@stackframe/stack-shared 2.5.17 → 2.5.18

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @stackframe/stack-shared
 
+## 2.5.18
+
+### Patch Changes
+
+- Multi-factor authentication
+  - @stackframe/stack-sc@2.5.18
+
 ## 2.5.17
 
 ### Patch Changes

package/dist/interface/clientInterface.d.ts

@@ -65,6 +65,23 @@ export declare class StackClientInterface {
     }, session: InternalSession): Promise<KnownErrors["PasswordConfirmationMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
     verifyPasswordResetCode(code: string): Promise<KnownErrors["VerificationCodeError"] | undefined>;
     verifyEmail(code: string): Promise<KnownErrors["VerificationCodeError"] | undefined>;
+    sendTeamInvitation(options: {
+        email: string;
+        teamId: string;
+        callbackUrl: string;
+        session: InternalSession | null;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
+    acceptTeamInvitation<T extends 'use' | 'details' | 'check'>(options: {
+        code: string;
+        session: InternalSession;
+        type: T;
+    }): Promise<Result<T extends 'details' ? {
+        team_display_name: string;
+    } : undefined, KnownErrors["VerificationCodeError"]>>;
+    totpMfa(attemptCode: string, totp: string, session: InternalSession): Promise<{
+        accessToken: any;
+        refreshToken: any;
+    }>;
     signInWithCredential(email: string, password: string, session: InternalSession): Promise<KnownErrors["EmailPasswordMismatch"] | {
         accessToken: string;
         refreshToken: string;

package/dist/interface/clientInterface.js

@@ -219,7 +219,6 @@ export class StackClientInterface {
         catch (e) {
             if (e instanceof TypeError) {
                 // Network error, retry
-                console.warn(`Stack detected a network error while fetching ${url}, retrying.`, e, { url });
                 return Result.error(e);
             }
             throw e;
@@ -386,6 +385,64 @@ export class StackClientInterface {
             return res.error;
         }
     }
+    async sendTeamInvitation(options) {
+        const res = await this.sendClientRequestAndCatchKnownError("/team-invitations/send-code", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                email: options.email,
+                team_id: options.teamId,
+                callback_url: options.callbackUrl,
+            }),
+        }, options.session, [KnownErrors.TeamPermissionRequired]);
+        if (res.status === "error") {
+            return Result.error(res.error);
+        }
+        else {
+            return Result.ok(undefined);
+        }
+    }
+    async acceptTeamInvitation(options) {
+        const res = await this.sendClientRequestAndCatchKnownError(options.type === 'check' ?
+            "/team-invitations/accept/check-code" :
+            options.type === 'details' ?
+                "/team-invitations/accept/details" :
+                "/team-invitations/accept", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                code: options.code,
+            }),
+        }, options.session, [KnownErrors.VerificationCodeError]);
+        if (res.status === "error") {
+            return Result.error(res.error);
+        }
+        else {
+            return Result.ok(await res.data.json());
+        }
+    }
+    async totpMfa(attemptCode, totp, session) {
+        const res = await this.sendClientRequest("/auth/mfa/sign-in", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+                code: attemptCode,
+                type: "totp",
+                totp: totp,
+            }),
+        }, session);
+        const result = await res.json();
+        return {
+            accessToken: result.access_token,
+            refreshToken: result.refresh_token,
+        };
+    }
     async signInWithCredential(email, password, session) {
         const res = await this.sendClientRequestAndCatchKnownError("/auth/password/sign-in", {
             method: "POST",
@@ -444,7 +501,7 @@ export class StackClientInterface {
         return {
             accessToken: result.access_token,
             refreshToken: result.refresh_token,
-            newUser: result.new_user,
+            newUser: result.is_new_user,
         };
     }
     async getOAuthUrl(options) {
@@ -509,8 +566,8 @@ export class StackClientInterface {
             throw new StackAssertionError("Outer OAuth error during authorization code response", { result });
         }
         return {
-            newUser: result.newUser,
-            afterCallbackRedirectUrl: result.afterCallbackRedirectUrl,
+            newUser: result.is_new_user,
+            afterCallbackRedirectUrl: result.after_callback_redirect_url,
             accessToken: result.access_token,
             refreshToken: result.refresh_token ?? throwErr("Refresh token not found in outer OAuth response"),
         };

package/dist/interface/crud/current-user.d.ts

@@ -16,6 +16,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
         auth_with_email: NonNullable<boolean | undefined>;
+        requires_totp_mfa: NonNullable<boolean | undefined>;
         auth_methods: ({
             type: "password";
             identifier: string;
@@ -60,6 +61,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         signed_up_at_millis: undefined;
         has_password: undefined;
         auth_with_email: undefined;
+        requires_totp_mfa: undefined;
         oauth_providers: undefined;
         auth_methods: undefined;
         connected_accounts: undefined;
@@ -82,6 +84,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
         auth_with_email: NonNullable<boolean | undefined>;
+        requires_totp_mfa: NonNullable<boolean | undefined>;
         oauth_providers: {
             email?: string | null | undefined;
             id: string;
@@ -128,6 +131,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         signed_up_at_millis: undefined;
         has_password: undefined;
         auth_with_email: undefined;
+        requires_totp_mfa: undefined;
         oauth_providers: undefined;
         auth_methods: undefined;
         connected_accounts: undefined;
@@ -137,6 +141,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
     clientUpdateSchema: import("yup").ObjectSchema<{
         display_name: string | null | undefined;
         client_metadata: {} | null | undefined;
+        totp_secret_base64: string | null | undefined;
         selected_team_id: string | null | undefined;
     }, import("yup").AnyObject, {
         display_name: undefined;
@@ -147,6 +152,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         primary_email_verified: undefined;
         primary_email_auth_enabled: undefined;
         password: undefined;
+        totp_secret_base64: undefined;
         selected_team_id: undefined;
     }, "">;
     serverUpdateSchema: import("yup").ObjectSchema<{
@@ -158,6 +164,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         primary_email_verified: boolean | undefined;
         primary_email_auth_enabled: boolean | undefined;
         password: string | null | undefined;
+        totp_secret_base64: string | null | undefined;
         selected_team_id: string | null | undefined;
     }, import("yup").AnyObject, {
         display_name: undefined;
@@ -168,6 +175,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         primary_email_verified: undefined;
         primary_email_auth_enabled: undefined;
         password: undefined;
+        totp_secret_base64: undefined;
         selected_team_id: undefined;
     }, "">;
     serverDeleteSchema: import("yup").MixedSchema<{} | undefined, import("yup").AnyObject, undefined, "">;

