@stackframe/react 2.8.56 → 2.8.59

package/dist/index.d.ts

@@ -42,6 +42,15 @@ type RedirectMethod = "window" | "none" | {
 };
 type GetCurrentUserOptions<HasTokenStore> = {
     or?: 'redirect' | 'throw' | 'return-null' | 'anonymous' | /** @deprecated */ 'anonymous-if-exists[deprecated]';
+    /**
+     * Whether to include restricted users (users who haven't completed onboarding requirements like email verification).
+     * By default, restricted users are filtered out (treated similar to anonymous users).
+     *
+     * Note: This option cannot be set to false when `or: 'anonymous'` is used, as all anonymous users are also restricted.
+     *
+     * @default false
+     */
+    includeRestricted?: boolean;
     tokenStore?: TokenStoreInit;
 } & (HasTokenStore extends false ? {
     tokenStore: TokenStoreInit;
@@ -89,6 +98,7 @@ type HandlerUrls = {
     teamInvitation: string;
     mfa: string;
     error: string;
+    onboarding: string;
 };
 type OAuthScopesOnSignIn = {
     [key in ProviderType]: string[];
@@ -104,6 +114,22 @@ type AuthLike<ExtraOptions = {}> = {
     signOut(options?: {
         redirectUrl?: URL | string;
     }): Promise<void>;
+    /**
+     * Returns the current access token, or null if the user is not signed in.
+     *
+     * The access token is a short-lived JWT that can be used to authenticate requests to external servers.
+     * It will be automatically refreshed when it expires.
+     */
+    getAccessToken(options?: {} & ExtraOptions): Promise<string | null>;
+    useAccessToken(options?: {} & ExtraOptions): string | null;
+    /**
+     * Returns the current refresh token, or null if the user is not signed in.
+     *
+     * The refresh token is a long-lived token that can be used to obtain new access tokens.
+     * It should be kept secret and never exposed to the client.
+     */
+    getRefreshToken(options?: {} & ExtraOptions): Promise<string | null>;
+    useRefreshToken(options?: {} & ExtraOptions): string | null;
     /**
      * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin
      * requests. Similar to `getAuthJson`, but specifically for HTTP requests.
@@ -120,8 +146,8 @@ type AuthLike<ExtraOptions = {}> = {
      * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
      * of the CORS preflight response.
      *
-     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function
-     * instead.
+     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAccessToken()` and
+     * `getRefreshToken()` functions instead.
      *
      * Example:
      *
@@ -144,7 +170,12 @@ type AuthLike<ExtraOptions = {}> = {
     getAuthHeaders(options?: {} & ExtraOptions): Promise<{
         "x-stack-auth": string;
     }>;
+    useAuthHeaders(options?: {} & ExtraOptions): {
+        "x-stack-auth": string;
+    };
     /**
+     * @deprecated Use `getAccessToken()` and `getRefreshToken()` instead.
+     *
      * Creates a JSON-serializable object containing the information to authenticate a user on an external server.
      * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just
      * HTTP headers.
@@ -175,6 +206,11 @@ type AuthLike<ExtraOptions = {}> = {
         accessToken: string | null;
         refreshToken: string | null;
     }>;
+    /** @deprecated Use `useAccessToken()` and `useRefreshToken()` instead. */
+    useAuthJson(options?: {} & ExtraOptions): {
+        accessToken: string | null;
+        refreshToken: string | null;
+    };
 };
 /** @internal */
 declare const stackAppInternalsSymbol: unique symbol;
@@ -213,6 +249,17 @@ type CustomerProduct = {
     customerType: "user" | "team" | "custom";
     isServerOnly: boolean;
     stackable: boolean;
+    type: "one_time" | "subscription";
+    subscription: null | {
+        currentPeriodEnd: Date | null;
+        cancelAtPeriodEnd: boolean;
+        isCancelable: boolean;
+    };
+    switchOptions?: Array<{
+        productId: string;
+        displayName: string;
+        prices: InlineProduct["prices"];
+    }>;
 };
 type CustomerProductsList = CustomerProduct[] & {
     nextCursor: string | null;
