@hexclave/next 1.0.40 → 1.0.42

package/dist/client-app-Bi8p4lxS.d.ts

@@ -0,0 +1,1359 @@
+import { t as GenericQueryCtx } from "./storage-kputlpQY.js";
+import { _ as ResolvedHandlerUrls, a as EmailConfig, f as HandlerUrls, h as RedirectToOptions, m as RedirectMethod, n as AuthLike, o as GetCurrentPartialUserOptions, p as OAuthScopesOnSignIn, s as GetCurrentUserOptions, t as AsyncStoreProperty, u as HandlerUrlOptions, v as TokenStoreInit, y as hexclaveAppInternalsSymbol } from "./common-B2gkWlXX.js";
+import { c as CustomerInvoicesRequestOptions, d as CustomerProductsList, g as ServerItem, h as Item, m as InlineProduct, o as CustomerInvoicesList, p as CustomerProductsRequestOptions, t as Customer } from "./index-DbiyXho6.js";
+import { D as SendEmailOptions, S as AdminSentEmail, t as AdminEmailOutbox, w as EmailDeliveryInfo } from "./index-CBDR4cNg.js";
+import { a as InternalApiKeyFirstView, i as InternalApiKeyCreateOptions, t as InternalApiKey } from "./index-TUtJOdMm.js";
+import { a as AdminTeamPermission, c as AdminTeamPermissionDefinitionUpdateOptions, i as AdminProjectPermissionDefinitionUpdateOptions, n as AdminProjectPermissionDefinition, o as AdminTeamPermissionDefinition, r as AdminProjectPermissionDefinitionCreateOptions, s as AdminTeamPermissionDefinitionCreateOptions, t as AdminProjectPermission, u as TeamPermission } from "./index-DSzMf-rS.js";
+import { t as PlanUsage } from "./index-D7Vdg30O.js";
+import { t as DataVaultStore } from "./index-BSr2pd22.js";
+import { a as TeamApiKey, c as UserApiKeyFirstView, n as ApiKeyCreationOptions, o as TeamApiKeyFirstView, s as UserApiKey } from "./index-fOYcs4NH.js";
+import { n as DeprecatedOAuthConnection, r as OAuthConnection } from "./index-C_kxyHao.js";
+import { a as ServerContactChannelCreateOptions, i as ServerContactChannel, n as ContactChannelCreateOptions, t as ContactChannel } from "./index-DN04TjLM.js";
+import { t as NotificationCategory } from "./index-O3hJsHSl.js";
+import { a as ListSessionReplaysOptions, i as ListSessionReplayChunksResult, o as ListSessionReplaysResult, r as ListSessionReplayChunksOptions, s as SessionReplayAllEventsResult, t as AdminSessionReplay } from "./index-hYjsGKNc.js";
+import { a as AdminProjectConfigUpdateOptions, i as AdminProjectConfig, s as ProjectConfig } from "./index-Dq4xsW7_.js";
+import { t as AnalyticsOptions } from "./session-replay-CQ849yH1.js";
+import { KnownErrors } from "@hexclave/shared";
+import { CurrentUserCrud } from "@hexclave/shared/dist/interface/crud/current-user";
+import { Result } from "@hexclave/shared/dist/utils/results";
+import { ProviderType } from "@hexclave/shared/dist/utils/oauth";
+import { RequestListener } from "@hexclave/shared/dist/interface/client-interface";
+import { ProjectOnboardingStatus, RestrictedReason } from "@hexclave/shared/dist/schema-fields";
+import { ProductionModeError } from "@hexclave/shared/dist/helpers/production-mode";
+import { AdminUserProjectsCrud, ProjectsCrud } from "@hexclave/shared/dist/interface/crud/projects";
+import { CompleteConfig, EnvironmentConfigOverrideOverride } from "@hexclave/shared/dist/config/schema";
+import { AnalyticsClickmapOptions, AnalyticsClickmapResponse, AnalyticsClickmapTokenResponse } from "@hexclave/shared/dist/interface/admin-metrics";
+import { AnalyticsQueryOptions, AnalyticsQueryResponse } from "@hexclave/shared/dist/interface/crud/analytics";
+import { AdminGetSessionReplayChunkEventsResponse } from "@hexclave/shared/dist/interface/crud/session-replays";
+import { Transaction, TransactionType } from "@hexclave/shared/dist/interface/crud/transactions";
+import { InternalSession } from "@hexclave/shared/dist/sessions";
+import { MoneyAmount } from "@hexclave/shared/dist/utils/currency-constants";
+import { ReadonlyJson } from "@hexclave/shared/dist/utils/json";
+import { TeamsCrud } from "@hexclave/shared/dist/interface/crud/teams";
+import { UsersCrud } from "@hexclave/shared/dist/interface/crud/users";
+import { GeoInfo } from "@hexclave/shared/dist/utils/geo";
+
+//#region src/lib/hexclave-app/users/index.d.ts
+declare function withUserDestructureGuard<T extends object>(target: T): T;
+type OAuthProvider = {
+  readonly id: string;
+  readonly type: string;
+  readonly userId: string;
+  readonly accountId?: string;
+  readonly email?: string;
+  readonly allowSignIn: boolean;
+  readonly allowConnectedAccounts: boolean;
+  update(data: {
+    allowSignIn?: boolean;
+    allowConnectedAccounts?: boolean;
+  }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
+  delete(): Promise<void>;
+};
+type ServerOAuthProvider = {
+  readonly id: string;
+  readonly type: string;
+  readonly userId: string;
+  readonly accountId: string;
+  readonly email?: string;
+  readonly allowSignIn: boolean;
+  readonly allowConnectedAccounts: boolean;
+  update(data: {
+    accountId?: string;
+    email?: string;
+    allowSignIn?: boolean;
+    allowConnectedAccounts?: boolean;
+  }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
+  delete(): Promise<void>;
+};
+/**
+ * Contains everything related to the current user session.
+ */
+type Auth = AuthLike<{}> & {
+  readonly _internalSession: InternalSession;
+  readonly currentSession: {
+    getTokens(): Promise<{
+      accessToken: string | null;
+      refreshToken: string | null;
+    }>;
+    useTokens(): {
+      accessToken: string | null;
+      refreshToken: string | null;
+    };
+  };
+};
+/**
+ * ```
+ * +----------+-------------+-------------------+
+ * |    \     |   !Server   |      Server       |
+ * +----------+-------------+-------------------+
+ * | !Session | User        | ServerUser        |
+ * | Session  | CurrentUser | CurrentServerUser |
+ * +----------+-------------+-------------------+
+ * ```
+ *
+ * The fields on each of these types are available iff:
+ * BaseUser: true
+ * Auth: Session
+ * ServerBaseUser: Server
+ * UserExtra: Session OR Server
+ *
+ * The types are defined as follows (in the typescript manner):
+ * User = BaseUser
+ * CurrentUser = BaseUser & Auth & UserExtra
+ * ServerUser = BaseUser & ServerBaseUser & UserExtra
+ * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra
+ **/
+type BaseUser = {
+  readonly id: string;
+  readonly displayName: string | null;
+  /**
+   * The user's email address.
+   *
+   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.
+   */
+  readonly primaryEmail: string | null;
+  readonly primaryEmailVerified: boolean;
+  readonly profileImageUrl: string | null;
+  readonly signedUpAt: Date;
+  readonly clientMetadata: any;
+  readonly clientReadOnlyMetadata: any;
+  /**
+   * Whether the user has a password set.
+   */
+  readonly hasPassword: boolean;
+  readonly otpAuthEnabled: boolean;
+  readonly passkeyAuthEnabled: boolean;
+  readonly isMultiFactorRequired: boolean;
+  readonly isAnonymous: boolean;
+  /**
+   * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).
+   * For example, if email verification is required but the user hasn't verified their email yet.
+   */
+  readonly isRestricted: boolean;
+  /**
+   * The reason why the user is restricted, e.g., { type: "email_not_verified" }, { type: "anonymous" }, or { type: "restricted_by_administrator" }.
