@stackframe/stack-shared 2.8.2 → 2.8.5

package/dist/interface/crud/users.d.ts

@@ -43,8 +43,8 @@ export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
         client_read_only_metadata?: {} | null | undefined;
         server_metadata?: {} | null | undefined;
         id: string;
-        created_at_millis: number;
         display_name: string;
+        created_at_millis: number;
         profile_image_url: string | null;
     } | null;
     selected_team_id: string | null;
@@ -96,13 +96,13 @@ export declare const usersCrudServerReadSchema: import("yup").ObjectSchema<{
     requires_totp_mfa: undefined;
 }, "">;
 export declare const usersCrudServerCreateSchema: import("yup").ObjectSchema<{
-    primary_email: string | null | undefined;
     password: string | null | undefined;
     display_name: string | null | undefined;
     profile_image_url: string | null | undefined;
     client_metadata: {} | null | undefined;
     client_read_only_metadata: {} | null | undefined;
     server_metadata: {} | null | undefined;
+    primary_email: string | null | undefined;
     primary_email_verified: boolean | undefined;
     primary_email_auth_enabled: boolean | undefined;
     passkey_auth_enabled: boolean | undefined;
@@ -112,9 +112,9 @@ export declare const usersCrudServerCreateSchema: import("yup").ObjectSchema<{
     is_anonymous: boolean | undefined;
 } & {
     oauth_providers: {
-        email: string | null;
         id: string;
         account_id: string;
+        email: string | null;
     }[] | undefined;
     is_anonymous: boolean | undefined;
 }, import("yup").AnyObject, {
@@ -148,8 +148,8 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
             client_read_only_metadata?: {} | null | undefined;
             server_metadata?: {} | null | undefined;
             id: string;
-            created_at_millis: number;
             display_name: string;
+            created_at_millis: number;
             profile_image_url: string | null;
         } | null;
         selected_team_id: string | null;
@@ -234,13 +234,13 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         is_anonymous: undefined;
     }, "">;
     serverCreateSchema: import("yup").ObjectSchema<{
-        primary_email: string | null | undefined;
         password: string | null | undefined;
         display_name: string | null | undefined;
         profile_image_url: string | null | undefined;
         client_metadata: {} | null | undefined;
         client_read_only_metadata: {} | null | undefined;
         server_metadata: {} | null | undefined;
+        primary_email: string | null | undefined;
         primary_email_verified: boolean | undefined;
         primary_email_auth_enabled: boolean | undefined;
         passkey_auth_enabled: boolean | undefined;
@@ -250,9 +250,9 @@ export declare const usersCrud: import("../../crud").CrudSchemaFromOptions<{
         is_anonymous: boolean | undefined;
     } & {
         oauth_providers: {
-            email: string | null;
             id: string;
             account_id: string;
+            email: string | null;
         }[] | undefined;
         is_anonymous: boolean | undefined;
     }, import("yup").AnyObject, {
@@ -316,8 +316,8 @@ export declare const userCreatedWebhookEvent: {
             client_read_only_metadata?: {} | null | undefined;
             server_metadata?: {} | null | undefined;
             id: string;
-            created_at_millis: number;
             display_name: string;
+            created_at_millis: number;
             profile_image_url: string | null;
         } | null;
         selected_team_id: string | null;
@@ -387,8 +387,8 @@ export declare const userUpdatedWebhookEvent: {
             client_read_only_metadata?: {} | null | undefined;
             server_metadata?: {} | null | undefined;
             id: string;
-            created_at_millis: number;
             display_name: string;
+            created_at_millis: number;
             profile_image_url: string | null;
         } | null;
         selected_team_id: string | null;

