@stackframe/js 2.8.48 → 2.8.51

package/dist/esm/lib/stack-app/common.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/stack-app/common.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { ProviderType } from \"@stackframe/stack-shared/dist/utils/oauth\";\nimport type { GenericQueryCtx, UserIdentity } from \"convex/server\";\n\nexport type RedirectToOptions = {\n  replace?: boolean,\n  noRedirectBack?: boolean,\n};\n\nexport type AsyncStoreProperty<Name extends string, Args extends any[], Value, IsMultiple extends boolean> =\n  & { [key in `${IsMultiple extends true ? \"list\" : \"get\"}${Capitalize<Name>}`]: (...args: Args) => Promise<Value> }\n\nexport type EmailConfig = {\n  host: string,\n  port: number,\n  username: string,\n  password: string,\n  senderEmail: string,\n  senderName: string,\n}\n\nexport type RedirectMethod = \"window\"\n  | \"none\"\n  | {\n    useNavigate: () => (to: string) => void,\n    navigate?: (to: string) => void,\n  }\n\n\nexport type GetCurrentUserOptions<HasTokenStore> =\n  & {\n    or?: 'redirect' | 'throw' | 'return-null' | 'anonymous' | /** @deprecated */ 'anonymous-if-exists[deprecated]',\n    tokenStore?: TokenStoreInit,\n  }\n  & (HasTokenStore extends false ? {\n    tokenStore: TokenStoreInit,\n  } : {});\n\nexport type ConvexCtx =\n| GenericQueryCtx<any>\n| { auth: { getUserIdentity: () => Promise<UserIdentity | null> } };\n\nexport type GetCurrentPartialUserOptions<HasTokenStore> =\n  & {\n    or?: 'return-null' | 'anonymous',  // note: unlike normal getUser, 'anonymous' still returns null sometimes (eg. if no token is present)\n    tokenStore?: TokenStoreInit,\n  }\n  & (\n    | {\n      from: 'token',\n    }\n    | {\n      from: 'convex',\n      ctx: ConvexCtx,\n    }\n  )\n  & (HasTokenStore extends false ? {\n    tokenStore: TokenStoreInit,\n  } : {});\n\nexport type RequestLike = {\n  headers: {\n    get: (name: string) => string | null,\n  },\n};\n\nexport type TokenStoreInit<HasTokenStore extends boolean = boolean> =\n  HasTokenStore extends true ? (\n    | \"cookie\"\n    | \"nextjs-cookie\"\n    | \"memory\"\n    | RequestLike\n    | { accessToken: string, refreshToken: string }\n  )\n  : HasTokenStore extends false ? null\n  : TokenStoreInit<true> | TokenStoreInit<false>;\n\nexport type HandlerUrls = {\n  handler: string,\n  signIn: string,\n  signUp: string,\n  afterSignIn: string,\n  afterSignUp: string,\n  signOut: string,\n  afterSignOut: string,\n  emailVerification: string,\n  passwordReset: string,\n  forgotPassword: string,\n  home: string,\n  oauthCallback: string,\n  magicLinkCallback: string,\n  accountSettings: string,\n  teamInvitation: string,\n  mfa: string,\n  error: string,\n}\n\nexport type OAuthScopesOnSignIn = {\n  [key in ProviderType]: string[];\n};\n\n/** @internal */\nexport const stackAppInternalsSymbol = Symbol.for(\"StackAuth--DO-NOT-USE-OR-YOU-WILL-BE-FIRED--StackAppInternals\");\n"],"mappings":";AAyGO,IAAM,0BAA0B,OAAO,IAAI,+DAA+D;","names":[]}
+{"version":3,"sources":["../../../../src/lib/stack-app/common.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { ProviderType } from \"@stackframe/stack-shared/dist/utils/oauth\";\nimport type { GenericQueryCtx, UserIdentity } from \"convex/server\";\n\nexport type RedirectToOptions = {\n  replace?: boolean,\n  noRedirectBack?: boolean,\n};\n\nexport type AsyncStoreProperty<Name extends string, Args extends any[], Value, IsMultiple extends boolean> =\n  & { [key in `${IsMultiple extends true ? \"list\" : \"get\"}${Capitalize<Name>}`]: (...args: Args) => Promise<Value> }\n\nexport type EmailConfig = {\n  host: string,\n  port: number,\n  username: string,\n  password: string,\n  senderEmail: string,\n  senderName: string,\n}\n\nexport type RedirectMethod = \"window\"\n  | \"none\"\n  | {\n    useNavigate: () => (to: string) => void,\n    navigate?: (to: string) => void,\n  }\n\n\nexport type GetCurrentUserOptions<HasTokenStore> =\n  & {\n    or?: 'redirect' | 'throw' | 'return-null' | 'anonymous' | /** @deprecated */ 'anonymous-if-exists[deprecated]',\n    tokenStore?: TokenStoreInit,\n  }\n  & (HasTokenStore extends false ? {\n    tokenStore: TokenStoreInit,\n  } : {});\n\nexport type ConvexCtx =\n| GenericQueryCtx<any>\n| { auth: { getUserIdentity: () => Promise<UserIdentity | null> } };\n\nexport type GetCurrentPartialUserOptions<HasTokenStore> =\n  & {\n    or?: 'return-null' | 'anonymous',  // note: unlike normal getUser, 'anonymous' still returns null sometimes (eg. if no token is present)\n    tokenStore?: TokenStoreInit,\n  }\n  & (\n    | {\n      from: 'token',\n    }\n    | {\n      from: 'convex',\n      ctx: ConvexCtx,\n    }\n  )\n  & (HasTokenStore extends false ? {\n    tokenStore: TokenStoreInit,\n  } : {});\n\nexport type RequestLike = {\n  headers: {\n    get: (name: string) => string | null,\n  },\n};\n\nexport type TokenStoreInit<HasTokenStore extends boolean = boolean> =\n  HasTokenStore extends true ? (\n    | \"cookie\"\n    | \"nextjs-cookie\"\n    | \"memory\"\n    | RequestLike\n    | { accessToken: string, refreshToken: string }\n  )\n  : HasTokenStore extends false ? null\n  : TokenStoreInit<true> | TokenStoreInit<false>;\n\nexport type HandlerUrls = {\n  handler: string,\n  signIn: string,\n  signUp: string,\n  afterSignIn: string,\n  afterSignUp: string,\n  signOut: string,\n  afterSignOut: string,\n  emailVerification: string,\n  passwordReset: string,\n  forgotPassword: string,\n  home: string,\n  oauthCallback: string,\n  magicLinkCallback: string,\n  accountSettings: string,\n  teamInvitation: string,\n  mfa: string,\n  error: string,\n}\n\nexport type OAuthScopesOnSignIn = {\n  [key in ProviderType]: string[];\n};\n\n/**\n * Contains the authentication methods without session-related fields.\n * Used for apps that have token storage capabilities.\n */\nexport type AuthLike<ExtraOptions = {}> = {\n  signOut(options?: { redirectUrl?: URL | string } & ExtraOptions): Promise<void>,\n  signOut(options?: { redirectUrl?: URL | string }): Promise<void>,\n\n  /**\n   * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin\n   * requests. Similar to `getAuthJson`, but specifically for HTTP requests.\n   *\n   * If you are using `tokenStore: \"cookie\"`, you don't need this for same-origin requests. However, most\n   * browsers now disable third-party cookies by default, so we must pass authentication tokens by header instead\n   * if the client and server are on different origins.\n   *\n   * This function returns a header object that can be used with `fetch` or other HTTP request libraries to send\n   * authenticated requests.\n   *\n   * On the server, you can then pass in the `Request` object to the `tokenStore` option\n   * of your Stack app. Please note that CORS does not allow most headers by default, so you\n   * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)\n   * of the CORS preflight response.\n   *\n   * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function\n   * instead.