@hexclave/next 1.0.41 → 1.0.43

package/dist/admin-app-impl-DgLL2Tua.d.ts

@@ -0,0 +1,1282 @@
+import { _ as ResolvedHandlerUrls, a as EmailConfig, f as HandlerUrls, g as RequestLike, h as RedirectToOptions, m as RedirectMethod, o as GetCurrentPartialUserOptions, p as OAuthScopesOnSignIn, r as ConvexCtx, s as GetCurrentUserOptions, u as HandlerUrlOptions, v as TokenStoreInit, y as hexclaveAppInternalsSymbol } from "./common-B2gkWlXX.js";
+import { c as CustomerInvoicesRequestOptions, d as CustomerProductsList, g as ServerItem, h as Item, m as InlineProduct, n as CustomerBilling, o as CustomerInvoicesList, p as CustomerProductsRequestOptions, t as Customer } from "./index-DbiyXho6.js";
+import { D as SendEmailOptions, S as AdminSentEmail, t as AdminEmailOutbox, w as EmailDeliveryInfo } from "./index-CBDR4cNg.js";
+import { a as InternalApiKeyFirstView, i as InternalApiKeyCreateOptions, n as InternalApiKeyBase, r as InternalApiKeyBaseCrudRead, t as InternalApiKey } from "./index-TUtJOdMm.js";
+import { a as AdminTeamPermission, c as AdminTeamPermissionDefinitionUpdateOptions, i as AdminProjectPermissionDefinitionUpdateOptions, n as AdminProjectPermissionDefinition, o as AdminTeamPermissionDefinition, r as AdminProjectPermissionDefinitionCreateOptions, s as AdminTeamPermissionDefinitionCreateOptions, t as AdminProjectPermission, u as TeamPermission } from "./index-DSzMf-rS.js";
+import { t as PlanUsage } from "./index-D7Vdg30O.js";
+import { t as DataVaultStore } from "./index-BSr2pd22.js";
+import { t as ApiKey } from "./index-fOYcs4NH.js";
+import { n as DeprecatedOAuthConnection, r as OAuthConnection } from "./index-C_kxyHao.js";
+import { i as ServerContactChannel, t as ContactChannel } from "./index-DN04TjLM.js";
+import { t as NotificationCategory } from "./index-O3hJsHSl.js";
+import { B as ServerListUsersOptions, Ct as UserExtra, D as StackAdminApp, E as ManagedEmailProviderStatus, F as StackServerAppConstructorOptions, G as ServerTeamUser, H as ServerTeamCreateOptions, I as EditableTeamMemberProfile, K as Team, L as ReceivedTeamInvitation, Q as TeamUser, R as SentTeamInvitation, T as ManagedEmailProviderSetupResult, V as ServerTeam, _t as ServerUserCreateOptions, a as StackClientApp, at as BaseUser, b as EmailOutboxUpdateOptions, c as StackClientAppJson, dt as OAuthProvider, f as AdminProjectUpdateOptions, ft as ProjectCurrentServerUser, gt as ServerUser, ht as ServerOAuthProvider, it as Auth, k as StackAdminAppConstructorOptions, l as AdminOwnedProject, p as Project, pt as ProjectCurrentUser, rt as ActiveSession, s as StackClientAppConstructorOptions, u as AdminProject, ut as InternalUserExtra, w as ManagedEmailProviderListItem, wt as UserUpdateOptions, xt as TokenPartialUser, z as ServerListTeamsOptions } from "./client-app-Bi8p4lxS.js";
+import { a as ListSessionReplaysOptions, i as ListSessionReplayChunksResult, o as ListSessionReplaysResult, r as ListSessionReplayChunksOptions, s as SessionReplayAllEventsResult, t as AdminSessionReplay } from "./index-hYjsGKNc.js";
+import { t as AnalyticsOptions } from "./session-replay-CQ849yH1.js";
+import { t as CookieHelper } from "./cookie-DTOQvCYn.js";
+import { t as AdminEmailTemplate } from "./index-Bo5DpPFH.js";
+import { t as TokenObject } from "./common-BK_sydxF.js";
+import { t as CrossDomainHandoffParams } from "./redirect-page-urls-NUHUchgR.js";
+import { HexclaveAdminInterface, HexclaveClientInterface, HexclaveServerInterface, KnownError, KnownErrors } from "@hexclave/shared";
+import { CurrentUserCrud } from "@hexclave/shared/dist/interface/crud/current-user";
+import { Result } from "@hexclave/shared/dist/utils/results";
+import { ProviderType } from "@hexclave/shared/dist/utils/oauth";
+import { RequestListener } from "@hexclave/shared/dist/interface/client-interface";
+import { RestrictedReason } from "@hexclave/shared/dist/schema-fields";
+import * as yup from "yup";
+import { ClientProjectsCrud, ProjectsCrud } from "@hexclave/shared/dist/interface/crud/projects";
+import { CompleteConfig } from "@hexclave/shared/dist/config/schema";
+import { AnalyticsClickmapOptions, AnalyticsClickmapResponse, AnalyticsClickmapTokenResponse, MetricsResponse, MetricsUserCounts, UserActivityResponse } from "@hexclave/shared/dist/interface/admin-metrics";
+import { AnalyticsQueryOptions, AnalyticsQueryResponse } from "@hexclave/shared/dist/interface/crud/analytics";
+import { AdminGetSessionReplayChunkEventsResponse } from "@hexclave/shared/dist/interface/crud/session-replays";
+import { Transaction, TransactionType } from "@hexclave/shared/dist/interface/crud/transactions";
+import { InternalSession } from "@hexclave/shared/dist/sessions";
+import { MoneyAmount } from "@hexclave/shared/dist/utils/currency-constants";
+import { InternalApiKeyCreateCrudResponse } from "@hexclave/shared/dist/interface/admin-interface";
+import { InternalApiKeysCrud } from "@hexclave/shared/dist/interface/crud/internal-api-keys";
+import { ProjectPermissionDefinitionsCrud, ProjectPermissionsCrud } from "@hexclave/shared/dist/interface/crud/project-permissions";
+import { TeamPermissionDefinitionsCrud, TeamPermissionsCrud } from "@hexclave/shared/dist/interface/crud/team-permissions";
+import { TeamsCrud } from "@hexclave/shared/dist/interface/crud/teams";
+import { TeamApiKeysCrud, UserApiKeysCrud, teamApiKeysCreateOutputSchema, userApiKeysCreateOutputSchema } from "@hexclave/shared/dist/interface/crud/project-api-keys";
+import { UsersCrud } from "@hexclave/shared/dist/interface/crud/users";
+import { ContactChannelsCrud } from "@hexclave/shared/dist/interface/crud/contact-channels";
+import { EmailTemplateCrud } from "@hexclave/shared/dist/interface/crud/email-templates";
+import { ItemCrud } from "@hexclave/shared/dist/interface/crud/items";
+import { NotificationPreferenceCrud } from "@hexclave/shared/dist/interface/crud/notification-preferences";
+import { OAuthProviderCrud } from "@hexclave/shared/dist/interface/crud/oauth-providers";
+import { TeamInvitationCrud } from "@hexclave/shared/dist/interface/crud/team-invitation";
+import { TeamMemberProfilesCrud } from "@hexclave/shared/dist/interface/crud/team-member-profiles";
+import { CustomerInvoicesListResponse } from "@hexclave/shared/dist/interface/crud/invoices";
+import { CustomerProductsListResponse } from "@hexclave/shared/dist/interface/crud/products";
+import { SessionsCrud } from "@hexclave/shared/dist/interface/crud/sessions";
+import { Store } from "@hexclave/shared/dist/utils/stores";
+import * as cookie from "cookie";
+
+//#region src/lib/hexclave-app/apps/implementations/client-app-impl.d.ts
+type HexclaveClientAppImplConstructorOptionsResolved<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {
+  inheritsFrom?: undefined;
+};
+declare class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, ProjectId extends string = string> implements StackClientApp<HasTokenStore, ProjectId> {
+  /**
+   * There is a circular dependency between the admin app and the client app, as the former inherits from the latter and
+   * the latter needs to use the former when creating a new instance of an internal project.
+   *
+   * To break it, we set the admin app here lazily instead of importing it directly. This variable is set by ./index.ts,
+   * which imports both this file and ./admin-app-impl.ts.