package/dist/interface/crud/current-user.js

@@ -6,6 +6,7 @@ const clientUpdateSchema = usersCrudServerUpdateSchema.pick([
     "display_name",
     "client_metadata",
     "selected_team_id",
+    "totp_secret_base64",
 ]).required();
 const serverUpdateSchema = usersCrudServerUpdateSchema;
 const clientReadSchema = usersCrudServerReadSchema.pick([
@@ -22,6 +23,7 @@ const clientReadSchema = usersCrudServerReadSchema.pick([
     "selected_team_id",
     "auth_methods",
     "connected_accounts",
+    "requires_totp_mfa",
 ]).concat(yupObject({
     selected_team: teamsCrudClientReadSchema.nullable().defined(),
 })).nullable().defined(); // TODO: next-release: make required

package/dist/interface/crud/email-templates.d.ts

@@ -1,8 +1,8 @@
 import { CrudTypeOf } from "../../crud";
 export type EmailTemplateType = typeof emailTemplateTypes[number];
-export declare const emailTemplateTypes: readonly ["email_verification", "password_reset", "magic_link"];
+export declare const emailTemplateTypes: readonly ["email_verification", "password_reset", "magic_link", "team_invitation"];
 export declare const emailTemplateAdminReadSchema: import("yup").ObjectSchema<{
-    type: NonNullable<"email_verification" | "password_reset" | "magic_link" | undefined>;
+    type: NonNullable<"email_verification" | "password_reset" | "magic_link" | "team_invitation" | undefined>;
     subject: string;
     content: {};
     is_default: NonNullable<boolean | undefined>;
@@ -21,7 +21,7 @@ export declare const emailTemplateCrudAdminUpdateSchema: import("yup").ObjectSch
 }, "">;
 export declare const emailTemplateCrudAdminDeleteSchema: import("yup").MixedSchema<{} | undefined, import("yup").AnyObject, undefined, "">;
 export declare const emailTemplateCrudAdminCreateSchema: import("yup").ObjectSchema<{
-    type: NonNullable<"email_verification" | "password_reset" | "magic_link" | undefined>;
+    type: NonNullable<"email_verification" | "password_reset" | "magic_link" | "team_invitation" | undefined>;
     content: {};
     subject: string;
 }, import("yup").AnyObject, {
@@ -31,7 +31,7 @@ export declare const emailTemplateCrudAdminCreateSchema: import("yup").ObjectSch
 }, "">;
 export declare const emailTemplateCrud: import("../../crud").CrudSchemaFromOptions<{
     adminReadSchema: import("yup").ObjectSchema<{
-        type: NonNullable<"email_verification" | "password_reset" | "magic_link" | undefined>;
+        type: NonNullable<"email_verification" | "password_reset" | "magic_link" | "team_invitation" | undefined>;
         subject: string;
         content: {};
         is_default: NonNullable<boolean | undefined>;
@@ -49,7 +49,7 @@ export declare const emailTemplateCrud: import("../../crud").CrudSchemaFromOptio
         subject: undefined;
     }, "">;
     adminCreateSchema: import("yup").ObjectSchema<{
-        type: NonNullable<"email_verification" | "password_reset" | "magic_link" | undefined>;
+        type: NonNullable<"email_verification" | "password_reset" | "magic_link" | "team_invitation" | undefined>;
         content: {};
         subject: string;
     }, import("yup").AnyObject, {

package/dist/interface/crud/email-templates.js

@@ -1,6 +1,6 @@
 import { createCrud } from "../../crud";
 import { jsonSchema, yupBoolean, yupMixed, yupObject, yupString } from "../../schema-fields";
-export const emailTemplateTypes = ['email_verification', 'password_reset', 'magic_link'];
+export const emailTemplateTypes = ['email_verification', 'password_reset', 'magic_link', 'team_invitation'];
 export const emailTemplateAdminReadSchema = yupObject({
     type: yupString().oneOf(emailTemplateTypes).required(),
     subject: yupString().required(),

