@hexclave/js 1.0.74 → 1.0.76

package/dist/esm/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-app-impl.cross-domain.test.js","names":[],"sources":["../../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { AccessToken } from \"@hexclave/shared/dist/sessions\";\nimport { Store } from \"@hexclave/shared/dist/utils/stores\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\nimport { planRedirectToHandler } from \"./redirect-page-urls\";\n\nfunction createAccessTokenString(refreshTokenId: string): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createMockDocument(): Document {\n  const cookieJar = new Map<string, string>();\n  return {\n    get cookie() {\n      return [...cookieJar.entries()].map(([key, value]) => `${key}=${value}`).join(\"; \");\n    },\n    set cookie(str: string) {\n      const [nameValue] = str.split(\";\");\n      const eqIndex = nameValue.indexOf(\"=\");\n      if (eqIndex < 0) return;\n      cookieJar.set(nameValue.slice(0, eqIndex).trim(), nameValue.slice(eqIndex + 1).trim());\n    },\n    createElement: () => ({}),\n  } as any;\n}\n\ndescribe(\"StackClientApp cross-domain auth\", () => {\n  it(\"keeps noRedirectBack same-domain redirects free of redirect-back state\", async () => {\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl: new URL(\"https://app.example.test/settings?tab=profile\"),\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Same-domain redirects must not create cross-domain handoff parameters.\");\n      },\n    });\n\n    expect(redirectPlan).toEqual({\n      type: \"redirect\",\n      url: \"/handler/sign-in\",\n    });\n  });\n\n  it(\"returns noRedirectBack cross-domain auth to the source app home\", async () => {\n    const handoffState = \"no-redirect-back-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(\"https://app.example.test/settings?tab=profile\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    currentUrl.searchParams.set(\n      \"hexclave_cross_domain_after_callback_redirect_url\",\n      \"https://app.example.test/settings?tab=profile\",\n    );\n\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"https://auth.example.test/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl,\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Existing cross-domain handoff parameters must be reused.\");\n      },\n    });\n\n    expect(redirectPlan.type).toBe(\"redirect\");\n    if (redirectPlan.type !== \"redirect\") {\n      throw new Error(\"Expected noRedirectBack sign-in to produce a redirect URL.\");\n    }\n\n    const hostedUrl = new URL(redirectPlan.url);\n    expect(hostedUrl.origin).toBe(\"https://auth.example.test\");\n    expect(hostedUrl.pathname).toBe(\"/handler/sign-in\");\n    expect(hostedUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n\n    const rawSourceCallbackUrl = hostedUrl.searchParams.get(\"after_auth_return_to\");\n    if (rawSourceCallbackUrl == null) {\n      throw new Error(\"Expected cross-domain noRedirectBack to include its internal source callback URL.\");\n    }\n    const sourceCallbackUrl = new URL(rawSourceCallbackUrl);\n    expect(sourceCallbackUrl.origin).toBe(\"https://app.example.test\");\n    expect(sourceCallbackUrl.pathname).toBe(\"/handler/oauth-callback\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_auth\")).toBe(\"1\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_state\")).toBe(handoffState);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(handoffCodeChallenge);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n    expect(sourceCallbackUrl.toString()).not.toContain(\"/settings\");\n  });\n\n  it(\"exposes redirect-back-aware handler URLs for devtool previews\", async () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    Reflect.set(globalThis, \"window\", {\n      location: {\n        href: \"http://localhost/music?track=1#song\",\n      },\n    });\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000000\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"none\",\n        urls: {\n          signIn: \"/handler/sign-in\",\n        },\n        noAutomaticPrefetch: true,\n      });\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"signIn\");\n\n      const resolved = new URL(redirectUrl, \"http://localhost\");\n      expect(resolved.pathname).toBe(\"/handler/sign-in\");\n      expect(resolved.searchParams.get(\"after_auth_return_to\")).toBe(\"/music?track=1#song\");\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"uses the fresh post-auth refresh token when minting a cross-domain handoff\", async () => {\n    const freshAccessToken = createAccessTokenString(\"fresh-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: {\n        accessToken: createAccessTokenString(\"stale-refresh-token-id\"),\n        refreshToken: \"stale-refresh-token\",\n      },\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSendClientRequest = Reflect.get(clientInterface, \"sendClientRequest\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const capturedRefreshTokens: string[] = [];\n    const capturedAccessTokenRefreshTokenIds: string[] = [];\n    const refreshedRawRefreshTokens: string[] = [];\n\n    Reflect.set(clientInterface, \"sendClientRequest\", async (_path: unknown, _requestOptions: unknown, session: unknown) => {\n      const getRefreshToken = Reflect.get(session ?? {}, \"getRefreshToken\");\n      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, \"getOrFetchLikelyValidTokens\");\n      if (typeof getRefreshToken !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session to the client interface.\");\n      }\n      if (typeof getOrFetchLikelyValidTokens !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session with token accessors.\");\n      }\n      const refreshToken = getRefreshToken.call(session);\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected cross-domain auth to pass a refresh-token-backed session.\");\n      }\n      capturedRefreshTokens.push(refreshTokenString);\n      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);\n      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);\n      return {\n        ok: true,\n        json: async () => ({ redirect_url: \"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\" }),\n      };\n    });\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected refresh token while fetching a new access token.\");\n      }\n      refreshedRawRefreshTokens.push(refreshTokenString);\n      return AccessToken.createIfValid(freshAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, \"_createCrossDomainAuthRedirectUrl\");\n      if (typeof createCrossDomainAuthRedirectUrl !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _createCrossDomainAuthRedirectUrl in tests.\");\n      }\n\n      await expect(createCrossDomainAuthRedirectUrl.call(clientApp, {\n        redirectUri: \"https://example.com/handler/oauth-callback\",\n        state: \"handoff-state\",\n        codeChallenge: \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\",\n        afterCallbackRedirectUrl: \"https://example.com/account-settings\",\n        overrideTokenStoreInit: {\n          accessToken: createAccessTokenString(\"fresh-stale-refresh-token-id\"),\n          refreshToken: \"fresh-refresh-token\",\n        },\n      })).resolves.toBe(\"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\");\n    } finally {\n      Reflect.set(clientInterface, \"sendClientRequest\", originalSendClientRequest);\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedAccessTokenRefreshTokenIds).toEqual([\"fresh-refresh-token-id\"]);\n  });\n\n  it(\"uses a fresh nested OAuth state while preserving the outer cross-domain return state\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000002\";\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const outerState = \"outer-cross-domain-state\";\n    const outerCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"after_auth_return_to\", `https://demo.stack-auth.com/?hexclave_cross_domain_auth=1&hexclave_cross_domain_state=${outerState}`);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", outerState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", outerCodeChallenge);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-session\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const redirectUrl = new URL(redirectedUrl);\n    expect(redirectUrl.searchParams.get(\"state\")).toBe(\"fresh-nested-state\");\n    expect(redirectUrl.searchParams.get(\"code_challenge\")).toBe(\"fresh-nested-code-challenge\");\n    const redirectUri = new URL(redirectUrl.searchParams.get(\"redirect_uri\") ?? \"\");\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_state\")).toBe(outerState);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(outerCodeChallenge);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\"https://demo.stack-auth.com/\");\n  });\n\n  it(\"clears a stale target-domain session before deferring to the source-domain session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000006\";\n    const hostedAccessToken = createAccessTokenString(\"hosted-old-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const tokenStore = Reflect.get(clientApp, \"_memoryTokenStore\");\n    if (!(tokenStore instanceof Store)) {\n      throw new Error(\"Expected StackClientApp to use a memory token store in this test.\");\n    }\n    tokenStore.set({\n      refreshToken: \"hosted-old-refresh-token\",\n      accessToken: hostedAccessToken,\n    });\n\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-anonymous-refresh-token-id\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/handler/oauth-callback\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", \"outer-state\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", \"outer-code-challenge\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/app\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(tokenStore.get()).toEqual({\n      refreshToken: null,\n      accessToken: null,\n    });\n    expect(new URL(redirectedUrl).origin).toBe(\"https://demo.stack-auth.com\");\n  });\n\n  it(\"uses the latest browser refresh cookie before computing nested cross-domain session IDs\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000007\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: \"https://demo.stack-auth.com/\",\n        protocol: \"https:\",\n        hostname: \"demo.stack-auth.com\",\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"cookie\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const refreshedRawRefreshTokens: string[] = [];\n\n    // Cookie-store writes queue a background trusted-parent-domain lookup. Without this stub, that\n    // lookup fetches the (unreachable) baseUrl with retries while holding the global store lock,\n    // which starves any later test that needs the write lock (e.g. signOut). Not restored on\n    // purpose: queued tasks can still run after this test body finishes.\n    vi.spyOn(clientApp as any, \"_getTrustedParentDomain\").mockResolvedValue(null);\n\n    try {\n      const getBrowserCookieTokenStore = Reflect.get(clientApp, \"_getBrowserCookieTokenStore\");\n      if (typeof getBrowserCookieTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.\");\n      }\n      const tokenStore = getBrowserCookieTokenStore.call(clientApp);\n      tokenStore.set({\n        refreshToken: \"old-refresh-token\",\n        accessToken: createAccessTokenString(\"old-refresh-token-id\"),\n      });\n\n      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({\n        refresh_token: \"new-refresh-token\",\n        updated_at_millis: 1,\n      })}`;\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n        const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n        if (typeof refreshTokenString !== \"string\") {\n          throw new Error(\"Expected refresh token while fetching a new access token.\");\n        }\n        refreshedRawRefreshTokens.push(refreshTokenString);\n        return AccessToken.createIfValid(createAccessTokenString(\"new-refresh-token-id\")) ?? (() => {\n          throw new Error(\"Expected test access token to be valid\");\n        })();\n      });\n\n      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\");\n      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.\");\n      }\n      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {\n        awaitPendingAuthResolutions: false,\n      })).resolves.toBe(\"new-refresh-token-id\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"new-refresh-token\"]);\n  });\n\n  it(\"does not re-bounce nested cross-domain auth after the OAuth callback consumed code+state from the URL\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000008\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const strippedUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n    const urlAtConstructionTime = new URL(strippedUrl);\n    urlAtConstructionTime.searchParams.set(\"code\", \"one-time-code\");\n    urlAtConstructionTime.searchParams.set(\"state\", \"nested-oauth-state\");\n\n    // Construct before installing the window mock so the constructor does not schedule its own\n    // nested-auth resolution; the assertions below drive the handler explicitly.\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      noAutomaticPrefetch: true,\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: strippedUrl.toString(),\n        replace: () => {\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    try {\n      // Without the construction-time URL, the handler re-bounces (location.replace aborts).\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      // With it, the in-flight OAuth callback wins and the handler stands down.\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime)).resolves.toBe(false);\n      // The live-URL guard must also stand down on its own when code+state are still present.\n      (globalThis.window as any).location.href = urlAtConstructionTime.toString();\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).resolves.toBe(false);\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"passes the construction-time URL to the nested cross-domain auth handler\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000009\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const callbackUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    callbackUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    callbackUrl.searchParams.set(\"code\", \"one-time-code\");\n    callbackUrl.searchParams.set(\"state\", \"nested-oauth-state\");\n    const strippedUrl = new URL(callbackUrl);\n    strippedUrl.searchParams.delete(\"code\");\n    strippedUrl.searchParams.delete(\"state\");\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: callbackUrl.toString(),\n      },\n    } as any;\n\n    const nestedAuthSpy = vi.spyOn(StackClientApp.prototype as any, \"_maybeHandleNestedCrossDomainAuth\").mockResolvedValue(false);\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n\n      // Simulate consumeOAuthCallbackQueryParams stripping code+state before microtasks run.