@stacknet/userutils 0.6.0 → 0.6.2

package/dist/config-CLzVWDrU.d.cts

@@ -1,177 +0,0 @@
-import { P as PublicSession } from './auth-c1d7Eji2.cjs';
-
-interface BillingPlan {
-    id: string;
-    name: string;
-    price_cents: number;
-    token_allocation: number;
-    features: string;
-    sort_order?: number;
-    is_active?: boolean;
-}
-interface Subscription {
-    plan?: {
-        id: string;
-        name: string;
-        priceCents: number;
-        tokenAllocation: number;
-    };
-    planId?: string;
-    planName?: string;
-    status: string;
-    tokensUsed?: number;
-    tokensRemaining?: number;
-    usagePercent?: number;
-    periodStart?: number;
-    periodEnd?: number;
-    cancelAtPeriodEnd?: boolean;
-    stripeCustomerId?: string;
-}
-interface UsageSummary {
-    ownerId: string;
-    planAllocation: number;
-    planId: string | null;
-    planName: string;
-    inferenceUsed: number;
-    ledgerSpent: number;
-    totalUsed: number;
-    remaining: number;
-    percent: number;
-    exceeded: boolean;
-    breakdown: {
-        subscription: number;
-        prepaidCredit: number;
-        tokenGrants: number;
-        inference: number;
-        skillRegistrations: number;
-        skillRegistrationCount: number;
-    };
-}
-interface PrepaidCheckoutResult {
-    url: string;
-    sessionId?: string;
-}
-interface PrepaidVerifyResult {
-    alreadyCredited: boolean;
-    tokensCredited?: number;
-    amountCents?: number;
-    paymentRef?: string;
-}
-interface BillingRecord {
-    id: string;
-    recorded_at?: number;
-    date?: string;
-    reason?: string;
-    description?: string;
-    amount: number;
-    direction?: string;
-    source?: string;
-    status?: string;
-    payment_ref?: string;
-}
-
-/** Decode JWT payload without verification (server-side helper) */
-declare function decodeJWTPayload(jwt: string): Record<string, any> | null;
-/** Sign a JWT with HMAC-SHA256 */
-declare function signJWT(payload: Record<string, any>, secret: string): string;
-/** Verify a JWT signature with HMAC-SHA256 (constant-time comparison) */
-declare function verifyJWTSignature(jwt: string, secret: string): boolean;
-/** Verify JWT and return payload if valid (checks signature + expiry) */
-declare function verifyJWT(jwt: string, secret: string): Record<string, any> | null;
-/**
- * Check if JWT needs refresh and return a new one if so.
- * Returns null if no refresh needed or JWT is invalid.
- */
-declare function maybeRefreshJWT(jwt: string, secret: string, expirySeconds?: number, refreshWindowSeconds?: number): string | null;
-/** Generate a cryptographically secure random token */
-declare function generateToken(bytes?: number): string;
-/** Options controlling how the real client IP is extracted from a Request.
- *
- *  The previous implementation trusted `X-Forwarded-For[0]` unconditionally,
- *  which lets any direct caller pin arbitrary values and bypass per-IP rate
- *  limits. The correct read depends on how many reverse proxies sit between
- *  the app and the real client: with N trusted hops, the real client IP is
- *  at position `(length - N)` in the XFF list, because each trusted hop
- *  appends its peer IP and the attacker-controlled prefix is pushed left. */
-interface IPExtractorConfig {
-    /** Number of trusted reverse-proxy hops between this app and the real client.
-     *  - `0`: do NOT trust X-Forwarded-For (app is directly internet-exposed).
-     *  - `1` (default): one trusted proxy (e.g. single LB, Vercel edge, Nginx).
-     *  - `N`: N trusted hops; the real client IP is `XFF[length - N]`.
