,0BAA0B,qBAAqB,OAAO,SAAS,MAAM,2BAA2B;EAChG;EACA;EACA,MAAM;EACN;EACA,eAAe,QAAQ;EACxB,CAAC;;AAoBJ,SAAS,gCAAgC,SAEC;CACxC,MAAM,mBAAmB;EAAC;EAAS;EAAqB;EAAa;EAAW;EAAU;CAC1F,MAAM,iBAAiB,CAAC,QAAQ,QAAQ;CACxC,MAAM,cAAc,IAAI,IAAI,OAAO,SAAS,KAAK;CACjD,MAAM,iBAAiB,YAAY,aAAa,IAAI,YAAY;CAChE,MAAM,oBAAoB,YAAY,aAAa,IAAI,UAAU;AACjE,KAAI,kBAAkB,mBAAmB;EACvC,MAAM,UAAU,YAAY,aAAa,IAAI,UAAU;EACvD,IAAI,cAAc,EAAE;AACpB,MAAI,QACF,KAAI;AACF,iBAAc,KAAK,MAAM,QAAQ;WAC1B,OAAO;AACd,SAAM,IAAI,uBAAuB,yDAAyD;IACxF;IACA,OAAO;IACR,CAAC;;EAIN,MAAM,SAAS,IAAI,IAAI,YAAY;AACnC,OAAK,MAAM,SAAS,iBAClB,QAAO,aAAa,OAAO,MAAM;AAEnC,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,OAAO,UAAU,CAAC;AAEtD,SAAO;GACL,MAAM;GACN,OAAO,WAAW,SAAS;IACzB,MAAM;IACN,SAAS;IACT,SAAS;IACV,CAAC;GACH;;AAGH,MAAK,MAAM,SAAS,eAClB,KAAI,CAAC,YAAY,aAAa,IAAI,MAAM,EAAE;AACxC,MAAI,CAAC,SAAS,gCACZ,SAAQ,qBAAK,IAAI,MAAM,uDAAuD,MAAM,2EAA2E,CAAC;AAElK,SAAO;;CAIX,MAAM,gBAAgB,YAAY,aAAa,IAAI,QAAQ,IAAI,SAAS,wDAAwD;CAChI,MAAM,eAAe,8BAA8B,cAAc;AAEjE,KAAI,CAAC,cAAc;AAGjB,UAAQ,KAAK,QAAQ;;;;;;;;;;;MAWnB;AACF,SAAO;;CAIT,MAAM,SAAS,IAAI,IAAI,YAAY;AACnC,MAAK,MAAM,SAAS,eAClB,QAAO,aAAa,OAAO,MAAM;AASnC,QAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,OAAO,UAAU,CAAC;AAEtD,QAAO;EACL,MAAM;EACN;EACA,cAAc,aAAa;EAC3B,OAAO;EACR;;AAGH,eAAsB,kBACpB,OACA,aACA,SAGA;CAIA,MAAM,WAAW,gCAAgC,QAAQ;AACzD,KAAI,CAAC,SAAU,QAAO,OAAO,GAAG,OAAU;AAC1C,KAAI,SAAS,SAAS,cACpB,OAAM,SAAS;AAMjB,KAAI;AACF,SAAO,OAAO,GAAG,MAAM,MAAM,kBAAkB;GAC7C,aAAa,SAAS,YAAY;GAClC,aAAa,qBAAqB,aAAa,cAAc;GAC7D,cAAc,SAAS;GACvB,OAAO,SAAS;GACjB,CAAC,CAAC;UACI,GAAG;AACV,MAAI,WAAW,aAAa,EAAE,CAC5B,OAAM;AAER,QAAM,IAAI,uBAAuB,6DAA6D,EAAE,OAAO,GAAG,CAAC"}

package/dist/esm/lib/auth.test.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/esm/lib/auth.test.js

@@ -0,0 +1,60 @@
+import { describe, expect, it, vi } from "vitest";
+import { HexclaveClientInterface } from "@hexclave/shared";
+import { getNewOAuthProviderOrScopeUrl } from "./auth.js";
+
+//#region src/lib/auth.test.ts
+// @vitest-environment jsdom
+vi.mock("./cookie", async (importOriginal) => {
+	return {
+		...await importOriginal(),
+		saveVerifierAndState: async () => ({
+			codeChallenge: "<stripped code challenge>",
+			state: "<stripped state>"
+		})
+	};
+});
+describe("getNewOAuthProviderOrScopeUrl", () => {
+	it("returns the OAuth URL without performing navigation", async () => {
+		window.history.replaceState({}, "", "/account?after_auth_return_to=%2Fsettings");
+		const iface = new HexclaveClientInterface({
+			clientVersion: "test",
+			getBaseUrl: () => "https://api.example.com",
+			getApiUrls: () => ["https://api.example.com"],
+			extraRequestHeaders: {},
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "pck_test"
+		});