\n      (globalThis.window as any).location.href = strippedUrl.toString();\n      await new Promise((resolve) => setTimeout(resolve, 0));\n\n      expect(nestedAuthSpy).toHaveBeenCalledTimes(1);\n      const urlArgument = nestedAuthSpy.mock.calls[0][0] as URL;\n      expect(urlArgument).toBeInstanceOf(URL);\n      expect(urlArgument.searchParams.get(\"code\")).toBe(\"one-time-code\");\n      expect(urlArgument.searchParams.get(\"state\")).toBe(\"nested-oauth-state\");\n    } finally {\n      nestedAuthSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"redirects hosted current-page OAuth callback errors to the hosted error handler during startup\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000010\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const callbackUrl = new URL(\"https://demo.stack-auth.com/dashboard\");\n    callbackUrl.searchParams.set(\"errorCode\", \"SIGN_UP_REJECTED\");\n    callbackUrl.searchParams.set(\"message\", \"Your sign up was rejected by an administrator's sign-up rule.\");\n    callbackUrl.searchParams.set(\"details\", JSON.stringify({\n      message: \"Your sign up was rejected by an administrator's sign-up rule.\",\n    }));\n    callbackUrl.searchParams.set(\"after_auth_return_to\", \"/dashboard\");\n    callbackUrl.searchParams.set(\"after_callback_redirect_url\", \"https://customer.example.test/settings?tab=connected-accounts\");\n    let currentHref = callbackUrl.toString();\n    let redirectedUrl = \"\";\n    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, \"_redirectTo\").mockImplementation(async (...args: unknown[]) => {\n      const options = args[0] as { url: string | URL };\n      redirectedUrl = options.url.toString();\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n        set href(value: string) {\n          currentHref = value;\n        },\n        origin: callbackUrl.origin,\n      },\n      history: {\n        replaceState: (_state: unknown, _title: string, url: string) => {\n          currentHref = new URL(url, currentHref).toString();\n        },\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        urls: {\n          default: { type: \"hosted\" },\n        },\n        noAutomaticPrefetch: true,\n      });\n\n      await new Promise((resolve) => setTimeout(resolve, 0));\n      await new Promise((resolve) => setTimeout(resolve, 0));\n    } finally {\n      redirectSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const errorUrl = new URL(redirectedUrl);\n    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);\n    expect(errorUrl.pathname).toBe(\"/handler/error\");\n    expect(errorUrl.searchParams.get(\"errorCode\")).toBe(\"SIGN_UP_REJECTED\");\n    expect(errorUrl.searchParams.get(\"message\")).toBe(\"Your sign up was rejected by an administrator's sign-up rule.\");\n    expect(errorUrl.searchParams.get(\"after_auth_return_to\")).toBe(\"/dashboard\");\n    expect(errorUrl.searchParams.get(\"after_callback_redirect_url\")).toBe(\"https://customer.example.test/settings?tab=connected-accounts\");\n    expect(new URL(currentHref).searchParams.has(\"errorCode\")).toBe(false);\n  });\n\n  it(\"uses direct sign-out instead of hosted sign-out redirects when code execution is available\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/handler\",\n        signOut: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const signOutSpy = vi.spyOn(clientApp, \"signOut\").mockRejectedValue(new Error(\"INTENTIONAL_TEST_ABORT\"));\n\n    try {\n      await expect(clientApp.redirectToSignOut()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      expect(signOutSpy).toHaveBeenCalledWith();\n    } finally {\n      signOutSpy.mockRestore();\n    }\n  });\n\n  it(\"throws when public app.urls reads would return hosted component URLs\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n\n    expect(() => clientApp.urls.signIn).toThrowError(/app\\.urls\\.signIn cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignIn\\(\\) instead/s);\n    expect(() => clientApp.urls.signOut).toThrowError(/app\\.urls\\.signOut cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignOut\\(\\) instead/s);\n    expect(clientApp.urls.afterSignIn).toBe(\"/\");\n  });\n\n  it(\"keeps public app.urls reads available for non-hosted targets\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/custom-handler\",\n      },\n      noAutomaticPrefetch: true,\n    });\n\n    expect(clientApp.urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"keeps default hosted signOut() on the source domain when afterSignOut is not configured\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000004\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const currentHref = \"https://demo.stack-auth.com/settings?tab=profile\";\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSignOut = Reflect.get(clientInterface, \"signOut\");\n    Reflect.set(clientInterface, \"signOut\", async () => {});\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentHref,\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      const signOut = Reflect.get(clientApp, \"_signOut\");\n      if (typeof signOut !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _signOut in tests.\");\n      }\n      await expect(signOut.call(clientApp, Reflect.get(clientInterface, \"createSession\").call(clientInterface, {\n        refreshToken: null,\n      }))).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"signOut\", originalSignOut);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(redirectedUrl).toBe(\"/settings?tab=profile\");\n  });\n\n  it(\"restores a dropped after_auth_return_to from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n    const windowMock = {\n      location: {\n        href: \"https://demo.example.test/handler/sign-in?after_auth_return_to=%2Fmusic%3Ftrack%3D1\",\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      // The constructor mirrors the redirect-back state from the arrival URL into sessionStorage.\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000011\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n\n      // Intermediate hops (MFA, magic link, OAuth round-trips, ...) dropped the query params.\n      windowMock.location.href = \"https://demo.example.test/handler/mfa\";\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n      expect(redirectUrl).toBe(\"/music?track=1\");\n\n      // noRedirectBack opts out of the mirror just like it opts out of the query param.\n      const noRedirectBackUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\", { noRedirectBack: true });\n      expect(new URL(noRedirectBackUrl, \"https://demo.example.test\").pathname).toBe(\"/\");\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"restores dropped cross-domain handoff state from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n\n    const handoffState = \"mirror-handoff-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const handoffAfterCallbackRedirect = \"https://demo.example.test/dashboard\";\n    const redirectBackUrl = new URL(\"https://demo.example.test/handler/oauth-callback\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_auth\", \"1\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);\n    arrivalUrl.searchParams.set(\"after_auth_return_to\", redirectBackUrl.toString());\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const previousDocument = globalThis.document;\n    const windowMock = {\n      location: {\n        href: arrivalUrl.toString(),\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n      const crossDomainAuthorizeRedirect = \"https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state\";\n      const createCrossDomainAuthRedirectUrlSpy = vi\n        .spyOn(clientApp as any, \"_createCrossDomainAuthRedirectUrl\")\n        .mockResolvedValue(crossDomainAuthorizeRedirect);\n\n      // All redirect-back query params were dropped before the after-sign-in redirect.\n      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n\n      expect(createCrossDomainAuthRedirectUrlSpy).toHaveBeenCalledWith(expect.objectContaining({\n        redirectUri: redirectBackUrl.toString(),\n        state: handoffState,\n        codeChallenge: handoffCodeChallenge,\n        afterCallbackRedirectUrl: handoffAfterCallbackRedirect,\n      }));\n      expect(redirectUrl).toBe(crossDomainAuthorizeRedirect);\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"ignores stale session callbacks after a newer refresh token owns the token store\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000005\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n    const oldAccessToken = createAccessTokenString(\"old-refresh-token-id\");\n    const refreshedOldAccessToken = createAccessTokenString(\"refreshed-old-refresh-token-id\");\n    const newAccessToken = createAccessTokenString(\"new-refresh-token-id\");\n    const tokenStore = new Store({\n      refreshToken: \"old-refresh-token\",\n      accessToken: oldAccessToken,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const getSessionFromTokenStore = Reflect.get(clientApp, \"_getSessionFromTokenStore\");\n      if (typeof getSessionFromTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getSessionFromTokenStore in tests.\");\n      }\n      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);\n      tokenStore.set({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      await oldSession.fetchNewTokens();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      oldSession.markInvalid();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n  });\n});\n"],"mappings":";;;;;;;AAWA,SAAS,wBAAwB,gBAAgC;CAC/D,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,qBAA+B;CACtC,MAAM,4BAAY,IAAI,IAAoB;CAC1C,OAAO;EACL,IAAI,SAAS;GACX,OAAO,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;EACpF;EACA,IAAI,OAAO,KAAa;GACtB,MAAM,CAAC,aAAa,IAAI,MAAM,GAAG;GACjC,MAAM,UAAU,UAAU,QAAQ,GAAG;GACrC,IAAI,UAAU,GAAG;GACjB,UAAU,IAAI,UAAU,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACvF;EACA,sBAAsB,CAAC;CACzB;AACF;AAEA,SAAS,0CAA0C;CACjD,GAAG,0EAA0E,YAAY;EAavF,OAAO,MAZoB,sBAAsB;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY,IAAI,IAAI,+CAA+C;GACnE,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,wEAAwE;GAC1F;EACF,CAAC,CAEkB,CAAC,CAAC,QAAQ;GAC3B,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;CAED,GAAG,mEAAmE,YAAY;EAChF,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,aAAa,IAAI,IAAI,+CAA+C;EAC1E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IACtB,qDACA,+CACF;EAEA,MAAM,eAAe,MAAM,sBAAsB;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB;GACA,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,0DAA0D;GAC5E;EACF,CAAC;EAED,OAAO,aAAa,IAAI,CAAC,CAAC,KAAK,UAAU;EACzC,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,YAAY,IAAI,IAAI,aAAa,GAAG;EAC1C,OAAO,UAAU,MAAM,CAAC,CAAC,KAAK,2BAA2B;EACzD,OAAO,UAAU,QAAQ,CAAC,CAAC,KAAK,kBAAkB;EAClD,OAAO,UAAU,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KACtF,+BACF;EAEA,MAAM,uBAAuB,UAAU,aAAa,IAAI,sBAAsB;EAC9E,IAAI,wBAAwB,MAC1B,MAAM,IAAI,MAAM,mFAAmF;EAErG,MAAM,oBAAoB,IAAI,IAAI,oBAAoB;EACtD,OAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK,0BAA0B;EAChE,OAAO,kBAAkB,QAAQ,CAAC,CAAC,KAAK,yBAAyB;EACjE,OAAO,kBAAkB,aAAa,IAAI,4BAA4B,CAAC,CAAC,CAAC,KAAK,GAAG;EACjF,OAAO,kBAAkB,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3F,OAAO,kBAAkB,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,oBAAoB;EAC5G,OAAO,kBAAkB,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAC9F,+BACF;EACA,OAAO,kBAAkB,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,WAAW;CAChE,CAAC;CAED,GAAG,iEAAiE,YAAY;EAC9E,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,QAAQ,IAAI,YAAY,UAAU,EAChC,UAAU,EACR,MAAM,sCACR,EACF,CAAC;EAED,IAAI;GAaF,MAAM,cAAc,MAAM,IAZJ,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,QAAQ,mBACV;IACA,qBAAqB;GACvB,CAEkC,CAAC,CAAC,2BAA2B,CAAC,wBAAwB,QAAQ;GAEhG,MAAM,WAAW,IAAI,IAAI,aAAa,kBAAkB;GACxD,OAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,kBAAkB;GACjD,OAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,qBAAqB;EACtF,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,GAAG,8EAA8E,YAAY;EAC3F,MAAM,mBAAmB,wBAAwB,wBAAwB;EACzE,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;IACV,aAAa,wBAAwB,wBAAwB;IAC7D,cAAc;GAChB;GACA,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EAED,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,4BAA4B,QAAQ,IAAI,iBAAiB,mBAAmB;EAClF,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,wBAAkC,CAAC;EACzC,MAAM,qCAA+C,CAAC;EACtD,MAAM,4BAAsC,CAAC;EAE7C,QAAQ,IAAI,iBAAiB,qBAAqB,OAAO,OAAgB,iBAA0B,YAAqB;GACtH,MAAM,kBAAkB,QAAQ,IAAI,WAAW,CAAC,GAAG,iBAAiB;GACpE,MAAM,8BAA8B,QAAQ,IAAI,WAAW,CAAC,GAAG,6BAA6B;GAC5F,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,MAAM,uEAAuE;GAEzF,IAAI,OAAO,gCAAgC,YACzC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,MAAM,eAAe,gBAAgB,KAAK,OAAO;GACjD,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,sBAAsB,KAAK,kBAAkB;GAC7C,MAAM,SAAS,MAAM,4BAA4B,KAAK,SAAS,GAAG,IAAI;GACtE,mCAAmC,KAAK,OAAO,YAAY,QAAQ,gBAAgB;GACnF,OAAO;IACL,IAAI;IACJ,MAAM,aAAa,EAAE,cAAc,mFAAmF;GACxH;EACF,CAAC;EACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;GACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,0BAA0B,KAAK,kBAAkB;GACjD,OAAO,YAAY,cAAc,gBAAgB,YAAY;IAC3D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,mCAAmC,QAAQ,IAAI,WAAW,mCAAmC;GACnG,IAAI,OAAO,qCAAqC,YAC9C,MAAM,IAAI,MAAM,+EAA+E;GAGjG,MAAM,OAAO,iCAAiC,KAAK,WAAW;IAC5D,aAAa;IACb,OAAO;IACP,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;KACtB,aAAa,wBAAwB,8BAA8B;KACnE,cAAc;IAChB;GACF,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,kFAAkF;EACtG,UAAU;GACR,QAAQ,IAAI,iBAAiB,qBAAqB,yBAAyB;GAC3E,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;EAEA,OAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EACjE,OAAO,qBAAqB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EAC7D,OAAO,kCAAkC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;CAED,GAAG,wFAAwF,YAAY;EACrG,MAAM,YAAY;EAClB,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,qBAAqB;EAC3B,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,wBAAwB,yFAAyF,YAAY;EACzJ,WAAW,aAAa,IAAI,+BAA+B,UAAU;EACrE,WAAW,aAAa,IAAI,wCAAwC,kBAAkB;EACtF,WAAW,aAAa,IAAI,qDAAqD,8BAA8B;EAC/G,WAAW,aAAa,IAAI,mDAAmD,gBAAgB;EAC/F,WAAW,aAAa,IAAI,+CAA+C,8BAA8B;EAEzG,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,OAAQ,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa;EACzC,OAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACvE,OAAO,YAAY,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,6BAA6B;EACzF,MAAM,cAAc,IAAI,IAAI,YAAY,aAAa,IAAI,cAAc,KAAK,EAAE;EAC9E,OAAO,YAAY,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,UAAU;EACnF,OAAO,YAAY,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACpG,OAAO,YAAY,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAAK,8BAA8B;CAC/H,CAAC;CAED,GAAG,sFAAsF,YAAY;EACnG,MAAM,YAAY;EAClB,MAAM,oBAAoB,wBAAwB,6BAA6B;EAC/E,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa,QAAQ,IAAI,WAAW,mBAAmB;EAC7D,IAAI,EAAE,sBAAsB,QAC1B,MAAM,IAAI,MAAM,mEAAmE;EAErF,WAAW,IAAI;GACb,cAAc;GACd,aAAa;EACf,CAAC;EAED,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,mDAAmD,mCAAmC;EAClH,WAAW,aAAa,IAAI,+CAA+C,oDAAoD;EAC/H,WAAW,aAAa,IAAI,+BAA+B,aAAa;EACxE,WAAW,aAAa,IAAI,wCAAwC,sBAAsB;EAC1F,WAAW,aAAa,IAAI,qDAAqD,iCAAiC;EAElH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAO,YAAY,cAAc,iBAAiB,YAAY;IAC5D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EACD,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,OAAQ,