package/dist/interface/crud/projects.d.ts

@@ -9,6 +9,7 @@ export declare const projectsCrudServerReadSchema: import("yup").ObjectSchema<{
     config: {
         id: string;
         allow_localhost: NonNullable<boolean | undefined>;
+        sign_up_enabled: NonNullable<boolean | undefined>;
         credential_enabled: NonNullable<boolean | undefined>;
         magic_link_enabled: NonNullable<boolean | undefined>;
         oauth_providers: {
@@ -53,6 +54,7 @@ export declare const projectsCrudServerReadSchema: import("yup").ObjectSchema<{
     config: {
         id: undefined;
         allow_localhost: undefined;
+        sign_up_enabled: undefined;
         credential_enabled: undefined;
         magic_link_enabled: undefined;
         oauth_providers: undefined;
@@ -76,6 +78,7 @@ export declare const projectsCrudClientReadSchema: import("yup").ObjectSchema<{
     id: string;
     display_name: string;
     config: {
+        sign_up_enabled: NonNullable<boolean | undefined>;
         credential_enabled: NonNullable<boolean | undefined>;
         magic_link_enabled: NonNullable<boolean | undefined>;
         enabled_oauth_providers: {
@@ -86,6 +89,7 @@ export declare const projectsCrudClientReadSchema: import("yup").ObjectSchema<{
     id: undefined;
     display_name: undefined;
     config: {
+        sign_up_enabled: undefined;
         credential_enabled: undefined;
         magic_link_enabled: undefined;
         enabled_oauth_providers: undefined;
@@ -97,6 +101,7 @@ export declare const projectsCrudServerUpdateSchema: import("yup").ObjectSchema<
     is_production_mode: boolean | undefined;
     config: {
         allow_localhost?: boolean | undefined;
+        sign_up_enabled?: boolean | undefined;
         credential_enabled?: boolean | undefined;
         magic_link_enabled?: boolean | undefined;
         oauth_providers?: {
@@ -140,6 +145,7 @@ export declare const projectsCrudServerCreateSchema: import("yup").ObjectSchema<
     is_production_mode: boolean | undefined;
     config: {
         allow_localhost?: boolean | undefined;
+        sign_up_enabled?: boolean | undefined;
         credential_enabled?: boolean | undefined;
         magic_link_enabled?: boolean | undefined;
         oauth_providers?: {
@@ -184,6 +190,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
         id: string;
         display_name: string;
         config: {
+            sign_up_enabled: NonNullable<boolean | undefined>;
             credential_enabled: NonNullable<boolean | undefined>;
             magic_link_enabled: NonNullable<boolean | undefined>;
             enabled_oauth_providers: {
@@ -194,6 +201,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
         id: undefined;
         display_name: undefined;
         config: {
+            sign_up_enabled: undefined;
             credential_enabled: undefined;
             magic_link_enabled: undefined;
             enabled_oauth_providers: undefined;
@@ -209,6 +217,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
         config: {
             id: string;
             allow_localhost: NonNullable<boolean | undefined>;
+            sign_up_enabled: NonNullable<boolean | undefined>;
             credential_enabled: NonNullable<boolean | undefined>;
             magic_link_enabled: NonNullable<boolean | undefined>;
             oauth_providers: {
@@ -253,6 +262,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
         config: {
             id: undefined;
             allow_localhost: undefined;
+            sign_up_enabled: undefined;
             credential_enabled: undefined;
             magic_link_enabled: undefined;
             oauth_providers: undefined;
@@ -278,6 +288,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
         is_production_mode: boolean | undefined;
         config: {
             allow_localhost?: boolean | undefined;
+            sign_up_enabled?: boolean | undefined;
             credential_enabled?: boolean | undefined;
             magic_link_enabled?: boolean | undefined;
             oauth_providers?: {
@@ -345,6 +356,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
         config: {
             id: string;
             allow_localhost: NonNullable<boolean | undefined>;
+            sign_up_enabled: NonNullable<boolean | undefined>;
             credential_enabled: NonNullable<boolean | undefined>;
             magic_link_enabled: NonNullable<boolean | undefined>;
             oauth_providers: {
@@ -389,6 +401,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
         config: {
             id: undefined;
             allow_localhost: undefined;
+            sign_up_enabled: undefined;
             credential_enabled: undefined;
             magic_link_enabled: undefined;
             oauth_providers: undefined;
@@ -414,6 +427,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
         is_production_mode: boolean | undefined;
         config: {
             allow_localhost?: boolean | undefined;
+            sign_up_enabled?: boolean | undefined;
             credential_enabled?: boolean | undefined;
             magic_link_enabled?: boolean | undefined;
             oauth_providers?: {

package/dist/interface/crud/projects.js

@@ -39,6 +39,7 @@ export const projectsCrudServerReadSchema = yupObject({
     config: yupObject({
         id: schemaFields.projectConfigIdSchema.required(),
         allow_localhost: schemaFields.projectAllowLocalhostSchema.required(),
+        sign_up_enabled: schemaFields.projectSignUpEnabledSchema.required(),
         credential_enabled: schemaFields.projectCredentialEnabledSchema.required(),
         magic_link_enabled: schemaFields.projectMagicLinkEnabledSchema.required(),
         oauth_providers: yupArray(oauthProviderSchema.required()).required(),
@@ -54,6 +55,7 @@ export const projectsCrudClientReadSchema = yupObject({
     id: schemaFields.projectIdSchema.required(),
     display_name: schemaFields.projectDisplayNameSchema.required(),
     config: yupObject({
+        sign_up_enabled: schemaFields.projectSignUpEnabledSchema.required(),
         credential_enabled: schemaFields.projectCredentialEnabledSchema.required(),
         magic_link_enabled: schemaFields.projectMagicLinkEnabledSchema.required(),
         enabled_oauth_providers: yupArray(enabledOAuthProviderSchema.required()).required(),
@@ -64,6 +66,7 @@ export const projectsCrudServerUpdateSchema = yupObject({
     description: schemaFields.projectDescriptionSchema.optional(),
     is_production_mode: schemaFields.projectIsProductionModeSchema.optional(),
     config: yupObject({
+        sign_up_enabled: schemaFields.projectSignUpEnabledSchema.optional(),
         credential_enabled: schemaFields.projectCredentialEnabledSchema.optional(),
         magic_link_enabled: schemaFields.projectMagicLinkEnabledSchema.optional(),
         allow_localhost: schemaFields.projectAllowLocalhostSchema.optional(),

package/dist/interface/crud/team-invitation-details.d.ts

@@ -0,0 +1,25 @@
+import { CrudTypeOf } from "../../crud";
+export declare const teamInvitationDetailsClientReadSchema: import("yup").ObjectSchema<{
+    team_id: string;
+    team_display_name: string;
+}, import("yup").AnyObject, {
+    team_id: undefined;
+    team_display_name: undefined;
+}, "">;
+export declare const teamInvitationDetailsCrud: import("../../crud").CrudSchemaFromOptions<{
+    clientReadSchema: import("yup").ObjectSchema<{
+        team_id: string;
+        team_display_name: string;
+    }, import("yup").AnyObject, {
+        team_id: undefined;
+        team_display_name: undefined;
+    }, "">;
+    docs: {
+        clientRead: {
+            summary: string;
+            description: string;
+            tags: string[];
+        };
+    };
+}>;
+export type TeamInvitationDetailsCrud = CrudTypeOf<typeof teamInvitationDetailsCrud>;

package/dist/interface/crud/team-invitation-details.js

@@ -0,0 +1,17 @@
+import { createCrud } from "../../crud";
+import * as schemaFields from "../../schema-fields";
+import { yupObject } from "../../schema-fields";
+export const teamInvitationDetailsClientReadSchema = yupObject({
+    team_id: schemaFields.teamIdSchema.required(),
+    team_display_name: schemaFields.teamDisplayNameSchema.required(),
+}).required();
+export const teamInvitationDetailsCrud = createCrud({
+    clientReadSchema: teamInvitationDetailsClientReadSchema,
+    docs: {
+        clientRead: {
+            summary: "Get the team details with invitation code",
+            description: "",
+            tags: ["Teams"],
+        },
+    },
+});

