@hexclave/next 1.0.125 → 1.0.127

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.external-token-store.test.js

@@ -0,0 +1,381 @@
+let _hexclave_shared = require("@hexclave/shared");
+let vitest = require("vitest");
+let ______common_js = require("../../common.js");
+let ___interfaces_client_app_js = require("../interfaces/client-app.js");
+//#region src/lib/hexclave-app/apps/implementations/client-app-impl.external-token-store.test.ts
+function createAccessTokenString(refreshTokenId, issuedAtOffsetSeconds = 0) {
+	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+	const nowSeconds = Math.floor(Date.now() / 1e3) + issuedAtOffsetSeconds;
+	return [
+		encode({
+			alg: "none",
+			typ: "JWT"
+		}),
+		encode({
+			sub: "user-id",
+			exp: nowSeconds + 60,
+			iat: nowSeconds,
+			iss: "http://localhost:12345",
+			aud: "00000000-0000-4000-8000-000000000000",
+			project_id: "00000000-0000-4000-8000-000000000000",
+			branch_id: "main",
+			refresh_token_id: refreshTokenId,
+			role: "authenticated",
+			name: "Test User",
+			email: "test@example.com",
+			email_verified: true,
+			selected_team_id: null,
+			signed_up_at: nowSeconds,
+			is_anonymous: false,
+			is_restricted: false,
+			restricted_reason: null,
+			requires_totp_mfa: false
+		}),
+		""
+	].join(".");
+}
+(0, vitest.describe)("StackClientApp external token stores", () => {
+	(0, vitest.it)("does not reuse a cached token when the provider session has ended", async () => {
+		let providerSessionId = "clerk-session";
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "stale-provider-token"
+			}),
+			redirectMethod: "none"
+		});
+		const getSession = Reflect.get(clientApp, "_getSession");
+		const authenticatedSession = await getSession.call(clientApp);
+		providerSessionId = null;
+		const signedOutSession = await getSession.call(clientApp);
+		(0, vitest.expect)(signedOutSession.sessionKey).toBe("not-logged-in");
+		(0, vitest.expect)(signedOutSession).not.toBe(authenticatedSession);
+		(0, vitest.expect)(signedOutSession.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+	});
+	(0, vitest.it)("exchanges provider tokens and preserves the session across token rotations", async () => {
+		let providerSessionId = "clerk-session";
+		let notifyProviderChange;
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "clerk-token",
+				subscribe: (callback) => {
+					notifyProviderChange = callback;
+					return () => {};
+				}
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			return {
+				status: "ok",
+				data: {
+					accessToken: createAccessTokenString("hexclave-external-session", exchangeCount),
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			};
+		});
+		const getSession = Reflect.get(clientApp, "_getSession");
+		const firstSession = await getSession.call(clientApp);
+		(0, vitest.expect)(firstSession.sessionKey).toBe("external-clerk-integration-clerk-session");
+		await firstSession.getOrFetchLikelyValidTokens(2e4, null);
+		(0, vitest.expect)(exchangeCount).toBe(1);
+		notifyProviderChange?.();
+		const refreshedSession = await getSession.call(clientApp);
+		(0, vitest.expect)(refreshedSession).toBe(firstSession);
+		await refreshedSession.getOrFetchLikelyValidTokens(2e4, null);
+		(0, vitest.expect)(exchangeCount).toBe(2);
+		providerSessionId = "another-clerk-session";
+		notifyProviderChange?.();
+		const switchedSession = await getSession.call(clientApp);
+		(0, vitest.expect)(switchedSession).not.toBe(firstSession);
+		(0, vitest.expect)(switchedSession.sessionKey).toBe("external-clerk-integration-another-clerk-session");
+	});
+	(0, vitest.it)("retries a rejected exchange once with a fresh provider token before giving up", async () => {
+		let tokenCounter = 0;
+		const exchangedTokens = [];
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => `clerk-token-${++tokenCounter}`
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async (_providerId, token) => {
+			exchangedTokens.push(token);
+			if (exchangedTokens.length === 1) return {
+				status: "error",
+				error: new _hexclave_shared.KnownErrors.InvalidExternalAuthToken("malformed_token")
+			};
+			return {
+				status: "ok",
+				data: {
+					accessToken: createAccessTokenString("hexclave-external-session"),
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		(0, vitest.expect)(await session.getOrFetchLikelyValidTokens(2e4, null)).not.toBeNull();
+		(0, vitest.expect)(exchangedTokens).toEqual(["clerk-token-1", "clerk-token-2"]);
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+	});
+	(0, vitest.it)("does not retry into a different provider session after an exchange rejection", async () => {
+		let providerSessionId = "clerk-session-a";
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			providerSessionId = "clerk-session-b";
+			return {
+				status: "error",
+				error: new _hexclave_shared.KnownErrors.InvalidExternalAuthToken("malformed_token")
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		await (0, vitest.expect)(session.getOrFetchLikelyValidTokens(2e4, null)).rejects.toThrow("provider session changed");
+		(0, vitest.expect)(exchangeCount).toBe(1);
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+		(0, vitest.expect)(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+	});
+	(0, vitest.it)("does not refresh a session after the provider switches before refresh starts", async () => {
+		let providerSessionId = "clerk-session-a";
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			return {
+				status: "ok",
+				data: {
+					accessToken: createAccessTokenString("hexclave-external-session"),