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;GAC/B,cAAc;GACd,aAAa;EACf,CAAC;EACD,OAAO,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,6BAA6B;CAC1E,CAAC;CAED,GAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,MAAM;IACN,UAAU;IACV,UAAU;GACZ;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,4BAAsC,CAAC;EAM7C,GAAG,MAAM,WAAkB,yBAAyB,CAAC,CAAC,kBAAkB,IAAI;EAE5E,IAAI;GACF,MAAM,6BAA6B,QAAQ,IAAI,WAAW,6BAA6B;GACvF,IAAI,OAAO,+BAA+B,YACxC,MAAM,IAAI,MAAM,yEAAyE;GAG3F,2BAD8C,KAAK,SAC1C,CAAC,CAAC,IAAI;IACb,cAAc;IACd,aAAa,wBAAwB,sBAAsB;GAC7D,CAAC;GAED,SAAS,SAAS,2BAA2B,UAAU,YAAY,KAAK,UAAU;IAChF,eAAe;IACf,mBAAmB;GACrB,CAAC;GACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;IACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;IAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;IAE7E,0BAA0B,KAAK,kBAAkB;IACjD,OAAO,YAAY,cAAc,wBAAwB,sBAAsB,CAAC,YAAY;KAC1F,MAAM,IAAI,MAAM,wCAAwC;IAC1D,EAAA,CAAG;GACL,CAAC;GAED,MAAM,uCAAuC,QAAQ,IAAI,WAAW,uCAAuC;GAC3G,IAAI,OAAO,yCAAyC,YAClD,MAAM,IAAI,MAAM,mFAAmF;GAErG,MAAM,OAAO,qCAAqC,KAAK,WAAW,EAChE,6BAA6B,MAC/B,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB;EAC1C,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,OAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjE,CAAC;CAED,GAAG,yGAAyG,YAAY;EACtH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,+CAA+C,8BAA8B;EAC1G,MAAM,wBAAwB,IAAI,IAAI,WAAW;EACjD,sBAAsB,aAAa,IAAI,QAAQ,eAAe;EAC9D,sBAAsB,aAAa,IAAI,SAAS,oBAAoB;EAIpE,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,YAAY,SAAS;GAC3B,eAAe;IACb,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,IAAI;GAEF,MAAM,OAAQ,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GAElH,MAAM,OAAQ,UAAkB,kCAAkC,qBAAqB,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;GAE7G,WAAY,OAAe,SAAS,OAAO,sBAAsB,SAAS;GAC1E,MAAM,OAAQ,UAAkB,kCAAkC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;EAC1F,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,GAAG,4EAA4E,YAAY;EACzF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,QAAQ,eAAe;EACpD,YAAY,aAAa,IAAI,SAAS,oBAAoB;EAC1D,MAAM,cAAc,IAAI,IAAI,WAAW;EACvC,YAAY,aAAa,OAAO,MAAM;EACtC,YAAY,aAAa,OAAO,OAAO;EAEvC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU,EACR,MAAM,YAAY,SAAS,EAC7B,EACF;EAEA,MAAM,gBAAgB,GAAG,MAAM,eAAe,WAAkB,mCAAmC,CAAC,CAAC,kBAAkB,KAAK;EAE5H,IAAI;GACF,IAAI,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GAGD,WAAY,OAAe,SAAS,OAAO,YAAY,SAAS;GAChE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GAErD,OAAO,aAAa,CAAC,CAAC,sBAAsB,CAAC;GAC7C,MAAM,cAAc,cAAc,KAAK,MAAM,EAAE,CAAC;GAChD,OAAO,WAAW,CAAC,CAAC,eAAe,GAAG;GACtC,OAAO,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;GACjE,OAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACzE,UAAU;GACR,cAAc,YAAY;GAC1B,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,GAAG,kGAAkG,YAAY;EAC/G,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,cAAc,IAAI,IAAI,uCAAuC;EACnE,YAAY,aAAa,IAAI,aAAa,kBAAkB;EAC5D,YAAY,aAAa,IAAI,WAAW,+DAA+D;EACvG,YAAY,aAAa,IAAI,WAAW,KAAK,UAAU,EACrD,SAAS,gEACX,CAAC,CAAC;EACF,YAAY,aAAa,IAAI,wBAAwB,YAAY;EACjE,YAAY,aAAa,IAAI,+BAA+B,+DAA+D;EAC3H,IAAI,cAAc,YAAY,SAAS;EACvC,IAAI,gBAAgB;EACpB,MAAM,cAAc,GAAG,MAAM,eAAe,WAAkB,aAAa,CAAC,CAAC,mBAAmB,OAAO,GAAG,SAAoB;GAE5H,gBADgB,KAAK,EACE,CAAC,IAAI,SAAS;EACvC,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,IAAI,OAAO;KACT,OAAO;IACT;IACA,IAAI,KAAK,OAAe;KACtB,cAAc;IAChB;IACA,QAAQ,YAAY;GACtB;GACA,SAAS,EACP,eAAe,QAAiB,QAAgB,QAAgB;IAC9D,cAAc,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,SAAS;GACnD,EACF;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,IAAI;GACF,IAAI,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;IACA,qBAAqB;GACvB,CAAC;GAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GACrD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;EACvD,UAAU;GACR,YAAY,YAAY;GACxB,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,WAAW,IAAI,IAAI,aAAa;EACtC,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,WAAW,UAAU,yBAAyB;EAC3E,OAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,gBAAgB;EAC/C,OAAO,SAAS,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACtE,OAAO,SAAS,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACjH,OAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3E,OAAO,SAAS,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACrI,OAAO,IAAI,IAAI,WAAW,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK;CACvE,CAAC;CAED,GAAG,8FAA8F,YAAY;EAC3G,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM;IACJ,SAAS;IACT,SAAS,EAAE,MAAM,SAAS;GAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa,GAAG,MAAM,WAAW,SAAS,CAAC,CAAC,kCAAkB,IAAI,MAAM,wBAAwB,CAAC;EAEvG,IAAI;GACF,MAAM,OAAO,UAAU,kBAAkB,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GACzF,OAAO,UAAU,CAAC,CAAC,qBAAqB;EAC1C,UAAU;GACR,WAAW,YAAY;EACzB;CACF,CAAC;CAED,GAAG,8EAA8E;EAC/E,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EAED,aAAa,UAAU,KAAK,MAAM,CAAC,CAAC,aAAa,+HAA+H;EAChL,aAAa,UAAU,KAAK,OAAO,CAAC,CAAC,aAAa,iIAAiI;EACnL,OAAO,UAAU,KAAK,WAAW,CAAC,CAAC,KAAK,GAAG;CAC7C,CAAC;CAED,GAAG,sEAAsE;EAavE,OAAO,IAZe,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,kBACX;GACA,qBAAqB;EACvB,CAEe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,yBAAyB;CAC9D,CAAC;CAED,GAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,cAAc;EAEpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,kBAAkB,QAAQ,IAAI,iBAAiB,SAAS;EAC9D,QAAQ,IAAI,iBAAiB,WAAW,YAAY,CAAC,CAAC;EACtD,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EAEpB,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM;GACN,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,UAAU,QAAQ,IAAI,WAAW,UAAU;GACjD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,sDAAsD;GAExE,MAAM,OAAO,QAAQ,KAAK,WAAW,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CAAC,KAAK,iBAAiB,EACvG,cAAc,KAChB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpD,UAAU;GACR,QAAQ,IAAI,iBAAiB,WAAW,eAAe;GACvD,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,OAAO,aAAa,CAAC,CAAC,KAAK,uBAAuB;CACpD,CAAC;CAED,GAAG,yGAAyG,YAAY;EACtH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAClD,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,sFACR;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GAEF,MAAM,YAAY,IAAI,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GAGD,WAAW,SAAS,OAAO;GAG3B,OAAO,MADmB,UAAU,2BAA2B,CAAC,wBAAwB,aAAa,CACnF,CAAC,CAAC,KAAK,gBAAgB;GAGzC,MAAM,oBAAoB,MAAM,UAAU,2BAA2B,CAAC,wBAAwB,eAAe,EAAE,gBAAgB,KAAK,CAAC;GACrI,OAAO,IAAI,IAAI,mBAAmB,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG;EACnF,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,GAAG,6GAA6G,YAAY;EAC1H,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAElD,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,+BAA+B;EACrC,MAAM,kBAAkB,IAAI,IAAI,kDAAkD;EAClF,gBAAgB,aAAa,IAAI,8BAA8B,GAAG;EAClE,gBAAgB,aAAa,IAAI,+BAA+B,YAAY;EAC5E,gBAAgB,aAAa,IAAI,wCAAwC,oBAAoB;EAC7F,gBAAgB,aAAa,IAAI,qDAAqD,4BAA4B;EAElH,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,yCAAyC;EACzF,WAAW,aAAa,IAAI,wBAAwB,gBAAgB,SAAS,CAAC;EAC9E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IAAI,qDAAqD,4BAA4B;EAE7G,MAAM,mBAAmB,WAAW;EACpC,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,WAAW,SAAS,EAC5B;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GACF,MAAM,YAAY,IAAI,eAAe;IACnC,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GACD,MAAM,+BAA+B;GACrC,MAAM,sCAAsC,GACzC,MAAM,WAAkB,mCAAmC,CAAC,CAC5D,kBAAkB,4BAA4B;GAGjD,WAAW,SAAS,OAAO,WAAW,UAAU;GAEhD,MAAM,cAAc,MAAM,UAAU,2BAA2B,CAAC,wBAAwB,aAAa;GAErG,OAAO,mCAAmC,CAAC,CAAC,qBAAqB,OAAO,iBAAiB;IACvF,aAAa,gBAAgB,SAAS;IACtC,OAAO;IACP,eAAe;IACf,0BAA0B;GAC5B,CAAC,CAAC;GACF,OAAO,WAAW,CAAC,CAAC,KAAK,4BAA4B;EACvD,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,GAAG,oFAAoF,YAAY;EACjG,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EACD,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,0BAA0B,wBAAwB,gCAAgC;EACxF,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,aAAa,IAAI,MAAM;GAC3B,cAAc;GACd,aAAa;EACf,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAO,YAAY,cAAc,uBAAuB,YAAY;IAClE,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,2BAA2B,QAAQ,IAAI,WAAW,2BAA2B;GACnF,IAAI,OAAO,6BAA6B,YACtC,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,aAAa,yBAAyB,KAAK,WAAW,UAAU;GACtE,WAAW,IAAI;IACb,cAAc;IACd,aAAa;GACf,CAAC;GAED,MAAM,WAAW,eAAe;GAChC,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;GAED,WAAW,YAAY;GACvB,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;EACH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"client-app-impl.cross-domain.test.js","names":[],"sources":["../../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { AccessToken } from \"@hexclave/shared/dist/sessions\";\nimport { HexclaveSetupError } from \"@hexclave/shared/dist/utils/errors\";\nimport { Store } from \"@hexclave/shared/dist/utils/stores\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\nimport { planRedirectToHandler } from \"./redirect-page-urls\";\n\n// Every app in this file is constructed with `devTool: false`. The tests install a mock window and document, which makes\n// the SDK believe it is in a browser, and mounting the dev tool kicks off a background `getProject()` against a backend\n// that does not exist here. That fetch never settles, and because it runs inside the global store lock, it blocks every\n// later `withWriteLock` caller (`_signOut`, most visibly) for the rest of the test file.\nfunction createAccessTokenString(refreshTokenId: string): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createMockDocument(): Document {\n  const cookieJar = new Map<string, string>();\n  return {\n    get cookie() {\n      return [...cookieJar.entries()].map(([key, value]) => `${key}=${value}`).join(\"; \");\n    },\n    set cookie(str: string) {\n      const [nameValue] = str.split(\";\");\n      const eqIndex = nameValue.indexOf(\"=\");\n      if (eqIndex < 0) return;\n      cookieJar.set(nameValue.slice(0, eqIndex).trim(), nameValue.slice(eqIndex + 1).trim());\n    },\n    createElement: () => ({}),\n  } as any;\n}\n\n/**\n * Installs a stand-in for `window` with only the parts the code under test touches. `globalThis.window` is typed as a\n * full `Window`, which a hand-written stub can never be, so the assignment goes through `Reflect.set` — the stub's own\n * shape stays checked, unlike with a cast on the object literal.\n */\nfunction setMockWindow(mockWindow: {\n  location: { href: string, replace?: (url: string) => void },\n}): void {\n  Reflect.set(globalThis, \"window\", mockWindow);\n}\n\n/**\n * Calls one of the app's `protected` methods, which are part of the flows under test but not of the public SDK surface.\n */\nfunction callProtectedMethod(app: StackClientApp<true>, methodName: string, ...args: unknown[]): Promise<unknown> {\n  const method = Reflect.get(app, methodName);\n  if (typeof method !== \"function\") {\n    throw new Error(`Expected StackClientApp to have a ${methodName} method in tests.`);\n  }\n  return method.apply(app, args);\n}\n\ndescribe(\"StackClientApp cross-domain auth\", () => {\n  it(\"keeps noRedirectBack same-domain redirects free of redirect-back state\", async () => {\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl: new URL(\"https://app.example.test/settings?tab=profile\"),\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Same-domain redirects must not create cross-domain handoff parameters.\");\n      },\n    });\n\n    expect(redirectPlan).toEqual({\n      type: \"redirect\",\n      url: \"/handler/sign-in\",\n    });\n  });\n\n  it(\"returns noRedirectBack cross-domain auth to the source app home\", async () => {\n    const handoffState = \"no-redirect-back-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(\"https://app.example.test/settings?tab=profile\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    currentUrl.searchParams.set(\n      \"hexclave_cross_domain_after_callback_redirect_url\",\n      \"https://app.example.test/settings?tab=profile\",\n    );\n\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"https://auth.example.test/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl,\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Existing cross-domain handoff parameters must be reused.\");\n      },\n    });\n\n    expect(redirectPlan.type).toBe(\"redirect\");\n    if (redirectPlan.type !== \"redirect\") {\n      throw new Error(\"Expected noRedirectBack sign-in to produce a redirect URL.\");\n    }\n\n    const hostedUrl = new URL(redirectPlan.url);\n    expect(hostedUrl.origin).toBe(\"https://auth.example.test\");\n    expect(hostedUrl.pathname).toBe(\"/handler/sign-in\");\n    expect(hostedUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n\n    const rawSourceCallbackUrl = hostedUrl.searchParams.get(\"after_auth_return_to\");\n    if (rawSourceCallbackUrl == null) {\n      throw new Error(\"Expected cross-domain noRedirectBack to include its internal source callback URL.\");\n    }\n    const sourceCallbackUrl = new URL(rawSourceCallbackUrl);\n    expect(sourceCallbackUrl.origin).toBe(\"https://app.example.test\");\n    expect(sourceCallbackUrl.pathname).toBe(\"/handler/oauth-callback\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_auth\")).toBe(\"1\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_state\")).toBe(handoffState);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(handoffCodeChallenge);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n    expect(sourceCallbackUrl.toString()).not.toContain(\"/settings\");\n  });\n\n  it(\"exposes redirect-back-aware handler URLs for devtool previews\", async () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    Reflect.set(globalThis, \"window\", {\n      location: {\n        href: \"http://localhost/music?track=1#song\",\n      },\n    });\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000000\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"none\",\n        urls: {\n          signIn: \"/handler/sign-in\",\n        },\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"signIn\");\n\n      const resolved = new URL(redirectUrl, \"http://localhost\");\n      expect(resolved.pathname).toBe(\"/handler/sign-in\");\n      expect(resolved.searchParams.get(\"after_auth_return_to\")).toBe(\"/music?track=1#song\");\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"uses the fresh post-auth refresh token when minting a cross-domain handoff\", async () => {\n    const freshAccessToken = createAccessTokenString(\"fresh-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: {\n        accessToken: createAccessTokenString(\"stale-refresh-token-id\"),\n        refreshToken: \"stale-refresh-token\",\n      },\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSendClientRequest = Reflect.get(clientInterface, \"sendClientRequest\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const capturedRefreshTokens: string[] = [];\n    const capturedAccessTokenRefreshTokenIds: string[] = [];\n    const refreshedRawRefreshTokens: string[] = [];\n\n    Reflect.set(clientInterface, \"sendClientRequest\", async (_path: unknown, _requestOptions: unknown, session: unknown) => {\n      const getRefreshToken = Reflect.get(session ?? {}, \"getRefreshToken\");\n      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, \"getOrFetchLikelyValidTokens\");\n      if (typeof getRefreshToken !