@stackframe/stack-shared 2.6.11 → 2.6.15

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @stackframe/stack-shared
 
+## 2.6.15
+
+### Patch Changes
+
+- Passkeys
+  - @stackframe/stack-sc@2.6.15
+
+## 2.6.14
+
+### Patch Changes
+
+- @stackframe/stack-sc@2.6.14
+
+## 2.6.13
+
+### Patch Changes
+
+- Updated docs
+  - @stackframe/stack-sc@2.6.13
+
+## 2.6.12
+
+### Patch Changes
+
+- Updated account settings page
+- Updated dependencies
+  - @stackframe/stack-sc@2.6.12
+
 ## 2.6.11
 
 ### Patch Changes

package/dist/interface/clientInterface.d.ts

@@ -1,7 +1,9 @@
 import { KnownErrors } from '../known-errors';
 import { AccessToken, InternalSession, RefreshToken } from '../sessions';
 import { ReadonlyJson } from '../utils/json';
+import { AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON } from '../utils/passkey';
 import { Result } from "../utils/results";
+import { ContactChannelsCrud } from './crud/contact-channels';
 import { CurrentUserCrud } from './crud/current-user';
 import { ConnectedAccountAccessTokenCrud } from './crud/oauth';
 import { InternalProjectsCrud, ProjectsCrud } from './crud/projects';
@@ -67,14 +69,29 @@ export declare class StackClientInterface {
         oldPassword: string;
         newPassword: string;
     }, session: InternalSession): Promise<KnownErrors["PasswordConfirmationMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    setPassword(options: {
+        password: string;
+    }, session: InternalSession): Promise<KnownErrors["PasswordRequirementsNotMet"] | undefined>;
     verifyPasswordResetCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
     verifyEmail(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    initiatePasskeyRegistration(options: {}, session: InternalSession): Promise<Result<{
+        options_json: PublicKeyCredentialCreationOptionsJSON;
+        code: string;
+    }, KnownErrors[]>>;
+    registerPasskey(options: {
+        credential: RegistrationResponseJSON;
+        code: string;
+    }, session: InternalSession): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"]>>;
+    initiatePasskeyAuthentication(options: {}, session: InternalSession): Promise<Result<{
+        options_json: PublicKeyCredentialRequestOptionsJSON;
+        code: string;
+    }, KnownErrors[]>>;
     sendTeamInvitation(options: {
         email: string;
         teamId: string;
         callbackUrl: string;
         session: InternalSession | null;
-    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
+    }): Promise<void>;
     acceptTeamInvitation<T extends 'use' | 'details' | 'check'>(options: {
         code: string;
         session: InternalSession;
@@ -100,6 +117,13 @@ export declare class StackClientInterface {
         accessToken: string;
         refreshToken: string;
     }, KnownErrors["VerificationCodeError"]>>;
+    signInWithPasskey(body: {
+        authentication_response: AuthenticationResponseJSON;
+        code: string;
+    }): Promise<Result<{
+        accessToken: string;
+        refreshToken: string;
+    }, KnownErrors["PasskeyAuthenticationFailed"]>>;
     getOAuthUrl(options: {
         provider: string;
         redirectUrl: string;
@@ -158,4 +182,9 @@ export declare class StackClientInterface {
     createProviderAccessToken(provider: string, scope: string, session: InternalSession): Promise<ConnectedAccountAccessTokenCrud['Client']['Read']>;
     createClientTeam(data: TeamsCrud['Client']['Create'], session: InternalSession): Promise<TeamsCrud['Client']['Read']>;
     deleteCurrentUser(session: InternalSession): Promise<void>;
+    createClientContactChannel(data: ContactChannelsCrud['Client']['Create'], session: InternalSession): Promise<ContactChannelsCrud['Client']['Read']>;
+    updateClientContactChannel(id: string, data: ContactChannelsCrud['Client']['Update'], session: InternalSession): Promise<ContactChannelsCrud['Client']['Read']>;
+    deleteClientContactChannel(id: string, session: InternalSession): Promise<void>;
+    listClientContactChannels(session: InternalSession): Promise<ContactChannelsCrud['Client']['Read'][]>;
+    sendCurrentUserContactChannelVerificationEmail(contactChannelId: string, callbackUrl: string, session: InternalSession): Promise<Result<undefined, KnownErrors["EmailAlreadyVerified"]>>;
 }

package/dist/interface/clientInterface.js

@@ -375,6 +375,18 @@ export class StackClientInterface {
             return res.error;
         }
     }
+    async setPassword(options, session) {
+        const res = await this.sendClientRequestAndCatchKnownError("/auth/password/set", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(options),
+        }, session, [KnownErrors.PasswordRequirementsNotMet]);
+        if (res.status === "error") {
+            return res.error;
+        }
+    }
     async verifyPasswordResetCode(code) {
         const res = await this.resetPassword({ code, onlyVerifyCode: true });
         if (res.status === "error") {
@@ -401,8 +413,47 @@ export class StackClientInterface {
             return Result.ok(undefined);
         }
     }
+    async initiatePasskeyRegistration(options, session) {
+        const res = await this.sendClientRequestAndCatchKnownError("/auth/passkey/initiate-passkey-registration", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(options),
+        }, session, []);
+        if (res.status === "error") {
+            return Result.error(res.error);
+        }
+        return Result.ok(await res.data.json());
+    }
+    async registerPasskey(options, session) {
+        const res = await this.sendClientRequestAndCatchKnownError("/auth/passkey/register", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(options),
+        }, session, [KnownErrors.PasskeyRegistrationFailed]);
+        if (res.status === "error") {
+            return Result.error(res.error);
+        }
+        return Result.ok(undefined);
+    }
+    async initiatePasskeyAuthentication(options, session) {
+        const res = await this.sendClientRequestAndCatchKnownError("/auth/passkey/initiate-passkey-authentication", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(options),
+        }, session, []);
+        if (res.status === "error") {
+            return Result.error(res.error);
+        }
+        return Result.ok(await res.data.json());
+    }
     async sendTeamInvitation(options) {
-        const res = await this.sendClientRequestAndCatchKnownError("/team-invitations/send-code", {
+        await this.sendClientRequest("/team-invitations/send-code", {
             method: "POST",
             headers: {
                 "Content-Type": "application/json"
@@ -412,13 +463,7 @@ export class StackClientInterface {
                 team_id: options.teamId,
                 callback_url: options.callbackUrl,
             }),
-        }, options.session, [KnownErrors.TeamPermissionRequired]);
-        if (res.status === "error") {
-            return Result.error(res.error);
-        }
-        else {
-            return Result.ok(undefined);
-        }
+        }, options.session);
     }
     async acceptTeamInvitation(options) {
         const res = await this.sendClientRequestAndCatchKnownError(options.type === 'check' ?
@@ -521,6 +566,23 @@ export class StackClientInterface {
             newUser: result.is_new_user,
         });
     }
+    async signInWithPasskey(body) {
+        const res = await this.sendClientRequestAndCatchKnownError("/auth/passkey/sign-in", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify(body),
+        }, null, [KnownErrors.PasskeyAuthenticationFailed]);
+        if (res.status === "error") {
+            return Result.error(res.error);
+        }
+        const result = await res.data.json();
+        return Result.ok({
+            accessToken: result.access_token,
+            refreshToken: result.refresh_token,
+        });
+    }
     async getOAuthUrl(options) {
         const updatedRedirectUrl = new URL(options.redirectUrl);
         for (const key of ["code", "state"]) {
@@ -747,4 +809,49 @@ export class StackClientInterface {
             method: "DELETE",
         }, session);
     }
+    async createClientContactChannel(data, session) {
+        const response = await this.sendClientRequest("/contact-channels", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(data),
+        }, session);
+        return await response.json();
+    }
+    async updateClientContactChannel(id, data, session) {
+        const response = await this.sendClientRequest(`/contact-channels/me/${id}`, {
+            method: "PATCH",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(data),
+        }, session);
+        return await response.json();
+    }
+    async deleteClientContactChannel(id, session) {
+        await this.sendClientRequest(`/contact-channels/me/${id}`, {
+            method: "DELETE",
+        }, session);
+    }
+    async listClientContactChannels(session) {
+        const response = await this.sendClientRequest("/contact-channels?user_id=me", {
+            method: "GET",
+        }, session);
+        const json = await response.json();
+        return json.items;
+    }
+    async sendCurrentUserContactChannelVerificationEmail(contactChannelId, callbackUrl, session) {
+        const responseOrError = await this.sendClientRequestAndCatchKnownError(`/contact-channels/me/${contactChannelId}/send-verification-code`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ callback_url: callbackUrl }),
+        }, session, [KnownErrors.EmailAlreadyVerified]);
+        if (responseOrError.status === "error") {
+            return Result.error(responseOrError.error);
+        }
+        return Result.ok(undefined);
+    }
 }

