@hexclave/js 1.0.75 → 1.0.77

package/dist/in-page-ui/issue-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-card.js","names":["HEXCLAVE_LOGO_SVG"],"sources":["../../src/in-page-ui/issue-card.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// Shared renderer for Hexclave's in-page issue cards: the modal-style card (plus its minimized pill) that the SDK uses\n// to tell developers about problems it cannot recover from, like a broken pushed config or an untrusted auth domain.\n// Every issue surface renders the same shape, so the markup, styles and clipboard handling live here and each feature\n// only supplies its copy and callbacks.\n\nimport { runAsynchronously } from \"@hexclave/shared/dist/utils/promises\";\nimport { getInPageUiBaseCSS } from \"./base-styles\";\nimport { h, setHtml } from \"./dom\";\nimport { HEXCLAVE_LOGO_SVG } from \"./logo\";\n\nexport type IssueCardKind = \"error\" | \"warning\";\n\nconst COPY_ICON_SVG = '<svg width=\"12\" height=\"12\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.25\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"9\" y=\"9\" width=\"13\" height=\"13\" rx=\"2\"/><path d=\"M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1\"/></svg>';\n\nexport function getIssueCardCSS(scopeSelector: string): string {\n  return getInPageUiBaseCSS(scopeSelector) + `\n  ${scopeSelector} .hic-backdrop {\n    position: fixed;\n    inset: 0;\n    z-index: 2147483647;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    padding: 24px;\n    background: rgba(0, 0, 0, 0.46);\n    backdrop-filter: blur(6px);\n    overflow: auto;\n  }\n\n  ${scopeSelector} .hic-card {\n    --hic-status: var(--sdt-error);\n    width: min(720px, calc(100vw - 32px));\n    max-height: min(640px, calc(100dvh - 48px));\n    border: 1px solid color-mix(in srgb, var(--hic-status) 35%, var(--sdt-border));\n    border-radius: 18px;\n    background: var(--sdt-overlay-bg);\n    box-shadow: var(--sdt-shadow);\n    backdrop-filter: blur(18px);\n    display: flex;\n    overflow: hidden;\n  }\n\n  ${scopeSelector} .hic-card-warning {\n    --hic-status: var(--sdt-warning);\n  }\n\n  ${scopeSelector} .hic-card-inner {\n    padding: 18px;\n    width: 100%;\n    overflow: auto;\n  }\n\n  ${scopeSelector} .hic-header {\n    display: flex;\n    align-items: flex-start;\n    justify-content: space-between;\n    gap: 12px;\n    margin-bottom: 12px;\n  }\n\n  ${scopeSelector} .hic-title-row {\n    display: flex;\n    align-items: flex-start;\n    gap: 10px;\n    min-width: 0;\n  }\n\n  ${scopeSelector} .hic-logo {\n    flex-shrink: 0;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    width: 34px;\n    height: 34px;\n    border-radius: 10px;\n    background: var(--hic-status);\n    color: white;\n    box-shadow: 0 10px 30px color-mix(in srgb, var(--hic-status) 32%, transparent);\n  }\n\n  ${scopeSelector} .hic-badge {\n    display: inline-flex;\n    flex-shrink: 0;\n    padding: 2px 6px;\n    border-radius: 999px;\n    background: var(--hic-status);\n    color: white;\n    font-size: 10px;\n    font-weight: 700;\n    letter-spacing: 0.06em;\n    text-transform: uppercase;\n  }\n\n  ${scopeSelector} .hic-title {\n    color: var(--sdt-text);\n    margin-top: 4px;\n    font-size: 18px;\n    font-weight: 700;\n    line-height: 1.25;\n  }\n\n  ${scopeSelector} .hic-actions {\n    display: flex;\n    gap: 4px;\n  }\n\n  ${scopeSelector} .hic-icon-btn {\n    display: inline-flex;\n    align-items: center;\n    justify-content: center;\n    width: 28px;\n    height: 28px;\n    border: 1px solid var(--sdt-border);\n    border-radius: 8px;\n    background: var(--sdt-bg-elevated);\n    color: var(--sdt-text-secondary);\n    cursor: pointer;\n    font: inherit;\n    line-height: 1;\n    vertical-align: top;\n  }\n\n  ${scopeSelector} .hic-icon-btn svg {\n    display: block;\n    flex-shrink: 0;\n  }\n\n  ${scopeSelector} .hic-text-btn {\n    align-items: center;\n    gap: 6px;\n    min-height: 28px;\n    padding: 0 10px;\n    width: auto;\n    font-size: 12px;\n    line-height: 1;\n  }\n\n  ${scopeSelector} .hic-icon-btn:hover {\n    background: var(--sdt-bg-hover);\n    color: var(--sdt-text);\n  }\n\n  ${scopeSelector} .hic-body {\n    color: var(--sdt-text-secondary);\n    font-size: 14px;\n    line-height: 1.5;\n  }\n\n  ${scopeSelector} .hic-message-header {\n    display: flex;\n    align-items: center;\n    justify-content: space-between;\n    gap: 10px;\n    margin-top: 14px;\n    margin-bottom: 8px;\n  }\n\n  ${scopeSelector} .hic-message-label {\n    color: var(--sdt-text);\n    font-size: 12px;\n    font-weight: 650;\n  }\n\n  ${scopeSelector} .hic-message {\n    padding: 12px;\n    max-height: min(260px, max(96px, 30dvh));\n    overflow: auto;\n    border: 1px solid var(--sdt-border-subtle);\n    border-radius: 10px;\n    background: var(--sdt-bg-subtle);\n    color: var(--sdt-text);\n    font-family: var(--sdt-font-mono);\n    font-size: 12px;\n    white-space: pre-wrap;\n    overflow-wrap: anywhere;\n  }\n\n  ${scopeSelector} .hic-fix-list {\n    margin: 8px 0 0;\n    padding-left: 18px;\n    color: var(--sdt-text);\n    font-size: 13px;\n  }\n\n  ${scopeSelector} .hic-fix-list li + li {\n    margin-top: 4px;\n  }\n\n  ${scopeSelector} .hic-footer {\n    margin-top: 10px;\n    color: var(--sdt-text-tertiary);\n    font-size: 12px;\n  }\n\n  ${scopeSelector} .hic-pill {\n    position: fixed;\n    right: 18px;\n    bottom: 18px;\n    z-index: 2147483647;\n    display: flex;\n    align-items: center;\n    gap: 8px;\n    padding: 8px 12px 8px 8px;\n    --hic-status: var(--sdt-error);\n    border: 1px solid color-mix(in srgb, var(--hic-status) 35%, var(--sdt-border));\n    border-radius: 999px;\n    background: var(--sdt-overlay-bg);\n    box-shadow: var(--sdt-trigger-shadow);\n    color: var(--sdt-text);\n    cursor: pointer;\n    font: inherit;\n    backdrop-filter: blur(18px);\n  }\n\n  ${scopeSelector} .hic-pill-warning {\n    --hic-status: var(--sdt-warning);\n  }\n\n  ${scopeSelector} .hic-pill-logo {\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    width: 26px;\n    height: 26px;\n    border-radius: 999px;\n    background: var(--hic-status);\n    color: white;\n  }\n\n  @media (max-height: 520px) {\n    ${scopeSelector} .hic-backdrop {\n      align-items: flex-start;\n      padding: 12px;\n    }\n\n    ${scopeSelector} .hic-card {\n      width: min(720px, calc(100vw - 24px));\n      max-height: calc(100dvh - 24px);\n    }\n\n    ${scopeSelector} .hic-card-inner {\n      padding: 12px;\n    }\n\n    ${scopeSelector} .hic-header {\n      margin-bottom: 8px;\n    }\n\n    ${scopeSelector} .hic-title {\n      font-size: 16px;\n    }\n\n    ${scopeSelector} .hic-body {\n      font-size: 13px;\n    }\n\n    ${scopeSelector} .hic-message {\n      max-height: max(80px, 24dvh);\n    }\n  }\n`;\n}\n\nexport async function copyTextToClipboard(text: string): Promise<void> {\n  const clipboard: unknown = Reflect.get(navigator, \"clipboard\");\n  const writeText = clipboard != null && typeof clipboard === \"object\"\n    ? Reflect.get(clipboard, \"writeText\")\n    : null;\n  if (typeof writeText === \"function\") {\n    await writeText.call(clipboard, text);\n    return;\n  }\n\n  const textarea = h(\"textarea\", {\n    style: {\n      position: \"fixed\",\n      left: \"-9999px\",\n      top: \"0\",\n      opacity: \"0\",\n    },\n    readonly: \"true\",\n  });\n  textarea.value = text;\n  document.body.appendChild(textarea);\n  textarea.select();\n  const copied = document.execCommand(\"copy\");\n  textarea.remove();\n  if (!copied) {\n    throw new Error(\"Browser refused to copy the message.