@stackframe/js 2.8.54 → 2.8.58

package/dist/index.d.ts

@@ -37,6 +37,15 @@ type RedirectMethod = "window" | "none" | {
 };
 type GetCurrentUserOptions<HasTokenStore> = {
     or?: 'redirect' | 'throw' | 'return-null' | 'anonymous' | /** @deprecated */ 'anonymous-if-exists[deprecated]';
+    /**
+     * Whether to include restricted users (users who haven't completed onboarding requirements like email verification).
+     * By default, restricted users are filtered out (treated similar to anonymous users).
+     *
+     * Note: This option cannot be set to false when `or: 'anonymous'` is used, as all anonymous users are also restricted.
+     *
+     * @default false
+     */
+    includeRestricted?: boolean;
     tokenStore?: TokenStoreInit;
 } & (HasTokenStore extends false ? {
     tokenStore: TokenStoreInit;
@@ -84,6 +93,7 @@ type HandlerUrls = {
     teamInvitation: string;
     mfa: string;
     error: string;
+    onboarding: string;
 };
 type OAuthScopesOnSignIn = {
     [key in ProviderType]: string[];
@@ -99,6 +109,20 @@ type AuthLike<ExtraOptions = {}> = {
     signOut(options?: {
         redirectUrl?: URL | string;
     }): Promise<void>;
+    /**
+     * Returns the current access token, or null if the user is not signed in.
+     *
+     * The access token is a short-lived JWT that can be used to authenticate requests to external servers.
+     * It will be automatically refreshed when it expires.
+     */
+    getAccessToken(options?: {} & ExtraOptions): Promise<string | null>;
+    /**
+     * Returns the current refresh token, or null if the user is not signed in.
+     *
+     * The refresh token is a long-lived token that can be used to obtain new access tokens.
+     * It should be kept secret and never exposed to the client.
+     */
+    getRefreshToken(options?: {} & ExtraOptions): Promise<string | null>;
     /**
      * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin
      * requests. Similar to `getAuthJson`, but specifically for HTTP requests.
@@ -115,8 +139,8 @@ type AuthLike<ExtraOptions = {}> = {
      * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
      * of the CORS preflight response.
      *
-     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function
-     * instead.
+     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAccessToken()` and
+     * `getRefreshToken()` functions instead.
      *
      * Example:
      *
@@ -140,6 +164,8 @@ type AuthLike<ExtraOptions = {}> = {
         "x-stack-auth": string;
     }>;
     /**
+     * @deprecated Use `getAccessToken()` and `getRefreshToken()` instead.
+     *
      * Creates a JSON-serializable object containing the information to authenticate a user on an external server.
      * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just
      * HTTP headers.
@@ -254,6 +280,137 @@ type AdminSentEmail = {
     sentAt: Date;
     error?: unknown;
 };
+type AdminEmailOutboxRecipient = {
+    type: "user-primary-email";
+    userId: string;
+} | {
+    type: "user-custom-emails";
+    userId: string;
+    emails: string[];
+} | {
+    type: "custom-emails";
+    emails: string[];
+};
+type AdminEmailOutboxStatus = "paused" | "preparing" | "rendering" | "render-error" | "scheduled" | "queued" | "sending" | "server-error" | "skipped" | "bounced" | "delivery-delayed" | "sent" | "opened" | "clicked" | "marked-as-spam";
+type AdminEmailOutboxSimpleStatus = "in-progress" | "ok" | "error";
+type AdminEmailOutboxBase = {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    to: AdminEmailOutboxRecipient;
+    scheduledAt: Date;
+    isPaused: false;
+    hasRendered: false;
+    hasDelivered: false;
+};
+type AdminEmailOutboxRenderedFields = Omit<AdminEmailOutboxBase, "hasRendered"> & {
+    hasRendered: true;
+    startedRenderingAt: Date;
+    renderedAt: Date;
+    subject: string;
+    html: string | null;
+    text: string | null;
+    isTransactional: boolean;
+    isHighPriority: boolean;
+    notificationCategoryId: string | null;
+};
+type AdminEmailOutboxStartedSendingFields = AdminEmailOutboxRenderedFields & {
+    startedSendingAt: Date;
+};
+type AdminEmailOutboxFinishedDeliveringFields = Omit<AdminEmailOutboxStartedSendingFields, "hasDelivered"> & {
+    hasDelivered: true;
+    deliveredAt: Date;
+};
+type AdminEmailOutboxPaused = Omit<AdminEmailOutboxBase, "isPaused"> & {
+    status: "paused";
+    simpleStatus: "in-progress";
+    isPaused: true;
+};
+type AdminEmailOutboxPreparing = AdminEmailOutboxBase & {
+    status: "preparing";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxRendering = AdminEmailOutboxBase & {
+    status: "rendering";
+    simpleStatus: "in-progress";
+    startedRenderingAt: Date;
+};
+type AdminEmailOutboxRenderError = AdminEmailOutboxBase & {
+    status: "render-error";
+    simpleStatus: "error";
+    startedRenderingAt: Date;
+    renderedAt: Date;
+    renderError: string;
+};
+type AdminEmailOutboxScheduled = AdminEmailOutboxRenderedFields & {
+    status: "scheduled";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxQueued = AdminEmailOutboxRenderedFields & {
+    status: "queued";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxSending = AdminEmailOutboxStartedSendingFields & {
+    status: "sending";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxServerError = AdminEmailOutboxStartedSendingFields & {
+    status: "server-error";
+    simpleStatus: "error";
+    errorAt: Date;
+    serverError: string;
+};
+type AdminEmailOutboxSkipped = Omit<AdminEmailOutboxBase, "hasRendered"> & {
+    status: "skipped";
+    simpleStatus: "ok";
+    hasRendered: boolean;
+    skippedAt: Date;
+    skippedReason: string;
+    skippedDetails: Record<string, unknown>;
+    startedRenderingAt?: Date;
+    renderedAt?: Date;
+    subject?: string;
+    html?: string | null;
+    text?: string | null;
+    isTransactional?: boolean;
+    isHighPriority?: boolean;
+    notificationCategoryId?: string | null;
+    startedSendingAt?: Date;
+};
+type AdminEmailOutboxBounced = AdminEmailOutboxStartedSendingFields & {
+    status: "bounced";
+    simpleStatus: "error";
+    bouncedAt: Date;
+};
+type AdminEmailOutboxDeliveryDelayed = AdminEmailOutboxStartedSendingFields & {
+    status: "delivery-delayed";
+    simpleStatus: "ok";
+    deliveryDelayedAt: Date;
+};
+type AdminEmailOutboxSent = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "sent";
+    simpleStatus: "ok";
+    canHaveDeliveryInfo: boolean;