package/dist/interface/crud/current-user.d.ts

@@ -13,6 +13,8 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         client_metadata: {} | null;
         client_read_only_metadata: {} | null;
         primary_email_verified: NonNullable<boolean | undefined>;
+        passkey_auth_enabled: NonNullable<boolean | undefined>;
+        otp_auth_enabled: NonNullable<boolean | undefined>;
         selected_team_id: string | null;
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
@@ -30,6 +32,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         id: undefined;
         primary_email: undefined;
         primary_email_verified: undefined;
+        primary_email_auth_enabled: undefined;
         display_name: undefined;
         selected_team: {
             id: undefined;
@@ -42,6 +45,8 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         profile_image_url: undefined;
         signed_up_at_millis: undefined;
         has_password: undefined;
+        otp_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         client_metadata: undefined;
         client_read_only_metadata: undefined;
         server_metadata: undefined;
@@ -54,6 +59,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         id: string;
         primary_email: string | null;
         primary_email_verified: NonNullable<boolean | undefined>;
+        primary_email_auth_enabled: NonNullable<boolean | undefined>;
         display_name: string | null;
         selected_team: {
             client_metadata?: {} | null | undefined;
@@ -68,6 +74,8 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         profile_image_url: string | null;
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
+        otp_auth_enabled: NonNullable<boolean | undefined>;
+        passkey_auth_enabled: NonNullable<boolean | undefined>;
         client_metadata: {} | null;
         client_read_only_metadata: {} | null;
         server_metadata: {} | null;
@@ -83,6 +91,7 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         id: undefined;
         primary_email: undefined;
         primary_email_verified: undefined;
+        primary_email_auth_enabled: undefined;
         display_name: undefined;
         selected_team: {
             id: undefined;
@@ -97,6 +106,8 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         profile_image_url: undefined;
         signed_up_at_millis: undefined;
         has_password: undefined;
+        otp_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         client_metadata: undefined;
         client_read_only_metadata: undefined;
         server_metadata: undefined;
@@ -109,6 +120,8 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         display_name: string | null | undefined;
         profile_image_url: string | null | undefined;
         client_metadata: {} | null | undefined;
+        passkey_auth_enabled: boolean | undefined;
+        otp_auth_enabled: boolean | undefined;
         totp_secret_base64: string | null | undefined;
         selected_team_id: string | null | undefined;
     }, import("yup").AnyObject, {
@@ -120,7 +133,9 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         primary_email: undefined;
         primary_email_verified: undefined;
         primary_email_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         password: undefined;
+        otp_auth_enabled: undefined;
         totp_secret_base64: undefined;
         selected_team_id: undefined;
     }, "">;
@@ -133,7 +148,9 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         primary_email: string | null | undefined;
         primary_email_verified: boolean | undefined;
         primary_email_auth_enabled: boolean | undefined;
+        passkey_auth_enabled: boolean | undefined;
         password: string | null | undefined;
+        otp_auth_enabled: boolean | undefined;
         totp_secret_base64: string | null | undefined;
         selected_team_id: string | null | undefined;
     }, import("yup").AnyObject, {
@@ -145,7 +162,9 @@ export declare const currentUserCrud: import("../../crud").CrudSchemaFromOptions
         primary_email: undefined;
         primary_email_verified: undefined;
         primary_email_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         password: undefined;
+        otp_auth_enabled: undefined;
         totp_secret_base64: undefined;
         selected_team_id: undefined;
     }, "">;

package/dist/interface/crud/current-user.js

@@ -8,6 +8,8 @@ const clientUpdateSchema = usersCrudServerUpdateSchema.pick([
     "client_metadata",
     "selected_team_id",
     "totp_secret_base64",
+    "otp_auth_enabled",
+    "passkey_auth_enabled",
 ]).required();
 const serverUpdateSchema = usersCrudServerUpdateSchema;
 const clientReadSchema = usersCrudServerReadSchema.pick([
@@ -24,6 +26,8 @@ const clientReadSchema = usersCrudServerReadSchema.pick([
     "oauth_providers",
     "selected_team_id",
     "requires_totp_mfa",
+    "otp_auth_enabled",
+    "passkey_auth_enabled",
 ]).concat(yupObject({
     selected_team: teamsCrudClientReadSchema.nullable().defined(),
 })).nullable().defined(); // TODO: next-release: make required