\");\n  }\n}\n\n/**\n * A button that copies `getText()` and briefly reports the outcome in its own label. Copying can fail for reasons\n * outside our control (permissions, insecure contexts), so the failure is reported inline instead of being thrown into\n * a click handler where nothing would show it.\n */\nfunction renderCopyButton(options: {\n  variant: \"icon\" | \"text\",\n  title: string,\n  ariaLabel: string,\n  getText: () => string,\n  onCopyError: (error: unknown) => void,\n}): HTMLElement {\n  const idleHtml = options.variant === \"text\" ? `${COPY_ICON_SVG}Copy` : COPY_ICON_SVG;\n  const button = h(\"button\", {\n    className: options.variant === \"text\" ? \"hic-icon-btn hic-text-btn\" : \"hic-icon-btn\",\n    type: \"button\",\n    title: options.title,\n    \"aria-label\": options.ariaLabel,\n    onClick: () => {\n      runAsynchronously(async () => {\n        await copyTextToClipboard(options.getText());\n        button.textContent = options.variant === \"text\" ? \"Copied\" : \"✓\";\n        setTimeout(() => setHtml(button, idleHtml), 1500);\n      }, {\n        noErrorLogging: true,\n        onError: (error) => {\n          options.onCopyError(error);\n          button.textContent = options.variant === \"text\" ? \"Copy failed\" : \"!\";\n          setTimeout(() => setHtml(button, idleHtml), 1500);\n        },\n      });\n    },\n  });\n  setHtml(button, idleHtml);\n  return button;\n}\n\nexport type IssueCardOptions = {\n  kind: IssueCardKind,\n  /** Short uppercase label in the card's badge, eg. \"Config error\". */\n  badge: string,\n  title: string,\n  /** One or two sentences on what this means for the running app. */\n  bodyText: string,\n  messageLabel: string,\n  message: string,\n  /** Concrete steps the developer should take; rendered as a list above the footer. */\n  howToFix?: readonly string[],\n  footerText: string,\n  ariaLabel: string,\n  /** Prompt for the \"copy AI prompt\" button, ie. the message plus enough context for a coding agent to fix it. */\n  aiPrompt: string,\n  onCopyError: (error: unknown) => void,\n  onCopyAiPromptError: (error: unknown) => void,\n  onMinimize: () => void,\n};\n\nexport function renderIssueCard(options: IssueCardOptions): HTMLElement {\n  const logoSpan = h(\"span\", { className: \"hic-logo\" });\n  setHtml(logoSpan, HEXCLAVE_LOGO_SVG);\n\n  return h(\"div\", { className: \"hic-backdrop\" },\n    h(\"div\", { className: options.kind === \"error\" ? \"hic-card\" : \"hic-card hic-card-warning\", role: \"alertdialog\", \"aria-modal\": \"true\", \"aria-label\": options.ariaLabel, tabindex: \"-1\" },\n      h(\"div\", { className: \"hic-card-inner\" },\n        h(\"div\", { className: \"hic-header\" },\n          h(\"div\", { className: \"hic-title-row\" },\n            logoSpan,\n            h(\"div\", null,\n              h(\"span\", { className: \"hic-badge\" }, options.badge),\n              h(\"div\", { className: \"hic-title\" }, options.title),\n            ),\n          ),\n          h(\"div\", { className: \"hic-actions\" },\n            renderCopyButton({\n              variant: \"icon\",\n              title: \"Copy AI prompt\",\n              ariaLabel: `Copy AI prompt for ${options.ariaLabel}`,\n              getText: () => options.aiPrompt,\n              onCopyError: options.onCopyAiPromptError,\n            }),\n            h(\"button\", {\n              className: \"hic-icon-btn\",\n              type: \"button\",\n              title: \"Minimize\",\n              \"aria-label\": `Minimize ${options.ariaLabel}`,\n              onClick: options.onMinimize,\n            }, \"–\"),\n          ),\n        ),\n        h(\"div\", { className: \"hic-body\" },\n          options.bodyText,\n          h(\"div\", { className: \"hic-message-header\" },\n            h(\"div\", { className: \"hic-message-label\" }, options.messageLabel),\n            renderCopyButton({\n              variant: \"text\",\n              title: `Copy ${options.messageLabel.toLowerCase()}`,\n              ariaLabel: `Copy ${options.ariaLabel} message`,\n              getText: () => options.message,\n              onCopyError: options.onCopyError,\n            }),\n          ),\n          h(\"div\", { className: \"hic-message\" }, options.message),\n          options.howToFix == null || options.howToFix.length === 0 ? null : h(\"div\", null,\n            h(\"div\", { className: \"hic-message-header\" },\n              h(\"div\", { className: \"hic-message-label\" }, \"How to fix\"),\n            ),\n            h(\"ul\",\n              { className: \"hic-fix-list\" },\n              ...options.howToFix.map((step) => h(\"li\", null, step)),\n            ),\n          ),\n          h(\"div\", { className: \"hic-footer\" }, options.footerText),\n        ),\n      ),\n    ),\n  );\n}\n\nconst FOCUSABLE_SELECTOR = \"a[href], button:not([disabled]), input:not([disabled]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex='-1'])\";\n\nexport type IssueCardFocusTrap = {\n  /**\n   * Whatever had focus before the card first appeared. Callers that rebind the trap to a re-rendered card pass it back\n   * in, so focus still returns to where the developer left it once the card is gone for good.\n   */\n  previouslyFocused: HTMLElement | null,\n  release: (releaseOptions?: { restoreFocus?: boolean }) => void,\n};\n\n/**\n * Keeps keyboard focus inside a mounted card, which claims to be an `aria-modal` alertdialog and therefore has to behave\n * like one: the flow behind the card is dead until the problem is fixed, so tabbing into it would only let a keyboard\n * user wander through a page that cannot work while the card stays invisible to them.\n *\n * Call right after mounting the card, and release the trap when the card is minimized, replaced or removed. Releasing\n * hands focus back to `previouslyFocused` unless `restoreFocus: false` is passed, which is what a caller that is about\n * to rebind the trap to a freshly rendered card wants.\n */\nexport function trapFocusInIssueCard(cardRoot: HTMLElement, options: {\n  moveFocusIntoCard?: boolean,\n  previouslyFocused?: HTMLElement | null,\n} = {}): IssueCardFocusTrap {\n  const previouslyFocused = options.previouslyFocused !