@hexclave/js 1.0.123 → 1.0.126

package/dist/esm/lib/hexclave-app/users/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../../src/lib/hexclave-app/users/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { CurrentUserCrud } from \"@hexclave/shared/dist/interface/crud/current-user\";\nimport { UsersCrud } from \"@hexclave/shared/dist/interface/crud/users\";\nimport type { RestrictedReason } from \"@hexclave/shared/dist/schema-fields\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport { encodeBase64 } from \"@hexclave/shared/dist/utils/bytes\";\nimport { GeoInfo } from \"@hexclave/shared/dist/utils/geo\";\nimport { ReadonlyJson } from \"@hexclave/shared/dist/utils/json\";\nimport { ProviderType } from \"@hexclave/shared/dist/utils/oauth\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from \"../api-keys\";\nimport { AsyncStoreProperty, AuthLike } from \"../common\";\nimport { DeprecatedOAuthConnection, OAuthConnection } from \"../connected-accounts\";\nimport { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from \"../contact-channels\";\nimport { Customer } from \"../customers\";\nimport { NotificationCategory } from \"../notification-categories\";\nimport { AdminTeamPermission, TeamPermission } from \"../permissions\";\nimport { AdminOwnedProject, AdminProjectCreateOptions } from \"../projects\";\nimport { EditableTeamMemberProfile, ReceivedTeamInvitation, ServerListTeamsOptions, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from \"../teams\";\n\nconst userGetterErrorMessage = \"Hexclave: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.\";\n\nexport function withUserDestructureGuard<T extends object>(target: T): T {\n  Object.freeze(target);\n  return new Proxy(target, {\n    get(target, prop, receiver) {\n      if (prop === \"user\") {\n        return guardGetter();\n      }\n      return target[prop as keyof T];\n    },\n  });\n}\n\nfunction guardGetter(): never {\n  throw new Error(userGetterErrorMessage);\n}\n\nexport type OAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId?: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\nexport type ServerOAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { accountId?: string, email?: string, allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\n\n/**\n * Contains everything related to the current user session.\n */\nexport type Auth = AuthLike<{}> & {\n  readonly _internalSession: InternalSession,\n  readonly currentSession: {\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  },\n};\n\n/**\n * ```\n * +----------+-------------+-------------------+\n * |    \\     |   !Server   |      Server       |\n * +----------+-------------+-------------------+\n * | !Session | User        | ServerUser        |\n * | Session  | CurrentUser | CurrentServerUser |\n * +----------+-------------+-------------------+\n * ```\n *\n * The fields on each of these types are available iff:\n * BaseUser: true\n * Auth: Session\n * ServerBaseUser: Server\n * UserExtra: Session OR Server\n *\n * The types are defined as follows (in the typescript manner):\n * User = BaseUser\n * CurrentUser = BaseUser & Auth & UserExtra\n * ServerUser = BaseUser & ServerBaseUser & UserExtra\n * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra\n **/\n\nexport type BaseUser = {\n  readonly id: string,\n\n  readonly displayName: string | null,\n\n  /**\n   * The user's email address.\n   *\n   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.\n   */\n  readonly primaryEmail: string | null,\n  readonly primaryEmailVerified: boolean,\n  readonly profileImageUrl: string | null,\n\n  readonly signedUpAt: Date,\n\n  readonly clientMetadata: any,\n  readonly clientReadOnlyMetadata: any,\n\n  /**\n   * Whether the user has a password set.\n   */\n  readonly hasPassword: boolean,\n  readonly otpAuthEnabled: boolean,\n  readonly passkeyAuthEnabled: boolean,\n\n  readonly isMultiFactorRequired: boolean,\n  readonly isAnonymous: boolean,\n  /**\n   * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).\n   * For example, if email verification is required but the user hasn't verified their email yet.\n   */\n  readonly isRestricted: boolean,\n  /**\n   * The reason why the user is restricted, e.g., { type: \"email_not_verified\" }, { type: \"anonymous\" }, or { type: \"restricted_by_administrator\" }.\n   * Null if the user is not restricted.\n   */\n  readonly restrictedReason: RestrictedReason | null,\n  /** Whether the user is restricted by an administrator. Can be set manually or by sign-up rules. */\n  readonly restrictedByAdmin: boolean,\n  /**\n   * Public reason shown to the user explaining why an administrator restricted them, or null if none was given.\n   *\n   * This is intentionally readable by the user themselves (unlike `restrictedByAdminPrivateDetails`, which is\n   * server-only), so onboarding screens can tell them why they can't continue.\n   */\n  readonly restrictedByAdminReason: string | null,\n  toClientJson(): CurrentUserCrud[\"Client\"][\"Read\"],\n\n  /**\n   * @deprecated, use contact channel's usedForAuth instead\n   */\n  readonly emailAuthEnabled: boolean,\n  /**\n   * @deprecated\n   */\n  readonly oauthProviders: readonly { id: string }[],\n}\n\nexport type UserExtra = {\n  setDisplayName(displayName: string | null): Promise<void>,\n  /** @deprecated Use contact channel's sendVerificationEmail instead */\n  sendVerificationEmail(): Promise<KnownErrors[\"EmailAlreadyVerified\"] | void>,\n  setClientMetadata(metadata: any): Promise<void>,\n  updatePassword(options: { oldPassword: string, newPassword: string}): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n  setPassword(options: { password: string }): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n\n  /**\n   * A shorthand method to update multiple fields of the user at once.\n   */\n  update(update: UserUpdateOptions): Promise<void>,\n\n  listContactChannels(): Promise<ContactChannel[]>,\n  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>,\n\n  listNotificationCategories(): Promise<NotificationCategory[]>,\n\n  delete(): Promise<void>,\n\n  /** @deprecated Use `getOrLinkConnectedAccount` for redirect behavior, or `getConnectedAccount({ provider, providerAccountId })` for existence check. */\n  getConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): Promise<DeprecatedOAuthConnection>,\n  /** @deprecated Use `getConnectedAccount({ provider, providerAccountId })` for existence check, or `getOrLinkConnectedAccount` for redirect behavior. */\n  getConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): Promise<DeprecatedOAuthConnection | null>,\n  /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */\n  getConnectedAccount(account: { provider: string, providerAccountId: string }): Promise<OAuthConnection | null>,\n\n\n  /** List all connected accounts for this user (only those with allowConnectedAccounts enabled). */\n  listConnectedAccounts(): Promise<OAuthConnection[]>,\n  /** React hook to list all connected accounts. */\n  /** Redirect the user to the OAuth flow to link a new connected account. Always redirects, never returns. */\n  linkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<void>,\n  /** Get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n  getOrLinkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<OAuthConnection>,\n  /** React hook: get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  readonly selectedTeam: Team | null,\n  setSelectedTeam(teamOrId: string | Team | null): Promise<void>,\n  createTeam(data: TeamCreateOptions): Promise<Team>,\n  leaveTeam(team: Team): Promise<void>,\n\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * This allows the user to discover which teams have invited them, even if they haven't\n   * joined those teams yet. Only invitations sent to verified email addresses are included.\n   *\n   * @returns An array of `ReceivedTeamInvitation` objects, each containing the team ID, team\n   * display name, recipient email, and expiration date.\n   *\n   * @example\n   * ```ts\n   * const invitations = await user.listTeamInvitations();\n   * for (const invitation of invitations) {\n   *   console.log(`Invited to ${invitation.teamDisplayName} via ${invitation.recipientEmail}`);\n   * }\n   * ```\n   */\n  listTeamInvitations(): Promise<ReceivedTeamInvitation[]>,\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * React hook version of `listTeamInvitations()`. Automatically re-renders when invitations change.