@stackframe/stack 2.5.17 → 2.5.19

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["import { StackClientInterface } from \"@stackframe/stack-shared\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { StackAssertionError, captureError } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { neverResolve } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { getVerifierAndState, saveVerifierAndState } from \"./cookie\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  }\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl),\n    codeChallenge,\n    state,\n    type: \"authenticate\",\n    providerScope: options.providerScope,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\nexport async function addNewOAuthProviderOrScope(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams(expectedState: string): null | URL {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      captureError(\"consumeOAuthCallbackQueryParams\", new Error(`Missing required query parameter on OAuth callback: ${param}`));\n      return null;\n    }\n  }\n\n  if (expectedState !== originalUrl.searchParams.get(\"state\")) {\n    // If the state doesn't match, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    captureError(\"consumeOAuthCallbackQueryParams\", new Error(`Invalid OAuth callback state: Was this meant for someone else, or did cookies fail?`));\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return originalUrl;\n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const { codeVerifier, state } = getVerifierAndState();\n  if (!codeVerifier || !state) {\n    throw new Error(\"Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.\");\n  }\n  const originalUrl = consumeOAuthCallbackQueryParams(state);\n  if (!originalUrl) return null;\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback)\n  try {\n    return await iface.callOAuthCallback({\n      oauthParams: originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl),\n      codeVerifier,\n      state,\n    });\n  } catch (e) {\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,oBAAkD;AAClD,sBAA6B;AAC7B,iBAAqC;AACrC,oBAA0D;AAE1D,eAAsB,gBACpB,OACA,SAMA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,WAAW;AAAA,IACrD,sBAAkB,iCAAqB,QAAQ,gBAAgB;AAAA,IAC/D;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAEA,eAAsB,2BACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,WAAW;AAAA,IACrD,sBAAkB,iCAAqB,QAAQ,gBAAgB;AAAA,IAC/D,8BAA0B,iCAAqB,OAAO,SAAS,IAAI;AAAA,IACnE;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,gCAAgC,eAAmC;AAC1E,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,sCAAa,mCAAmC,IAAI,MAAM,uDAAuD,KAAK,EAAE,CAAC;AACzH,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,kBAAkB,YAAY,aAAa,IAAI,OAAO,GAAG;AAG3D,oCAAa,mCAAmC,IAAI,MAAM,qFAAqF,CAAC;AAChJ,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AACT;AAEA,eAAsB,kBACpB,OACA,aACA;AAIA,QAAM,EAAE,cAAc,MAAM,QAAI,mCAAoB;AACpD,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,UAAM,IAAI,MAAM,2GAA2G;AAAA,EAC7H;AACA,QAAM,cAAc,gCAAgC,KAAK;AACzD,MAAI,CAAC,YAAa,QAAO;AAIzB,MAAI;AACF,WAAO,MAAM,MAAM,kBAAkB;AAAA,MACnC,aAAa,YAAY;AAAA,MACzB,iBAAa,iCAAqB,WAAW;AAAA,MAC7C;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,GAAG;AACV,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}
+{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["import { KnownError, StackClientInterface } from \"@stackframe/stack-shared\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { StackAssertionError, captureError } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { neverResolve } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { getVerifierAndState, saveVerifierAndState } from \"./cookie\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  }\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl),\n    codeChallenge,\n    state,\n    type: \"authenticate\",\n    providerScope: options.providerScope,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\nexport async function addNewOAuthProviderOrScope(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams(expectedState: string): null | URL {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      captureError(\"consumeOAuthCallbackQueryParams\", new Error(`Missing required query parameter on OAuth callback: ${param}`));\n      return null;\n    }\n  }\n\n  if (expectedState !== originalUrl.searchParams.get(\"state\")) {\n    // If the state doesn't match, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    captureError(\"consumeOAuthCallbackQueryParams\", new Error(`Invalid OAuth callback state: Are you using another OAuth authentication with the same callback URL as Stack, or did your cookies reset?`));\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return originalUrl;\n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const { codeVerifier, state } = getVerifierAndState();\n  if (!codeVerifier || !state) {\n    throw new Error(\"Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.\");\n  }\n  const originalUrl = consumeOAuthCallbackQueryParams(state);\n  if (!originalUrl) return null;\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback)\n  try {\n    return await iface.callOAuthCallback({\n      oauthParams: originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl),\n      codeVerifier,\n      state,\n    });\n  } catch (e) {\n    if (e instanceof KnownError) {\n      throw e;\n    }\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAiD;AAEjD,oBAAkD;AAClD,sBAA6B;AAC7B,iBAAqC;AACrC,oBAA0D;AAE1D,eAAsB,gBACpB,OACA,SAMA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,WAAW;AAAA,IACrD,sBAAkB,iCAAqB,QAAQ,gBAAgB;AAAA,IAC/D;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAEA,eAAsB,2BACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,WAAW;AAAA,IACrD,sBAAkB,iCAAqB,QAAQ,gBAAgB;AAAA,IAC/D,8BAA0B,iCAAqB,OAAO,SAAS,IAAI;AAAA,IACnE;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,gCAAgC,eAAmC;AAC1E,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,sCAAa,mCAAmC,IAAI,MAAM,uDAAuD,KAAK,EAAE,CAAC;AACzH,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,kBAAkB,YAAY,aAAa,IAAI,OAAO,GAAG;AAG3D,oCAAa,mCAAmC,IAAI,MAAM,0IAA0I,CAAC;AACrM,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AACT;AAEA,eAAsB,kBACpB,OACA,aACA;AAIA,QAAM,EAAE,cAAc,MAAM,QAAI,mCAAoB;AACpD,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,UAAM,IAAI,MAAM,2GAA2G;AAAA,EAC7H;AACA,QAAM,cAAc,gCAAgC,KAAK;AACzD,MAAI,CAAC,YAAa,QAAO;AAIzB,MAAI;AACF,WAAO,MAAM,MAAM,kBAAkB;AAAA,MACnC,aAAa,YAAY;AAAA,MACzB,iBAAa,iCAAqB,WAAW;AAAA,MAC7C;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,GAAG;AACV,QAAI,aAAa,gCAAY;AAC3B,YAAM;AAAA,IACR;AACA,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}

