@hexclave/js 1.0.0

package/dist/lib/stack-app/apps/implementations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../../../src/lib/stack-app/apps/implementations/index.ts"],"mappings":";;;;;cA8BE,kBAAA,SAAkB,4BAAA,EAAA,mBAAA,SACC,6BAAA,EAAA,mBAAA,SACA,6BAAA"}

package/dist/lib/stack-app/apps/implementations/index.js

@@ -0,0 +1,31 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../../../../chunk-BE-pF4vm.js');
+let __server_app_impl_js = require("./server-app-impl.js");
+let _stackframe_stack_shared_dist_utils_compile_time = require("@hexclave/shared/dist/utils/compile-time");
+let __admin_app_impl_js = require("./admin-app-impl.js");
+let __client_app_impl_js = require("./client-app-impl.js");
+
+//#region src/lib/stack-app/apps/implementations/index.ts
+/**
+* Prevents a circular dependency between the client and admin apps. For more information, see the documentation comment
+* of `_StackClientAppImplIncomplete.LazyStackAdminAppImpl`.
+*
+* Note: This is an explicitly defined function that returns the new values (and not a barrel file with top-level side
+* effects) because we have `sideEffects: false` in the package.json, and so it would be tree-shaken away if we just
+* exported the values directly.
+*/
+function complete() {
+	__client_app_impl_js._StackClientAppImplIncomplete.LazyStackAdminAppImpl.value = __admin_app_impl_js._StackAdminAppImplIncomplete;
+	return {
+		_StackAdminAppImpl: (0, _stackframe_stack_shared_dist_utils_compile_time.scrambleDuringCompileTime)(__admin_app_impl_js._StackAdminAppImplIncomplete),
+		_StackClientAppImpl: (0, _stackframe_stack_shared_dist_utils_compile_time.scrambleDuringCompileTime)(__client_app_impl_js._StackClientAppImplIncomplete),
+		_StackServerAppImpl: (0, _stackframe_stack_shared_dist_utils_compile_time.scrambleDuringCompileTime)(__server_app_impl_js._StackServerAppImplIncomplete)
+	};
+}
+const { _StackAdminAppImpl, _StackClientAppImpl, _StackServerAppImpl } = complete();
+
+//#endregion
+exports._StackAdminAppImpl = _StackAdminAppImpl;
+exports._StackClientAppImpl = _StackClientAppImpl;
+exports._StackServerAppImpl = _StackServerAppImpl;
+//# sourceMappingURL=index.js.map

package/dist/lib/stack-app/apps/implementations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["_StackAdminAppImplIncomplete","_StackClientAppImplIncomplete","_StackServerAppImplIncomplete"],"sources":["../../../../../src/lib/stack-app/apps/implementations/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n\nimport { scrambleDuringCompileTime } from \"@stackframe/stack-shared/dist/utils/compile-time\";\nimport { _StackAdminAppImplIncomplete } from \"./admin-app-impl\";\nimport { _StackClientAppImplIncomplete } from \"./client-app-impl\";\nimport { _StackServerAppImplIncomplete } from \"./server-app-impl\";\n\n\n/**\n * Prevents a circular dependency between the client and admin apps. For more information, see the documentation comment\n * of `_StackClientAppImplIncomplete.LazyStackAdminAppImpl`.\n *\n * Note: This is an explicitly defined function that returns the new values (and not a barrel file with top-level side\n * effects) because we have `sideEffects: false` in the package.json, and so it would be tree-shaken away if we just\n * exported the values directly.\n */\nfunction complete() {\n  _StackClientAppImplIncomplete.LazyStackAdminAppImpl.value = _StackAdminAppImplIncomplete;\n\n  return {\n    _StackAdminAppImpl: scrambleDuringCompileTime(_StackAdminAppImplIncomplete),\n    _StackClientAppImpl: scrambleDuringCompileTime(_StackClientAppImplIncomplete),\n    _StackServerAppImpl: scrambleDuringCompileTime(_StackServerAppImplIncomplete),\n  };\n}\n\nexport const {\n  _StackAdminAppImpl,\n  _StackClientAppImpl,\n  _StackServerAppImpl\n} = complete();\n\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,SAAS,WAAW;AAClB,oDAA8B,sBAAsB,QAAQA;AAE5D,QAAO;EACL,oGAA8CA,iDAA6B;EAC3E,qGAA+CC,mDAA8B;EAC7E,qGAA+CC,mDAA8B;EAC9E;;AAGH,MAAa,EACX,oBACA,qBACA,wBACE,UAAU"}

package/dist/lib/stack-app/apps/implementations/redirect-page-urls.d.ts

@@ -0,0 +1,35 @@
+import { HandlerUrls } from "../../common.js";
+
+//#region src/lib/stack-app/apps/implementations/redirect-page-urls.d.ts
+declare const crossDomainAuthQueryParams: {
+  readonly marker: "hexclave_cross_domain_auth";
+  readonly state: "hexclave_cross_domain_state";
+  readonly codeChallenge: "hexclave_cross_domain_code_challenge";
+  readonly afterCallbackRedirectUrl: "hexclave_cross_domain_after_callback_redirect_url";
+};
+type CrossDomainHandoffParams = {
+  state: string;
+  codeChallenge: string;
+};
+declare function getCrossDomainHandoffParamsFromCurrentUrl(currentUrl: URL): CrossDomainHandoffParams | null;
+type RedirectToHandlerPlan = {
+  type: "redirect";
+  url: string;
+} | {
+  type: "cross-domain-authorize";
+  redirectUri: string;
+  state: string;
+  codeChallenge: string;
+  afterCallbackRedirectUrl: string;
+};
+declare function planRedirectToHandler(options: {
+  handlerName: keyof HandlerUrls;
+  rawHandlerUrl: string;
+  noRedirectBack: boolean;
+  currentUrl: URL | null;
+  localOAuthCallbackUrl: string;
+  getCrossDomainHandoffParams: (currentUrl: URL) => Promise<CrossDomainHandoffParams>;
+}): Promise<RedirectToHandlerPlan>;
+//#endregion
+export { CrossDomainHandoffParams, crossDomainAuthQueryParams, getCrossDomainHandoffParamsFromCurrentUrl, planRedirectToHandler };
+//# sourceMappingURL=redirect-page-urls.d.ts.map

package/dist/lib/stack-app/apps/implementations/redirect-page-urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-page-urls.d.ts","names":[],"sources":["../../../../../src/lib/stack-app/apps/implementations/redirect-page-urls.ts"],"mappings":";;;cAQa,0BAAA;EAAA;;;;;KAqBD,wBAAA;EACV,KAAA;EACA,aAAA;AAAA;AAAA,iBAGc,yCAAA,CAA0C,UAAA,EAAY,GAAA,GAAM,wBAAA;AAAA,KAkIvE,qBAAA;EACC,IAAA;EAAkB,GAAA;AAAA;EAEpB,IAAA;EACA,WAAA;EACA,KAAA;EACA,aAAA;EACA,wBAAA;AAAA;AAAA,iBAsCkB,qBAAA,CAAsB,OAAA;EAC1C,WAAA,QAAmB,WAAA;EACnB,aAAA;EACA,cAAA;EACA,UAAA,EAAY,GAAA;EACZ,qBAAA;EACA,2BAAA,GAA8B,UAAA,EAAY,GAAA,KAAQ,OAAA,CAAQ,wBAAA;AAAA,IACxD,OAAA,CAAQ,qBAAA"}

package/dist/lib/stack-app/apps/implementations/redirect-page-urls.js

@@ -0,0 +1,201 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../../../../chunk-BE-pF4vm.js');
+let _stackframe_stack_shared_dist_utils_urls = require("@hexclave/shared/dist/utils/urls");
+let _stackframe_stack_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