-     *  If XFF has fewer entries than expected, the chain is misconfigured or
-     *  spoofed and the extractor falls through to the next source. */
-    trustedProxyCount?: number;
-    /** Trust the `X-Real-IP` header. Only enable if your proxy sets it AND
-     *  strips any inbound `X-Real-IP` from clients. Default: `false`. */
-    trustRealIpHeader?: boolean;
-    /** Override entirely — return the real client IP from a request however
-     *  you know best (e.g. a platform-specific header like `cf-connecting-ip`
-     *  or `x-vercel-forwarded-for`). If this returns a non-empty string it
-     *  wins; if it returns null/empty the other strategies run. */
-    customExtractor?: (request: Request) => string | null | undefined;
-}
-/** Extract the real client IP address from a request.
- *
- *  Default behavior (`trustedProxyCount: 1`) is safe for the common case of
- *  one trusted reverse proxy. Consumers with no proxy must pass `0`, and
- *  consumers behind multiple proxies must pass the exact hop count. */
-declare function extractIP(request: Request, config?: IPExtractorConfig): string;
-
-/** Client-side configuration for UserUtilsProvider */
-interface UserUtilsConfig {
-    /** Base URL for API calls (empty string = same origin) */
-    apiBaseUrl: string;
-    /** StackNet stack identifier */
-    stackId?: string;
-    /** Direct StackNet URL for client-side API calls (e.g. challenges) */
-    stacknetUrl?: string;
-    /** Theme preference */
-    theme?: 'light' | 'dark' | 'system';
-}
-/** Callbacks for auth and billing events */
-interface UserUtilsCallbacks {
-    onAuthSuccess?: (session: PublicSession) => void;
-    onAuthError?: (error: Error) => void;
-    onLogout?: () => void;
-    onSubscriptionChange?: (subscription: Subscription) => void;
-}
-/** Server-side configuration for handler factories */
-interface ServerConfig {
-    /** HMAC-SHA256 secret for signing JWTs */
-    authSecret: string;
-    /** StackNet backend URL (always https://stacknet.magma-rpc.com) */
-    stacknetUrl: string;
-    /** StackNet stack identifier */
-    stackId: string;
-    /** JWT secret for re-signing to StackNet (defaults to authSecret) */
-    stacknetJwtSecret?: string;
-    /** Cookie domain for subdomain sharing (e.g. '.geoff.ai') */
-    cookieDomain?: string;
-    /** Use Secure flag on cookies (default: true) */
-    secureCookies?: boolean;
-    /** Session max age in seconds (default: 604800 = 7 days) */
-    sessionMaxAge?: number;
-    /** JWT expiry in seconds (default: 900 = 15 minutes) */
-    jwtExpiry?: number;
-    /**
-     * Google OAuth client ID (single). Used by createGoogleOneTapHandler to
-     * validate the `aud` claim on incoming Google ID tokens. Required for
-     * Google One Tap — without it, an ID token issued to any other Google
-     * application could be replayed against this endpoint.
-     */
-    googleClientId?: string;
-    /**
-     * Google OAuth client IDs (multiple). Use when the stack accepts tokens
-     * from more than one Google client (e.g. web + native).
-     */
-    googleClientIds?: string[];
-    /**
-     * How the handlers should derive the real client IP for rate-limit keys.
-     * Defaults to `{ trustedProxyCount: 1 }`. Set `trustedProxyCount: 0` if
-     * the app is exposed directly (no proxy) — otherwise any caller can pin
-     * their X-Forwarded-For and bypass rate limiting.