+   * Null if the user is not restricted.
+   */
+  readonly restrictedReason: RestrictedReason | null;
+  toClientJson(): CurrentUserCrud["Client"]["Read"];
+  /**
+   * @deprecated, use contact channel's usedForAuth instead
+   */
+  readonly emailAuthEnabled: boolean;
+  /**
+   * @deprecated
+   */
+  readonly oauthProviders: readonly {
+    id: string;
+  }[];
+};
+type UserExtra = {
+  setDisplayName(displayName: string | null): Promise<void>; /** @deprecated Use contact channel's sendVerificationEmail instead */
+  sendVerificationEmail(): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
+  setClientMetadata(metadata: any): Promise<void>;
+  updatePassword(options: {
+    oldPassword: string;
+    newPassword: string;
+  }): Promise<KnownErrors["PasswordConfirmationMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
+  setPassword(options: {
+    password: string;
+  }): Promise<KnownErrors["PasswordRequirementsNotMet"] | void>;
+  /**
+   * A shorthand method to update multiple fields of the user at once.
+   */
+  update(update: UserUpdateOptions): Promise<void>;
+  useContactChannels(): ContactChannel[];
+  listContactChannels(): Promise<ContactChannel[]>;
+  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>;
+  useNotificationCategories(): NotificationCategory[];
+  listNotificationCategories(): Promise<NotificationCategory[]>;
+  delete(): Promise<void>; /** @deprecated Use `getOrLinkConnectedAccount` for redirect behavior, or `getConnectedAccount({ provider, providerAccountId })` for existence check. */
+  getConnectedAccount(id: ProviderType, options: {
+    or: 'redirect';
+    scopes?: string[];
+  }): Promise<DeprecatedOAuthConnection>; /** @deprecated Use `getConnectedAccount({ provider, providerAccountId })` for existence check, or `getOrLinkConnectedAccount` for redirect behavior. */
+  getConnectedAccount(id: ProviderType, options?: {
+    or?: 'redirect' | 'throw' | 'return-null';
+    scopes?: string[];
+  }): Promise<DeprecatedOAuthConnection | null>; /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */
+  getConnectedAccount(account: {
+    provider: string;
+    providerAccountId: string;
+  }): Promise<OAuthConnection | null>; /** @deprecated Use `useOrLinkConnectedAccount` for redirect behavior, or `useConnectedAccount({ provider, providerAccountId })` for existence check. */
+  useConnectedAccount(id: ProviderType, options: {
+    or: 'redirect';
+    scopes?: string[];
+  }): DeprecatedOAuthConnection; /** @deprecated Use `useConnectedAccount({ provider, providerAccountId })` for existence check, or `useOrLinkConnectedAccount` for redirect behavior. */
+  useConnectedAccount(id: ProviderType, options?: {
+    or?: 'redirect' | 'throw' | 'return-null';
+    scopes?: string[];
+  }): DeprecatedOAuthConnection | null; /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */
+  useConnectedAccount(account: {
+    provider: string;
+    providerAccountId: string;
+  }): OAuthConnection | null; /** List all connected accounts for this user (only those with allowConnectedAccounts enabled). */
+  listConnectedAccounts(): Promise<OAuthConnection[]>; /** React hook to list all connected accounts. */
+  useConnectedAccounts(): OAuthConnection[]; /** Redirect the user to the OAuth flow to link a new connected account. Always redirects, never returns. */
+  linkConnectedAccount(provider: string, options?: {
+    scopes?: string[];
+  }): Promise<void>; /** Get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */
+  getOrLinkConnectedAccount(provider: string, options?: {
+    scopes?: string[];
+  }): Promise<OAuthConnection>; /** React hook: get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */
+  useOrLinkConnectedAccount(provider: string, options?: {
+    scopes?: string[];
+  }): OAuthConnection;
+  hasPermission(scope: Team, permissionId: string): Promise<boolean>;
+  hasPermission(permissionId: string): Promise<boolean>;
+  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>;
+  getPermission(permissionId: string): Promise<TeamPermission | null>;
+  listPermissions(scope: Team, options?: {
+    recursive?: boolean;
+  }): Promise<TeamPermission[]>;
+  listPermissions(options?: {
+    recursive?: boolean;
+  }): Promise<TeamPermission[]>;
+  usePermissions(scope: Team, options?: {
+    recursive?: boolean;
+  }): TeamPermission[];
+  usePermissions(options?: {
+    recursive?: boolean;
+  }): TeamPermission[];
+  usePermission(scope: Team, permissionId: string): TeamPermission | null;
+  usePermission(permissionId: string): TeamPermission | null;
+  readonly selectedTeam: Team | null;
+  setSelectedTeam(teamOrId: string | Team | null): Promise<void>;
+  createTeam(data: TeamCreateOptions): Promise<Team>;
+  leaveTeam(team: Team): Promise<void>;
+  /**
+   * Lists all pending team invitations sent to any of the current user's verified email addresses.
+   *
+   * This allows the user to discover which teams have invited them, even if they haven't
+   * joined those teams yet. Only invitations sent to verified email addresses are included.
+   *
+   * @returns An array of `ReceivedTeamInvitation` objects, each containing the team ID, team
+   * display name, recipient email, and expiration date.
+   *
+   * @example
+   * ```ts
+   * const invitations = await user.listTeamInvitations();
+   * for (const invitation of invitations) {
+   *   console.log(`Invited to ${invitation.teamDisplayName} via ${invitation.recipientEmail}`);
+   * }
+   * ```
+   */
+  listTeamInvitations(): Promise<ReceivedTeamInvitation[]>;
+  /**
+   * Lists all pending team invitations sent to any of the current user's verified email addresses.
+   *
+   * React hook version of `listTeamInvitations()`. Automatically re-renders when invitations change.