== undefined\n    ? options.previouslyFocused\n    : document.activeElement instanceof HTMLElement ? document.activeElement : null;\n  const card = cardRoot.querySelector(\".hic-card\");\n  if (!(card instanceof HTMLElement)) return { previouslyFocused, release: () => {} };\n\n  const onKeyDown = (event: KeyboardEvent) => {\n    if (event.key !== \"Tab\") return;\n    const focusable = [...card.querySelectorAll(FOCUSABLE_SELECTOR)].filter((element): element is HTMLElement => element instanceof HTMLElement);\n    const first = focusable[0] ?? card;\n    const last = focusable[focusable.length - 1] ?? card;\n    const active = document.activeElement instanceof HTMLElement ? document.activeElement : null;\n\n    let target: HTMLElement | null = null;\n    if (active == null || !card.contains(active)) {\n      // Focus is outside the card (the page moved it, or it never got in): pull it back to the card's near end.\n      target = event.shiftKey ? last : first;\n    } else if (active === last && !event.shiftKey) {\n      target = first;\n    } else if (active === first && event.shiftKey) {\n      target = last;\n    }\n    if (target == null) return;\n    event.preventDefault();\n    target.focus();\n  };\n\n  document.addEventListener(\"keydown\", onKeyDown, true);\n  if (options.moveFocusIntoCard !== false) {\n    card.focus();\n  }\n\n  return {\n    previouslyFocused,\n    release: (releaseOptions) => {\n      document.removeEventListener(\"keydown\", onKeyDown, true);\n      if (releaseOptions?.restoreFocus === false) return;\n      if (previouslyFocused != null && previouslyFocused.isConnected) {\n        previouslyFocused.focus();\n      }\n    },\n  };\n}\n\nexport function renderIssuePill(options: {\n  kind: IssueCardKind,\n  label: string,\n  ariaLabel: string,\n  onClick: () => void,\n}): HTMLElement {\n  const logoSpan = h(\"span\", { className: \"hic-pill-logo\" });\n  setHtml(logoSpan, HEXCLAVE_LOGO_SVG);\n  return h(\"button\", {\n    className: options.kind === \"error\" ? \"hic-pill\" : \"hic-pill hic-pill-warning\",\n    type: \"button\",\n    \"aria-label\": options.ariaLabel,\n    onClick: options.onClick,\n  },\n    logoSpan,\n    h(\"span\", null, options.label),\n  );\n}\n"],"mappings":";;;;;;AAgBA,MAAM,gBAAgB;AAEtB,SAAgB,gBAAgB,eAA+B;CAC7D,QAAA,GAAA,iBAAA,mBAAA,CAA0B,aAAa,IAAI;IACzC,cAAc;;;;;;;;;;;;;IAad,cAAc;;;;;;;;;;;;;IAad,cAAc;;;;IAId,cAAc;;;;;;IAMd,cAAc;;;;;;;;IAQd,cAAc;;;;;;;IAOd,cAAc;;;;;;;;;;;;;IAad,cAAc;;;;;;;;;;;;;IAad,cAAc;;;;;;;;IAQd,cAAc;;;;;IAKd,cAAc;;;;;;;;;;;;;;;;IAgBd,cAAc;;;;;IAKd,cAAc;;;;;;;;;;IAUd,cAAc;;;;;IAKd,cAAc;;;;;;IAMd,cAAc;;;;;;;;;IASd,cAAc;;;;;;IAMd,cAAc;;;;;;;;;;;;;;IAcd,cAAc;;;;;;;IAOd,cAAc;;;;IAId,cAAc;;;;;;IAMd,cAAc;;;;;;;;;;;;;;;;;;;;IAoBd,cAAc;;;;IAId,cAAc;;;;;;;;;;;;MAYZ,cAAc;;;;;MAKd,cAAc;;;;;MAKd,cAAc;;;;MAId,cAAc;;;;MAId,cAAc;;;;MAId,cAAc;;;;MAId,cAAc;;;;;AAKpB;AAEA,eAAsB,oBAAoB,MAA6B;CACrE,MAAM,YAAqB,QAAQ,IAAI,WAAW,WAAW;CAC7D,MAAM,YAAY,aAAa,QAAQ,OAAO,cAAc,WACxD,QAAQ,IAAI,WAAW,WAAW,IAClC;CACJ,IAAI,OAAO,cAAc,YAAY;EACnC,MAAM,UAAU,KAAK,WAAW,IAAI;EACpC;CACF;CAEA,MAAM,YAAA,GAAA,SAAA,EAAA,CAAa,YAAY;EAC7B,OAAO;GACL,UAAU;GACV,MAAM;GACN,KAAK;GACL,SAAS;EACX;EACA,UAAU;CACZ,CAAC;CACD,SAAS,QAAQ;CACjB,SAAS,KAAK,YAAY,QAAQ;CAClC,SAAS,OAAO;CAChB,MAAM,SAAS,SAAS,YAAY,MAAM;CAC1C,SAAS,OAAO;CAChB,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,sCAAsC;AAE1D;;;;;;AAOA,SAAS,iBAAiB,SAMV;CACd,MAAM,WAAW,QAAQ,YAAY,SAAS,GAAG,cAAc,QAAQ;CACvE,MAAM,UAAA,GAAA,SAAA,EAAA,CAAW,UAAU;EACzB,WAAW,QAAQ,YAAY,SAAS,8BAA8B;EACtE,MAAM;EACN,OAAO,QAAQ;EACf,cAAc,QAAQ;EACtB,eAAe;GACb,CAAA,GAAA,qCAAA,kBAAA,CAAkB,YAAY;IAC5B,MAAM,oBAAoB,QAAQ,QAAQ,CAAC;IAC3C,OAAO,cAAc,QAAQ,YAAY,SAAS,WAAW;IAC7D,kBAAA,GAAA,SAAA,QAAA,CAAyB,QAAQ,QAAQ,GAAG,IAAI;GAClD,GAAG;IACD,gBAAgB;IAChB,UAAU,UAAU;KAClB,QAAQ,YAAY,KAAK;KACzB,OAAO,cAAc,QAAQ,YAAY,SAAS,gBAAgB;KAClE,kBAAA,GAAA,SAAA,QAAA,CAAyB,QAAQ,QAAQ,GAAG,IAAI;IAClD;GACF,CAAC;EACH;CACF,CAAC;CACD,CAAA,GAAA,SAAA,QAAA,CAAQ,QAAQ,QAAQ;CACxB,OAAO;AACT;AAsBA,SAAgB,gBAAgB,SAAwC;CACtE,MAAM,YAAA,GAAA,SAAA,EAAA,CAAa,QAAQ,EAAE,WAAW,WAAW,CAAC;CACpD,CAAA,GAAA,SAAA,QAAA,CAAQ,UAAUA,UAAAA,iBAAiB;CAEnC,QAAA,GAAA,SAAA,EAAA,CAAS,OAAO,EAAE,WAAW,eAAe,IAAA,GAAA,SAAA,EAAA,CACxC,OAAO;EAAE,WAAW,QAAQ,SAAS,UAAU,aAAa;EAA6B,MAAM;EAAe,cAAc;EAAQ,cAAc,QAAQ;EAAW,UAAU;CAAK,IAAA,GAAA,SAAA,EAAA,CAClL,OAAO,EAAE,WAAW,iBAAiB,IAAA,GAAA,SAAA,EAAA,CACnC,OAAO,EAAE,WAAW,aAAa,IAAA,GAAA,SAAA,EAAA,CAC/B,OAAO,EAAE,WAAW,gBAAgB,GACpC,WAAA,GAAA,SAAA,EAAA,CACE,OAAO,OAAA,GAAA,SAAA,EAAA,CACL,QAAQ,EAAE,WAAW,YAAY,GAAG,QAAQ,KAAK,IAAA,GAAA,SAAA,EAAA,CACjD,OAAO,EAAE,WAAW,YAAY,GAAG,QAAQ,KAAK,CACpD,CACF,IAAA,GAAA,SAAA,EAAA,CACE,OAAO,EAAE,WAAW,cAAc,GAClC,iBAAiB;EACf,SAAS;EACT,OAAO;EACP,WAAW,sBAAsB,QAAQ;EACzC,eAAe,QAAQ;EACvB,aAAa,QAAQ;CACvB,CAAC,IAAA,GAAA,SAAA,EAAA,CACC,UAAU;EACV,WAAW;EACX,MAAM;EACN,OAAO;EACP,cAAc,YAAY,QAAQ;EAClC,SAAS,QAAQ;CACnB,GAAG,GAAG,CACR,CACF,IAAA,GAAA,SAAA,EAAA,CACE,OAAO,EAAE,WAAW,WAAW,GAC/B,QAAQ,WAAA,GAAA,SAAA,EAAA,CACN,OAAO,EAAE,WAAW,qBAAqB,IAAA,GAAA,SAAA,EAAA,CACvC,OAAO,EAAE,WAAW,oBAAoB,GAAG,QAAQ,YAAY,GACjE,iBAAiB;EACf,SAAS;EACT,OAAO,QAAQ,QAAQ,aAAa,YAAY;EAChD,WAAW,QAAQ,QAAQ,UAAU;EACrC,eAAe,QAAQ;EACvB,aAAa,QAAQ;CACvB,CAAC,CACH,IAAA,GAAA,SAAA,EAAA,CACE,OAAO,EAAE,WAAW,cAAc,GAAG,QAAQ,OAAO,GACtD,QAAQ,YAAY,QAAQ,QAAQ,SAAS,WAAW,IAAI,QAAA,GAAA,SAAA,EAAA,CAAS,OAAO,OAAA,GAAA,SAAA,EAAA,CACxE,OAAO,EAAE,WAAW,qBAAqB,IAAA,GAAA,SAAA,EAAA,CACvC,OAAO,EAAE,WAAW,oBAAoB,GAAG,YAAY,CAC3D,IAAA,GAAA,SAAA,EAAA,CACE,MACA,EAAE,WAAW,eAAe,GAC5B,GAAG,QAAQ,SAAS,KAAK,UAAA,GAAA,SAAA,EAAA,CAAW,MAAM,MAAM,IAAI,CAAC,CACvD,CACF,IAAA,GAAA,SAAA,EAAA,CACE,OAAO,EAAE,WAAW,aAAa,GAAG,QAAQ,UAAU,CAC1D,CACF,CACF,CACF;AACF;AAEA,MAAM,qBAAqB;;;;;;;;;;AAoB3B,SAAgB,qBAAqB,UAAuB,UAGxD,CAAC,GAAuB;CAC1B,MAAM,oBAAoB,QAAQ,sBAAsB,KAAA,IACpD,QAAQ,oBACR,SAAS,yBAAyB,cAAc,SAAS,gBAAgB;CAC7E,MAAM,OAAO,SAAS,cAAc,WAAW;CAC/C,IAAI,EAAE,gBAAgB,cAAc,OAAO;EAAE;EAAmB,eAAe,CAAC;CAAE;CAElF,MAAM,aAAa,UAAyB;EAC1C,IAAI,MAAM,QAAQ,OAAO;EACzB,MAAM,YAAY,CAAC,GAAG,KAAK,iBAAiB,kBAAkB,CAAC,CAAC,CAAC,QAAQ,YAAoC,mBAAmB,WAAW;EAC3I,MAAM,QAAQ,UAAU,MAAM;EAC9B,MAAM,OAAO,UAAU,UAAU,SAAS,MAAM;EAChD,MAAM,SAAS,SAAS,yBAAyB,cAAc,SAAS,gBAAgB;EAExF,IAAI,SAA6B;EACjC,IAAI,UAAU,QAAQ,CAAC,KAAK,SAAS,MAAM,GAEzC,SAAS,MAAM,WAAW,OAAO;OAC5B,IAAI,WAAW,QAAQ,CAAC,MAAM,UACnC,SAAS;OACJ,IAAI,WAAW,SAAS,MAAM,UACnC,SAAS;EAEX,IAAI,UAAU,MAAM;EACpB,MAAM,eAAe;EACrB,OAAO,MAAM;CACf;CAEA,SAAS,iBAAiB,WAAW,WAAW,IAAI;CACpD,IAAI,QAAQ,sBAAsB,OAChC,KAAK,MAAM;CAGb,OAAO;EACL;EACA,UAAU,mBAAmB;GAC3B,SAAS,oBAAoB,WAAW,WAAW,IAAI;GACvD,IAAI,gBAAgB,iBAAiB,OAAO;GAC5C,IAAI,qBAAqB,QAAQ,kBAAkB,aACjD,kBAAkB,MAAM;EAE5B;CACF;AACF;AAEA,SAAgB,gBAAgB,SAKhB;CACd,MAAM,YAAA,GAAA,SAAA,EAAA,CAAa,QAAQ,EAAE,WAAW,gBAAgB,CAAC;CACzD,CAAA,GAAA,SAAA,QAAA,CAAQ,UAAUA,UAAAA,iBAAiB;CACnC,QAAA,GAAA,SAAA,EAAA,CAAS,UAAU;EACjB,WAAW,QAAQ,SAAS,UAAU,aAAa;EACnD,MAAM;EACN,cAAc,QAAQ;EACtB,SAAS,QAAQ;CACnB,GACE,WAAA,GAAA,SAAA,EAAA,CACE,QAAQ,MAAM,QAAQ,KAAK,CAC/B;AACF"}

