@hexclave/next 1.0.41 → 1.0.43

package/dist/lib/hexclave-app/users/index.d.ts

@@ -1,400 +1,2 @@
-import { AsyncStoreProperty, AuthLike } from "../common.js";
-import { Customer } from "../customers/index.js";
-import { AdminTeamPermission, TeamPermission } from "../permissions/index.js";
-import { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from "../api-keys/index.js";
-import { DeprecatedOAuthConnection, OAuthConnection } from "../connected-accounts/index.js";
-import { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from "../contact-channels/index.js";
-import { NotificationCategory } from "../notification-categories/index.js";
-import { EditableTeamMemberProfile, ReceivedTeamInvitation, ServerListTeamsOptions, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from "../teams/index.js";
-import { AdminOwnedProject, AdminProjectCreateOptions } from "../projects/index.js";
-import { KnownErrors } from "@hexclave/shared";
-import { CurrentUserCrud } from "@hexclave/shared/dist/interface/crud/current-user";
-import { Result } from "@hexclave/shared/dist/utils/results";
-import { ProviderType } from "@hexclave/shared/dist/utils/oauth";
-import { RestrictedReason } from "@hexclave/shared/dist/schema-fields";
-import { InternalSession } from "@hexclave/shared/dist/sessions";
-import { ReadonlyJson } from "@hexclave/shared/dist/utils/json";
-import { UsersCrud } from "@hexclave/shared/dist/interface/crud/users";
-import { GeoInfo } from "@hexclave/shared/dist/utils/geo";
-
-//#region src/lib/hexclave-app/users/index.d.ts
-declare function withUserDestructureGuard<T extends object>(target: T): T;
-type OAuthProvider = {
-  readonly id: string;
-  readonly type: string;
-  readonly userId: string;
-  readonly accountId?: string;
-  readonly email?: string;
-  readonly allowSignIn: boolean;
-  readonly allowConnectedAccounts: boolean;
-  update(data: {
-    allowSignIn?: boolean;
-    allowConnectedAccounts?: boolean;
-  }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
-  delete(): Promise<void>;
-};
-type ServerOAuthProvider = {
-  readonly id: string;
-  readonly type: string;
-  readonly userId: string;
-  readonly accountId: string;
-  readonly email?: string;
-  readonly allowSignIn: boolean;
-  readonly allowConnectedAccounts: boolean;
-  update(data: {
-    accountId?: string;
-    email?: string;
-    allowSignIn?: boolean;
-    allowConnectedAccounts?: boolean;
-  }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
-  delete(): Promise<void>;
-};
-/**
- * Contains everything related to the current user session.
- */
-type Auth = AuthLike<{}> & {
-  readonly _internalSession: InternalSession;
-  readonly currentSession: {
-    getTokens(): Promise<{
-      accessToken: string | null;
-      refreshToken: string | null;
-    }>;
-    useTokens(): {
-      accessToken: string | null;
-      refreshToken: string | null;
-    };
-  };
-};
-/**
- * ```
- * +----------+-------------+-------------------+
- * |    \     |   !Server   |      Server       |
- * +----------+-------------+-------------------+
- * | !Session | User        | ServerUser        |
- * | Session  | CurrentUser | CurrentServerUser |
- * +----------+-------------+-------------------+
- * ```
- *
- * The fields on each of these types are available iff:
- * BaseUser: true
- * Auth: Session
- * ServerBaseUser: Server
- * UserExtra: Session OR Server
- *
- * The types are defined as follows (in the typescript manner):
- * User = BaseUser
- * CurrentUser = BaseUser & Auth & UserExtra
- * ServerUser = BaseUser & ServerBaseUser & UserExtra
- * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra
- **/
-type BaseUser = {
-  readonly id: string;
-  readonly displayName: string | null;
-  /**
-   * The user's email address.
-   *
-   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.
-   */
-  readonly primaryEmail: string | null;
-  readonly primaryEmailVerified: boolean;
-  readonly profileImageUrl: string | null;
-  readonly signedUpAt: Date;
-  readonly clientMetadata: any;
-  readonly clientReadOnlyMetadata: any;
-  /**
-   * Whether the user has a password set.
-   */
-  readonly hasPassword: boolean;
-  readonly otpAuthEnabled: boolean;
-  readonly passkeyAuthEnabled: boolean;
-  readonly isMultiFactorRequired: boolean;
-  readonly isAnonymous: boolean;
-  /**
-   * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).
-   * For example, if email verification is required but the user hasn't verified their email yet.
-   */
-  readonly isRestricted: boolean;
-  /**
-   * The reason why the user is restricted, e.g., { type: "email_not_verified" }, { type: "anonymous" }, or { type: "restricted_by_administrator" }.
-   * Null if the user is not restricted.
-   */
-  readonly restrictedReason: RestrictedReason | null;
-  toClientJson(): CurrentUserCrud["Client"]["Read"];
-  /**
-   * @deprecated, use contact channel's usedForAuth instead
-   */
-  readonly emailAuthEnabled: boolean;
-  /**
-   * @deprecated
-   */
-  readonly oauthProviders: readonly {
-    id: string;
-  }[];
-};
-type UserExtra = {
-  setDisplayName(displayName: string | null): Promise<void>; /** @deprecated Use contact channel's sendVerificationEmail instead */
-  sendVerificationEmail(): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
-  setClientMetadata(metadata: any): Promise<void>;
-  updatePassword(options: {
-    oldPassword: string;
-    newPassword: string;
-  }): Promise<KnownErrors["PasswordConfirmationMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
-  setPassword(options: {
-    password: string;
-  }): Promise<KnownErrors["PasswordRequirementsNotMet"] | void>;
-  /**
-   * A shorthand method to update multiple fields of the user at once.
-   */
-  update(update: UserUpdateOptions): Promise<void>;
-  useContactChannels(): ContactChannel[];
-  listContactChannels(): Promise<ContactChannel[]>;
-  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>;
-  useNotificationCategories(): NotificationCategory[];
-  listNotificationCategories(): Promise<NotificationCategory[]>;
-  delete(): Promise<void>; /** @deprecated Use `getOrLinkConnectedAccount` for redirect behavior, or `getConnectedAccount({ provider, providerAccountId })` for existence check. */
-  getConnectedAccount(id: ProviderType, options: {
-    or: 'redirect';
-    scopes?: string[];
-  }): Promise<DeprecatedOAuthConnection>; /** @deprecated Use `getConnectedAccount({ provider, providerAccountId })` for existence check, or `getOrLinkConnectedAccount` for redirect behavior. */
-  getConnectedAccount(id: ProviderType, options?: {
-    or?: 'redirect' | 'throw' | 'return-null';
-    scopes?: string[];
-  }): Promise<DeprecatedOAuthConnection | null>; /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */
-  getConnectedAccount(account: {
-    provider: string;
-    providerAccountId: string;
-  }): Promise<OAuthConnection | null>; /** @deprecated Use `useOrLinkConnectedAccount` for redirect behavior, or `useConnectedAccount({ provider, providerAccountId })` for existence check. */
-  useConnectedAccount(id: ProviderType, options: {
-    or: 'redirect';
-    scopes?: string[];
-  }): DeprecatedOAuthConnection; /** @deprecated Use `useConnectedAccount({ provider, providerAccountId })` for existence check, or `useOrLinkConnectedAccount` for redirect behavior. */
-  useConnectedAccount(id: ProviderType, options?: {
-    or?: 'redirect' | 'throw' | 'return-null';
-    scopes?: string[];
-  }): DeprecatedOAuthConnection | null; /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */
-  useConnectedAccount(account: {
-    provider: string;
-    providerAccountId: string;
-  }): OAuthConnection | null; /** List all connected accounts for this user (only those with allowConnectedAccounts enabled). */
-  listConnectedAccounts(): Promise<OAuthConnection[]>; /** React hook to list all connected accounts. */
-  useConnectedAccounts(): OAuthConnection[]; /** Redirect the user to the OAuth flow to link a new connected account. Always redirects, never returns. */
-  linkConnectedAccount(provider: string, options?: {
-    scopes?: string[];
-  }): Promise<void>; /** Get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */
-  getOrLinkConnectedAccount(provider: string, options?: {
-    scopes?: string[];
-  }): Promise<OAuthConnection>; /** React hook: get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */
-  useOrLinkConnectedAccount(provider: string, options?: {
-    scopes?: string[];
-  }): OAuthConnection;
-  hasPermission(scope: Team, permissionId: string): Promise<boolean>;
-  hasPermission(permissionId: string): Promise<boolean>;
-  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>;
-  getPermission(permissionId: string): Promise<TeamPermission | null>;
-  listPermissions(scope: Team, options?: {
-    recursive?: boolean;
-  }): Promise<TeamPermission[]>;
-  listPermissions(options?: {
-    recursive?: boolean;
-  }): Promise<TeamPermission[]>;
-  usePermissions(scope: Team, options?: {
-    recursive?: boolean;
-  }): TeamPermission[];
-  usePermissions(options?: {
-    recursive?: boolean;
-  }): TeamPermission[];
-  usePermission(scope: Team, permissionId: string): TeamPermission | null;
-  usePermission(permissionId: string): TeamPermission | null;
-  readonly selectedTeam: Team | null;
-  setSelectedTeam(teamOrId: string | Team | null): Promise<void>;
-  createTeam(data: TeamCreateOptions): Promise<Team>;
-  leaveTeam(team: Team): Promise<void>;
-  /**
-   * Lists all pending team invitations sent to any of the current user's verified email addresses.
