@hexclave/next 1.0.73 → 1.0.75

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js

@@ -1,8 +1,9 @@
 let vitest = require("vitest");
 let ______common_js = require("../../common.js");
+let ___interfaces_client_app_js = require("../interfaces/client-app.js");
 let _hexclave_shared_dist_sessions = require("@hexclave/shared/dist/sessions");
 let _hexclave_shared_dist_utils_stores = require("@hexclave/shared/dist/utils/stores");
-let ___interfaces_client_app_js = require("../interfaces/client-app.js");
+let __redirect_page_urls_js = require("./redirect-page-urls.js");
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts
 function createAccessTokenString(refreshTokenId) {
 	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
@@ -51,6 +52,57 @@ function createMockDocument() {
 	};
 }
 (0, vitest.describe)("StackClientApp cross-domain auth", () => {
+	(0, vitest.it)("keeps noRedirectBack same-domain redirects free of redirect-back state", async () => {
+		(0, vitest.expect)(await (0, __redirect_page_urls_js.planRedirectToHandler)({
+			handlerName: "signIn",
+			rawHandlerUrl: "/handler/sign-in",
+			noRedirectBack: true,
+			currentUrl: new URL("https://app.example.test/settings?tab=profile"),
+			localOAuthCallbackUrl: "/handler/oauth-callback",
+			rawHomeUrl: "/home",
+			getCrossDomainHandoffParams: async () => {
+				throw new Error("Same-domain redirects must not create cross-domain handoff parameters.");
+			}
+		})).toEqual({
+			type: "redirect",
+			url: "/handler/sign-in"
+		});
+	});
+	(0, vitest.it)("returns noRedirectBack cross-domain auth to the source app home", async () => {
+		const handoffState = "no-redirect-back-state";
+		const handoffCodeChallenge = "abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~";
+		const currentUrl = new URL("https://app.example.test/settings?tab=profile");
+		currentUrl.searchParams.set("hexclave_cross_domain_state", handoffState);
+		currentUrl.searchParams.set("hexclave_cross_domain_code_challenge", handoffCodeChallenge);
+		currentUrl.searchParams.set("hexclave_cross_domain_after_callback_redirect_url", "https://app.example.test/settings?tab=profile");
+		const redirectPlan = await (0, __redirect_page_urls_js.planRedirectToHandler)({
+			handlerName: "signIn",
+			rawHandlerUrl: "https://auth.example.test/handler/sign-in",
+			noRedirectBack: true,
+			currentUrl,
+			localOAuthCallbackUrl: "/handler/oauth-callback",
+			rawHomeUrl: "/home",
+			getCrossDomainHandoffParams: async () => {
+				throw new Error("Existing cross-domain handoff parameters must be reused.");
+			}
+		});
+		(0, vitest.expect)(redirectPlan.type).toBe("redirect");
+		if (redirectPlan.type !== "redirect") throw new Error("Expected noRedirectBack sign-in to produce a redirect URL.");
+		const hostedUrl = new URL(redirectPlan.url);
+		(0, vitest.expect)(hostedUrl.origin).toBe("https://auth.example.test");
+		(0, vitest.expect)(hostedUrl.pathname).toBe("/handler/sign-in");
+		(0, vitest.expect)(hostedUrl.searchParams.get("hexclave_cross_domain_after_callback_redirect_url")).toBe("https://app.example.test/home");
+		const rawSourceCallbackUrl = hostedUrl.searchParams.get("after_auth_return_to");
+		if (rawSourceCallbackUrl == null) throw new Error("Expected cross-domain noRedirectBack to include its internal source callback URL.");
+		const sourceCallbackUrl = new URL(rawSourceCallbackUrl);
+		(0, vitest.expect)(sourceCallbackUrl.origin).toBe("https://app.example.test");
+		(0, vitest.expect)(sourceCallbackUrl.pathname).toBe("/handler/oauth-callback");
+		(0, vitest.expect)(sourceCallbackUrl.searchParams.get("hexclave_cross_domain_auth")).toBe("1");
+		(0, vitest.expect)(sourceCallbackUrl.searchParams.get("hexclave_cross_domain_state")).toBe(handoffState);
+		(0, vitest.expect)(sourceCallbackUrl.searchParams.get("hexclave_cross_domain_code_challenge")).toBe(handoffCodeChallenge);
+		(0, vitest.expect)(sourceCallbackUrl.searchParams.get("hexclave_cross_domain_after_callback_redirect_url")).toBe("https://app.example.test/home");
+		(0, vitest.expect)(sourceCallbackUrl.toString()).not.toContain("/settings");
+	});
 	(0, vitest.it)("exposes redirect-back-aware handler URLs for devtool previews", async () => {
 		const previousWindow = Reflect.get(globalThis, "window");
 		const hadPreviousWindow = Reflect.has(globalThis, "window");
@@ -384,6 +436,8 @@ function createMockDocument() {
 		callbackUrl.searchParams.set("errorCode", "SIGN_UP_REJECTED");
 		callbackUrl.searchParams.set("message", "Your sign up was rejected by an administrator's sign-up rule.");
 		callbackUrl.searchParams.set("details", JSON.stringify({ message: "Your sign up was rejected by an administrator's sign-up rule." }));
+		callbackUrl.searchParams.set("after_auth_return_to", "/dashboard");
+		callbackUrl.searchParams.set("after_callback_redirect_url", "https://customer.example.test/settings?tab=connected-accounts");
 		let currentHref = callbackUrl.toString();
 		let redirectedUrl = "";
 		const redirectSpy = vitest.vi.spyOn(___interfaces_client_app_js.StackClientApp.prototype, "_redirectTo").mockImplementation(async (...args) => {
@@ -428,6 +482,8 @@ function createMockDocument() {
 		(0, vitest.expect)(errorUrl.pathname).toBe("/handler/error");
 		(0, vitest.expect)(errorUrl.searchParams.get("errorCode")).toBe("SIGN_UP_REJECTED");
 		(0, vitest.expect)(errorUrl.searchParams.get("message")).toBe("Your sign up was rejected by an administrator's sign-up rule.");
+		(0, vitest.expect)(errorUrl.searchParams.get("after_auth_return_to")).toBe("/dashboard");
+		(0, vitest.expect)(errorUrl.searchParams.get("after_callback_redirect_url")).toBe("https://customer.example.test/settings?tab=connected-accounts");
 		(0, vitest.expect)(new URL(currentHref).searchParams.has("errorCode")).toBe(false);
 	});
 	(0, vitest.it)("uses direct sign-out instead of hosted sign-out redirects when code execution is available", async () => {

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-app-impl.cross-domain.test.js","names":["StackClientApp","hexclaveAppInternalsSymbol","AccessToken","Store","vi","expect"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { AccessToken } from \"@hexclave/shared/dist/sessions\";\nimport { Store } from \"@hexclave/shared/dist/utils/stores\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\n\nfunction createAccessTokenString(refreshTokenId: string): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createMockDocument(): Document {\n  const cookieJar = new Map<string, string>();\n  return {\n    get cookie() {\n      return [...cookieJar.entries()].map(([key, value]) => `${key}=${value}`).join(\"; \");\n    },\n    set cookie(str: string) {\n      const [nameValue] = str.split(\";\");\n      const eqIndex = nameValue.indexOf(\"=\");\n      if (eqIndex < 0) return;\n      cookieJar.set(nameValue.slice(0, eqIndex).trim(), nameValue.slice(eqIndex + 1).trim());\n    },\n    createElement: () => ({}),\n  } as any;\n}\n\ndescribe(\"StackClientApp cross-domain auth\", () => {\n  it(\"exposes redirect-back-aware handler URLs for devtool previews\", async () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    Reflect.set(globalThis, \"window\", {\n      location: {\n        href: \"http://localhost/music?track=1#song\",\n      },\n    });\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000000\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"none\",\n        urls: {\n          signIn: \"/handler/sign-in\",\n        },\n        noAutomaticPrefetch: true,\n      });\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"signIn\");\n\n      const resolved = new URL(redirectUrl, \"http://localhost\");\n      expect(resolved.pathname).toBe(\"/handler/sign-in\");\n      expect(resolved.searchParams.get(\"after_auth_return_to\")).toBe(\"/music?track=1#song\");\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"uses the fresh post-auth refresh token when minting a cross-domain handoff\", async () => {\n    const freshAccessToken = createAccessTokenString(\"fresh-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: {\n        accessToken: createAccessTokenString(\"stale-refresh-token-id\"),\n        refreshToken: \"stale-refresh-token\",\n      },\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSendClientRequest = Reflect.get(clientInterface, \"sendClientRequest\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const capturedRefreshTokens: string[] = [];\n    const capturedAccessTokenRefreshTokenIds: string[] = [];\n    const refreshedRawRefreshTokens: string[] = [];\n\n    Reflect.set(clientInterface, \"sendClientRequest\", async (_path: unknown, _requestOptions: unknown, session: unknown) => {\n      const getRefreshToken = Reflect.get(session ?? {}, \"getRefreshToken\");\n      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, \"getOrFetchLikelyValidTokens\");\n      if (typeof getRefreshToken !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session to the client interface.\");\n      }\n      if (typeof getOrFetchLikelyValidTokens !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session with token accessors.\");\n      }\n      const refreshToken = getRefreshToken.call(session);\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected cross-domain auth to pass a refresh-token-backed session.\");\n      }\n      capturedRefreshTokens.push(refreshTokenString);\n      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);\n      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);\n      return {\n        ok: true,\n        json: async () => ({ redirect_url: \"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\" }),\n      };\n    });\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected refresh token while fetching a new access token.\");\n      }\n      refreshedRawRefreshTokens.push(refreshTokenString);\n      return AccessToken.createIfValid(freshAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, \"_createCrossDomainAuthRedirectUrl\");\n      if (typeof createCrossDomainAuthRedirectUrl !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _createCrossDomainAuthRedirectUrl in tests.