@hexclave/next 1.0.105 → 1.0.107

package/dist/lib/hexclave-app/apps/implementations/common.js

@@ -18,8 +18,8 @@ let ____________generated_env_js = require("../../../../generated/env.js");
 let ____________utils_react_js = require("../../../../utils/react.js");
 let ______url_targets_js = require("../../url-targets.js");
 //#region src/lib/hexclave-app/apps/implementations/common.ts
-const clientVersion = "js @hexclave/next@1.0.105";
-if ("js @hexclave/next@1.0.105".startsWith("STACK_COMPILE_TIME"));
+const clientVersion = "js @hexclave/next@1.0.107";
+if ("js @hexclave/next@1.0.107".startsWith("STACK_COMPILE_TIME"));
 const replaceHexclavePortPrefix = (input) => {
 	if (!input) return input;
 	const prefix = ____________generated_env_js.envVars.HEXCLAVE_PORT_PREFIX;

package/dist/lib/hexclave-app/apps/implementations/index.d.ts

@@ -1,4 +1,4 @@
-import { n as _HexclaveServerAppImplIncomplete, r as _HexclaveClientAppImplIncomplete, t as _HexclaveAdminAppImplIncomplete } from "../../../../admin-app-impl-CMKoG26j.js";
+import { n as _HexclaveServerAppImplIncomplete, r as _HexclaveClientAppImplIncomplete, t as _HexclaveAdminAppImplIncomplete } from "../../../../admin-app-impl-BmZQrPYN.js";
 
 //#region src/lib/hexclave-app/apps/implementations/index.d.ts
 declare const _HexclaveAdminAppImpl: typeof _HexclaveAdminAppImplIncomplete, _HexclaveClientAppImpl: typeof _HexclaveClientAppImplIncomplete, _HexclaveServerAppImpl: typeof _HexclaveServerAppImplIncomplete;

package/dist/lib/hexclave-app/apps/implementations/redirect-page-urls.d.ts

@@ -1,2 +1,2 @@
-import { i as planRedirectToHandler, n as crossDomainAuthQueryParams, r as getCrossDomainHandoffParamsFromCurrentUrl, t as CrossDomainHandoffParams } from "../../../../redirect-page-urls-Jfs_-wyq.js";
+import { i as planRedirectToHandler, n as crossDomainAuthQueryParams, r as getCrossDomainHandoffParamsFromCurrentUrl, t as CrossDomainHandoffParams } from "../../../../redirect-page-urls-ofcg3AYr.js";
 export { CrossDomainHandoffParams, crossDomainAuthQueryParams, getCrossDomainHandoffParamsFromCurrentUrl, planRedirectToHandler };

package/dist/lib/hexclave-app/apps/implementations/redirect-page-urls.js

@@ -142,14 +142,20 @@ async function planRedirectToHandler(options) {
 		url: options.rawHandlerUrl
 	};
 	const policy = getHandlerRedirectPolicy(options.handlerName);
-	if (options.noRedirectBack) if (options.handlerName === "signIn") {
-		if (new URL(options.rawHandlerUrl, options.currentUrl).origin === options.currentUrl.origin) return {
-			type: "redirect",
-			url: buildContinuationAwareHandlerUrl({
-				rawHandlerUrl: options.rawHandlerUrl,
-				currentUrl: options.currentUrl
-			})
-		};
+	if (options.noRedirectBack) if (policy === "redirect-back-aware" && options.handlerName !== "signOut") {
+		if (new URL(options.rawHandlerUrl, options.currentUrl).origin === options.currentUrl.origin) {
+			if (options.handlerName !== "signIn") return {
+				type: "redirect",
+				url: options.rawHandlerUrl
+			};
+			return {
+				type: "redirect",
+				url: buildContinuationAwareHandlerUrl({
+					rawHandlerUrl: options.rawHandlerUrl,
+					currentUrl: options.currentUrl
+				})
+			};
+		}
 	} else return {
 		type: "redirect",
 		url: options.rawHandlerUrl
@@ -205,7 +211,7 @@ async function planRedirectToHandler(options) {
 		handlerName: options.handlerName,
 		policy
 	});
-	const afterCallbackRedirectUrlOverride = options.noRedirectBack ? new URL(options.rawHomeUrl, options.currentUrl).toString() : null;
+	const afterCallbackRedirectUrlOverride = options.noRedirectBack ? new URL(options.rawAfterSignInUrl, options.currentUrl).toString() : null;
 	return {
 		type: "redirect",
 		url: await resolveRedirectBackAwareHandlerUrlForRedirect({