+};
+type AdminEmailOutboxOpened = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "opened";
+    simpleStatus: "ok";
+    openedAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutboxClicked = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "clicked";
+    simpleStatus: "ok";
+    clickedAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutboxMarkedAsSpam = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "marked-as-spam";
+    simpleStatus: "ok";
+    markedAsSpamAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutbox = AdminEmailOutboxPaused | AdminEmailOutboxPreparing | AdminEmailOutboxRendering | AdminEmailOutboxRenderError | AdminEmailOutboxScheduled | AdminEmailOutboxQueued | AdminEmailOutboxSending | AdminEmailOutboxServerError | AdminEmailOutboxSkipped | AdminEmailOutboxBounced | AdminEmailOutboxDeliveryDelayed | AdminEmailOutboxSent | AdminEmailOutboxOpened | AdminEmailOutboxClicked | AdminEmailOutboxMarkedAsSpam;
 type SendEmailOptionsBase = {
     themeId?: string | null | false;
     subject?: string;
@@ -278,6 +435,25 @@ type SendEmailOptions = SendEmailOptionsBase & XOR<[
         draftId: string;
     }
 ]>;
+type EmailDeliveryWindowStats = {
+    sent: number;
+    bounced: number;
+    marked_as_spam: number;
+};
+type EmailDeliveryStats = {
+    hour: EmailDeliveryWindowStats;
+    day: EmailDeliveryWindowStats;
+    week: EmailDeliveryWindowStats;
+    month: EmailDeliveryWindowStats;
+};
+type EmailDeliveryCapacity = {
+    rate_per_second: number;
+    penalty_factor: number;
+};
+type EmailDeliveryInfo = {
+    stats: EmailDeliveryStats;
+    capacity: EmailDeliveryCapacity;
+};
 
 type InternalApiKeyBase = {
     id: string;
@@ -477,18 +653,17 @@ type ServerOAuthProvider = {
     }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
     delete(): Promise<void>;
 };
-type Session = {
-    getTokens(): Promise<{
-        accessToken: string | null;
-        refreshToken: string | null;
-    }>;
-};
 /**
  * Contains everything related to the current user session.
  */
 type Auth = AuthLike<{}> & {
     readonly _internalSession: InternalSession;
-    readonly currentSession: Session;
+    readonly currentSession: {
+        getTokens(): Promise<{
+            accessToken: string | null;
+            refreshToken: string | null;
+        }>;
+    };
 };
 /**
  * ```
@@ -534,6 +709,18 @@ type BaseUser = {
     readonly passkeyAuthEnabled: boolean;
     readonly isMultiFactorRequired: boolean;
     readonly isAnonymous: boolean;
+    /**
+     * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).
+     * For example, if email verification is required but the user hasn't verified their email yet.
+     */
+    readonly isRestricted: boolean;
+    /**
+     * The reason why the user is restricted, e.g., { type: "email_not_verified" } or { type: "anonymous" }.
+     * Null if the user is not restricted.
+     */
+    readonly restrictedReason: {
+        type: "anonymous" | "email_not_verified";
+    } | null;
     toClientJson(): CurrentUserCrud["Client"]["Read"];
     /**
      * @deprecated, use contact channel's usedForAuth instead
@@ -547,7 +734,7 @@ type BaseUser = {
     }[];
 };
 type UserExtra = {
-    setDisplayName(displayName: string): Promise<void>;
+    setDisplayName(displayName: string | null): Promise<void>;
     /** @deprecated Use contact channel's sendVerificationEmail instead */
     sendVerificationEmail(): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
     setClientMetadata(metadata: any): Promise<void>;
@@ -585,7 +772,7 @@ type UserExtra = {
         recursive?: boolean;
     }): Promise<TeamPermission[]>;
     readonly selectedTeam: Team | null;
-    setSelectedTeam(team: Team | null): Promise<void>;
+    setSelectedTeam(teamOrId: string | Team | null): Promise<void>;
     createTeam(data: TeamCreateOptions): Promise<Team>;
     leaveTeam(team: Team): Promise<void>;
     getActiveSessions(): Promise<ActiveSession[]>;
@@ -610,8 +797,8 @@ type User = BaseUser;
 type CurrentUser = BaseUser & Auth & UserExtra & Customer;
 type CurrentInternalUser = CurrentUser & InternalUserExtra;
 type ProjectCurrentUser<ProjectId> = ProjectId extends "internal" ? CurrentInternalUser : CurrentUser;
-type TokenPartialUser = Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "isAnonymous">;
-type SyncedPartialUser = TokenPartialUser & Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "profileImageUrl" | "signedUpAt" | "clientMetadata" | "clientReadOnlyMetadata" | "isAnonymous" | "hasPassword">;
+type TokenPartialUser = Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "isAnonymous" | "isRestricted" | "restrictedReason">;
+type SyncedPartialUser = TokenPartialUser & Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "profileImageUrl" | "signedUpAt" | "clientMetadata" | "clientReadOnlyMetadata" | "isAnonymous" | "hasPassword" | "isRestricted" | "restrictedReason">;
 type ActiveSession = {
     id: string;
     userId: string;
@@ -622,13 +809,14 @@ type ActiveSession = {
     geoInfo?: GeoInfo;
 };
 type UserUpdateOptions = {
-    displayName?: string;
+    displayName?: string | null;
     clientMetadata?: ReadonlyJson;
     selectedTeamId?: string | null;
     totpMultiFactorSecret?: Uint8Array | null;
     profileImageUrl?: string | null;
     otpAuthEnabled?: boolean;
     passkeyAuthEnabled?: boolean;
+    primaryEmail?: string | null;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string | null, options?: {
@@ -664,7 +852,12 @@ type ServerBaseUser = {
     createSession(options?: {
         expiresInMillis?: number;
         isImpersonation?: boolean;
-    }): Promise<Session>;
+    }): Promise<{
+        getTokens(): Promise<{
+            accessToken: string | null;
+            refreshToken: string | null;
+        }>;
+    }>;
 } & AsyncStoreProperty<"team", [id: string], ServerTeam | null, false> & AsyncStoreProperty<"teams", [], ServerTeam[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
     direct?: boolean;
 }], AdminTeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
@@ -768,6 +961,15 @@ type ServerListUsersOptions = {
     orderBy?: 'signedUpAt';
     desc?: boolean;
     query?: string;
+    /**
+     * Whether to include restricted users (users who haven't completed onboarding requirements).
+     * Defaults to false.
+     */
+    includeRestricted?: boolean;
+    /**
+     * Whether to include anonymous users (and restricted users).