package/dist/in-page-ui/issue-card.test.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/in-page-ui/issue-card.test.js

@@ -0,0 +1,59 @@
+let vitest = require("vitest");
+let __issue_card_js = require("./issue-card.js");
+//#region src/in-page-ui/issue-card.test.ts
+// @vitest-environment jsdom
+function mountCard() {
+	const root = document.body.appendChild(document.createElement("div"));
+	root.appendChild((0, __issue_card_js.renderIssueCard)({
+		kind: "error",
+		badge: "Config error",
+		title: "Something is misconfigured",
+		bodyText: "Body",
+		messageLabel: "Error message",
+		message: "Message",
+		footerText: "Footer",
+		ariaLabel: "Hexclave config error",
+		aiPrompt: "prompt",
+		onCopyError: () => {},
+		onCopyAiPromptError: () => {},
+		onMinimize: () => {}
+	}));
+	return root;
+}
+function pressTab() {
+	document.dispatchEvent(new KeyboardEvent("keydown", {
+		key: "Tab",
+		bubbles: true,
+		cancelable: true
+	}));
+}
+function cardButtons(root) {
+	return [...root.querySelectorAll(".hic-card button")];
+}
+(0, vitest.describe)("issue card focus trap", () => {
+	(0, vitest.afterEach)(() => {
+		document.body.replaceChildren();
+	});
+	(0, vitest.it)("follows a re-rendered card without moving focus or losing the original focus owner", () => {
+		const pageButton = document.body.appendChild(document.createElement("button"));
+		pageButton.focus();
+		const firstRoot = mountCard();
+		const firstTrap = (0, __issue_card_js.trapFocusInIssueCard)(firstRoot);
+		(0, vitest.expect)(document.activeElement).toBe(firstRoot.querySelector(".hic-card"));
+		firstRoot.remove();
+		const secondRoot = mountCard();
+		firstTrap.release({ restoreFocus: false });
+		const secondTrap = (0, __issue_card_js.trapFocusInIssueCard)(secondRoot, {
+			moveFocusIntoCard: false,
+			previouslyFocused: firstTrap.previouslyFocused
+		});
+		(0, vitest.expect)(document.activeElement).not.toBe(secondRoot.querySelector(".hic-card"));
+		pressTab();
+		(0, vitest.expect)(document.activeElement).toBe(cardButtons(secondRoot)[0]);
+		secondTrap.release();
+		(0, vitest.expect)(document.activeElement).toBe(pageButton);
+	});
+});
+//#endregion
+
+//# sourceMappingURL=issue-card.test.js.map

package/dist/in-page-ui/issue-card.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-card.test.js","names":[],"sources":["../../src/in-page-ui/issue-card.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { renderIssueCard, trapFocusInIssueCard } from \"./issue-card\";\n\nfunction mountCard(): HTMLElement {\n  const root = document.body.appendChild(document.createElement(\"div\"));\n  root.appendChild(renderIssueCard({\n    kind: \"error\",\n    badge: \"Config error\",\n    title: \"Something is misconfigured\",\n    bodyText: \"Body\",\n    messageLabel: \"Error message\",\n    message: \"Message\",\n    footerText: \"Footer\",\n    ariaLabel: \"Hexclave config error\",\n    aiPrompt: \"prompt\",\n    onCopyError: () => {},\n    onCopyAiPromptError: () => {},\n    onMinimize: () => {},\n  }));\n  return root;\n}\n\nfunction pressTab() {\n  document.dispatchEvent(new KeyboardEvent(\"keydown\", { key: \"Tab\", bubbles: true, cancelable: true }));\n}\n\nfunction cardButtons(root: HTMLElement): HTMLButtonElement[] {\n  return [...root.querySelectorAll<HTMLButtonElement>(\".hic-card button\")];\n}\n\ndescribe(\"issue card focus trap\", () => {\n  afterEach(() => {\n    document.body.replaceChildren();\n  });\n\n  it(\"follows a re-rendered card without moving focus or losing the original focus owner\", () => {\n    const pageButton = document.body.appendChild(document.createElement(\"button\"));\n    pageButton.focus();\n\n    const firstRoot = mountCard();\n    const firstTrap = trapFocusInIssueCard(firstRoot);\n    expect(document.activeElement).toBe(firstRoot.querySelector(\".hic-card\"));\n\n    // What the pushed-config overlay does on every poll: throw the rendered card away and render a fresh one.\n    firstRoot.remove();\n    const secondRoot = mountCard();\n    firstTrap.release({ restoreFocus: false });\n    const secondTrap = trapFocusInIssueCard(secondRoot, {\n      moveFocusIntoCard: false,\n      previouslyFocused: firstTrap.previouslyFocused,\n    });\n    expect(document.activeElement).not.toBe(secondRoot.querySelector(\".hic-card\"));\n\n    // The trap now belongs to the visible card, so Tab lands inside it instead of inside the detached one.\n    pressTab();\n    expect(document.activeElement).toBe(cardButtons(secondRoot)[0]);\n\n    secondTrap.release();\n    expect(document.activeElement).toBe(pageButton);\n  });\n});\n"],"mappings":";;;;AASA,SAAS,YAAyB;CAChC,MAAM,OAAO,SAAS,KAAK,YAAY,SAAS,cAAc,KAAK,CAAC;CACpE,KAAK,aAAA,GAAA,gBAAA,gBAAA,CAA4B;EAC/B,MAAM;EACN,OAAO;EACP,OAAO;EACP,UAAU;EACV,cAAc;EACd,SAAS;EACT,YAAY;EACZ,WAAW;EACX,UAAU;EACV,mBAAmB,CAAC;EACpB,2BAA2B,CAAC;EAC5B,kBAAkB,CAAC;CACrB,CAAC,CAAC;CACF,OAAO;AACT;AAEA,SAAS,WAAW;CAClB,SAAS,cAAc,IAAI,cAAc,WAAW;EAAE,KAAK;EAAO,SAAS;EAAM,YAAY;CAAK,CAAC,CAAC;AACtG;AAEA,SAAS,YAAY,MAAwC;CAC3D,OAAO,CAAC,GAAG,KAAK,iBAAoC,kBAAkB,CAAC;AACzE;qBAES,+BAA+B;CACtC,CAAA,GAAA,OAAA,UAAA,OAAgB;EACd,SAAS,KAAK,gBAAgB;CAChC,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4FAA4F;EAC7F,MAAM,aAAa,SAAS,KAAK,YAAY,SAAS,cAAc,QAAQ,CAAC;EAC7E,WAAW,MAAM;EAEjB,MAAM,YAAY,UAAU;EAC5B,MAAM,aAAA,GAAA,gBAAA,qBAAA,CAAiC,SAAS;EAChD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,CAAC,CAAC,KAAK,UAAU,cAAc,WAAW,CAAC;EAGxE,UAAU,OAAO;EACjB,MAAM,aAAa,UAAU;EAC7B,UAAU,QAAQ,EAAE,cAAc,MAAM,CAAC;EACzC,MAAM,cAAA,GAAA,gBAAA,qBAAA,CAAkC,YAAY;GAClD,mBAAmB;GACnB,mBAAmB,UAAU;EAC/B,CAAC;EACD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,CAAC,CAAC,IAAI,KAAK,WAAW,cAAc,WAAW,CAAC;EAG7E,SAAS;EACT,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC,EAAE;EAE9D,WAAW,QAAQ;EACnB,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,CAAC,CAAC,KAAK,UAAU;CAChD,CAAC;AACH,CAAC"}