package/dist/interface/crud/projects.d.ts

@@ -12,6 +12,7 @@ export declare const projectsCrudAdminReadSchema: import("yup").ObjectSchema<{
         sign_up_enabled: NonNullable<boolean | undefined>;
         credential_enabled: NonNullable<boolean | undefined>;
         magic_link_enabled: NonNullable<boolean | undefined>;
+        passkey_enabled: NonNullable<boolean | undefined>;
         legacy_global_jwt_signing: NonNullable<boolean | undefined>;
         client_team_creation_enabled: NonNullable<boolean | undefined>;
         client_user_deletion_enabled: NonNullable<boolean | undefined>;
@@ -61,6 +62,7 @@ export declare const projectsCrudAdminReadSchema: import("yup").ObjectSchema<{
         sign_up_enabled: undefined;
         credential_enabled: undefined;
         magic_link_enabled: undefined;
+        passkey_enabled: undefined;
         legacy_global_jwt_signing: undefined;
         client_team_creation_enabled: undefined;
         client_user_deletion_enabled: undefined;
@@ -88,6 +90,7 @@ export declare const projectsCrudClientReadSchema: import("yup").ObjectSchema<{
         sign_up_enabled: NonNullable<boolean | undefined>;
         credential_enabled: NonNullable<boolean | undefined>;
         magic_link_enabled: NonNullable<boolean | undefined>;
+        passkey_enabled: NonNullable<boolean | undefined>;
         client_team_creation_enabled: NonNullable<boolean | undefined>;
         client_user_deletion_enabled: NonNullable<boolean | undefined>;
         enabled_oauth_providers: {
@@ -101,6 +104,7 @@ export declare const projectsCrudClientReadSchema: import("yup").ObjectSchema<{
         sign_up_enabled: undefined;
         credential_enabled: undefined;
         magic_link_enabled: undefined;
+        passkey_enabled: undefined;
         client_team_creation_enabled: undefined;
         client_user_deletion_enabled: undefined;
         enabled_oauth_providers: undefined;
@@ -115,6 +119,7 @@ export declare const projectsCrudAdminUpdateSchema: import("yup").ObjectSchema<{
         sign_up_enabled?: boolean | undefined;
         credential_enabled?: boolean | undefined;
         magic_link_enabled?: boolean | undefined;
+        passkey_enabled?: boolean | undefined;
         legacy_global_jwt_signing?: false | undefined;
         client_team_creation_enabled?: boolean | undefined;
         client_user_deletion_enabled?: boolean | undefined;
@@ -163,6 +168,7 @@ export declare const projectsCrudAdminCreateSchema: import("yup").ObjectSchema<{
         sign_up_enabled?: boolean | undefined;
         credential_enabled?: boolean | undefined;
         magic_link_enabled?: boolean | undefined;
+        passkey_enabled?: boolean | undefined;
         legacy_global_jwt_signing?: false | undefined;
         client_team_creation_enabled?: boolean | undefined;
         client_user_deletion_enabled?: boolean | undefined;
@@ -213,6 +219,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
             sign_up_enabled: NonNullable<boolean | undefined>;
             credential_enabled: NonNullable<boolean | undefined>;
             magic_link_enabled: NonNullable<boolean | undefined>;
+            passkey_enabled: NonNullable<boolean | undefined>;
             client_team_creation_enabled: NonNullable<boolean | undefined>;
             client_user_deletion_enabled: NonNullable<boolean | undefined>;
             enabled_oauth_providers: {
@@ -226,6 +233,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
             sign_up_enabled: undefined;
             credential_enabled: undefined;
             magic_link_enabled: undefined;
+            passkey_enabled: undefined;
             client_team_creation_enabled: undefined;
             client_user_deletion_enabled: undefined;
             enabled_oauth_providers: undefined;
@@ -244,6 +252,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
             sign_up_enabled: NonNullable<boolean | undefined>;
             credential_enabled: NonNullable<boolean | undefined>;
             magic_link_enabled: NonNullable<boolean | undefined>;
+            passkey_enabled: NonNullable<boolean | undefined>;
             legacy_global_jwt_signing: NonNullable<boolean | undefined>;
             client_team_creation_enabled: NonNullable<boolean | undefined>;
             client_user_deletion_enabled: NonNullable<boolean | undefined>;
@@ -293,6 +302,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
             sign_up_enabled: undefined;
             credential_enabled: undefined;
             magic_link_enabled: undefined;
+            passkey_enabled: undefined;
             legacy_global_jwt_signing: undefined;
             client_team_creation_enabled: undefined;
             client_user_deletion_enabled: undefined;
@@ -322,6 +332,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
             sign_up_enabled?: boolean | undefined;
             credential_enabled?: boolean | undefined;
             magic_link_enabled?: boolean | undefined;
+            passkey_enabled?: boolean | undefined;
             legacy_global_jwt_signing?: false | undefined;
             client_team_creation_enabled?: boolean | undefined;
             client_user_deletion_enabled?: boolean | undefined;
@@ -400,6 +411,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
             sign_up_enabled: NonNullable<boolean | undefined>;
             credential_enabled: NonNullable<boolean | undefined>;
             magic_link_enabled: NonNullable<boolean | undefined>;
+            passkey_enabled: NonNullable<boolean | undefined>;
             legacy_global_jwt_signing: NonNullable<boolean | undefined>;
             client_team_creation_enabled: NonNullable<boolean | undefined>;
             client_user_deletion_enabled: NonNullable<boolean | undefined>;
@@ -449,6 +461,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
             sign_up_enabled: undefined;
             credential_enabled: undefined;
             magic_link_enabled: undefined;
+            passkey_enabled: undefined;
             legacy_global_jwt_signing: undefined;
             client_team_creation_enabled: undefined;
             client_user_deletion_enabled: undefined;
@@ -478,6 +491,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
             sign_up_enabled?: boolean | undefined;
             credential_enabled?: boolean | undefined;
             magic_link_enabled?: boolean | undefined;
+            passkey_enabled?: boolean | undefined;
             legacy_global_jwt_signing?: false | undefined;
             client_team_creation_enabled?: boolean | undefined;
             client_user_deletion_enabled?: boolean | undefined;

package/dist/interface/crud/projects.js

@@ -43,12 +43,13 @@ export const projectsCrudAdminReadSchema = yupObject({
         sign_up_enabled: schemaFields.projectSignUpEnabledSchema.required(),
         credential_enabled: schemaFields.projectCredentialEnabledSchema.required(),
         magic_link_enabled: schemaFields.projectMagicLinkEnabledSchema.required(),
+        passkey_enabled: schemaFields.projectPasskeyEnabledSchema.required(),
         // TODO: remove this
         legacy_global_jwt_signing: schemaFields.yupBoolean().required(),
         client_team_creation_enabled: schemaFields.projectClientTeamCreationEnabledSchema.required(),
         client_user_deletion_enabled: schemaFields.projectClientUserDeletionEnabledSchema.required(),
         oauth_providers: yupArray(oauthProviderSchema.required()).required(),
-        enabled_oauth_providers: yupArray(enabledOAuthProviderSchema.required()).required(),
+        enabled_oauth_providers: yupArray(enabledOAuthProviderSchema.required()).required().meta({ openapiField: { hidden: true } }),
         domains: yupArray(domainSchema.required()).required(),
         email_config: emailConfigSchema.required(),
         create_team_on_sign_up: schemaFields.projectCreateTeamOnSignUpSchema.required(),
@@ -63,9 +64,10 @@ export const projectsCrudClientReadSchema = yupObject({
         sign_up_enabled: schemaFields.projectSignUpEnabledSchema.required(),
         credential_enabled: schemaFields.projectCredentialEnabledSchema.required(),
         magic_link_enabled: schemaFields.projectMagicLinkEnabledSchema.required(),
+        passkey_enabled: schemaFields.projectPasskeyEnabledSchema.required(),
         client_team_creation_enabled: schemaFields.projectClientTeamCreationEnabledSchema.required(),
         client_user_deletion_enabled: schemaFields.projectClientUserDeletionEnabledSchema.required(),
-        enabled_oauth_providers: yupArray(enabledOAuthProviderSchema.required()).required(),
+        enabled_oauth_providers: yupArray(enabledOAuthProviderSchema.required()).required().meta({ openapiField: { hidden: true } }),
     }).required(),
 }).required();
 export const projectsCrudAdminUpdateSchema = yupObject({
@@ -76,6 +78,7 @@ export const projectsCrudAdminUpdateSchema = yupObject({
         sign_up_enabled: schemaFields.projectSignUpEnabledSchema.optional(),
         credential_enabled: schemaFields.projectCredentialEnabledSchema.optional(),
         magic_link_enabled: schemaFields.projectMagicLinkEnabledSchema.optional(),
+        passkey_enabled: schemaFields.projectPasskeyEnabledSchema.optional(),
         client_team_creation_enabled: schemaFields.projectClientTeamCreationEnabledSchema.optional(),
         client_user_deletion_enabled: schemaFields.projectClientUserDeletionEnabledSchema.optional(),
         legacy_global_jwt_signing: schemaFields.yupBoolean().isFalse().optional(),