+     * Defaults to false.
+     */
     includeAnonymous?: boolean;
 };
 type ServerTeamCreateOptions = TeamCreateOptions & {
@@ -848,6 +1050,7 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         allowConnectedAccounts: boolean;
     }): Promise<Result<ServerOAuthProvider, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
     sendEmail(options: SendEmailOptions): Promise<void>;
+    getEmailDeliveryStats(): Promise<EmailDeliveryInfo>;
 } & AsyncStoreProperty<"user", [id: string], ServerUser | null, false> & Omit<AsyncStoreProperty<"users", [], ServerUser[], true>, "listUsers" | "useUsers"> & AsyncStoreProperty<"teams", [], ServerTeam[], true> & AsyncStoreProperty<"dataVaultStore", [id: string], DataVaultStore, false> & AsyncStoreProperty<"item", [
     {
         itemId: string;
@@ -864,6 +1067,21 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
 ], CustomerProductsList, true> & StackClientApp<HasTokenStore, ProjectId>);
 declare const StackServerApp: StackServerAppConstructor;
 
+type EmailOutboxListOptions = {
+    status?: string;
+    simpleStatus?: string;
+    limit?: number;
+    cursor?: string;
+};
+type EmailOutboxListResult = {
+    items: AdminEmailOutbox[];
+    nextCursor: string | null;
+};
+type EmailOutboxUpdateOptions = {
+    isPaused?: boolean;
+    scheduledAtMillis?: number;
+    cancel?: boolean;
+};
 type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = (StackServerAppConstructorOptions<HasTokenStore, ProjectId> & {
     superSecretAdminKey?: string;
     projectOwnerSession?: InternalSession;
@@ -988,6 +1206,12 @@ type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends st
         type: "subscription" | "one-time-purchase";
         id: string;
     }): Promise<void>;
+    listOutboxEmails(options?: EmailOutboxListOptions): Promise<EmailOutboxListResult>;
+    getOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    updateOutboxEmail(id: string, options: EmailOutboxUpdateOptions): Promise<AdminEmailOutbox>;
+    pauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    unpauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    cancelOutboxEmail(id: string): Promise<AdminEmailOutbox>;
 } & StackServerApp<HasTokenStore, ProjectId>);
 declare const StackAdminApp: StackAdminAppConstructor;
 
@@ -1005,6 +1229,9 @@ type ProjectConfig = {
 type OAuthProviderConfig = {
     readonly id: string;
 };
+/**
+ * @deprecated This type is deprecated. Use the new config override setup instead.
+ */
 type AdminProjectConfig = {
     readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
@@ -1238,6 +1465,12 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         or: 'anonymous';
     }): Promise<ProjectCurrentUser<ProjectId>>;
     getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentUser<ProjectId> | null>;
+    cancelSubscription(options: {
+        productId: string;
+    } | {
+        productId: string;
+        teamId: string;
+    }): Promise<void>;
     getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
         from: 'token';
     }): Promise<TokenPartialUser | null>;
@@ -1274,4 +1507,4 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
 }>);
 declare const StackClientApp: StackClientAppConstructor;
 
-export { type AdminDomainConfig, type AdminEmailConfig, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectUpdateOptions, type AdminSentEmail, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type Auth, type Connection, type ContactChannel, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrls, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, type Project, type ProjectConfig, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, type Session, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamInvitation, type TeamMemberProfile, type TeamUpdateOptions, type TeamUser, type User, stackAppInternalsSymbol };
+export { type AdminDomainConfig, type AdminEmailConfig, type AdminEmailOutbox, type AdminEmailOutboxRecipient, type AdminEmailOutboxSimpleStatus, type AdminEmailOutboxStatus, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectUpdateOptions, type AdminSentEmail, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type Auth, type Connection, type ContactChannel, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type EmailOutboxListOptions, type EmailOutboxListResult, type EmailOutboxUpdateOptions, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrls, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, type Project, type ProjectConfig, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamInvitation, type TeamMemberProfile, type TeamUpdateOptions, type TeamUser, type User, stackAppInternalsSymbol };

package/dist/lib/cookie.js

@@ -90,7 +90,7 @@ function getCookieClient(name) {
 }
 function getAllCookiesClient() {
   ensureClient();
-  import_js_cookie.default.set("stack-is-https", "true", { secure: true });
+  import_js_cookie.default.set("stack-is-https", "true", { secure: true, expires: new Date(Date.now() + 1e3 * 60 * 60 * 24 * 365) });
   return import_js_cookie.default.get();
 }
 async function getCookie(name) {
@@ -106,21 +106,56 @@ async function isSecure() {
 function determineSecureFromClientContext() {
   return typeof window !== "undefined" && window.location.protocol === "https:";
 }
-function setCookieClientInternal(name, value, options = {}) {
+var _shouldSetPartitionedClientCache = void 0;
+function shouldSetPartitionedClient() {
+  return _shouldSetPartitionedClientCache ??= _internalShouldSetPartitionedClient();
+}
+function _internalShouldSetPartitionedClient() {
+  ensureClient();
+  if (!determineSecureFromClientContext()) {
+    return false;
+  }
+  const cookie1Name = "__Host-stack-temporary-chips-test-" + Math.random().toString(36).substring(2, 15);
+  document.cookie = `${cookie1Name}=value1; Secure; path=/`;
+  const cookies1 = document.cookie.split("; ");
+  document.cookie = `${cookie1Name}=delete1; Secure; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC;`;