\n   *\n   * Example:\n   *\n   * ```ts\n   * // client\n   * const res = await fetch(\"https://api.example.com\", {\n   *   headers: {\n   *     ...await stackApp.getAuthHeaders()\n   *     // you can also add your own headers here\n   *   },\n   * });\n   *\n   * // server\n   * function handleRequest(req: Request) {\n   *   const user = await stackServerApp.getUser({ tokenStore: req });\n   *   return new Response(\"Welcome, \" + user.displayName);\n   * }\n   * ```\n   */\n  getAuthHeaders(options?: {} & ExtraOptions): Promise<{ \"x-stack-auth\": string }>,\n\n  /**\n   * Creates a JSON-serializable object containing the information to authenticate a user on an external server.\n   * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just\n   * HTTP headers.\n   *\n   * While `getAuthHeaders` is the recommended way to send authentication tokens over HTTP, your app may use\n   * a different protocol, for example WebSockets or gRPC. This function returns a token object that can be JSON-serialized and sent to the server in any way you like.\n   *\n   * On the server, you can pass in this token object into the `tokenStore` option to fetch user details.\n   *\n   * Example:\n   *\n   * ```ts\n   * // client\n   * const res = await rpcCall(rpcEndpoint, {\n   *   data: {\n   *     auth: await stackApp.getAuthJson(),\n   *   },\n   * });\n   *\n   * // server\n   * function handleRequest(data) {\n   *   const user = await stackServerApp.getUser({ tokenStore: data.auth });\n   *   return new Response(\"Welcome, \" + user.displayName);\n   * }\n   * ```\n   */\n  getAuthJson(options?: {} & ExtraOptions): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n};\n\n/** @internal */\nexport const stackAppInternalsSymbol = Symbol.for(\"StackAuth--DO-NOT-USE-OR-YOU-WILL-BE-FIRED--StackAppInternals\");\n"],"mappings":";AAsLO,IAAM,0BAA0B,OAAO,IAAI,+DAA+D;","names":[]}

package/dist/esm/lib/stack-app/users/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/stack-app/users/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { KnownErrors } from \"@stackframe/stack-shared\";\nimport { CurrentUserCrud } from \"@stackframe/stack-shared/dist/interface/crud/current-user\";\nimport { UsersCrud } from \"@stackframe/stack-shared/dist/interface/crud/users\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { encodeBase64 } from \"@stackframe/stack-shared/dist/utils/bytes\";\nimport { GeoInfo } from \"@stackframe/stack-shared/dist/utils/geo\";\nimport { ReadonlyJson } from \"@stackframe/stack-shared/dist/utils/json\";\nimport { ProviderType } from \"@stackframe/stack-shared/dist/utils/oauth\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from \"../api-keys\";\nimport { AsyncStoreProperty } from \"../common\";\nimport { OAuthConnection } from \"../connected-accounts\";\nimport { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from \"../contact-channels\";\nimport { Customer } from \"../customers\";\nimport { NotificationCategory } from \"../notification-categories\";\nimport { AdminTeamPermission, TeamPermission } from \"../permissions\";\nimport { AdminOwnedProject, AdminProjectCreateOptions } from \"../projects\";\nimport { EditableTeamMemberProfile, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from \"../teams\";\n\nconst userGetterErrorMessage = \"Stack Auth: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.\";\n\nexport function attachUserDestructureGuard(target: object): void {\n  const descriptor = Object.getOwnPropertyDescriptor(target, \"user\");\n  if (descriptor?.get === guardGetter) {\n    return;\n  }\n\n  Object.defineProperty(target, \"user\", {\n    get: guardGetter,\n    configurable: false,\n    enumerable: false,\n  });\n}\n\nfunction guardGetter(): never {\n  throw new Error(userGetterErrorMessage);\n}\n\nexport type OAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId?: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\nexport type ServerOAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { accountId?: string, email?: string, allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\n\nexport type Session = {\n  getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n};\n\n/**\n * Contains everything related to the current user session.\n */\nexport type Auth = {\n  readonly _internalSession: InternalSession,\n  readonly currentSession: Session,\n  signOut(options?: { redirectUrl?: URL | string }): Promise<void>,\n\n  /**\n   * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin\n   * requests. Similar to `getAuthJson`, but specifically for HTTP requests.\n   *\n   * If you are using `tokenStore: \"cookie\"`, you don't need this for same-origin requests. However, most\n   * browsers now disable third-party cookies by default, so we must pass authentication tokens by header instead\n   * if the client and server are on different origins.\n   *\n   * This function returns a header object that can be used with `fetch` or other HTTP request libraries to send\n   * authenticated requests.\n   *\n   * On the server, you can then pass in the `Request` object to the `tokenStore` option\n   * of your Stack app. Please note that CORS does not allow most headers by default, so you\n   * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)\n   * of the CORS preflight response.\n   *\n   * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function\n   * instead.\n   *\n   * Example:\n   *\n   * ```ts\n   * // client\n   * const res = await fetch(\"https://api.example.com\", {\n   *   headers: {\n   *     ...await stackApp.getAuthHeaders()\n   *     // you can also add your own headers here\n   *   },\n   * });\n   *\n   * // server\n   * function handleRequest(req: Request) {\n   *   const user = await stackServerApp.getUser({ tokenStore: req });\n   *   return new Response(\"Welcome, \" + user.displayName);\n   * }\n   * ```\n   */\n  getAuthHeaders(): Promise<{ \"x-stack-auth\": string }>,\n\n  /**\n   * Creates a JSON-serializable object containing the information to authenticate a user on an external server.\n   * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just\n   * HTTP headers.\n   *\n   * While `getAuthHeaders` is the recommended way to send authentication tokens over HTTP, your app may use\n   * a different protocol, for example WebSockets or gRPC. This function returns a token object that can be JSON-serialized and sent to the server in any way you like.\n   *\n   * On the server, you can pass in this token object into the `tokenStore` option to fetch user details.\n   *\n   * Example:\n   *\n   * ```ts\n   * // client\n   * const res = await rpcCall(rpcEndpoint, {\n   *   data: {\n   *     auth: await stackApp.getAuthJson(),\n   *   },\n   * });\n   *\n   * // server\n   * function handleRequest(data) {\n   *   const user = await stackServerApp.getUser({ tokenStore: data.auth });\n   *   return new Response(\"Welcome, \" + user.displayName);\n   * }\n   * ```\n   */\n  getAuthJson(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n};\n\n/**\n * ```\n * +----------+-------------+-------------------+\n * |    \\     |   !Server   |      Server       |\n * +----------+-------------+-------------------+\n * | !Session | User        | ServerUser        |\n * | Session  | CurrentUser | CurrentServerUser |\n * +----------+-------------+-------------------+\n * ```\n *\n * The fields on each of these types are available iff:\n * BaseUser: true\n * Auth: Session\n * ServerBaseUser: Server\n * UserExtra: Session OR Server\n *\n * The types are defined as follows (in the typescript manner):\n * User = BaseUser\n * CurrentUser = BaseUser & Auth & UserExtra\n * ServerUser = BaseUser & ServerBaseUser & UserExtra\n * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra\n **/\n\nexport type BaseUser = {\n  readonly id: string,\n\n  readonly displayName: string | null,\n\n  /**\n   * The user's email address.