+		const location = await getNewOAuthProviderOrScopeUrl(iface, {
+			provider: "github",
+			redirectUrl: "/handler/oauth-callback",
+			errorRedirectUrl: "/handler/error",
+			providerScope: "repo user"
+		}, iface.createSession({
+			refreshToken: null,
+			accessToken: null
+		}));
+		const url = new URL(location);
+		expect(`${url.origin}${url.pathname}`).toBe("https://api.example.com/api/v1/auth/oauth/authorize/github");
+		expect(Object.fromEntries(url.searchParams.entries())).toMatchInlineSnapshot(`
+      {
+        "after_callback_redirect_url": "http://localhost:3000/account?after_auth_return_to=%2Fsettings",
+        "client_id": "00000000-0000-4000-8000-000000000000",
+        "client_secret": "pck_test",
+        "code_challenge": "<stripped code challenge>",
+        "code_challenge_method": "S256",
+        "error_redirect_url": "http://localhost:3000/handler/error?after_auth_return_to=%2Fsettings",
+        "grant_type": "authorization_code",
+        "provider_scope": "repo user",
+        "redirect_uri": "http://localhost:3000/handler/oauth-callback?after_auth_return_to=%2Fsettings",
+        "response_type": "code",
+        "scope": "legacy",
+        "state": "<stripped state>",
+        "type": "link",
+      }
+    `);
+	});
+});
+
+//#endregion
+export {  };
+//# sourceMappingURL=auth.test.js.map

package/dist/esm/lib/auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.js","names":[],"sources":["../../../src/lib/auth.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { HexclaveClientInterface } from \"@stackframe/stack-shared\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { getNewOAuthProviderOrScopeUrl } from \"./auth\";\n\nvi.mock(\"./cookie\", async (importOriginal) => {\n  const actual = await importOriginal<typeof import(\"./cookie\")>();\n  return {\n    ...actual,\n    saveVerifierAndState: async () => ({\n      codeChallenge: \"<stripped code challenge>\",\n      state: \"<stripped state>\",\n    }),\n  };\n});\n\ndescribe(\"getNewOAuthProviderOrScopeUrl\", () => {\n  it(\"returns the OAuth URL without performing navigation\", async () => {\n    window.history.replaceState({}, \"\", \"/account?after_auth_return_to=%2Fsettings\");\n\n    const iface = new HexclaveClientInterface({\n      clientVersion: \"test\",\n      getBaseUrl: () => \"https://api.example.com\",\n      getApiUrls: () => [\"https://api.example.com\"],\n      extraRequestHeaders: {},\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"pck_test\",\n    });\n    const session = iface.createSession({ refreshToken: null, accessToken: null });\n\n    const location = await getNewOAuthProviderOrScopeUrl(\n      iface,\n      {\n        provider: \"github\",\n        redirectUrl: \"/handler/oauth-callback\",\n        