package/dist/interface/serverInterface.d.ts

@@ -5,11 +5,11 @@ import { ClientInterfaceOptions, StackClientInterface } from "./clientInterface"
 import { ContactChannelsCrud } from "./crud/contact-channels";
 import { CurrentUserCrud } from "./crud/current-user";
 import { ConnectedAccountAccessTokenCrud } from "./crud/oauth";
+import { ProjectPermissionsCrud } from "./crud/project-permissions";
 import { SessionsCrud } from "./crud/sessions";
 import { TeamInvitationCrud } from "./crud/team-invitation";
 import { TeamMemberProfilesCrud } from "./crud/team-member-profiles";
 import { TeamMembershipsCrud } from "./crud/team-memberships";
-import { ProjectPermissionsCrud } from "./crud/project-permissions";
 import { TeamPermissionsCrud } from "./crud/team-permissions";
 import { TeamsCrud } from "./crud/teams";
 import { UsersCrud } from "./crud/users";
@@ -66,6 +66,7 @@ export declare class StackServerInterface extends StackClientInterface {
     listServerTeams(options?: {
         userId?: string;
     }): Promise<TeamsCrud['Server']['Read'][]>;
+    getServerTeam(teamId: string): Promise<TeamsCrud['Server']['Read']>;
     listServerTeamUsers(teamId: string): Promise<UsersCrud['Server']['Read'][]>;
     createServerTeam(data: TeamsCrud['Server']['Create']): Promise<TeamsCrud['Server']['Read']>;
     updateServerTeam(teamId: string, data: TeamsCrud['Server']['Update']): Promise<TeamsCrud['Server']['Read']>;

package/dist/interface/serverInterface.js

@@ -123,6 +123,10 @@ export class StackServerInterface extends StackClientInterface {
         const result = await response.json();
         return result.items;
     }
+    async getServerTeam(teamId) {
+        const response = await this.sendServerRequest(`/teams/${teamId}`, {}, null);
+        return await response.json();
+    }
     async listServerTeamUsers(teamId) {
         const response = await this.sendServerRequest(`/users?team_id=${teamId}`, {}, null);
         const result = await response.json();

package/dist/interface/webhooks.d.ts

@@ -21,8 +21,8 @@ export declare const webhookEvents: readonly [{
             client_read_only_metadata?: {} | null | undefined;
             server_metadata?: {} | null | undefined;
             id: string;
-            created_at_millis: number;
             display_name: string;
+            created_at_millis: number;
             profile_image_url: string | null;
         } | null;
         selected_team_id: string | null;
@@ -91,8 +91,8 @@ export declare const webhookEvents: readonly [{
             client_read_only_metadata?: {} | null | undefined;
             server_metadata?: {} | null | undefined;
             id: string;
-            created_at_millis: number;
             display_name: string;
+            created_at_millis: number;
             profile_image_url: string | null;
         } | null;
         selected_team_id: string | null;