\n   *\n   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.\n   */\n  readonly primaryEmail: string | null,\n  readonly primaryEmailVerified: boolean,\n  readonly profileImageUrl: string | null,\n\n  readonly signedUpAt: Date,\n\n  readonly clientMetadata: any,\n  readonly clientReadOnlyMetadata: any,\n\n  /**\n   * Whether the user has a password set.\n   */\n  readonly hasPassword: boolean,\n  readonly otpAuthEnabled: boolean,\n  readonly passkeyAuthEnabled: boolean,\n\n  readonly isMultiFactorRequired: boolean,\n  readonly isAnonymous: boolean,\n  toClientJson(): CurrentUserCrud[\"Client\"][\"Read\"],\n\n  /**\n   * @deprecated, use contact channel's usedForAuth instead\n   */\n  readonly emailAuthEnabled: boolean,\n  /**\n   * @deprecated\n   */\n  readonly oauthProviders: readonly { id: string }[],\n}\n\nexport type UserExtra = {\n  setDisplayName(displayName: string): Promise<void>,\n  /** @deprecated Use contact channel's sendVerificationEmail instead */\n  sendVerificationEmail(): Promise<KnownErrors[\"EmailAlreadyVerified\"] | void>,\n  setClientMetadata(metadata: any): Promise<void>,\n  updatePassword(options: { oldPassword: string, newPassword: string}): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n  setPassword(options: { password: string }): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n\n  /**\n   * A shorthand method to update multiple fields of the user at once.\n   */\n  update(update: UserUpdateOptions): Promise<void>,\n\n  listContactChannels(): Promise<ContactChannel[]>,\n  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>,\n\n  listNotificationCategories(): Promise<NotificationCategory[]>,\n\n  delete(): Promise<void>,\n\n  getConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): Promise<OAuthConnection>,\n  getConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): Promise<OAuthConnection | null>,\n\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  readonly selectedTeam: Team | null,\n  setSelectedTeam(team: Team | null): Promise<void>,\n  createTeam(data: TeamCreateOptions): Promise<Team>,\n  leaveTeam(team: Team): Promise<void>,\n\n  getActiveSessions(): Promise<ActiveSession[]>,\n  revokeSession(sessionId: string): Promise<void>,\n  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>,\n\n  createApiKey(options: ApiKeyCreationOptions<\"user\">): Promise<UserApiKeyFirstView>,\n\n  listOAuthProviders(): Promise<OAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<OAuthProvider | null>,\n}\n& AsyncStoreProperty<\"apiKeys\", [], UserApiKey[], true>\n& AsyncStoreProperty<\"team\", [id: string], Team | null, false>\n& AsyncStoreProperty<\"teams\", [], Team[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { recursive?: boolean }], TeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { recursive?: boolean }], TeamPermission[], true>;\n\nexport type InternalUserExtra =\n  & {\n    createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>,\n    transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>,\n  }\n  & AsyncStoreProperty<\"ownedProjects\", [], AdminOwnedProject[], true>\n\nexport type User = BaseUser;\n\nexport type CurrentUser = BaseUser & Auth & UserExtra & Customer;\n\nexport type CurrentInternalUser = CurrentUser & InternalUserExtra;\n\nexport type ProjectCurrentUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalUser : CurrentUser;\n\nexport type TokenPartialUser = Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"isAnonymous\"\n>\n\nexport type SyncedPartialUser = TokenPartialUser & Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"profileImageUrl\"\n  | \"signedUpAt\"\n  | \"clientMetadata\"\n  | \"clientReadOnlyMetadata\"\n  | \"isAnonymous\"\n  | \"hasPassword\"\n>;\n\n\nexport type ActiveSession = {\n  id: string,\n  userId: string,\n  createdAt: Date,\n  isImpersonation: boolean,\n  lastUsedAt: Date | undefined,\n  isCurrentSession: boolean,\n  geoInfo?: GeoInfo,\n};\n\nexport type UserUpdateOptions = {\n  displayName?: string,\n  clientMetadata?: ReadonlyJson,\n  selectedTeamId?: string | null,\n  totpMultiFactorSecret?: Uint8Array | null,\n  profileImageUrl?: string | null,\n  otpAuthEnabled?: boolean,\n  passkeyAuthEnabled?:boolean,\n}\nexport function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud[\"Client\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    client_metadata: options.clientMetadata,\n    selected_team_id: options.selectedTeamId,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n    profile_image_url: options.profileImageUrl,\n    otp_auth_enabled: options.otpAuthEnabled,\n    passkey_auth_enabled: options.passkeyAuthEnabled,\n  };\n}\n\n\nexport type ServerBaseUser = {\n  setPrimaryEmail(email: string | null, options?: { verified?: boolean | undefined }): Promise<void>,\n\n  readonly lastActiveAt: Date,\n\n  readonly serverMetadata: any,\n  setServerMetadata(metadata: any): Promise<void>,\n  setClientReadOnlyMetadata(metadata: any): Promise<void>,\n\n  createTeam(data: Omit<ServerTeamCreateOptions, \"creatorUserId\">): Promise<ServerTeam>,\n\n  listContactChannels(): Promise<ServerContactChannel[]>,\n  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>,\n\n  update(user: ServerUserUpdateOptions): Promise<void>,\n\n  grantPermission(scope: Team, permissionId: string): Promise<void>,\n  grantPermission(permissionId: string): Promise<void>,\n\n  revokePermission(scope: Team, permissionId: string): Promise<void>,\n  revokePermission(permissionId: string): Promise<void>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  listOAuthProviders(): Promise<ServerOAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>,\n\n  /**\n   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.\n   */\n  createSession(options?: { expiresInMillis?: number, isImpersonation?: boolean }): Promise<Session>,\n}\n& AsyncStoreProperty<\"team\", [id: string], ServerTeam | null, false>\n& AsyncStoreProperty<\"teams\", [], ServerTeam[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { direct?: boolean }], AdminTeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { direct?: boolean }], AdminTeamPermission[], true>;\n\n/**\n * A user including sensitive fields that should only be used on the server, never sent to the client\n * (such as sensitive information and serverMetadata).