package/dist/lib/hexclave-app/apps/implementations/redirect-page-urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-page-urls.js","names":["HexclaveAssertionError"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/redirect-page-urls.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { HexclaveAssertionError } from \"@hexclave/shared/dist/utils/errors\";\nimport { getRelativePart } from \"@hexclave/shared/dist/utils/urls\";\nimport { HandlerUrls } from \"../../common\";\n\nexport const crossDomainAuthQueryParams = {\n  marker: \"hexclave_cross_domain_auth\",\n  state: \"hexclave_cross_domain_state\",\n  codeChallenge: \"hexclave_cross_domain_code_challenge\",\n  afterCallbackRedirectUrl: \"hexclave_cross_domain_after_callback_redirect_url\",\n} as const;\n\ntype CrossDomainAuthQueryParamKey = keyof typeof crossDomainAuthQueryParams;\n\nfunction getCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey): string | null {\n  return params.get(crossDomainAuthQueryParams[key]);\n}\n\nfunction hasCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey): boolean {\n  return params.has(crossDomainAuthQueryParams[key]);\n}\n\nfunction setCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey, value: string): void {\n  params.set(crossDomainAuthQueryParams[key], value);\n}\n\nexport type CrossDomainHandoffParams = {\n  state: string,\n  codeChallenge: string,\n};\n\nexport function getCrossDomainHandoffParamsFromCurrentUrl(currentUrl: URL): CrossDomainHandoffParams | null {\n  const state = getCrossDomainParam(currentUrl.searchParams, \"state\");\n  const codeChallenge = getCrossDomainParam(currentUrl.searchParams, \"codeChallenge\");\n  if (state == null || codeChallenge == null) {\n    return null;\n  }\n  return { state, codeChallenge };\n}\n\ntype RedirectBackAwareHandlerName = \"signIn\" | \"signUp\" | \"onboarding\" | \"signOut\";\ntype ContinuationAwareHandlerName = \"forgotPassword\" | \"passwordReset\";\ntype HandlerRedirectPolicy = \"none\" | \"redirect-back-aware\" | \"continuation-aware\" | \"after-auth-return\";\n\ntype CrossDomainHandoffParamsMaybeMissing = {\n  state: string | null,\n  codeChallenge: string | null,\n  afterCallbackRedirectUrl: string | null,\n};\n\nfunction isRedirectBackAwareHandlerName(handlerName: keyof HandlerUrls): handlerName is RedirectBackAwareHandlerName {\n  return handlerName === \"signIn\"\n    || handlerName === \"signUp\"\n    || handlerName === \"onboarding\"\n    || handlerName === \"signOut\";\n}\n\nfunction isContinuationAwareHandlerName(handlerName: keyof HandlerUrls): handlerName is ContinuationAwareHandlerName {\n  return handlerName === \"forgotPassword\" || handlerName === \"passwordReset\";\n}\n\nfunction hasCrossDomainHandoffParams(url: URL): boolean {\n  return (\n    hasCrossDomainParam(url.searchParams, \"state\")\n    && hasCrossDomainParam(url.searchParams, \"codeChallenge\")\n    && hasCrossDomainParam(url.searchParams, \"afterCallbackRedirectUrl\")\n  );\n}\n\nfunction buildCrossDomainAuthCallbackUrl(options: {\n  currentUrl: URL,\n  localOAuthCallbackUrl: string,\n  state?: string,\n  codeChallenge?: string,\n  afterCallbackRedirectUrl?: string,\n}): URL {\n  const localOAuthCallbackUrl = new URL(options.localOAuthCallbackUrl, options.currentUrl);\n  if (localOAuthCallbackUrl.origin !== options.currentUrl.origin) {\n    throw new HexclaveAssertionError(\"Cross-domain auth callback URL must stay on the current origin\", {\n      localOAuthCallbackUrl: localOAuthCallbackUrl.toString(),\n      currentUrl: options.currentUrl.toString(),\n    });\n  }\n  setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"marker\", \"1\");\n  if (options.state != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"state\", options.state);\n  }\n  if (options.codeChallenge != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"codeChallenge\", options.codeChallenge);\n  }\n  if (options.afterCallbackRedirectUrl != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"afterCallbackRedirectUrl\", options.afterCallbackRedirectUrl);\n  }\n  return localOAuthCallbackUrl;\n}\n\nfunction buildRedirectBackAwareHandlerUrl(options: {\n  handlerName: RedirectBackAwareHandlerName,\n  rawHandlerUrl: string,\n  currentUrl: URL,\n  crossDomainHandoffParams: CrossDomainHandoffParams | null,\n  localOAuthCallbackUrl: string,\n  noRedirectBack: boolean,\n  afterCallbackRedirectUrlOverride: string | null,\n}): string {\n  const nextUrl = new URL(options.rawHandlerUrl, options.currentUrl);\n  // Preserve after_auth_return_to verbatim (not a rebranded param).\n  const currentAfterAuthReturnTo = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n  if (!options.noRedirectBack && currentAfterAuthReturnTo != null && !nextUrl.searchParams.has(\"after_auth_return_to\")) {\n    nextUrl.searchParams.set(\"after_auth_return_to\", currentAfterAuthReturnTo);\n  }\n  for (const preservedParam of [\"state\", \"codeChallenge\", \"afterCallbackRedirectUrl\"] as const) {\n    if (options.noRedirectBack && preservedParam === \"afterCallbackRedirectUrl\") {\n      continue;\n    }\n    const currentValue = getCrossDomainParam(options.currentUrl.searchParams, preservedParam);\n    if (currentValue != null && !hasCrossDomainParam(nextUrl.searchParams, preservedParam)) {\n      setCrossDomainParam(nextUrl.searchParams, preservedParam, currentValue);\n    }\n  }\n\n  if (options.handlerName === \"signOut\") {\n    if (!nextUrl.searchParams.has(\"after_auth_return_to\")) {\n      if (options.currentUrl.protocol === nextUrl.protocol && options.currentUrl.host === nextUrl.host) {\n        nextUrl.searchParams.set(\"after_auth_return_to\", getRelativePart(options.currentUrl));\n      } else {\n        nextUrl.searchParams.set(\"after_auth_return_to\", options.currentUrl.toString());\n      }\n    }\n    return nextUrl.origin === options.currentUrl.origin ? getRelativePart(nextUrl) : nextUrl.toString();\n  }\n\n  const isCrossDomainHandlerRedirect = options.currentUrl.origin !== nextUrl.origin;\n  if (isCrossDomainHandlerRedirect) {\n    if (!hasCrossDomainHandoffParams(nextUrl)) {\n      const inheritedAfterAuthReturnTo = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n      const afterCallbackRedirectUrl = options.afterCallbackRedirectUrlOverride ?? (\n        inheritedAfterAuthReturnTo\n          ? new URL(inheritedAfterAuthReturnTo, options.currentUrl).toString()\n          : options.currentUrl.toString()\n      );\n      const handoffParams = options.crossDomainHandoffParams\n        ?? getCrossDomainHandoffParamsFromCurrentUrl(options.currentUrl);\n      const callbackUrl = buildCrossDomainAuthCallbackUrl({\n        currentUrl: options.currentUrl,\n        localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n        state: handoffParams?.state,\n        codeChallenge: handoffParams?.codeChallenge,\n        afterCallbackRedirectUrl,\n      });\n\n      nextUrl.searchParams.set(\"after_auth_return_to\", callbackUrl.toString());\n      setCrossDomainParam(nextUrl.searchParams, \"afterCallbackRedirectUrl\", afterCallbackRedirectUrl);\n      if (handoffParams != null) {\n        setCrossDomainParam(nextUrl.searchParams, \"state\", handoffParams.state);\n        setCrossDomainParam(nextUrl.searchParams, \"codeChallenge\", handoffParams.codeChallenge);\n      }\n    }\n  } else if (!options.noRedirectBack && options.currentUrl.protocol === nextUrl.protocol && options.currentUrl.host === nextUrl.host && !nextUrl.searchParams.has(\"after_auth_return_to\")) {\n    nextUrl.searchParams.set(\"after_auth_return_to\", getRelativePart(options.currentUrl));\n  }\n\n  return nextUrl.origin === options.currentUrl.origin ? getRelativePart(nextUrl) : nextUrl.toString();\n}\n\n/**\n * Carries an auth flow's existing return state without ever making the current page the return\n * target. This distinction is important for password flows: forgot-password and password-reset\n * are continuation pages, not destinations customers should return to after signing in.\n */\nfunction buildContinuationAwareHandlerUrl(options: {\n  rawHandlerUrl: string,\n  currentUrl: URL,\n}): string {\n  const nextUrl = new URL(options.rawHandlerUrl, options.currentUrl);\n  const inheritedAfterAuthReturnTo = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n  if (inheritedAfterAuthReturnTo != null && !nextUrl.searchParams.has(\"after_auth_return_to\")) {\n    nextUrl.searchParams.set(\"after_auth_return_to\", inheritedAfterAuthReturnTo);\n  }\n  for (const preservedParam of [\"state\", \"codeChallenge\", \"afterCallbackRedirectUrl\"] as const) {\n    const currentValue = getCrossDomainParam(options.currentUrl.searchParams, preservedParam);\n    if (currentValue != null && !hasCrossDomainParam(nextUrl.searchParams, preservedParam)) {\n      setCrossDomainParam(nextUrl.searchParams, preservedParam, currentValue);\n    }\n  }\n  return nextUrl.origin === options.currentUrl.origin ? getRelativePart(nextUrl) : nextUrl.toString();\n}\n\nfunction getHandlerRedirectPolicy(handlerName: keyof HandlerUrls): HandlerRedirectPolicy {\n  if (handlerName === \"afterSignIn\" || handlerName === \"afterSignUp\") {\n    return \"after-auth-return\";\n  }\n  if (isRedirectBackAwareHandlerName(handlerName)) {\n    return \"redirect-back-aware\";\n  }\n  if (isContinuationAwareHandlerName(handlerName)) {\n    return \"continuation-aware\";\n  }\n  return \"none\";\n}\n\ntype RedirectToHandlerPlan =\n  | { type: \"redirect\", url: string }\n  | {\n    type: \"cross-domain-authorize\",\n    redirectUri: string,\n    state: string,\n    codeChallenge: string,\n    afterCallbackRedirectUrl: string,\n  };\n\n\nasync function resolveRedirectBackAwareHandlerUrlForRedirect(options: {\n  handlerName: RedirectBackAwareHandlerName,\n  rawHandlerUrl: string,\n  currentUrl: URL,\n  localOAuthCallbackUrl: string,\n  getCrossDomainHandoffParams: (currentUrl: URL) => Promise<CrossDomainHandoffParams>,\n  noRedirectBack: boolean,\n  afterCallbackRedirectUrlOverride: string | null,\n}): Promise<string> {\n  const initial = buildRedirectBackAwareHandlerUrl({\n    handlerName: options.handlerName,\n    rawHandlerUrl: options.rawHandlerUrl,\n    currentUrl: options.currentUrl,\n    crossDomainHandoffParams: null,\n    localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n    noRedirectBack: options.noRedirectBack,\n    afterCallbackRedirectUrlOverride: options.afterCallbackRedirectUrlOverride,\n  });\n  if (options.handlerName === \"signOut\") {\n    return initial;\n  }\n\n  const initialTarget = new URL(initial, options.currentUrl);\n  const isCrossDomainHandlerRedirect = options.currentUrl.origin !== initialTarget.origin;\n  if (!isCrossDomainHandlerRedirect || hasCrossDomainHandoffParams(initialTarget)) {\n    return initial;\n  }\n\n  const crossDomainHandoffParams = await options.getCrossDomainHandoffParams(options.currentUrl);\n  return buildRedirectBackAwareHandlerUrl({\n    handlerName: options.handlerName,\n    rawHandlerUrl: options.rawHandlerUrl,\n    currentUrl: options.currentUrl,\n    crossDomainHandoffParams,\n    localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n    noRedirectBack: options.noRedirectBack,\n    afterCallbackRedirectUrlOverride: options.afterCallbackRedirectUrlOverride,\n  });\n}\n\nexport async function planRedirectToHandler(options: {\n  handlerName: keyof HandlerUrls,\n  rawHandlerUrl: string,\n  noRedirectBack: boolean,\n  currentUrl: URL | null,\n  getLocalOAuthCallbackUrl: () => string,\n  rawHomeUrl: string,\n  getCrossDomainHandoffParams: (currentUrl: URL) => Promise<CrossDomainHandoffParams>,\n}): Promise<RedirectToHandlerPlan> {\n  if (options.currentUrl == null) {\n    return { type: \"redirect\", url: options.rawHandlerUrl };\n  }\n\n  const policy = getHandlerRedirectPolicy(options.handlerName);\n  if (options.noRedirectBack) {\n    // Sign-in uses noRedirectBack from password-reset pages to avoid capturing the reset page.\n    // Same-domain sign-in must still carry an already-inherited continuation. Cross-domain\n    // sign-in falls through to the redirect-back-aware planner below because it needs to return\n    // through the source app's callback before continuing to home.\n    if (options.handlerName === \"signIn\") {\n      const signInTarget = new URL(options.rawHandlerUrl, options.currentUrl);\n      if (signInTarget.origin === options.currentUrl.origin) {\n        return {\n          type: \"redirect\",\n          url: buildContinuationAwareHandlerUrl({\n            rawHandlerUrl: options.rawHandlerUrl,\n            currentUrl: options.currentUrl,\n          }),\n        };\n      }\n    } else {\n      // Other handlers retain the historical noRedirectBack behavior, including\n      // afterSignIn/afterSignUp ignoring all return state.\n      return {\n        type: \"redirect\",\n        url: options.rawHandlerUrl,\n      };\n    }\n  }\n  if (policy === \"none\") {\n    return { type: \"redirect\", url: options.rawHandlerUrl };\n  }\n  if (policy === \"continuation-aware\") {\n    return {\n      type: \"redirect\",\n      url: buildContinuationAwareHandlerUrl({\n        rawHandlerUrl: options.rawHandlerUrl,\n        currentUrl: options.currentUrl,\n      }),\n    };\n  }\n\n  if (policy === \"after-auth-return\") {\n    if (options.noRedirectBack) {\n      return { type: \"redirect\", url: options.rawHandlerUrl };\n    }\n    const redirectBackUrl = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n    if (redirectBackUrl == null) {\n      return { type: \"redirect\", url: options.rawHandlerUrl };\n    }\n    const redirectBackTarget = new URL(redirectBackUrl, options.currentUrl);\n    const crossDomainHandoff = getCrossDomainHandoffForRedirect({\n      currentUrl: options.currentUrl,\n      redirectBackTarget,\n    });\n    if (crossDomainHandoff == null) {\n      return { type: \"redirect\", url: redirectBackUrl };\n    }\n    let state = crossDomainHandoff.handoffParams.state;\n    let codeChallenge = crossDomainHandoff.handoffParams.codeChallenge;\n    let afterCallbackRedirectUrl = crossDomainHandoff.handoffParams.afterCallbackRedirectUrl;\n    if (state == null || codeChallenge == null) {\n      const generatedHandoffParams = await options.getCrossDomainHandoffParams(options.currentUrl);\n      state ??= generatedHandoffParams.state;\n      codeChallenge ??= generatedHandoffParams.codeChallenge;\n    }\n    afterCallbackRedirectUrl ??= options.currentUrl.toString();\n    return {\n      type: \"cross-domain-authorize\",\n      redirectUri: crossDomainHandoff.redirectBackTarget.toString(),\n      state,\n      codeChallenge,\n      afterCallbackRedirectUrl,\n    };\n  }\n\n  if (\n    options.handlerName !== \"signIn\"\n    && options.handlerName !== \"signUp\"\n    && options.handlerName !== \"onboarding\"\n    && options.handlerName !== \"signOut\"\n  ) {\n    throw new HexclaveAssertionError(\"Unexpected redirect-back-aware handler policy mismatch\", {\n      handlerName: options.handlerName,\n      policy,\n    });\n  }\n\n  // noRedirectBack suppresses the initiating deep link, not the return journey. Cross-domain auth\n  // still needs to return through the source app's callback, but its final destination is home.\n  const afterCallbackRedirectUrlOverride = options.noRedirectBack\n    ? new URL(options.rawHomeUrl, options.currentUrl).toString()\n    : null;\n\n  return {\n    type: \"redirect\",\n    url: await resolveRedirectBackAwareHandlerUrlForRedirect({\n      handlerName: options.handlerName,\n      rawHandlerUrl: options.rawHandlerUrl,\n      currentUrl: options.currentUrl,\n      localOAuthCallbackUrl: options.getLocalOAuthCallbackUrl(),\n      getCrossDomainHandoffParams: options.getCrossDomainHandoffParams,\n      noRedirectBack: options.noRedirectBack,\n      afterCallbackRedirectUrlOverride,\n    }),\n  };\n}\n\nfunction readCrossDomainHandoffParams(currentUrl: URL, redirectBackTarget: URL): CrossDomainHandoffParamsMaybeMissing {\n  // Hexclave rebrand: accept either param name from both URLs.\n  const state = getCrossDomainParam(currentUrl.searchParams, \"state\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"state\");\n  const codeChallenge = getCrossDomainParam(currentUrl.searchParams, \"codeChallenge\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"codeChallenge\");\n  const afterCallbackRedirectUrl = getCrossDomainParam(currentUrl.searchParams, \"afterCallbackRedirectUrl\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"afterCallbackRedirectUrl\");\n  return {\n    state,\n    codeChallenge,\n    afterCallbackRedirectUrl,\n  };\n}\n\nfunction resolveCrossDomainRedirectBackTarget(options: {\n  currentUrl: URL,\n  redirectBackTarget: URL,\n  handoffParams: CrossDomainHandoffParamsMaybeMissing,\n}): URL | null {\n  if (options.redirectBackTarget.origin !== options.currentUrl.origin) {\n    return options.redirectBackTarget;\n  }\n  if (\n    options.handoffParams.state == null\n    || options.handoffParams.codeChallenge == null\n    || options.handoffParams.afterCallbackRedirectUrl == null\n  ) {\n    return null;\n  }\n  const afterCallbackRedirectTarget = new URL(options.handoffParams.afterCallbackRedirectUrl, options.currentUrl);\n  if (afterCallbackRedirectTarget.origin === options.currentUrl.origin) {\n    return null;\n  }\n  return new URL(\n    `${options.redirectBackTarget.pathname}${options.redirectBackTarget.search}${options.redirectBackTarget.hash}`,\n    afterCallbackRedirectTarget.origin,\n  );\n}\n\nfunction getCrossDomainHandoffForRedirect(options: {\n  currentUrl: URL,\n  redirectBackTarget: URL,\n}): {\n  redirectBackTarget: URL,\n  handoffParams: CrossDomainHandoffParamsMaybeMissing,\n} | null {\n  const handoffParams = readCrossDomainHandoffParams(options.currentUrl, options.redirectBackTarget);\n  const crossDomainRedirectBackTarget = resolveCrossDomainRedirectBackTarget({\n    currentUrl: options.currentUrl,\n    redirectBackTarget: options.redirectBackTarget,\n    handoffParams,\n  });\n  if (crossDomainRedirectBackTarget == null) {\n    return null;\n  }\n  return {\n    redirectBackTarget: crossDomainRedirectBackTarget,\n    handoffParams,\n  };\n}\n"],"mappings":";;;;AAQA,MAAa,6BAA6B;CACxC,QAAQ;CACR,OAAO;CACP,eAAe;CACf,0BAA0B;AAC5B;AAIA,SAAS,oBAAoB,QAAyB,KAAkD;CACtG,OAAO,OAAO,IAAI,2BAA2B,IAAI;AACnD;AAEA,SAAS,oBAAoB,QAAyB,KAA4C;CAChG,OAAO,OAAO,IAAI,2BAA2B,IAAI;AACnD;AAEA,SAAS,oBAAoB,QAAyB,KAAmC,OAAqB;CAC5G,OAAO,IAAI,2BAA2B,MAAM,KAAK;AACnD;AAOA,SAAgB,0CAA0C,YAAkD;CAC1G,MAAM,QAAQ,oBAAoB,WAAW,cAAc,OAAO;CAClE,MAAM,gBAAgB,oBAAoB,WAAW,cAAc,eAAe;CAClF,IAAI,SAAS,QAAQ,iBAAiB,MACpC,OAAO;CAET,OAAO;EAAE;EAAO;CAAc;AAChC;AAYA,SAAS,+BAA+B,aAA6E;CACnH,OAAO,gBAAgB,YAClB,gBAAgB,YAChB,gBAAgB,gBAChB,gBAAgB;AACvB;AAEA,SAAS,+BAA+B,aAA6E;CACnH,OAAO,gBAAgB,oBAAoB,gBAAgB;AAC7D;AAEA,SAAS,4BAA4B,KAAmB;CACtD,OACE,oBAAoB,IAAI,cAAc,OAAO,KAC1C,oBAAoB,IAAI,cAAc,eAAe,KACrD,oBAAoB,IAAI,cAAc,0BAA0B;AAEvE;AAEA,SAAS,gCAAgC,SAMjC;CACN,MAAM,wBAAwB,IAAI,IAAI,QAAQ,uBAAuB,QAAQ,UAAU;CACvF,IAAI,sBAAsB,WAAW,QAAQ,WAAW,QACtD,MAAM,IAAIA,mCAAAA,uBAAuB,kEAAkE;EACjG,uBAAuB,sBAAsB,SAAS;EACtD,YAAY,QAAQ,WAAW,SAAS;CAC1C,CAAC;CAEH,oBAAoB,sBAAsB,cAAc,UAAU,GAAG;CACrE,IAAI,QAAQ,SAAS,MACnB,oBAAoB,sBAAsB,cAAc,SAAS,QAAQ,KAAK;CAEhF,IAAI,QAAQ,iBAAiB,MAC3B,oBAAoB,sBAAsB,cAAc,iBAAiB,QAAQ,aAAa;CAEhG,IAAI,QAAQ,4BAA4B,MACtC,oBAAoB,sBAAsB,cAAc,4BAA4B,QAAQ,wBAAwB;CAEtH,OAAO;AACT;AAEA,SAAS,iCAAiC,SAQ/B;CACT,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,QAAQ,UAAU;CAEjE,MAAM,2BAA2B,QAAQ,WAAW,aAAa,IAAI,sBAAsB;CAC3F,IAAI,CAAC,QAAQ,kBAAkB,4BAA4B,QAAQ,CAAC,QAAQ,aAAa,IAAI,sBAAsB,GACjH,QAAQ,aAAa,IAAI,wBAAwB,wBAAwB;CAE3E,KAAK,MAAM,kBAAkB;EAAC;EAAS;EAAiB;CAA0B,GAAY;EAC5F,IAAI,QAAQ,kBAAkB,mBAAmB,4BAC/C;EAEF,MAAM,eAAe,oBAAoB,QAAQ,WAAW,cAAc,cAAc;EACxF,IAAI,gBAAgB,QAAQ,CAAC,oBAAoB,QAAQ,cAAc,cAAc,GACnF,oBAAoB,QAAQ,cAAc,gBAAgB,YAAY;CAE1E;CAEA,IAAI,QAAQ,gBAAgB,WAAW;EACrC,IAAI,CAAC,QAAQ,aAAa,IAAI,sBAAsB,GAClD,IAAI,QAAQ,WAAW,aAAa,QAAQ,YAAY,QAAQ,WAAW,SAAS,QAAQ,MAC1F,QAAQ,aAAa,IAAI,yBAAA,GAAA,iCAAA,gBAAA,CAAwC,QAAQ,UAAU,CAAC;OAEpF,QAAQ,aAAa,IAAI,wBAAwB,QAAQ,WAAW,SAAS,CAAC;EAGlF,OAAO,QAAQ,WAAW,QAAQ,WAAW,UAAA,GAAA,iCAAA,gBAAA,CAAyB,OAAO,IAAI,QAAQ,SAAS;CACpG;CAGA,IADqC,QAAQ,WAAW,WAAW,QAAQ;MAErE,CAAC,4BAA4B,OAAO,GAAG;GACzC,MAAM,6BAA6B,QAAQ,WAAW,aAAa,IAAI,sBAAsB;GAC7F,MAAM,2BAA2B,QAAQ,qCACvC,6BACI,IAAI,IAAI,4BAA4B,QAAQ,UAAU,CAAC,CAAC,SAAS,IACjE,QAAQ,WAAW,SAAS;GAElC,MAAM,gBAAgB,QAAQ,4BACzB,0CAA0C,QAAQ,UAAU;GACjE,MAAM,cAAc,gCAAgC;IAClD,YAAY,QAAQ;IACpB,uBAAuB,QAAQ;IAC/B,OAAO,eAAe;IACtB,eAAe,eAAe;IAC9B;GACF,CAAC;GAED,QAAQ,aAAa,IAAI,wBAAwB,YAAY,SAAS,CAAC;GACvE,oBAAoB,QAAQ,cAAc,4BAA4B,wBAAwB;GAC9F,IAAI,iBAAiB,MAAM;IACzB,oBAAoB,QAAQ,cAAc,SAAS,cAAc,KAAK;IACtE,oBAAoB,QAAQ,cAAc,iBAAiB,cAAc,aAAa;GACxF;EACF;QACK,IAAI,CAAC,QAAQ,kBAAkB,QAAQ,WAAW,aAAa,QAAQ,YAAY,QAAQ,WAAW,SAAS,QAAQ,QAAQ,CAAC,QAAQ,aAAa,IAAI,sBAAsB,GACpL,QAAQ,aAAa,IAAI,yBAAA,GAAA,iCAAA,gBAAA,CAAwC,QAAQ,UAAU,CAAC;CAGtF,OAAO,QAAQ,WAAW,QAAQ,WAAW,UAAA,GAAA,iCAAA,gBAAA,CAAyB,OAAO,IAAI,QAAQ,SAAS;AACpG;;;;;;AAOA,SAAS,iCAAiC,SAG/B;CACT,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,QAAQ,UAAU;CACjE,MAAM,6BAA6B,QAAQ,WAAW,aAAa,IAAI,sBAAsB;CAC7F,IAAI,8BAA8B,QAAQ,CAAC,QAAQ,aAAa,IAAI,sBAAsB,GACxF,QAAQ,aAAa,IAAI,wBAAwB,0BAA0B;CAE7E,KAAK,MAAM,kBAAkB;EAAC;EAAS;EAAiB;CAA0B,GAAY;EAC5F,MAAM,eAAe,oBAAoB,QAAQ,WAAW,cAAc,cAAc;EACxF,IAAI,gBAAgB,QAAQ,CAAC,oBAAoB,QAAQ,cAAc,cAAc,GACnF,oBAAoB,QAAQ,cAAc,gBAAgB,YAAY;CAE1E;CACA,OAAO,QAAQ,WAAW,QAAQ,WAAW,UAAA,GAAA,iCAAA,gBAAA,CAAyB,OAAO,IAAI,QAAQ,SAAS;AACpG;AAEA,SAAS,yBAAyB,aAAuD;CACvF,IAAI,gBAAgB,iBAAiB,gBAAgB,eACnD,OAAO;CAET,IAAI,+BAA+B,WAAW,GAC5C,OAAO;CAET,IAAI,+BAA+B,WAAW,GAC5C,OAAO;CAET,OAAO;AACT;AAaA,eAAe,8CAA8C,SAQzC;CAClB,MAAM,UAAU,iCAAiC;EAC/C,aAAa,QAAQ;EACrB,eAAe,QAAQ;EACvB,YAAY,QAAQ;EACpB,0BAA0B;EAC1B,uBAAuB,QAAQ;EAC/B,gBAAgB,QAAQ;EACxB,kCAAkC,QAAQ;CAC5C,CAAC;CACD,IAAI,QAAQ,gBAAgB,WAC1B,OAAO;CAGT,MAAM,gBAAgB,IAAI,IAAI,SAAS,QAAQ,UAAU;CAEzD,IAAI,EADiC,QAAQ,WAAW,WAAW,cAAc,WAC5C,4BAA4B,aAAa,GAC5E,OAAO;CAGT,MAAM,2BAA2B,MAAM,QAAQ,4BAA4B,QAAQ,UAAU;CAC7F,OAAO,iCAAiC;EACtC,aAAa,QAAQ;EACrB,eAAe,QAAQ;EACvB,YAAY,QAAQ;EACpB;EACA,uBAAuB,QAAQ;EAC/B,gBAAgB,QAAQ;EACxB,kCAAkC,QAAQ;CAC5C,CAAC;AACH;AAEA,eAAsB,sBAAsB,SAQT;CACjC,IAAI,QAAQ,cAAc,MACxB,OAAO;EAAE,MAAM;EAAY,KAAK,QAAQ;CAAc;CAGxD,MAAM,SAAS,yBAAyB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,gBAKV,IAAI,QAAQ,gBAAgB;MAEtB,IADqB,IAAI,QAAQ,eAAe,QAAQ,UAC7C,CAAC,CAAC,WAAW,QAAQ,WAAW,QAC7C,OAAO;GACL,MAAM;GACN,KAAK,iCAAiC;IACpC,eAAe,QAAQ;IACvB,YAAY,QAAQ;GACtB,CAAC;EACH;CAAA,OAKF,OAAO;EACL,MAAM;EACN,KAAK,QAAQ;CACf;CAGJ,IAAI,WAAW,QACb,OAAO;EAAE,MAAM;EAAY,KAAK,QAAQ;CAAc;CAExD,IAAI,WAAW,sBACb,OAAO;EACL,MAAM;EACN,KAAK,iCAAiC;GACpC,eAAe,QAAQ;GACvB,YAAY,QAAQ;EACtB,CAAC;CACH;CAGF,IAAI,WAAW,qBAAqB;EAClC,IAAI,QAAQ,gBACV,OAAO;GAAE,MAAM;GAAY,KAAK,QAAQ;EAAc;EAExD,MAAM,kBAAkB,QAAQ,WAAW,aAAa,IAAI,sBAAsB;EAClF,IAAI,mBAAmB,MACrB,OAAO;GAAE,MAAM;GAAY,KAAK,QAAQ;EAAc;EAExD,MAAM,qBAAqB,IAAI,IAAI,iBAAiB,QAAQ,UAAU;EACtE,MAAM,qBAAqB,iCAAiC;GAC1D,YAAY,QAAQ;GACpB;EACF,CAAC;EACD,IAAI,sBAAsB,MACxB,OAAO;GAAE,MAAM;GAAY,KAAK;EAAgB;EAElD,IAAI,QAAQ,mBAAmB,cAAc;EAC7C,IAAI,gBAAgB,mBAAmB,cAAc;EACrD,IAAI,2BAA2B,mBAAmB,cAAc;EAChE,IAAI,SAAS,QAAQ,iBAAiB,MAAM;GAC1C,MAAM,yBAAyB,MAAM,QAAQ,4BAA4B,QAAQ,UAAU;GAC3F,UAAU,uBAAuB;GACjC,kBAAkB,uBAAuB;EAC3C;EACA,6BAA6B,QAAQ,WAAW,SAAS;EACzD,OAAO;GACL,MAAM;GACN,aAAa,mBAAmB,mBAAmB,SAAS;GAC5D;GACA;GACA;EACF;CACF;CAEA,IACE,QAAQ,gBAAgB,YACrB,QAAQ,gBAAgB,YACxB,QAAQ,gBAAgB,gBACxB,QAAQ,gBAAgB,WAE3B,MAAM,IAAIA,mCAAAA,uBAAuB,0DAA0D;EACzF,aAAa,QAAQ;EACrB;CACF,CAAC;CAKH,MAAM,mCAAmC,QAAQ,iBAC7C,IAAI,IAAI,QAAQ,YAAY,QAAQ,UAAU,CAAC,CAAC,SAAS,IACzD;CAEJ,OAAO;EACL,MAAM;EACN,KAAK,MAAM,8CAA8C;GACvD,aAAa,QAAQ;GACrB,eAAe,QAAQ;GACvB,YAAY,QAAQ;GACpB,uBAAuB,QAAQ,yBAAyB;GACxD,6BAA6B,QAAQ;GACrC,gBAAgB,QAAQ;GACxB;EACF,CAAC;CACH;AACF;AAEA,SAAS,6BAA6B,YAAiB,oBAA+D;CAQpH,OAAO;EACL,OAPY,oBAAoB,WAAW,cAAc,OAAO,KAC7D,oBAAoB,mBAAmB,cAAc,OAAO;EAO/D,eANoB,oBAAoB,WAAW,cAAc,eAAe,KAC7E,oBAAoB,mBAAmB,cAAc,eAAe;EAMvE,0BAL+B,oBAAoB,WAAW,cAAc,0BAA0B,KACnG,oBAAoB,mBAAmB,cAAc,0BAA0B;CAKpF;AACF;AAEA,SAAS,qCAAqC,SAI/B;CACb,IAAI,QAAQ,mBAAmB,WAAW,QAAQ,WAAW,QAC3D,OAAO,QAAQ;CAEjB,IACE,QAAQ,cAAc,SAAS,QAC5B,QAAQ,cAAc,iBAAiB,QACvC,QAAQ,cAAc,4BAA4B,MAErD,OAAO;CAET,MAAM,8BAA8B,IAAI,IAAI,QAAQ,cAAc,0BAA0B,QAAQ,UAAU;CAC9G,IAAI,4BAA4B,WAAW,QAAQ,WAAW,QAC5D,OAAO;CAET,OAAO,IAAI,IACT,GAAG,QAAQ,mBAAmB,WAAW,QAAQ,mBAAmB,SAAS,QAAQ,mBAAmB,QACxG,4BAA4B,MAC9B;AACF;AAEA,SAAS,iCAAiC,SAMjC;CACP,MAAM,gBAAgB,6BAA6B,QAAQ,YAAY,QAAQ,kBAAkB;CACjG,MAAM,gCAAgC,qCAAqC;EACzE,YAAY,QAAQ;EACpB,oBAAoB,QAAQ;EAC5B;CACF,CAAC;CACD,IAAI,iCAAiC,MACnC,OAAO;CAET,OAAO;EACL,oBAAoB;EACpB;CACF;AACF"}
+{"version":3,"file":"redirect-page-urls.js","names":["HexclaveAssertionError"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/redirect-page-urls.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { HexclaveAssertionError } from \"@hexclave/shared/dist/utils/errors\";\nimport { getRelativePart } from \"@hexclave/shared/dist/utils/urls\";\nimport { HandlerUrls } from \"../../common\";\n\nexport const crossDomainAuthQueryParams = {\n  marker: \"hexclave_cross_domain_auth\",\n  state: \"hexclave_cross_domain_state\",\n  codeChallenge: \"hexclave_cross_domain_code_challenge\",\n  afterCallbackRedirectUrl: \"hexclave_cross_domain_after_callback_redirect_url\",\n} as const;\n\ntype CrossDomainAuthQueryParamKey = keyof typeof crossDomainAuthQueryParams;\n\nfunction getCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey): string | null {\n  return params.get(crossDomainAuthQueryParams[key]);\n}\n\nfunction hasCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey): boolean {\n  return params.has(crossDomainAuthQueryParams[key]);\n}\n\nfunction setCrossDomainParam(params: URLSearchParams, key: CrossDomainAuthQueryParamKey, value: string): void {\n  params.set(crossDomainAuthQueryParams[key], value);\n}\n\nexport type CrossDomainHandoffParams = {\n  state: string,\n  codeChallenge: string,\n};\n\nexport function getCrossDomainHandoffParamsFromCurrentUrl(currentUrl: URL): CrossDomainHandoffParams | null {\n  const state = getCrossDomainParam(currentUrl.searchParams, \"state\");\n  const codeChallenge = getCrossDomainParam(currentUrl.searchParams, \"codeChallenge\");\n  if (state == null || codeChallenge == null) {\n    return null;\n  }\n  return { state, codeChallenge };\n}\n\ntype RedirectBackAwareHandlerName = \"signIn\" | \"signUp\" | \"onboarding\" | \"signOut\";\ntype ContinuationAwareHandlerName = \"forgotPassword\" | \"passwordReset\";\ntype HandlerRedirectPolicy = \"none\" | \"redirect-back-aware\" | \"continuation-aware\" | \"after-auth-return\";\n\ntype CrossDomainHandoffParamsMaybeMissing = {\n  state: string | null,\n  codeChallenge: string | null,\n  afterCallbackRedirectUrl: string | null,\n};\n\nfunction isRedirectBackAwareHandlerName(handlerName: keyof HandlerUrls): handlerName is RedirectBackAwareHandlerName {\n  return handlerName === \"signIn\"\n    || handlerName === \"signUp\"\n    || handlerName === \"onboarding\"\n    || handlerName === \"signOut\";\n}\n\nfunction isContinuationAwareHandlerName(handlerName: keyof HandlerUrls): handlerName is ContinuationAwareHandlerName {\n  return handlerName === \"forgotPassword\" || handlerName === \"passwordReset\";\n}\n\nfunction hasCrossDomainHandoffParams(url: URL): boolean {\n  return (\n    hasCrossDomainParam(url.searchParams, \"state\")\n    && hasCrossDomainParam(url.searchParams, \"codeChallenge\")\n    && hasCrossDomainParam(url.searchParams, \"afterCallbackRedirectUrl\")\n  );\n}\n\nfunction buildCrossDomainAuthCallbackUrl(options: {\n  currentUrl: URL,\n  localOAuthCallbackUrl: string,\n  state?: string,\n  codeChallenge?: string,\n  afterCallbackRedirectUrl?: string,\n}): URL {\n  const localOAuthCallbackUrl = new URL(options.localOAuthCallbackUrl, options.currentUrl);\n  if (localOAuthCallbackUrl.origin !== options.currentUrl.origin) {\n    throw new HexclaveAssertionError(\"Cross-domain auth callback URL must stay on the current origin\", {\n      localOAuthCallbackUrl: localOAuthCallbackUrl.toString(),\n      currentUrl: options.currentUrl.toString(),\n    });\n  }\n  setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"marker\", \"1\");\n  if (options.state != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"state\", options.state);\n  }\n  if (options.codeChallenge != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"codeChallenge\", options.codeChallenge);\n  }\n  if (options.afterCallbackRedirectUrl != null) {\n    setCrossDomainParam(localOAuthCallbackUrl.searchParams, \"afterCallbackRedirectUrl\", options.afterCallbackRedirectUrl);\n  }\n  return localOAuthCallbackUrl;\n}\n\nfunction buildRedirectBackAwareHandlerUrl(options: {\n  handlerName: RedirectBackAwareHandlerName,\n  rawHandlerUrl: string,\n  currentUrl: URL,\n  crossDomainHandoffParams: CrossDomainHandoffParams | null,\n  localOAuthCallbackUrl: string,\n  noRedirectBack: boolean,\n  afterCallbackRedirectUrlOverride: string | null,\n}): string {\n  const nextUrl = new URL(options.rawHandlerUrl, options.currentUrl);\n  // Preserve after_auth_return_to verbatim (not a rebranded param).\n  const currentAfterAuthReturnTo = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n  if (!options.noRedirectBack && currentAfterAuthReturnTo != null && !nextUrl.searchParams.has(\"after_auth_return_to\")) {\n    nextUrl.searchParams.set(\"after_auth_return_to\", currentAfterAuthReturnTo);\n  }\n  for (const preservedParam of [\"state\", \"codeChallenge\", \"afterCallbackRedirectUrl\"] as const) {\n    if (options.noRedirectBack && preservedParam === \"afterCallbackRedirectUrl\") {\n      continue;\n    }\n    const currentValue = getCrossDomainParam(options.currentUrl.searchParams, preservedParam);\n    if (currentValue != null && !hasCrossDomainParam(nextUrl.searchParams, preservedParam)) {\n      setCrossDomainParam(nextUrl.searchParams, preservedParam, currentValue);\n    }\n  }\n\n  if (options.handlerName === \"signOut\") {\n    if (!nextUrl.searchParams.has(\"after_auth_return_to\")) {\n      if (options.currentUrl.protocol === nextUrl.protocol && options.currentUrl.host === nextUrl.host) {\n        nextUrl.searchParams.set(\"after_auth_return_to\", getRelativePart(options.currentUrl));\n      } else {\n        nextUrl.searchParams.set(\"after_auth_return_to\", options.currentUrl.toString());\n      }\n    }\n    return nextUrl.origin === options.currentUrl.origin ? getRelativePart(nextUrl) : nextUrl.toString();\n  }\n\n  const isCrossDomainHandlerRedirect = options.currentUrl.origin !== nextUrl.origin;\n  if (isCrossDomainHandlerRedirect) {\n    if (!hasCrossDomainHandoffParams(nextUrl)) {\n      const inheritedAfterAuthReturnTo = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n      const afterCallbackRedirectUrl = options.afterCallbackRedirectUrlOverride ?? (\n        inheritedAfterAuthReturnTo\n          ? new URL(inheritedAfterAuthReturnTo, options.currentUrl).toString()\n          : options.currentUrl.toString()\n      );\n      const handoffParams = options.crossDomainHandoffParams\n        ?? getCrossDomainHandoffParamsFromCurrentUrl(options.currentUrl);\n      const callbackUrl = buildCrossDomainAuthCallbackUrl({\n        currentUrl: options.currentUrl,\n        localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n        state: handoffParams?.state,\n        codeChallenge: handoffParams?.codeChallenge,\n        afterCallbackRedirectUrl,\n      });\n\n      nextUrl.searchParams.set(\"after_auth_return_to\", callbackUrl.toString());\n      setCrossDomainParam(nextUrl.searchParams, \"afterCallbackRedirectUrl\", afterCallbackRedirectUrl);\n      if (handoffParams != null) {\n        setCrossDomainParam(nextUrl.searchParams, \"state\", handoffParams.state);\n        setCrossDomainParam(nextUrl.searchParams, \"codeChallenge\", handoffParams.codeChallenge);\n      }\n    }\n  } else if (!options.noRedirectBack && options.currentUrl.protocol === nextUrl.protocol && options.currentUrl.host === nextUrl.host && !nextUrl.searchParams.has(\"after_auth_return_to\")) {\n    nextUrl.searchParams.set(\"after_auth_return_to\", getRelativePart(options.currentUrl));\n  }\n\n  return nextUrl.origin === options.currentUrl.origin ? getRelativePart(nextUrl) : nextUrl.toString();\n}\n\n/**\n * Carries an auth flow's existing return state without ever making the current page the return\n * target. This distinction is important for password flows: forgot-password and password-reset\n * are continuation pages, not destinations customers should return to after signing in.\n */\nfunction buildContinuationAwareHandlerUrl(options: {\n  rawHandlerUrl: string,\n  currentUrl: URL,\n}): string {\n  const nextUrl = new URL(options.rawHandlerUrl, options.currentUrl);\n  const inheritedAfterAuthReturnTo = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n  if (inheritedAfterAuthReturnTo != null && !nextUrl.searchParams.has(\"after_auth_return_to\")) {\n    nextUrl.searchParams.set(\"after_auth_return_to\", inheritedAfterAuthReturnTo);\n  }\n  for (const preservedParam of [\"state\", \"codeChallenge\", \"afterCallbackRedirectUrl\"] as const) {\n    const currentValue = getCrossDomainParam(options.currentUrl.searchParams, preservedParam);\n    if (currentValue != null && !hasCrossDomainParam(nextUrl.searchParams, preservedParam)) {\n      setCrossDomainParam(nextUrl.searchParams, preservedParam, currentValue);\n    }\n  }\n  return nextUrl.origin === options.currentUrl.origin ? getRelativePart(nextUrl) : nextUrl.toString();\n}\n\nfunction getHandlerRedirectPolicy(handlerName: keyof HandlerUrls): HandlerRedirectPolicy {\n  if (handlerName === \"afterSignIn\" || handlerName === \"afterSignUp\") {\n    return \"after-auth-return\";\n  }\n  if (isRedirectBackAwareHandlerName(handlerName)) {\n    return \"redirect-back-aware\";\n  }\n  if (isContinuationAwareHandlerName(handlerName)) {\n    return \"continuation-aware\";\n  }\n  return \"none\";\n}\n\ntype RedirectToHandlerPlan =\n  | { type: \"redirect\", url: string }\n  | {\n    type: \"cross-domain-authorize\",\n    redirectUri: string,\n    state: string,\n    codeChallenge: string,\n    afterCallbackRedirectUrl: string,\n  };\n\n\nasync function resolveRedirectBackAwareHandlerUrlForRedirect(options: {\n  handlerName: RedirectBackAwareHandlerName,\n  rawHandlerUrl: string,\n  currentUrl: URL,\n  localOAuthCallbackUrl: string,\n  getCrossDomainHandoffParams: (currentUrl: URL) => Promise<CrossDomainHandoffParams>,\n  noRedirectBack: boolean,\n  afterCallbackRedirectUrlOverride: string | null,\n}): Promise<string> {\n  const initial = buildRedirectBackAwareHandlerUrl({\n    handlerName: options.handlerName,\n    rawHandlerUrl: options.rawHandlerUrl,\n    currentUrl: options.currentUrl,\n    crossDomainHandoffParams: null,\n    localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n    noRedirectBack: options.noRedirectBack,\n    afterCallbackRedirectUrlOverride: options.afterCallbackRedirectUrlOverride,\n  });\n  if (options.handlerName === \"signOut\") {\n    return initial;\n  }\n\n  const initialTarget = new URL(initial, options.currentUrl);\n  const isCrossDomainHandlerRedirect = options.currentUrl.origin !== initialTarget.origin;\n  if (!isCrossDomainHandlerRedirect || hasCrossDomainHandoffParams(initialTarget)) {\n    return initial;\n  }\n\n  const crossDomainHandoffParams = await options.getCrossDomainHandoffParams(options.currentUrl);\n  return buildRedirectBackAwareHandlerUrl({\n    handlerName: options.handlerName,\n    rawHandlerUrl: options.rawHandlerUrl,\n    currentUrl: options.currentUrl,\n    crossDomainHandoffParams,\n    localOAuthCallbackUrl: options.localOAuthCallbackUrl,\n    noRedirectBack: options.noRedirectBack,\n    afterCallbackRedirectUrlOverride: options.afterCallbackRedirectUrlOverride,\n  });\n}\n\nexport async function planRedirectToHandler(options: {\n  handlerName: keyof HandlerUrls,\n  rawHandlerUrl: string,\n  noRedirectBack: boolean,\n  currentUrl: URL | null,\n  getLocalOAuthCallbackUrl: () => string,\n  rawAfterSignInUrl: string,\n  getCrossDomainHandoffParams: (currentUrl: URL) => Promise<CrossDomainHandoffParams>,\n}): Promise<RedirectToHandlerPlan> {\n  if (options.currentUrl == null) {\n    return { type: \"redirect\", url: options.rawHandlerUrl };\n  }\n\n  const policy = getHandlerRedirectPolicy(options.handlerName);\n  if (options.noRedirectBack) {\n    // noRedirectBack suppresses the current deep link, but hosted auth still has to return through\n    // the source app so it can finish the cross-domain token handoff. Once that finishes, continue\n    // to afterSignIn instead.\n    if (policy === \"redirect-back-aware\" && options.handlerName !== \"signOut\") {\n      const authTarget = new URL(options.rawHandlerUrl, options.currentUrl);\n      if (authTarget.origin === options.currentUrl.origin) {\n        if (options.handlerName !== \"signIn\") {\n          return { type: \"redirect\", url: options.rawHandlerUrl };\n        }\n        return {\n          type: \"redirect\",\n          url: buildContinuationAwareHandlerUrl({\n            rawHandlerUrl: options.rawHandlerUrl,\n            currentUrl: options.currentUrl,\n          }),\n        };\n      }\n    } else {\n      // Other handlers retain the historical noRedirectBack behavior, including\n      // afterSignIn/afterSignUp ignoring all return state.\n      return {\n        type: \"redirect\",\n        url: options.rawHandlerUrl,\n      };\n    }\n  }\n  if (policy === \"none\") {\n    return { type: \"redirect\", url: options.rawHandlerUrl };\n  }\n  if (policy === \"continuation-aware\") {\n    return {\n      type: \"redirect\",\n      url: buildContinuationAwareHandlerUrl({\n        rawHandlerUrl: options.rawHandlerUrl,\n        currentUrl: options.currentUrl,\n      }),\n    };\n  }\n\n  if (policy === \"after-auth-return\") {\n    if (options.noRedirectBack) {\n      return { type: \"redirect\", url: options.rawHandlerUrl };\n    }\n    const redirectBackUrl = options.currentUrl.searchParams.get(\"after_auth_return_to\");\n    if (redirectBackUrl == null) {\n      return { type: \"redirect\", url: options.rawHandlerUrl };\n    }\n    const redirectBackTarget = new URL(redirectBackUrl, options.currentUrl);\n    const crossDomainHandoff = getCrossDomainHandoffForRedirect({\n      currentUrl: options.currentUrl,\n      redirectBackTarget,\n    });\n    if (crossDomainHandoff == null) {\n      return { type: \"redirect\", url: redirectBackUrl };\n    }\n    let state = crossDomainHandoff.handoffParams.state;\n    let codeChallenge = crossDomainHandoff.handoffParams.codeChallenge;\n    let afterCallbackRedirectUrl = crossDomainHandoff.handoffParams.afterCallbackRedirectUrl;\n    if (state == null || codeChallenge == null) {\n      const generatedHandoffParams = await options.getCrossDomainHandoffParams(options.currentUrl);\n      state ??= generatedHandoffParams.state;\n      codeChallenge ??= generatedHandoffParams.codeChallenge;\n    }\n    afterCallbackRedirectUrl ??= options.currentUrl.toString();\n    return {\n      type: \"cross-domain-authorize\",\n      redirectUri: crossDomainHandoff.redirectBackTarget.toString(),\n      state,\n      codeChallenge,\n      afterCallbackRedirectUrl,\n    };\n  }\n\n  if (\n    options.handlerName !== \"signIn\"\n    && options.handlerName !== \"signUp\"\n    && options.handlerName !== \"onboarding\"\n    && options.handlerName !== \"signOut\"\n  ) {\n    throw new HexclaveAssertionError(\"Unexpected redirect-back-aware handler policy mismatch\", {\n      handlerName: options.handlerName,\n      policy,\n    });\n  }\n\n  // noRedirectBack suppresses the initiating deep link, not the return journey. Cross-domain auth\n  // still needs to return through the source app's callback, but its final destination is the\n  // configured post-sign-in page.\n  const afterCallbackRedirectUrlOverride = options.noRedirectBack\n    ? new URL(options.rawAfterSignInUrl, options.currentUrl).toString()\n    : null;\n\n  return {\n    type: \"redirect\",\n    url: await resolveRedirectBackAwareHandlerUrlForRedirect({\n      handlerName: options.handlerName,\n      rawHandlerUrl: options.rawHandlerUrl,\n      currentUrl: options.currentUrl,\n      localOAuthCallbackUrl: options.getLocalOAuthCallbackUrl(),\n      getCrossDomainHandoffParams: options.getCrossDomainHandoffParams,\n      noRedirectBack: options.noRedirectBack,\n      afterCallbackRedirectUrlOverride,\n    }),\n  };\n}\n\nfunction readCrossDomainHandoffParams(currentUrl: URL, redirectBackTarget: URL): CrossDomainHandoffParamsMaybeMissing {\n  // Hexclave rebrand: accept either param name from both URLs.\n  const state = getCrossDomainParam(currentUrl.searchParams, \"state\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"state\");\n  const codeChallenge = getCrossDomainParam(currentUrl.searchParams, \"codeChallenge\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"codeChallenge\");\n  const afterCallbackRedirectUrl = getCrossDomainParam(currentUrl.searchParams, \"afterCallbackRedirectUrl\")\n    ?? getCrossDomainParam(redirectBackTarget.searchParams, \"afterCallbackRedirectUrl\");\n  return {\n    state,\n    codeChallenge,\n    afterCallbackRedirectUrl,\n  };\n}\n\nfunction resolveCrossDomainRedirectBackTarget(options: {\n  currentUrl: URL,\n  redirectBackTarget: URL,\n  handoffParams: CrossDomainHandoffParamsMaybeMissing,\n}): URL | null {\n  if (options.redirectBackTarget.origin !== options.currentUrl.origin) {\n    return options.redirectBackTarget;\n  }\n  if (\n    options.handoffParams.state == null\n    || options.handoffParams.codeChallenge == null\n    || options.handoffParams.afterCallbackRedirectUrl == null\n  ) {\n    return null;\n  }\n  const afterCallbackRedirectTarget = new URL(options.handoffParams.afterCallbackRedirectUrl, options.currentUrl);\n  if (afterCallbackRedirectTarget.origin === options.currentUrl.origin) {\n    return null;\n  }\n  return new URL(\n    `${options.redirectBackTarget.pathname}${options.redirectBackTarget.search}${options.redirectBackTarget.hash}`,\n    afterCallbackRedirectTarget.origin,\n  );\n}\n\nfunction getCrossDomainHandoffForRedirect(options: {\n  currentUrl: URL,\n  redirectBackTarget: URL,\n}): {\n  redirectBackTarget: URL,\n  handoffParams: CrossDomainHandoffParamsMaybeMissing,\n} | null {\n  const handoffParams = readCrossDomainHandoffParams(options.currentUrl, options.redirectBackTarget);\n  const crossDomainRedirectBackTarget = resolveCrossDomainRedirectBackTarget({\n    currentUrl: options.currentUrl,\n    redirectBackTarget: options.redirectBackTarget,\n    handoffParams,\n  });\n  if (crossDomainRedirectBackTarget == null) {\n    return null;\n  }\n  return {\n    redirectBackTarget: crossDomainRedirectBackTarget,\n    handoffParams,\n  };\n}\n"],"mappings":";;;;AAQA,MAAa,6BAA6B;CACxC,QAAQ;CACR,OAAO;CACP,eAAe;CACf,0BAA0B;AAC5B;AAIA,SAAS,oBAAoB,QAAyB,KAAkD;CACtG,OAAO,OAAO,IAAI,2BAA2B,IAAI;AACnD;AAEA,SAAS,oBAAoB,QAAyB,KAA4C;CAChG,OAAO,OAAO,IAAI,2BAA2B,IAAI;AACnD;AAEA,SAAS,oBAAoB,QAAyB,KAAmC,OAAqB;CAC5G,OAAO,IAAI,2BAA2B,MAAM,KAAK;AACnD;AAOA,SAAgB,0CAA0C,YAAkD;CAC1G,MAAM,QAAQ,oBAAoB,WAAW,cAAc,OAAO;CAClE,MAAM,gBAAgB,oBAAoB,WAAW,cAAc,eAAe;CAClF,IAAI,SAAS,QAAQ,iBAAiB,MACpC,OAAO;CAET,OAAO;EAAE;EAAO;CAAc;AAChC;AAYA,SAAS,+BAA+B,aAA6E;CACnH,OAAO,gBAAgB,YAClB,gBAAgB,YAChB,gBAAgB,gBAChB,gBAAgB;AACvB;AAEA,SAAS,+BAA+B,aAA6E;CACnH,OAAO,gBAAgB,oBAAoB,gBAAgB;AAC7D;AAEA,SAAS,4BAA4B,KAAmB;CACtD,OACE,oBAAoB,IAAI,cAAc,OAAO,KAC1C,oBAAoB,IAAI,cAAc,eAAe,KACrD,oBAAoB,IAAI,cAAc,0BAA0B;AAEvE;AAEA,SAAS,gCAAgC,SAMjC;CACN,MAAM,wBAAwB,IAAI,IAAI,QAAQ,uBAAuB,QAAQ,UAAU;CACvF,IAAI,sBAAsB,WAAW,QAAQ,WAAW,QACtD,MAAM,IAAIA,mCAAAA,uBAAuB,kEAAkE;EACjG,uBAAuB,sBAAsB,SAAS;EACtD,YAAY,QAAQ,WAAW,SAAS;CAC1C,CAAC;CAEH,oBAAoB,sBAAsB,cAAc,UAAU,GAAG;CACrE,IAAI,QAAQ,SAAS,MACnB,oBAAoB,sBAAsB,cAAc,SAAS,QAAQ,KAAK;CAEhF,IAAI,QAAQ,iBAAiB,MAC3B,oBAAoB,sBAAsB,cAAc,iBAAiB,QAAQ,aAAa;CAEhG,IAAI,QAAQ,4BAA4B,MACtC,oBAAoB,sBAAsB,cAAc,4BAA4B,QAAQ,wBAAwB;CAEtH,OAAO;AACT;AAEA,SAAS,iCAAiC,SAQ/B;CACT,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,QAAQ,UAAU;CAEjE,MAAM,2BAA2B,QAAQ,WAAW,aAAa,IAAI,sBAAsB;CAC3F,IAAI,CAAC,QAAQ,kBAAkB,4BAA4B,QAAQ,CAAC,QAAQ,aAAa,IAAI,sBAAsB,GACjH,QAAQ,aAAa,IAAI,wBAAwB,wBAAwB;CAE3E,KAAK,MAAM,kBAAkB;EAAC;EAAS;EAAiB;CAA0B,GAAY;EAC5F,IAAI,QAAQ,kBAAkB,mBAAmB,4BAC/C;EAEF,MAAM,eAAe,oBAAoB,QAAQ,WAAW,cAAc,cAAc;EACxF,IAAI,gBAAgB,QAAQ,CAAC,oBAAoB,QAAQ,cAAc,cAAc,GACnF,oBAAoB,QAAQ,cAAc,gBAAgB,YAAY;CAE1E;CAEA,IAAI,QAAQ,gBAAgB,WAAW;EACrC,IAAI,CAAC,QAAQ,aAAa,IAAI,sBAAsB,GAClD,IAAI,QAAQ,WAAW,aAAa,QAAQ,YAAY,QAAQ,WAAW,SAAS,QAAQ,MAC1F,QAAQ,aAAa,IAAI,yBAAA,GAAA,iCAAA,gBAAA,CAAwC,QAAQ,UAAU,CAAC;OAEpF,QAAQ,aAAa,IAAI,wBAAwB,QAAQ,WAAW,SAAS,CAAC;EAGlF,OAAO,QAAQ,WAAW,QAAQ,WAAW,UAAA,GAAA,iCAAA,gBAAA,CAAyB,OAAO,IAAI,QAAQ,SAAS;CACpG;CAGA,IADqC,QAAQ,WAAW,WAAW,QAAQ;MAErE,CAAC,4BAA4B,OAAO,GAAG;GACzC,MAAM,6BAA6B,QAAQ,WAAW,aAAa,IAAI,sBAAsB;GAC7F,MAAM,2BAA2B,QAAQ,qCACvC,6BACI,IAAI,IAAI,4BAA4B,QAAQ,UAAU,CAAC,CAAC,SAAS,IACjE,QAAQ,WAAW,SAAS;GAElC,MAAM,gBAAgB,QAAQ,4BACzB,0CAA0C,QAAQ,UAAU;GACjE,MAAM,cAAc,gCAAgC;IAClD,YAAY,QAAQ;IACpB,uBAAuB,QAAQ;IAC/B,OAAO,eAAe;IACtB,eAAe,eAAe;IAC9B;GACF,CAAC;GAED,QAAQ,aAAa,IAAI,wBAAwB,YAAY,SAAS,CAAC;GACvE,oBAAoB,QAAQ,cAAc,4BAA4B,wBAAwB;GAC9F,IAAI,iBAAiB,MAAM;IACzB,oBAAoB,QAAQ,cAAc,SAAS,cAAc,KAAK;IACtE,oBAAoB,QAAQ,cAAc,iBAAiB,cAAc,aAAa;GACxF;EACF;QACK,IAAI,CAAC,QAAQ,kBAAkB,QAAQ,WAAW,aAAa,QAAQ,YAAY,QAAQ,WAAW,SAAS,QAAQ,QAAQ,CAAC,QAAQ,aAAa,IAAI,sBAAsB,GACpL,QAAQ,aAAa,IAAI,yBAAA,GAAA,iCAAA,gBAAA,CAAwC,QAAQ,UAAU,CAAC;CAGtF,OAAO,QAAQ,WAAW,QAAQ,WAAW,UAAA,GAAA,iCAAA,gBAAA,CAAyB,OAAO,IAAI,QAAQ,SAAS;AACpG;;;;;;AAOA,SAAS,iCAAiC,SAG/B;CACT,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,QAAQ,UAAU;CACjE,MAAM,6BAA6B,QAAQ,WAAW,aAAa,IAAI,sBAAsB;CAC7F,IAAI,8BAA8B,QAAQ,CAAC,QAAQ,aAAa,IAAI,sBAAsB,GACxF,QAAQ,aAAa,IAAI,wBAAwB,0BAA0B;CAE7E,KAAK,MAAM,kBAAkB;EAAC;EAAS;EAAiB;CAA0B,GAAY;EAC5F,MAAM,eAAe,oBAAoB,QAAQ,WAAW,cAAc,cAAc;EACxF,IAAI,gBAAgB,QAAQ,CAAC,oBAAoB,QAAQ,cAAc,cAAc,GACnF,oBAAoB,QAAQ,cAAc,gBAAgB,YAAY;CAE1E;CACA,OAAO,QAAQ,WAAW,QAAQ,WAAW,UAAA,GAAA,iCAAA,gBAAA,CAAyB,OAAO,IAAI,QAAQ,SAAS;AACpG;AAEA,SAAS,yBAAyB,aAAuD;CACvF,IAAI,gBAAgB,iBAAiB,gBAAgB,eACnD,OAAO;CAET,IAAI,+BAA+B,WAAW,GAC5C,OAAO;CAET,IAAI,+BAA+B,WAAW,GAC5C,OAAO;CAET,OAAO;AACT;AAaA,eAAe,8CAA8C,SAQzC;CAClB,MAAM,UAAU,iCAAiC;EAC/C,aAAa,QAAQ;EACrB,eAAe,QAAQ;EACvB,YAAY,QAAQ;EACpB,0BAA0B;EAC1B,uBAAuB,QAAQ;EAC/B,gBAAgB,QAAQ;EACxB,kCAAkC,QAAQ;CAC5C,CAAC;CACD,IAAI,QAAQ,gBAAgB,WAC1B,OAAO;CAGT,MAAM,gBAAgB,IAAI,IAAI,SAAS,QAAQ,UAAU;CAEzD,IAAI,EADiC,QAAQ,WAAW,WAAW,cAAc,WAC5C,4BAA4B,aAAa,GAC5E,OAAO;CAGT,MAAM,2BAA2B,MAAM,QAAQ,4BAA4B,QAAQ,UAAU;CAC7F,OAAO,iCAAiC;EACtC,aAAa,QAAQ;EACrB,eAAe,QAAQ;EACvB,YAAY,QAAQ;EACpB;EACA,uBAAuB,QAAQ;EAC/B,gBAAgB,QAAQ;EACxB,kCAAkC,QAAQ;CAC5C,CAAC;AACH;AAEA,eAAsB,sBAAsB,SAQT;CACjC,IAAI,QAAQ,cAAc,MACxB,OAAO;EAAE,MAAM;EAAY,KAAK,QAAQ;CAAc;CAGxD,MAAM,SAAS,yBAAyB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,gBAIV,IAAI,WAAW,yBAAyB,QAAQ,gBAAgB;MAE1D,IADmB,IAAI,QAAQ,eAAe,QAAQ,UAC7C,CAAC,CAAC,WAAW,QAAQ,WAAW,QAAQ;GACnD,IAAI,QAAQ,gBAAgB,UAC1B,OAAO;IAAE,MAAM;IAAY,KAAK,QAAQ;GAAc;GAExD,OAAO;IACL,MAAM;IACN,KAAK,iCAAiC;KACpC,eAAe,QAAQ;KACvB,YAAY,QAAQ;IACtB,CAAC;GACH;EACF;QAIA,OAAO;EACL,MAAM;EACN,KAAK,QAAQ;CACf;CAGJ,IAAI,WAAW,QACb,OAAO;EAAE,MAAM;EAAY,KAAK,QAAQ;CAAc;CAExD,IAAI,WAAW,sBACb,OAAO;EACL,MAAM;EACN,KAAK,iCAAiC;GACpC,eAAe,QAAQ;GACvB,YAAY,QAAQ;EACtB,CAAC;CACH;CAGF,IAAI,WAAW,qBAAqB;EAClC,IAAI,QAAQ,gBACV,OAAO;GAAE,MAAM;GAAY,KAAK,QAAQ;EAAc;EAExD,MAAM,kBAAkB,QAAQ,WAAW,aAAa,IAAI,sBAAsB;EAClF,IAAI,mBAAmB,MACrB,OAAO;GAAE,MAAM;GAAY,KAAK,QAAQ;EAAc;EAExD,MAAM,qBAAqB,IAAI,IAAI,iBAAiB,QAAQ,UAAU;EACtE,MAAM,qBAAqB,iCAAiC;GAC1D,YAAY,QAAQ;GACpB;EACF,CAAC;EACD,IAAI,sBAAsB,MACxB,OAAO;GAAE,MAAM;GAAY,KAAK;EAAgB;EAElD,IAAI,QAAQ,mBAAmB,cAAc;EAC7C,IAAI,gBAAgB,mBAAmB,cAAc;EACrD,IAAI,2BAA2B,mBAAmB,cAAc;EAChE,IAAI,SAAS,QAAQ,iBAAiB,MAAM;GAC1C,MAAM,yBAAyB,MAAM,QAAQ,4BAA4B,QAAQ,UAAU;GAC3F,UAAU,uBAAuB;GACjC,kBAAkB,uBAAuB;EAC3C;EACA,6BAA6B,QAAQ,WAAW,SAAS;EACzD,OAAO;GACL,MAAM;GACN,aAAa,mBAAmB,mBAAmB,SAAS;GAC5D;GACA;GACA;EACF;CACF;CAEA,IACE,QAAQ,gBAAgB,YACrB,QAAQ,gBAAgB,YACxB,QAAQ,gBAAgB,gBACxB,QAAQ,gBAAgB,WAE3B,MAAM,IAAIA,mCAAAA,uBAAuB,0DAA0D;EACzF,aAAa,QAAQ;EACrB;CACF,CAAC;CAMH,MAAM,mCAAmC,QAAQ,iBAC7C,IAAI,IAAI,QAAQ,mBAAmB,QAAQ,UAAU,CAAC,CAAC,SAAS,IAChE;CAEJ,OAAO;EACL,MAAM;EACN,KAAK,MAAM,8CAA8C;GACvD,aAAa,QAAQ;GACrB,eAAe,QAAQ;GACvB,YAAY,QAAQ;GACpB,uBAAuB,QAAQ,yBAAyB;GACxD,6BAA6B,QAAQ;GACrC,gBAAgB,QAAQ;GACxB;EACF,CAAC;CACH;AACF;AAEA,SAAS,6BAA6B,YAAiB,oBAA+D;CAQpH,OAAO;EACL,OAPY,oBAAoB,WAAW,cAAc,OAAO,KAC7D,oBAAoB,mBAAmB,cAAc,OAAO;EAO/D,eANoB,oBAAoB,WAAW,cAAc,eAAe,KAC7E,oBAAoB,mBAAmB,cAAc,eAAe;EAMvE,0BAL+B,oBAAoB,WAAW,cAAc,0BAA0B,KACnG,oBAAoB,mBAAmB,cAAc,0BAA0B;CAKpF;AACF;AAEA,SAAS,qCAAqC,SAI/B;CACb,IAAI,QAAQ,mBAAmB,WAAW,QAAQ,WAAW,QAC3D,OAAO,QAAQ;CAEjB,IACE,QAAQ,cAAc,SAAS,QAC5B,QAAQ,cAAc,iBAAiB,QACvC,QAAQ,cAAc,4BAA4B,MAErD,OAAO;CAET,MAAM,8BAA8B,IAAI,IAAI,QAAQ,cAAc,0BAA0B,QAAQ,UAAU;CAC9G,IAAI,4BAA4B,WAAW,QAAQ,WAAW,QAC5D,OAAO;CAET,OAAO,IAAI,IACT,GAAG,QAAQ,mBAAmB,WAAW,QAAQ,mBAAmB,SAAS,QAAQ,mBAAmB,QACxG,4BAA4B,MAC9B;AACF;AAEA,SAAS,iCAAiC,SAMjC;CACP,MAAM,gBAAgB,6BAA6B,QAAQ,YAAY,QAAQ,kBAAkB;CACjG,MAAM,gCAAgC,qCAAqC;EACzE,YAAY,QAAQ;EACpB,oBAAoB,QAAQ;EAC5B;CACF,CAAC;CACD,IAAI,iCAAiC,MACnC,OAAO;CAET,OAAO;EACL,oBAAoB;EACpB;CACF;AACF"}