package/dist/lib/hooks.d.mts

@@ -8,6 +8,7 @@ import '@stackframe/stack-shared/dist/interface/crud/team-permissions';
 import '@stackframe/stack-shared/dist/sessions';
 import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/utils/oauth';
+import '@stackframe/stack-shared/dist/utils/results';
 
 type GetUserOptions = GetUserOptions$1<true> & {
     projectIdMustMatch?: string;

package/dist/lib/hooks.d.ts

@@ -8,6 +8,7 @@ import '@stackframe/stack-shared/dist/interface/crud/team-permissions';
 import '@stackframe/stack-shared/dist/sessions';
 import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/utils/oauth';
+import '@stackframe/stack-shared/dist/utils/results';
 
 type GetUserOptions = GetUserOptions$1<true> & {
     projectIdMustMatch?: string;

package/dist/lib/stack-app.d.mts

@@ -7,6 +7,7 @@ import { TeamPermissionDefinitionsCrud } from '@stackframe/stack-shared/dist/int
 import { InternalSession } from '@stackframe/stack-shared/dist/sessions';
 import { ReadonlyJson } from '@stackframe/stack-shared/dist/utils/json';
 import { ProviderType } from '@stackframe/stack-shared/dist/utils/oauth';
+import { Result } from '@stackframe/stack-shared/dist/utils/results';
 