+  if (cookies1.some((c) => c.startsWith(cookie1Name + "="))) {
+    return false;
+  }
+  const cookie2Name = "__Host-stack-temporary-chips-test-" + Math.random().toString(36).substring(2, 15);
+  document.cookie = `${cookie2Name}=delete1; Secure; SameSite=None; Partitioned; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;
+  document.cookie = `${cookie2Name}=delete2; Secure; SameSite=None; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;
+  document.cookie = `${cookie2Name}=set1; Secure; SameSite=None; Partitioned; path=/`;
+  document.cookie = `${cookie2Name}=set2; Secure; SameSite=None; path=/`;
+  const cookies2 = document.cookie.split("; ");
+  const numberOfCookiesWithThisName = cookies2.filter((c) => c.startsWith(cookie2Name + "=")).length;
+  document.cookie = `${cookie2Name}=delete3; Secure; SameSite=None; Partitioned; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;
+  document.cookie = `${cookie2Name}=delete4; Secure; SameSite=None; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;
+  return numberOfCookiesWithThisName === 2;
+}
+function setCookieClientInternal(name, value, options) {
   const secure = options.secure ?? determineSecureFromClientContext();
+  const partitioned = shouldSetPartitionedClient();
   import_js_cookie.default.set(name, value, {
-    expires: options.maxAge === void 0 ? void 0 : new Date(Date.now() + options.maxAge * 1e3),
+    expires: options.maxAge === "session" ? void 0 : new Date(Date.now() + options.maxAge * 1e3),
     domain: options.domain,
-    secure
+    secure,
+    sameSite: "Lax",
+    ...partitioned ? {
+      partitioned,
+      sameSite: "None"
+    } : {}
   });
 }
-function deleteCookieClientInternal(name, options = {}) {
-  if (options.domain !== void 0) {
-    import_js_cookie.default.remove(name, { domain: options.domain, secure: determineSecureFromClientContext() });
+function deleteCookieClientInternal(name, options) {
+  for (const partitioned of [true, false]) {
+    if (options.domain !== void 0) {
+      import_js_cookie.default.remove(name, { domain: options.domain, secure: determineSecureFromClientContext(), partitioned });
+    }
+    import_js_cookie.default.remove(name, { secure: determineSecureFromClientContext(), partitioned });
   }
-  import_js_cookie.default.remove(name, { secure: determineSecureFromClientContext() });
 }
-function setOrDeleteCookieClient(name, value, options = {}) {
+function setOrDeleteCookieClient(name, value, options) {
   ensureClient();
   if (value === null) {
     deleteCookieClientInternal(name, options);
@@ -128,23 +163,23 @@ function setOrDeleteCookieClient(name, value, options = {}) {
     setCookieClientInternal(name, value, options);
   }
 }
-async function setOrDeleteCookie(name, value, options = {}) {
+async function setOrDeleteCookie(name, value, options) {
   const cookieHelper = await createCookieHelper();
   cookieHelper.setOrDelete(name, value, options);
 }
-function deleteCookieClient(name, options = {}) {
+function deleteCookieClient(name, options) {
   ensureClient();
   deleteCookieClientInternal(name, options);
 }
-async function deleteCookie(name, options = {}) {
+async function deleteCookie(name, options) {
   const cookieHelper = await createCookieHelper();
   cookieHelper.delete(name, options);
 }
-function setCookieClient(name, value, options = {}) {
+function setCookieClient(name, value, options) {
   ensureClient();
   setCookieClientInternal(name, value, options);
 }
-async function setCookie(name, value, options = {}) {
+async function setCookie(name, value, options) {
   const cookieHelper = await createCookieHelper();
   cookieHelper.set(name, value, options);
 }
@@ -165,7 +200,7 @@ function consumeVerifierAndStateCookie(state) {
   if (!codeVerifier) {
     return null;
   }
-  deleteCookieClient(cookieName);
+  deleteCookieClient(cookieName, {});
   return {
     codeVerifier
   };

package/dist/lib/cookie.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/cookie.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { isBrowserLike } from '@stackframe/stack-shared/dist/utils/env';\nimport { StackAssertionError } from '@stackframe/stack-shared/dist/utils/errors';\nimport Cookies from \"js-cookie\";\nimport { calculatePKCECodeChallenge, generateRandomCodeVerifier, generateRandomState } from \"oauth4webapi\";\n\ntype SetCookieOptions = { maxAge?: number, noOpIfServerComponent?: boolean, domain?: string, secure?: boolean };\ntype DeleteCookieOptions = { noOpIfServerComponent?: boolean, domain?: string };\n\nfunction ensureClient() {\n  if (!isBrowserLike()) {\n    throw new Error(\"cookieClient functions can only be called in a browser environment, yet window is undefined\");\n  }\n}\n\nexport type CookieHelper = {\n  get: (name: string) => string | null,\n  getAll: () => Record<string, string>,\n  set: (name: string, value: string, options: SetCookieOptions) => void,\n  setOrDelete: (name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) => void,\n  delete: (name: string, options: DeleteCookieOptions) => void,\n};\n\nconst placeholderCookieHelperIdentity = { \"placeholder cookie helper identity\": true };\nexport async function createPlaceholderCookieHelper(): Promise<CookieHelper> {\n  function throwError(): never {\n    throw new StackAssertionError(\"Throwing cookie helper is just a placeholder. This should never be called\");\n  }\n  return {\n    get: throwError,\n    getAll: throwError,\n    set: throwError,\n    setOrDelete: throwError,\n    delete: throwError,\n  };\n}\n\nexport async function createCookieHelper(): Promise<CookieHelper> {\n  if (isBrowserLike()) {\n    return createBrowserCookieHelper();\n  } else {\n    return await createPlaceholderCookieHelper();\n  }\n}\n\nexport function createBrowserCookieHelper(): CookieHelper {\n  return {\n    get: getCookieClient,\n    getAll: getAllCookiesClient,\n    set: setCookieClient,\n    setOrDelete: setOrDeleteCookieClient,\n    delete: deleteCookieClient,\n  };\n}\n\nfunction