package/dist/lib/hexclave-app/apps/implementations/redirect-page-urls.test.js

@@ -7,7 +7,7 @@ async function plan(options) {
 		...options,
 		noRedirectBack: options.noRedirectBack === true,
 		getLocalOAuthCallbackUrl: () => localOAuthCallbackUrl,
-		rawHomeUrl: "/",
+		rawAfterSignInUrl: "/",
 		getCrossDomainHandoffParams: async () => {
 			throw new Error("Continuation-only redirects must not mint a new cross-domain handoff");
 		}
@@ -27,19 +27,19 @@ function expectContinuation(url, expectedReturnTo) {
 	(0, vitest.it)("does not resolve a browser-only callback URL without a current URL", async () => {
 		(0, vitest.expect)(await (0, __redirect_page_urls_js.planRedirectToHandler)({
 			handlerName: "signIn",
-			rawHandlerUrl: "https://hosted.example.test/handler/sign-in",
+			rawHandlerUrl: "/handler/sign-in",
 			noRedirectBack: false,
 			currentUrl: null,
 			getLocalOAuthCallbackUrl: () => {
 				throw new Error("Server-side redirect planning must not resolve the browser callback URL");
 			},
-			rawHomeUrl: "/",
+			rawAfterSignInUrl: "/",
 			getCrossDomainHandoffParams: async () => {
 				throw new Error("Server-side redirect planning must not mint cross-domain handoff parameters");
 			}
 		})).toEqual({
 			type: "redirect",
-			url: "https://hosted.example.test/handler/sign-in"
+			url: "/handler/sign-in"
 		});
 	});
 });

