@stackframe/stack 2.4.16 → 2.4.18

package/dist/index.d.ts

@@ -28,6 +28,7 @@ import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
 import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import '@stackframe/stack-shared/dist/sessions';
 import '@radix-ui/react-tabs';
 import '@radix-ui/react-collapsible';
 import '@radix-ui/react-avatar';

package/dist/lib/auth.d.mts

@@ -1,11 +1,13 @@
-import * as oauth4webapi from 'oauth4webapi';
 import { StackClientInterface } from '@stackframe/stack-shared';
-import { TokenStore } from '@stackframe/stack-shared/dist/interface/clientInterface';
 
 declare function signInWithOAuth(iface: StackClientInterface, { provider, redirectUrl, }: {
     provider: string;
     redirectUrl?: string;
 }): Promise<void>;
-declare function callOAuthCallback(iface: StackClientInterface, tokenStore: TokenStore, redirectUrl: string): Promise<oauth4webapi.OAuth2TokenEndpointResponse | null>;
+declare function callOAuthCallback(iface: StackClientInterface, redirectUrl: string): Promise<{
+    newUser: boolean;
+    accessToken: string;
+    refreshToken: string;
+} | null>;
 
 export { callOAuthCallback, signInWithOAuth };

package/dist/lib/auth.d.ts

@@ -1,11 +1,13 @@
-import * as oauth4webapi from 'oauth4webapi';
 import { StackClientInterface } from '@stackframe/stack-shared';
-import { TokenStore } from '@stackframe/stack-shared/dist/interface/clientInterface';
 
 declare function signInWithOAuth(iface: StackClientInterface, { provider, redirectUrl, }: {
     provider: string;
     redirectUrl?: string;
 }): Promise<void>;
-declare function callOAuthCallback(iface: StackClientInterface, tokenStore: TokenStore, redirectUrl: string): Promise<oauth4webapi.OAuth2TokenEndpointResponse | null>;
+declare function callOAuthCallback(iface: StackClientInterface, redirectUrl: string): Promise<{
+    newUser: boolean;
+    accessToken: string;
+    refreshToken: string;
+} | null>;
 
 export { callOAuthCallback, signInWithOAuth };

package/dist/lib/auth.js

@@ -61,7 +61,7 @@ function consumeOAuthCallbackQueryParams(expectedState) {
   window.history.replaceState({}, "", newUrl.toString());
   return originalUrl;
 }
-async function callOAuthCallback(iface, tokenStore, redirectUrl) {
+async function callOAuthCallback(iface, redirectUrl) {
   const { codeVerifier, state } = (0, import_cookie.getVerifierAndState)();
   if (!codeVerifier || !state) {
     throw new Error("Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.");
@@ -74,8 +74,7 @@ async function callOAuthCallback(iface, tokenStore, redirectUrl) {
       originalUrl.searchParams,
       (0, import_url.constructRedirectUrl)(redirectUrl),
       codeVerifier,
-      state,
-      tokenStore
+      state
     );
   } catch (e) {
     throw new import_errors.StackAssertionError("Error signing in during OAuth callback. Please try again.", { cause: e });