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		providerSessionId = "clerk-session-b";
+		await (0, vitest.expect)(session.getOrFetchLikelyValidTokens(2e4, null)).rejects.toThrow("provider session changed");
+		(0, vitest.expect)(exchangeCount).toBe(0);
+		(0, vitest.expect)(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+	});
+	(0, vitest.it)("does not install a token when the provider switches accounts mid-exchange", async () => {
+		let providerSessionId = "clerk-session-a";
+		let resolveExchange;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", () => new Promise((resolve) => {
+			resolveExchange = (accessToken) => resolve({
+				status: "ok",
+				data: {
+					accessToken,
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			});
+		}));
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		const pending = session.getOrFetchLikelyValidTokens(2e4, null);
+		await vitest.vi.waitFor(() => (0, vitest.expect)(resolveExchange).toBeDefined());
+		providerSessionId = "clerk-session-b";
+		resolveExchange?.(createAccessTokenString("hexclave-external-session"));
+		await (0, vitest.expect)(pending).rejects.toThrow("provider session changed");
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+		(0, vitest.expect)(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+	});
+	(0, vitest.it)("does not install a token when the provider switches away and back during token retrieval", async () => {
+		let providerSessionId = "clerk-session-a";
+		let notifyProviderChange;
+		let resolveProviderToken;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => providerSessionId,
+				getToken: () => new Promise((resolve) => {
+					resolveProviderToken = resolve;
+				}),
+				subscribe: (callback) => {
+					notifyProviderChange = callback;
+					return () => {};
+				}
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => ({
+			status: "ok",
+			data: {
+				accessToken: createAccessTokenString("hexclave-external-session"),
+				sessionId: "hexclave-external-session",
+				userId: "user-id"
+			}
+		}));
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		const pending = session.getOrFetchLikelyValidTokens(2e4, null);
+		await vitest.vi.waitFor(() => (0, vitest.expect)(resolveProviderToken).toBeDefined());
+		providerSessionId = "clerk-session-b";
+		notifyProviderChange?.();
+		providerSessionId = "clerk-session-a";
+		notifyProviderChange?.();
+		resolveProviderToken?.("clerk-token");
+		await (0, vitest.expect)(pending).rejects.toThrow("provider session changed");
+		(0, vitest.expect)(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+	});
+	(0, vitest.it)("surfaces the rejection without invalidating the session when the retried exchange is rejected too", async () => {
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			return {
+				status: "error",
+				error: new _hexclave_shared.KnownErrors.InvalidExternalAuthToken("malformed_token")
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		await (0, vitest.expect)(session.getOrFetchLikelyValidTokens(2e4, null)).rejects.toBeInstanceOf(_hexclave_shared.KnownErrors.InvalidExternalAuthToken);
+		(0, vitest.expect)(exchangeCount).toBe(2);
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+	});
+	(0, vitest.it)("rejects first-party sign-in with Hexclave tokens for an app with an external token store", async () => {
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		await (0, vitest.expect)(Reflect.get(clientApp, "_signInToAccountWithTokens").call(clientApp, {
+			accessToken: createAccessTokenString("unrelated-session"),
+			refreshToken: "unrelated-refresh-token"
+		})).rejects.toThrow("cannot sign in with Hexclave tokens");
+	});
+	(0, vitest.it)("treats a missing provider token as transient while the provider still reports a session", async () => {
+		let providerToken = null;
+		let exchangeCount = 0;
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => providerToken
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		Reflect.set(clientInterface, "exchangeExternalAuthToken", async () => {
+			exchangeCount += 1;
+			return {
+				status: "ok",
+				data: {
+					accessToken: createAccessTokenString("hexclave-external-session"),
+					sessionId: "hexclave-external-session",
+					userId: "user-id"
+				}
+			};
+		});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		await (0, vitest.expect)(session.getOrFetchLikelyValidTokens(2e4, null)).rejects.toThrow("external token store returned no token");
+		(0, vitest.expect)(session.isKnownToBeInvalid()).toBe(false);
+		(0, vitest.expect)(exchangeCount).toBe(0);
+		providerToken = "clerk-token";
+		(0, vitest.expect)(await session.getOrFetchLikelyValidTokens(2e4, null)).not.toBeNull();
+		(0, vitest.expect)(exchangeCount).toBe(1);
+	});
+	(0, vitest.it)("rejects signing out an external session without revoking the Hexclave session", async () => {
+		const clientApp = new ___interfaces_client_app_js.StackClientApp({
+			automaticSideEffects: false,
+			baseUrl: "http://localhost:12345",
+			projectId: "00000000-0000-4000-8000-000000000000",
+			publishableClientKey: "stack-pk-test",
+			tokenStore: (0, ______common_js.clerkTokenStore)({
+				getSessionId: () => "clerk-session",
+				getToken: async () => "clerk-token"
+			}),
+			redirectMethod: "none"
+		});
+		const clientInterface = Reflect.get(clientApp, "_interface");
+		let hexclaveSignOutCount = 0;
+		Reflect.set(clientInterface, "signOut", async () => {
+			hexclaveSignOutCount += 1;
+		});
+		Reflect.set(clientApp, "_redirectToDefaultAfterSignOut", async () => {});
+		const session = await Reflect.get(clientApp, "_getSession").call(clientApp);