\n   */\n\n  getActiveSessions(): Promise<ActiveSession[]>,\n  revokeSession(sessionId: string): Promise<void>,\n  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>,\n\n  createApiKey(options: ApiKeyCreationOptions<\"user\">): Promise<UserApiKeyFirstView>,\n\n  listOAuthProviders(): Promise<OAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<OAuthProvider | null>,\n\n  registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n}\n& AsyncStoreProperty<\"apiKeys\", [], UserApiKey[], true>\n& AsyncStoreProperty<\"team\", [id: string], Team | null, false>\n& AsyncStoreProperty<\"teams\", [], Team[], true>\n& AsyncStoreProperty<\"teamInvitations\", [], ReceivedTeamInvitation[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { recursive?: boolean }], TeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { recursive?: boolean }], TeamPermission[], true>;\n\nexport type InternalUserExtra =\n  & {\n    createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>,\n    transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>,\n  }\n  & AsyncStoreProperty<\"ownedProjects\", [], AdminOwnedProject[], true>\n\nexport type User = BaseUser;\n\nexport type CurrentUser = BaseUser & Auth & UserExtra & Customer;\n\nexport type CurrentInternalUser = CurrentUser & InternalUserExtra;\n\nexport type ProjectCurrentUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalUser : CurrentUser;\n\nexport type TokenPartialUser = Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"isAnonymous\"\n  | \"isMultiFactorRequired\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>\n\nexport type SyncedPartialUser = TokenPartialUser & Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"profileImageUrl\"\n  | \"signedUpAt\"\n  | \"clientMetadata\"\n  | \"clientReadOnlyMetadata\"\n  | \"isAnonymous\"\n  | \"hasPassword\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>;\n\n\nexport type ActiveSession = {\n  id: string,\n  userId: string,\n  createdAt: Date,\n  isImpersonation: boolean,\n  lastUsedAt: Date | undefined,\n  isCurrentSession: boolean,\n  geoInfo?: GeoInfo,\n};\n\nexport type UserUpdateOptions = {\n  displayName?: string | null,\n  clientMetadata?: ReadonlyJson,\n  selectedTeamId?: string | null,\n  totpMultiFactorSecret?: Uint8Array | null,\n  profileImageUrl?: string | null,\n  otpAuthEnabled?: boolean,\n  passkeyAuthEnabled?: boolean,\n  primaryEmail?: string | null,\n}\nexport function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud[\"Client\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    client_metadata: options.clientMetadata,\n    selected_team_id: options.selectedTeamId,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n    profile_image_url: options.profileImageUrl,\n    otp_auth_enabled: options.otpAuthEnabled,\n    passkey_auth_enabled: options.passkeyAuthEnabled,\n    primary_email: options.primaryEmail,\n  };\n}\n\n\nexport type ServerBaseUser = {\n  setPrimaryEmail(email: string | null, options?: { verified?: boolean | undefined }): Promise<void>,\n\n  readonly lastActiveAt: Date,\n\n  readonly serverMetadata: any,\n  setServerMetadata(metadata: any): Promise<void>,\n  setClientReadOnlyMetadata(metadata: any): Promise<void>,\n\n  /** Private details about the restriction (e.g., which sign-up rule triggered). Only visible to server access and above. */\n  readonly restrictedByAdminPrivateDetails: string | null,\n  /** Best-effort ISO country code captured at sign-up time from request geo headers. */\n  readonly countryCode: string | null,\n  /** Server-only risk scores used during sign-up risk evaluation. */\n  readonly riskScores: {\n    readonly signUp: {\n      readonly bot: number,\n      readonly freeTrialAbuse: number,\n    },\n  },\n\n  createTeam(data: Omit<ServerTeamCreateOptions, \"creatorUserId\">): Promise<ServerTeam>,\n\n  listContactChannels(): Promise<ServerContactChannel[]>,\n  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>,\n\n  update(user: ServerUserUpdateOptions): Promise<void>,\n\n  grantPermission(scope: Team, permissionId: string): Promise<void>,\n  grantPermission(permissionId: string): Promise<void>,\n\n  revokePermission(scope: Team, permissionId: string): Promise<void>,\n  revokePermission(permissionId: string): Promise<void>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  listOAuthProviders(): Promise<ServerOAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>,\n\n  /**\n   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.\n   */\n  createSession(options?: { expiresInMillis?: number, isImpersonation?: boolean }): Promise<{\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  }>,\n}\n& AsyncStoreProperty<\"team\", [id: string], ServerTeam | null, false>\n& AsyncStoreProperty<\"teams\", [options?: ServerListTeamsOptions], ServerTeam[] & { nextCursor: string | null }, true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { direct?: boolean }], AdminTeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { direct?: boolean }], AdminTeamPermission[], true>;\n\n/**\n * A user including sensitive fields that should only be used on the server, never sent to the client\n * (such as sensitive information and serverMetadata).\n */\nexport type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;\n\nexport type CurrentServerUser = Auth & ServerUser;\n\nexport type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;\n\nexport type ProjectCurrentServerUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalServerUser : CurrentServerUser;\n\nexport type SyncedPartialServerUser = SyncedPartialUser & Pick<\n  ServerUser,\n  | \"serverMetadata\"\n>;\n\nexport type ServerUserUpdateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailVerified?: boolean,\n  primaryEmailAuthEnabled?: boolean,\n  clientReadOnlyMetadata?: ReadonlyJson,\n  serverMetadata?: ReadonlyJson,\n  password?: string,\n  restrictedByAdmin?: boolean,\n  restrictedByAdminReason?: string | null,\n  restrictedByAdminPrivateDetails?: string | null,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n} & UserUpdateOptions;\nexport function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud[\"Server\"][\"Update\"] {\n  // Base update options\n  const baseUpdate: CurrentUserCrud[\"Server\"][\"Update\"] = {\n    display_name: options.displayName,\n    primary_email: options.primaryEmail,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    selected_team_id: options.selectedTeamId,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    primary_email_verified: options.primaryEmailVerified,\n    password: options.password,\n    profile_image_url: options.profileImageUrl,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n  };\n  return {\n    ...baseUpdate,\n    restricted_by_admin: options.restrictedByAdmin,\n    restricted_by_admin_reason: options.restrictedByAdminReason,\n    restricted_by_admin_private_details: options.restrictedByAdminPrivateDetails,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n\n\nexport type ServerUserCreateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailAuthEnabled?: boolean,\n  password?: string,\n  otpAuthEnabled?: boolean,\n  displayName?: string,\n  primaryEmailVerified?: boolean,\n  clientMetadata?: any,\n  clientReadOnlyMetadata?: any,\n  serverMetadata?: any,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n}\nexport function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud[\"Server\"][\"Create\"] {\n  return {\n    primary_email: options.primaryEmail,\n    password: options.password,\n    otp_auth_enabled: options.otpAuthEnabled,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    display_name: options.displayName,\n    primary_email_verified: options.primaryEmailVerified,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n"],"mappings":";;AAwBA,MAAM,yBAAyB;AAE/B,SAAgB,yBAA2C,QAAc;CACvE,OAAO,OAAO,MAAM;CACpB,OAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;EAC1B,IAAI,SAAS,QACX,OAAO,YAAY;EAErB,OAAO,OAAO;CAChB,EACF,CAAC;AACH;AAEA,SAAS,cAAqB;CAC5B,MAAM,IAAI,MAAM,sBAAsB;AACxC;AA0RA,SAAgB,wBAAwB,SAAiE;CACvG,OAAO;EACL,cAAc,QAAQ;EACtB,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,qBAAqB,IAAI,QAAQ;EAClH,mBAAmB,QAAQ;EAC3B,kBAAkB,QAAQ;EAC1B,sBAAsB,QAAQ;EAC9B,eAAe,QAAQ;CACzB;AACF;AAkGA,SAAgB,8BAA8B,SAAuE;CAenH,OAAO;EAZL,cAAc,QAAQ;EACtB,eAAe,QAAQ;EACvB,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,wBAAwB,QAAQ;EAChC,UAAU,QAAQ;EAClB,mBAAmB,QAAQ;EAC3B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,qBAAqB,IAAI,QAAQ;EAIlH,qBAAqB,QAAQ;EAC7B,4BAA4B,QAAQ;EACpC,qCAAqC,QAAQ;EAC7C,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;EAC9C,EACF,IAAI,KAAA;CACN;AACF;AAqBA,SAAgB,8BAA8B,SAAiE;CAC7G,OAAO;EACL,eAAe,QAAQ;EACvB,UAAU,QAAQ;EAClB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,cAAc,QAAQ;EACtB,wBAAwB,QAAQ;EAChC,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;EAC9C,EACF,IAAI,KAAA;CACN;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../../src/lib/hexclave-app/users/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { CurrentUserCrud } from \"@hexclave/shared/dist/interface/crud/current-user\";\nimport { UsersCrud } from \"@hexclave/shared/dist/interface/crud/users\";\nimport type { RestrictedReason } from \"@hexclave/shared/dist/schema-fields\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport { encodeBase64 } from \"@hexclave/shared/dist/utils/bytes\";\nimport { GeoInfo } from \"@hexclave/shared/dist/utils/geo\";\nimport { ReadonlyJson } from \"@hexclave/shared/dist/utils/json\";\nimport { ProviderType } from \"@hexclave/shared/dist/utils/oauth\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from \"../api-keys\";\nimport { AsyncStoreProperty, AuthLike } from \"../common\";\nimport { DeprecatedOAuthConnection, OAuthConnection } from \"../connected-accounts\";\nimport { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from \"../contact-channels\";\nimport { Customer } from \"../customers\";\nimport { NotificationCategory } from \"../notification-categories\";\nimport { AdminTeamPermission, TeamPermission } from \"../permissions\";\nimport { AdminOwnedProject, AdminProjectCreateOptions } from \"../projects\";\nimport { EditableTeamMemberProfile, ReceivedTeamInvitation, ServerListTeamsOptions, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from \"../teams\";\n\nconst userGetterErrorMessage = \"Hexclave: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.\";\n\nexport function withUserDestructureGuard<T extends object>(target: T): T {\n  Object.freeze(target);\n  return new Proxy(target, {\n    get(target, prop, receiver) {\n      if (prop === \"user\") {\n        return guardGetter();\n      }\n      return target[prop as keyof T];\n    },\n  });\n}\n\nfunction guardGetter(): never {\n  throw new Error(userGetterErrorMessage);\n}\n\nexport type OAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId?: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\nexport type ServerOAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { accountId?: string, email?: string, allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\n\n/**\n * Contains everything related to the current user session.\n */\nexport type Auth = AuthLike<{}> & {\n  readonly _internalSession: InternalSession,\n  readonly currentSession: {\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  },\n};\n\n/**\n * ```\n * +----------+-------------+-------------------+\n * |    \\     |   !Server   |      Server       |\n * +----------+-------------+-------------------+\n * | !Session | User        | ServerUser        |\n * | Session  | CurrentUser | CurrentServerUser |\n * +----------+-------------+-------------------+\n * ```\n *\n * The fields on each of these types are available iff:\n * BaseUser: true\n * Auth: Session\n * ServerBaseUser: Server\n * UserExtra: Session OR Server\n *\n * The types are defined as follows (in the typescript manner):\n * User = BaseUser\n * CurrentUser = BaseUser & Auth & UserExtra\n * ServerUser = BaseUser & ServerBaseUser & UserExtra\n * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra\n **/\n\nexport type BaseUser = {\n  readonly id: string,\n\n  readonly displayName: string | null,\n\n  /**\n   * The user's email address.\n   *\n   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.\n   */\n  readonly primaryEmail: string | null,\n  readonly primaryEmailVerified: boolean,\n  readonly profileImageUrl: string | null,\n\n  readonly signedUpAt: Date,\n\n  readonly clientMetadata: any,\n  readonly clientReadOnlyMetadata: any,\n\n  /**\n   * Whether the user has a password set.\n   */\n  readonly hasPassword: boolean,\n  readonly otpAuthEnabled: boolean,\n  readonly passkeyAuthEnabled: boolean,\n\n  readonly isMultiFactorRequired: boolean,\n  readonly isAnonymous: boolean,\n  /**\n   * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).\n   * For example, if email verification is required but the user hasn't verified their email yet.\n   */\n  readonly isRestricted: boolean,\n  /**\n   * The reason why the user is restricted, e.g., { type: \"email_not_verified\" }, { type: \"anonymous\" }, or { type: \"restricted_by_administrator\" }.\n   * Null if the user is not restricted.\n   */\n  readonly restrictedReason: RestrictedReason | null,\n  /** Whether the user is restricted by an administrator. Can be set manually or by sign-up rules. */\n  readonly restrictedByAdmin: boolean,\n  /**\n   * Public reason shown to the user explaining why an administrator restricted them, or null if none was given.\n   *\n   * This is intentionally readable by the user themselves (unlike `restrictedByAdminPrivateDetails`, which is\n   * server-only), so onboarding screens can tell them why they can't continue.\n   */\n  readonly restrictedByAdminReason: string | null,\n  toClientJson(): CurrentUserCrud[\"Client\"][\"Read\"],\n\n  /**\n   * @deprecated, use contact channel's usedForAuth instead\n   */\n  readonly emailAuthEnabled: boolean,\n  /**\n   * @deprecated\n   */\n  readonly oauthProviders: readonly { id: string }[],\n  readonly externalAuthProviders: readonly { id: string }[],\n}\n\nexport type UserExtra = {\n  setDisplayName(displayName: string | null): Promise<void>,\n  /** @deprecated Use contact channel's sendVerificationEmail instead */\n  sendVerificationEmail(): Promise<KnownErrors[\"EmailAlreadyVerified\"] | void>,\n  setClientMetadata(metadata: any): Promise<void>,\n  updatePassword(options: { oldPassword: string, newPassword: string}): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n  setPassword(options: { password: string }): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n\n  /**\n   * A shorthand method to update multiple fields of the user at once.\n   */\n  update(update: UserUpdateOptions): Promise<void>,\n\n  listContactChannels(): Promise<ContactChannel[]>,\n  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>,\n\n  listNotificationCategories(): Promise<NotificationCategory[]>,\n\n  delete(): Promise<void>,\n\n  /** @deprecated Use `getOrLinkConnectedAccount` for redirect behavior, or `getConnectedAccount({ provider, providerAccountId })` for existence check. */\n  getConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): Promise<DeprecatedOAuthConnection>,\n  /** @deprecated Use `getConnectedAccount({ provider, providerAccountId })` for existence check, or `getOrLinkConnectedAccount` for redirect behavior. */\n  getConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): Promise<DeprecatedOAuthConnection | null>,\n  /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */\n  getConnectedAccount(account: { provider: string, providerAccountId: string }): Promise<OAuthConnection | null>,\n\n\n  /** List all connected accounts for this user (only those with allowConnectedAccounts enabled). */\n  listConnectedAccounts(): Promise<OAuthConnection[]>,\n  /** React hook to list all connected accounts. */\n  /** Redirect the user to the OAuth flow to link a new connected account. Always redirects, never returns. */\n  linkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<void>,\n  /** Get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n  getOrLinkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<OAuthConnection>,\n  /** React hook: get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  readonly selectedTeam: Team | null,\n  setSelectedTeam(teamOrId: string | Team | null): Promise<void>,\n  createTeam(data: TeamCreateOptions): Promise<Team>,\n  leaveTeam(team: Team): Promise<void>,\n\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * This allows the user to discover which teams have invited them, even if they haven't\n   * joined those teams yet. Only invitations sent to verified email addresses are included.\n   *\n   * @returns An array of `ReceivedTeamInvitation` objects, each containing the team ID, team\n   * display name, recipient email, and expiration date.\n   *\n   * @example\n   * ```ts\n   * const invitations = await user.listTeamInvitations();\n   * for (const invitation of invitations) {\n   *   console.log(`Invited to ${invitation.teamDisplayName} via ${invitation.recipientEmail}`);\n   * }\n   * ```\n   */\n  listTeamInvitations(): Promise<ReceivedTeamInvitation[]>,\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * React hook version of `listTeamInvitations()`. Automatically re-renders when invitations change.