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["import { StackClientInterface } from \"@stackframe/stack-shared\";\nimport { saveVerifierAndState, getVerifierAndState } from \"./cookie\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { TokenStore } from \"@stackframe/stack-shared/dist/interface/clientInterface\";\nimport { neverResolve, wait } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { StackAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  {\n    provider,\n    redirectUrl,\n  } : { \n    provider: string,\n    redirectUrl?: string,\n  }\n) {\n  redirectUrl = constructRedirectUrl(redirectUrl);\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl(\n    provider,\n    redirectUrl,\n    codeChallenge,\n    state,\n  );\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n * \n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams(expectedState: string): null | URL {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      return null;\n    }\n  }\n\n  if (expectedState !== originalUrl.searchParams.get(\"state\")) {\n    // If the state doesn't match, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return originalUrl; \n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  tokenStore: TokenStore,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const { codeVerifier, state } = getVerifierAndState();\n  if (!codeVerifier || !state) {\n    throw new Error(\"Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.\");\n  }\n  const originalUrl = consumeOAuthCallbackQueryParams(state);\n  if (!originalUrl) return null;\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback)\n  try {\n    return await iface.callOAuthCallback(\n      originalUrl.searchParams,\n      constructRedirectUrl(redirectUrl),\n      codeVerifier,\n      state,\n      tokenStore,\n    );\n  } catch (e) {\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,oBAA0D;AAC1D,iBAAqC;AAErC,sBAAmC;AACnC,oBAAoC;AAEpC,eAAsB,gBACpB,OACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,oBAAc,iCAAqB,WAAW;AAC9C,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,gCAAgC,eAAmC;AAC1E,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,kBAAkB,YAAY,aAAa,IAAI,OAAO,GAAG;AAG3D,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AACT;AAEA,eAAsB,kBACpB,OACA,YACA,aACA;AAIA,QAAM,EAAE,cAAc,MAAM,QAAI,mCAAoB;AACpD,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,UAAM,IAAI,MAAM,2GAA2G;AAAA,EAC7H;AACA,QAAM,cAAc,gCAAgC,KAAK;AACzD,MAAI,CAAC;AAAa,WAAO;AAIzB,MAAI;AACF,WAAO,MAAM,MAAM;AAAA,MACjB,YAAY;AAAA,UACZ,iCAAqB,WAAW;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AACV,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}
+{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["import { StackClientInterface } from \"@stackframe/stack-shared\";\nimport { saveVerifierAndState, getVerifierAndState } from \"./cookie\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { neverResolve, wait } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { StackAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  {\n    provider,\n    redirectUrl,\n  } : { \n    provider: string,\n    redirectUrl?: string,\n  }\n) {\n  redirectUrl = constructRedirectUrl(redirectUrl);\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl(\n    provider,\n    redirectUrl,\n    codeChallenge,\n    state,\n  );\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n * \n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams(expectedState: string): null | URL {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      return null;\n    }\n  }\n\n  if (expectedState !== originalUrl.searchParams.get(\"state\")) {\n    // If the state doesn't match, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return originalUrl; \n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const { codeVerifier, state } = getVerifierAndState();\n  if (!codeVerifier || !state) {\n    throw new Error(\"Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.\");\n  }\n  const originalUrl = consumeOAuthCallbackQueryParams(state);\n  if (!originalUrl) return null;\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback)\n  try {\n    return await iface.callOAuthCallback(\n      originalUrl.searchParams,\n      constructRedirectUrl(redirectUrl),\n      codeVerifier,\n      state,\n    );\n  } catch (e) {\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,oBAA0D;AAC1D,iBAAqC;AACrC,sBAAmC;AACnC,oBAAoC;AAEpC,eAAsB,gBACpB,OACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,oBAAc,iCAAqB,WAAW;AAC9C,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,gCAAgC,eAAmC;AAC1E,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,kBAAkB,YAAY,aAAa,IAAI,OAAO,GAAG;AAG3D,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AACT;AAEA,eAAsB,kBACpB,OACA,aACA;AAIA,QAAM,EAAE,cAAc,MAAM,QAAI,mCAAoB;AACpD,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,UAAM,IAAI,MAAM,2GAA2G;AAAA,EAC7H;AACA,QAAM,cAAc,gCAAgC,KAAK;AACzD,MAAI,CAAC;AAAa,WAAO;AAIzB,MAAI;AACF,WAAO,MAAM,MAAM;AAAA,MACjB,YAAY;AAAA,UACZ,iCAAqB,WAAW;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AACV,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}

package/dist/lib/hooks.d.mts

@@ -5,6 +5,7 @@ import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
 import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import '@stackframe/stack-shared/dist/sessions';
 
 /**
  * Returns the current user object. Equivalent to `useStackApp().useUser()`.

package/dist/lib/hooks.d.ts

@@ -5,6 +5,7 @@ import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
 import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import '@stackframe/stack-shared/dist/sessions';
 
 /**
  * Returns the current user object. Equivalent to `useStackApp().useUser()`.

package/dist/lib/stack-app.d.mts

@@ -1,11 +1,20 @@
 import { ServerUserJson, OAuthProviderConfigJson, KnownErrors } from '@stackframe/stack-shared';
-import { TokenStore, UserJson, UserUpdateJson, ProjectJson, ProductionModeError, TeamJson, EmailConfigJson, DomainConfigJson, ClientProjectJson } from '@stackframe/stack-shared/dist/interface/clientInterface';
+import { UserJson, UserUpdateJson, ProjectJson, ProductionModeError, TeamJson, EmailConfigJson, DomainConfigJson, ClientProjectJson } from '@stackframe/stack-shared/dist/interface/clientInterface';
 import { ReadonlyJson } from '@stackframe/stack-shared/dist/utils/json';
 import { ProjectUpdateOptions, ApiKeySetCreateOptions } from '@stackframe/stack-shared/dist/interface/adminInterface';
 import { ServerUserUpdateJson, ServerTeamCustomizableJson, ServerPermissionDefinitionCustomizableJson, ServerPermissionDefinitionJson, EmailTemplateType } from '@stackframe/stack-shared/dist/interface/serverInterface';
 import { ListEmailTemplatesCrud, EmailTemplateCrud } from '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import { Session } from '@stackframe/stack-shared/dist/sessions';
 