@@ -228,6 +275,21 @@ type CustomerProductsRequestOptions = ({
 } & CustomerProductsListOptions) | ({
     customCustomerId: string;
 } & CustomerProductsListOptions);
+type CustomerDefaultPaymentMethod = {
+    id: string;
+    brand: string | null;
+    last4: string | null;
+    exp_month: number | null;
+    exp_year: number | null;
+} | null;
+type CustomerBilling = {
+    hasCustomer: boolean;
+    defaultPaymentMethod: CustomerDefaultPaymentMethod;
+};
+type CustomerPaymentMethodSetupIntent = {
+    clientSecret: string;
+    stripeAccountId: string;
+};
 type Customer<IsServer extends boolean = false> = {
     readonly id: string;
     createCheckoutUrl(options: ({
@@ -237,7 +299,16 @@ type Customer<IsServer extends boolean = false> = {
         product: InlineProduct;
         returnUrl?: string;
     } : never))): Promise<string>;
-} & AsyncStoreProperty<"item", [
+    createPaymentMethodSetupIntent(): Promise<CustomerPaymentMethodSetupIntent>;
+    setDefaultPaymentMethodFromSetupIntent(setupIntentId: string): Promise<CustomerDefaultPaymentMethod>;
+    switchSubscription(options: {
+        fromProductId: string;
+        toProductId: string;
+        priceId?: string;
+        quantity?: number;
+    }): Promise<void>;
+} & AsyncStoreProperty<"billing", [
+], CustomerBilling, false> & AsyncStoreProperty<"item", [
     itemId: string
 ], IsServer extends true ? ServerItem : Item, false> & AsyncStoreProperty<"products", [
     options?: CustomerProductsListOptions
@@ -259,6 +330,137 @@ type AdminSentEmail = {
     sentAt: Date;
     error?: unknown;
 };
+type AdminEmailOutboxRecipient = {
+    type: "user-primary-email";
+    userId: string;
+} | {
+    type: "user-custom-emails";
+    userId: string;
+    emails: string[];
+} | {
+    type: "custom-emails";
+    emails: string[];
+};
+type AdminEmailOutboxStatus = "paused" | "preparing" | "rendering" | "render-error" | "scheduled" | "queued" | "sending" | "server-error" | "skipped" | "bounced" | "delivery-delayed" | "sent" | "opened" | "clicked" | "marked-as-spam";
+type AdminEmailOutboxSimpleStatus = "in-progress" | "ok" | "error";
+type AdminEmailOutboxBase = {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    to: AdminEmailOutboxRecipient;
+    scheduledAt: Date;
+    isPaused: false;
+    hasRendered: false;
+    hasDelivered: false;
+};
+type AdminEmailOutboxRenderedFields = Omit<AdminEmailOutboxBase, "hasRendered"> & {
+    hasRendered: true;
+    startedRenderingAt: Date;
+    renderedAt: Date;
+    subject: string;
+    html: string | null;
+    text: string | null;
+    isTransactional: boolean;
+    isHighPriority: boolean;
+    notificationCategoryId: string | null;
+};
+type AdminEmailOutboxStartedSendingFields = AdminEmailOutboxRenderedFields & {
+    startedSendingAt: Date;
+};
+type AdminEmailOutboxFinishedDeliveringFields = Omit<AdminEmailOutboxStartedSendingFields, "hasDelivered"> & {
+    hasDelivered: true;
+    deliveredAt: Date;
+};
+type AdminEmailOutboxPaused = Omit<AdminEmailOutboxBase, "isPaused"> & {
+    status: "paused";
+    simpleStatus: "in-progress";
+    isPaused: true;
+};
+type AdminEmailOutboxPreparing = AdminEmailOutboxBase & {
+    status: "preparing";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxRendering = AdminEmailOutboxBase & {
+    status: "rendering";
+    simpleStatus: "in-progress";
+    startedRenderingAt: Date;
+};
+type AdminEmailOutboxRenderError = AdminEmailOutboxBase & {
+    status: "render-error";
+    simpleStatus: "error";
+    startedRenderingAt: Date;
+    renderedAt: Date;
+    renderError: string;
+};
+type AdminEmailOutboxScheduled = AdminEmailOutboxRenderedFields & {
+    status: "scheduled";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxQueued = AdminEmailOutboxRenderedFields & {
+    status: "queued";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxSending = AdminEmailOutboxStartedSendingFields & {
+    status: "sending";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxServerError = AdminEmailOutboxStartedSendingFields & {
+    status: "server-error";