+   */
+  useTeamInvitations(): ReceivedTeamInvitation[];
+  getActiveSessions(): Promise<ActiveSession[]>;
+  revokeSession(sessionId: string): Promise<void>;
+  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>;
+  useTeamProfile(team: Team): EditableTeamMemberProfile;
+  createApiKey(options: ApiKeyCreationOptions<"user">): Promise<UserApiKeyFirstView>;
+  useOAuthProviders(): OAuthProvider[];
+  listOAuthProviders(): Promise<OAuthProvider[]>;
+  useOAuthProvider(id: string): OAuthProvider | null;
+  getOAuthProvider(id: string): Promise<OAuthProvider | null>;
+  registerPasskey(options?: {
+    hostname?: string;
+  }): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>>;
+} & AsyncStoreProperty<"apiKeys", [], UserApiKey[], true> & AsyncStoreProperty<"team", [id: string], Team | null, false> & AsyncStoreProperty<"teams", [], Team[], true> & AsyncStoreProperty<"teamInvitations", [], ReceivedTeamInvitation[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
+  recursive?: boolean;
+}], TeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
+  recursive?: boolean;
+}], TeamPermission[], true>;
+type InternalUserExtra = {
+  createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>;
+  transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>;
+} & AsyncStoreProperty<"ownedProjects", [], AdminOwnedProject[], true>;
+type User = BaseUser;
+type CurrentUser = BaseUser & Auth & UserExtra & Customer;
+type CurrentInternalUser = CurrentUser & InternalUserExtra;
+type ProjectCurrentUser<ProjectId> = ProjectId extends "internal" ? CurrentInternalUser : CurrentUser;
+type TokenPartialUser = Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "isAnonymous" | "isMultiFactorRequired" | "isRestricted" | "restrictedReason">;
+type SyncedPartialUser = TokenPartialUser & Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "profileImageUrl" | "signedUpAt" | "clientMetadata" | "clientReadOnlyMetadata" | "isAnonymous" | "hasPassword" | "isRestricted" | "restrictedReason">;
+type ActiveSession = {
+  id: string;
+  userId: string;
+  createdAt: Date;
+  isImpersonation: boolean;
+  lastUsedAt: Date | undefined;
+  isCurrentSession: boolean;
+  geoInfo?: GeoInfo;
+};
+type UserUpdateOptions = {
+  displayName?: string | null;
+  clientMetadata?: ReadonlyJson;
+  selectedTeamId?: string | null;
+  totpMultiFactorSecret?: Uint8Array | null;
+  profileImageUrl?: string | null;
+  otpAuthEnabled?: boolean;
+  passkeyAuthEnabled?: boolean;
+  primaryEmail?: string | null;
+};
+declare function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud["Client"]["Update"];
+type ServerBaseUser = {
+  setPrimaryEmail(email: string | null, options?: {
+    verified?: boolean | undefined;
+  }): Promise<void>;
+  readonly lastActiveAt: Date;
+  readonly serverMetadata: any;
+  setServerMetadata(metadata: any): Promise<void>;
+  setClientReadOnlyMetadata(metadata: any): Promise<void>; /** Whether the user is restricted by an administrator. Can be set manually or by sign-up rules. */
+  readonly restrictedByAdmin: boolean; /** Public reason shown to the user explaining why they are restricted. Optional. */
+  readonly restrictedByAdminReason: string | null; /** Private details about the restriction (e.g., which sign-up rule triggered). Only visible to server access and above. */
+  readonly restrictedByAdminPrivateDetails: string | null; /** Best-effort ISO country code captured at sign-up time from request geo headers. */
+  readonly countryCode: string | null; /** Server-only risk scores used during sign-up risk evaluation. */
+  readonly riskScores: {
+    readonly signUp: {
+      readonly bot: number;
+      readonly freeTrialAbuse: number;
+    };
+  };
+  createTeam(data: Omit<ServerTeamCreateOptions, "creatorUserId">): Promise<ServerTeam>;
+  useContactChannels(): ServerContactChannel[];
+  listContactChannels(): Promise<ServerContactChannel[]>;
+  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>;
+  update(user: ServerUserUpdateOptions): Promise<void>;
+  grantPermission(scope: Team, permissionId: string): Promise<void>;
+  grantPermission(permissionId: string): Promise<void>;
+  revokePermission(scope: Team, permissionId: string): Promise<void>;
+  revokePermission(permissionId: string): Promise<void>;
+  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>;
+  getPermission(permissionId: string): Promise<TeamPermission | null>;
+  hasPermission(scope: Team, permissionId: string): Promise<boolean>;
+  hasPermission(permissionId: string): Promise<boolean>;
+  listPermissions(scope: Team, options?: {
+    recursive?: boolean;
+  }): Promise<TeamPermission[]>;
+  listPermissions(options?: {
+    recursive?: boolean;
+  }): Promise<TeamPermission[]>;
+  usePermissions(scope: Team, options?: {
+    recursive?: boolean;
+  }): TeamPermission[];
+  usePermissions(options?: {
+    recursive?: boolean;
+  }): TeamPermission[];
+  usePermission(scope: Team, permissionId: string): TeamPermission | null;
+  usePermission(permissionId: string): TeamPermission | null;
+  useOAuthProviders(): ServerOAuthProvider[];
+  listOAuthProviders(): Promise<ServerOAuthProvider[]>;
+  useOAuthProvider(id: string): ServerOAuthProvider | null;
+  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>;
+  /**
+   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.
+   */
+  createSession(options?: {
+    expiresInMillis?: number;
+    isImpersonation?: boolean;
+  }): Promise<{
+    getTokens(): Promise<{
+      accessToken: string | null;
+      refreshToken: string | null;
+    }>;
+  }>;
+} & AsyncStoreProperty<"team", [id: string], ServerTeam | null, false> & AsyncStoreProperty<"teams", [options?: ServerListTeamsOptions], ServerTeam[] & {
+  nextCursor: string | null;
+}, true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
+  direct?: boolean;
+}], AdminTeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
+  direct?: boolean;
+}], AdminTeamPermission[], true>;
+/**
+ * A user including sensitive fields that should only be used on the server, never sent to the client
+ * (such as sensitive information and serverMetadata).
+ */
+type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;
+type CurrentServerUser = Auth & ServerUser;
+type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;
+type ProjectCurrentServerUser<ProjectId> = ProjectId extends "internal" ? CurrentInternalServerUser : CurrentServerUser;
+type SyncedPartialServerUser = SyncedPartialUser & Pick<ServerUser, "serverMetadata">;
+type ServerUserUpdateOptions = {
+  primaryEmail?: string | null;
+  primaryEmailVerified?: boolean;
+  primaryEmailAuthEnabled?: boolean;
+  clientReadOnlyMetadata?: ReadonlyJson;
+  serverMetadata?: ReadonlyJson;
+  password?: string;
+  restrictedByAdmin?: boolean;
+  restrictedByAdminReason?: string | null;
+  restrictedByAdminPrivateDetails?: string | null;
+  countryCode?: string | null;
+  riskScores?: {
+    signUp: {
+      bot: number;
+      freeTrialAbuse: number;
+    };
+  };
+} & UserUpdateOptions;
+declare function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud["Server"]["Update"];
+type ServerUserCreateOptions = {
+  primaryEmail?: string | null;
+  primaryEmailAuthEnabled?: boolean;
+  password?: string;
+  otpAuthEnabled?: boolean;
+  displayName?: string;
+  primaryEmailVerified?: boolean;
+  clientMetadata?: any;
+  clientReadOnlyMetadata?: any;
+  serverMetadata?: any;
+  countryCode?: string | null;
+  riskScores?: {
+    signUp: {
+      bot: number;
+      freeTrialAbuse: number;
+    };
+  };
+};
+declare function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud["Server"]["Create"];
+//#endregion
+//#region src/lib/hexclave-app/teams/index.d.ts
+type TeamMemberProfile = {
+  displayName: string | null;
+  profileImageUrl: string | null;
+};
+type TeamMemberProfileUpdateOptions = {
+  displayName?: string;
+  profileImageUrl?: string | null;
+};
+type EditableTeamMemberProfile = TeamMemberProfile & {
+  update(update: TeamMemberProfileUpdateOptions): Promise<void>;
+};
+type TeamUser = {
+  id: string;
+  teamProfile: TeamMemberProfile;
+};
+/**
+ * A team invitation as seen from the team's perspective (ie. the sender).
+ *
+ * Returned by `team.listInvitations()`. Contains the recipient email and allows
+ * revoking the invitation.
+ */
+type SentTeamInvitation = {
+  id: string;
+  recipientEmail: string | null;
+  expiresAt: Date;
+  revoke(): Promise<void>;
+};
+/**
+ * @deprecated Use `SentTeamInvitation` instead.
+ */
+type TeamInvitation = SentTeamInvitation;
+/**
+ * A team invitation as seen from the invited user's perspective (ie. the receiver).
+ *
+ * Returned by `user.listTeamInvitations()`. Contains information about teams that have
+ * sent invitations to any of the user's verified email addresses, and allows accepting
+ * the invitation to join the team.
+ */
+type ReceivedTeamInvitation = {
+  id: string;
+  teamId: string;
+  teamDisplayName: string;
+  recipientEmail: string;
+  expiresAt: Date;
+  /**
+   * Accepts the invitation, adding the current user to the team.
+   *
+   * The user must have a verified email address matching the invitation's recipient email.
