@hexclave/next 1.0.74 → 1.0.76

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js

@@ -1,3 +1,4 @@
+let _hexclave_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
 let vitest = require("vitest");
 let ______common_js = require("../../common.js");
 let ___interfaces_client_app_js = require("../interfaces/client-app.js");
@@ -51,6 +52,22 @@ function createMockDocument() {
 		createElement: () => ({})
 	};
 }
+/**
+* Installs a stand-in for `window` with only the parts the code under test touches. `globalThis.window` is typed as a
+* full `Window`, which a hand-written stub can never be, so the assignment goes through `Reflect.set` — the stub's own
+* shape stays checked, unlike with a cast on the object literal.
+*/
+function setMockWindow(mockWindow) {
+	Reflect.set(globalThis, "window", mockWindow);
+}
+/**
+* Calls one of the app's `protected` methods, which are part of the flows under test but not of the public SDK surface.
+*/
+function callProtectedMethod(app, methodName, ...args) {
+	const method = Reflect.get(app, methodName);
+	if (typeof method !== "function") throw new Error(`Expected StackClientApp to have a ${methodName} method in tests.`);
+	return method.apply(app, args);
+}
 (0, vitest.describe)("StackClientApp cross-domain auth", () => {
 	(0, vitest.it)("keeps noRedirectBack same-domain redirects free of redirect-back state", async () => {
 		(0, vitest.expect)(await (0, __redirect_page_urls_js.planRedirectToHandler)({
@@ -115,7 +132,8 @@ function createMockDocument() {
 				tokenStore: "memory",
 				redirectMethod: "none",
 				urls: { signIn: "/handler/sign-in" },
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			})[______common_js.hexclaveAppInternalsSymbol].getRedirectToHandlerUrl("signIn");
 			const resolved = new URL(redirectUrl, "http://localhost");
 			(0, vitest.expect)(resolved.pathname).toBe("/handler/sign-in");
@@ -136,7 +154,8 @@ function createMockDocument() {
 				refreshToken: "stale-refresh-token"
 			},
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const clientInterface = Reflect.get(clientApp, "_interface");
 		const originalSendClientRequest = Reflect.get(clientInterface, "sendClientRequest");
@@ -198,7 +217,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const outerState = "outer-cross-domain-state";
 		const outerCodeChallenge = "abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~";
@@ -250,7 +270,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const tokenStore = Reflect.get(clientApp, "_memoryTokenStore");
 		if (!(tokenStore instanceof _hexclave_shared_dist_utils_stores.Store)) throw new Error("Expected StackClientApp to use a memory token store in this test.");
@@ -316,7 +337,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "cookie",
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const clientInterface = Reflect.get(clientApp, "_interface");
 		const originalFetchNewAccessToken = Reflect.get(clientInterface, "fetchNewAccessToken");
@@ -367,7 +389,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "memory",
 			redirectMethod: "window",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		globalThis.document = createMockDocument();
 		globalThis.window = { location: {
@@ -392,6 +415,99 @@ function createMockDocument() {
 			globalThis.document = previousDocument;
 		}
 	});
+	(0, vitest.it)("reports malformed nested cross-domain auth URLs as setup errors", async () => {
+		const projectId = "00000000-0000-4000-8000-000000000012";
+		const previousWindow = globalThis.window;
+		const previousDocument = globalThis.document;
+		globalThis.document = createMockDocument();
+		const malformedCases = [
+			{
+				description: "redirect URI",
+				currentRefreshTokenId: "source-refresh-token-id",
+				params: {
+					redirect_uri: "not-a-url",
+					state: "nested-state",
+					code_challenge: "nested-code-challenge"
+				}
+			},
+			{
+				description: "after-callback redirect URL",
+				currentRefreshTokenId: "source-refresh-token-id",
+				params: {
+					redirect_uri: "https://source.example.test/handler/account-settings",
+					state: "nested-state",
+					code_challenge: "nested-code-challenge",
+					after_callback_redirect_url: "http://["
+				}
+			},
+			{
+				description: "callback URL",
+				currentRefreshTokenId: null,
+				params: { stack_nested_cross_domain_auth_callback_url: "http://[" }
+			}
+		];
+		try {
+			for (const malformedCase of malformedCases) {
+				const currentUrl = new URL("https://target.example.test/nested-provider");
+				currentUrl.searchParams.set("stack_nested_cross_domain_auth_refresh_token_id", "source-refresh-token-id");
+				for (const [key, value] of Object.entries(malformedCase.params)) currentUrl.searchParams.set(key, value);
+				globalThis.window = previousWindow;
+				const clientApp = new ___interfaces_client_app_js.StackClientApp({
+					baseUrl: "http://localhost:12345",
+					projectId,
+					publishableClientKey: "stack-pk-test",
+					tokenStore: "memory",
+					redirectMethod: "window",
+					noAutomaticPrefetch: true,
+					devTool: false
+				});
+				setMockWindow({ location: { href: currentUrl.toString() } });
+				Reflect.set(clientApp, "_fetchCurrentRefreshTokenIdIfSignedIn", async () => malformedCase.currentRefreshTokenId);
+				Reflect.set(clientApp, "_isTrusted", async () => true);
+				const nestedAuthPromise = callProtectedMethod(clientApp, "_maybeHandleNestedCrossDomainAuth");
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toThrowError(new RegExp(`${malformedCase.description} .* is not a valid absolute URL`));
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toSatisfy((error) => _hexclave_shared_dist_utils_errors.HexclaveSetupError.isSetupError(error));
+			}
+		} finally {
+			globalThis.window = previousWindow;
+			globalThis.document = previousDocument;
+		}
+	});
+	(0, vitest.it)("keeps nested cross-domain auth failures off the page for a handoff that does not own the session", async () => {
+		const projectId = "00000000-0000-4000-8000-000000000013";
+		const previousWindow = globalThis.window;
+		const previousDocument = globalThis.document;
+		globalThis.document = createMockDocument();
+		const craftedRedirectUris = ["https://evil.example.test/handler/account-settings", "not-a-url"];
+		try {
+			for (const craftedRedirectUri of craftedRedirectUris) {
+				const currentUrl = new URL("https://target.example.test/nested-provider");
+				currentUrl.searchParams.set("stack_nested_cross_domain_auth_refresh_token_id", "attacker-chosen-refresh-token-id");
+				currentUrl.searchParams.set("redirect_uri", craftedRedirectUri);
+				currentUrl.searchParams.set("state", "nested-state");
+				currentUrl.searchParams.set("code_challenge", "nested-code-challenge");
+				globalThis.window = previousWindow;
+				const clientApp = new ___interfaces_client_app_js.StackClientApp({
+					baseUrl: "http://localhost:12345",
+					projectId,
+					publishableClientKey: "stack-pk-test",
+					tokenStore: "memory",
+					redirectMethod: "window",
+					noAutomaticPrefetch: true,
+					devTool: false
+				});
+				setMockWindow({ location: { href: currentUrl.toString() } });
+				Reflect.set(clientApp, "_fetchCurrentRefreshTokenIdIfSignedIn", async () => "this-apps-refresh-token-id");
+				Reflect.set(clientApp, "_isTrusted", async () => false);
+				const nestedAuthPromise = callProtectedMethod(clientApp, "_maybeHandleNestedCrossDomainAuth");
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toThrowError(/does not match the requested refresh token ID/);
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toSatisfy((error) => !_hexclave_shared_dist_utils_errors.HexclaveSetupError.isSetupError(error));
+			}
+		} finally {
+			globalThis.window = previousWindow;
+			globalThis.document = previousDocument;
+		}
+	});
 	(0, vitest.it)("passes the construction-time URL to the nested cross-domain auth handler", async () => {
 		const projectId = "00000000-0000-4000-8000-000000000009";
 		const previousWindow = globalThis.window;
@@ -413,7 +529,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			globalThis.window.location.href = strippedUrl.toString();
 			await new Promise((resolve) => setTimeout(resolve, 0));
@@ -468,7 +585,8 @@ function createMockDocument() {
 				tokenStore: "memory",
 				redirectMethod: "window",
 				urls: { default: { type: "hosted" } },
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			await new Promise((resolve) => setTimeout(resolve, 0));
 			await new Promise((resolve) => setTimeout(resolve, 0));
@@ -497,7 +615,8 @@ function createMockDocument() {
 				handler: "/handler",
 				signOut: { type: "hosted" }
 			},
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const signOutSpy = vitest.vi.spyOn(clientApp, "signOut").mockRejectedValue(/* @__PURE__ */ new Error("INTENTIONAL_TEST_ABORT"));
 		try {
@@ -515,7 +634,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		(0, vitest.expect)(() => clientApp.urls.signIn).toThrowError(/app\.urls\.signIn cannot be used when this app is configured to use hosted components.*Use app\.redirectToSignIn\(\) instead/s);
 		(0, vitest.expect)(() => clientApp.urls.signOut).toThrowError(/app\.urls\.signOut cannot be used when this app is configured to use hosted components.*Use app\.redirectToSignOut\(\) instead/s);
@@ -529,7 +649,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { handler: "/custom-handler" },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		}).urls.signIn).toBe("/custom-handler/sign-in");
 	});
 	(0, vitest.it)("keeps default hosted signOut() on the source domain when afterSignOut is not configured", async () => {
@@ -540,7 +661,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const currentHref = "https://demo.stack-auth.com/settings?tab=profile";
 		const clientInterface = Reflect.get(clientApp, "_interface");
@@ -594,7 +716,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			windowMock.location.href = "https://demo.example.test/handler/mfa";
 			(0, vitest.expect)(await clientApp[______common_js.hexclaveAppInternalsSymbol].getRedirectToHandlerUrl("afterSignIn")).toBe("/music?track=1");
@@ -646,7 +769,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			const crossDomainAuthorizeRedirect = "https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state";
 			const createCrossDomainAuthRedirectUrlSpy = vitest.vi.spyOn(clientApp, "_createCrossDomainAuthRedirectUrl").mockResolvedValue(crossDomainAuthorizeRedirect);
@@ -672,7 +796,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "memory",
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const oldAccessToken = createAccessTokenString("old-refresh-token-id");
 		const refreshedOldAccessToken = createAccessTokenString("refreshed-old-refresh-token-id");