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session to the client interface.\");\n      }\n      if (typeof getOrFetchLikelyValidTokens !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session with token accessors.\");\n      }\n      const refreshToken = getRefreshToken.call(session);\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected cross-domain auth to pass a refresh-token-backed session.\");\n      }\n      capturedRefreshTokens.push(refreshTokenString);\n      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);\n      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);\n      return {\n        ok: true,\n        json: async () => ({ redirect_url: \"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\" }),\n      };\n    });\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected refresh token while fetching a new access token.\");\n      }\n      refreshedRawRefreshTokens.push(refreshTokenString);\n      return AccessToken.createIfValid(freshAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, \"_createCrossDomainAuthRedirectUrl\");\n      if (typeof createCrossDomainAuthRedirectUrl !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _createCrossDomainAuthRedirectUrl in tests.\");\n      }\n\n      await expect(createCrossDomainAuthRedirectUrl.call(clientApp, {\n        redirectUri: \"https://example.com/handler/oauth-callback\",\n        state: \"handoff-state\",\n        codeChallenge: \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\",\n        afterCallbackRedirectUrl: \"https://example.com/account-settings\",\n        overrideTokenStoreInit: {\n          accessToken: createAccessTokenString(\"fresh-stale-refresh-token-id\"),\n          refreshToken: \"fresh-refresh-token\",\n        },\n      })).resolves.toBe(\"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\");\n    } finally {\n      Reflect.set(clientInterface, \"sendClientRequest\", originalSendClientRequest);\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedAccessTokenRefreshTokenIds).toEqual([\"fresh-refresh-token-id\"]);\n  });\n\n  it(\"uses a fresh nested OAuth state while preserving the outer cross-domain return state\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000002\";\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const outerState = \"outer-cross-domain-state\";\n    const outerCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"after_auth_return_to\", `https://demo.stack-auth.com/?hexclave_cross_domain_auth=1&hexclave_cross_domain_state=${outerState}`);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", outerState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", outerCodeChallenge);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-session\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const redirectUrl = new URL(redirectedUrl);\n    expect(redirectUrl.searchParams.get(\"state\")).toBe(\"fresh-nested-state\");\n    expect(redirectUrl.searchParams.get(\"code_challenge\")).toBe(\"fresh-nested-code-challenge\");\n    const redirectUri = new URL(redirectUrl.searchParams.get(\"redirect_uri\") ?? \"\");\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_state\")).toBe(outerState);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(outerCodeChallenge);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\"https://demo.stack-auth.com/\");\n  });\n\n  it(\"clears a stale target-domain session before deferring to the source-domain session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000006\";\n    const hostedAccessToken = createAccessTokenString(\"hosted-old-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const tokenStore = Reflect.get(clientApp, \"_memoryTokenStore\");\n    if (!(tokenStore instanceof Store)) {\n      throw new Error(\"Expected StackClientApp to use a memory token store in this test.\");\n    }\n    tokenStore.set({\n      refreshToken: \"hosted-old-refresh-token\",\n      accessToken: hostedAccessToken,\n    });\n\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-anonymous-refresh-token-id\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/handler/oauth-callback\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", \"outer-state\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", \"outer-code-challenge\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/app\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(tokenStore.get()).toEqual({\n      refreshToken: null,\n      accessToken: null,\n    });\n    expect(new URL(redirectedUrl).origin).toBe(\"https://demo.stack-auth.com\");\n  });\n\n  it(\"uses the latest browser refresh cookie before computing nested cross-domain session IDs\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000007\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: \"https://demo.stack-auth.com/\",\n        protocol: \"https:\",\n        hostname: \"demo.stack-auth.com\",\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"cookie\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const refreshedRawRefreshTokens: string[] = [];\n\n    // Cookie-store writes queue a background trusted-parent-domain lookup. Without this stub, that\n    // lookup fetches the (unreachable) baseUrl with retries while holding the global store lock,\n    // which starves any later test that needs the write lock (e.g. signOut). Not restored on\n    // purpose: queued tasks can still run after this test body finishes.\n    vi.spyOn(clientApp as any, \"_getTrustedParentDomain\").mockResolvedValue(null);\n\n    try {\n      const getBrowserCookieTokenStore = Reflect.get(clientApp, \"_getBrowserCookieTokenStore\");\n      if (typeof getBrowserCookieTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.\");\n      }\n      const tokenStore = getBrowserCookieTokenStore.call(clientApp);\n      tokenStore.set({\n        refreshToken: \"old-refresh-token\",\n        accessToken: createAccessTokenString(\"old-refresh-token-id\"),\n      });\n\n      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({\n        refresh_token: \"new-refresh-token\",\n        updated_at_millis: 1,\n      })}`;\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n        const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n        if (typeof refreshTokenString !== \"string\") {\n          throw new Error(\"Expected refresh token while fetching a new access token.\");\n        }\n        refreshedRawRefreshTokens.push(refreshTokenString);\n        return AccessToken.createIfValid(createAccessTokenString(\"new-refresh-token-id\")) ?? (() => {\n          throw new Error(\"Expected test access token to be valid\");\n        })();\n      });\n\n      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\");\n      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.\");\n      }\n      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {\n        awaitPendingAuthResolutions: false,\n      })).resolves.toBe(\"new-refresh-token-id\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"new-refresh-token\"]);\n  });\n\n  it(\"does not re-bounce nested cross-domain auth after the OAuth callback consumed code+state from the URL\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000008\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const strippedUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n    const urlAtConstructionTime = new URL(strippedUrl);\n    urlAtConstructionTime.searchParams.set(\"code\", \"one-time-code\");\n    urlAtConstructionTime.searchParams.set(\"state\", \"nested-oauth-state\");\n\n    // Construct before installing the window mock so the constructor does not schedule its own\n    // nested-auth resolution; the assertions below drive the handler explicitly.\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: strippedUrl.toString(),\n        replace: () => {\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    try {\n      // Without the construction-time URL, the handler re-bounces (location.replace aborts).\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      // With it, the in-flight OAuth callback wins and the handler stands down.\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime)).resolves.toBe(false);\n      // The live-URL guard must also stand down on its own when code+state are still present.\n      (globalThis.window as any).location.href = urlAtConstructionTime.toString();\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).resolves.toBe(false);\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"reports malformed nested cross-domain auth URLs as setup errors\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    globalThis.document = createMockDocument();\n\n    // A URL the flow cannot even parse is as fatal as an untrusted one, so it has to reach the developer the same way\n    // instead of escaping as a bare TypeError from `new URL()`, which the overlay only shows during development.\n    // The two branches of the handler want opposite session states: on the provider side (a.com) a query-derived failure\n    // only becomes a setup error when the handoff belongs to the current session, while the requesting side (b.com) only\n    // bounces when the current session is *not* the one that was asked for.\n    const malformedCases = [\n      {\n        description: \"redirect URI\",\n        currentRefreshTokenId: \"source-refresh-token-id\",\n        params: { redirect_uri: \"not-a-url\", state: \"nested-state\", code_challenge: \"nested-code-challenge\" },\n      },\n      {\n        description: \"after-callback redirect URL\",\n        currentRefreshTokenId: \"source-refresh-token-id\",\n        params: {\n          redirect_uri: \"https://source.example.test/handler/account-settings\",\n          state: \"nested-state\",\n          code_challenge: \"nested-code-challenge\",\n          after_callback_redirect_url: \"http://[\",\n        },\n      },\n      {\n        description: \"callback URL\",\n        currentRefreshTokenId: null,\n        params: { stack_nested_cross_domain_auth_callback_url: \"http://[\" },\n      },\n    ];\n\n    try {\n      for (const malformedCase of malformedCases) {\n        const currentUrl = new URL(\"https://target.example.test/nested-provider\");\n        currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n        for (const [key, value] of Object.entries(malformedCase.params)) {\n          currentUrl.searchParams.set(key, value);\n        }\n        // Each app is constructed with the mock window uninstalled: the constructor's automatic side effects expect a\n        // real window, and a construction-time nested-auth URL would also schedule a second, unawaited run of the\n        // handler that keeps failing in the background and leaks into whichever test runs next.\n        globalThis.window = previousWindow;\n        const clientApp = new StackClientApp({\n          baseUrl: \"http://localhost:12345\",\n          projectId,\n          publishableClientKey: \"stack-pk-test\",\n          tokenStore: \"memory\",\n          redirectMethod: \"window\",\n          noAutomaticPrefetch: true,\n          devTool: false,\n        });\n        setMockWindow({ location: { href: currentUrl.toString() } });\n        Reflect.set(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\", async () => malformedCase.currentRefreshTokenId);\n        Reflect.set(clientApp, \"_isTrusted\", async () => true);\n\n        const nestedAuthPromise = callProtectedMethod(clientApp, \"_maybeHandleNestedCrossDomainAuth\");\n        await expect(nestedAuthPromise).rejects.toThrowError(new RegExp(`${malformedCase.description} .* is not a valid absolute URL`));\n        await expect(nestedAuthPromise).rejects.toSatisfy((error: unknown) => HexclaveSetupError.isSetupError(error));\n      }\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"keeps nested cross-domain auth failures off the page for a handoff that does not own the session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000013\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    globalThis.document = createMockDocument();\n\n    // Setup errors are shown in production, so a link anybody can craft must not be able to put a card on a healthy\n    // app's page: with a refresh-token ID that is not the current session's, every failure below stays an ordinary error\n    // that only captureError sees, even though the same URL from the right session would render a card.\n    const craftedRedirectUris = [\n      \"https://evil.example.test/handler/account-settings\", // untrusted\n      \"not-a-url\", // malformed\n    ];\n\n    try {\n      for (const craftedRedirectUri of craftedRedirectUris) {\n        const currentUrl = new URL(\"https://target.example.test/nested-provider\");\n        currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"attacker-chosen-refresh-token-id\");\n        currentUrl.searchParams.set(\"redirect_uri\", craftedRedirectUri);\n        currentUrl.searchParams.set(\"state\", \"nested-state\");\n        currentUrl.searchParams.set(\"code_challenge\", \"nested-code-challenge\");\n\n        globalThis.window = previousWindow;\n        const clientApp = new StackClientApp({\n          baseUrl: \"http://localhost:12345\",\n          projectId,\n          publishableClientKey: \"stack-pk-test\",\n          tokenStore: \"memory\",\n          redirectMethod: \"window\",\n          noAutomaticPrefetch: true,\n          devTool: false,\n        });\n        setMockWindow({ location: { href: currentUrl.toString() } });\n        Reflect.set(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\", async () => \"this-apps-refresh-token-id\");\n        Reflect.set(clientApp, \"_isTrusted\", async () => false);\n\n        const nestedAuthPromise = callProtectedMethod(clientApp, \"_maybeHandleNestedCrossDomainAuth\");\n        await expect(nestedAuthPromise).rejects.toThrowError(/does not match the requested refresh token ID/);\n        await expect(nestedAuthPromise).rejects.toSatisfy(\n          (error: unknown) => !HexclaveSetupError.isSetupError(error),\n        );\n      }\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"passes the construction-time URL to the nested cross-domain auth handler\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000009\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const callbackUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    callbackUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    callbackUrl.searchParams.set(\"code\", \"one-time-code\");\n    callbackUrl.searchParams.set(\"state\", \"nested-oauth-state\");\n    const strippedUrl = new URL(callbackUrl);\n    strippedUrl.searchParams.delete(\"code\");\n    strippedUrl.searchParams.delete(\"state\");\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: callbackUrl.toString(),\n      },\n    } as any;\n\n    const nestedAuthSpy = vi.spyOn(StackClientApp.prototype as any, \"_maybeHandleNestedCrossDomainAuth\").mockResolvedValue(false);\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      // Simulate consumeOAuthCallbackQueryParams stripping code+state before microtasks run.