+
+//#region src/lib/stack-app/apps/implementations/redirect-page-urls.ts
+const crossDomainAuthQueryParams = {
+	marker: "hexclave_cross_domain_auth",
+	state: "hexclave_cross_domain_state",
+	codeChallenge: "hexclave_cross_domain_code_challenge",
+	afterCallbackRedirectUrl: "hexclave_cross_domain_after_callback_redirect_url"
+};
+function getCrossDomainParam(params, key) {
+	return params.get(crossDomainAuthQueryParams[key]);
+}
+function hasCrossDomainParam(params, key) {
+	return params.has(crossDomainAuthQueryParams[key]);
+}
+function setCrossDomainParam(params, key, value) {
+	params.set(crossDomainAuthQueryParams[key], value);
+}
+function getCrossDomainHandoffParamsFromCurrentUrl(currentUrl) {
+	const state = getCrossDomainParam(currentUrl.searchParams, "state");
+	const codeChallenge = getCrossDomainParam(currentUrl.searchParams, "codeChallenge");
+	if (state == null || codeChallenge == null) return null;
+	return {
+		state,
+		codeChallenge
+	};
+}
+function isRedirectBackAwareHandlerName(handlerName) {
+	return handlerName === "signIn" || handlerName === "signUp" || handlerName === "onboarding" || handlerName === "signOut";
+}
+function hasCrossDomainHandoffParams(url) {
+	return hasCrossDomainParam(url.searchParams, "state") && hasCrossDomainParam(url.searchParams, "codeChallenge") && hasCrossDomainParam(url.searchParams, "afterCallbackRedirectUrl");
+}
+function buildCrossDomainAuthCallbackUrl(options) {
+	const localOAuthCallbackUrl = new URL(options.localOAuthCallbackUrl, options.currentUrl);
+	if (localOAuthCallbackUrl.origin !== options.currentUrl.origin) throw new _stackframe_stack_shared_dist_utils_errors.HexclaveAssertionError("Cross-domain auth callback URL must stay on the current origin", {
+		localOAuthCallbackUrl: localOAuthCallbackUrl.toString(),
+		currentUrl: options.currentUrl.toString()
+	});
+	setCrossDomainParam(localOAuthCallbackUrl.searchParams, "marker", "1");
+	if (options.state != null) setCrossDomainParam(localOAuthCallbackUrl.searchParams, "state", options.state);
+	if (options.codeChallenge != null) setCrossDomainParam(localOAuthCallbackUrl.searchParams, "codeChallenge", options.codeChallenge);
+	if (options.afterCallbackRedirectUrl != null) setCrossDomainParam(localOAuthCallbackUrl.searchParams, "afterCallbackRedirectUrl", options.afterCallbackRedirectUrl);
+	return localOAuthCallbackUrl;
+}
+function buildRedirectBackAwareHandlerUrl(options) {
+	const nextUrl = new URL(options.rawHandlerUrl, options.currentUrl);
+	const currentAfterAuthReturnTo = options.currentUrl.searchParams.get("after_auth_return_to");
+	if (currentAfterAuthReturnTo != null && !nextUrl.searchParams.has("after_auth_return_to")) nextUrl.searchParams.set("after_auth_return_to", currentAfterAuthReturnTo);
+	for (const preservedParam of [
+		"state",
+		"codeChallenge",
+		"afterCallbackRedirectUrl"
+	]) {
+		const currentValue = getCrossDomainParam(options.currentUrl.searchParams, preservedParam);
+		if (currentValue != null && !hasCrossDomainParam(nextUrl.searchParams, preservedParam)) setCrossDomainParam(nextUrl.searchParams, preservedParam, currentValue);
+	}
+	if (options.handlerName === "signOut") {
+		if (!nextUrl.searchParams.has("after_auth_return_to")) if (options.currentUrl.protocol === nextUrl.protocol && options.currentUrl.host === nextUrl.host) nextUrl.searchParams.set("after_auth_return_to", (0, _stackframe_stack_shared_dist_utils_urls.getRelativePart)(options.currentUrl));
+		else nextUrl.searchParams.set("after_auth_return_to", options.currentUrl.toString());
+		return nextUrl.origin === options.currentUrl.origin ? (0, _stackframe_stack_shared_dist_utils_urls.getRelativePart)(nextUrl) : nextUrl.toString();
+	}
+	if (options.currentUrl.origin !== nextUrl.origin) {
+		if (!hasCrossDomainHandoffParams(nextUrl)) {
+			const inheritedAfterAuthReturnTo = options.currentUrl.searchParams.get("after_auth_return_to");
+			const afterCallbackRedirectUrl = inheritedAfterAuthReturnTo ? new URL(inheritedAfterAuthReturnTo, options.currentUrl).toString() : options.currentUrl.toString();
+			const callbackUrl = buildCrossDomainAuthCallbackUrl({
+				currentUrl: options.currentUrl,
+				localOAuthCallbackUrl: options.localOAuthCallbackUrl,
+				state: options.crossDomainHandoffParams?.state,
+				codeChallenge: options.crossDomainHandoffParams?.codeChallenge,
+				afterCallbackRedirectUrl
+			});
+			nextUrl.searchParams.set("after_auth_return_to", callbackUrl.toString());
+			setCrossDomainParam(nextUrl.searchParams, "afterCallbackRedirectUrl", afterCallbackRedirectUrl);
+			if (options.crossDomainHandoffParams != null) {
+				setCrossDomainParam(nextUrl.searchParams, "state", options.crossDomainHandoffParams.state);
+				setCrossDomainParam(nextUrl.searchParams, "codeChallenge", options.crossDomainHandoffParams.codeChallenge);
+			}
+		}
+	} else if (options.currentUrl.protocol === nextUrl.protocol && options.currentUrl.host === nextUrl.host && !nextUrl.searchParams.has("after_auth_return_to")) nextUrl.searchParams.set("after_auth_return_to", (0, _stackframe_stack_shared_dist_utils_urls.getRelativePart)(options.currentUrl));
+	return nextUrl.origin === options.currentUrl.origin ? (0, _stackframe_stack_shared_dist_utils_urls.getRelativePart)(nextUrl) : nextUrl.toString();
+}
+function getHandlerRedirectPolicy(handlerName) {
+	if (handlerName === "afterSignIn" || handlerName === "afterSignUp") return "after-auth-return";
+	if (isRedirectBackAwareHandlerName(handlerName)) return "redirect-back-aware";
+	return "none";
+}
+async function resolveRedirectBackAwareHandlerUrlForRedirect(options) {
+	const initial = buildRedirectBackAwareHandlerUrl({
+		handlerName: options.handlerName,
+		rawHandlerUrl: options.rawHandlerUrl,
+		currentUrl: options.currentUrl,
+		crossDomainHandoffParams: null,
+		localOAuthCallbackUrl: options.localOAuthCallbackUrl
+	});
+	if (options.handlerName === "signOut") return initial;
+	const initialTarget = new URL(initial, options.currentUrl);
+	if (!(options.currentUrl.origin !== initialTarget.origin) || hasCrossDomainHandoffParams(initialTarget)) return initial;
+	const crossDomainHandoffParams = await options.getCrossDomainHandoffParams(options.currentUrl);
+	return buildRedirectBackAwareHandlerUrl({
+		handlerName: options.handlerName,
+		rawHandlerUrl: options.rawHandlerUrl,
+		currentUrl: options.currentUrl,