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-app-impl.cross-domain.test.js","names":["StackClientApp","hexclaveAppInternalsSymbol","AccessToken","Store","vi","expect"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { AccessToken } from \"@hexclave/shared/dist/sessions\";\nimport { Store } from \"@hexclave/shared/dist/utils/stores\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\nimport { planRedirectToHandler } from \"./redirect-page-urls\";\n\nfunction createAccessTokenString(refreshTokenId: string): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createMockDocument(): Document {\n  const cookieJar = new Map<string, string>();\n  return {\n    get cookie() {\n      return [...cookieJar.entries()].map(([key, value]) => `${key}=${value}`).join(\"; \");\n    },\n    set cookie(str: string) {\n      const [nameValue] = str.split(\";\");\n      const eqIndex = nameValue.indexOf(\"=\");\n      if (eqIndex < 0) return;\n      cookieJar.set(nameValue.slice(0, eqIndex).trim(), nameValue.slice(eqIndex + 1).trim());\n    },\n    createElement: () => ({}),\n  } as any;\n}\n\ndescribe(\"StackClientApp cross-domain auth\", () => {\n  it(\"keeps noRedirectBack same-domain redirects free of redirect-back state\", async () => {\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl: new URL(\"https://app.example.test/settings?tab=profile\"),\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Same-domain redirects must not create cross-domain handoff parameters.\");\n      },\n    });\n\n    expect(redirectPlan).toEqual({\n      type: \"redirect\",\n      url: \"/handler/sign-in\",\n    });\n  });\n\n  it(\"returns noRedirectBack cross-domain auth to the source app home\", async () => {\n    const handoffState = \"no-redirect-back-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(\"https://app.example.test/settings?tab=profile\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    currentUrl.searchParams.set(\n      \"hexclave_cross_domain_after_callback_redirect_url\",\n      \"https://app.example.test/settings?tab=profile\",\n    );\n\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"https://auth.example.test/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl,\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Existing cross-domain handoff parameters must be reused.\");\n      },\n    });\n\n    expect(redirectPlan.type).toBe(\"redirect\");\n    if (redirectPlan.type !== \"redirect\") {\n      throw new Error(\"Expected noRedirectBack sign-in to produce a redirect URL.\");\n    }\n\n    const hostedUrl = new URL(redirectPlan.url);\n    expect(hostedUrl.origin).toBe(\"https://auth.example.test\");\n    expect(hostedUrl.pathname).toBe(\"/handler/sign-in\");\n    expect(hostedUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n\n    const rawSourceCallbackUrl = hostedUrl.searchParams.get(\"after_auth_return_to\");\n    if (rawSourceCallbackUrl == null) {\n      throw new Error(\"Expected cross-domain noRedirectBack to include its internal source callback URL.\");\n    }\n    const sourceCallbackUrl = new URL(rawSourceCallbackUrl);\n    expect(sourceCallbackUrl.origin).toBe(\"https://app.example.test\");\n    expect(sourceCallbackUrl.pathname).toBe(\"/handler/oauth-callback\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_auth\")).toBe(\"1\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_state\")).toBe(handoffState);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(handoffCodeChallenge);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n    expect(sourceCallbackUrl.toString()).not.toContain(\"/settings\");\n  });\n\n  it(\"exposes redirect-back-aware handler URLs for devtool previews\", async () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    Reflect.set(globalThis, \"window\", {\n      location: {\n        href: \"http://localhost/music?track=1#song\",\n      },\n    });\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000000\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"none\",\n        urls: {\n          signIn: \"/handler/sign-in\",\n        },\n        noAutomaticPrefetch: true,\n      });\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"signIn\");\n\n      const resolved = new URL(redirectUrl, \"http://localhost\");\n      expect(resolved.pathname).toBe(\"/handler/sign-in\");\n      expect(resolved.searchParams.get(\"after_auth_return_to\")).toBe(\"/music?track=1#song\");\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"uses the fresh post-auth refresh token when minting a cross-domain handoff\", async () => {\n    const freshAccessToken = createAccessTokenString(\"fresh-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: {\n        accessToken: createAccessTokenString(\"stale-refresh-token-id\"),\n        refreshToken: \"stale-refresh-token\",\n      },\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSendClientRequest = Reflect.get(clientInterface, \"sendClientRequest\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const capturedRefreshTokens: string[] = [];\n    const capturedAccessTokenRefreshTokenIds: string[] = [];\n    const refreshedRawRefreshTokens: string[] = [];\n\n    Reflect.set(clientInterface, \"sendClientRequest\", async (_path: unknown, _requestOptions: unknown, session: unknown) => {\n      const getRefreshToken = Reflect.get(session ?? {}, \"getRefreshToken\");\n      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, \"getOrFetchLikelyValidTokens\");\n      if (typeof getRefreshToken !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session to the client interface.\");\n      }\n      if (typeof getOrFetchLikelyValidTokens !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session with token accessors.\");\n      }\n      const refreshToken = getRefreshToken.call(session);\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected cross-domain auth to pass a refresh-token-backed session.\");\n      }\n      capturedRefreshTokens.push(refreshTokenString);\n      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);\n      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);\n      return {\n        ok: true,\n        json: async () => ({ redirect_url: \"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\" }),\n      };\n    });\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected refresh token while fetching a new access token.\");\n      }\n      refreshedRawRefreshTokens.push(refreshTokenString);\n      return AccessToken.createIfValid(freshAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, \"_createCrossDomainAuthRedirectUrl\");\n      if (typeof createCrossDomainAuthRedirectUrl !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _createCrossDomainAuthRedirectUrl in tests.\");\n      }\n\n      await expect(createCrossDomainAuthRedirectUrl.call(clientApp, {\n        redirectUri: \"https://example.com/handler/oauth-callback\",\n        state: \"handoff-state\",\n        codeChallenge: \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\",\n        afterCallbackRedirectUrl: \"https://example.com/account-settings\",\n        overrideTokenStoreInit: {\n          accessToken: createAccessTokenString(\"fresh-stale-refresh-token-id\"),\n          refreshToken: \"fresh-refresh-token\",\n        },\n      })).resolves.toBe(\"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\");\n    } finally {\n      Reflect.set(clientInterface, \"sendClientRequest\", originalSendClientRequest);\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedAccessTokenRefreshTokenIds).toEqual([\"fresh-refresh-token-id\"]);\n  });\n\n  it(\"uses a fresh nested OAuth state while preserving the outer cross-domain return state\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000002\";\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const outerState = \"outer-cross-domain-state\";\n    const outerCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"after_auth_return_to\", `https://demo.stack-auth.com/?hexclave_cross_domain_auth=1&hexclave_cross_domain_state=${outerState}`);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", outerState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", outerCodeChallenge);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-session\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const redirectUrl = new URL(redirectedUrl);\n    expect(redirectUrl.searchParams.get(\"state\")).toBe(\"fresh-nested-state\");\n    expect(redirectUrl.searchParams.get(\"code_challenge\")).toBe(\"fresh-nested-code-challenge\");\n    const redirectUri = new URL(redirectUrl.searchParams.get(\"redirect_uri\") ?? \"\");\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_state\")).toBe(outerState);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(outerCodeChallenge);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\"https://demo.stack-auth.com/\");\n  });\n\n  it(\"clears a stale target-domain session before deferring to the source-domain session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000006\";\n    const hostedAccessToken = createAccessTokenString(\"hosted-old-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const tokenStore = Reflect.get(clientApp, \"_memoryTokenStore\");\n    if (!(tokenStore instanceof Store)) {\n      throw new Error(\"Expected StackClientApp to use a memory token store in this test.\");\n    }\n    tokenStore.set({\n      refreshToken: \"hosted-old-refresh-token\",\n      accessToken: hostedAccessToken,\n    });\n\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-anonymous-refresh-token-id\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/handler/oauth-callback\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", \"outer-state\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", \"outer-code-challenge\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/app\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(tokenStore.get()).toEqual({\n      refreshToken: null,\n      accessToken: null,\n    });\n    expect(new URL(redirectedUrl).origin).toBe(\"https://demo.stack-auth.com\");\n  });\n\n  it(\"uses the latest browser refresh cookie before computing nested cross-domain session IDs\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000007\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: \"https://demo.stack-auth.com/\",\n        protocol: \"https:\",\n        hostname: \"demo.stack-auth.com\",\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"cookie\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const refreshedRawRefreshTokens: string[] = [];\n\n    // Cookie-store writes queue a background trusted-parent-domain lookup. Without this stub, that\n    // lookup fetches the (unreachable) baseUrl with retries while holding the global store lock,\n    // which starves any later test that needs the write lock (e.g. signOut). Not restored on\n    // purpose: queued tasks can still run after this test body finishes.\n    vi.spyOn(clientApp as any, \"_getTrustedParentDomain\").mockResolvedValue(null);\n\n    try {\n      const getBrowserCookieTokenStore = Reflect.get(clientApp, \"_getBrowserCookieTokenStore\");\n      if (typeof getBrowserCookieTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.