package/dist/interface/crud/users.d.ts

@@ -8,6 +8,7 @@ export declare const usersCrudServerUpdateSchema: import("yup").ObjectSchema<{
     primary_email_verified: boolean | undefined;
     primary_email_auth_enabled: boolean | undefined;
     password: string | null | undefined;
+    totp_secret_base64: string | null | undefined;
     selected_team_id: string | null | undefined;
 }, import("yup").AnyObject, {
     display_name: undefined;
@@ -18,6 +19,7 @@ export declare const usersCrudServerUpdateSchema: import("yup").ObjectSchema<{
     primary_email_verified: undefined;
     primary_email_auth_enabled: undefined;
     password: undefined;
+    totp_secret_base64: undefined;
     selected_team_id: undefined;
 }, "">;
 export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
@@ -36,6 +38,7 @@ export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
     signed_up_at_millis: number;
     has_password: NonNullable<boolean | undefined>;
     auth_with_email: NonNullable<boolean | undefined>;
+    requires_totp_mfa: NonNullable<boolean | undefined>;
     oauth_providers: {
         email?: string | null | undefined;
         id: string;
@@ -82,6 +85,7 @@ export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
     signed_up_at_millis: undefined;
     has_password: undefined;
     auth_with_email: undefined;
+    requires_totp_mfa: undefined;
     oauth_providers: undefined;
     auth_methods: undefined;
     connected_accounts: undefined;
@@ -97,6 +101,7 @@ export declare const usersCrudServerCreateSchema: import("yup").ObjectSchema<{
     primary_email_verified: boolean | undefined;
     primary_email_auth_enabled: boolean | undefined;
     password: string | null | undefined;
+    totp_secret_base64: string | null | undefined;
     selected_team_id: string | null | undefined;
 } & {
     oauth_providers: {
@@ -113,6 +118,7 @@ export declare const usersCrudServerCreateSchema: import("yup").ObjectSchema<{
     primary_email_verified: undefined;
     primary_email_auth_enabled: undefined;
     password: undefined;
+    totp_secret_base64: undefined;
     selected_team_id: undefined;
     oauth_providers: undefined;
 }, "">;
@@ -134,6 +140,7 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
         auth_with_email: NonNullable<boolean | undefined>;
+        requires_totp_mfa: NonNullable<boolean | undefined>;
         oauth_providers: {
             email?: string | null | undefined;
             id: string;
@@ -180,6 +187,7 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         signed_up_at_millis: undefined;
         has_password: undefined;
         auth_with_email: undefined;
+        requires_totp_mfa: undefined;
         oauth_providers: undefined;
         auth_methods: undefined;
         connected_accounts: undefined;
@@ -195,6 +203,7 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         primary_email_verified: boolean | undefined;
         primary_email_auth_enabled: boolean | undefined;
         password: string | null | undefined;
+        totp_secret_base64: string | null | undefined;
         selected_team_id: string | null | undefined;
     }, import("yup").AnyObject, {
         display_name: undefined;
@@ -205,6 +214,7 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         primary_email_verified: undefined;
         primary_email_auth_enabled: undefined;
         password: undefined;
+        totp_secret_base64: undefined;
         selected_team_id: undefined;
     }, "">;
     serverCreateSchema: import("yup").ObjectSchema<{
@@ -216,6 +226,7 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         primary_email_verified: boolean | undefined;
         primary_email_auth_enabled: boolean | undefined;
         password: string | null | undefined;
+        totp_secret_base64: string | null | undefined;
         selected_team_id: string | null | undefined;
     } & {
         oauth_providers: {
@@ -232,6 +243,7 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         primary_email_verified: undefined;
         primary_email_auth_enabled: undefined;
         password: undefined;
+        totp_secret_base64: undefined;
         selected_team_id: undefined;
         oauth_providers: undefined;
     }, "">;
@@ -283,6 +295,7 @@ export declare const userCreatedWebhookEvent: {
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
         auth_with_email: NonNullable<boolean | undefined>;
+        requires_totp_mfa: NonNullable<boolean | undefined>;
         oauth_providers: {
             email?: string | null | undefined;
             id: string;
@@ -329,6 +342,7 @@ export declare const userCreatedWebhookEvent: {
         signed_up_at_millis: undefined;
         has_password: undefined;
         auth_with_email: undefined;
+        requires_totp_mfa: undefined;
         oauth_providers: undefined;
         auth_methods: undefined;
         connected_accounts: undefined;
@@ -359,6 +373,7 @@ export declare const userUpdatedWebhookEvent: {
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
         auth_with_email: NonNullable<boolean | undefined>;
+        requires_totp_mfa: NonNullable<boolean | undefined>;
         oauth_providers: {
             email?: string | null | undefined;
             id: string;
@@ -405,6 +420,7 @@ export declare const userUpdatedWebhookEvent: {
         signed_up_at_millis: undefined;
         has_password: undefined;
         auth_with_email: undefined;
+        requires_totp_mfa: undefined;
         oauth_providers: undefined;
         auth_methods: undefined;
         connected_accounts: undefined;

package/dist/interface/crud/users.js

@@ -10,6 +10,7 @@ export const usersCrudServerUpdateSchema = fieldSchema.yupObject({
     primary_email_verified: fieldSchema.primaryEmailVerifiedSchema.optional(),
     primary_email_auth_enabled: fieldSchema.yupBoolean().optional().meta({ openapiField: { description: "Whether the primary email can be used to sign into this user's account", exampleValue: true } }),
     password: fieldSchema.yupString().nullable().meta({ openapiField: { description: 'A new password for the user, overwriting the old one (if it exists).', exampleValue: 'password' } }),
+    totp_secret_base64: fieldSchema.base64Schema.nullable().meta({ openapiField: { description: 'A TOTP secret for the user, overwriting the old one (if it exists). Set to null to disable 2FA.', exampleValue: 'dG90cC1zZWNyZXQ=' } }),
     selected_team_id: fieldSchema.selectedTeamIdSchema.nullable().optional(),
 }).required();
 export const usersCrudServerReadSchema = fieldSchema.yupObject({
@@ -26,6 +27,10 @@ export const usersCrudServerReadSchema = fieldSchema.yupObject({
      * @deprecated
      */
     auth_with_email: fieldSchema.yupBoolean().required().meta({ openapiField: { hidden: true, description: 'Whether the user can authenticate with their primary e-mail. If set to true, the user can log-in with credentials and/or magic link, if enabled in the project settings.', exampleValue: true } }),
+    /**
+     * @deprecated
+     */
+    requires_totp_mfa: fieldSchema.yupBoolean().required().meta({ openapiField: { hidden: true, description: 'Whether the user is required to use TOTP MFA to sign in', exampleValue: false } }),
     /**
      * @deprecated
      */
@@ -46,11 +51,11 @@ export const usersCrudServerReadSchema = fieldSchema.yupObject({
     }).required(), fieldSchema.yupObject({
         type: fieldSchema.yupString().oneOf(['oauth']).required(),
         provider: fieldSchema.userOAuthProviderSchema.required(),
-    }).required())).required().meta({ openapiField: { description: 'A list of authentication methods available for this user to sign in with', exampleValue: [{ "contact_channel": { "email": "john.doe@gmail.com", "type": "email", }, "type": "otp", }] } }),
+    }).required())).required().meta({ openapiField: { hidden: true, description: 'A list of authentication methods available for this user to sign in with', exampleValue: [{ "contact_channel": { "email": "john.doe@gmail.com", "type": "email", }, "type": "otp", }] } }),
     connected_accounts: fieldSchema.yupArray(fieldSchema.yupUnion(fieldSchema.yupObject({
         type: fieldSchema.yupString().oneOf(['oauth']).required(),
         provider: fieldSchema.userOAuthProviderSchema.required(),
-    }).required())).required().meta({ openapiField: { description: 'A list of connected accounts to this user', exampleValue: [{ "provider": { "provider_user_id": "12345", "type": "google", }, "type": "oauth", }] } }),
+    }).required())).required().meta({ openapiField: { hidden: true, description: 'A list of connected accounts to this user', exampleValue: [{ "provider": { "provider_user_id": "12345", "type": "google", }, "type": "oauth", }] } }),
     client_metadata: fieldSchema.userClientMetadataSchema,
     server_metadata: fieldSchema.userServerMetadataSchema,
 }).required();