+   */
+  accept(): Promise<void>;
+};
+type Team = {
+  id: string;
+  displayName: string;
+  profileImageUrl: string | null;
+  clientMetadata: any;
+  clientReadOnlyMetadata: any;
+  inviteUser(options: {
+    email: string;
+    callbackUrl?: string;
+  }): Promise<void>;
+  listUsers(): Promise<TeamUser[]>;
+  useUsers(): TeamUser[];
+  listInvitations(): Promise<SentTeamInvitation[]>;
+  useInvitations(): SentTeamInvitation[];
+  update(update: TeamUpdateOptions): Promise<void>;
+  delete(): Promise<void>;
+  createApiKey(options: ApiKeyCreationOptions<"team">): Promise<TeamApiKeyFirstView>;
+} & AsyncStoreProperty<"apiKeys", [], TeamApiKey[], true> & Customer;
+type TeamUpdateOptions = {
+  displayName?: string;
+  profileImageUrl?: string | null;
+  clientMetadata?: ReadonlyJson;
+};
+declare function teamUpdateOptionsToCrud(options: TeamUpdateOptions): TeamsCrud["Client"]["Update"];
+type TeamCreateOptions = {
+  displayName: string;
+  profileImageUrl?: string;
+};
+declare function teamCreateOptionsToCrud(options: TeamCreateOptions, creatorUserId: string): TeamsCrud["Client"]["Create"];
+type ServerTeamMemberProfile = TeamMemberProfile;
+type ServerTeamUser = ServerUser & {
+  teamProfile: ServerTeamMemberProfile;
+};
+type ServerTeam = {
+  createdAt: Date;
+  serverMetadata: any;
+  listUsers(): Promise<ServerTeamUser[]>;
+  useUsers(): ServerUser[];
+  update(update: ServerTeamUpdateOptions): Promise<void>;
+  delete(): Promise<void>;
+  addUser(userId: string): Promise<void>;
+  inviteUser(options: {
+    email: string;
+    callbackUrl?: string;
+  }): Promise<void>;
+  removeUser(userId: string): Promise<void>;
+} & Team;
+type ServerListUsersOptionsBase = {
+  cursor?: string;
+  limit?: number;
+  orderBy?: 'signedUpAt' | 'lastActiveAt';
+  desc?: boolean;
+  /**
+   * Free-text search. Matches user ID (exact UUID), display name, and contact channels (e.g. primary email).
+   */
+  query?: string;
+  /**
+   * Exclude users whose primary email domain matches one of these exact domains.
+   */
+  excludedEmailDomains?: string[];
+  /**
+   * Only return users who are members of the given team.
+   */
+  teamId?: string;
+  /**
+   * Whether to include restricted users (users who haven't completed onboarding requirements).
+   * Defaults to false.
+   */
+  includeRestricted?: boolean;
+  /**
+   * Whether to include anonymous users (and restricted users).
+   * Defaults to false.
+   */
+  includeAnonymous?: boolean;
+};
+type ServerListUsersOptions = ServerListUsersOptionsBase & ({
+  onlyAnonymous?: false;
+} | {
+  /**
+   * Whether to return only anonymous users.
+   * Requires includeAnonymous=true.
+   * Defaults to false.
+   */
+  onlyAnonymous: true;
+  includeAnonymous: true;
+});
+type ServerListTeamsOptions = {
+  orderBy?: 'createdAt';
+  desc?: boolean;
+  cursor?: string;
+  limit?: number;
+  /**
+   * Free-text search. Matches team ID (exact UUID) and display name.
+   */
+  query?: string;
+};
+type ServerTeamCreateOptions = TeamCreateOptions & {
+  creatorUserId?: string;
+};
+declare function serverTeamCreateOptionsToCrud(options: ServerTeamCreateOptions): TeamsCrud["Server"]["Create"];
+type ServerTeamUpdateOptions = TeamUpdateOptions & {
+  clientReadOnlyMetadata?: ReadonlyJson;
+  serverMetadata?: ReadonlyJson;
+};
+declare function serverTeamUpdateOptionsToCrud(options: ServerTeamUpdateOptions): TeamsCrud["Server"]["Update"];
+//#endregion
+//#region src/lib/hexclave-app/apps/interfaces/server-app.d.ts
+/** @deprecated Use `HexclaveServerAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {
+  secretServerKey?: string;
+};
+/** @deprecated Use `HexclaveServerApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = ({
+  createTeam(data: ServerTeamCreateOptions): Promise<ServerTeam>;
+  /**
+   * @deprecated use `getUser()` instead
+   */
+  getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+  createUser(options: ServerUserCreateOptions): Promise<ServerUser>;
+  grantProduct(options: (({
+    userId: string;
+  } | {
+    teamId: string;
+  } | {
+    customCustomerId: string;
+  }) & ({
+    productId: string;
+  } | {
+    product: InlineProduct;
+  }) & {
+    quantity?: number;
+  })): Promise<void>;
+  createCheckoutUrl(options: (({
+    userId: string;
+  } | {
+    teamId: string;
+  } | {
+    customCustomerId: string;
+  }) & ({
+    productId: string;
+  } | {
+    product: InlineProduct;
+  }) & {
+    returnUrl?: string;
+  })): Promise<string>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): ProjectCurrentServerUser<ProjectId>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): ProjectCurrentServerUser<ProjectId>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): ProjectCurrentServerUser<ProjectId>;
+  useUser(options?: GetCurrentUserOptions<HasTokenStore>): ProjectCurrentServerUser<ProjectId> | null;
+  useUser(id: string): ServerUser | null;
+  useUser(options: {
+    apiKey: string;
+    or?: "return-null" | "anonymous";
+  }): ServerUser | null;
+  useUser(options: {
+    from: "convex";
+    ctx: GenericQueryCtx<any>;
+    or?: "return-null" | "anonymous";
+  }): ServerUser | null;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+  getUser(id: string): Promise<ServerUser | null>;
+  getUser(options: {
+    apiKey: string;
+    or?: "return-null" | "anonymous";
+  }): Promise<ServerUser | null>;
+  getUser(options: {
+    from: "convex";
+    ctx: GenericQueryCtx<any>;
+    or?: "return-null" | "anonymous";
+  }): Promise<ServerUser | null>;
+  getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'token';
+  }): Promise<TokenPartialUser | null>;
+  getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'convex';
+  }): Promise<TokenPartialUser | null>;
+  getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): Promise<SyncedPartialServerUser | TokenPartialUser | null>;
+  usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'token';
+  }): TokenPartialUser | null;
+  usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'convex';
+  }): TokenPartialUser | null;
+  usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): SyncedPartialServerUser | TokenPartialUser | null;
+  useTeam(id: string): ServerTeam | null;
+  useTeam(options: {
+    apiKey: string;
+  }): ServerTeam | null;
+  getTeam(id: string): Promise<ServerTeam | null>;
+  getTeam(options: {
+    apiKey: string;
+  }): Promise<ServerTeam | null>;
+  useUsers(options?: ServerListUsersOptions): ServerUser[] & {
+    nextCursor: string | null;
+  };
+  listUsers(options?: ServerListUsersOptions): Promise<ServerUser[] & {
+    nextCursor: string | null;
+  }>;
+  /**
+   * Returns every direct (or recursive) team permission grant for every
+   * member of the given team in one request. Use this instead of calling
+   * `user.listPermissions(team)` per row when rendering a roster — that
+   * pattern produces an N+1 over the team-member endpoint.