\");\n      }\n      const tokenStore = getBrowserCookieTokenStore.call(clientApp);\n      tokenStore.set({\n        refreshToken: \"old-refresh-token\",\n        accessToken: createAccessTokenString(\"old-refresh-token-id\"),\n      });\n\n      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({\n        refresh_token: \"new-refresh-token\",\n        updated_at_millis: 1,\n      })}`;\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n        const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n        if (typeof refreshTokenString !== \"string\") {\n          throw new Error(\"Expected refresh token while fetching a new access token.\");\n        }\n        refreshedRawRefreshTokens.push(refreshTokenString);\n        return AccessToken.createIfValid(createAccessTokenString(\"new-refresh-token-id\")) ?? (() => {\n          throw new Error(\"Expected test access token to be valid\");\n        })();\n      });\n\n      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\");\n      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.\");\n      }\n      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {\n        awaitPendingAuthResolutions: false,\n      })).resolves.toBe(\"new-refresh-token-id\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"new-refresh-token\"]);\n  });\n\n  it(\"does not re-bounce nested cross-domain auth after the OAuth callback consumed code+state from the URL\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000008\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const strippedUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n    const urlAtConstructionTime = new URL(strippedUrl);\n    urlAtConstructionTime.searchParams.set(\"code\", \"one-time-code\");\n    urlAtConstructionTime.searchParams.set(\"state\", \"nested-oauth-state\");\n\n    // Construct before installing the window mock so the constructor does not schedule its own\n    // nested-auth resolution; the assertions below drive the handler explicitly.\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      noAutomaticPrefetch: true,\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: strippedUrl.toString(),\n        replace: () => {\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    try {\n      // Without the construction-time URL, the handler re-bounces (location.replace aborts).\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      // With it, the in-flight OAuth callback wins and the handler stands down.\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime)).resolves.toBe(false);\n      // The live-URL guard must also stand down on its own when code+state are still present.\n      (globalThis.window as any).location.href = urlAtConstructionTime.toString();\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).resolves.toBe(false);\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"passes the construction-time URL to the nested cross-domain auth handler\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000009\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const callbackUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    callbackUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    callbackUrl.searchParams.set(\"code\", \"one-time-code\");\n    callbackUrl.searchParams.set(\"state\", \"nested-oauth-state\");\n    const strippedUrl = new URL(callbackUrl);\n    strippedUrl.searchParams.delete(\"code\");\n    strippedUrl.searchParams.delete(\"state\");\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: callbackUrl.toString(),\n      },\n    } as any;\n\n    const nestedAuthSpy = vi.spyOn(StackClientApp.prototype as any, \"_maybeHandleNestedCrossDomainAuth\").mockResolvedValue(false);\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n\n      // Simulate consumeOAuthCallbackQueryParams stripping code+state before microtasks run.\n      (globalThis.window as any).location.href = strippedUrl.toString();\n      await new Promise((resolve) => setTimeout(resolve, 0));\n\n      expect(nestedAuthSpy).toHaveBeenCalledTimes(1);\n      const urlArgument = nestedAuthSpy.mock.calls[0][0] as URL;\n      expect(urlArgument).toBeInstanceOf(URL);\n      expect(urlArgument.searchParams.get(\"code\")).toBe(\"one-time-code\");\n      expect(urlArgument.searchParams.get(\"state\")).toBe(\"nested-oauth-state\");\n    } finally {\n      nestedAuthSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"redirects hosted current-page OAuth callback errors to the hosted error handler during startup\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000010\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const callbackUrl = new URL(\"https://demo.stack-auth.com/dashboard\");\n    callbackUrl.searchParams.set(\"errorCode\", \"SIGN_UP_REJECTED\");\n    callbackUrl.searchParams.set(\"message\", \"Your sign up was rejected by an administrator's sign-up rule.\");\n    callbackUrl.searchParams.set(\"details\", JSON.stringify({\n      message: \"Your sign up was rejected by an administrator's sign-up rule.\",\n    }));\n    callbackUrl.searchParams.set(\"after_auth_return_to\", \"/dashboard\");\n    callbackUrl.searchParams.set(\"after_callback_redirect_url\", \"https://customer.example.test/settings?tab=connected-accounts\");\n    let currentHref = callbackUrl.toString();\n    let redirectedUrl = \"\";\n    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, \"_redirectTo\").mockImplementation(async (...args: unknown[]) => {\n      const options = args[0] as { url: string | URL };\n      redirectedUrl = options.url.toString();\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n        set href(value: string) {\n          currentHref = value;\n        },\n        origin: callbackUrl.origin,\n      },\n      history: {\n        replaceState: (_state: unknown, _title: string, url: string) => {\n          currentHref = new URL(url, currentHref).toString();\n        },\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        urls: {\n          default: { type: \"hosted\" },\n        },\n        noAutomaticPrefetch: true,\n      });\n\n      await new Promise((resolve) => setTimeout(resolve, 0));\n      await new Promise((resolve) => setTimeout(resolve, 0));\n    } finally {\n      redirectSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const errorUrl = new URL(redirectedUrl);\n    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);\n    expect(errorUrl.pathname).toBe(\"/handler/error\");\n    expect(errorUrl.searchParams.get(\"errorCode\")).toBe(\"SIGN_UP_REJECTED\");\n    expect(errorUrl.searchParams.get(\"message\")).toBe(\"Your sign up was rejected by an administrator's sign-up rule.\");\n    expect(errorUrl.searchParams.get(\"after_auth_return_to\")).toBe(\"/dashboard\");\n    expect(errorUrl.searchParams.get(\"after_callback_redirect_url\")).toBe(\"https://customer.example.test/settings?tab=connected-accounts\");\n    expect(new URL(currentHref).searchParams.has(\"errorCode\")).toBe(false);\n  });\n\n  it(\"uses direct sign-out instead of hosted sign-out redirects when code execution is available\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/handler\",\n        signOut: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const signOutSpy = vi.spyOn(clientApp, \"signOut\").mockRejectedValue(new Error(\"INTENTIONAL_TEST_ABORT\"));\n\n    try {\n      await expect(clientApp.redirectToSignOut()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      expect(signOutSpy).toHaveBeenCalledWith();\n    } finally {\n      signOutSpy.mockRestore();\n    }\n  });\n\n  it(\"throws when public app.urls reads would return hosted component URLs\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n\n    expect(() => clientApp.urls.signIn).toThrowError(/app\\.urls\\.signIn cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignIn\\(\\) instead/s);\n    expect(() => clientApp.urls.signOut).toThrowError(/app\\.urls\\.signOut cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignOut\\(\\) instead/s);\n    expect(clientApp.urls.afterSignIn).toBe(\"/\");\n  });\n\n  it(\"keeps public app.urls reads available for non-hosted targets\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/custom-handler\",\n      },\n      noAutomaticPrefetch: true,\n    });\n\n    expect(clientApp.urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"keeps default hosted signOut() on the source domain when afterSignOut is not configured\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000004\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n    });\n    const currentHref = \"https://demo.stack-auth.com/settings?tab=profile\";\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSignOut = Reflect.get(clientInterface, \"signOut\");\n    Reflect.set(clientInterface, \"signOut\", async () => {});\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentHref,\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      const signOut = Reflect.get(clientApp, \"_signOut\");\n      if (typeof signOut !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _signOut in tests.\");\n      }\n      await expect(signOut.call(clientApp, Reflect.get(clientInterface, \"createSession\").call(clientInterface, {\n        refreshToken: null,\n      }))).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"signOut\", originalSignOut);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(redirectedUrl).toBe(\"/settings?tab=profile\");\n  });\n\n  it(\"restores a dropped after_auth_return_to from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n    const windowMock = {\n      location: {\n        href: \"https://demo.example.test/handler/sign-in?after_auth_return_to=%2Fmusic%3Ftrack%3D1\",\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      // The constructor mirrors the redirect-back state from the arrival URL into sessionStorage.\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000011\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n\n      // Intermediate hops (MFA, magic link, OAuth round-trips, ...) dropped the query params.\n      windowMock.location.href = \"https://demo.example.test/handler/mfa\";\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n      expect(redirectUrl).toBe(\"/music?track=1\");\n\n      // noRedirectBack opts out of the mirror just like it opts out of the query param.