+		crossDomainHandoffParams,
+		localOAuthCallbackUrl: options.localOAuthCallbackUrl
+	});
+}
+async function planRedirectToHandler(options) {
+	if (options.noRedirectBack || options.currentUrl == null) return {
+		type: "redirect",
+		url: options.rawHandlerUrl
+	};
+	const policy = getHandlerRedirectPolicy(options.handlerName);
+	if (policy === "none") return {
+		type: "redirect",
+		url: options.rawHandlerUrl
+	};
+	if (policy === "after-auth-return") {
+		const redirectBackUrl = options.currentUrl.searchParams.get("after_auth_return_to");
+		if (redirectBackUrl == null) return {
+			type: "redirect",
+			url: options.rawHandlerUrl
+		};
+		const redirectBackTarget = new URL(redirectBackUrl, options.currentUrl);
+		const crossDomainHandoff = getCrossDomainHandoffForRedirect({
+			currentUrl: options.currentUrl,
+			redirectBackTarget
+		});
+		if (crossDomainHandoff == null) return {
+			type: "redirect",
+			url: redirectBackUrl
+		};
+		let state = crossDomainHandoff.handoffParams.state;
+		let codeChallenge = crossDomainHandoff.handoffParams.codeChallenge;
+		let afterCallbackRedirectUrl = crossDomainHandoff.handoffParams.afterCallbackRedirectUrl;
+		if (state == null || codeChallenge == null) {
+			const generatedHandoffParams = await options.getCrossDomainHandoffParams(options.currentUrl);
+			state ??= generatedHandoffParams.state;
+			codeChallenge ??= generatedHandoffParams.codeChallenge;
+		}
+		afterCallbackRedirectUrl ??= options.currentUrl.toString();
+		return {
+			type: "cross-domain-authorize",
+			redirectUri: crossDomainHandoff.redirectBackTarget.toString(),
+			state,
+			codeChallenge,
+			afterCallbackRedirectUrl
+		};
+	}
+	if (options.handlerName !== "signIn" && options.handlerName !== "signUp" && options.handlerName !== "onboarding" && options.handlerName !== "signOut") throw new _stackframe_stack_shared_dist_utils_errors.HexclaveAssertionError("Unexpected redirect-back-aware handler policy mismatch", {
+		handlerName: options.handlerName,
+		policy
+	});
+	return {
+		type: "redirect",
+		url: await resolveRedirectBackAwareHandlerUrlForRedirect({
+			handlerName: options.handlerName,
+			rawHandlerUrl: options.rawHandlerUrl,
+			currentUrl: options.currentUrl,
+			localOAuthCallbackUrl: options.localOAuthCallbackUrl,
+			getCrossDomainHandoffParams: options.getCrossDomainHandoffParams
+		})
+	};
+}
+function readCrossDomainHandoffParams(currentUrl, redirectBackTarget) {
+	return {
+		state: getCrossDomainParam(currentUrl.searchParams, "state") ?? getCrossDomainParam(redirectBackTarget.searchParams, "state"),
+		codeChallenge: getCrossDomainParam(currentUrl.searchParams, "codeChallenge") ?? getCrossDomainParam(redirectBackTarget.searchParams, "codeChallenge"),
+		afterCallbackRedirectUrl: getCrossDomainParam(currentUrl.searchParams, "afterCallbackRedirectUrl") ?? getCrossDomainParam(redirectBackTarget.searchParams, "afterCallbackRedirectUrl")
+	};
+}
+function resolveCrossDomainRedirectBackTarget(options) {
+	if (options.redirectBackTarget.origin !== options.currentUrl.origin) return options.redirectBackTarget;
+	if (options.handoffParams.state == null || options.handoffParams.codeChallenge == null || options.handoffParams.afterCallbackRedirectUrl == null) return null;
+	const afterCallbackRedirectTarget = new URL(options.handoffParams.afterCallbackRedirectUrl, options.currentUrl);
+	if (afterCallbackRedirectTarget.origin === options.currentUrl.origin) return null;
+	return new URL(`${options.redirectBackTarget.pathname}${options.redirectBackTarget.search}${options.redirectBackTarget.hash}`, afterCallbackRedirectTarget.origin);
+}
+function getCrossDomainHandoffForRedirect(options) {
+	const handoffParams = readCrossDomainHandoffParams(options.currentUrl, options.redirectBackTarget);
+	const crossDomainRedirectBackTarget = resolveCrossDomainRedirectBackTarget({
+		currentUrl: options.currentUrl,
+		redirectBackTarget: options.redirectBackTarget,
+		handoffParams
+	});
+	if (crossDomainRedirectBackTarget == null) return null;
+	return {
+		redirectBackTarget: crossDomainRedirectBackTarget,
+		handoffParams
+	};
+}
+
+//#endregion
+exports.crossDomainAuthQueryParams = crossDomainAuthQueryParams;
+exports.getCrossDomainHandoffParamsFromCurrentUrl = getCrossDomainHandoffParamsFromCurrentUrl;
+exports.planRedirectToHandler = planRedirectToHandler;
+//# sourceMappingURL=redirect-page-urls.js.map

package/dist/lib/stack-app/apps/implementations/redirect-page-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-page-urls.js","names":["HexclaveAssertionError"],"sources":["../../../../../src/lib/stack-app/apps/implementations/redirect-page-urls.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { HexclaveAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { getRelativePart } from \"@stackframe/stack-shared/dist/utils/urls\";\nimport { HandlerUrls } from \"../../common\";\n\nexport const crossDomainAuthQueryParams = {\n  marker: \"hexclave_cross_domain_auth\",\n  state: \"hexclave_cross_domain_state\",\n  codeChallenge: \"hexclave_cross_domain_code_challenge\",\n  afterCallbackRedirectUrl: \"hexclave_cross_domain_after_callback_redirect_url\",\n} as const;\n\ntype CrossDomainAuthQueryParamKey = keyof typeof crossDomainAuthQueryParams;\n\nfunction getCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey): string | null {\n  return params.get(crossDomainAuthQueryParams[key]);\n}\n\nfunction hasCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey): boolean {\n  return params.has(crossDomainAuthQueryParams[key]);\n}\n\nfunction setCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey, value: string): void {\n  params.set(crossDomainAuthQueryParams[key], value);\n}\n\nexport type CrossDomainHandoffParams = {\n  state: string,\n  codeChallenge: string,\n};\n\nexport function getCrossDomainHandoffParamsFromCurrentUrl(currentUrl: URL): CrossDomainHandoffParams | null {\n  const state = getCrossDomainParam(currentUrl.searchParams, \"state\");\n  const codeChallenge = getCrossDomainParam(currentUrl.searchParams, \"codeChallenge\");\n  if (state == null || codeChallenge == null) {\n    return null;\n  }\n  return { state, codeChallenge };\n}\n\ntype RedirectBackAwareHandlerName = \"signIn\" | \"signUp\" | \"onboarding\" | \"signOut\";\ntype HandlerRedirectPolicy = \"none\" | \"redirect-back-aware\" | \"after-auth-return\";\n\ntype CrossDomainHandoffParamsMaybeMissing = {\n  state: string | null,\n  codeChallenge: string | null,\n  afterCallbackRedirectUrl: string | null,\n};\n\nfunction isRedirectBackAwareHandlerName(handlerName: keyof HandlerUrls): handlerName is RedirectBackAwareHandlerName {\n  return handlerName === \"signIn\"\n    || handlerName === \"signUp\"\n    || handlerName === \"onboarding\"\n    || handlerName === \"signOut\";\n}\n\nfunction hasCrossDomainHandoffParams(url: URL): boolean {\n  return (\n    hasCrossDomainParam(url.searchParams, \"state\")\n    && hasCrossDomainParam(url.searchParams, \"codeChallenge\")\n    && hasCrossDomainParam(url.searchParams, \"afterCallbackRedirectUrl\")\n  );\n}\n\nfunction buildCrossDomainAuthCallbackUrl(options: {\n  currentUrl: URL,\n  localOAuthCallbackUrl: string,\n  state?: string,\n  codeChallenge?: string,\n  afterCallbackRedirectUrl?: string,\n}): URL {\n  const localOAuthCallbackUrl = new URL(options.localOAuthCallbackUrl, options.currentUrl);\n  if (localOAuthCallbackUrl.origin !== options.currentUrl.origin) {\n    throw new HexclaveAssertionError(\"Cross-domain auth callback URL must stay on the current origin\", {\n      localOAuthCallbackUrl: localOAuthCallbackUrl.toString(),\n      currentUrl: options.currentUrl.toString(),\n    });\n  }\n  setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"marker\", \"1\");\n  if (options.state != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"state\", options.state);\n  }\n  if (options.codeChallenge != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"codeChallenge\", options.codeChallenge);\n  }\n  if (options.afterCallbackRedirectUrl != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"afterCallbackRedirectUrl\", options.afterCallbackRedirectUrl);\n  }\n  return localOAuthCallbackUrl;\n}\n\nfunction buildRedirectBackAwareHandlerUrl(options: {\n  handlerName: RedirectBackAwareHandlerName,\n  rawHandlerUrl: string,\n  currentUrl: URL,\n  crossDomainHandoffParams: CrossDomainHandoffParams | null,\n  localOAuthCallbackUrl: string,\n}): string {\n  const nextUrl = new URL(options.rawHandlerUrl, options.currentUrl);\n  // Preserve after_auth_return_to verbatim (not a rebranded param).\n  const currentAfterAuthReturnTo = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n  if (currentAfterAuthReturnTo != null && !nextUrl.searchParams.has(\"after_auth_return_to\")) {\n    nextUrl.searchParams.set(\"after_auth_return_to\", currentAfterAuthReturnTo);\n  }\n  for (const preservedParam of [\"state\", \"codeChallenge\", \"afterCallbackRedirectUrl\"] as const) {\n    const currentValue = getCrossDomainParam(options.currentUrl.searchParams, preservedParam);\n    if (currentValue != null && !hasCrossDomainParam(nextUrl.searchParams, preservedParam)) {\n      setCrossDomainParam(nextUrl.searchParams, preservedParam, currentValue);\n    }\n  }\n\n  if (options.handlerName === \"signOut\") {\n    if (!nextUrl.searchParams.has(\"after_auth_return_to\")) {\n      if (options.currentUrl.protocol === nextUrl.protocol && options.currentUrl.host === nextUrl.host) {\n        nextUrl.searchParams.set(\"after_auth_return_to\", getRelativePart(options.currentUrl));\n      } else {\n        nextUrl.searchParams.set(\"after_auth_return_to\", options.currentUrl.toString());\n      }\n    }\n    return nextUrl.origin === options.currentUrl.origin ? getRelativePart(nextUrl) : nextUrl.toString();\n  }\n\n  const isCrossDomainHandlerRedirect = options.currentUrl.origin !== nextUrl.origin;\n  if (isCrossDomainHandlerRedirect) {\n    if (!hasCrossDomainHandoffParams(nextUrl)) {\n      const inheritedAfterAuthReturnTo = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n      const afterCallbackRedirectUrl = inheritedAfterAuthReturnTo\n        ? new URL(inheritedAfterAuthReturnTo, options.currentUrl).toString()\n        : options.currentUrl.toString();\n      const callbackUrl = buildCrossDomainAuthCallbackUrl({\n        currentUrl: options.currentUrl,\n        localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n        state: options.crossDomainHandoffParams?.state,\n        codeChallenge: options.crossDomainHandoffParams?.codeChallenge,\n        afterCallbackRedirectUrl,\n      });\n\n      nextUrl.searchParams.set(\"after_auth_return_to\", callbackUrl.toString());\n      setCrossDomainParam(nextUrl.searchParams, \"afterCallbackRedirectUrl\", afterCallbackRedirectUrl);\n      if (options.crossDomainHandoffParams != null) {\n        setCrossDomainParam(nextUrl.searchParams, \"state\", options.crossDomainHandoffParams.state);\n        setCrossDomainParam(nextUrl.searchParams, \"codeChallenge\", options.crossDomainHandoffParams.codeChallenge);\n      }\n    }\n  } else if (options.currentUrl.protocol === nextUrl.protocol && options.currentUrl.host === nextUrl.host && !nextUrl.searchParams.has(\"after_auth_return_to\")) {\n    nextUrl.searchParams.set(\"after_auth_return_to\", getRelativePart(options.currentUrl));\n  }\n\n  return nextUrl.origin === options.currentUrl.origin ? getRelativePart(nextUrl) : nextUrl.toString();\n}\n\nfunction getHandlerRedirectPolicy(handlerName: keyof HandlerUrls): HandlerRedirectPolicy {\n  if (handlerName === \"afterSignIn\" || handlerName === \"afterSignUp\") {\n    return \"after-auth-return\";\n  }\n  if (isRedirectBackAwareHandlerName(handlerName)) {\n    return \"redirect-back-aware\";\n  }\n  return \"none\";\n}\n\ntype RedirectToHandlerPlan =\n  | { type: \"redirect\", url: string }\n  | {\n    type: \"cross-domain-authorize\",\n    redirectUri: string,\n    state: string,\n    codeChallenge: string,\n    afterCallbackRedirectUrl: string,\n  };\n\n\nasync function resolveRedirectBackAwareHandlerUrlForRedirect(options: {\n  handlerName: RedirectBackAwareHandlerName,\n  rawHandlerUrl: string,\n  currentUrl: URL,\n  localOAuthCallbackUrl: string,\n  getCrossDomainHandoffParams: (currentUrl: URL) => Promise<CrossDomainHandoffParams>,\n}): Promise<string> {\n  const initial = buildRedirectBackAwareHandlerUrl({\n    handlerName: options.handlerName,\n    rawHandlerUrl: options.rawHandlerUrl,\n    currentUrl: options.currentUrl,\n    crossDomainHandoffParams: null,\n    localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n  });\n  if (options.handlerName === \"signOut\") {\n    return initial;\n  }\n\n  const initialTarget = new URL(initial, options.currentUrl);\n  const isCrossDomainHandlerRedirect = options.currentUrl.origin !