handleCookieError(e: unknown, options: DeleteCookieOptions | SetCookieOptions) {\n  if (e instanceof Error && e.message.includes(\"Cookies can only be modified in\")) {\n    if (options.noOpIfServerComponent) {\n      // ignore\n    } else {\n      throw new StackAssertionError(\"Attempted to set cookie in server component. Pass { noOpIfServerComponent: true } in the options of Stack's cookie functions if this is intentional and you want to ignore this error. Read more: https://nextjs.org/docs/app/api-reference/functions/cookies#options\");\n    }\n  } else {\n    throw e;\n  }\n}\n\n\nexport function getCookieClient(name: string): string | null {\n  const all = getAllCookiesClient();\n  return all[name] ?? null;\n}\n\nexport function getAllCookiesClient(): Record<string, string> {\n  ensureClient();\n  // set a helper cookie, see comment in `NextCookieHelper.set` above\n  Cookies.set(\"stack-is-https\", \"true\", { secure: true });\n  return Cookies.get();\n}\n\nexport async function getCookie(name: string): Promise<string | null> {\n  const cookieHelper = await createCookieHelper();\n  return cookieHelper.get(name);\n}\n\nexport async function isSecure(): Promise<boolean> {\n  if (isBrowserLike()) {\n    return determineSecureFromClientContext();\n  }\n  return false;\n}\n\nfunction determineSecureFromClientContext(): boolean {\n  return typeof window !== \"undefined\" && window.location.protocol === \"https:\";\n}\n\nfunction setCookieClientInternal(name: string, value: string, options: SetCookieOptions = {}) {\n  const secure = options.secure ?? determineSecureFromClientContext();\n  Cookies.set(name, value, {\n    expires: options.maxAge === undefined ? undefined : new Date(Date.now() + (options.maxAge) * 1000),\n    domain: options.domain,\n    secure,\n  });\n}\n\nfunction deleteCookieClientInternal(name: string, options: DeleteCookieOptions = {}) {\n  if (options.domain !== undefined) {\n    Cookies.remove(name, { domain: options.domain, secure: determineSecureFromClientContext() });\n  }\n  Cookies.remove(name, { secure: determineSecureFromClientContext() });\n}\n\nexport function setOrDeleteCookieClient(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions = {}) {\n  ensureClient();\n  if (value === null) {\n    deleteCookieClientInternal(name, options);\n  } else {\n    setCookieClientInternal(name, value, options);\n  }\n}\n\nexport async function setOrDeleteCookie(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions = {}) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.setOrDelete(name, value, options);\n}\n\nexport function deleteCookieClient(name: string, options: DeleteCookieOptions = {}) {\n  ensureClient();\n  deleteCookieClientInternal(name, options);\n}\n\nexport async function deleteCookie(name: string, options: DeleteCookieOptions = {}) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.delete(name, options);\n}\n\nexport function setCookieClient(name: string, value: string, options: SetCookieOptions = {}) {\n  ensureClient();\n  setCookieClientInternal(name, value, options);\n}\n\nexport async function setCookie(name: string, value: string, options: SetCookieOptions = {}) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.set(name, value, options);\n}\n\nexport async function saveVerifierAndState() {\n  const codeVerifier = generateRandomCodeVerifier();\n  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);\n  const state = generateRandomState();\n\n  await setCookie(\"stack-oauth-outer-\" + state, codeVerifier, { maxAge: 60 * 60 });\n\n  return {\n    codeChallenge,\n    state,\n  };\n}\n\nexport function consumeVerifierAndStateCookie(state: string) {\n  ensureClient();\n  const cookieName = \"stack-oauth-outer-\" + state;\n  const codeVerifier = getCookieClient(cookieName);\n  if (!codeVerifier) {\n    return null;\n  }\n  deleteCookieClient(cookieName);\n  return {\n    codeVerifier,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,iBAA8B;AAC9B,oBAAoC;AACpC,uBAAoB;AACpB,0BAA4F;AAK5F,SAAS,eAAe;AACtB,MAAI,KAAC,0BAAc,GAAG;AACpB,UAAM,IAAI,MAAM,6FAA6F;AAAA,EAC/G;AACF;AAWA,eAAsB,gCAAuD;AAC3E,WAAS,aAAoB;AAC3B,UAAM,IAAI,kCAAoB,2EAA2E;AAAA,EAC3G;AACA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,qBAA4C;AAChE,UAAI,0BAAc,GAAG;AACnB,WAAO,0BAA0B;AAAA,EACnC,OAAO;AACL,WAAO,MAAM,8BAA8B;AAAA,EAC7C;AACF;AAEO,SAAS,4BAA0C;AACxD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACF;AAeO,SAAS,gBAAgB,MAA6B;AAC3D,QAAM,MAAM,oBAAoB;AAChC,SAAO,IAAI,IAAI,KAAK;AACtB;AAEO,SAAS,sBAA8C;AAC5D,eAAa;AAEb,mBAAAA,QAAQ,IAAI,kBAAkB,QAAQ,EAAE,QAAQ,KAAK,CAAC;AACtD,SAAO,iBAAAA,QAAQ,IAAI;AACrB;AAEA,eAAsB,UAAU,MAAsC;AACpE,QAAM,eAAe,MAAM,mBAAmB;AAC9C,SAAO,aAAa,IAAI,IAAI;AAC9B;AAEA,eAAsB,WAA6B;AACjD,UAAI,0BAAc,GAAG;AACnB,WAAO,iCAAiC;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,mCAA4C;AACnD,SAAO,OAAO,WAAW,eAAe,OAAO,SAAS,aAAa;AACvE;AAEA,SAAS,wBAAwB,MAAc,OAAe,UAA4B,CAAC,GAAG;AAC5F,QAAM,SAAS,QAAQ,UAAU,iCAAiC;AAClE,mBAAAA,QAAQ,IAAI,MAAM,OAAO;AAAA,IACvB,SAAS,QAAQ,WAAW,SAAY,SAAY,IAAI,KAAK,KAAK,IAAI,IAAK,QAAQ,SAAU,GAAI;AAAA,IACjG,QAAQ,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,2BAA2B,MAAc,UAA+B,CAAC,GAAG;AACnF,MAAI,QAAQ,WAAW,QAAW;AAChC,qBAAAA,QAAQ,OAAO,MAAM,EAAE,QAAQ,QAAQ,QAAQ,QAAQ,iCAAiC,EAAE,CAAC;AAAA,EAC7F;AACA,mBAAAA,QAAQ,OAAO,MAAM,EAAE,QAAQ,iCAAiC,EAAE,CAAC;AACrE;AAEO,SAAS,wBAAwB,MAAc,OAAsB,UAAkD,CAAC,GAAG;AAChI,eAAa;AACb,MAAI,UAAU,MAAM;AAClB,+BAA2B,MAAM,OAAO;AAAA,EAC1C,OAAO;AACL,4BAAwB,MAAM,OAAO,OAAO;AAAA,EAC9C;AACF;AAEA,eAAsB,kBAAkB,MAAc,OAAsB,UAAkD,CAAC,GAAG;AAChI,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,YAAY,MAAM,OAAO,OAAO;AAC/C;AAEO,SAAS,mBAAmB,MAAc,UAA+B,CAAC,GAAG;AAClF,eAAa;AACb,6BAA2B,MAAM,OAAO;AAC1C;AAEA,eAAsB,aAAa,MAAc,UAA+B,CAAC,GAAG;AAClF,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,OAAO,MAAM,OAAO;AACnC;AAEO,SAAS,gBAAgB,MAAc,OAAe,UAA4B,CAAC,GAAG;AAC3F,eAAa;AACb,0BAAwB,MAAM,OAAO,OAAO;AAC9C;AAEA,eAAsB,UAAU,MAAc,OAAe,UAA4B,CAAC,GAAG;AAC3F,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,IAAI,MAAM,OAAO,OAAO;AACvC;AAEA,eAAsB,uBAAuB;AAC3C,QAAM,mBAAe,gDAA2B;AAChD,QAAM,gBAAgB,UAAM,gDAA2B,YAAY;AACnE,QAAM,YAAQ,yCAAoB;AAElC,QAAM,UAAU,uBAAuB,OAAO,cAAc,EAAE,QAAQ,KAAK,GAAG,CAAC;AAE/E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,8BAA8B,OAAe;AAC3D,eAAa;AACb,QAAM,aAAa,uBAAuB;AAC1C,QAAM,eAAe,gBAAgB,UAAU;AAC/C,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,qBAAmB,UAAU;AAC7B,SAAO;AAAA,IACL;AAAA,EACF;AACF;","names":["Cookies"]}