\n      (globalThis.window as any).location.href = strippedUrl.toString();\n      await new Promise((resolve) => setTimeout(resolve, 0));\n\n      expect(nestedAuthSpy).toHaveBeenCalledTimes(1);\n      const urlArgument = nestedAuthSpy.mock.calls[0][0] as URL;\n      expect(urlArgument).toBeInstanceOf(URL);\n      expect(urlArgument.searchParams.get(\"code\")).toBe(\"one-time-code\");\n      expect(urlArgument.searchParams.get(\"state\")).toBe(\"nested-oauth-state\");\n    } finally {\n      nestedAuthSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"redirects hosted current-page OAuth callback errors to the hosted error handler during startup\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000010\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const callbackUrl = new URL(\"https://demo.stack-auth.com/dashboard\");\n    callbackUrl.searchParams.set(\"errorCode\", \"SIGN_UP_REJECTED\");\n    callbackUrl.searchParams.set(\"message\", \"Your sign up was rejected by an administrator's sign-up rule.\");\n    callbackUrl.searchParams.set(\"details\", JSON.stringify({\n      message: \"Your sign up was rejected by an administrator's sign-up rule.\",\n    }));\n    callbackUrl.searchParams.set(\"after_auth_return_to\", \"/dashboard\");\n    callbackUrl.searchParams.set(\"after_callback_redirect_url\", \"https://customer.example.test/settings?tab=connected-accounts\");\n    let currentHref = callbackUrl.toString();\n    let redirectedUrl = \"\";\n    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, \"_redirectTo\").mockImplementation(async (...args: unknown[]) => {\n      const options = args[0] as { url: string | URL };\n      redirectedUrl = options.url.toString();\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n        set href(value: string) {\n          currentHref = value;\n        },\n        origin: callbackUrl.origin,\n      },\n      history: {\n        replaceState: (_state: unknown, _title: string, url: string) => {\n          currentHref = new URL(url, currentHref).toString();\n        },\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        urls: {\n          default: { type: \"hosted\" },\n        },\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      await new Promise((resolve) => setTimeout(resolve, 0));\n      await new Promise((resolve) => setTimeout(resolve, 0));\n    } finally {\n      redirectSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const errorUrl = new URL(redirectedUrl);\n    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);\n    expect(errorUrl.pathname).toBe(\"/handler/error\");\n    expect(errorUrl.searchParams.get(\"errorCode\")).toBe(\"SIGN_UP_REJECTED\");\n    expect(errorUrl.searchParams.get(\"message\")).toBe(\"Your sign up was rejected by an administrator's sign-up rule.\");\n    expect(errorUrl.searchParams.get(\"after_auth_return_to\")).toBe(\"/dashboard\");\n    expect(errorUrl.searchParams.get(\"after_callback_redirect_url\")).toBe(\"https://customer.example.test/settings?tab=connected-accounts\");\n    expect(new URL(currentHref).searchParams.has(\"errorCode\")).toBe(false);\n  });\n\n  it(\"uses direct sign-out instead of hosted sign-out redirects when code execution is available\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/handler\",\n        signOut: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const signOutSpy = vi.spyOn(clientApp, \"signOut\").mockRejectedValue(new Error(\"INTENTIONAL_TEST_ABORT\"));\n\n    try {\n      await expect(clientApp.redirectToSignOut()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      expect(signOutSpy).toHaveBeenCalledWith();\n    } finally {\n      signOutSpy.mockRestore();\n    }\n  });\n\n  it(\"throws when public app.urls reads would return hosted component URLs\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    expect(() => clientApp.urls.signIn).toThrowError(/app\\.urls\\.signIn cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignIn\\(\\) instead/s);\n    expect(() => clientApp.urls.signOut).toThrowError(/app\\.urls\\.signOut cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignOut\\(\\) instead/s);\n    expect(clientApp.urls.afterSignIn).toBe(\"/\");\n  });\n\n  it(\"keeps public app.urls reads available for non-hosted targets\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/custom-handler\",\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    expect(clientApp.urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"keeps default hosted signOut() on the source domain when afterSignOut is not configured\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000004\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const currentHref = \"https://demo.stack-auth.com/settings?tab=profile\";\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSignOut = Reflect.get(clientInterface, \"signOut\");\n    Reflect.set(clientInterface, \"signOut\", async () => {});\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentHref,\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      const signOut = Reflect.get(clientApp, \"_signOut\");\n      if (typeof signOut !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _signOut in tests.\");\n      }\n      await expect(signOut.call(clientApp, Reflect.get(clientInterface, \"createSession\").call(clientInterface, {\n        refreshToken: null,\n      }))).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"signOut\", originalSignOut);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(redirectedUrl).toBe(\"/settings?tab=profile\");\n  });\n\n  it(\"restores a dropped after_auth_return_to from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n    const windowMock = {\n      location: {\n        href: \"https://demo.example.test/handler/sign-in?after_auth_return_to=%2Fmusic%3Ftrack%3D1\",\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      // The constructor mirrors the redirect-back state from the arrival URL into sessionStorage.\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000011\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      // Intermediate hops (MFA, magic link, OAuth round-trips, ...) dropped the query params.\n      windowMock.location.href = \"https://demo.example.test/handler/mfa\";\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n      expect(redirectUrl).toBe(\"/music?track=1\");\n\n      // noRedirectBack opts out of the mirror just like it opts out of the query param.\n      const noRedirectBackUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\", { noRedirectBack: true });\n      expect(new URL(noRedirectBackUrl, \"https://demo.example.test\").pathname).toBe(\"/\");\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"restores dropped cross-domain handoff state from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n\n    const handoffState = \"mirror-handoff-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const handoffAfterCallbackRedirect = \"https://demo.example.test/dashboard\";\n    const redirectBackUrl = new URL(\"https://demo.example.test/handler/oauth-callback\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_auth\", \"1\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);\n    arrivalUrl.searchParams.set(\"after_auth_return_to\", redirectBackUrl.toString());\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const previousDocument = globalThis.document;\n    const windowMock = {\n      location: {\n        href: arrivalUrl.toString(),\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n      const crossDomainAuthorizeRedirect = \"https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state\";\n      const createCrossDomainAuthRedirectUrlSpy = vi\n        .spyOn(clientApp as any, \"_createCrossDomainAuthRedirectUrl\")\n        .mockResolvedValue(crossDomainAuthorizeRedirect);\n\n      // All redirect-back query params were dropped before the after-sign-in redirect.\n      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n\n      expect(createCrossDomainAuthRedirectUrlSpy).toHaveBeenCalledWith(expect.objectContaining({\n        redirectUri: redirectBackUrl.toString(),\n        state: handoffState,\n        codeChallenge: handoffCodeChallenge,\n        afterCallbackRedirectUrl: handoffAfterCallbackRedirect,\n      }));\n      expect(redirectUrl).toBe(crossDomainAuthorizeRedirect);\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"ignores stale session callbacks after a newer refresh token owns the token store\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000005\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const oldAccessToken = createAccessTokenString(\"old-refresh-token-id\");\n    const refreshedOldAccessToken = createAccessTokenString(\"refreshed-old-refresh-token-id\");\n    const newAccessToken = createAccessTokenString(\"new-refresh-token-id\");\n    const tokenStore = new Store({\n      refreshToken: \"old-refresh-token\",\n      accessToken: oldAccessToken,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const getSessionFromTokenStore = Reflect.get(clientApp, \"_getSessionFromTokenStore\");\n      if (typeof getSessionFromTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getSessionFromTokenStore in tests.\");\n      }\n      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);\n      tokenStore.set({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      await oldSession.fetchNewTokens();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      oldSession.markInvalid();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n  });\n});\n"],"mappings":";;;;;;;;AAgBA,SAAS,wBAAwB,gBAAgC;CAC/D,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,qBAA+B;CACtC,MAAM,4BAAY,IAAI,IAAoB;CAC1C,OAAO;EACL,IAAI,SAAS;GACX,OAAO,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;EACpF;EACA,IAAI,OAAO,KAAa;GACtB,MAAM,CAAC,aAAa,IAAI,MAAM,GAAG;GACjC,MAAM,UAAU,UAAU,QAAQ,GAAG;GACrC,IAAI,UAAU,GAAG;GACjB,UAAU,IAAI,UAAU,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACvF;EACA,sBAAsB,CAAC;CACzB;AACF;;;;;;AAOA,SAAS,cAAc,YAEd;CACP,QAAQ,IAAI,YAAY,UAAU,UAAU;AAC9C;;;;AAKA,SAAS,oBAAoB,KAA2B,YAAoB,GAAG,MAAmC;CAChH,MAAM,SAAS,QAAQ,IAAI,KAAK,UAAU;CAC1C,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,MAAM,qCAAqC,WAAW,kBAAkB;CAEpF,OAAO,OAAO,MAAM,KAAK,IAAI;AAC/B;AAEA,SAAS,0CAA0C;CACjD,GAAG,0EAA0E,YAAY;EAavF,OAAO,MAZoB,sBAAsB;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY,IAAI,IAAI,+CAA+C;GACnE,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,wEAAwE;GAC1F;EACF,CAAC,CAEkB,CAAC,CAAC,QAAQ;GAC3B,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;CAED,GAAG,mEAAmE,YAAY;EAChF,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,aAAa,IAAI,IAAI,+CAA+C;EAC1E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IACtB,qDACA,+CACF;EAEA,MAAM,eAAe,MAAM,sBAAsB;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB;GACA,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,0DAA0D;GAC5E;EACF,CAAC;EAED,OAAO,aAAa,IAAI,CAAC,CAAC,KAAK,UAAU;EACzC,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,YAAY,IAAI,IAAI,aAAa,GAAG;EAC1C,OAAO,UAAU,MAAM,CAAC,CAAC,KAAK,2BAA2B;EACzD,OAAO,UAAU,QAAQ,CAAC,CAAC,KAAK,kBAAkB;EAClD,OAAO,UAAU,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KACtF,+BACF;EAEA,MAAM,uBAAuB,UAAU,aAAa,IAAI,sBAAsB;EAC9E,IAAI,wBAAwB,MAC1B,MAAM,IAAI,MAAM,mFAAmF;EAErG,MAAM,oBAAoB,IAAI,IAAI,oBAAoB;EACtD,OAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK,0BAA0B;EAChE,OAAO,kBAAkB,QAAQ,CAAC,CAAC,KAAK,yBAAyB;EACjE,OAAO,kBAAkB,aAAa,IAAI,4BAA4B,CAAC,CAAC,CAAC,KAAK,GAAG;EACjF,OAAO,kBAAkB,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3F,OAAO,kBAAkB,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,oBAAoB;EAC5G,OAAO,kBAAkB,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAC9F,+BACF;EACA,OAAO,kBAAkB,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,WAAW;CAChE,CAAC;CAED,GAAG,iEAAiE,YAAY;EAC9E,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,QAAQ,IAAI,YAAY,UAAU,EAChC,UAAU,EACR,MAAM,sCACR,EACF,CAAC;EAED,IAAI;GAcF,MAAM,cAAc,MAAM,IAbJ,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,QAAQ,mBACV;IACA,qBAAqB;IACrB,SAAS;GACX,CAEkC,CAAC,CAAC,2BAA2B,CAAC,wBAAwB,QAAQ;GAEhG,MAAM,WAAW,IAAI,IAAI,aAAa,kBAAkB;GACxD,OAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,kBAAkB;GACjD,OAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,qBAAqB;EACtF,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,GAAG,8EAA8E,YAAY;EAC3F,MAAM,mBAAmB,wBAAwB,wBAAwB;EACzE,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;IACV,aAAa,wBAAwB,wBAAwB;IAC7D,cAAc;GAChB;GACA,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,4BAA4B,QAAQ,IAAI,iBAAiB,mBAAmB;EAClF,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,wBAAkC,CAAC;EACzC,MAAM,qCAA+C,CAAC;EACtD,MAAM,4BAAsC,CAAC;EAE7C,QAAQ,IAAI,iBAAiB,qBAAqB,OAAO,OAAgB,iBAA0B,YAAqB;GACtH,MAAM,kBAAkB,QAAQ,IAAI,WAAW,CAAC,GAAG,iBAAiB;GACpE,MAAM,8BAA8B,QAAQ,IAAI,WAAW,CAAC,GAAG,6BAA6B;GAC5F,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,MAAM,uEAAuE;GAEzF,IAAI,OAAO,gCAAgC,YACzC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,MAAM,eAAe,gBAAgB,KAAK,OAAO;GACjD,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,sBAAsB,KAAK,kBAAkB;GAC7C,MAAM,SAAS,MAAM,4BAA4B,KAAK,SAAS,GAAG,IAAI;GACtE,mCAAmC,KAAK,OAAO,YAAY,QAAQ,gBAAgB;GACnF,OAAO;IACL,IAAI;IACJ,MAAM,aAAa,EAAE,cAAc,mFAAmF;GACxH;EACF,CAAC;EACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;GACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,0BAA0B,KAAK,kBAAkB;GACjD,OAAO,YAAY,cAAc,gBAAgB,YAAY;IAC3D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,mCAAmC,QAAQ,IAAI,WAAW,mCAAmC;GACnG,IAAI,OAAO,qCAAqC,YAC9C,MAAM,IAAI,MAAM,+EAA+E;GAGjG,MAAM,OAAO,iCAAiC,KAAK,WAAW;IAC5D,aAAa;IACb,OAAO;IACP,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;KACtB,aAAa,wBAAwB,8BAA8B;KACnE,cAAc;IAChB;GACF,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,kFAAkF;EACtG,UAAU;GACR,QAAQ,IAAI,iBAAiB,qBAAqB,yBAAyB;GAC3E,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;EAEA,OAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EACjE,OAAO,qBAAqB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EAC7D,OAAO,kCAAkC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;CAED,GAAG,wFAAwF,YAAY;EACrG,MAAM,YAAY;EAClB,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,qBAAqB;EAC3B,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,wBAAwB,yFAAyF,YAAY;EACzJ,WAAW,aAAa,IAAI,+BAA+B,UAAU;EACrE,WAAW,aAAa,IAAI,wCAAwC,kBAAkB;EACtF,WAAW,aAAa,IAAI,qDAAqD,8BAA8B;EAC/G,WAAW,aAAa,IAAI,mDAAmD,gBAAgB;EAC/F,WAAW,aAAa,IAAI,+CAA+C,8BAA8B;EAEzG,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,OAAQ,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa;EACzC,OAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACvE,OAAO,YAAY,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,6BAA6B;EACzF,MAAM,cAAc,IAAI,IAAI,YAAY,aAAa,IAAI,cAAc,KAAK,EAAE;EAC9E,OAAO,YAAY,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,UAAU;EACnF,OAAO,YAAY,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACpG,OAAO,YAAY,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAAK,8BAA8B;CAC/H,CAAC;CAED,GAAG,sFAAsF,YAAY;EACnG,MAAM,YAAY;EAClB,MAAM,oBAAoB,wBAAwB,6BAA6B;EAC/E,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa,QAAQ,IAAI,WAAW,mBAAmB;EAC7D,IAAI,EAAE,sBAAsB,QAC1B,MAAM,IAAI,MAAM,mEAAmE;EAErF,WAAW,IAAI;GACb,cAAc;GACd,aAAa;EACf,CAAC;EAED,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,mDAAmD,mCAAmC;EAClH,WAAW,aAAa,IAAI,+CAA+C,oDAAoD;EAC/H,WAAW,aAAa,IAAI,+BAA+B,aAAa;EACxE,WAAW,aAAa,IAAI,wCAAwC,sBAAsB;EAC