@stacknet/userutils 0.4.1 → 0.5.3

package/dist/types/index.d.cts

@@ -1,4 +1,5 @@
-export { A as APIResponse, B as BillingPlan, a as BillingRecord, M as MPCNode, N as NetworkStatus, P as PrepaidCheckoutResult, b as PrepaidVerifyResult, c as PublicSession, S as Session, d as Subscription, U as UsageSummary, e as UserUtilsCallbacks, f as UserUtilsConfig, W as Web3Chain } from '../config-BrziGArs.cjs';
+export { A as APIResponse, M as MPCNode, N as NetworkStatus, P as PublicSession, S as Session, W as Web3Chain } from '../auth-DR2aYcor.cjs';
+export { B as BillingPlan, a as BillingRecord, P as PrepaidCheckoutResult, b as PrepaidVerifyResult, S as Subscription, U as UsageSummary, c as UserUtilsCallbacks, d as UserUtilsConfig } from '../config-Bjh8PEhY.cjs';
 
 /** User profile — global (network-wide) or stack-scoped */
 interface UserProfile {
@@ -6,6 +7,12 @@ interface UserProfile {
     username: string;
     avatarUrl?: string;
     bio?: string;
+    /**
+     * Stack-scoped payout address (e.g. Solana wallet for Paper / USDC payouts).
+     * Only meaningful on stack-scoped profiles. The backend stores this as
+     * `payment_address` (snake_case).
+     */
+    paymentAddress?: string;
     createdAt?: number;
     updatedAt?: number;
 }
@@ -14,6 +21,12 @@ interface ProfileUpdateInput {
     username?: string;
     avatarUrl?: string;
     bio?: string;
+    /**
+     * Stack-scoped payout address. Pass through `useProfile().updateProfile`
+     * with a stack-scoped scope to set the payment_address on the user's
+     * profile for that stack.
+     */
+    paymentAddress?: string;
 }
 /** Scope for profile operations */
 type ProfileScope = 'global' | {

package/dist/types/index.d.ts

@@ -1,4 +1,5 @@
-export { A as APIResponse, B as BillingPlan, a as BillingRecord, M as MPCNode, N as NetworkStatus, P as PrepaidCheckoutResult, b as PrepaidVerifyResult, c as PublicSession, S as Session, d as Subscription, U as UsageSummary, e as UserUtilsCallbacks, f as UserUtilsConfig, W as Web3Chain } from '../config-BrziGArs.js';
+export { A as APIResponse, M as MPCNode, N as NetworkStatus, P as PublicSession, S as Session, W as Web3Chain } from '../auth-DR2aYcor.js';
+export { B as BillingPlan, a as BillingRecord, P as PrepaidCheckoutResult, b as PrepaidVerifyResult, S as Subscription, U as UsageSummary, c as UserUtilsCallbacks, d as UserUtilsConfig } from '../config-_ZjAzNkJ.js';
 
 /** User profile — global (network-wide) or stack-scoped */
 interface UserProfile {
@@ -6,6 +7,12 @@ interface UserProfile {
     username: string;
     avatarUrl?: string;
     bio?: string;
+    /**
+     * Stack-scoped payout address (e.g. Solana wallet for Paper / USDC payouts).
+     * Only meaningful on stack-scoped profiles. The backend stores this as
+     * `payment_address` (snake_case).
+     */
+    paymentAddress?: string;
     createdAt?: number;
     updatedAt?: number;
 }
@@ -14,6 +21,12 @@ interface ProfileUpdateInput {
     username?: string;
     avatarUrl?: string;
     bio?: string;
+    /**
+     * Stack-scoped payout address. Pass through `useProfile().updateProfile`
+     * with a stack-scoped scope to set the payment_address on the user's
+     * profile for that stack.
+     */
+    paymentAddress?: string;
 }
 /** Scope for profile operations */
 type ProfileScope = 'global' | {