+		await (0, vitest.expect)(Reflect.get(clientApp, "_signOut").call(clientApp, session)).rejects.toThrow("Cannot sign out an externally authenticated session through Hexclave");
+		(0, vitest.expect)(hexclaveSignOutCount).toBe(0);
+	});
+});
+//#endregion
+
+//# sourceMappingURL=client-app-impl.external-token-store.test.js.map

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.external-token-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-app-impl.external-token-store.test.js","names":["StackClientApp","KnownErrors","vi"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.external-token-store.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { clerkTokenStore } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\n\nfunction createAccessTokenString(refreshTokenId: string, issuedAtOffsetSeconds = 0): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000) + issuedAtOffsetSeconds;\n  // The payload must satisfy accessTokenPayloadSchema, otherwise AccessToken.createIfValid rejects it.\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"http://localhost:12345\",\n      aud: \"00000000-0000-4000-8000-000000000000\",\n      project_id: \"00000000-0000-4000-8000-000000000000\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: \"Test User\",\n      email: \"test@example.com\",\n      email_verified: true,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\ndescribe(\"StackClientApp external token stores\", () => {\n  it(\"does not reuse a cached token when the provider session has ended\", async () => {\n    let providerSessionId: string | null = \"clerk-session\";\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => providerSessionId,\n        getToken: async () => \"stale-provider-token\",\n      }),\n      redirectMethod: \"none\",\n    });\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const authenticatedSession = await getSession.call(clientApp);\n    providerSessionId = null;\n    const signedOutSession = await getSession.call(clientApp);\n\n    expect(signedOutSession.sessionKey).toBe(\"not-logged-in\");\n    expect(signedOutSession).not.toBe(authenticatedSession);\n    expect(signedOutSession.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();\n  });\n\n  it(\"exchanges provider tokens and preserves the session across token rotations\", async () => {\n    let providerSessionId = \"clerk-session\";\n    let notifyProviderChange: (() => void) | undefined;\n    let exchangeCount = 0;\n    const externalTokenStore = clerkTokenStore({\n      getSessionId: () => providerSessionId,\n      getToken: async () => \"clerk-token\",\n      subscribe: (callback) => {\n        notifyProviderChange = callback;\n        return () => {};\n      },\n    });\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: externalTokenStore,\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    Reflect.set(clientInterface, \"exchangeExternalAuthToken\", async () => {\n      exchangeCount += 1;\n      return {\n        status: \"ok\",\n        data: {\n          accessToken: createAccessTokenString(\"hexclave-external-session\", exchangeCount),\n          sessionId: \"hexclave-external-session\",\n          userId: \"user-id\",\n        },\n      };\n    });\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const firstSession = await getSession.call(clientApp);\n    expect(firstSession.sessionKey).toBe(\"external-clerk-integration-clerk-session\");\n    await firstSession.getOrFetchLikelyValidTokens(20_000, null);\n    expect(exchangeCount).toBe(1);\n\n    notifyProviderChange?.();\n    const refreshedSession = await getSession.call(clientApp);\n    expect(refreshedSession).toBe(firstSession);\n    await refreshedSession.getOrFetchLikelyValidTokens(20_000, null);\n    expect(exchangeCount).toBe(2);\n\n    providerSessionId = \"another-clerk-session\";\n    notifyProviderChange?.();\n    const switchedSession = await getSession.call(clientApp);\n    expect(switchedSession).not.toBe(firstSession);\n    expect(switchedSession.sessionKey).toBe(\"external-clerk-integration-another-clerk-session\");\n  });\n\n  it(\"retries a rejected exchange once with a fresh provider token before giving up\", async () => {\n    let tokenCounter = 0;\n    const exchangedTokens: string[] = [];\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => \"clerk-session\",\n        getToken: async () => `clerk-token-${++tokenCounter}`,\n      }),\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    Reflect.set(clientInterface, \"exchangeExternalAuthToken\", async (_providerId: string, token: string) => {\n      exchangedTokens.push(token);\n      // The first provider token is treated as expired-in-flight; the retried, freshly fetched one succeeds.\n      if (exchangedTokens.length === 1) {\n        return { status: \"error\", error: new KnownErrors.InvalidExternalAuthToken(\"malformed_token\") };\n      }\n      return {\n        status: \"ok\",\n        data: {\n          accessToken: createAccessTokenString(\"hexclave-external-session\"),\n          sessionId: \"hexclave-external-session\",\n          userId: \"user-id\",\n        },\n      };\n    });\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const session = await getSession.call(clientApp);\n    const tokens = await session.getOrFetchLikelyValidTokens(20_000, null);\n    expect(tokens).not.toBeNull();\n    expect(exchangedTokens).toEqual([\"clerk-token-1\", \"clerk-token-2\"]);\n    expect(session.isKnownToBeInvalid()).toBe(false);\n  });\n\n  it(\"does not retry into a different provider session after an exchange rejection\", async () => {\n    let providerSessionId: string | null = \"clerk-session-a\";\n    let exchangeCount = 0;\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => providerSessionId,\n        getToken: async () => \"clerk-token\",\n      }),\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    Reflect.set(clientInterface, \"exchangeExternalAuthToken\", async () => {\n      exchangeCount += 1;\n      providerSessionId = \"clerk-session-b\";\n      return { status: \"error\", error: new KnownErrors.InvalidExternalAuthToken(\"malformed_token\") };\n    });\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const session = await getSession.call(clientApp);\n    await expect(session.getOrFetchLikelyValidTokens(20_000, null)).rejects.toThrow(\"provider session changed\");\n    expect(exchangeCount).toBe(1);\n    expect(session.isKnownToBeInvalid()).toBe(false);\n    expect(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();\n  });\n\n  it(\"does not refresh a session after the provider switches before refresh starts\", async () => {\n    let providerSessionId: string | null = \"clerk-session-a\";\n    let exchangeCount = 0;\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => providerSessionId,\n        getToken: async () => \"clerk-token\",\n      }),\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    Reflect.set(clientInterface, \"exchangeExternalAuthToken\", async () => {\n      exchangeCount += 1;\n      return {\n        status: \"ok\",\n        data: {\n          accessToken: createAccessTokenString(\"hexclave-external-session\"),\n          sessionId: \"hexclave-external-session\",\n          userId: \"user-id\",\n        },\n      };\n    });\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const session = await getSession.call(clientApp);\n    providerSessionId = \"clerk-session-b\";\n\n    await expect(session.getOrFetchLikelyValidTokens(20_000, null)).rejects.toThrow(\"provider session changed\");\n    expect(exchangeCount).toBe(0);\n    expect(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();\n    expect(session.isKnownToBeInvalid()).toBe(false);\n  });\n\n  it(\"does not install a token when the provider switches accounts mid-exchange\", async () => {\n    let providerSessionId: string | null = \"clerk-session-a\";\n    let resolveExchange: ((value: string) => void) | undefined;\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => providerSessionId,\n        getToken: async () => \"clerk-token\",\n      }),\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    Reflect.set(clientInterface, \"exchangeExternalAuthToken\", () => new Promise((resolve) => {\n      resolveExchange = (accessToken) => resolve({\n        status: \"ok\",\n        data: {\n          accessToken,\n          sessionId: \"hexclave-external-session\",\n          userId: \"user-id\",\n        },\n      });\n    }));\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const session = await getSession.call(clientApp);\n    const pending = session.getOrFetchLikelyValidTokens(20_000, null);\n    await vi.waitFor(() => expect(resolveExchange).toBeDefined());\n    providerSessionId = \"clerk-session-b\";\n    resolveExchange?.(createAccessTokenString(\"hexclave-external-session\"));\n\n    await expect(pending).rejects.toThrow(\"provider session changed\");\n    expect(session.isKnownToBeInvalid()).toBe(false);\n    // The rejected exchange must not have left the other account's token behind on this session.\n    expect(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();\n  });\n\n  it(\"does not install a token when the provider switches away and back during token retrieval\", async () => {\n    let providerSessionId = \"clerk-session-a\";\n    let notifyProviderChange: (() => void) | undefined;\n    let resolveProviderToken: ((token: string) => void) | undefined;\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => providerSessionId,\n        getToken: () => new Promise(resolve => {\n          resolveProviderToken = resolve;\n        }),\n        subscribe: callback => {\n          notifyProviderChange = callback;\n          return () => {};\n        },\n      }),\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    Reflect.set(clientInterface, \"exchangeExternalAuthToken\", async () => ({\n      status: \"ok\",\n      data: {\n        accessToken: createAccessTokenString(\"hexclave-external-session\"),\n        sessionId: \"hexclave-external-session\",\n        userId: \"user-id\",\n      },\n    }));\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const session = await getSession.call(clientApp);\n    const pending = session.getOrFetchLikelyValidTokens(20_000, null);\n    await vi.waitFor(() => expect(resolveProviderToken).toBeDefined());\n\n    providerSessionId = \"clerk-session-b\";\n    notifyProviderChange?.();\n    providerSessionId = \"clerk-session-a\";\n    notifyProviderChange?.();\n    resolveProviderToken?.(\"clerk-token\");\n\n    await expect(pending).rejects.toThrow(\"provider session changed\");\n    expect(session.getAccessTokenIfNotExpiredYet(0, null)).toBeNull();\n    expect(session.isKnownToBeInvalid()).toBe(false);\n  });\n\n  it(\"surfaces the rejection without invalidating the session when the retried exchange is rejected too\", async () => {\n    let exchangeCount = 0;\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => \"clerk-session\",\n        getToken: async () => \"clerk-token\",\n      }),\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    Reflect.set(clientInterface, \"exchangeExternalAuthToken\", async () => {\n      exchangeCount += 1;\n      return { status: \"error\", error: new KnownErrors.InvalidExternalAuthToken(\"malformed_token\") };\n    });\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const session = await getSession.call(clientApp);\n    await expect(session.getOrFetchLikelyValidTokens(20_000, null)).rejects.toBeInstanceOf(KnownErrors.InvalidExternalAuthToken);\n    expect(exchangeCount).toBe(2);\n    // A repeated rejection is a misconfiguration signal, not a sign-out: the session must stay usable\n    // so that fixing the configuration recovers it.