\");\n      }\n\n      await expect(createCrossDomainAuthRedirectUrl.call(clientApp, {\n        redirectUri: \"https://example.com/handler/oauth-callback\",\n        state: \"handoff-state\",\n        codeChallenge: \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\",\n        afterCallbackRedirectUrl: \"https://example.com/account-settings\",\n        overrideTokenStoreInit: {\n          accessToken: createAccessTokenString(\"fresh-stale-refresh-token-id\"),\n          refreshToken: \"fresh-refresh-token\",\n        },\n      })).resolves.toBe(\"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\");\n    } finally {\n      Reflect.set(clientInterface, \"sendClientRequest\", originalSendClientRequest);\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedAccessTokenRefreshTokenIds).toEqual([\"fresh-refresh-token-id\"]);\n  });\n\n  it(\"uses a fresh nested OAuth state while preserving the outer cross-domain return state\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000002\";\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const outerState = \"outer-cross-domain-state\";\n    const outerCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"after_auth_return_to\", `https://demo.stack-auth.com/?hexclave_cross_domain_auth=1&hexclave_cross_domain_state=${outerState}`);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", outerState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", outerCodeChallenge);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-session\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const redirectUrl = new URL(redirectedUrl);\n    expect(redirectUrl.searchParams.get(\"state\")).toBe(\"fresh-nested-state\");\n    expect(redirectUrl.searchParams.get(\"code_challenge\")).toBe(\"fresh-nested-code-challenge\");\n    const redirectUri = new URL(redirectUrl.searchParams.get(\"redirect_uri\") ?? \"\");\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_state\")).toBe(outerState);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(outerCodeChallenge);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\"https://demo.stack-auth.com/\");\n  });\n\n  it(\"clears a stale target-domain session before deferring to the source-domain session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000006\";\n    const hostedAccessToken = createAccessTokenString(\"hosted-old-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const tokenStore = Reflect.get(clientApp, \"_memoryTokenStore\");\n    if (!(tokenStore instanceof Store)) {\n      throw new Error(\"Expected StackClientApp to use a memory token store in this test.\");\n    }\n    tokenStore.set({\n      refreshToken: \"hosted-old-refresh-token\",\n      accessToken: hostedAccessToken,\n    });\n\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-anonymous-refresh-token-id\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/handler/oauth-callback\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", \"outer-state\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", \"outer-code-challenge\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/app\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(tokenStore.get()).toEqual({\n      refreshToken: null,\n      accessToken: null,\n    });\n    expect(new URL(redirectedUrl).origin).toBe(\"https://demo.stack-auth.com\");\n  });\n\n  it(\"uses the latest browser refresh cookie before computing nested cross-domain session IDs\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000007\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: \"https://demo.stack-auth.com/\",\n        protocol: \"https:\",\n        hostname: \"demo.stack-auth.com\",\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"cookie\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const refreshedRawRefreshTokens: string[] = [];\n\n    // Cookie-store writes queue a background trusted-parent-domain lookup. Without this stub, that\n    // lookup fetches the (unreachable) baseUrl with retries while holding the global store lock,\n    // which starves any later test that needs the write lock (e.g. signOut). Not restored on\n    // purpose: queued tasks can still run after this test body finishes.\n    vi.spyOn(clientApp as any, \"_getTrustedParentDomain\").mockResolvedValue(null);\n\n    try {\n      const getBrowserCookieTokenStore = Reflect.get(clientApp, \"_getBrowserCookieTokenStore\");\n      if (typeof getBrowserCookieTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.\");\n      }\n      const tokenStore = getBrowserCookieTokenStore.call(clientApp);\n      tokenStore.set({\n        refreshToken: \"old-refresh-token\",\n        accessToken: createAccessTokenString(\"old-refresh-token-id\"),\n      });\n\n      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({\n        refresh_token: \"new-refresh-token\",\n        updated_at_millis: 1,\n      })}`;\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n        const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n        if (typeof refreshTokenString !== \"string\") {\n          throw new Error(\"Expected refresh token while fetching a new access token.\");\n        }\n        refreshedRawRefreshTokens.push(refreshTokenString);\n        return AccessToken.createIfValid(createAccessTokenString(\"new-refresh-token-id\")) ?? (() => {\n          throw new Error(\"Expected test access token to be valid\");\n        })();\n      });\n\n      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\");\n      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.\");\n      }\n      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {\n        awaitPendingAuthResolutions: false,\n      })).resolves.toBe(\"new-refresh-token-id\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"new-refresh-token\"]);\n  });\n\n  it(\"does not re-bounce nested cross-domain auth after the OAuth callback consumed code+state from the URL\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000008\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const strippedUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n    const urlAtConstructionTime = new URL(strippedUrl);\n    urlAtConstructionTime.searchParams.set(\"code\", \"one-time-code\");\n    urlAtConstructionTime.searchParams.set(\"state\", \"nested-oauth-state\");\n\n    // Construct before installing the window mock so the constructor does not schedule its own\n    // nested-auth resolution; the assertions below drive the handler explicitly.\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      noAutomaticPrefetch: true,\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: strippedUrl.toString(),\n        replace: () => {\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    try {\n      // Without the construction-time URL, the handler re-bounces (location.replace aborts).\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      // With it, the in-flight OAuth callback wins and the handler stands down.\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime)).resolves.toBe(false);\n      // The live-URL guard must also stand down on its own when code+state are still present.\n      (globalThis.window as any).location.href = urlAtConstructionTime.toString();\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).resolves.toBe(false);\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"passes the construction-time URL to the nested cross-domain auth handler\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000009\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const callbackUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    callbackUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    callbackUrl.searchParams.set(\"code\", \"one-time-code\");\n    callbackUrl.searchParams.set(\"state\", \"nested-oauth-state\");\n    const strippedUrl = new URL(callbackUrl);\n    strippedUrl.searchParams.delete(\"code\");\n    strippedUrl.searchParams.delete(\"state\");\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: callbackUrl.toString(),\n      },\n    } as any;\n\n    const nestedAuthSpy = vi.spyOn(StackClientApp.prototype as any, \"_maybeHandleNestedCrossDomainAuth\").mockResolvedValue(false);\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n\n      // Simulate consumeOAuthCallbackQueryParams stripping code+state before microtasks run.\n      (globalThis.window as any).location.href = strippedUrl.toString();\n      await new Promise((resolve) => setTimeout(resolve, 0));\n\n      expect(nestedAuthSpy).toHaveBeenCalledTimes(1);\n      const urlArgument = nestedAuthSpy.mock.calls[0][0] as URL;\n      expect(urlArgument).toBeInstanceOf(URL);\n      expect(urlArgument.searchParams.get(\"code\")).toBe(\"one-time-code\");\n      expect(urlArgument.searchParams.get(\"state\")).toBe(\"nested-oauth-state\");\n    } finally {\n      nestedAuthSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"redirects hosted current-page OAuth callback errors to the hosted error handler during startup\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000010\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const callbackUrl = new URL(\"https://demo.stack-auth.com/dashboard\");\n    callbackUrl.searchParams.set(\"errorCode\", \"SIGN_UP_REJECTED\");\n    callbackUrl.searchParams.set(\"message\", \"Your sign up was rejected by an administrator's sign-up rule.\");\n    callbackUrl.searchParams.set(\"details\", JSON.stringify({\n      message: \"Your sign up was rejected by an administrator's sign-up rule.\",\n    }));\n    let currentHref = callbackUrl.toString();\n    let redirectedUrl = \"\";\n    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, \"_redirectTo\").mockImplementation(async (...args: unknown[]) => {\n      const options = args[0] as { url: string | URL };\n      redirectedUrl = options.url.toString();\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n        set href(value: string) {\n          currentHref = value;\n        },\n        origin: callbackUrl.origin,\n      },\n      history: {\n        replaceState: (_state: unknown, _title: string, url: string) => {\n          currentHref = new URL(url, currentHref).toString();\n        },\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        urls: {\n          default: { type: \"hosted\" },\n        },\n        noAutomaticPrefetch: true,\n      });\n\n      await new Promise((resolve) => setTimeout(resolve, 0));\n      await new Promise((resolve) => setTimeout(resolve, 0));\n    } finally {\n      redirectSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const errorUrl = new URL(redirectedUrl);\n    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);\n    expect(errorUrl.pathname).toBe(\"/handler/error\");\n    expect(errorUrl.searchParams.get(\"errorCode\")).toBe(\"SIGN_UP_REJECTED\");\n    expect(errorUrl.searchParams.get(\"message\")).toBe(\"Your sign up was rejected by an administrator's sign-up rule.\");\n    expect(new URL(currentHref).searchParams.has(\"errorCode\")).toBe(false);\n  });\n\n  it(\"uses direct sign-out instead of hosted sign-out redirects when code execution is available\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/handler\",\n        signOut: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const signOutSpy = vi.spyOn(clientApp, \"signOut\").mockRejectedValue(new Error(\"INTENTIONAL_TEST_ABORT\"));\n\n    try {\n      await expect(clientApp.redirectToSignOut()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      expect(signOutSpy).toHaveBeenCalledWith();\n    } finally {\n      signOutSpy.mockRestore();\n    }\n  });\n\n  it(\"throws when public app.urls reads would return hosted component URLs\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n\n    expect(() => clientApp.urls.signIn).toThrowError(/app\\.urls\\.signIn cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignIn\\(\\) instead/s);\n    expect(() => clientApp.urls.signOut).toThrowError(/app\\.urls\\.signOut cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignOut\\(\\) instead/s);\n    expect(clientApp.urls.afterSignIn).toBe(\"/\");\n  });\n\n  it(\"keeps public app.urls reads available for non-hosted targets\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/custom-handler\",\n      },\n      noAutomaticPrefetch: true,\n    });\n\n    expect(clientApp.urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"keeps default hosted signOut() on the source domain when afterSignOut is not configured\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000004\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const currentHref = \"https://demo.stack-auth.com/settings?tab=profile\";\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSignOut = Reflect.get(clientInterface, \"signOut\");\n    Reflect.set(clientInterface, \"signOut\", async () => {});\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentHref,\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      const signOut = Reflect.get(clientApp, \"_signOut\");\n      if (typeof signOut !