package/dist/known-errors.d.ts

@@ -69,6 +69,15 @@ export declare const KnownErrors: {
     PermissionIdAlreadyExists: KnownErrorConstructor<KnownError & KnownErrorBrand<"PERMISSION_ID_ALREADY_EXISTS">, [permissionId: string]> & {
         errorCode: "PERMISSION_ID_ALREADY_EXISTS";
     };
+    CliAuthError: KnownErrorConstructor<KnownError & KnownErrorBrand<"CLI_AUTH_ERROR">, [message: string]> & {
+        errorCode: "CLI_AUTH_ERROR";
+    };
+    CliAuthExpiredError: KnownErrorConstructor<KnownError & KnownErrorBrand<"CLI_AUTH_EXPIRED_ERROR">, [message?: string | undefined]> & {
+        errorCode: "CLI_AUTH_EXPIRED_ERROR";
+    };
+    CliAuthUsedError: KnownErrorConstructor<KnownError & KnownErrorBrand<"CLI_AUTH_USED_ERROR">, [message?: string | undefined]> & {
+        errorCode: "CLI_AUTH_USED_ERROR";
+    };
     InvalidProjectAuthentication: KnownErrorConstructor<KnownError & KnownErrorBrand<"PROJECT_AUTHENTICATION_ERROR"> & {
         constructorArgs: [statusCode: number, humanReadableMessage: string, details?: Json | undefined];
     } & KnownErrorBrand<"INVALID_PROJECT_AUTHENTICATION">, [statusCode: number, humanReadableMessage: string, details?: Json | undefined]> & {
@@ -235,9 +244,16 @@ export declare const KnownErrors: {
     UserNotFound: KnownErrorConstructor<KnownError & KnownErrorBrand<"USER_NOT_FOUND">, []> & {
         errorCode: "USER_NOT_FOUND";
     };
-    ApiKeyNotFound: KnownErrorConstructor<KnownError & KnownErrorBrand<"API_KEY_NOT_FOUND">, []> & {
+    ApiKeyNotFound: KnownErrorConstructor<KnownError & KnownErrorBrand<"API_KEY_NOT_VALID"> & {
+        constructorArgs: [statusCode: number, humanReadableMessage: string, details?: Json | undefined];
+    } & KnownErrorBrand<"API_KEY_NOT_FOUND">, []> & {
         errorCode: "API_KEY_NOT_FOUND";
     };
+    PublicApiKeyCannotBeRevoked: KnownErrorConstructor<KnownError & KnownErrorBrand<"API_KEY_NOT_VALID"> & {
+        constructorArgs: [statusCode: number, humanReadableMessage: string, details?: Json | undefined];
+    } & KnownErrorBrand<"PUBLIC_API_KEY_CANNOT_BE_REVOKED">, []> & {
+        errorCode: "PUBLIC_API_KEY_CANNOT_BE_REVOKED";
+    };
     ProjectNotFound: KnownErrorConstructor<KnownError & KnownErrorBrand<"PROJECT_NOT_FOUND">, [projectId: string]> & {
         errorCode: "PROJECT_NOT_FOUND";
     };
@@ -403,5 +419,23 @@ export declare const KnownErrors: {
     InvalidPollingCodeError: KnownErrorConstructor<KnownError & KnownErrorBrand<"INVALID_POLLING_CODE">, [details?: Json | undefined]> & {
         errorCode: "INVALID_POLLING_CODE";
     };
+    ApiKeyNotValid: KnownErrorConstructor<KnownError & KnownErrorBrand<"API_KEY_NOT_VALID">, [statusCode: number, humanReadableMessage: string, details?: Json | undefined]> & {
+        errorCode: "API_KEY_NOT_VALID";
+    };
+    ApiKeyExpired: KnownErrorConstructor<KnownError & KnownErrorBrand<"API_KEY_NOT_VALID"> & {
+        constructorArgs: [statusCode: number, humanReadableMessage: string, details?: Json | undefined];
+    } & KnownErrorBrand<"API_KEY_EXPIRED">, []> & {
+        errorCode: "API_KEY_EXPIRED";
+    };
+    ApiKeyRevoked: KnownErrorConstructor<KnownError & KnownErrorBrand<"API_KEY_NOT_VALID"> & {
+        constructorArgs: [statusCode: number, humanReadableMessage: string, details?: Json | undefined];
+    } & KnownErrorBrand<"API_KEY_REVOKED">, []> & {
+        errorCode: "API_KEY_REVOKED";
+    };
+    WrongApiKeyType: KnownErrorConstructor<KnownError & KnownErrorBrand<"API_KEY_NOT_VALID"> & {
+        constructorArgs: [statusCode: number, humanReadableMessage: string, details?: Json | undefined];
+    } & KnownErrorBrand<"WRONG_API_KEY_TYPE">, [expectedType: string, actualType: string]> & {
+        errorCode: "WRONG_API_KEY_TYPE";
+    };
 };
 export {};