package/dist/lib/hexclave-app/apps/implementations/redirect-page-urls.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-page-urls.test.js","names":["crossDomainAuthQueryParams"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/redirect-page-urls.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it } from \"vitest\";\nimport { crossDomainAuthQueryParams, planRedirectToHandler } from \"./redirect-page-urls\";\n\nconst localOAuthCallbackUrl = \"https://hosted.example.test/handler/oauth-callback\";\n\nasync function plan(options: {\n  handlerName: \"signIn\" | \"forgotPassword\" | \"passwordReset\" | \"afterSignIn\" | \"afterSignUp\",\n  rawHandlerUrl: string,\n  currentUrl: URL,\n  noRedirectBack?: boolean,\n}) {\n  return await planRedirectToHandler({\n    ...options,\n    noRedirectBack: options.noRedirectBack === true,\n    getLocalOAuthCallbackUrl: () => localOAuthCallbackUrl,\n    rawHomeUrl: \"/\",\n    getCrossDomainHandoffParams: async () => {\n      throw new Error(\"Continuation-only redirects must not mint a new cross-domain handoff\");\n    },\n  });\n}\n\nfunction expectRedirectUrl(planResult: Awaited<ReturnType<typeof plan>>, baseUrl: URL): URL {\n  if (planResult.type !== \"redirect\") {\n    throw new Error(\"Expected a direct redirect plan\");\n  }\n  return new URL(planResult.url, baseUrl);\n}\n\nfunction expectContinuation(url: URL, expectedReturnTo: string): void {\n  expect(url.searchParams.get(\"after_auth_return_to\")).toBe(expectedReturnTo);\n  expect(url.searchParams.get(crossDomainAuthQueryParams.state)).toBe(\"outer-state\");\n  expect(url.searchParams.get(crossDomainAuthQueryParams.codeChallenge)).toBe(\"outer-challenge\");\n  expect(url.searchParams.get(crossDomainAuthQueryParams.afterCallbackRedirectUrl)).toBe(\"https://customer.example.test/dashboard\");\n}\n\ndescribe(\"server-side redirect planning\", () => {\n  it(\"does not resolve a browser-only callback URL without a current URL\", async () => {\n    const result = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"https://hosted.example.test/handler/sign-in\",\n      noRedirectBack: false,\n      currentUrl: null,\n      getLocalOAuthCallbackUrl: () => {\n        throw new Error(\"Server-side redirect planning must not resolve the browser callback URL\");\n      },\n      rawHomeUrl: \"/\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Server-side redirect planning must not mint cross-domain handoff parameters\");\n      },\n    });\n\n    expect(result).toEqual({\n      type: \"redirect\",\n      url: \"https://hosted.example.test/handler/sign-in\",\n    });\n  });\n});\n\ndescribe(\"password-flow redirect continuation\", () => {\n  it(\"carries the complete customer return state through forgot-password and a reset-email new tab\", async () => {\n    const customerReturnTo = \"https://customer.example.test/handler/oauth-callback?hexclave_cross_domain_auth=1\";\n    const signInUrl = new URL(\"https://hosted.example.test/handler/sign-in\");\n    signInUrl.searchParams.set(\"after_auth_return_to\", customerReturnTo);\n    signInUrl.searchParams.set(crossDomainAuthQueryParams.state, \"outer-state\");\n    signInUrl.searchParams.set(crossDomainAuthQueryParams.codeChallenge, \"outer-challenge\");\n    signInUrl.searchParams.set(crossDomainAuthQueryParams.afterCallbackRedirectUrl, \"https://customer.example.test/dashboard\");\n\n    const forgotPlan = await plan({\n      handlerName: \"forgotPassword\",\n      rawHandlerUrl: \"/handler/forgot-password\",\n      currentUrl: signInUrl,\n    });\n    const forgotUrl = expectRedirectUrl(forgotPlan, signInUrl);\n    expectContinuation(forgotUrl, customerReturnTo);\n\n    const callbackPlan = await plan({\n      handlerName: \"passwordReset\",\n      rawHandlerUrl: \"/handler/password-reset\",\n      currentUrl: forgotUrl,\n    });\n    const resetEmailCallbackUrl = expectRedirectUrl(callbackPlan, forgotUrl);\n    expectContinuation(resetEmailCallbackUrl, customerReturnTo);\n\n    // Model opening the callback in a new tab: only URL state is available.\n    resetEmailCallbackUrl.searchParams.set(\"code\", \"reset-code\");\n    const signInPlan = await plan({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      currentUrl: resetEmailCallbackUrl,\n      noRedirectBack: true,\n    });\n    const finalSignInUrl = expectRedirectUrl(signInPlan, resetEmailCallbackUrl);\n    expectContinuation(finalSignInUrl, customerReturnTo);\n    expect(finalSignInUrl.searchParams.has(\"code\")).toBe(false);\n  });\n\n  it.each([\n    [\"forgotPassword\", \"/handler/forgot-password\"],\n    [\"passwordReset\", \"/handler/password-reset\"],\n  ] as const)(\"never synthesizes the current %s page as a return target\", async (handlerName, rawHandlerUrl) => {\n    const currentUrl = new URL(`https://hosted.example.test${rawHandlerUrl}?code=reset-code`);\n    const result = expectRedirectUrl(await plan({\n      handlerName,\n      rawHandlerUrl,\n      currentUrl,\n    }), currentUrl);\n\n    expect(result.searchParams.has(\"after_auth_return_to\")).toBe(false);\n    expect(result.searchParams.has(\"code\")).toBe(false);\n  });\n\n  it(\"makes sign-in noRedirectBack suppress capture while preserving only inherited state\", async () => {\n    const resetUrlWithoutContinuation = new URL(\"https://hosted.example.test/handler/password-reset?code=reset-code\");\n    const result = expectRedirectUrl(await plan({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      currentUrl: resetUrlWithoutContinuation,\n      noRedirectBack: true,\n    }), resetUrlWithoutContinuation);\n\n    expect(result.toString()).toBe(\"https://hosted.example.test/handler/sign-in\");\n  });\n\n  it.each([\"afterSignIn\", \"afterSignUp\"] as const)(\n    \"keeps existing %s noRedirectBack semantics\",\n    async (handlerName) => {\n      const currentUrl = new URL(\"https://hosted.example.test/handler/sign-in?after_auth_return_to=%2Fcustomer\");\n      const result = expectRedirectUrl(await plan({\n        handlerName,\n        rawHandlerUrl: \"/default-after-auth\",\n        currentUrl,\n        noRedirectBack: true,\n      }), currentUrl);\n\n      expect(result.toString()).toBe(\"https://hosted.example.test/default-after-auth\");\n    },\n  );\n});\n"],"mappings":";;;AAOA,MAAM,wBAAwB;AAE9B,eAAe,KAAK,SAKjB;CACD,OAAO,OAAA,GAAA,wBAAA,sBAAA,CAA4B;EACjC,GAAG;EACH,gBAAgB,QAAQ,mBAAmB;EAC3C,gCAAgC;EAChC,YAAY;EACZ,6BAA6B,YAAY;GACvC,MAAM,IAAI,MAAM,sEAAsE;EACxF;CACF,CAAC;AACH;AAEA,SAAS,kBAAkB,YAA8C,SAAmB;CAC1F,IAAI,WAAW,SAAS,YACtB,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO,IAAI,IAAI,WAAW,KAAK,OAAO;AACxC;AAEA,SAAS,mBAAmB,KAAU,kBAAgC;CACpE,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,gBAAgB;CAC1E,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,aAAa,IAAIA,wBAAAA,2BAA2B,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa;CACjF,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,aAAa,IAAIA,wBAAAA,2BAA2B,aAAa,CAAC,CAAC,CAAC,KAAK,iBAAiB;CAC7F,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,aAAa,IAAIA,wBAAAA,2BAA2B,wBAAwB,CAAC,CAAC,CAAC,KAAK,yCAAyC;AAClI;qBAES,uCAAuC;CAC9C,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE,YAAY;EAenF,CAAA,GAAA,OAAA,OAAA,CAAO,OAAA,GAAA,wBAAA,sBAAA,CAdoC;GACzC,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY;GACZ,gCAAgC;IAC9B,MAAM,IAAI,MAAM,yEAAyE;GAC3F;GACA,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,6EAA6E;GAC/F;EACF,CAAC,CAEY,CAAC,CAAC,QAAQ;GACrB,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;AACH,CAAC;qBAEQ,6CAA6C;CACpD,CAAA,GAAA,OAAA,GAAA,CAAG,gGAAgG,YAAY;EAC7G,MAAM,mBAAmB;EACzB,MAAM,YAAY,IAAI,IAAI,6CAA6C;EACvE,UAAU,aAAa,IAAI,wBAAwB,gBAAgB;EACnE,UAAU,aAAa,IAAIA,wBAAAA,2BAA2B,OAAO,aAAa;EAC1E,UAAU,aAAa,IAAIA,wBAAAA,2BAA2B,eAAe,iBAAiB;EACtF,UAAU,aAAa,IAAIA,wBAAAA,2BAA2B,0BAA0B,yCAAyC;EAOzH,MAAM,YAAY,kBAAkB,MALX,KAAK;GAC5B,aAAa;GACb,eAAe;GACf,YAAY;EACd,CAAC,GAC+C,SAAS;EACzD,mBAAmB,WAAW,gBAAgB;EAO9C,MAAM,wBAAwB,kBAAkB,MALrB,KAAK;GAC9B,aAAa;GACb,eAAe;GACf,YAAY;EACd,CAAC,GAC6D,SAAS;EACvE,mBAAmB,uBAAuB,gBAAgB;EAG1D,sBAAsB,aAAa,IAAI,QAAQ,YAAY;EAO3D,MAAM,iBAAiB,kBAAkB,MANhB,KAAK;GAC5B,aAAa;GACb,eAAe;GACf,YAAY;GACZ,gBAAgB;EAClB,CAAC,GACoD,qBAAqB;EAC1E,mBAAmB,gBAAgB,gBAAgB;EACnD,CAAA,GAAA,OAAA,OAAA,CAAO,eAAe,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK;CAC5D,CAAC;CAED,OAAA,GAAG,KAAK,CACN,CAAC,kBAAkB,0BAA0B,GAC7C,CAAC,iBAAiB,yBAAyB,CAC7C,CAAU,CAAC,CAAC,4DAA4D,OAAO,aAAa,kBAAkB;EAC5G,MAAM,aAAa,IAAI,IAAI,8BAA8B,cAAc,iBAAiB;EACxF,MAAM,SAAS,kBAAkB,MAAM,KAAK;GAC1C;GACA;GACA;EACF,CAAC,GAAG,UAAU;EAEd,CAAA,GAAA,OAAA,OAAA,CAAO,OAAO,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,KAAK;EAClE,CAAA,GAAA,OAAA,OAAA,CAAO,OAAO,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK;CACpD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,uFAAuF,YAAY;EACpG,MAAM,8BAA8B,IAAI,IAAI,oEAAoE;EAQhH,CAAA,GAAA,OAAA,OAAA,CAPe,kBAAkB,MAAM,KAAK;GAC1C,aAAa;GACb,eAAe;GACf,YAAY;GACZ,gBAAgB;EAClB,CAAC,GAAG,2BAEQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,6CAA6C;CAC9E,CAAC;CAED,OAAA,GAAG,KAAK,CAAC,eAAe,aAAa,CAAU,CAAC,CAC9C,8CACA,OAAO,gBAAgB;EACrB,MAAM,aAAa,IAAI,IAAI,8EAA8E;EAQzG,CAAA,GAAA,OAAA,OAAA,CAPe,kBAAkB,MAAM,KAAK;GAC1C;GACA,eAAe;GACf;GACA,gBAAgB;EAClB,CAAC,GAAG,UAEQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,gDAAgD;CACjF,CACF;AACF,CAAC"}
+{"version":3,"file":"redirect-page-urls.test.js","names":["crossDomainAuthQueryParams"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/redirect-page-urls.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it } from \"vitest\";\nimport { crossDomainAuthQueryParams, planRedirectToHandler } from \"./redirect-page-urls\";\n\nconst localOAuthCallbackUrl = \"https://hosted.example.test/handler/oauth-callback\";\n\nasync function plan(options: {\n  handlerName: \"signIn\" | \"forgotPassword\" | \"passwordReset\" | \"afterSignIn\" | \"afterSignUp\",\n  rawHandlerUrl: string,\n  currentUrl: URL,\n  noRedirectBack?: boolean,\n}) {\n  return await planRedirectToHandler({\n    ...options,\n    noRedirectBack: options.noRedirectBack === true,\n    getLocalOAuthCallbackUrl: () => localOAuthCallbackUrl,\n    rawAfterSignInUrl: \"/\",\n    getCrossDomainHandoffParams: async () => {\n      throw new Error(\"Continuation-only redirects must not mint a new cross-domain handoff\");\n    },\n  });\n}\n\nfunction expectRedirectUrl(planResult: Awaited<ReturnType<typeof plan>>, baseUrl: URL): URL {\n  if (planResult.type !== \"redirect\") {\n    throw new Error(\"Expected a direct redirect plan\");\n  }\n  return new URL(planResult.url, baseUrl);\n}\n\nfunction expectContinuation(url: URL, expectedReturnTo: string): void {\n  expect(url.searchParams.get(\"after_auth_return_to\")).toBe(expectedReturnTo);\n  expect(url.searchParams.get(crossDomainAuthQueryParams.state)).toBe(\"outer-state\");\n  expect(url.searchParams.get(crossDomainAuthQueryParams.codeChallenge)).toBe(\"outer-challenge\");\n  expect(url.searchParams.get(crossDomainAuthQueryParams.afterCallbackRedirectUrl)).toBe(\"https://customer.example.test/dashboard\");\n}\n\ndescribe(\"server-side redirect planning\", () => {\n  it(\"does not resolve a browser-only callback URL without a current URL\", async () => {\n    const result = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      noRedirectBack: false,\n      currentUrl: null,\n      getLocalOAuthCallbackUrl: () => {\n        throw new Error(\"Server-side redirect planning must not resolve the browser callback URL\");\n      },\n      rawAfterSignInUrl: \"/\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Server-side redirect planning must not mint cross-domain handoff parameters\");\n      },\n    });\n\n    expect(result).toEqual({\n      type: \"redirect\",\n      url: \"/handler/sign-in\",\n    });\n  });\n});\n\ndescribe(\"password-flow redirect continuation\", () => {\n  it(\"carries the complete customer return state through forgot-password and a reset-email new tab\", async () => {\n    const customerReturnTo = \"https://customer.example.test/handler/oauth-callback?hexclave_cross_domain_auth=1\";\n    const signInUrl = new URL(\"https://hosted.example.test/handler/sign-in\");\n    signInUrl.searchParams.set(\"after_auth_return_to\", customerReturnTo);\n    signInUrl.searchParams.set(crossDomainAuthQueryParams.state, \"outer-state\");\n    signInUrl.searchParams.set(crossDomainAuthQueryParams.codeChallenge, \"outer-challenge\");\n    signInUrl.searchParams.set(crossDomainAuthQueryParams.afterCallbackRedirectUrl, \"https://customer.example.test/dashboard\");\n\n    const forgotPlan = await plan({\n      handlerName: \"forgotPassword\",\n      rawHandlerUrl: \"/handler/forgot-password\",\n      currentUrl: signInUrl,\n    });\n    const forgotUrl = expectRedirectUrl(forgotPlan, signInUrl);\n    expectContinuation(forgotUrl, customerReturnTo);\n\n    const callbackPlan = await plan({\n      handlerName: \"passwordReset\",\n      rawHandlerUrl: \"/handler/password-reset\",\n      currentUrl: forgotUrl,\n    });\n    const resetEmailCallbackUrl = expectRedirectUrl(callbackPlan, forgotUrl);\n    expectContinuation(resetEmailCallbackUrl, customerReturnTo);\n\n    // Model opening the callback in a new tab: only URL state is available.\n    resetEmailCallbackUrl.searchParams.set(\"code\", \"reset-code\");\n    const signInPlan = await plan({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      currentUrl: resetEmailCallbackUrl,\n      noRedirectBack: true,\n    });\n    const finalSignInUrl = expectRedirectUrl(signInPlan, resetEmailCallbackUrl);\n    expectContinuation(finalSignInUrl, customerReturnTo);\n    expect(finalSignInUrl.searchParams.has(\"code\")).toBe(false);\n  });\n\n  it.each([\n    [\"forgotPassword\", \"/handler/forgot-password\"],\n    [\"passwordReset\", \"/handler/password-reset\"],\n  ] as const)(\"never synthesizes the current %s page as a return target\", async (handlerName, rawHandlerUrl) => {\n    const currentUrl = new URL(`https://hosted.example.test${rawHandlerUrl}?code=reset-code`);\n    const result = expectRedirectUrl(await plan({\n      handlerName,\n      rawHandlerUrl,\n      currentUrl,\n    }), currentUrl);\n\n    expect(result.searchParams.has(\"after_auth_return_to\")).toBe(false);\n    expect(result.searchParams.has(\"code\")).toBe(false);\n  });\n\n  it(\"makes sign-in noRedirectBack suppress capture while preserving only inherited state\", async () => {\n    const resetUrlWithoutContinuation = new URL(\"https://hosted.example.test/handler/password-reset?code=reset-code\");\n    const result = expectRedirectUrl(await plan({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      currentUrl: resetUrlWithoutContinuation,\n      noRedirectBack: true,\n    }), resetUrlWithoutContinuation);\n\n    expect(result.toString()).toBe(\"https://hosted.example.test/handler/sign-in\");\n  });\n\n  it.each([\"afterSignIn\", \"afterSignUp\"] as const)(\n    \"keeps existing %s noRedirectBack semantics\",\n    async (handlerName) => {\n      const currentUrl = new URL(\"https://hosted.example.test/handler/sign-in?after_auth_return_to=%2Fcustomer\");\n      const result = expectRedirectUrl(await plan({\n        handlerName,\n        rawHandlerUrl: \"/default-after-auth\",\n        currentUrl,\n        noRedirectBack: true,\n      }), currentUrl);\n\n      expect(result.toString()).toBe(\"https://hosted.example.test/default-after-auth\");\n    },\n  );\n});\n"],"mappings":";;;AAOA,MAAM,wBAAwB;AAE9B,eAAe,KAAK,SAKjB;CACD,OAAO,OAAA,GAAA,wBAAA,sBAAA,CAA4B;EACjC,GAAG;EACH,gBAAgB,QAAQ,mBAAmB;EAC3C,gCAAgC;EAChC,mBAAmB;EACnB,6BAA6B,YAAY;GACvC,MAAM,IAAI,MAAM,sEAAsE;EACxF;CACF,CAAC;AACH;AAEA,SAAS,kBAAkB,YAA8C,SAAmB;CAC1F,IAAI,WAAW,SAAS,YACtB,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO,IAAI,IAAI,WAAW,KAAK,OAAO;AACxC;AAEA,SAAS,mBAAmB,KAAU,kBAAgC;CACpE,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,gBAAgB;CAC1E,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,aAAa,IAAIA,wBAAAA,2BAA2B,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa;CACjF,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,aAAa,IAAIA,wBAAAA,2BAA2B,aAAa,CAAC,CAAC,CAAC,KAAK,iBAAiB;CAC7F,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,aAAa,IAAIA,wBAAAA,2BAA2B,wBAAwB,CAAC,CAAC,CAAC,KAAK,yCAAyC;AAClI;qBAES,uCAAuC;CAC9C,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE,YAAY;EAenF,CAAA,GAAA,OAAA,OAAA,CAAO,OAAA,GAAA,wBAAA,sBAAA,CAdoC;GACzC,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY;GACZ,gCAAgC;IAC9B,MAAM,IAAI,MAAM,yEAAyE;GAC3F;GACA,mBAAmB;GACnB,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,6EAA6E;GAC/F;EACF,CAAC,CAEY,CAAC,CAAC,QAAQ;GACrB,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;AACH,CAAC;qBAEQ,6CAA6C;CACpD,CAAA,GAAA,OAAA,GAAA,CAAG,gGAAgG,YAAY;EAC7G,MAAM,mBAAmB;EACzB,MAAM,YAAY,IAAI,IAAI,6CAA6C;EACvE,UAAU,aAAa,IAAI,wBAAwB,gBAAgB;EACnE,UAAU,aAAa,IAAIA,wBAAAA,2BAA2B,OAAO,aAAa;EAC1E,UAAU,aAAa,IAAIA,wBAAAA,2BAA2B,eAAe,iBAAiB;EACtF,UAAU,aAAa,IAAIA,wBAAAA,2BAA2B,0BAA0B,yCAAyC;EAOzH,MAAM,YAAY,kBAAkB,MALX,KAAK;GAC5B,aAAa;GACb,eAAe;GACf,YAAY;EACd,CAAC,GAC+C,SAAS;EACzD,mBAAmB,WAAW,gBAAgB;EAO9C,MAAM,wBAAwB,kBAAkB,MALrB,KAAK;GAC9B,aAAa;GACb,eAAe;GACf,YAAY;EACd,CAAC,GAC6D,SAAS;EACvE,mBAAmB,uBAAuB,gBAAgB;EAG1D,sBAAsB,aAAa,IAAI,QAAQ,YAAY;EAO3D,MAAM,iBAAiB,kBAAkB,MANhB,KAAK;GAC5B,aAAa;GACb,eAAe;GACf,YAAY;GACZ,gBAAgB;EAClB,CAAC,GACoD,qBAAqB;EAC1E,mBAAmB,gBAAgB,gBAAgB;EACnD,CAAA,GAAA,OAAA,OAAA,CAAO,eAAe,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK;CAC5D,CAAC;CAED,OAAA,GAAG,KAAK,CACN,CAAC,kBAAkB,0BAA0B,GAC7C,CAAC,iBAAiB,yBAAyB,CAC7C,CAAU,CAAC,CAAC,4DAA4D,OAAO,aAAa,kBAAkB;EAC5G,MAAM,aAAa,IAAI,IAAI,8BAA8B,cAAc,iBAAiB;EACxF,MAAM,SAAS,kBAAkB,MAAM,KAAK;GAC1C;GACA;GACA;EACF,CAAC,GAAG,UAAU;EAEd,CAAA,GAAA,OAAA,OAAA,CAAO,OAAO,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,KAAK;EAClE,CAAA,GAAA,OAAA,OAAA,CAAO,OAAO,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK;CACpD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,uFAAuF,YAAY;EACpG,MAAM,8BAA8B,IAAI,IAAI,oEAAoE;EAQhH,CAAA,GAAA,OAAA,OAAA,CAPe,kBAAkB,MAAM,KAAK;GAC1C,aAAa;GACb,eAAe;GACf,YAAY;GACZ,gBAAgB;EAClB,CAAC,GAAG,2BAEQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,6CAA6C;CAC9E,CAAC;CAED,OAAA,GAAG,KAAK,CAAC,eAAe,aAAa,CAAU,CAAC,CAC9C,8CACA,OAAO,gBAAgB;EACrB,MAAM,aAAa,IAAI,IAAI,8EAA8E;EAQzG,CAAA,GAAA,OAAA,OAAA,CAPe,kBAAkB,MAAM,KAAK;GAC1C;GACA,eAAe;GACf;GACA,gBAAgB;EAClB,CAAC,GAAG,UAEQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,gDAAgD;CACjF,CACF;AACF,CAAC"}