-   *
-   * This allows the user to discover which teams have invited them, even if they haven't
-   * joined those teams yet. Only invitations sent to verified email addresses are included.
-   *
-   * @returns An array of `ReceivedTeamInvitation` objects, each containing the team ID, team
-   * display name, recipient email, and expiration date.
-   *
-   * @example
-   * ```ts
-   * const invitations = await user.listTeamInvitations();
-   * for (const invitation of invitations) {
-   *   console.log(`Invited to ${invitation.teamDisplayName} via ${invitation.recipientEmail}`);
-   * }
-   * ```
-   */
-  listTeamInvitations(): Promise<ReceivedTeamInvitation[]>;
-  /**
-   * Lists all pending team invitations sent to any of the current user's verified email addresses.
-   *
-   * React hook version of `listTeamInvitations()`. Automatically re-renders when invitations change.
-   */
-  useTeamInvitations(): ReceivedTeamInvitation[];
-  getActiveSessions(): Promise<ActiveSession[]>;
-  revokeSession(sessionId: string): Promise<void>;
-  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>;
-  useTeamProfile(team: Team): EditableTeamMemberProfile;
-  createApiKey(options: ApiKeyCreationOptions<"user">): Promise<UserApiKeyFirstView>;
-  useOAuthProviders(): OAuthProvider[];
-  listOAuthProviders(): Promise<OAuthProvider[]>;
-  useOAuthProvider(id: string): OAuthProvider | null;
-  getOAuthProvider(id: string): Promise<OAuthProvider | null>;
-  registerPasskey(options?: {
-    hostname?: string;
-  }): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>>;
-} & AsyncStoreProperty<"apiKeys", [], UserApiKey[], true> & AsyncStoreProperty<"team", [id: string], Team | null, false> & AsyncStoreProperty<"teams", [], Team[], true> & AsyncStoreProperty<"teamInvitations", [], ReceivedTeamInvitation[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
-  recursive?: boolean;
-}], TeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
-  recursive?: boolean;
-}], TeamPermission[], true>;
-type InternalUserExtra = {
-  createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>;
-  transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>;
-} & AsyncStoreProperty<"ownedProjects", [], AdminOwnedProject[], true>;
-type User = BaseUser;
-type CurrentUser = BaseUser & Auth & UserExtra & Customer;
-type CurrentInternalUser = CurrentUser & InternalUserExtra;
-type ProjectCurrentUser<ProjectId> = ProjectId extends "internal" ? CurrentInternalUser : CurrentUser;
-type TokenPartialUser = Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "isAnonymous" | "isMultiFactorRequired" | "isRestricted" | "restrictedReason">;
-type SyncedPartialUser = TokenPartialUser & Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "profileImageUrl" | "signedUpAt" | "clientMetadata" | "clientReadOnlyMetadata" | "isAnonymous" | "hasPassword" | "isRestricted" | "restrictedReason">;
-type ActiveSession = {
-  id: string;
-  userId: string;
-  createdAt: Date;
-  isImpersonation: boolean;
-  lastUsedAt: Date | undefined;
-  isCurrentSession: boolean;
-  geoInfo?: GeoInfo;
-};
-type UserUpdateOptions = {
-  displayName?: string | null;
-  clientMetadata?: ReadonlyJson;
-  selectedTeamId?: string | null;
-  totpMultiFactorSecret?: Uint8Array | null;
-  profileImageUrl?: string | null;
-  otpAuthEnabled?: boolean;
-  passkeyAuthEnabled?: boolean;
-  primaryEmail?: string | null;
-};
-declare function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud["Client"]["Update"];
-type ServerBaseUser = {
-  setPrimaryEmail(email: string | null, options?: {
-    verified?: boolean | undefined;
-  }): Promise<void>;
-  readonly lastActiveAt: Date;
-  readonly serverMetadata: any;
-  setServerMetadata(metadata: any): Promise<void>;
-  setClientReadOnlyMetadata(metadata: any): Promise<void>; /** Whether the user is restricted by an administrator. Can be set manually or by sign-up rules. */
-  readonly restrictedByAdmin: boolean; /** Public reason shown to the user explaining why they are restricted. Optional. */
-  readonly restrictedByAdminReason: string | null; /** Private details about the restriction (e.g., which sign-up rule triggered). Only visible to server access and above. */
-  readonly restrictedByAdminPrivateDetails: string | null; /** Best-effort ISO country code captured at sign-up time from request geo headers. */
-  readonly countryCode: string | null; /** Server-only risk scores used during sign-up risk evaluation. */
-  readonly riskScores: {
-    readonly signUp: {
-      readonly bot: number;
-      readonly freeTrialAbuse: number;
-    };
-  };
-  createTeam(data: Omit<ServerTeamCreateOptions, "creatorUserId">): Promise<ServerTeam>;
-  useContactChannels(): ServerContactChannel[];
-  listContactChannels(): Promise<ServerContactChannel[]>;
-  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>;
-  update(user: ServerUserUpdateOptions): Promise<void>;
-  grantPermission(scope: Team, permissionId: string): Promise<void>;
-  grantPermission(permissionId: string): Promise<void>;
-  revokePermission(scope: Team, permissionId: string): Promise<void>;
-  revokePermission(permissionId: string): Promise<void>;
-  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>;
-  getPermission(permissionId: string): Promise<TeamPermission | null>;
-  hasPermission(scope: Team, permissionId: string): Promise<boolean>;
-  hasPermission(permissionId: string): Promise<boolean>;
-  listPermissions(scope: Team, options?: {
-    recursive?: boolean;
-  }): Promise<TeamPermission[]>;
-  listPermissions(options?: {
-    recursive?: boolean;
-  }): Promise<TeamPermission[]>;
-  usePermissions(scope: Team, options?: {
-    recursive?: boolean;
-  }): TeamPermission[];
-  usePermissions(options?: {
-    recursive?: boolean;
-  }): TeamPermission[];
-  usePermission(scope: Team, permissionId: string): TeamPermission | null;
-  usePermission(permissionId: string): TeamPermission | null;
-  useOAuthProviders(): ServerOAuthProvider[];
-  listOAuthProviders(): Promise<ServerOAuthProvider[]>;
-  useOAuthProvider(id: string): ServerOAuthProvider | null;
-  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>;
-  /**
-   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.
-   */
-  createSession(options?: {
-    expiresInMillis?: number;
-    isImpersonation?: boolean;
-  }): Promise<{
-    getTokens(): Promise<{
-      accessToken: string | null;
-      refreshToken: string | null;
-    }>;
-  }>;
-} & AsyncStoreProperty<"team", [id: string], ServerTeam | null, false> & AsyncStoreProperty<"teams", [options?: ServerListTeamsOptions], ServerTeam[] & {
-  nextCursor: string | null;
-}, true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
-  direct?: boolean;
-}], AdminTeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
-  direct?: boolean;
-}], AdminTeamPermission[], true>;
-/**
- * A user including sensitive fields that should only be used on the server, never sent to the client
- * (such as sensitive information and serverMetadata).