+{"version":3,"sources":["../../src/lib/cookie.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { isBrowserLike } from '@stackframe/stack-shared/dist/utils/env';\nimport { StackAssertionError } from '@stackframe/stack-shared/dist/utils/errors';\nimport Cookies from \"js-cookie\";\nimport { calculatePKCECodeChallenge, generateRandomCodeVerifier, generateRandomState } from \"oauth4webapi\";\n\n\n// INFO: This file is used to manage cookies. It also sets some cookie flags automatically, see this description.\n//\n// It provides asynchronous setCookie, getCookie, deleteCookie, etc. functions that can be used in various environments\n// (browser + Next.js for now). Under the hood, they just get a CookieHelper object and then set the cookies there.\n//\n// The CookieHelper object is a simple object that lets you set, get and delete cookies synchronously. Acquiring one\n// is asynchronous (except for browser environments, where they can be acquired synchronously), but once you have it,\n// you can use it synchronously. This function is useful if you cannot await in the calling code, but otherwise you\n// should prefer to await the functions directly.\n//\n// Some cookie flags are set automatically by the CookieHelper (and hence also the <xyz>Cookie functions).\n// In particular:\n//  - SameSite is set to `Lax` by default, which is already true in Chromium-based browsers, so this creates\n//    compatibility with other browsers that use either Strict or None (particularly Safari and Firefox, and older\n//    versions of Chrome). If Partitioned is automatically set (as described below), then this value is set to `None`\n//    instead.\n//  - Secure is set depending on whether we could successfully determine that the client is on HTTPS. For this, we use a\n//    set of heuristics:\n//     - In a browser environment, we check window.location.protocol which is always accurate\n//     - In a Next.js server environment:\n//        - First we check the `stack-is-https` cookie, which is set in various places on the\n//          client with a Secure attribute. If that one is passed on to the server, we know that the client is on HTTPS\n//          and we can set the Secure flag on the cookie. TODO: Should we also do this with a second cookie with a\n//          __Host- prefix, so a malicious subdomain of the current domain cannot forcibly enable HTTPS mode and\n//          therefore prevent new cookies from being set?\n//        - Otherwise, we check the X-Forwarded-Proto header. If that one is `https`, we know that the client is\n//          (pretending to be) on HTTPS and we can set the Secure flag on the cookie. Note that this header is\n//          spoofable by malicious clients (so is the cookie actually), but since setting this value can only *increase*\n//          security (and therefore prevent setting of a cookie), and requires a malicious client, this is still safe.\n//        - If neither of the above is true, we don't set the Secure flag on the cookie.\n//  - Partitioned is set depending on whether it is needed & supported. Unfortunately, the fact that Partitioned\n//    cookies require SameSite=None, browsers that don't support it will still set them as normal third-party cookies,\n//    which are fundamentally unsafe. Therefore, we need to take extra care that we only ever set Partitioned cookies\n//    if we know for sure that the browser supports it.\n//    - In a browser environment, we check:\n//       - Whether `Secure` is set. If it's not, we don't set Partitioned.\n//       - Whether we can set & retrieve cookies without Partitioned being set. If this is the case, we are likely in a\n//         top-level context or a browser that partitions cookies by default (eg. Firefox). In this case, we don't need\n//         Partitioned and can just proceed as normal.\n//       - Whether CHIPS is supported. To prevent the case where CHIPS is not supported but third-party cookies are (in\n//         which we would accidentally set SameSite=None without Partitioned as the latter requires the former), we\n//         check this by running a simple test with document.cookie.\n//       - Whether the browser supports Partitioned cookies. If yes, set Partitioned. Otherwise, don't set Partitioned.\n//         Since there's no easy cross-compat way to do this (CookieStore and document.cookie do not return whether a\n//         cookie is partitioned on some/all versions of Safari and Firefox), we use a heuristic; we run this test by\n//         creating two cookies with the same name: One with Partitioned and one without. If there are two resulting\n//         cookies, that means they were put into different jars, implying that the browser supports Partitioned cookies\n//         (but doesn't partition cookies by default). If they result in just one cookie, that could mean that the\n//         browser doesn't support Partitioned cookies, or that the browser doesn't put partitioned cookies into\n//         different jars by default, in which case we still don't know. This heuristic works on Chrome, but may\n//         incorrectly conclude that some other browsers don't support Partitioned. But from a security perspective,\n//         that is better than accidentally setting SameSite=None without Partitioned. TODO: Find a better heuristic to\n//         to determine whether the browser supports Partitioned cookies or not.