package/dist/known-errors.js

@@ -293,10 +293,6 @@ const UserNotFound = createKnownErrorConstructor(KnownError, "USER_NOT_FOUND", (
     404,
     "User not found.",
 ], () => []);
-const ApiKeyNotFound = createKnownErrorConstructor(KnownError, "API_KEY_NOT_FOUND", () => [
-    404,
-    "API key not found.",
-], () => []);
 const ProjectNotFound = createKnownErrorConstructor(KnownError, "PROJECT_NOT_FOUND", (projectId) => {
     if (typeof projectId !== "string")
         throw new StackAssertionError("projectId of KnownErrors.ProjectNotFound must be a string");
@@ -570,6 +566,40 @@ const InvalidPollingCodeError = createKnownErrorConstructor(KnownError, "INVALID
     "The polling code is invalid or does not exist.",
     details,
 ], (json) => [json]);
+const CliAuthError = createKnownErrorConstructor(KnownError, "CLI_AUTH_ERROR", (message) => [
+    400,
+    message,
+], (json) => [json.message]);
+const CliAuthExpiredError = createKnownErrorConstructor(KnownError, "CLI_AUTH_EXPIRED_ERROR", (message = "CLI authentication request expired. Please try again.") => [
+    400,
+    message,
+], (json) => [json.message]);
+const CliAuthUsedError = createKnownErrorConstructor(KnownError, "CLI_AUTH_USED_ERROR", (message = "This authentication token has already been used.") => [
+    400,
+    message,
+], (json) => [json.message]);
+const ApiKeyNotValid = createKnownErrorConstructor(KnownError, "API_KEY_NOT_VALID", "inherit", "inherit");
+const ApiKeyExpired = createKnownErrorConstructor(ApiKeyNotValid, "API_KEY_EXPIRED", () => [
+    401,
+    "API key has expired.",
+], () => []);
+const ApiKeyRevoked = createKnownErrorConstructor(ApiKeyNotValid, "API_KEY_REVOKED", () => [
+    401,
+    "API key has been revoked.",
+], () => []);
+const WrongApiKeyType = createKnownErrorConstructor(ApiKeyNotValid, "WRONG_API_KEY_TYPE", (expectedType, actualType) => [
+    400,
+    `This endpoint is for ${expectedType} API keys, but a ${actualType} API key was provided.`,
+    { expected_type: expectedType, actual_type: actualType },
+], (json) => [json.expected_type, json.actual_type]);
+const ApiKeyNotFound = createKnownErrorConstructor(ApiKeyNotValid, "API_KEY_NOT_FOUND", () => [
+    404,
+    "API key not found.",
+], () => []);
+const PublicApiKeyCannotBeRevoked = createKnownErrorConstructor(ApiKeyNotValid, "PUBLIC_API_KEY_CANNOT_BE_REVOKED", () => [
+    400,
+    "Public API keys cannot be revoked by the secretscanner endpoint.",
+], () => []);
 const PermissionIdAlreadyExists = createKnownErrorConstructor(KnownError, "PERMISSION_ID_ALREADY_EXISTS", (permissionId) => [
     400,
     `Permission with ID "${permissionId}" already exists. Choose a different ID.`,
@@ -585,6 +615,9 @@ export const KnownErrors = {
     AllOverloadsFailed,
     ProjectAuthenticationError,
     PermissionIdAlreadyExists,
+    CliAuthError,
+    CliAuthExpiredError,
+    CliAuthUsedError,
     InvalidProjectAuthentication,
     ProjectKeyWithoutAccessType,
     InvalidAccessType,
@@ -622,6 +655,7 @@ export const KnownErrors = {
     UserIdDoesNotExist,
     UserNotFound,
     ApiKeyNotFound,
+    PublicApiKeyCannotBeRevoked,
     ProjectNotFound,
     SignUpNotEnabled,
     PasswordAuthenticationNotEnabled,
@@ -673,6 +707,10 @@ export const KnownErrors = {
     OAuthProviderAccessDenied,
     ContactChannelAlreadyUsedForAuthBySomeoneElse,
     InvalidPollingCodeError,
+    ApiKeyNotValid,
+    ApiKeyExpired,
+    ApiKeyRevoked,
+    WrongApiKeyType,
 };
 // ensure that all known error codes are unique
 const knownErrorCodes = new Set();