 type RequestLike = {
     headers: {
@@ -32,6 +33,8 @@ type HandlerUrls = {
     oauthCallback: string;
     magicLinkCallback: string;
     accountSettings: string;
+    teamInvitation: string;
+    teamCreation: string;
     error: string;
 };
 type OAuthScopesOnSignIn = {
@@ -193,9 +196,13 @@ type BaseUser = {
      * Whether the user has a password set.
      */
     readonly hasPassword: boolean;
+    /**
+     * @deprecated
+     */
     readonly oauthProviders: readonly {
         id: string;
     }[];
+    readonly isMultiFactorRequired: boolean;
     /**
      * A shorthand method to update multiple fields of the user at once.
      */
@@ -233,6 +240,9 @@ type UserExtra = {
     hasPermission(scope: Team, permissionId: string): Promise<boolean>;
     setSelectedTeam(team: Team | null): Promise<void>;
     createTeam(data: TeamCreateOptions): Promise<Team>;
+    leaveTeam(team: Team): Promise<void>;
+    getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>;
+    useTeamProfile(team: Team): EditableTeamMemberProfile;
 } & AsyncStoreProperty<"team", [id: string], Team | null, false> & AsyncStoreProperty<"teams", [], Team[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
     recursive?: boolean;
 }], TeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
@@ -250,6 +260,7 @@ type UserUpdateOptions = {
     displayName?: string;
     clientMetadata?: ReadonlyJson;
     selectedTeamId?: string | null;
+    totpMultiFactorSecret?: Uint8Array | null;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string, options?: {
@@ -291,8 +302,15 @@ type ServerUserUpdateOptions = {
     serverMetadata?: ReadonlyJson;
     password?: string;
 } & UserUpdateOptions;
+type ServerUserCreateOptions = {
+    primaryEmail: string;
+    password: string;
+    displayName?: string;
+    primaryEmailVerified?: boolean;
+};
 type Project = {
     readonly id: string;
+    readonly displayName: string;
     readonly config: ProjectConfig;
 };
 type AdminProject = {
@@ -304,6 +322,7 @@ type AdminProject = {
     readonly isProductionMode: boolean;
     readonly config: AdminProjectConfig;
     update(this: AdminProject, update: AdminProjectUpdateOptions): Promise<void>;
+    delete(this: AdminProject): Promise<void>;
     getProductionModeErrors(this: AdminProject): Promise<ProductionModeError[]>;
     useProductionModeErrors(this: AdminProject): ProductionModeError[];
 } & Project;
@@ -320,16 +339,21 @@ type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'>
     displayName: string;
 };
 type ProjectConfig = {
+    readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
+    readonly clientTeamCreationEnabled: boolean;
     readonly oauthProviders: OAuthProviderConfig[];
 };
 type OAuthProviderConfig = {
     readonly id: string;
 };
 type AdminProjectConfig = {
+    readonly id: string;
+    readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
+    readonly clientTeamCreationEnabled: boolean;
     readonly allowLocalhost: boolean;
     readonly oauthProviders: AdminOAuthProviderConfig[];
     readonly emailConfig?: AdminEmailConfig;
@@ -337,7 +361,7 @@ type AdminProjectConfig = {
     readonly createTeamOnSignUp: boolean;
     readonly teamCreatorDefaultPermissions: AdminTeamPermission[];
     readonly teamMemberDefaultPermissions: AdminTeamPermission[];
-} & OAuthProviderConfig;
+};
 type AdminEmailConfig = ({
     type: "standard";
     senderName: string;
@@ -370,8 +394,10 @@ type AdminProjectConfigUpdateOptions = {
         handlerPath: string;
     }[];
     oauthProviders?: AdminOAuthProviderConfig[];
+    signUpEnabled?: boolean;
     credentialEnabled?: boolean;
     magicLinkEnabled?: boolean;
+    clientTeamCreationEnabled?: boolean;
     allowLocalhost?: boolean;
     createTeamOnSignUp?: boolean;
     emailConfig?: AdminEmailConfig;
@@ -416,22 +442,49 @@ type ApiKeyCreateOptions = {
     hasSecretServerKey: boolean;
     hasSuperSecretAdminKey: boolean;
 };
+type TeamMemberProfile = {
+    displayName: string | null;
+    profileImageUrl: string | null;
+};
+type TeamMemberProfileUpdateOptions = {
+    displayName?: string;
+    profileImageUrl?: string | null;
+};
+type EditableTeamMemberProfile = TeamMemberProfile & {
+    update(update: TeamMemberProfileUpdateOptions): Promise<void>;
+};
+type TeamUser = {
+    id: string;
+    teamProfile: TeamMemberProfile;
+};
 type Team = {
     id: string;
     displayName: string;
     profileImageUrl: string | null;
+    inviteUser(options: {
+        email: string;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
+    listUsers(): Promise<TeamUser[]>;
+    useUsers(): TeamUser[];
 };
 type TeamCreateOptions = {
     displayName: string;
     profileImageUrl?: string;
 };
+type ServerTeamMemberProfile = TeamMemberProfile;
+type ServerTeamUser = ServerUser & {
+    teamProfile: ServerTeamMemberProfile;
+};
 type ServerTeam = {
     createdAt: Date;
-    listUsers(): Promise<ServerUser[]>;
+    listUsers(): Promise<ServerTeamUser[]>;
     useUsers(): ServerUser[];
     update(update: ServerTeamUpdateOptions): Promise<void>;
     delete(): Promise<void>;
     addUser(userId: string): Promise<void>;
+    inviteUser(options: {
+        email: string;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
     removeUser(userId: string): Promise<void>;
 } & Team;
 type ServerTeamCreateOptions = TeamCreateOptions;
@@ -487,7 +540,7 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
     signInWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["EmailPasswordMismatch"] | void>;
+    }): Promise<KnownErrors["EmailPasswordMismatch"] | KnownErrors["InvalidTotpCode"] | void>;
     signUpWithCredential(options: {
         email: string;
         password: string;
@@ -500,8 +553,13 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         password: string;
     }): Promise<KnownErrors["VerificationCodeError"] | void>;
     verifyPasswordResetCode(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
+    verifyTeamInvitationCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    acceptTeamInvitation(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    getTeamInvitationDetails(code: string): Promise<Result<{
+        teamDisplayName: string;
+    }, KnownErrors["VerificationCodeError"]>>;
     verifyEmail(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
-    signInWithMagicLink(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
+    signInWithMagicLink(code: string): Promise<KnownErrors["VerificationCodeError"] | KnownErrors["InvalidTotpCode"] | void>;
     redirectToOAuthCallback(): Promise<void>;
     useUser(options: GetUserOptions<HasTokenStore> & {
         or: 'redirect';
@@ -535,6 +593,7 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
      * @deprecated use `getUser()` instead
      */
     getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+    createUser(options: ServerUserCreateOptions): Promise<ServerUser>;
     useUser(options: GetUserOptions<HasTokenStore> & {
         or: 'redirect';
     }): ProjectCurrentServerUser<ProjectId>;
@@ -587,4 +646,4 @@ type AsyncStoreProperty<Name extends string, Args extends any[], Value, IsMultip
     [key in `use${Capitalize<Name>}`]: (...args: Args) => Value;
 };
 
