The duplicate signOut method signature is redundant. TypeScript function overloads should only include the implementation signature once. The first signature with ExtraOptions already covers the second signature when ExtraOptions is an empty object type. Consider removing line 109.

The type assertion as any is used to bypass type checking. Consider using a more type-safe approach. Since getUser expects GetCurrentUserOptions<HasTokenStore>, you could pass options?.tokenStore directly without the ?? undefined as any pattern, or properly type the options parameter based on HasTokenStore.

The type assertion as any is used to bypass type checking. Consider using a more type-safe approach. This is the same issue as in the signOut method on line 2173.

⚠️ Potential issue | 🟠 Major

Actually exercise signOut in the test
The test titled “clientApp.signOut should sign out the user” never calls clientApp.signOut, so it will succeed even if the implementation is entirely broken. Call the method and assert the post-sign-out state to make the test meaningful.

   const authJsonBefore = await clientApp.getAuthJson();
   expect(authJsonBefore.accessToken).not.toBeNull();
+
+  await clientApp.signOut();
+
+  const authJsonAfter = await clientApp.getAuthJson();
+  expect(authJsonAfter.accessToken).toBeNull();
+  expect(authJsonAfter.refreshToken).toBeNull();

In apps/e2e/tests/js/auth-like.test.ts around lines 83 to 92, the test never
actually calls clientApp.signOut so it passes even if signOut is broken; update
the test to call await clientApp.signOut() and then assert the post-sign-out
state (for example await clientApp.getUser() returns null or
clientApp.getAuthJson().accessToken is null) to verify signOut was exercised and
had the expected effect.

⚠️ Potential issue | 🔴 Critical

Use the caller-provided hostname when inferring the RP ID
registerPasskey accepts options.hostname precisely to support environments where _getCurrentUrl() is unavailable (e.g., redirectMethod: "none"). Ignoring that argument means we still throw even if the caller supplied the hostname. Wire the option into the RP ID selection so the method works off-browser.

-      const hostname = (await app._getCurrentUrl())?.hostname;
+      const hostname = options?.hostname ?? (await app._getCurrentUrl())?.hostname;
       if (!hostname) {
         throw new StackAssertionError("hostname must be provided if the Stack App does not have a redirect method");
       }

packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts
around lines 1245 to 1264: the code always derives hostname from
app._getCurrentUrl() and throws if missing, ignoring the caller-provided
options.hostname; update the logic to prefer options.hostname when present (fall
back to _getCurrentUrl()), use that resolved hostname for the RP ID override and
for the missing-hostname check, and only throw a StackAssertionError if neither
options.hostname nor _getCurrentUrl() provides a hostname; ensure the rest of
the flow uses this resolved hostname variable.

The signOut, getAuthHeaders, and getAuthJson methods have incorrect type signatures that don't properly enforce the conditional tokenStore requirement when HasTokenStore extends false.

diff --git a/packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts
index a88469d8..4ab51c07 100644
--- a/packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts
+++ b/packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts
@@ -1957,7 +1957,7 @@ export class _StackClientAppImplIncomplete<HasTokenStore extends boolean, Projec
     }
   }
   // END_PLATFORM
-  getConvexClientAuth(options: { tokenStore: TokenStoreInit }): (args: { forceRefreshToken: boolean }) => Promise<string | null> {
+  getConvexClientAuth(options: {} & (HasTokenStore extends false ? { tokenStore: TokenStoreInit } : { tokenStore?: TokenStoreInit })): (args: { forceRefreshToken: boolean }) => Promise<string | null> {
     return async (args: { forceRefreshToken: boolean }) => {
       const session = await this._getSession(options.tokenStore ?? this._tokenStoreInit);
       if (!args.forceRefreshToken) {
@@ -2379,20 +2379,20 @@ export class _StackClientAppImplIncomplete<HasTokenStore extends boolean, Projec
     });
   }
 
-  async signOut(options?: { redirectUrl?: URL | string, tokenStore?: TokenStoreInit }): Promise<void> {
+  async signOut(options?: { redirectUrl?: URL | string } & (HasTokenStore extends false ? { tokenStore: TokenStoreInit } : { tokenStore?: TokenStoreInit })): Promise<void> {
     const user = await this.getUser({ tokenStore: options?.tokenStore ?? undefined as any });
     if (user) {
       await user.signOut({ redirectUrl: options?.redirectUrl });
     }
   }
 