+    simpleStatus: "error";
+    errorAt: Date;
+    serverError: string;
+};
+type AdminEmailOutboxSkipped = Omit<AdminEmailOutboxBase, "hasRendered"> & {
+    status: "skipped";
+    simpleStatus: "ok";
+    hasRendered: boolean;
+    skippedAt: Date;
+    skippedReason: string;
+    skippedDetails: Record<string, unknown>;
+    startedRenderingAt?: Date;
+    renderedAt?: Date;
+    subject?: string;
+    html?: string | null;
+    text?: string | null;
+    isTransactional?: boolean;
+    isHighPriority?: boolean;
+    notificationCategoryId?: string | null;
+    startedSendingAt?: Date;
+};
+type AdminEmailOutboxBounced = AdminEmailOutboxStartedSendingFields & {
+    status: "bounced";
+    simpleStatus: "error";
+    bouncedAt: Date;
+};
+type AdminEmailOutboxDeliveryDelayed = AdminEmailOutboxStartedSendingFields & {
+    status: "delivery-delayed";
+    simpleStatus: "ok";
+    deliveryDelayedAt: Date;
+};
+type AdminEmailOutboxSent = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "sent";
+    simpleStatus: "ok";
+    canHaveDeliveryInfo: boolean;
+};
+type AdminEmailOutboxOpened = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "opened";
+    simpleStatus: "ok";
+    openedAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutboxClicked = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "clicked";
+    simpleStatus: "ok";
+    clickedAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutboxMarkedAsSpam = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "marked-as-spam";
+    simpleStatus: "ok";
+    markedAsSpamAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutbox = AdminEmailOutboxPaused | AdminEmailOutboxPreparing | AdminEmailOutboxRendering | AdminEmailOutboxRenderError | AdminEmailOutboxScheduled | AdminEmailOutboxQueued | AdminEmailOutboxSending | AdminEmailOutboxServerError | AdminEmailOutboxSkipped | AdminEmailOutboxBounced | AdminEmailOutboxDeliveryDelayed | AdminEmailOutboxSent | AdminEmailOutboxOpened | AdminEmailOutboxClicked | AdminEmailOutboxMarkedAsSpam;
 type SendEmailOptionsBase = {
     themeId?: string | null | false;
     subject?: string;
@@ -283,6 +485,25 @@ type SendEmailOptions = SendEmailOptionsBase & XOR<[
         draftId: string;
     }
 ]>;
+type EmailDeliveryWindowStats = {
+    sent: number;
+    bounced: number;
+    marked_as_spam: number;
+};
+type EmailDeliveryStats = {
+    hour: EmailDeliveryWindowStats;
+    day: EmailDeliveryWindowStats;
+    week: EmailDeliveryWindowStats;
+    month: EmailDeliveryWindowStats;
+};
+type EmailDeliveryCapacity = {
+    rate_per_second: number;
+    penalty_factor: number;
+};
+type EmailDeliveryInfo = {
+    stats: EmailDeliveryStats;
+    capacity: EmailDeliveryCapacity;
+};
 
 type InternalApiKeyBase = {
     id: string;
@@ -485,18 +706,21 @@ type ServerOAuthProvider = {
     }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
     delete(): Promise<void>;
 };
-type Session = {
-    getTokens(): Promise<{
-        accessToken: string | null;
-        refreshToken: string | null;
-    }>;
-};
 /**
  * Contains everything related to the current user session.
  */
 type Auth = AuthLike<{}> & {
     readonly _internalSession: InternalSession;
-    readonly currentSession: Session;
+    readonly currentSession: {
+        getTokens(): Promise<{
+            accessToken: string | null;
+            refreshToken: string | null;
+        }>;
+        useTokens(): {
+            accessToken: string | null;
+            refreshToken: string | null;
+        };
+    };
 };
 /**
  * ```
@@ -542,6 +766,18 @@ type BaseUser = {
     readonly passkeyAuthEnabled: boolean;
     readonly isMultiFactorRequired: boolean;
     readonly isAnonymous: boolean;
+    /**
+     * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).
+     * For example, if email verification is required but the user hasn't verified their email yet.
+     */
+    readonly isRestricted: boolean;
+    /**
+     * The reason why the user is restricted, e.g., { type: "email_not_verified" } or { type: "anonymous" }.
+     * Null if the user is not restricted.