== initialTarget.origin;\n  if (!isCrossDomainHandlerRedirect || hasCrossDomainHandoffParams(initialTarget)) {\n    return initial;\n  }\n\n  const crossDomainHandoffParams = await options.getCrossDomainHandoffParams(options.currentUrl);\n  return buildRedirectBackAwareHandlerUrl({\n    handlerName: options.handlerName,\n    rawHandlerUrl: options.rawHandlerUrl,\n    currentUrl: options.currentUrl,\n    crossDomainHandoffParams,\n    localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n  });\n}\n\nexport async function planRedirectToHandler(options: {\n  handlerName: keyof HandlerUrls,\n  rawHandlerUrl: string,\n  noRedirectBack: boolean,\n  currentUrl: URL | null,\n  localOAuthCallbackUrl: string,\n  getCrossDomainHandoffParams: (currentUrl: URL) => Promise<CrossDomainHandoffParams>,\n}): Promise<RedirectToHandlerPlan> {\n  if (options.noRedirectBack || options.currentUrl == null) {\n    return { type: \"redirect\", url: options.rawHandlerUrl };\n  }\n\n  const policy = getHandlerRedirectPolicy(options.handlerName);\n  if (policy === \"none\") {\n    return { type: \"redirect\", url: options.rawHandlerUrl };\n  }\n\n  if (policy === \"after-auth-return\") {\n    const redirectBackUrl = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n    if (redirectBackUrl == null) {\n      return { type: \"redirect\", url: options.rawHandlerUrl };\n    }\n    const redirectBackTarget = new URL(redirectBackUrl, options.currentUrl);\n    const crossDomainHandoff = getCrossDomainHandoffForRedirect({\n      currentUrl: options.currentUrl,\n      redirectBackTarget,\n    });\n    if (crossDomainHandoff == null) {\n      return { type: \"redirect\", url: redirectBackUrl };\n    }\n    let state = crossDomainHandoff.handoffParams.state;\n    let codeChallenge = crossDomainHandoff.handoffParams.codeChallenge;\n    let afterCallbackRedirectUrl = crossDomainHandoff.handoffParams.afterCallbackRedirectUrl;\n    if (state == null || codeChallenge == null) {\n      const generatedHandoffParams = await options.getCrossDomainHandoffParams(options.currentUrl);\n      state ??= generatedHandoffParams.state;\n      codeChallenge ??= generatedHandoffParams.codeChallenge;\n    }\n    afterCallbackRedirectUrl ??= options.currentUrl.toString();\n    return {\n      type: \"cross-domain-authorize\",\n      redirectUri: crossDomainHandoff.redirectBackTarget.toString(),\n      state,\n      codeChallenge,\n      afterCallbackRedirectUrl,\n    };\n  }\n\n  if (\n    options.handlerName !== \"signIn\"\n    && options.handlerName !== \"signUp\"\n    && options.handlerName !== \"onboarding\"\n    && options.handlerName !== \"signOut\"\n  ) {\n    throw new HexclaveAssertionError(\"Unexpected redirect-back-aware handler policy mismatch\", {\n      handlerName: options.handlerName,\n      policy,\n    });\n  }\n\n  return {\n    type: \"redirect\",\n    url: await resolveRedirectBackAwareHandlerUrlForRedirect({\n      handlerName: options.handlerName,\n      rawHandlerUrl: options.rawHandlerUrl,\n      currentUrl: options.currentUrl,\n      localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n      getCrossDomainHandoffParams: options.getCrossDomainHandoffParams,\n    }),\n  };\n}\n\nfunction readCrossDomainHandoffParams(currentUrl: URL, redirectBackTarget: URL): CrossDomainHandoffParamsMaybeMissing {\n  // Hexclave rebrand: accept either param name from both URLs.\n  const state = getCrossDomainParam(currentUrl.searchParams, \"state\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"state\");\n  const codeChallenge = getCrossDomainParam(currentUrl.searchParams, \"codeChallenge\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"codeChallenge\");\n  const afterCallbackRedirectUrl = getCrossDomainParam(currentUrl.searchParams, \"afterCallbackRedirectUrl\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"afterCallbackRedirectUrl\");\n  return {\n    state,\n    codeChallenge,\n    afterCallbackRedirectUrl,\n  };\n}\n\nfunction resolveCrossDomainRedirectBackTarget(options: {\n  currentUrl: URL,\n  redirectBackTarget: URL,\n  handoffParams: CrossDomainHandoffParamsMaybeMissing,\n}): URL | null {\n  if (options.redirectBackTarget.origin !== options.currentUrl.origin) {\n    return options.redirectBackTarget;\n  }\n  if (\n    options.handoffParams.state == null\n    || options.handoffParams.codeChallenge == null\n    || options.handoffParams.afterCallbackRedirectUrl == null\n  ) {\n    return null;\n  }\n  const afterCallbackRedirectTarget = new URL(options.handoffParams.afterCallbackRedirectUrl, options.currentUrl);\n  if (afterCallbackRedirectTarget.origin === options.currentUrl.origin) {\n    return null;\n  }\n  return new URL(\n    `${options.redirectBackTarget.pathname}${options.redirectBackTarget.search}${options.redirectBackTarget.hash}`,\n    afterCallbackRedirectTarget.origin,\n  );\n}\n\nfunction getCrossDomainHandoffForRedirect(options: {\n  currentUrl: URL,\n  redirectBackTarget: URL,\n}): {\n  redirectBackTarget: URL,\n  handoffParams: CrossDomainHandoffParamsMaybeMissing,\n} | null {\n  const handoffParams = readCrossDomainHandoffParams(options.currentUrl, options.redirectBackTarget);\n  const crossDomainRedirectBackTarget = resolveCrossDomainRedirectBackTarget({\n    currentUrl: options.currentUrl,\n    redirectBackTarget: options.redirectBackTarget,\n    handoffParams,\n  });\n  if (crossDomainRedirectBackTarget == null) {\n    return null;\n  }\n  return {\n    redirectBackTarget: crossDomainRedirectBackTarget,\n    handoffParams,\n  };\n}\n"],"mappings":";;;;;;AAQA,MAAa,6BAA6B;CACxC,QAAQ;CACR,OAAO;CACP,eAAe;CACf,0BAA0B;CAC3B;AAID,SAAS,oBAAoB,QAAyB,KAAkD;AACtG,QAAO,OAAO,IAAI,2BAA2B,KAAK;;AAGpD,SAAS,oBAAoB,QAAyB,KAA4C;AAChG,QAAO,OAAO,IAAI,2BAA2B,KAAK;;AAGpD,SAAS,oBAAoB,QAAyB,KAAmC,OAAqB;AAC5G,QAAO,IAAI,2BAA2B,MAAM,MAAM;;AAQpD,SAAgB,0CAA0C,YAAkD;CAC1G,MAAM,QAAQ,oBAAoB,WAAW,cAAc,QAAQ;CACnE,MAAM,gBAAgB,oBAAoB,WAAW,cAAc,gBAAgB;AACnF,KAAI,SAAS,QAAQ,iBAAiB,KACpC,QAAO;AAET,QAAO;EAAE;EAAO;EAAe;;AAYjC,SAAS,+BAA+B,aAA6E;AACnH,QAAO,gBAAgB,YAClB,gBAAgB,YAChB,gBAAgB,gBAChB,gBAAgB;;AAGvB,SAAS,4BAA4B,KAAmB;AACtD,QACE,oBAAoB,IAAI,cAAc,QAAQ,IAC3C,oBAAoB,IAAI,cAAc,gBAAgB,IACtD,oBAAoB,IAAI,cAAc,2BAA2B;;AAIxE,SAAS,gCAAgC,SAMjC;CACN,MAAM,wBAAwB,IAAI,IAAI,QAAQ,uBAAuB,QAAQ,WAAW;AACxF,KAAI,sBAAsB,WAAW,QAAQ,WAAW,OACtD,OAAM,IAAIA,kEAAuB,kEAAkE;EACjG,uBAAuB,sBAAsB,UAAU;EACvD,YAAY,QAAQ,WAAW,UAAU;EAC1C,CAAC;AAEJ,qBAAoB,sBAAsB,cAAc,UAAU,IAAI;AACtE,KAAI,QAAQ,SAAS,KACnB,qBAAoB,sBAAsB,cAAc,SAAS,QAAQ,MAAM;AAEjF,KAAI,QAAQ,iBAAiB,KAC3B,qBAAoB,sBAAsB,cAAc,iBAAiB,QAAQ,cAAc;AAEjG,KAAI,QAAQ,4BAA4B,KACtC,qBAAoB,sBAAsB,cAAc,4BAA4B,QAAQ,yBAAyB;AAEvH,QAAO;;AAGT,SAAS,iCAAiC,SAM/B;CACT,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,QAAQ,WAAW;CAElE,MAAM,2BAA2B,QAAQ,WAAW,aAAa,IAAI,uBAAuB;AAC5F,KAAI,4BAA4B,QAAQ,CAAC,QAAQ,aAAa,IAAI,uBAAuB,CACvF,SAAQ,aAAa,IAAI,wBAAwB,yBAAyB;AAE5E,MAAK,MAAM,kBAAkB;EAAC;EAAS;EAAiB;EAA2B,EAAW;EAC5F,MAAM,eAAe,oBAAoB,QAAQ,WAAW,cAAc,eAAe;AACzF,MAAI,gBAAgB,QAAQ,CAAC,oBAAoB,QAAQ,cAAc,eAAe,CACpF,qBAAoB,QAAQ,cAAc,gBAAgB,aAAa;;AAI3E,KAAI,QAAQ,gBAAgB,WAAW;AACrC,MAAI,CAAC,QAAQ,aAAa,IAAI,uBAAuB,CACnD,KAAI,QAAQ,WAAW,aAAa,QAAQ,YAAY,QAAQ,WAAW,SAAS,QAAQ,KAC1F,SAAQ,aAAa,IAAI,sFAAwC,QAAQ,WAAW,CAAC;MAErF,SAAQ,aAAa,IAAI,wBAAwB,QAAQ,WAAW,UAAU,CAAC;AAGnF,SAAO,QAAQ,WAAW,QAAQ,WAAW,uEAAyB,QAAQ,GAAG,QAAQ,UAAU;;AAIrG,KADqC,QAAQ,WAAW,WAAW,QAAQ,QAEzE;MAAI,CAAC,4BAA4B,QAAQ,EAAE;GACzC,MAAM,6BAA6B,QAAQ,WAAW,aAAa,IAAI,uBAAuB;GAC9F,MAAM,2BAA2B,6BAC7B,IAAI,IAAI,4BAA4B,QAAQ,WAAW,CAAC,UAAU,GAClE,QAAQ,WAAW,UAAU;GACjC,MAAM,cAAc,gCAAgC;IAClD,YAAY,QAAQ;IACpB,uBAAuB,QAAQ;IAC/B,OAAO,QAAQ,0BAA0B;IACzC,eAAe,QAAQ,0BAA0B;IACjD;IACD,CAAC;AAEF,WAAQ,aAAa,IAAI,wBAAwB,YAAY,UAAU,CAAC;AACxE,uBAAoB,QAAQ,cAAc,4BAA4B,yBAAyB;AAC/F,OAAI,QAAQ,4BAA4B,MAAM;AAC5C,wBAAoB,QAAQ,cAAc,SAAS,QAAQ,yBAAyB,MAAM;AAC1F,wBAAoB,QAAQ,cAAc,iBAAiB,QAAQ,yBAAyB,cAAc;;;YAGrG,QAAQ,WAAW,aAAa,QAAQ,YAAY,QAAQ,WAAW,SAAS,QAAQ,QAAQ,CAAC,QAAQ,aAAa,IAAI,uBAAuB,CAC1J,SAAQ,aAAa,IAAI,sFAAwC,QAAQ,WAAW,CAAC;AAGvF,QAAO,QAAQ,WAAW,QAAQ,WAAW,uEAAyB,QAAQ,GAAG,QAAQ,UAAU;;AAGrG,SAAS,yBAAyB,aAAuD;AACvF,KAAI,gBAAgB,iBAAiB,gBAAgB,cACnD,QAAO;AAET,KAAI,+BAA+B,YAAY,CAC7C,QAAO;AAET,QAAO;;AAcT,eAAe,8CAA8C,SAMzC;CAClB,MAAM,UAAU,iCAAiC;EAC/C,aAAa,QAAQ;EACrB,eAAe,QAAQ;EACvB,YAAY,QAAQ;EACpB,0BAA0B;EAC1B,uBAAuB,QAAQ;EAChC,CAAC;AACF,KAAI,QAAQ,gBAAgB,UAC1B,QAAO;CAGT,MAAM,gBAAgB,IAAI,IAAI,SAAS,QAAQ,WAAW;AAE1D,KAAI,EADiC,QAAQ,WAAW,WAAW,cAAc,WAC5C,4BAA4B,cAAc,CAC7E,QAAO;CAGT,MAAM,2BAA2B,MAAM,QAAQ,4BAA4B,QAAQ,WAAW;AAC9F,QAAO,iCAAiC;EACtC,aAAa,QAAQ;EACrB,eAAe,QAAQ;EACvB,YAAY,QAAQ;EACpB;EACA,uBAAuB,QAAQ;EAChC,CAAC;;AAGJ,eAAsB,sBAAsB,SAOT;AACjC,KAAI,QAAQ,kBAAkB,QAAQ,cAAc,KAClD,QAAO;EAAE,MAAM;EAAY,KAAK,QAAQ;EAAe;CAGzD,MAAM,SAAS,yBAAyB,QAAQ,YAAY;AAC5D,KAAI,WAAW,OACb,QAAO;EAAE,MAAM;EAAY,KAAK,QAAQ;EAAe;AAGzD,KAAI,WAAW,qBAAqB;EAClC,MAAM,kBAAkB,QAAQ,WAAW,aAAa,IAAI,uBAAuB;AACnF,MAAI,mBAAmB,KACrB,QAAO;GAAE,MAAM;GAAY,KAAK,QAAQ;GAAe;EAEzD,MAAM,qBAAqB,IAAI,IAAI,iBAAiB,QAAQ,WAAW;EACvE,MAAM,qBAAqB,iCAAiC;GAC1D,YAAY,QAAQ;GACpB;GACD,CAAC;AACF,MAAI,sBAAsB,KACxB,QAAO;GAAE,MAAM;GAAY,KAAK;GAAiB;EAEnD,IAAI,QAAQ,mBAAmB,cAAc;EAC7C,IAAI,gBAAgB,mBAAmB,cAAc;EACrD,IAAI,2BAA2B,mBAAmB,cAAc;AAChE,MAAI,SAAS,QAAQ,iBAAiB,MAAM;GAC1C,MAAM,yBAAyB,MAAM,QAAQ,4BAA4B,QAAQ,WAAW;AAC5F,aAAU,uBAAuB;AACjC,qBAAkB,uBAAuB;;AAE3C,+BAA6B,QAAQ,WAAW,UAAU;AAC1D,SAAO;GACL,MAAM;GACN,aAAa,mBAAmB,mBAAmB,UAAU;GAC7D;GACA;GACA;GACD;;AAGH,KACE,QAAQ,gBAAgB,YACrB,QAAQ,gBAAgB,YACxB,QAAQ,gBAAgB,gBACxB,QAAQ,gBAAgB,UAE3B,OAAM,IAAIA,kEAAuB,0DAA0D;EACzF,aAAa,QAAQ;EACrB;EACD,CAAC;AAGJ,QAAO;EACL,MAAM;EACN,KAAK,MAAM,8CAA8C;GACvD,aAAa,QAAQ;GACrB,eAAe,QAAQ;GACvB,YAAY,QAAQ;GACpB,uBAAuB,QAAQ;GAC/B,6BAA6B,QAAQ;GACtC,CAAC;EACH;;AAGH,SAAS,6BAA6B,YAAiB,oBAA+D;AAQpH,QAAO;EACL,OAPY,oBAAoB,WAAW,cAAc,QAAQ,IAC9D,oBAAoB,mBAAmB,cAAc,QAAQ;EAOhE,eANoB,oBAAoB,WAAW,cAAc,gBAAgB,IAC9E,oBAAoB,mBAAmB,cAAc,gBAAgB;EAMxE,0BAL+B,oBAAoB,WAAW,cAAc,2BAA2B,IACpG,oBAAoB,mBAAmB,cAAc,2BAA2B;EAKpF;;AAGH,SAAS,qCAAqC,SAI/B;AACb,KAAI,QAAQ,mBAAmB,WAAW,QAAQ,WAAW,OAC3D,QAAO,QAAQ;AAEjB,KACE,QAAQ,cAAc,SAAS,QAC5B,QAAQ,cAAc,iBAAiB,QACvC,QAAQ,cAAc,4BAA4B,KAErD,QAAO;CAET,MAAM,8BAA8B,IAAI,IAAI,QAAQ,cAAc,0BAA0B,QAAQ,WAAW;AAC/G,KAAI,4BAA4B,WAAW,QAAQ,WAAW,OAC5D,QAAO;AAET,QAAO,IAAI,IACT,GAAG,QAAQ,mBAAmB,WAAW,QAAQ,mBAAmB,SAAS,QAAQ,mBAAmB,QACxG,4BAA4B,OAC7B;;AAGH,SAAS,iCAAiC,SAMjC;CACP,MAAM,gBAAgB,6BAA6B,QAAQ,YAAY,QAAQ,mBAAmB;CAClG,MAAM,gCAAgC,qCAAqC;EACzE,YAAY,QAAQ;EACpB,oBAAoB,QAAQ;EAC5B;EACD,CAAC;AACF,KAAI,iCAAiC,KACnC,QAAO;AAET,QAAO;EACL,oBAAoB;EACpB;EACD"}

package/dist/lib/stack-app/apps/implementations/server-app-impl.d.ts

@@ -0,0 +1,203 @@
+import { ConvexCtx, GetCurrentUserOptions } from "../../common.js";
+import { Customer, CustomerProductsList, CustomerProductsRequestOptions, InlineProduct, ServerItem } from "../../customers/index.js";
+import { EmailDeliveryInfo, SendEmailOptions } from "../../email/index.js";
+import { AdminProjectPermissionDefinition, AdminTeamPermission, AdminTeamPermissionDefinition } from "../../permissions/index.js";
+import { DataVaultStore } from "../../data-vault/index.js";
+import { ApiKey } from "../../api-keys/index.js";
+import { OAuthConnection } from "../../connected-accounts/index.js";
+import { ServerContactChannel } from "../../contact-channels/index.js";
+import { NotificationCategory } from "../../notification-categories/index.js";
+import { ProjectCurrentServerUser, ServerOAuthProvider, ServerUser, ServerUserCreateOptions } from "../../users/index.js";
+import { EditableTeamMemberProfile, ReceivedTeamInvitation, SentTeamInvitation, ServerListTeamsOptions, ServerListUsersOptions, ServerTeam, ServerTeamCreateOptions, ServerTeamUser } from "../../teams/index.js";
+import { StackServerAppConstructorOptions } from "../interfaces/server-app.js";
+import { _StackClientAppImplIncomplete } from "./client-app-impl.js";
+import { HexclaveServerInterface, KnownErrors } from "@hexclave/shared";
+import { Result } from "@hexclave/shared/dist/utils/results";
+import * as yup from "yup";
+import { InternalSession } from "@hexclave/shared/dist/sessions";
+import { ProjectPermissionDefinitionsCrud, ProjectPermissionsCrud } from "@hexclave/shared/dist/interface/crud/project-permissions";
+import { TeamPermissionDefinitionsCrud, TeamPermissionsCrud } from "@hexclave/shared/dist/interface/crud/team-permissions";
+import { TeamsCrud } from "@hexclave/shared/dist/interface/crud/teams";
+import { TeamApiKeysCrud, UserApiKeysCrud, teamApiKeysCreateOutputSchema, userApiKeysCreateOutputSchema } from "@hexclave/shared/dist/interface/crud/project-api-keys";
+import { UsersCrud } from "@hexclave/shared/dist/interface/crud/users";
+import { ContactChannelsCrud } from "@hexclave/shared/dist/interface/crud/contact-channels";
+import { ItemCrud } from "@hexclave/shared/dist/interface/crud/items";
+import { NotificationPreferenceCrud } from "@hexclave/shared/dist/interface/crud/notification-preferences";