\n */\nexport type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;\n\nexport type CurrentServerUser = Auth & ServerUser;\n\nexport type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;\n\nexport type ProjectCurrentServerUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalServerUser : CurrentServerUser;\n\nexport type SyncedPartialServerUser = SyncedPartialUser & Pick<\n  ServerUser,\n  | \"serverMetadata\"\n>;\n\nexport type ServerUserUpdateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailVerified?: boolean,\n  primaryEmailAuthEnabled?: boolean,\n  clientReadOnlyMetadata?: ReadonlyJson,\n  serverMetadata?: ReadonlyJson,\n  password?: string,\n} & UserUpdateOptions;\nexport function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud[\"Server\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    primary_email: options.primaryEmail,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    selected_team_id: options.selectedTeamId,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    primary_email_verified: options.primaryEmailVerified,\n    password: options.password,\n    profile_image_url: options.profileImageUrl,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n  };\n}\n\n\nexport type ServerUserCreateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailAuthEnabled?: boolean,\n  password?: string,\n  otpAuthEnabled?: boolean,\n  displayName?: string,\n  primaryEmailVerified?: boolean,\n  clientMetadata?: any,\n  clientReadOnlyMetadata?: any,\n  serverMetadata?: any,\n}\nexport function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud[\"Server\"][\"Create\"] {\n  return {\n    primary_email: options.primaryEmail,\n    password: options.password,\n    otp_auth_enabled: options.otpAuthEnabled,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    display_name: options.displayName,\n    primary_email_verified: options.primaryEmailVerified,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n  };\n}\n"],"mappings":";AAQA,SAAS,oBAAoB;AAe7B,IAAM,yBAAyB;AAExB,SAAS,2BAA2B,QAAsB;AAC/D,QAAM,aAAa,OAAO,yBAAyB,QAAQ,MAAM;AACjE,MAAI,YAAY,QAAQ,aAAa;AACnC;AAAA,EACF;AAEA,SAAO,eAAe,QAAQ,QAAQ;AAAA,IACpC,KAAK;AAAA,IACL,cAAc;AAAA,IACd,YAAY;AAAA,EACd,CAAC;AACH;AAEA,SAAS,cAAqB;AAC5B,QAAM,IAAI,MAAM,sBAAsB;AACxC;AAiSO,SAAS,wBAAwB,SAAiE;AACvG,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,QAAQ;AAAA,IAC1B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,qBAAqB,IAAI,QAAQ;AAAA,IAClH,mBAAmB,QAAQ;AAAA,IAC3B,kBAAkB,QAAQ;AAAA,IAC1B,sBAAsB,QAAQ;AAAA,EAChC;AACF;AA0EO,SAAS,8BAA8B,SAAuE;AACnH,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,eAAe,QAAQ;AAAA,IACvB,iBAAiB,QAAQ;AAAA,IACzB,2BAA2B,QAAQ;AAAA,IACnC,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,QAAQ;AAAA,IAC1B,4BAA4B,QAAQ;AAAA,IACpC,wBAAwB,QAAQ;AAAA,IAChC,UAAU,QAAQ;AAAA,IAClB,mBAAmB,QAAQ;AAAA,IAC3B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,qBAAqB,IAAI,QAAQ;AAAA,EACpH;AACF;AAcO,SAAS,8BAA8B,SAAiE;AAC7G,SAAO;AAAA,IACL,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,IAClB,kBAAkB,QAAQ;AAAA,IAC1B,4BAA4B,QAAQ;AAAA,IACpC,cAAc,QAAQ;AAAA,IACtB,wBAAwB,QAAQ;AAAA,IAChC,iBAAiB,QAAQ;AAAA,IACzB,2BAA2B,QAAQ;AAAA,IACnC,iBAAiB,QAAQ;AAAA,EAC3B;AACF;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/stack-app/users/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { KnownErrors } from \"@stackframe/stack-shared\";\nimport { CurrentUserCrud } from \"@stackframe/stack-shared/dist/interface/crud/current-user\";\nimport { UsersCrud } from \"@stackframe/stack-shared/dist/interface/crud/users\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { encodeBase64 } from \"@stackframe/stack-shared/dist/utils/bytes\";\nimport { GeoInfo } from \"@stackframe/stack-shared/dist/utils/geo\";\nimport { ReadonlyJson } from \"@stackframe/stack-shared/dist/utils/json\";\nimport { ProviderType } from \"@stackframe/stack-shared/dist/utils/oauth\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from \"../api-keys\";\nimport { AsyncStoreProperty, AuthLike } from \"../common\";\nimport { OAuthConnection } from \"../connected-accounts\";\nimport { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from \"../contact-channels\";\nimport { Customer } from \"../customers\";\nimport { NotificationCategory } from \"../notification-categories\";\nimport { AdminTeamPermission, TeamPermission } from \"../permissions\";\nimport { AdminOwnedProject, AdminProjectCreateOptions } from \"../projects\";\nimport { EditableTeamMemberProfile, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from \"../teams\";\n\nconst userGetterErrorMessage = \"Stack Auth: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.\";\n\nexport function attachUserDestructureGuard(target: object): void {\n  const descriptor = Object.getOwnPropertyDescriptor(target, \"user\");\n  if (descriptor?.get === guardGetter) {\n    return;\n  }\n\n  Object.defineProperty(target, \"user\", {\n    get: guardGetter,\n    configurable: false,\n    enumerable: false,\n  });\n}\n\nfunction guardGetter(): never {\n  throw new Error(userGetterErrorMessage);\n}\n\nexport type OAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId?: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\nexport type ServerOAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { accountId?: string, email?: string, allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\n\nexport type Session = {\n  getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n};\n\n/**\n * Contains everything related to the current user session.\n */\nexport type Auth = AuthLike<{}> & {\n  readonly _internalSession: InternalSession,\n  readonly currentSession: Session,\n};\n\n/**\n * ```\n * +----------+-------------+-------------------+\n * |    \\     |   !Server   |      Server       |\n * +----------+-------------+-------------------+\n * | !Session | User        | ServerUser        |\n * | Session  | CurrentUser | CurrentServerUser |\n * +----------+-------------+-------------------+\n * ```\n *\n * The fields on each of these types are available iff:\n * BaseUser: true\n * Auth: Session\n * ServerBaseUser: Server\n * UserExtra: Session OR Server\n *\n * The types are defined as follows (in the typescript manner):\n * User = BaseUser\n * CurrentUser = BaseUser & Auth & UserExtra\n * ServerUser = BaseUser & ServerBaseUser & UserExtra\n * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra\n **/\n\nexport type BaseUser = {\n  readonly id: string,\n\n  readonly displayName: string | null,\n\n  /**\n   * The user's email address.\n   *\n   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.\n   */\n  readonly primaryEmail: string | null,\n  readonly primaryEmailVerified: boolean,\n  readonly profileImageUrl: string | null,\n\n  readonly signedUpAt: Date,\n\n  readonly clientMetadata: any,\n  readonly clientReadOnlyMetadata: any,\n\n  /**\n   * Whether the user has a password set.