package/dist/types-CAoB_5kk.d.cts

@@ -0,0 +1,60 @@
+import { P as PublicSession, W as Web3Chain } from './auth-DR2aYcor.cjs';
+
+interface AuthTransport {
+    /** Store credentials after successful login */
+    storeCredentials(token: string, session: PublicSession): Promise<void>;
+    /** Retrieve the stored auth token (null if not authenticated) */
+    getToken(): Promise<string | null>;
+    /** Get headers to attach to authenticated API requests */
+    getHeaders(): Promise<Record<string, string>>;
+    /** Read the stored session without a network call */
+    getStoredSession(): Promise<PublicSession | null>;
+    /** Clear all stored auth data */
+    clear(): Promise<void>;
+}
+interface AuthClientConfig {
+    /** Base URL for app API routes (e.g. http://localhost:3000) */
+    apiBaseUrl: string;
+    /** Direct StackNet URL for challenges (defaults to https://stacknet.magma-rpc.com) */
+    stacknetUrl?: string;
+    /** Stack identifier */
+    stackId?: string;
+    /** Auth transport (web cookies or native secure storage) */
+    transport: AuthTransport;
+    /** Optional fallback token for dev (e.g. service key) */
+    serviceKey?: string;
+    /** Callbacks */
+    onAuthSuccess?: (session: PublicSession) => void;
+    onAuthError?: (error: Error) => void;
+    onLogout?: () => void;
+}
+interface AuthClient {
+    /** Email + password login */
+    login(email: string, password: string): Promise<PublicSession>;
+    /** Web3 wallet login (challenge must be obtained first) */
+    loginWeb3(params: {
+        chain: Web3Chain;
+        address: string;
+        message: string;
+        signature: string;
+    }): Promise<PublicSession>;
+    /** OTP code login */
+    loginOTP(code: string): Promise<PublicSession>;
+    /** Get current session (from storage, then validate with server) */
+    getSession(): Promise<PublicSession | null>;
+    /** Check if token is valid with the server */
+    checkSession(): Promise<boolean>;
+    /** Get a web3 challenge for wallet signing */
+    getChallenge(chain: Web3Chain, address: string): Promise<{
+        message: string;
+        nonce: string;
+    }>;
+    /** Sign out and clear stored credentials */
+    logout(): Promise<void>;
+    /** Get auth headers for API requests */
+    getHeaders(): Promise<Record<string, string>>;
+    /** Get stored token directly */
+    getToken(): Promise<string | null>;
+}
+
+export type { AuthClient as A, AuthClientConfig as a, AuthTransport as b };

package/dist/types-Dghy_8Wh.d.ts

@@ -0,0 +1,60 @@
+import { P as PublicSession, W as Web3Chain } from './auth-DR2aYcor.js';
+
+interface AuthTransport {
+    /** Store credentials after successful login */
+    storeCredentials(token: string, session: PublicSession): Promise<void>;
+    /** Retrieve the stored auth token (null if not authenticated) */
+    getToken(): Promise<string | null>;
+    /** Get headers to attach to authenticated API requests */
+    getHeaders(): Promise<Record<string, string>>;
+    /** Read the stored session without a network call */
+    getStoredSession(): Promise<PublicSession | null>;
+    /** Clear all stored auth data */
+    clear(): Promise<void>;
+}
+interface AuthClientConfig {
+    /** Base URL for app API routes (e.g. http://localhost:3000) */
+    apiBaseUrl: string;
+    /** Direct StackNet URL for challenges (defaults to https://stacknet.magma-rpc.com) */
+    stacknetUrl?: string;
+    /** Stack identifier */
+    stackId?: string;
+    /** Auth transport (web cookies or native secure storage) */
+    transport: AuthTransport;
+    /** Optional fallback token for dev (e.g. service key) */
+    serviceKey?: string;
+    /** Callbacks */
+    onAuthSuccess?: (session: PublicSession) => void;
+    onAuthError?: (error: Error) => void;
+    onLogout?: () => void;
+}
+interface AuthClient {
+    /** Email + password login */
+    login(email: string, password: string): Promise<PublicSession>;
+    /** Web3 wallet login (challenge must be obtained first) */
+    loginWeb3(params: {
+        chain: Web3Chain;
+        address: string;
+        message: string;
+        signature: string;
+    }): Promise<PublicSession>;
+    /** OTP code login */
+    loginOTP(code: string): Promise<PublicSession>;
+    /** Get current session (from storage, then validate with server) */
+    getSession(): Promise<PublicSession | null>;
+    /** Check if token is valid with the server */
+    checkSession(): Promise<boolean>;
+    /** Get a web3 challenge for wallet signing */
+    getChallenge(chain: Web3Chain, address: string): Promise<{
+        message: string;
+        nonce: string;
+    }>;
+    /** Sign out and clear stored credentials */
+    logout(): Promise<void>;
+    /** Get auth headers for API requests */
+    getHeaders(): Promise<Record<string, string>>;
+    /** Get stored token directly */
+    getToken(): Promise<string | null>;
+}
+
+export type { AuthClient as A, AuthClientConfig as a, AuthTransport as b };