\n      const noRedirectBackUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\", { noRedirectBack: true });\n      expect(new URL(noRedirectBackUrl, \"https://demo.example.test\").pathname).toBe(\"/\");\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"restores dropped cross-domain handoff state from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n\n    const handoffState = \"mirror-handoff-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const handoffAfterCallbackRedirect = \"https://demo.example.test/dashboard\";\n    const redirectBackUrl = new URL(\"https://demo.example.test/handler/oauth-callback\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_auth\", \"1\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);\n    arrivalUrl.searchParams.set(\"after_auth_return_to\", redirectBackUrl.toString());\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const previousDocument = globalThis.document;\n    const windowMock = {\n      location: {\n        href: arrivalUrl.toString(),\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n      });\n      const crossDomainAuthorizeRedirect = \"https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state\";\n      const createCrossDomainAuthRedirectUrlSpy = vi\n        .spyOn(clientApp as any, \"_createCrossDomainAuthRedirectUrl\")\n        .mockResolvedValue(crossDomainAuthorizeRedirect);\n\n      // All redirect-back query params were dropped before the after-sign-in redirect.\n      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n\n      expect(createCrossDomainAuthRedirectUrlSpy).toHaveBeenCalledWith(expect.objectContaining({\n        redirectUri: redirectBackUrl.toString(),\n        state: handoffState,\n        codeChallenge: handoffCodeChallenge,\n        afterCallbackRedirectUrl: handoffAfterCallbackRedirect,\n      }));\n      expect(redirectUrl).toBe(crossDomainAuthorizeRedirect);\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"ignores stale session callbacks after a newer refresh token owns the token store\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000005\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n    });\n    const oldAccessToken = createAccessTokenString(\"old-refresh-token-id\");\n    const refreshedOldAccessToken = createAccessTokenString(\"refreshed-old-refresh-token-id\");\n    const newAccessToken = createAccessTokenString(\"new-refresh-token-id\");\n    const tokenStore = new Store({\n      refreshToken: \"old-refresh-token\",\n      accessToken: oldAccessToken,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const getSessionFromTokenStore = Reflect.get(clientApp, \"_getSessionFromTokenStore\");\n      if (typeof getSessionFromTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getSessionFromTokenStore in tests.\");\n      }\n      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);\n      tokenStore.set({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      await oldSession.fetchNewTokens();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      oldSession.markInvalid();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n  });\n});\n"],"mappings":";;;;;;;AAWA,SAAS,wBAAwB,gBAAgC;CAC/D,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,qBAA+B;CACtC,MAAM,4BAAY,IAAI,IAAoB;CAC1C,OAAO;EACL,IAAI,SAAS;GACX,OAAO,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;EACpF;EACA,IAAI,OAAO,KAAa;GACtB,MAAM,CAAC,aAAa,IAAI,MAAM,GAAG;GACjC,MAAM,UAAU,UAAU,QAAQ,GAAG;GACrC,IAAI,UAAU,GAAG;GACjB,UAAU,IAAI,UAAU,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACvF;EACA,sBAAsB,CAAC;CACzB;AACF;qBAES,0CAA0C;CACjD,CAAA,GAAA,OAAA,GAAA,CAAG,0EAA0E,YAAY;EAavF,CAAA,GAAA,OAAA,OAAA,CAAO,OAAA,GAAA,wBAAA,sBAAA,CAZ0C;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY,IAAI,IAAI,+CAA+C;GACnE,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,wEAAwE;GAC1F;EACF,CAAC,CAEkB,CAAC,CAAC,QAAQ;GAC3B,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,mEAAmE,YAAY;EAChF,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,aAAa,IAAI,IAAI,+CAA+C;EAC1E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IACtB,qDACA,+CACF;EAEA,MAAM,eAAe,OAAA,GAAA,wBAAA,sBAAA,CAA4B;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB;GACA,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,0DAA0D;GAC5E;EACF,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,IAAI,CAAC,CAAC,KAAK,UAAU;EACzC,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,YAAY,IAAI,IAAI,aAAa,GAAG;EAC1C,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,MAAM,CAAC,CAAC,KAAK,2BAA2B;EACzD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,QAAQ,CAAC,CAAC,KAAK,kBAAkB;EAClD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KACtF,+BACF;EAEA,MAAM,uBAAuB,UAAU,aAAa,IAAI,sBAAsB;EAC9E,IAAI,wBAAwB,MAC1B,MAAM,IAAI,MAAM,mFAAmF;EAErG,MAAM,oBAAoB,IAAI,IAAI,oBAAoB;EACtD,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK,0BAA0B;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,QAAQ,CAAC,CAAC,KAAK,yBAAyB;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,4BAA4B,CAAC,CAAC,CAAC,KAAK,GAAG;EACjF,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3F,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,oBAAoB;EAC5G,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAC9F,+BACF;EACA,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,WAAW;CAChE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iEAAiE,YAAY;EAC9E,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,QAAQ,IAAI,YAAY,UAAU,EAChC,UAAU,EACR,MAAM,sCACR,EACF,CAAC;EAED,IAAI;GAaF,MAAM,cAAc,MAAM,IAZJA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,QAAQ,mBACV;IACA,qBAAqB;GACvB,CAEkC,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,wBAAwB,QAAQ;GAEhG,MAAM,WAAW,IAAI,IAAI,aAAa,kBAAkB;GACxD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,kBAAkB;GACjD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,qBAAqB;EACtF,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E,YAAY;EAC3F,MAAM,mBAAmB,wBAAwB,wBAAwB;EACzE,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;IACV,aAAa,wBAAwB,wBAAwB;IAC7D,cAAc;GAChB;GACA,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EAED,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,4BAA4B,QAAQ,IAAI,iBAAiB,mBAAmB;EAClF,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,wBAAkC,CAAC;EACzC,MAAM,qCAA+C,CAAC;EACtD,MAAM,4BAAsC,CAAC;EAE7C,QAAQ,IAAI,iBAAiB,qBAAqB,OAAO,OAAgB,iBAA0B,YAAqB;GACtH,MAAM,kBAAkB,QAAQ,IAAI,WAAW,CAAC,GAAG,iBAAiB;GACpE,MAAM,8BAA8B,QAAQ,IAAI,WAAW,CAAC,GAAG,6BAA6B;GAC5F,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,MAAM,uEAAuE;GAEzF,IAAI,OAAO,gCAAgC,YACzC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,MAAM,eAAe,gBAAgB,KAAK,OAAO;GACjD,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,sBAAsB,KAAK,kBAAkB;GAC7C,MAAM,SAAS,MAAM,4BAA4B,KAAK,SAAS,GAAG,IAAI;GACtE,mCAAmC,KAAK,OAAO,YAAY,QAAQ,gBAAgB;GACnF,OAAO;IACL,IAAI;IACJ,MAAM,aAAa,EAAE,cAAc,mFAAmF;GACxH;EACF,CAAC;EACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;GACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,0BAA0B,KAAK,kBAAkB;GACjD,OAAOE,+BAAAA,YAAY,cAAc,gBAAgB,YAAY;IAC3D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,mCAAmC,QAAQ,IAAI,WAAW,mCAAmC;GACnG,IAAI,OAAO,qCAAqC,YAC9C,MAAM,IAAI,MAAM,+EAA+E;GAGjG,OAAA,GAAA,OAAA,OAAA,CAAa,iCAAiC,KAAK,WAAW;IAC5D,aAAa;IACb,OAAO;IACP,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;KACtB,aAAa,wBAAwB,8BAA8B;KACnE,cAAc;IAChB;GACF,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,kFAAkF;EACtG,UAAU;GACR,QAAQ,IAAI,iBAAiB,qBAAqB,yBAAyB;GAC3E,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,qBAAqB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EAC7D,CAAA,GAAA,OAAA,OAAA,CAAO,kCAAkC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,wFAAwF,YAAY;EACrG,MAAM,YAAY;EAClB,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,qBAAqB;EAC3B,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,wBAAwB,yFAAyF,YAAY;EACzJ,WAAW,aAAa,IAAI,+BAA+B,UAAU;EACrE,WAAW,aAAa,IAAI,wCAAwC,kBAAkB;EACtF,WAAW,aAAa,IAAI,qDAAqD,8BAA8B;EAC/G,WAAW,aAAa,IAAI,mDAAmD,gBAAgB;EAC/F,WAAW,aAAa,IAAI,+CAA+C,8BAA8B;EAEzG,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa;EACzC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACvE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,6BAA6B;EACzF,MAAM,cAAc,IAAI,IAAI,YAAY,aAAa,IAAI,cAAc,KAAK,EAAE;EAC9E,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,UAAU;EACnF,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACpG,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAAK,8BAA8B;CAC/H,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sFAAsF,YAAY;EACnG,MAAM,YAAY;EAClB,MAAM,oBAAoB,wBAAwB,6BAA6B;EAC/E,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAa,QAAQ,IAAI,WAAW,mBAAmB;EAC7D,IAAI,EAAE,sBAAsBG,mCAAAA,QAC1B,MAAM,IAAI,MAAM,mEAAmE;EAErF,WAAW,IAAI;GACb,cAAc;GACd,aAAa;EACf,CAAC;EAED,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,mDAAmD,mCAAmC;EAClH,WAAW,aAAa,IAAI,+CAA+C,oDAAoD;EAC/H,WAAW,aAAa,IAAI,+BAA+B,aAAa;EACxE,WAAW,aAAa,IAAI,wCAAwC,sBAAsB;EAC1F,WAAW,aAAa,IAAI,qDAAqD,iCAAiC;EAElH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,iBAAiB,YAAY;IAC5D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;GAC/B,cAAc;GACd,aAAa;EACf,CAAC;EACD,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,6BAA6B;CAC1E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,MAAM;IACN,UAAU;IACV,UAAU;GACZ;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,4BAAsC,CAAC;EAM7C,OAAA,GAAG,MAAM,WAAkB,yBAAyB,CAAC,CAAC,kBAAkB,IAAI;EAE5E,IAAI;GACF,MAAM,6BAA6B,QAAQ,IAAI,WAAW,6BAA6B;GACvF,IAAI,OAAO,+BAA+B,YACxC,MAAM,IAAI,MAAM,yEAAyE;GAG3F,2BAD8C,KAAK,SAC1C,CAAC,CAAC,IAAI;IACb,cAAc;IACd,aAAa,wBAAwB,sBAAsB;GAC7D,CAAC;GAED,SAAS,SAAS,2BAA2B,UAAU,YAAY,KAAK,UAAU;IAChF,eAAe;IACf,mBAAmB;GACrB,CAAC;GACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;IACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;IAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;IAE7E,0BAA0B,KAAK,kBAAkB;IACjD,OAAOE,+BAAAA,YAAY,cAAc,wBAAwB,sBAAsB,CAAC,YAAY;KAC1F,MAAM,IAAI,MAAM,wCAAwC;IAC1D,EAAA,CAAG;GACL,CAAC;GAED,MAAM,uCAAuC,QAAQ,IAAI,WAAW,uCAAuC;GAC3G,IAAI,OAAO,yCAAyC,YAClD,MAAM,IAAI,MAAM,mFAAmF;GAErG,OAAA,GAAA,OAAA,OAAA,CAAa,qCAAqC,KAAK,WAAW,EAChE,6BAA6B,MAC/B,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB;EAC1C,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,+CAA+C,8BAA8B;EAC1G,MAAM,wBAAwB,IAAI,IAAI,WAAW;EACjD,sBAAsB,aAAa,IAAI,QAAQ,eAAe;EAC9D,sBAAsB,aAAa,IAAI,SAAS,oBAAoB;EAIpE,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,YAAY,SAAS;GAC3B,eAAe;IACb,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,IAAI;GAEF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GAElH,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,qBAAqB,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;GAE7G,WAAY,OAAe,SAAS,OAAO,sBAAsB,SAAS;GAC1E,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;EAC1F,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4EAA4E,YAAY;EACzF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,QAAQ,eAAe;EACpD,YAAY,aAAa,IAAI,SAAS,oBAAoB;EAC1D,MAAM,cAAc,IAAI,IAAI,WAAW;EACvC,YAAY,aAAa,OAAO,MAAM;EACtC,YAAY,aAAa,OAAO,OAAO;EAEvC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU,EACR,MAAM,YAAY,SAAS,EAC7B,EACF;EAEA,MAAM,gBAAgBI,OAAAA,GAAG,MAAMJ,4BAAAA,eAAe,WAAkB,mCAAmC,CAAC,CAAC,kBAAkB,KAAK;EAE5H,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GAGD,WAAY,OAAe,SAAS,OAAO,YAAY,SAAS;GAChE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GAErD,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,sBAAsB,CAAC;GAC7C,MAAM,cAAc,cAAc,KAAK,MAAM,EAAE,CAAC;GAChD,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,eAAe,GAAG;GACtC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;GACjE