package/dist/in-page-ui/logo.d.ts

@@ -0,0 +1,5 @@
+//#region src/in-page-ui/logo.d.ts
+declare const HEXCLAVE_LOGO_SVG = "<svg width=\"16\" height=\"16\" viewBox=\"0 0 48 48\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"3\" stroke-linejoin=\"miter\"><path d=\"M 24 4 L 41.32 14 L 41.32 34 L 24 44 L 6.68 34 L 6.68 14 Z\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\" transform=\"rotate(120 24 24)\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\" transform=\"rotate(240 24 24)\"/></svg>";
+//#endregion
+export { HEXCLAVE_LOGO_SVG };
+//# sourceMappingURL=logo.d.ts.map

package/dist/in-page-ui/logo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logo.d.ts","names":[],"sources":["../../src/in-page-ui/logo.ts"],"mappings":";cAOa,iBAAA"}

package/dist/in-page-ui/logo.js

@@ -0,0 +1,7 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/in-page-ui/logo.ts
+const HEXCLAVE_LOGO_SVG = "<svg width=\"16\" height=\"16\" viewBox=\"0 0 48 48\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"3\" stroke-linejoin=\"miter\"><path d=\"M 24 4 L 41.32 14 L 41.32 34 L 24 44 L 6.68 34 L 6.68 14 Z\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\" transform=\"rotate(120 24 24)\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\" transform=\"rotate(240 24 24)\"/></svg>";
+//#endregion
+exports.HEXCLAVE_LOGO_SVG = HEXCLAVE_LOGO_SVG;
+
+//# sourceMappingURL=logo.js.map

package/dist/in-page-ui/logo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logo.js","names":[],"sources":["../../src/in-page-ui/logo.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// Hexclave mark — hexagon outline with three radial bars, monochrome via currentColor so it inherits the surrounding\n// text color. Sourced from apps/dashboard/public/hexclave-icon.svg (gradient + glow stripped; this is a tiny glyph, not\n// the full brand mark). Shared by every in-page UI so the mark cannot drift between them.\nexport const HEXCLAVE_LOGO_SVG = '<svg width=\"16\" height=\"16\" viewBox=\"0 0 48 48\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"3\" stroke-linejoin=\"miter\"><path d=\"M 24 4 L 41.32 14 L 41.32 34 L 24 44 L 6.68 34 L 6.68 14 Z\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\" transform=\"rotate(120 24 24)\"/><path d=\"M 11 16.87 L 14 15.13 L 14 32.87 L 11 31.13 Z\" fill=\"currentColor\" stroke=\"none\" transform=\"rotate(240 24 24)\"/></svg>';\n"],"mappings":";;AAOA,MAAa,oBAAoB"}

package/dist/index.d.ts

@@ -6,7 +6,7 @@ import { a as PlanUsageRow, i as PlanUsagePlanId, n as PlanUsageKind, r as PlanU
 import { a as AdminWorkflowRunState, c as AdminWorkflowStepAttempt, d as AdminWorkflowUpgradeResult, f as AdminWorkflowVersion, i as AdminWorkflowRunDetails, l as AdminWorkflowSyncResult, n as AdminWorkflowDivergenceDiagnostic, o as AdminWorkflowRunsFilter, r as AdminWorkflowRun, s as AdminWorkflowStep, t as AdminWorkflow, u as AdminWorkflowTrigger } from "./workflows-DEb7pIuQ.js";
 import { r as OAuthConnection, t as Connection } from "./index-ClBTM-St.js";
 import { i as ServerContactChannel, t as ContactChannel } from "./index-DN04TjLM.js";
-import { $ as TeamCreateOptions, B as StackServerAppConstructor, D as HexclaveAdminApp, E as EmailOutboxUpdateOptions, F as StackAdminAppConstructorOptions, H as EditableTeamMemberProfile, I as HexclaveServerApp, J as ServerTeamCreateOptions, K as ServerListUsersOptions, L as HexclaveServerAppConstructor, N as StackAdminApp, O as HexclaveAdminAppConstructor, Ot as User, P as StackAdminAppConstructor, Q as Team, R as HexclaveServerAppConstructorOptions, St as ServerUser, T as EmailOutboxListResult, U as ReceivedTeamInvitation, V as StackServerAppConstructorOptions, W as SentTeamInvitation, X as ServerTeamUpdateOptions, Y as ServerTeamMemberProfile, Z as ServerTeamUser, _ as AdminProjectCreateOptions, _t as OAuthProvider, a as StackClientApp, c as StackClientAppJson, d as AdminDeploymentEnvVarOptions, et as TeamInvitation, f as AdminDeploymentRunJson, ft as CurrentInternalServerUser, g as AdminProject, h as AdminOwnedProject, ht as CurrentUser, i as HexclaveClientAppJson, it as TeamUser, k as HexclaveAdminAppConstructorOptions, l as AdminDeploymentDomainJson, m as AdminDeploymentServiceJson, mt as CurrentServerUser, n as HexclaveClientAppConstructor, o as StackClientAppConstructor, p as AdminDeploymentServiceBuildOptions, pt as CurrentInternalUser, q as ServerTeam, r as HexclaveClientAppConstructorOptions, rt as TeamUpdateOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp, tt as TeamMemberProfile, u as AdminDeploymentEnvVarJson, ut as Auth, v as AdminProjectUpdateOptions, w as EmailOutboxListOptions, x as PushedConfigSource, xt as ServerOAuthProvider, y as Project, z as StackServerApp } from "./client-app-WOX3pOo1.js";
+import { $ as TeamCreateOptions, B as StackServerAppConstructor, D as HexclaveAdminApp, E as EmailOutboxUpdateOptions, F as StackAdminAppConstructorOptions, H as EditableTeamMemberProfile, I as HexclaveServerApp, J as ServerTeamCreateOptions, K as ServerListUsersOptions, L as HexclaveServerAppConstructor, N as StackAdminApp, O as HexclaveAdminAppConstructor, Ot as User, P as StackAdminAppConstructor, Q as Team, R as HexclaveServerAppConstructorOptions, St as ServerUser, T as EmailOutboxListResult, U as ReceivedTeamInvitation, V as StackServerAppConstructorOptions, W as SentTeamInvitation, X as ServerTeamUpdateOptions, Y as ServerTeamMemberProfile, Z as ServerTeamUser, _ as AdminProjectCreateOptions, _t as OAuthProvider, a as StackClientApp, c as StackClientAppJson, d as AdminDeploymentEnvVarOptions, et as TeamInvitation, f as AdminDeploymentRunJson, ft as CurrentInternalServerUser, g as AdminProject, h as AdminOwnedProject, ht as CurrentUser, i as HexclaveClientAppJson, it as TeamUser, k as HexclaveAdminAppConstructorOptions, l as AdminDeploymentDomainJson, m as AdminDeploymentServiceJson, mt as CurrentServerUser, n as HexclaveClientAppConstructor, o as StackClientAppConstructor, p as AdminDeploymentServiceBuildOptions, pt as CurrentInternalUser, q as ServerTeam, r as HexclaveClientAppConstructorOptions, rt as TeamUpdateOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp, tt as TeamMemberProfile, u as AdminDeploymentEnvVarJson, ut as Auth, v as AdminProjectUpdateOptions, w as EmailOutboxListOptions, x as PushedConfigSource, xt as ServerOAuthProvider, y as Project, z as StackServerApp } from "./client-app-R5X8wyeV.js";
 import { a as AdminProjectConfigUpdateOptions, i as AdminProjectConfig, n as AdminEmailConfig, o as OAuthProviderConfig, r as AdminOAuthProviderConfig, s as ProjectConfig, t as AdminDomainConfig } from "./index-B-MazpM_.js";
 import { r as getPagePrompt } from "./url-targets-BJgkwPGW.js";
 import { getConvexProvidersConfig } from "./integrations/convex.js";

package/dist/lib/hexclave-app/apps/implementations/admin-app-impl.d.ts

@@ -1,2 +1,2 @@
-import { t as _HexclaveAdminAppImplIncomplete } from "../../../../admin-app-impl-BhrjJlxj.js";
+import { t as _HexclaveAdminAppImplIncomplete } from "../../../../admin-app-impl-CHQtsn4f.js";
 export { _HexclaveAdminAppImplIncomplete };