package/dist/interface/crud/team-member-profiles.d.ts

@@ -30,6 +30,9 @@ export declare const teamMemberProfilesCrudServerReadSchema: import("yup").Objec
         client_read_only_metadata: {} | null;
         server_metadata: {} | null;
         primary_email_verified: NonNullable<boolean | undefined>;
+        primary_email_auth_enabled: NonNullable<boolean | undefined>;
+        passkey_auth_enabled: NonNullable<boolean | undefined>;
+        otp_auth_enabled: NonNullable<boolean | undefined>;
         selected_team_id: string | null;
         selected_team: {
             client_metadata?: {} | null | undefined;
@@ -55,6 +58,7 @@ export declare const teamMemberProfilesCrudServerReadSchema: import("yup").Objec
         id: undefined;
         primary_email: undefined;
         primary_email_verified: undefined;
+        primary_email_auth_enabled: undefined;
         display_name: undefined;
         selected_team: {
             id: undefined;
@@ -69,6 +73,8 @@ export declare const teamMemberProfilesCrudServerReadSchema: import("yup").Objec
         profile_image_url: undefined;
         signed_up_at_millis: undefined;
         has_password: undefined;
+        otp_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         client_metadata: undefined;
         client_read_only_metadata: undefined;
         server_metadata: undefined;
@@ -117,6 +123,9 @@ export declare const teamMemberProfilesCrud: import("../../crud").CrudSchemaFrom
             client_read_only_metadata: {} | null;
             server_metadata: {} | null;
             primary_email_verified: NonNullable<boolean | undefined>;
+            primary_email_auth_enabled: NonNullable<boolean | undefined>;
+            passkey_auth_enabled: NonNullable<boolean | undefined>;
+            otp_auth_enabled: NonNullable<boolean | undefined>;
             selected_team_id: string | null;
             selected_team: {
                 client_metadata?: {} | null | undefined;
@@ -142,6 +151,7 @@ export declare const teamMemberProfilesCrud: import("../../crud").CrudSchemaFrom
             id: undefined;
             primary_email: undefined;
             primary_email_verified: undefined;
+            primary_email_auth_enabled: undefined;
             display_name: undefined;
             selected_team: {
                 id: undefined;
@@ -156,6 +166,8 @@ export declare const teamMemberProfilesCrud: import("../../crud").CrudSchemaFrom
             profile_image_url: undefined;
             signed_up_at_millis: undefined;
             has_password: undefined;
+            otp_auth_enabled: undefined;
+            passkey_auth_enabled: undefined;
             client_metadata: undefined;
             client_read_only_metadata: undefined;
             server_metadata: undefined;