+import { OAuthProviderCrud } from "@hexclave/shared/dist/interface/crud/oauth-providers";
+import { TeamInvitationCrud } from "@hexclave/shared/dist/interface/crud/team-invitation";
+import { TeamMemberProfilesCrud } from "@hexclave/shared/dist/interface/crud/team-member-profiles";
+
+//#region src/lib/stack-app/apps/implementations/server-app-impl.d.ts
+declare class _StackServerAppImplIncomplete<HasTokenStore extends boolean, ProjectId extends string> extends _StackClientAppImplIncomplete<HasTokenStore, ProjectId> {
+  protected _interface: HexclaveServerInterface;
+  private readonly _currentServerUserCache;
+  private readonly _serverUsersCache;
+  private readonly _serverUserCache;
+  private readonly _serverTeamsCache;
+  protected _refreshTeamMembership(teamId: string, userId: string): Promise<void>;
+  private readonly _serverUserTeamInvitationsCache;
+  private readonly _serverTeamUserPermissionsCache;
+  private readonly _serverAllTeamMemberPermissionsCache;
+  private readonly _serverUserProjectPermissionsCache;
+  /** @deprecated Used by legacy getConnectedAccount(providerId) — uses old per-provider access token endpoint */
+  private readonly _serverUserOAuthConnectionAccessTokensCache;
+  /** @deprecated Used by legacy getConnectedAccount(providerId) — combines token check + redirect */
+  private readonly _serverUserOAuthConnectionCache;
+  private readonly _serverUserConnectedAccountsCache;
+  private readonly _serverUserOAuthConnectionAccessTokensByAccountCache;
+  private readonly _serverTeamMemberProfilesCache;
+  private readonly _serverTeamInvitationsCache;
+  private readonly _serverUserTeamProfileCache;
+  private readonly _serverContactChannelsCache;
+  private readonly _serverNotificationCategoriesCache;
+  private readonly _serverDataVaultStoreValueCache;
+  private readonly _emailDeliveryInfoCache;
+  private readonly _serverUserApiKeysCache;
+  private readonly _serverTeamApiKeysCache;
+  private readonly _convexIdentitySubjectCache;
+  private readonly _serverCheckApiKeyCache;
+  private readonly _serverOAuthProvidersCache;
+  private readonly _serverTeamItemsCache;
+  private readonly _serverUserItemsCache;
+  private readonly _serverCustomItemsCache;
+  private readonly _serverUserProductsCache;
+  private readonly _serverTeamProductsCache;
+  private readonly _serverCustomProductsCache;
+  protected _createServerCustomer(userIdOrTeamId: string, type: "user" | "team"): Omit<Customer<true>, "id">;
+  private _updateServerUser;
+  protected _serverEditableTeamProfileFromCrud(crud: TeamMemberProfilesCrud['Client']['Read']): EditableTeamMemberProfile;
+  protected _serverContactChannelFromCrud(userId: string, crud: ContactChannelsCrud['Server']['Read']): ServerContactChannel;
+  protected _serverNotificationCategoryFromCrud(userId: string, crud: NotificationPreferenceCrud['Server']['Read']): NotificationCategory;
+  protected _serverOAuthProviderFromCrud(crud: OAuthProviderCrud['Server']['Read']): {
+    id: string;
+    type: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch";
+    userId: string;
+    accountId: string;
+    email: string | undefined;
+    allowSignIn: boolean;
+    allowConnectedAccounts: boolean;
+    update(data: {
+      accountId?: string;
+      email?: string;
+      allowSignIn?: boolean;
+      allowConnectedAccounts?: boolean;
+    }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
+    delete(): Promise<void>;
+  };
+  constructor(options: StackServerAppConstructorOptions<HasTokenStore, ProjectId>, extraOptions?: {
+    uniqueIdentifier?: string;
+    checkString?: string;
+    interface?: HexclaveServerInterface;
+  });
+  protected _serverApiKeyFromCrud(crud: TeamApiKeysCrud['Client']['Read']): ApiKey<"team">;
+  protected _serverApiKeyFromCrud(crud: UserApiKeysCrud['Client']['Read']): ApiKey<"user">;
+  protected _serverApiKeyFromCrud(crud: yup.InferType<typeof teamApiKeysCreateOutputSchema>): ApiKey<"team", true>;
+  protected _serverApiKeyFromCrud(crud: yup.InferType<typeof userApiKeysCreateOutputSchema>): ApiKey<"user", true>;
+  protected _createServerOAuthConnectionFromCrudItem(userId: string, item: {
+    provider: string;
+    provider_account_id: string;
+  }): OAuthConnection;
+  protected _serverUserFromCrud(crud: UsersCrud['Server']['Read']): ServerUser;
+  protected _serverTeamUserFromCrud(crud: TeamMemberProfilesCrud["Server"]["Read"]): ServerTeamUser;
+  protected _serverSentTeamInvitationFromCrud(crud: TeamInvitationCrud['Server']['Read']): SentTeamInvitation;
+  protected _serverReceivedTeamInvitationFromCrud(userId: string, crud: TeamInvitationCrud['Client']['Read']): ReceivedTeamInvitation;
+  protected _currentUserFromCrud(crud: UsersCrud['Server']['Read'], session: InternalSession): ProjectCurrentServerUser<ProjectId>;
+  protected _serverTeamFromCrud(crud: TeamsCrud['Server']['Read']): ServerTeam;
+  protected _serverItemFromCrud(customer: {
+    type: "user" | "team" | "custom";
+    id: string;
+  }, crud: ItemCrud['Client']['Read']): ServerItem;
+  protected _getUserApiKey(options: {
+    apiKey: string;
+  }): Promise<ApiKey<"user"> | null>;
+  protected _getTeamApiKey(options: {
+    apiKey: string;
+  }): Promise<ApiKey<"team"> | null>;
+  protected _getUserByApiKey(apiKey: string): Promise<ServerUser | null>;
+  protected _getUserByConvex(ctx: ConvexCtx, includeAnonymous: boolean): Promise<ServerUser | null>;
+  protected _getTeamByApiKey(apiKey: string): Promise<ServerTeam | null>;
+  createUser(options: ServerUserCreateOptions): Promise<ServerUser>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+  getUser(id: string): Promise<ServerUser | null>;
+  getUser(options: {
+    apiKey: string;
+  }): Promise<ServerUser | null>;
+  getUser(options: {
+    from: "convex";
+    ctx: ConvexCtx;
+    or?: "return-null" | "anonymous";
+  }): Promise<ServerUser | null>;
+  getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+  getServerUserById(userId: string): Promise<ServerUser | null>;
+  listUsers(options?: ServerListUsersOptions): Promise<ServerUser[] & {
+    nextCursor: string | null;
+  }>;
+  _serverPermissionFromCrud(crud: TeamPermissionsCrud['Server']['Read'] | ProjectPermissionsCrud['Server']['Read']): AdminTeamPermission;
+  _serverTeamPermissionDefinitionFromCrud(crud: TeamPermissionDefinitionsCrud['Admin']['Read']): AdminTeamPermissionDefinition;