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _signOut in tests.\");\n      }\n      await expect(signOut.call(clientApp, Reflect.get(clientInterface, \"createSession\").call(clientInterface, {\n        refreshToken: null,\n      }))).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"signOut\", originalSignOut);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(redirectedUrl).toBe(\"/settings?tab=profile\");\n  });\n\n  it(\"restores a dropped after_auth_return_to from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n    const windowMock = {\n      location: {\n        href: \"https://demo.example.test/handler/sign-in?after_auth_return_to=%2Fmusic%3Ftrack%3D1\",\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      // The constructor mirrors the redirect-back state from the arrival URL into sessionStorage.\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000011\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n\n      // Intermediate hops (MFA, magic link, OAuth round-trips, ...) dropped the query params.\n      windowMock.location.href = \"https://demo.example.test/handler/mfa\";\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n      expect(redirectUrl).toBe(\"/music?track=1\");\n\n      // noRedirectBack opts out of the mirror just like it opts out of the query param.\n      const noRedirectBackUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\", { noRedirectBack: true });\n      expect(new URL(noRedirectBackUrl, \"https://demo.example.test\").pathname).toBe(\"/\");\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"restores dropped cross-domain handoff state from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n\n    const handoffState = \"mirror-handoff-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const handoffAfterCallbackRedirect = \"https://demo.example.test/dashboard\";\n    const redirectBackUrl = new URL(\"https://demo.example.test/handler/oauth-callback\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_auth\", \"1\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);\n    arrivalUrl.searchParams.set(\"after_auth_return_to\", redirectBackUrl.toString());\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const previousDocument = globalThis.document;\n    const windowMock = {\n      location: {\n        href: arrivalUrl.toString(),\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n      const crossDomainAuthorizeRedirect = \"https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state\";\n      const createCrossDomainAuthRedirectUrlSpy = vi\n        .spyOn(clientApp as any, \"_createCrossDomainAuthRedirectUrl\")\n        .mockResolvedValue(crossDomainAuthorizeRedirect);\n\n      // All redirect-back query params were dropped before the after-sign-in redirect.\n      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n\n      expect(createCrossDomainAuthRedirectUrlSpy).toHaveBeenCalledWith(expect.objectContaining({\n        redirectUri: redirectBackUrl.toString(),\n        state: handoffState,\n        codeChallenge: handoffCodeChallenge,\n        afterCallbackRedirectUrl: handoffAfterCallbackRedirect,\n      }));\n      expect(redirectUrl).toBe(crossDomainAuthorizeRedirect);\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"ignores stale session callbacks after a newer refresh token owns the token store\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000005\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n    const oldAccessToken = createAccessTokenString(\"old-refresh-token-id\");\n    const refreshedOldAccessToken = createAccessTokenString(\"refreshed-old-refresh-token-id\");\n    const newAccessToken = createAccessTokenString(\"new-refresh-token-id\");\n    const tokenStore = new Store({\n      refreshToken: \"old-refresh-token\",\n      accessToken: oldAccessToken,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const getSessionFromTokenStore = Reflect.get(clientApp, \"_getSessionFromTokenStore\");\n      if (typeof getSessionFromTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getSessionFromTokenStore in tests.\");\n      }\n      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);\n      tokenStore.set({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      await oldSession.fetchNewTokens();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      oldSession.markInvalid();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n  });\n});\n"],"mappings":";;;;;;AAUA,SAAS,wBAAwB,gBAAgC;CAC/D,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,qBAA+B;CACtC,MAAM,4BAAY,IAAI,IAAoB;CAC1C,OAAO;EACL,IAAI,SAAS;GACX,OAAO,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;EACpF;EACA,IAAI,OAAO,KAAa;GACtB,MAAM,CAAC,aAAa,IAAI,MAAM,GAAG;GACjC,MAAM,UAAU,UAAU,QAAQ,GAAG;GACrC,IAAI,UAAU,GAAG;GACjB,UAAU,IAAI,UAAU,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACvF;EACA,sBAAsB,CAAC;CACzB;AACF;qBAES,0CAA0C;CACjD,CAAA,GAAA,OAAA,GAAA,CAAG,iEAAiE,YAAY;EAC9E,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,QAAQ,IAAI,YAAY,UAAU,EAChC,UAAU,EACR,MAAM,sCACR,EACF,CAAC;EAED,IAAI;GAaF,MAAM,cAAc,MAAM,IAZJA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,QAAQ,mBACV;IACA,qBAAqB;GACvB,CAEkC,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,wBAAwB,QAAQ;GAEhG,MAAM,WAAW,IAAI,IAAI,aAAa,kBAAkB;GACxD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,kBAAkB;GACjD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,qBAAqB;EACtF,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E,YAAY;EAC3F,MAAM,mBAAmB,wBAAwB,wBAAwB;EACzE,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;IACV,aAAa,wBAAwB,wBAAwB;IAC7D,cAAc;GAChB;GACA,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EAED,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,4BAA4B,QAAQ,IAAI,iBAAiB,mBAAmB;EAClF,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,wBAAkC,CAAC;EACzC,MAAM,qCAA+C,CAAC;EACtD,MAAM,4BAAsC,CAAC;EAE7C,QAAQ,IAAI,iBAAiB,qBAAqB,OAAO,OAAgB,iBAA0B,YAAqB;GACtH,MAAM,kBAAkB,QAAQ,IAAI,WAAW,CAAC,GAAG,iBAAiB;GACpE,MAAM,8BAA8B,QAAQ,IAAI,WAAW,CAAC,GAAG,6BAA6B;GAC5F,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,MAAM,uEAAuE;GAEzF,IAAI,OAAO,gCAAgC,YACzC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,MAAM,eAAe,gBAAgB,KAAK,OAAO;GACjD,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,sBAAsB,KAAK,kBAAkB;GAC7C,MAAM,SAAS,MAAM,4BAA4B,KAAK,SAAS,GAAG,IAAI;GACtE,mCAAmC,KAAK,OAAO,YAAY,QAAQ,gBAAgB;GACnF,OAAO;IACL,IAAI;IACJ,MAAM,aAAa,EAAE,cAAc,mFAAmF;GACxH;EACF,CAAC;EACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;GACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,0BAA0B,KAAK,kBAAkB;GACjD,OAAOE,+BAAAA,YAAY,cAAc,gBAAgB,YAAY;IAC3D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,mCAAmC,QAAQ,IAAI,WAAW,mCAAmC;GACnG,IAAI,OAAO,qCAAqC,YAC9C,MAAM,IAAI,MAAM,+EAA+E;GAGjG,OAAA,GAAA,OAAA,OAAA,CAAa,iCAAiC,KAAK,WAAW;IAC5D,aAAa;IACb,OAAO;IACP,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;KACtB,aAAa,wBAAwB,8BAA8B;KACnE,cAAc;IAChB;GACF,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,kFAAkF;EACtG,UAAU;GACR,QAAQ,IAAI,iBAAiB,qBAAqB,yBAAyB;GAC3E,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,qBAAqB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EAC7D,CAAA,GAAA,OAAA,OAAA,CAAO,kCAAkC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,wFAAwF,YAAY;EACrG,MAAM,YAAY;EAClB,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,qBAAqB;EAC3B,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,wBAAwB,yFAAyF,YAAY;EACzJ,WAAW,aAAa,IAAI,+BAA+B,UAAU;EACrE,WAAW,aAAa,IAAI,wCAAwC,kBAAkB;EACtF,WAAW,aAAa,IAAI,qDAAqD,8BAA8B;EAC/G,WAAW,aAAa,IAAI,mDAAmD,gBAAgB;EAC/F,WAAW,aAAa,IAAI,+CAA+C,8BAA8B;EAEzG,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa;EACzC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACvE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,6BAA6B;EACzF,MAAM,cAAc,IAAI,IAAI,YAAY,aAAa,IAAI,cAAc,KAAK,EAAE;EAC9E,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,UAAU;EACnF,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACpG,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAAK,8BAA8B;CAC/H,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sFAAsF,YAAY;EACnG,MAAM,YAAY;EAClB,MAAM,oBAAoB,wBAAwB,6BAA6B;EAC/E,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa,QAAQ,IAAI,WAAW,mBAAmB;EAC7D,IAAI,EAAE,sBAAsBG,mCAAAA,QAC1B,MAAM,IAAI,MAAM,mEAAmE;EAErF,WAAW,IAAI;GACb,cAAc;GACd,aAAa;EACf,CAAC;EAED,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,mDAAmD,mCAAmC;EAClH,WAAW,aAAa,IAAI,+CAA+C,oDAAoD;EAC/H,WAAW,aAAa,IAAI,+BAA+B,aAAa;EACxE,WAAW,aAAa,IAAI,wCAAwC,sBAAsB;EAC1F,WAAW,aAAa,IAAI,qDAAqD,iCAAiC;EAElH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,iBAAiB,YAAY;IAC5D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;GAC/B,cAAc;GACd,aAAa;EACf,CAAC;EACD,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,6BAA6B;CAC1E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,MAAM;IACN,UAAU;IACV,UAAU;GACZ;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,4BAAsC,CAAC;EAM7C,OAAA,GAAG,MAAM,WAAkB,yBAAyB,CAAC,CAAC,kBAAkB,IAAI;EAE5E,IAAI;GACF,MAAM,6BAA6B,QAAQ,IAAI,WAAW,6BAA6B;GACvF,IAAI,OAAO,+BAA+B,YACxC,MAAM,IAAI,MAAM,yEAAyE;GAG3F,2BAD8C,KAAK,SAC1C,CAAC,CAAC,IAAI;IACb,cAAc;IACd,aAAa,wBAAwB,sBAAsB;GAC7D,CAAC;GAED,SAAS,SAAS,2BAA2B,UAAU,YAAY,KAAK,UAAU;IAChF,eAAe;IACf,mBAAmB;GACrB,CAAC;GACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;IACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;IAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;IAE7E,0BAA0B,KAAK,kBAAkB;IACjD,OAAOE,+BAAAA,YAAY,cAAc,wBAAwB,sBAAsB,CAAC,YAAY;KAC1F,MAAM,IAAI,MAAM,wCAAwC;IAC1D,EAAA,CAAG;GACL,CAAC;GAED,MAAM,uCAAuC,QAAQ,IAAI,WAAW,uCAAuC;GAC3G,IAAI,OAAO,yCAAyC,YAClD,MAAM,IAAI,MAAM,mFAAmF;GAErG,OAAA,GAAA,OAAA,OAAA,CAAa,qCAAqC,KAAK,WAAW,EAChE,6BAA6B,MAC/B,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB;EAC1C,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,+CAA+C,8BAA8B;EAC1G,MAAM,wBAAwB,IAAI,IAAI,WAAW;EACjD,sBAAsB,aAAa,IAAI,QAAQ,eAAe;EAC9D,sBAAsB,aAAa,IAAI,SAAS,oBAAoB;EAIpE,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,YAAY,SAAS;GAC3B,eAAe;IACb,