package/dist/interface/crud-deprecated/email-templates.d.ts

@@ -1,8 +1,8 @@
 import { CrudTypeOf } from "../../crud";
 export type EmailTemplateType = typeof emailTemplateTypes[number];
-export declare const emailTemplateTypes: readonly ["EMAIL_VERIFICATION", "PASSWORD_RESET", "MAGIC_LINK"];
+export declare const emailTemplateTypes: readonly ["EMAIL_VERIFICATION", "PASSWORD_RESET", "MAGIC_LINK", "TEAM_INVITATION"];
 export declare const emailTemplateServerReadSchema: import("yup").ObjectSchema<{
-    type: NonNullable<"EMAIL_VERIFICATION" | "PASSWORD_RESET" | "MAGIC_LINK" | undefined>;
+    type: NonNullable<"EMAIL_VERIFICATION" | "PASSWORD_RESET" | "MAGIC_LINK" | "TEAM_INVITATION" | undefined>;
     subject: string;
     content: {};
 }, import("yup").AnyObject, {
@@ -19,7 +19,7 @@ export declare const emailTemplateCrudServerUpdateSchema: import("yup").ObjectSc
 }, "">;
 export declare const emailTemplateCrudServerDeleteSchema: import("yup").MixedSchema<{} | undefined, import("yup").AnyObject, undefined, "">;
 export declare const emailTemplateCrudServerCreateSchema: import("yup").ObjectSchema<{
-    type: NonNullable<"EMAIL_VERIFICATION" | "PASSWORD_RESET" | "MAGIC_LINK" | undefined>;
+    type: NonNullable<"EMAIL_VERIFICATION" | "PASSWORD_RESET" | "MAGIC_LINK" | "TEAM_INVITATION" | undefined>;
     content: {};
     subject: string;
 }, import("yup").AnyObject, {
@@ -29,7 +29,7 @@ export declare const emailTemplateCrudServerCreateSchema: import("yup").ObjectSc
 }, "">;
 export declare const emailTemplateCrud: import("../../crud").CrudSchemaFromOptions<{
     serverReadSchema: import("yup").ObjectSchema<{
-        type: NonNullable<"EMAIL_VERIFICATION" | "PASSWORD_RESET" | "MAGIC_LINK" | undefined>;
+        type: NonNullable<"EMAIL_VERIFICATION" | "PASSWORD_RESET" | "MAGIC_LINK" | "TEAM_INVITATION" | undefined>;
         subject: string;
         content: {};
     }, import("yup").AnyObject, {
@@ -45,7 +45,7 @@ export declare const emailTemplateCrud: import("../../crud").CrudSchemaFromOptio
         subject: undefined;
     }, "">;
     serverCreateSchema: import("yup").ObjectSchema<{
-        type: NonNullable<"EMAIL_VERIFICATION" | "PASSWORD_RESET" | "MAGIC_LINK" | undefined>;
+        type: NonNullable<"EMAIL_VERIFICATION" | "PASSWORD_RESET" | "MAGIC_LINK" | "TEAM_INVITATION" | undefined>;
         content: {};
         subject: string;
     }, import("yup").AnyObject, {

package/dist/interface/crud-deprecated/email-templates.js

@@ -1,6 +1,6 @@
 import { createCrud } from "../../crud";
 import { jsonSchema, yupMixed, yupObject, yupString } from "../../schema-fields";
-export const emailTemplateTypes = ['EMAIL_VERIFICATION', 'PASSWORD_RESET', 'MAGIC_LINK'];
+export const emailTemplateTypes = ['EMAIL_VERIFICATION', 'PASSWORD_RESET', 'MAGIC_LINK', 'TEAM_INVITATION'];
 export const emailTemplateServerReadSchema = yupObject({
     type: yupString().oneOf(emailTemplateTypes).required(),
     subject: yupString().required(),

package/dist/interface/serverInterface.d.ts

@@ -28,13 +28,14 @@ export declare class StackServerInterface extends StackClientInterface {
             refreshToken: RefreshToken | null;
         } | null;
     }, InstanceType<E>>>;
+    createServerUser(data: UsersCrud['Server']['Create']): Promise<UsersCrud['Server']['Read']>;
     getServerUserByToken(session: InternalSession): Promise<CurrentUserCrud['Server']['Read'] | null>;
     getServerUserById(userId: string): Promise<Result<UsersCrud['Server']['Read']>>;
     listServerTeamPermissions(options: {
         userId?: string;
         teamId?: string;
         recursive: boolean;
-    }, session: InternalSession): Promise<TeamPermissionsCrud['Server']['Read'][]>;
+    }, session: InternalSession | null): Promise<TeamPermissionsCrud['Server']['Read'][]>;
     listServerUsers(): Promise<UsersCrud['Server']['Read'][]>;
     listServerTeams(options?: {
         userId?: string;
@@ -57,11 +58,6 @@ export declare class StackServerInterface extends StackClientInterface {
         accessToken: string;
         refreshToken: string;
     }>;
-    listServerTeamMemberPermissions(options: {
-        teamId: string;
-        userId: string;
-        recursive: boolean;
-    }): Promise<TeamPermissionsCrud['Server']['Read'][]>;
     grantServerTeamUserPermission(teamId: string, userId: string, permissionId: string): Promise<void>;
     revokeServerTeamUserPermission(teamId: string, userId: string, permissionId: string): Promise<void>;
     deleteServerServerUser(userId: string): Promise<void>;