package/dist/lib/hexclave-app/apps/implementations/server-app-impl.d.ts

@@ -1,2 +1,2 @@
-import { n as _HexclaveServerAppImplIncomplete } from "../../../../admin-app-impl-CMKoG26j.js";
+import { n as _HexclaveServerAppImplIncomplete } from "../../../../admin-app-impl-BmZQrPYN.js";
 export { _HexclaveServerAppImplIncomplete };

package/dist/lib/hexclave-app/apps/implementations/server-app-impl.js

@@ -13,8 +13,8 @@ let _simplewebauthn_browser = require("@simplewebauthn/browser");
 let ____________utils_url_js = require("../../../../utils/url.js");
 let ______api_keys_index_js = require("../../api-keys/index.js");
 let ______contact_channels_index_js = require("../../contact-channels/index.js");
-let ______teams_index_js = require("../../teams/index.js");
 let ______passkey_rp_id_js = require("../../passkey-rp-id.js");
+let ______teams_index_js = require("../../teams/index.js");
 let ______users_index_js = require("../../users/index.js");
 //#region src/lib/hexclave-app/apps/implementations/server-app-impl.ts
 var _HexclaveServerAppImplIncomplete = class extends __client_app_impl_js._HexclaveClientAppImplIncomplete {

package/dist/lib/hexclave-app/apps/index.d.ts

@@ -1,2 +1,2 @@
-import { B as StackServerAppConstructor, D as HexclaveAdminApp, F as StackAdminAppConstructorOptions, I as HexclaveServerApp, L as HexclaveServerAppConstructor, N as StackAdminApp, O as HexclaveAdminAppConstructor, P as StackAdminAppConstructor, R as HexclaveServerAppConstructorOptions, V as StackServerAppConstructorOptions, a as StackClientApp, c as StackClientAppJson, i as HexclaveClientAppJson, k as HexclaveAdminAppConstructorOptions, n as HexclaveClientAppConstructor, o as StackClientAppConstructor, r as HexclaveClientAppConstructorOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp, z as StackServerApp } from "../../../client-app-D84Jo2In.js";
+import { A as HexclaveAdminAppConstructorOptions, B as StackServerApp, F as StackAdminAppConstructor, H as StackServerAppConstructorOptions, I as StackAdminAppConstructorOptions, L as HexclaveServerApp, O as HexclaveAdminApp, P as StackAdminApp, R as HexclaveServerAppConstructor, V as StackServerAppConstructor, a as StackClientApp, c as StackClientAppJson, i as HexclaveClientAppJson, k as HexclaveAdminAppConstructor, n as HexclaveClientAppConstructor, o as StackClientAppConstructor, r as HexclaveClientAppConstructorOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp, z as HexclaveServerAppConstructorOptions } from "../../../client-app-BowxO_77.js";
 export { HexclaveAdminApp, type HexclaveAdminAppConstructor, type HexclaveAdminAppConstructorOptions, HexclaveClientApp, type HexclaveClientAppConstructor, type HexclaveClientAppConstructorOptions, type HexclaveClientAppJson, HexclaveServerApp, type HexclaveServerAppConstructor, type HexclaveServerAppConstructorOptions, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions };

package/dist/lib/hexclave-app/apps/interfaces/admin-app.d.ts

@@ -1,3 +1,3 @@
 import { a as AdminWorkflowRunState, c as AdminWorkflowStepAttempt, d as AdminWorkflowUpgradeResult, f as AdminWorkflowVersion, i as AdminWorkflowRunDetails, l as AdminWorkflowSyncResult, n as AdminWorkflowDivergenceDiagnostic, o as AdminWorkflowRunsFilter, r as AdminWorkflowRun, s as AdminWorkflowStep, t as AdminWorkflow, u as AdminWorkflowTrigger } from "../../../../workflows-2-MBWbGl.js";
-import { A as ManagedEmailProviderListItem, D as HexclaveAdminApp, E as EmailOutboxUpdateOptions, F as StackAdminAppConstructorOptions, M as ManagedEmailProviderStatus, N as StackAdminApp, O as HexclaveAdminAppConstructor, P as StackAdminAppConstructor, T as EmailOutboxListResult, j as ManagedEmailProviderSetupResult, k as HexclaveAdminAppConstructorOptions, w as EmailOutboxListOptions } from "../../../../client-app-D84Jo2In.js";
+import { A as HexclaveAdminAppConstructorOptions, D as EmailOutboxUpdateOptions, E as EmailOutboxListResult, F as StackAdminAppConstructor, I as StackAdminAppConstructorOptions, M as ManagedEmailProviderSetupResult, N as ManagedEmailProviderStatus, O as HexclaveAdminApp, P as StackAdminApp, T as EmailOutboxListOptions, j as ManagedEmailProviderListItem, k as HexclaveAdminAppConstructor } from "../../../../client-app-BowxO_77.js";
 export { type AdminWorkflow, type AdminWorkflowDivergenceDiagnostic, type AdminWorkflowRun, type AdminWorkflowRunDetails, type AdminWorkflowRunState, type AdminWorkflowRunsFilter, type AdminWorkflowStep, type AdminWorkflowStepAttempt, type AdminWorkflowSyncResult, type AdminWorkflowTrigger, type AdminWorkflowUpgradeResult, type AdminWorkflowVersion, EmailOutboxListOptions, EmailOutboxListResult, EmailOutboxUpdateOptions, HexclaveAdminApp, HexclaveAdminAppConstructor, HexclaveAdminAppConstructorOptions, ManagedEmailProviderListItem, ManagedEmailProviderSetupResult, ManagedEmailProviderStatus, StackAdminApp, StackAdminAppConstructor, StackAdminAppConstructorOptions };

package/dist/lib/hexclave-app/apps/interfaces/client-app.d.ts

@@ -1,2 +1,2 @@
-import { a as StackClientApp, c as StackClientAppJson, i as HexclaveClientAppJson, n as HexclaveClientAppConstructor, o as StackClientAppConstructor, r as HexclaveClientAppConstructorOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp } from "../../../../client-app-D84Jo2In.js";
+import { a as StackClientApp, c as StackClientAppJson, i as HexclaveClientAppJson, n as HexclaveClientAppConstructor, o as StackClientAppConstructor, r as HexclaveClientAppConstructorOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp } from "../../../../client-app-BowxO_77.js";
 export { HexclaveClientApp, HexclaveClientAppConstructor, HexclaveClientAppConstructorOptions, HexclaveClientAppJson, StackClientApp, StackClientAppConstructor, StackClientAppConstructorOptions, StackClientAppJson };

package/dist/lib/hexclave-app/apps/interfaces/client-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-app.js","names":["_HexclaveClientAppImpl"],"sources":["../../../../../src/lib/hexclave-app/apps/interfaces/client-app.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport type { RequestListener } from \"@hexclave/shared/dist/interface/client-interface\";\nimport { CurrentUserCrud } from \"@hexclave/shared/dist/interface/crud/current-user\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { AsyncStoreProperty, AuthLike, GetCurrentPartialUserOptions, GetCurrentUserOptions, HandlerUrlOptions, HandlerUrls, hexclaveAppInternalsSymbol, OAuthScopesOnSignIn, RedirectMethod, RedirectToOptions, ResolvedHandlerUrls, TokenStoreInit } from \"../../common\";\nimport { CustomerInvoicesList, CustomerInvoicesRequestOptions, CustomerProductsList, CustomerProductsRequestOptions, Item } from \"../../customers\";\nimport { Project } from \"../../projects\";\nimport { ProjectCurrentUser, SyncedPartialUser, TokenPartialUser } from \"../../users\";\nimport { _HexclaveClientAppImpl } from \"../implementations\";\nimport { AnalyticsOptions } from \"../implementations/session-replay\";\n\n/** @deprecated Use `HexclaveClientAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackClientAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = {\n  baseUrl?: string | { browser: string, server: string },\n  extraRequestHeaders?: Record<string, string>,\n  projectId?: ProjectId,\n  publishableClientKey?: string,\n  urls?: HandlerUrlOptions,\n  oauthScopesOnSignIn?: Partial<OAuthScopesOnSignIn>,\n  tokenStore?: TokenStoreInit<HasTokenStore>,\n  redirectMethod?: RedirectMethod,\n  inheritsFrom?: StackClientApp<any, any>,\n\n  /**\n   * Whether to show the Hexclave dev tool indicator in browser-like environments.\n   *\n   * - `true`: always show\n   * - `false`: never show\n   * - `\"auto\"` (default): show based on NODE_ENV or origin heuristics\n   */\n  devTool?: boolean | \"auto\",\n\n  /**\n   * By default, the Stack app will automatically prefetch some data from Stack's server when this app is first\n   * constructed. This improves the performance of your app, but will create network requests that are unnecessary if\n   * the app is never used or disposed of immediately. To disable this behavior, set this option to true.\n   */\n  noAutomaticPrefetch?: boolean,\n\n  /**\n   * Whether the constructor starts browser integrations and other automatic side effects. Defaults to `true`.\n   *\n   * Set this to `false` when the app is instantiated inside a custom dashboard. Explicit method calls remain\n   * available and can still perform their documented side effects.\n   */\n  automaticSideEffects?: boolean,\n\n  /**\n   * Options for analytics and session recording. Replays are enabled by default;\n   * set `{ replays: { enabled: false } }` to opt out.\n   */\n  analytics?: AnalyticsOptions,\n} & (\n  { tokenStore: TokenStoreInit<HasTokenStore> } | { tokenStore?: undefined, inheritsFrom: StackClientApp<HasTokenStore, any> }\n) & (\n  string extends ProjectId ? unknown : ({ projectId: ProjectId } | { inheritsFrom: StackClientApp<any, ProjectId> })\n);\n\n\n/** @deprecated Use `HexclaveClientAppJson` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & { inheritsFrom?: undefined } & {\n  uniqueIdentifier: string,\n  // note: if you add more fields here, make sure to ensure the checkString in the constructor has/doesn't have them\n};\n\n/** @deprecated Use `HexclaveClientApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = (\n  & {\n    readonly projectId: ProjectId,\n\n    /**\n     * The version of the Hexclave SDK.\n     */\n    readonly version: string,\n\n    /**\n     * @deprecated Do not use `app.urls` for navigation. It is static and does not include runtime redirect-back,\n     * cross-domain auth, or sign-out state. Use the matching `redirectToXyz()` method instead, for example\n     * `redirectToSignIn()`, `redirectToSignUp()`, `redirectToSignOut()`, or `redirectToAccountSettings()`.\n     */\n    readonly urls: Readonly<ResolvedHandlerUrls>,\n\n    signInWithOAuth(provider: string, options?: { returnTo?: string }): Promise<void>,\n    signInWithCredential(options: { email: string, password: string, noRedirect?: boolean }): Promise<Result<undefined, KnownErrors[\"EmailPasswordMismatch\"] | KnownErrors[\"InvalidTotpCode\"]>>,\n    signUpWithCredential(options: {\n      email: string,\n      password: string,\n      noRedirect?: boolean,\n    } & ({ noVerificationCallback: true } | { noVerificationCallback?: false, verificationCallbackUrl?: string })): Promise<Result<undefined, KnownErrors[\"UserWithEmailAlreadyExists\"] | KnownErrors[\"ContactChannelAlreadyUsedForAuthBySomeoneElse\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | KnownErrors[\"BotChallengeFailed\"]>>,\n    signInWithPasskey(): Promise<Result<undefined, KnownErrors[\"PasskeyAuthenticationFailed\"] | KnownErrors[\"InvalidTotpCode\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n    callOAuthCallback(): Promise<boolean>,\n    promptCliLogin(options: { appUrl: string, expiresInMillis?: number, anonRefreshToken?: string, promptLink?: (url: string, loginCode: string) => void }): Promise<Result<string, KnownErrors[\"CliAuthError\"] | KnownErrors[\"CliAuthExpiredError\"] | KnownErrors[\"CliAuthUsedError\"]>>,\n    sendForgotPasswordEmail(email: string, options?: { callbackUrl?: string }): Promise<Result<undefined, KnownErrors[\"UserNotFound\"]>>,\n    sendMagicLinkEmail(email: string, options?: { callbackUrl?: string }): Promise<Result<{ nonce: string }, KnownErrors[\"RedirectUrlNotWhitelisted\"] | KnownErrors[\"BotChallengeFailed\"]>>,\n    resetPassword(options: { code: string, password: string }): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>>,\n    verifyPasswordResetCode(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>>,\n    verifyTeamInvitationCode(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"TeamInvitationEmailMismatch\"]>>,\n    acceptTeamInvitation(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"TeamInvitationEmailMismatch\"]>>,\n    getTeamInvitationDetails(code: string): Promise<Result<{ teamDisplayName: string }, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"TeamInvitationEmailMismatch\"]>>,\n    verifyEmail(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>>,\n    signInWithMagicLink(code: string, options?: { noRedirect?: boolean }): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"InvalidTotpCode\"]>>,\n    signInWithMfa(otp: string, code: string, options?: { noRedirect?: boolean }): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"InvalidTotpCode\"]>>,\n\n    redirectToOAuthCallback(): Promise<void>,\n\n    getConvexClientAuth(options: HasTokenStore extends false ? { tokenStore: TokenStoreInit } : { tokenStore?: TokenStoreInit }): (args: { forceRefreshToken: boolean }) => Promise<string | null>,\n    getConvexHttpClientAuth(options: { tokenStore: TokenStoreInit }): Promise<string>,\n\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'redirect' }): ProjectCurrentUser<ProjectId>,\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'throw' }): ProjectCurrentUser<ProjectId>,\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'anonymous' }): ProjectCurrentUser<ProjectId>,\n    useUser(options?: GetCurrentUserOptions<HasTokenStore>): ProjectCurrentUser<ProjectId> | null,\n\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'redirect' }): Promise<ProjectCurrentUser<ProjectId>>,\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'throw' }): Promise<ProjectCurrentUser<ProjectId>>,\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'anonymous' }): Promise<ProjectCurrentUser<ProjectId>>,\n    getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentUser<ProjectId> | null>,\n\n    cancelSubscription(options: { productId: string, subscriptionId?: string } | { productId: string, subscriptionId?: string, teamId: string }): Promise<void>,\n\n    // note: we don't special-case 'anonymous' here to return non-null, see GetPartialUserOptions for more details\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'token' }): Promise<TokenPartialUser | null>,\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'convex' }): Promise<TokenPartialUser | null>,\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): Promise<SyncedPartialUser | TokenPartialUser | null>,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'token' }): TokenPartialUser | null,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'convex' }): TokenPartialUser | null,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): SyncedPartialUser | TokenPartialUser | null,\n    useNavigate(): (to: string) => void, // THIS_LINE_PLATFORM react-like\n\n    [hexclaveAppInternalsSymbol]: {\n      toClientJson(): StackClientAppJson<HasTokenStore, ProjectId>,\n      setCurrentUser(userJsonPromise: Promise<CurrentUserCrud['Client']['Read'] | null>): void,\n      getConstructorOptions(): StackClientAppConstructorOptions<HasTokenStore, ProjectId> & { inheritsFrom?: undefined },\n      sendSessionReplayBatch(body: string, options: { keepalive: boolean }): Promise<Result<Response, Error>>,\n      sendAnalyticsEventBatch(body: string, options: { keepalive: boolean }): Promise<Result<Response, Error>>,\n      addRequestListener(listener: RequestListener): () => void,\n      sendRequest(path: string, requestOptions: RequestInit, requestType?: \"client\" | \"server\" | \"admin\"): Promise<Response>,\n      getUrls(): Readonly<ResolvedHandlerUrls>,\n      getRedirectMethod(): RedirectMethod,\n      redirectToUrl(url: string | URL, options?: { replace?: boolean }): Promise<void>,\n      getRedirectToHandlerUrl(handlerName: keyof HandlerUrls, options?: RedirectToOptions): Promise<string>,\n      redirectToHandler(handlerName: keyof HandlerUrls, options?: RedirectToOptions): Promise<void>,\n      /** Raw flow metadata only. Never navigate to this value without normal redirect validation. */\n      getRawAfterAuthReturnTo(): string | null,\n      signInWithTokens(tokens: { accessToken: string, refreshToken: string }): Promise<void>,\n      awaitPendingAuthResolutions(): Promise<void>,\n      isTrustedRedirectUrl(url: string): Promise<boolean>,\n    },\n  }\n  & AsyncStoreProperty<\"project\", [], Project, false>\n  & AsyncStoreProperty<\n    \"item\",\n    [{ itemId: string, userId: string } | { itemId: string, teamId: string } | { itemId: string, customCustomerId: string }],\n    Item,\n    false\n  >\n  & AsyncStoreProperty<\n    \"products\",\n    [options: CustomerProductsRequestOptions],\n    CustomerProductsList,\n    true\n  >\n  & AsyncStoreProperty<\n    \"invoices\",\n    [options: CustomerInvoicesRequestOptions],\n    CustomerInvoicesList,\n    true\n  >\n  & { [K in `redirectTo${Capitalize<keyof Omit<HandlerUrls, 'handler' | 'oauthCallback'>>}`]: (options?: RedirectToOptions) => Promise<void> }\n  & AuthLike<HasTokenStore extends false ? { tokenStore: TokenStoreInit } : { tokenStore?: TokenStoreInit }>\n);\n/** @deprecated Use `HexclaveClientAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackClientAppConstructor = {\n  new <\n    TokenStoreType extends string,\n    HasTokenStore extends (TokenStoreType extends {} ? true : boolean),\n    ProjectId extends string\n  >(options: StackClientAppConstructorOptions<HasTokenStore, ProjectId>): StackClientApp<HasTokenStore, ProjectId>,\n  new(options: StackClientAppConstructorOptions<boolean, string>): StackClientApp<boolean, string>,\n\n  [hexclaveAppInternalsSymbol]: {\n    fromClientJson<HasTokenStore extends boolean, ProjectId extends string>(\n      json: StackClientAppJson<HasTokenStore, ProjectId>\n    ): StackClientApp<HasTokenStore, ProjectId>,\n  },\n};\nexport type HexclaveClientAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId>;\nexport type HexclaveClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppJson<HasTokenStore, ProjectId>;\nexport type HexclaveClientApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackClientApp<HasTokenStore, ProjectId>;\nexport type HexclaveClientAppConstructor = StackClientAppConstructor;\nexport const HexclaveClientApp: HexclaveClientAppConstructor = _HexclaveClientAppImpl;\n/** @deprecated Use `HexclaveClientApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport const StackClientApp: StackClientAppConstructor = HexclaveClientApp;\n"],"mappings":";;AAkMA,MAAa,yDAAkDA,CAAAA,CAAAA;;AAE/D,MAAa,iBAA4C"}
+{"version":3,"file":"client-app.js","names":["_HexclaveClientAppImpl"],"sources":["../../../../../src/lib/hexclave-app/apps/interfaces/client-app.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport type { RequestListener } from \"@hexclave/shared/dist/interface/client-interface\";\nimport { CurrentUserCrud } from \"@hexclave/shared/dist/interface/crud/current-user\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { AsyncStoreProperty, AuthLike, GetCurrentPartialUserOptions, GetCurrentUserOptions, HandlerUrlOptions, HandlerUrls, hexclaveAppInternalsSymbol, OAuthScopesOnSignIn, RedirectMethod, RedirectToOptions, ResolvedHandlerUrls, TokenStoreInit } from \"../../common\";\nimport { CustomerInvoicesList, CustomerInvoicesRequestOptions, CustomerProductsList, CustomerProductsRequestOptions, Item } from \"../../customers\";\nimport { Project } from \"../../projects\";\nimport { ProjectCurrentUser, SyncedPartialUser, TokenPartialUser } from \"../../users\";\nimport { _HexclaveClientAppImpl } from \"../implementations\";\nimport { AnalyticsOptions } from \"../implementations/session-replay\";\n\n/** @deprecated Use `HexclaveClientAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackClientAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = {\n  baseUrl?: string | { browser: string, server: string },\n  extraRequestHeaders?: Record<string, string>,\n  projectId?: ProjectId,\n  publishableClientKey?: string,\n  urls?: HandlerUrlOptions,\n  oauthScopesOnSignIn?: Partial<OAuthScopesOnSignIn>,\n  tokenStore?: TokenStoreInit<HasTokenStore>,\n  redirectMethod?: RedirectMethod,\n  inheritsFrom?: StackClientApp<any, any>,\n\n  /**\n   * Whether to show the Hexclave dev tool indicator in browser-like environments.\n   *\n   * - `true`: always show\n   * - `false`: never show\n   * - `\"auto\"` (default): show based on NODE_ENV or origin heuristics\n   */\n  devTool?: boolean | \"auto\",\n\n  /**\n   * By default, the Stack app will automatically prefetch some data from Stack's server when this app is first\n   * constructed. This improves the performance of your app, but will create network requests that are unnecessary if\n   * the app is never used or disposed of immediately. To disable this behavior, set this option to true.\n   */\n  noAutomaticPrefetch?: boolean,\n\n  /**\n   * Whether the constructor starts browser integrations and other automatic side effects. Defaults to `true`.\n   *\n   * Set this to `false` when the app is instantiated inside a custom dashboard. Explicit method calls remain\n   * available and can still perform their documented side effects.\n   */\n  automaticSideEffects?: boolean,\n\n  /**\n   * Options for analytics and session recording. Replays are enabled by default;\n   * set `{ replays: { enabled: false } }` to opt out.\n   */\n  analytics?: AnalyticsOptions,\n} & (\n  { tokenStore: TokenStoreInit<HasTokenStore> } | { tokenStore?: undefined, inheritsFrom: StackClientApp<HasTokenStore, any> }\n) & (\n  string extends ProjectId ? unknown : ({ projectId: ProjectId } | { inheritsFrom: StackClientApp<any, ProjectId> })\n);\n\n\n/** @deprecated Use `HexclaveClientAppJson` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & { inheritsFrom?: undefined } & {\n  uniqueIdentifier: string,\n  // note: if you add more fields here, make sure to ensure the checkString in the constructor has/doesn't have them\n};\n\n/** @deprecated Use `HexclaveClientApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = (\n  & {\n    readonly projectId: ProjectId,\n\n    /**\n     * The version of the Hexclave SDK.\n     */\n    readonly version: string,\n\n    /**\n     * @deprecated Do not use `app.urls` for navigation. It is static and does not include runtime redirect-back,\n     * cross-domain auth, or sign-out state. Use the matching `redirectToXyz()` method instead, for example\n     * `redirectToSignIn()`, `redirectToSignUp()`, `redirectToSignOut()`, or `redirectToAccountSettings()`.\n     */\n    readonly urls: Readonly<ResolvedHandlerUrls>,\n\n    signInWithOAuth(provider: string, options?: { returnTo?: string }): Promise<void>,\n    signInWithCredential(options: { email: string, password: string, noRedirect?: boolean }): Promise<Result<undefined, KnownErrors[\"EmailPasswordMismatch\"] | KnownErrors[\"InvalidTotpCode\"]>>,\n    signUpWithCredential(options: {\n      email: string,\n      password: string,\n      noRedirect?: boolean,\n    } & ({ noVerificationCallback: true } | { noVerificationCallback?: false, verificationCallbackUrl?: string })): Promise<Result<undefined, KnownErrors[\"UserWithEmailAlreadyExists\"] | KnownErrors[\"ContactChannelAlreadyUsedForAuthBySomeoneElse\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | KnownErrors[\"BotChallengeFailed\"]>>,\n    signInWithPasskey(): Promise<Result<undefined, KnownErrors[\"PasskeyAuthenticationFailed\"] | KnownErrors[\"InvalidTotpCode\"] | KnownErrors[\"PasskeyWebAuthnError\"]>>,\n    callOAuthCallback(): Promise<boolean>,\n    promptCliLogin(options: { appUrl: string, expiresInMillis?: number, anonRefreshToken?: string, promptLink?: (url: string, loginCode: string) => void }): Promise<Result<string, KnownErrors[\"CliAuthError\"] | KnownErrors[\"CliAuthExpiredError\"] | KnownErrors[\"CliAuthUsedError\"]>>,\n    sendForgotPasswordEmail(email: string, options?: { callbackUrl?: string }): Promise<Result<undefined, KnownErrors[\"UserNotFound\"]>>,\n    sendMagicLinkEmail(email: string, options?: { callbackUrl?: string }): Promise<Result<{ nonce: string }, KnownErrors[\"RedirectUrlNotWhitelisted\"] | KnownErrors[\"BotChallengeFailed\"]>>,\n    resetPassword(options: { code: string, password: string }): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>>,\n    verifyPasswordResetCode(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>>,\n    verifyTeamInvitationCode(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"TeamInvitationEmailMismatch\"]>>,\n    acceptTeamInvitation(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"TeamInvitationEmailMismatch\"]>>,\n    getTeamInvitationDetails(code: string): Promise<Result<{ teamDisplayName: string }, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"TeamInvitationEmailMismatch\"]>>,\n    verifyEmail(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>>,\n    signInWithMagicLink(code: string, options?: { noRedirect?: boolean }): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"InvalidTotpCode\"]>>,\n    signInWithMfa(otp: string, code: string, options?: { noRedirect?: boolean }): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"InvalidTotpCode\"]>>,\n\n    redirectToOAuthCallback(): Promise<void>,\n\n    getConvexClientAuth(options: HasTokenStore extends false ? { tokenStore: TokenStoreInit } : { tokenStore?: TokenStoreInit }): (args: { forceRefreshToken: boolean }) => Promise<string | null>,\n    getConvexHttpClientAuth(options: { tokenStore: TokenStoreInit }): Promise<string>,\n\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'redirect' }): ProjectCurrentUser<ProjectId>,\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'throw' }): ProjectCurrentUser<ProjectId>,\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'anonymous' }): ProjectCurrentUser<ProjectId>,\n    useUser(options?: GetCurrentUserOptions<HasTokenStore>): ProjectCurrentUser<ProjectId> | null,\n\n    /**\n     * @deprecated Whether an app object has server permissions does not determine whether this\n     * call runs in a browser, so an async read should not implicitly choose a navigation strategy.\n     * In React, use useUser({ or: \"redirect\" }). Otherwise, call getUser() and explicitly invoke\n     * redirectToSignIn() from browser code when it returns null.\n     */\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'redirect' }): Promise<ProjectCurrentUser<ProjectId>>,\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'throw' }): Promise<ProjectCurrentUser<ProjectId>>,\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'anonymous' }): Promise<ProjectCurrentUser<ProjectId>>,\n    getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentUser<ProjectId> | null>,\n\n    cancelSubscription(options: { productId: string, subscriptionId?: string } | { productId: string, subscriptionId?: string, teamId: string }): Promise<void>,\n\n    // note: we don't special-case 'anonymous' here to return non-null, see GetPartialUserOptions for more details\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'token' }): Promise<TokenPartialUser | null>,\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'convex' }): Promise<TokenPartialUser | null>,\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): Promise<SyncedPartialUser | TokenPartialUser | null>,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'token' }): TokenPartialUser | null,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'convex' }): TokenPartialUser | null,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): SyncedPartialUser | TokenPartialUser | null,\n    useNavigate(): (to: string) => void, // THIS_LINE_PLATFORM react-like\n\n    [hexclaveAppInternalsSymbol]: {\n      toClientJson(): StackClientAppJson<HasTokenStore, ProjectId>,\n      setCurrentUser(userJsonPromise: Promise<CurrentUserCrud['Client']['Read'] | null>): void,\n      getConstructorOptions(): StackClientAppConstructorOptions<HasTokenStore, ProjectId> & { inheritsFrom?: undefined },\n      sendSessionReplayBatch(body: string, options: { keepalive: boolean }): Promise<Result<Response, Error>>,\n      sendAnalyticsEventBatch(body: string, options: { keepalive: boolean }): Promise<Result<Response, Error>>,\n      addRequestListener(listener: RequestListener): () => void,\n      sendRequest(path: string, requestOptions: RequestInit, requestType?: \"client\" | \"server\" | \"admin\"): Promise<Response>,\n      getUrls(): Readonly<ResolvedHandlerUrls>,\n      getRedirectMethod(): RedirectMethod,\n      redirectToUrl(url: string | URL, options?: { replace?: boolean }): Promise<void>,\n      getRedirectToHandlerUrl(handlerName: keyof HandlerUrls, options?: RedirectToOptions): Promise<string>,\n      redirectToHandler(handlerName: keyof HandlerUrls, options?: RedirectToOptions): Promise<void>,\n      /** Raw flow metadata only. Never navigate to this value without normal redirect validation. */\n      getRawAfterAuthReturnTo(): string | null,\n      signInWithTokens(tokens: { accessToken: string, refreshToken: string }): Promise<void>,\n      awaitPendingAuthResolutions(): Promise<void>,\n      isTrustedRedirectUrl(url: string): Promise<boolean>,\n    },\n  }\n  & AsyncStoreProperty<\"project\", [], Project, false>\n  & AsyncStoreProperty<\n    \"item\",\n    [{ itemId: string, userId: string } | { itemId: string, teamId: string } | { itemId: string, customCustomerId: string }],\n    Item,\n    false\n  >\n  & AsyncStoreProperty<\n    \"products\",\n    [options: CustomerProductsRequestOptions],\n    CustomerProductsList,\n    true\n  >\n  & AsyncStoreProperty<\n    \"invoices\",\n    [options: CustomerInvoicesRequestOptions],\n    CustomerInvoicesList,\n    true\n  >\n  & { [K in `redirectTo${Capitalize<keyof Omit<HandlerUrls, 'handler' | 'oauthCallback'>>}`]: (options?: RedirectToOptions) => Promise<void> }\n  & AuthLike<HasTokenStore extends false ? { tokenStore: TokenStoreInit } : { tokenStore?: TokenStoreInit }>\n);\n/** @deprecated Use `HexclaveClientAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackClientAppConstructor = {\n  new <\n    TokenStoreType extends string,\n    HasTokenStore extends (TokenStoreType extends {} ? true : boolean),\n    ProjectId extends string\n  >(options: StackClientAppConstructorOptions<HasTokenStore, ProjectId>): StackClientApp<HasTokenStore, ProjectId>,\n  new(options: StackClientAppConstructorOptions<boolean, string>): StackClientApp<boolean, string>,\n\n  [hexclaveAppInternalsSymbol]: {\n    fromClientJson<HasTokenStore extends boolean, ProjectId extends string>(\n      json: StackClientAppJson<HasTokenStore, ProjectId>\n    ): StackClientApp<HasTokenStore, ProjectId>,\n  },\n};\nexport type HexclaveClientAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId>;\nexport type HexclaveClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppJson<HasTokenStore, ProjectId>;\nexport type HexclaveClientApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackClientApp<HasTokenStore, ProjectId>;\nexport type HexclaveClientAppConstructor = StackClientAppConstructor;\nexport const HexclaveClientApp: HexclaveClientAppConstructor = _HexclaveClientAppImpl;\n/** @deprecated Use `HexclaveClientApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport const StackClientApp: StackClientAppConstructor = HexclaveClientApp;\n"],"mappings":";;AAwMA,MAAa,yDAAkDA,CAAAA,CAAAA;;AAE/D,MAAa,iBAA4C"}