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACzE,UAAU;GACR,cAAc,YAAY;GAC1B,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kGAAkG,YAAY;EAC/G,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,cAAc,IAAI,IAAI,uCAAuC;EACnE,YAAY,aAAa,IAAI,aAAa,kBAAkB;EAC5D,YAAY,aAAa,IAAI,WAAW,+DAA+D;EACvG,YAAY,aAAa,IAAI,WAAW,KAAK,UAAU,EACrD,SAAS,gEACX,CAAC,CAAC;EACF,YAAY,aAAa,IAAI,wBAAwB,YAAY;EACjE,YAAY,aAAa,IAAI,+BAA+B,+DAA+D;EAC3H,IAAI,cAAc,YAAY,SAAS;EACvC,IAAI,gBAAgB;EACpB,MAAM,cAAcI,OAAAA,GAAG,MAAMJ,4BAAAA,eAAe,WAAkB,aAAa,CAAC,CAAC,mBAAmB,OAAO,GAAG,SAAoB;GAE5H,gBADgB,KAAK,EACE,CAAC,IAAI,SAAS;EACvC,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,IAAI,OAAO;KACT,OAAO;IACT;IACA,IAAI,KAAK,OAAe;KACtB,cAAc;IAChB;IACA,QAAQ,YAAY;GACtB;GACA,SAAS,EACP,eAAe,QAAiB,QAAgB,QAAgB;IAC9D,cAAc,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,SAAS;GACnD,EACF;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;IACA,qBAAqB;GACvB,CAAC;GAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GACrD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;EACvD,UAAU;GACR,YAAY,YAAY;GACxB,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,WAAW,IAAI,IAAI,aAAa;EACtC,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,MAAM,CAAC,CAAC,KAAK,WAAW,UAAU,yBAAyB;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,gBAAgB;EAC/C,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACtE,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACjH,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,WAAW,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK;CACvE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8FAA8F,YAAY;EAC3G,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM;IACJ,SAAS;IACT,SAAS,EAAE,MAAM,SAAS;GAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,aAAaI,OAAAA,GAAG,MAAM,WAAW,SAAS,CAAC,CAAC,kCAAkB,IAAI,MAAM,wBAAwB,CAAC;EAEvG,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAa,UAAU,kBAAkB,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GACzF,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,CAAC,CAAC,qBAAqB;EAC1C,UAAU;GACR,WAAW,YAAY;EACzB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E;EAC/E,MAAM,YAAY,IAAIJ,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,MAAM,CAAC,CAAC,aAAa,+HAA+H;EAChL,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,OAAO,CAAC,CAAC,aAAa,iIAAiI;EACnL,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,KAAK,WAAW,CAAC,CAAC,KAAK,GAAG;CAC7C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE;EAavE,CAAA,GAAA,OAAA,OAAA,CAAO,IAZeA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,kBACX;GACA,qBAAqB;EACvB,CAEe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,yBAAyB;CAC9D,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;EACvB,CAAC;EACD,MAAM,cAAc;EAEpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,kBAAkB,QAAQ,IAAI,iBAAiB,SAAS;EAC9D,QAAQ,IAAI,iBAAiB,WAAW,YAAY,CAAC,CAAC;EACtD,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EAEpB,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM;GACN,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,UAAU,QAAQ,IAAI,WAAW,UAAU;GACjD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,sDAAsD;GAExE,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,KAAK,WAAW,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CAAC,KAAK,iBAAiB,EACvG,cAAc,KAChB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpD,UAAU;GACR,QAAQ,IAAI,iBAAiB,WAAW,eAAe;GACvD,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,uBAAuB;CACpD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAClD,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,sFACR;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GAEF,MAAM,YAAY,IAAIA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GAGD,WAAW,SAAS,OAAO;GAG3B,CAAA,GAAA,OAAA,OAAA,CAAO,MADmB,UAAUC,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa,CACnF,CAAC,CAAC,KAAK,gBAAgB;GAGzC,MAAM,oBAAoB,MAAM,UAAUA,gBAAAA,2BAA2B,CAAC,wBAAwB,eAAe,EAAE,gBAAgB,KAAK,CAAC;GACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,mBAAmB,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG;EACnF,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6GAA6G,YAAY;EAC1H,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAElD,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,+BAA+B;EACrC,MAAM,kBAAkB,IAAI,IAAI,kDAAkD;EAClF,gBAAgB,aAAa,IAAI,8BAA8B,GAAG;EAClE,gBAAgB,aAAa,IAAI,+BAA+B,YAAY;EAC5E,gBAAgB,aAAa,IAAI,wCAAwC,oBAAoB;EAC7F,gBAAgB,aAAa,IAAI,qDAAqD,4BAA4B;EAElH,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,yCAAyC;EACzF,WAAW,aAAa,IAAI,wBAAwB,gBAAgB,SAAS,CAAC;EAC9E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IAAI,qDAAqD,4BAA4B;EAE7G,MAAM,mBAAmB,WAAW;EACpC,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,WAAW,SAAS,EAC5B;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GACF,MAAM,YAAY,IAAID,4BAAAA,eAAe;IACnC,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;GACvB,CAAC;GACD,MAAM,+BAA+B;GACrC,MAAM,sCAAsCI,OAAAA,GACzC,MAAM,WAAkB,mCAAmC,CAAC,CAC5D,kBAAkB,4BAA4B;GAGjD,WAAW,SAAS,OAAO,WAAW,UAAU;GAEhD,MAAM,cAAc,MAAM,UAAUH,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa;GAErG,CAAA,GAAA,OAAA,OAAA,CAAO,mCAAmC,CAAC,CAAC,qBAAqBI,OAAAA,OAAO,iBAAiB;IACvF,aAAa,gBAAgB,SAAS;IACtC,OAAO;IACP,eAAe;IACf,0BAA0B;GAC5B,CAAC,CAAC;GACF,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,KAAK,4BAA4B;EACvD,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oFAAoF,YAAY;EACjG,MAAM,YAAY,IAAIL,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;EACvB,CAAC;EACD,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,0BAA0B,wBAAwB,gCAAgC;EACxF,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,aAAa,IAAIG,mCAAAA,MAAM;GAC3B,cAAc;GACd,aAAa;EACf,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,uBAAuB,YAAY;IAClE,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,2BAA2B,QAAQ,IAAI,WAAW,2BAA2B;GACnF,IAAI,OAAO,6BAA6B,YACtC,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,aAAa,yBAAyB,KAAK,WAAW,UAAU;GACtE,WAAW,IAAI;IACb,cAAc;IACd,aAAa;GACf,CAAC;GAED,MAAM,WAAW,eAAe;GAChC,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;GAED,WAAW,YAAY;GACvB,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;EACH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"client-app-impl.cross-domain.test.js","names":["StackClientApp","hexclaveAppInternalsSymbol","AccessToken","Store","HexclaveSetupError","vi","expect"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { AccessToken } from \"@hexclave/shared/dist/sessions\";\nimport { HexclaveSetupError } from \"@hexclave/shared/dist/utils/errors\";\nimport { Store } from \"@hexclave/shared/dist/utils/stores\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\nimport { planRedirectToHandler } from \"./redirect-page-urls\";\n\n// Every app in this file is constructed with `devTool: false`. The tests install a mock window and document, which makes\n// the SDK believe it is in a browser, and mounting the dev tool kicks off a background `getProject()` against a backend\n// that does not exist here. That fetch never settles, and because it runs inside the global store lock, it blocks every\n// later `withWriteLock` caller (`_signOut`, most visibly) for the rest of the test file.\nfunction createAccessTokenString(refreshTokenId: string): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createMockDocument(): Document {\n  const cookieJar = new Map<string, string>();\n  return {\n    get cookie() {\n      return [...cookieJar.entries()].map(([key, value]) => `${key}=${value}`).join(\"; \");\n    },\n    set cookie(str: string) {\n      const [nameValue] = str.split(\";\");\n      const eqIndex = nameValue.indexOf(\"=\");\n      if (eqIndex < 0) return;\n      cookieJar.set(nameValue.slice(0, eqIndex).trim(), nameValue.slice(eqIndex + 1).trim());\n    },\n    createElement: () => ({}),\n  } as any;\n}\n\n/**\n * Installs a stand-in for `window` with only the parts the code under test touches. `globalThis.window` is typed as a\n * full `Window`, which a hand-written stub can never be, so the assignment goes through `Reflect.set` — the stub's own\n * shape stays checked, unlike with a cast on the object literal.\n */\nfunction setMockWindow(mockWindow: {\n  location: { href: string, replace?: (url: string) => void },\n}): void {\n  Reflect.set(globalThis, \"window\", mockWindow);\n}\n\n/**\n * Calls one of the app's `protected` methods, which are part of the flows under test but not of the public SDK surface.\n */\nfunction callProtectedMethod(app: StackClientApp<true>, methodName: string, ...args: unknown[]): Promise<unknown> {\n  const method = Reflect.get(app, methodName);\n  if (typeof method !== \"function\") {\n    throw new Error(`Expected StackClientApp to have a ${methodName} method in tests.`);\n  }\n  return method.apply(app, args);\n}\n\ndescribe(\"StackClientApp cross-domain auth\", () => {\n  it(\"keeps noRedirectBack same-domain redirects free of redirect-back state\", async () => {\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl: new URL(\"https://app.example.test/settings?tab=profile\"),\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Same-domain redirects must not create cross-domain handoff parameters.\");\n      },\n    });\n\n    expect(redirectPlan).toEqual({\n      type: \"redirect\",\n      url: \"/handler/sign-in\",\n    });\n  });\n\n  it(\"returns noRedirectBack cross-domain auth to the source app home\", async () => {\n    const handoffState = \"no-redirect-back-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(\"https://app.example.test/settings?tab=profile\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    currentUrl.searchParams.set(\n      \"hexclave_cross_domain_after_callback_redirect_url\",\n      \"https://app.example.test/settings?tab=profile\",\n    );\n\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"https://auth.example.test/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl,\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Existing cross-domain handoff parameters must be reused.\");\n      },\n    });\n\n    expect(redirectPlan.type).toBe(\"redirect\");\n    if (redirectPlan.type !== \"redirect\") {\n      throw new Error(\"Expected noRedirectBack sign-in to produce a redirect URL.\");\n    }\n\n    const hostedUrl = new URL(redirectPlan.url);\n    expect(hostedUrl.origin).toBe(\"https://auth.example.test\");\n    expect(hostedUrl.pathname).toBe(\"/handler/sign-in\");\n    expect(hostedUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n\n    const rawSourceCallbackUrl = hostedUrl.searchParams.get(\"after_auth_return_to\");\n    if (rawSourceCallbackUrl == null) {\n      throw new Error(\"Expected cross-domain noRedirectBack to include its internal source callback URL.