- */
-type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;
-type CurrentServerUser = Auth & ServerUser;
-type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;
-type ProjectCurrentServerUser<ProjectId> = ProjectId extends "internal" ? CurrentInternalServerUser : CurrentServerUser;
-type SyncedPartialServerUser = SyncedPartialUser & Pick<ServerUser, "serverMetadata">;
-type ServerUserUpdateOptions = {
-  primaryEmail?: string | null;
-  primaryEmailVerified?: boolean;
-  primaryEmailAuthEnabled?: boolean;
-  clientReadOnlyMetadata?: ReadonlyJson;
-  serverMetadata?: ReadonlyJson;
-  password?: string;
-  restrictedByAdmin?: boolean;
-  restrictedByAdminReason?: string | null;
-  restrictedByAdminPrivateDetails?: string | null;
-  countryCode?: string | null;
-  riskScores?: {
-    signUp: {
-      bot: number;
-      freeTrialAbuse: number;
-    };
-  };
-} & UserUpdateOptions;
-declare function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud["Server"]["Update"];
-type ServerUserCreateOptions = {
-  primaryEmail?: string | null;
-  primaryEmailAuthEnabled?: boolean;
-  password?: string;
-  otpAuthEnabled?: boolean;
-  displayName?: string;
-  primaryEmailVerified?: boolean;
-  clientMetadata?: any;
-  clientReadOnlyMetadata?: any;
-  serverMetadata?: any;
-  countryCode?: string | null;
-  riskScores?: {
-    signUp: {
-      bot: number;
-      freeTrialAbuse: number;
-    };
-  };
-};
-declare function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud["Server"]["Create"];
-//#endregion
-export { ActiveSession, Auth, BaseUser, CurrentInternalServerUser, CurrentInternalUser, CurrentServerUser, CurrentUser, InternalUserExtra, OAuthProvider, ProjectCurrentServerUser, ProjectCurrentUser, ServerBaseUser, ServerOAuthProvider, ServerUser, ServerUserCreateOptions, ServerUserUpdateOptions, SyncedPartialServerUser, SyncedPartialUser, TokenPartialUser, User, UserExtra, UserUpdateOptions, serverUserCreateOptionsToCrud, serverUserUpdateOptionsToCrud, userUpdateOptionsToCrud, withUserDestructureGuard };
-//# sourceMappingURL=index.d.ts.map
+import { Ct as UserExtra, Dt as userUpdateOptionsToCrud, Et as serverUserUpdateOptionsToCrud, Ot as withUserDestructureGuard, St as User, Tt as serverUserCreateOptionsToCrud, _t as ServerUserCreateOptions, at as BaseUser, bt as SyncedPartialUser, ct as CurrentServerUser, dt as OAuthProvider, ft as ProjectCurrentServerUser, gt as ServerUser, ht as ServerOAuthProvider, it as Auth, lt as CurrentUser, mt as ServerBaseUser, ot as CurrentInternalServerUser, pt as ProjectCurrentUser, rt as ActiveSession, st as CurrentInternalUser, ut as InternalUserExtra, vt as ServerUserUpdateOptions, wt as UserUpdateOptions, xt as TokenPartialUser, yt as SyncedPartialServerUser } from "../../../client-app-Bi8p4lxS.js";
+export { ActiveSession, Auth, BaseUser, CurrentInternalServerUser, CurrentInternalUser, CurrentServerUser, CurrentUser, InternalUserExtra, OAuthProvider, ProjectCurrentServerUser, ProjectCurrentUser, ServerBaseUser, ServerOAuthProvider, ServerUser, ServerUserCreateOptions, ServerUserUpdateOptions, SyncedPartialServerUser, SyncedPartialUser, TokenPartialUser, User, UserExtra, UserUpdateOptions, serverUserCreateOptionsToCrud, serverUserUpdateOptionsToCrud, userUpdateOptionsToCrud, withUserDestructureGuard };

package/dist/lib/hexclave-app/users/index.js

@@ -1,7 +1,5 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_chunk = require('../../../chunk-BE-pF4vm.js');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let _hexclave_shared_dist_utils_bytes = require("@hexclave/shared/dist/utils/bytes");
-
 //#region src/lib/hexclave-app/users/index.ts
 const userGetterErrorMessage = "Hexclave: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.";
 function withUserDestructureGuard(target) {
@@ -67,10 +65,10 @@ function serverUserCreateOptionsToCrud(options) {
 		} } : void 0
 	};
 }
-
 //#endregion
 exports.serverUserCreateOptionsToCrud = serverUserCreateOptionsToCrud;
 exports.serverUserUpdateOptionsToCrud = serverUserUpdateOptionsToCrud;
 exports.userUpdateOptionsToCrud = userUpdateOptionsToCrud;
 exports.withUserDestructureGuard = withUserDestructureGuard;
+
 //# sourceMappingURL=index.js.map

package/dist/lib/hexclave-app/users/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../src/lib/hexclave-app/users/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { CurrentUserCrud } from \"@hexclave/shared/dist/interface/crud/current-user\";\nimport { UsersCrud } from \"@hexclave/shared/dist/interface/crud/users\";\nimport type { RestrictedReason } from \"@hexclave/shared/dist/schema-fields\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport { encodeBase64 } from \"@hexclave/shared/dist/utils/bytes\";\nimport { GeoInfo } from \"@hexclave/shared/dist/utils/geo\";\nimport { ReadonlyJson } from \"@hexclave/shared/dist/utils/json\";\nimport { ProviderType } from \"@hexclave/shared/dist/utils/oauth\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from \"../api-keys\";\nimport { AsyncStoreProperty, AuthLike } from \"../common\";\nimport { DeprecatedOAuthConnection, OAuthConnection } from \"../connected-accounts\";\nimport { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from \"../contact-channels\";\nimport { Customer } from \"../customers\";\nimport { NotificationCategory } from \"../notification-categories\";\nimport { AdminTeamPermission, TeamPermission } from \"../permissions\";\nimport { AdminOwnedProject, AdminProjectCreateOptions } from \"../projects\";\nimport { EditableTeamMemberProfile, ReceivedTeamInvitation, ServerListTeamsOptions, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from \"../teams\";\n\nconst userGetterErrorMessage = \"Hexclave: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.\";\n\nexport function withUserDestructureGuard<T extends object>(target: T): T {\n  Object.freeze(target);\n  return new Proxy(target, {\n    get(target, prop, receiver) {\n      if (prop === \"user\") {\n        return guardGetter();\n      }\n      return target[prop as keyof T];\n    },\n  });\n}\n\nfunction guardGetter(): never {\n  throw new Error(userGetterErrorMessage);\n}\n\nexport type OAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId?: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\nexport type ServerOAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { accountId?: string, email?: string, allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\n\n/**\n * Contains everything related to the current user session.\n */\nexport type Auth = AuthLike<{}> & {\n  readonly _internalSession: InternalSession,\n  readonly currentSession: {\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n    useTokens(): { accessToken: string | null, refreshToken: string | null }, // THIS_LINE_PLATFORM react-like\n  },\n};\n\n/**\n * ```\n * +----------+-------------+-------------------+\n * |    \\     |   !Server   |      Server       |\n * +----------+-------------+-------------------+\n * | !Session | User        | ServerUser        |\n * | Session  | CurrentUser | CurrentServerUser |\n * +----------+-------------+-------------------+\n * ```\n *\n * The fields on each of these types are available iff:\n * BaseUser: true\n * Auth: Session\n * ServerBaseUser: Server\n * UserExtra: Session OR Server\n *\n * The types are defined as follows (in the typescript manner):\n * User = BaseUser\n * CurrentUser = BaseUser & Auth & UserExtra\n * ServerUser = BaseUser & ServerBaseUser & UserExtra\n * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra\n **/\n\nexport type BaseUser = {\n  readonly id: string,\n\n  readonly displayName: string | null,\n\n  /**\n   * The user's email address.\n   *\n   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.\n   */\n  readonly primaryEmail: string | null,\n  readonly primaryEmailVerified: boolean,\n  readonly profileImageUrl: string | null,\n\n  readonly signedUpAt: Date,\n\n  readonly clientMetadata: any,\n  readonly clientReadOnlyMetadata: any,\n\n  /**\n   * Whether the user has a password set.\n   */\n  readonly hasPassword: boolean,\n  readonly otpAuthEnabled: boolean,\n  readonly passkeyAuthEnabled: boolean,\n\n  readonly isMultiFactorRequired: boolean,\n  readonly isAnonymous: boolean,\n  /**\n   * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).\n   * For example, if email verification is required but the user hasn't verified their email yet.\n   */\n  readonly isRestricted: boolean,\n  /**\n   * The reason why the user is restricted, e.g., { type: \"email_not_verified\" }, { type: \"anonymous\" }, or { type: \"restricted_by_administrator\" }.\n   * Null if the user is not restricted.\n   */\n  readonly restrictedReason: RestrictedReason | null,\n  toClientJson(): CurrentUserCrud[\"Client\"][\"Read\"],\n\n  /**\n   * @deprecated, use contact channel's usedForAuth instead\n   */\n  readonly emailAuthEnabled: boolean,\n  /**\n   * @deprecated\n   */\n  readonly oauthProviders: readonly { id: string }[],\n}\n\nexport type UserExtra = {\n  setDisplayName(displayName: string | null): Promise<void>,\n  /** @deprecated Use contact channel's sendVerificationEmail instead */\n  sendVerificationEmail(): Promise<KnownErrors[\"EmailAlreadyVerified\"] | void>,\n  setClientMetadata(metadata: any): Promise<void>,\n  updatePassword(options: { oldPassword: string, newPassword: string}): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n  setPassword(options: { password: string }): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n\n  /**\n   * A shorthand method to update multiple fields of the user at once.