package/dist/lib/hexclave-app/apps/interfaces/server-app.d.ts

@@ -1,3 +1,3 @@
-import { B as StackServerAppConstructor, I as HexclaveServerApp, L as HexclaveServerAppConstructor, R as HexclaveServerAppConstructorOptions, V as StackServerAppConstructorOptions, z as StackServerApp } from "../../../../client-app-D84Jo2In.js";
+import { B as StackServerApp, H as StackServerAppConstructorOptions, L as HexclaveServerApp, R as HexclaveServerAppConstructor, V as StackServerAppConstructor, z as HexclaveServerAppConstructorOptions } from "../../../../client-app-BowxO_77.js";
 import { a as ListSessionReplaysOptions, i as ListSessionReplayChunksResult, n as AdminSessionReplayChunk, o as ListSessionReplaysResult, r as ListSessionReplayChunksOptions, s as SessionReplayAllEventsResult, t as AdminSessionReplay } from "../../../../index-Cf1wOohp.js";
 export { type AdminSessionReplay, type AdminSessionReplayChunk, HexclaveServerApp, HexclaveServerAppConstructor, HexclaveServerAppConstructorOptions, type ListSessionReplayChunksOptions, type ListSessionReplayChunksResult, type ListSessionReplaysOptions, type ListSessionReplaysResult, type SessionReplayAllEventsResult, StackServerApp, StackServerAppConstructor, StackServerAppConstructorOptions };

package/dist/lib/hexclave-app/apps/interfaces/server-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-app.js","names":["_HexclaveServerAppImpl"],"sources":["../../../../../src/lib/hexclave-app/apps/interfaces/server-app.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport type { GenericQueryCtx } from \"convex/server\";\nimport type { AnalyticsQueryOptions, AnalyticsQueryResponse } from \"@hexclave/shared/dist/interface/crud/analytics\";\nimport type { AdminGetSessionReplayChunkEventsResponse } from \"@hexclave/shared/dist/interface/crud/session-replays\";\nimport { AsyncStoreProperty, GetCurrentPartialUserOptions, GetCurrentUserOptions } from \"../../common\";\nimport { CustomerProductsList, CustomerProductsRequestOptions, InlineProduct, ServerItem } from \"../../customers\";\nimport { DataVaultStore } from \"../../data-vault\";\nimport { EmailDeliveryInfo, SendEmailOptions } from \"../../email\";\nimport { ServerListTeamsOptions, ServerListUsersOptions, ServerTeam, ServerTeamCreateOptions } from \"../../teams\";\nimport type { AdminSessionReplay, ListSessionReplayChunksOptions, ListSessionReplayChunksResult, ListSessionReplaysOptions, ListSessionReplaysResult, SessionReplayAllEventsResult } from \"../../session-replays\";\nimport { ProjectCurrentServerUser, ServerOAuthProvider, ServerUser, ServerUserCreateOptions, SyncedPartialServerUser, TokenPartialUser } from \"../../users\";\nimport { _HexclaveServerAppImpl } from \"../implementations\";\nimport { StackClientApp, StackClientAppConstructorOptions } from \"./client-app\";\n\n\nexport type { AdminSessionReplay, AdminSessionReplayChunk, ListSessionReplaysOptions, ListSessionReplaysResult, ListSessionReplayChunksOptions, ListSessionReplayChunksResult, SessionReplayAllEventsResult } from \"../../session-replays\";\n\n\n/** @deprecated Use `HexclaveServerAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {\n  secretServerKey?: string,\n};\n\n/** @deprecated Use `HexclaveServerApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = (\n  & {\n    createTeam(data: ServerTeamCreateOptions): Promise<ServerTeam>,\n    /**\n     * @deprecated use `getUser()` instead\n     */\n    getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>,\n\n    createUser(options: ServerUserCreateOptions): Promise<ServerUser>,\n    grantProduct(options: (\n      ({ userId: string } | { teamId: string } | { customCustomerId: string }) &\n      ({ productId: string } | { product: InlineProduct }) &\n      { quantity?: number }\n    )): Promise<void>,\n    createCheckoutUrl(options: (\n      ({ userId: string } | { teamId: string } | { customCustomerId: string }) &\n      ({ productId: string } | { product: InlineProduct }) &\n      { returnUrl?: string }\n    )): Promise<string>,\n\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'redirect' }): ProjectCurrentServerUser<ProjectId>,\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'throw' }): ProjectCurrentServerUser<ProjectId>,\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'anonymous' }): ProjectCurrentServerUser<ProjectId>,\n    useUser(options?: GetCurrentUserOptions<HasTokenStore>): ProjectCurrentServerUser<ProjectId> | null,\n    useUser(id: string): ServerUser | null,\n    useUser(options: { apiKey: string, or?: \"return-null\" | \"anonymous\" }): ServerUser | null,\n    useUser(options: { from: \"convex\", ctx: GenericQueryCtx<any>, or?: \"return-null\" | \"anonymous\" }): ServerUser | null,\n\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'redirect' }): Promise<ProjectCurrentServerUser<ProjectId>>,\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'throw' }): Promise<ProjectCurrentServerUser<ProjectId>>,\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'anonymous' }): Promise<ProjectCurrentServerUser<ProjectId>>,\n    getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentServerUser<ProjectId> | null>,\n    getUser(id: string): Promise<ServerUser | null>,\n    getUser(options: { apiKey: string, or?: \"return-null\" | \"anonymous\" }): Promise<ServerUser | null>,\n    getUser(options: { from: \"convex\", ctx: GenericQueryCtx<any>, or?: \"return-null\" | \"anonymous\" }): Promise<ServerUser | null>,\n\n    // note: we don't special-case 'anonymous' here to return non-null, see GetPartialUserOptions for more details\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'token' }): Promise<TokenPartialUser | null>,\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'convex' }): Promise<TokenPartialUser | null>,\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): Promise<SyncedPartialServerUser | TokenPartialUser | null>,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'token' }): TokenPartialUser | null,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'convex' }): TokenPartialUser | null,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): SyncedPartialServerUser | TokenPartialUser | null,\n    useTeam(id: string): ServerTeam | null,\n    useTeam(options: { apiKey: string }): ServerTeam | null,\n    getTeam(id: string): Promise<ServerTeam | null>,\n    getTeam(options: { apiKey: string }): Promise<ServerTeam | null>,\n\n\n    useUsers(options?: ServerListUsersOptions): ServerUser[] & { nextCursor: string | null }, // THIS_LINE_PLATFORM react-like\n    listUsers(options?: ServerListUsersOptions): Promise<ServerUser[] & { nextCursor: string | null }>,\n\n    /**\n     * Returns every direct (or recursive) team permission grant for every\n     * member of the given team in one request. Use this instead of calling\n     * `user.listPermissions(team)` per row when rendering a roster — that\n     * pattern produces an N+1 over the team-member endpoint.\n     */\n    listTeamMemberPermissions(teamId: string, options?: { recursive?: boolean }): Promise<{ userId: string, permissionId: string }[]>,\n    useTeamMemberPermissions(teamId: string, options?: { recursive?: boolean }): { userId: string, permissionId: string }[],\n\n    // TODO this should actually be on ServerUser\n    createOAuthProvider(options: {\n      userId: string,\n      accountId: string,\n      providerConfigId: string,\n      email: string,\n      allowSignIn: boolean,\n      allowConnectedAccounts: boolean,\n    }): Promise<Result<ServerOAuthProvider, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>,\n\n    sendEmail(options: SendEmailOptions): Promise<void>,\n\n    getEmailDeliveryStats(): Promise<EmailDeliveryInfo>,\n    useEmailDeliveryStats(): EmailDeliveryInfo,\n\n    activateEmailCapacityBoost(): Promise<void>,\n\n    queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse>,\n\n    listSessionReplays(options?: ListSessionReplaysOptions): Promise<ListSessionReplaysResult>,\n    getSessionReplay(sessionReplayId: string): Promise<AdminSessionReplay>,\n    listSessionReplayChunks(sessionReplayId: string, options?: ListSessionReplayChunksOptions): Promise<ListSessionReplayChunksResult>,\n    getSessionReplayChunkEvents(sessionReplayId: string, chunkId: string): Promise<AdminGetSessionReplayChunkEventsResponse>,\n    getSessionReplayEvents(sessionReplayId: string, options?: { offset?: number, limit?: number }): Promise<SessionReplayAllEventsResult>,\n  }\n  & AsyncStoreProperty<\"user\", [id: string], ServerUser | null, false>\n  & Omit<AsyncStoreProperty<\"users\", [], ServerUser[], true>, \"listUsers\" | \"useUsers\">\n  & AsyncStoreProperty<\"teams\", [options?: ServerListTeamsOptions], ServerTeam[] & { nextCursor: string | null }, true>\n  & AsyncStoreProperty<\"dataVaultStore\", [id: string], DataVaultStore, false>\n  & AsyncStoreProperty<\n    \"item\",\n    [{ itemId: string, userId: string } | { itemId: string, teamId: string } | { itemId: string, customCustomerId: string }],\n    ServerItem,\n    false\n  >\n  & AsyncStoreProperty<\n    \"products\",\n    [options: CustomerProductsRequestOptions],\n    CustomerProductsList,\n    true\n  >\n  & StackClientApp<HasTokenStore, ProjectId>\n);\n/** @deprecated Use `HexclaveServerAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackServerAppConstructor = {\n  new <\n    TokenStoreType extends string,\n    HasTokenStore extends (TokenStoreType extends {} ? true : boolean),\n    ProjectId extends string\n  >(options: StackServerAppConstructorOptions<HasTokenStore, ProjectId>): StackServerApp<HasTokenStore, ProjectId>,\n  new (options: StackServerAppConstructorOptions<boolean, string>): StackServerApp<boolean, string>,\n};\nexport type HexclaveServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackServerAppConstructorOptions<HasTokenStore, ProjectId>;\nexport type HexclaveServerApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackServerApp<HasTokenStore, ProjectId>;\nexport type HexclaveServerAppConstructor = StackServerAppConstructor;\nexport const HexclaveServerApp: HexclaveServerAppConstructor = _HexclaveServerAppImpl;\n/** @deprecated Use `HexclaveServerApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport const StackServerApp: StackServerAppConstructor = HexclaveServerApp;\n"],"mappings":";;AAiJA,MAAa,yDAAkDA,CAAAA,CAAAA;;AAE/D,MAAa,iBAA4C"}
+{"version":3,"file":"server-app.js","names":["_HexclaveServerAppImpl"],"sources":["../../../../../src/lib/hexclave-app/apps/interfaces/server-app.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport type { GenericQueryCtx } from \"convex/server\";\nimport type { AnalyticsQueryOptions, AnalyticsQueryResponse } from \"@hexclave/shared/dist/interface/crud/analytics\";\nimport type { AdminGetSessionReplayChunkEventsResponse } from \"@hexclave/shared/dist/interface/crud/session-replays\";\nimport { AsyncStoreProperty, GetCurrentPartialUserOptions, GetCurrentUserOptions } from \"../../common\";\nimport { CustomerProductsList, CustomerProductsRequestOptions, InlineProduct, ServerItem } from \"../../customers\";\nimport { DataVaultStore } from \"../../data-vault\";\nimport { EmailDeliveryInfo, SendEmailOptions } from \"../../email\";\nimport { ServerListTeamsOptions, ServerListUsersOptions, ServerTeam, ServerTeamCreateOptions } from \"../../teams\";\nimport type { AdminSessionReplay, ListSessionReplayChunksOptions, ListSessionReplayChunksResult, ListSessionReplaysOptions, ListSessionReplaysResult, SessionReplayAllEventsResult } from \"../../session-replays\";\nimport { ProjectCurrentServerUser, ServerOAuthProvider, ServerUser, ServerUserCreateOptions, SyncedPartialServerUser, TokenPartialUser } from \"../../users\";\nimport { _HexclaveServerAppImpl } from \"../implementations\";\nimport { StackClientApp, StackClientAppConstructorOptions } from \"./client-app\";\n\n\nexport type { AdminSessionReplay, AdminSessionReplayChunk, ListSessionReplaysOptions, ListSessionReplaysResult, ListSessionReplayChunksOptions, ListSessionReplayChunksResult, SessionReplayAllEventsResult } from \"../../session-replays\";\n\n\n/** @deprecated Use `HexclaveServerAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {\n  secretServerKey?: string,\n};\n\n/** @deprecated Use `HexclaveServerApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = (\n  & {\n    createTeam(data: ServerTeamCreateOptions): Promise<ServerTeam>,\n    /**\n     * @deprecated use `getUser()` instead\n     */\n    getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>,\n\n    createUser(options: ServerUserCreateOptions): Promise<ServerUser>,\n    grantProduct(options: (\n      ({ userId: string } | { teamId: string } | { customCustomerId: string }) &\n      ({ productId: string } | { product: InlineProduct }) &\n      { quantity?: number }\n    )): Promise<void>,\n    createCheckoutUrl(options: (\n      ({ userId: string } | { teamId: string } | { customCustomerId: string }) &\n      ({ productId: string } | { product: InlineProduct }) &\n      { returnUrl?: string }\n    )): Promise<string>,\n\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'redirect' }): ProjectCurrentServerUser<ProjectId>,\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'throw' }): ProjectCurrentServerUser<ProjectId>,\n    useUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'anonymous' }): ProjectCurrentServerUser<ProjectId>,\n    useUser(options?: GetCurrentUserOptions<HasTokenStore>): ProjectCurrentServerUser<ProjectId> | null,\n    useUser(id: string): ServerUser | null,\n    useUser(options: { apiKey: string, or?: \"return-null\" | \"anonymous\" }): ServerUser | null,\n    useUser(options: { from: \"convex\", ctx: GenericQueryCtx<any>, or?: \"return-null\" | \"anonymous\" }): ServerUser | null,\n\n    /**\n     * @deprecated Whether an app object has server permissions does not determine whether this\n     * call runs in a browser, so an async read should not implicitly choose a navigation strategy.\n     * In React, use useUser({ or: \"redirect\" }). Otherwise, call getUser() and explicitly invoke\n     * redirectToSignIn() from browser code when it returns null.\n     */\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'redirect' }): Promise<ProjectCurrentServerUser<ProjectId>>,\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'throw' }): Promise<ProjectCurrentServerUser<ProjectId>>,\n    getUser(options: GetCurrentUserOptions<HasTokenStore> & { or: 'anonymous' }): Promise<ProjectCurrentServerUser<ProjectId>>,\n    getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentServerUser<ProjectId> | null>,\n    getUser(id: string): Promise<ServerUser | null>,\n    getUser(options: { apiKey: string, or?: \"return-null\" | \"anonymous\" }): Promise<ServerUser | null>,\n    getUser(options: { from: \"convex\", ctx: GenericQueryCtx<any>, or?: \"return-null\" | \"anonymous\" }): Promise<ServerUser | null>,\n\n    // note: we don't special-case 'anonymous' here to return non-null, see GetPartialUserOptions for more details\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'token' }): Promise<TokenPartialUser | null>,\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'convex' }): Promise<TokenPartialUser | null>,\n    getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): Promise<SyncedPartialServerUser | TokenPartialUser | null>,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'token' }): TokenPartialUser | null,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & { from: 'convex' }): TokenPartialUser | null,\n    usePartialUser(options: GetCurrentPartialUserOptions<HasTokenStore>): SyncedPartialServerUser | TokenPartialUser | null,\n    useTeam(id: string): ServerTeam | null,\n    useTeam(options: { apiKey: string }): ServerTeam | null,\n    getTeam(id: string): Promise<ServerTeam | null>,\n    getTeam(options: { apiKey: string }): Promise<ServerTeam | null>,\n\n\n    useUsers(options?: ServerListUsersOptions): ServerUser[] & { nextCursor: string | null }, // THIS_LINE_PLATFORM react-like\n    listUsers(options?: ServerListUsersOptions): Promise<ServerUser[] & { nextCursor: string | null }>,\n\n    /**\n     * Returns every direct (or recursive) team permission grant for every\n     * member of the given team in one request. Use this instead of calling\n     * `user.listPermissions(team)` per row when rendering a roster — that\n     * pattern produces an N+1 over the team-member endpoint.\n     */\n    listTeamMemberPermissions(teamId: string, options?: { recursive?: boolean }): Promise<{ userId: string, permissionId: string }[]>,\n    useTeamMemberPermissions(teamId: string, options?: { recursive?: boolean }): { userId: string, permissionId: string }[],\n\n    // TODO this should actually be on ServerUser\n    createOAuthProvider(options: {\n      userId: string,\n      accountId: string,\n      providerConfigId: string,\n      email: string,\n      allowSignIn: boolean,\n      allowConnectedAccounts: boolean,\n    }): Promise<Result<ServerOAuthProvider, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>,\n\n    sendEmail(options: SendEmailOptions): Promise<void>,\n\n    getEmailDeliveryStats(): Promise<EmailDeliveryInfo>,\n    useEmailDeliveryStats(): EmailDeliveryInfo,\n\n    activateEmailCapacityBoost(): Promise<void>,\n\n    queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse>,\n\n    listSessionReplays(options?: ListSessionReplaysOptions): Promise<ListSessionReplaysResult>,\n    getSessionReplay(sessionReplayId: string): Promise<AdminSessionReplay>,\n    listSessionReplayChunks(sessionReplayId: string, options?: ListSessionReplayChunksOptions): Promise<ListSessionReplayChunksResult>,\n    getSessionReplayChunkEvents(sessionReplayId: string, chunkId: string): Promise<AdminGetSessionReplayChunkEventsResponse>,\n    getSessionReplayEvents(sessionReplayId: string, options?: { offset?: number, limit?: number }): Promise<SessionReplayAllEventsResult>,\n  }\n  & AsyncStoreProperty<\"user\", [id: string], ServerUser | null, false>\n  & Omit<AsyncStoreProperty<\"users\", [], ServerUser[], true>, \"listUsers\" | \"useUsers\">\n  & AsyncStoreProperty<\"teams\", [options?: ServerListTeamsOptions], ServerTeam[] & { nextCursor: string | null }, true>\n  & AsyncStoreProperty<\"dataVaultStore\", [id: string], DataVaultStore, false>\n  & AsyncStoreProperty<\n    \"item\",\n    [{ itemId: string, userId: string } | { itemId: string, teamId: string } | { itemId: string, customCustomerId: string }],\n    ServerItem,\n    false\n  >\n  & AsyncStoreProperty<\n    \"products\",\n    [options: CustomerProductsRequestOptions],\n    CustomerProductsList,\n    true\n  >\n  & StackClientApp<HasTokenStore, ProjectId>\n);\n/** @deprecated Use `HexclaveServerAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackServerAppConstructor = {\n  new <\n    TokenStoreType extends string,\n    HasTokenStore extends (TokenStoreType extends {} ? true : boolean),\n    ProjectId extends string\n  >(options: StackServerAppConstructorOptions<HasTokenStore, ProjectId>): StackServerApp<HasTokenStore, ProjectId>,\n  new (options: StackServerAppConstructorOptions<boolean, string>): StackServerApp<boolean, string>,\n};\nexport type HexclaveServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackServerAppConstructorOptions<HasTokenStore, ProjectId>;\nexport type HexclaveServerApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackServerApp<HasTokenStore, ProjectId>;\nexport type HexclaveServerAppConstructor = StackServerAppConstructor;\nexport const HexclaveServerApp: HexclaveServerAppConstructor = _HexclaveServerAppImpl;\n/** @deprecated Use `HexclaveServerApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport const StackServerApp: StackServerAppConstructor = HexclaveServerApp;\n"],"mappings":";;AAuJA,MAAa,yDAAkDA,CAAAA,CAAAA;;AAE/D,MAAa,iBAA4C"}