package/dist/schema-fields.d.ts

@@ -5,8 +5,8 @@ declare module "yup" {
         empty(): StringSchema<TType, TContext, TDefault, TFlags>;
     }
     interface Schema<TType, TContext, TDefault, TFlags> {
-        getNested<K extends keyof TType>(path: K): yup.Schema<TType[K], TContext, TDefault, TFlags>;
-        concat<U extends yup.AnySchema>(schema: U): yup.Schema<Omit<TType, keyof yup.InferType<U>> & yup.InferType<U>, TContext, TDefault, TFlags>;
+        getNested<K extends keyof NonNullable<TType>>(path: K): yup.Schema<NonNullable<TType>[K], TContext, TDefault, TFlags>;
+        concat<U extends yup.AnySchema>(schema: U): yup.Schema<Omit<NonNullable<TType>, keyof yup.InferType<U>> & yup.InferType<U> | (TType & (null | undefined)), TContext, TDefault, TFlags>;
     }
 }
 export declare function yupValidate<S extends yup.ISchema<any>>(schema: S, obj: unknown, options?: yup.ValidateOptions & {
@@ -27,6 +27,7 @@ export declare function yupTuple<T extends [unknown, ...unknown[]]>(...args: Par
 export declare function yupObject<A extends yup.Maybe<yup.AnyObject>, B extends yup.ObjectShape>(...args: Parameters<typeof yup.object<A, B>>): yup.ObjectSchema<yup.TypeFromShape<B, yup.AnyObject> extends infer T ? T extends yup.TypeFromShape<B, yup.AnyObject> ? T extends {} ? { [k in keyof T]: T[k]; } : T : never : never, yup.AnyObject, yup.DefaultFromShape<B> extends infer T_1 ? T_1 extends yup.DefaultFromShape<B> ? T_1 extends {} ? { [k_1 in keyof T_1]: T_1[k_1]; } : T_1 : never : never, "">;
 export declare function yupNever(): yup.MixedSchema<never>;
 export declare function yupUnion<T extends yup.ISchema<any>[]>(...args: T): yup.MixedSchema<yup.InferType<T[number]>>;
+export declare function yupRecord<K extends yup.StringSchema, T extends yup.AnySchema>(keySchema: K, valueSchema: T): yup.MixedSchema<Record<string, yup.InferType<T>>>;
 export declare function ensureObjectSchema<T extends yup.AnyObject>(schema: yup.Schema<T>): yup.ObjectSchema<T> & typeof schema;
 export declare const adaptSchema: yup.MixedSchema<typeof StackAdaptSentinel | undefined, yup.AnyObject, undefined, "">;
 /**
@@ -65,7 +66,7 @@ export declare const projectClientTeamCreationEnabledSchema: yup.BooleanSchema<b
 export declare const projectClientUserDeletionEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectSignUpEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const projectCredentialEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
-export declare const oauthIdSchema: yup.StringSchema<"google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined, yup.AnyObject, undefined, "">;
+export declare const oauthIdSchema: yup.StringSchema<"apple" | "x" | "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | undefined, yup.AnyObject, undefined, "">;
 export declare const oauthEnabledSchema: yup.BooleanSchema<boolean | undefined, yup.AnyObject, undefined, "">;
 export declare const oauthTypeSchema: yup.StringSchema<"shared" | "standard" | undefined, yup.AnyObject, undefined, "">;
 export declare const oauthClientIdSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
@@ -99,7 +100,7 @@ export declare const userClientReadOnlyMetadataSchema: yup.MixedSchema<{} | null
 export declare const userServerMetadataSchema: yup.MixedSchema<{} | null, yup.AnyObject, undefined, "">;
 export declare const userOAuthProviderSchema: yup.ObjectSchema<{
     id: string;
-    type: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x";
+    type: "apple" | "x" | "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin";
     provider_user_id: string;
 }, yup.AnyObject, {
     id: undefined;