package/dist/utils/index.cjs

@@ -1,2 +1,2 @@
-'use strict';var clsx=require('clsx'),tailwindMerge=require('tailwind-merge');function i(...t){return tailwindMerge.twMerge(clsx.clsx(t))}function s(t){return t>=1e12?`${(t/1e12).toFixed(t%1e12===0?0:1)}T`:t>=1e9?`${(t/1e9).toFixed(t%1e9===0?0:1)}B`:t>=1e6?`${(t/1e6).toFixed(t%1e6===0?0:1)}M`:t>=1e3?`${(t/1e3).toFixed(0)}K`:t.toLocaleString()}function a(t,r){if(!t)return "/";if(t.startsWith("/")&&!t.startsWith("//"))return t;try{let e=new URL(t,r);return e.origin!==r?"/":e.pathname+e.search+e.hash}catch{return "/"}}function u(t){try{let r=t.split(".");if(r.length!==3)return null;let e=atob(r[1].replace(/-/g,"+").replace(/_/g,"/"));return JSON.parse(e)}catch{return null}}function c(){if(typeof document>"u")return null;try{let t=document.cookie.split(";").map(e=>e.trim()).find(e=>e.startsWith("stackauth_session="));if(!t)return null;let r=t.slice(18);return JSON.parse(atob(r.replace(/-/g,"+").replace(/_/g,"/")))}catch{return null}}function l(t="__csrf"){if(typeof document>"u")return null;let r=document.cookie.split(";").map(e=>e.trim()).find(e=>e.startsWith(`${t}=`));return r?r.slice(t.length+1):null}
-exports.cn=i;exports.decodeJwtPayloadClient=u;exports.formatTokens=s;exports.readCSRFCookie=l;exports.readSessionCookie=c;exports.validateRedirectUrl=a;
+'use strict';var clsx=require('clsx'),tailwindMerge=require('tailwind-merge');function s(...t){return tailwindMerge.twMerge(clsx.clsx(t))}function a(t){return t>=1e12?`${(t/1e12).toFixed(t%1e12===0?0:1)}T`:t>=1e9?`${(t/1e9).toFixed(t%1e9===0?0:1)}B`:t>=1e6?`${(t/1e6).toFixed(t%1e6===0?0:1)}M`:t>=1e3?`${(t/1e3).toFixed(0)}K`:t.toLocaleString()}function u(t,e){if(!t)return "/";if(t.startsWith("/")&&!t.startsWith("//"))return t;try{let r=new URL(t,e);return r.origin!==e?"/":r.pathname+r.search+r.hash}catch{return "/"}}function c(t,e="#"){if(!t||typeof t!="string")return e;let r=t.trim();if(r===""||r==="#")return e;if(r.startsWith("/")||r.startsWith("./")||r.startsWith("../"))return r;try{let n=new URL(r);if(n.protocol==="http:"||n.protocol==="https:")return n.toString()}catch{}return e}function l(t){try{let e=t.split(".");if(e.length!==3)return null;let r=atob(e[1].replace(/-/g,"+").replace(/_/g,"/"));return JSON.parse(r)}catch{return null}}function d(){if(typeof document>"u")return null;try{let t=document.cookie.split(";").map(r=>r.trim()).find(r=>r.startsWith("stackauth_session="));if(!t)return null;let e=t.slice(18);return JSON.parse(atob(e.replace(/-/g,"+").replace(/_/g,"/")))}catch{return null}}function f(t="__csrf"){if(typeof document>"u")return null;let e=document.cookie.split(";").map(r=>r.trim()).find(r=>r.startsWith(`${t}=`));return e?e.slice(t.length+1):null}
+exports.cn=s;exports.decodeJwtPayloadClient=l;exports.formatTokens=a;exports.readCSRFCookie=f;exports.readSessionCookie=d;exports.safeUrl=c;exports.validateRedirectUrl=u;