package/dist/interface/serverInterface.js

@@ -30,6 +30,16 @@ export class StackServerInterface extends StackClientInterface {
             throw e;
         }
     }
+    async createServerUser(data) {
+        const response = await this.sendServerRequest("/users", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(data),
+        }, null);
+        return await response.json();
+    }
     async getServerUserByToken(session) {
         const responseOrError = await this.sendServerRequestAndCatchKnownError("/users/me", {}, session, [KnownErrors.CannotGetOwnUserWithoutUser]);
         if (responseOrError.status === "error") {
@@ -159,11 +169,6 @@ export class StackServerInterface extends StackClientInterface {
             refreshToken: result.refresh_token,
         };
     }
-    async listServerTeamMemberPermissions(options) {
-        const response = await this.sendServerRequest(`/team-permissions?team_id=${options.teamId}&user_id=${options.userId}&recursive=${options.recursive}`, {}, null);
-        const result = await response.json();
-        return result.items;
-    }
     async grantServerTeamUserPermission(teamId, userId, permissionId) {
         await this.sendServerRequest(`/team-permissions/${teamId}/${userId}/${permissionId}`, {
             method: "POST",

package/dist/interface/webhooks.d.ts

@@ -26,6 +26,7 @@ export declare const webhookEvents: readonly [{
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
         auth_with_email: NonNullable<boolean | undefined>;
+        requires_totp_mfa: NonNullable<boolean | undefined>;
         oauth_providers: {
             email?: string | null | undefined;
             id: string;
@@ -72,6 +73,7 @@ export declare const webhookEvents: readonly [{
         signed_up_at_millis: undefined;
         has_password: undefined;
         auth_with_email: undefined;
+        requires_totp_mfa: undefined;
         oauth_providers: undefined;
         auth_methods: undefined;
         connected_accounts: undefined;
@@ -101,6 +103,7 @@ export declare const webhookEvents: readonly [{
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
         auth_with_email: NonNullable<boolean | undefined>;
+        requires_totp_mfa: NonNullable<boolean | undefined>;
         oauth_providers: {
             email?: string | null | undefined;
             id: string;
@@ -147,6 +150,7 @@ export declare const webhookEvents: readonly [{
         signed_up_at_millis: undefined;
         has_password: undefined;
         auth_with_email: undefined;
+        requires_totp_mfa: undefined;
         oauth_providers: undefined;
         auth_methods: undefined;
         connected_accounts: undefined;

package/dist/known-errors.d.ts

@@ -245,6 +245,9 @@ export declare const KnownErrors: {
     ProjectNotFound: KnownErrorConstructor<KnownError & KnownErrorBrand<"PROJECT_NOT_FOUND">, [projectId: string]> & {
         errorCode: "PROJECT_NOT_FOUND";
     };
+    SignUpNotEnabled: KnownErrorConstructor<KnownError & KnownErrorBrand<"SIGN_UP_NOT_ENABLED">, []> & {
+        errorCode: "SIGN_UP_NOT_ENABLED";
+    };
     PasswordAuthenticationNotEnabled: KnownErrorConstructor<KnownError & KnownErrorBrand<"PASSWORD_AUTHENTICATION_NOT_ENABLED">, []> & {
         errorCode: "PASSWORD_AUTHENTICATION_NOT_ENABLED";
     };
@@ -345,6 +348,12 @@ export declare const KnownErrors: {
     OAuthProviderNotFoundOrNotEnabled: KnownErrorConstructor<KnownError & KnownErrorBrand<"OAUTH_PROVIDER_NOT_FOUND_OR_NOT_ENABLED">, []> & {
         errorCode: "OAUTH_PROVIDER_NOT_FOUND_OR_NOT_ENABLED";
     };
+    MultiFactorAuthenticationRequired: KnownErrorConstructor<KnownError & KnownErrorBrand<"MULTI_FACTOR_AUTHENTICATION_REQUIRED">, [attemptCode: string]> & {
+        errorCode: "MULTI_FACTOR_AUTHENTICATION_REQUIRED";
+    };
+    InvalidTotpCode: KnownErrorConstructor<KnownError & KnownErrorBrand<"INVALID_TOTP_CODE">, []> & {
+        errorCode: "INVALID_TOTP_CODE";
+    };
     UserAuthenticationRequired: KnownErrorConstructor<KnownError & KnownErrorBrand<"USER_AUTHENTICATION_REQUIRED">, []> & {
         errorCode: "USER_AUTHENTICATION_REQUIRED";
     };
@@ -363,5 +372,8 @@ export declare const KnownErrors: {
     InvalidAuthorizationCode: KnownErrorConstructor<KnownError & KnownErrorBrand<"INVALID_AUTHORIZATION_CODE">, []> & {
         errorCode: "INVALID_AUTHORIZATION_CODE";
     };
+    TeamPermissionNotFound: KnownErrorConstructor<KnownError & KnownErrorBrand<"TEAM_PERMISSION_NOT_FOUND">, [any, any, any]> & {
+        errorCode: "TEAM_PERMISSION_NOT_FOUND";
+    };
 };
 export {};