-type TokenStoreInit<HasTokenStore extends boolean = boolean> = HasTokenStore extends true ? ("cookie" | "nextjs-cookie" | "memory" | Request) : HasTokenStore extends false ? null : TokenStoreInit<true> | TokenStoreInit<false>;
+type RequestLike = {
+    headers: {
+        get: (name: string) => string | null;
+    };
+};
+type TokenStoreInit<HasTokenStore extends boolean = boolean> = HasTokenStore extends true ? ("cookie" | "nextjs-cookie" | "memory" | RequestLike | {
+    accessToken: string;
+    refreshToken: string;
+}) : HasTokenStore extends false ? null : TokenStoreInit<true> | TokenStoreInit<false>;
 type HandlerUrls = {
     handler: string;
     signIn: string;
@@ -36,8 +45,7 @@ type StackServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId e
 type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = ((StackServerAppConstructorOptions<HasTokenStore, ProjectId> & {
     superSecretAdminKey?: string;
 }) | (Omit<StackServerAppConstructorOptions<HasTokenStore, ProjectId>, "publishableClientKey" | "secretServerKey"> & {
-    projectOwnerTokens: TokenStore;
-    refreshProjectOwnerTokens: () => Promise<void>;
+    projectOwnerSession: Session;
 }));
 type StackClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {
     uniqueIdentifier: string;
@@ -47,16 +55,15 @@ type RedirectToOptions = {
     replace?: boolean;
 };
 type Auth<T, C> = {
-    readonly tokenStore: TokenStore;
-    refreshAccessToken(this: T): Promise<void>;
+    readonly session: Session;
     updateSelectedTeam(this: T, team: Team | null): Promise<void>;
     update(this: T, user: C): Promise<void>;
     signOut(this: T): Promise<void>;
-    sendVerificationEmail(this: T): Promise<KnownErrors["EmailAlreadyVerified"] | undefined>;
+    sendVerificationEmail(this: T): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
     updatePassword(this: T, options: {
         oldPassword: string;
         newPassword: string;
-    }): Promise<KnownErrors["PasswordMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    }): Promise<KnownErrors["PasswordMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
 };
 type InternalAuth<T> = {
     createProject(this: T, newProject: ProjectUpdateOptions & {
@@ -230,21 +237,21 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
     signInWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["EmailPasswordMismatch"] | undefined>;
+    }): Promise<KnownErrors["EmailPasswordMismatch"] | void>;
     signUpWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    }): Promise<KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
     callOAuthCallback(): Promise<boolean>;
-    sendForgotPasswordEmail(email: string): Promise<KnownErrors["UserNotFound"] | undefined>;
-    sendMagicLinkEmail(email: string): Promise<KnownErrors["RedirectUrlNotWhitelisted"] | undefined>;
+    sendForgotPasswordEmail(email: string): Promise<KnownErrors["UserNotFound"] | void>;
+    sendMagicLinkEmail(email: string): Promise<KnownErrors["RedirectUrlNotWhitelisted"] | void>;
     resetPassword(options: {
         code: string;
         password: string;
-    }): Promise<KnownErrors["PasswordResetError"] | undefined>;
-    verifyPasswordResetCode(code: string): Promise<KnownErrors["PasswordResetCodeError"] | undefined>;
-    verifyEmail(code: string): Promise<KnownErrors["EmailVerificationError"] | undefined>;
-    signInWithMagicLink(code: string): Promise<KnownErrors["MagicLinkError"] | undefined>;
+    }): Promise<KnownErrors["PasswordResetError"] | void>;
+    verifyPasswordResetCode(code: string): Promise<KnownErrors["PasswordResetCodeError"] | void>;
+    verifyEmail(code: string): Promise<KnownErrors["EmailVerificationError"] | void>;
+    signInWithMagicLink(code: string): Promise<KnownErrors["MagicLinkError"] | void>;
     [stackAppInternalsSymbol]: {
         toClientJson(): StackClientAppJson<HasTokenStore, ProjectId>;
         setCurrentUser(userJsonPromise: Promise<UserJson | null>): void;

package/dist/lib/stack-app.d.ts

@@ -1,11 +1,20 @@
 import { ServerUserJson, OAuthProviderConfigJson, KnownErrors } from '@stackframe/stack-shared';
-import { TokenStore, UserJson, UserUpdateJson, ProjectJson, ProductionModeError, TeamJson, EmailConfigJson, DomainConfigJson, ClientProjectJson } from '@stackframe/stack-shared/dist/interface/clientInterface';
+import { UserJson, UserUpdateJson, ProjectJson, ProductionModeError, TeamJson, EmailConfigJson, DomainConfigJson, ClientProjectJson } from '@stackframe/stack-shared/dist/interface/clientInterface';
 import { ReadonlyJson } from '@stackframe/stack-shared/dist/utils/json';
 import { ProjectUpdateOptions, ApiKeySetCreateOptions } from '@stackframe/stack-shared/dist/interface/adminInterface';
 import { ServerUserUpdateJson, ServerTeamCustomizableJson, ServerPermissionDefinitionCustomizableJson, ServerPermissionDefinitionJson, EmailTemplateType } from '@stackframe/stack-shared/dist/interface/serverInterface';
 import { ListEmailTemplatesCrud, EmailTemplateCrud } from '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import { Session } from '@stackframe/stack-shared/dist/sessions';
 