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,IAAI;GAEF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GAElH,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,qBAAqB,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;GAE7G,WAAY,OAAe,SAAS,OAAO,sBAAsB,SAAS;GAC1E,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;EAC1F,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4EAA4E,YAAY;EACzF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,QAAQ,eAAe;EACpD,YAAY,aAAa,IAAI,SAAS,oBAAoB;EAC1D,MAAM,cAAc,IAAI,IAAI,WAAW;EACvC,YAAY,aAAa,OAAO,MAAM;EACtC,YAAY,aAAa,OAAO,OAAO;EAEvC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU,EACR,MAAM,YAAY,SAAS,EAC7B,EACF;EAEA,MAAM,gBAAgBI,OAAAA,GAAG,MAAMJ,4BAAAA,eAAe,WAAkB,mCAAmC,CAAC,CAAC,kBAAkB,KAAK;EAE5H,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GAGD,WAAY,OAAe,SAAS,OAAO,YAAY,SAAS;GAChE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GAErD,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,sBAAsB,CAAC;GAC7C,MAAM,cAAc,cAAc,KAAK,MAAM,EAAE,CAAC;GAChD,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,eAAe,GAAG;GACtC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;GACjE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACzE,UAAU;GACR,cAAc,YAAY;GAC1B,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kGAAkG,YAAY;EAC/G,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,cAAc,IAAI,IAAI,uCAAuC;EACnE,YAAY,aAAa,IAAI,aAAa,kBAAkB;EAC5D,YAAY,aAAa,IAAI,WAAW,+DAA+D;EACvG,YAAY,aAAa,IAAI,WAAW,KAAK,UAAU,EACrD,SAAS,gEACX,CAAC,CAAC;EACF,IAAI,cAAc,YAAY,SAAS;EACvC,IAAI,gBAAgB;EACpB,MAAM,cAAcI,OAAAA,GAAG,MAAMJ,4BAAAA,eAAe,WAAkB,aAAa,CAAC,CAAC,mBAAmB,OAAO,GAAG,SAAoB;GAE5H,gBADgB,KAAK,EACE,CAAC,IAAI,SAAS;EACvC,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,IAAI,OAAO;KACT,OAAO;IACT;IACA,IAAI,KAAK,OAAe;KACtB,cAAc;IAChB;IACA,QAAQ,YAAY;GACtB;GACA,SAAS,EACP,eAAe,QAAiB,QAAgB,QAAgB;IAC9D,cAAc,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,SAAS;GACnD,EACF;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;IACA,qBAAqB;GACvB,CAAC;GAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GACrD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;EACvD,UAAU;GACR,YAAY,YAAY;GACxB,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,WAAW,IAAI,IAAI,aAAa;EACtC,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,MAAM,CAAC,CAAC,KAAK,WAAW,UAAU,yBAAyB;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,gBAAgB;EAC/C,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACtE,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACjH,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,WAAW,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK;CACvE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8FAA8F,YAAY;EAC3G,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM;IACJ,SAAS;IACT,SAAS,EAAE,MAAM,SAAS;GAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAaI,OAAAA,GAAG,MAAM,WAAW,SAAS,CAAC,CAAC,kCAAkB,IAAI,MAAM,wBAAwB,CAAC;EAEvG,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAa,UAAU,kBAAkB,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GACzF,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,CAAC,CAAC,qBAAqB;EAC1C,UAAU;GACR,WAAW,YAAY;EACzB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E;EAC/E,MAAM,YAAY,IAAIJ,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,MAAM,CAAC,CAAC,aAAa,+HAA+H;EAChL,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,OAAO,CAAC,CAAC,aAAa,iIAAiI;EACnL,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,KAAK,WAAW,CAAC,CAAC,KAAK,GAAG;CAC7C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE;EAavE,CAAA,GAAA,OAAA,OAAA,CAAO,IAZeA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,kBACX;GACA,qBAAqB;EACvB,CAEe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,yBAAyB;CAC9D,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,cAAc;EAEpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,kBAAkB,QAAQ,IAAI,iBAAiB,SAAS;EAC9D,QAAQ,IAAI,iBAAiB,WAAW,YAAY,CAAC,CAAC;EACtD,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EAEpB,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM;GACN,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,UAAU,QAAQ,IAAI,WAAW,UAAU;GACjD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,sDAAsD;GAExE,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,KAAK,WAAW,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CAAC,KAAK,iBAAiB,EACvG,cAAc,KAChB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpD,UAAU;GACR,QAAQ,IAAI,iBAAiB,WAAW,eAAe;GACvD,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,uBAAuB;CACpD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAClD,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,sFACR;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GAEF,MAAM,YAAY,IAAIA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GAGD,WAAW,SAAS,OAAO;GAG3B,CAAA,GAAA,OAAA,OAAA,CAAO,MADmB,UAAUC,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa,CACnF,CAAC,CAAC,KAAK,gBAAgB;GAGzC,MAAM,oBAAoB,MAAM,UAAUA,gBAAAA,2BAA2B,CAAC,wBAAwB,eAAe,EAAE,gBAAgB,KAAK,CAAC;GACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,mBAAmB,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG;EACnF,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6GAA6G,YAAY;EAC1H,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAElD,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,+BAA+B;EACrC,MAAM,kBAAkB,IAAI,IAAI,kDAAkD;EAClF,gBAAgB,aAAa,IAAI,8BAA8B,GAAG;EAClE,gBAAgB,aAAa,IAAI,+BAA+B,YAAY;EAC5E,gBAAgB,aAAa,IAAI,wCAAwC,oBAAoB;EAC7F,gBAAgB,aAAa,IAAI,qDAAqD,4BAA4B;EAElH,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,yCAAyC;EACzF,WAAW,aAAa,IAAI,wBAAwB,gBAAgB,SAAS,CAAC;EAC9E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IAAI,qDAAqD,4BAA4B;EAE7G,MAAM,mBAAmB,WAAW;EACpC,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,WAAW,SAAS,EAC5B;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GACF,MAAM,YAAY,IAAID,4BAAAA,eAAe;IACnC,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GACD,MAAM,+BAA+B;GACrC,MAAM,sCAAsCI,OAAAA,GACzC,MAAM,WAAkB,mCAAmC,CAAC,CAC5D,kBAAkB,4BAA4B;GAGjD,WAAW,SAAS,OAAO,WAAW,UAAU;GAEhD,MAAM,cAAc,MAAM,UAAUH,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa;GAErG,CAAA,GAAA,OAAA,OAAA,CAAO,mCAAmC,CAAC,CAAC,qBAAqBI,OAAAA,OAAO,iBAAiB;IACvF,aAAa,gBAAgB,SAAS;IACtC,OAAO;IACP,eAAe;IACf,0BAA0B;GAC5B,CAAC,CAAC;GACF,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,KAAK,4BAA4B;EACvD,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oFAAoF,YAAY;EACjG,MAAM,YAAY,IAAIL,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EACD,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,0BAA0B,wBAAwB,gCAAgC;EACxF,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,aAAa,IAAIG,mCAAAA,MAAM;GAC3B,cAAc;GACd,aAAa;EACf,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,uBAAuB,YAAY;IAClE,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,2BAA2B,QAAQ,IAAI,WAAW,2BAA2B;GACnF,IAAI,OAAO,6BAA6B,YACtC,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,aAAa,yBAAyB,KAAK,WAAW,UAAU;GACtE,WAAW,IAAI;IACb,cAAc;IACd,aAAa;GACf,CAAC;GAED,MAAM,WAAW,eAAe;GAChC,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;GAED,WAAW,YAAY;GACvB,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;EACH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"client-app-impl.cross-domain.test.js","names":["StackClientApp","hexclaveAppInternalsSymbol","AccessToken","Store","vi","expect"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { AccessToken } from \"@hexclave/shared/dist/sessions\";\nimport { Store } from \"@hexclave/shared/dist/utils/stores\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\nimport { planRedirectToHandler } from \"./redirect-page-urls\";\n\nfunction createAccessTokenString(refreshTokenId: string): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createMockDocument(): Document {\n  const cookieJar = new Map<string, string>();\n  return {\n    get cookie() {\n      return [...cookieJar.entries()].map(([key, value]) => `${key}=${value}`).join(\"; \");\n    },\n    set cookie(str: string) {\n      const [nameValue] = str.split(\";\");\n      const eqIndex = nameValue.indexOf(\"=\");\n      if (eqIndex < 0) return;\n      cookieJar.set(nameValue.slice(0, eqIndex).trim(), nameValue.slice(eqIndex + 1).trim());\n    },\n    createElement: () => ({}),\n  } as any;\n}\n\ndescribe(\"StackClientApp cross-domain auth\", () => {\n  it(\"keeps noRedirectBack same-domain redirects free of redirect-back state\", async () => {\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl: new URL(\"https://app.example.test/settings?tab=profile\"),\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Same-domain redirects must not create cross-domain handoff parameters.\");\n      },\n    });\n\n    expect(redirectPlan).toEqual({\n      type: \"redirect\",\n      url: \"/handler/sign-in\",\n    });\n  });\n\n  it(\"returns noRedirectBack cross-domain auth to the source app home\", async () => {\n    const handoffState = \"no-redirect-back-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(\"https://app.example.test/settings?tab=profile\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    currentUrl.searchParams.set(\n      \"hexclave_cross_domain_after_callback_redirect_url\",\n      \"https://app.example.test/settings?tab=profile\",\n    );\n\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"https://auth.example.test/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl,\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Existing cross-domain handoff parameters must be reused.\");\n      },\n    });\n\n    expect(redirectPlan.type).toBe(\"redirect\");\n    if (redirectPlan.type !== \"redirect\") {\n      throw new Error(\"Expected noRedirectBack sign-in to produce a redirect URL.\");\n    }\n\n    const hostedUrl = new URL(redirectPlan.url);\n    expect(hostedUrl.origin).toBe(\"https://auth.example.test\");\n    expect(hostedUrl.pathname).toBe(\"/handler/sign-in\");\n    expect(hostedUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n\n    const rawSourceCallbackUrl = hostedUrl.searchParams.get(\"after_auth_return_to\");\n    if (rawSourceCallbackUrl == null) {\n      throw new Error(\"Expected cross-domain noRedirectBack to include its internal source callback URL.