import * as react_jsx_runtime from 'react/jsx-runtime'; import { ReactNode } from 'react'; import { UserUtilsConfig, UserUtilsCallbacks, ProfileScope } from '../types/index.js'; import '../auth-c1d7Eji2.js'; interface UserUtilsContextValue { config: UserUtilsConfig; callbacks?: UserUtilsCallbacks; } declare function useUserUtilsContext(): UserUtilsContextValue; interface UserUtilsProviderProps { config: UserUtilsConfig; callbacks?: UserUtilsCallbacks; children: ReactNode; } declare function UserUtilsProvider({ config, callbacks, children }: UserUtilsProviderProps): react_jsx_runtime.JSX.Element; interface ConnectWidgetProps { config: UserUtilsConfig; onSuccess?: () => void; title?: string; /** Explicitly set which wallets to show (overrides stack config) */ showWallets?: ('phantom' | 'metamask' | 'solflare')[]; showOTP?: boolean; showEmail?: boolean; /** Hide the built-in header (logo + title). Useful when wrapping in custom layout. */ hideHeader?: boolean; /** Custom OTP handler — overrides default authenticateOTP (e.g. for pairing codes) */ onOTPSubmit?: (code: string) => Promise; /** Label for the OTP button (default: "Access Code") */ otpLabel?: string; /** * Show the "Preview Code" entry point. This is a SEPARATE auth flow * from OTP: the user enters a 6-digit preview code (e.g. `692232`) * issued by an admin via the stacknet admin console. On success the * widget stores `pc_` as the bearer token in localStorage * under `stacknet-api-key` — the stacknet backend accepts this as a * valid auth credential (see Bun api-key-auth middleware). * * Default: hidden. Apps that issue preview codes should set * `showPreviewCode: true`. */ showPreviewCode?: boolean; /** * Custom preview-code handler. Defaults to a validator that hits * `${config.stacknetUrl}/v1/preview-codes/:code`, checks the row is * not revoked / expired / exhausted, then stores `pc_` as * the api key. Consumer apps can override to add redirect logic or * multi-tenant preview-code pools. */ onPreviewCodeSubmit?: (code: string) => Promise; /** Label for the preview-code button (default: "Preview Code"). */ previewCodeLabel?: string; /** Show OAuth providers inline (not behind "or continue with" divider) */ oauthInline?: boolean; /** Place specific OAuth providers at the top, before wallets */ oauthFirst?: string[]; className?: string; } declare function ConnectWidget({ config, onSuccess, title, showWallets, showOTP, hideHeader, onOTPSubmit, otpLabel, showPreviewCode, onPreviewCodeSubmit, previewCodeLabel, oauthInline, oauthFirst, className, }: ConnectWidgetProps): react_jsx_runtime.JSX.Element; interface OTPInputProps { length?: number; onComplete: (code: string) => void; disabled?: boolean; error?: string; className?: string; inputClassName?: string; } declare function OTPInput({ length, onComplete, disabled, error, className, inputClassName, }: OTPInputProps): react_jsx_runtime.JSX.Element; declare namespace OTPInput { var displayName: string; } /** * Client-side fixed-window rate limiter for unauthenticated form * submits (OTP, preview-code). Pairs with the server-side limits at * - userutils createOTPHandler (3 attempts / 5 min per IP) * - userutils createPreviewCodeHandler (3 attempts / 1 min per IP) * - stacknet GET /v1/preview-codes/:code (3 / 1 min per IP, Rust) * * Why client-side too: * - The server caps are the security layer. The client cap is the UX * layer: a user mashing the submit button can otherwise burn their * server budget in <1 second and get 429s with no friendly hint as * to when they can try again. * - Showing "2 attempts left" + a countdown is way better than the * bare "Invalid code" loop the user gets without it. * - Cuts wasted HTTP roundtrips on the obviously-throttled case. * * Storage: localStorage by default (survives reloads + across tabs). * SSR-safe — falls back to in-memory when window/localStorage isn't * available so importing into a server component doesn't blow up. * * NOT a security boundary. The server limiters are. A user clearing * localStorage gets their client budget back; the server cap still * holds. */ interface ClientRateLimitConfig { /** Max attempts per window. */ maxAttempts: number; /** Window length in milliseconds. */ windowMs: number; /** Storage key prefix; full key = `${storagePrefix}:${scope}`. */ storagePrefix?: string; } interface ClientRateLimitDecision { allowed: boolean; /** Attempts remaining in the current window AFTER the call that * produced this decision. 0 when the call was denied. */ remaining: number; /** Seconds the user should wait before the next attempt is allowed. * 0 when allowed. */ retryAfterSecs: number; } /** * Create a scoped client rate limiter. Each `scope` (e.g. `'otp'`, * `'preview-code'`) gets its own bucket so they don't share quota. * * Recommended config: * - OTP: { maxAttempts: 3, windowMs: 5 * 60_000 } * - preview-code: { maxAttempts: 3, windowMs: 60_000 } * * Mirrors the server-side caps so a user who hits the client cap * doesn't surprise themselves by getting through to a 429 anyway. */ declare function createClientRateLimiter(scope: string, config: ClientRateLimitConfig): { peek: () => ClientRateLimitDecision; consume: () => ClientRateLimitDecision; reset: () => void; }; interface ProfileSettingsProps { /** The user's MID (global_id or address) */ mid: string; /** API base URL (empty = same-origin) */ apiBaseUrl?: string; /** 'global' (default) or { stackId: 'stk_...' } for stack-scoped profiles */ scope?: ProfileScope; /** Called after successful save */ onSave?: () => void; /** CSS class name */ className?: string; } declare function ProfileSettings({ mid, apiBaseUrl, scope, onSave, className, }: ProfileSettingsProps): react_jsx_runtime.JSX.Element; declare function PhantomIcon({ className, style }: { className?: string; style?: React.CSSProperties; }): react_jsx_runtime.JSX.Element; declare function MetaMaskIcon({ className, style }: { className?: string; style?: React.CSSProperties; }): react_jsx_runtime.JSX.Element; declare function SolanaIcon({ className }: { className?: string; }): react_jsx_runtime.JSX.Element; declare function EthereumIcon({ className }: { className?: string; }): react_jsx_runtime.JSX.Element; declare function TwitterIcon({ className, style }: { className?: string; style?: React.CSSProperties; }): react_jsx_runtime.JSX.Element; declare function GoogleIcon({ className, style }: { className?: string; style?: React.CSSProperties; }): react_jsx_runtime.JSX.Element; declare function DiscordIcon({ className, style }: { className?: string; style?: React.CSSProperties; }): react_jsx_runtime.JSX.Element; declare function TelegramIcon({ className }: { className?: string; }): react_jsx_runtime.JSX.Element; declare function AppleIcon({ className, style }: { className?: string; style?: React.CSSProperties; }): react_jsx_runtime.JSX.Element; export { AppleIcon, type ClientRateLimitConfig, type ClientRateLimitDecision, ConnectWidget, type ConnectWidgetProps, DiscordIcon, EthereumIcon, GoogleIcon, MetaMaskIcon, OTPInput, type OTPInputProps, PhantomIcon, ProfileSettings, type ProfileSettingsProps, SolanaIcon, TelegramIcon, TwitterIcon, UserUtilsProvider, type UserUtilsProviderProps, createClientRateLimiter, useUserUtilsContext };