+   */
+  static readonly LazyStackAdminAppImpl: {
+    value: typeof _HexclaveAdminAppImplIncomplete | undefined;
+  };
+  protected readonly _options: HexclaveClientAppImplConstructorOptionsResolved<HasTokenStore, ProjectId>;
+  protected readonly _extraOptions: {
+    uniqueIdentifier?: string;
+    checkString?: string;
+    interface?: HexclaveClientInterface;
+  } | undefined;
+  protected _uniqueIdentifier: string | undefined;
+  protected _interface: HexclaveClientInterface;
+  protected readonly _tokenStoreInit: TokenStoreInit<HasTokenStore>;
+  protected readonly _redirectMethod: RedirectMethod | undefined;
+  protected readonly _urlOptions: HandlerUrlOptions;
+  protected readonly _oauthScopesOnSignIn: Partial<OAuthScopesOnSignIn>;
+  private readonly _analyticsOptions;
+  private _sessionRecorder;
+  private _eventTracker;
+  private __DEMO_ENABLE_SLIGHT_FETCH_DELAY;
+  private readonly _ownedAdminApps;
+  private readonly _currentUserCache;
+  private readonly _currentProjectCache;
+  private readonly _ownedProjectsCache;
+  private readonly _currentUserPermissionsCache;
+  private readonly _currentUserProjectPermissionsCache;
+  private readonly _currentUserTeamsCache;
+  /** @deprecated Used by legacy getConnectedAccount(providerId) — uses old per-provider access token endpoint */
+  private readonly _currentUserOAuthConnectionAccessTokensCache;
+  /** @deprecated Used by legacy getConnectedAccount(providerId) — combines token check + redirect */
+  private readonly _currentUserOAuthConnectionCache;
+  private readonly _currentUserConnectedAccountsCache;
+  private readonly _currentUserOAuthConnectionAccessTokensByAccountCache;
+  private readonly _currentUserValidConnectedAccountForProviderCache;
+  private readonly _teamMemberProfilesCache;
+  private readonly _teamInvitationsCache;
+  private readonly _currentUserTeamProfileCache;
+  private readonly _currentUserTeamInvitationsCache;
+  private readonly _clientContactChannelsCache;
+  private readonly _userApiKeysCache;
+  private readonly _teamApiKeysCache;
+  private readonly _notificationCategoriesCache;
+  private readonly _currentUserOAuthProvidersCache;
+  private readonly _userItemCache;
+  private readonly _teamItemCache;
+  private readonly _customItemCache;
+  private readonly _userProductsCache;
+  private readonly _teamProductsCache;
+  private readonly _customProductsCache;
+  private readonly _userInvoicesCache;
+  private readonly _teamInvoicesCache;
+  private readonly _customerBillingCache;
+  private readonly _convexPartialUserCache;
+  private readonly _trustedParentDomainCache;
+  private _anonymousSignUpInProgress;
+  private _prefetchedCrossDomainHandoffParams;
+  private _prefetchedCrossDomainHandoffParamsFetchedAt;
+  private _isPrefetchingCrossDomainHandoffParams;
+  private _pendingAuthResolutionPromises;
+  protected _createCookieHelper(overrideTokenStoreInit?: TokenStoreInit): Promise<CookieHelper>;
+  /** @deprecated Used by legacy getConnectedAccount(providerId) — combines user check + token check + redirect into one cache */
+  protected _getUserOAuthConnectionCacheFn(options: {
+    getUser: () => Promise<CurrentUserCrud['Client']['Read'] | null>;
+    getOrWaitOAuthToken: () => Promise<{
+      accessToken: string;
+    } | null>;
+    useOAuthToken: () => {
+      accessToken: string;
+    } | null;
+    providerId: ProviderType;
+    scope: string | null;
+  } & ({
+    redirect: true;
+    session: InternalSession | null;
+  } | {
+    redirect: false;
+  })): Promise<DeprecatedOAuthConnection | null>;
+  protected _createOAuthConnectionFromCrudItem(item: {
+    provider: string;
+    provider_account_id: string;
+  }, session: InternalSession): OAuthConnection;
+  constructor(options: StackClientAppConstructorOptions<HasTokenStore, ProjectId>, extraOptions?: {
+    uniqueIdentifier?: string;
+    checkString?: string;
+    interface?: HexclaveClientInterface;
+  });
+  protected _initUniqueIdentifier(): void;
+  protected _trackPendingAuthResolution(callback: () => Promise<unknown>): void;
+  protected _awaitPendingAuthResolutions(overrideTokenStoreInit?: TokenStoreInit, options?: {
+    awaitPendingAuthResolutions?: boolean;
+  }): Promise<void>;
+  protected _usePendingAuthResolutions(overrideTokenStoreInit?: TokenStoreInit): void;
+  protected _isOAuthCallbackUrlHosted(): boolean;
+  protected _currentUrlLooksLikeOAuthCallback(): boolean;
+  protected _currentUrlLooksLikeOAuthCallbackError(): boolean;
+  protected _currentUrlLooksLikeHexclaveOAuthCallback(): boolean;
+  protected _currentUrlLooksLikeNestedCrossDomainOAuthCallback(): boolean;
+  protected _getOAuthCallbackRedirectUri(): string;
+  protected _redirectToOAuthCallbackError(error: KnownError): Promise<void>;
+  protected _handleHostedOAuthCallbackDuringStartup(): Promise<void>;
+  protected _fetchCurrentRefreshTokenIdIfSignedIn(options?: {
+    awaitPendingAuthResolutions?: boolean;
+    overrideTokenStoreInit?: TokenStoreInit;
+  }): Promise<string | null>;
+  protected _addNestedCrossDomainAuthParamsToRedirectUrl(options: {
+    url: string;
+    currentUrl: URL;
+    awaitPendingAuthResolutions?: boolean;
+    overrideTokenStoreInit?: TokenStoreInit;
+  }): Promise<string>;
+  protected _maybeHandleNestedCrossDomainAuth(urlAtConstructionTime?: URL): Promise<boolean>;
+  /**
+   * Cloudflare workers does not allow use of randomness on the global scope (on which the Stack app is probably
+   * initialized). For that reason, we generate the unique identifier lazily when it is first needed instead of in the
+   * constructor.
+   */
+  protected _getUniqueIdentifier(): string;
+  protected _checkFeatureSupport(name: string, options: any): Promise<never>;
+  protected _useCheckFeatureSupport(name: string, options: any): never;
+  protected _memoryTokenStore: Store<TokenObject>;
+  protected _nextServerCookiesTokenStores: WeakMap<object, Store<TokenObject>>;
+  protected _requestTokenStores: WeakMap<RequestLike, Store<TokenObject>>;
+  protected _storedBrowserCookieTokenStore: Store<TokenObject> | null;
+  private _mostRecentQueuedCookieRefreshIndex;
+  protected get _legacyRefreshTokenCookieName(): string;
+  protected get _refreshTokenCookieName(): string;
+  private _getRefreshTokenDefaultCookieNameForSecure;
+  private _getCustomRefreshCookieName;
+  private _getDomainFromCustomRefreshCookieName;
+  private _formatRefreshCookieValue;
+  private _formatAccessCookieValue;
+  private _parseStructuredRefreshCookie;
+  private _extractRefreshTokenFromCookieMap;
+  protected _getTokensFromCookies(cookies: cookie.Cookies): TokenObject;
+  private _getCurrentBrowserCookieTokenStoreValue;
+  protected get _accessTokenCookieName(): string;
+  protected get _legacyAccessTokenCookieName(): string;
+  private _getAllBrowserCookies;
+  private _getRefreshTokenCookieNamePatterns;
+  private _collectRefreshTokenCookieNames;
+  private _prepareRefreshCookieUpdate;
+  private _ensureCrossSubdomainCookieExists;
+  private _queueCustomRefreshCookieUpdate;
+  private _getTrustedRedirectConfig;
+  private _getTrustedParentDomain;
+  protected _getBrowserCookieTokenStore(): Store<TokenObject>;
+  protected _getOrCreateTokenStore(cookieHelper: CookieHelper, overrideTokenStoreInit?: TokenStoreInit): Store<TokenObject>;
+  protected _useTokenStore(overrideTokenStoreInit?: TokenStoreInit): Store<TokenObject>;
+  /**
+   * A map from token stores and session keys to sessions.