\n//    - In a Next.js server environment, right now we do nothing because of the complexity involved :( TODO: In the\n//      future, we could improve this for example by setting hint cookies from the client, but we need to make sure that\n//      no malicious actor (eg. on a malicious subdomain) can forcefully enable Partitioned cookies on a browser that\n//      does not support it.\n\n\ntype SetCookieOptions = { maxAge: number | \"session\", noOpIfServerComponent?: boolean, domain?: string, secure?: boolean };\ntype DeleteCookieOptions = { noOpIfServerComponent?: boolean, domain?: string };\n\nfunction ensureClient() {\n  if (!isBrowserLike()) {\n    throw new Error(\"cookieClient functions can only be called in a browser environment, yet window is undefined\");\n  }\n}\n\nexport type CookieHelper = {\n  get: (name: string) => string | null,\n  getAll: () => Record<string, string>,\n  set: (name: string, value: string, options: SetCookieOptions) => void,\n  setOrDelete: (name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) => void,\n  delete: (name: string, options: DeleteCookieOptions) => void,\n};\n\nconst placeholderCookieHelperIdentity = { \"placeholder cookie helper identity\": true };\nexport async function createPlaceholderCookieHelper(): Promise<CookieHelper> {\n  function throwError(): never {\n    throw new StackAssertionError(\"Throwing cookie helper is just a placeholder. This should never be called\");\n  }\n  return {\n    get: throwError,\n    getAll: throwError,\n    set: throwError,\n    setOrDelete: throwError,\n    delete: throwError,\n  };\n}\n\nexport async function createCookieHelper(): Promise<CookieHelper> {\n  if (isBrowserLike()) {\n    return createBrowserCookieHelper();\n  } else {\n    return await createPlaceholderCookieHelper();\n  }\n}\n\nexport function createBrowserCookieHelper(): CookieHelper {\n  return {\n    get: getCookieClient,\n    getAll: getAllCookiesClient,\n    set: setCookieClient,\n    setOrDelete: setOrDeleteCookieClient,\n    delete: deleteCookieClient,\n  };\n}\n\nfunction handleCookieError(e: unknown, options: DeleteCookieOptions | SetCookieOptions) {\n  if (e instanceof Error && e.message.includes(\"Cookies can only be modified in\")) {\n    if (options.noOpIfServerComponent) {\n      // ignore\n    } else {\n      throw new StackAssertionError(\"Attempted to set cookie in server component. Pass { noOpIfServerComponent: true } in the options of Stack's cookie functions if this is intentional and you want to ignore this error. Read more: https://nextjs.org/docs/app/api-reference/functions/cookies#options\");\n    }\n  } else {\n    throw e;\n  }\n}\n\n\nexport function getCookieClient(name: string): string | null {\n  const all = getAllCookiesClient();\n  return all[name] ?? null;\n}\n\nexport function getAllCookiesClient(): Record<string, string> {\n  ensureClient();\n  // set a helper cookie, see comment in `NextCookieHelper.set` above\n  Cookies.set(\"stack-is-https\", \"true\", { secure: true, expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 365) });\n  return Cookies.get();\n}\n\nexport async function getCookie(name: string): Promise<string | null> {\n  const cookieHelper = await createCookieHelper();\n  return cookieHelper.get(name);\n}\n\nexport async function isSecure(): Promise<boolean> {\n  if (isBrowserLike()) {\n    return determineSecureFromClientContext();\n  }\n  return false;\n}\n\nfunction determineSecureFromClientContext(): boolean {\n  return typeof window !== \"undefined\" && window.location.protocol === \"https:\";\n}\n\n\nlet _shouldSetPartitionedClientCache: boolean | undefined = undefined;\nfunction shouldSetPartitionedClient() {\n  return _shouldSetPartitionedClientCache ??= _internalShouldSetPartitionedClient();\n}\nfunction _internalShouldSetPartitionedClient() {\n  ensureClient();\n\n  if (!(determineSecureFromClientContext())) {\n    return false;\n  }\n\n  // check whether we can set & retrieve normal cookies (either because we're on a top-level/same-origin context or the browser partitions cookies by default)\n  const cookie1Name = \"__Host-stack-temporary-chips-test-\" + Math.random().toString(36).substring(2, 15);\n  document.cookie = `${cookie1Name}=value1; Secure; path=/`;\n  const cookies1 = document.cookie.split(\"; \");\n  document.cookie = `${cookie1Name}=delete1; Secure; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC;`;\n  if (cookies1.some((c) => c.startsWith(cookie1Name + \"=\"))) {\n    return false;\n  }\n\n\n  // check whether Partitioned cookies are supported by the browser\n  // TODO: See comment at the top. Feels like we should find a better way to do this\n  const cookie2Name = \"__Host-stack-temporary-chips-test-\" + Math.random().toString(36).substring(2, 15);\n\n  // just to be safe, delete the cookie first to avoid weird RNG-prediction attacks\n  // I don't know what they look like (since this is a host cookie) but better safe than sorry\n  // (this function should be 100% bulletproof so we don't accidentally fall back to non-partitioned third party cookies on unsupported browsers)\n  document.cookie = `${cookie2Name}=delete1; Secure; SameSite=None; Partitioned; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n  document.cookie = `${cookie2Name}=delete2; Secure; SameSite=None; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n\n  // set the cookie, once partitioned and once not partitioned\n  document.cookie = `${cookie2Name}=set1; Secure; SameSite=None; Partitioned; path=/`;\n  document.cookie = `${cookie2Name}=set2; Secure; SameSite=None; path=/`;\n\n  // check if there are two cookies\n  const cookies2 = document.cookie.split(\"; \");\n  const numberOfCookiesWithThisName = cookies2.filter((c) => c.startsWith(cookie2Name + \"=\")).length;\n\n  // clean up\n  document.cookie = `${cookie2Name}=delete3; Secure; SameSite=None; Partitioned; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n  document.cookie = `${cookie2Name}=delete4; Secure; SameSite=None; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n\n  return numberOfCookiesWithThisName === 2;\n}\n\nfunction setCookieClientInternal(name: string, value: string, options: SetCookieOptions) {\n  const secure = options.secure ?? determineSecureFromClientContext();\n  const partitioned = shouldSetPartitionedClient();\n  Cookies.set(name, value, {\n    expires: options.maxAge === \"session\" ? undefined : new Date(Date.now() + (options.maxAge) * 1000),\n    domain: options.domain,\n    secure,\n    sameSite: \"Lax\",\n    ...