\n   */\n  update(update: UserUpdateOptions): Promise<void>,\n\n  useContactChannels(): ContactChannel[], // THIS_LINE_PLATFORM react-like\n  listContactChannels(): Promise<ContactChannel[]>,\n  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>,\n\n  useNotificationCategories(): NotificationCategory[], // THIS_LINE_PLATFORM react-like\n  listNotificationCategories(): Promise<NotificationCategory[]>,\n\n  delete(): Promise<void>,\n\n  /** @deprecated Use `getOrLinkConnectedAccount` for redirect behavior, or `getConnectedAccount({ provider, providerAccountId })` for existence check. */\n  getConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): Promise<DeprecatedOAuthConnection>,\n  /** @deprecated Use `getConnectedAccount({ provider, providerAccountId })` for existence check, or `getOrLinkConnectedAccount` for redirect behavior. */\n  getConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): Promise<DeprecatedOAuthConnection | null>,\n  /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */\n  getConnectedAccount(account: { provider: string, providerAccountId: string }): Promise<OAuthConnection | null>,\n\n  /** @deprecated Use `useOrLinkConnectedAccount` for redirect behavior, or `useConnectedAccount({ provider, providerAccountId })` for existence check. */\n  useConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): DeprecatedOAuthConnection,\n  /** @deprecated Use `useConnectedAccount({ provider, providerAccountId })` for existence check, or `useOrLinkConnectedAccount` for redirect behavior. */\n  useConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): DeprecatedOAuthConnection | null,\n  /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */\n  useConnectedAccount(account: { provider: string, providerAccountId: string }): OAuthConnection | null,\n\n  /** List all connected accounts for this user (only those with allowConnectedAccounts enabled). */\n  listConnectedAccounts(): Promise<OAuthConnection[]>,\n  /** React hook to list all connected accounts. */\n  useConnectedAccounts(): OAuthConnection[], // THIS_LINE_PLATFORM react-like\n  /** Redirect the user to the OAuth flow to link a new connected account. Always redirects, never returns. */\n  linkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<void>,\n  /** Get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n  getOrLinkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<OAuthConnection>,\n  /** React hook: get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n  useOrLinkConnectedAccount(provider: string, options?: { scopes?: string[] }): OAuthConnection, // THIS_LINE_PLATFORM react-like\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n  usePermissions(scope: Team, options?: { recursive?: boolean }): TeamPermission[],\n  usePermissions(options?: { recursive?: boolean }): TeamPermission[],\n\n  usePermission(scope: Team, permissionId: string): TeamPermission | null,\n  usePermission(permissionId: string): TeamPermission | null,\n\n  readonly selectedTeam: Team | null,\n  setSelectedTeam(teamOrId: string | Team | null): Promise<void>,\n  createTeam(data: TeamCreateOptions): Promise<Team>,\n  leaveTeam(team: Team): Promise<void>,\n\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * This allows the user to discover which teams have invited them, even if they haven't\n   * joined those teams yet. Only invitations sent to verified email addresses are included.\n   *\n   * @returns An array of `ReceivedTeamInvitation` objects, each containing the team ID, team\n   * display name, recipient email, and expiration date.\n   *\n   * @example\n   * ```ts\n   * const invitations = await user.listTeamInvitations();\n   * for (const invitation of invitations) {\n   *   console.log(`Invited to ${invitation.teamDisplayName} via ${invitation.recipientEmail}`);\n   * }\n   * ```\n   */\n  listTeamInvitations(): Promise<ReceivedTeamInvitation[]>,\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * React hook version of `listTeamInvitations()`. Automatically re-renders when invitations change.\n   */\n  useTeamInvitations(): ReceivedTeamInvitation[], // THIS_LINE_PLATFORM react-like\n\n  getActiveSessions(): Promise<ActiveSession[]>,\n  revokeSession(sessionId: string): Promise<void>,\n  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>,\n  useTeamProfile(team: Team): EditableTeamMemberProfile, // THIS_LINE_PLATFORM react-like\n\n  createApiKey(options: ApiKeyCreationOptions<\"user\">): Promise<UserApiKeyFirstView>,\n\n  useOAuthProviders(): OAuthProvider[], // THIS_LINE_PLATFORM react-like\n  listOAuthProviders(): Promise<OAuthProvider[]>,\n\n  useOAuthProvider(id: string): OAuthProvider | null, // THIS_LINE_PLATFORM react-like\n  getOAuthProvider(id: string): Promise<OAuthProvider | null>,\n\n  registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n}\n& AsyncStoreProperty<\"apiKeys\", [], UserApiKey[], true>\n& AsyncStoreProperty<\"team\", [id: string], Team | null, false>\n& AsyncStoreProperty<\"teams\", [], Team[], true>\n& AsyncStoreProperty<\"teamInvitations\", [], ReceivedTeamInvitation[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { recursive?: boolean }], TeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { recursive?: boolean }], TeamPermission[], true>;\n\nexport type InternalUserExtra =\n  & {\n    createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>,\n    transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>,\n  }\n  & AsyncStoreProperty<\"ownedProjects\", [], AdminOwnedProject[], true>\n\nexport type User = BaseUser;\n\nexport type CurrentUser = BaseUser & Auth & UserExtra & Customer;\n\nexport type CurrentInternalUser = CurrentUser & InternalUserExtra;\n\nexport type ProjectCurrentUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalUser : CurrentUser;\n\nexport type TokenPartialUser = Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"isAnonymous\"\n  | \"isMultiFactorRequired\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>\n\nexport type SyncedPartialUser = TokenPartialUser & Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"profileImageUrl\"\n  | \"signedUpAt\"\n  | \"clientMetadata\"\n  | \"clientReadOnlyMetadata\"\n  | \"isAnonymous\"\n  | \"hasPassword\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>;\n\n\nexport type ActiveSession = {\n  id: string,\n  userId: string,\n  createdAt: Date,\n  isImpersonation: boolean,\n  lastUsedAt: Date | undefined,\n  isCurrentSession: boolean,\n  geoInfo?: GeoInfo,\n};\n\nexport type UserUpdateOptions = {\n  displayName?: string | null,\n  clientMetadata?: ReadonlyJson,\n  selectedTeamId?: string | null,\n  totpMultiFactorSecret?: Uint8Array | null,\n  profileImageUrl?: string | null,\n  otpAuthEnabled?: boolean,\n  passkeyAuthEnabled?: boolean,\n  primaryEmail?: string | null,\n}\nexport function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud[\"Client\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    client_metadata: options.clientMetadata,\n    selected_team_id: options.selectedTeamId,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n    profile_image_url: options.profileImageUrl,\n    otp_auth_enabled: options.otpAuthEnabled,\n    passkey_auth_enabled: options.passkeyAuthEnabled,\n    primary_email: options.primaryEmail,\n  };\n}\n\n\nexport type ServerBaseUser = {\n  setPrimaryEmail(email: string | null, options?: { verified?: boolean | undefined }): Promise<void>,\n\n  readonly lastActiveAt: Date,\n\n  readonly serverMetadata: any,\n  setServerMetadata(metadata: any): Promise<void>,\n  setClientReadOnlyMetadata(metadata: any): Promise<void>,\n\n  /** Whether the user is restricted by an administrator. Can be set manually or by sign-up rules. */\n  readonly restrictedByAdmin: boolean,\n  /** Public reason shown to the user explaining why they are restricted. Optional. */\n  readonly restrictedByAdminReason: string | null,\n  /** Private details about the restriction (e.g., which sign-up rule triggered). Only visible to server access and above. */\n  readonly restrictedByAdminPrivateDetails: string | null,\n  /** Best-effort ISO country code captured at sign-up time from request geo headers. */\n  readonly countryCode: string | null,\n  /** Server-only risk scores used during sign-up risk evaluation. */\n  readonly riskScores: {\n    readonly signUp: {\n      readonly bot: number,\n      readonly freeTrialAbuse: number,\n    },\n  },\n\n  createTeam(data: Omit<ServerTeamCreateOptions, \"creatorUserId\">): Promise<ServerTeam>,\n\n  useContactChannels(): ServerContactChannel[], // THIS_LINE_PLATFORM react-like\n  listContactChannels(): Promise<ServerContactChannel[]>,\n  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>,\n\n  update(user: ServerUserUpdateOptions): Promise<void>,\n\n  grantPermission(scope: Team, permissionId: string): Promise<void>,\n  grantPermission(permissionId: string): Promise<void>,\n\n  revokePermission(scope: Team, permissionId: string): Promise<void>,\n  revokePermission(permissionId: string): Promise<void>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n  usePermissions(scope: Team, options?: { recursive?: boolean }): TeamPermission[],\n  usePermissions(options?: { recursive?: boolean }): TeamPermission[],\n\n  usePermission(scope: Team, permissionId: string): TeamPermission | null,\n  usePermission(permissionId: string): TeamPermission | null,\n\n  useOAuthProviders(): ServerOAuthProvider[], // THIS_LINE_PLATFORM react-like\n  listOAuthProviders(): Promise<ServerOAuthProvider[]>,\n\n  useOAuthProvider(id: string): ServerOAuthProvider | null, // THIS_LINE_PLATFORM react-like\n  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>,\n\n  /**\n   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.