package/dist/utils/index.d.cts

@@ -11,6 +11,21 @@ declare function formatTokens(n: number): string;
  */
 declare function validateRedirectUrl(url: string, allowedOrigin: string): string;
 
+/**
+ * Returns a safe href value for an anchor or image source.
+ *
+ * Allows: relative paths (starting with /, ./, ../), and absolute http(s) URLs.
+ * Blocks: javascript:, data:, file:, vbscript:, mailto:, etc.
+ *
+ * React only sanitizes `javascript:` in href attributes by default; this
+ * helper closes the gap for `data:` (which can carry HTML/JS) and any other
+ * non-network protocol that a misconfigured or malicious config could supply.
+ *
+ * Returns the supplied `fallback` (default '#') for any input that fails
+ * validation, so the markup never renders an unsafe URL.
+ */
+declare function safeUrl(url: string | undefined | null, fallback?: string): string;
+
 /**
  * Client-side JWT payload decode — NO VERIFICATION.
  * For display purposes only. Never trust the result for auth decisions.
@@ -33,4 +48,4 @@ declare function readSessionCookie(): {
  */
 declare function readCSRFCookie(cookieName?: string): string | null;
 
-export { cn, decodeJwtPayloadClient, formatTokens, readCSRFCookie, readSessionCookie, validateRedirectUrl };
+export { cn, decodeJwtPayloadClient, formatTokens, readCSRFCookie, readSessionCookie, safeUrl, validateRedirectUrl };

package/dist/utils/index.d.ts

@@ -11,6 +11,21 @@ declare function formatTokens(n: number): string;
  */
 declare function validateRedirectUrl(url: string, allowedOrigin: string): string;
 
+/**
+ * Returns a safe href value for an anchor or image source.
+ *
+ * Allows: relative paths (starting with /, ./, ../), and absolute http(s) URLs.
+ * Blocks: javascript:, data:, file:, vbscript:, mailto:, etc.
+ *
+ * React only sanitizes `javascript:` in href attributes by default; this
+ * helper closes the gap for `data:` (which can carry HTML/JS) and any other
+ * non-network protocol that a misconfigured or malicious config could supply.
+ *
+ * Returns the supplied `fallback` (default '#') for any input that fails
+ * validation, so the markup never renders an unsafe URL.
+ */
+declare function safeUrl(url: string | undefined | null, fallback?: string): string;
+
 /**
  * Client-side JWT payload decode — NO VERIFICATION.
  * For display purposes only. Never trust the result for auth decisions.
@@ -33,4 +48,4 @@ declare function readSessionCookie(): {
  */
 declare function readCSRFCookie(cookieName?: string): string | null;
 