+     */
+    readonly restrictedReason: {
+        type: "anonymous" | "email_not_verified";
+    } | null;
     toClientJson(): CurrentUserCrud["Client"]["Read"];
     /**
      * @deprecated, use contact channel's usedForAuth instead
@@ -555,7 +791,7 @@ type BaseUser = {
     }[];
 };
 type UserExtra = {
-    setDisplayName(displayName: string): Promise<void>;
+    setDisplayName(displayName: string | null): Promise<void>;
     /** @deprecated Use contact channel's sendVerificationEmail instead */
     sendVerificationEmail(): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
     setClientMetadata(metadata: any): Promise<void>;
@@ -611,7 +847,7 @@ type UserExtra = {
     usePermission(scope: Team, permissionId: string): TeamPermission | null;
     usePermission(permissionId: string): TeamPermission | null;
     readonly selectedTeam: Team | null;
-    setSelectedTeam(team: Team | null): Promise<void>;
+    setSelectedTeam(teamOrId: string | Team | null): Promise<void>;
     createTeam(data: TeamCreateOptions): Promise<Team>;
     leaveTeam(team: Team): Promise<void>;
     getActiveSessions(): Promise<ActiveSession[]>;
@@ -639,8 +875,8 @@ type User = BaseUser;
 type CurrentUser = BaseUser & Auth & UserExtra & Customer;
 type CurrentInternalUser = CurrentUser & InternalUserExtra;
 type ProjectCurrentUser<ProjectId> = ProjectId extends "internal" ? CurrentInternalUser : CurrentUser;
-type TokenPartialUser = Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "isAnonymous">;
-type SyncedPartialUser = TokenPartialUser & Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "profileImageUrl" | "signedUpAt" | "clientMetadata" | "clientReadOnlyMetadata" | "isAnonymous" | "hasPassword">;
+type TokenPartialUser = Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "isAnonymous" | "isRestricted" | "restrictedReason">;
+type SyncedPartialUser = TokenPartialUser & Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "profileImageUrl" | "signedUpAt" | "clientMetadata" | "clientReadOnlyMetadata" | "isAnonymous" | "hasPassword" | "isRestricted" | "restrictedReason">;
 type ActiveSession = {
     id: string;
     userId: string;
@@ -651,13 +887,14 @@ type ActiveSession = {
     geoInfo?: GeoInfo;
 };
 type UserUpdateOptions = {
-    displayName?: string;
+    displayName?: string | null;
     clientMetadata?: ReadonlyJson;
     selectedTeamId?: string | null;
     totpMultiFactorSecret?: Uint8Array | null;
     profileImageUrl?: string | null;
     otpAuthEnabled?: boolean;
     passkeyAuthEnabled?: boolean;
+    primaryEmail?: string | null;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string | null, options?: {
@@ -704,7 +941,12 @@ type ServerBaseUser = {
     createSession(options?: {
         expiresInMillis?: number;
         isImpersonation?: boolean;
-    }): Promise<Session>;
+    }): Promise<{
+        getTokens(): Promise<{
+            accessToken: string | null;
+            refreshToken: string | null;
+        }>;
+    }>;
 } & AsyncStoreProperty<"team", [id: string], ServerTeam | null, false> & AsyncStoreProperty<"teams", [], ServerTeam[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
     direct?: boolean;
 }], AdminTeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
@@ -811,6 +1053,15 @@ type ServerListUsersOptions = {
     orderBy?: 'signedUpAt';
     desc?: boolean;
     query?: string;
+    /**
+     * Whether to include restricted users (users who haven't completed onboarding requirements).
+     * Defaults to false.
+     */
+    includeRestricted?: boolean;
+    /**
+     * Whether to include anonymous users (and restricted users).
+     * Defaults to false.
+     */
     includeAnonymous?: boolean;
 };
 type ServerTeamCreateOptions = TeamCreateOptions & {
@@ -925,6 +1176,8 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         allowConnectedAccounts: boolean;
     }): Promise<Result<ServerOAuthProvider, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
     sendEmail(options: SendEmailOptions): Promise<void>;
+    getEmailDeliveryStats(): Promise<EmailDeliveryInfo>;
+    useEmailDeliveryStats(): EmailDeliveryInfo;
 } & AsyncStoreProperty<"user", [id: string], ServerUser | null, false> & Omit<AsyncStoreProperty<"users", [], ServerUser[], true>, "listUsers" | "useUsers"> & AsyncStoreProperty<"teams", [], ServerTeam[], true> & AsyncStoreProperty<"dataVaultStore", [id: string], DataVaultStore, false> & AsyncStoreProperty<"item", [
     {
         itemId: string;
@@ -941,6 +1194,21 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
 ], CustomerProductsList, true> & StackClientApp<HasTokenStore, ProjectId>);
 declare const StackServerApp: StackServerAppConstructor;
 
+type EmailOutboxListOptions = {
+    status?: string;
+    simpleStatus?: string;
+    limit?: number;
+    cursor?: string;
+};
+type EmailOutboxListResult = {
+    items: AdminEmailOutbox[];
+    nextCursor: string | null;
+};
+type EmailOutboxUpdateOptions = {
+    isPaused?: boolean;
+    scheduledAtMillis?: number;
+    cancel?: boolean;
+};
 type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = (StackServerAppConstructorOptions<HasTokenStore, ProjectId> & {
     superSecretAdminKey?: string;
     projectOwnerSession?: InternalSession;
@@ -1073,6 +1341,12 @@ type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends st
         type: "subscription" | "one-time-purchase";
         id: string;
     }): Promise<void>;
+    listOutboxEmails(options?: EmailOutboxListOptions): Promise<EmailOutboxListResult>;
+    getOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    updateOutboxEmail(id: string, options: EmailOutboxUpdateOptions): Promise<AdminEmailOutbox>;
+    pauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    unpauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    cancelOutboxEmail(id: string): Promise<AdminEmailOutbox>;
 } & StackServerApp<HasTokenStore, ProjectId>);
 declare const StackAdminApp: StackAdminAppConstructor;
 
@@ -1090,6 +1364,9 @@ type ProjectConfig = {
 type OAuthProviderConfig = {
     readonly id: string;
 };
+/**
+ * @deprecated This type is deprecated. Use the new config override setup instead.