+   *
+   * This isn't just a map from session keys to sessions for two reasons:
+   *
+   * - So we can garbage-collect Session objects when the token store is garbage-collected
+   * - So different token stores are separated and don't leak information between each other, eg. if the same user sends two requests to the same server they should get a different session object
+   */
+  private _sessionsByTokenStoreAndSessionKey;
+  protected _getSessionFromTokenStore(tokenStore: Store<TokenObject>): InternalSession;
+  protected _getSession(overrideTokenStoreInit?: TokenStoreInit, options?: {
+    awaitPendingAuthResolutions?: boolean;
+  }): Promise<InternalSession>;
+  protected _useSession(overrideTokenStoreInit?: TokenStoreInit): InternalSession;
+  protected _signInToAccountWithTokens(tokens: {
+    accessToken: string | null;
+    refreshToken: string;
+  }): Promise<void>;
+  protected _getTokenStoreInitForFreshTokens(tokens: {
+    accessToken: string | null;
+    refreshToken: string;
+  }): TokenStoreInit | undefined;
+  protected _hasPersistentTokenStore(overrideTokenStoreInit?: TokenStoreInit): this is StackClientApp<true, ProjectId>;
+  protected _ensurePersistentTokenStore(overrideTokenStoreInit?: TokenStoreInit): asserts this is StackClientApp<true, ProjectId>;
+  protected _isInternalProject(): this is {
+    projectId: "internal";
+  };
+  protected _ensureInternalProject(): asserts this is {
+    projectId: "internal";
+  };
+  protected _clientProjectFromCrud(crud: ClientProjectsCrud['Client']['Read']): Project;
+  protected _clientPermissionFromCrud(crud: TeamPermissionsCrud['Client']['Read'] | ProjectPermissionsCrud['Client']['Read']): TeamPermission;
+  protected _clientTeamUserFromCrud(crud: TeamMemberProfilesCrud['Client']['Read']): TeamUser;
+  protected _clientSentTeamInvitationFromCrud(session: InternalSession, crud: TeamInvitationCrud['Client']['Read']): SentTeamInvitation;
+  protected _clientReceivedTeamInvitationFromCrud(session: InternalSession, crud: TeamInvitationCrud['Client']['Read']): ReceivedTeamInvitation;
+  protected _baseApiKeyFromCrud(crud: TeamApiKeysCrud['Client']['Read'] | UserApiKeysCrud['Client']['Read'] | yup.InferType<typeof teamApiKeysCreateOutputSchema> | yup.InferType<typeof userApiKeysCreateOutputSchema>): Omit<ApiKey<"user", boolean>, "revoke" | "update"> | Omit<ApiKey<"team", boolean>, "revoke" | "update">;
+  protected _clientApiKeyFromCrud(session: InternalSession, crud: TeamApiKeysCrud['Client']['Read']): ApiKey<"team">;
+  protected _clientApiKeyFromCrud(session: InternalSession, crud: UserApiKeysCrud['Client']['Read']): ApiKey<"user">;
+  protected _clientApiKeyFromCrud(session: InternalSession, crud: yup.InferType<typeof teamApiKeysCreateOutputSchema>): ApiKey<"team", true>;
+  protected _clientApiKeyFromCrud(session: InternalSession, crud: yup.InferType<typeof userApiKeysCreateOutputSchema>): ApiKey<"user", true>;
+  protected _clientTeamFromCrud(crud: TeamsCrud['Client']['Read'], session: InternalSession): Team;
+  protected _clientContactChannelFromCrud(crud: ContactChannelsCrud['Client']['Read'], session: InternalSession): ContactChannel;
+  protected _clientNotificationCategoryFromCrud(crud: NotificationPreferenceCrud['Client']['Read'], session: InternalSession): NotificationCategory;
+  protected _clientOAuthProviderFromCrud(crud: OAuthProviderCrud['Client']['Read'], session: InternalSession): OAuthProvider;
+  protected _clientItemFromCrud(crud: ItemCrud['Client']['Read']): Item;
+  protected _customerProductsFromResponse(response: CustomerProductsListResponse): CustomerProductsList;
+  protected _customerInvoicesFromResponse(response: CustomerInvoicesListResponse): CustomerInvoicesList;
+  protected _customerBillingFromResponse(response: {
+    has_customer: boolean;
+    default_payment_method: {
+      id: string;
+      brand: string | null;
+      last4: string | null;
+      exp_month: number | null;
+      exp_year: number | null;
+    } | null;
+  }): CustomerBilling;
+  protected _createAuth(session: InternalSession): Auth;
+  protected _editableTeamProfileFromCrud(crud: TeamMemberProfilesCrud['Client']['Read'], session: InternalSession): EditableTeamMemberProfile;
+  protected _createBaseUser(crud: NonNullable<CurrentUserCrud['Client']['Read']> | UsersCrud['Server']['Read']): BaseUser;
+  protected _createUserExtraFromCurrent(crud: NonNullable<CurrentUserCrud['Client']['Read']>, session: InternalSession): UserExtra;
+  protected _createInternalUserExtra(session: InternalSession): InternalUserExtra;
+  protected _createCustomer(userIdOrTeamId: string, type: "user" | "team", session: InternalSession | null): Omit<Customer, "id">;
+  getItem(options: {
+    itemId: string;
+    userId: string;
+  } | {
+    itemId: string;
+    teamId: string;
+  } | {
+    itemId: string;
+    customCustomerId: string;
+  }): Promise<Item>;
+  useItem(options: {
+    itemId: string;
+    userId: string;
+  } | {
+    itemId: string;
+    teamId: string;
+  } | {
+    itemId: string;
+    customCustomerId: string;
+  }): Item;
+  listProducts(options: CustomerProductsRequestOptions): Promise<CustomerProductsList>;
+  listInvoices(options: CustomerInvoicesRequestOptions): Promise<CustomerInvoicesList>;
+  cancelSubscription(options: {
+    productId: string;
+    subscriptionId?: string;
+  } | {
+    productId: string;
+    subscriptionId?: string;
+    teamId: string;
+  }): Promise<void>;
+  useProducts(options: CustomerProductsRequestOptions): CustomerProductsList;
+  useInvoices(options: CustomerInvoicesRequestOptions): CustomerInvoicesList;
+  protected _currentUserFromCrud(crud: NonNullable<CurrentUserCrud['Client']['Read']>, session: InternalSession): ProjectCurrentUser<ProjectId>;
+  protected _clientSessionFromCrud(crud: SessionsCrud['Client']['Read']): ActiveSession;
+  protected _getOwnedAdminApp(forProjectId: string, session: InternalSession): _HexclaveAdminAppImplIncomplete<false, string>;
+  get projectId(): ProjectId;
+  get version(): string;
+  private _getBotChallengeSiteKeys;
+  private _getBotChallengeFlowFailure;
+  private _normalizeBotChallengeResult;
+  private _toInterfaceBotChallengeInput;
+  private _executeResultWithBotChallengeFlow;
+  protected _isTrusted(url: string): Promise<boolean>;
+  get urls(): Readonly<ResolvedHandlerUrls>;
+  protected _getUrls(): Readonly<ResolvedHandlerUrls>;
+  protected _prefetchCrossDomainHandoffParamsIfNeeded(): void;
+  protected _getCrossDomainHandoffParamsForUrlsGetter(currentUrl: URL): CrossDomainHandoffParams | null;
+  protected _getCrossDomainHandoffParamsForRedirect(currentUrl: URL): Promise<CrossDomainHandoffParams>;
+  protected _getLocalOAuthCallbackHandlerUrl(): string;
+  protected _createCrossDomainAuthRedirectUrl(options: {
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    afterCallbackRedirectUrl: string;
+    awaitPendingAuthResolutions?: boolean;
+    overrideTokenStoreInit?: TokenStoreInit;
+  }): Promise<string>;
+  protected _getFreshPrefetchedCrossDomainHandoffParams(): CrossDomainHandoffParams | null;
+  protected _getCurrentUrl(): Promise<URL | null>;
+  protected _redirectTo(options: {
+    url: URL | string;
+    replace?: boolean;
+  }): Promise<void>;
+  useNavigate(): (to: string) => void;
+  protected _redirectIfTrusted(url: string, options?: RedirectToOptions): Promise<void>;
+  protected _redirectToHandler(handlerName: keyof HandlerUrls, options?: RedirectToOptions, internalOptions?: {
+    awaitPendingAuthResolutions?: boolean;
+    overrideTokenStoreInit?: TokenStoreInit;
+  }): Promise<void>;
+  protected _getRedirectToHandlerUrl(handlerName: keyof HandlerUrls, options?: RedirectToOptions, internalOptions?: {