\");\n    }\n    const sourceCallbackUrl = new URL(rawSourceCallbackUrl);\n    expect(sourceCallbackUrl.origin).toBe(\"https://app.example.test\");\n    expect(sourceCallbackUrl.pathname).toBe(\"/handler/oauth-callback\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_auth\")).toBe(\"1\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_state\")).toBe(handoffState);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(handoffCodeChallenge);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n    expect(sourceCallbackUrl.toString()).not.toContain(\"/settings\");\n  });\n\n  it(\"exposes redirect-back-aware handler URLs for devtool previews\", async () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    Reflect.set(globalThis, \"window\", {\n      location: {\n        href: \"http://localhost/music?track=1#song\",\n      },\n    });\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000000\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"none\",\n        urls: {\n          signIn: \"/handler/sign-in\",\n        },\n        noAutomaticPrefetch: true,\n      });\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"signIn\");\n\n      const resolved = new URL(redirectUrl, \"http://localhost\");\n      expect(resolved.pathname).toBe(\"/handler/sign-in\");\n      expect(resolved.searchParams.get(\"after_auth_return_to\")).toBe(\"/music?track=1#song\");\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"uses the fresh post-auth refresh token when minting a cross-domain handoff\", async () => {\n    const freshAccessToken = createAccessTokenString(\"fresh-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: {\n        accessToken: createAccessTokenString(\"stale-refresh-token-id\"),\n        refreshToken: \"stale-refresh-token\",\n      },\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSendClientRequest = Reflect.get(clientInterface, \"sendClientRequest\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const capturedRefreshTokens: string[] = [];\n    const capturedAccessTokenRefreshTokenIds: string[] = [];\n    const refreshedRawRefreshTokens: string[] = [];\n\n    Reflect.set(clientInterface, \"sendClientRequest\", async (_path: unknown, _requestOptions: unknown, session: unknown) => {\n      const getRefreshToken = Reflect.get(session ?? {}, \"getRefreshToken\");\n      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, \"getOrFetchLikelyValidTokens\");\n      if (typeof getRefreshToken !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session to the client interface.\");\n      }\n      if (typeof getOrFetchLikelyValidTokens !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session with token accessors.\");\n      }\n      const refreshToken = getRefreshToken.call(session);\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected cross-domain auth to pass a refresh-token-backed session.\");\n      }\n      capturedRefreshTokens.push(refreshTokenString);\n      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);\n      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);\n      return {\n        ok: true,\n        json: async () => ({ redirect_url: \"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\" }),\n      };\n    });\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected refresh token while fetching a new access token.\");\n      }\n      refreshedRawRefreshTokens.push(refreshTokenString);\n      return AccessToken.createIfValid(freshAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, \"_createCrossDomainAuthRedirectUrl\");\n      if (typeof createCrossDomainAuthRedirectUrl !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _createCrossDomainAuthRedirectUrl in tests.\");\n      }\n\n      await expect(createCrossDomainAuthRedirectUrl.call(clientApp, {\n        redirectUri: \"https://example.com/handler/oauth-callback\",\n        state: \"handoff-state\",\n        codeChallenge: \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\",\n        afterCallbackRedirectUrl: \"https://example.com/account-settings\",\n        overrideTokenStoreInit: {\n          accessToken: createAccessTokenString(\"fresh-stale-refresh-token-id\"),\n          refreshToken: \"fresh-refresh-token\",\n        },\n      })).resolves.toBe(\"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\");\n    } finally {\n      Reflect.set(clientInterface, \"sendClientRequest\", originalSendClientRequest);\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedAccessTokenRefreshTokenIds).toEqual([\"fresh-refresh-token-id\"]);\n  });\n\n  it(\"uses a fresh nested OAuth state while preserving the outer cross-domain return state\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000002\";\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const outerState = \"outer-cross-domain-state\";\n    const outerCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"after_auth_return_to\", `https://demo.stack-auth.com/?hexclave_cross_domain_auth=1&hexclave_cross_domain_state=${outerState}`);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", outerState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", outerCodeChallenge);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-session\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const redirectUrl = new URL(redirectedUrl);\n    expect(redirectUrl.searchParams.get(\"state\")).toBe(\"fresh-nested-state\");\n    expect(redirectUrl.searchParams.get(\"code_challenge\")).toBe(\"fresh-nested-code-challenge\");\n    const redirectUri = new URL(redirectUrl.searchParams.get(\"redirect_uri\") ?? \"\");\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_state\")).toBe(outerState);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(outerCodeChallenge);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\"https://demo.stack-auth.com/\");\n  });\n\n  it(\"clears a stale target-domain session before deferring to the source-domain session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000006\";\n    const hostedAccessToken = createAccessTokenString(\"hosted-old-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const tokenStore = Reflect.get(clientApp, \"_memoryTokenStore\");\n    if (!(tokenStore instanceof Store)) {\n      throw new Error(\"Expected StackClientApp to use a memory token store in this test.\");\n    }\n    tokenStore.set({\n      refreshToken: \"hosted-old-refresh-token\",\n      accessToken: hostedAccessToken,\n    });\n\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-anonymous-refresh-token-id\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/handler/oauth-callback\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", \"outer-state\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", \"outer-code-challenge\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/app\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(tokenStore.get()).toEqual({\n      refreshToken: null,\n      accessToken: null,\n    });\n    expect(new URL(redirectedUrl).origin).toBe(\"https://demo.stack-auth.com\");\n  });\n\n  it(\"uses the latest browser refresh cookie before computing nested cross-domain session IDs\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000007\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: \"https://demo.stack-auth.com/\",\n        protocol: \"https:\",\n        hostname: \"demo.stack-auth.com\",\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"cookie\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const refreshedRawRefreshTokens: string[] = [];\n\n    // Cookie-store writes queue a background trusted-parent-domain lookup. Without this stub, that\n    // lookup fetches the (unreachable) baseUrl with retries while holding the global store lock,\n    // which starves any later test that needs the write lock (e.g. signOut). Not restored on\n    // purpose: queued tasks can still run after this test body finishes.\n    vi.spyOn(clientApp as any, \"_getTrustedParentDomain\").mockResolvedValue(null);\n\n    try {\n      const getBrowserCookieTokenStore = Reflect.get(clientApp, \"_getBrowserCookieTokenStore\");\n      if (typeof getBrowserCookieTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.\");\n      }\n      const tokenStore = getBrowserCookieTokenStore.call(clientApp);\n      tokenStore.set({\n        refreshToken: \"old-refresh-token\",\n        accessToken: createAccessTokenString(\"old-refresh-token-id\"),\n      });\n\n      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({\n        refresh_token: \"new-refresh-token\",\n        updated_at_millis: 1,\n      })}`;\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n        const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n        if (typeof refreshTokenString !== \"string\") {\n          throw new Error(\"Expected refresh token while fetching a new access token.\");\n        }\n        refreshedRawRefreshTokens.push(refreshTokenString);\n        return AccessToken.createIfValid(createAccessTokenString(\"new-refresh-token-id\")) ?? (() => {\n          throw new Error(\"Expected test access token to be valid\");\n        })();\n      });\n\n      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\");\n      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.\");\n      }\n      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {\n        awaitPendingAuthResolutions: false,\n      })).resolves.toBe(\"new-refresh-token-id\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"new-refresh-token\"]);\n  });\n\n  it(\"does not re-bounce nested cross-domain auth after the OAuth callback consumed code+state from the URL\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000008\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const strippedUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n    const urlAtConstructionTime = new URL(strippedUrl);\n    urlAtConstructionTime.searchParams.set(\"code\", \"one-time-code\");\n    urlAtConstructionTime.searchParams.set(\"state\", \"nested-oauth-state\");\n\n    // Construct before installing the window mock so the constructor does not schedule its own\n    // nested-auth resolution; the assertions below drive the handler explicitly.\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      noAutomaticPrefetch: true,\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: strippedUrl.toString(),\n        replace: () => {\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    try {\n      // Without the construction-time URL, the handler re-bounces (location.replace aborts).\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      // With it, the in-flight OAuth callback wins and the handler stands down.\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime)).resolves.toBe(false);\n      // The live-URL guard must also stand down on its own when code+state are still present.\n      (globalThis.window as any).location.href = urlAtConstructionTime.toString();\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).resolves.toBe(false);\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"passes the construction-time URL to the nested cross-domain auth handler\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000009\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const callbackUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    callbackUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    callbackUrl.searchParams.set(\"code\", \"one-time-code\");\n    callbackUrl.searchParams.set(\"state\", \"nested-oauth-state\");\n    const strippedUrl = new URL(callbackUrl);\n    strippedUrl.searchParams.delete(\"code\");\n    strippedUrl.searchParams.delete(\"state\");\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: callbackUrl.toString(),\n      },\n    } as any;\n\n    const nestedAuthSpy = vi.spyOn(StackClientApp.prototype as any, \"_maybeHandleNestedCrossDomainAuth\").mockResolvedValue(false);\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n\n      // Simulate consumeOAuthCallbackQueryParams stripping code+state before microtasks run.