(partitioned ? {\n      partitioned,\n      sameSite: \"None\",\n    } : {}),\n  });\n}\n\nfunction deleteCookieClientInternal(name: string, options: DeleteCookieOptions) {\n  for (const partitioned of [true, false]) {\n    if (options.domain !== undefined) {\n      Cookies.remove(name, { domain: options.domain, secure: determineSecureFromClientContext(), partitioned });\n    }\n    Cookies.remove(name, { secure: determineSecureFromClientContext(), partitioned });\n  }\n}\n\nexport function setOrDeleteCookieClient(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) {\n  ensureClient();\n  if (value === null) {\n    deleteCookieClientInternal(name, options);\n  } else {\n    setCookieClientInternal(name, value, options);\n  }\n}\n\nexport async function setOrDeleteCookie(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.setOrDelete(name, value, options);\n}\n\nexport function deleteCookieClient(name: string, options: DeleteCookieOptions) {\n  ensureClient();\n  deleteCookieClientInternal(name, options);\n}\n\nexport async function deleteCookie(name: string, options: DeleteCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.delete(name, options);\n}\n\nexport function setCookieClient(name: string, value: string, options: SetCookieOptions) {\n  ensureClient();\n  setCookieClientInternal(name, value, options);\n}\n\nexport async function setCookie(name: string, value: string, options: SetCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.set(name, value, options);\n}\n\nexport async function saveVerifierAndState() {\n  const codeVerifier = generateRandomCodeVerifier();\n  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);\n  const state = generateRandomState();\n\n  await setCookie(\"stack-oauth-outer-\" + state, codeVerifier, { maxAge: 60 * 60 });\n\n  return {\n    codeChallenge,\n    state,\n  };\n}\n\nexport function consumeVerifierAndStateCookie(state: string) {\n  ensureClient();\n  const cookieName = \"stack-oauth-outer-\" + state;\n  const codeVerifier = getCookieClient(cookieName);\n  if (!codeVerifier) {\n    return null;\n  }\n  deleteCookieClient(cookieName, {});\n  return {\n    codeVerifier,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,iBAA8B;AAC9B,oBAAoC;AACpC,uBAAoB;AACpB,0BAA4F;AAiE5F,SAAS,eAAe;AACtB,MAAI,KAAC,0BAAc,GAAG;AACpB,UAAM,IAAI,MAAM,6FAA6F;AAAA,EAC/G;AACF;AAWA,eAAsB,gCAAuD;AAC3E,WAAS,aAAoB;AAC3B,UAAM,IAAI,kCAAoB,2EAA2E;AAAA,EAC3G;AACA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,qBAA4C;AAChE,UAAI,0BAAc,GAAG;AACnB,WAAO,0BAA0B;AAAA,EACnC,OAAO;AACL,WAAO,MAAM,8BAA8B;AAAA,EAC7C;AACF;AAEO,SAAS,4BAA0C;AACxD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACF;AAeO,SAAS,gBAAgB,MAA6B;AAC3D,QAAM,MAAM,oBAAoB;AAChC,SAAO,IAAI,IAAI,KAAK;AACtB;AAEO,SAAS,sBAA8C;AAC5D,eAAa;AAEb,mBAAAA,QAAQ,IAAI,kBAAkB,QAAQ,EAAE,QAAQ,MAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAO,KAAK,KAAK,KAAK,GAAG,EAAE,CAAC;AACjH,SAAO,iBAAAA,QAAQ,IAAI;AACrB;AAEA,eAAsB,UAAU,MAAsC;AACpE,QAAM,eAAe,MAAM,mBAAmB;AAC9C,SAAO,aAAa,IAAI,IAAI;AAC9B;AAEA,eAAsB,WAA6B;AACjD,UAAI,0BAAc,GAAG;AACnB,WAAO,iCAAiC;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,mCAA4C;AACnD,SAAO,OAAO,WAAW,eAAe,OAAO,SAAS,aAAa;AACvE;AAGA,IAAI,mCAAwD;AAC5D,SAAS,6BAA6B;AACpC,SAAO,qCAAqC,oCAAoC;AAClF;AACA,SAAS,sCAAsC;AAC7C,eAAa;AAEb,MAAI,CAAE,iCAAiC,GAAI;AACzC,WAAO;AAAA,EACT;AAGA,QAAM,cAAc,uCAAuC,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE;AACrG,WAAS,SAAS,GAAG,WAAW;AAChC,QAAM,WAAW,SAAS,OAAO,MAAM,IAAI;AAC3C,WAAS,SAAS,GAAG,WAAW;AAChC,MAAI,SAAS,KAAK,CAAC,MAAM,EAAE,WAAW,cAAc,GAAG,CAAC,GAAG;AACzD,WAAO;AAAA,EACT;AAKA,QAAM,cAAc,uCAAuC,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE;AAKrG,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAGhC,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAGhC,QAAM,WAAW,SAAS,OAAO,MAAM,IAAI;AAC3C,QAAM,8BAA8B,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,cAAc,GAAG,CAAC,EAAE;AAG5F,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAEhC,SAAO,gCAAgC;AACzC;AAEA,SAAS,wBAAwB,MAAc,OAAe,SAA2B;AACvF,QAAM,SAAS,QAAQ,UAAU,iCAAiC;AAClE,QAAM,cAAc,2BAA2B;AAC/C,mBAAAA,QAAQ,IAAI,MAAM,OAAO;AAAA,IACvB,SAAS,QAAQ,WAAW,YAAY,SAAY,IAAI,KAAK,KAAK,IAAI,IAAK,QAAQ,SAAU,GAAI;AAAA,IACjG,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,UAAU;AAAA,IACV,GAAI,cAAc;AAAA,MAChB;AAAA,MACA,UAAU;AAAA,IACZ,IAAI,CAAC;AAAA,EACP,CAAC;AACH;AAEA,SAAS,2BAA2B,MAAc,SAA8B;AAC9E,aAAW,eAAe,CAAC,MAAM,KAAK,GAAG;AACvC,QAAI,QAAQ,WAAW,QAAW;AAChC,uBAAAA,QAAQ,OAAO,MAAM,EAAE,QAAQ,QAAQ,QAAQ,QAAQ,iCAAiC,GAAG,YAAY,CAAC;AAAA,IAC1G;AACA,qBAAAA,QAAQ,OAAO,MAAM,EAAE,QAAQ,iCAAiC,GAAG,YAAY,CAAC;AAAA,EAClF;AACF;AAEO,SAAS,wBAAwB,MAAc,OAAsB,SAAiD;AAC3H,eAAa;AACb,MAAI,UAAU,MAAM;AAClB,+BAA2B,MAAM,OAAO;AAAA,EAC1C,OAAO;AACL,4BAAwB,MAAM,OAAO,OAAO;AAAA,EAC9C;AACF;AAEA,eAAsB,kBAAkB,MAAc,OAAsB,SAAiD;AAC3H,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,YAAY,MAAM,OAAO,OAAO;AAC/C;AAEO,SAAS,mBAAmB,MAAc,SAA8B;AAC7E,eAAa;AACb,6BAA2B,MAAM,OAAO;AAC1C;AAEA,eAAsB,aAAa,MAAc,SAA8B;AAC7E,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,OAAO,MAAM,OAAO;AACnC;AAEO,SAAS,gBAAgB,MAAc,OAAe,SAA2B;AACtF,eAAa;AACb,0BAAwB,MAAM,OAAO,OAAO;AAC9C;AAEA,eAAsB,UAAU,MAAc,OAAe,SAA2B;AACtF,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,IAAI,MAAM,OAAO,OAAO;AACvC;AAEA,eAAsB,uBAAuB;AAC3C,QAAM,mBAAe,gDAA2B;AAChD,QAAM,gBAAgB,UAAM,gDAA2B,YAAY;AACnE,QAAM,YAAQ,yCAAoB;AAElC,QAAM,UAAU,uBAAuB,OAAO,cAAc,EAAE,QAAQ,KAAK,GAAG,CAAC;AAE/E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,8BAA8B,OAAe;AAC3D,eAAa;AACb,QAAM,aAAa,uBAAuB;AAC1C,QAAM,eAAe,gBAAgB,UAAU;AAC/C,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,qBAAmB,YAAY,CAAC,CAAC;AACjC,SAAO;AAAA,IACL;AAAA,EACF;AACF;","names":["Cookies"]}