@@ -130,7 +131,7 @@ export declare const signInResponseSchema: yup.ObjectSchema<{
     is_new_user: undefined;
     user_id: undefined;
 }, "">;
-export declare const teamSystemPermissions: readonly ["$update_team", "$delete_team", "$read_members", "$remove_members", "$invite_members"];
+export declare const teamSystemPermissions: readonly ["$update_team", "$delete_team", "$read_members", "$remove_members", "$invite_members", "$manage_api_keys"];
 export declare const permissionDefinitionIdSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const customPermissionDefinitionIdSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;
 export declare const teamPermissionDescriptionSchema: yup.StringSchema<string | undefined, yup.AnyObject, undefined, "">;

package/dist/schema-fields.js

@@ -118,9 +118,9 @@ export function yupObject(...args) {
                 if (unknownKeys.length > 0) {
                     // TODO "did you mean XYZ"
                     return context.createError({
-                        message: `${context.path} contains unknown properties: ${unknownKeys.join(', ')}`,
+                        message: `${context.path || "Object"} contains unknown properties: ${unknownKeys.join(', ')}`,
                         path: context.path,
-                        params: { unknownKeys },
+                        params: { unknownKeys, availableKeys },
                     });
                 }
             }
@@ -147,7 +147,7 @@ export function yupUnion(...args) {
         const errors = [];
         for (const schema of args) {
             try {
-                await schema.validate(value, context.options);
+                await yupValidate(schema, value, context.options);
                 return true;
             }
             catch (e) {
@@ -160,6 +160,38 @@ export function yupUnion(...args) {
         });
     });
 }
+export function yupRecord(keySchema, valueSchema) {
+    return yupObject().unknown(true).test('record', '${path} must be a record of valid values', async function (value, context) {
+        if (value == null)
+            return true;
+        const { path, createError } = this;
+        if (typeof value !== 'object') {
+            return createError({ message: `${path} must be an object` });
+        }
+        // Validate each property using the provided valueSchema
+        for (const key of Object.keys(value)) {
+            // Validate the key
+            await yupValidate(keySchema, key, context.options);
+            // Validate the value
+            try {
+                await yupValidate(valueSchema, value[key], {
+                    ...context.options,
+                    context: {
+                        ...context.options.context,
+                        path: path ? `${path}.${key}` : key,
+                    },
+                });
+            }
+            catch (e) {
+                return createError({
+                    path: path ? `${path}.${key}` : key,
+                    message: e.message,
+                });
+            }
+        }
+        return true;
+    });
+}
 export function ensureObjectSchema(schema) {
     if (!(schema instanceof yup.ObjectSchema))
         throw new StackAssertionError(`assertObjectSchema: schema is not an ObjectSchema: ${schema.describe().type}`);
@@ -326,6 +358,7 @@ export const teamSystemPermissions = [
     '$read_members',
     '$remove_members',
     '$invite_members',
+    '$manage_api_keys',
 ];
 export const permissionDefinitionIdSchema = yupString()
     .matches(/^\$?[a-z0-9_:]+$/, 'Only lowercase letters, numbers, ":", "_" and optional "$" at the beginning are allowed')