\n    expect(session.isKnownToBeInvalid()).toBe(false);\n  });\n\n  it(\"rejects first-party sign-in with Hexclave tokens for an app with an external token store\", async () => {\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => \"clerk-session\",\n        getToken: async () => \"clerk-token\",\n      }),\n      redirectMethod: \"none\",\n    });\n\n    const signInToAccountWithTokens = Reflect.get(clientApp, \"_signInToAccountWithTokens\");\n    await expect(signInToAccountWithTokens.call(clientApp, {\n      accessToken: createAccessTokenString(\"unrelated-session\"),\n      refreshToken: \"unrelated-refresh-token\",\n    })).rejects.toThrow(\"cannot sign in with Hexclave tokens\");\n  });\n\n  it(\"treats a missing provider token as transient while the provider still reports a session\", async () => {\n    let providerToken: string | null = null;\n    let exchangeCount = 0;\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => \"clerk-session\",\n        getToken: async () => providerToken,\n      }),\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    Reflect.set(clientInterface, \"exchangeExternalAuthToken\", async () => {\n      exchangeCount += 1;\n      return {\n        status: \"ok\",\n        data: {\n          accessToken: createAccessTokenString(\"hexclave-external-session\"),\n          sessionId: \"hexclave-external-session\",\n          userId: \"user-id\",\n        },\n      };\n    });\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const session = await getSession.call(clientApp);\n    // The provider SDK is still initializing (session reported, but no token yet): the fetch must\n    // fail loudly instead of permanently invalidating the session.\n    await expect(session.getOrFetchLikelyValidTokens(20_000, null)).rejects.toThrow(\"external token store returned no token\");\n    expect(session.isKnownToBeInvalid()).toBe(false);\n    expect(exchangeCount).toBe(0);\n\n    providerToken = \"clerk-token\";\n    const tokens = await session.getOrFetchLikelyValidTokens(20_000, null);\n    expect(tokens).not.toBeNull();\n    expect(exchangeCount).toBe(1);\n  });\n\n  it(\"rejects signing out an external session without revoking the Hexclave session\", async () => {\n    const clientApp = new StackClientApp({\n      automaticSideEffects: false,\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: clerkTokenStore({\n        getSessionId: () => \"clerk-session\",\n        getToken: async () => \"clerk-token\",\n      }),\n      redirectMethod: \"none\",\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    let hexclaveSignOutCount = 0;\n    Reflect.set(clientInterface, \"signOut\", async () => {\n      hexclaveSignOutCount += 1;\n    });\n    Reflect.set(clientApp, \"_redirectToDefaultAfterSignOut\", async () => {});\n\n    const getSession = Reflect.get(clientApp, \"_getSession\");\n    const session = await getSession.call(clientApp);\n    const signOut = Reflect.get(clientApp, \"_signOut\");\n    await expect(signOut.call(clientApp, session)).rejects.toThrow(\n      \"Cannot sign out an externally authenticated session through Hexclave\",\n    );\n\n    expect(hexclaveSignOutCount).toBe(0);\n  });\n});\n"],"mappings":";;;;;AASA,SAAS,wBAAwB,gBAAwB,wBAAwB,GAAW;CAC1F,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;CAEnD,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;qBAES,8CAA8C;CACrD,CAAA,GAAA,OAAA,GAAA,CAAG,qEAAqE,YAAY;EAClF,IAAI,oBAAmC;EACvC,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY;GACxB,CAAC;GACD,gBAAgB;EAClB,CAAC;EAED,MAAM,aAAa,QAAQ,IAAI,WAAW,aAAa;EACvD,MAAM,uBAAuB,MAAM,WAAW,KAAK,SAAS;EAC5D,oBAAoB;EACpB,MAAM,mBAAmB,MAAM,WAAW,KAAK,SAAS;EAExD,CAAA,GAAA,OAAA,OAAA,CAAO,iBAAiB,UAAU,CAAC,CAAC,KAAK,eAAe;EACxD,CAAA,GAAA,OAAA,OAAA,CAAO,gBAAgB,CAAC,CAAC,IAAI,KAAK,oBAAoB;EACtD,CAAA,GAAA,OAAA,OAAA,CAAO,iBAAiB,8BAA8B,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;CAC3E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E,YAAY;EAC3F,IAAI,oBAAoB;EACxB,IAAI;EACJ,IAAI,gBAAgB;EASpB,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAbyC;IACzC,oBAAoB;IACpB,UAAU,YAAY;IACtB,YAAY,aAAa;KACvB,uBAAuB;KACvB,aAAa,CAAC;IAChB;GACF,CAM+B;GAC7B,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,QAAQ,IAAI,iBAAiB,6BAA6B,YAAY;GACpE,iBAAiB;GACjB,OAAO;IACL,QAAQ;IACR,MAAM;KACJ,aAAa,wBAAwB,6BAA6B,aAAa;KAC/E,WAAW;KACX,QAAQ;IACV;GACF;EACF,CAAC;EAED,MAAM,aAAa,QAAQ,IAAI,WAAW,aAAa;EACvD,MAAM,eAAe,MAAM,WAAW,KAAK,SAAS;EACpD,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,UAAU,CAAC,CAAC,KAAK,0CAA0C;EAC/E,MAAM,aAAa,4BAA4B,KAAQ,IAAI;EAC3D,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,CAAC;EAE5B,uBAAuB;EACvB,MAAM,mBAAmB,MAAM,WAAW,KAAK,SAAS;EACxD,CAAA,GAAA,OAAA,OAAA,CAAO,gBAAgB,CAAC,CAAC,KAAK,YAAY;EAC1C,MAAM,iBAAiB,4BAA4B,KAAQ,IAAI;EAC/D,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,CAAC;EAE5B,oBAAoB;EACpB,uBAAuB;EACvB,MAAM,kBAAkB,MAAM,WAAW,KAAK,SAAS;EACvD,CAAA,GAAA,OAAA,OAAA,CAAO,eAAe,CAAC,CAAC,IAAI,KAAK,YAAY;EAC7C,CAAA,GAAA,OAAA,OAAA,CAAO,gBAAgB,UAAU,CAAC,CAAC,KAAK,kDAAkD;CAC5F,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iFAAiF,YAAY;EAC9F,IAAI,eAAe;EACnB,MAAM,kBAA4B,CAAC;EACnC,