package/dist/interface/crud/users.d.ts

@@ -8,7 +8,9 @@ export declare const usersCrudServerUpdateSchema: import("yup").ObjectSchema<{
     primary_email: string | null | undefined;
     primary_email_verified: boolean | undefined;
     primary_email_auth_enabled: boolean | undefined;
+    passkey_auth_enabled: boolean | undefined;
     password: string | null | undefined;
+    otp_auth_enabled: boolean | undefined;
     totp_secret_base64: string | null | undefined;
     selected_team_id: string | null | undefined;
 }, import("yup").AnyObject, {
@@ -20,7 +22,9 @@ export declare const usersCrudServerUpdateSchema: import("yup").ObjectSchema<{
     primary_email: undefined;
     primary_email_verified: undefined;
     primary_email_auth_enabled: undefined;
+    passkey_auth_enabled: undefined;
     password: undefined;
+    otp_auth_enabled: undefined;
     totp_secret_base64: undefined;
     selected_team_id: undefined;
 }, "">;
@@ -28,6 +32,7 @@ export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
     id: string;
     primary_email: string | null;
     primary_email_verified: NonNullable<boolean | undefined>;
+    primary_email_auth_enabled: NonNullable<boolean | undefined>;
     display_name: string | null;
     selected_team: {
         client_metadata?: {} | null | undefined;
@@ -42,6 +47,8 @@ export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
     profile_image_url: string | null;
     signed_up_at_millis: number;
     has_password: NonNullable<boolean | undefined>;
+    otp_auth_enabled: NonNullable<boolean | undefined>;
+    passkey_auth_enabled: NonNullable<boolean | undefined>;
     client_metadata: {} | null;
     client_read_only_metadata: {} | null;
     server_metadata: {} | null;
@@ -57,6 +64,7 @@ export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
     id: undefined;
     primary_email: undefined;
     primary_email_verified: undefined;
+    primary_email_auth_enabled: undefined;
     display_name: undefined;
     selected_team: {
         id: undefined;
@@ -71,6 +79,8 @@ export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
     profile_image_url: undefined;
     signed_up_at_millis: undefined;
     has_password: undefined;
+    otp_auth_enabled: undefined;
+    passkey_auth_enabled: undefined;
     client_metadata: undefined;
     client_read_only_metadata: undefined;
     server_metadata: undefined;
@@ -89,6 +99,8 @@ export declare const usersCrudServerCreateSchema: import("yup").ObjectSchema<{
     server_metadata: {} | null | undefined;
     primary_email_verified: boolean | undefined;
     primary_email_auth_enabled: boolean | undefined;
+    passkey_auth_enabled: boolean | undefined;
+    otp_auth_enabled: boolean | undefined;
     totp_secret_base64: string | null | undefined;
 } & {
     oauth_providers: {
@@ -105,7 +117,9 @@ export declare const usersCrudServerCreateSchema: import("yup").ObjectSchema<{
     primary_email: undefined;
     primary_email_verified: undefined;
     primary_email_auth_enabled: undefined;
+    passkey_auth_enabled: undefined;
     password: undefined;
+    otp_auth_enabled: undefined;
     totp_secret_base64: undefined;
     selected_team_id: undefined;
     oauth_providers: undefined;
@@ -116,6 +130,7 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         id: string;
         primary_email: string | null;
         primary_email_verified: NonNullable<boolean | undefined>;
+        primary_email_auth_enabled: NonNullable<boolean | undefined>;
         display_name: string | null;
         selected_team: {
             client_metadata?: {} | null | undefined;
@@ -130,6 +145,8 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         profile_image_url: string | null;
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
+        otp_auth_enabled: NonNullable<boolean | undefined>;
+        passkey_auth_enabled: NonNullable<boolean | undefined>;
         client_metadata: {} | null;
         client_read_only_metadata: {} | null;
         server_metadata: {} | null;
@@ -145,6 +162,7 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         id: undefined;
         primary_email: undefined;
         primary_email_verified: undefined;
+        primary_email_auth_enabled: undefined;
         display_name: undefined;
         selected_team: {
             id: undefined;
@@ -159,6 +177,8 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         profile_image_url: undefined;
         signed_up_at_millis: undefined;
         has_password: undefined;
+        otp_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         client_metadata: undefined;
         client_read_only_metadata: undefined;
         server_metadata: undefined;
@@ -176,7 +196,9 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         primary_email: string | null | undefined;
         primary_email_verified: boolean | undefined;
         primary_email_auth_enabled: boolean | undefined;
+        passkey_auth_enabled: boolean | undefined;
         password: string | null | undefined;
+        otp_auth_enabled: boolean | undefined;
         totp_secret_base64: string | null | undefined;
         selected_team_id: string | null | undefined;
     }, import("yup").AnyObject, {
@@ -188,7 +210,9 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         primary_email: undefined;
         primary_email_verified: undefined;
         primary_email_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         password: undefined;
+        otp_auth_enabled: undefined;
         totp_secret_base64: undefined;
         selected_team_id: undefined;
     }, "">;
@@ -202,6 +226,8 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         server_metadata: {} | null | undefined;
         primary_email_verified: boolean | undefined;
         primary_email_auth_enabled: boolean | undefined;
+        passkey_auth_enabled: boolean | undefined;
+        otp_auth_enabled: boolean | undefined;
         totp_secret_base64: string | null | undefined;
     } & {
         oauth_providers: {
@@ -218,7 +244,9 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         primary_email: undefined;
         primary_email_verified: undefined;
         primary_email_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         password: undefined;
+        otp_auth_enabled: undefined;
         totp_secret_base64: undefined;
         selected_team_id: undefined;
         oauth_providers: undefined;
@@ -259,6 +287,7 @@ export declare const userCreatedWebhookEvent: {
         id: string;
         primary_email: string | null;
         primary_email_verified: NonNullable<boolean | undefined>;
+        primary_email_auth_enabled: NonNullable<boolean | undefined>;
         display_name: string | null;
         selected_team: {
             client_metadata?: {} | null | undefined;
@@ -273,6 +302,8 @@ export declare const userCreatedWebhookEvent: {
         profile_image_url: string | null;
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
+        otp_auth_enabled: NonNullable<boolean | undefined>;
+        passkey_auth_enabled: NonNullable<boolean | undefined>;
         client_metadata: {} | null;
         client_read_only_metadata: {} | null;
         server_metadata: {} | null;
@@ -288,6 +319,7 @@ export declare const userCreatedWebhookEvent: {
         id: undefined;
         primary_email: undefined;
         primary_email_verified: undefined;
+        primary_email_auth_enabled: undefined;
         display_name: undefined;
         selected_team: {
             id: undefined;
@@ -302,6 +334,8 @@ export declare const userCreatedWebhookEvent: {
         profile_image_url: undefined;
         signed_up_at_millis: undefined;
         has_password: undefined;
+        otp_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         client_metadata: undefined;
         client_read_only_metadata: undefined;
         server_metadata: undefined;
@@ -322,6 +356,7 @@ export declare const userUpdatedWebhookEvent: {
         id: string;
         primary_email: string | null;
         primary_email_verified: NonNullable<boolean | undefined>;
+        primary_email_auth_enabled: NonNullable<boolean | undefined>;
         display_name: string | null;
         selected_team: {
             client_metadata?: {} | null | undefined;
@@ -336,6 +371,8 @@ export declare const userUpdatedWebhookEvent: {
         profile_image_url: string | null;
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
+        otp_auth_enabled: NonNullable<boolean | undefined>;
+        passkey_auth_enabled: NonNullable<boolean | undefined>;
         client_metadata: {} | null;
         client_read_only_metadata: {} | null;
         server_metadata: {} | null;
@@ -351,6 +388,7 @@ export declare const userUpdatedWebhookEvent: {
         id: undefined;
         primary_email: undefined;
         primary_email_verified: undefined;
+        primary_email_auth_enabled: undefined;
         display_name: undefined;
         selected_team: {
             id: undefined;
@@ -365,6 +403,8 @@ export declare const userUpdatedWebhookEvent: {
         profile_image_url: undefined;
         signed_up_at_millis: undefined;
         has_password: undefined;
+        otp_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         client_metadata: undefined;
         client_read_only_metadata: undefined;
         server_metadata: undefined;