-  async getAuthHeaders(options?: { tokenStore?: TokenStoreInit }): Promise<{ "x-stack-auth": string }> {
+  async getAuthHeaders(options?: {} & (HasTokenStore extends false ? { tokenStore: TokenStoreInit } : { tokenStore?: TokenStoreInit })): Promise<{ "x-stack-auth": string }> {
     return {
       "x-stack-auth": JSON.stringify(await this.getAuthJson(options)),
     };
   }
 
-  async getAuthJson(options?: { tokenStore?: TokenStoreInit }): Promise<{ accessToken: string | null, refreshToken: string | null }> {
+  async getAuthJson(options?: {} & (HasTokenStore extends false ? { tokenStore: TokenStoreInit } : { tokenStore?: TokenStoreInit })): Promise<{ accessToken: string | null, refreshToken: string | null }> {
     const user = await this.getUser({ tokenStore: options?.tokenStore ?? undefined as any });
     if (user) {
       return await user.getAuthJson();

// TypeScript should error but doesn't before fix:
const app: StackClientApp<false> = new StackClientApp({ projectId: "test" });
await app.signOut(); // Missing required tokenStore
await app.getAuthHeaders(); // Missing required tokenStore  
await app.getAuthJson(); // Missing required tokenStore

🛠️ Refactor suggestion | 🟠 Major

#!/bin/bash
# Check for similar registerPasskey implementation in client-app-impl.ts
rg -nP -A 50 'async registerPasskey\(' --type=ts -g 'client-app-impl.ts'

---

🏁 Script executed:

```shell
#!/bin/bash
# Search for registerPasskey in server-app-impl.ts to see the actual server implementation
rg -nP -A 60 'async registerPasskey\(' --type=ts -g 'server-app-impl.ts'

Extract duplicated passkey registration logic into shared utilities.

The TODO is valid. Both implementations share identical logic for hostname resolution, rpID override validation, and WebAuthn error handling. Consider extracting these into shared utility functions:

• validateAndOverrideRpId() — handles sentinel validation and hostname substitution (lines 726–730 in server, 1470–1474 in client)
• handleWebAuthnRegistrationError() — standardizes WebAuthn error handling (lines 733–746 in server, 1477–1487 in client)
• resolveHostname() — centralizes hostname resolution (lines 711–714 in server, 1456–1459 in client)

The core difference—client using the existing session vs. server creating a temporary session—can be parameterized or handled by the caller, leaving the shared logic focused on credential generation and error handling.

packages/template/src/lib/stack-app/apps/implementations/server-app-impl.ts
around line 710: duplicate passkey registration logic exists in both
server-app-impl.ts and client-app-impl.ts (hostname resolution, rpID override
validation, and WebAuthn error handling). Extract three shared utility functions
into a common module (e.g., lib/auth/webauthn-utils.ts):
resolveHostname(hostnameOrSentinel) to centralize hostname resolution;
validateAndOverrideRpId(rpIdOverride, resolvedHostname) to perform sentinel
validation and return the effective rpId or throw; and
handleWebAuthnRegistrationError(err) to normalize and rethrow/log WebAuthn
errors. Replace the duplicated blocks in both server and client implementations
to call these utilities, and parameterize the remaining difference (session
creation vs. using existing session) by having the caller provide a session or a
session-creator callback so the shared code only handles credential generation
and error handling.

⚠️ Potential issue | 🟠 Major

Double temporary session creation.

This method creates a second temporary session (in addition to the one created by initiateServerPasskeyRegistration), resulting in two session history entries for a single passkey registration. This compounds the concern noted in the TODO comment.

Consider refactoring both initiateServerPasskeyRegistration and the registration completion to use a single server-side flow that doesn't require user sessions, or reuse the initial temporary session for the completion step.

</comment_end>

packages/template/src/lib/stack-app/apps/implementations/server-app-impl.ts
lines 748-761: the code creates a second temporary session for completing
passkey registration which produces duplicate session history entries; instead
reuse the existing temporary session created by
initiateServerPasskeyRegistration (pass it through or return it from that
function) or change both initiation and completion to a server-side flow that
does not require a user session; update initiateServerPasskeyRegistration to
return the temp session (or a token object) and change this block to call
registerPasskey with that session rather than calling createServerUserSession
again, then remove the duplicate session creation and ensure
serverUserCache.refresh still receives the user id.