@stacknet/userutils 0.2.55 → 0.2.56

package/README.md

@@ -164,30 +164,6 @@ export function Header() {
 }
 ```
 
-## Auth Flow
-
-```
-1. User clicks wallet button in ConnectWidget
-2. useStackAuth calls StackNet: POST /api/v2/stacks/{stackId}/auth/web3/challenge
-3. User signs the challenge message with their wallet
-4. Client POSTs signature to your /api/auth/callback
-5. Server verifies with StackNet, re-signs JWT with AUTH_SECRET
-6. Server sets three cookies:
-   - stackauth_jwt (HttpOnly) — server-side session validation
-   - stackauth_session (readable) — client-side UI state
-   - __csrf — CSRF protection token
-7. useSession() reads stackauth_session cookie → isAuthenticated: true
-8. UI updates to show authenticated state
-```
-
-## Cookies
-
-| Cookie | HttpOnly | Purpose |
-|--------|----------|---------|
-| `stackauth_jwt` | Yes | Server-side JWT (15 min, auto-refreshes) |
-| `stackauth_session` | No | Public session for UI (userId, address, chain, expiresAt) |
-| `__csrf` | No | CSRF double-submit token |
-
 The JWT auto-refreshes when `/api/auth/session` is called and the token is within 5 minutes of expiry.
 
 ## Hooks
@@ -229,50 +205,6 @@ const {
 })
 ```
 
-### useAuthBridge(opts?)
-
-Cross-domain auth state detection via iframe.
-
-```typescript
-const bridge = useAuthBridge()
-
-// bridge.ready — iframe loaded
-// bridge.known — previous auth found
-// bridge.identity — { address, chain, method, stackCount }
-// bridge.resolvedStackId — last stackId used on this domain
-// bridge.reportConnected({ address, chain, method, stackId })
-// bridge.reportDisconnected({ address, chain, stackId })
-```
-
-The bridge never transmits JWTs — only public metadata (address, chain, method, stackId).
-
-### useWeb3Wallet()
-
-Low-level wallet connection. Used internally by useStackAuth.
-
-```typescript
-const { wallet, connectSolana, connectEVM, signMessage, disconnect } = useWeb3Wallet()
-```
-
-### useCSRFToken(cookieName?, headerName?)
-
-Reads CSRF token for mutation requests.
-
-```typescript
-const { token, headers } = useCSRFToken()
-// headers = { 'x-csrf-token': '...' }
-```
-
-### Billing hooks
-
-```typescript
-const { plans, loading } = usePlans(apiBaseUrl?)
-const { subscription, subscribe, cancel } = useSubscription(apiBaseUrl?)
-const { usage, refresh } = useUsage(apiBaseUrl?)
-const { purchase, verifySession } = usePrepaidCheckout(apiBaseUrl?)
-const { records, refresh } = useBillingHistory(apiBaseUrl?, { limit, offset })
-```
-
 ## Components
 
 ### ConnectWidget
@@ -300,88 +232,6 @@ React context provider. Wrap your app with this.
 </UserUtilsProvider>
 ```
 
-## Server Exports
-
-```typescript
-import {
-  // Auth route handlers
-  createAuthCallback,     // POST /api/auth/callback
-  createSessionHandler,   // GET /api/auth/session
-  createLogoutHandler,    // POST /api/auth/logout
-  createOTPHandler,       // POST /api/auth/otp
-
-  // Billing proxy
-  createBillingProxy,     // All billing routes
-  createWebhookHandler,   // Stripe webhooks
-
-  // JWT utilities
-  signJWT,
-  verifyJWT,
-  verifyJWTSignature,
-  decodeJWTPayload,
-  maybeRefreshJWT,
-  extractJwt,
-
-  // Security
-  createCSRFProtection,
-  securityHeaders,
-  withSecurityHeaders,
-  nextSecurityHeaders,
-  extractIP,
-  generateToken,
-
-  // StackNet proxy
-  buildStackNetHeaders,
-  resignForStackNet,
-
-  // Rate limiting
-  createInMemoryRateLimiter,
-  createInMemoryReplayStore,
-} from '@stacknet/userutils/server'
-```
-
-## Server Config
-
-```typescript
-interface ServerConfig {
-  authSecret: string          // HMAC-SHA256 secret for signing JWTs
-  stacknetUrl: string         // https://stacknet.magma-rpc.com
-  stackId: string             // Your stack ID
-  stacknetJwtSecret?: string  // For re-signing to StackNet (defaults to authSecret)
-  cookieDomain?: string       // For subdomain sharing (e.g. '.geoff.ai')
-  secureCookies?: boolean     // Secure flag on cookies (default: true)
-  sessionMaxAge?: number      // Session duration in seconds (default: 604800 = 7 days)
-  jwtExpiry?: number          // JWT expiry in seconds (default: 900 = 15 min)
-}
-```
-
-## Auth Bridge
-
-The auth bridge enables cross-domain session detection via an invisible iframe loaded from `https://stacknet.magma-rpc.com/auth/bridge`.
-
-When a user authenticates on one stack app, the bridge stores their public identity (address, chain, method). When they visit another stack app, `useAuthBridge()` detects the known identity and can auto-trigger wallet connection if `autoConnect: true`.
-
-The bridge uses postMessage with the `stacknet-auth-bridge` protocol. It never stores or transmits JWTs.
-
-## Proxying to StackNet
-
-If your app needs to call StackNet APIs on behalf of the user, store the original StackNet JWT in a separate cookie during callback:
-
-```typescript
-// In your custom /api/auth/callback handler:
-const originalJwt = sessionData.jwt
-headers.append('Set-Cookie',
-  `stacknet_jwt=${originalJwt}; Path=/; HttpOnly; SameSite=Lax; Max-Age=604800${secureSuffix}`
-)
-
-// In your proxy routes:
-import { extractJwt } from '@stacknet/userutils/server'
-
-const jwt = extractJwt(request)  // reads stackauth_jwt cookie
-const headers = buildStackNetHeaders(jwt, process.env.STACKNET_JWT_SECRET!)
-await fetch(`https://stacknet.magma-rpc.com/api/...`, { headers })
-```
-
 ## Security
 
 - **HttpOnly cookies** prevent XSS token theft

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stacknet/userutils",
-  "version": "0.2.55",
+  "version": "0.2.56",
   "description": "Reusable auth, billing, and security utilities for StackNet stacks and applications",
   "type": "module",
   "main": "./dist/index.cjs",