package/dist/interface/crud/users.js

@@ -9,29 +9,26 @@ export const usersCrudServerUpdateSchema = fieldSchema.yupObject({
     server_metadata: fieldSchema.userServerMetadataSchema.optional(),
     primary_email: fieldSchema.primaryEmailSchema.nullable().optional(),
     primary_email_verified: fieldSchema.primaryEmailVerifiedSchema.optional(),
-    primary_email_auth_enabled: fieldSchema.yupBoolean().optional().meta({ openapiField: { description: "Whether the primary email can be used to sign into this user's account", exampleValue: true } }),
-    password: fieldSchema.yupString().nullable().meta({ openapiField: { description: 'A new password for the user, overwriting the old one (if it exists). Specifying this option revokes all current sessions.', exampleValue: 'my-new-password' } }),
-    totp_secret_base64: fieldSchema.base64Schema.nullable().meta({ openapiField: { description: 'A TOTP secret for the user, overwriting the old one (if it exists). Set to null to disable 2FA.', exampleValue: 'dG90cC1zZWNyZXQ=' } }),
+    primary_email_auth_enabled: fieldSchema.primaryEmailAuthEnabledSchema.optional(),
+    passkey_auth_enabled: fieldSchema.userOtpAuthEnabledSchema.optional(),
+    password: fieldSchema.userPasswordMutationSchema.optional(),
+    otp_auth_enabled: fieldSchema.userOtpAuthEnabledMutationSchema.optional(),
+    totp_secret_base64: fieldSchema.userTotpSecretMutationSchema.optional(),
     selected_team_id: fieldSchema.selectedTeamIdSchema.nullable().optional(),
 }).required();
-const contactChannelSchema = fieldSchema.yupObject({
-    id: fieldSchema.yupString().required(),
-    type: fieldSchema.yupString().required(),
-    value: fieldSchema.yupString().required(),
-    is_primary: fieldSchema.yupBoolean().required(),
-    is_verified: fieldSchema.yupBoolean().required(),
-    used_for_auth: fieldSchema.yupBoolean().required(),
-}).required();
 export const usersCrudServerReadSchema = fieldSchema.yupObject({
     id: fieldSchema.userIdSchema.required(),
     primary_email: fieldSchema.primaryEmailSchema.nullable().defined(),
     primary_email_verified: fieldSchema.primaryEmailVerifiedSchema.required(),
+    primary_email_auth_enabled: fieldSchema.primaryEmailAuthEnabledSchema.required(),
     display_name: fieldSchema.userDisplayNameSchema.nullable().defined(),
     selected_team: teamsCrudServerReadSchema.nullable().defined(),
     selected_team_id: fieldSchema.selectedTeamIdSchema.nullable().defined(),
     profile_image_url: fieldSchema.profileImageUrlSchema.nullable().defined(),
     signed_up_at_millis: fieldSchema.signedUpAtMillisSchema.required(),
-    has_password: fieldSchema.yupBoolean().required().meta({ openapiField: { description: 'Whether the user has a password associated with their account', exampleValue: true } }),
+    has_password: fieldSchema.userHasPasswordSchema.required(),
+    otp_auth_enabled: fieldSchema.userOtpAuthEnabledSchema.required(),
+    passkey_auth_enabled: fieldSchema.userOtpAuthEnabledSchema.required(),
     client_metadata: fieldSchema.userClientMetadataSchema,
     client_read_only_metadata: fieldSchema.userClientReadOnlyMetadataSchema,
     server_metadata: fieldSchema.userServerMetadataSchema,
@@ -40,7 +37,7 @@ export const usersCrudServerReadSchema = fieldSchema.yupObject({
         id: fieldSchema.yupString().required(),
         account_id: fieldSchema.yupString().required(),
         email: fieldSchema.yupString().nullable(),
-    }).required()).required().meta({ openapiField: { hidden: true, description: 'A list of OAuth providers connected to this account', exampleValue: [{ id: 'google', account_id: '12345', email: 'john.doe@gmail.com' }] } }),
+    }).required()).required().meta({ openapiField: { hidden: true } }),
     /**
      * @deprecated
      */
@@ -55,7 +52,7 @@ export const usersCrudServerCreateSchema = usersCrudServerUpdateSchema.omit(['se
         id: fieldSchema.yupString().required(),
         account_id: fieldSchema.yupString().required(),
         email: fieldSchema.yupString().nullable().defined().default(null),
-    }).required()).optional(),
+    }).required()).optional().meta({ openapiField: { hidden: true } }),
 }).required());
 export const usersCrudServerDeleteSchema = fieldSchema.yupMixed();
 export const usersCrud = createCrud({

package/dist/interface/serverInterface.d.ts

@@ -2,6 +2,7 @@ import { KnownErrors } from "../known-errors";
 import { AccessToken, InternalSession, RefreshToken } from "../sessions";
 import { Result } from "../utils/results";
 import { ClientInterfaceOptions, StackClientInterface } from "./clientInterface";
+import { ContactChannelsCrud } from "./crud/contact-channels";
 import { CurrentUserCrud } from "./crud/current-user";
 import { ConnectedAccountAccessTokenCrud } from "./crud/oauth";
 import { TeamMemberProfilesCrud } from "./crud/team-member-profiles";
@@ -73,4 +74,9 @@ export declare class StackServerInterface extends StackClientInterface {
     grantServerTeamUserPermission(teamId: string, userId: string, permissionId: string): Promise<void>;
     revokeServerTeamUserPermission(teamId: string, userId: string, permissionId: string): Promise<void>;
     deleteServerServerUser(userId: string): Promise<void>;
+    createServerContactChannel(data: ContactChannelsCrud['Server']['Create']): Promise<ContactChannelsCrud['Server']['Read']>;
+    updateServerContactChannel(userId: string, contactChannelId: string, data: ContactChannelsCrud['Server']['Update']): Promise<ContactChannelsCrud['Server']['Read']>;
+    deleteServerContactChannel(userId: string, contactChannelId: string): Promise<void>;
+    listServerContactChannels(userId: string): Promise<ContactChannelsCrud['Server']['Read'][]>;
+    sendServerContactChannelVerificationEmail(userId: string, contactChannelId: string, callbackUrl: string): Promise<Result<undefined, KnownErrors["EmailAlreadyVerified"]>>;
 }

package/dist/interface/serverInterface.js

@@ -214,4 +214,49 @@ export class StackServerInterface extends StackClientInterface {
             body: JSON.stringify({}),
         }, null);
     }
+    async createServerContactChannel(data) {
+        const response = await this.sendServerRequest("/contact-channels", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(data),
+        }, null);
+        return await response.json();
+    }
+    async updateServerContactChannel(userId, contactChannelId, data) {
+        const response = await this.sendServerRequest(`/contact-channels/${userId}/${contactChannelId}`, {
+            method: "PATCH",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(data),
+        }, null);
+        return await response.json();
+    }
+    async deleteServerContactChannel(userId, contactChannelId) {
+        await this.sendServerRequest(`/contact-channels/${userId}/${contactChannelId}`, {
+            method: "DELETE",
+        }, null);
+    }
+    async listServerContactChannels(userId) {
+        const response = await this.sendServerRequest(`/contact-channels?user_id=${userId}`, {
+            method: "GET",
+        }, null);
+        const json = await response.json();
+        return json.items;
+    }
+    async sendServerContactChannelVerificationEmail(userId, contactChannelId, callbackUrl) {
+        const responseOrError = await this.sendServerRequestAndCatchKnownError(`/contact-channels/${userId}/${contactChannelId}/send-verification-code`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ callback_url: callbackUrl }),
+        }, null, [KnownErrors.EmailAlreadyVerified]);
+        if (responseOrError.status === "error") {
+            return Result.error(responseOrError.error);
+        }
+        return Result.ok(undefined);
+    }
 }