-export { type AdminDomainConfig, type AdminEmailConfig, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectUpdateOptions, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type ApiKey, type ApiKeyBase, type ApiKeyBaseCrudRead, type ApiKeyCreateOptions, type ApiKeyFirstView, type Connection, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type GetUserOptions, type HandlerUrls, type OAuthConnection, type OAuthProviderConfig, type OAuthScopesOnSignIn, type Project, type ProjectConfig, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamUpdateOptions, type ServerUser, StackAdminApp, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamPermission, type TokenStoreInit, type User, serverTeamPermissionDefinitionCreateOptionsToCrud, serverTeamPermissionDefinitionUpdateOptionsToCrud, stackAppInternalsSymbol };
+export { type AdminDomainConfig, type AdminEmailConfig, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectUpdateOptions, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type ApiKey, type ApiKeyBase, type ApiKeyBaseCrudRead, type ApiKeyCreateOptions, type ApiKeyFirstView, type Connection, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type GetUserOptions, type HandlerUrls, type OAuthConnection, type OAuthProviderConfig, type OAuthScopesOnSignIn, type Project, type ProjectConfig, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, StackAdminApp, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamMemberProfile, type TeamPermission, type TeamUser, type TokenStoreInit, type User, serverTeamPermissionDefinitionCreateOptionsToCrud, serverTeamPermissionDefinitionUpdateOptionsToCrud, stackAppInternalsSymbol };

package/dist/lib/stack-app.d.ts

@@ -7,6 +7,7 @@ import { TeamPermissionDefinitionsCrud } from '@stackframe/stack-shared/dist/int
 import { InternalSession } from '@stackframe/stack-shared/dist/sessions';
 import { ReadonlyJson } from '@stackframe/stack-shared/dist/utils/json';
 import { ProviderType } from '@stackframe/stack-shared/dist/utils/oauth';
+import { Result } from '@stackframe/stack-shared/dist/utils/results';
 