+  _serverProjectPermissionDefinitionFromCrud(crud: ProjectPermissionDefinitionsCrud['Admin']['Read']): AdminProjectPermissionDefinition;
+  getItem(options: {
+    itemId: string;
+    userId: string;
+  } | {
+    itemId: string;
+    teamId: string;
+  } | {
+    itemId: string;
+    customCustomerId: string;
+  }): Promise<ServerItem>;
+  listProducts(options: CustomerProductsRequestOptions): Promise<CustomerProductsList>;
+  grantProduct(options: (({
+    userId: string;
+  } | {
+    teamId: string;
+  } | {
+    customCustomerId: string;
+  }) & ({
+    productId: string;
+  } | {
+    product: InlineProduct;
+  }) & {
+    quantity?: number;
+  })): Promise<void>;
+  createTeam(data: ServerTeamCreateOptions): Promise<ServerTeam>;
+  listTeams(options?: ServerListTeamsOptions): Promise<ServerTeam[] & {
+    nextCursor: string | null;
+  }>;
+  listTeamMemberPermissions(teamId: string, options?: {
+    recursive?: boolean;
+  }): Promise<{
+    userId: string;
+    permissionId: string;
+  }[]>;
+  getTeam(options: {
+    apiKey: string;
+  }): Promise<ServerTeam | null>;
+  getTeam(teamId: string): Promise<ServerTeam | null>;
+  protected _createServerDataVaultStore(id: string): DataVaultStore;
+  getDataVaultStore(id: string): Promise<DataVaultStore>;
+  sendEmail(options: SendEmailOptions): Promise<void>;
+  getEmailDeliveryStats(): Promise<EmailDeliveryInfo>;
+  activateEmailCapacityBoost(): Promise<void>;
+  protected _refreshSession(session: InternalSession): Promise<void>;
+  protected _refreshUsers(): Promise<void>;
+  createOAuthProvider(options: {
+    userId: string;
+    providerConfigId: string;
+    accountId: string;
+    email: string;
+    allowSignIn: boolean;
+    allowConnectedAccounts: boolean;
+  }): Promise<Result<ServerOAuthProvider, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
+}
+//#endregion
+export { _StackServerAppImplIncomplete };
+//# sourceMappingURL=server-app-impl.d.ts.map

package/dist/lib/stack-app/apps/implementations/server-app-impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-app-impl.d.ts","names":[],"sources":["../../../../../src/lib/stack-app/apps/implementations/server-app-impl.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2Ca,6BAAA,kEAA+F,6BAAA,CAA8B,aAAA,EAAe,SAAA;EAAA,UACrI,UAAA,EAAY,uBAAA;EAAA,iBAGb,uBAAA;EAAA,iBAOA,iBAAA;EAAA,iBAmBA,gBAAA;EAAA,iBAIA,iBAAA;EAAA,UAWD,sBAAA,CAAuB,MAAA,UAAgB,MAAA,WAAc,OAAA;EAAA,iBAOpD,+BAAA;EAAA,iBAGA,+BAAA;EAAA,iBAUA,oCAAA;EAAA,iBAMA,kCAAA;EAuNkC;EAAA,iBAhNlC,2CAAA;EAmO6C;EAAA,iBArN7C,+BAAA;EAAA,iBAYA,iCAAA;EAAA,iBAMA,oDAAA;EAAA,iBAaA,8BAAA;EAAA,iBAKA,2BAAA;EAAA,iBAKA,2BAAA;EAAA,iBAKA,2BAAA;EAAA,iBAKA,kCAAA;EAAA,iBAKA,+BAAA;EAAA,iBAIA,uBAAA;EAAA,iBAIA,uBAAA;EAAA,iBASA,uBAAA;EAAA,iBASA,2BAAA;EAAA,iBAOA,uBAAA;EAAA,iBAUA,0BAAA;EAAA,iBAMA,qBAAA;EAAA,iBAMA,qBAAA;EAAA,iBAMA,uBAAA;EAAA,iBAMA,wBAAA;EAAA,iBAWA,wBAAA;EAAA,iBAWA,0BAAA;EAAA,UAWP,qBAAA,CAAsB,cAAA,UAAwB,IAAA,oBAAwB,IAAA,CAAK,QAAA;EAAA,QAgCvE,iBAAA;EAAA,UAMJ,kCAAA,CAAmC,IAAA,EAAM,sBAAA,qBAA2C,yBAAA;EAAA,UAmBpF,6BAAA,CAA8B,MAAA,UAAgB,IAAA,EAAM,mBAAA,qBAAwC,oBAAA;EAAA,UA6B5F,mCAAA,CAAoC,MAAA,UAAgB,IAAA,EAAM,0BAAA,qBAA+C,oBAAA;EAAA,UAezG,4BAAA,CAA6B,IAAA,EAAM,iBAAA;;;;;;;;;MAWpB,SAAA;MAAoB,KAAA;MAAgB,WAAA;MAAuB,sBAAA;IAAA,IAAqC,OAAA,CAAQ,MAAA,OAC3H,YAAA,QAAoB,WAAA,CAAY,0CAAA;;;cAgC1B,OAAA,EAAS,gCAAA,CAAiC,aAAA,EAAe,SAAA,GAAY,YAAA;IAAiB,gBAAA;IAA2B,WAAA;IAAsB,SAAA,GAAY,uBAAA;EAAA;EAAA,UAuBrJ,qBAAA,CAAsB,IAAA,EAAM,eAAA,qBAAoC,MAAA;EAAA,UAChE,qBAAA,CAAsB,IAAA,EAAM,eAAA,qBAAoC,MAAA;EAAA,UAChE,qBAAA,CAAsB,IAAA,EAAM,GAAA,CAAI,SAAA,QAAiB,6BAAA,IAAiC,MAAA;EAAA,UAClF,qBAAA,CAAsB,IAAA,EAAM,GAAA,CAAI,SAAA,QAAiB,6BAAA,IAAiC,MAAA;EAAA,UAuBlF,wCAAA,CACR,MAAA,UACA,IAAA;IAAQ,QAAA;IAAkB,mBAAA;EAAA,IACzB,eAAA;EAAA,UAoBO,mBAAA,CAAoB,IAAA,EAAM,SAAA,qBAA8B,UAAA;EAAA,UA6TxD,uBAAA,CAAwB,IAAA,EAAM,sBAAA,qBAA2C,cAAA;EAAA,UAYzE,iCAAA,CAAkC,IAAA,EAAM,kBAAA,qBAAuC,kBAAA;EAAA,UAY/E,qCAAA,CAAsC,MAAA,UAAgB,IAAA,EAAM,kBAAA,qBAAuC,sBAAA;EAAA,UAmB1F,oBAAA,CAAqB,IAAA,EAAM,SAAA,oBAA6B,OAAA,EAAS,eAAA,GAAkB,wBAAA,CAAyB,SAAA;EAAA,UAUrH,mBAAA,CAAoB,IAAA,EAAM,SAAA,qBAA8B,UAAA;EAAA,UAuExD,mBAAA,CAAoB,QAAA;IAAY,IAAA;IAAkC,EAAA;EAAA,GAAc,IAAA,EAAM,QAAA,qBAA6B,UAAA;EAAA,UAkD7G,cAAA,CAAe,OAAA;IAAW,MAAA;EAAA,IAAmB,OAAA,CAAQ,MAAA;EAAA,UAKrD,cAAA,CAAe,OAAA;IAAW,MAAA;EAAA,IAAmB,OAAA,CAAQ,MAAA;EAAA,UAIrD,gBAAA,CAAiB,MAAA,WAAiB,OAAA,CAAQ,UAAA;EAAA,UAQ1C,gBAAA,CAAiB,GAAA,EAAK,SAAA,EAAW,gBAAA,YAA4B,OAAA,CAAQ,UAAA;EAAA,UAYrE,gBAAA,CAAiB,MAAA,WAAiB,OAAA,CAAQ,UAAA;EAQpD,UAAA,CAAW,OAAA,EAAS,uBAAA,GAA0B,OAAA,CAAQ,UAAA;EAMtD,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAmB,OAAA,CAAQ,wBAAA,CAAyB,SAAA;EAC9G,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAgB,OAAA,CAAQ,wBAAA,CAAyB,SAAA;EAC3G,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAoB,OAAA,CAAQ,wBAAA,CAAyB,SAAA;EAC/G,OAAA,CAAQ,OAAA,GAAU,qBAAA,CAAsB,aAAA,IAAiB,OAAA,CAAQ,wBAAA,CAAyB,SAAA;EAC1F,OAAA,CAAQ,EAAA,WAAa,OAAA,CAAQ,UAAA;EAC7B,OAAA,CAAQ,OAAA;IAAW,MAAA;EAAA,IAAmB,OAAA,CAAQ,UAAA;EAC9C,OAAA,CAAQ,OAAA;IAAW,IAAA;IAAgB,GAAA,EAAK,SAAA;IAAW,EAAA;EAAA,IAAqC,OAAA,CAAQ,UAAA;EAqDhG,aAAA,CAAA,GAAiB,OAAA,CAAQ,wBAAA,CAAyB,SAAA;EAKlD,iBAAA,CAAkB,MAAA,WAAiB,OAAA,CAAQ,UAAA;EAM3C,SAAA,CAAU,OAAA,GAAU,sBAAA,GAAyB,OAAA,CAAQ,UAAA;IAAiB,UAAA;EAAA;EAQ5E,yBAAA,CAA0B,IAAA,EAAM,mBAAA,qBAAwC,sBAAA,qBAA2C,mBAAA;EAMnH,uCAAA,CAAwC,IAAA,EAAM,6BAAA,oBAAiD,6BAAA;EAQ/F,0CAAA,CAA2C,IAAA,EAAM,gCAAA,oBAAoD,gCAAA;EAQ/F,OAAA,CAAQ,OAAA;IAAW,MAAA;IAAgB,MAAA;EAAA;IAAqB,MAAA;IAAgB,MAAA;EAAA;IAAqB,MAAA;IAAgB,gBAAA;EAAA,IAA6B,OAAA,CAAQ,UAAA;EAalJ,YAAA,CAAa,OAAA,EAAS,8BAAA,GAAiC,OAAA,CAAQ,oBAAA;EAY/D,YAAA,CAAa,OAAA;IACd,MAAA;EAAA;IAAqB,MAAA;EAAA;IAAqB,gBAAA;EAAA;IAC1C,SAAA;EAAA;IAAwB,OAAA,EAAS,aAAA;EAAA;IAClC,QAAA;EAAA,KACA,OAAA;EA8BE,UAAA,CAAW,IAAA,EAAM,uBAAA,GAA0B,OAAA,CAAQ,UAAA;EAMnD,SAAA,CAAU,OAAA,GAAU,sBAAA,GAAyB,OAAA,CAAQ,UAAA;IAAiB,UAAA;EAAA;EAQtE,yBAAA,CAA0B,MAAA,UAAgB,OAAA;IAAY,SAAA;EAAA,IAAwB,OAAA;IAAU,MAAA;IAAgB,YAAA;EAAA;EAOxG,OAAA,CAAQ,OAAA;IAAW,MAAA;EAAA,IAAmB,OAAA,CAAQ,UAAA;EAC9C,OAAA,CAAQ,MAAA,WAAiB,OAAA,CAAQ,UAAA;EAAA,UAY7B,2BAAA,CAA4B,EAAA,WAAa,cAAA;EAiB7C,iBAAA,CAAkB,EAAA,WAAa,OAAA,CAAQ,cAAA;EAKvC,SAAA,CAAU,OAAA,EAAS,gBAAA,GAAmB,OAAA;EAKtC,qBAAA,CAAA,GAAyB,OAAA,CAAQ,iBAAA;EAKjC,0BAAA,CAAA,GAA8B,OAAA;EAAA,UAMX,eAAA,CAAgB,OAAA,EAAS,eAAA,GAAe,OAAA;EAAA,UAOxC,aAAA,CAAA,GAAa,OAAA;EAWhC,mBAAA,CAAoB,OAAA;IACxB,MAAA;IACA,gBAAA;IACA,SAAA;IACA,KAAA;IACA,WAAA;IACA,sBAAA;EAAA,IACE,OAAA,CAAQ,MAAA,CAAO,mBAAA,EAAqB,YAAA,QAAoB,WAAA,CAAY,0CAAA;AAAA"}