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.js

@@ -1,6 +1,7 @@
 let vitest = require("vitest");
 let ______common_js = require("../../common.js");
 let ___interfaces_client_app_js = require("../interfaces/client-app.js");
+let __client_app_impl_js = require("./client-app-impl.js");
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.ts
 const baseOptions = {
 	baseUrl: "http://localhost:12345",
@@ -95,6 +96,34 @@ const baseOptions = {
 		const first = ___interfaces_client_app_js.HexclaveClientApp[______common_js.hexclaveAppInternalsSymbol].fromClientJson(json);
 		(0, vitest.expect)(___interfaces_client_app_js.HexclaveClientApp[______common_js.hexclaveAppInternalsSymbol].fromClientJson(json)).toBe(first);
 	});
+	(0, vitest.it)("keeps stripping the browser action parameter after a router restores it", () => {
+		vitest.vi.useFakeTimers();
+		const previousWindow = Reflect.get(globalThis, "window");
+		const hadPreviousWindow = Reflect.has(globalThis, "window");
+		let currentHref = "http://localhost:12345/?hexclave_action_id=action-id";
+		Reflect.set(globalThis, "window", {
+			location: { get href() {
+				return currentHref;
+			} },
+			history: {
+				state: null,
+				replaceState: (_state, _title, url) => {
+					currentHref = String(url);
+				}
+			},
+			setTimeout
+		});
+		try {
+			(0, __client_app_impl_js.stripBrowserActionQueryParam)();
+			currentHref = "http://localhost:12345/?hexclave_action_id=action-id";
+			vitest.vi.runAllTimers();
+			(0, vitest.expect)(currentHref).toBe("http://localhost:12345/");
+		} finally {
+			vitest.vi.useRealTimers();
+			if (hadPreviousWindow) Reflect.set(globalThis, "window", previousWindow);
+			else Reflect.deleteProperty(globalThis, "window");
+		}
+	});
 });
 //#endregion
 