\");\n    }\n    const sourceCallbackUrl = new URL(rawSourceCallbackUrl);\n    expect(sourceCallbackUrl.origin).toBe(\"https://app.example.test\");\n    expect(sourceCallbackUrl.pathname).toBe(\"/handler/oauth-callback\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_auth\")).toBe(\"1\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_state\")).toBe(handoffState);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(handoffCodeChallenge);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n    expect(sourceCallbackUrl.toString()).not.toContain(\"/settings\");\n  });\n\n  it(\"exposes redirect-back-aware handler URLs for devtool previews\", async () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    Reflect.set(globalThis, \"window\", {\n      location: {\n        href: \"http://localhost/music?track=1#song\",\n      },\n    });\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000000\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"none\",\n        urls: {\n          signIn: \"/handler/sign-in\",\n        },\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"signIn\");\n\n      const resolved = new URL(redirectUrl, \"http://localhost\");\n      expect(resolved.pathname).toBe(\"/handler/sign-in\");\n      expect(resolved.searchParams.get(\"after_auth_return_to\")).toBe(\"/music?track=1#song\");\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"uses the fresh post-auth refresh token when minting a cross-domain handoff\", async () => {\n    const freshAccessToken = createAccessTokenString(\"fresh-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: {\n        accessToken: createAccessTokenString(\"stale-refresh-token-id\"),\n        refreshToken: \"stale-refresh-token\",\n      },\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSendClientRequest = Reflect.get(clientInterface, \"sendClientRequest\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const capturedRefreshTokens: string[] = [];\n    const capturedAccessTokenRefreshTokenIds: string[] = [];\n    const refreshedRawRefreshTokens: string[] = [];\n\n    Reflect.set(clientInterface, \"sendClientRequest\", async (_path: unknown, _requestOptions: unknown, session: unknown) => {\n      const getRefreshToken = Reflect.get(session ?? {}, \"getRefreshToken\");\n      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, \"getOrFetchLikelyValidTokens\");\n      if (typeof getRefreshToken !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session to the client interface.\");\n      }\n      if (typeof getOrFetchLikelyValidTokens !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session with token accessors.\");\n      }\n      const refreshToken = getRefreshToken.call(session);\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected cross-domain auth to pass a refresh-token-backed session.\");\n      }\n      capturedRefreshTokens.push(refreshTokenString);\n      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);\n      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);\n      return {\n        ok: true,\n        json: async () => ({ redirect_url: \"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\" }),\n      };\n    });\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected refresh token while fetching a new access token.\");\n      }\n      refreshedRawRefreshTokens.push(refreshTokenString);\n      return AccessToken.createIfValid(freshAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, \"_createCrossDomainAuthRedirectUrl\");\n      if (typeof createCrossDomainAuthRedirectUrl !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _createCrossDomainAuthRedirectUrl in tests.\");\n      }\n\n      await expect(createCrossDomainAuthRedirectUrl.call(clientApp, {\n        redirectUri: \"https://example.com/handler/oauth-callback\",\n        state: \"handoff-state\",\n        codeChallenge: \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\",\n        afterCallbackRedirectUrl: \"https://example.com/account-settings\",\n        overrideTokenStoreInit: {\n          accessToken: createAccessTokenString(\"fresh-stale-refresh-token-id\"),\n          refreshToken: \"fresh-refresh-token\",\n        },\n      })).resolves.toBe(\"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\");\n    } finally {\n      Reflect.set(clientInterface, \"sendClientRequest\", originalSendClientRequest);\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedAccessTokenRefreshTokenIds).toEqual([\"fresh-refresh-token-id\"]);\n  });\n\n  it(\"uses a fresh nested OAuth state while preserving the outer cross-domain return state\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000002\";\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const outerState = \"outer-cross-domain-state\";\n    const outerCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"after_auth_return_to\", `https://demo.stack-auth.com/?hexclave_cross_domain_auth=1&hexclave_cross_domain_state=${outerState}`);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", outerState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", outerCodeChallenge);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-session\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const redirectUrl = new URL(redirectedUrl);\n    expect(redirectUrl.searchParams.get(\"state\")).toBe(\"fresh-nested-state\");\n    expect(redirectUrl.searchParams.get(\"code_challenge\")).toBe(\"fresh-nested-code-challenge\");\n    const redirectUri = new URL(redirectUrl.searchParams.get(\"redirect_uri\") ?? \"\");\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_state\")).toBe(outerState);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(outerCodeChallenge);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\"https://demo.stack-auth.com/\");\n  });\n\n  it(\"clears a stale target-domain session before deferring to the source-domain session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000006\";\n    const hostedAccessToken = createAccessTokenString(\"hosted-old-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const tokenStore = Reflect.get(clientApp, \"_memoryTokenStore\");\n    if (!(tokenStore instanceof Store)) {\n      throw new Error(\"Expected StackClientApp to use a memory token store in this test.\");\n    }\n    tokenStore.set({\n      refreshToken: \"hosted-old-refresh-token\",\n      accessToken: hostedAccessToken,\n    });\n\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-anonymous-refresh-token-id\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/handler/oauth-callback\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", \"outer-state\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", \"outer-code-challenge\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/app\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(tokenStore.get()).toEqual({\n      refreshToken: null,\n      accessToken: null,\n    });\n    expect(new URL(redirectedUrl).origin).toBe(\"https://demo.stack-auth.com\");\n  });\n\n  it(\"uses the latest browser refresh cookie before computing nested cross-domain session IDs\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000007\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: \"https://demo.stack-auth.com/\",\n        protocol: \"https:\",\n        hostname: \"demo.stack-auth.com\",\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"cookie\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const refreshedRawRefreshTokens: string[] = [];\n\n    // Cookie-store writes queue a background trusted-parent-domain lookup. Without this stub, that\n    // lookup fetches the (unreachable) baseUrl with retries while holding the global store lock,\n    // which starves any later test that needs the write lock (e.g. signOut). Not restored on\n    // purpose: queued tasks can still run after this test body finishes.\n    vi.spyOn(clientApp as any, \"_getTrustedParentDomain\").mockResolvedValue(null);\n\n    try {\n      const getBrowserCookieTokenStore = Reflect.get(clientApp, \"_getBrowserCookieTokenStore\");\n      if (typeof getBrowserCookieTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.\");\n      }\n      const tokenStore = getBrowserCookieTokenStore.call(clientApp);\n      tokenStore.set({\n        refreshToken: \"old-refresh-token\",\n        accessToken: createAccessTokenString(\"old-refresh-token-id\"),\n      });\n\n      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({\n        refresh_token: \"new-refresh-token\",\n        updated_at_millis: 1,\n      })}`;\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n        const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n        if (typeof refreshTokenString !== \"string\") {\n          throw new Error(\"Expected refresh token while fetching a new access token.\");\n        }\n        refreshedRawRefreshTokens.push(refreshTokenString);\n        return AccessToken.createIfValid(createAccessTokenString(\"new-refresh-token-id\")) ?? (() => {\n          throw new Error(\"Expected test access token to be valid\");\n        })();\n      });\n\n      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\");\n      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.\");\n      }\n      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {\n        awaitPendingAuthResolutions: false,\n      })).resolves.toBe(\"new-refresh-token-id\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"new-refresh-token\"]);\n  });\n\n  it(\"does not re-bounce nested cross-domain auth after the OAuth callback consumed code+state from the URL\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000008\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const strippedUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n    const urlAtConstructionTime = new URL(strippedUrl);\n    urlAtConstructionTime.searchParams.set(\"code\", \"one-time-code\");\n    urlAtConstructionTime.searchParams.set(\"state\", \"nested-oauth-state\");\n\n    // Construct before installing the window mock so the constructor does not schedule its own\n    // nested-auth resolution; the assertions below drive the handler explicitly.\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: strippedUrl.toString(),\n        replace: () => {\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    try {\n      // Without the construction-time URL, the handler re-bounces (location.replace aborts).\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      // With it, the in-flight OAuth callback wins and the handler stands down.\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime)).resolves.toBe(false);\n      // The live-URL guard must also stand down on its own when code+state are still present.\n      (globalThis.window as any).location.href = urlAtConstructionTime.toString();\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).resolves.toBe(false);\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"reports malformed nested cross-domain auth URLs as setup errors\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    globalThis.document = createMockDocument();\n\n    // A URL the flow cannot even parse is as fatal as an untrusted one, so it has to reach the developer the same way\n    // instead of escaping as a bare TypeError from `new URL()`, which the overlay only shows during development.