+ */
 type AdminProjectConfig = {
     readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
@@ -1335,6 +1612,12 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         or: 'anonymous';
     }): Promise<ProjectCurrentUser<ProjectId>>;
     getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentUser<ProjectId> | null>;
+    cancelSubscription(options: {
+        productId: string;
+    } | {
+        productId: string;
+        teamId: string;
+    }): Promise<void>;
     getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
         from: 'token';
     }): Promise<TokenPartialUser | null>;
@@ -1387,6 +1670,7 @@ declare const iconMap: {
     readonly Key: React$1.ForwardRefExoticComponent<Omit<lucide_react.LucideProps, "ref"> & React$1.RefAttributes<SVGSVGElement>>;
     readonly Settings: React$1.ForwardRefExoticComponent<Omit<lucide_react.LucideProps, "ref"> & React$1.RefAttributes<SVGSVGElement>>;
     readonly CirclePlus: React$1.ForwardRefExoticComponent<Omit<lucide_react.LucideProps, "ref"> & React$1.RefAttributes<SVGSVGElement>>;
+    readonly CreditCard: React$1.ForwardRefExoticComponent<Omit<lucide_react.LucideProps, "ref"> & React$1.RefAttributes<SVGSVGElement>>;
 };
 declare function AccountSettings(props: {
     fullPage?: boolean;
@@ -1462,6 +1746,10 @@ declare function OAuthCallback({ fullPage }: {
     fullPage?: boolean;
 }): react_jsx_runtime.JSX.Element;
 
+declare function Onboarding(props: {
+    fullPage?: boolean;
+}): react_jsx_runtime.JSX.Element | null;
+
 declare function PasswordReset({ searchParams, fullPage, }: {
     searchParams: Record<string, string>;
     fullPage?: boolean;
@@ -1490,6 +1778,7 @@ type Components = {
     AccountSettings: typeof AccountSettings;
     CliAuthConfirmation: typeof CliAuthConfirmation;
     MFA: typeof MFA;
+    Onboarding: typeof Onboarding;
 };
 type BaseHandlerProps = {
     fullPage: boolean;
@@ -1761,4 +2050,4 @@ type UserButtonProps = {
 };
 declare function UserButton(props: UserButtonProps): react_jsx_runtime.JSX.Element;
 
-export { AccountSettings, type AdminDomainConfig, type AdminEmailConfig, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectUpdateOptions, type AdminSentEmail, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type Auth, AuthPage, CliAuthConfirmation, type Connection, type ContactChannel, CredentialSignIn, CredentialSignUp, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, EmailVerification, ForgotPassword, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrls, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, MagicLinkSignIn, MessageCard, OAuthButton, OAuthButtonGroup, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, PasswordReset, type Project, type ProjectConfig, SelectedTeamSwitcher, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, type Session, SignIn, SignUp, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackHandler, ReactStackProvider as StackProvider, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, StackTheme, type Team, type TeamCreateOptions, type TeamInvitation$1 as TeamInvitation, type TeamMemberProfile, TeamSwitcher, type TeamUpdateOptions, type TeamUser, type User, UserAvatar, UserButton, stackAppInternalsSymbol, useStackApp, useUser };
+export { AccountSettings, type AdminDomainConfig, type AdminEmailConfig, type AdminEmailOutbox, type AdminEmailOutboxRecipient, type AdminEmailOutboxSimpleStatus, type AdminEmailOutboxStatus, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectUpdateOptions, type AdminSentEmail, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type Auth, AuthPage, CliAuthConfirmation, type Connection, type ContactChannel, CredentialSignIn, CredentialSignUp, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type EmailOutboxListOptions, type EmailOutboxListResult, type EmailOutboxUpdateOptions, EmailVerification, ForgotPassword, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrls, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, MagicLinkSignIn, MessageCard, OAuthButton, OAuthButtonGroup, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, PasswordReset, type Project, type ProjectConfig, SelectedTeamSwitcher, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, SignIn, SignUp, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackHandler, ReactStackProvider