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-app-impl.automatic-side-effects.test.js","names":["HexclaveClientApp","hexclaveAppInternalsSymbol"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it } from \"vitest\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { HexclaveClientApp, HexclaveClientAppConstructorOptions, HexclaveClientAppJson } from \"../interfaces/client-app\";\n\nconst baseOptions = {\n  baseUrl: \"http://localhost:12345\",\n  projectId: \"00000000-0000-4000-8000-000000000000\",\n  publishableClientKey: \"stack-pk-test\",\n  tokenStore: \"memory\",\n  redirectMethod: \"none\",\n} satisfies HexclaveClientAppConstructorOptions<true, string>;\n\ndescribe(\"HexclaveClientApp automatic side effects\", () => {\n  it(\"does not inspect browser state when disabled\", () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const previousDocument = Reflect.get(globalThis, \"document\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const hadPreviousDocument = Reflect.has(globalThis, \"document\");\n    const browserGlobal = {};\n    Object.defineProperty(browserGlobal, \"location\", {\n      get() {\n        throw new Error(\"Construction must not inspect the current URL when automatic side effects are disabled\");\n      },\n    });\n\n    Reflect.set(globalThis, \"window\", browserGlobal);\n    Object.defineProperty(globalThis, \"document\", {\n      configurable: true,\n      get() {\n        throw new Error(\"Construction must not access the document when automatic side effects are disabled\");\n      },\n    });\n\n    try {\n      expect(() => new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      })).not.toThrow();\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n      if (hadPreviousDocument) {\n        Object.defineProperty(globalThis, \"document\", {\n          configurable: true,\n          value: previousDocument,\n          writable: true,\n        });\n      } else {\n        Reflect.deleteProperty(globalThis, \"document\");\n      }\n    }\n  });\n\n  it(\"does not initialize automatic side effects when disabled\", () => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      });\n\n      expect(initializationCalls).toBe(0);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it.each([undefined, true])(\"retains automatic initialization when automaticSideEffects is %s\", (automaticSideEffects) => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects,\n      });\n\n      expect(initializationCalls).toBe(1);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it(\"preserves the option through serialization\", () => {\n    const app = new HexclaveClientApp({\n      ...baseOptions,\n      automaticSideEffects: false,\n    });\n\n    expect(app[hexclaveAppInternalsSymbol].toClientJson().automaticSideEffects).toBe(false);\n  });\n\n  it(\"preserves stable identity when deserializing with automatic side effects disabled\", () => {\n    const json: HexclaveClientAppJson<false, string> = {\n      baseUrl: baseOptions.baseUrl,\n      projectId: baseOptions.projectId,\n      publishableClientKey: baseOptions.publishableClientKey,\n      tokenStore: null,\n      redirectMethod: baseOptions.redirectMethod,\n      automaticSideEffects: false,\n      uniqueIdentifier: \"00000000-0000-4000-8000-000000000001\",\n    };\n\n    const first = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n    const second = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n\n    expect(second).toBe(first);\n  });\n});\n"],"mappings":";;;;AAQA,MAAM,cAAc;CAClB,SAAS;CACT,WAAW;CACX,sBAAsB;CACtB,YAAY;CACZ,gBAAgB;AAClB;qBAES,kDAAkD;CACzD,CAAA,GAAA,OAAA,GAAA,CAAG,sDAAsD;EACvD,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,mBAAmB,QAAQ,IAAI,YAAY,UAAU;EAC3D,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,sBAAsB,QAAQ,IAAI,YAAY,UAAU;EAC9D,MAAM,gBAAgB,CAAC;EACvB,OAAO,eAAe,eAAe,YAAY,EAC/C,MAAM;GACJ,MAAM,IAAI,MAAM,wFAAwF;EAC1G,EACF,CAAC;EAED,QAAQ,IAAI,YAAY,UAAU,aAAa;EAC/C,OAAO,eAAe,YAAY,YAAY;GAC5C,cAAc;GACd,MAAM;IACJ,MAAM,IAAI,MAAM,oFAAoF;GACtG;EACF,CAAC;EAED,IAAI;GACF,CAAA,GAAA,OAAA,OAAA,OAAa,IAAIA,4BAAAA,kBAAkB;IACjC,GAAG;IACH,sBAAsB;GACxB,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ;EAClB,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;GAE7C,IAAI,qBACF,OAAO,eAAe,YAAY,YAAY;IAC5C,cAAc;IACd,OAAO;IACP,UAAU;GACZ,CAAC;QAED,QAAQ,eAAe,YAAY,UAAU;EAEjD;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kEAAkE;EACnE,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAIA,4BAAAA,kBAAkB;IACpB,GAAG;IACH,sBAAsB;GACxB,CAAC;GAED,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,OAAA,GAAG,KAAK,CAAC,KAAA,GAAW,IAAI,CAAC,CAAC,CAAC,qEAAqE,yBAAyB;EACvH,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAIA,4BAAAA,kBAAkB;IACpB,GAAG;IACH;GACF,CAAC;GAED,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oDAAoD;EAMrD,CAAA,GAAA,OAAA,OAAA,CAAO,IALSA,4BAAAA,kBAAkB;GAChC,GAAG;GACH,sBAAsB;EACxB,CAES,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,CAAC,KAAK,KAAK;CACxF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F;EAC5F,MAAM,OAA6C;GACjD,SAAS,YAAY;GACrB,WAAW,YAAY;GACvB,sBAAsB,YAAY;GAClC,YAAY;GACZ,gBAAgB,YAAY;GAC5B,sBAAsB;GACtB,kBAAkB;EACpB;EAEA,MAAM,QAAQD,4BAAAA,kBAAkBC,gBAAAA,2BAA2B,CAAC,eAAe,IAAI;EAG/E,CAAA,GAAA,OAAA,OAAA,CAFeD,4BAAAA,kBAAkBC,gBAAAA,2BAA2B,CAAC,eAAe,IAEhE,CAAC,CAAC,CAAC,KAAK,KAAK;CAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"client-app-impl.automatic-side-effects.test.js","names":["HexclaveClientApp","hexclaveAppInternalsSymbol"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { HexclaveClientApp, HexclaveClientAppConstructorOptions, HexclaveClientAppJson } from \"../interfaces/client-app\";\nimport { stripBrowserActionQueryParam } from \"./client-app-impl\";\n\nconst baseOptions = {\n  baseUrl: \"http://localhost:12345\",\n  projectId: \"00000000-0000-4000-8000-000000000000\",\n  publishableClientKey: \"stack-pk-test\",\n  tokenStore: \"memory\",\n  redirectMethod: \"none\",\n} satisfies HexclaveClientAppConstructorOptions<true, string>;\n\ndescribe(\"HexclaveClientApp automatic side effects\", () => {\n  it(\"does not inspect browser state when disabled\", () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const previousDocument = Reflect.get(globalThis, \"document\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const hadPreviousDocument = Reflect.has(globalThis, \"document\");\n    const browserGlobal = {};\n    Object.defineProperty(browserGlobal, \"location\", {\n      get() {\n        throw new Error(\"Construction must not inspect the current URL when automatic side effects are disabled\");\n      },\n    });\n\n    Reflect.set(globalThis, \"window\", browserGlobal);\n    Object.defineProperty(globalThis, \"document\", {\n      configurable: true,\n      get() {\n        throw new Error(\"Construction must not access the document when automatic side effects are disabled\");\n      },\n    });\n\n    try {\n      expect(() => new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      })).not.toThrow();\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n      if (hadPreviousDocument) {\n        Object.defineProperty(globalThis, \"document\", {\n          configurable: true,\n          value: previousDocument,\n          writable: true,\n        });\n      } else {\n        Reflect.deleteProperty(globalThis, \"document\");\n      }\n    }\n  });\n\n  it(\"does not initialize automatic side effects when disabled\", () => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      });\n\n      expect(initializationCalls).toBe(0);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it.each([undefined, true])(\"retains automatic initialization when automaticSideEffects is %s\", (automaticSideEffects) => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects,\n      });\n\n      expect(initializationCalls).toBe(1);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it(\"preserves the option through serialization\", () => {\n    const app = new HexclaveClientApp({\n      ...baseOptions,\n      automaticSideEffects: false,\n    });\n\n    expect(app[hexclaveAppInternalsSymbol].toClientJson().automaticSideEffects).toBe(false);\n  });\n\n  it(\"preserves stable identity when deserializing with automatic side effects disabled\", () => {\n    const json: HexclaveClientAppJson<false, string> = {\n      baseUrl: baseOptions.baseUrl,\n      projectId: baseOptions.projectId,\n      publishableClientKey: baseOptions.publishableClientKey,\n      tokenStore: null,\n      redirectMethod: baseOptions.redirectMethod,\n      automaticSideEffects: false,\n      uniqueIdentifier: \"00000000-0000-4000-8000-000000000001\",\n    };\n\n    const first = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n    const second = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n\n    expect(second).toBe(first);\n  });\n\n  it(\"keeps stripping the browser action parameter after a router restores it\", () => {\n    vi.useFakeTimers();\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    let currentHref = \"http://localhost:12345/?hexclave_action_id=action-id\";\n    const browserGlobal = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n      },\n      history: {\n        state: null,\n        replaceState: (_state: null, _title: string, url: string | URL) => {\n          currentHref = String(url);\n        },\n      },\n      setTimeout,\n    };\n\n    Reflect.set(globalThis, \"window\", browserGlobal);\n    try {\n      stripBrowserActionQueryParam();\n      currentHref = \"http://localhost:12345/?hexclave_action_id=action-id\";\n      vi.runAllTimers();\n      expect(currentHref).toBe(\"http://localhost:12345/\");\n    } finally {\n      vi.useRealTimers();\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n});\n"],"mappings":";;;;;AASA,MAAM,cAAc;CAClB,SAAS;CACT,WAAW;CACX,sBAAsB;CACtB,YAAY;CACZ,gBAAgB;AAClB;qBAES,kDAAkD;CACzD,CAAA,GAAA,OAAA,GAAA,CAAG,sDAAsD;EACvD,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,mBAAmB,QAAQ,IAAI,YAAY,UAAU;EAC3D,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,sBAAsB,QAAQ,IAAI,YAAY,UAAU;EAC9D,MAAM,gBAAgB,CAAC;EACvB,OAAO,eAAe,eAAe,YAAY,EAC/C,MAAM;GACJ,MAAM,IAAI,MAAM,wFAAwF;EAC1G,EACF,CAAC;EAED,QAAQ,IAAI,YAAY,UAAU,aAAa;EAC/C,OAAO,eAAe,YAAY,YAAY;GAC5C,cAAc;GACd,MAAM;IACJ,MAAM,IAAI,MAAM,oFAAoF;GACtG;EACF,CAAC;EAED,IAAI;GACF,CAAA,GAAA,OAAA,OAAA,OAAa,IAAIA,4BAAAA,kBAAkB;IACjC,GAAG;IACH,sBAAsB;GACxB,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ;EAClB,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;GAE7C,IAAI,qBACF,OAAO,eAAe,YAAY,YAAY;IAC5C,cAAc;IACd,OAAO;IACP,UAAU;GACZ,CAAC;QAED,QAAQ,eAAe,YAAY,UAAU;EAEjD;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kEAAkE;EACnE,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAIA,4BAAAA,kBAAkB;IACpB,GAAG;IACH,sBAAsB;GACxB,CAAC;GAED,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,OAAA,GAAG,KAAK,CAAC,KAAA,GAAW,IAAI,CAAC,CAAC,CAAC,qEAAqE,yBAAyB;EACvH,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAIA,4BAAAA,kBAAkB;IACpB,GAAG;IACH;GACF,CAAC;GAED,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oDAAoD;EAMrD,CAAA,GAAA,OAAA,OAAA,CAAO,IALSA,4BAAAA,kBAAkB;GAChC,GAAG;GACH,sBAAsB;EACxB,CAES,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,CAAC,KAAK,KAAK;CACxF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F;EAC5F,MAAM,OAA6C;GACjD,SAAS,YAAY;GACrB,WAAW,YAAY;GACvB,sBAAsB,YAAY;GAClC,YAAY;GACZ,gBAAgB,YAAY;GAC5B,sBAAsB;GACtB,kBAAkB;EACpB;EAEA,MAAM,QAAQD,4BAAAA,kBAAkBC,gBAAAA,2BAA2B,CAAC,eAAe,IAAI;EAG/E,CAAA,GAAA,OAAA,OAAA,CAFeD,4BAAAA,kBAAkBC,gBAAAA,2BAA2B,CAAC,eAAe,IAEhE,CAAC,CAAC,CAAC,KAAK,KAAK;CAC3B,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iFAAiF;EAClF,OAAA,GAAG,cAAc;EACjB,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,IAAI,cAAc;EAgBlB,QAAQ,IAAI,YAAY,UAAU;GAdhC,UAAU,EACR,IAAI,OAAO;IACT,OAAO;GACT,EACF;GACA,SAAS;IACP,OAAO;IACP,eAAe,QAAc,QAAgB,QAAsB;KACjE,cAAc,OAAO,GAAG;IAC1B;GACF;GACA;EAG4C,CAAC;EAC/C,IAAI;GACF,CAAA,GAAA,qBAAA,6BAAA,CAA6B;GAC7B,cAAc;GACd,OAAA,GAAG,aAAa;GAChB,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,KAAK,yBAAyB;EACpD,UAAU;GACR,OAAA,GAAG,cAAc;GACjB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;AACH,CAAC"}