+    awaitPendingAuthResolutions?: boolean;
+    overrideTokenStoreInit?: TokenStoreInit;
+  }): Promise<string>;
+  protected _redirectToHandlerDuringRender(handlerName: keyof HandlerUrls, options?: RedirectToOptions): boolean;
+  redirectToSignIn(options?: RedirectToOptions): Promise<void>;
+  redirectToSignUp(options?: RedirectToOptions): Promise<void>;
+  redirectToSignOut(options?: RedirectToOptions): Promise<void>;
+  redirectToEmailVerification(options?: RedirectToOptions): Promise<void>;
+  redirectToPasswordReset(options?: RedirectToOptions): Promise<void>;
+  redirectToForgotPassword(options?: RedirectToOptions): Promise<void>;
+  redirectToHome(options?: RedirectToOptions): Promise<void>;
+  redirectToOAuthCallback(options?: RedirectToOptions): Promise<void>;
+  redirectToMagicLinkCallback(options?: RedirectToOptions): Promise<void>;
+  redirectToAfterSignIn(options?: RedirectToOptions): Promise<void>;
+  redirectToAfterSignUp(options?: RedirectToOptions): Promise<void>;
+  redirectToOnboarding(options?: RedirectToOptions): Promise<void>;
+  redirectToAfterSignOut(options?: RedirectToOptions): Promise<void>;
+  redirectToAccountSettings(options?: RedirectToOptions): Promise<void>;
+  redirectToError(options?: RedirectToOptions): Promise<void>;
+  redirectToTeamInvitation(options?: RedirectToOptions): Promise<void>;
+  redirectToCliAuthConfirm(options?: RedirectToOptions): Promise<void>;
+  redirectToMfa(options?: RedirectToOptions): Promise<void>;
+  sendForgotPasswordEmail(email: string, options?: {
+    callbackUrl?: string;
+  }): Promise<Result<undefined, KnownErrors["UserNotFound"]>>;
+  sendMagicLinkEmail(email: string, options?: {
+    callbackUrl?: string;
+  }): Promise<Result<{
+    nonce: string;
+  }, KnownErrors["RedirectUrlNotWhitelisted"] | KnownErrors["BotChallengeFailed"]>>;
+  resetPassword(options: {
+    password: string;
+    code: string;
+  }): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+  verifyPasswordResetCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+  verifyTeamInvitationCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"] | KnownErrors["TeamInvitationEmailMismatch"]>>;
+  acceptTeamInvitation(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"] | KnownErrors["TeamInvitationEmailMismatch"]>>;
+  getTeamInvitationDetails(code: string): Promise<Result<{
+    teamDisplayName: string;
+  }, KnownErrors["VerificationCodeError"] | KnownErrors["TeamInvitationEmailMismatch"]>>;
+  verifyEmail(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): Promise<ProjectCurrentUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): Promise<ProjectCurrentUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): Promise<ProjectCurrentUser<ProjectId>>;
+  getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentUser<ProjectId> | null>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): ProjectCurrentUser<ProjectId>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): ProjectCurrentUser<ProjectId>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): ProjectCurrentUser<ProjectId>;
+  useUser(options?: GetCurrentUserOptions<HasTokenStore>): ProjectCurrentUser<ProjectId> | null;
+  _getTokenPartialUserFromSession(session: InternalSession, options: GetCurrentPartialUserOptions<HasTokenStore>): TokenPartialUser | null;
+  _getPartialUserFromConvex(ctx: ConvexCtx): Promise<TokenPartialUser | null>;
+  getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'token';
+  }): Promise<TokenPartialUser | null>;
+  getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'convex';
+  }): Promise<TokenPartialUser | null>;
+  usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'token';
+  }): TokenPartialUser | null;
+  usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
+    from: 'convex';
+  }): TokenPartialUser | null;
+  getConvexClientAuth(options: {
+    tokenStore: TokenStoreInit;
+  }): (args: {
+    forceRefreshToken: boolean;
+  }) => Promise<string | null>;
+  getConvexHttpClientAuth(options: {
+    tokenStore: TokenStoreInit;
+  }): Promise<string>;
+  protected _updateClientUser(update: UserUpdateOptions, session: InternalSession): Promise<void>;
+  signInWithOAuth(provider: ProviderType, options?: {
+    returnTo?: string;
+  }): Promise<void>;
+  /**
+   * Handles MFA verification by redirecting to the OTP page
+   */
+  protected _experimentalMfa(error: KnownErrors['MultiFactorAuthenticationRequired'], session: InternalSession): Promise<never>;
+  /**
+   * @deprecated
+   * TODO remove
+   */
+  protected _catchMfaRequiredError<T, E>(callback: () => Promise<Result<T, E>>): Promise<Result<T | {
+    accessToken: string;
+    refreshToken: string;
+    newUser: boolean;
+  }, E>>;
+  signInWithCredential(options: {
+    email: string;
+    password: string;
+    noRedirect?: boolean;
+  }): Promise<Result<undefined, KnownErrors["EmailPasswordMismatch"] | KnownErrors["InvalidTotpCode"]>>;
+  signUpWithCredential(options: {
+    email: string;
+    password: string;
+    noRedirect?: boolean;
+    noVerificationCallback?: boolean;
+    verificationCallbackUrl?: string;
+  }): Promise<Result<undefined, KnownErrors["UserWithEmailAlreadyExists"] | KnownErrors['PasswordRequirementsNotMet'] | KnownErrors["BotChallengeFailed"]>>;
+  _signUpAnonymously(): Promise<{
+    accessToken: string;
+    refreshToken: string;
+  }>;
+  signInWithMagicLink(code: string, options?: {
+    noRedirect?: boolean;
+  }): Promise<Result<undefined, KnownErrors["VerificationCodeError"] | KnownErrors["InvalidTotpCode"]>>;
+  /**
+   * Initiates a CLI authentication process that allows a command line application
+   * to get a refresh token for a user's account.
+   *
+   * This process works as follows:
+   * 1. The CLI app calls this method, which initiates the auth process with the server
+   * 2. The server returns a polling code and a login code
+   * 3. The CLI app opens a browser window to the appUrl with the login code as a parameter
+   * 4. The user logs in through the browser and confirms the authorization
+   * 5. The CLI app polls for the refresh token using the polling code
+   *
+   * @param options Options for the CLI login
+   * @param options.appUrl The URL of the app that will handle the CLI auth confirmation
+   * @param options.expiresInMillis Optional duration in milliseconds before the auth attempt expires (default: 2 hours)
+   * @param options.maxAttempts Optional maximum number of polling attempts (default: Infinity)
+   * @param options.waitTimeMillis Optional time to wait between polling attempts (default: 2 seconds)
+   * @param options.promptLink Optional function to call with the login URL and code to prompt the user to open the browser
+   * @param options.anonRefreshToken Optional anonymous refresh token from the CLI's token store to associate with this login attempt
+   * @returns Result containing either the refresh token or an error
+   */
+  promptCliLogin(options: {
+    appUrl: string;
+    expiresInMillis?: number;
+    maxAttempts?: number;
+    waitTimeMillis?: number;
+    promptLink?: (url: string, loginCode: string) => void;
+    anonRefreshToken?: string;
+  }): Promise<Result<string, KnownErrors["CliAuthError"] | KnownErrors["CliAuthExpiredError"] | KnownErrors["CliAuthUsedError"]>>;
+  signInWithMfa(totp: string, code: string, options?: {
+    noRedirect?: boolean;
+  }): Promise<Result<undefined, KnownErrors["VerificationCodeError"] | KnownErrors["InvalidTotpCode"]>>;
+  signInWithPasskey(): Promise<Result<undefined, KnownErrors["PasskeyAuthenticationFailed"] | KnownErrors["InvalidTotpCode"] | KnownErrors["PasskeyWebAuthnError"]>>;
+  callOAuthCallback(options?: {
+    dontWarnAboutMissingQueryParams?: boolean;