package/dist/interface/webhooks.d.ts

@@ -14,6 +14,7 @@ export declare const webhookEvents: readonly [{
         id: string;
         primary_email: string | null;
         primary_email_verified: NonNullable<boolean | undefined>;
+        primary_email_auth_enabled: NonNullable<boolean | undefined>;
         display_name: string | null;
         selected_team: {
             client_metadata?: {} | null | undefined;
@@ -28,6 +29,8 @@ export declare const webhookEvents: readonly [{
         profile_image_url: string | null;
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
+        otp_auth_enabled: NonNullable<boolean | undefined>;
+        passkey_auth_enabled: NonNullable<boolean | undefined>;
         client_metadata: {} | null;
         client_read_only_metadata: {} | null;
         server_metadata: {} | null;
@@ -43,6 +46,7 @@ export declare const webhookEvents: readonly [{
         id: undefined;
         primary_email: undefined;
         primary_email_verified: undefined;
+        primary_email_auth_enabled: undefined;
         display_name: undefined;
         selected_team: {
             id: undefined;
@@ -57,6 +61,8 @@ export declare const webhookEvents: readonly [{
         profile_image_url: undefined;
         signed_up_at_millis: undefined;
         has_password: undefined;
+        otp_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         client_metadata: undefined;
         client_read_only_metadata: undefined;
         server_metadata: undefined;
@@ -76,6 +82,7 @@ export declare const webhookEvents: readonly [{
         id: string;
         primary_email: string | null;
         primary_email_verified: NonNullable<boolean | undefined>;
+        primary_email_auth_enabled: NonNullable<boolean | undefined>;
         display_name: string | null;
         selected_team: {
             client_metadata?: {} | null | undefined;
@@ -90,6 +97,8 @@ export declare const webhookEvents: readonly [{
         profile_image_url: string | null;
         signed_up_at_millis: number;
         has_password: NonNullable<boolean | undefined>;
+        otp_auth_enabled: NonNullable<boolean | undefined>;
+        passkey_auth_enabled: NonNullable<boolean | undefined>;
         client_metadata: {} | null;
         client_read_only_metadata: {} | null;
         server_metadata: {} | null;
@@ -105,6 +114,7 @@ export declare const webhookEvents: readonly [{
         id: undefined;
         primary_email: undefined;
         primary_email_verified: undefined;
+        primary_email_auth_enabled: undefined;
         display_name: undefined;
         selected_team: {
             id: undefined;
@@ -119,6 +129,8 @@ export declare const webhookEvents: readonly [{
         profile_image_url: undefined;
         signed_up_at_millis: undefined;
         has_password: undefined;
+        otp_auth_enabled: undefined;
+        passkey_auth_enabled: undefined;
         client_metadata: undefined;
         client_read_only_metadata: undefined;
         server_metadata: undefined;

package/dist/known-errors.d.ts

@@ -251,6 +251,9 @@ export declare const KnownErrors: {
     PasswordAuthenticationNotEnabled: KnownErrorConstructor<KnownError & KnownErrorBrand<"PASSWORD_AUTHENTICATION_NOT_ENABLED">, []> & {
         errorCode: "PASSWORD_AUTHENTICATION_NOT_ENABLED";
     };
+    PasskeyAuthenticationNotEnabled: KnownErrorConstructor<KnownError & KnownErrorBrand<"PASSKEY_AUTHENTICATION_NOT_ENABLED">, []> & {
+        errorCode: "PASSKEY_AUTHENTICATION_NOT_ENABLED";
+    };
     EmailPasswordMismatch: KnownErrorConstructor<KnownError & KnownErrorBrand<"EMAIL_PASSWORD_MISMATCH">, []> & {
         errorCode: "EMAIL_PASSWORD_MISMATCH";
     };
@@ -308,6 +311,15 @@ export declare const KnownErrors: {
     EmailIsNotPrimaryEmail: KnownErrorConstructor<KnownError & KnownErrorBrand<"EMAIL_IS_NOT_PRIMARY_EMAIL">, [email: string, primaryEmail: string | null]> & {
         errorCode: "EMAIL_IS_NOT_PRIMARY_EMAIL";
     };
+    PasskeyRegistrationFailed: KnownErrorConstructor<KnownError & KnownErrorBrand<"PASSKEY_REGISTRATION_FAILED">, [message: string]> & {
+        errorCode: "PASSKEY_REGISTRATION_FAILED";
+    };
+    PasskeyWebAuthnError: KnownErrorConstructor<KnownError & KnownErrorBrand<"PASSKEY_WEBAUTHN_ERROR">, [message: string, code: string]> & {
+        errorCode: "PASSKEY_WEBAUTHN_ERROR";
+    };
+    PasskeyAuthenticationFailed: KnownErrorConstructor<KnownError & KnownErrorBrand<"PASSKEY_AUTHENTICATION_FAILED">, [message: string]> & {
+        errorCode: "PASSKEY_AUTHENTICATION_FAILED";
+    };
     PermissionNotFound: KnownErrorConstructor<KnownError & KnownErrorBrand<"PERMISSION_NOT_FOUND">, [permissionId: string]> & {
         errorCode: "PERMISSION_NOT_FOUND";
     };

package/dist/known-errors.js

@@ -328,6 +328,10 @@ const PasswordAuthenticationNotEnabled = createKnownErrorConstructor(KnownError,
     400,
     "Password authentication is not enabled for this project.",
 ], () => []);
+const PasskeyAuthenticationNotEnabled = createKnownErrorConstructor(KnownError, "PASSKEY_AUTHENTICATION_NOT_ENABLED", () => [
+    400,
+    "Passkey authentication is not enabled for this project.",
+], () => []);
 const EmailPasswordMismatch = createKnownErrorConstructor(KnownError, "EMAIL_PASSWORD_MISMATCH", () => [
     400,
     "Wrong e-mail or password.",
@@ -396,6 +400,22 @@ const EmailIsNotPrimaryEmail = createKnownErrorConstructor(KnownError, "EMAIL_IS
         primary_email: primaryEmail,
     },
 ], (json) => [json.email, json.primary_email]);
+const PasskeyRegistrationFailed = createKnownErrorConstructor(KnownError, "PASSKEY_REGISTRATION_FAILED", (message) => [
+    400,
+    message,
+], (json) => [json.message]);
+const PasskeyWebAuthnError = createKnownErrorConstructor(KnownError, "PASSKEY_WEBAUTHN_ERROR", (message, code) => [
+    400,
+    message,
+    {
+        message,
+        code,
+    },
+], (json) => [json.message, json.code]);
+const PasskeyAuthenticationFailed = createKnownErrorConstructor(KnownError, "PASSKEY_AUTHENTICATION_FAILED", (message) => [
+    400,
+    message,
+], (json) => [json.message]);
 const PermissionNotFound = createKnownErrorConstructor(KnownError, "PERMISSION_NOT_FOUND", (permissionId) => [
     404,
     `Permission "${permissionId}" not found. Make sure you created it on the dashboard.`,
@@ -586,6 +606,7 @@ export const KnownErrors = {
     ProjectNotFound,
     SignUpNotEnabled,
     PasswordAuthenticationNotEnabled,
+    PasskeyAuthenticationNotEnabled,
     EmailPasswordMismatch,
     RedirectUrlNotWhitelisted,
     PasswordRequirementsNotMet,
@@ -601,6 +622,9 @@ export const KnownErrors = {
     EmailAlreadyVerified,
     EmailNotAssociatedWithUser,
     EmailIsNotPrimaryEmail,
+    PasskeyRegistrationFailed,
+    PasskeyWebAuthnError,
+    PasskeyAuthenticationFailed,
     PermissionNotFound,
     ContainedPermissionNotFound,
     TeamNotFound,