as StackProvider, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, StackTheme, type Team, type TeamCreateOptions, type TeamInvitation$1 as TeamInvitation, type TeamMemberProfile, TeamSwitcher, type TeamUpdateOptions, type TeamUser, type User, UserAvatar, UserButton, stackAppInternalsSymbol, useStackApp, useUser };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nexport * from './lib/stack-app';\n\nexport { getConvexProvidersConfig } from \"./integrations/convex\";\n\nexport { default as StackHandler } from \"./components-page/stack-handler\";\nexport { useStackApp, useUser } from \"./lib/hooks\";\nexport { default as StackProvider } from \"./providers/stack-provider\";\nexport { StackTheme } from './providers/theme-provider';\n\nexport { AccountSettings } from \"./components-page/account-settings\";\nexport { AuthPage } from \"./components-page/auth-page\";\nexport { CliAuthConfirmation } from \"./components-page/cli-auth-confirm\";\nexport { EmailVerification } from \"./components-page/email-verification\";\nexport { ForgotPassword } from \"./components-page/forgot-password\";\nexport { PasswordReset } from \"./components-page/password-reset\";\nexport { SignIn } from \"./components-page/sign-in\";\nexport { SignUp } from \"./components-page/sign-up\";\nexport { CredentialSignIn as CredentialSignIn } from \"./components/credential-sign-in\";\nexport { CredentialSignUp as CredentialSignUp } from \"./components/credential-sign-up\";\nexport { UserAvatar } from \"./components/elements/user-avatar\";\nexport { MagicLinkSignIn as MagicLinkSignIn } from \"./components/magic-link-sign-in\";\nexport { MessageCard } from \"./components/message-cards/message-card\";\nexport { OAuthButton } from \"./components/oauth-button\";\nexport { OAuthButtonGroup } from \"./components/oauth-button-group\";\nexport { SelectedTeamSwitcher } from \"./components/selected-team-switcher\";\nexport { TeamSwitcher } from \"./components/team-switcher\";\nexport { UserButton } from \"./components/user-button\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,0BAAc,qCAJd;AAMA,oBAAyC;AAEzC,2BAAwC;AACxC,mBAAqC;AACrC,4BAAyC;AACzC,4BAA2B;AAE3B,8BAAgC;AAChC,uBAAyB;AACzB,8BAAoC;AACpC,gCAAkC;AAClC,6BAA+B;AAC/B,4BAA8B;AAC9B,qBAAuB;AACvB,qBAAuB;AACvB,gCAAqD;AACrD,gCAAqD;AACrD,yBAA2B;AAC3B,gCAAmD;AACnD,0BAA4B;AAC5B,0BAA4B;AAC5B,gCAAiC;AACjC,oCAAqC;AACrC,2BAA6B;AAC7B,yBAA2B;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nexport * from './lib/stack-app';\n\nexport { getConvexProvidersConfig } from \"./integrations/convex\";\n\nexport { default as StackHandler } from \"./components-page/stack-handler\";\nexport { useStackApp, useUser } from \"./lib/hooks\";\nexport { default as StackProvider } from \"./providers/stack-provider\";\nexport { StackTheme } from './providers/theme-provider';\n\nexport { AccountSettings } from \"./components-page/account-settings\";\nexport { AuthPage } from \"./components-page/auth-page\";\nexport { CliAuthConfirmation } from \"./components-page/cli-auth-confirm\";\nexport { EmailVerification } from \"./components-page/email-verification\";\nexport { ForgotPassword } from \"./components-page/forgot-password\";\nexport { PasswordReset } from \"./components-page/password-reset\";\nexport { SignIn } from \"./components-page/sign-in\";\nexport { SignUp } from \"./components-page/sign-up\";\nexport { CredentialSignIn as CredentialSignIn } from \"./components/credential-sign-in\";\nexport { CredentialSignUp as CredentialSignUp } from \"./components/credential-sign-up\";\nexport { UserAvatar } from \"./components/elements/user-avatar\";\nexport { MagicLinkSignIn as MagicLinkSignIn } from \"./components/magic-link-sign-in\";\nexport { MessageCard } from \"./components/message-cards/message-card\";\nexport { OAuthButton } from \"./components/oauth-button\";\nexport { OAuthButtonGroup } from \"./components/oauth-button-group\";\nexport { SelectedTeamSwitcher } from \"./components/selected-team-switcher\";\nexport { TeamSwitcher } from \"./components/team-switcher\";\nexport { UserButton } from \"./components/user-button\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,0BAAc,qCAJd;AAMA,oBAAyC;AAEzC,2BAAwC;AACxC,mBAAqC;AACrC,4BAAyC;AACzC,4BAA2B;AAE3B,8BAAgC;AAChC,uBAAyB;AACzB,8BAAoC;AACpC,gCAAkC;AAClC,6BAA+B;AAC/B,4BAA8B;AAC9B,qBAAuB;AACvB,qBAAuB;AACvB,gCAAqD;AACrD,gCAAqD;AACrD,yBAA2B;AAC3B,gCAAmD;AACnD,0BAA4B;AAC5B,0BAA4B;AAC5B,gCAAiC;AACjC,oCAAqC;AACrC,2BAA6B;AAC7B,yBAA2B;","names":[]}