package/dist/lib/hexclave-app/index.d.ts

@@ -6,8 +6,8 @@ import { a as PlanUsageRow, i as PlanUsagePlanId, n as PlanUsageKind, r as PlanU
 import { a as AdminWorkflowRunState, c as AdminWorkflowStepAttempt, d as AdminWorkflowUpgradeResult, f as AdminWorkflowVersion, i as AdminWorkflowRunDetails, l as AdminWorkflowSyncResult, n as AdminWorkflowDivergenceDiagnostic, o as AdminWorkflowRunsFilter, r as AdminWorkflowRun, s as AdminWorkflowStep, t as AdminWorkflow, u as AdminWorkflowTrigger } from "../../workflows-2-MBWbGl.js";
 import { r as OAuthConnection, t as Connection } from "../../index-C_kxyHao.js";
 import { i as ServerContactChannel, t as ContactChannel } from "../../index-DN04TjLM.js";
-import { $ as TeamCreateOptions, B as StackServerAppConstructor, D as HexclaveAdminApp, E as EmailOutboxUpdateOptions, F as StackAdminAppConstructorOptions, H as EditableTeamMemberProfile, I as HexclaveServerApp, J as ServerTeamCreateOptions, K as ServerListUsersOptions, L as HexclaveServerAppConstructor, N as StackAdminApp, O as HexclaveAdminAppConstructor, Ot as User, P as StackAdminAppConstructor, Q as Team, R as HexclaveServerAppConstructorOptions, St as ServerUser, T as EmailOutboxListResult, U as ReceivedTeamInvitation, V as StackServerAppConstructorOptions, W as SentTeamInvitation, X as ServerTeamUpdateOptions, Y as ServerTeamMemberProfile, Z as ServerTeamUser, _ as AdminProjectSecretJson, _t as OAuthProvider, a as StackClientApp, c as StackClientAppJson, d as AdminDeploymentJson, et as TeamInvitation, f as AdminDeploymentServiceJson, ft as CurrentInternalServerUser, g as AdminProjectCreateOptions, h as AdminProject, ht as CurrentUser, i as HexclaveClientAppJson, it as TeamUser, k as HexclaveAdminAppConstructorOptions, l as AdminDeploymentDomainJson, m as AdminOwnedProject, mt as CurrentServerUser, n as HexclaveClientAppConstructor, o as StackClientAppConstructor, p as AdminDeploymentServiceOutcomeJson, pt as CurrentInternalUser, q as ServerTeam, r as HexclaveClientAppConstructorOptions, rt as TeamUpdateOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp, tt as TeamMemberProfile, u as AdminDeploymentEnvVarJson, ut as Auth, v as AdminProjectUpdateOptions, w as EmailOutboxListOptions, x as PushedConfigSource, xt as ServerOAuthProvider, y as Project, z as StackServerApp } from "../../client-app-D84Jo2In.js";
+import { $ as Team, A as HexclaveAdminAppConstructorOptions, B as StackServerApp, Ct as ServerUser, D as EmailOutboxUpdateOptions, E as EmailOutboxListResult, F as StackAdminAppConstructor, G as SentTeamInvitation, H as StackServerAppConstructorOptions, I as StackAdminAppConstructorOptions, J as ServerTeam, L as HexclaveServerApp, O as HexclaveAdminApp, P as StackAdminApp, Q as ServerTeamUser, R as HexclaveServerAppConstructor, S as PushedConfigSource, St as ServerOAuthProvider, T as EmailOutboxListOptions, U as EditableTeamMemberProfile, V as StackServerAppConstructor, W as ReceivedTeamInvitation, X as ServerTeamMemberProfile, Y as ServerTeamCreateOptions, Z as ServerTeamUpdateOptions, _ as AdminProjectCreateOptions, a as StackClientApp, at as TeamUser, b as Project, c as StackClientAppJson, d as AdminDeploymentJson, dt as Auth, et as TeamCreateOptions, f as AdminDeploymentServiceJson, g as AdminProject, gt as CurrentUser, h as AdminOwnedProject, ht as CurrentServerUser, i as HexclaveClientAppJson, it as TeamUpdateOptions, k as HexclaveAdminAppConstructor, kt as User, l as AdminDeploymentDomainJson, m as AdminDeploymentServiceOutcomeJson, mt as CurrentInternalUser, n as HexclaveClientAppConstructor, nt as TeamMemberProfile, o as StackClientAppConstructor, p as AdminDeploymentServiceLogLineJson, pt as CurrentInternalServerUser, q as ServerListUsersOptions, r as HexclaveClientAppConstructorOptions, s as StackClientAppConstructorOptions, t as HexclaveClientApp, tt as TeamInvitation, u as AdminDeploymentEnvVarJson, v as AdminProjectSecretJson, vt as OAuthProvider, y as AdminProjectUpdateOptions, z as HexclaveServerAppConstructorOptions } from "../../client-app-BowxO_77.js";
 import { a as ListSessionReplaysOptions, i as ListSessionReplayChunksResult, n as AdminSessionReplayChunk, o as ListSessionReplaysResult, r as ListSessionReplayChunksOptions, s as SessionReplayAllEventsResult, t as AdminSessionReplay } from "../../index-Cf1wOohp.js";
 import { a as AdminProjectConfigUpdateOptions, i as AdminProjectConfig, n as AdminEmailConfig, o as OAuthProviderConfig, r as AdminOAuthProviderConfig, s as ProjectConfig, t as AdminDomainConfig } from "../../index-B-MazpM_.js";
 import { r as getPagePrompt } from "../../url-targets-CWO0mjTr.js";
-export { type AdminDeploymentDomainJson, type AdminDeploymentEnvVarJson, type AdminDeploymentJson, type AdminDeploymentServiceJson, type AdminDeploymentServiceOutcomeJson, type AdminDomainConfig, type AdminEmailConfig, type AdminEmailOutbox, type AdminEmailOutboxRecipient, type AdminEmailOutboxSimpleStatus, type AdminEmailOutboxStatus, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectSecretJson, type AdminProjectUpdateOptions, type AdminSendAttemptError, type AdminSentEmail, type AdminSessionReplay, type AdminSessionReplayChunk, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type AdminWorkflow, type AdminWorkflowDivergenceDiagnostic, type AdminWorkflowRun, type AdminWorkflowRunDetails, type AdminWorkflowRunState, type AdminWorkflowRunsFilter, type AdminWorkflowStep, type AdminWorkflowStepAttempt, type AdminWorkflowSyncResult, type AdminWorkflowTrigger, type AdminWorkflowUpgradeResult, type AdminWorkflowVersion, type Auth, type Connection, type ContactChannel, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type EmailOutboxListOptions, type EmailOutboxListResult, type EmailOutboxUpdateOptions, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrlOptions, type HandlerUrls, HexclaveAdminApp, type HexclaveAdminAppConstructor, type HexclaveAdminAppConstructorOptions, HexclaveClientApp, type HexclaveClientAppConstructor, type HexclaveClientAppConstructorOptions, type HexclaveClientAppJson, HexclaveServerApp, type HexclaveServerAppConstructor, type HexclaveServerAppConstructorOptions, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, type ListSessionReplayChunksOptions, type ListSessionReplayChunksResult, type ListSessionReplaysOptions, type ListSessionReplaysResult, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, type PlanUsage, type PlanUsageKind, type PlanUsageNextPlanId, type PlanUsagePlanId, type PlanUsageRow, type Project, type ProjectConfig, type PushedConfigSource, type ReceivedTeamInvitation, type ResolvedHandlerUrls, type SentTeamInvitation, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, type SessionReplayAllEventsResult, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamInvitation, type TeamMemberProfile, type TeamUpdateOptions, type TeamUser, type User, getPagePrompt, hexclaveAppInternalsSymbol };
+export { type AdminDeploymentDomainJson, type AdminDeploymentEnvVarJson, type AdminDeploymentJson, type AdminDeploymentServiceJson, type AdminDeploymentServiceLogLineJson, type AdminDeploymentServiceOutcomeJson, type AdminDomainConfig, type AdminEmailConfig, type AdminEmailOutbox, type AdminEmailOutboxRecipient, type AdminEmailOutboxSimpleStatus, type AdminEmailOutboxStatus, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectSecretJson, type AdminProjectUpdateOptions, type AdminSendAttemptError, type AdminSentEmail, type AdminSessionReplay, type AdminSessionReplayChunk, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type AdminWorkflow, type AdminWorkflowDivergenceDiagnostic, type AdminWorkflowRun, type AdminWorkflowRunDetails, type AdminWorkflowRunState, type AdminWorkflowRunsFilter, type AdminWorkflowStep, type AdminWorkflowStepAttempt, type AdminWorkflowSyncResult, type AdminWorkflowTrigger, type AdminWorkflowUpgradeResult, type AdminWorkflowVersion, type Auth, type Connection, type ContactChannel, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type EmailOutboxListOptions, type EmailOutboxListResult, type EmailOutboxUpdateOptions, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrlOptions, type HandlerUrls, HexclaveAdminApp, type HexclaveAdminAppConstructor, type HexclaveAdminAppConstructorOptions, HexclaveClientApp, type HexclaveClientAppConstructor, type HexclaveClientAppConstructorOptions, type HexclaveClientAppJson, HexclaveServerApp, type HexclaveServerAppConstructor, type HexclaveServerAppConstructorOptions, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, type ListSessionReplayChunksOptions, type ListSessionReplayChunksResult, type ListSessionReplaysOptions, type ListSessionReplaysResult, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, type PlanUsage, type PlanUsageKind, type PlanUsageNextPlanId, type PlanUsagePlanId, type PlanUsageRow, type Project, type ProjectConfig, type PushedConfigSource, type ReceivedTeamInvitation, type ResolvedHandlerUrls, type SentTeamInvitation, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, type SessionReplayAllEventsResult, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamInvitation, type TeamMemberProfile, type TeamUpdateOptions, type TeamUser, type User, getPagePrompt, hexclaveAppInternalsSymbol };

package/dist/lib/hexclave-app/projects/index.d.ts

@@ -1,2 +1,2 @@
-import { C as adminProjectUpdateOptionsToCrud, S as adminProjectCreateOptionsToCrud, _ as AdminProjectSecretJson, b as PushConfigOptions, d as AdminDeploymentJson, f as AdminDeploymentServiceJson, g as AdminProjectCreateOptions, h as AdminProject, l as AdminDeploymentDomainJson, m as AdminOwnedProject, p as AdminDeploymentServiceOutcomeJson, u as AdminDeploymentEnvVarJson, v as AdminProjectUpdateOptions, x as PushedConfigSource, y as Project } from "../../../client-app-D84Jo2In.js";
-export { type AdminDeploymentDomainJson, type AdminDeploymentEnvVarJson, type AdminDeploymentJson, type AdminDeploymentServiceJson, type AdminDeploymentServiceOutcomeJson, AdminOwnedProject, AdminProject, AdminProjectCreateOptions, type AdminProjectSecretJson, AdminProjectUpdateOptions, Project, PushConfigOptions, PushedConfigSource, adminProjectCreateOptionsToCrud, adminProjectUpdateOptionsToCrud };
+import { C as adminProjectCreateOptionsToCrud, S as PushedConfigSource, _ as AdminProjectCreateOptions, b as Project, d as AdminDeploymentJson, f as AdminDeploymentServiceJson, g as AdminProject, h as AdminOwnedProject, l as AdminDeploymentDomainJson, m as AdminDeploymentServiceOutcomeJson, p as AdminDeploymentServiceLogLineJson, u as AdminDeploymentEnvVarJson, v as AdminProjectSecretJson, w as adminProjectUpdateOptionsToCrud, x as PushConfigOptions, y as AdminProjectUpdateOptions } from "../../../client-app-BowxO_77.js";
+export { type AdminDeploymentDomainJson, type AdminDeploymentEnvVarJson, type AdminDeploymentJson, type AdminDeploymentServiceJson, type AdminDeploymentServiceLogLineJson, type AdminDeploymentServiceOutcomeJson, AdminOwnedProject, AdminProject, AdminProjectCreateOptions, type AdminProjectSecretJson, AdminProjectUpdateOptions, Project, PushConfigOptions, PushedConfigSource, adminProjectCreateOptionsToCrud, adminProjectUpdateOptionsToCrud };