\n   */\n  readonly hasPassword: boolean,\n  readonly otpAuthEnabled: boolean,\n  readonly passkeyAuthEnabled: boolean,\n\n  readonly isMultiFactorRequired: boolean,\n  readonly isAnonymous: boolean,\n  toClientJson(): CurrentUserCrud[\"Client\"][\"Read\"],\n\n  /**\n   * @deprecated, use contact channel's usedForAuth instead\n   */\n  readonly emailAuthEnabled: boolean,\n  /**\n   * @deprecated\n   */\n  readonly oauthProviders: readonly { id: string }[],\n}\n\nexport type UserExtra = {\n  setDisplayName(displayName: string): Promise<void>,\n  /** @deprecated Use contact channel's sendVerificationEmail instead */\n  sendVerificationEmail(): Promise<KnownErrors[\"EmailAlreadyVerified\"] | void>,\n  setClientMetadata(metadata: any): Promise<void>,\n  updatePassword(options: { oldPassword: string, newPassword: string}): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n  setPassword(options: { password: string }): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n\n  /**\n   * A shorthand method to update multiple fields of the user at once.\n   */\n  update(update: UserUpdateOptions): Promise<void>,\n\n  listContactChannels(): Promise<ContactChannel[]>,\n  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>,\n\n  listNotificationCategories(): Promise<NotificationCategory[]>,\n\n  delete(): Promise<void>,\n\n  getConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): Promise<OAuthConnection>,\n  getConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): Promise<OAuthConnection | null>,\n\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  readonly selectedTeam: Team | null,\n  setSelectedTeam(team: Team | null): Promise<void>,\n  createTeam(data: TeamCreateOptions): Promise<Team>,\n  leaveTeam(team: Team): Promise<void>,\n\n  getActiveSessions(): Promise<ActiveSession[]>,\n  revokeSession(sessionId: string): Promise<void>,\n  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>,\n\n  createApiKey(options: ApiKeyCreationOptions<\"user\">): Promise<UserApiKeyFirstView>,\n\n  listOAuthProviders(): Promise<OAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<OAuthProvider | null>,\n\n  registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n}\n& AsyncStoreProperty<\"apiKeys\", [], UserApiKey[], true>\n& AsyncStoreProperty<\"team\", [id: string], Team | null, false>\n& AsyncStoreProperty<\"teams\", [], Team[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { recursive?: boolean }], TeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { recursive?: boolean }], TeamPermission[], true>;\n\nexport type InternalUserExtra =\n  & {\n    createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>,\n    transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>,\n  }\n  & AsyncStoreProperty<\"ownedProjects\", [], AdminOwnedProject[], true>\n\nexport type User = BaseUser;\n\nexport type CurrentUser = BaseUser & Auth & UserExtra & Customer;\n\nexport type CurrentInternalUser = CurrentUser & InternalUserExtra;\n\nexport type ProjectCurrentUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalUser : CurrentUser;\n\nexport type TokenPartialUser = Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"isAnonymous\"\n>\n\nexport type SyncedPartialUser = TokenPartialUser & Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"profileImageUrl\"\n  | \"signedUpAt\"\n  | \"clientMetadata\"\n  | \"clientReadOnlyMetadata\"\n  | \"isAnonymous\"\n  | \"hasPassword\"\n>;\n\n\nexport type ActiveSession = {\n  id: string,\n  userId: string,\n  createdAt: Date,\n  isImpersonation: boolean,\n  lastUsedAt: Date | undefined,\n  isCurrentSession: boolean,\n  geoInfo?: GeoInfo,\n};\n\nexport type UserUpdateOptions = {\n  displayName?: string,\n  clientMetadata?: ReadonlyJson,\n  selectedTeamId?: string | null,\n  totpMultiFactorSecret?: Uint8Array | null,\n  profileImageUrl?: string | null,\n  otpAuthEnabled?: boolean,\n  passkeyAuthEnabled?:boolean,\n}\nexport function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud[\"Client\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    client_metadata: options.clientMetadata,\n    selected_team_id: options.selectedTeamId,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n    profile_image_url: options.profileImageUrl,\n    otp_auth_enabled: options.otpAuthEnabled,\n    passkey_auth_enabled: options.passkeyAuthEnabled,\n  };\n}\n\n\nexport type ServerBaseUser = {\n  setPrimaryEmail(email: string | null, options?: { verified?: boolean | undefined }): Promise<void>,\n\n  readonly lastActiveAt: Date,\n\n  readonly serverMetadata: any,\n  setServerMetadata(metadata: any): Promise<void>,\n  setClientReadOnlyMetadata(metadata: any): Promise<void>,\n\n  createTeam(data: Omit<ServerTeamCreateOptions, \"creatorUserId\">): Promise<ServerTeam>,\n\n  listContactChannels(): Promise<ServerContactChannel[]>,\n  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>,\n\n  update(user: ServerUserUpdateOptions): Promise<void>,\n\n  grantPermission(scope: Team, permissionId: string): Promise<void>,\n  grantPermission(permissionId: string): Promise<void>,\n\n  revokePermission(scope: Team, permissionId: string): Promise<void>,\n  revokePermission(permissionId: string): Promise<void>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  listOAuthProviders(): Promise<ServerOAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>,\n\n  /**\n   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.\n   */\n  createSession(options?: { expiresInMillis?: number, isImpersonation?: boolean }): Promise<Session>,\n}\n& AsyncStoreProperty<\"team\", [id: string], ServerTeam | null, false>\n& AsyncStoreProperty<\"teams\", [], ServerTeam[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { direct?: boolean }], AdminTeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { direct?: boolean }], AdminTeamPermission[], true>;\n\n/**\n * A user including sensitive fields that should only be used on the server, never sent to the client\n * (such as sensitive information and serverMetadata).\n */\nexport type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;\n\nexport type CurrentServerUser = Auth & ServerUser;\n\nexport type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;\n\nexport type ProjectCurrentServerUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalServerUser : CurrentServerUser;\n\nexport type SyncedPartialServerUser = SyncedPartialUser & Pick<\n  ServerUser,\n  | \"serverMetadata\"\n>;\n\nexport type ServerUserUpdateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailVerified?: boolean,\n  primaryEmailAuthEnabled?: boolean,\n  clientReadOnlyMetadata?: ReadonlyJson,\n  serverMetadata?: ReadonlyJson,\n  password?: string,\n} & UserUpdateOptions;\nexport function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud[\"Server\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    primary_email: options.primaryEmail,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    selected_team_id: options.selectedTeamId,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    primary_email_verified: options.primaryEmailVerified,\n    password: options.password,\n    profile_image_url: options.profileImageUrl,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n  };\n}\n\n\nexport type ServerUserCreateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailAuthEnabled?: boolean,\n  password?: string,\n  otpAuthEnabled?: boolean,\n  displayName?: string,\n  primaryEmailVerified?: boolean,\n  clientMetadata?: any,\n  clientReadOnlyMetadata?: any,\n  serverMetadata?: any,\n}\nexport