+   */
+  listTeamMemberPermissions(teamId: string, options?: {
+    recursive?: boolean;
+  }): Promise<{
+    userId: string;
+    permissionId: string;
+  }[]>;
+  useTeamMemberPermissions(teamId: string, options?: {
+    recursive?: boolean;
+  }): {
+    userId: string;
+    permissionId: string;
+  }[];
+  createOAuthProvider(options: {
+    userId: string;
+    accountId: string;
+    providerConfigId: string;
+    email: string;
+    allowSignIn: boolean;
+    allowConnectedAccounts: boolean;
+  }): Promise<Result<ServerOAuthProvider, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
+  sendEmail(options: SendEmailOptions): Promise<void>;
+  getEmailDeliveryStats(): Promise<EmailDeliveryInfo>;
+  useEmailDeliveryStats(): EmailDeliveryInfo;
+  activateEmailCapacityBoost(): Promise<void>;
+} & AsyncStoreProperty<"user", [id: string], ServerUser | null, false> & Omit<AsyncStoreProperty<"users", [], ServerUser[], true>, "listUsers" | "useUsers"> & AsyncStoreProperty<"teams", [options?: ServerListTeamsOptions], ServerTeam[] & {
+  nextCursor: string | null;
+}, true> & AsyncStoreProperty<"dataVaultStore", [id: string], DataVaultStore, false> & AsyncStoreProperty<"item", [{
+  itemId: string;
+  userId: string;
+} | {
+  itemId: string;
+  teamId: string;
+} | {
+  itemId: string;
+  customCustomerId: string;
+}], ServerItem, false> & AsyncStoreProperty<"products", [options: CustomerProductsRequestOptions], CustomerProductsList, true> & StackClientApp<HasTokenStore, ProjectId>);
+/** @deprecated Use `HexclaveServerAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackServerAppConstructor = {
+  new <TokenStoreType extends string, HasTokenStore extends (TokenStoreType extends {} ? true : boolean), ProjectId extends string>(options: StackServerAppConstructorOptions<HasTokenStore, ProjectId>): StackServerApp<HasTokenStore, ProjectId>;
+  new (options: StackServerAppConstructorOptions<boolean, string>): StackServerApp<boolean, string>;
+};
+type HexclaveServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackServerAppConstructorOptions<HasTokenStore, ProjectId>;
+type HexclaveServerApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackServerApp<HasTokenStore, ProjectId>;
+type HexclaveServerAppConstructor = StackServerAppConstructor;
+declare const HexclaveServerApp: HexclaveServerAppConstructor;
+/** @deprecated Use `HexclaveServerApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+declare const StackServerApp: StackServerAppConstructor;
+//#endregion
+//#region src/lib/hexclave-app/apps/interfaces/admin-app.d.ts
+type EmailOutboxListOptions = {
+  status?: string;
+  simpleStatus?: string;
+  userId?: string;
+  limit?: number;
+  cursor?: string;
+};
+type EmailOutboxListResult = {
+  items: AdminEmailOutbox[];
+  nextCursor: string | null;
+};
+type EmailOutboxUpdateOptions = {
+  isPaused?: boolean;
+  scheduledAtMillis?: number;
+  cancel?: boolean;
+  tsxSource?: string;
+  themeId?: string | null;
+};
+type ManagedEmailProviderSetupResult = {
+  domainId: string;
+  subdomain: string;
+  senderLocalPart: string;
+  nameServerRecords: string[];
+  status: ManagedEmailProviderStatus["status"];
+};
+type ManagedEmailProviderStatus = {
+  status: "pending_dns" | "pending_verification" | "verified" | "applied" | "failed";
+};
+type ManagedEmailProviderListItem = {
+  domainId: string;
+  subdomain: string;
+  senderLocalPart: string;
+  status: ManagedEmailProviderStatus["status"];
+  nameServerRecords: string[];
+};
+/** @deprecated Use `HexclaveAdminAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = (StackServerAppConstructorOptions<HasTokenStore, ProjectId> & {
+  superSecretAdminKey?: string;
+  projectOwnerSession?: InternalSession | (() => Promise<string | null>);
+});
+/** @deprecated Use `HexclaveAdminApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = (AsyncStoreProperty<"project", [], AdminProject, false> & AsyncStoreProperty<"planUsage", [], PlanUsage, false> & AsyncStoreProperty<"internalApiKeys", [], InternalApiKey[], true> & AsyncStoreProperty<"teamPermissionDefinitions", [], AdminTeamPermissionDefinition[], true> & AsyncStoreProperty<"projectPermissionDefinitions", [], AdminProjectPermissionDefinition[], true> & AsyncStoreProperty<"emailThemes", [], {
+  id: string;
+  displayName: string;
+}[], true> & AsyncStoreProperty<"emailPreview", [{
+  themeId?: string | null | false;
+  themeTsxSource?: string;
+  templateId?: string;
+  templateTsxSource?: string;
+}], string, false> & AsyncStoreProperty<"emailPreviewWithEditableMarkers", [{
+  themeId?: string | null | false;
+  themeTsxSource?: string;
+  templateId?: string;
+  templateTsxSource?: string;
+  editableSource?: 'template' | 'theme' | 'both';
+}], {
+  html: string;
+  editableRegions?: Record<string, unknown>;
+}, false> & AsyncStoreProperty<"emailTemplates", [], {
+  id: string;
+  displayName: string;
+  themeId?: string;
+  tsxSource: string;
+}[], true> & AsyncStoreProperty<"emailDrafts", [], {
+  id: string;
+  displayName: string;
+  themeId: string | undefined | false;
+  tsxSource: string;
+  sentAt: Date | null;
+}[], true> & AsyncStoreProperty<"stripeAccountInfo", [], {
+  account_id: string;
+  charges_enabled: boolean;
+  details_submitted: boolean;
+  payouts_enabled: boolean;
+} | null, false> & AsyncStoreProperty<"transactions", [{
+  cursor?: string;
+  limit?: number;
+  type?: TransactionType;
+  customerType?: 'user' | 'team' | 'custom';
+  customerId?: string;
+}], {
+  transactions: Transaction[];
+  nextCursor: string | null;
+}, true> & {
+  createInternalApiKey(options: InternalApiKeyCreateOptions): Promise<InternalApiKeyFirstView>;
+  createTeamPermissionDefinition(data: AdminTeamPermissionDefinitionCreateOptions): Promise<AdminTeamPermission>;
+  updateTeamPermissionDefinition(permissionId: string, data: AdminTeamPermissionDefinitionUpdateOptions): Promise<void>;
+  deleteTeamPermissionDefinition(permissionId: string): Promise<void>;
+  /**
+   * @param options.query Free-text search; matches against permission ID and description.
+   */
+  listTeamPermissionDefinitionsPaginated(options: {
+    limit: number;
+    cursor?: string;
+    query?: string;
+  }): Promise<{
+    items: AdminTeamPermissionDefinition[];
+    nextCursor: string | null;
+  }>;
+  createProjectPermissionDefinition(data: AdminProjectPermissionDefinitionCreateOptions): Promise<AdminProjectPermission>;
+  updateProjectPermissionDefinition(permissionId: string, data: AdminProjectPermissionDefinitionUpdateOptions): Promise<void>;
+  deleteProjectPermissionDefinition(permissionId: string): Promise<void>;
+  useSvixToken(): {
+    token: string;
+    url: string | undefined;
+  };
+  sendTestEmail(options: {
+    recipientEmail: string;
+    emailConfig: EmailConfig;
+  }): Promise<Result<undefined, {
+    errorMessage: string;
+  }>>;
+  sendTestWebhook(options: {
+    endpointId: string;
+  }): Promise<Result<undefined, {
+    errorMessage: string;
+  }>>;
+  sendSignInInvitationEmail(email: string, callbackUrl: string): Promise<void>;
+  listSentEmails(): Promise<AdminSentEmail[]>;
+  setupManagedEmailProvider(options: {
+    subdomain: string;
+    senderLocalPart: string;
+  }): Promise<ManagedEmailProviderSetupResult>;
+  checkManagedEmailStatus(options: {
+    domainId: string;
+    subdomain: string;
+    senderLocalPart: string;
+  }): Promise<ManagedEmailProviderStatus>;
+  listManagedEmailDomains(): Promise<ManagedEmailProviderListItem[]>;
+  applyManagedEmailProvider(options: {
+    domainId: string;
+  }): Promise<{
+    status: "applied";
+  }>;
+  deleteManagedEmailDomain(options: {
+    resendDomainId: string;
+  }): Promise<{
+    status: "deleted";
+  }>;
+  useEmailTheme(id: string): {
+    displayName: string;
+    tsxSource: string;
+  };
+  createEmailTheme(displayName: string): Promise<{
+    id: string;
+  }>;
+  updateEmailTheme(id: string, tsxSource: string): Promise<void>;
+  deleteEmailTheme(id: string): Promise<void>;
+  saveChatMessage(threadId: string, message: any): Promise<void>;
+  listChatMessages(threadId: string): Promise<{
+    messages: Array<any>;
+  }>;