-     */
-    ipConfig?: IPExtractorConfig;
-}
-
-export { type BillingPlan as B, type IPExtractorConfig as I, type PrepaidCheckoutResult as P, type Subscription as S, type UsageSummary as U, type BillingRecord as a, type PrepaidVerifyResult as b, type UserUtilsCallbacks as c, type UserUtilsConfig as d, type ServerConfig as e, decodeJWTPayload as f, extractIP as g, generateToken as h, verifyJWTSignature as i, maybeRefreshJWT as m, signJWT as s, verifyJWT as v };

package/dist/config-xNca5ufB.d.ts

@@ -1,177 +0,0 @@
-import { P as PublicSession } from './auth-c1d7Eji2.js';
-
-interface BillingPlan {
-    id: string;
-    name: string;
-    price_cents: number;
-    token_allocation: number;
-    features: string;
-    sort_order?: number;
-    is_active?: boolean;
-}
-interface Subscription {
-    plan?: {
-        id: string;
-        name: string;
-        priceCents: number;
-        tokenAllocation: number;
-    };
-    planId?: string;
-    planName?: string;
-    status: string;
-    tokensUsed?: number;
-    tokensRemaining?: number;
-    usagePercent?: number;
-    periodStart?: number;
-    periodEnd?: number;
-    cancelAtPeriodEnd?: boolean;
-    stripeCustomerId?: string;
-}
-interface UsageSummary {
-    ownerId: string;
-    planAllocation: number;
-    planId: string | null;
-    planName: string;
-    inferenceUsed: number;
-    ledgerSpent: number;
-    totalUsed: number;
-    remaining: number;
-    percent: number;
-    exceeded: boolean;
-    breakdown: {
-        subscription: number;
-        prepaidCredit: number;
-        tokenGrants: number;
-        inference: number;
-        skillRegistrations: number;
-        skillRegistrationCount: number;
-    };
-}
-interface PrepaidCheckoutResult {
-    url: string;
-    sessionId?: string;
-}
-interface PrepaidVerifyResult {
-    alreadyCredited: boolean;
-    tokensCredited?: number;
-    amountCents?: number;
-    paymentRef?: string;
-}
-interface BillingRecord {
-    id: string;
-    recorded_at?: number;
-    date?: string;
-    reason?: string;
-    description?: string;
-    amount: number;
-    direction?: string;
-    source?: string;
-    status?: string;
-    payment_ref?: string;
-}
-
-/** Decode JWT payload without verification (server-side helper) */
-declare function decodeJWTPayload(jwt: string): Record<string, any> | null;
-/** Sign a JWT with HMAC-SHA256 */
-declare function signJWT(payload: Record<string, any>, secret: string): string;
-/** Verify a JWT signature with HMAC-SHA256 (constant-time comparison) */
-declare function verifyJWTSignature(jwt: string, secret: string): boolean;
-/** Verify JWT and return payload if valid (checks signature + expiry) */
-declare function verifyJWT(jwt: string, secret: string): Record<string, any> | null;
-/**
- * Check if JWT needs refresh and return a new one if so.
- * Returns null if no refresh needed or JWT is invalid.
- */
-declare function maybeRefreshJWT(jwt: string, secret: string, expirySeconds?: number, refreshWindowSeconds?: number): string | null;
-/** Generate a cryptographically secure random token */
-declare function generateToken(bytes?: number): string;
-/** Options controlling how the real client IP is extracted from a Request.
- *
- *  The previous implementation trusted `X-Forwarded-For[0]` unconditionally,
- *  which lets any direct caller pin arbitrary values and bypass per-IP rate
- *  limits. The correct read depends on how many reverse proxies sit between
- *  the app and the real client: with N trusted hops, the real client IP is
- *  at position `(length - N)` in the XFF list, because each trusted hop
- *  appends its peer IP and the attacker-controlled prefix is pushed left. */
-interface IPExtractorConfig {
-    /** Number of trusted reverse-proxy hops between this app and the real client.
-     *  - `0`: do NOT trust X-Forwarded-For (app is directly internet-exposed).
-     *  - `1` (default): one trusted proxy (e.g. single LB, Vercel edge, Nginx).
-     *  - `N`: N trusted hops; the real client IP is `XFF[length - N]`.