function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud[\"Server\"][\"Create\"] {\n  return {\n    primary_email: options.primaryEmail,\n    password: options.password,\n    otp_auth_enabled: options.otpAuthEnabled,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    display_name: options.displayName,\n    primary_email_verified: options.primaryEmailVerified,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n  };\n}\n"],"mappings":";AAQA,SAAS,oBAAoB;AAe7B,IAAM,yBAAyB;AAExB,SAAS,2BAA2B,QAAsB;AAC/D,QAAM,aAAa,OAAO,yBAAyB,QAAQ,MAAM;AACjE,MAAI,YAAY,QAAQ,aAAa;AACnC;AAAA,EACF;AAEA,SAAO,eAAe,QAAQ,QAAQ;AAAA,IACpC,KAAK;AAAA,IACL,cAAc;AAAA,IACd,YAAY;AAAA,EACd,CAAC;AACH;AAEA,SAAS,cAAqB;AAC5B,QAAM,IAAI,MAAM,sBAAsB;AACxC;AA6NO,SAAS,wBAAwB,SAAiE;AACvG,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,QAAQ;AAAA,IAC1B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,qBAAqB,IAAI,QAAQ;AAAA,IAClH,mBAAmB,QAAQ;AAAA,IAC3B,kBAAkB,QAAQ;AAAA,IAC1B,sBAAsB,QAAQ;AAAA,EAChC;AACF;AA0EO,SAAS,8BAA8B,SAAuE;AACnH,SAAO;AAAA,IACL,cAAc,QAAQ;AAAA,IACtB,eAAe,QAAQ;AAAA,IACvB,iBAAiB,QAAQ;AAAA,IACzB,2BAA2B,QAAQ;AAAA,IACnC,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,QAAQ;AAAA,IAC1B,4BAA4B,QAAQ;AAAA,IACpC,wBAAwB,QAAQ;AAAA,IAChC,UAAU,QAAQ;AAAA,IAClB,mBAAmB,QAAQ;AAAA,IAC3B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,qBAAqB,IAAI,QAAQ;AAAA,EACpH;AACF;AAcO,SAAS,8BAA8B,SAAiE;AAC7G,SAAO;AAAA,IACL,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,IAClB,kBAAkB,QAAQ;AAAA,IAC1B,4BAA4B,QAAQ;AAAA,IACpC,cAAc,QAAQ;AAAA,IACtB,wBAAwB,QAAQ;AAAA,IAChC,iBAAiB,QAAQ;AAAA,IACzB,2BAA2B,QAAQ;AAAA,IACnC,iBAAiB,QAAQ;AAAA,EAC3B;AACF;","names":[]}

package/dist/index.d.mts

@@ -87,6 +87,89 @@ type HandlerUrls = {
 type OAuthScopesOnSignIn = {
     [key in ProviderType]: string[];
 };
+/**
+ * Contains the authentication methods without session-related fields.
+ * Used for apps that have token storage capabilities.
+ */
+type AuthLike<ExtraOptions = {}> = {
+    signOut(options?: {
+        redirectUrl?: URL | string;
+    } & ExtraOptions): Promise<void>;
+    signOut(options?: {
+        redirectUrl?: URL | string;
+    }): Promise<void>;
+    /**
+     * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin
+     * requests. Similar to `getAuthJson`, but specifically for HTTP requests.
+     *
+     * If you are using `tokenStore: "cookie"`, you don't need this for same-origin requests. However, most
+     * browsers now disable third-party cookies by default, so we must pass authentication tokens by header instead
+     * if the client and server are on different origins.
+     *
+     * This function returns a header object that can be used with `fetch` or other HTTP request libraries to send
+     * authenticated requests.
+     *
+     * On the server, you can then pass in the `Request` object to the `tokenStore` option
+     * of your Stack app. Please note that CORS does not allow most headers by default, so you
+     * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
+     * of the CORS preflight response.
+     *
+     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function
+     * instead.
+     *
+     * Example:
+     *
+     * ```ts
+     * // client
+     * const res = await fetch("https://api.example.com", {
+     *   headers: {
+     *     ...await stackApp.getAuthHeaders()
+     *     // you can also add your own headers here
+     *   },
+     * });
+     *
+     * // server
+     * function handleRequest(req: Request) {
+     *   const user = await stackServerApp.getUser({ tokenStore: req });
+     *   return new Response("Welcome, " + user.displayName);
+     * }
+     * ```
+     */
+    getAuthHeaders(options?: {} & ExtraOptions): Promise<{
+        "x-stack-auth": string;
+    }>;
+    /**
+     * Creates a JSON-serializable object containing the information to authenticate a user on an external server.
+     * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just
+     * HTTP headers.
+     *
+     * While `getAuthHeaders` is the recommended way to send authentication tokens over HTTP, your app may use
+     * a different protocol, for example WebSockets or gRPC. This function returns a token object that can be JSON-serialized and sent to the server in any way you like.
+     *
+     * On the server, you can pass in this token object into the `tokenStore` option to fetch user details.
+     *
+     * Example:
+     *
+     * ```ts
+     * // client
+     * const res = await rpcCall(rpcEndpoint, {
+     *   data: {
+     *     auth: await stackApp.getAuthJson(),
+     *   },
+     * });
+     *
+     * // server
+     * function handleRequest(data) {
+     *   const user = await stackServerApp.getUser({ tokenStore: data.auth });
+     *   return new Response("Welcome, " + user.displayName);
+     * }
+     * ```
+     */
+    getAuthJson(options?: {} & ExtraOptions): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+    }>;
+};
 /** @internal */
 declare const stackAppInternalsSymbol: unique symbol;
 
@@ -402,86 +485,9 @@ type Session = {
 /**
  * Contains everything related to the current user session.
  */
-type Auth = {
+type Auth = AuthLike<{}> & {
     readonly _internalSession: InternalSession;
     readonly currentSession: Session;
-    signOut(options?: {
-        redirectUrl?: URL | string;
-    }): Promise<void>;
-    /**
-     * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin
-     * requests. Similar to `getAuthJson`, but specifically for HTTP requests.
-     *
-     * If you are using `tokenStore: "cookie"`, you don't need this for same-origin requests. However, most
-     * browsers now disable third-party cookies by default, so we must pass authentication tokens by header instead
-     * if the client and server are on different origins.
-     *
-     * This function returns a header object that can be used with `fetch` or other HTTP request libraries to send
-     * authenticated requests.
-     *
-     * On the server, you can then pass in the `Request` object to the `tokenStore` option
-     * of your Stack app. Please note that CORS does not allow most headers by default, so you
-     * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
-     * of the CORS preflight response.
-     *
-     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function
-     * instead.
-     *
-     * Example:
-     *
-     * ```ts
-     * // client
-     * const res = await fetch("https://api.example.com", {
-     *   headers: {
-     *     ...await stackApp.getAuthHeaders()
-     *     // you can also add your own headers here
-     *   },
-     * });
-     *
-     * // server
-     * function handleRequest(req: Request) {
-     *   const user = await stackServerApp.getUser({ tokenStore: req });
-     *   return new Response("Welcome, " + user.displayName);
-     * }
-     * ```
-     */
-    getAuthHeaders(): Promise<{
-        "x-stack-auth": string;
-    }>;
-    /**
-     * Creates a JSON-serializable object containing the information to authenticate a user on an external server.
-     * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just
-     * HTTP headers.