1F,WAAW,aAAa,IAAI,qDAAqD,iCAAiC;EAElH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAO,YAAY,cAAc,iBAAiB,YAAY;IAC5D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EACD,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,OAAQ,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;GAC/B,cAAc;GACd,aAAa;EACf,CAAC;EACD,OAAO,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,6BAA6B;CAC1E,CAAC;CAED,GAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,MAAM;IACN,UAAU;IACV,UAAU;GACZ;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,4BAAsC,CAAC;EAM7C,GAAG,MAAM,WAAkB,yBAAyB,CAAC,CAAC,kBAAkB,IAAI;EAE5E,IAAI;GACF,MAAM,6BAA6B,QAAQ,IAAI,WAAW,6BAA6B;GACvF,IAAI,OAAO,+BAA+B,YACxC,MAAM,IAAI,MAAM,yEAAyE;GAG3F,2BAD8C,KAAK,SAC1C,CAAC,CAAC,IAAI;IACb,cAAc;IACd,aAAa,wBAAwB,sBAAsB;GAC7D,CAAC;GAED,SAAS,SAAS,2BAA2B,UAAU,YAAY,KAAK,UAAU;IAChF,eAAe;IACf,mBAAmB;GACrB,CAAC;GACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;IACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;IAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;IAE7E,0BAA0B,KAAK,kBAAkB;IACjD,OAAO,YAAY,cAAc,wBAAwB,sBAAsB,CAAC,YAAY;KAC1F,MAAM,IAAI,MAAM,wCAAwC;IAC1D,EAAA,CAAG;GACL,CAAC;GAED,MAAM,uCAAuC,QAAQ,IAAI,WAAW,uCAAuC;GAC3G,IAAI,OAAO,yCAAyC,YAClD,MAAM,IAAI,MAAM,mFAAmF;GAErG,MAAM,OAAO,qCAAqC,KAAK,WAAW,EAChE,6BAA6B,MAC/B,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB;EAC1C,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,OAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjE,CAAC;CAED,GAAG,yGAAyG,YAAY;EACtH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,+CAA+C,8BAA8B;EAC1G,MAAM,wBAAwB,IAAI,IAAI,WAAW;EACjD,sBAAsB,aAAa,IAAI,QAAQ,eAAe;EAC9D,sBAAsB,aAAa,IAAI,SAAS,oBAAoB;EAIpE,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,YAAY,SAAS;GAC3B,eAAe;IACb,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,IAAI;GAEF,MAAM,OAAQ,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GAElH,MAAM,OAAQ,UAAkB,kCAAkC,qBAAqB,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;GAE7G,WAAY,OAAe,SAAS,OAAO,sBAAsB,SAAS;GAC1E,MAAM,OAAQ,UAAkB,kCAAkC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;EAC1F,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,GAAG,mEAAmE,YAAY;EAChF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,WAAW,WAAW,mBAAmB;EAOzC,MAAM,iBAAiB;GACrB;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ;KAAE,cAAc;KAAa,OAAO;KAAgB,gBAAgB;IAAwB;GACtG;GACA;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ;KACN,cAAc;KACd,OAAO;KACP,gBAAgB;KAChB,6BAA6B;IAC/B;GACF;GACA;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ,EAAE,6CAA6C,WAAW;GACpE;EACF;EAEA,IAAI;GACF,KAAK,MAAM,iBAAiB,gBAAgB;IAC1C,MAAM,aAAa,IAAI,IAAI,6CAA6C;IACxE,WAAW,aAAa,IAAI,mDAAmD,yBAAyB;IACxG,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,MAAM,GAC5D,WAAW,aAAa,IAAI,KAAK,KAAK;IAKxC,WAAW,SAAS;IACpB,MAAM,YAAY,IAAI,eAAe;KACnC,SAAS;KACT;KACA,sBAAsB;KACtB,YAAY;KACZ,gBAAgB;KAChB,qBAAqB;KACrB,SAAS;IACX,CAAC;IACD,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,SAAS,EAAE,EAAE,CAAC;IAC3D,QAAQ,IAAI,WAAW,yCAAyC,YAAY,cAAc,qBAAqB;IAC/G,QAAQ,IAAI,WAAW,cAAc,YAAY,IAAI;IAErD,MAAM,oBAAoB,oBAAoB,WAAW,mCAAmC;IAC5F,MAAM,OAAO,iBAAiB,CAAC,CAAC,QAAQ,aAAa,IAAI,OAAO,GAAG,cAAc,YAAY,gCAAgC,CAAC;IAC9H,MAAM,OAAO,iBAAiB,CAAC,CAAC,QAAQ,WAAW,UAAmB,mBAAmB,aAAa,KAAK,CAAC;GAC9G;EACF,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,GAAG,oGAAoG,YAAY;EACjH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,WAAW,WAAW,mBAAmB;EAKzC,MAAM,sBAAsB,CAC1B,sDACA,WACF;EAEA,IAAI;GACF,KAAK,MAAM,sBAAsB,qBAAqB;IACpD,MAAM,aAAa,IAAI,IAAI,6CAA6C;IACxE,WAAW,aAAa,IAAI,mDAAmD,kCAAkC;IACjH,WAAW,aAAa,IAAI,gBAAgB,kBAAkB;IAC9D,WAAW,aAAa,IAAI,SAAS,cAAc;IACnD,WAAW,aAAa,IAAI,kBAAkB,uBAAuB;IAErE,WAAW,SAAS;IACpB,MAAM,YAAY,IAAI,eAAe;KACnC,SAAS;KACT;KACA,sBAAsB;KACtB,YAAY;KACZ,gBAAgB;KAChB,qBAAqB;KACrB,SAAS;IACX,CAAC;IACD,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,SAAS,EAAE,EAAE,CAAC;IAC3D,QAAQ,IAAI,WAAW,yCAAyC,YAAY,4BAA4B;IACxG,QAAQ,IAAI,WAAW,cAAc,YAAY,KAAK;IAEtD,MAAM,oBAAoB,oBAAoB,WAAW,mCAAmC;IAC5F,MAAM,OAAO,iBAAiB,CAAC,CAAC,QAAQ,aAAa,+CAA+C;IACpG,MAAM,OAAO,iBAAiB,CAAC,CAAC,QAAQ,WACrC,UAAmB,CAAC,mBAAmB,aAAa,KAAK,CAC5D;GACF;EACF,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,GAAG,4EAA4E,YAAY;EACzF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,QAAQ,eAAe;EACpD,YAAY,aAAa,IAAI,SAAS,oBAAoB;EAC1D,MAAM,cAAc,IAAI,IAAI,WAAW;EACvC,YAAY,aAAa,OAAO,MAAM;EACtC,YAAY,aAAa,OAAO,OAAO;EAEvC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU,EACR,MAAM,YAAY,SAAS,EAC7B,EACF;EAEA,MAAM,gBAAgB,GAAG,MAAM,eAAe,WAAkB,mCAAmC,CAAC,CAAC,kBAAkB,KAAK;EAE5H,IAAI;GACF,IAAI,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GAGD,WAAY,OAAe,SAAS,OAAO,YAAY,SAAS;GAChE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GAErD,OAAO,aAAa,CAAC,CAAC,sBAAsB,CAAC;GAC7C,MAAM,cAAc,cAAc,KAAK,MAAM,EAAE,CAAC;GAChD,OAAO,WAAW,CAAC,CAAC,eAAe,GAAG;GACtC,OAAO,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;GACjE,OAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACzE,UAAU;GACR,cAAc,YAAY;GAC1B,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,GAAG,kGAAkG,YAAY;EAC/G,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,cAAc,IAAI,IAAI,uCAAuC;EACnE,YAAY,aAAa,IAAI,aAAa,kBAAkB;EAC5D,YAAY,aAAa,IAAI,WAAW,+DAA+D;EACvG,YAAY,aAAa,IAAI,WAAW,KAAK,UAAU,EACrD,SAAS,gEACX,CAAC,CAAC;EACF,YAAY,aAAa,IAAI,wBAAwB,YAAY;EACjE,YAAY,aAAa,IAAI,+BAA+B,+DAA+D;EAC3H,IAAI,cAAc,YAAY,SAAS;EACvC,IAAI,gBAAgB;EACpB,MAAM,cAAc,GAAG,MAAM,eAAe,WAAkB,aAAa,CAAC,CAAC,mBAAmB,OAAO,GAAG,SAAoB;GAE5H,gBADgB,KAAK,EACE,CAAC,IAAI,SAAS;EACvC,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,IAAI,OAAO;KACT,OAAO;IACT;IACA,IAAI,KAAK,OAAe;KACtB,cAAc;IAChB;IACA,QAAQ,YAAY;GACtB;GACA,SAAS,EACP,eAAe,QAAiB,QAAgB,QAAgB;IAC9D,cAAc,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,SAAS;GACnD,EACF;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,IAAI;GACF,IAAI,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;IACA,qBAAqB;IACrB,SAAS;GACX,CAAC;GAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GACrD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;EACvD,UAAU;GACR,YAAY,YAAY;GACxB,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,WAAW,IAAI,IAAI,aAAa;EACtC,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,WAAW,UAAU,yBAAyB;EAC3E,OAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,gBAAgB;EAC/C,OAAO,SAAS,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACtE,OAAO,SAAS,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACjH,OAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3E,OAAO,SAAS,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACrI,OAAO,IAAI,IAAI,WAAW,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK;CACvE,CAAC;CAED,GAAG,8FAA8F,YAAY;EAC3G,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM;IACJ,SAAS;IACT,SAAS,EAAE,MAAM,SAAS;GAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa,GAAG,MAAM,WAAW,SAAS,CAAC,CAAC,kCAAkB,IAAI,MAAM,wBAAwB,CAAC;EAEvG,IAAI;GACF,MAAM,OAAO,UAAU,kBAAkB,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GACzF,OAAO,UAAU,CAAC,CAAC,qBAAqB;EAC1C,UAAU;GACR,WAAW,YAAY;EACzB;CACF,CAAC;CAED,GAAG,8EAA8E;EAC/E,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,aAAa,UAAU,KAAK,MAAM,CAAC,CAAC,aAAa,+HAA+H;EAChL,aAAa,UAAU,KAAK,OAAO,CAAC,CAAC,aAAa,iIAAiI;EACnL,OAAO,UAAU,KAAK,WAAW,CAAC,CAAC,KAAK,GAAG;CAC7C,CAAC;CAED,GAAG,sEAAsE;EAcvE,OAAO,IAbe,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,kBACX;GACA,qBAAqB;GACrB,SAAS;EACX,CAEe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,yBAAyB;CAC9D,CAAC;CAED,GAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,cAAc;EAEpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,kBAAkB,QAAQ,IAAI,iBAAiB,SAAS;EAC9D,QAAQ,IAAI,iBAAiB,WAAW,YAAY,CAAC,CAAC;EACtD,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EAEpB,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM;GACN,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,UAAU,QAAQ,IAAI,WAAW,UAAU;GACjD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,sDAAsD;GAExE,MAAM,OAAO,QAAQ,KAAK,WAAW,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CAAC,KAAK,iBAAiB,EACvG,cAAc,KAChB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpD,UAAU;GACR,QAAQ,IAAI,iBAAiB,WAAW,eAAe;GACvD,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,OAAO,aAAa,CAAC,CAAC,KAAK,uBAAuB;CACpD,CAAC;CAED,GAAG,yGAAyG,YAAY;EACtH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAClD,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,sFACR;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GAEF,MAAM,YAAY,IAAI,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GAGD,WAAW,SAAS,OAAO;GAG3B,OAAO,MADmB,UAAU,2BAA2B,CAAC,wBAAwB,aAAa,CACnF,CAAC,CAAC,KAAK,gBAAgB;GAGzC,MAAM,oBAAoB,MAAM,UAAU,2BAA2B,CAAC,wBAAwB,eAAe,EAAE,gBAAgB,KAAK,CAAC;GACrI,OAAO,IAAI,IAAI,mBAAmB,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG;EACnF,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,GAAG,6GAA6G,YAAY;EAC1H,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAElD,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,+BAA+B;EACrC,MAAM,kBAAkB,IAAI,IAAI,kDAAkD;EAClF,gBAAgB,aAAa,IAAI,8BAA8B,GAAG;EAClE,gBAAgB,aAAa,IAAI,+BAA+B,YAAY;EAC5E,gBAAgB,aAAa,IAAI,wCAAwC,oBAAoB;EAC7F,gBAAgB,aAAa,IAAI,qDAAqD,4BAA4B;EAElH,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,yCAAyC;EACzF,WAAW,aAAa,IAAI,wBAAwB,gBAAgB,SAAS,CAAC;EAC9E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IAAI,qDAAqD,4BAA4B;EAE7G,MAAM,mBAAmB,WAAW;EACpC,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,WAAW,SAAS,EAC5B;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GACF,MAAM,YAAY,IAAI,eAAe;IACnC,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GACD,MAAM,+BAA+B;GACrC,MAAM,sCAAsC,GACzC,MAAM,WAAkB,mCAAmC,CAAC,CAC5D,kBAAkB,4BAA4B;GAGjD,WAAW,SAAS,OAAO,WAAW,UAAU;GAEhD,MAAM,cAAc,MAAM,UAAU,2BAA2B,CAAC,wBAAwB,aAAa;GAErG,OAAO,mCAAmC,CAAC,CAAC,qBAAqB,OAAO,iBAAiB;IACvF,aAAa,gBAAgB,SAAS;IACtC,OAAO;IACP,eAAe;IACf,0BAA0B;GAC5B,CAAC,CAAC;GACF,OAAO,WAAW,CAAC,CAAC,KAAK,4BAA4B;EACvD,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,GAAG,oFAAoF,YAAY;EACjG,MAAM,YAAY,IAAI,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,0BAA0B,wBAAwB,gCAAgC;EACxF,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,aAAa,IAAI,MAAM;GAC3B,cAAc;GACd,aAAa;EACf,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAO,YAAY,cAAc,uBAAuB,YAAY;IAClE,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,2BAA2B,QAAQ,IAAI,WAAW,2BAA2B;GACnF,IAAI,OAAO,6BAA6B,YACtC,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,aAAa,yBAAyB,KAAK,WAAW,UAAU;GACtE,WAAW,IAAI;IACb,cAAc;IACd,aAAa;GACf,CAAC;GAED,MAAM,WAAW,eAAe;GAChC,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;GAED,WAAW,YAAY;GACvB,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;EACH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;CACF,CAAC;AACH,CAAC"}

package/dist/esm/lib/hexclave-app/apps/implementations/client-app-impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-app-impl.d.ts","names":[],"sources":["../../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAqNK,+CAAA,4DAA2G,gCAAA,CAAiC,aAAA,EAAe,SAAA;EAAe,YAAA;AAAA;AAAA,cAElK,gCAAA,8EAA8G,cAAA,CAAe,aAAA,EAAe,SAAA;EAFrG;;;;;;;EAAA,gBAUlC,qBAAA;IAAyB,KAAA,oCAAyC,+BAAA;EAAA;EAAA,mBAE/D,QAAA,EAAU,+CAAA,CAAgD,aAAA,EAAe,SAAA;EAAA,mBACzE,aAAA;IAAiB,gBAAA;IAA2B,WAAA;IAAsB,SAAA,GAAY,uBAAA;EAAA;EAAA,UACvF,iBAAA;EAAA,UACA,UAAA,EAAY,uBAAA;EAAA,mBACH,eAAA,EAAiB,cAAA,CAAe,aAAA;EAAA,mBAChC,eAAA,EAAiB,cAAA;EAAA,mBACjB,WAAA,EAAa,mBAAA;EAAA,mBACb,oBAAA,EAAsB,OAAA,CAAQ,mBAAA;EAAA,iBAEhC,iBAAA;EAAA,QACT,gBAAA;EAAA,QACA,aAAA;EAAA,QAEA,gCAAA;EAAA,iBACS,eAAA;EAAA,iBAEA,iBAAA;EAAA,iBAyBA,oBAAA;EAAA,iBAGA,mBAAA;EAAA,iBAGA,4BAAA;EAAA,iBAMA,mCAAA;EAAA,iBAMA,sBAAA;EAgPQ;EAAA,iBA5OR,4CAAA;EA6OY;EAAA,iBA/NZ,gCAAA;EAAA,iBAYA,kCAAA;EAAA,iBAMA,qDAAA;EAAA,iBAaA,iDAAA;EAAA,iBA2BA,wBAAA;EAAA,iBAKA,qBAAA;EAAA,iBAKA,4BAAA;EAAA,iBAKA,gCAAA;EAAA,iBAGA,2BAAA;EAAA,iBAMA,iBAAA;EAAA,iBAOA,iBAAA;EAAA,iBAOA,4BAAA;EAAA,iBAOA,+BAAA;EAAA,iBAMA,cAAA;EAAA,iBAMA,cAAA;EAAA,iBAMA,gBAAA;EAAA,iBAMA,kBAAA;EAAA,iBAWA,kBAAA;EAAA,iBAWA,oBAAA;EAAA,iBAWA,kBAAA;EAAA,iBAWA,kBAAA;EAAA,iBAWA,qBAAA;EAAA,iBAeA,uBAAA;EAAA,iBAIA,yBAAA;EAAA,QAIT,0BAAA;EAAA,QACA,mCAAA;EAAA,QACA,4CAAA;EAAA,QACA,sCAAA;EAAA,QACA,8BAAA;EAAA,UAEQ,mBAAA,CAAoB,sBAAA,GAAyB,cAAA,GAAiB,OAAA,CAAQ,YAAA;EA+iBzD;EAAA,UAriBb,8BAAA,CAA+B,OAAA;IAC7C,OAAA,QAAe,OAAA,CAAQ,eAAA;IACvB,mBAAA,QAA2B,OAAA;MAAU,WAAA;IAAA;IACrC,UAAA,EAAY,YAAA;IACZ,KAAA;EAAA;IACK,QAAA;IAAgB,OAAA,EAAS,eAAA;EAAA;IAA6B,QAAA;EAAA,KAAsB,OAAA,CAAQ,yBAAA;EAAA,UAuDjF,kCAAA,CACR,IAAA;IAAQ,QAAA;IAAkB,mBAAA;EAAA,GAC1B,OAAA,EAAS,eAAA,GACR,eAAA;cAoBS,OAAA,EAAS,gCAAA,CAAiC,aAAA,EAAe,SAAA,GAAY,YAAA;IAAiB,gBAAA;IAA2B,WAAA;IAAsB,SAAA,GAAY,uBAAA;EAAA;EAAA,QAsDvJ,+BAAA;EAAA,UAkFE,qBAAA;EAAA,UAUA,2BAAA,CAA4B,QAAA,QAAgB,OAAA;EAAA,UAqBtC,4BAAA,CACd,sBAAA,GAAyB,cAAA,EACzB,OAAA;IAAY,2BAAA;EAAA,IAAuC,OAAA;EAAA,UAiB3C,yBAAA;EAAA,UAKA,iCAAA;EAAA,UAcA,sCAAA;EAAA,UAcA,yCAAA;EAAA,UAaA,kDAAA;EAAA,UAUA,4BAAA;EAAA,UAeM,6BAAA,CAA8B,KAAA,EAAO,UAAA,GAAa,OAAA;EAAA,UA8BlD,uCAAA,IAA2C,OAAA;EAAA,UAY3C,qCAAA,CAAsC,OAAA;IACpD,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IACvB,OAAA;EAAA,UAaY,4CAAA,CAA6C,OAAA;IAC3D,GAAA;IACA,UAAA,EAAY,GAAA;IACZ,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IACvB,OAAA;EAAA,UAsBY,iCAAA,CAAkC,qBAAA,GAAwB,GAAA,GAAM,OAAA;EAwvB7E;;;;;EAAA,UA/oBO,oBAAA;EAAA,UAQM,oBAAA,CAAqB,IAAA,UAAc,OAAA,QAAY,OAAA;EAAA,UAIrD,uBAAA,CAAwB,IAAA,UAAc,OAAA;EAAA,UAKtC,iBAAA,EAAiB,KAAA,CAAA,WAAA;EAAA,UACjB,6BAAA,EAA6B,OAAA,SAAA,KAAA,CAAA,WAAA;EAAA,UAC7B,mBAAA,EAAmB,OAAA,CAAA,WAAA,EAAA,KAAA,CAAA,WAAA;EAAA,UACnB,8BAAA,EAAgC,KAAA,CAAM,WAAA;EAAA,QACxC,mCAAA;EAAA,cACM,6BAAA;EAAA,cAGA,uBAAA;EAAA,QAGN,0CAAA;EAAA,QAGA,2BAAA;EAAA,QAIA,qCAAA;EAAA,QAYA,yBAAA;EAAA,QAMA,wBAAA;EAAA,QAGA,6BAAA;EAAA,QAsBA,iCAAA;EAAA,UAkDE,qBAAA,CAAsB,OAAA,EAAS,MAAA,CAAO,OAAA,GAAU,WAAA;EAAA,QA2BlD,uCAAA;EAAA,cAOM,sBAAA;EAAA,cAOA,4BAAA;EAAA,QAGN,qBAAA;EAAA,QAMA,kCAAA;EAAA,QAWA,+BAAA;EAAA,QAeA,2BAAA;EAAA,QAmBA,iCAAA;EAAA,QAmBA,+BAAA;EAAA,QAyCM,yBAAA;EAAA,QAWA,uBAAA;EAAA,UAIJ,2BAAA,IAA+B,KAAA,CAAM,WAAA;EAAA,UAwDrC,sBAAA,CAAuB,YAAA,EAAc,YAAA,EAAc,sBAAA,GAAyB,cAAA,GAAiB,KAAA,CAAM,WAAA;EA0iB9E;;;;;;;;EAAA,QAlbvB,kCAAA;EAugBgD;;;;EAAA,UAlgB9C,yBAAA,CAA0B,UAAA,EAAY,KAAA,CAAM,WAAA,GAAc,gBAAA,GAAmB,WAAA,GAAc,eAAA;EAAA,UA8BrF,WAAA,CACd,sBAAA,GAAyB,cAAA,EACzB,OAAA;IAAY,2BAAA;EAAA,IACX,OAAA,CAAQ,eAAA;EAAA,QAQH,qBAAA;EAAA,UACQ,0BAAA,CAA2B,MAAA;IAAU,WAAA;IAA4B,YAAA;EAAA,IAAsB,OAAA;EAAA,UA4B7F,gCAAA,CAAiC,MAAA;IAAU,WAAA;IAA4B,YAAA;EAAA,IAAyB,cAAA;EAAA,UAUhG,wBAAA,CAAyB,sBAAA,GAAyB,cAAA,WAAyB,cAAA,OAAqB,SAAA;EAAA,UAIhG,2BAAA,CAA4B,sBAAA,GAAyB,cAAA,mBAAiC,cAAA,OAAqB,SAAA;EAAA,UAM3G,kBAAA;IAAgC,SAAA;EAAA;EAAA,UAIhC,sBAAA;IAA4C,SAAA;EAAA;EAAA,UAM5C,sBAAA,CAAuB,IAAA,EAAM,kBAAA,qBAAuC,OAAA;EAAA,UA2BpE,yBAAA,CAA0B,IAAA,EAAM,mBAAA,qBAAwC,sBAAA,qBAA2C,cAAA;EAAA,UAMnH,uBAAA,CAAwB,IAAA,EAAM,sBAAA,qBAA2C,QAAA;EAAA,UAUzE,iCAAA,CAAkC,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,kBAAA,qBAAuC,kBAAA;EAAA,UAYzG,qCAAA,CAAsC,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,kBAAA,qBAAuC,sBAAA;EAAA,UAmB7G,mBAAA,CACR,IAAA,EAAM,eAAA,qBAAoC,eAAA,qBAAoC,GAAA,CAAI,SAAA,QAAiB,6BAAA,IAAiC,GAAA,CAAI,SAAA,QAAiB,6BAAA,IACxJ,IAAA,CAAK,MAAA,0CAAgD,IAAA,CAAK,MAAA;EAAA,UA2BnD,qBAAA,CAAsB,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,eAAA,qBAAoC,MAAA;EAAA,UAC1F,qBAAA,CAAsB,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,eAAA,qBAAoC,MAAA;EAAA,UAC1F,qBAAA,CAAsB,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