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY,eAAe,EAAE;GACzC,CAAC;GACD,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,QAAQ,IAAI,iBAAiB,6BAA6B,OAAO,aAAqB,UAAkB;GACtG,gBAAgB,KAAK,KAAK;GAE1B,IAAI,gBAAgB,WAAW,GAC7B,OAAO;IAAE,QAAQ;IAAS,OAAO,IAAIC,iBAAAA,YAAY,yBAAyB,iBAAiB;GAAE;GAE/F,OAAO;IACL,QAAQ;IACR,MAAM;KACJ,aAAa,wBAAwB,2BAA2B;KAChE,WAAW;KACX,QAAQ;IACV;GACF;EACF,CAAC;EAGD,MAAM,UAAU,MADG,QAAQ,IAAI,WAAW,aACX,CAAC,CAAC,KAAK,SAAS;EAE/C,CAAA,GAAA,OAAA,OAAA,CAAO,MADc,QAAQ,4BAA4B,KAAQ,IAAI,CACxD,CAAC,CAAC,IAAI,SAAS;EAC5B,CAAA,GAAA,OAAA,OAAA,CAAO,eAAe,CAAC,CAAC,QAAQ,CAAC,iBAAiB,eAAe,CAAC;EAClE,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;CACjD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,gFAAgF,YAAY;EAC7F,IAAI,oBAAmC;EACvC,IAAI,gBAAgB;EACpB,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY;GACxB,CAAC;GACD,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,QAAQ,IAAI,iBAAiB,6BAA6B,YAAY;GACpE,iBAAiB;GACjB,oBAAoB;GACpB,OAAO;IAAE,QAAQ;IAAS,OAAO,IAAIC,iBAAAA,YAAY,yBAAyB,iBAAiB;GAAE;EAC/F,CAAC;EAGD,MAAM,UAAU,MADG,QAAQ,IAAI,WAAW,aACX,CAAC,CAAC,KAAK,SAAS;EAC/C,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,4BAA4B,KAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,0BAA0B;EAC1G,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,CAAC;EAC5B,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;EAC/C,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,8BAA8B,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;CAClE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,gFAAgF,YAAY;EAC7F,IAAI,oBAAmC;EACvC,IAAI,gBAAgB;EACpB,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY;GACxB,CAAC;GACD,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,QAAQ,IAAI,iBAAiB,6BAA6B,YAAY;GACpE,iBAAiB;GACjB,OAAO;IACL,QAAQ;IACR,MAAM;KACJ,aAAa,wBAAwB,2BAA2B;KAChE,WAAW;KACX,QAAQ;IACV;GACF;EACF,CAAC;EAGD,MAAM,UAAU,MADG,QAAQ,IAAI,WAAW,aACX,CAAC,CAAC,KAAK,SAAS;EAC/C,oBAAoB;EAEpB,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,4BAA4B,KAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,0BAA0B;EAC1G,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,CAAC;EAC5B,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,8BAA8B,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;CACjD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6EAA6E,YAAY;EAC1F,IAAI,oBAAmC;EACvC,IAAI;EACJ,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY;GACxB,CAAC;GACD,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,QAAQ,IAAI,iBAAiB,mCAAmC,IAAI,SAAS,YAAY;GACvF,mBAAmB,gBAAgB,QAAQ;IACzC,QAAQ;IACR,MAAM;KACJ;KACA,WAAW;KACX,QAAQ;IACV;GACF,CAAC;EACH,CAAC,CAAC;EAGF,MAAM,UAAU,MADG,QAAQ,IAAI,WAAW,aACX,CAAC,CAAC,KAAK,SAAS;EAC/C,MAAM,UAAU,QAAQ,4BAA4B,KAAQ,IAAI;EAChE,MAAME,OAAAA,GAAG,eAAA,GAAA,OAAA,OAAA,CAAqB,eAAe,CAAC,CAAC,YAAY,CAAC;EAC5D,oBAAoB;EACpB,kBAAkB,wBAAwB,2BAA2B,CAAC;EAEtE,OAAA,GAAA,OAAA,OAAA,CAAa,OAAO,CAAC,CAAC,QAAQ,QAAQ,0BAA0B;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;EAE/C,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,8BAA8B,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;CAClE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4FAA4F,YAAY;EACzG,IAAI,oBAAoB;EACxB,IAAI;EACJ,IAAI;EACJ,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,gBAAgB,IAAI,SAAQ,YAAW;KACrC,uBAAuB;IACzB,CAAC;IACD,YAAW,aAAY;KACrB,uBAAuB;KACvB,aAAa,CAAC;IAChB;GACF,CAAC;GACD,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,QAAQ,IAAI,iBAAiB,6BAA6B,aAAa;GACrE,QAAQ;GACR,MAAM;IACJ,aAAa,wBAAwB,2BAA2B;IAChE,WAAW;IACX,QAAQ;GACV;EACF,EAAE;EAGF,MAAM,UAAU,MADG,QAAQ,IAAI,WAAW,aACX,CAAC,CAAC,KAAK,SAAS;EAC/C,MAAM,UAAU,QAAQ,4BAA4B,KAAQ,IAAI;EAChE,MAAME,OAAAA,GAAG,eAAA,GAAA,OAAA,OAAA,CAAqB,oBAAoB,CAAC,CAAC,YAAY,CAAC;EAEjE,oBAAoB;EACpB,uBAAuB;EACvB,oBAAoB;EACpB,uBAAuB;EACvB,uBAAuB,aAAa;EAEpC,OAAA,GAAA,OAAA,OAAA,CAAa,OAAO,CAAC,CAAC,QAAQ,QAAQ,0BAA0B;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,8BAA8B,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;CACjD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,qGAAqG,YAAY;EAClH,IAAI,gBAAgB;EACpB,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY;GACxB,CAAC;GACD,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,QAAQ,IAAI,iBAAiB,6BAA6B,YAAY;GACpE,iBAAiB;GACjB,OAAO;IAAE,QAAQ;IAAS,OAAO,IAAIC,iBAAAA,YAAY,yBAAyB,iBAAiB;GAAE;EAC/F,CAAC;EAGD,MAAM,UAAU,MADG,QAAQ,IAAI,WAAW,aACX,CAAC,CAAC,KAAK,SAAS;EAC/C,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,4BAA4B,KAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,eAAeA,iBAAAA,YAAY,wBAAwB;EAC3H,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,CAAC;EAG5B,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;CACjD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4FAA4F,YAAY;EACzG,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY;GACxB,CAAC;GACD,gBAAgB;EAClB,CAAC;EAGD,OAAA,GAAA,OAAA,OAAA,CADkC,QAAQ,IAAI,WAAW,4BACpB,CAAC,CAAC,KAAK,WAAW;GACrD,aAAa,wBAAwB,mBAAmB;GACxD,cAAc;EAChB,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,qCAAqC;CAC3D,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,IAAI,gBAA+B;EACnC,IAAI,gBAAgB;EACpB,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY;GACxB,CAAC;GACD,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,QAAQ,IAAI,iBAAiB,6BAA6B,YAAY;GACpE,iBAAiB;GACjB,OAAO;IACL,QAAQ;IACR,MAAM;KACJ,aAAa,wBAAwB,2BAA2B;KAChE,WAAW;KACX,QAAQ;IACV;GACF;EACF,CAAC;EAGD,MAAM,UAAU,MADG,QAAQ,IAAI,WAAW,aACX,CAAC,CAAC,KAAK,SAAS;EAG/C,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,4BAA4B,KAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,wCAAwC;EACxH,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;EAC/C,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,CAAC;EAE5B,gBAAgB;EAEhB,CAAA,GAAA,OAAA,OAAA,CAAO,MADc,QAAQ,4BAA4B,KAAQ,IAAI,CACxD,CAAC,CAAC,IAAI,SAAS;EAC5B,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,CAAC;CAC9B,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iFAAiF,YAAY;EAC9F,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,sBAAsB;GACtB,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,aAAA,GAAA,gBAAA,gBAAA,CAA4B;IAC1B,oBAAoB;IACpB,UAAU,YAAY;GACxB,CAAC;GACD,gBAAgB;EAClB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,IAAI,uBAAuB;EAC3B,QAAQ,IAAI,iBAAiB,WAAW,YAAY;GAClD,wBAAwB;EAC1B,CAAC;EACD,QAAQ,IAAI,WAAW,kCAAkC,YAAY,CAAC,CAAC;EAGvE,MAAM,UAAU,MADG,QAAQ,IAAI,WAAW,aACX,CAAC,CAAC,KAAK,SAAS;EAE/C,OAAA,GAAA,OAAA,OAAA,CADgB,QAAQ,IAAI,WAAW,UACpB,CAAC,CAAC,KAAK,WAAW,OAAO,CAAC,CAAC,CAAC,QAAQ,QACrD,sEACF;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,oBAAoB,CAAC,CAAC,KAAK,CAAC;CACrC,CAAC;AACH,CAAC"}

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.init-analytics.test.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.init-analytics.test.js

@@ -0,0 +1,65 @@
+let _hexclave_shared = require("@hexclave/shared");
+let vitest = require("vitest");
+let _hexclave_shared_dist_utils_results = require("@hexclave/shared/dist/utils/results");
+let ___interfaces_client_app_js = require("../interfaces/client-app.js");
+//#region src/lib/hexclave-app/apps/implementations/client-app-impl.init-analytics.test.ts
+const baseOptions = {
+	baseUrl: "http://localhost:12345",
+	projectId: "00000000-0000-4000-8000-000000000000",
+	publishableClientKey: "stack-pk-test",
+	tokenStore: "memory",
+	redirectMethod: "none",
+	noAutomaticPrefetch: true
+};
+const analyticsAppDisabledMessage = "initAnalytics() was called, but the Analytics app is not enabled on this Hexclave project";
+function simulateAnalyticsUploadResult(app, result) {
+	const handler = Reflect.get(app, "_handleAnalyticsUploadResult");
+	if (typeof handler !== "function") throw new Error("Expected HexclaveClientApp to have a _handleAnalyticsUploadResult method");
+	handler.call(app, result);
+}
+(0, vitest.describe)("HexclaveClientApp.initAnalytics", () => {
+	(0, vitest.afterEach)(() => {
+		vitest.vi.restoreAllMocks();
+	});
+	(0, vitest.it)("does not throw when analytics are configured", () => {
+		const app = new ___interfaces_client_app_js.HexclaveClientApp(baseOptions);
+		(0, vitest.expect)(() => app.initAnalytics()).not.toThrow();
+	});
+	(0, vitest.it)("throws when analytics are disabled with the analytics option", () => {
+		const app = new ___interfaces_client_app_js.HexclaveClientApp({
+			...baseOptions,
+			analytics: { enabled: false }
+		});
+		(0, vitest.expect)(() => app.initAnalytics()).toThrow("`analytics.enabled` constructor option is set to false");
+	});
+	(0, vitest.it)("does not throw when only session replays are disabled", () => {
+		const app = new ___interfaces_client_app_js.HexclaveClientApp({
+			...baseOptions,
+			analytics: { replays: { enabled: false } }
+		});
+		(0, vitest.expect)(() => app.initAnalytics()).not.toThrow();
+	});
+	(0, vitest.it)("reports an error when the backend rejects uploads after initAnalytics() was called", () => {
+		const consoleError = vitest.vi.spyOn(console, "error").mockImplementation(() => {});
+		const app = new ___interfaces_client_app_js.HexclaveClientApp(baseOptions);
+		app.initAnalytics();
+		simulateAnalyticsUploadResult(app, _hexclave_shared_dist_utils_results.Result.error(new _hexclave_shared.KnownErrors.AnalyticsNotEnabled()));
+		simulateAnalyticsUploadResult(app, _hexclave_shared_dist_utils_results.Result.error(new _hexclave_shared.KnownErrors.AnalyticsNotEnabled()));
+		(0, vitest.expect)(consoleError.mock.calls.filter((args) => args.some((arg) => String(arg).includes(analyticsAppDisabledMessage)))).toHaveLength(1);
+	});
+	(0, vitest.it)("throws from initAnalytics() when the backend already rejected uploads before it was called", () => {
+		const consoleError = vitest.vi.spyOn(console, "error").mockImplementation(() => {});
+		const app = new ___interfaces_client_app_js.HexclaveClientApp(baseOptions);
+		simulateAnalyticsUploadResult(app, _hexclave_shared_dist_utils_results.Result.error(new _hexclave_shared.KnownErrors.AnalyticsNotEnabled()));
+		(0, vitest.expect)(consoleError.mock.calls.some((args) => args.some((arg) => String(arg).includes(analyticsAppDisabledMessage)))).toBe(false);
+		(0, vitest.expect)(() => app.initAnalytics()).toThrow(analyticsAppDisabledMessage);
+	});
+	(0, vitest.it)("ignores upload failures unrelated to the Analytics app being disabled", () => {
+		const app = new ___interfaces_client_app_js.HexclaveClientApp(baseOptions);
+		simulateAnalyticsUploadResult(app, _hexclave_shared_dist_utils_results.Result.error(/* @__PURE__ */ new Error("network error")));
+		(0, vitest.expect)(() => app.initAnalytics()).not.toThrow();
+	});
+});
+//#endregion
+
+//# sourceMappingURL=client-app-impl.init-analytics.test.js.map