 type RequestLike = {
     headers: {
@@ -32,6 +33,8 @@ type HandlerUrls = {
     oauthCallback: string;
     magicLinkCallback: string;
     accountSettings: string;
+    teamInvitation: string;
+    teamCreation: string;
     error: string;
 };
 type OAuthScopesOnSignIn = {
@@ -193,9 +196,13 @@ type BaseUser = {
      * Whether the user has a password set.
      */
     readonly hasPassword: boolean;
+    /**
+     * @deprecated
+     */
     readonly oauthProviders: readonly {
         id: string;
     }[];
+    readonly isMultiFactorRequired: boolean;
     /**
      * A shorthand method to update multiple fields of the user at once.
      */
@@ -233,6 +240,9 @@ type UserExtra = {
     hasPermission(scope: Team, permissionId: string): Promise<boolean>;
     setSelectedTeam(team: Team | null): Promise<void>;
     createTeam(data: TeamCreateOptions): Promise<Team>;
+    leaveTeam(team: Team): Promise<void>;
+    getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>;
+    useTeamProfile(team: Team): EditableTeamMemberProfile;
 } & AsyncStoreProperty<"team", [id: string], Team | null, false> & AsyncStoreProperty<"teams", [], Team[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
     recursive?: boolean;
 }], TeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
@@ -250,6 +260,7 @@ type UserUpdateOptions = {
     displayName?: string;
     clientMetadata?: ReadonlyJson;
     selectedTeamId?: string | null;
+    totpMultiFactorSecret?: Uint8Array | null;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string, options?: {
@@ -291,8 +302,15 @@ type ServerUserUpdateOptions = {
     serverMetadata?: ReadonlyJson;
     password?: string;
 } & UserUpdateOptions;
+type ServerUserCreateOptions = {
+    primaryEmail: string;
+    password: string;
+    displayName?: string;
+    primaryEmailVerified?: boolean;
+};
 type Project = {
     readonly id: string;
+    readonly displayName: string;
     readonly config: ProjectConfig;
 };
 type AdminProject = {
@@ -304,6 +322,7 @@ type AdminProject = {
     readonly isProductionMode: boolean;
     readonly config: AdminProjectConfig;
     update(this: AdminProject, update: AdminProjectUpdateOptions): Promise<void>;
+    delete(this: AdminProject): Promise<void>;
     getProductionModeErrors(this: AdminProject): Promise<ProductionModeError[]>;
     useProductionModeErrors(this: AdminProject): ProductionModeError[];
 } & Project;
@@ -320,16 +339,21 @@ type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'>
     displayName: string;
 };
 type ProjectConfig = {
+    readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
+    readonly clientTeamCreationEnabled: boolean;
     readonly oauthProviders: OAuthProviderConfig[];
 };
 type OAuthProviderConfig = {
     readonly id: string;
 };
 type AdminProjectConfig = {
+    readonly id: string;
+    readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
+    readonly clientTeamCreationEnabled: boolean;
     readonly allowLocalhost: boolean;
     readonly oauthProviders: AdminOAuthProviderConfig[];
     readonly emailConfig?: AdminEmailConfig;
@@ -337,7 +361,7 @@ type AdminProjectConfig = {
     readonly createTeamOnSignUp: boolean;
     readonly teamCreatorDefaultPermissions: AdminTeamPermission[];
     readonly teamMemberDefaultPermissions: AdminTeamPermission[];
-} & OAuthProviderConfig;
+};
 type AdminEmailConfig = ({
     type: "standard";
     senderName: string;
@@ -370,8 +394,10 @@ type AdminProjectConfigUpdateOptions = {
         handlerPath: string;
     }[];
     oauthProviders?: AdminOAuthProviderConfig[];
+    signUpEnabled?: boolean;
     credentialEnabled?: boolean;
     magicLinkEnabled?: boolean;
+    clientTeamCreationEnabled?: boolean;
     allowLocalhost?: boolean;
     createTeamOnSignUp?: boolean;
     emailConfig?: AdminEmailConfig;
@@ -416,22 +442,49 @@ type ApiKeyCreateOptions = {
     hasSecretServerKey: boolean;
     hasSuperSecretAdminKey: boolean;
 };
+type TeamMemberProfile = {
+    displayName: string | null;
+    profileImageUrl: string | null;
+};
+type TeamMemberProfileUpdateOptions = {
+    displayName?: string;
+    profileImageUrl?: string | null;
+};
+type EditableTeamMemberProfile = TeamMemberProfile & {
+    update(update: TeamMemberProfileUpdateOptions): Promise<void>;
+};
+type TeamUser = {
+    id: string;
+    teamProfile: TeamMemberProfile;
+};
 type Team = {
     id: string;
     displayName: string;
     profileImageUrl: string | null;
+    inviteUser(options: {
+        email: string;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
+    listUsers(): Promise<TeamUser[]>;
+    useUsers(): TeamUser[];
 };
 type TeamCreateOptions = {
     displayName: string;
     profileImageUrl?: string;
 };
+type ServerTeamMemberProfile = TeamMemberProfile;
+type ServerTeamUser = ServerUser & {
+    teamProfile: ServerTeamMemberProfile;
+};
 type ServerTeam = {
     createdAt: Date;
-    listUsers(): Promise<ServerUser[]>;
+    listUsers(): Promise<ServerTeamUser[]>;
     useUsers(): ServerUser[];
     update(update: ServerTeamUpdateOptions): Promise<void>;
     delete(): Promise<void>;
     addUser(userId: string): Promise<void>;
+    inviteUser(options: {
+        email: string;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
     removeUser(userId: string): Promise<void>;
 } & Team;
 type ServerTeamCreateOptions = TeamCreateOptions;
@@ -487,7 +540,7 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
     signInWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["EmailPasswordMismatch"] | void>;
+    }): Promise<KnownErrors["EmailPasswordMismatch"] | KnownErrors["InvalidTotpCode"] | void>;
     signUpWithCredential(options: {
         email: string;
         password: string;
@@ -500,8 +553,13 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         password: string;
     }): Promise<KnownErrors["VerificationCodeError"] | void>;
     verifyPasswordResetCode(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
+    verifyTeamInvitationCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    acceptTeamInvitation(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    getTeamInvitationDetails(code: string): Promise<Result<{
+        teamDisplayName: string;
+    }, KnownErrors["VerificationCodeError"]>>;
     verifyEmail(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
-    signInWithMagicLink(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
+    signInWithMagicLink(code: string): Promise<KnownErrors["VerificationCodeError"] | KnownErrors["InvalidTotpCode"] | void>;
     redirectToOAuthCallback(): Promise<void>;
     useUser(options: GetUserOptions<HasTokenStore> & {
         or: 'redirect';
@@ -535,6 +593,7 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
      * @deprecated use `getUser()` instead
      */
     getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+    createUser(options: ServerUserCreateOptions): Promise<ServerUser>;
     useUser(options: GetUserOptions<HasTokenStore> & {
         or: 'redirect';
     }): ProjectCurrentServerUser<ProjectId>;
@@ -587,4 +646,4 @@ type AsyncStoreProperty<Name extends string, Args extends any[], Value, IsMultip
     [key in `use${Capitalize<Name>}`]: (...args: Args) => Value;
 };
 