+  }): Promise<boolean>;
+  protected _signOut(session: InternalSession, options?: {
+    redirectUrl?: URL | string;
+  }): Promise<void>;
+  protected _redirectToDefaultAfterSignOut(): Promise<void>;
+  signOut(options?: {
+    redirectUrl?: URL | string;
+    tokenStore?: TokenStoreInit;
+  }): Promise<void>;
+  getAccessToken(options?: {
+    tokenStore?: TokenStoreInit;
+  }): Promise<string | null>;
+  useAccessToken(options?: {
+    tokenStore?: TokenStoreInit;
+  }): string | null;
+  getRefreshToken(options?: {
+    tokenStore?: TokenStoreInit;
+  }): Promise<string | null>;
+  useRefreshToken(options?: {
+    tokenStore?: TokenStoreInit;
+  }): string | null;
+  getAuthorizationHeader(options?: {
+    tokenStore?: TokenStoreInit;
+  }): Promise<string | null>;
+  useAuthorizationHeader(options?: {
+    tokenStore?: TokenStoreInit;
+  }): string | null;
+  getAuthHeaders(options?: {
+    tokenStore?: TokenStoreInit;
+  }): Promise<{
+    "x-stack-auth": string;
+  }>;
+  useAuthHeaders(options?: {
+    tokenStore?: TokenStoreInit;
+  }): {
+    "x-stack-auth": string;
+  };
+  getAuthJson(options?: {
+    tokenStore?: TokenStoreInit;
+  }): Promise<{
+    accessToken: string | null;
+    refreshToken: string | null;
+  }>;
+  useAuthJson(options?: {
+    tokenStore?: TokenStoreInit;
+  }): {
+    accessToken: string | null;
+    refreshToken: string | null;
+  };
+  getProject(): Promise<Project>;
+  useProject(): Project;
+  protected _listOwnedProjects(session: InternalSession): Promise<AdminOwnedProject[]>;
+  protected _useOwnedProjects(session: InternalSession): AdminOwnedProject[];
+  protected _createProject(session: InternalSession, newProject: AdminProjectUpdateOptions & {
+    displayName: string;
+    teamId: string;
+  }): Promise<AdminOwnedProject>;
+  protected _refreshUser(session: InternalSession): Promise<void>;
+  protected _refreshSession(session: InternalSession): Promise<void>;
+  protected _refreshUsers(): Promise<void>;
+  protected _refreshProject(): Promise<void>;
+  protected _refreshOwnedProjects(session: InternalSession): Promise<void>;
+  static get [hexclaveAppInternalsSymbol](): {
+    fromClientJson: <HasTokenStore extends boolean, ProjectId extends string>(json: StackClientAppJson<HasTokenStore, ProjectId>) => StackClientApp<HasTokenStore, ProjectId>;
+  };
+  get [hexclaveAppInternalsSymbol](): {
+    toClientJson: () => StackClientAppJson<HasTokenStore, ProjectId>;
+    setCurrentUser: (userJsonPromise: Promise<CurrentUserCrud["Client"]["Read"] | null>) => void;
+    getConstructorOptions: () => {
+      baseUrl?: string | {
+        browser: string;
+        server: string;
+      };
+      extraRequestHeaders?: Record<string, string>;
+      projectId?: ProjectId | undefined;
+      publishableClientKey?: string;
+      urls?: HandlerUrlOptions;
+      oauthScopesOnSignIn?: Partial<OAuthScopesOnSignIn>;
+      tokenStore?: TokenStoreInit<HasTokenStore> | undefined;
+      redirectMethod?: RedirectMethod;
+      inheritsFrom?: StackClientApp<any, any>;
+      devTool?: boolean | "auto";
+      noAutomaticPrefetch?: boolean;
+      analytics?: AnalyticsOptions;
+    } & {
+      tokenStore: TokenStoreInit<HasTokenStore>;
+    } & (string extends ProjectId ? unknown : {
+      projectId: ProjectId;
+    } | {
+      inheritsFrom: StackClientApp<any, ProjectId>;
+    }) & {
+      inheritsFrom?: undefined;
+    };
+    sendSessionReplayBatch: (body: string, options: {
+      keepalive: boolean;
+    }) => Promise<Result<Response, Error>>;
+    sendAnalyticsEventBatch: (body: string, options: {
+      keepalive: boolean;
+    }) => Promise<Result<Response, Error>>;
+    addRequestListener: (listener: RequestListener) => () => void;
+    sendRequest: (path: string, requestOptions: RequestInit, requestType?: "client" | "server" | "admin") => Promise<Response & {
+      usedTokens: {
+        accessToken: import("@hexclave/shared/dist/sessions-d8qtvBUB").t;
+        refreshToken: import("@hexclave/shared/dist/sessions-d8qtvBUB").i | null;
+      } | null;
+    }>;
+    getUrls: () => Readonly<ResolvedHandlerUrls>;
+    getRedirectMethod: () => RedirectMethod;
+    redirectToUrl: (url: string | URL, options?: {
+      replace?: boolean;
+    }) => Promise<void>;
+    getRedirectToHandlerUrl: (handlerName: keyof HandlerUrls, options?: RedirectToOptions) => Promise<string>;
+    redirectToHandler: (handlerName: keyof HandlerUrls, options?: RedirectToOptions) => Promise<void>;
+    refreshOwnedProjects: () => Promise<void>;
+    signInWithTokens: (tokens: {
+      accessToken: string;
+      refreshToken: string;
+    }) => Promise<void>;
+    awaitPendingAuthResolutions: () => Promise<void>;
+  };
+}
+//#endregion
+//#region src/lib/hexclave-app/apps/implementations/server-app-impl.d.ts
+declare class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, ProjectId extends string> extends _HexclaveClientAppImplIncomplete<HasTokenStore, ProjectId> {
+  protected _interface: HexclaveServerInterface;
+  private readonly _currentServerUserCache;
+  private readonly _serverUsersCache;
+  private readonly _serverUserCache;
+  private readonly _serverTeamsCache;
+  protected _refreshTeamMembership(teamId: string, userId: string): Promise<void>;
+  private readonly _serverUserTeamInvitationsCache;
+  private readonly _serverTeamUserPermissionsCache;
+  private readonly _serverAllTeamMemberPermissionsCache;
+  private readonly _serverUserProjectPermissionsCache;
+  /** @deprecated Used by legacy getConnectedAccount(providerId) — uses old per-provider access token endpoint */
+  private readonly _serverUserOAuthConnectionAccessTokensCache;
+  /** @deprecated Used by legacy getConnectedAccount(providerId) — combines token check + redirect */
+  private readonly _serverUserOAuthConnectionCache;
+  private readonly _serverUserConnectedAccountsCache;
+  private readonly _serverUserOAuthConnectionAccessTokensByAccountCache;
+  private readonly _serverTeamMemberProfilesCache;
+  private readonly _serverTeamInvitationsCache;
+  private readonly _serverUserTeamProfileCache;
+  private readonly _serverContactChannelsCache;
+  private readonly _serverNotificationCategoriesCache;
+  private readonly _serverDataVaultStoreValueCache;
+  private readonly _emailDeliveryInfoCache;
+  private readonly _serverUserApiKeysCache;
+  private readonly _serverTeamApiKeysCache;
+  private readonly _convexIdentitySubjectCache;
+  private readonly _serverCheckApiKeyCache;
+  private readonly _serverOAuthProvidersCache;
+  private readonly _serverTeamItemsCache;
+  private readonly _serverUserItemsCache;
+  private readonly _serverCustomItemsCache;
+  private readonly _serverUserProductsCache;
+  private readonly _serverTeamProductsCache;
+  private readonly _serverCustomProductsCache;
+  protected _createServerCustomer(userIdOrTeamId: string, type: "user" | "team"): Omit<Customer<true>, "id">;
+  private _updateServerUser;
+  protected _serverEditableTeamProfileFromCrud(crud: TeamMemberProfilesCrud['Client']['Read']): EditableTeamMemberProfile;
+  protected _serverContactChannelFromCrud(userId: string, crud: ContactChannelsCrud['Server']['Read']): ServerContactChannel;
+  protected _serverNotificationCategoryFromCrud(userId: string, crud: NotificationPreferenceCrud['Server']['Read']): NotificationCategory;
+  protected _serverOAuthProviderFromCrud(crud: OAuthProviderCrud['Server']['Read']): {
+    id: string;
+    type: "x" | "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "twitch";
+    userId: string;
+    accountId: string;
+    email: string | undefined;
+    allowSignIn: boolean;
+    allowConnectedAccounts: boolean;
+    update(data: {