,GAAA,CAAI,SAAA,QAAiB,6BAAA,IAAiC,MAAA;EAAA,UAC5G,qBAAA,CAAsB,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,GAAA,CAAI,SAAA,QAAiB,6BAAA,IAAiC,MAAA;EAAA,UAkB5G,mBAAA,CAAoB,IAAA,EAAM,SAAA,oBAA6B,OAAA,EAAS,eAAA,GAAkB,IAAA;EAAA,UA2DlF,6BAAA,CAA8B,IAAA,EAAM,mBAAA,oBAAuC,OAAA,EAAS,eAAA,GAAkB,cAAA;EAAA,UA2BtG,mCAAA,CAAoC,IAAA,EAAM,0BAAA,oBAA8C,OAAA,EAAS,eAAA,GAAkB,oBAAA;EAAA,UAcnH,4BAAA,CAA6B,IAAA,EAAM,iBAAA,oBAAqC,OAAA,EAAS,eAAA,GAAkB,aAAA;EAAA,UA8CnG,mBAAA,CAAoB,IAAA,EAAM,QAAA,qBAA6B,IAAA;EAAA,UASvD,6BAAA,CAA8B,QAAA,EAAU,4BAAA,GAA+B,oBAAA;EAAA,UAwBvE,6BAAA,CAA8B,QAAA,EAAU,4BAAA,GAA+B,oBAAA;EAAA,UAUvE,4BAAA,CAA6B,QAAA;IACrC,YAAA;IACA,sBAAA;MACE,EAAA;MACA,KAAA;MACA,KAAA;MACA,SAAA;MACA,QAAA;IAAA;EAAA,IAEA,eAAA;EAAA,UAOM,WAAA,CAAY,OAAA,EAAS,eAAA,GAAkB,IAAA;EAAA,UAuCvC,4BAAA,CAA6B,IAAA,EAAM,sBAAA,oBAA0C,OAAA,EAAS,eAAA,GAAkB,yBAAA;EAAA,UAmBxG,eAAA,CAAgB,IAAA,EAAM,WAAA,CAAY,eAAA,sBAAqC,SAAA,qBAA8B,QAAA;EAAA,UA2BrG,2BAAA,CAA4B,IAAA,EAAM,WAAA,CAAY,eAAA,qBAAoC,OAAA,EAAS,eAAA,GAAkB,SAAA;EAAA,UA+P7G,wBAAA,CAAyB,OAAA,EAAS,eAAA,GAAkB,iBAAA;EAAA,UAiBpD,eAAA,CAAgB,cAAA,UAAwB,IAAA,mBAAuB,OAAA,EAAS,eAAA,UAAyB,IAAA,CAAK,QAAA;EAoD1G,OAAA,CAAQ,OAAA;IAAW,MAAA;IAAgB,MAAA;EAAA;IAAqB,MAAA;IAAgB,MAAA;EAAA;IAAqB,MAAA;IAAgB,gBAAA;EAAA,IAA6B,OAAA,CAAQ,IAAA;EAclJ,YAAA,CAAa,OAAA,EAAS,8BAAA,GAAiC,OAAA,CAAQ,oBAAA;EAc/D,YAAA,CAAa,OAAA,EAAS,8BAAA,GAAiC,OAAA,CAAQ,oBAAA;EAU/D,kBAAA,CAAmB,OAAA;IAAW,SAAA;IAAmB,cAAA;EAAA;IAA8B,SAAA;IAAmB,cAAA;IAAyB,MAAA;EAAA,IAAmB,OAAA;EAAA,UAqB1I,oBAAA,CAAqB,IAAA,EAAM,WAAA,CAAY,eAAA,qBAAoC,OAAA,EAAS,eAAA,GAAkB,kBAAA,CAAmB,SAAA;EAAA,UAUzH,sBAAA,CAAuB,IAAA,EAAM,YAAA,qBAAiC,aAAA;EAAA,UAY9D,iBAAA,CAAkB,YAAA,UAAsB,OAAA,EAAS,eAAA,GAAkB,+BAAA;EAAA,IAczE,SAAA,IAAa,SAAA;EAAA,IAIb,OAAA;EAAA,QAII,wBAAA;EAAA,QAaA,2BAAA;EAAA,QAgBA,4BAAA;EAAA,QAaA,6BAAA;EAAA,QAaM,kCAAA;EAAA,UA+BE,UAAA,CAAW,GAAA,WAAc,OAAA;EAAA,IAqBrC,IAAA,IAAQ,QAAA,CAAS,qBAAA;EAAA,UAOX,QAAA,IAAY,QAAA,CAAS,qBAAA;EAAA,UAIrB,yCAAA;EAAA,UAyBA,yCAAA,CAA0C,UAAA,EAAY,GAAA,GAAM,wBAAA;EAAA,UAetD,uCAAA,CAAwC,UAAA,EAAY,GAAA,GAAM,OAAA,CAAQ,wBAAA;EAAA,UAexE,gCAAA;EAAA,UAeM,iCAAA,CAAkC,OAAA;IAChD,WAAA;IACA,KAAA;IACA,aAAA;IACA,wBAAA;IACA,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IACvB,OAAA;EAAA,UAmCM,2CAAA,IAA+C,wBAAA;EAAA,UAYzC,cAAA,IAAc,OAAA,CAAA,GAAA;EAAA,UAOd,WAAA,CAAY,OAAA;IAAW,GAAA,EAAK,GAAA;IAAc,OAAA;EAAA,IAAmB,OAAA;EAAA,UA2B7D,kBAAA,CAAmB,GAAA,UAAa,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAAA,UAO3D,kBAAA,CACd,WAAA,QAAmB,WAAA,EACnB,OAAA,GAAU,iBAAA,EACV,eAAA;IACE,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IAC1B,OAAA;EAAA,UAQa,wBAAA,CACd,WAAA,QAAmB,WAAA,EACnB,OAAA,GAAU,iBAAA,EACV,eAAA;IACE,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IAE1B,OAAA;EAAA,UA4DO,8BAAA,CAA+B,WAAA,QAAmB,WAAA,EAAa,OAAA,GAAU,iBAAA;EAI7E,gBAAA,CAAiB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAC5C,gBAAA,CAAiB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAC5C,iBAAA,CAAkB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAO7C,2BAAA,CAA4B,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACvD,uBAAA,CAAwB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACnD,wBAAA,CAAyB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACpD,cAAA,CAAe,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAC1C,uBAAA,CAAwB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACnD,2BAAA,CAA4B,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACvD,qBAAA,CAAsB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACjD,qBAAA,CAAsB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACjD,oBAAA,CAAqB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAChD,sBAAA,CAAuB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAClD,yBAAA,CAA0B,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACrD,eAAA,CAAgB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAC3C,wBAAA,CAAyB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACpD,wBAAA,CAAyB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACpD,aAAA,CAAc,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAEzC,uBAAA,CAAwB,KAAA,UAAe,OAAA;IAAY,WAAA;EAAA,IAAyB,OAAA,CAAQ,MAAA,YAAkB,WAAA;EAItG,kBAAA,CAAmB,KAAA,UAAe,OAAA;IACtC,WAAA;EAAA,IACE,OAAA,CAAQ,MAAA;IAAS,KAAA;EAAA,GAAiB,WAAA,gCAA2C,WAAA;EAU3E,aAAA,CAAc,OAAA;IAAW,QAAA;IAAkB,IAAA;EAAA,IAAiB,OAAA,CAAQ,MAAA,YAAkB,WAAA;EAItF,uBAAA,CAAwB,IAAA,WAAe,OAAA,CAAQ,MAAA,YAAkB,WAAA;EAIjE,wBAAA,CAAyB,IAAA,WAAe,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EAQzG,oBAAA,CAAqB,IAAA,WAAe,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EAcrG,wBAAA,CAAyB,IAAA,WAAe,OAAA,CAAQ,MAAA;IAAS,eAAA;EAAA,GAA2B,WAAA,4BAAuC,WAAA;EAc3H,WAAA,CAAY,IAAA,WAAe,OAAA,CAAQ,MAAA,YAAkB,WAAA;EAOrD,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAmB,OAAA,CAAQ,kBAAA,CAAmB,SAAA;EACxG,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAgB,OAAA,CAAQ,kBAAA,CAAmB,SAAA;EACrG,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAoB,OAAA,CAAQ,kBAAA,CAAmB,SAAA;EACzG,OAAA,CAAQ,OAAA,GAAU,qBAAA,CAAsB,aAAA,IAAiB,OAAA,CAAQ,kBAAA,CAAmB,SAAA;EA2C1F,+BAAA,CAAgC,OAAA,EAAS,eAAA,EAAiB,OAAA,EAAS,4BAAA,CAA6B,aAAA,IAAiB,gBAAA;EAqB3G,yBAAA,CAA0B,GAAA,EAAK,SAAA,GAAY,OAAA,CAAQ,gBAAA;EAiBnD,cAAA,CAAe,OAAA,EAAS,4BAAA,CAA6B,aAAA;IAAmB,IAAA;EAAA,IAAkB,OAAA,CAAQ,gBAAA;EAClG,cAAA,CAAe,OAAA,EAAS,4BAAA,CAA6B,aAAA;IAAmB,IAAA;EAAA,IAAmB,OAAA,CAAQ,gBAAA;EAiBzG,mBAAA,CAAoB,OAAA;IAAW,UAAA,EAAY,cAAA;EAAA,KAAoB,IAAA;IAAQ,iBAAA;EAAA,MAAiC,OAAA;EAYlG,uBAAA,CAAwB,OAAA;IAAW,UAAA,EAAY,cAAA;EAAA,IAAmB,OAAA;EAAA,UAMxD,iBAAA,CAAkB,MAAA,EAAQ,iBAAA,EAAmB,OAAA,EAAS,eAAA,GAAe,OAAA;EAM/E,eAAA,CAAgB,QAAA,EAAU,YAAA,EAAc,OAAA;IAC5C,QAAA;EAAA,IACD,OAAA;EAkMuB;;;EAAA,UA/HR,gBAAA,CAAiB,KAAA,EAAO,WAAA,uCAAkD,OAAA,EAAS,eAAA,GAAkB,OAAA;EAoJxC;;;;EAAA,UAnI7D,sBAAA,OAA6B,QAAA,QAAgB,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,CAAA,KAAM,OAAA,CAAQ,MAAA,CAAO,CAAA;IAAM,WAAA;IAAqB,YAAA;IAAsB,OAAA;EAAA,GAAoB,CAAA;EAcnK,oBAAA,CAAqB,OAAA;IACzB,KAAA;IACA,QAAA;IACA,UAAA;EAAA,IACE,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EA4B/D,oBAAA,CAAqB,OAAA;IACzB,KAAA;IACA,QAAA;IACA,UAAA;IACA,sBAAA;IACA,uBAAA;EAAA,IACE,OAAA,CAAQ,MAAA,YAAkB,WAAA,iCAA4C,WAAA,oDAA+D,WAAA,iCAA4C,WAAA;EA0D/K,kBAAA,IAAkB,OAAA;;;;EAqBlB,mBAAA,CAAoB,IAAA,UAAc,OAAA;IAAY,UAAA;EAAA,IAAyB,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EAmVrE;;;;;;;;;;;;;;;;;;;;EA3RnE,cAAA,CAAe,OAAA;IACnB,MAAA;IACA,eAAA;IACA,WAAA;IACA,cAAA;IACA,UAAA,IAAc,GAAA,UAAa,SAAA;IAC3B,gBAAA;EAAA,IACE,OAAA,CAAQ,MAAA,SAAe,WAAA,mBAA8B,WAAA,0BAAqC,WAAA;EAmFxF,aAAA,CAAc,IAAA,UAAc,IAAA,UAAc,OAAA;IAAY,UAAA;EAAA,IAAyB,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EAiChJ,iBAAA,IAAqB,OAAA,CAAQ,MAAA,YAAkB,WAAA,kCAA6C,WAAA,sBAAiC,WAAA;EA0C7H,iBAAA,CACJ,OAAA;IACE,+BAAA;EAAA,IACD,OAAA;EAAA,UAwDa,QAAA,CAAS,OAAA,EAAS,eAAA,EAAiB,OAAA;IAAY,WAAA,GAAc,GAAA;EAAA,IAAiB,OAAA;EAAA,UAe9E,8BAAA,IAAkC,OAAA;EAmB5C,OAAA,CAAQ,OAAA;IAAY,WAAA,GAAc,GAAA;IAAc,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;EAOhF,cAAA,CAAe,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;EAS3D,eAAA,CAAgB,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;EAS5D,sBAAA,CAAuB,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;EAKnE,cAAA,CAAe,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;IAAU,cAAA;EAAA;EAOrE,WAAA,CAAY,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;IAAU,WAAA;IAA4B,YAAA;EAAA;EAS9F,UAAA,IAAc,OAAA,CAAQ,OAAA;EAAA,UAMZ,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,iBAAA;EAAA,UAStD,cAAA,CAAe,OAAA,EAAS,eAAA,EAAiB,UAAA,EAAY,yBAAA;IAA8B,WAAA;IAAqB,MAAA;EAAA,IAAmB,OAAA,CAAQ,iBAAA;EAAA,UAWnI,YAAA,CAAa,OAAA,EAAS,eAAA,GAAe,OAAA;EAAA,UAKrC,eAAA,CAAgB,OAAA,EAAS,eAAA,GAAe,OAAA;EAAA,UASxC,aAAA,IAAa,OAAA;EAAA,UAIb,eAAA,IAAe,OAAA;EAAA,UAIf,qBAAA,CAAsB,OAAA,EAAS,eAAA,GAAe,OAAA;EAAA,YAIlD,0BAAA;8EAEgE,IAAA,EAChE,kBAAA,CAAmB,aAAA,EAAe,SAAA,MACvC,cAAA,CAAe,aAAA,EAAe,SAAA;EAAA;EAAA,KA6BhC,0BAAA;wBAEiB,kBAAA,CAAmB,aAAA,EAAe,SAAA;sCAwBlB,OAAA,CAAQ,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAMC,OAAA;MAAa,SAAA;IAAA,MAAoB,OAAA,CAAA,MAAA,CAAA,QAAA,EAAA,KAAA;4CAGhC,OAAA;MAAa,SAAA;IAAA,MAAoB,OAAA,CAAA,MAAA,CAAA,QAAA,EAAA,KAAA;mCAG9C,eAAA;gCAIjB,cAAA,EACI,WAAA,EAAW,WAAA,qCACe,OAAA,CAAA,QAAA;;;;;;;;kCAMR,GAAA,EAAG,OAAA;MAAc,OAAA;IAAA,MAAmB,OAAA;iDAGrB,WAAA,EAAW,OAAA,GAAY,iBAAA,KAAiB,OAAA;2CAG9C,WAAA,EAAW,OAAA,GAAY,iBAAA,KAAiB,OAAA;;;;MAelD,WAAA;MAAqB,YAAA;IAAA,MAAsB,OAAA;;2CAMtC,OAAA;EAAA;AAAA"}
+{"version":3,"file":"client-app-impl.d.ts","names":[],"sources":["../../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAmRK,+CAAA,4DAA2G,gCAAA,CAAiC,aAAA,EAAe,SAAA;EAAe,YAAA;AAAA;AAAA,cAElK,gCAAA,8EAA8G,cAAA,CAAe,aAAA,EAAe,SAAA;EAFrG;;;;;;;EAAA,gBAUlC,qBAAA;IAAyB,KAAA,oCAAyC,+BAAA;EAAA;EAAA,mBAE/D,QAAA,EAAU,+CAAA,CAAgD,aAAA,EAAe,SAAA;EAAA,mBACzE,aAAA;IAAiB,gBAAA;IAA2B,WAAA;IAAsB,SAAA,GAAY,uBAAA;EAAA;EAAA,UACvF,iBAAA;EAAA,UACA,UAAA,EAAY,uBAAA;EAAA,mBACH,eAAA,EAAiB,cAAA,CAAe,aAAA;EAAA,mBAChC,eAAA,EAAiB,cAAA;EAAA,mBACjB,WAAA,EAAa,mBAAA;EAAA,mBACb,oBAAA,EAAsB,OAAA,CAAQ,mBAAA;EAAA,iBAEhC,iBAAA;EAAA,QACT,gBAAA;EAAA,QACA,aAAA;EAAA,QAEA,gCAAA;EAAA,iBACS,eAAA;EAAA,iBAEA,iBAAA;EAAA,iBAyBA,oBAAA;EAAA,iBAGA,mBAAA;EAAA,iBAGA,4BAAA;EAAA,iBAMA,mCAAA;EAAA,iBAMA,sBAAA;EAgPQ;EAAA,iBA5OR,4CAAA;EA6OY;EAAA,iBA/NZ,gCAAA;EAAA,iBAYA,kCAAA;EAAA,iBAMA,qDAAA;EAAA,iBAaA,iDAAA;EAAA,iBA2BA,wBAAA;EAAA,iBAKA,qBAAA;EAAA,iBAKA,4BAAA;EAAA,iBAKA,gCAAA;EAAA,iBAGA,2BAAA;EAAA,iBAMA,iBAAA;EAAA,iBAOA,iBAAA;EAAA,iBAOA,4BAAA;EAAA,iBAOA,+BAAA;EAAA,iBAMA,cAAA;EAAA,iBAMA,cAAA;EAAA,iBAMA,gBAAA;EAAA,iBAMA,kBAAA;EAAA,iBAWA,kBAAA;EAAA,iBAWA,oBAAA;EAAA,iBAWA,kBAAA;EAAA,iBAWA,kBAAA;EAAA,iBAWA,qBAAA;EAAA,iBAeA,uBAAA;EAAA,iBAIA,yBAAA;EAAA,QAIT,0BAAA;EAAA,QACA,mCAAA;EAAA,QACA,4CAAA;EAAA,QACA,sCAAA;EAAA,QACA,8BAAA;EAAA,UAEQ,mBAAA,CAAoB,sBAAA,GAAyB,cAAA,GAAiB,OAAA,CAAQ,YAAA;EAqlBzD;EAAA,UA3kBb,8BAAA,CAA+B,OAAA;IAC7C,OAAA,QAAe,OAAA,CAAQ,eAAA;IACvB,mBAAA,QAA2B,OAAA;MAAU,WAAA;IAAA;IACrC,UAAA,EAAY,YAAA;IACZ,KAAA;EAAA;IACK,QAAA;IAAgB,OAAA,EAAS,eAAA;EAAA;IAA6B,QAAA;EAAA,KAAsB,OAAA,CAAQ,yBAAA;EAAA,UAuDjF,kCAAA,CACR,IAAA;IAAQ,QAAA;IAAkB,mBAAA;EAAA,GAC1B,OAAA,EAAS,eAAA,GACR,eAAA;cAoBS,OAAA,EAAS,gCAAA,CAAiC,aAAA,EAAe,SAAA,GAAY,YAAA;IAAiB,gBAAA;IAA2B,WAAA;IAAsB,SAAA,GAAY,uBAAA;EAAA;EAAA,QAsDvJ,+BAAA;EAAA,UAkFE,qBAAA;EAAA,UAUA,2BAAA,CAA4B,QAAA,QAAgB,OAAA;EAAA,UAwBtC,4BAAA,CACd,sBAAA,GAAyB,cAAA,EACzB,OAAA;IAAY,2BAAA;EAAA,IAAuC,OAAA;EAAA,UAiB3C,yBAAA;EAAA,UAKA,iCAAA;EAAA,UAcA,sCAAA;EAAA,UAcA,yCAAA;EAAA,UAaA,kDAAA;EAAA,UAUA,4BAAA;EAAA,UAeM,6BAAA,CAA8B,KAAA,EAAO,UAAA,GAAa,OAAA;EAAA,UA8BlD,uCAAA,IAA2C,OAAA;EAAA,UAY3C,qCAAA,CAAsC,OAAA;IACpD,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IACvB,OAAA;EAAA,UAaY,4CAAA,CAA6C,OAAA;IAC3D,GAAA;IACA,UAAA,EAAY,GAAA;IACZ,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IACvB,OAAA;EAAA,UAsBY,iCAAA,CAAkC,qBAAA,GAAwB,GAAA,GAAM,OAAA;EA2xB7E;;;;;EAAA,UA/oBO,oBAAA;EAAA,UAQM,oBAAA,CAAqB,IAAA,UAAc,OAAA,QAAY,OAAA;EAAA,UAIrD,uBAAA,CAAwB,IAAA,UAAc,OAAA;EAAA,UAKtC,iBAAA,EAAiB,KAAA,CAAA,WAAA;EAAA,UACjB,6BAAA,EAA6B,OAAA,SAAA,KAAA,CAAA,WAAA;EAAA,UAC7B,mBAAA,EAAmB,OAAA,CAAA,WAAA,EAAA,KAAA,CAAA,WAAA;EAAA,UACnB,8BAAA,EAAgC,KAAA,CAAM,WAAA;EAAA,QACxC,mCAAA;EAAA,cACM,6BAAA;EAAA,cAGA,uBAAA;EAAA,QAGN,0CAAA;EAAA,QAGA,2BAAA;EAAA,QAIA,qCAAA;EAAA,QAYA,yBAAA;EAAA,QAMA,wBAAA;EAAA,QAGA,6BAAA;EAAA,QAsBA,iCAAA;EAAA,UAkDE,qBAAA,CAAsB,OAAA,EAAS,MAAA,CAAO,OAAA,GAAU,WAAA;EAAA,QA2BlD,uCAAA;EAAA,cAOM,sBAAA;EAAA,cAOA,4BAAA;EAAA,QAGN,qBAAA;EAAA,QAMA,kCAAA;EAAA,QAWA,+BAAA;EAAA,QAeA,2BAAA;EAAA,QAmBA,iCAAA;EAAA,QAmBA,+BAAA;EAAA,QAyCM,yBAAA;EAAA,QAWA,uBAAA;EAAA,UAIJ,2BAAA,IAA+B,KAAA,CAAM,WAAA;EAAA,UAwDrC,sBAAA,CAAuB,YAAA,EAAc,YAAA,EAAc,sBAAA,GAAyB,cAAA,GAAiB,KAAA,CAAM,WAAA;EA0iB9E;;;;;;;;EAAA,QAlbvB,kCAAA;EAugBgD;;;;EAAA,UAlgB9C,yBAAA,CAA0B,UAAA,EAAY,KAAA,CAAM,WAAA,GAAc,gBAAA,GAAmB,WAAA,GAAc,eAAA;EAAA,UA8BrF,WAAA,CACd,sBAAA,GAAyB,cAAA,EACzB,OAAA;IAAY,2BAAA;EAAA,IACX,OAAA,CAAQ,eAAA;EAAA,QAQH,qBAAA;EAAA,UACQ,0BAAA,CAA2B,MAAA;IAAU,WAAA;IAA4B,YAAA;EAAA,IAAsB,OAAA;EAAA,UA4B7F,gCAAA,CAAiC,MAAA;IAAU,WAAA;IAA4B,YAAA;EAAA,IAAyB,cAAA;EAAA,UAUhG,wBAAA,CAAyB,sBAAA,GAAyB,cAAA,WAAyB,cAAA,OAAqB,SAAA;EAAA,UAIhG,2BAAA,CAA4B,sBAAA,GAAyB,cAAA,mBAAiC,cAAA,OAAqB,SAAA;EAAA,UAM3G,kBAAA;IAAgC,SAAA;EAAA;EAAA,UAIhC,sBAAA;IAA4C,SAAA;EAAA;EAAA,UAM5C,sBAAA,CAAuB,IAAA,EAAM,kBAAA,qBAAuC,OAAA;EAAA,UA2BpE,yBAAA,CAA0B,IAAA,EAAM,mBAAA,qBAAwC,sBAAA,qBAA2C,cAAA;EAAA,UAMnH,uBAAA,CAAwB,IAAA,EAAM,sBAAA,qBAA2C,QAAA;EAAA,UAUzE,iCAAA,CAAkC,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,kBAAA,qBAAuC,kBAAA;EAAA,UAYzG,qCAAA,CAAsC,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,kBAAA,qBAAuC,sBAAA;EAAA,UAmB7G,mBAAA,CACR,IAAA,EAAM,eAAA,qBAAoC,eAAA,qBAAoC,GAAA,CAAI,SAAA,QAAiB,6BAAA,IAAiC,GAAA,CAAI,SAAA,QAAiB,6BAAA,IACxJ,IAAA,CAAK,MAAA,0CAAgD,IAAA,CAAK,MAAA;EAAA,UA2BnD,qBAAA,CAAsB,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,eAAA,qBAAoC,MAAA;EAAA,UAC1F,qBAAA,CAAsB,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,eAAA,qBAAoC,MAAA;EAAA,UAC1F,qBAAA,CAAsB,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,GAAA,CAAI,SAAA,QAAiB,6BAAA,IAAiC,MAAA;EAAA,UAC5G,qBAAA,CAAsB,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,GAAA,CAAI,SAAA,QAAiB,6BAAA,IAAiC,MAAA;EAAA,UAkB5G,mBAAA,CAAoB,IAAA,EAAM,SAAA,oBAA6B,OAAA,EAAS,eAAA,GAAkB,IAAA;EAAA,UA2DlF,6BAAA,CAA8B,IAAA,EAAM,mBAAA,oBAAuC,OAAA,EAAS,eAAA,GAAkB,cAAA;EAAA,UA2BtG,mCAAA,CAAoC,IAAA,EAAM,0BAAA,oBAA8C,OAAA,EAAS,eAAA,GAAkB,oBAAA;EAAA,UAcnH,4BAAA,CAA6B,IAAA,EAAM,iBAAA,oBAAqC,OAAA,EAAS,eAAA,GAAkB,aAAA;EAAA,UA8CnG,mBAAA,CAAoB,IAAA,EAAM,QAAA,qBAA6B,IAAA;EAAA,UASvD,6BAAA,CAA8B,QAAA,EAAU,4BAAA,GAA+B,oBAAA;EAAA,UAwBvE,6BAAA,CAA8B,QAAA,EAAU,4BAAA,GAA+B,oBAAA;EAAA,UAUvE,4BAAA,CAA6B,QAAA;IACrC,YAAA;IACA,sBAAA;MACE,EAAA;MACA,KAAA;MACA,KAAA;MACA,SAAA;MACA,QAAA;IAAA;EAAA,IAEA,eAAA;EAAA,UAOM,WAAA,CAAY,OAAA,EAAS,eAAA,GAAkB,IAAA;EAAA,UAuCvC,4BAAA,CAA6B,IAAA,EAAM,sBAAA,oBAA0C,OAAA,EAAS,eAAA,GAAkB,yBAAA;EAAA,UAmBxG,eAAA,CAAgB,IAAA,EAAM,WAAA,CAAY,eAAA,sBAAqC,SAAA,qBAA8B,QAAA;EAAA,UA2BrG,2BAAA,CAA4B,IAAA,EAAM,WAAA,CAAY,eAAA,qBAAoC,OAAA,EAAS,eAAA,GAAkB,SAAA;EAAA,UA+P7G,wBAAA,CAAyB,OAAA,EAAS,eAAA,GAAkB,iBAAA;EAAA,UAiBpD,eAAA,CAAgB,cAAA,UAAwB,IAAA,mBAAuB,OAAA,EAAS,eAAA,UAAyB,IAAA,CAAK,QAAA;EAoD1G,OAAA,CAAQ,OAAA;IAAW,MAAA;IAAgB,MAAA;EAAA;IAAqB,MAAA;IAAgB,MAAA;EAAA;IAAqB,MAAA;IAAgB,gBAAA;EAAA,IAA6B,OAAA,CAAQ,IAAA;EAclJ,YAAA,CAAa,OAAA,EAAS,8BAAA,GAAiC,OAAA,CAAQ,oBAAA;EAc/D,YAAA,CAAa,OAAA,EAAS,8BAAA,GAAiC,OAAA,CAAQ,oBAAA;EAU/D,kBAAA,CAAmB,OAAA;IAAW,SAAA;IAAmB,cAAA;EAAA;IAA8B,SAAA;IAAmB,cAAA;IAAyB,MAAA;EAAA,IAAmB,OAAA;EAAA,UAqB1I,oBAAA,CAAqB,IAAA,EAAM,WAAA,CAAY,eAAA,qBAAoC,OAAA,EAAS,eAAA,GAAkB,kBAAA,CAAmB,SAAA;EAAA,UAUzH,sBAAA,CAAuB,IAAA,EAAM,YAAA,qBAAiC,aAAA;EAAA,UAY9D,iBAAA,CAAkB,YAAA,UAAsB,OAAA,EAAS,eAAA,GAAkB,+BAAA;EAAA,IAczE,SAAA,IAAa,SAAA;EAAA,IAIb,OAAA;EAAA,QAII,wBAAA;EAAA,QAaA,2BAAA;EAAA,QAgBA,4BAAA;EAAA,QAaA,6BAAA;EAAA,QAaM,kCAAA;EAAA,UA+BE,UAAA,CAAW,GAAA,WAAc,OAAA;EAAA,IAqBrC,IAAA,IAAQ,QAAA,CAAS,qBAAA;EAAA,UAOX,QAAA,IAAY,QAAA,CAAS,qBAAA;EAAA,UAIrB,yCAAA;EAAA,UAyBA,yCAAA,CAA0C,UAAA,EAAY,GAAA,GAAM,wBAAA;EAAA,UAetD,uCAAA,CAAwC,UAAA,EAAY,GAAA,GAAM,OAAA,CAAQ,wBAAA;EAAA,UAexE,gCAAA;EAAA,UAeM,iCAAA,CAAkC,OAAA;IAChD,WAAA;IACA,KAAA;IACA,aAAA;IACA,wBAAA;IACA,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IACvB,OAAA;EAAA,UAmCM,2CAAA,IAA+C,wBAAA;EAAA,UAYzC,cAAA,IAAc,OAAA,CAAA,GAAA;EAAA,UAOd,WAAA,CAAY,OAAA;IAAW,GAAA,EAAK,GAAA;IAAc,OAAA;EAAA,IAAmB,OAAA;EAAA,UA2B7D,kBAAA,CAAmB,GAAA,UAAa,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAAA,UAW3D,kBAAA,CACd,WAAA,QAAmB,WAAA,EACnB,OAAA,GAAU,iBAAA,EACV,eAAA;IACE,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IAC1B,OAAA;EAAA,UAQa,wBAAA,CACd,WAAA,QAAmB,WAAA,EACnB,OAAA,GAAU,iBAAA,EACV,eAAA;IACE,2BAAA;IACA,sBAAA,GAAyB,cAAA;EAAA,IAE1B,OAAA;EAAA,UAgEO,8BAAA,CAA+B,WAAA,QAAmB,WAAA,EAAa,OAAA,GAAU,iBAAA;EAI7E,gBAAA,CAAiB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAC5C,gBAAA,CAAiB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAC5C,iBAAA,CAAkB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAO7C,2BAAA,CAA4B,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACvD,uBAAA,CAAwB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACnD,wBAAA,CAAyB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACpD,cAAA,CAAe,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAC1C,uBAAA,CAAwB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACnD,2BAAA,CAA4B,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACvD,qBAAA,CAAsB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACjD,qBAAA,CAAsB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACjD,oBAAA,CAAqB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAChD,sBAAA,CAAuB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAClD,yBAAA,CAA0B,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACrD,eAAA,CAAgB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAC3C,wBAAA,CAAyB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACpD,wBAAA,CAAyB,OAAA,GAAU,iBAAA,GAAiB,OAAA;EACpD,aAAA,CAAc,OAAA,GAAU,iBAAA,GAAiB,OAAA;EAEzC,uBAAA,CAAwB,KAAA,UAAe,OAAA;IAAY,WAAA;EAAA,IAAyB,OAAA,CAAQ,MAAA,YAAkB,WAAA;EAItG,kBAAA,CAAmB,KAAA,UAAe,OAAA;IACtC,WAAA;EAAA,IACE,OAAA,CAAQ,MAAA;IAAS,KAAA;EAAA,GAAiB,WAAA,gCAA2C,WAAA;EAU3E,aAAA,CAAc,OAAA;IAAW,QAAA;IAAkB,IAAA;EAAA,IAAiB,OAAA,CAAQ,MAAA,YAAkB,WAAA;EAItF,uBAAA,CAAwB,IAAA,WAAe,OAAA,CAAQ,MAAA,YAAkB,WAAA;EAIjE,wBAAA,CAAyB,IAAA,WAAe,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EAQzG,oBAAA,CAAqB,IAAA,WAAe,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EAcrG,wBAAA,CAAyB,IAAA,WAAe,OAAA,CAAQ,MAAA;IAAS,eAAA;EAAA,GAA2B,WAAA,4BAAuC,WAAA;EAc3H,WAAA,CAAY,IAAA,WAAe,OAAA,CAAQ,MAAA,YAAkB,WAAA;EAOrD,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAmB,OAAA,CAAQ,kBAAA,CAAmB,SAAA;EACxG,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAgB,OAAA,CAAQ,kBAAA,CAAmB,SAAA;EACrG,OAAA,CAAQ,OAAA,EAAS,qBAAA,CAAsB,aAAA;IAAmB,EAAA;EAAA,IAAoB,OAAA,CAAQ,kBAAA,CAAmB,SAAA;EACzG,OAAA,CAAQ,OAAA,GAAU,qBAAA,CAAsB,aAAA,IAAiB,OAAA,CAAQ,kBAAA,CAAmB,SAAA;EA2C1F,+BAAA,CAAgC,OAAA,EAAS,eAAA,EAAiB,OAAA,EAAS,4BAAA,CAA6B,aAAA,IAAiB,gBAAA;EAqB3G,yBAAA,CAA0B,GAAA,EAAK,SAAA,GAAY,OAAA,CAAQ,gBAAA;EAiBnD,cAAA,CAAe,OAAA,EAAS,4BAAA,CAA6B,aAAA;IAAmB,IAAA;EAAA,IAAkB,OAAA,CAAQ,gBAAA;EAClG,cAAA,CAAe,OAAA,EAAS,4BAAA,CAA6B,aAAA;IAAmB,IAAA;EAAA,IAAmB,OAAA,CAAQ,gBAAA;EAiBzG,mBAAA,CAAoB,OAAA;IAAW,UAAA,EAAY,cAAA;EAAA,KAAoB,IAAA;IAAQ,iBAAA;EAAA,MAAiC,OAAA;EAYlG,uBAAA,CAAwB,OAAA;IAAW,UAAA,EAAY,cAAA;EAAA,IAAmB,OAAA;EAAA,UAMxD,iBAAA,CAAkB,MAAA,EAAQ,iBAAA,EAAmB,OAAA,EAAS,eAAA,GAAe,OAAA;EAM/E,eAAA,CAAgB,QAAA,EAAU,YAAA,EAAc,OAAA;IAC5C,QAAA;EAAA,IACD,OAAA;EAkMuB;;;EAAA,UA/HR,gBAAA,CAAiB,KAAA,EAAO,WAAA,uCAAkD,OAAA,EAAS,eAAA,GAAkB,OAAA;EAoJxC;;;;EAAA,UAnI7D,sBAAA,OAA6B,QAAA,QAAgB,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,CAAA,KAAM,OAAA,CAAQ,MAAA,CAAO,CAAA;IAAM,WAAA;IAAqB,YAAA;IAAsB,OAAA;EAAA,GAAoB,CAAA;EAcnK,oBAAA,CAAqB,OAAA;IACzB,KAAA;IACA,QAAA;IACA,UAAA;EAAA,IACE,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EA4B/D,oBAAA,CAAqB,OAAA;IACzB,KAAA;IACA,QAAA;IACA,UAAA;IACA,sBAAA;IACA,uBAAA;EAAA,IACE,OAAA,CAAQ,MAAA,YAAkB,WAAA,iCAA4C,WAAA,oDAA+D,WAAA,iCAA4C,WAAA;EA0D/K,kBAAA,IAAkB,OAAA;;;;EAqBlB,mBAAA,CAAoB,IAAA,UAAc,OAAA;IAAY,UAAA;EAAA,IAAyB,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EAmVrE;;;;;;;;;;;;;;;;;;;;EA3RnE,cAAA,CAAe,OAAA;IACnB,MAAA;IACA,eAAA;IACA,WAAA;IACA,cAAA;IACA,UAAA,IAAc,GAAA,UAAa,SAAA;IAC3B,gBAAA;EAAA,IACE,OAAA,CAAQ,MAAA,SAAe,WAAA,mBAA8B,WAAA,0BAAqC,WAAA;EAmFxF,aAAA,CAAc,IAAA,UAAc,IAAA,UAAc,OAAA;IAAY,UAAA;EAAA,IAAyB,OAAA,CAAQ,MAAA,YAAkB,WAAA,4BAAuC,WAAA;EAiChJ,iBAAA,IAAqB,OAAA,CAAQ,MAAA,YAAkB,WAAA,kCAA6C,WAAA,sBAAiC,WAAA;EA0C7H,iBAAA,CACJ,OAAA;IACE,+BAAA;EAAA,IACD,OAAA;EAAA,UAwDa,QAAA,CAAS,OAAA,EAAS,eAAA,EAAiB,OAAA;IAAY,WAAA,GAAc,GAAA;EAAA,IAAiB,OAAA;EAAA,UAe9E,8BAAA,IAAkC,OAAA;EAmB5C,OAAA,CAAQ,OAAA;IAAY,WAAA,GAAc,GAAA;IAAc,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;EAOhF,cAAA,CAAe,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;EAS3D,eAAA,CAAgB,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;EAS5D,sBAAA,CAAuB,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;EAKnE,cAAA,CAAe,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;IAAU,cAAA;EAAA;EAOrE,WAAA,CAAY,OAAA;IAAY,UAAA,GAAa,cAAA;EAAA,IAAmB,OAAA;IAAU,WAAA;IAA4B,YAAA;EAAA;EAS9F,UAAA,IAAc,OAAA,CAAQ,OAAA;EAAA,UAMZ,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,iBAAA;EAAA,UAStD,cAAA,CAAe,OAAA,EAAS,eAAA,EAAiB,UAAA,EAAY,yBAAA;IAA8B,WAAA;IAAqB,MAAA;EAAA,IAAmB,OAAA,CAAQ,iBAAA;EAAA,UAWnI,YAAA,CAAa,OAAA,EAAS,eAAA,GAAe,OAAA;EAAA,UAKrC,eAAA,CAAgB,OAAA,EAAS,eAAA,GAAe,OAAA;EAAA,UASxC,aAAA,IAAa,OAAA;EAAA,UAIb,eAAA,IAAe,OAAA;EAAA,UAIf,qBAAA,CAAsB,OAAA,EAAS,eAAA,GAAe,OAAA;EAAA,YAIlD,0BAAA;8EAEgE,IAAA,EAChE,kBAAA,CAAmB,aAAA,EAAe,SAAA,MACvC,cAAA,CAAe,aAAA,EAAe,SAAA;EAAA;EAAA,KA6BhC,0BAAA;wBAEiB,kBAAA,CAAmB,aAAA,EAAe,SAAA;sCAwBlB,OAAA,CAAQ,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAMC,OAAA;MAAa,SAAA;IAAA,MAAoB,OAAA,CAAA,MAAA,CAAA,QAAA,EAAA,KAAA;4CAGhC,OAAA;MAAa,SAAA;IAAA,MAAoB,OAAA,CAAA,MAAA,CAAA,QAAA,EAAA,KAAA;mCAG9C,eAAA;gCAIjB,cAAA,EACI,WAAA,EAAW,WAAA,qCACe,OAAA,CAAA,QAAA;;;;;;;;kCAMR,GAAA,EAAG,OAAA;MAAc,OAAA;IAAA,MAAmB,OAAA;iDAGrB,WAAA,EAAW,OAAA,GAAY,iBAAA,KAAiB,OAAA;2CAG9C,WAAA,EAAW,OAAA,GAAY,iBAAA,KAAiB,OAAA;;;;MAelD,WAAA;MAAqB,YAAA;IAAA,MAAsB,OAAA;;2CAMtC,OAAA;EAAA;AAAA"}

package/dist/esm/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -1,6 +1,6 @@
 import { neverResolve, runAsynchronously, wait } from "@hexclave/shared/dist/utils/promises";
 import { deindent, mergeScopeStrings } from "@hexclave/shared/dist/utils/strings";
-import { HexclaveAssertionError, captureError, throwErr } from "@hexclave/shared/dist/utils/errors";
+import { HexclaveAssertionError, HexclaveSetupError, captureError, throwErr } from "@hexclave/shared/dist/utils/errors";
 import { createUrlIfValid, getRelativePart, isRelative } from "@hexclave/shared/dist/utils/urls";
 import { HexclaveClientInterface, KnownError, KnownErrors } from "@hexclave/shared";
 import { Result } from "@hexclave/shared/dist/utils/results";
@@ -37,6 +37,7 @@ import { SessionRecorder, analyticsOptionsFromJson, analyticsOptionsToJson, getS
 import { mountClickmapOverlay } from "../../../../clickmap/index.js";
 import { mountDevTool } from "../../../../dev-tool/index.js";
 import { mountPushedConfigErrorOverlay } from "../../../../pushed-config-error-overlay/index.js";
+import { showSetupErrorOverlay } from "../../../../setup-error-overlay/index.js";
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.ts
 const prefetchedCrossDomainHandoffTtlMs = 3300 * 1e3;
 const oauthAfterCallbackRedirectUrlQueryParam = "after_callback_redirect_url";
@@ -49,6 +50,50 @@ const nestedCrossDomainAuthQueryParams = {
 	codeChallengeMethod: "code_challenge_method",
 	afterCallbackRedirectUrl: oauthAfterCallbackRedirectUrlQueryParam
 };
+/**
+* An auth flow can only ever send the user to a URL that the project trusts, so an untrusted one means the flow is dead
+* until someone changes the project's configuration. Describe the problem in terms of that configuration rather than in
+* terms of the flow's internals, which nobody outside this file knows about.
+*/
+function createUntrustedUrlError(options) {
+	const origin = createUrlIfValid(options.url)?.origin ?? options.url;
+	return new HexclaveSetupError({
+		title: "A domain in your authentication flow is not one of your project's trusted domains",
+		message: options.message,
+		howToFix: [
+			`If ${origin} is yours, add it to your project's trusted domains in the Hexclave dashboard, under Domains.`,
+			"Protocol, domain and port must all match a trusted domain exactly; a wildcard like https://*.example.com matches only one subdomain level.",
+			`If ${origin} is not yours, do not add it \u2014 somebody may be trying to redirect your users' credentials to it.`
+		],
+		extraData: {
+			url: options.url,
+			projectId: options.projectId
+		}
+	});
+}
+function createUntrustedNestedCrossDomainUrlError(options) {
+	return createUntrustedUrlError({
+		message: `Nested cross-domain auth ${options.urlDescription} ${options.url} is not trusted.`,
+		url: options.url,
+		projectId: options.projectId
+	});
+}
+/**
+* A URL that the auth flow cannot even parse is just as fatal as an untrusted one, and just as much a configuration
+* problem: something in the developer's setup put a relative or malformed value where an absolute URL belongs.
+*/
+function createMalformedNestedCrossDomainUrlError(options) {
+	return new HexclaveSetupError({
+		title: "A URL in your authentication flow is not a valid absolute URL",
+		message: `Nested cross-domain auth ${options.urlDescription} ${options.url} is not a valid absolute URL.`,
+		howToFix: [
+			"Handler URLs and after-auth redirect URLs must be absolute, including their protocol, like https://example.com/handler/oauth-callback.",
+			"Check the handler URLs configured for your project and the redirect URLs you pass to Hexclave's sign-in and sign-up methods.",
+			"If none of those look wrong, check whether a proxy or rewrite in front of your app is rewriting the authentication flow's query parameters."
+		],
+		extraData: { url: options.url }
+	});
+}
 function getRedirectHelperInstruction(handlerName) {
 	if (handlerName === "handler") return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
 	return `Use app.${`redirectTo${handlerName.slice(0, 1).toUpperCase()}${handlerName.slice(1)}`}() instead.`;
@@ -454,6 +499,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				await callback();
 			} catch (error) {
 				captureError("pending-auth-resolution-failed", error);
+				showSetupErrorOverlay(error);
 			}
 		})();
 		this._pendingAuthResolutionPromises.push(promise);
@@ -570,13 +616,35 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				codeChallenge
 			});
 			if ((currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.codeChallengeMethod) ?? "S256") !== "S256") throw new HexclaveAssertionError("Nested cross-domain auth only supports S256 PKCE");
-			if (isRelative(redirectUri)) throw new Error("Nested cross-domain auth redirect URI must be absolute.");
-			const redirectUriUrl = new URL(redirectUri);
-			if (!await this._isTrusted(redirectUriUrl.toString())) throw new Error(`Nested cross-domain auth redirect URI ${redirectUri} is not trusted.`);
+			const validateHandoffOwnership = async () => {
+				if (await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
+			};
+			const setupErrorIfHandoffIsOwned = async (setupError) => {
+				await validateHandoffOwnership();
+				return setupError;
+			};
+			const redirectUriUrl = isRelative(redirectUri) ? null : createUrlIfValid(redirectUri);
+			if (redirectUriUrl == null) throw await setupErrorIfHandoffIsOwned(createMalformedNestedCrossDomainUrlError({
+				urlDescription: "redirect URI",
+				url: redirectUri
+			}));
+			if (!await this._isTrusted(redirectUriUrl.toString())) throw await setupErrorIfHandoffIsOwned(createUntrustedNestedCrossDomainUrlError({
+				urlDescription: "redirect URI",
+				url: redirectUri,
+				projectId: this.projectId
+			}));
 			const afterCallbackRedirectUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.afterCallbackRedirectUrl);
-			const afterCallbackRedirectUrl = afterCallbackRedirectUrlString == null ? redirectUriUrl : new URL(afterCallbackRedirectUrlString, redirectUriUrl);
-			if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) throw new Error(`Nested cross-domain auth after-callback redirect URL ${afterCallbackRedirectUrlString} is not trusted.`);
-			if (await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
+			const afterCallbackRedirectUrl = afterCallbackRedirectUrlString == null ? redirectUriUrl : createUrlIfValid(afterCallbackRedirectUrlString, redirectUriUrl);
+			if (afterCallbackRedirectUrl == null) throw await setupErrorIfHandoffIsOwned(createMalformedNestedCrossDomainUrlError({
+				urlDescription: "after-callback redirect URL",
+				url: afterCallbackRedirectUrlString ?? ""
+			}));
+			if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) throw await setupErrorIfHandoffIsOwned(createUntrustedNestedCrossDomainUrlError({
+				urlDescription: "after-callback redirect URL",
+				url: afterCallbackRedirectUrlString ?? afterCallbackRedirectUrl.toString(),
+				projectId: this.projectId
+			}));
+			await validateHandoffOwnership();
 			await this._redirectTo({
 				url: await this._createCrossDomainAuthRedirectUrl({
 					redirectUri: redirectUriUrl.toString(),
@@ -594,9 +662,16 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		if (currentRefreshTokenId != null) (await this._getSession(void 0, { awaitPendingAuthResolutions: false })).markInvalid();
 		const callbackUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.callbackUrl);
 		if (callbackUrlString == null) throw new HexclaveAssertionError("Nested cross-domain auth URL is missing callback URL");
-		if (isRelative(callbackUrlString)) throw new Error("Nested cross-domain auth callback URL must be absolute.");
-		const callbackUrl = new URL(callbackUrlString);
-		if (!await this._isTrusted(callbackUrl.toString())) throw new Error(`Nested cross-domain auth callback URL ${callbackUrlString} is not trusted.`);
+		const callbackUrl = isRelative(callbackUrlString) ? null : createUrlIfValid(callbackUrlString);
+		if (callbackUrl == null) throw createMalformedNestedCrossDomainUrlError({
+			urlDescription: "callback URL",
+			url: callbackUrlString
+		});
+		if (!await this._isTrusted(callbackUrl.toString())) throw createUntrustedNestedCrossDomainUrlError({
+			urlDescription: "callback URL",
+			url: callbackUrlString,
+			projectId: this.projectId
+		});
 		const afterCallbackRedirectUrl = new URL(currentUrl);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.refreshTokenId);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.callbackUrl);
@@ -1940,7 +2015,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		await wait(2e3);
 	}
 	async _redirectIfTrusted(url, options) {
-		if (!await this._isTrusted(url)) throw new Error(`Redirect URL ${url} is not trusted; should be relative.`);
+		if (!await this._isTrusted(url)) throw createUntrustedUrlError({
+			message: `Redirect URL ${url} is not trusted; should be relative.`,
+			url,
+			projectId: this.projectId
+		});
 		return await this._redirectTo({
 			url,
 			...options
@@ -1985,7 +2064,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			awaitPendingAuthResolutions: internalOptions?.awaitPendingAuthResolutions,
 			overrideTokenStoreInit: internalOptions?.overrideTokenStoreInit
 		}) : plan.url;
-		if (!await this._isTrusted(redirectUrl)) throw new Error(`Redirect URL ${redirectUrl} is not trusted; should be relative.`);
+		if (!await this._isTrusted(redirectUrl)) throw createUntrustedUrlError({
+			message: `Redirect URL ${redirectUrl} is not trusted; should be relative.`,
+			url: redirectUrl,
+			projectId: this.projectId
+		});
 		return redirectUrl;
 	}
 	_redirectToHandlerDuringRender(handlerName, options) {