\n   */\n\n  getActiveSessions(): Promise<ActiveSession[]>,\n  revokeSession(sessionId: string): Promise<void>,\n  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>,\n\n  createApiKey(options: ApiKeyCreationOptions<\"user\">): Promise<UserApiKeyFirstView>,\n\n  listOAuthProviders(): Promise<OAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<OAuthProvider | null>,\n\n  registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n}\n& AsyncStoreProperty<\"apiKeys\", [], UserApiKey[], true>\n& AsyncStoreProperty<\"team\", [id: string], Team | null, false>\n& AsyncStoreProperty<\"teams\", [], Team[], true>\n& AsyncStoreProperty<\"teamInvitations\", [], ReceivedTeamInvitation[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { recursive?: boolean }], TeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { recursive?: boolean }], TeamPermission[], true>;\n\nexport type InternalUserExtra =\n  & {\n    createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>,\n    transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>,\n  }\n  & AsyncStoreProperty<\"ownedProjects\", [], AdminOwnedProject[], true>\n\nexport type User = BaseUser;\n\nexport type CurrentUser = BaseUser & Auth & UserExtra & Customer;\n\nexport type CurrentInternalUser = CurrentUser & InternalUserExtra;\n\nexport type ProjectCurrentUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalUser : CurrentUser;\n\nexport type TokenPartialUser = Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"isAnonymous\"\n  | \"isMultiFactorRequired\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n> & {\n  /**\n   * The ID of the user's selected team, read from the `selected_team_id` claim of the access token or Convex identity.\n   */\n  readonly selectedTeamId: string | null,\n}\n\nexport type SyncedPartialUser = TokenPartialUser & Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"profileImageUrl\"\n  | \"signedUpAt\"\n  | \"clientMetadata\"\n  | \"clientReadOnlyMetadata\"\n  | \"isAnonymous\"\n  | \"hasPassword\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>;\n\n\nexport type ActiveSession = {\n  id: string,\n  userId: string,\n  createdAt: Date,\n  isImpersonation: boolean,\n  lastUsedAt: Date | undefined,\n  isCurrentSession: boolean,\n  geoInfo?: GeoInfo,\n};\n\nexport type UserUpdateOptions = {\n  displayName?: string | null,\n  clientMetadata?: ReadonlyJson,\n  selectedTeamId?: string | null,\n  totpMultiFactorSecret?: Uint8Array | null,\n  profileImageUrl?: string | null,\n  otpAuthEnabled?: boolean,\n  passkeyAuthEnabled?: boolean,\n  primaryEmail?: string | null,\n}\nexport function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud[\"Client\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    client_metadata: options.clientMetadata,\n    selected_team_id: options.selectedTeamId,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n    profile_image_url: options.profileImageUrl,\n    otp_auth_enabled: options.otpAuthEnabled,\n    passkey_auth_enabled: options.passkeyAuthEnabled,\n    primary_email: options.primaryEmail,\n  };\n}\n\n\nexport type ServerBaseUser = {\n  /**\n   * The selected team is a `ServerTeam` when non-null, so `listUsers()` returns full member details\n   * without fetching the team again.\n   */\n  readonly selectedTeam: ServerTeam | null,\n\n  setPrimaryEmail(email: string | null, options?: { verified?: boolean | undefined }): Promise<void>,\n\n  readonly lastActiveAt: Date,\n\n  readonly serverMetadata: any,\n  setServerMetadata(metadata: any): Promise<void>,\n  setClientReadOnlyMetadata(metadata: any): Promise<void>,\n\n  /** Private details about the restriction (e.g., which sign-up rule triggered). Only visible to server access and above. */\n  readonly restrictedByAdminPrivateDetails: string | null,\n  /** Best-effort ISO country code captured at sign-up time from request geo headers. */\n  readonly countryCode: string | null,\n  /** Server-only risk scores used during sign-up risk evaluation. */\n  readonly riskScores: {\n    readonly signUp: {\n      readonly bot: number,\n      readonly freeTrialAbuse: number,\n    },\n  },\n\n  createTeam(data: Omit<ServerTeamCreateOptions, \"creatorUserId\">): Promise<ServerTeam>,\n\n  listContactChannels(): Promise<ServerContactChannel[]>,\n  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>,\n\n  update(user: ServerUserUpdateOptions): Promise<void>,\n\n  grantPermission(scope: Team, permissionId: string): Promise<void>,\n  grantPermission(permissionId: string): Promise<void>,\n\n  revokePermission(scope: Team, permissionId: string): Promise<void>,\n  revokePermission(permissionId: string): Promise<void>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n\n  listOAuthProviders(): Promise<ServerOAuthProvider[]>,\n\n  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>,\n\n  /**\n   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.\n   */\n  createSession(options?: { expiresInMillis?: number, isImpersonation?: boolean }): Promise<{\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  }>,\n}\n& AsyncStoreProperty<\"team\", [id: string], ServerTeam | null, false>\n& AsyncStoreProperty<\"teams\", [options?: ServerListTeamsOptions], ServerTeam[] & { nextCursor: string | null }, true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { direct?: boolean }], AdminTeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { direct?: boolean }], AdminTeamPermission[], true>;\n\n/**\n * A user including sensitive fields that should only be used on the server, never sent to the client\n * (such as sensitive information and serverMetadata).\n */\nexport type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;\n\nexport type CurrentServerUser = Auth & ServerUser;\n\nexport type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;\n\nexport type ProjectCurrentServerUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalServerUser : CurrentServerUser;\n\nexport type SyncedPartialServerUser = SyncedPartialUser & Pick<\n  ServerUser,\n  | \"serverMetadata\"\n>;\n\nexport type ServerUserUpdateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailVerified?: boolean,\n  primaryEmailAuthEnabled?: boolean,\n  clientReadOnlyMetadata?: ReadonlyJson,\n  serverMetadata?: ReadonlyJson,\n  password?: string,\n  restrictedByAdmin?: boolean,\n  restrictedByAdminReason?: string | null,\n  restrictedByAdminPrivateDetails?: string | null,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n} & UserUpdateOptions;\nexport function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud[\"Server\"][\"Update\"] {\n  // Base update options\n  const baseUpdate: CurrentUserCrud[\"Server\"][\"Update\"] = {\n    display_name: options.displayName,\n    primary_email: options.primaryEmail,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    selected_team_id: options.selectedTeamId,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    primary_email_verified: options.primaryEmailVerified,\n    password: options.password,\n    profile_image_url: options.profileImageUrl,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n  };\n  return {\n    ...baseUpdate,\n    restricted_by_admin: options.restrictedByAdmin,\n    restricted_by_admin_reason: options.restrictedByAdminReason,\n    restricted_by_admin_private_details: options.restrictedByAdminPrivateDetails,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n\n\nexport type ServerUserCreateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailAuthEnabled?: boolean,\n  password?: string,\n  otpAuthEnabled?: boolean,\n  displayName?: string,\n  primaryEmailVerified?: boolean,\n  clientMetadata?: any,\n  clientReadOnlyMetadata?: any,\n  serverMetadata?: any,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n}\nexport function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud[\"Server\"][\"Create\"] {\n  return {\n    primary_email: options.primaryEmail,\n    password: options.password,\n    otp_auth_enabled: options.otpAuthEnabled,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    display_name: options.displayName,\n    primary_email_verified: options.primaryEmailVerified,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n"],"mappings":";;AAwBA,MAAM,yBAAyB;AAE/B,SAAgB,yBAA2C,QAAc;CACvE,OAAO,OAAO,MAAM;CACpB,OAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;EAC1B,IAAI,SAAS,QACX,OAAO,YAAY;EAErB,OAAO,OAAO;CAChB,EACF,CAAC;AACH;AAEA,SAAS,cAAqB;CAC5B,MAAM,IAAI,MAAM,sBAAsB;AACxC;AAgSA,SAAgB,wBAAwB,SAAiE;CACvG,OAAO;EACL,cAAc,QAAQ;EACtB,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,qBAAqB,IAAI,QAAQ;EAClH,mBAAmB,QAAQ;EAC3B,kBAAkB,QAAQ;EAC1B,sBAAsB,QAAQ;EAC9B,eAAe,QAAQ;CACzB;AACF;AAwGA,SAAgB,8BAA8B,SAAuE;CAenH,OAAO;EAZL,cAAc,QAAQ;EACtB,eAAe,QAAQ;EACvB,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,wBAAwB,QAAQ;EAChC,UAAU,QAAQ;EAClB,mBAAmB,QAAQ;EAC3B,oBAAoB,QAAQ,yBAAyB,OAAO,aAAa,QAAQ,qBAAqB,IAAI,QAAQ;EAIlH,qBAAqB,QAAQ;EAC7B,4BAA4B,QAAQ;EACpC,qCAAqC,QAAQ;EAC7C,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;EAC9C,EACF,IAAI,KAAA;CACN;AACF;AAqBA,SAAgB,8BAA8B,SAAiE;CAC7G,OAAO;EACL,eAAe,QAAQ;EACvB,UAAU,QAAQ;EAClB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,cAAc,QAAQ;EACtB,wBAAwB,QAAQ;EAChC,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;EAC9C,EACF,IAAI,KAAA;CACN;AACF"}