-     *
-     * While `getAuthHeaders` is the recommended way to send authentication tokens over HTTP, your app may use
-     * a different protocol, for example WebSockets or gRPC. This function returns a token object that can be JSON-serialized and sent to the server in any way you like.
-     *
-     * On the server, you can pass in this token object into the `tokenStore` option to fetch user details.
-     *
-     * Example:
-     *
-     * ```ts
-     * // client
-     * const res = await rpcCall(rpcEndpoint, {
-     *   data: {
-     *     auth: await stackApp.getAuthJson(),
-     *   },
-     * });
-     *
-     * // server
-     * function handleRequest(data) {
-     *   const user = await stackServerApp.getUser({ tokenStore: data.auth });
-     *   return new Response("Welcome, " + user.displayName);
-     * }
-     * ```
-     */
-    getAuthJson(): Promise<{
-        accessToken: string | null;
-        refreshToken: string | null;
-    }>;
-    registerPasskey(options?: {
-        hostname?: string;
-    }): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>>;
 };
 /**
  * ```
@@ -587,6 +593,9 @@ type UserExtra = {
     createApiKey(options: ApiKeyCreationOptions<"user">): Promise<UserApiKeyFirstView>;
     listOAuthProviders(): Promise<OAuthProvider[]>;
     getOAuthProvider(id: string): Promise<OAuthProvider | null>;
+    registerPasskey(options?: {
+        hostname?: string;
+    }): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>>;
 } & AsyncStoreProperty<"apiKeys", [], UserApiKey[], true> & AsyncStoreProperty<"team", [id: string], Team | null, false> & AsyncStoreProperty<"teams", [], Team[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
     recursive?: boolean;
 }], TeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
@@ -910,6 +919,11 @@ type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends st
     }): Promise<Result<undefined, {
         errorMessage: string;
     }>>;
+    sendTestWebhook(options: {
+        endpointId: string;
+    }): Promise<Result<undefined, {
+        errorMessage: string;
+    }>>;
     sendSignInInvitationEmail(email: string, callbackUrl: string): Promise<void>;
     listSentEmails(): Promise<AdminSentEmail[]>;
     createEmailTheme(displayName: string): Promise<{
@@ -1242,7 +1256,11 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
     options: CustomerProductsRequestOptions
 ], CustomerProductsList, true> & {
     [K in `redirectTo${Capitalize<keyof Omit<HandlerUrls, 'handler' | 'oauthCallback'>>}`]: (options?: RedirectToOptions) => Promise<void>;
-});
+} & AuthLike<HasTokenStore extends false ? {
+    tokenStore: TokenStoreInit;
+} : {
+    tokenStore?: TokenStoreInit;
+}>);
 declare const StackClientApp: StackClientAppConstructor;
 
 declare function getConvexProvidersConfig(options: {

package/dist/index.d.ts

@@ -87,6 +87,89 @@ type HandlerUrls = {
 type OAuthScopesOnSignIn = {
     [key in ProviderType]: string[];
 };
+/**
+ * Contains the authentication methods without session-related fields.
+ * Used for apps that have token storage capabilities.
+ */
+type AuthLike<ExtraOptions = {}> = {
+    signOut(options?: {
+        redirectUrl?: URL | string;
+    } & ExtraOptions): Promise<void>;
+    signOut(options?: {
+        redirectUrl?: URL | string;
+    }): Promise<void>;
+    /**
+     * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin
+     * requests. Similar to `getAuthJson`, but specifically for HTTP requests.
+     *
+     * If you are using `tokenStore: "cookie"`, you don't need this for same-origin requests. However, most
+     * browsers now disable third-party cookies by default, so we must pass authentication tokens by header instead
+     * if the client and server are on different origins.
+     *
+     * This function returns a header object that can be used with `fetch` or other HTTP request libraries to send
+     * authenticated requests.
+     *
+     * On the server, you can then pass in the `Request` object to the `tokenStore` option
+     * of your Stack app. Please note that CORS does not allow most headers by default, so you
+     * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
+     * of the CORS preflight response.
+     *
+     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function
+     * instead.
+     *
+     * Example:
+     *
+     * ```ts
+     * // client
+     * const res = await fetch("https://api.example.com", {
+     *   headers: {
+     *     ...await stackApp.getAuthHeaders()
+     *     // you can also add your own headers here
+     *   },
+     * });
+     *
+     * // server
+     * function handleRequest(req: Request) {
+     *   const user = await stackServerApp.getUser({ tokenStore: req });
+     *   return new Response("Welcome, " + user.displayName);
+     * }
+     * ```
+     */
+    getAuthHeaders(options?: {} & ExtraOptions): Promise<{
+        "x-stack-auth": string;
+    }>;
+    /**
+     * Creates a JSON-serializable object containing the information to authenticate a user on an external server.
+     * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just
+     * HTTP headers.
+     *
+     * While `getAuthHeaders` is the recommended way to send authentication tokens over HTTP, your app may use
+     * a different protocol, for example WebSockets or gRPC. This function returns a token object that can be JSON-serialized and sent to the server in any way you like.
+     *
+     * On the server, you can pass in this token object into the `tokenStore` option to fetch user details.
+     *
+     * Example:
+     *
+     * ```ts
+     * // client
+     * const res = await rpcCall(rpcEndpoint, {
+     *   data: {
+     *     auth: await stackApp.getAuthJson(),
+     *   },
+     * });
+     *
+     * // server
+     * function handleRequest(data) {
+     *   const user = await stackServerApp.getUser({ tokenStore: data.auth });
+     *   return new Response("Welcome, " + user.displayName);
+     * }
+     * ```
+     */
+    getAuthJson(options?: {} & ExtraOptions): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+    }>;
+};
 /** @internal */
 declare const stackAppInternalsSymbol: unique symbol;
 
@@ -402,86 +485,9 @@ type Session = {
 /**
  * Contains everything related to the current user session.
  */
-type Auth = {
+type Auth = AuthLike<{}> & {
     readonly _internalSession: InternalSession;
     readonly currentSession: Session;
-    signOut(options?: {
-        redirectUrl?: URL | string;
-    }): Promise<void>;
-    /**
-     * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin
-     * requests. Similar to `getAuthJson`, but specifically for HTTP requests.
-     *
-     * If you are using `tokenStore: "cookie"`, you don't need this for same-origin requests. However, most
-     * browsers now disable third-party cookies by default, so we must pass authentication tokens by header instead
-     * if the client and server are on different origins.
-     *
-     * This function returns a header object that can be used with `fetch` or other HTTP request libraries to send
-     * authenticated requests.
-     *
-     * On the server, you can then pass in the `Request` object to the `tokenStore` option
-     * of your Stack app. Please note that CORS does not allow most headers by default, so you
-     * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
-     * of the CORS preflight response.
-     *
-     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function
-     * instead.
-     *
-     * Example:
-     *
-     * ```ts
-     * // client
-     * const res = await fetch("https://api.example.com", {
-     *   headers: {
-     *     ...await stackApp.getAuthHeaders()
-     *     // you can also add your own headers here
-     *   },
-     * });
-     *
-     * // server
-     * function handleRequest(req: Request) {
-     *   const user = await stackServerApp.getUser({ tokenStore: req });
-     *   return new Response("Welcome, " + user.displayName);
-     * }
-     * ```
-     */
-    getAuthHeaders(): Promise<{
-        "x-stack-auth": string;
-    }>;
-    /**
-     * Creates a JSON-serializable object containing the information to authenticate a user on an external server.