+      accountId?: string;
+      email?: string;
+      allowSignIn?: boolean;
+      allowConnectedAccounts?: boolean;
+    }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
+    delete(): Promise<void>;
+  };
+  constructor(options: StackServerAppConstructorOptions<HasTokenStore, ProjectId>, extraOptions?: {
+    uniqueIdentifier?: string;
+    checkString?: string;
+    interface?: HexclaveServerInterface;
+  });
+  protected _serverApiKeyFromCrud(crud: TeamApiKeysCrud['Client']['Read']): ApiKey<"team">;
+  protected _serverApiKeyFromCrud(crud: UserApiKeysCrud['Client']['Read']): ApiKey<"user">;
+  protected _serverApiKeyFromCrud(crud: yup.InferType<typeof teamApiKeysCreateOutputSchema>): ApiKey<"team", true>;
+  protected _serverApiKeyFromCrud(crud: yup.InferType<typeof userApiKeysCreateOutputSchema>): ApiKey<"user", true>;
+  protected _createServerOAuthConnectionFromCrudItem(userId: string, item: {
+    provider: string;
+    provider_account_id: string;
+  }): OAuthConnection;
+  protected _serverUserFromCrud(crud: UsersCrud['Server']['Read']): ServerUser;
+  protected _serverTeamUserFromCrud(crud: TeamMemberProfilesCrud["Server"]["Read"]): ServerTeamUser;
+  protected _serverSentTeamInvitationFromCrud(crud: TeamInvitationCrud['Server']['Read']): SentTeamInvitation;
+  protected _serverReceivedTeamInvitationFromCrud(userId: string, crud: TeamInvitationCrud['Client']['Read']): ReceivedTeamInvitation;
+  protected _currentUserFromCrud(crud: UsersCrud['Server']['Read'], session: InternalSession): ProjectCurrentServerUser<ProjectId>;
+  protected _serverTeamFromCrud(crud: TeamsCrud['Server']['Read']): ServerTeam;
+  protected _serverItemFromCrud(customer: {
+    type: "user" | "team" | "custom";
+    id: string;
+  }, crud: ItemCrud['Client']['Read']): ServerItem;
+  protected _getUserApiKey(options: {
+    apiKey: string;
+  }): Promise<ApiKey<"user"> | null>;
+  protected _getTeamApiKey(options: {
+    apiKey: string;
+  }): Promise<ApiKey<"team"> | null>;
+  protected _useUserApiKey(options: {
+    apiKey: string;
+  }): ApiKey<"user"> | null;
+  protected _useTeamApiKey(options: {
+    apiKey: string;
+  }): ApiKey<"team"> | null;
+  protected _getUserByApiKey(apiKey: string): Promise<ServerUser | null>;
+  protected _getUserByConvex(ctx: ConvexCtx, includeAnonymous: boolean): Promise<ServerUser | null>;
+  protected _useUserByConvex(ctx: ConvexCtx, includeAnonymous: boolean): ServerUser | null;
+  protected _useUserByApiKey(apiKey: string): ServerUser | null;
+  protected _getTeamByApiKey(apiKey: string): Promise<ServerTeam | null>;
+  protected _useTeamByApiKey(apiKey: string): ServerTeam | null;
+  createUser(options: ServerUserCreateOptions): Promise<ServerUser>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): Promise<ProjectCurrentServerUser<ProjectId>>;
+  getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+  getUser(id: string): Promise<ServerUser | null>;
+  getUser(options: {
+    apiKey: string;
+  }): Promise<ServerUser | null>;
+  getUser(options: {
+    from: "convex";
+    ctx: ConvexCtx;
+    or?: "return-null" | "anonymous";
+  }): Promise<ServerUser | null>;
+  getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+  getServerUserById(userId: string): Promise<ServerUser | null>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'redirect';
+  }): ProjectCurrentServerUser<ProjectId>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'throw';
+  }): ProjectCurrentServerUser<ProjectId>;
+  useUser(options: GetCurrentUserOptions<HasTokenStore> & {
+    or: 'anonymous';
+  }): ProjectCurrentServerUser<ProjectId>;
+  useUser(options?: GetCurrentUserOptions<HasTokenStore>): ProjectCurrentServerUser<ProjectId> | null;
+  useUser(id: string): ServerUser | null;
+  useUser(options: {
+    apiKey: string;
+  }): ServerUser | null;
+  useUser(options: {
+    from: "convex";
+    ctx: ConvexCtx;
+    or?: "return-null" | "anonymous";
+  }): ServerUser | null;
+  useUserById(userId: string): ServerUser | null;
+  listUsers(options?: ServerListUsersOptions): Promise<ServerUser[] & {
+    nextCursor: string | null;
+  }>;
+  useUsers(options?: ServerListUsersOptions): ServerUser[] & {
+    nextCursor: string | null;
+  };
+  _serverPermissionFromCrud(crud: TeamPermissionsCrud['Server']['Read'] | ProjectPermissionsCrud['Server']['Read']): AdminTeamPermission;
+  _serverTeamPermissionDefinitionFromCrud(crud: TeamPermissionDefinitionsCrud['Admin']['Read']): AdminTeamPermissionDefinition;
+  _serverProjectPermissionDefinitionFromCrud(crud: ProjectPermissionDefinitionsCrud['Admin']['Read']): AdminProjectPermissionDefinition;
+  getItem(options: {
+    itemId: string;
+    userId: string;
+  } | {
+    itemId: string;
+    teamId: string;
+  } | {
+    itemId: string;
+    customCustomerId: string;
+  }): Promise<ServerItem>;
+  listProducts(options: CustomerProductsRequestOptions): Promise<CustomerProductsList>;
+  useItem(options: {
+    itemId: string;
+    userId: string;
+  } | {
+    itemId: string;
+    teamId: string;
+  } | {
+    itemId: string;
+    customCustomerId: string;
+  }): ServerItem;
+  private _resolveCustomer;
+  grantProduct(options: (({
+    userId: string;
+  } | {
+    teamId: string;
+  } | {
+    customCustomerId: string;
+  }) & ({
+    productId: string;
+  } | {
+    product: InlineProduct;
+  }) & {
+    quantity?: number;
+  })): Promise<void>;
+  createCheckoutUrl(options: (({
+    userId: string;
+  } | {
+    teamId: string;
+  } | {
+    customCustomerId: string;
+  }) & ({
+    productId: string;
+  } | {
+    product: InlineProduct;
+  }) & {
+    returnUrl?: string;
+  })): Promise<string>;
+  createTeam(data: ServerTeamCreateOptions): Promise<ServerTeam>;
+  listTeams(options?: ServerListTeamsOptions): Promise<ServerTeam[] & {
+    nextCursor: string | null;
+  }>;
+  useTeams(options?: ServerListTeamsOptions): ServerTeam[] & {
+    nextCursor: string | null;
+  };
+  listTeamMemberPermissions(teamId: string, options?: {
+    recursive?: boolean;
+  }): Promise<{
+    userId: string;
+    permissionId: string;
+  }[]>;
+  useTeamMemberPermissions(teamId: string, options?: {
+    recursive?: boolean;
+  }): {
+    userId: string;
+    permissionId: string;
+  }[];
+  getTeam(options: {
+    apiKey: string;
+  }): Promise<ServerTeam | null>;
+  getTeam(teamId: string): Promise<ServerTeam | null>;
+  useTeam(options: {
+    apiKey: string;
+  }): ServerTeam | null;
+  useTeam(teamId: string): ServerTeam | null;
+  protected _createServerDataVaultStore(id: string): DataVaultStore;
+  getDataVaultStore(id: string): Promise<DataVaultStore>;
+  useDataVaultStore(id: string): DataVaultStore;
+  sendEmail(options: SendEmailOptions): Promise<void>;
+  getEmailDeliveryStats(): Promise<EmailDeliveryInfo>;
+  useEmailDeliveryStats(): EmailDeliveryInfo;
+  activateEmailCapacityBoost(): Promise<void>;
+  protected _refreshSession(session: InternalSession): Promise<void>;
+  protected _refreshUsers(): Promise<void>;
+  createOAuthProvider(options: {
+    userId: string;
+    providerConfigId: string;
+    accountId: string;
+    email: string;
+    allowSignIn: boolean;
+    allowConnectedAccounts: boolean;
+  }): Promise<Result<ServerOAuthProvider, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
+}
+//#endregion
+//#region src/lib/hexclave-app/apps/implementations/admin-app-impl.d.ts
+type PlanUsageResponse = Awaited<ReturnType<HexclaveAdminInterface["getPlanUsage"]>>;
+declare class _HexclaveAdminAppImplIncomplete<HasTokenStore extends boolean, ProjectId extends string> extends _HexclaveServerAppImplIncomplete<HasTokenStore, ProjectId> implements StackAdminApp<HasTokenStore, ProjectId> {