\n   */\n  createSession(options?: { expiresInMillis?: number, isImpersonation?: boolean }): Promise<{\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  }>,\n}\n& AsyncStoreProperty<\"team\", [id: string], ServerTeam | null, false>\n& AsyncStoreProperty<\"teams\", [options?: ServerListTeamsOptions], ServerTeam[] & { nextCursor: string | null }, true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { direct?: boolean }], AdminTeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { direct?: boolean }], AdminTeamPermission[], true>;\n\n/**\n * A user including sensitive fields that should only be used on the server, never sent to the client\n * (such as sensitive information and serverMetadata).\n */\nexport type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;\n\nexport type CurrentServerUser = Auth & ServerUser;\n\nexport type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;\n\nexport type ProjectCurrentServerUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalServerUser : CurrentServerUser;\n\nexport type SyncedPartialServerUser = SyncedPartialUser & Pick<\n  ServerUser,\n  | \"serverMetadata\"\n>;\n\nexport type ServerUserUpdateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailVerified?: boolean,\n  primaryEmailAuthEnabled?: boolean,\n  clientReadOnlyMetadata?: ReadonlyJson,\n  serverMetadata?: ReadonlyJson,\n  password?: string,\n  restrictedByAdmin?: boolean,\n  restrictedByAdminReason?: string | null,\n  restrictedByAdminPrivateDetails?: string | null,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n} & UserUpdateOptions;\nexport function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud[\"Server\"][\"Update\"] {\n  // Base update options\n  const baseUpdate: CurrentUserCrud[\"Server\"][\"Update\"] = {\n    display_name: options.displayName,\n    primary_email: options.primaryEmail,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    selected_team_id: options.selectedTeamId,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    primary_email_verified: options.primaryEmailVerified,\n    password: options.password,\n    profile_image_url: options.profileImageUrl,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n  };\n  return {\n    ...baseUpdate,\n    restricted_by_admin: options.restrictedByAdmin,\n    restricted_by_admin_reason: options.restrictedByAdminReason,\n    restricted_by_admin_private_details: options.restrictedByAdminPrivateDetails,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n\n\nexport type ServerUserCreateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailAuthEnabled?: boolean,\n  password?: string,\n  otpAuthEnabled?: boolean,\n  displayName?: string,\n  primaryEmailVerified?: boolean,\n  clientMetadata?: any,\n  clientReadOnlyMetadata?: any,\n  serverMetadata?: any,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n}\nexport function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud[\"Server\"][\"Create\"] {\n  return {\n    primary_email: options.primaryEmail,\n    password: options.password,\n    otp_auth_enabled: options.otpAuthEnabled,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    display_name: options.displayName,\n    primary_email_verified: options.primaryEmailVerified,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n"],"mappings":";;;;;AAwBA,MAAM,yBAAyB;AAE/B,SAAgB,yBAA2C,QAAc;AACvE,QAAO,OAAO,OAAO;AACrB,QAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;AAC1B,MAAI,SAAS,OACX,QAAO,aAAa;AAEtB,SAAO,OAAO;IAEjB,CAAC;;AAGJ,SAAS,cAAqB;AAC5B,OAAM,IAAI,MAAM,uBAAuB;;AAsSzC,SAAgB,wBAAwB,SAAiE;AACvG,QAAO;EACL,cAAc,QAAQ;EACtB,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,oBAAoB,QAAQ,yBAAyB,2DAAoB,QAAQ,sBAAsB,GAAG,QAAQ;EAClH,mBAAmB,QAAQ;EAC3B,kBAAkB,QAAQ;EAC1B,sBAAsB,QAAQ;EAC9B,eAAe,QAAQ;EACxB;;AA+GH,SAAgB,8BAA8B,SAAuE;AAenH,QAAO;EAZL,cAAc,QAAQ;EACtB,eAAe,QAAQ;EACvB,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,wBAAwB,QAAQ;EAChC,UAAU,QAAQ;EAClB,mBAAmB,QAAQ;EAC3B,oBAAoB,QAAQ,yBAAyB,2DAAoB,QAAQ,sBAAsB,GAAG,QAAQ;EAIlH,qBAAqB,QAAQ;EAC7B,4BAA4B,QAAQ;EACpC,qCAAqC,QAAQ;EAC7C,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;GAC7C,EACF,GAAG;EACL;;AAsBH,SAAgB,8BAA8B,SAAiE;AAC7G,QAAO;EACL,eAAe,QAAQ;EACvB,UAAU,QAAQ;EAClB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,cAAc,QAAQ;EACtB,wBAAwB,QAAQ;EAChC,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;GAC7C,EACF,GAAG;EACL"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/lib/hexclave-app/users/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { CurrentUserCrud } from \"@hexclave/shared/dist/interface/crud/current-user\";\nimport { UsersCrud } from \"@hexclave/shared/dist/interface/crud/users\";\nimport type { RestrictedReason } from \"@hexclave/shared/dist/schema-fields\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport { encodeBase64 } from \"@hexclave/shared/dist/utils/bytes\";\nimport { GeoInfo } from \"@hexclave/shared/dist/utils/geo\";\nimport { ReadonlyJson } from \"@hexclave/shared/dist/utils/json\";\nimport { ProviderType } from \"@hexclave/shared/dist/utils/oauth\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { ApiKeyCreationOptions, UserApiKey, UserApiKeyFirstView } from \"../api-keys\";\nimport { AsyncStoreProperty, AuthLike } from \"../common\";\nimport { DeprecatedOAuthConnection, OAuthConnection } from \"../connected-accounts\";\nimport { ContactChannel, ContactChannelCreateOptions, ServerContactChannel, ServerContactChannelCreateOptions } from \"../contact-channels\";\nimport { Customer } from \"../customers\";\nimport { NotificationCategory } from \"../notification-categories\";\nimport { AdminTeamPermission, TeamPermission } from \"../permissions\";\nimport { AdminOwnedProject, AdminProjectCreateOptions } from \"../projects\";\nimport { EditableTeamMemberProfile, ReceivedTeamInvitation, ServerListTeamsOptions, ServerTeam, ServerTeamCreateOptions, Team, TeamCreateOptions } from \"../teams\";\n\nconst userGetterErrorMessage = \"Hexclave: useUser() already returns the user object. Use `const user = useUser()` (or `const user = await app.getUser()`) instead of destructuring it like `const { user } = ...`.\";\n\nexport function withUserDestructureGuard<T extends object>(target: T): T {\n  Object.freeze(target);\n  return new Proxy(target, {\n    get(target, prop, receiver) {\n      if (prop === \"user\") {\n        return guardGetter();\n      }\n      return target[prop as keyof T];\n    },\n  });\n}\n\nfunction guardGetter(): never {\n  throw new Error(userGetterErrorMessage);\n}\n\nexport type OAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId?: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\nexport type ServerOAuthProvider = {\n  readonly id: string,\n  readonly type: string,\n  readonly userId: string,\n  readonly accountId: string,\n  readonly email?: string,\n  readonly allowSignIn: boolean,\n  readonly allowConnectedAccounts: boolean,\n  update(data: { accountId?: string, email?: string, allowSignIn?: boolean, allowConnectedAccounts?: boolean }): Promise<Result<void,\n    InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>\n  >>,\n  delete(): Promise<void>,\n};\n\n\n/**\n * Contains everything related to the current user session.\n */\nexport type Auth = AuthLike<{}> & {\n  readonly _internalSession: InternalSession,\n  readonly currentSession: {\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n    useTokens(): { accessToken: string | null, refreshToken: string | null }, // THIS_LINE_PLATFORM react-like\n  },\n};\n\n/**\n * ```\n * +----------+-------------+-------------------+\n * |    \\     |   !Server   |      Server       |\n * +----------+-------------+-------------------+\n * | !Session | User        | ServerUser        |\n * | Session  | CurrentUser | CurrentServerUser |\n * +----------+-------------+-------------------+\n * ```\n *\n * The fields on each of these types are available iff:\n * BaseUser: true\n * Auth: Session\n * ServerBaseUser: Server\n * UserExtra: Session OR Server\n *\n * The types are defined as follows (in the typescript manner):\n * User = BaseUser\n * CurrentUser = BaseUser & Auth & UserExtra\n * ServerUser = BaseUser & ServerBaseUser & UserExtra\n * CurrentServerUser = BaseUser & ServerBaseUser & Auth & UserExtra\n **/\n\nexport type BaseUser = {\n  readonly id: string,\n\n  readonly displayName: string | null,\n\n  /**\n   * The user's email address.\n   *\n   * Note: This might NOT be unique across multiple users, so always use `id` for unique identification.\n   */\n  readonly primaryEmail: string | null,\n  readonly primaryEmailVerified: boolean,\n  readonly profileImageUrl: string | null,\n\n  readonly signedUpAt: Date,\n\n  readonly clientMetadata: any,\n  readonly clientReadOnlyMetadata: any,\n\n  /**\n   * Whether the user has a password set.