package/dist/{index-ZiEXZJBF.d.ts → index-BTa6Yu7N.d.ts}

@@ -1,4 +1,4 @@
-import { t as AsyncStoreProperty } from "./common-BDyEKSM6.js";
+import { t as AsyncStoreProperty } from "./common-Dii3iHJR.js";
 import { inlineProductSchema } from "@hexclave/shared/dist/schema-fields";
 import * as yup from "yup";
 
@@ -126,4 +126,4 @@ type Customer<IsServer extends boolean = false> = {
 } : {});
 //#endregion
 export { CustomerInvoiceStatus as a, CustomerInvoicesRequestOptions as c, CustomerProductsList as d, CustomerProductsListOptions as f, ServerItem as g, Item as h, CustomerInvoice as i, CustomerPaymentMethodSetupIntent as l, InlineProduct as m, CustomerBilling as n, CustomerInvoicesList as o, CustomerProductsRequestOptions as p, CustomerDefaultPaymentMethod as r, CustomerInvoicesListOptions as s, Customer as t, CustomerProduct as u };
-//# sourceMappingURL=index-ZiEXZJBF.d.ts.map
+//# sourceMappingURL=index-BTa6Yu7N.d.ts.map

package/dist/{index-ZiEXZJBF.d.ts.map → index-BTa6Yu7N.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"index-ZiEXZJBF.d.ts","names":[],"sources":["../src/lib/hexclave-app/customers/index.ts"],"mappings":";;;;;KAQY,aAAA,GAAgB,GAAA,CAAI,SAAS,QAAQ,mBAAA;AAAA,KAErC,IAAA;EACV,WAAA;EAHuB;;;EAOvB,QAAA;EAP8B;;;EAW9B,mBAAA;AAAA;AAAA,KAGU,UAAA,GAAa,IAAA;EACvB,gBAAA,CAAiB,MAAA,WAAiB,OAAA;EAbpB;;;;;EAmBd,gBAAA,CAAiB,MAAA,WAAiB,OAAA;EAPxB;;;;;EAaV,mBAAA,CAAoB,MAAA,WAAiB,OAAA;AAAA;AAAA,KAG3B,eAAA;EACV,EAAA;EACA,QAAA;EACA,WAAA;EACA,YAAA;EACA,YAAA;EACA,SAAA,WAfiB;EAiBjB,IAAA;EACA,YAAA;IACE,cAAA;IACA,gBAAA,EAAkB,IAAA;IAClB,iBAAA;IACA,YAAA;EAAA;EAEF,aAAA,GAAgB,KAAA;IACd,SAAA;IACA,WAAA;IACA,MAAA,EAAQ,aAAA;EAAA;AAAA;AAAA,KAIA,oBAAA,GAAuB,eAAe;EAChD,UAAU;AAAA;AAAA,KAGA,2BAAA;EACV,MAAA;EACA,KAAK;AAAA;AAAA,KAGK,8BAAA;EACL,MAAA;AAAA,IAAmB,2BAAA;EACnB,MAAA;AAAA,IAAmB,2BAAA;EACnB,gBAAA;AAAA,IAA6B,2BAAA;AAAA,KAExB,qBAAA;AAAA,KAEA,eAAA;EACV,SAAA,EAAW,IAAA;EACX,MAAA,EAAQ,qBAAqB;EAC7B,WAAA;EACA,gBAAA;AAAA;AAAA,KAGU,oBAAA,GAAuB,eAAe;EAChD,UAAU;AAAA;AAAA,KAGA,2BAAA;EACV,MAAA;EACA,KAAK;AAAA;AAAA,KAGK,8BAAA;EACL,MAAA;AAAA,IAAmB,2BAAA;EACnB,MAAA;AAAA,IAAmB,2BAA2B;AAAA,KAEzC,4BAAA;EACV,EAAA;EACA,KAAA;EACA,KAAA;EACA,SAAA;EACA,QAAA;AAAA;AAAA,KAGU,eAAA;EACV,WAAA;EACA,oBAAA,EAAsB,4BAA4B;AAAA;AAAA,KAGxC,gCAAA;EACV,YAAA;EACA,eAAe;AAAA;AAAA,KAGL,QAAA;EAAA,SAEC,EAAA;EAET,iBAAA,CAAkB,OAAA;IACZ,SAAA;IAAmB,SAAA;EAAA,KACpB,QAAA;IAA0B,OAAA,EAAS,aAAA;IAAe,SAAA;EAAA,cACnD,OAAA;EAEJ,8BAAA,IAAkC,OAAA,CAAQ,gCAAA;EAE1C,sCAAA,CAAuC,aAAA,WAAwB,OAAA,CAAQ,4BAAA;EAEvE,kBAAA,CAAmB,OAAA;IAAW,aAAA;IAAuB,WAAA;IAAqB,OAAA;IAAkB,QAAA;EAAA,IAAsB,OAAA;AAAA,IAElH,kBAAA,gBAGA,eAAA,WAGA,kBAAA,UAEC,MAAA,WACD,QAAA,gBAAwB,UAAA,GAAa,IAAA,WAGrC,kBAAA,cAEC,OAAA,GAAU,2BAAA,GACX,oBAAA,UAGA,kBAAA,cAEC,OAAA,GAAU,2BAAA,GACX,oBAAA,WAGC,QAAA;EACD,YAAA,CACE,OAAA;IAAW,SAAA;IAAmB,QAAA;EAAA;IAAwB,OAAA,EAAS,aAAA;IAAe,QAAA;EAAA,IAC7E,OAAA;AAAA"}
+{"version":3,"file":"index-BTa6Yu7N.d.ts","names":[],"sources":["../src/lib/hexclave-app/customers/index.ts"],"mappings":";;;;;KAQY,aAAA,GAAgB,GAAA,CAAI,SAAS,QAAQ,mBAAA;AAAA,KAErC,IAAA;EACV,WAAA;EAHuB;;;EAOvB,QAAA;EAP8B;;;EAW9B,mBAAA;AAAA;AAAA,KAGU,UAAA,GAAa,IAAA;EACvB,gBAAA,CAAiB,MAAA,WAAiB,OAAA;EAbpB;;;;;EAmBd,gBAAA,CAAiB,MAAA,WAAiB,OAAA;EAPxB;;;;;EAaV,mBAAA,CAAoB,MAAA,WAAiB,OAAA;AAAA;AAAA,KAG3B,eAAA;EACV,EAAA;EACA,QAAA;EACA,WAAA;EACA,YAAA;EACA,YAAA;EACA,SAAA,WAfiB;EAiBjB,IAAA;EACA,YAAA;IACE,cAAA;IACA,gBAAA,EAAkB,IAAA;IAClB,iBAAA;IACA,YAAA;EAAA;EAEF,aAAA,GAAgB,KAAA;IACd,SAAA;IACA,WAAA;IACA,MAAA,EAAQ,aAAA;EAAA;AAAA;AAAA,KAIA,oBAAA,GAAuB,eAAe;EAChD,UAAU;AAAA;AAAA,KAGA,2BAAA;EACV,MAAA;EACA,KAAK;AAAA;AAAA,KAGK,8BAAA;EACL,MAAA;AAAA,IAAmB,2BAAA;EACnB,MAAA;AAAA,IAAmB,2BAAA;EACnB,gBAAA;AAAA,IAA6B,2BAAA;AAAA,KAExB,qBAAA;AAAA,KAEA,eAAA;EACV,SAAA,EAAW,IAAA;EACX,MAAA,EAAQ,qBAAqB;EAC7B,WAAA;EACA,gBAAA;AAAA;AAAA,KAGU,oBAAA,GAAuB,eAAe;EAChD,UAAU;AAAA;AAAA,KAGA,2BAAA;EACV,MAAA;EACA,KAAK;AAAA;AAAA,KAGK,8BAAA;EACL,MAAA;AAAA,IAAmB,2BAAA;EACnB,MAAA;AAAA,IAAmB,2BAA2B;AAAA,KAEzC,4BAAA;EACV,EAAA;EACA,KAAA;EACA,KAAA;EACA,SAAA;EACA,QAAA;AAAA;AAAA,KAGU,eAAA;EACV,WAAA;EACA,oBAAA,EAAsB,4BAA4B;AAAA;AAAA,KAGxC,gCAAA;EACV,YAAA;EACA,eAAe;AAAA;AAAA,KAGL,QAAA;EAAA,SAEC,EAAA;EAET,iBAAA,CAAkB,OAAA;IACZ,SAAA;IAAmB,SAAA;EAAA,KACpB,QAAA;IAA0B,OAAA,EAAS,aAAA;IAAe,SAAA;EAAA,cACnD,OAAA;EAEJ,8BAAA,IAAkC,OAAA,CAAQ,gCAAA;EAE1C,sCAAA,CAAuC,aAAA,WAAwB,OAAA,CAAQ,4BAAA;EAEvE,kBAAA,CAAmB,OAAA;IAAW,aAAA;IAAuB,WAAA;IAAqB,OAAA;IAAkB,QAAA;EAAA,IAAsB,OAAA;AAAA,IAElH,kBAAA,gBAGA,eAAA,WAGA,kBAAA,UAEC,MAAA,WACD,QAAA,gBAAwB,UAAA,GAAa,IAAA,WAGrC,kBAAA,cAEC,OAAA,GAAU,2BAAA,GACX,oBAAA,UAGA,kBAAA,cAEC,OAAA,GAAU,2BAAA,GACX,oBAAA,WAGC,QAAA;EACD,YAAA,CACE,OAAA;IAAW,SAAA;IAAmB,QAAA;EAAA;IAAwB,OAAA,EAAS,aAAA;IAAe,QAAA;EAAA,IAC7E,OAAA;AAAA"}

package/dist/{index-DLPccxVU.d.ts → index-DlOcbI9W.d.ts}

@@ -1,4 +1,4 @@
-import { t as AsyncStoreProperty } from "./common-BDyEKSM6.js";
+import { t as AsyncStoreProperty } from "./common-Dii3iHJR.js";
 