package/dist/known-errors.js

@@ -320,6 +320,10 @@ const ProjectNotFound = createKnownErrorConstructor(KnownError, "PROJECT_NOT_FOU
         },
     ];
 }, (json) => [json.project_id]);
+const SignUpNotEnabled = createKnownErrorConstructor(KnownError, "SIGN_UP_NOT_ENABLED", () => [
+    400,
+    "Creation of new accounts is not enabled for this project. Please ask the project owner to enable it.",
+], () => []);
 const PasswordAuthenticationNotEnabled = createKnownErrorConstructor(KnownError, "PASSWORD_AUTHENTICATION_NOT_ENABLED", () => [
     400,
     "Password authentication is not enabled for this project.",
@@ -471,6 +475,17 @@ const OAuthProviderNotFoundOrNotEnabled = createKnownErrorConstructor(KnownError
     400,
     "The OAuth provider is not found or not enabled.",
 ], () => []);
+const MultiFactorAuthenticationRequired = createKnownErrorConstructor(KnownError, "MULTI_FACTOR_AUTHENTICATION_REQUIRED", (attemptCode) => [
+    400,
+    `Multi-factor authentication is required for this user.`,
+    {
+        attempt_code: attemptCode,
+    },
+], (json) => [json.attempt_code]);
+const InvalidTotpCode = createKnownErrorConstructor(KnownError, "INVALID_TOTP_CODE", () => [
+    400,
+    "The TOTP code is invalid. Please try again.",
+], () => []);
 const UserAuthenticationRequired = createKnownErrorConstructor(KnownError, "USER_AUTHENTICATION_REQUIRED", () => [
     401,
     "User authentication required for this endpoint.",
@@ -488,6 +503,15 @@ const TeamPermissionRequired = createKnownErrorConstructor(KnownError, "TEAM_PER
         permission_id: permissionId,
     },
 ], (json) => [json.team_id, json.user_id, json.permission_id]);
+const TeamPermissionNotFound = createKnownErrorConstructor(KnownError, "TEAM_PERMISSION_NOT_FOUND", (teamId, userId, permissionId) => [
+    401,
+    `User ${userId} does not have permission ${permissionId} in team ${teamId}.`,
+    {
+        team_id: teamId,
+        user_id: userId,
+        permission_id: permissionId,
+    },
+], (json) => [json.team_id, json.user_id, json.permission_id]);
 const InvalidSharedOAuthProviderId = createKnownErrorConstructor(KnownError, "INVALID_SHARED_OAUTH_PROVIDER_ID", (providerId) => [
     400,
     `The shared OAuth provider with ID ${providerId} is not valid.`,
@@ -552,6 +576,7 @@ export const KnownErrors = {
     UserNotFound,
     ApiKeyNotFound,
     ProjectNotFound,
+    SignUpNotEnabled,
     PasswordAuthenticationNotEnabled,
     EmailPasswordMismatch,
     RedirectUrlNotWhitelisted,
@@ -582,12 +607,15 @@ export const KnownErrors = {
     UserAlreadyConnectedToAnotherOAuthConnection,
     OuterOAuthTimeout,
     OAuthProviderNotFoundOrNotEnabled,
+    MultiFactorAuthenticationRequired,
+    InvalidTotpCode,
     UserAuthenticationRequired,
     TeamMembershipAlreadyExists,
     TeamPermissionRequired,
     InvalidSharedOAuthProviderId,
     InvalidStandardOAuthProviderId,
     InvalidAuthorizationCode,
+    TeamPermissionNotFound,
 };
 // ensure that all known error codes are unique
 const knownErrorCodes = new Set();

package/dist/schema-fields.d.ts

@@ -22,6 +22,7 @@ export declare const jsonSchema: yup.MixedSchema<{} | null, yup.AnyObject, undef
 export declare const jsonStringSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const jsonStringOrEmptySchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const emailSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
+export declare const base64Schema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const clientOrHigherAuthTypeSchema: yup.StringSchema<"client" | "server" | "admin" | undefined, yup.AnyObject, undefined, "">;
 export declare const serverOrHigherAuthTypeSchema: yup.StringSchema<"server" | "admin" | undefined, yup.AnyObject, undefined, "">;
 export declare const adminAuthTypeSchema: yup.StringSchema<"admin" | undefined, yup.AnyObject, undefined, "">;
@@ -35,6 +36,7 @@ export declare const projectConfigIdSchema: yup.StringSchema<string | undefined,
 export declare const projectAllowLocalhostSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectCreateTeamOnSignUpSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectMagicLinkEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
+export declare const projectSignUpEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectCredentialEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const oauthIdSchema: yup.StringSchema<"google" | "github" | "facebook" | "microsoft" | "spotify" | undefined, yup.AnyObject, undefined, "">;
 export declare const oauthEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
@@ -98,6 +100,8 @@ export declare const teamProfileImageUrlSchema: yup.StringSchema<string | undefi
 export declare const teamClientMetadataSchema: yup.MixedSchema<{} | null, yup.AnyObject, undefined, "">;
 export declare const teamServerMetadataSchema: yup.MixedSchema<{} | null, yup.AnyObject, undefined, "">;
 export declare const teamCreatedAtMillisSchema: yup.NumberSchema<number | undefined, yup.AnyObject, undefined, "">;
+export declare const teamInvitationEmailSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
+export declare const teamInvitationCallbackUrlSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const teamMemberDisplayNameSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const teamMemberProfileImageUrlSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare function yupRequiredWhen<S extends yup.AnyObject>(schema: S, triggerName: string, isValue: any): S;