\n   */\n  readonly hasPassword: boolean,\n  readonly otpAuthEnabled: boolean,\n  readonly passkeyAuthEnabled: boolean,\n\n  readonly isMultiFactorRequired: boolean,\n  readonly isAnonymous: boolean,\n  /**\n   * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).\n   * For example, if email verification is required but the user hasn't verified their email yet.\n   */\n  readonly isRestricted: boolean,\n  /**\n   * The reason why the user is restricted, e.g., { type: \"email_not_verified\" }, { type: \"anonymous\" }, or { type: \"restricted_by_administrator\" }.\n   * Null if the user is not restricted.\n   */\n  readonly restrictedReason: RestrictedReason | null,\n  toClientJson(): CurrentUserCrud[\"Client\"][\"Read\"],\n\n  /**\n   * @deprecated, use contact channel's usedForAuth instead\n   */\n  readonly emailAuthEnabled: boolean,\n  /**\n   * @deprecated\n   */\n  readonly oauthProviders: readonly { id: string }[],\n}\n\nexport type UserExtra = {\n  setDisplayName(displayName: string | null): Promise<void>,\n  /** @deprecated Use contact channel's sendVerificationEmail instead */\n  sendVerificationEmail(): Promise<KnownErrors[\"EmailAlreadyVerified\"] | void>,\n  setClientMetadata(metadata: any): Promise<void>,\n  updatePassword(options: { oldPassword: string, newPassword: string}): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n  setPassword(options: { password: string }): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | void>,\n\n  /**\n   * A shorthand method to update multiple fields of the user at once.\n   */\n  update(update: UserUpdateOptions): Promise<void>,\n\n  useContactChannels(): ContactChannel[], // THIS_LINE_PLATFORM react-like\n  listContactChannels(): Promise<ContactChannel[]>,\n  createContactChannel(data: ContactChannelCreateOptions): Promise<ContactChannel>,\n\n  useNotificationCategories(): NotificationCategory[], // THIS_LINE_PLATFORM react-like\n  listNotificationCategories(): Promise<NotificationCategory[]>,\n\n  delete(): Promise<void>,\n\n  /** @deprecated Use `getOrLinkConnectedAccount` for redirect behavior, or `getConnectedAccount({ provider, providerAccountId })` for existence check. */\n  getConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): Promise<DeprecatedOAuthConnection>,\n  /** @deprecated Use `getConnectedAccount({ provider, providerAccountId })` for existence check, or `getOrLinkConnectedAccount` for redirect behavior. */\n  getConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): Promise<DeprecatedOAuthConnection | null>,\n  /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */\n  getConnectedAccount(account: { provider: string, providerAccountId: string }): Promise<OAuthConnection | null>,\n\n  /** @deprecated Use `useOrLinkConnectedAccount` for redirect behavior, or `useConnectedAccount({ provider, providerAccountId })` for existence check. */\n  useConnectedAccount(id: ProviderType, options: { or: 'redirect', scopes?: string[] }): DeprecatedOAuthConnection,\n  /** @deprecated Use `useConnectedAccount({ provider, providerAccountId })` for existence check, or `useOrLinkConnectedAccount` for redirect behavior. */\n  useConnectedAccount(id: ProviderType, options?: { or?: 'redirect' | 'throw' | 'return-null', scopes?: string[] }): DeprecatedOAuthConnection | null,\n  /** Get a specific connected account by provider and providerAccountId. Returns null if not found. */\n  useConnectedAccount(account: { provider: string, providerAccountId: string }): OAuthConnection | null,\n\n  /** List all connected accounts for this user (only those with allowConnectedAccounts enabled). */\n  listConnectedAccounts(): Promise<OAuthConnection[]>,\n  /** React hook to list all connected accounts. */\n  useConnectedAccounts(): OAuthConnection[], // THIS_LINE_PLATFORM react-like\n  /** Redirect the user to the OAuth flow to link a new connected account. Always redirects, never returns. */\n  linkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<void>,\n  /** Get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n  getOrLinkConnectedAccount(provider: string, options?: { scopes?: string[] }): Promise<OAuthConnection>,\n  /** React hook: get a connected account for the given provider, or redirect to link one if none exists or the token/scopes are insufficient. */\n  useOrLinkConnectedAccount(provider: string, options?: { scopes?: string[] }): OAuthConnection, // THIS_LINE_PLATFORM react-like\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n  usePermissions(scope: Team, options?: { recursive?: boolean }): TeamPermission[],\n  usePermissions(options?: { recursive?: boolean }): TeamPermission[],\n\n  usePermission(scope: Team, permissionId: string): TeamPermission | null,\n  usePermission(permissionId: string): TeamPermission | null,\n\n  readonly selectedTeam: Team | null,\n  setSelectedTeam(teamOrId: string | Team | null): Promise<void>,\n  createTeam(data: TeamCreateOptions): Promise<Team>,\n  leaveTeam(team: Team): Promise<void>,\n\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * This allows the user to discover which teams have invited them, even if they haven't\n   * joined those teams yet. Only invitations sent to verified email addresses are included.\n   *\n   * @returns An array of `ReceivedTeamInvitation` objects, each containing the team ID, team\n   * display name, recipient email, and expiration date.\n   *\n   * @example\n   * ```ts\n   * const invitations = await user.listTeamInvitations();\n   * for (const invitation of invitations) {\n   *   console.log(`Invited to ${invitation.teamDisplayName} via ${invitation.recipientEmail}`);\n   * }\n   * ```\n   */\n  listTeamInvitations(): Promise<ReceivedTeamInvitation[]>,\n  /**\n   * Lists all pending team invitations sent to any of the current user's verified email addresses.\n   *\n   * React hook version of `listTeamInvitations()`. Automatically re-renders when invitations change.\n   */\n  useTeamInvitations(): ReceivedTeamInvitation[], // THIS_LINE_PLATFORM react-like\n\n  getActiveSessions(): Promise<ActiveSession[]>,\n  revokeSession(sessionId: string): Promise<void>,\n  getTeamProfile(team: Team): Promise<EditableTeamMemberProfile>,\n  useTeamProfile(team: Team): EditableTeamMemberProfile, // THIS_LINE_PLATFORM react-like\n\n  createApiKey(options: ApiKeyCreationOptions<\"user\">): Promise<UserApiKeyFirstView>,\n\n  useOAuthProviders(): OAuthProvider[], // THIS_LINE_PLATFORM react-like\n  listOAuthProviders(): Promise<OAuthProvider[]>,\n\n  useOAuthProvider(id: string): OAuthProvider | null, // THIS_LINE_PLATFORM react-like\n  getOAuthProvider(id: string): Promise<OAuthProvider | null>,\n\n  registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n}\n& AsyncStoreProperty<\"apiKeys\", [], UserApiKey[], true>\n& AsyncStoreProperty<\"team\", [id: string], Team | null, false>\n& AsyncStoreProperty<\"teams\", [], Team[], true>\n& AsyncStoreProperty<\"teamInvitations\", [], ReceivedTeamInvitation[], true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { recursive?: boolean }], TeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { recursive?: boolean }], TeamPermission[], true>;\n\nexport type InternalUserExtra =\n  & {\n    createProject(newProject: AdminProjectCreateOptions): Promise<AdminOwnedProject>,\n    transferProject(projectIdToTransfer: string, newTeamId: string): Promise<void>,\n  }\n  & AsyncStoreProperty<\"ownedProjects\", [], AdminOwnedProject[], true>\n\nexport type User = BaseUser;\n\nexport type CurrentUser = BaseUser & Auth & UserExtra & Customer;\n\nexport type CurrentInternalUser = CurrentUser & InternalUserExtra;\n\nexport type ProjectCurrentUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalUser : CurrentUser;\n\nexport type TokenPartialUser = Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"isAnonymous\"\n  | \"isMultiFactorRequired\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>\n\nexport type SyncedPartialUser = TokenPartialUser & Pick<\n  User,\n  | \"id\"\n  | \"displayName\"\n  | \"primaryEmail\"\n  | \"primaryEmailVerified\"\n  | \"profileImageUrl\"\n  | \"signedUpAt\"\n  | \"clientMetadata\"\n  | \"clientReadOnlyMetadata\"\n  | \"isAnonymous\"\n  | \"hasPassword\"\n  | \"isRestricted\"\n  | \"restrictedReason\"\n>;\n\n\nexport type ActiveSession = {\n  id: string,\n  userId: string,\n  createdAt: Date,\n  isImpersonation: boolean,\n  lastUsedAt: Date | undefined,\n  isCurrentSession: boolean,\n  geoInfo?: GeoInfo,\n};\n\nexport type UserUpdateOptions = {\n  displayName?: string | null,\n  clientMetadata?: ReadonlyJson,\n  selectedTeamId?: string | null,\n  totpMultiFactorSecret?: Uint8Array | null,\n  profileImageUrl?: string | null,\n  otpAuthEnabled?: boolean,\n  passkeyAuthEnabled?: boolean,\n  primaryEmail?: string | null,\n}\nexport function userUpdateOptionsToCrud(options: UserUpdateOptions): CurrentUserCrud[\"Client\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    client_metadata: options.clientMetadata,\n    selected_team_id: options.selectedTeamId,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n    profile_image_url: options.profileImageUrl,\n    otp_auth_enabled: options.otpAuthEnabled,\n    passkey_auth_enabled: options.passkeyAuthEnabled,\n    primary_email: options.primaryEmail,\n  };\n}\n\n\nexport type ServerBaseUser = {\n  setPrimaryEmail(email: string | null, options?: { verified?: boolean | undefined }): Promise<void>,\n\n  readonly lastActiveAt: Date,\n\n  readonly serverMetadata: any,\n  setServerMetadata(metadata: any): Promise<void>,\n  setClientReadOnlyMetadata(metadata: any): Promise<void>,\n\n  /** Whether the user is restricted by an administrator. Can be set manually or by sign-up rules. */\n  readonly restrictedByAdmin: boolean,\n  /** Public reason shown to the user explaining why they are restricted. Optional. */\n  readonly restrictedByAdminReason: string | null,\n  /** Private details about the restriction (e.g., which sign-up rule triggered). Only visible to server access and above. */\n  readonly restrictedByAdminPrivateDetails: string | null,\n  /** Best-effort ISO country code captured at sign-up time from request geo headers. */\n  readonly countryCode: string | null,\n  /** Server-only risk scores used during sign-up risk evaluation. */\n  readonly riskScores: {\n    readonly signUp: {\n      readonly bot: number,\n      readonly freeTrialAbuse: number,\n    },\n  },\n\n  createTeam(data: Omit<ServerTeamCreateOptions, \"creatorUserId\">): Promise<ServerTeam>,\n\n  useContactChannels(): ServerContactChannel[], // THIS_LINE_PLATFORM react-like\n  listContactChannels(): Promise<ServerContactChannel[]>,\n  createContactChannel(data: ServerContactChannelCreateOptions): Promise<ServerContactChannel>,\n\n  update(user: ServerUserUpdateOptions): Promise<void>,\n\n  grantPermission(scope: Team, permissionId: string): Promise<void>,\n  grantPermission(permissionId: string): Promise<void>,\n\n  revokePermission(scope: Team, permissionId: string): Promise<void>,\n  revokePermission(permissionId: string): Promise<void>,\n\n  getPermission(scope: Team, permissionId: string): Promise<TeamPermission | null>,\n  getPermission(permissionId: string): Promise<TeamPermission | null>,\n\n  hasPermission(scope: Team, permissionId: string): Promise<boolean>,\n  hasPermission(permissionId: string): Promise<boolean>,\n\n  listPermissions(scope: Team, options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n  listPermissions(options?: { recursive?: boolean }): Promise<TeamPermission[]>,\n\n  usePermissions(scope: Team, options?: { recursive?: boolean }): TeamPermission[],\n  usePermissions(options?: { recursive?: boolean }): TeamPermission[],\n\n  usePermission(scope: Team, permissionId: string): TeamPermission | null,\n  usePermission(permissionId: string): TeamPermission | null,\n\n  useOAuthProviders(): ServerOAuthProvider[], // THIS_LINE_PLATFORM react-like\n  listOAuthProviders(): Promise<ServerOAuthProvider[]>,\n\n  useOAuthProvider(id: string): ServerOAuthProvider | null, // THIS_LINE_PLATFORM react-like\n  getOAuthProvider(id: string): Promise<ServerOAuthProvider | null>,\n\n  /**\n   * Creates a new session object with a refresh token for this user. Can be used to impersonate them.\n   */\n  createSession(options?: { expiresInMillis?: number, isImpersonation?: boolean }): Promise<{\n    getTokens(): Promise<{ accessToken: string | null, refreshToken: string | null }>,\n  }>,\n}\n& AsyncStoreProperty<\"team\", [id: string], ServerTeam | null, false>\n& AsyncStoreProperty<\"teams\", [options?: ServerListTeamsOptions], ServerTeam[] & { nextCursor: string | null }, true>\n& AsyncStoreProperty<\"permission\", [scope: Team, permissionId: string, options?: { direct?: boolean }], AdminTeamPermission | null, false>\n& AsyncStoreProperty<\"permissions\", [scope: Team, options?: { direct?: boolean }], AdminTeamPermission[], true>;\n\n/**\n * A user including sensitive fields that should only be used on the server, never sent to the client\n * (such as sensitive information and serverMetadata).\n */\nexport type ServerUser = ServerBaseUser & BaseUser & UserExtra & Customer<true>;\n\nexport type CurrentServerUser = Auth & ServerUser;\n\nexport type CurrentInternalServerUser = CurrentServerUser & InternalUserExtra;\n\nexport type ProjectCurrentServerUser<ProjectId> = ProjectId extends \"internal\" ? CurrentInternalServerUser : CurrentServerUser;\n\nexport type SyncedPartialServerUser = SyncedPartialUser & Pick<\n  ServerUser,\n  | \"serverMetadata\"\n>;\n\nexport type ServerUserUpdateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailVerified?: boolean,\n  primaryEmailAuthEnabled?: boolean,\n  clientReadOnlyMetadata?: ReadonlyJson,\n  serverMetadata?: ReadonlyJson,\n  password?: string,\n  restrictedByAdmin?: boolean,\n  restrictedByAdminReason?: string | null,\n  restrictedByAdminPrivateDetails?: string | null,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n} & UserUpdateOptions;\nexport function serverUserUpdateOptionsToCrud(options: ServerUserUpdateOptions): CurrentUserCrud[\"Server\"][\"Update\"] {\n  // Base update options\n  const baseUpdate: CurrentUserCrud[\"Server\"][\"Update\"] = {\n    display_name: options.displayName,\n    primary_email: options.primaryEmail,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    selected_team_id: options.selectedTeamId,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    primary_email_verified: options.primaryEmailVerified,\n    password: options.password,\n    profile_image_url: options.profileImageUrl,\n    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,\n  };\n  return {\n    ...baseUpdate,\n    restricted_by_admin: options.restrictedByAdmin,\n    restricted_by_admin_reason: options.restrictedByAdminReason,\n    restricted_by_admin_private_details: options.restrictedByAdminPrivateDetails,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n\n\nexport type ServerUserCreateOptions = {\n  primaryEmail?: string | null,\n  primaryEmailAuthEnabled?: boolean,\n  password?: string,\n  otpAuthEnabled?: boolean,\n  displayName?: string,\n  primaryEmailVerified?: boolean,\n  clientMetadata?: any,\n  clientReadOnlyMetadata?: any,\n  serverMetadata?: any,\n  countryCode?: string | null,\n  riskScores?: {\n    signUp: {\n      bot: number,\n      freeTrialAbuse: number,\n    },\n  },\n}\nexport function serverUserCreateOptionsToCrud(options: ServerUserCreateOptions): UsersCrud[\"Server\"][\"Create\"] {\n  return {\n    primary_email: options.primaryEmail,\n    password: options.password,\n    otp_auth_enabled: options.otpAuthEnabled,\n    primary_email_auth_enabled: options.primaryEmailAuthEnabled,\n    display_name: options.displayName,\n    primary_email_verified: options.primaryEmailVerified,\n    client_metadata: options.clientMetadata,\n    client_read_only_metadata: options.clientReadOnlyMetadata,\n    server_metadata: options.serverMetadata,\n    country_code: options.countryCode,\n    risk_scores: options.riskScores ? {\n      sign_up: {\n        bot: options.riskScores.signUp.bot,\n        free_trial_abuse: options.riskScores.signUp.freeTrialAbuse,\n      },\n    } : undefined,\n  };\n}\n"],"mappings":";;;AAwBA,MAAM,yBAAyB;AAE/B,SAAgB,yBAA2C,QAAc;CACvE,OAAO,OAAO,MAAM;CACpB,OAAO,IAAI,MAAM,QAAQ,EACvB,IAAI,QAAQ,MAAM,UAAU;EAC1B,IAAI,SAAS,QACX,OAAO,YAAY;EAErB,OAAO,OAAO;CAChB,EACF,CAAC;AACH;AAEA,SAAS,cAAqB;CAC5B,MAAM,IAAI,MAAM,sBAAsB;AACxC;AAqSA,SAAgB,wBAAwB,SAAiE;CACvG,OAAO;EACL,cAAc,QAAQ;EACtB,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,oBAAoB,QAAQ,yBAAyB,QAAA,GAAA,kCAAA,aAAA,CAAoB,QAAQ,qBAAqB,IAAI,QAAQ;EAClH,mBAAmB,QAAQ;EAC3B,kBAAkB,QAAQ;EAC1B,sBAAsB,QAAQ;EAC9B,eAAe,QAAQ;CACzB;AACF;AA8GA,SAAgB,8BAA8B,SAAuE;CAenH,OAAO;EAZL,cAAc,QAAQ;EACtB,eAAe,QAAQ;EACvB,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,wBAAwB,QAAQ;EAChC,UAAU,QAAQ;EAClB,mBAAmB,QAAQ;EAC3B,oBAAoB,QAAQ,yBAAyB,QAAA,GAAA,kCAAA,aAAA,CAAoB,QAAQ,qBAAqB,IAAI,QAAQ;EAIlH,qBAAqB,QAAQ;EAC7B,4BAA4B,QAAQ;EACpC,qCAAqC,QAAQ;EAC7C,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;EAC9C,EACF,IAAI,KAAA;CACN;AACF;AAqBA,SAAgB,8BAA8B,SAAiE;CAC7G,OAAO;EACL,eAAe,QAAQ;EACvB,UAAU,QAAQ;EAClB,kBAAkB,QAAQ;EAC1B,4BAA4B,QAAQ;EACpC,cAAc,QAAQ;EACtB,wBAAwB,QAAQ;EAChC,iBAAiB,QAAQ;EACzB,2BAA2B,QAAQ;EACnC,iBAAiB,QAAQ;EACzB,cAAc,QAAQ;EACtB,aAAa,QAAQ,aAAa,EAChC,SAAS;GACP,KAAK,QAAQ,WAAW,OAAO;GAC/B,kBAAkB,QAAQ,WAAW,OAAO;EAC9C,EACF,IAAI,KAAA;CACN;AACF"}

package/dist/lib/hooks.d.ts

@@ -1,45 +1,2 @@
-import { GetCurrentUserOptions } from "./hexclave-app/common.js";
-import { CurrentInternalUser, CurrentUser } from "./hexclave-app/users/index.js";
-import { StackClientApp } from "./hexclave-app/apps/interfaces/client-app.js";
-
-//#region src/lib/hooks.d.ts
-type GetUserOptions = GetCurrentUserOptions<true> & {
-  projectIdMustMatch?: string;
-};
-/**
- * Returns the current user object. Equivalent to `useStackApp().useUser()`.
- *
- * @returns the current user
- */
-declare function useUser(options: GetUserOptions & {
-  or: 'redirect' | 'throw';
-  projectIdMustMatch: "internal";
-}): CurrentInternalUser;
-declare function useUser(options: GetUserOptions & {
-  or: 'redirect' | 'throw';
-}): CurrentUser;
-declare function useUser(options: GetUserOptions & {
-  projectIdMustMatch: "internal";
-}): CurrentInternalUser | null;
-declare function useUser(options?: GetUserOptions): CurrentUser | CurrentInternalUser | null;
-/**
- * Returns the current Hexclave app associated with the HexclaveProvider.
- *
- * @returns the current Hexclave app
- */
-declare function useHexclaveApp<ProjectId extends string>(options?: {
-  projectIdMustMatch?: ProjectId;
-}): StackClientApp<true, ProjectId>;
-/**
- * Returns the current Stack app associated with the StackProvider.
- *
- * @deprecated Use `useHexclaveApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration.