errorRedirectUrl: \"/handler/error\",\n        providerScope: \"repo user\",\n      },\n      session,\n    );\n\n    const url = new URL(location);\n    expect(`${url.origin}${url.pathname}`).toBe(\"https://api.example.com/api/v1/auth/oauth/authorize/github\");\n    expect(Object.fromEntries(url.searchParams.entries())).toMatchInlineSnapshot(`\n      {\n        \"after_callback_redirect_url\": \"http://localhost:3000/account?after_auth_return_to=%2Fsettings\",\n        \"client_id\": \"00000000-0000-4000-8000-000000000000\",\n        \"client_secret\": \"pck_test\",\n        \"code_challenge\": \"<stripped code challenge>\",\n        \"code_challenge_method\": \"S256\",\n        \"error_redirect_url\": \"http://localhost:3000/handler/error?after_auth_return_to=%2Fsettings\",\n        \"grant_type\": \"authorization_code\",\n        \"provider_scope\": \"repo user\",\n        \"redirect_uri\": \"http://localhost:3000/handler/oauth-callback?after_auth_return_to=%2Fsettings\",\n        \"response_type\": \"code\",\n        \"scope\": \"legacy\",\n        \"state\": \"<stripped state>\",\n        \"type\": \"link\",\n      }\n    `);\n  });\n});\n"],"mappings":";;;;;;AAUA,GAAG,KAAK,YAAY,OAAO,mBAAmB;AAE5C,QAAO;EACL,GAFa,MAAM,gBAA2C;EAG9D,sBAAsB,aAAa;GACjC,eAAe;GACf,OAAO;GACR;EACF;EACD;AAEF,SAAS,uCAAuC;AAC9C,IAAG,uDAAuD,YAAY;AACpE,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,4CAA4C;EAEhF,MAAM,QAAQ,IAAI,wBAAwB;GACxC,eAAe;GACf,kBAAkB;GAClB,kBAAkB,CAAC,0BAA0B;GAC7C,qBAAqB,EAAE;GACvB,WAAW;GACX,sBAAsB;GACvB,CAAC;EAGF,MAAM,WAAW,MAAM,8BACrB,OACA;GACE,UAAU;GACV,aAAa;GACb,kBAAkB;GAClB,eAAe;GAChB,EATa,MAAM,cAAc;GAAE,cAAc;GAAM,aAAa;GAAM,CAAC,CAW7E;EAED,MAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,SAAO,GAAG,IAAI,SAAS,IAAI,WAAW,CAAC,KAAK,6DAA6D;AACzG,SAAO,OAAO,YAAY,IAAI,aAAa,SAAS,CAAC,CAAC,CAAC,sBAAsB;;;;;;;;;;;;;;;;MAgB3E;GACF;EACF"}

package/dist/esm/lib/cookie.d.ts

@@ -0,0 +1,42 @@
+//#region src/lib/cookie.d.ts
+type SetCookieOptions = {
+  maxAge: number | "session";
+  noOpIfServerComponent?: boolean;
+  domain?: string;
+  secure?: boolean;
+};
+type DeleteCookieOptions = {
+  noOpIfServerComponent?: boolean;
+  domain?: string;
+};
+type CookieHelper = {
+  get: (name: string) => string | null;
+  getAll: () => Record<string, string>;
+  set: (name: string, value: string, options: SetCookieOptions) => void;
+  setOrDelete: (name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) => void;
+  delete: (name: string, options: DeleteCookieOptions) => void;
+};
+declare function createPlaceholderCookieHelper(): Promise<CookieHelper>;
+declare function createCookieHelper(): Promise<CookieHelper>;
+declare function createCookieHelperSync(): CookieHelper;