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.init-analytics.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-app-impl.init-analytics.test.js","names":["HexclaveClientApp","vi","Result","KnownErrors"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.init-analytics.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownErrors } from \"@hexclave/shared\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { HexclaveClientApp, HexclaveClientAppConstructorOptions } from \"../interfaces/client-app\";\n\nconst baseOptions = {\n  baseUrl: \"http://localhost:12345\",\n  projectId: \"00000000-0000-4000-8000-000000000000\",\n  publishableClientKey: \"stack-pk-test\",\n  tokenStore: \"memory\",\n  redirectMethod: \"none\",\n  noAutomaticPrefetch: true,\n} satisfies HexclaveClientAppConstructorOptions<true, string>;\n\nconst analyticsAppDisabledMessage = \"initAnalytics() was called, but the Analytics app is not enabled on this Hexclave project\";\n\n// The backend's AnalyticsNotEnabled rejection only reaches the client through the event tracker's and session\n// recorder's upload callbacks, which only exist in a browser; this simulates such a rejection arriving.\nfunction simulateAnalyticsUploadResult(app: HexclaveClientApp, result: Result<Response, Error>) {\n  const handler: unknown = Reflect.get(app, \"_handleAnalyticsUploadResult\");\n  if (typeof handler !== \"function\") {\n    throw new Error(\"Expected HexclaveClientApp to have a _handleAnalyticsUploadResult method\");\n  }\n  handler.call(app, result);\n}\n\ndescribe(\"HexclaveClientApp.initAnalytics\", () => {\n  afterEach(() => {\n    vi.restoreAllMocks();\n  });\n\n  it(\"does not throw when analytics are configured\", () => {\n    const app = new HexclaveClientApp(baseOptions);\n    expect(() => app.initAnalytics()).not.toThrow();\n  });\n\n  it(\"throws when analytics are disabled with the analytics option\", () => {\n    const app = new HexclaveClientApp({ ...baseOptions, analytics: { enabled: false } });\n    expect(() => app.initAnalytics()).toThrow(\"`analytics.enabled` constructor option is set to false\");\n  });\n\n  it(\"does not throw when only session replays are disabled\", () => {\n    const app = new HexclaveClientApp({ ...baseOptions, analytics: { replays: { enabled: false } } });\n    expect(() => app.initAnalytics()).not.toThrow();\n  });\n\n  it(\"reports an error when the backend rejects uploads after initAnalytics() was called\", () => {\n    const consoleError = vi.spyOn(console, \"error\").mockImplementation(() => {});\n    const app = new HexclaveClientApp(baseOptions);\n    app.initAnalytics();\n\n    simulateAnalyticsUploadResult(app, Result.error(new KnownErrors.AnalyticsNotEnabled()));\n    // Repeated rejections must not report the error again.\n    simulateAnalyticsUploadResult(app, Result.error(new KnownErrors.AnalyticsNotEnabled()));\n\n    const reports = consoleError.mock.calls.filter((args) => args.some((arg) => String(arg).includes(analyticsAppDisabledMessage)));\n    expect(reports).toHaveLength(1);\n  });\n\n  it(\"throws from initAnalytics() when the backend already rejected uploads before it was called\", () => {\n    const consoleError = vi.spyOn(console, \"error\").mockImplementation(() => {});\n    const app = new HexclaveClientApp(baseOptions);\n\n    simulateAnalyticsUploadResult(app, Result.error(new KnownErrors.AnalyticsNotEnabled()));\n    expect(consoleError.mock.calls.some((args) => args.some((arg) => String(arg).includes(analyticsAppDisabledMessage)))).toBe(false);\n\n    expect(() => app.initAnalytics()).toThrow(analyticsAppDisabledMessage);\n  });\n\n  it(\"ignores upload failures unrelated to the Analytics app being disabled\", () => {\n    const app = new HexclaveClientApp(baseOptions);\n    simulateAnalyticsUploadResult(app, Result.error(new Error(\"network error\")));\n    expect(() => app.initAnalytics()).not.toThrow();\n  });\n});\n"],"mappings":";;;;;AASA,MAAM,cAAc;CAClB,SAAS;CACT,WAAW;CACX,sBAAsB;CACtB,YAAY;CACZ,gBAAgB;CAChB,qBAAqB;AACvB;AAEA,MAAM,8BAA8B;AAIpC,SAAS,8BAA8B,KAAwB,QAAiC;CAC9F,MAAM,UAAmB,QAAQ,IAAI,KAAK,8BAA8B;CACxE,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,0EAA0E;CAE5F,QAAQ,KAAK,KAAK,MAAM;AAC1B;qBAES,yCAAyC;CAChD,CAAA,GAAA,OAAA,UAAA,OAAgB;EACd,OAAA,GAAG,gBAAgB;CACrB,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sDAAsD;EACvD,MAAM,MAAM,IAAIA,4BAAAA,kBAAkB,WAAW;EAC7C,CAAA,GAAA,OAAA,OAAA,OAAa,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,QAAQ;CAChD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE;EACvE,MAAM,MAAM,IAAIA,4BAAAA,kBAAkB;GAAE,GAAG;GAAa,WAAW,EAAE,SAAS,MAAM;EAAE,CAAC;EACnF,CAAA,GAAA,OAAA,OAAA,OAAa,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,wDAAwD;CACpG,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,+DAA+D;EAChE,MAAM,MAAM,IAAIA,4BAAAA,kBAAkB;GAAE,GAAG;GAAa,WAAW,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE;EAAE,CAAC;EAChG,CAAA,GAAA,OAAA,OAAA,OAAa,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,QAAQ;CAChD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4FAA4F;EAC7F,MAAM,eAAeC,OAAAA,GAAG,MAAM,SAAS,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC;EAC3E,MAAM,MAAM,IAAID,4BAAAA,kBAAkB,WAAW;EAC7C,IAAI,cAAc;EAElB,8BAA8B,KAAKE,oCAAAA,OAAO,MAAM,IAAIC,iBAAAA,YAAY,oBAAoB,CAAC,CAAC;EAEtF,8BAA8B,KAAKD,oCAAAA,OAAO,MAAM,IAAIC,iBAAAA,YAAY,oBAAoB,CAAC,CAAC;EAGtF,CAAA,GAAA,OAAA,OAAA,CADgB,aAAa,KAAK,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,OAAO,GAAG,CAAC,CAAC,SAAS,2BAA2B,CAAC,CAChH,CAAC,CAAC,CAAC,aAAa,CAAC;CAChC,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oGAAoG;EACrG,MAAM,eAAeF,OAAAA,GAAG,MAAM,SAAS,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC;EAC3E,MAAM,MAAM,IAAID,4BAAAA,kBAAkB,WAAW;EAE7C,8BAA8B,KAAKE,oCAAAA,OAAO,MAAM,IAAIC,iBAAAA,YAAY,oBAAoB,CAAC,CAAC;EACtF,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,KAAK,MAAM,MAAM,SAAS,KAAK,MAAM,QAAQ,OAAO,GAAG,CAAC,CAAC,SAAS,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;EAEhI,CAAA,GAAA,OAAA,OAAA,OAAa,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,2BAA2B;CACvE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,+EAA+E;EAChF,MAAM,MAAM,IAAIH,4BAAAA,kBAAkB,WAAW;EAC7C,8BAA8B,KAAKE,oCAAAA,OAAO,sBAAM,IAAI,MAAM,eAAe,CAAC,CAAC;EAC3E,CAAA,GAAA,OAAA,OAAA,OAAa,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,QAAQ;CAChD,CAAC;AACH,CAAC"}