- *
- * @returns the current Stack app
- */
-declare function useStackApp<ProjectId extends string>(options?: {
-  projectIdMustMatch?: ProjectId;
-}): StackClientApp<true, ProjectId>;
-//#endregion
-export { useHexclaveApp, useStackApp, useUser };
-//# sourceMappingURL=hooks.d.ts.map
+import { n as useStackApp, r as useUser, t as useHexclaveApp } from "../hooks-psPwqxZ4.js";
+export { useHexclaveApp, useStackApp, useUser };

package/dist/lib/hooks.js

@@ -1,8 +1,6 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_chunk = require('../chunk-BE-pF4vm.js');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let react = require("react");
 let ___providers_hexclave_context_js = require("../providers/hexclave-context.js");
-
 //#region src/lib/hooks.tsx
 function useUser(options = {}) {
 	const hexclaveApp = useHexclaveApp(options);
@@ -33,9 +31,9 @@ function useHexclaveApp(options = {}) {
 function useStackApp(options = {}) {
 	return useHexclaveApp(options);
 }
-
 //#endregion
 exports.useHexclaveApp = useHexclaveApp;
 exports.useStackApp = useStackApp;
 exports.useUser = useUser;
+
 //# sourceMappingURL=hooks.js.map

package/dist/lib/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","names":["useContext","HexclaveContext"],"sources":["../../src/lib/hooks.tsx"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { useContext } from \"react\";\nimport { HexclaveContext } from \"../providers/hexclave-context\";\nimport type { GetUserOptions as AppGetUserOptions, CurrentInternalUser, CurrentUser, StackClientApp } from \"./hexclave-app\";\n\ntype GetUserOptions = AppGetUserOptions<true> & {\n  projectIdMustMatch?: string,\n};\n\n/**\n * Returns the current user object. Equivalent to `useStackApp().useUser()`.\n *\n * @returns the current user\n */\nexport function useUser(options: GetUserOptions & { or: 'redirect' | 'throw', projectIdMustMatch: \"internal\" }): CurrentInternalUser;\nexport function useUser(options: GetUserOptions & { or: 'redirect' | 'throw' }): CurrentUser;\nexport function useUser(options: GetUserOptions & { projectIdMustMatch: \"internal\" }): CurrentInternalUser | null;\nexport function useUser(options?: GetUserOptions): CurrentUser | CurrentInternalUser | null;\nexport function useUser(options: GetUserOptions = {}): CurrentUser | CurrentInternalUser | null {\n  const hexclaveApp = useHexclaveApp(options);\n  if (options.projectIdMustMatch && hexclaveApp.projectId !== options.projectIdMustMatch) {\n    throw new Error(\"Unexpected project ID in useHexclaveApp: \" + hexclaveApp.projectId);\n  }\n  if (options.projectIdMustMatch === \"internal\") {\n    return hexclaveApp.useUser(options) as CurrentInternalUser;\n  } else {\n    return hexclaveApp.useUser(options) as CurrentUser;\n  }\n}\n\n/**\n * Returns the current Hexclave app associated with the HexclaveProvider.\n *\n * @returns the current Hexclave app\n */\nexport function useHexclaveApp<ProjectId extends string>(options: { projectIdMustMatch?: ProjectId } = {}): StackClientApp<true, ProjectId> {\n  if (typeof useContext !== \"function\") {\n    throw new Error(\"useHexclaveApp() can only be used in a React Client Component. Make sure you're not calling it from a Server Component, or any other environment.\");\n  }\n  const context = useContext(HexclaveContext);\n  if (context === null) {\n    throw new Error(\"useHexclaveApp must be used within a HexclaveProvider\");\n  }\n  const hexclaveApp = context.app;\n  if (options.projectIdMustMatch && hexclaveApp.projectId !== options.projectIdMustMatch) {\n    throw new Error(\"Unexpected project ID in useHexclaveApp: \" + hexclaveApp.projectId);\n  }\n  return hexclaveApp as StackClientApp<true, ProjectId>;\n}\n\n/**\n * Returns the current Stack app associated with the StackProvider.\n *\n * @deprecated Use `useHexclaveApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration.\n *\n * @returns the current Stack app\n */\nexport function useStackApp<ProjectId extends string>(options: { projectIdMustMatch?: ProjectId } = {}): StackClientApp<true, ProjectId> {\n  return useHexclaveApp(options);\n}\n"],"mappings":";;;;;;AAqBA,SAAgB,QAAQ,UAA0B,EAAE,EAA4C;CAC9F,MAAM,cAAc,eAAe,QAAQ;AAC3C,KAAI,QAAQ,sBAAsB,YAAY,cAAc,QAAQ,mBAClE,OAAM,IAAI,MAAM,8CAA8C,YAAY,UAAU;AAEtF,KAAI,QAAQ,uBAAuB,WACjC,QAAO,YAAY,QAAQ,QAAQ;KAEnC,QAAO,YAAY,QAAQ,QAAQ;;;;;;;AASvC,SAAgB,eAAyC,UAA8C,EAAE,EAAmC;AAC1I,KAAI,OAAOA,qBAAe,WACxB,OAAM,IAAI,MAAM,oJAAoJ;CAEtK,MAAM,gCAAqBC,iDAAgB;AAC3C,KAAI,YAAY,KACd,OAAM,IAAI,MAAM,wDAAwD;CAE1E,MAAM,cAAc,QAAQ;AAC5B,KAAI,QAAQ,sBAAsB,YAAY,cAAc,QAAQ,mBAClE,OAAM,IAAI,MAAM,8CAA8C,YAAY,UAAU;AAEtF,QAAO;;;;;;;;;AAUT,SAAgB,YAAsC,UAA8C,EAAE,EAAmC;AACvI,QAAO,eAAe,QAAQ"}
+{"version":3,"file":"hooks.js","names":["useContext","HexclaveContext"],"sources":["../../src/lib/hooks.tsx"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { useContext } from \"react\";\nimport { HexclaveContext } from \"../providers/hexclave-context\";\nimport type { GetUserOptions as AppGetUserOptions, CurrentInternalUser, CurrentUser, StackClientApp } from \"./hexclave-app\";\n\ntype GetUserOptions = AppGetUserOptions<true> & {\n  projectIdMustMatch?: string,\n};\n\n/**\n * Returns the current user object. Equivalent to `useStackApp().useUser()`.\n *\n * @returns the current user\n */\nexport function useUser(options: GetUserOptions & { or: 'redirect' | 'throw', projectIdMustMatch: \"internal\" }): CurrentInternalUser;\nexport function useUser(options: GetUserOptions & { or: 'redirect' | 'throw' }): CurrentUser;\nexport function useUser(options: GetUserOptions & { projectIdMustMatch: \"internal\" }): CurrentInternalUser | null;\nexport function useUser(options?: GetUserOptions): CurrentUser | CurrentInternalUser | null;\nexport function useUser(options: GetUserOptions = {}): CurrentUser | CurrentInternalUser | null {\n  const hexclaveApp = useHexclaveApp(options);\n  if (options.projectIdMustMatch && hexclaveApp.projectId !== options.projectIdMustMatch) {\n    throw new Error(\"Unexpected project ID in useHexclaveApp: \" + hexclaveApp.projectId);\n  }\n  if (options.projectIdMustMatch === \"internal\") {\n    return hexclaveApp.useUser(options) as CurrentInternalUser;\n  } else {\n    return hexclaveApp.useUser(options) as CurrentUser;\n  }\n}\n\n/**\n * Returns the current Hexclave app associated with the HexclaveProvider.\n *\n * @returns the current Hexclave app\n */\nexport function useHexclaveApp<ProjectId extends string>(options: { projectIdMustMatch?: ProjectId } = {}): StackClientApp<true, ProjectId> {\n  if (typeof useContext !== \"function\") {\n    throw new Error(\"useHexclaveApp() can only be used in a React Client Component. Make sure you're not calling it from a Server Component, or any other environment.\");\n  }\n  const context = useContext(HexclaveContext);\n  if (context === null) {\n    throw new Error(\"useHexclaveApp must be used within a HexclaveProvider\");\n  }\n  const hexclaveApp = context.app;\n  if (options.projectIdMustMatch && hexclaveApp.projectId !== options.projectIdMustMatch) {\n    throw new Error(\"Unexpected project ID in useHexclaveApp: \" + hexclaveApp.projectId);\n  }\n  return hexclaveApp as StackClientApp<true, ProjectId>;\n}\n\n/**\n * Returns the current Stack app associated with the StackProvider.\n *\n * @deprecated Use `useHexclaveApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration.\n *\n * @returns the current Stack app\n */\nexport function useStackApp<ProjectId extends string>(options: { projectIdMustMatch?: ProjectId } = {}): StackClientApp<true, ProjectId> {\n  return useHexclaveApp(options);\n}\n"],"mappings":";;;;AAqBA,SAAgB,QAAQ,UAA0B,CAAC,GAA6C;CAC9F,MAAM,cAAc,eAAe,OAAO;CAC1C,IAAI,QAAQ,sBAAsB,YAAY,cAAc,QAAQ,oBAClE,MAAM,IAAI,MAAM,8CAA8C,YAAY,SAAS;CAErF,IAAI,QAAQ,uBAAuB,YACjC,OAAO,YAAY,QAAQ,OAAO;MAElC,OAAO,YAAY,QAAQ,OAAO;AAEtC;;;;;;AAOA,SAAgB,eAAyC,UAA8C,CAAC,GAAoC;CAC1I,IAAI,OAAOA,MAAAA,eAAe,YACxB,MAAM,IAAI,MAAM,mJAAmJ;CAErK,MAAM,WAAA,GAAA,MAAA,WAAA,CAAqBC,iCAAAA,eAAe;CAC1C,IAAI,YAAY,MACd,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,cAAc,QAAQ;CAC5B,IAAI,QAAQ,sBAAsB,YAAY,cAAc,QAAQ,oBAClE,MAAM,IAAI,MAAM,8CAA8C,YAAY,SAAS;CAErF,OAAO;AACT;;;;;;;;AASA,SAAgB,YAAsC,UAA8C,CAAC,GAAoC;CACvI,OAAO,eAAe,OAAO;AAC/B"}

package/dist/lib/translations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"translations.d.ts","names":[],"sources":["../../src/lib/translations.tsx"],"mappings":";iBAOgB,cAAA,CAAA;mBAMG,YAAA,GAAiB,MAAA;AAAA"}
+{"version":3,"file":"translations.d.ts","names":[],"sources":["../../src/lib/translations.tsx"],"mappings":";iBAOgB,cAAA;mBAMG,YAAA,GAAiB,MAAM;AAAA"}