\n    // The two branches of the handler want opposite session states: on the provider side (a.com) a query-derived failure\n    // only becomes a setup error when the handoff belongs to the current session, while the requesting side (b.com) only\n    // bounces when the current session is *not* the one that was asked for.\n    const malformedCases = [\n      {\n        description: \"redirect URI\",\n        currentRefreshTokenId: \"source-refresh-token-id\",\n        params: { redirect_uri: \"not-a-url\", state: \"nested-state\", code_challenge: \"nested-code-challenge\" },\n      },\n      {\n        description: \"after-callback redirect URL\",\n        currentRefreshTokenId: \"source-refresh-token-id\",\n        params: {\n          redirect_uri: \"https://source.example.test/handler/account-settings\",\n          state: \"nested-state\",\n          code_challenge: \"nested-code-challenge\",\n          after_callback_redirect_url: \"http://[\",\n        },\n      },\n      {\n        description: \"callback URL\",\n        currentRefreshTokenId: null,\n        params: { stack_nested_cross_domain_auth_callback_url: \"http://[\" },\n      },\n    ];\n\n    try {\n      for (const malformedCase of malformedCases) {\n        const currentUrl = new URL(\"https://target.example.test/nested-provider\");\n        currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n        for (const [key, value] of Object.entries(malformedCase.params)) {\n          currentUrl.searchParams.set(key, value);\n        }\n        // Each app is constructed with the mock window uninstalled: the constructor's automatic side effects expect a\n        // real window, and a construction-time nested-auth URL would also schedule a second, unawaited run of the\n        // handler that keeps failing in the background and leaks into whichever test runs next.\n        globalThis.window = previousWindow;\n        const clientApp = new StackClientApp({\n          baseUrl: \"http://localhost:12345\",\n          projectId,\n          publishableClientKey: \"stack-pk-test\",\n          tokenStore: \"memory\",\n          redirectMethod: \"window\",\n          noAutomaticPrefetch: true,\n          devTool: false,\n        });\n        setMockWindow({ location: { href: currentUrl.toString() } });\n        Reflect.set(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\", async () => malformedCase.currentRefreshTokenId);\n        Reflect.set(clientApp, \"_isTrusted\", async () => true);\n\n        const nestedAuthPromise = callProtectedMethod(clientApp, \"_maybeHandleNestedCrossDomainAuth\");\n        await expect(nestedAuthPromise).rejects.toThrowError(new RegExp(`${malformedCase.description} .* is not a valid absolute URL`));\n        await expect(nestedAuthPromise).rejects.toSatisfy((error: unknown) => HexclaveSetupError.isSetupError(error));\n      }\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"keeps nested cross-domain auth failures off the page for a handoff that does not own the session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000013\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    globalThis.document = createMockDocument();\n\n    // Setup errors are shown in production, so a link anybody can craft must not be able to put a card on a healthy\n    // app's page: with a refresh-token ID that is not the current session's, every failure below stays an ordinary error\n    // that only captureError sees, even though the same URL from the right session would render a card.\n    const craftedRedirectUris = [\n      \"https://evil.example.test/handler/account-settings\", // untrusted\n      \"not-a-url\", // malformed\n    ];\n\n    try {\n      for (const craftedRedirectUri of craftedRedirectUris) {\n        const currentUrl = new URL(\"https://target.example.test/nested-provider\");\n        currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"attacker-chosen-refresh-token-id\");\n        currentUrl.searchParams.set(\"redirect_uri\", craftedRedirectUri);\n        currentUrl.searchParams.set(\"state\", \"nested-state\");\n        currentUrl.searchParams.set(\"code_challenge\", \"nested-code-challenge\");\n\n        globalThis.window = previousWindow;\n        const clientApp = new StackClientApp({\n          baseUrl: \"http://localhost:12345\",\n          projectId,\n          publishableClientKey: \"stack-pk-test\",\n          tokenStore: \"memory\",\n          redirectMethod: \"window\",\n          noAutomaticPrefetch: true,\n          devTool: false,\n        });\n        setMockWindow({ location: { href: currentUrl.toString() } });\n        Reflect.set(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\", async () => \"this-apps-refresh-token-id\");\n        Reflect.set(clientApp, \"_isTrusted\", async () => false);\n\n        const nestedAuthPromise = callProtectedMethod(clientApp, \"_maybeHandleNestedCrossDomainAuth\");\n        await expect(nestedAuthPromise).rejects.toThrowError(/does not match the requested refresh token ID/);\n        await expect(nestedAuthPromise).rejects.toSatisfy(\n          (error: unknown) => !HexclaveSetupError.isSetupError(error),\n        );\n      }\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"passes the construction-time URL to the nested cross-domain auth handler\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000009\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const callbackUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    callbackUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    callbackUrl.searchParams.set(\"code\", \"one-time-code\");\n    callbackUrl.searchParams.set(\"state\", \"nested-oauth-state\");\n    const strippedUrl = new URL(callbackUrl);\n    strippedUrl.searchParams.delete(\"code\");\n    strippedUrl.searchParams.delete(\"state\");\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: callbackUrl.toString(),\n      },\n    } as any;\n\n    const nestedAuthSpy = vi.spyOn(StackClientApp.prototype as any, \"_maybeHandleNestedCrossDomainAuth\").mockResolvedValue(false);\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      // Simulate consumeOAuthCallbackQueryParams stripping code+state before microtasks run.\n      (globalThis.window as any).location.href = strippedUrl.toString();\n      await new Promise((resolve) => setTimeout(resolve, 0));\n\n      expect(nestedAuthSpy).toHaveBeenCalledTimes(1);\n      const urlArgument = nestedAuthSpy.mock.calls[0][0] as URL;\n      expect(urlArgument).toBeInstanceOf(URL);\n      expect(urlArgument.searchParams.get(\"code\")).toBe(\"one-time-code\");\n      expect(urlArgument.searchParams.get(\"state\")).toBe(\"nested-oauth-state\");\n    } finally {\n      nestedAuthSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"redirects hosted current-page OAuth callback errors to the hosted error handler during startup\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000010\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const callbackUrl = new URL(\"https://demo.stack-auth.com/dashboard\");\n    callbackUrl.searchParams.set(\"errorCode\", \"SIGN_UP_REJECTED\");\n    callbackUrl.searchParams.set(\"message\", \"Your sign up was rejected by an administrator's sign-up rule.\");\n    callbackUrl.searchParams.set(\"details\", JSON.stringify({\n      message: \"Your sign up was rejected by an administrator's sign-up rule.\",\n    }));\n    callbackUrl.searchParams.set(\"after_auth_return_to\", \"/dashboard\");\n    callbackUrl.searchParams.set(\"after_callback_redirect_url\", \"https://customer.example.test/settings?tab=connected-accounts\");\n    let currentHref = callbackUrl.toString();\n    let redirectedUrl = \"\";\n    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, \"_redirectTo\").mockImplementation(async (...args: unknown[]) => {\n      const options = args[0] as { url: string | URL };\n      redirectedUrl = options.url.toString();\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n        set href(value: string) {\n          currentHref = value;\n        },\n        origin: callbackUrl.origin,\n      },\n      history: {\n        replaceState: (_state: unknown, _title: string, url: string) => {\n          currentHref = new URL(url, currentHref).toString();\n        },\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        urls: {\n          default: { type: \"hosted\" },\n        },\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      await new Promise((resolve) => setTimeout(resolve, 0));\n      await new Promise((resolve) => setTimeout(resolve, 0));\n    } finally {\n      redirectSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const errorUrl = new URL(redirectedUrl);\n    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);\n    expect(errorUrl.pathname).toBe(\"/handler/error\");\n    expect(errorUrl.searchParams.get(\"errorCode\")).toBe(\"SIGN_UP_REJECTED\");\n    expect(errorUrl.searchParams.get(\"message\")).toBe(\"Your sign up was rejected by an administrator's sign-up rule.\");\n    expect(errorUrl.searchParams.get(\"after_auth_return_to\")).toBe(\"/dashboard\");\n    expect(errorUrl.searchParams.get(\"after_callback_redirect_url\")).toBe(\"https://customer.example.test/settings?tab=connected-accounts\");\n    expect(new URL(currentHref).searchParams.has(\"errorCode\")).toBe(false);\n  });\n\n  it(\"uses direct sign-out instead of hosted sign-out redirects when code execution is available\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/handler\",\n        signOut: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const signOutSpy = vi.spyOn(clientApp, \"signOut\").mockRejectedValue(new Error(\"INTENTIONAL_TEST_ABORT\"));\n\n    try {\n      await expect(clientApp.redirectToSignOut()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      expect(signOutSpy).toHaveBeenCalledWith();\n    } finally {\n      signOutSpy.mockRestore();\n    }\n  });\n\n  it(\"throws when public app.urls reads would return hosted component URLs\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    expect(() => clientApp.urls.signIn).toThrowError(/app\\.urls\\.signIn cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignIn\\(\\) instead/s);\n    expect(() => clientApp.urls.signOut).toThrowError(/app\\.urls\\.signOut cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignOut\\(\\) instead/s);\n    expect(clientApp.urls.afterSignIn).toBe(\"/\");\n  });\n\n  it(\"keeps public app.urls reads available for non-hosted targets\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/custom-handler\",\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    expect(clientApp.urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"keeps default hosted signOut() on the source domain when afterSignOut is not configured\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000004\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const currentHref = \"https://demo.stack-auth.com/settings?tab=profile\";\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSignOut = Reflect.get(clientInterface, \"signOut\");\n    Reflect.set(clientInterface, \"signOut\", async () => {});\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentHref,\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      const signOut = Reflect.get(clientApp, \"_signOut\");\n      if (typeof signOut !