package/dist/utils/api-keys.d.ts

@@ -0,0 +1,23 @@
+/**
+ * An api key has the following format:
+ * <prefix_without_underscores>_<secret_part_45_chars><id_part_32_chars><type_user_or_team_4_chars><scanner_and_marker_10_chars><checksum_8_chars>
+ *
+ * The scanner and marker is a base32 character that is used to determine if the api key is a public or private key
+ * and if it is a cloud or self-hosted key.
+ *
+ * The checksum is a crc32 checksum of the api key encoded in hex.
+ *
+ */
+type ProjectApiKey = {
+    id: string;
+    prefix: string;
+    isPublic: boolean;
+    isCloudVersion: boolean;
+    secret: string;
+    checksum: string;
+    type: "user" | "team";
+};
+export declare function isApiKey(secret: string): boolean;
+export declare function createProjectApiKey(options: Pick<ProjectApiKey, "id" | "isPublic" | "isCloudVersion" | "type">): string;
+export declare function parseProjectApiKey(secret: string): ProjectApiKey;
+export {};

package/dist/utils/api-keys.js

@@ -0,0 +1,76 @@
+import { getBase32CharacterFromIndex } from "@stackframe/stack-shared/dist/utils/bytes";
+import { generateSecureRandomString } from "@stackframe/stack-shared/dist/utils/crypto";
+import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
+import crc32 from 'crc/crc32';
+const STACK_AUTH_MARKER = "574ck4u7h";
+// API key part lengths
+const API_KEY_LENGTHS = {
+    SECRET_PART: 45,
+    ID_PART: 32,
+    TYPE_PART: 4,
+    SCANNER: 1,
+    MARKER: 9,
+    CHECKSUM: 8,
+};
+function createChecksumSync(checksummablePart) {
+    const data = new TextEncoder().encode(checksummablePart);
+    const calculated_checksum = crc32(data);
+    return calculated_checksum.toString(16).padStart(8, "0");
+}
+function createApiKeyParts(options) {
+    const { id, isPublic, isCloudVersion, type } = options;
+    const prefix = isPublic ? "pk" : "sk";
+    const scannerFlag = (isCloudVersion ? 0 : 1) + (isPublic ? 2 : 0) + ( /* version */0);
+    const secretPart = generateSecureRandomString();
+    const idPart = id.replace(/-/g, "");
+    const scannerAndMarker = getBase32CharacterFromIndex(scannerFlag).toLowerCase() + STACK_AUTH_MARKER;
+    const checksummablePart = `${prefix}_${secretPart}${idPart}${type}${scannerAndMarker}`;
+    return { checksummablePart, idPart, prefix, scannerAndMarker, type };
+}
+function parseApiKeyParts(secret) {
+    const regex = new RegExp(`^([a-zA-Z0-9_]+)_` + // prefix
+        `([a-zA-Z0-9_]{${API_KEY_LENGTHS.SECRET_PART}})` + // secretPart
+        `([a-zA-Z0-9_]{${API_KEY_LENGTHS.ID_PART}})` + // idPart
+        `([a-zA-Z0-9_]{${API_KEY_LENGTHS.TYPE_PART}})` + // type
+        `([a-zA-Z0-9_]{${API_KEY_LENGTHS.SCANNER}})` + // scanner
+        `(${STACK_AUTH_MARKER})` + // marker
+        `([a-zA-Z0-9_]{${API_KEY_LENGTHS.CHECKSUM}})$` // checksum
+    );
+    const match = secret.match(regex);
+    if (!match) {
+        throw new StackAssertionError("Invalid API key format");
+    }
+    const [, prefix, secretPart, idPart, type, scannerFlag, marker, checksum] = match;
+    const isCloudVersion = parseInt(scannerFlag, 32) % 2 === 0;
+    const isPublic = (parseInt(scannerFlag, 32) & 2) !== 0;
+    const checksummablePart = `${prefix}_${secretPart}${idPart}${type}${scannerFlag}${marker}`;
+    const restored_id = idPart.replace(/(.{8})(.{4})(.{4})(.{4})(.{12})/, "$1-$2-$3-$4-$5");
+    if (!["user", "team"].includes(type)) {
+        throw new StackAssertionError("Invalid type");
+    }
+    return { checksummablePart, checksum, id: restored_id, isCloudVersion, isPublic, prefix, type: type };
+}
+export function isApiKey(secret) {
+    return secret.includes("_") && secret.includes(STACK_AUTH_MARKER);
+}
+export function createProjectApiKey(options) {
+    const { checksummablePart } = createApiKeyParts(options);
+    const checksum = createChecksumSync(checksummablePart);
+    return `${checksummablePart}${checksum}`;
+}
+export function parseProjectApiKey(secret) {
+    const { checksummablePart, checksum, id, isCloudVersion, isPublic, prefix, type } = parseApiKeyParts(secret);
+    const calculated_checksum = createChecksumSync(checksummablePart);
+    if (calculated_checksum !== checksum) {
+        throw new StackAssertionError("Checksum mismatch");
+    }
+    return {
+        id,
+        prefix,
+        isPublic,
+        isCloudVersion,
+        secret,
+        checksum,
+        type,
+    };
+}