\n      (globalThis.window as any).location.href = strippedUrl.toString();\n      await new Promise((resolve) => setTimeout(resolve, 0));\n\n      expect(nestedAuthSpy).toHaveBeenCalledTimes(1);\n      const urlArgument = nestedAuthSpy.mock.calls[0][0] as URL;\n      expect(urlArgument).toBeInstanceOf(URL);\n      expect(urlArgument.searchParams.get(\"code\")).toBe(\"one-time-code\");\n      expect(urlArgument.searchParams.get(\"state\")).toBe(\"nested-oauth-state\");\n    } finally {\n      nestedAuthSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"redirects hosted current-page OAuth callback errors to the hosted error handler during startup\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000010\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const callbackUrl = new URL(\"https://demo.stack-auth.com/dashboard\");\n    callbackUrl.searchParams.set(\"errorCode\", \"SIGN_UP_REJECTED\");\n    callbackUrl.searchParams.set(\"message\", \"Your sign up was rejected by an administrator's sign-up rule.\");\n    callbackUrl.searchParams.set(\"details\", JSON.stringify({\n      message: \"Your sign up was rejected by an administrator's sign-up rule.\",\n    }));\n    callbackUrl.searchParams.set(\"after_auth_return_to\", \"/dashboard\");\n    callbackUrl.searchParams.set(\"after_callback_redirect_url\", \"https://customer.example.test/settings?tab=connected-accounts\");\n    let currentHref = callbackUrl.toString();\n    let redirectedUrl = \"\";\n    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, \"_redirectTo\").mockImplementation(async (...args: unknown[]) => {\n      const options = args[0] as { url: string | URL };\n      redirectedUrl = options.url.toString();\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n        set href(value: string) {\n          currentHref = value;\n        },\n        origin: callbackUrl.origin,\n      },\n      history: {\n        replaceState: (_state: unknown, _title: string, url: string) => {\n          currentHref = new URL(url, currentHref).toString();\n        },\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        urls: {\n          default: { type: \"hosted\" },\n        },\n        noAutomaticPrefetch: true,\n      });\n\n      await new Promise((resolve) => setTimeout(resolve, 0));\n      await new Promise((resolve) => setTimeout(resolve, 0));\n    } finally {\n      redirectSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const errorUrl = new URL(redirectedUrl);\n    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);\n    expect(errorUrl.pathname).toBe(\"/handler/error\");\n    expect(errorUrl.searchParams.get(\"errorCode\")).toBe(\"SIGN_UP_REJECTED\");\n    expect(errorUrl.searchParams.get(\"message\")).toBe(\"Your sign up was rejected by an administrator's sign-up rule.\");\n    expect(errorUrl.searchParams.get(\"after_auth_return_to\")).toBe(\"/dashboard\");\n    expect(errorUrl.searchParams.get(\"after_callback_redirect_url\")).toBe(\"https://customer.example.test/settings?tab=connected-accounts\");\n    expect(new URL(currentHref).searchParams.has(\"errorCode\")).toBe(false);\n  });\n\n  it(\"uses direct sign-out instead of hosted sign-out redirects when code execution is available\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/handler\",\n        signOut: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const signOutSpy = vi.spyOn(clientApp, \"signOut\").mockRejectedValue(new Error(\"INTENTIONAL_TEST_ABORT\"));\n\n    try {\n      await expect(clientApp.redirectToSignOut()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      expect(signOutSpy).toHaveBeenCalledWith();\n    } finally {\n      signOutSpy.mockRestore();\n    }\n  });\n\n  it(\"throws when public app.urls reads would return hosted component URLs\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n\n    expect(() => clientApp.urls.signIn).toThrowError(/app\\.urls\\.signIn cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignIn\\(\\) instead/s);\n    expect(() => clientApp.urls.signOut).toThrowError(/app\\.urls\\.signOut cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignOut\\(\\) instead/s);\n    expect(clientApp.urls.afterSignIn).toBe(\"/\");\n  });\n\n  it(\"keeps public app.urls reads available for non-hosted targets\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/custom-handler\",\n      },\n      noAutomaticPrefetch: true,\n    });\n\n    expect(clientApp.urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"keeps default hosted signOut() on the source domain when afterSignOut is not configured\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000004\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const currentHref = \"https://demo.stack-auth.com/settings?tab=profile\";\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSignOut = Reflect.get(clientInterface, \"signOut\");\n    Reflect.set(clientInterface, \"signOut\", async () => {});\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentHref,\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      const signOut = Reflect.get(clientApp, \"_signOut\");\n      if (typeof signOut !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _signOut in tests.\");\n      }\n      await expect(signOut.call(clientApp, Reflect.get(clientInterface, \"createSession\").call(clientInterface, {\n        refreshToken: null,\n      }))).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"signOut\", originalSignOut);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(redirectedUrl).toBe(\"/settings?tab=profile\");\n  });\n\n  it(\"restores a dropped after_auth_return_to from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n    const windowMock = {\n      location: {\n        href: \"https://demo.example.test/handler/sign-in?after_auth_return_to=%2Fmusic%3Ftrack%3D1\",\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      // The constructor mirrors the redirect-back state from the arrival URL into sessionStorage.\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000011\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n\n      // Intermediate hops (MFA, magic link, OAuth round-trips, ...) dropped the query params.\n      windowMock.location.href = \"https://demo.example.test/handler/mfa\";\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n      expect(redirectUrl).toBe(\"/music?track=1\");\n\n      // noRedirectBack opts out of the mirror just like it opts out of the query param.\n      const noRedirectBackUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\", { noRedirectBack: true });\n      expect(new URL(noRedirectBackUrl, \"https://demo.example.test\").pathname).toBe(\"/\");\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"restores dropped cross-domain handoff state from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n\n    const handoffState = \"mirror-handoff-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const handoffAfterCallbackRedirect = \"https://demo.example.test/dashboard\";\n    const redirectBackUrl = new URL(\"https://demo.example.test/handler/oauth-callback\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_auth\", \"1\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);\n    arrivalUrl.searchParams.set(\"after_auth_return_to\", redirectBackUrl.toString());\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const previousDocument = globalThis.document;\n    const windowMock = {\n      location: {\n        href: arrivalUrl.toString(),\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n      const crossDomainAuthorizeRedirect = \"https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state\";\n      const createCrossDomainAuthRedirectUrlSpy = vi\n        .spyOn(clientApp as any, \"_createCrossDomainAuthRedirectUrl\")\n        .mockResolvedValue(crossDomainAuthorizeRedirect);\n\n      // All redirect-back query params were dropped before the after-sign-in redirect.\n      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n\n      expect(createCrossDomainAuthRedirectUrlSpy).toHaveBeenCalledWith(expect.objectContaining({\n        redirectUri: redirectBackUrl.toString(),\n        state: handoffState,\n        codeChallenge: handoffCodeChallenge,\n        afterCallbackRedirectUrl: handoffAfterCallbackRedirect,\n      }));\n      expect(redirectUrl).toBe(crossDomainAuthorizeRedirect);\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"ignores stale session callbacks after a newer refresh token owns the token store\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000005\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n    const oldAccessToken = createAccessTokenString(\"old-refresh-token-id\");\n    const refreshedOldAccessToken = createAccessTokenString(\"refreshed-old-refresh-token-id\");\n    const newAccessToken = createAccessTokenString(\"new-refresh-token-id\");\n    const tokenStore = new Store({\n      refreshToken: \"old-refresh-token\",\n      accessToken: oldAccessToken,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const getSessionFromTokenStore = Reflect.get(clientApp, \"_getSessionFromTokenStore\");\n      if (typeof getSessionFromTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getSessionFromTokenStore in tests.\");\n      }\n      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);\n      tokenStore.set({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      await oldSession.fetchNewTokens();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      oldSession.markInvalid();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n  });\n});\n"],"mappings":";;;;;;;AAWA,SAAS,wBAAwB,gBAAgC;CAC/D,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,qBAA+B;CACtC,MAAM,4BAAY,IAAI,IAAoB;CAC1C,OAAO;EACL,IAAI,SAAS;GACX,OAAO,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;EACpF;EACA,IAAI,OAAO,KAAa;GACtB,MAAM,CAAC,aAAa,IAAI,MAAM,GAAG;GACjC,MAAM,UAAU,UAAU,QAAQ,GAAG;GACrC,IAAI,UAAU,GAAG;GACjB,UAAU,IAAI,UAAU,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACvF;EACA,sBAAsB,CAAC;CACzB;AACF;qBAES,0CAA0C;CACjD,CAAA,GAAA,OAAA,GAAA,CAAG,0EAA0E,YAAY;EAavF,CAAA,GAAA,OAAA,OAAA,CAAO,OAAA,GAAA,wBAAA,sBAAA,CAZ0C;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY,IAAI,IAAI,+CAA+C;GACnE,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,wEAAwE;GAC1F;EACF,CAAC,CAEkB,CAAC,CAAC,QAAQ;GAC3B,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,mEAAmE,YAAY;EAChF,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,aAAa,IAAI,IAAI,+CAA+C;EAC1E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IACtB,qDACA,+CACF;EAEA,MAAM,eAAe,OAAA,GAAA,wBAAA,sBAAA,CAA4B;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB;GACA,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,0DAA0D;GAC5E;EACF,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,IAAI,CAAC,CAAC,KAAK,UAAU;EACzC,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,YAAY,IAAI,IAAI,aAAa,GAAG;EAC1C,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,MAAM,CAAC,CAAC,KAAK,2BAA2B;EACzD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,QAAQ,CAAC,CAAC,KAAK,kBAAkB;EAClD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KACtF,+BACF;EAEA,MAAM,uBAAuB,UAAU,aAAa,IAAI,sBAAsB;EAC9E,IAAI,wBAAwB,MAC1B,MAAM,IAAI,MAAM,mFAAmF;EAErG,MAAM,oBAAoB,IAAI,IAAI,oBAAoB;EACtD,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK,0BAA0B;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,QAAQ,CAAC,CAAC,KAAK,yBAAyB;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,4BAA4B,CAAC,CAAC,CAAC,KAAK,GAAG;EACjF,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3F,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,oBAAoB;EAC5G,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAC9F,+BACF;EACA,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,WAAW;CAChE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iEAAiE,YAAY;EAC9E,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,QAAQ,IAAI,YAAY,UAAU,EAChC,UAAU,EACR,MAAM,sCACR,EACF,CAAC;EAED,IAAI;GAaF,MAAM,cAAc,MAAM,IAZJA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,QAAQ,mBACV;IACA,qBAAqB;GACvB,CAEkC,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,wBAAwB,QAAQ;GAEhG,MAAM,WAAW,IAAI,IAAI,aAAa,kBAAkB;GACxD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,kBAAkB;GACjD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,qBAAqB;EACtF,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E,YAAY;EAC3F,MAAM,mBAAmB,wBAAwB,wBAAwB;EACzE,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;IACV,aAAa,wBAAwB,wBAAwB;IAC7D,cAAc;GAChB;GACA,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EAED,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,4BAA4B,QAAQ,IAAI,iBAAiB,mBAAmB;EAClF,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,wBAAkC,CAAC;EACzC,MAAM,qCAA+C,CAAC;EACtD,MAAM,4BAAsC,CAAC;EAE7C,QAAQ,IAAI,iBAAiB,qBAAqB,OAAO,OAAgB,iBAA0B,YAAqB;GACtH,MAAM,kBAAkB,QAAQ,IAAI,WAAW,CAAC,GAAG,iBAAiB;GACpE,MAAM,8BAA8B,QAAQ,IAAI,WAAW,CAAC,GAAG,6BAA6B;GAC5F,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,MAAM,uEAAuE;GAEzF,IAAI,OAAO,gCAAgC,YACzC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,MAAM,eAAe,gBAAgB,KAAK,OAAO;GACjD,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,sBAAsB,KAAK,kBAAkB;GAC7C,MAAM,SAAS,MAAM,4BAA4B,KAAK,SAAS,GAAG,IAAI;GACtE,mCAAmC,KAAK,OAAO,YAAY,QAAQ,gBAAgB;GACnF,OAAO;IACL,IAAI;IACJ,MAAM,aAAa,EAAE,cAAc,mFAAmF;GACxH;EACF,CAAC;EACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;GACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,0BAA0B,KAAK,kBAAkB;GACjD,OAAOE,+BAAAA,YAAY,cAAc,gBAAgB,YAAY;IAC3D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,mCAAmC,QAAQ,IAAI,WAAW,mCAAmC;GACnG,IAAI,OAAO,qCAAqC,YAC9C,MAAM,IAAI,MAAM,+EAA+E;GAGjG,OAAA,GAAA,OAAA,OAAA,CAAa,iCAAiC,KAAK,WAAW;IAC5D,aAAa;IACb,OAAO;IACP,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;KACtB,aAAa,wBAAwB,8BAA8B;KACnE,cAAc;IAChB;GACF,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,kFAAkF;EACtG,UAAU;GACR,QAAQ,IAAI,iBAAiB,qBAAqB,yBAAyB;GAC3E,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,qBAAqB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EAC7D,CAAA,GAAA,OAAA,OAAA,CAAO,kCAAkC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,wFAAwF,YAAY;EACrG,MAAM,YAAY;EAClB,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,qBAAqB;EAC3B,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,wBAAwB,yFAAyF,YAAY;EACzJ,WAAW,aAAa,IAAI,+BAA+B,UAAU;EACrE,WAAW,aAAa,IAAI,wCAAwC,kBAAkB;EACtF,WAAW,aAAa,IAAI,qDAAqD,8BAA8B;EAC/G,WAAW,aAAa,IAAI,mDAAmD,gBAAgB;EAC/F,WAAW,aAAa,IAAI,+CAA+C,8BAA8B;EAEzG,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa;EACzC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACvE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,6BAA6B;EACzF,MAAM,cAAc,IAAI,IAAI,YAAY,aAAa,IAAI,cAAc,KAAK,EAAE;EAC9E,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,UAAU;EACnF,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACpG,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAAK,8BAA8B;CAC/H,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sFAAsF,YAAY;EACnG,MAAM,YAAY;EAClB,MAAM,oBAAoB,wBAAwB,6BAA6B;EAC/E,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa,QAAQ,IAAI,WAAW,mBAAmB;EAC7D,IAAI,EAAE,sBAAsBG,mCAAAA,QAC1B,MAAM,IAAI,MAAM,mEAAmE;EAErF,WAAW,IAAI;GACb,cAAc;GACd,aAAa;EACf,CAAC;EAED,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,mDAAmD,mCAAmC;EAClH,WAAW,aAAa,IAAI,+CAA+C,oDAAoD;EAC/H,WAAW,aAAa,IAAI,+BAA+B,aAAa;EACxE,WAAW,aAAa,IAAI,wCAAwC,sBAAsB;EAC1F,WAAW,aAAa,IAAI,qDAAqD,iCAAiC;EAElH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,iBAAiB,YAAY;IAC5D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;GAC/B,cAAc;GACd,aAAa;EACf,CAAC;EACD,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,6BAA6B;CAC1E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,MAAM;IACN,UAAU;IACV,UAAU;GACZ;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,4BAAsC,CAAC;EAM7C,OAAA,GAAG,MAAM,WAAkB,yBAAyB,CAAC,CAAC,kBAAkB,IAAI;EAE5E,IAAI;GACF,MAAM,6BAA6B,QAAQ,IAAI,WAAW,6BAA6B;GACvF,IAAI,OAAO,+BAA+B,YACxC,MAAM,IAAI,MAAM,yEAAyE;GAG3F,2BAD8C,KAAK,SAC1C,CAAC,CAAC,IAAI;IACb,cAAc;IACd,aAAa,wBAAwB,sBAAsB;GAC7D,CAAC;GAED,SAAS,SAAS,2BAA2B,UAAU,YAAY,KAAK,UAAU;IAChF,eAAe;IACf,mBAAmB;GACrB,CAAC;GACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;IACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;IAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;IAE7E,0BAA0B,KAAK,kBAAkB;IACjD,OAAOE,+BAAAA,YAAY,cAAc,wBAAwB,sBAAsB,CAAC,YAAY;KAC1F,MAAM,IAAI,MAAM,wCAAwC;IAC1D,EAAA,CAAG;GACL,CAAC;GAED,MAAM,uCAAuC,QAAQ,IAAI,WAAW,uCAAuC;GAC3G,IAAI,OAAO,yCAAyC,YAClD,MAAM,IAAI,MAAM,mFAAmF;GAErG,OAAA,GAAA,OAAA,OAAA,CAAa,qCAAqC,KAAK,WAAW,EAChE,6BAA6B,MAC/B,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB;EAC1C,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,+CAA+C,8BAA8B;EAC1G,MAAM,wBAAwB,IAAI,IAAI,WAAW;EACjD,sBAAsB,aAAa,IAAI,QAAQ,eAAe;EAC9D,sBAAsB,aAAa,IAAI,SAAS,oBAAoB;EAIpE,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,YAAY,SAAS;GAC3B,eAAe;IACb,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,IAAI;GAEF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GAElH,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,qBAAqB,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;GAE7G,WAAY,OAAe,SAAS,OAAO,sBAAsB,SAAS;GAC1E,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;EAC1F,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4EAA4E,YAAY;EACzF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,QAAQ,eAAe;EACpD,YAAY,aAAa,IAAI,SAAS,oBAAoB;EAC1D,MAAM,cAAc,IAAI,IAAI,WAAW;EACvC,YAAY,aAAa,OAAO,MAAM;EACtC,YAAY,aAAa,OAAO,OAAO;EAEvC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU,EACR,MAAM,YAAY,SAAS,EAC7B,EACF;EAEA,MAAM,gBAAgBI,OAAAA,GAAG,MAAMJ,4BAAAA,eAAe,WAAkB,mCAAmC,CAAC,CAAC,kBAAkB,KAAK;EAE5H,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GAGD,WAAY,OAAe,SAAS,OAAO,YAAY,SAAS;GAChE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GAErD,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,sBAAsB,CAAC;GAC7C,MAAM,cAAc,cAAc,KAAK,MAAM,EAAE,CAAC;GAChD,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,eAAe,GAAG;GACtC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;GACjE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACzE,UAAU;GACR,cAAc,YAAY;GAC1B,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kGAAkG,YAAY;EAC/G,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,cAAc,IAAI,IAAI,uCAAuC;EACnE,YAAY,aAAa,IAAI,aAAa,kBAAkB;EAC5D,YAAY,aAAa,IAAI,WAAW,+DAA+D;EACvG,YAAY,aAAa,IAAI,WAAW,KAAK,UAAU,EACrD,SAAS,gEACX,CAAC,CAAC;EACF,YAAY,aAAa,IAAI,wBAAwB,YAAY;EACjE,YAAY,aAAa,IAAI,+BAA+B,+DAA+D;EAC3H,IAAI,cAAc,YAAY,SAAS;EACvC,IAAI,gBAAgB;EACpB,MAAM,cAAcI,OAAAA,GAAG,MAAMJ,4BAAAA,eAAe,WAAkB,aAAa,CAAC,CAAC,mBAAmB,OAAO,GAAG,SAAoB;GAE5H,gBADgB,KAAK,EACE,CAAC,IAAI,SAAS;EACvC,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,IAAI,OAAO;KACT,OAAO;IACT;IACA,IAAI,KAAK,OAAe;KACtB,cAAc;IAChB;IACA,QAAQ,YAAY;GACtB;GACA,SAAS,EACP,eAAe,QAAiB,QAAgB,QAAgB;IAC9D,cAAc,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,SAAS;GACnD,EACF;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;IACA,qBAAqB;GACvB,CAAC;GAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GACrD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;EACvD,UAAU;GACR,YAAY,YAAY;GACxB,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,WAAW,IAAI,IAAI,aAAa;EACtC,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,MAAM,CAAC,CAAC,KAAK,WAAW,UAAU,yBAAyB;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,gBAAgB;EAC/C,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACtE,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACjH,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,WAAW,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK;CACvE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8FAA8F,YAAY;EAC3G,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM;IACJ,SAAS;IACT,SAAS,EAAE,MAAM,SAAS;GAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAaI,OAAAA,GAAG,MAAM,WAAW,SAAS,CAAC,CAAC,kCAAkB,IAAI,MAAM,wBAAwB,CAAC;EAEvG,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAa,UAAU,kBAAkB,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GACzF,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,CAAC,CAAC,qBAAqB;EAC1C,UAAU;GACR,WAAW,YAAY;EACzB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E;EAC/E,MAAM,YAAY,IAAIJ,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,MAAM,CAAC,CAAC,aAAa,+HAA+H;EAChL,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,OAAO,CAAC,CAAC,aAAa,iIAAiI;EACnL,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,KAAK,WAAW,CAAC,CAAC,KAAK,GAAG;CAC7C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE;EAavE,CAAA,GAAA,OAAA,OAAA,CAAO,IAZeA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,kBACX;GACA,qBAAqB;EACvB,CAEe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,yBAAyB;CAC9D,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,cAAc;EAEpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,kBAAkB,QAAQ,IAAI,iBAAiB,SAAS;EAC9D,QAAQ,IAAI,iBAAiB,WAAW,YAAY,CAAC,CAAC;EACtD,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EAEpB,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM;GACN,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,UAAU,QAAQ,IAAI,WAAW,UAAU;GACjD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,sDAAsD;GAExE,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,KAAK,WAAW,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CAAC,KAAK,iBAAiB,EACvG,cAAc,KAChB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpD,UAAU;GACR,QAAQ,IAAI,iBAAiB,WAAW,eAAe;GACvD,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,uBAAuB;CACpD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAClD,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,sFACR;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GAEF,MAAM,YAAY,IAAIA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GAGD,WAAW,SAAS,OAAO;GAG3B,CAAA,GAAA,OAAA,OAAA,CAAO,MADmB,UAAUC,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa,CACnF,CAAC,CAAC,KAAK,gBAAgB;GAGzC,MAAM,oBAAoB,MAAM,UAAUA,gBAAAA,2BAA2B,CAAC,wBAAwB,eAAe,EAAE,gBAAgB,KAAK,CAAC;GACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,mBAAmB,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG;EACnF,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6GAA6G,YAAY;EAC1H,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAElD,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,+BAA+B;EACrC,MAAM,kBAAkB,IAAI,IAAI,kDAAkD;EAClF,gBAAgB,aAAa,IAAI,8BAA8B,GAAG;EAClE,gBAAgB,aAAa,IAAI,+BAA+B,YAAY;EAC5E,gBAAgB,aAAa,IAAI,wCAAwC,oBAAoB;EAC7F,gBAAgB,aAAa,IAAI,qDAAqD,4BAA4B;EAElH,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,yCAAyC;EACzF,WAAW,aAAa,IAAI,wBAAwB,gBAAgB,SAAS,CAAC;EAC9E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IAAI,qDAAqD,4BAA4B;EAE7G,MAAM,mBAAmB,WAAW;EACpC,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,WAAW,SAAS,EAC5B;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GACF,MAAM,YAAY,IAAID,4BAAAA,eAAe;IACnC,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GACD,MAAM,+BAA+B;GACrC,MAAM,sCAAsCI,OAAAA,GACzC,MAAM,WAAkB,mCAAmC,CAAC,CAC5D,kBAAkB,4BAA4B;GAGjD,WAAW,SAAS,OAAO,WAAW,UAAU;GAEhD,MAAM,cAAc,MAAM,UAAUH,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa;GAErG,CAAA,GAAA,OAAA,OAAA,CAAO,mCAAmC,CAAC,CAAC,qBAAqBI,OAAAA,OAAO,iBAAiB;IACvF,aAAa,gBAAgB,SAAS;IACtC,OAAO;IACP,eAAe;IACf,0BAA0B;GAC5B,CAAC,CAAC;GACF,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,KAAK,4BAA4B;EACvD,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oFAAoF,YAAY;EACjG,MAAM,YAAY,IAAIL,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EACD,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,0BAA0B,wBAAwB,gCAAgC;EACxF,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,aAAa,IAAIG,mCAAAA,MAAM;GAC3B,cAAc;GACd,aAAa;EACf,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,uBAAuB,YAAY;IAClE,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,2BAA2B,QAAQ,IAAI,WAAW,2BAA2B;GACnF,IAAI,OAAO,6BAA6B,YACtC,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,aAAa,yBAAyB,KAAK,WAAW,UAAU;GACtE,WAAW,IAAI;IACb,cAAc;IACd,aAAa;GACf,CAAC;GAED,MAAM,WAAW,eAAe;GAChC,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;GAED,WAAW,YAAY;GACvB,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;EACH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;CACF,CAAC;AACH,CAAC"}

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.d.ts

@@ -1,2 +1,2 @@
-import { r as _HexclaveClientAppImplIncomplete } from "../../../../admin-app-impl-D867jXHk.js";
+import { r as _HexclaveClientAppImplIncomplete } from "../../../../admin-app-impl-sTQD2d-3.js";
 export { _HexclaveClientAppImplIncomplete };

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -20,6 +20,7 @@ let ______common_js = require("../../common.js");
 let ______projects_index_js = require("../../projects/index.js");
 let _hexclave_shared_dist_sessions = require("@hexclave/shared/dist/sessions");
 let _hexclave_shared_dist_utils_stores = require("@hexclave/shared/dist/utils/stores");
+let __redirect_page_urls_js = require("./redirect-page-urls.js");
 let _hexclave_shared_dist_utils_compile_time = require("@hexclave/shared/dist/utils/compile-time");
 let _hexclave_shared_dist_utils_json = require("@hexclave/shared/dist/utils/json");
 let _hexclave_shared_dist_utils_maps = require("@hexclave/shared/dist/utils/maps");
@@ -41,7 +42,6 @@ let __redirect_loop_breaker_js = require("./redirect-loop-breaker.js");
 let ______passkey_rp_id_js = require("../../passkey-rp-id.js");
 let ______users_index_js = require("../../users/index.js");
 let __event_tracker_js = require("./event-tracker.js");
-let __redirect_page_urls_js = require("./redirect-page-urls.js");
 let __session_refresh_subscription_js = require("./session-refresh-subscription.js");
 let __session_replay_js = require("./session-replay.js");
 let ____________clickmap_index_js = require("../../../../clickmap/index.js");
@@ -54,6 +54,7 @@ let isReactServer = false;
 isReactServer = _hexclave_sc.isReactServer;
 const NextNavigation = (0, _hexclave_shared_dist_utils_compile_time.scrambleDuringCompileTime)(next_navigation);
 const prefetchedCrossDomainHandoffTtlMs = 3300 * 1e3;
+const oauthAfterCallbackRedirectUrlQueryParam = "after_callback_redirect_url";
 const nestedCrossDomainAuthQueryParams = {
 	refreshTokenId: "stack_nested_cross_domain_auth_refresh_token_id",
 	callbackUrl: "stack_nested_cross_domain_auth_callback_url",
@@ -61,7 +62,7 @@ const nestedCrossDomainAuthQueryParams = {
 	state: "state",
 	codeChallenge: "code_challenge",
 	codeChallengeMethod: "code_challenge_method",
-	afterCallbackRedirectUrl: "after_callback_redirect_url"
+	afterCallbackRedirectUrl: oauthAfterCallbackRedirectUrlQueryParam
 };
 function getRedirectHelperInstruction(handlerName) {
 	if (handlerName === "handler") return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
@@ -425,15 +426,17 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		this._redirectMethod = resolvedOptions.redirectMethod || "nextjs";
 		this._urlOptions = resolvedOptions.urls ?? {};
 		this._oauthScopesOnSignIn = resolvedOptions.oauthScopesOnSignIn ?? {};
+		this._analyticsOptions = resolvedOptions.analytics;
+		if (extraOptions?.uniqueIdentifier !== void 0) this._uniqueIdentifier = extraOptions.uniqueIdentifier;
+		if (resolvedOptions.automaticSideEffects === false) return;
+		this._initializeAutomaticSideEffects(resolvedOptions);
+	}
+	_initializeAutomaticSideEffects(resolvedOptions) {
 		if ((0, _hexclave_shared_dist_utils_env.isBrowserLike)() && (resolvedOptions.tokenStore === "cookie" || resolvedOptions.tokenStore === "nextjs-cookie")) {
 			(0, _hexclave_shared_dist_utils_promises.runAsynchronously)(this._trustedParentDomainCache.getOrWait([window.location.hostname], "write-only"));
 			this._ensureCrossSubdomainCookieExists();
 		}
-		if (extraOptions && extraOptions.uniqueIdentifier) {
-			this._uniqueIdentifier = extraOptions.uniqueIdentifier;
-			this._initUniqueIdentifier();
-		}
-		this._analyticsOptions = resolvedOptions.analytics;
+		if (this._uniqueIdentifier !== void 0) this._initUniqueIdentifier();
 		const getAnalyticsSession = async () => {
 			this._ensurePersistentTokenStore();
 			if (await this.getPartialUser({
@@ -548,9 +551,24 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 	async _redirectToOAuthCallbackError(error) {
 		const errorUrl = new URL(this._getUrls().error, window.location.href);
+		const callbackUrl = (0, __redirect_back_state_js.augmentUrlWithPersistedRedirectBackState)({
+			currentUrl: new URL(window.location.href),
+			projectId: this.projectId
+		});
 		errorUrl.searchParams.set("errorCode", error.errorCode);
 		errorUrl.searchParams.set("message", error.message);
 		errorUrl.searchParams.set("details", JSON.stringify(error.details ?? {}));
+		for (const paramName of [
+			"after_auth_return_to",
+			__redirect_page_urls_js.crossDomainAuthQueryParams.state,
+			__redirect_page_urls_js.crossDomainAuthQueryParams.codeChallenge,
+			__redirect_page_urls_js.crossDomainAuthQueryParams.afterCallbackRedirectUrl
+		]) {
+			const value = callbackUrl.searchParams.get(paramName);
+			if (value != null) errorUrl.searchParams.set(paramName, value);
+		}
+		const afterCallbackRedirectUrl = callbackUrl.searchParams.get(oauthAfterCallbackRedirectUrlQueryParam);
+		if (afterCallbackRedirectUrl != null) errorUrl.searchParams.set(oauthAfterCallbackRedirectUrlQueryParam, afterCallbackRedirectUrl);
 		await this._redirectIfTrusted(errorUrl.toString(), { replace: true });
 	}
 	async _handleHostedOAuthCallbackDuringStartup() {
@@ -1978,7 +1996,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			projectId: forProjectId,
 			tokenStore: null,
 			projectOwnerSession: session,
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			automaticSideEffects: false
 		}));
 		return this._ownedAdminApps.get([session, forProjectId]);
 	}
@@ -2197,10 +2216,12 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		});
 	}
 	async _getRedirectToHandlerUrl(handlerName, options, internalOptions) {
-		const rawHandlerUrl = (0, __common_js.getUrls)(this._urlOptions, { projectId: this.projectId })[handlerName];
+		const rawUrls = (0, __common_js.getUrls)(this._urlOptions, { projectId: this.projectId });
+		const rawHandlerUrl = rawUrls[handlerName];
 		if (!rawHandlerUrl) throw new Error(`No URL for handler name ${handlerName}`);
 		let currentUrl = isReactServer || typeof window === "undefined" ? null : new URL(window.location.href);
-		if (currentUrl != null && options?.noRedirectBack !== true && (handlerName === "afterSignIn" || handlerName === "afterSignUp")) currentUrl = (0, __redirect_back_state_js.augmentUrlWithPersistedRedirectBackState)({
+		const shouldRestorePersistedRedirectBackState = options?.noRedirectBack !== true && (handlerName === "afterSignIn" || handlerName === "afterSignUp") || handlerName === "forgotPassword" || handlerName === "passwordReset" || handlerName === "signIn" && options?.noRedirectBack === true;
+		if (currentUrl != null && shouldRestorePersistedRedirectBackState) currentUrl = (0, __redirect_back_state_js.augmentUrlWithPersistedRedirectBackState)({
 			currentUrl,
 			projectId: this.projectId
 		});
@@ -2210,6 +2231,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			noRedirectBack: options?.noRedirectBack === true,
 			currentUrl,
 			localOAuthCallbackUrl: this._getLocalOAuthCallbackHandlerUrl(),
+			rawHomeUrl: rawUrls.home,
 			getCrossDomainHandoffParams: async (href) => await this._getCrossDomainHandoffParamsForRedirect(href)
 		});
 		if (plan.type === "cross-domain-authorize") return await this._createCrossDomainAuthRedirectUrl({
@@ -2901,13 +2923,15 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				return clientApp;
 			}
 			const { analytics, ...restJson } = (0, _hexclave_shared_dist_utils_objects.omit)(json, ["uniqueIdentifier"]);
-			return new _HexclaveClientAppImplIncomplete({
+			const app = new _HexclaveClientAppImplIncomplete({
 				...restJson,
 				analytics: (0, __session_replay_js.analyticsOptionsFromJson)(analytics)
 			}, {
 				uniqueIdentifier: json.uniqueIdentifier,
 				checkString: providedCheckString
 			});
+			if (json.automaticSideEffects === false) app._initUniqueIdentifier();
+			return app;
 		} };
 	}
 	get [______common_js.hexclaveAppInternalsSymbol]() {
@@ -2926,6 +2950,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 					redirectMethod: this._redirectMethod,
 					extraRequestHeaders: this._options.extraRequestHeaders,
 					devTool: this._options.devTool,
+					automaticSideEffects: this._options.automaticSideEffects,
 					analytics: (0, __session_replay_js.analyticsOptionsToJson)(this._analyticsOptions)
 				};
 			},
@@ -2961,6 +2986,13 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			redirectToHandler: async (handlerName, options) => {
 				await this._redirectToHandler(handlerName, options);
 			},
+			getRawAfterAuthReturnTo: () => {
+				if (isReactServer || typeof window === "undefined") return null;
+				return (0, __redirect_back_state_js.getRawAfterAuthReturnTo)({
+					currentUrl: new URL(window.location.href),
+					projectId: this.projectId
+				});
+			},
 			refreshOwnedProjects: async () => {
 				await this._refreshOwnedProjects(await this._getSession());
 			},