+  rewriteTemplateSourceWithAI(templateTsxSource: string): Promise<{
+    tsxSource: string;
+  }>;
+  updateEmailTemplate(id: string, tsxSource: string, themeId: string | null | false): Promise<{
+    renderedHtml: string;
+  }>;
+  createEmailTemplate(displayName: string): Promise<{
+    id: string;
+  }>;
+  deleteEmailTemplate(id: string): Promise<void>;
+  setupPayments(): Promise<{
+    url: string;
+  }>;
+  createStripeWidgetAccountSession(): Promise<{
+    client_secret: string;
+  }>;
+  getPaymentMethodConfigs(): Promise<{
+    configId: string;
+    methods: Array<{
+      id: string;
+      name: string;
+      enabled: boolean;
+      available: boolean;
+      overridable: boolean;
+    }>;
+  } | null>;
+  updatePaymentMethodConfigs(configId: string, updates: Record<string, 'on' | 'off'>): Promise<void>;
+  createEmailDraft(options: {
+    displayName: string;
+    themeId?: string | undefined | false;
+    tsxSource?: string;
+  }): Promise<{
+    id: string;
+  }>;
+  updateEmailDraft(id: string, data: {
+    displayName?: string;
+    themeId?: string | undefined | false;
+    tsxSource?: string;
+  }): Promise<void>;
+  deleteEmailDraft(id: string): Promise<void>;
+  refreshEmailDrafts(): Promise<void>;
+  createItemQuantityChange(options: ({
+    userId: string;
+    itemId: string;
+    quantity: number;
+    expiresAt?: string;
+    description?: string;
+  } | {
+    teamId: string;
+    itemId: string;
+    quantity: number;
+    expiresAt?: string;
+    description?: string;
+  } | {
+    customCustomerId: string;
+    itemId: string;
+    quantity: number;
+    expiresAt?: string;
+    description?: string;
+  })): Promise<void>;
+  refundTransaction(options: {
+    type: "subscription" | "one-time-purchase";
+    id: string;
+    invoiceId?: string;
+    amountUsd: MoneyAmount;
+    endAction?: "now" | "at-period-end";
+  }): Promise<{
+    refundTransactionId: string;
+  }>;
+  queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse>;
+  getAnalyticsClickmap(options: AnalyticsClickmapOptions): Promise<AnalyticsClickmapResponse>;
+  createAnalyticsClickmapToken(options: {
+    origin: string;
+  }): Promise<AnalyticsClickmapTokenResponse>;
+  listSessionReplays(options?: ListSessionReplaysOptions): Promise<ListSessionReplaysResult>;
+  getSessionReplay(sessionReplayId: string): Promise<AdminSessionReplay>;
+  listSessionReplayChunks(sessionReplayId: string, options?: ListSessionReplayChunksOptions): Promise<ListSessionReplayChunksResult>;
+  getSessionReplayChunkEvents(sessionReplayId: string, chunkId: string): Promise<AdminGetSessionReplayChunkEventsResponse>;
+  getSessionReplayEvents(sessionReplayId: string, options?: {
+    offset?: number;
+    limit?: number;
+  }): Promise<SessionReplayAllEventsResult>;
+  listOutboxEmails(options?: EmailOutboxListOptions): Promise<EmailOutboxListResult>;
+  getOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+  updateOutboxEmail(id: string, options: EmailOutboxUpdateOptions): Promise<AdminEmailOutbox>;
+  pauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+  unpauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+  cancelOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+} & StackServerApp<HasTokenStore, ProjectId>);
+/** @deprecated Use `HexclaveAdminAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackAdminAppConstructor = {
+  new <HasTokenStore extends boolean, ProjectId extends string>(options: StackAdminAppConstructorOptions<HasTokenStore, ProjectId>): StackAdminApp<HasTokenStore, ProjectId>;
+  new (options: StackAdminAppConstructorOptions<boolean, string>): StackAdminApp<boolean, string>;
+};
+type HexclaveAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackAdminAppConstructorOptions<HasTokenStore, ProjectId>;
+type HexclaveAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackAdminApp<HasTokenStore, ProjectId>;
+type HexclaveAdminAppConstructor = StackAdminAppConstructor;
+declare const HexclaveAdminApp: HexclaveAdminAppConstructor;
+/** @deprecated Use `HexclaveAdminApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+declare const StackAdminApp: StackAdminAppConstructor;
+//#endregion
+//#region src/lib/hexclave-app/projects/index.d.ts
+/**
+ * SDK type for pushed config source (camelCase for SDK).
+ * Represents where the branch config was pushed from.
+ */
+type PushedConfigSource = {
+  type: "pushed-from-github";
+  owner: string;
+  repo: string;
+  branch: string;
+  commitHash: string;
+  configFilePath: string;
+  workflowPath?: string;
+} | {
+  type: "pushed-from-unknown";
+} | {
+  type: "unlinked";
+};
+type PushConfigOptions = {
+  /**
+   * The source of this config push.
+   */
+  source: PushedConfigSource;
+};
+type Project = {
+  readonly id: string;
+  readonly displayName: string;
+  readonly pushedConfigError: {
+    message: string;
+  } | null;
+  readonly configWarnings: {
+    message: string;
+  }[];
+  readonly config: ProjectConfig;
+};
+type AdminProject = {
+  readonly id: string;
+  readonly displayName: string;
+  readonly description: string | null;
+  readonly createdAt: Date;
+  readonly isProductionMode: boolean;
+  readonly isDevelopmentEnvironment: boolean;
+  readonly ownerTeamId: string | null;
+  readonly onboardingStatus: ProjectOnboardingStatus;
+  readonly onboardingState: NonNullable<ProjectsCrud["Admin"]["Read"]["onboarding_state"]> | null;
+  readonly logoUrl: string | null | undefined;
+  readonly logoFullUrl: string | null | undefined;
+  readonly logoDarkModeUrl: string | null | undefined;
+  readonly logoFullDarkModeUrl: string | null | undefined;
+  readonly config: AdminProjectConfig;
+  update(this: AdminProject, update: AdminProjectUpdateOptions): Promise<void>;
+  delete(this: AdminProject): Promise<void>;
+  getConfig(this: AdminProject): Promise<CompleteConfig>;
+  useConfig(this: AdminProject): CompleteConfig;
+  /**
+   * Updates the environment's config by merging the provided config into the existing config.
+   *
+   * Changes made with `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`
+   * config was pushed after the changes were made with `updateConfig`. This is best for environment-specific
+   * configuration like secrets, API keys, and other values that you wouldn't push into a source repository.
+   */
+  updateConfig(this: AdminProject, config: EnvironmentConfigOverrideOverride): Promise<void>;
+  /**
+   * Pushes a config, replacing any previous config pushed with `pushConfig`.
+   *
+   * **Note:** This function does **not** replace any changes made with `updateConfig`. Changes made with
+   * `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`
+   * config was pushed after the changes were made with `updateConfig`.
+   *
+   * This is useful for programmatically deploying configuration. More often than not, you'll want to use
+   * `updateConfig` instead.
+   */
+  pushConfig(this: AdminProject, config: EnvironmentConfigOverrideOverride, options: PushConfigOptions): Promise<void>;
+  /**
+   * Updates the pushed config by merging the provided config into the existing pushed config.
+   *
+   * **Warning:** This is almost always **not** the function you want to call. Changes made with
+   * `updatePushedConfig` will be replaced entirely the next time `pushConfig` is called. Consider using
+   * `pushConfig` to set the full pushed config, or `updateConfig` for environment-specific values that
+   * should persist across pushes.
+   *
+   * This function is useful for making temporary modifications to the pushed config before the next push.
+   */
+  updatePushedConfig(this: AdminProject, config: EnvironmentConfigOverrideOverride): Promise<void>;
+  /**
+   * Gets the source metadata for the pushed config, indicating where it was pushed from.
+   *
+   * The source can be:
+   * - `pushed-from-github`: Config was pushed from a GitHub repository
+   * - `pushed-from-unknown`: Config was pushed via CLI but source details unknown
+   * - `unlinked`: Config can be edited directly on the dashboard
+   */
+  getPushedConfigSource(this: AdminProject): Promise<PushedConfigSource>;
+  /**
+   * Unlinks the pushed config source, setting it to "unlinked".