package/dist/utils/bytes.d.ts

@@ -1,3 +1,6 @@
+export declare function toHexString(input: Uint8Array): string;
+export declare function getBase32CharacterFromIndex(index: number): string;
+export declare function getBase32IndexFromCharacter(character: string): number;
 export declare function encodeBase32(input: Uint8Array): string;
 export declare function decodeBase32(input: string): Uint8Array;
 export declare function encodeBase64(input: Uint8Array): string;

package/dist/utils/bytes.js

@@ -5,6 +5,43 @@ const crockfordReplacements = new Map([
     ["i", "1"],
     ["l", "1"],
 ]);
+export function toHexString(input) {
+    return Array.from(input).map(b => b.toString(16).padStart(2, "0")).join("");
+}
+import.meta.vitest?.test("toHexString", ({ expect }) => {
+    expect(toHexString(new Uint8Array([]))).toBe("");
+    expect(toHexString(new Uint8Array([0]))).toBe("00");
+    expect(toHexString(new Uint8Array([15]))).toBe("0f");
+    expect(toHexString(new Uint8Array([16]))).toBe("10");
+    expect(toHexString(new Uint8Array([255]))).toBe("ff");
+    expect(toHexString(new Uint8Array([1, 2, 3]))).toBe("010203");
+});
+export function getBase32CharacterFromIndex(index) {
+    if (index < 0 || index >= crockfordAlphabet.length) {
+        throw new StackAssertionError(`Invalid base32 index: ${index}`);
+    }
+    return crockfordAlphabet[index];
+}
+import.meta.vitest?.test("getBase32CharacterFromIndex", ({ expect }) => {
+    expect(getBase32CharacterFromIndex(0)).toBe("0");
+    expect(getBase32CharacterFromIndex(15)).toBe("F");
+    expect(() => getBase32CharacterFromIndex(32)).toThrow();
+});
+export function getBase32IndexFromCharacter(character) {
+    if (character.length !== 1) {
+        throw new StackAssertionError(`Invalid base32 character: ${character}`);
+    }
+    const index = crockfordAlphabet.indexOf(character.toUpperCase());
+    if (index === -1) {
+        throw new StackAssertionError(`Invalid base32 character: ${character}`);
+    }
+    return index;
+}
+import.meta.vitest?.test("getBase32IndexFromCharacter", ({ expect }) => {
+    expect(getBase32IndexFromCharacter("0")).toBe(0);
+    expect(getBase32IndexFromCharacter("F")).toBe(15);
+    expect(() => getBase32IndexFromCharacter("_")).toThrow();
+});
 export function encodeBase32(input) {
     let bits = 0;
     let value = 0;
@@ -13,12 +50,12 @@ export function encodeBase32(input) {
         value = (value << 8) | input[i];
         bits += 8;
         while (bits >= 5) {
-            output += crockfordAlphabet[(value >>> (bits - 5)) & 31];
+            output += getBase32CharacterFromIndex((value >>> (bits - 5)) & 31);
             bits -= 5;
         }
     }
     if (bits > 0) {
-        output += crockfordAlphabet[(value << (5 - bits)) & 31];
+        output += getBase32CharacterFromIndex((value << (5 - bits)) & 31);
     }
     // sanity check
     if (!isBase32(output)) {
@@ -26,6 +63,14 @@ export function encodeBase32(input) {
     }
     return output;
 }
+import.meta.vitest?.test("encodeBase32", ({ expect }) => {
+    expect(encodeBase32(new Uint8Array([]))).toBe("");
+    expect(encodeBase32(new Uint8Array([1]))).toBe("04");
+    expect(encodeBase32(new Uint8Array([15]))).toBe("1W");
+    expect(encodeBase32(new Uint8Array([16]))).toBe("20");
+    expect(encodeBase32(new Uint8Array([255]))).toBe("ZW");
+    expect(encodeBase32(new Uint8Array([255, 255]))).toBe("ZZZG");
+});
 export function decodeBase32(input) {
     if (!isBase32(input)) {
         throw new StackAssertionError("Invalid base32 string");
@@ -41,10 +86,7 @@ export function decodeBase32(input) {
         if (crockfordReplacements.has(char)) {
             char = crockfordReplacements.get(char);
         }
-        const index = crockfordAlphabet.indexOf(char);
-        if (index === -1) {
-            throw new Error(`Invalid character: ${char}`);
-        }
+        const index = getBase32IndexFromCharacter(char);
         value = (value << 5) | index;
         bits += 5;
         if (bits >= 8) {
@@ -54,6 +96,13 @@ export function decodeBase32(input) {
     }
     return output;
 }
+import.meta.vitest?.test("decodeBase32", ({ expect }) => {
+    expect(decodeBase32("")).toEqual(new Uint8Array([]));
+    expect(decodeBase32("00")).toEqual(new Uint8Array([0]));
+    expect(decodeBase32("1W")).toEqual(new Uint8Array([15]));
+    expect(decodeBase32("20")).toEqual(new Uint8Array([16]));
+    expect(decodeBase32("ZW")).toEqual(new Uint8Array([255]));
+});
 export function encodeBase64(input) {
     const res = btoa(String.fromCharCode(...input));
     // Skip sanity check for test cases

package/dist/utils/caches.d.ts

@@ -17,16 +17,16 @@ export declare class AsyncCache<D extends any[], T> {
     refreshWhere(predicate: (dependencies: D) => boolean): Promise<void>;
     readonly isCacheAvailable: (key: D) => boolean;
     readonly getIfCached: (key: D) => ({
-        status: "error";
-        error: unknown;
-    } & {
-        status: "error";
-    }) | ({
         status: "pending";
     } & {
         progress: void;
     } & {
         status: "pending";
+    }) | ({
+        status: "error";
+        error: unknown;
+    } & {
+        status: "error";
     }) | ({
         status: "ok";
         data: T;
@@ -57,16 +57,16 @@ declare class AsyncValueCache<T> {
     });
     isCacheAvailable(): boolean;
     getIfCached(): ({
-        status: "error";
-        error: unknown;
-    } & {
-        status: "error";
-    }) | ({
         status: "pending";
     } & {
         progress: void;
     } & {
         status: "pending";
+    }) | ({
+        status: "error";
+        error: unknown;
+    } & {
+        status: "error";
     }) | ({
         status: "ok";
         data: T;

package/dist/utils/hashes.d.ts

@@ -1,4 +1,4 @@
-export declare function sha512(input: Uint8Array | string): Promise<string>;
+export declare function sha512(input: Uint8Array | string): Promise<Uint8Array>;
 export declare function hashPassword(password: string): Promise<string>;
 export declare function comparePassword(password: string, hash: string): Promise<boolean>;
 export declare function isPasswordHashValid(hash: string): Promise<boolean>;