package/dist/lib/hexclave-app/projects/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../src/lib/hexclave-app/projects/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { ProductionModeError } from \"@hexclave/shared/dist/helpers/production-mode\";\nimport { AdminUserProjectsCrud, ProjectsCrud } from \"@hexclave/shared/dist/interface/crud/projects\";\nimport { ProjectOnboardingStatus } from \"@hexclave/shared/dist/schema-fields\";\n\nimport { CompleteConfig, EnvironmentConfigNormalizedOverride, EnvironmentConfigOverrideOverride } from \"@hexclave/shared/dist/config/schema\";\nimport type { AdminDeploymentDomainJson, AdminDeploymentJson, AdminDeploymentServiceOutcomeJson, AdminProjectSecretJson, AdminDeploymentServiceJson } from \"@hexclave/shared/dist/interface/admin-interface\";\nimport { StackAdminApp } from \"../apps/interfaces/admin-app\";\nimport { AdminProjectConfig, AdminProjectConfigUpdateOptions, ProjectConfig } from \"../project-configs\";\n\nexport type { AdminDeploymentDomainJson, AdminDeploymentEnvVarJson, AdminDeploymentJson, AdminDeploymentServiceOutcomeJson, AdminProjectSecretJson, AdminDeploymentServiceJson } from \"@hexclave/shared/dist/interface/admin-interface\";\n\n/**\n * SDK type for pushed config source (camelCase for SDK).\n * Represents where the branch config was pushed from.\n */\nexport type PushedConfigSource =\n  | { type: \"pushed-from-github\", owner: string, repo: string, branch: string, commitHash: string, configFilePath: string, workflowPath?: string }\n  | { type: \"pushed-from-unknown\" }\n  | { type: \"unlinked\" };\n\nexport type PushConfigOptions = {\n  /**\n   * The source of this config push.\n   */\n  source: PushedConfigSource,\n};\n\n\nexport type Project = {\n  readonly id: string,\n  readonly displayName: string,\n  readonly isDevelopmentEnvironment: boolean,\n  readonly pushedConfigError: { message: string } | null,\n  readonly configWarnings: { message: string }[],\n  readonly config: ProjectConfig,\n};\n\nexport type AdminProject = {\n  readonly id: string,\n  readonly displayName: string,\n  readonly description: string | null,\n  readonly createdAt: Date,\n  readonly isProductionMode: boolean,\n  readonly isDevelopmentEnvironment: boolean,\n  readonly ownerTeamId: string | null,\n  readonly onboardingStatus: ProjectOnboardingStatus,\n  readonly onboardingState: NonNullable<ProjectsCrud[\"Admin\"][\"Read\"][\"onboarding_state\"]> | null,\n  readonly logoUrl: string | null | undefined,\n  readonly logoFullUrl: string | null | undefined,\n  readonly logoDarkModeUrl: string | null | undefined,\n  readonly logoFullDarkModeUrl: string | null | undefined,\n\n  readonly config: AdminProjectConfig,\n\n  update(this: AdminProject, update: AdminProjectUpdateOptions): Promise<void>,\n  delete(this: AdminProject): Promise<void>,\n\n  getConfig(this: AdminProject): Promise<CompleteConfig>,\n  useConfig(this: AdminProject): CompleteConfig,\n\n  /**\n   * Updates the environment's config by merging the provided config into the existing config.\n   *\n   * Changes made with `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`\n   * config was pushed after the changes were made with `updateConfig`. This is best for environment-specific\n   * configuration like secrets, API keys, and other values that you wouldn't push into a source repository.\n   */\n  // We have some strict types here in order to prevent accidental overwriting of a top-level property of a config object\n  updateConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride,\n  ): Promise<void>,\n\n  /**\n   * Pushes a config, replacing any previous config pushed with `pushConfig`.\n   *\n   * **Note:** This function does **not** replace any changes made with `updateConfig`. Changes made with\n   * `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`\n   * config was pushed after the changes were made with `updateConfig`.\n   *\n   * This is useful for programmatically deploying configuration. More often than not, you'll want to use\n   * `updateConfig` instead.\n   */\n  pushConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride,\n    options: PushConfigOptions,\n  ): Promise<void>,\n\n  /**\n   * Updates the pushed config by merging the provided config into the existing pushed config.\n   *\n   * **Warning:** This is almost always **not** the function you want to call. Changes made with\n   * `updatePushedConfig` will be replaced entirely the next time `pushConfig` is called. Consider using\n   * `pushConfig` to set the full pushed config, or `updateConfig` for environment-specific values that\n   * should persist across pushes.\n   *\n   * This function is useful for making temporary modifications to the pushed config before the next push.\n   */\n  updatePushedConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride\n  ): Promise<void>,\n\n  /**\n   * Gets the source metadata for the pushed config, indicating where it was pushed from.\n   *\n   * The source can be:\n   * - `pushed-from-github`: Config was pushed from a GitHub repository\n   * - `pushed-from-unknown`: Config was pushed via CLI but source details unknown\n   * - `unlinked`: Config can be edited directly on the dashboard\n   */\n  getPushedConfigSource(this: AdminProject): Promise<PushedConfigSource>,\n\n  /**\n   * Unlinks the pushed config source, setting it to \"unlinked\".\n   * This allows the config to be edited directly on the dashboard without external push restrictions.\n   */\n  unlinkPushedConfigSource(this: AdminProject): Promise<void>,\n\n  /**\n   * Resets (removes) specific keys from the config override at the specified level.\n   * Uses the same nested key logic as the override algorithm: resetting key \"a.b\" also resets \"a.b.c\".\n   *\n   * This is useful when updating the pushed config (branch level) and wanting to remove the same keys\n   * from the environment config override so that the branch config values take precedence.\n   */\n  resetConfigOverrideKeys(this: AdminProject, level: \"branch\" | \"environment\", keys: string[]): Promise<void>,\n\n  /**\n   * Gets the raw config override at the specified level (before merging/defaults).\n   * Useful for inspecting exactly what's been set at each level.\n   */\n  getConfigOverride(this: AdminProject, level: \"branch\" | \"environment\"): Promise<Record<string, unknown>>,\n\n  /**\n   * Replaces the entire config override at the specified level.\n   * For branch level, preserves the existing source metadata.\n   */\n  replaceConfigOverride(this: AdminProject, level: \"branch\" | \"environment\", config: Record<string, unknown>): Promise<void>,\n\n  getProductionModeErrors(this: AdminProject): Promise<ProductionModeError[]>,\n  useProductionModeErrors(this: AdminProject): ProductionModeError[],\n\n  /**\n   * Lists the project's deployment services (definitions as synced from the\n   * config file's `services` export by `hexclave deploy`, merged with their\n   * operational state: deploy status, env vars, domains). Definitions are\n   * read-only through the SDK — the config file is the source of truth.\n   */\n  listDeploymentServices(this: AdminProject): Promise<AdminDeploymentServiceJson[]>,\n\n  /**\n   * Lists the project's stored secrets (keys and timestamps only — values are\n   * write-only and can never be read back).\n   */\n  listProjectSecrets(this: AdminProject): Promise<AdminProjectSecretJson[]>,\n\n  /**\n   * Sets (or overwrites) the value of a project secret. Values are only read\n   * server-side by the feature that consumes them — today, a deploy filling\n   * `secret()` env vars.\n   */\n  setProjectSecret(this: AdminProject, key: string, value: string): Promise<void>,\n\n  /**\n   * Deletes a stored project secret value.\n   */\n  deleteProjectSecret(this: AdminProject, key: string): Promise<void>,\n\n  /**\n   * Lists the project's deployments (one per `hexclave deploy`) newest first,\n   * each with the services it deployed and their runs.\n   */\n  listDeployments(this: AdminProject, options?: { limit?: number }): Promise<AdminDeploymentJson[]>,\n\n  /**\n   * Reads one deployment, including what each of its services did.\n   */\n  getDeployment(this: AdminProject, deploymentId: string): Promise<AdminDeploymentJson>,\n\n  /**\n   * Returns the build logs of a deployment collected so far (the server follows\n   * a running build for a while before returning). One deploy is one build, so\n   * one log covers every service it shipped.\n   */\n  getDeploymentBuildLogs(this: AdminProject, deploymentId: string, options?: { signal?: AbortSignal }): Promise<string>,\n\n  /**\n   * Adds a custom domain to a deployment service.\n   */\n  addDeploymentServiceDomain(this: AdminProject, serviceId: string, hostname: string, options?: { isPrimary?: boolean }): Promise<void>,\n\n  /**\n   * Returns a domain's verification state and the DNS records the user must\n   * create. Poll this until `verified` is true.\n   */\n  getDeploymentServiceDomain(this: AdminProject, serviceId: string, hostname: string): Promise<AdminDeploymentDomainJson>,\n\n  /**\n   * Removes a custom domain from a deployment service.\n   */\n  deleteDeploymentServiceDomain(this: AdminProject, serviceId: string, hostname: string): Promise<void>,\n} & Project;\n\nexport type AdminOwnedProject = {\n  readonly app: StackAdminApp<false>,\n} & AdminProject;\n\nexport type AdminProjectUpdateOptions = {\n  displayName?: string,\n  description?: string,\n  isProductionMode?: boolean,\n  onboardingStatus?: ProjectOnboardingStatus,\n  /**\n   * Updates `project.requirePublishableClientKey` in the project-level config override.\n   */\n  requirePublishableClientKey?: boolean,\n  logoUrl?: string | null,\n  logoFullUrl?: string | null,\n  logoDarkModeUrl?: string | null,\n  logoFullDarkModeUrl?: string | null,\n  config?: AdminProjectConfigUpdateOptions,\n};\nexport function adminProjectUpdateOptionsToCrud(options: AdminProjectUpdateOptions): ProjectsCrud[\"Admin\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    description: options.description,\n    is_production_mode: options.isProductionMode,\n    onboarding_status: options.onboardingStatus,\n    logo_url: options.logoUrl,\n    logo_full_url: options.logoFullUrl,\n    logo_dark_mode_url: options.logoDarkModeUrl,\n    logo_full_dark_mode_url: options.logoFullDarkModeUrl,\n    /**\n     * NOTE: Do not update this config anymore. It's been superseded by the new config in schema.ts.\n     * @deprecated\n     */\n    config: {\n      domains: options.config?.domains?.map((d) => ({\n        domain: d.domain,\n        handler_path: d.handlerPath\n      })),\n      oauth_providers: options.config?.oauthProviders\n        ?.filter((p): p is Exclude<typeof p, { type: 'custom_oidc' }> => p.type !== 'custom_oidc')\n        .map((p) => ({\n          id: p.id as any,\n          type: p.type,\n          ...(p.type === 'standard' && {\n            client_id: p.clientId,\n            client_secret: p.clientSecret,\n            facebook_config_id: p.facebookConfigId,\n            microsoft_tenant_id: p.microsoftTenantId,\n            apple_team_id: p.appleTeamId,\n            apple_key_id: p.appleKeyId,\n            apple_private_key: p.applePrivateKey,\n            apple_bundle_ids: p.appleBundleIds,\n          }),\n        })),\n      email_config: options.config?.emailConfig && (\n        options.config.emailConfig.type === 'shared' ? {\n          type: 'shared',\n        } : {\n          type: 'standard',\n          host: options.config.emailConfig.host,\n          port: options.config.emailConfig.port,\n          username: options.config.emailConfig.username,\n          password: options.config.emailConfig.password,\n          sender_name: options.config.emailConfig.senderName,\n          sender_email: options.config.emailConfig.senderEmail,\n        }\n      ),\n      email_theme: options.config?.emailTheme,\n      sign_up_enabled: options.config?.signUpEnabled,\n      credential_enabled: options.config?.credentialEnabled,\n      magic_link_enabled: options.config?.magicLinkEnabled,\n      passkey_enabled: options.config?.passkeyEnabled,\n      allow_localhost: options.config?.allowLocalhost,\n      create_team_on_sign_up: options.config?.createTeamOnSignUp,\n      client_team_creation_enabled: options.config?.clientTeamCreationEnabled,\n      client_user_deletion_enabled: options.config?.clientUserDeletionEnabled,\n      team_creator_default_permissions: options.config?.teamCreatorDefaultPermissions,\n      team_member_default_permissions: options.config?.teamMemberDefaultPermissions,\n      user_default_permissions: options.config?.userDefaultPermissions,\n      oauth_account_merge_strategy: options.config?.oauthAccountMergeStrategy,\n      allow_user_api_keys: options.config?.allowUserApiKeys,\n      allow_team_api_keys: options.config?.allowTeamApiKeys,\n    },\n  };\n}\n\nexport type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'> & {\n  displayName: string,\n  teamId: string,\n  isDevelopmentEnvironment?: boolean,\n};\nexport function adminProjectCreateOptionsToCrud(options: AdminProjectCreateOptions): AdminUserProjectsCrud[\"Server\"][\"Create\"] {\n  return {\n    ...adminProjectUpdateOptionsToCrud(options),\n    display_name: options.displayName,\n    is_development_environment: options.isDevelopmentEnvironment,\n    owner_team_id: options.teamId,\n  };\n}\n"],"mappings":";;AAoOA,SAAgB,gCAAgC,SAAqE;CACnH,OAAO;EACL,cAAc,QAAQ;EACtB,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,UAAU,QAAQ;EAClB,eAAe,QAAQ;EACvB,oBAAoB,QAAQ;EAC5B,yBAAyB,QAAQ;;;;;EAKjC,QAAQ;GACN,SAAS,QAAQ,QAAQ,SAAS,KAAK,OAAO;IAC5C,QAAQ,EAAE;IACV,cAAc,EAAE;GAClB,EAAE;GACF,iBAAiB,QAAQ,QAAQ,gBAC7B,QAAQ,MAAuD,EAAE,SAAS,aAAa,CAAC,CACzF,KAAK,OAAO;IACX,IAAI,EAAE;IACN,MAAM,EAAE;IACR,GAAI,EAAE,SAAS,cAAc;KAC3B,WAAW,EAAE;KACb,eAAe,EAAE;KACjB,oBAAoB,EAAE;KACtB,qBAAqB,EAAE;KACvB,eAAe,EAAE;KACjB,cAAc,EAAE;KAChB,mBAAmB,EAAE;KACrB,kBAAkB,EAAE;IACtB;GACF,EAAE;GACJ,cAAc,QAAQ,QAAQ,gBAC5B,QAAQ,OAAO,YAAY,SAAS,WAAW,EAC7C,MAAM,SACR,IAAI;IACF,MAAM;IACN,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,QAAQ,OAAO,YAAY;IACjC,UAAU,QAAQ,OAAO,YAAY;IACrC,UAAU,QAAQ,OAAO,YAAY;IACrC,aAAa,QAAQ,OAAO,YAAY;IACxC,cAAc,QAAQ,OAAO,YAAY;GAC3C;GAEF,aAAa,QAAQ,QAAQ;GAC7B,iBAAiB,QAAQ,QAAQ;GACjC,oBAAoB,QAAQ,QAAQ;GACpC,oBAAoB,QAAQ,QAAQ;GACpC,iBAAiB,QAAQ,QAAQ;GACjC,iBAAiB,QAAQ,QAAQ;GACjC,wBAAwB,QAAQ,QAAQ;GACxC,8BAA8B,QAAQ,QAAQ;GAC9C,8BAA8B,QAAQ,QAAQ;GAC9C,kCAAkC,QAAQ,QAAQ;GAClD,iCAAiC,QAAQ,QAAQ;GACjD,0BAA0B,QAAQ,QAAQ;GAC1C,8BAA8B,QAAQ,QAAQ;GAC9C,qBAAqB,QAAQ,QAAQ;GACrC,qBAAqB,QAAQ,QAAQ;EACvC;CACF;AACF;AAOA,SAAgB,gCAAgC,SAA+E;CAC7H,OAAO;EACL,GAAG,gCAAgC,OAAO;EAC1C,cAAc,QAAQ;EACtB,4BAA4B,QAAQ;EACpC,eAAe,QAAQ;CACzB;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/lib/hexclave-app/projects/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { ProductionModeError } from \"@hexclave/shared/dist/helpers/production-mode\";\nimport { AdminUserProjectsCrud, ProjectsCrud } from \"@hexclave/shared/dist/interface/crud/projects\";\nimport { ProjectOnboardingStatus } from \"@hexclave/shared/dist/schema-fields\";\n\nimport { CompleteConfig, EnvironmentConfigNormalizedOverride, EnvironmentConfigOverrideOverride } from \"@hexclave/shared/dist/config/schema\";\nimport type { AdminDeploymentDomainJson, AdminDeploymentJson, AdminDeploymentServiceLogLineJson, AdminDeploymentServiceOutcomeJson, AdminProjectSecretJson, AdminDeploymentServiceJson } from \"@hexclave/shared/dist/interface/admin-interface\";\nimport { StackAdminApp } from \"../apps/interfaces/admin-app\";\nimport { AdminProjectConfig, AdminProjectConfigUpdateOptions, ProjectConfig } from \"../project-configs\";\n\nexport type { AdminDeploymentDomainJson, AdminDeploymentEnvVarJson, AdminDeploymentJson, AdminDeploymentServiceLogLineJson, AdminDeploymentServiceOutcomeJson, AdminProjectSecretJson, AdminDeploymentServiceJson } from \"@hexclave/shared/dist/interface/admin-interface\";\n\n/**\n * SDK type for pushed config source (camelCase for SDK).\n * Represents where the branch config was pushed from.\n */\nexport type PushedConfigSource =\n  | { type: \"pushed-from-github\", owner: string, repo: string, branch: string, commitHash: string, configFilePath: string, workflowPath?: string }\n  | { type: \"pushed-from-unknown\" }\n  | { type: \"unlinked\" };\n\nexport type PushConfigOptions = {\n  /**\n   * The source of this config push.\n   */\n  source: PushedConfigSource,\n};\n\n\nexport type Project = {\n  readonly id: string,\n  readonly displayName: string,\n  readonly isDevelopmentEnvironment: boolean,\n  readonly pushedConfigError: { message: string } | null,\n  readonly configWarnings: { message: string }[],\n  readonly config: ProjectConfig,\n};\n\nexport type AdminProject = {\n  readonly id: string,\n  readonly displayName: string,\n  readonly description: string | null,\n  readonly createdAt: Date,\n  readonly isProductionMode: boolean,\n  readonly isDevelopmentEnvironment: boolean,\n  readonly ownerTeamId: string | null,\n  readonly onboardingStatus: ProjectOnboardingStatus,\n  readonly onboardingState: NonNullable<ProjectsCrud[\"Admin\"][\"Read\"][\"onboarding_state\"]> | null,\n  readonly logoUrl: string | null | undefined,\n  readonly logoFullUrl: string | null | undefined,\n  readonly logoDarkModeUrl: string | null | undefined,\n  readonly logoFullDarkModeUrl: string | null | undefined,\n\n  readonly config: AdminProjectConfig,\n\n  update(this: AdminProject, update: AdminProjectUpdateOptions): Promise<void>,\n  delete(this: AdminProject): Promise<void>,\n\n  getConfig(this: AdminProject): Promise<CompleteConfig>,\n  useConfig(this: AdminProject): CompleteConfig,\n\n  /**\n   * Updates the environment's config by merging the provided config into the existing config.\n   *\n   * Changes made with `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`\n   * config was pushed after the changes were made with `updateConfig`. This is best for environment-specific\n   * configuration like secrets, API keys, and other values that you wouldn't push into a source repository.\n   */\n  // We have some strict types here in order to prevent accidental overwriting of a top-level property of a config object\n  updateConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride,\n  ): Promise<void>,\n\n  /**\n   * Pushes a config, replacing any previous config pushed with `pushConfig`.\n   *\n   * **Note:** This function does **not** replace any changes made with `updateConfig`. Changes made with\n   * `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`\n   * config was pushed after the changes were made with `updateConfig`.\n   *\n   * This is useful for programmatically deploying configuration. More often than not, you'll want to use\n   * `updateConfig` instead.\n   */\n  pushConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride,\n    options: PushConfigOptions,\n  ): Promise<void>,\n\n  /**\n   * Updates the pushed config by merging the provided config into the existing pushed config.\n   *\n   * **Warning:** This is almost always **not** the function you want to call. Changes made with\n   * `updatePushedConfig` will be replaced entirely the next time `pushConfig` is called. Consider using\n   * `pushConfig` to set the full pushed config, or `updateConfig` for environment-specific values that\n   * should persist across pushes.\n   *\n   * This function is useful for making temporary modifications to the pushed config before the next push.\n   */\n  updatePushedConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride\n  ): Promise<void>,\n\n  /**\n   * Gets the source metadata for the pushed config, indicating where it was pushed from.\n   *\n   * The source can be:\n   * - `pushed-from-github`: Config was pushed from a GitHub repository\n   * - `pushed-from-unknown`: Config was pushed via CLI but source details unknown\n   * - `unlinked`: Config can be edited directly on the dashboard\n   */\n  getPushedConfigSource(this: AdminProject): Promise<PushedConfigSource>,\n\n  /**\n   * Unlinks the pushed config source, setting it to \"unlinked\".\n   * This allows the config to be edited directly on the dashboard without external push restrictions.\n   */\n  unlinkPushedConfigSource(this: AdminProject): Promise<void>,\n\n  /**\n   * Resets (removes) specific keys from the config override at the specified level.\n   * Uses the same nested key logic as the override algorithm: resetting key \"a.b\" also resets \"a.b.c\".\n   *\n   * This is useful when updating the pushed config (branch level) and wanting to remove the same keys\n   * from the environment config override so that the branch config values take precedence.\n   */\n  resetConfigOverrideKeys(this: AdminProject, level: \"branch\" | \"environment\", keys: string[]): Promise<void>,\n\n  /**\n   * Gets the raw config override at the specified level (before merging/defaults).\n   * Useful for inspecting exactly what's been set at each level.\n   */\n  getConfigOverride(this: AdminProject, level: \"branch\" | \"environment\"): Promise<Record<string, unknown>>,\n\n  /**\n   * Replaces the entire config override at the specified level.\n   * For branch level, preserves the existing source metadata.\n   */\n  replaceConfigOverride(this: AdminProject, level: \"branch\" | \"environment\", config: Record<string, unknown>): Promise<void>,\n\n  getProductionModeErrors(this: AdminProject): Promise<ProductionModeError[]>,\n  useProductionModeErrors(this: AdminProject): ProductionModeError[],\n\n  /**\n   * Lists the project's deployment services (definitions as synced from the\n   * config file's `services` export by `hexclave deploy`, merged with their\n   * operational state: deploy status, env vars, domains). Definitions are\n   * read-only through the SDK — the config file is the source of truth.\n   */\n  listDeploymentServices(this: AdminProject): Promise<AdminDeploymentServiceJson[]>,\n\n  /**\n   * Lists the project's stored secrets (keys and timestamps only — values are\n   * write-only and can never be read back).\n   */\n  listProjectSecrets(this: AdminProject): Promise<AdminProjectSecretJson[]>,\n\n  /**\n   * Sets (or overwrites) the value of a project secret. Values are only read\n   * server-side by the feature that consumes them — today, a deploy filling\n   * `secret()` env vars.\n   */\n  setProjectSecret(this: AdminProject, key: string, value: string): Promise<void>,\n\n  /**\n   * Deletes a stored project secret value.\n   */\n  deleteProjectSecret(this: AdminProject, key: string): Promise<void>,\n\n  /**\n   * Lists the project's deployments (one per `hexclave deploy`) newest first,\n   * each with the services it deployed and their runs.\n   */\n  listDeployments(this: AdminProject, options?: { limit?: number }): Promise<AdminDeploymentJson[]>,\n\n  /**\n   * Reads one deployment, including what each of its services did.\n   */\n  getDeployment(this: AdminProject, deploymentId: string): Promise<AdminDeploymentJson>,\n\n  /**\n   * Returns the build logs of a deployment collected so far (the server follows\n   * a running build for a while before returning). One deploy is one build, so\n   * one log covers every service it shipped.\n   */\n  getDeploymentBuildLogs(this: AdminProject, deploymentId: string, options?: { signal?: AbortSignal }): Promise<string>,\n\n  /**\n   * Follows a service's RUNTIME logs (what the container printed while running,\n   * not what its build printed), calling `onLine` per line as it arrives.\n   *\n   * A runtime log has no end, so this resolves when the server stops following\n   * — after a few minutes — rather than when the service stops. Call again with\n   * the largest `at_millis` seen to resume exactly where it left off; omit it to\n   * start at the tail. These lines are NOT redacted.\n   */\n  getDeploymentServiceLogs(this: AdminProject, serviceId: string, options: {\n    sinceMillis?: number,\n    /** False returns what is available right now instead of following. */\n    follow?: boolean,\n    signal?: AbortSignal,\n    onLine: (line: AdminDeploymentServiceLogLineJson) => void,\n  }): Promise<void>,\n\n  /**\n   * Adds a custom domain to a deployment service.\n   */\n  addDeploymentServiceDomain(this: AdminProject, serviceId: string, hostname: string, options?: { isPrimary?: boolean }): Promise<void>,\n\n  /**\n   * Returns a domain's verification state and the DNS records the user must\n   * create. Poll this until `verified` is true.\n   */\n  getDeploymentServiceDomain(this: AdminProject, serviceId: string, hostname: string): Promise<AdminDeploymentDomainJson>,\n\n  /**\n   * Removes a custom domain from a deployment service.\n   */\n  deleteDeploymentServiceDomain(this: AdminProject, serviceId: string, hostname: string): Promise<void>,\n} & Project;\n\nexport type AdminOwnedProject = {\n  readonly app: StackAdminApp<false>,\n} & AdminProject;\n\nexport type AdminProjectUpdateOptions = {\n  displayName?: string,\n  description?: string,\n  isProductionMode?: boolean,\n  onboardingStatus?: ProjectOnboardingStatus,\n  /**\n   * Updates `project.requirePublishableClientKey` in the project-level config override.\n   */\n  requirePublishableClientKey?: boolean,\n  logoUrl?: string | null,\n  logoFullUrl?: string | null,\n  logoDarkModeUrl?: string | null,\n  logoFullDarkModeUrl?: string | null,\n  config?: AdminProjectConfigUpdateOptions,\n};\nexport function adminProjectUpdateOptionsToCrud(options: AdminProjectUpdateOptions): ProjectsCrud[\"Admin\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    description: options.description,\n    is_production_mode: options.isProductionMode,\n    onboarding_status: options.onboardingStatus,\n    logo_url: options.logoUrl,\n    logo_full_url: options.logoFullUrl,\n    logo_dark_mode_url: options.logoDarkModeUrl,\n    logo_full_dark_mode_url: options.logoFullDarkModeUrl,\n    /**\n     * NOTE: Do not update this config anymore. It's been superseded by the new config in schema.ts.\n     * @deprecated\n     */\n    config: {\n      domains: options.config?.domains?.map((d) => ({\n        domain: d.domain,\n        handler_path: d.handlerPath\n      })),\n      oauth_providers: options.config?.oauthProviders\n        ?.filter((p): p is Exclude<typeof p, { type: 'custom_oidc' }> => p.type !== 'custom_oidc')\n        .map((p) => ({\n          id: p.id as any,\n          type: p.type,\n          ...(p.type === 'standard' && {\n            client_id: p.clientId,\n            client_secret: p.clientSecret,\n            facebook_config_id: p.facebookConfigId,\n            microsoft_tenant_id: p.microsoftTenantId,\n            apple_team_id: p.appleTeamId,\n            apple_key_id: p.appleKeyId,\n            apple_private_key: p.applePrivateKey,\n            apple_bundle_ids: p.appleBundleIds,\n          }),\n        })),\n      email_config: options.config?.emailConfig && (\n        options.config.emailConfig.type === 'shared' ? {\n          type: 'shared',\n        } : {\n          type: 'standard',\n          host: options.config.emailConfig.host,\n          port: options.config.emailConfig.port,\n          username: options.config.emailConfig.username,\n          password: options.config.emailConfig.password,\n          sender_name: options.config.emailConfig.senderName,\n          sender_email: options.config.emailConfig.senderEmail,\n        }\n      ),\n      email_theme: options.config?.emailTheme,\n      sign_up_enabled: options.config?.signUpEnabled,\n      credential_enabled: options.config?.credentialEnabled,\n      magic_link_enabled: options.config?.magicLinkEnabled,\n      passkey_enabled: options.config?.passkeyEnabled,\n      allow_localhost: options.config?.allowLocalhost,\n      create_team_on_sign_up: options.config?.createTeamOnSignUp,\n      client_team_creation_enabled: options.config?.clientTeamCreationEnabled,\n      client_user_deletion_enabled: options.config?.clientUserDeletionEnabled,\n      team_creator_default_permissions: options.config?.teamCreatorDefaultPermissions,\n      team_member_default_permissions: options.config?.teamMemberDefaultPermissions,\n      user_default_permissions: options.config?.userDefaultPermissions,\n      oauth_account_merge_strategy: options.config?.oauthAccountMergeStrategy,\n      allow_user_api_keys: options.config?.allowUserApiKeys,\n      allow_team_api_keys: options.config?.allowTeamApiKeys,\n    },\n  };\n}\n\nexport type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'> & {\n  displayName: string,\n  teamId: string,\n  isDevelopmentEnvironment?: boolean,\n};\nexport function adminProjectCreateOptionsToCrud(options: AdminProjectCreateOptions): AdminUserProjectsCrud[\"Server\"][\"Create\"] {\n  return {\n    ...adminProjectUpdateOptionsToCrud(options),\n    display_name: options.displayName,\n    is_development_environment: options.isDevelopmentEnvironment,\n    owner_team_id: options.teamId,\n  };\n}\n"],"mappings":";;AAqPA,SAAgB,gCAAgC,SAAqE;CACnH,OAAO;EACL,cAAc,QAAQ;EACtB,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,UAAU,QAAQ;EAClB,eAAe,QAAQ;EACvB,oBAAoB,QAAQ;EAC5B,yBAAyB,QAAQ;;;;;EAKjC,QAAQ;GACN,SAAS,QAAQ,QAAQ,SAAS,KAAK,OAAO;IAC5C,QAAQ,EAAE;IACV,cAAc,EAAE;GAClB,EAAE;GACF,iBAAiB,QAAQ,QAAQ,gBAC7B,QAAQ,MAAuD,EAAE,SAAS,aAAa,CAAC,CACzF,KAAK,OAAO;IACX,IAAI,EAAE;IACN,MAAM,EAAE;IACR,GAAI,EAAE,SAAS,cAAc;KAC3B,WAAW,EAAE;KACb,eAAe,EAAE;KACjB,oBAAoB,EAAE;KACtB,qBAAqB,EAAE;KACvB,eAAe,EAAE;KACjB,cAAc,EAAE;KAChB,mBAAmB,EAAE;KACrB,kBAAkB,EAAE;IACtB;GACF,EAAE;GACJ,cAAc,QAAQ,QAAQ,gBAC5B,QAAQ,OAAO,YAAY,SAAS,WAAW,EAC7C,MAAM,SACR,IAAI;IACF,MAAM;IACN,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,QAAQ,OAAO,YAAY;IACjC,UAAU,QAAQ,OAAO,YAAY;IACrC,UAAU,QAAQ,OAAO,YAAY;IACrC,aAAa,QAAQ,OAAO,YAAY;IACxC,cAAc,QAAQ,OAAO,YAAY;GAC3C;GAEF,aAAa,QAAQ,QAAQ;GAC7B,iBAAiB,QAAQ,QAAQ;GACjC,oBAAoB,QAAQ,QAAQ;GACpC,oBAAoB,QAAQ,QAAQ;GACpC,iBAAiB,QAAQ,QAAQ;GACjC,iBAAiB,QAAQ,QAAQ;GACjC,wBAAwB,QAAQ,QAAQ;GACxC,8BAA8B,QAAQ,QAAQ;GAC9C,8BAA8B,QAAQ,QAAQ;GAC9C,kCAAkC,QAAQ,QAAQ;GAClD,iCAAiC,QAAQ,QAAQ;GACjD,0BAA0B,QAAQ,QAAQ;GAC1C,8BAA8B,QAAQ,QAAQ;GAC9C,qBAAqB,QAAQ,QAAQ;GACrC,qBAAqB,QAAQ,QAAQ;EACvC;CACF;AACF;AAOA,SAAgB,gCAAgC,SAA+E;CAC7H,OAAO;EACL,GAAG,gCAAgC,OAAO;EAC1C,cAAc,QAAQ;EACtB,4BAA4B,QAAQ;EACpC,eAAe,QAAQ;CACzB;AACF"}