+   * This allows the config to be edited directly on the dashboard without external push restrictions.
+   */
+  unlinkPushedConfigSource(this: AdminProject): Promise<void>;
+  /**
+   * Resets (removes) specific keys from the config override at the specified level.
+   * Uses the same nested key logic as the override algorithm: resetting key "a.b" also resets "a.b.c".
+   *
+   * This is useful when updating the pushed config (branch level) and wanting to remove the same keys
+   * from the environment config override so that the branch config values take precedence.
+   */
+  resetConfigOverrideKeys(this: AdminProject, level: "branch" | "environment", keys: string[]): Promise<void>;
+  /**
+   * Gets the raw config override at the specified level (before merging/defaults).
+   * Useful for inspecting exactly what's been set at each level.
+   */
+  getConfigOverride(this: AdminProject, level: "branch" | "environment"): Promise<Record<string, unknown>>;
+  /**
+   * Replaces the entire config override at the specified level.
+   * For branch level, preserves the existing source metadata.
+   */
+  replaceConfigOverride(this: AdminProject, level: "branch" | "environment", config: Record<string, unknown>): Promise<void>;
+  getProductionModeErrors(this: AdminProject): Promise<ProductionModeError[]>;
+  useProductionModeErrors(this: AdminProject): ProductionModeError[];
+} & Project;
+type AdminOwnedProject = {
+  readonly app: StackAdminApp<false>;
+} & AdminProject;
+type AdminProjectUpdateOptions = {
+  displayName?: string;
+  description?: string;
+  isProductionMode?: boolean;
+  onboardingStatus?: ProjectOnboardingStatus;
+  /**
+   * Updates `project.requirePublishableClientKey` in the project-level config override.
+   */
+  requirePublishableClientKey?: boolean;
+  logoUrl?: string | null;
+  logoFullUrl?: string | null;
+  logoDarkModeUrl?: string | null;
+  logoFullDarkModeUrl?: string | null;
+  config?: AdminProjectConfigUpdateOptions;
+};
+declare function adminProjectUpdateOptionsToCrud(options: AdminProjectUpdateOptions): ProjectsCrud["Admin"]["Update"];
+type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'> & {
+  displayName: string;
+  teamId: string;
+  isDevelopmentEnvironment?: boolean;
+};
+declare function adminProjectCreateOptionsToCrud(options: AdminProjectCreateOptions): AdminUserProjectsCrud["Server"]["Create"];
+//#endregion
+//#region src/lib/hexclave-app/apps/interfaces/client-app.d.ts
+/** @deprecated Use `HexclaveClientAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackClientAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = {
+  baseUrl?: string | {
+    browser: string;
+    server: string;
+  };
+  extraRequestHeaders?: Record<string, string>;
+  projectId?: ProjectId;
+  publishableClientKey?: string;
+  urls?: HandlerUrlOptions;
+  oauthScopesOnSignIn?: Partial<OAuthScopesOnSignIn>;
+  tokenStore?: TokenStoreInit<HasTokenStore>;
+  redirectMethod?: RedirectMethod;
+  inheritsFrom?: StackClientApp<any, any>;
+  /**
+   * Whether to show the Hexclave dev tool indicator in browser-like environments.
+   *
+   * - `true`: always show
+   * - `false`: never show
+   * - `"auto"` (default): show based on NODE_ENV or origin heuristics
+   */
+  devTool?: boolean | "auto";
+  /**
+   * By default, the Stack app will automatically prefetch some data from Stack's server when this app is first
+   * constructed. This improves the performance of your app, but will create network requests that are unnecessary if
+   * the app is never used or disposed of immediately. To disable this behavior, set this option to true.
+   */
+  noAutomaticPrefetch?: boolean;
+  /**
+   * Options for analytics and session recording. Replays are enabled by default;
+   * set `{ replays: { enabled: false } }` to opt out.
+   */
+  analytics?: AnalyticsOptions;
+} & ({
+  tokenStore: TokenStoreInit<HasTokenStore>;
+} | {
+  tokenStore?: undefined;
+  inheritsFrom: StackClientApp<HasTokenStore, any>;
+}) & (string extends ProjectId ? unknown : ({
+  projectId: ProjectId;
+} | {
+  inheritsFrom: StackClientApp<any, ProjectId>;
+}));
+/** @deprecated Use `HexclaveClientAppJson` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {
+  inheritsFrom?: undefined;
+} & {
+  uniqueIdentifier: string;
+};
+/** @deprecated Use `HexclaveClientApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = ({
+  readonly projectId: ProjectId;
+  /**
+   * The version of the Hexclave SDK.
+   */
+  readonly version: string;
+  /**
+   * @deprecated Do not use `app.urls` for navigation. It is static and does not include runtime redirect-back,
+   * cross-domain auth, or sign-out state. Use the matching `redirectToXyz()` method instead, for example
+   * `redirectToSignIn()`, `redirectToSignUp()`, `redirectToSignOut()`, or `redirectToAccountSettings()`.
+   */
+  readonly urls: Readonly<ResolvedHandlerUrls>;
+  signInWithOAuth(provider: string, options?: {
+    returnTo?: string;
+  }): Promise<void>;
+  signInWithCredential(options: {
+    email: string;
+    password: string;
+    noRedirect?: boolean;
+  }): Promise<Result<undefined, KnownErrors["EmailPasswordMismatch"] | KnownErrors["InvalidTotpCode"]>>;
+  signUpWithCredential(options: {
+    email: string;
+    password: string;
+    noRedirect?: boolean;
+  } & ({
+    noVerificationCallback: true;
+  } | {
+    noVerificationCallback?: false;
+    verificationCallbackUrl?: string;
+  })): Promise<Result<undefined, KnownErrors["UserWithEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | KnownErrors["BotChallengeFailed"]>>;
+  signInWithPasskey(): Promise<Result<undefined, KnownErrors["PasskeyAuthenticationFailed"] | KnownErrors["InvalidTotpCode"] | KnownErrors["PasskeyWebAuthnError"]>>;
+  callOAuthCallback(): Promise<boolean>;
+  promptCliLogin(options: {
+    appUrl: string;
+    expiresInMillis?: number;
+    anonRefreshToken?: string;
+    promptLink?: (url: string, loginCode: string) => void;
+  }): Promise<Result<string, KnownErrors["CliAuthError"] | KnownErrors["CliAuthExpiredError"] | KnownErrors["CliAuthUsedError"]>>;
+  sendForgotPasswordEmail(email: string, options?: {
+    callbackUrl?: string;
+  }): Promise<Result<undefined, KnownErrors["UserNotFound"]>>;
+  sendMagicLinkEmail(email: string, options?: {
+    callbackUrl?: string;
+  }): Promise<Result<{
+    nonce: string;
+  }, KnownErrors["RedirectUrlNotWhitelisted"] | KnownErrors["BotChallengeFailed"]>>;
+  resetPassword(options: {
+    code: string;
+    password: string;
+  }): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+  verifyPasswordResetCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+  verifyTeamInvitationCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"] | KnownErrors["TeamInvitationEmailMismatch"]>>;
+  acceptTeamInvitation(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"] | KnownErrors["TeamInvitationEmailMismatch"]>>;
+  getTeamInvitationDetails(code: string): Promise<Result<{
+    teamDisplayName: string;
+  }, KnownErrors["VerificationCodeError"] | KnownErrors["TeamInvitationEmailMismatch"]>>;
+  verifyEmail(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+  signInWithMagicLink(code: string, options?: {
+    noRedirect?: boolean;
+  }): Promise<Result<undefined, KnownErrors["VerificationCodeError"] | KnownErrors["InvalidTotpCode"]>>;
+  signInWithMfa(otp: string, code: string, options?: {
+    noRedirect?: boolean;
+  }): Promise<Result<undefined, KnownErrors["VerificationCodeError"] | KnownErrors["InvalidTotpCode"]>>;
+  redirectToOAuthCallback(): Promise<void>;