-type TokenStoreInit<HasTokenStore extends boolean = boolean> = HasTokenStore extends true ? ("cookie" | "nextjs-cookie" | "memory" | Request) : HasTokenStore extends false ? null : TokenStoreInit<true> | TokenStoreInit<false>;
+type RequestLike = {
+    headers: {
+        get: (name: string) => string | null;
+    };
+};
+type TokenStoreInit<HasTokenStore extends boolean = boolean> = HasTokenStore extends true ? ("cookie" | "nextjs-cookie" | "memory" | RequestLike | {
+    accessToken: string;
+    refreshToken: string;
+}) : HasTokenStore extends false ? null : TokenStoreInit<true> | TokenStoreInit<false>;
 type HandlerUrls = {
     handler: string;
     signIn: string;
@@ -36,8 +45,7 @@ type StackServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId e
 type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = ((StackServerAppConstructorOptions<HasTokenStore, ProjectId> & {
     superSecretAdminKey?: string;
 }) | (Omit<StackServerAppConstructorOptions<HasTokenStore, ProjectId>, "publishableClientKey" | "secretServerKey"> & {
-    projectOwnerTokens: TokenStore;
-    refreshProjectOwnerTokens: () => Promise<void>;
+    projectOwnerSession: Session;
 }));
 type StackClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {
     uniqueIdentifier: string;
@@ -47,16 +55,15 @@ type RedirectToOptions = {
     replace?: boolean;
 };
 type Auth<T, C> = {
-    readonly tokenStore: TokenStore;
-    refreshAccessToken(this: T): Promise<void>;
+    readonly session: Session;
     updateSelectedTeam(this: T, team: Team | null): Promise<void>;
     update(this: T, user: C): Promise<void>;
     signOut(this: T): Promise<void>;
-    sendVerificationEmail(this: T): Promise<KnownErrors["EmailAlreadyVerified"] | undefined>;
+    sendVerificationEmail(this: T): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
     updatePassword(this: T, options: {
         oldPassword: string;
         newPassword: string;
-    }): Promise<KnownErrors["PasswordMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    }): Promise<KnownErrors["PasswordMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
 };
 type InternalAuth<T> = {
     createProject(this: T, newProject: ProjectUpdateOptions & {
@@ -230,21 +237,21 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
     signInWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["EmailPasswordMismatch"] | undefined>;
+    }): Promise<KnownErrors["EmailPasswordMismatch"] | void>;
     signUpWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    }): Promise<KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
     callOAuthCallback(): Promise<boolean>;
-    sendForgotPasswordEmail(email: string): Promise<KnownErrors["UserNotFound"] | undefined>;
-    sendMagicLinkEmail(email: string): Promise<KnownErrors["RedirectUrlNotWhitelisted"] | undefined>;
+    sendForgotPasswordEmail(email: string): Promise<KnownErrors["UserNotFound"] | void>;
+    sendMagicLinkEmail(email: string): Promise<KnownErrors["RedirectUrlNotWhitelisted"] | void>;
     resetPassword(options: {
         code: string;
         password: string;
-    }): Promise<KnownErrors["PasswordResetError"] | undefined>;
-    verifyPasswordResetCode(code: string): Promise<KnownErrors["PasswordResetCodeError"] | undefined>;
-    verifyEmail(code: string): Promise<KnownErrors["EmailVerificationError"] | undefined>;
-    signInWithMagicLink(code: string): Promise<KnownErrors["MagicLinkError"] | undefined>;
+    }): Promise<KnownErrors["PasswordResetError"] | void>;
+    verifyPasswordResetCode(code: string): Promise<KnownErrors["PasswordResetCodeError"] | void>;
+    verifyEmail(code: string): Promise<KnownErrors["EmailVerificationError"] | void>;
+    signInWithMagicLink(code: string): Promise<KnownErrors["MagicLinkError"] | void>;
     [stackAppInternalsSymbol]: {
         toClientJson(): StackClientAppJson<HasTokenStore, ProjectId>;
         setCurrentUser(userJsonPromise: Promise<UserJson | null>): void;