-     * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just
-     * HTTP headers.
-     *
-     * While `getAuthHeaders` is the recommended way to send authentication tokens over HTTP, your app may use
-     * a different protocol, for example WebSockets or gRPC. This function returns a token object that can be JSON-serialized and sent to the server in any way you like.
-     *
-     * On the server, you can pass in this token object into the `tokenStore` option to fetch user details.
-     *
-     * Example:
-     *
-     * ```ts
-     * // client
-     * const res = await rpcCall(rpcEndpoint, {
-     *   data: {
-     *     auth: await stackApp.getAuthJson(),
-     *   },
-     * });
-     *
-     * // server
-     * function handleRequest(data) {
-     *   const user = await stackServerApp.getUser({ tokenStore: data.auth });
-     *   return new Response("Welcome, " + user.displayName);
-     * }
-     * ```
-     */
-    getAuthJson(): Promise<{
-        accessToken: string | null;
-        refreshToken: string | null;
-    }>;
-    registerPasskey(options?: {
-        hostname?: string;
-    }): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>>;
 };
 /**
  * ```
@@ -587,6 +593,9 @@ type UserExtra = {
     createApiKey(options: ApiKeyCreationOptions<"user">): Promise<UserApiKeyFirstView>;
     listOAuthProviders(): Promise<OAuthProvider[]>;
     getOAuthProvider(id: string): Promise<OAuthProvider | null>;
+    registerPasskey(options?: {
+        hostname?: string;
+    }): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>>;
 } & AsyncStoreProperty<"apiKeys", [], UserApiKey[], true> & AsyncStoreProperty<"team", [id: string], Team | null, false> & AsyncStoreProperty<"teams", [], Team[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
     recursive?: boolean;
 }], TeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
@@ -910,6 +919,11 @@ type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends st
     }): Promise<Result<undefined, {
         errorMessage: string;
     }>>;
+    sendTestWebhook(options: {
+        endpointId: string;
+    }): Promise<Result<undefined, {
+        errorMessage: string;
+    }>>;
     sendSignInInvitationEmail(email: string, callbackUrl: string): Promise<void>;
     listSentEmails(): Promise<AdminSentEmail[]>;
     createEmailTheme(displayName: string): Promise<{
@@ -1242,7 +1256,11 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
     options: CustomerProductsRequestOptions
 ], CustomerProductsList, true> & {
     [K in `redirectTo${Capitalize<keyof Omit<HandlerUrls, 'handler' | 'oauthCallback'>>}`]: (options?: RedirectToOptions) => Promise<void>;
-});
+} & AuthLike<HasTokenStore extends false ? {
+    tokenStore: TokenStoreInit;
+} : {
+    tokenStore?: TokenStoreInit;
+}>);
 declare const StackClientApp: StackClientAppConstructor;
 
 declare function getConvexProvidersConfig(options: {

package/dist/lib/cookie.js

@@ -36,8 +36,10 @@ __export(cookie_exports, {
   createPlaceholderCookieHelper: () => createPlaceholderCookieHelper,
   deleteCookie: () => deleteCookie,
   deleteCookieClient: () => deleteCookieClient,
+  getAllCookiesClient: () => getAllCookiesClient,
   getCookie: () => getCookie,
   getCookieClient: () => getCookieClient,
+  isSecure: () => isSecure,
   saveVerifierAndState: () => saveVerifierAndState,
   setCookie: () => setCookie,
   setCookieClient: () => setCookieClient,
@@ -60,6 +62,7 @@ async function createPlaceholderCookieHelper() {
   }
   return {
     get: throwError,
+    getAll: throwError,
     set: throwError,
     setOrDelete: throwError,
     delete: throwError
@@ -75,26 +78,54 @@ async function createCookieHelper() {
 function createBrowserCookieHelper() {
   return {
     get: getCookieClient,
+    getAll: getAllCookiesClient,
     set: setCookieClient,
     setOrDelete: setOrDeleteCookieClient,
     delete: deleteCookieClient
   };
 }
 function getCookieClient(name) {
+  const all = getAllCookiesClient();
+  return all[name] ?? null;
+}
+function getAllCookiesClient() {
   ensureClient();
   import_js_cookie.default.set("stack-is-https", "true", { secure: true });
-  return import_js_cookie.default.get(name) ?? null;
+  return import_js_cookie.default.get();
 }
 async function getCookie(name) {
   const cookieHelper = await createCookieHelper();
   return cookieHelper.get(name);
 }
+async function isSecure() {
+  if ((0, import_env.isBrowserLike)()) {
+    return determineSecureFromClientContext();
+  }
+  return false;
+}
+function determineSecureFromClientContext() {
+  return typeof window !== "undefined" && window.location.protocol === "https:";
+}
+function setCookieClientInternal(name, value, options = {}) {
+  const secure = options.secure ?? determineSecureFromClientContext();
+  import_js_cookie.default.set(name, value, {
+    expires: options.maxAge === void 0 ? void 0 : new Date(Date.now() + options.maxAge * 1e3),
+    domain: options.domain,
+    secure
+  });
+}
+function deleteCookieClientInternal(name, options = {}) {
+  if (options.domain !== void 0) {
+    import_js_cookie.default.remove(name, { domain: options.domain });
+  }
+  import_js_cookie.default.remove(name);
+}
 function setOrDeleteCookieClient(name, value, options = {}) {
   ensureClient();
   if (value === null) {
-    deleteCookieClient(name, options);
+    deleteCookieClientInternal(name, options);
   } else {
-    setCookieClient(name, value, options);
+    setCookieClientInternal(name, value, options);
   }
 }
 async function setOrDeleteCookie(name, value, options = {}) {
@@ -103,7 +134,7 @@ async function setOrDeleteCookie(name, value, options = {}) {
 }
 function deleteCookieClient(name, options = {}) {
   ensureClient();
-  import_js_cookie.default.remove(name);
+  deleteCookieClientInternal(name, options);
 }
 async function deleteCookie(name, options = {}) {
   const cookieHelper = await createCookieHelper();
@@ -111,9 +142,7 @@ async function deleteCookie(name, options = {}) {
 }
 function setCookieClient(name, value, options = {}) {
   ensureClient();
-  import_js_cookie.default.set(name, value, {
-    expires: options.maxAge === void 0 ? void 0 : new Date(Date.now() + options.maxAge * 1e3)
-  });
+  setCookieClientInternal(name, value, options);
 }
 async function setCookie(name, value, options = {}) {
   const cookieHelper = await createCookieHelper();
@@ -149,8 +178,10 @@ function consumeVerifierAndStateCookie(state) {
   createPlaceholderCookieHelper,
   deleteCookie,
   deleteCookieClient,
+  getAllCookiesClient,
   getCookie,
   getCookieClient,
+  isSecure,
   saveVerifierAndState,
   setCookie,
   setCookieClient,