+  getConvexClientAuth(options: HasTokenStore extends false ? {
+    tokenStore: TokenStoreInit;
+  } : {
+    tokenStore?: TokenStoreInit;
+  }): (args: {
+    forceRefreshToken: boolean;
+  }) => Promise<string | null>;
+  getConvexHttpClientAuth(options: {
+    tokenStore: TokenStoreInit;
+  }): Promise<string>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): ProjectCurrentUser<ProjectId>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): ProjectCurrentUser<ProjectId>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): ProjectCurrentUser<ProjectId>;
+  useUser(options?: GetCurrentUserOptions<HasTokenStore>): ProjectCurrentUser<ProjectId> | null;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): Promise<ProjectCurrentUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): Promise<ProjectCurrentUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): Promise<ProjectCurrentUser<ProjectId>>;
+  getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentUser<ProjectId> | null>;
+  cancelSubscription(options: {
+    productId: string;
+    subscriptionId?: string;
+  } | {
+    productId: string;
+    subscriptionId?: string;
+    teamId: string;
+  }): Promise<void>;
+  getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'token';
+  }): Promise<TokenPartialUser | null>;
+  getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'convex';
+  }): Promise<TokenPartialUser | null>;
+  getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): Promise<SyncedPartialUser | TokenPartialUser | null>;
+  usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'token';
+  }): TokenPartialUser | null;
+  usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'convex';
+  }): TokenPartialUser | null;
+  usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): SyncedPartialUser | TokenPartialUser | null;
+  useNavigate(): (to: string) => void;
+  [hexclaveAppInternalsSymbol]: {
+    toClientJson(): StackClientAppJson<HasTokenStore, ProjectId>;
+    setCurrentUser(userJsonPromise: Promise<CurrentUserCrud['Client']['Read'] | null>): void;
+    getConstructorOptions(): StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {
+      inheritsFrom?: undefined;
+    };
+    sendSessionReplayBatch(body: string, options: {
+      keepalive: boolean;
+    }): Promise<Result<Response, Error>>;
+    sendAnalyticsEventBatch(body: string, options: {
+      keepalive: boolean;
+    }): Promise<Result<Response, Error>>;
+    addRequestListener(listener: RequestListener): () => void;
+    sendRequest(path: string, requestOptions: RequestInit, requestType?: "client" | "server" | "admin"): Promise<Response>;
+    getUrls(): Readonly<ResolvedHandlerUrls>;
+    getRedirectMethod(): RedirectMethod;
+    redirectToUrl(url: string | URL, options?: {
+      replace?: boolean;
+    }): Promise<void>;
+    getRedirectToHandlerUrl(handlerName: keyof HandlerUrls, options?: RedirectToOptions): Promise<string>;
+    redirectToHandler(handlerName: keyof HandlerUrls, options?: RedirectToOptions): Promise<void>;
+    signInWithTokens(tokens: {
+      accessToken: string;
+      refreshToken: string;
+    }): Promise<void>;
+    awaitPendingAuthResolutions(): Promise<void>;
+  };
+} & AsyncStoreProperty<"project", [], Project, false> & AsyncStoreProperty<"item", [{
+  itemId: string;
+  userId: string;
+} | {
+  itemId: string;
+  teamId: string;
+} | {
+  itemId: string;
+  customCustomerId: string;
+}], Item, false> & AsyncStoreProperty<"products", [options: CustomerProductsRequestOptions], CustomerProductsList, true> & AsyncStoreProperty<"invoices", [options: CustomerInvoicesRequestOptions], CustomerInvoicesList, true> & { [K in `redirectTo${Capitalize<keyof Omit<HandlerUrls, 'handler' | 'oauthCallback'>>}`]: (options?: RedirectToOptions) => Promise<void> } & AuthLike<HasTokenStore extends false ? {
+  tokenStore: TokenStoreInit;
+} : {
+  tokenStore?: TokenStoreInit;
+}>);
+/** @deprecated Use `HexclaveClientAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+type StackClientAppConstructor = {
+  new <TokenStoreType extends string, HasTokenStore extends (TokenStoreType extends {} ? true : boolean), ProjectId extends string>(options: StackClientAppConstructorOptions<HasTokenStore, ProjectId>): StackClientApp<HasTokenStore, ProjectId>;
+  new (options: StackClientAppConstructorOptions<boolean, string>): StackClientApp<boolean, string>;
+  [hexclaveAppInternalsSymbol]: {
+    fromClientJson<HasTokenStore extends boolean, ProjectId extends string>(json: StackClientAppJson<HasTokenStore, ProjectId>): StackClientApp<HasTokenStore, ProjectId>;
+  };
+};
+type HexclaveClientAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId>;
+type HexclaveClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppJson<HasTokenStore, ProjectId>;
+type HexclaveClientApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackClientApp<HasTokenStore, ProjectId>;
+type HexclaveClientAppConstructor = StackClientAppConstructor;
+declare const HexclaveClientApp: HexclaveClientAppConstructor;
+/** @deprecated Use `HexclaveClientApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */
+declare const StackClientApp: StackClientAppConstructor;
+//#endregion
+export { serverTeamCreateOptionsToCrud as $, HexclaveServerApp as A, ServerListUsersOptions as B, HexclaveAdminAppConstructorOptions as C, UserExtra as Ct, StackAdminApp as D, userUpdateOptionsToCrud as Dt, ManagedEmailProviderStatus as E, serverUserUpdateOptionsToCrud as Et, StackServerAppConstructorOptions as F, ServerTeamUser as G, ServerTeamCreateOptions as H, EditableTeamMemberProfile as I, TeamInvitation as J, Team as K, ReceivedTeamInvitation as L, HexclaveServerAppConstructorOptions as M, StackServerApp as N, StackAdminAppConstructor as O, withUserDestructureGuard as Ot, StackServerAppConstructor as P, TeamUser as Q, SentTeamInvitation as R, HexclaveAdminAppConstructor as S, User as St, ManagedEmailProviderSetupResult as T, serverUserCreateOptionsToCrud as Tt, ServerTeamMemberProfile as U, ServerTeam as V, ServerTeamUpdateOptions as W, TeamMemberProfileUpdateOptions as X, TeamMemberProfile as Y, TeamUpdateOptions as Z, adminProjectUpdateOptionsToCrud as _, ServerUserCreateOptions as _t, StackClientApp as a, BaseUser as at, EmailOutboxUpdateOptions as b, SyncedPartialUser as bt, StackClientAppJson as c, CurrentServerUser as ct, AdminProjectCreateOptions as d, OAuthProvider as dt, serverTeamUpdateOptionsToCrud as et, AdminProjectUpdateOptions as f, ProjectCurrentServerUser as ft, adminProjectCreateOptionsToCrud as g, ServerUser as gt, PushedConfigSource as h, ServerOAuthProvider as ht, HexclaveClientAppJson as i, Auth as it, HexclaveServerAppConstructor as j, StackAdminAppConstructorOptions as k, AdminOwnedProject as l, CurrentUser as lt, PushConfigOptions as m, ServerBaseUser as mt, HexclaveClientAppConstructor as n, teamUpdateOptionsToCrud as nt, StackClientAppConstructor as o, CurrentInternalServerUser as ot, Project as p, ProjectCurrentUser as pt, TeamCreateOptions as q, HexclaveClientAppConstructorOptions as r, ActiveSession as rt, StackClientAppConstructorOptions as s, CurrentInternalUser as st, HexclaveClientApp as t, teamCreateOptionsToCrud as tt, AdminProject as u, InternalUserExtra as ut, EmailOutboxListOptions as v, ServerUserUpdateOptions as vt, ManagedEmailProviderListItem as w, UserUpdateOptions as wt, HexclaveAdminApp as x, TokenPartialUser as xt, EmailOutboxListResult as y, SyncedPartialServerUser as yt, ServerListTeamsOptions as z };
+//# sourceMappingURL=client-app-Bi8p4lxS.d.ts.map