+  protected _interface: HexclaveAdminInterface;
+  private readonly _adminProjectCache;
+  private readonly _planUsageCache;
+  private readonly _internalApiKeysCache;
+  private readonly _adminEmailThemeCache;
+  private readonly _adminEmailThemesCache;
+  private readonly _adminEmailTemplatesCache;
+  private readonly _adminEmailDraftsCache;
+  private readonly _adminTeamPermissionDefinitionsCache;
+  private readonly _adminProjectPermissionDefinitionsCache;
+  private readonly _svixTokenCache;
+  private readonly _metricsCache;
+  private readonly _userActivityCache;
+  private readonly _metricsUserCountsCache;
+  private readonly _emailPreviewCache;
+  private readonly _emailPreviewWithEditableMarkersCache;
+  private readonly _configOverridesCache;
+  private readonly _stripeAccountInfoCache;
+  private readonly _transactionsCache;
+  constructor(options: StackAdminAppConstructorOptions<HasTokenStore, ProjectId>, extraOptions?: {
+    uniqueIdentifier?: string;
+    checkString?: string;
+    interface?: HexclaveAdminInterface;
+  });
+  _adminConfigFromCrud(data: {
+    config_string: string;
+  }): CompleteConfig;
+  _adminOwnedProjectFromCrud(data: ProjectsCrud['Admin']['Read'], onRefresh: () => Promise<void>): AdminOwnedProject;
+  _adminProjectFromCrud(data: ProjectsCrud['Admin']['Read'], onRefresh: () => Promise<void>): AdminProject;
+  _adminEmailTemplateFromCrud(data: EmailTemplateCrud['Admin']['Read']): AdminEmailTemplate;
+  _planUsageFromCrud(data: PlanUsageResponse): PlanUsage;
+  getProject(): Promise<AdminProject>;
+  useProject(): AdminProject;
+  getPlanUsage(): Promise<PlanUsage>;
+  usePlanUsage(): PlanUsage;
+  protected _createInternalApiKeyBaseFromCrud(data: InternalApiKeyBaseCrudRead): InternalApiKeyBase;
+  protected _createInternalApiKeyFromCrud(data: InternalApiKeysCrud["Admin"]["Read"]): InternalApiKey;
+  protected _createInternalApiKeyFirstViewFromCrud(data: InternalApiKeyCreateCrudResponse): InternalApiKeyFirstView;
+  listInternalApiKeys(): Promise<InternalApiKey[]>;
+  useInternalApiKeys(): InternalApiKey[];
+  createInternalApiKey(options: InternalApiKeyCreateOptions): Promise<InternalApiKeyFirstView>;
+  useEmailThemes(): {
+    id: string;
+    displayName: string;
+  }[];
+  useEmailTemplates(): {
+    id: string;
+    displayName: string;
+    themeId?: string;
+    tsxSource: string;
+  }[];
+  useEmailDrafts(): {
+    id: string;
+    displayName: string;
+    themeId: string | undefined | false;
+    tsxSource: string;
+    sentAt: Date | null;
+  }[];
+  listEmailThemes(): Promise<{
+    id: string;
+    displayName: string;
+  }[]>;
+  listEmailTemplates(): Promise<{
+    id: string;
+    displayName: string;
+    themeId?: string;
+    tsxSource: string;
+  }[]>;
+  listEmailDrafts(): Promise<{
+    id: string;
+    displayName: string;
+    themeId: string | undefined | false;
+    tsxSource: string;
+    sentAt: Date | null;
+  }[]>;
+  createTeamPermissionDefinition(data: AdminTeamPermissionDefinitionCreateOptions): Promise<AdminTeamPermission>;
+  updateTeamPermissionDefinition(permissionId: string, data: AdminTeamPermissionDefinitionUpdateOptions): Promise<void>;
+  deleteTeamPermissionDefinition(permissionId: string): Promise<void>;
+  listTeamPermissionDefinitions(): Promise<AdminTeamPermissionDefinition[]>;
+  listTeamPermissionDefinitionsPaginated(options: {
+    limit: number;
+    cursor?: string;
+    query?: string;
+  }): Promise<{
+    items: AdminTeamPermissionDefinition[];
+    nextCursor: string | null;
+  }>;
+  useTeamPermissionDefinitions(): AdminTeamPermissionDefinition[];
+  createProjectPermissionDefinition(data: AdminProjectPermissionDefinitionCreateOptions): Promise<AdminProjectPermission>;
+  updateProjectPermissionDefinition(permissionId: string, data: AdminProjectPermissionDefinitionUpdateOptions): Promise<void>;
+  deleteProjectPermissionDefinition(permissionId: string): Promise<void>;
+  listProjectPermissionDefinitions(): Promise<AdminProjectPermissionDefinition[]>;
+  useProjectPermissionDefinitions(): AdminProjectPermissionDefinition[];
+  useSvixToken(): {
+    token: string;
+    url: string | undefined;
+  };
+  protected _refreshProject(): Promise<void>;
+  protected _refreshProjectConfig(): Promise<void>;
+  protected _refreshInternalApiKeys(): Promise<void>;
+  protected _refreshUsers(): Promise<void>;
+  get [hexclaveAppInternalsSymbol](): {
+    useMetrics: (includeAnonymous?: boolean, filters?: {
+      country_code?: string;
+      referrer?: string;
+      browser?: string;
+      os?: string;
+      device?: string;
+      since?: string;
+      until?: string;
+    }) => MetricsResponse;
+    useUserActivity: (userId: string) => UserActivityResponse;
+    useMetricsUserCounts: () => MetricsUserCounts;
+    toClientJson: () => {
+      baseUrl?: string | {
+        browser: string;
+        server: string;
+      };
+      extraRequestHeaders?: Record<string, string>;
+      projectId?: ProjectId | undefined;
+      publishableClientKey?: string;
+      urls?: import("@hexclave/shared/dist/handler-urls-BHt3v8Ai").i;
+      oauthScopesOnSignIn?: Partial<OAuthScopesOnSignIn>;
+      tokenStore?: TokenStoreInit<HasTokenStore> | undefined;
+      redirectMethod?: RedirectMethod;
+      inheritsFrom?: StackClientApp<any, any>;
+      devTool?: boolean | "auto";
+      noAutomaticPrefetch?: boolean;
+      analytics?: AnalyticsOptions;
+    } & {
+      tokenStore: TokenStoreInit<HasTokenStore>;
+    } & (string extends ProjectId ? unknown : {
+      projectId: ProjectId;
+    } | {
+      inheritsFrom: StackClientApp<any, ProjectId>;
+    }) & {
+      inheritsFrom?: undefined;
+    } & {
+      uniqueIdentifier: string;
+    };
+    setCurrentUser: (userJsonPromise: Promise<import("@hexclave/shared/dist/current-user-Dvf8Ttjo").t["Client"]["Read"] | null>) => void;
+    getConstructorOptions: () => {
+      baseUrl?: string | {
+        browser: string;
+        server: string;
+      };
+      extraRequestHeaders?: Record<string, string>;
+      projectId?: ProjectId | undefined;
+      publishableClientKey?: string;
+      urls?: import("@hexclave/shared/dist/handler-urls-BHt3v8Ai").i;
+      oauthScopesOnSignIn?: Partial<OAuthScopesOnSignIn>;
+      tokenStore?: TokenStoreInit<HasTokenStore> | undefined;
+      redirectMethod?: RedirectMethod;
+      inheritsFrom?: StackClientApp<any, any>;
+      devTool?: boolean | "auto";
+      noAutomaticPrefetch?: boolean;
+      analytics?: AnalyticsOptions;
+    } & {
+      tokenStore: TokenStoreInit<HasTokenStore>;
+    } & (string extends ProjectId ? unknown : {
+      projectId: ProjectId;
+    } | {
+      inheritsFrom: StackClientApp<any, ProjectId>;
+    }) & {
+      inheritsFrom?: undefined;
+    };
+    sendSessionReplayBatch: (body: string, options: {
+      keepalive: boolean;
+    }) => Promise<Result<Response, Error>>;
+    sendAnalyticsEventBatch: (body: string, options: {
+      keepalive: boolean;
+    }) => Promise<Result<Response, Error>>;
+    addRequestListener: (listener: import("@hexclave/shared/dist/client-interface-CGrvUtX0").r) => () => void;
+    sendRequest: (path: string, requestOptions: RequestInit, requestType?: "client" | "server" | "admin") => Promise<Response & {
+      usedTokens: {
+        accessToken: import("@hexclave/shared/dist/sessions-d8qtvBUB").t;
+        refreshToken: import("@hexclave/shared/dist/sessions-d8qtvBUB").i | null;
+      } | null;
+    }>;
+    getUrls: () => Readonly<import("@hexclave/shared/dist/handler-urls-BHt3v8Ai").s>;
+    getRedirectMethod: () => RedirectMethod;
+    redirectToUrl: (url: string | URL, options?: {
+      replace?: boolean;
+    } | undefined) => Promise<void>;