package/dist/schema-fields.js

@@ -1,4 +1,5 @@
 import * as yup from "yup";
+import { isBase64 } from "./utils/bytes";
 import { StackAssertionError } from "./utils/errors";
 import { allProviders } from "./utils/oauth";
 import { isUuid } from "./utils/uuids";
@@ -124,6 +125,11 @@ export const jsonStringOrEmptySchema = yupString().test("json", "Invalid JSON fo
     }
 });
 export const emailSchema = yupString().email();
+export const base64Schema = yupString().test("is-base64", "Invalid base64 format", (value) => {
+    if (value == null)
+        return true;
+    return isBase64(value);
+});
 // Request auth
 export const clientOrHigherAuthTypeSchema = yupString().oneOf(['client', 'server', 'admin']);
 export const serverOrHigherAuthTypeSchema = yupString().oneOf(['server', 'admin']);
@@ -140,6 +146,7 @@ export const projectConfigIdSchema = yupString().meta({ openapiField: { descript
 export const projectAllowLocalhostSchema = yupBoolean().meta({ openapiField: { description: 'Whether localhost is allowed as a domain for this project. Should only be allowed in development mode', exampleValue: true } });
 export const projectCreateTeamOnSignUpSchema = yupBoolean().meta({ openapiField: { description: 'Whether a team should be created for each user that signs up', exampleValue: true } });
 export const projectMagicLinkEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether magic link authentication is enabled for this project', exampleValue: true } });
+export const projectSignUpEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether users can sign up new accounts, or whether they are only allowed to sign in to existing accounts. Regardless of this option, the server API can always create new users with the `POST /users` endpoint.', exampleValue: true } });
 export const projectCredentialEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether email password authentication is enabled for this project', exampleValue: true } });
 // Project OAuth config
 export const oauthIdSchema = yupString().oneOf(allProviders).meta({ openapiField: { description: `OAuth provider ID, one of ${allProviders.map(x => `\`${x}\``).join(', ')}`, exampleValue: 'google' } });
@@ -180,7 +187,7 @@ export const userIdSchema = yupString().uuid().meta({ openapiField: { descriptio
 export const primaryEmailSchema = emailSchema.meta({ openapiField: { description: 'Primary email', exampleValue: 'johndoe@example.com' } });
 export const primaryEmailVerifiedSchema = yupBoolean().meta({ openapiField: { description: 'Whether the primary email has been verified to belong to this user', exampleValue: true } });
 export const userDisplayNameSchema = yupString().nullable().meta({ openapiField: { description: _displayNameDescription('user'), exampleValue: 'John Doe' } });
-export const selectedTeamIdSchema = yupString().meta({ openapiField: { description: 'ID of the team currently selected by the user', exampleValue: 'team-id' } });
+export const selectedTeamIdSchema = yupString().uuid().meta({ openapiField: { description: 'ID of the team currently selected by the user', exampleValue: 'team-id' } });
 export const profileImageUrlSchema = yupString().meta({ openapiField: { description: _profileImageUrlDescription('user'), exampleValue: 'https://example.com/image.jpg' } });
 export const signedUpAtMillisSchema = yupNumber().meta({ openapiField: { description: _signedUpAtMillisDescription, exampleValue: 1630000000000 } });
 export const userClientMetadataSchema = jsonSchema.meta({ openapiField: { description: _clientMetaDataDescription('user'), exampleValue: { key: 'value' } } });
@@ -232,6 +239,8 @@ export const teamProfileImageUrlSchema = yupString().meta({ openapiField: { desc
 export const teamClientMetadataSchema = jsonSchema.meta({ openapiField: { description: _clientMetaDataDescription('team'), exampleValue: { key: 'value' } } });
 export const teamServerMetadataSchema = jsonSchema.meta({ openapiField: { description: _serverMetaDataDescription('team'), exampleValue: { key: 'value' } } });
 export const teamCreatedAtMillisSchema = yupNumber().meta({ openapiField: { description: _createdAtMillisDescription('team'), exampleValue: 1630000000000 } });
+export const teamInvitationEmailSchema = emailSchema.meta({ openapiField: { description: 'The email to sign in with.', exampleValue: 'johndoe@example.com' } });
+export const teamInvitationCallbackUrlSchema = urlSchema.meta({ openapiField: { description: 'The base callback URL to construct a verification link for the verification e-mail. A query argument `code` with the verification code will be appended to it. The page should then make a request to the `/contact-channels/verify` endpoint.', exampleValue: 'https://example.com/handler/email-verification' } });
 // Team member profiles
 export const teamMemberDisplayNameSchema = yupString().meta({ openapiField: { description: _displayNameDescription('team member') + ' Note that this is separate from the display_name of the user.', exampleValue: 'John Doe' } });
 export const teamMemberProfileImageUrlSchema = yupString().meta({ openapiField: { description: _profileImageUrlDescription('team member'), exampleValue: 'https://example.com/image.jpg' } });

package/dist/utils/bytes.d.ts

@@ -1,2 +1,6 @@
 export declare function encodeBase32(input: Uint8Array): string;
 export declare function decodeBase32(input: string): Uint8Array;
+export declare function encodeBase64(input: Uint8Array): string;
+export declare function decodeBase64(input: string): Uint8Array;
+export declare function isBase32(input: string): boolean;
+export declare function isBase64(input: string): boolean;

package/dist/utils/bytes.js

@@ -1,3 +1,4 @@
+import { StackAssertionError } from "./errors";
 const crockfordAlphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 const crockfordReplacements = new Map([
     ["o", "0"],
@@ -19,9 +20,16 @@ export function encodeBase32(input) {
     if (bits > 0) {
         output += crockfordAlphabet[(value << (5 - bits)) & 31];
     }
+    // sanity check
+    if (!isBase32(output)) {
+        throw new StackAssertionError("Invalid base32 output; this should never happen");
+    }
     return output;
 }
 export function decodeBase32(input) {
+    if (!isBase32(input)) {
+        throw new StackAssertionError("Invalid base32 string");
+    }
     const output = new Uint8Array((input.length * 5 / 8) | 0);
     let bits = 0;
     let value = 0;
@@ -46,3 +54,31 @@ export function decodeBase32(input) {
     }
     return output;
 }
+export function encodeBase64(input) {
+    const res = btoa(String.fromCharCode(...input));
+    // sanity check
+    if (!isBase64(res)) {
+        throw new StackAssertionError("Invalid base64 output; this should never happen");
+    }
+    return res;
+}
+export function decodeBase64(input) {
+    if (!isBase64(input)) {
+        throw new StackAssertionError("Invalid base64 string");
+    }
+    return new Uint8Array(atob(input).split("").map((char) => char.charCodeAt(0)));
+}
+export function isBase32(input) {
+    for (const char of input) {
+        if (char === " ")
+            continue;
+        if (!crockfordAlphabet.includes(char)) {
+            return false;
+        }
+    }
+    return true;
+}
+export function isBase64(input) {
+    const regex = /^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/;
+    return regex.test(input);
+}

package/dist/utils/crypto.d.ts

@@ -1,4 +1,4 @@
-export declare function generateRandomValues(array: Uint8Array): any;
+export declare function generateRandomValues(array: Uint8Array): typeof array;
 /**
  * Generates a secure alphanumeric string using the system's cryptographically secure
  * random number generator.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackframe/stack-shared",
-  "version": "2.5.17",
+  "version": "2.5.18",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -36,7 +36,7 @@
     "jose": "^5.2.2",
     "oauth4webapi": "^2.10.3",
     "uuid": "^9.0.1",
-    "@stackframe/stack-sc": "2.5.17"
+    "@stackframe/stack-sc": "2.5.18"
   },
   "devDependencies": {
     "rimraf": "^5.0.5",