package/dist/integrations/convex/component/convex.config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/integrations/convex/component/convex.config.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { defineComponent } from \"convex/server\";\n\nconst component = defineComponent(\"stack_auth\");\n\nexport default component;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAAgC;AAEhC,IAAM,gBAAY,+BAAgB,YAAY;AAE9C,IAAO,wBAAQ;","names":[]}
+{"version":3,"sources":["../../../../src/integrations/convex/component/convex.config.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { defineComponent } from \"convex/server\";\n\nconst component = defineComponent(\"stack_auth\");\n\nexport default component;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAAgC;AAEhC,IAAM,gBAAY,+BAAgB,YAAY;AAE9C,IAAO,wBAAQ;","names":[]}

package/dist/integrations/convex.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/integrations/convex.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { urlString } from \"@stackframe/stack-shared/dist/utils/urls\";\nimport { defaultBaseUrl } from \"../lib/stack-app/apps/implementations/common\";\n\nexport function getConvexProvidersConfig(options: {\n  baseUrl?: string,\n  projectId: string,\n}) {\n  const baseUrl = options.baseUrl || defaultBaseUrl;\n  const projectId = options.projectId;\n  return [\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),\n      algorithm: \"ES256\",\n    },\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),\n      algorithm: \"ES256\",\n    },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,kBAA0B;AAC1B,oBAA+B;AAExB,SAAS,yBAAyB,SAGtC;AACD,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,YAAY,QAAQ;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,IAAI,IAAI,yCAA6B,SAAS,IAAI,OAAO;AAAA,MACjE,MAAM,IAAI,IAAI,yCAA6B,SAAS,0BAA0B,OAAO;AAAA,MACrF,WAAW;AAAA,IACb;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,IAAI,IAAI,yDAA6C,SAAS,IAAI,OAAO;AAAA,MACjF,MAAM,IAAI,IAAI,yCAA6B,SAAS,iDAAiD,OAAO;AAAA,MAC5G,WAAW;AAAA,IACb;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/integrations/convex.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { urlString } from \"@stackframe/stack-shared/dist/utils/urls\";\nimport { defaultBaseUrl } from \"../lib/stack-app/apps/implementations/common\";\n\nexport function getConvexProvidersConfig(options: {\n  baseUrl?: string,\n  projectId: string,\n}) {\n  const baseUrl = options.baseUrl || defaultBaseUrl;\n  const projectId = options.projectId;\n  return [\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),\n      algorithm: \"ES256\",\n    },\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),\n      algorithm: \"ES256\",\n    },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,kBAA0B;AAC1B,oBAA+B;AAExB,SAAS,yBAAyB,SAGtC;AACD,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,YAAY,QAAQ;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,IAAI,IAAI,yCAA6B,SAAS,IAAI,OAAO;AAAA,MACjE,MAAM,IAAI,IAAI,yCAA6B,SAAS,0BAA0B,OAAO;AAAA,MACrF,WAAW;AAAA,IACb;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,IAAI,IAAI,yDAA6C,SAAS,IAAI,OAAO;AAAA,MACjF,MAAM,IAAI,IAAI,yCAA6B,SAAS,iDAAiD,OAAO;AAAA,MAC5G,WAAW;AAAA,IACb;AAAA,EACF;AACF;","names":[]}

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { KnownError, StackClientInterface } from \"@stackframe/stack-shared\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { StackAssertionError, throwErr } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { neverResolve } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { deindent } from \"@stackframe/stack-shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"authenticate\",\n    providerScope: options.providerScope,\n    session,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\nexport async function addNewOAuthProviderOrScope(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, \"afterCallbackRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams() {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Stack found an outer OAuth callback state in the query parameters, but not in cookies.