 //#region src/lib/hexclave-app/data-vault/index.d.ts
 type DataVaultStore = {
@@ -11,4 +11,4 @@ type DataVaultStore = {
 }], string | null, false>;
 //#endregion
 export { DataVaultStore as t };
-//# sourceMappingURL=index-DLPccxVU.d.ts.map
+//# sourceMappingURL=index-DlOcbI9W.d.ts.map

package/dist/{index-DLPccxVU.d.ts.map → index-DlOcbI9W.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"index-DLPccxVU.d.ts","names":[],"sources":["../src/lib/hexclave-app/data-vault/index.ts"],"mappings":";;;KAMY,cAAA;EAER,EAAA;EACA,QAAA,GAAW,GAAA,UAAa,KAAA,UAAe,OAAA;IAAW,MAAA;EAAA,MAAqB,OAAA;AAAA,IAExE,kBAAkB,WAAW,GAAA,UAAa,OAAA;EAAW,MAAA;AAAA"}
+{"version":3,"file":"index-DlOcbI9W.d.ts","names":[],"sources":["../src/lib/hexclave-app/data-vault/index.ts"],"mappings":";;;KAMY,cAAA;EAER,EAAA;EACA,QAAA,GAAW,GAAA,UAAa,KAAA,UAAe,OAAA;IAAW,MAAA;EAAA,MAAqB,OAAA;AAAA,IAExE,kBAAkB,WAAW,GAAA,UAAa,OAAA;EAAW,MAAA;AAAA"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { _ as ResolvedHandlerUrls, f as HandlerUrls, p as OAuthScopesOnSignIn, s as GetCurrentUserOptions, u as HandlerUrlOptions, y as hexclaveAppInternalsSymbol } from "./common-BDyEKSM6.js";
+import { C as workosTokenStore, S as hexclaveAppInternalsSymbol, b as betterAuthTokenStore, c as GetCurrentUserOptions, d as HandlerUrlOptions, m as OAuthScopesOnSignIn, o as ExternalTokenStore, p as HandlerUrls, v as ResolvedHandlerUrls, x as clerkTokenStore } from "./common-Dii3iHJR.js";
 import { S as AdminSentEmail, b as AdminEmailOutboxStatus, d as AdminEmailOutboxRecipient, t as AdminEmailOutbox, v as AdminEmailOutboxSimpleStatus, x as AdminSendAttemptError } from "./index-CBDR4cNg.js";
 import { a as InternalApiKeyFirstView, i as InternalApiKeyCreateOptions, n as InternalApiKeyBase, r as InternalApiKeyBaseCrudRead, t as InternalApiKey } from "./index-TUtJOdMm.js";
 import { a as AdminTeamPermission, c as AdminTeamPermissionDefinitionUpdateOptions, i as AdminProjectPermissionDefinitionUpdateOptions, n as AdminProjectPermissionDefinition, o as AdminTeamPermissionDefinition, r as AdminProjectPermissionDefinitionCreateOptions, s as AdminTeamPermissionDefinitionCreateOptions, t as AdminProjectPermission } from "./index-DSzMf-rS.js";
@@ -6,10 +6,10 @@ import { a as PlanUsageRow, i as PlanUsagePlanId, n as PlanUsageKind, r as PlanU
 import { a as AdminWorkflowRunState, c as AdminWorkflowStepAttempt, d as AdminWorkflowUpgradeResult, f as AdminWorkflowVersion, i as AdminWorkflowRunDetails, l as AdminWorkflowSyncResult, n as AdminWorkflowDivergenceDiagnostic, o as AdminWorkflowRunsFilter, r as AdminWorkflowRun, s as AdminWorkflowStep, t as AdminWorkflow, u as AdminWorkflowTrigger } from "./workflows-DhWZSQCI.js";
 import { r as OAuthConnection, t as Connection } from "./index-ClBTM-St.js";
 import { i as ServerContactChannel, t as ContactChannel } from "./index-DN04TjLM.js";
-import { $ as Team, A as HexclaveAdminAppConstructorOptions, B as StackServerApp, Ct as ServerUser, D as EmailOutboxUpdateOptions, E as EmailOutboxListResult, F as StackAdminAppConstructor, G as SentTeamInvitation, H as StackServerAppConstructorOptions, I as StackAdminAppConstructorOptions, J as ServerTeam, L as HexclaveServerApp, O as HexclaveAdminApp, P as StackAdminApp, Q as ServerTeamUser, R as HexclaveServerAppConstructor, S as PushedConfigSource, St as ServerOAuthProvider, T as EmailOutboxListOptions, U as EditableTeamMemberProfile, V as StackServerAppConstructor, W as ReceivedTeamInvitation, X as ServerTeamMemberProfile, Y as ServerTeamCreateOptions, Z as ServerTeamUpdateOptions, _ as AdminProjectCreateOptions, a as StackClientApp, at as TeamUser, b as Project, c as StackClientAppJson, d as AdminDeploymentJson, dt as Auth, et as TeamCreateOptions, f as AdminDeploymentServiceJson, g as AdminProject, gt as CurrentUser, h as AdminOwnedProject, ht as CurrentServerUser, i as HexclaveClientAppJson, it as TeamUpdateOptions, k as HexclaveAdminAppConstructor, kt as User, l as AdminDeploymentDomainJson, m as AdminDeploymentServiceOutcomeJson, mt as CurrentInternalUser, n as HexclaveClientAppConstructor, nt as TeamMemberProfile, o as StackClientAppConstructor, p as AdminDeploymentServiceLogLineJson, pt as CurrentInternalServerUser, q as ServerListUsersOptions, r as HexclaveClientAppConstructorOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp, tt as TeamInvitation, u as AdminDeploymentEnvVarJson, v as AdminProjectSecretJson, vt as OAuthProvider, y as AdminProjectUpdateOptions, z as HexclaveServerAppConstructorOptions } from "./client-app-DLFxr4f7.js";
+import { $ as Team, A as HexclaveAdminAppConstructorOptions, B as StackServerApp, Ct as ServerUser, D as EmailOutboxUpdateOptions, E as EmailOutboxListResult, F as StackAdminAppConstructor, G as SentTeamInvitation, H as StackServerAppConstructorOptions, I as StackAdminAppConstructorOptions, J as ServerTeam, L as HexclaveServerApp, O as HexclaveAdminApp, P as StackAdminApp, Q as ServerTeamUser, R as HexclaveServerAppConstructor, S as PushedConfigSource, St as ServerOAuthProvider, T as EmailOutboxListOptions, U as EditableTeamMemberProfile, V as StackServerAppConstructor, W as ReceivedTeamInvitation, X as ServerTeamMemberProfile, Y as ServerTeamCreateOptions, Z as ServerTeamUpdateOptions, _ as AdminProjectCreateOptions, a as StackClientApp, at as TeamUser, b as Project, c as StackClientAppJson, d as AdminDeploymentJson, dt as Auth, et as TeamCreateOptions, f as AdminDeploymentServiceJson, g as AdminProject, gt as CurrentUser, h as AdminOwnedProject, ht as CurrentServerUser, i as HexclaveClientAppJson, it as TeamUpdateOptions, k as HexclaveAdminAppConstructor, kt as User, l as AdminDeploymentDomainJson, m as AdminDeploymentServiceOutcomeJson, mt as CurrentInternalUser, n as HexclaveClientAppConstructor, nt as TeamMemberProfile, o as StackClientAppConstructor, p as AdminDeploymentServiceLogLineJson, pt as CurrentInternalServerUser, q as ServerListUsersOptions, r as HexclaveClientAppConstructorOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp, tt as TeamInvitation, u as AdminDeploymentEnvVarJson, v as AdminProjectSecretJson, vt as OAuthProvider, y as AdminProjectUpdateOptions, z as HexclaveServerAppConstructorOptions } from "./client-app-C7Tnf0n1.js";
 import { a as ListSessionReplaysOptions, i as ListSessionReplayChunksResult, n as AdminSessionReplayChunk, o as ListSessionReplaysResult, r as ListSessionReplayChunksOptions, s as SessionReplayAllEventsResult, t as AdminSessionReplay } from "./index-Cf1wOohp.js";