+declare function createBrowserCookieHelper(): CookieHelper;
+declare function getCookieClient(name: string): string | null;
+declare function getAllCookiesClient(): Record<string, string>;
+declare function getCookie(name: string): Promise<string | null>;
+declare function isSecure(): Promise<boolean>;
+declare function setOrDeleteCookieClient(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions): void;
+declare function setOrDeleteCookie(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions): Promise<void>;
+declare function deleteCookieClient(name: string, options: DeleteCookieOptions): void;
+declare function deleteCookie(name: string, options: DeleteCookieOptions): Promise<void>;
+declare function setCookieClient(name: string, value: string, options: SetCookieOptions): void;
+declare function setCookie(name: string, value: string, options: SetCookieOptions): Promise<void>;
+declare function saveVerifierAndState(): Promise<{
+  codeChallenge: string;
+  state: string;
+}>;
+declare function consumeVerifierAndStateCookie(state: string): {
+  codeVerifier: string;
+} | null;
+//#endregion
+export { CookieHelper, consumeVerifierAndStateCookie, createBrowserCookieHelper, createCookieHelper, createCookieHelperSync, createPlaceholderCookieHelper, deleteCookie, deleteCookieClient, getAllCookiesClient, getCookie, getCookieClient, isSecure, saveVerifierAndState, setCookie, setCookieClient, setOrDeleteCookie, setOrDeleteCookieClient };
+//# sourceMappingURL=cookie.d.ts.map

package/dist/esm/lib/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","names":[],"sources":["../../../src/lib/cookie.ts"],"mappings":";KAqEK,gBAAA;EAAqB,MAAA;EAA4B,qBAAA;EAAiC,MAAA;EAAiB,MAAA;AAAA;AAAA,KACnG,mBAAA;EAAwB,qBAAA;EAAiC,MAAA;AAAA;AAAA,KASlD,YAAA;EACV,GAAA,GAAM,IAAA;EACN,MAAA,QAAc,MAAA;EACd,GAAA,GAAM,IAAA,UAAc,KAAA,UAAe,OAAA,EAAS,gBAAA;EAC5C,WAAA,GAAc,IAAA,UAAc,KAAA,iBAAsB,OAAA,EAAS,gBAAA,GAAmB,mBAAA;EAC9E,MAAA,GAAS,IAAA,UAAc,OAAA,EAAS,mBAAA;AAAA;AAAA,iBAIZ,6BAAA,CAAA,GAAiC,OAAA,CAAQ,YAAA;AAAA,iBAuBzC,kBAAA,CAAA,GAAsB,OAAA,CAAQ,YAAA;AAAA,iBAQpC,sBAAA,CAAA,GAA0B,YAAA;AAAA,iBAiB1B,yBAAA,CAAA,GAA6B,YAAA;AAAA,iBAuB7B,eAAA,CAAgB,IAAA;AAAA,iBAKhB,mBAAA,CAAA,GAAuB,MAAA;AAAA,iBASjB,SAAA,CAAU,IAAA,WAAe,OAAA;AAAA,iBAKzB,QAAA,CAAA,GAAY,OAAA;AAAA,iBAqFlB,uBAAA,CAAwB,IAAA,UAAc,KAAA,iBAAsB,OAAA,EAAS,gBAAA,GAAmB,mBAAA;AAAA,iBASlF,iBAAA,CAAkB,IAAA,UAAc,KAAA,iBAAsB,OAAA,EAAS,gBAAA,GAAmB,mBAAA,GAAmB,OAAA;AAAA,iBAK3G,kBAAA,CAAmB,IAAA,UAAc,OAAA,EAAS,mBAAA;AAAA,iBAKpC,YAAA,CAAa,IAAA,UAAc,OAAA,EAAS,mBAAA,GAAmB,OAAA;AAAA,iBAK7D,eAAA,CAAgB,IAAA,UAAc,KAAA,UAAe,OAAA,EAAS,gBAAA;AAAA,iBAKhD,SAAA,CAAU,IAAA,UAAc,KAAA,UAAe,OAAA,EAAS,gBAAA,GAAgB,OAAA;AAAA,iBAKhE,oBAAA,CAAA,GAAoB,OAAA;;;;iBAe1B,6BAAA,CAA8B,KAAA;EAAA,YAAA;AAAA"}