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js

@@ -1,3 +1,4 @@
+let _hexclave_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
 let vitest = require("vitest");
 let ______common_js = require("../../common.js");
 let ___interfaces_client_app_js = require("../interfaces/client-app.js");
@@ -51,6 +52,22 @@ function createMockDocument() {
 		createElement: () => ({})
 	};
 }
+/**
+* Installs a stand-in for `window` with only the parts the code under test touches. `globalThis.window` is typed as a
+* full `Window`, which a hand-written stub can never be, so the assignment goes through `Reflect.set` — the stub's own
+* shape stays checked, unlike with a cast on the object literal.
+*/
+function setMockWindow(mockWindow) {
+	Reflect.set(globalThis, "window", mockWindow);
+}
+/**
+* Calls one of the app's `protected` methods, which are part of the flows under test but not of the public SDK surface.
+*/
+function callProtectedMethod(app, methodName, ...args) {
+	const method = Reflect.get(app, methodName);
+	if (typeof method !== "function") throw new Error(`Expected StackClientApp to have a ${methodName} method in tests.`);
+	return method.apply(app, args);
+}
 (0, vitest.describe)("StackClientApp cross-domain auth", () => {
 	(0, vitest.it)("keeps noRedirectBack same-domain redirects free of redirect-back state", async () => {
 		(0, vitest.expect)(await (0, __redirect_page_urls_js.planRedirectToHandler)({
@@ -115,7 +132,8 @@ function createMockDocument() {
 				tokenStore: "memory",
 				redirectMethod: "none",
 				urls: { signIn: "/handler/sign-in" },
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			})[______common_js.hexclaveAppInternalsSymbol].getRedirectToHandlerUrl("signIn");
 			const resolved = new URL(redirectUrl, "http://localhost");
 			(0, vitest.expect)(resolved.pathname).toBe("/handler/sign-in");
@@ -136,7 +154,8 @@ function createMockDocument() {
 				refreshToken: "stale-refresh-token"
 			},
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const clientInterface = Reflect.get(clientApp, "_interface");
 		const originalSendClientRequest = Reflect.get(clientInterface, "sendClientRequest");
@@ -198,7 +217,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const outerState = "outer-cross-domain-state";
 		const outerCodeChallenge = "abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~";
@@ -250,7 +270,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const tokenStore = Reflect.get(clientApp, "_memoryTokenStore");
 		if (!(tokenStore instanceof _hexclave_shared_dist_utils_stores.Store)) throw new Error("Expected StackClientApp to use a memory token store in this test.");
@@ -316,7 +337,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "cookie",
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const clientInterface = Reflect.get(clientApp, "_interface");
 		const originalFetchNewAccessToken = Reflect.get(clientInterface, "fetchNewAccessToken");
@@ -367,7 +389,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "memory",
 			redirectMethod: "window",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		globalThis.document = createMockDocument();
 		globalThis.window = { location: {
@@ -392,6 +415,99 @@ function createMockDocument() {
 			globalThis.document = previousDocument;
 		}
 	});
+	(0, vitest.it)("reports malformed nested cross-domain auth URLs as setup errors", async () => {
+		const projectId = "00000000-0000-4000-8000-000000000012";
+		const previousWindow = globalThis.window;
+		const previousDocument = globalThis.document;
+		globalThis.document = createMockDocument();
+		const malformedCases = [
+			{
+				description: "redirect URI",
+				currentRefreshTokenId: "source-refresh-token-id",
+				params: {
+					redirect_uri: "not-a-url",
+					state: "nested-state",
+					code_challenge: "nested-code-challenge"
+				}
+			},
+			{
+				description: "after-callback redirect URL",
+				currentRefreshTokenId: "source-refresh-token-id",
+				params: {
+					redirect_uri: "https://source.example.test/handler/account-settings",
+					state: "nested-state",
+					code_challenge: "nested-code-challenge",
+					after_callback_redirect_url: "http://["
+				}
+			},
+			{
+				description: "callback URL",
+				currentRefreshTokenId: null,
+				params: { stack_nested_cross_domain_auth_callback_url: "http://[" }
+			}
+		];
+		try {
+			for (const malformedCase of malformedCases) {
+				const currentUrl = new URL("https://target.example.test/nested-provider");
+				currentUrl.searchParams.set("stack_nested_cross_domain_auth_refresh_token_id", "source-refresh-token-id");
+				for (const [key, value] of Object.entries(malformedCase.params)) currentUrl.searchParams.set(key, value);
+				globalThis.window = previousWindow;
+				const clientApp = new ___interfaces_client_app_js.StackClientApp({
+					baseUrl: "http://localhost:12345",
+					projectId,
+					publishableClientKey: "stack-pk-test",
+					tokenStore: "memory",
+					redirectMethod: "window",
+					noAutomaticPrefetch: true,
+					devTool: false
+				});
+				setMockWindow({ location: { href: currentUrl.toString() } });
+				Reflect.set(clientApp, "_fetchCurrentRefreshTokenIdIfSignedIn", async () => malformedCase.currentRefreshTokenId);
+				Reflect.set(clientApp, "_isTrusted", async () => true);
+				const nestedAuthPromise = callProtectedMethod(clientApp, "_maybeHandleNestedCrossDomainAuth");
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toThrowError(new RegExp(`${malformedCase.description} .* is not a valid absolute URL`));
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toSatisfy((error) => _hexclave_shared_dist_utils_errors.HexclaveSetupError.isSetupError(error));
+			}
+		} finally {
+			globalThis.window = previousWindow;
+			globalThis.document = previousDocument;
+		}
+	});
+	(0, vitest.it)("keeps nested cross-domain auth failures off the page for a handoff that does not own the session", async () => {
+		const projectId = "00000000-0000-4000-8000-000000000013";
+		const previousWindow = globalThis.window;
+		const previousDocument = globalThis.document;
+		globalThis.document = createMockDocument();
+		const craftedRedirectUris = ["https://evil.example.test/handler/account-settings", "not-a-url"];
+		try {
+			for (const craftedRedirectUri of craftedRedirectUris) {
+				const currentUrl = new URL("https://target.example.test/nested-provider");
+				currentUrl.searchParams.set("stack_nested_cross_domain_auth_refresh_token_id", "attacker-chosen-refresh-token-id");
+				currentUrl.searchParams.set("redirect_uri", craftedRedirectUri);
+				currentUrl.searchParams.set("state", "nested-state");
+				currentUrl.searchParams.set("code_challenge", "nested-code-challenge");
+				globalThis.window = previousWindow;
+				const clientApp = new ___interfaces_client_app_js.StackClientApp({
+					baseUrl: "http://localhost:12345",
+					projectId,
+					publishableClientKey: "stack-pk-test",
+					tokenStore: "memory",
+					redirectMethod: "window",
+					noAutomaticPrefetch: true,
+					devTool: false
+				});
+				setMockWindow({ location: { href: currentUrl.toString() } });
+				Reflect.set(clientApp, "_fetchCurrentRefreshTokenIdIfSignedIn", async () => "this-apps-refresh-token-id");
+				Reflect.set(clientApp, "_isTrusted", async () => false);
+				const nestedAuthPromise = callProtectedMethod(clientApp, "_maybeHandleNestedCrossDomainAuth");
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toThrowError(/does not match the requested refresh token ID/);
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toSatisfy((error) => !_hexclave_shared_dist_utils_errors.HexclaveSetupError.isSetupError(error));
+			}
+		} finally {
+			globalThis.window = previousWindow;
+			globalThis.document = previousDocument;
+		}
+	});
 	(0, vitest.it)("passes the construction-time URL to the nested cross-domain auth handler", async () => {
 		const projectId = "00000000-0000-4000-8000-000000000009";
 		const previousWindow = globalThis.window;
@@ -413,7 +529,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			globalThis.window.location.href = strippedUrl.toString();
 			await new Promise((resolve) => setTimeout(resolve, 0));
@@ -468,7 +585,8 @@ function createMockDocument() {
 				tokenStore: "memory",
 				redirectMethod: "window",
 				urls: { default: { type: "hosted" } },
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			await new Promise((resolve) => setTimeout(resolve, 0));
 			await new Promise((resolve) => setTimeout(resolve, 0));
@@ -497,7 +615,8 @@ function createMockDocument() {
 				handler: "/handler",
 				signOut: { type: "hosted" }
 			},
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const signOutSpy = vitest.vi.spyOn(clientApp, "signOut").mockRejectedValue(/* @__PURE__ */ new Error("INTENTIONAL_TEST_ABORT"));
 		try {
@@ -515,7 +634,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		(0, vitest.expect)(() => clientApp.urls.signIn).toThrowError(/app\.urls\.signIn cannot be used when this app is configured to use hosted components.*Use app\.redirectToSignIn\(\) instead/s);
 		(0, vitest.expect)(() => clientApp.urls.signOut).toThrowError(/app\.urls\.signOut cannot be used when this app is configured to use hosted components.*Use app\.redirectToSignOut\(\) instead/s);
@@ -529,7 +649,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { handler: "/custom-handler" },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		}).urls.signIn).toBe("/custom-handler/sign-in");
 	});
 	(0, vitest.it)("keeps default hosted signOut() on the source domain when afterSignOut is not configured", async () => {
@@ -540,7 +661,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const currentHref = "https://demo.stack-auth.com/settings?tab=profile";
 		const clientInterface = Reflect.get(clientApp, "_interface");
@@ -594,7 +716,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			windowMock.location.href = "https://demo.example.test/handler/mfa";
 			(0, vitest.expect)(await clientApp[______common_js.hexclaveAppInternalsSymbol].getRedirectToHandlerUrl("afterSignIn")).toBe("/music?track=1");
@@ -646,7 +769,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			const crossDomainAuthorizeRedirect = "https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state";
 			const createCrossDomainAuthRedirectUrlSpy = vitest.vi.spyOn(clientApp, "_createCrossDomainAuthRedirectUrl").mockResolvedValue(crossDomainAuthorizeRedirect);
@@ -672,7 +796,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "memory",
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const oldAccessToken = createAccessTokenString("old-refresh-token-id");
 		const refreshedOldAccessToken = createAccessTokenString("refreshed-old-refresh-token-id");