 import { a as AdminProjectConfigUpdateOptions, i as AdminProjectConfig, n as AdminEmailConfig, o as OAuthProviderConfig, r as AdminOAuthProviderConfig, s as ProjectConfig, t as AdminDomainConfig } from "./index-B-MazpM_.js";
-import { r as getPagePrompt } from "./url-targets-BJgkwPGW.js";
+import { r as getPagePrompt } from "./url-targets-DYLcHumF.js";
 import { getConvexProvidersConfig } from "./integrations/convex.js";
 import { HexclaveConfig, HexclaveDeploymentConfig, HexclaveDeploymentContext, HexclaveDeploymentReference, HexclaveEnvVarValue, HexclavePersistentVolume, HexclaveServerService, HexclaveServerlessService, HexclaveService, HexclaveServiceOutputs, StackConfig, defineHexclaveConfig, defineStackConfig } from "@hexclave/shared/config";
-export { type AdminDeploymentDomainJson, type AdminDeploymentEnvVarJson, type AdminDeploymentJson, type AdminDeploymentServiceJson, type AdminDeploymentServiceLogLineJson, type AdminDeploymentServiceOutcomeJson, type AdminDomainConfig, type AdminEmailConfig, type AdminEmailOutbox, type AdminEmailOutboxRecipient, type AdminEmailOutboxSimpleStatus, type AdminEmailOutboxStatus, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectSecretJson, type AdminProjectUpdateOptions, type AdminSendAttemptError, type AdminSentEmail, type AdminSessionReplay, type AdminSessionReplayChunk, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type AdminWorkflow, type AdminWorkflowDivergenceDiagnostic, type AdminWorkflowRun, type AdminWorkflowRunDetails, type AdminWorkflowRunState, type AdminWorkflowRunsFilter, type AdminWorkflowStep, type AdminWorkflowStepAttempt, type AdminWorkflowSyncResult, type AdminWorkflowTrigger, type AdminWorkflowUpgradeResult, type AdminWorkflowVersion, type Auth, type Connection, type ContactChannel, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type EmailOutboxListOptions, type EmailOutboxListResult, type EmailOutboxUpdateOptions, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrlOptions, type HandlerUrls, HexclaveAdminApp, type HexclaveAdminAppConstructor, type HexclaveAdminAppConstructorOptions, HexclaveClientApp, type HexclaveClientAppConstructor, type HexclaveClientAppConstructorOptions, type HexclaveClientAppJson, type HexclaveConfig, type HexclaveDeploymentConfig, type HexclaveDeploymentContext, type HexclaveDeploymentReference, type HexclaveEnvVarValue, type HexclavePersistentVolume, HexclaveServerApp, type HexclaveServerAppConstructor, type HexclaveServerAppConstructorOptions, type HexclaveServerService, type HexclaveServerlessService, type HexclaveService, type HexclaveServiceOutputs, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, type ListSessionReplayChunksOptions, type ListSessionReplayChunksResult, type ListSessionReplaysOptions, type ListSessionReplaysResult, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, type PlanUsage, type PlanUsageKind, type PlanUsageNextPlanId, type PlanUsagePlanId, type PlanUsageRow, type Project, type ProjectConfig, type PushedConfigSource, type ReceivedTeamInvitation, type ResolvedHandlerUrls, type SentTeamInvitation, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, type SessionReplayAllEventsResult, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, type StackConfig, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamInvitation, type TeamMemberProfile, type TeamUpdateOptions, type TeamUser, type User, defineHexclaveConfig, defineStackConfig, getConvexProvidersConfig, getPagePrompt, hexclaveAppInternalsSymbol };
+export { type AdminDeploymentDomainJson, type AdminDeploymentEnvVarJson, type AdminDeploymentJson, type AdminDeploymentServiceJson, type AdminDeploymentServiceLogLineJson, type AdminDeploymentServiceOutcomeJson, type AdminDomainConfig, type AdminEmailConfig, type AdminEmailOutbox, type AdminEmailOutboxRecipient, type AdminEmailOutboxSimpleStatus, type AdminEmailOutboxStatus, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectSecretJson, type AdminProjectUpdateOptions, type AdminSendAttemptError, type AdminSentEmail, type AdminSessionReplay, type AdminSessionReplayChunk, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type AdminWorkflow, type AdminWorkflowDivergenceDiagnostic, type AdminWorkflowRun, type AdminWorkflowRunDetails, type AdminWorkflowRunState, type AdminWorkflowRunsFilter, type AdminWorkflowStep, type AdminWorkflowStepAttempt, type AdminWorkflowSyncResult, type AdminWorkflowTrigger, type AdminWorkflowUpgradeResult, type AdminWorkflowVersion, type Auth, type Connection, type ContactChannel, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type EmailOutboxListOptions, type EmailOutboxListResult, type EmailOutboxUpdateOptions, type ExternalTokenStore, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrlOptions, type HandlerUrls, HexclaveAdminApp, type HexclaveAdminAppConstructor, type HexclaveAdminAppConstructorOptions, HexclaveClientApp, type HexclaveClientAppConstructor, type HexclaveClientAppConstructorOptions, type HexclaveClientAppJson, type HexclaveConfig, type HexclaveDeploymentConfig, type HexclaveDeploymentContext, type HexclaveDeploymentReference, type HexclaveEnvVarValue, type HexclavePersistentVolume, HexclaveServerApp, type HexclaveServerAppConstructor, type HexclaveServerAppConstructorOptions, type HexclaveServerService, type HexclaveServerlessService, type HexclaveService, type HexclaveServiceOutputs, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, type ListSessionReplayChunksOptions, type ListSessionReplayChunksResult, type ListSessionReplaysOptions, type ListSessionReplaysResult, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, type PlanUsage, type PlanUsageKind, type PlanUsageNextPlanId, type PlanUsagePlanId, type PlanUsageRow, type Project, type ProjectConfig, type PushedConfigSource, type ReceivedTeamInvitation, type ResolvedHandlerUrls, type SentTeamInvitation, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, type SessionReplayAllEventsResult, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, type StackConfig, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamInvitation, type TeamMemberProfile, type TeamUpdateOptions, type TeamUser, type User, betterAuthTokenStore, clerkTokenStore, defineHexclaveConfig, defineStackConfig, getConvexProvidersConfig, getPagePrompt, hexclaveAppInternalsSymbol, workosTokenStore };