-export { cn, decodeJwtPayloadClient, formatTokens, readCSRFCookie, readSessionCookie, validateRedirectUrl };
+export { cn, decodeJwtPayloadClient, formatTokens, readCSRFCookie, readSessionCookie, safeUrl, validateRedirectUrl };

package/dist/utils/index.js

@@ -1,2 +1,2 @@
-import {clsx}from'clsx';import {twMerge}from'tailwind-merge';function i(...t){return twMerge(clsx(t))}function s(t){return t>=1e12?`${(t/1e12).toFixed(t%1e12===0?0:1)}T`:t>=1e9?`${(t/1e9).toFixed(t%1e9===0?0:1)}B`:t>=1e6?`${(t/1e6).toFixed(t%1e6===0?0:1)}M`:t>=1e3?`${(t/1e3).toFixed(0)}K`:t.toLocaleString()}function a(t,r){if(!t)return "/";if(t.startsWith("/")&&!t.startsWith("//"))return t;try{let e=new URL(t,r);return e.origin!==r?"/":e.pathname+e.search+e.hash}catch{return "/"}}function u(t){try{let r=t.split(".");if(r.length!==3)return null;let e=atob(r[1].replace(/-/g,"+").replace(/_/g,"/"));return JSON.parse(e)}catch{return null}}function c(){if(typeof document>"u")return null;try{let t=document.cookie.split(";").map(e=>e.trim()).find(e=>e.startsWith("stackauth_session="));if(!t)return null;let r=t.slice(18);return JSON.parse(atob(r.replace(/-/g,"+").replace(/_/g,"/")))}catch{return null}}function l(t="__csrf"){if(typeof document>"u")return null;let r=document.cookie.split(";").map(e=>e.trim()).find(e=>e.startsWith(`${t}=`));return r?r.slice(t.length+1):null}
-export{i as cn,u as decodeJwtPayloadClient,s as formatTokens,l as readCSRFCookie,c as readSessionCookie,a as validateRedirectUrl};
+import {clsx}from'clsx';import {twMerge}from'tailwind-merge';function s(...t){return twMerge(clsx(t))}function a(t){return t>=1e12?`${(t/1e12).toFixed(t%1e12===0?0:1)}T`:t>=1e9?`${(t/1e9).toFixed(t%1e9===0?0:1)}B`:t>=1e6?`${(t/1e6).toFixed(t%1e6===0?0:1)}M`:t>=1e3?`${(t/1e3).toFixed(0)}K`:t.toLocaleString()}function u(t,e){if(!t)return "/";if(t.startsWith("/")&&!t.startsWith("//"))return t;try{let r=new URL(t,e);return r.origin!==e?"/":r.pathname+r.search+r.hash}catch{return "/"}}function c(t,e="#"){if(!t||typeof t!="string")return e;let r=t.trim();if(r===""||r==="#")return e;if(r.startsWith("/")||r.startsWith("./")||r.startsWith("../"))return r;try{let n=new URL(r);if(n.protocol==="http:"||n.protocol==="https:")return n.toString()}catch{}return e}function l(t){try{let e=t.split(".");if(e.length!==3)return null;let r=atob(e[1].replace(/-/g,"+").replace(/_/g,"/"));return JSON.parse(r)}catch{return null}}function d(){if(typeof document>"u")return null;try{let t=document.cookie.split(";").map(r=>r.trim()).find(r=>r.startsWith("stackauth_session="));if(!t)return null;let e=t.slice(18);return JSON.parse(atob(e.replace(/-/g,"+").replace(/_/g,"/")))}catch{return null}}function f(t="__csrf"){if(typeof document>"u")return null;let e=document.cookie.split(";").map(r=>r.trim()).find(r=>r.startsWith(`${t}=`));return e?e.slice(t.length+1):null}
+export{s as cn,l as decodeJwtPayloadClient,a as formatTokens,f as readCSRFCookie,d as readSessionCookie,c as safeUrl,u as validateRedirectUrl};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stacknet/userutils",
-  "version": "0.4.1",
+  "version": "0.5.3",
   "description": "Reusable auth, billing, and security utilities for StackNet stacks and applications",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -36,6 +36,16 @@
       "types": "./dist/server/index.d.ts",
       "import": "./dist/server/index.js",
       "require": "./dist/server/index.cjs"
+    },
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js",
+      "require": "./dist/core/index.cjs"
+    },
+    "./adapters": {
+      "types": "./dist/adapters/index.d.ts",
+      "import": "./dist/adapters/index.js",
+      "require": "./dist/adapters/index.cjs"
     }
   },
   "files": [