\n      \n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Stack.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams();\n  if (!consumed) return Result.ok(undefined);\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,0BAAiD;AAEjD,oBAA8C;AAC9C,sBAA6B;AAC7B,qBAAuB;AACvB,qBAAyB;AACzB,iBAAqC;AACrC,oBAAoE;AAEpE,eAAsB,gBACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,aAAa,aAAa;AAAA,IACpE,sBAAkB,iCAAqB,QAAQ,kBAAkB,kBAAkB;AAAA,IACnF;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,eAAe,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAEA,eAAsB,2BACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,aAAa,aAAa;AAAA,IACpE,sBAAkB,iCAAqB,QAAQ,kBAAkB,kBAAkB;AAAA,IACnF,8BAA0B,iCAAqB,OAAO,SAAS,MAAM,0BAA0B;AAAA,IAC/F;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,kCAAkC;AACzC,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,cAAQ,KAAK,IAAI,MAAM,uDAAuD,KAAK,2EAA2E,CAAC;AAC/J,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,YAAY,aAAa,IAAI,OAAO,SAAK,wBAAS,uDAAuD;AAC/H,QAAM,mBAAe,6CAA8B,aAAa;AAEhE,MAAI,CAAC,cAAc;AAGjB,YAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWZ;AACD,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AAAA,IACL;AAAA,IACA,cAAc,aAAa;AAAA,IAC3B,OAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,OACA,aACA;AAIA,QAAM,WAAW,gCAAgC;AACjD,MAAI,CAAC,SAAU,QAAO,sBAAO,GAAG,MAAS;AAKzC,MAAI;AACF,WAAO,sBAAO,GAAG,MAAM,MAAM,kBAAkB;AAAA,MAC7C,aAAa,SAAS,YAAY;AAAA,MAClC,iBAAa,iCAAqB,aAAa,aAAa;AAAA,MAC5D,cAAc,SAAS;AAAA,MACvB,OAAO,SAAS;AAAA,IAClB,CAAC,CAAC;AAAA,EACJ,SAAS,GAAG;AACV,QAAI,+BAAW,aAAa,CAAC,GAAG;AAC9B,YAAM;AAAA,IACR;AACA,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}
+{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownError, StackClientInterface } from \"@stackframe/stack-shared\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { StackAssertionError, throwErr } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { neverResolve } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { deindent } from \"@stackframe/stack-shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"authenticate\",\n    providerScope: options.providerScope,\n    session,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\nexport async function addNewOAuthProviderOrScope(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, \"afterCallbackRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams() {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Stack found an outer OAuth callback state in the query parameters, but not in cookies.\n      \n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Stack.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams();\n  if (!consumed) return Result.ok(undefined);\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,0BAAiD;AAEjD,oBAA8C;AAC9C,sBAA6B;AAC7B,qBAAuB;AACvB,qBAAyB;AACzB,iBAAqC;AACrC,oBAAoE;AAEpE,eAAsB,gBACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,aAAa,aAAa;AAAA,IACpE,sBAAkB,iCAAqB,QAAQ,kBAAkB,kBAAkB;AAAA,IACnF;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,eAAe,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAEA,eAAsB,2BACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,aAAa,aAAa;AAAA,IACpE,sBAAkB,iCAAqB,QAAQ,kBAAkB,kBAAkB;AAAA,IACnF,8BAA0B,iCAAqB,OAAO,SAAS,MAAM,0BAA0B;AAAA,IAC/F;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,kCAAkC;AACzC,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,cAAQ,KAAK,IAAI,MAAM,uDAAuD,KAAK,2EAA2E,CAAC;AAC/J,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,YAAY,aAAa,IAAI,OAAO,SAAK,wBAAS,uDAAuD;AAC/H,QAAM,mBAAe,6CAA8B,aAAa;AAEhE,MAAI,CAAC,cAAc;AAGjB,YAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWZ;AACD,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AAAA,IACL;AAAA,IACA,cAAc,aAAa;AAAA,IAC3B,OAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,OACA,aACA;AAIA,QAAM,WAAW,gCAAgC;AACjD,MAAI,CAAC,SAAU,QAAO,sBAAO,GAAG,MAAS;AAKzC,MAAI;AACF,WAAO,sBAAO,GAAG,MAAM,MAAM,kBAAkB;AAAA,MAC7C,aAAa,SAAS,YAAY;AAAA,MAClC,iBAAa,iCAAqB,aAAa,aAAa;AAAA,MAC5D,cAAc,SAAS;AAAA,MACvB,OAAO,SAAS;AAAA,IAClB,CAAC,CAAC;AAAA,EACJ,SAAS,GAAG;AACV,QAAI,+BAAW,aAAa,CAAC,GAAG;AAC9B,YAAM;AAAA,IACR;AACA,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}