package/dist/lib/hexclave-app/apps/implementations/admin-app-impl.d.ts

@@ -1,2 +1,2 @@
-import { t as _HexclaveAdminAppImplIncomplete } from "../../../../admin-app-impl-Cxer4EIA.js";
+import { t as _HexclaveAdminAppImplIncomplete } from "../../../../admin-app-impl-Df-WtGg0.js";
 export { _HexclaveAdminAppImplIncomplete };

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.d.ts

@@ -1,2 +1,2 @@
-import { i as stripBrowserActionQueryParam, r as _HexclaveClientAppImplIncomplete } from "../../../../admin-app-impl-Cxer4EIA.js";
+import { i as stripBrowserActionQueryParam, r as _HexclaveClientAppImplIncomplete } from "../../../../admin-app-impl-Df-WtGg0.js";
 export { _HexclaveClientAppImplIncomplete, stripBrowserActionQueryParam };

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.external-token-store.test.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.external-token-store.test.js

@@ -0,0 +1,381 @@
+let vitest = require("vitest");
+let _hexclave_shared = require("@hexclave/shared");
+let ______common_js = require("../../common.js");
+let ___interfaces_client_app_js = require("../interfaces/client-app.js");
+//#region src/lib/hexclave-app/apps/implementations/client-app-impl.external-token-store.test.ts
+function createAccessTokenString(refreshTokenId, issuedAtOffsetSeconds = 0) {
+	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+	const nowSeconds = Math.floor(Date.now() / 1e3) + issuedAtOffsetSeconds;
+	return [
+		encode({
+			alg: "none",
+			typ: "JWT"
+		}),
+		encode({
+			sub: "user-id",
+			exp: nowSeconds + 60,
+			iat: nowSeconds,
+			iss: "http://localhost:12345",
+			aud: "00000000-0000-4000-8000-000000000000",
+			project_id: "00000000-0000-4000-8000-000000000000",
+			branch_id: "main",
+			refresh_token_id: refreshTokenId,
+			role: "authenticated",
+			name: "Test User",
+			email: "test@example.com",
+			email_verified: true,
+			selected_team_id: null,
+			signed_up_at: nowSeconds,
+			is_anonymous: false,
+			is_restricted: false,
+			restricted_reason: null,
+			requires_totp_mfa: false
+		}),
+		""
+	].join(".");
+}
+(0, vitest.describe)("StackClientApp external token stores", () => {
+	(0, vitest.it)("does not reuse a cached token when the provider session has ended", async () => {
+		let providerSessionId = "clerk-session";
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "stale-provider-token"
+			}),
+			redirectMethod: "none"
+		});
+		const getSession = Reflect.get(clientApp, "_getSession");
+		const authenticatedSession = await getSession.call(clientApp);
+		providerSessionId = null;
+		const signedOutSession = await getSession.call(clientApp);
+		(0, vitest.expect)(signedOutSession.sessionKey).toBe("not-logged-in");
+		(0, vitest.expect)(signedOutSession).not.toBe(authenticatedSession);
+		(0, vitest.expect)(signedOutSession.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+	});
+	(0, vitest.it)("exchanges provider tokens and preserves the session across token rotations", async () => {
+		let providerSessionId = "clerk-session";
+		let notifyProviderChange;
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "clerk-token",
+				subscribe: (callback) => {
+					notifyProviderChange = callback;
+					return () => {};
+				}
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			return {
+				status: "ok",
+				data: {
+					accessToken: createAccessTokenString("hexclave-external-session", exchangeCount),
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			};
+		});
+		const getSession = Reflect.get(clientApp, "_getSession");
+		const firstSession = await getSession.call(clientApp);
+		(0, vitest.expect)(firstSession.sessionKey).toBe("external-clerk-integration-clerk-session");
+		await firstSession.getOrFetchLikelyValidTokens(2e4, null);
+		(0, vitest.expect)(exchangeCount).toBe(1);
+		notifyProviderChange?.();
+		const refreshedSession = await getSession.call(clientApp);
+		(0, vitest.expect)(refreshedSession).toBe(firstSession);
+		await refreshedSession.getOrFetchLikelyValidTokens(2e4, null);
+		(0, vitest.expect)(exchangeCount).toBe(2);
+		providerSessionId = "another-clerk-session";
+		notifyProviderChange?.();
+		const switchedSession = await getSession.call(clientApp);
+		(0, vitest.expect)(switchedSession).not.toBe(firstSession);
+		(0, vitest.expect)(switchedSession.sessionKey).toBe("external-clerk-integration-another-clerk-session");
+	});
+	(0, vitest.it)("retries a rejected exchange once with a fresh provider token before giving up", async () => {
+		let tokenCounter = 0;
+		const exchangedTokens = [];
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => `clerk-token-${++tokenCounter}`
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async (_providerId, token) => {
+			exchangedTokens.push(token);
+			if (exchangedTokens.length === 1) return {
+				status: "error",
+				error: new _hexclave_shared.KnownErrors.InvalidExternalAuthToken("malformed_token")
+			};
+			return {
+				status: "ok",
+				data: {
+					accessToken: createAccessTokenString("hexclave-external-session"),
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		(0, vitest.expect)(await session.getOrFetchLikelyValidTokens(2e4, null)).not.toBeNull();
+		(0, vitest.expect)(exchangedTokens).toEqual(["clerk-token-1", "clerk-token-2"]);
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+	});
+	(0, vitest.it)("does not retry into a different provider session after an exchange rejection", async () => {
+		let providerSessionId = "clerk-session-a";
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			providerSessionId = "clerk-session-b";
+			return {
+				status: "error",
+				error: new _hexclave_shared.KnownErrors.InvalidExternalAuthToken("malformed_token")
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		await (0, vitest.expect)(session.getOrFetchLikelyValidTokens(2e4, null)).rejects.toThrow("provider session changed");
+		(0, vitest.expect)(exchangeCount).toBe(1);
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+		(0, vitest.expect)(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+	});
+	(0, vitest.it)("does not refresh a session after the provider switches before refresh starts", async () => {
+		let providerSessionId = "clerk-session-a";
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			return {
+				status: "ok",
+				data: {
+					accessToken: createAccessTokenString("hexclave-external-session"),
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		providerSessionId = "clerk-session-b";
+		await (0, vitest.expect)(session.getOrFetchLikelyValidTokens(2e4, null)).rejects.toThrow("provider session changed");
+		(0, vitest.expect)(exchangeCount).toBe(0);
+		(0, vitest.expect)(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+	});
+	(0, vitest.it)("does not install a token when the provider switches accounts mid-exchange", async () => {
+		let providerSessionId = "clerk-session-a";
+		let resolveExchange;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", () => new Promise((resolve) => {
+			resolveExchange = (accessToken) => resolve({
+				status: "ok",
+				data: {
+					accessToken,
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			});
+		}));
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		const pending = session.getOrFetchLikelyValidTokens(2e4, null);
+		await vitest.vi.waitFor(() => (0, vitest.expect)(resolveExchange).toBeDefined());
+		providerSessionId = "clerk-session-b";
+		resolveExchange?.(createAccessTokenString("hexclave-external-session"));
+		await (0, vitest.expect)(pending).rejects.toThrow("provider session changed");
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+		(0, vitest.expect)(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+	});
+	(0, vitest.it)("does not install a token when the provider switches away and back during token retrieval", async () => {
+		let providerSessionId = "clerk-session-a";
+		let notifyProviderChange;
+		let resolveProviderToken;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: () => new Promise((resolve) => {
+					resolveProviderToken = resolve;
+				}),
+				subscribe: (callback) => {
+					notifyProviderChange = callback;
+					return () => {};
+				}
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => ({
+			status: "ok",
+			data: {
+				accessToken: createAccessTokenString("hexclave-external-session"),
+				sessionId: "hexclave-external-session",
+				userId: "user-id"
+			}
+		}));
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		const pending = session.getOrFetchLikelyValidTokens(2e4, null);
+		await vitest.vi.waitFor(() => (0, vitest.expect)(resolveProviderToken).toBeDefined());
+		providerSessionId = "clerk-session-b";
+		notifyProviderChange?.();
+		providerSessionId = "clerk-session-a";
+		notifyProviderChange?.();
+		resolveProviderToken?.("clerk-token");
+		await (0, vitest.expect)(pending).rejects.toThrow("provider session changed");
+		(0, vitest.expect)(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+	});
+	(0, vitest.it)("surfaces the rejection without invalidating the session when the retried exchange is rejected too", async () => {
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			return {
+				status: "error",
+				error: new _hexclave_shared.KnownErrors.InvalidExternalAuthToken("malformed_token")
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		await (0, vitest.expect)(session.getOrFetchLikelyValidTokens(2e4, null)).rejects.toBeInstanceOf(_hexclave_shared.KnownErrors.InvalidExternalAuthToken);
+		(0, vitest.expect)(exchangeCount).toBe(2);
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+	});
+	(0, vitest.it)("rejects first-party sign-in with Hexclave tokens for an app with an external token store", async () => {
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		await (0, vitest.expect)(Reflect.get(clientApp, "_signInToAccountWithTokens").call(clientApp, {
+			accessToken: createAccessTokenString("unrelated-session"),
+			refreshToken: "unrelated-refresh-token"
+		})).rejects.toThrow("cannot sign in with Hexclave tokens");
+	});
+	(0, vitest.it)("treats a missing provider token as transient while the provider still reports a session", async () => {
+		let providerToken = null;
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => providerToken
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			return {
+				status: "ok",
+				data: {
+					accessToken: createAccessTokenString("hexclave-external-session"),
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		await (0, vitest.expect)(session.getOrFetchLikelyValidTokens(2e4, null)).rejects.toThrow("external token store returned no token");
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+		(0, vitest.expect)(exchangeCount).toBe(0);
+		providerToken = "clerk-token";
+		(0, vitest.expect)(await session.getOrFetchLikelyValidTokens(2e4, null)).not.toBeNull();
+		(0, vitest.expect)(exchangeCount).toBe(1);
+	});
+	(0, vitest.it)("rejects signing out an external session without revoking the Hexclave session", async () => {
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		let hexclaveSignOutCount = 0;
+		Reflect.set(clientInterface, "signOut", async () => {
+			hexclaveSignOutCount += 1;
+		});
+		Reflect.set(clientApp, "_redirectToDefaultAfterSignOut", async () => {});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		await (0, vitest.expect)(Reflect.get(clientApp, "_signOut").call(clientApp, session)).rejects.toThrow("Cannot sign out an externally authenticated session through Hexclave");
+		(0, vitest.expect)(hexclaveSignOutCount).toBe(0);
+	});
+});
+//#endregion
+
+//# sourceMappingURL=client-app-impl.external-token-store.test.js.map