package/dist/schema-fields.d.ts

@@ -39,6 +39,7 @@ export declare const projectConfigIdSchema: yup.StringSchema<string | undefined,
 export declare const projectAllowLocalhostSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectCreateTeamOnSignUpSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectMagicLinkEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
+export declare const projectPasskeyEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectClientTeamCreationEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectClientUserDeletionEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectSignUpEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
@@ -64,6 +65,7 @@ export declare class ReplaceFieldWithOwnUserId extends Error {
 export declare const userIdOrMeSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const userIdSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const primaryEmailSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
+export declare const primaryEmailAuthEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const primaryEmailVerifiedSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const userDisplayNameSchema: yup.StringSchema<string | null | undefined, yup.AnyObject, undefined, "">;
 export declare const selectedTeamIdSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
@@ -82,6 +84,12 @@ export declare const userOAuthProviderSchema: yup.ObjectSchema<{
     provider_user_id: undefined;
 }, "">;
 export declare const userLastActiveAtMillisSchema: yup.NumberSchema<number | null | undefined, yup.AnyObject, undefined, "">;
+export declare const userPasskeyAuthEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
+export declare const userOtpAuthEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
+export declare const userOtpAuthEnabledMutationSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
+export declare const userHasPasswordSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
+export declare const userPasswordMutationSchema: yup.StringSchema<string | null | undefined, yup.AnyObject, undefined, "">;
+export declare const userTotpSecretMutationSchema: yup.StringSchema<string | null | undefined, yup.AnyObject, undefined, "">;
 export declare const signInEmailSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const emailOtpSignInCallbackUrlSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const emailVerificationCallbackUrlSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;

package/dist/schema-fields.js

@@ -203,6 +203,7 @@ export const projectConfigIdSchema = yupString().meta({ openapiField: { descript
 export const projectAllowLocalhostSchema = yupBoolean().meta({ openapiField: { description: 'Whether localhost is allowed as a domain for this project. Should only be allowed in development mode', exampleValue: true } });
 export const projectCreateTeamOnSignUpSchema = yupBoolean().meta({ openapiField: { description: 'Whether a team should be created for each user that signs up', exampleValue: true } });
 export const projectMagicLinkEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether magic link authentication is enabled for this project', exampleValue: true } });
+export const projectPasskeyEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether passkey authentication is enabled for this project', exampleValue: true } });
 export const projectClientTeamCreationEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether client users can create teams', exampleValue: true } });
 export const projectClientUserDeletionEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether client users can delete their own account from the client', exampleValue: true } });
 export const projectSignUpEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether users can sign up new accounts, or whether they are only allowed to sign in to existing accounts. Regardless of this option, the server API can always create new users with the `POST /users` endpoint.', exampleValue: true } });
@@ -248,6 +249,7 @@ export const userIdOrMeSchema = yupString().uuid().transform(v => {
 }).meta({ openapiField: { description: 'The ID of the user, or the special value `me` for the currently authenticated user', exampleValue: '3241a285-8329-4d69-8f3d-316e08cf140c' } });
 export const userIdSchema = yupString().uuid().meta({ openapiField: { description: _idDescription('user'), exampleValue: '3241a285-8329-4d69-8f3d-316e08cf140c' } });
 export const primaryEmailSchema = emailSchema.meta({ openapiField: { description: 'Primary email', exampleValue: 'johndoe@example.com' } });
+export const primaryEmailAuthEnabledSchema = yupBoolean().meta({ openapiField: { description: 'Whether the primary email is used for authentication. If this is set to `false`, the user will not be able to sign in with the primary email with password or OTP', exampleValue: true } });
 export const primaryEmailVerifiedSchema = yupBoolean().meta({ openapiField: { description: 'Whether the primary email has been verified to belong to this user', exampleValue: true } });
 export const userDisplayNameSchema = yupString().nullable().meta({ openapiField: { description: _displayNameDescription('user'), exampleValue: 'John Doe' } });
 export const selectedTeamIdSchema = yupString().uuid().meta({ openapiField: { description: 'ID of the team currently selected by the user', exampleValue: 'team-id' } });
@@ -262,6 +264,12 @@ export const userOAuthProviderSchema = yupObject({
     provider_user_id: yupString().required(),
 });
 export const userLastActiveAtMillisSchema = yupNumber().nullable().meta({ openapiField: { description: _lastActiveAtMillisDescription, exampleValue: 1630000000000 } });
+export const userPasskeyAuthEnabledSchema = yupBoolean().meta({ openapiField: { hidden: true, description: 'Whether the user has passkeys enabled', exampleValue: false } });
+export const userOtpAuthEnabledSchema = yupBoolean().meta({ openapiField: { hidden: true, description: 'Whether the user has OTP/magic link enabled. ', exampleValue: true } });
+export const userOtpAuthEnabledMutationSchema = yupBoolean().meta({ openapiField: { hidden: true, description: 'Whether the user has OTP/magic link enabled. Note that only accounts with verified emails can sign-in with OTP.', exampleValue: true } });
+export const userHasPasswordSchema = yupBoolean().meta({ openapiField: { hidden: true, description: 'Whether the user has a password set. If the user does not have a password set, they will not be able to sign in with email/password.', exampleValue: true } });
+export const userPasswordMutationSchema = yupString().nullable().meta({ openapiField: { description: 'Sets the user\'s password. Doing so revokes all current sessions.', exampleValue: 'my-new-password' } });
+export const userTotpSecretMutationSchema = base64Schema.nullable().meta({ openapiField: { description: 'Enables 2FA and sets a TOTP secret for the user. Set to null to disable 2FA.', exampleValue: 'dG90cC1zZWNyZXQ=' } });
 // Auth
 export const signInEmailSchema = emailSchema.meta({ openapiField: { description: 'The email to sign in with.', exampleValue: 'johndoe@example.com' } });
 export const emailOtpSignInCallbackUrlSchema = urlSchema.meta({ openapiField: { description: 'The base callback URL to construct the magic link from. A query parameter `code` with the verification code will be appended to it. The page should then make a request to the `/auth/otp/sign-in` endpoint.', exampleValue: 'https://example.com/handler/magic-link-callback' } });

package/dist/utils/passkey.d.ts

@@ -0,0 +1 @@
+export type { AuthenticationResponseJSON, RegistrationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, AuthenticatorAttestationResponseJSON } from "@simplewebauthn/types";

package/dist/utils/passkey.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackframe/stack-shared",
-  "version": "2.6.11",
+  "version": "2.6.15",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -32,15 +32,17 @@
     }
   },
   "dependencies": {
+    "@simplewebauthn/browser": "^11.0.0",
     "bcrypt": "^5.1.1",
     "elliptic": "^6.5.7",
     "jose": "^5.2.2",
     "oauth4webapi": "^2.10.3",
     "semver": "^7.6.3",
     "uuid": "^9.0.1",
-    "@stackframe/stack-sc": "2.6.11"
+    "@stackframe/stack-sc": "2.6.15"
   },
   "devDependencies": {
+    "@simplewebauthn/types": "^11.0.0",
     "@types/bcrypt": "^5.0.2",
     "@types/elliptic": "^6.4.18",
     "@types/react": "^18.2.66",