-     *  If XFF has fewer entries than expected, the chain is misconfigured or
-     *  spoofed and the extractor falls through to the next source. */
-    trustedProxyCount?: number;
-    /** Trust the `X-Real-IP` header. Only enable if your proxy sets it AND
-     *  strips any inbound `X-Real-IP` from clients. Default: `false`. */
-    trustRealIpHeader?: boolean;
-    /** Override entirely — return the real client IP from a request however
-     *  you know best (e.g. a platform-specific header like `cf-connecting-ip`
-     *  or `x-vercel-forwarded-for`). If this returns a non-empty string it
-     *  wins; if it returns null/empty the other strategies run. */
-    customExtractor?: (request: Request) => string | null | undefined;
-}
-/** Extract the real client IP address from a request.
- *
- *  Default behavior (`trustedProxyCount: 1`) is safe for the common case of
- *  one trusted reverse proxy. Consumers with no proxy must pass `0`, and
- *  consumers behind multiple proxies must pass the exact hop count. */
-declare function extractIP(request: Request, config?: IPExtractorConfig): string;
-
-/** Client-side configuration for UserUtilsProvider */
-interface UserUtilsConfig {
-    /** Base URL for API calls (empty string = same origin) */
-    apiBaseUrl: string;
-    /** StackNet stack identifier */
-    stackId?: string;
-    /** Direct StackNet URL for client-side API calls (e.g. challenges) */
-    stacknetUrl?: string;
-    /** Theme preference */
-    theme?: 'light' | 'dark' | 'system';
-}
-/** Callbacks for auth and billing events */
-interface UserUtilsCallbacks {
-    onAuthSuccess?: (session: PublicSession) => void;
-    onAuthError?: (error: Error) => void;
-    onLogout?: () => void;
-    onSubscriptionChange?: (subscription: Subscription) => void;
-}
-/** Server-side configuration for handler factories */
-interface ServerConfig {
-    /** HMAC-SHA256 secret for signing JWTs */
-    authSecret: string;
-    /** StackNet backend URL (always https://stacknet.magma-rpc.com) */
-    stacknetUrl: string;
-    /** StackNet stack identifier */
-    stackId: string;
-    /** JWT secret for re-signing to StackNet (defaults to authSecret) */
-    stacknetJwtSecret?: string;
-    /** Cookie domain for subdomain sharing (e.g. '.geoff.ai') */
-    cookieDomain?: string;
-    /** Use Secure flag on cookies (default: true) */
-    secureCookies?: boolean;
-    /** Session max age in seconds (default: 604800 = 7 days) */
-    sessionMaxAge?: number;
-    /** JWT expiry in seconds (default: 900 = 15 minutes) */
-    jwtExpiry?: number;
-    /**
-     * Google OAuth client ID (single). Used by createGoogleOneTapHandler to
-     * validate the `aud` claim on incoming Google ID tokens. Required for
-     * Google One Tap — without it, an ID token issued to any other Google
-     * application could be replayed against this endpoint.
-     */
-    googleClientId?: string;
-    /**
-     * Google OAuth client IDs (multiple). Use when the stack accepts tokens
-     * from more than one Google client (e.g. web + native).
-     */
-    googleClientIds?: string[];
-    /**
-     * How the handlers should derive the real client IP for rate-limit keys.
-     * Defaults to `{ trustedProxyCount: 1 }`. Set `trustedProxyCount: 0` if
-     * the app is exposed directly (no proxy) — otherwise any caller can pin
-     * their X-Forwarded-For and bypass rate limiting.
-     */
-    ipConfig?: IPExtractorConfig;
-}
-
-export { type BillingPlan as B, type IPExtractorConfig as I, type PrepaidCheckoutResult as P, type Subscription as S, type UsageSummary as U, type BillingRecord as a, type PrepaidVerifyResult as b, type UserUtilsCallbacks as c, type UserUtilsConfig as d, type ServerConfig as e, decodeJWTPayload as f, extractIP as g, generateToken as h, verifyJWTSignature as i, maybeRefreshJWT as m, signJWT as s, verifyJWT as v };