+    getRedirectToHandlerUrl: (handlerName: keyof import("@hexclave/shared/dist/handler-urls-BHt3v8Ai").o, options?: RedirectToOptions) => Promise<string>;
+    redirectToHandler: (handlerName: keyof import("@hexclave/shared/dist/handler-urls-BHt3v8Ai").o, options?: RedirectToOptions) => Promise<void>;
+    refreshOwnedProjects: () => Promise<void>;
+    signInWithTokens: (tokens: {
+      accessToken: string;
+      refreshToken: string;
+    }) => Promise<void>;
+    awaitPendingAuthResolutions: () => Promise<void>;
+  };
+  sendTestEmail(options: {
+    recipientEmail: string;
+    emailConfig: EmailConfig;
+  }): Promise<Result<undefined, {
+    errorMessage: string;
+  }>>;
+  sendTestWebhook(options: {
+    endpointId: string;
+  }): Promise<Result<undefined, {
+    errorMessage: string;
+  }>>;
+  listSentEmails(): Promise<AdminSentEmail[]>;
+  setupManagedEmailProvider(options: {
+    subdomain: string;
+    senderLocalPart: string;
+  }): Promise<ManagedEmailProviderSetupResult>;
+  checkManagedEmailStatus(options: {
+    domainId: string;
+    subdomain: string;
+    senderLocalPart: string;
+  }): Promise<ManagedEmailProviderStatus>;
+  listManagedEmailDomains(): Promise<ManagedEmailProviderListItem[]>;
+  applyManagedEmailProvider(options: {
+    domainId: string;
+  }): Promise<{
+    status: "applied";
+  }>;
+  deleteManagedEmailDomain(options: {
+    resendDomainId: string;
+  }): Promise<{
+    status: "deleted";
+  }>;
+  sendSignInInvitationEmail(email: string, callbackUrl: string): Promise<void>;
+  createEmailTemplate(displayName: string): Promise<{
+    id: string;
+  }>;
+  deleteEmailTemplate(id: string): Promise<void>;
+  createEmailDraft(options: {
+    displayName: string;
+    themeId?: string | false;
+    tsxSource?: string;
+  }): Promise<{
+    id: string;
+  }>;
+  updateEmailDraft(id: string, data: {
+    displayName?: string;
+    themeId?: string | undefined | false;
+    tsxSource?: string;
+  }): Promise<void>;
+  deleteEmailDraft(id: string): Promise<void>;
+  refreshEmailDrafts(): Promise<void>;
+  saveChatMessage(threadId: string, message: any): Promise<void>;
+  listChatMessages(threadId: string): Promise<{
+    messages: Array<any>;
+  }>;
+  rewriteTemplateSourceWithAI(templateTsxSource: string): Promise<{
+    tsxSource: string;
+  }>;
+  createEmailTheme(displayName: string): Promise<{
+    id: string;
+  }>;
+  getEmailPreview(options: {
+    themeId?: string | null | false;
+    themeTsxSource?: string;
+    templateId?: string;
+    templateTsxSource?: string;
+  }): Promise<string>;
+  useEmailPreview(options: {
+    themeId?: string | null | false;
+    themeTsxSource?: string;
+    templateId?: string;
+    templateTsxSource?: string;
+  }): string;
+  getEmailPreviewWithEditableMarkers(options: {
+    themeId?: string | null | false;
+    themeTsxSource?: string;
+    templateId?: string;
+    templateTsxSource?: string;
+    editableSource?: 'template' | 'theme' | 'both';
+  }): Promise<{
+    html: string;
+    editableRegions?: Record<string, unknown>;
+  }>;
+  useEmailPreviewWithEditableMarkers(options: {
+    themeId?: string | null | false;
+    themeTsxSource?: string;
+    templateId?: string;
+    templateTsxSource?: string;
+    editableSource?: 'template' | 'theme' | 'both';
+  }): {
+    html: string;
+    editableRegions?: Record<string, unknown>;
+  };
+  useEmailTheme(id: string): {
+    displayName: string;
+    tsxSource: string;
+  };
+  updateEmailTheme(id: string, tsxSource: string): Promise<void>;
+  deleteEmailTheme(id: string): Promise<void>;
+  updateEmailTemplate(id: string, tsxSource: string, themeId: string | null | false): Promise<{
+    renderedHtml: string;
+  }>;
+  setupPayments(): Promise<{
+    url: string;
+  }>;
+  createStripeWidgetAccountSession(): Promise<{
+    client_secret: string;
+  }>;
+  getPaymentMethodConfigs(): Promise<{
+    configId: string;
+    methods: Array<{
+      id: string;
+      name: string;
+      enabled: boolean;
+      available: boolean;
+      overridable: boolean;
+    }>;
+  } | null>;
+  updatePaymentMethodConfigs(configId: string, updates: Record<string, 'on' | 'off'>): Promise<void>;
+  createItemQuantityChange(options: ({
+    userId: string;
+    itemId: string;
+    quantity: number;
+    expiresAt?: string;
+    description?: string;
+  } | {
+    teamId: string;
+    itemId: string;
+    quantity: number;
+    expiresAt?: string;
+    description?: string;
+  } | {
+    customCustomerId: string;
+    itemId: string;
+    quantity: number;
+    expiresAt?: string;
+    description?: string;
+  })): Promise<void>;
+  refundTransaction(options: {
+    type: "subscription" | "one-time-purchase";
+    id: string;
+    invoiceId?: string;
+    amountUsd: MoneyAmount;
+    endAction?: "now" | "at-period-end";
+  }): Promise<{
+    refundTransactionId: string;
+  }>;
+  listTransactions(params: {
+    cursor?: string;
+    limit?: number;
+    type?: TransactionType;
+    customerType?: 'user' | 'team' | 'custom';
+    customerId?: string;
+  }): Promise<{
+    transactions: Transaction[];
+    nextCursor: string | null;
+  }>;
+  private _emailOutboxCrudToAdmin;
+  listOutboxEmails(options?: {
+    status?: string;
+    simpleStatus?: string;
+    userId?: string;
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    items: AdminEmailOutbox[];
+    nextCursor: string | null;
+  }>;
+  getOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+  updateOutboxEmail(id: string, options: EmailOutboxUpdateOptions): Promise<AdminEmailOutbox>;
+  pauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+  unpauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+  cancelOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+  useTransactions(params: {
+    cursor?: string;
+    limit?: number;
+    type?: TransactionType;
+    customerType?: 'user' | 'team' | 'custom';
+    customerId?: string;
+  }): {
+    transactions: Transaction[];
+    nextCursor: string | null;
+  };
+  getStripeAccountInfo(): Promise<null | {
+    account_id: string;
+    charges_enabled: boolean;
+    details_submitted: boolean;
+    payouts_enabled: boolean;
+  }>;
+  useStripeAccountInfo(): {
+    account_id: string;
+    charges_enabled: boolean;
+    details_submitted: boolean;
+    payouts_enabled: boolean;
+  } | null;
+  queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse>;
+  getAnalyticsClickmap(options: AnalyticsClickmapOptions): Promise<AnalyticsClickmapResponse>;
+  createAnalyticsClickmapToken(options: {
+    origin: string;
+  }): Promise<AnalyticsClickmapTokenResponse>;
+  listSessionReplays(options?: ListSessionReplaysOptions): Promise<ListSessionReplaysResult>;
+  getSessionReplay(sessionReplayId: string): Promise<AdminSessionReplay>;
+  listSessionReplayChunks(sessionReplayId: string, options?: ListSessionReplayChunksOptions): Promise<ListSessionReplayChunksResult>;
+  getSessionReplayChunkEvents(sessionReplayId: string, chunkId: string): Promise<AdminGetSessionReplayChunkEventsResponse>;
+  getSessionReplayEvents(sessionReplayId: string, options?: {
+    offset?: number;
+    limit?: number;
+  }): Promise<SessionReplayAllEventsResult>;
+  previewAffectedUsersByOnboardingChange(onboarding: {
+    requireEmailVerification?: boolean;
+  }, limit?: number): Promise<{
+    affectedUsers: Array<{
+      id: string;
+      displayName: string | null;
+      primaryEmail: string | null;
+      restrictedReason: RestrictedReason;
+    }>;
+    totalAffectedCount: number;
+  }>;
+}
+//#endregion
+export { _HexclaveServerAppImplIncomplete as n, _HexclaveClientAppImplIncomplete as r, _HexclaveAdminAppImplIncomplete as t };
+//# sourceMappingURL=admin-app-impl-DgLL2Tua.d.ts.map