-export { type AdminDomainConfig, type AdminEmailConfig, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectUpdateOptions, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type ApiKey, type ApiKeyBase, type ApiKeyBaseCrudRead, type ApiKeyCreateOptions, type ApiKeyFirstView, type Connection, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type GetUserOptions, type HandlerUrls, type OAuthConnection, type OAuthProviderConfig, type OAuthScopesOnSignIn, type Project, type ProjectConfig, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamUpdateOptions, type ServerUser, StackAdminApp, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamPermission, type TokenStoreInit, type User, serverTeamPermissionDefinitionCreateOptionsToCrud, serverTeamPermissionDefinitionUpdateOptionsToCrud, stackAppInternalsSymbol };
+export { type AdminDomainConfig, type AdminEmailConfig, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectUpdateOptions, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type ApiKey, type ApiKeyBase, type ApiKeyBaseCrudRead, type ApiKeyCreateOptions, type ApiKeyFirstView, type Connection, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type GetUserOptions, type HandlerUrls, type OAuthConnection, type OAuthProviderConfig, type OAuthScopesOnSignIn, type Project, type ProjectConfig, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, StackAdminApp, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamMemberProfile, type TeamPermission, type TeamUser, type TokenStoreInit, type User, serverTeamPermissionDefinitionCreateOptionsToCrud, serverTeamPermissionDefinitionUpdateOptionsToCrud, stackAppInternalsSymbol };