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _signOut in tests.\");\n      }\n      await expect(signOut.call(clientApp, Reflect.get(clientInterface, \"createSession\").call(clientInterface, {\n        refreshToken: null,\n      }))).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"signOut\", originalSignOut);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(redirectedUrl).toBe(\"/settings?tab=profile\");\n  });\n\n  it(\"restores a dropped after_auth_return_to from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n    const windowMock = {\n      location: {\n        href: \"https://demo.example.test/handler/sign-in?after_auth_return_to=%2Fmusic%3Ftrack%3D1\",\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      // The constructor mirrors the redirect-back state from the arrival URL into sessionStorage.\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000011\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      // Intermediate hops (MFA, magic link, OAuth round-trips, ...) dropped the query params.\n      windowMock.location.href = \"https://demo.example.test/handler/mfa\";\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n      expect(redirectUrl).toBe(\"/music?track=1\");\n\n      // noRedirectBack opts out of the mirror just like it opts out of the query param.\n      const noRedirectBackUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\", { noRedirectBack: true });\n      expect(new URL(noRedirectBackUrl, \"https://demo.example.test\").pathname).toBe(\"/\");\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"restores dropped cross-domain handoff state from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n\n    const handoffState = \"mirror-handoff-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const handoffAfterCallbackRedirect = \"https://demo.example.test/dashboard\";\n    const redirectBackUrl = new URL(\"https://demo.example.test/handler/oauth-callback\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_auth\", \"1\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);\n    arrivalUrl.searchParams.set(\"after_auth_return_to\", redirectBackUrl.toString());\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const previousDocument = globalThis.document;\n    const windowMock = {\n      location: {\n        href: arrivalUrl.toString(),\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n      const crossDomainAuthorizeRedirect = \"https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state\";\n      const createCrossDomainAuthRedirectUrlSpy = vi\n        .spyOn(clientApp as any, \"_createCrossDomainAuthRedirectUrl\")\n        .mockResolvedValue(crossDomainAuthorizeRedirect);\n\n      // All redirect-back query params were dropped before the after-sign-in redirect.\n      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n\n      expect(createCrossDomainAuthRedirectUrlSpy).toHaveBeenCalledWith(expect.objectContaining({\n        redirectUri: redirectBackUrl.toString(),\n        state: handoffState,\n        codeChallenge: handoffCodeChallenge,\n        afterCallbackRedirectUrl: handoffAfterCallbackRedirect,\n      }));\n      expect(redirectUrl).toBe(crossDomainAuthorizeRedirect);\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"ignores stale session callbacks after a newer refresh token owns the token store\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000005\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const oldAccessToken = createAccessTokenString(\"old-refresh-token-id\");\n    const refreshedOldAccessToken = createAccessTokenString(\"refreshed-old-refresh-token-id\");\n    const newAccessToken = createAccessTokenString(\"new-refresh-token-id\");\n    const tokenStore = new Store({\n      refreshToken: \"old-refresh-token\",\n      accessToken: oldAccessToken,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const getSessionFromTokenStore = Reflect.get(clientApp, \"_getSessionFromTokenStore\");\n      if (typeof getSessionFromTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getSessionFromTokenStore in tests.\");\n      }\n      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);\n      tokenStore.set({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      await oldSession.fetchNewTokens();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      oldSession.markInvalid();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n  });\n});\n"],"mappings":";;;;;;;;AAgBA,SAAS,wBAAwB,gBAAgC;CAC/D,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,qBAA+B;CACtC,MAAM,4BAAY,IAAI,IAAoB;CAC1C,OAAO;EACL,IAAI,SAAS;GACX,OAAO,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;EACpF;EACA,IAAI,OAAO,KAAa;GACtB,MAAM,CAAC,aAAa,IAAI,MAAM,GAAG;GACjC,MAAM,UAAU,UAAU,QAAQ,GAAG;GACrC,IAAI,UAAU,GAAG;GACjB,UAAU,IAAI,UAAU,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACvF;EACA,sBAAsB,CAAC;CACzB;AACF;;;;;;AAOA,SAAS,cAAc,YAEd;CACP,QAAQ,IAAI,YAAY,UAAU,UAAU;AAC9C;;;;AAKA,SAAS,oBAAoB,KAA2B,YAAoB,GAAG,MAAmC;CAChH,MAAM,SAAS,QAAQ,IAAI,KAAK,UAAU;CAC1C,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,MAAM,qCAAqC,WAAW,kBAAkB;CAEpF,OAAO,OAAO,MAAM,KAAK,IAAI;AAC/B;qBAES,0CAA0C;CACjD,CAAA,GAAA,OAAA,GAAA,CAAG,0EAA0E,YAAY;EAavF,CAAA,GAAA,OAAA,OAAA,CAAO,OAAA,GAAA,wBAAA,sBAAA,CAZ0C;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY,IAAI,IAAI,+CAA+C;GACnE,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,wEAAwE;GAC1F;EACF,CAAC,CAEkB,CAAC,CAAC,QAAQ;GAC3B,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,mEAAmE,YAAY;EAChF,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,aAAa,IAAI,IAAI,+CAA+C;EAC1E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IACtB,qDACA,+CACF;EAEA,MAAM,eAAe,OAAA,GAAA,wBAAA,sBAAA,CAA4B;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB;GACA,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,0DAA0D;GAC5E;EACF,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,IAAI,CAAC,CAAC,KAAK,UAAU;EACzC,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,YAAY,IAAI,IAAI,aAAa,GAAG;EAC1C,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,MAAM,CAAC,CAAC,KAAK,2BAA2B;EACzD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,QAAQ,CAAC,CAAC,KAAK,kBAAkB;EAClD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KACtF,+BACF;EAEA,MAAM,uBAAuB,UAAU,aAAa,IAAI,sBAAsB;EAC9E,IAAI,wBAAwB,MAC1B,MAAM,IAAI,MAAM,mFAAmF;EAErG,MAAM,oBAAoB,IAAI,IAAI,oBAAoB;EACtD,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK,0BAA0B;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,QAAQ,CAAC,CAAC,KAAK,yBAAyB;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,4BAA4B,CAAC,CAAC,CAAC,KAAK,GAAG;EACjF,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3F,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,oBAAoB;EAC5G,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAC9F,+BACF;EACA,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,WAAW;CAChE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iEAAiE,YAAY;EAC9E,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,QAAQ,IAAI,YAAY,UAAU,EAChC,UAAU,EACR,MAAM,sCACR,EACF,CAAC;EAED,IAAI;GAcF,MAAM,cAAc,MAAM,IAbJA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,QAAQ,mBACV;IACA,qBAAqB;IACrB,SAAS;GACX,CAEkC,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,wBAAwB,QAAQ;GAEhG,MAAM,WAAW,IAAI,IAAI,aAAa,kBAAkB;GACxD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,kBAAkB;GACjD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,qBAAqB;EACtF,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E,YAAY;EAC3F,MAAM,mBAAmB,wBAAwB,wBAAwB;EACzE,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;IACV,aAAa,wBAAwB,wBAAwB;IAC7D,cAAc;GAChB;GACA,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,4BAA4B,QAAQ,IAAI,iBAAiB,mBAAmB;EAClF,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,wBAAkC,CAAC;EACzC,MAAM,qCAA+C,CAAC;EACtD,MAAM,4BAAsC,CAAC;EAE7C,QAAQ,IAAI,iBAAiB,qBAAqB,OAAO,OAAgB,iBAA0B,YAAqB;GACtH,MAAM,kBAAkB,QAAQ,IAAI,WAAW,CAAC,GAAG,iBAAiB;GACpE,MAAM,8BAA8B,QAAQ,IAAI,WAAW,CAAC,GAAG,6BAA6B;GAC5F,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,MAAM,uEAAuE;GAEzF,IAAI,OAAO,gCAAgC,YACzC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,MAAM,eAAe,gBAAgB,KAAK,OAAO;GACjD,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,sBAAsB,KAAK,kBAAkB;GAC7C,MAAM,SAAS,MAAM,4BAA4B,KAAK,SAAS,GAAG,IAAI;GACtE,mCAAmC,KAAK,OAAO,YAAY,QAAQ,gBAAgB;GACnF,OAAO;IACL,IAAI;IACJ,MAAM,aAAa,EAAE,cAAc,mFAAmF;GACxH;EACF,CAAC;EACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;GACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,0BAA0B,KAAK,kBAAkB;GACjD,OAAOE,+BAAAA,YAAY,cAAc,gBAAgB,YAAY;IAC3D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,mCAAmC,QAAQ,IAAI,WAAW,mCAAmC;GACnG,IAAI,OAAO,qCAAqC,YAC9C,MAAM,IAAI,MAAM,+EAA+E;GAGjG,OAAA,GAAA,OAAA,OAAA,CAAa,iCAAiC,KAAK,WAAW;IAC5D,aAAa;IACb,OAAO;IACP,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;KACtB,aAAa,wBAAwB,8BAA8B;KACnE,cAAc;IAChB;GACF,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,kFAAkF;EACtG,UAAU;GACR,QAAQ,IAAI,iBAAiB,qBAAqB,yBAAyB;GAC3E,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,qBAAqB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EAC7D,CAAA,GAAA,OAAA,OAAA,CAAO,kCAAkC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,wFAAwF,YAAY;EACrG,MAAM,YAAY;EAClB,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,qBAAqB;EAC3B,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,wBAAwB,yFAAyF,YAAY;EACzJ,WAAW,aAAa,IAAI,+BAA+B,UAAU;EACrE,WAAW,aAAa,IAAI,wCAAwC,kBAAkB;EACtF,WAAW,aAAa,IAAI,qDAAqD,8BAA8B;EAC/G,WAAW,aAAa,IAAI,mDAAmD,gBAAgB;EAC/F,WAAW,aAAa,IAAI,+CAA+C,8BAA8B;EAEzG,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa;EACzC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACvE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,6BAA6B;EACzF,MAAM,cAAc,IAAI,IAAI,YAAY,aAAa,IAAI,cAAc,KAAK,EAAE;EAC9E,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,UAAU;EACnF,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACpG,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAAK,8BAA8B;CAC/H,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sFAAsF,YAAY;EACnG,MAAM,YAAY;EAClB,MAAM,oBAAoB,wBAAwB,6BAA6B;EAC/E,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa,QAAQ,IAAI,WAAW,mBAAmB;EAC7D,IAAI,EAAE,sBAAsBG,mCAAAA,QAC1B,MAAM,IAAI,MAAM,mEAAmE;EAErF,WAAW,IAAI;GACb,cAAc;GACd,aAAa;EACf,CAAC;EAED,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,mDAAmD,mCAAmC;EAClH,WAAW,aAAa,IAAI,+CAA+C,oDAAoD;EAC/H,WAAW,aAAa,IAAI,+BAA+B,aAAa;EACxE,WAAW,aAAa,IAAI,wCAAwC,sBAAsB;EAC1F,WAAW,aAAa,IAAI,qDAAqD,iCAAiC;EAElH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,iBAAiB,YAAY;IAC5D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;GAC/B,cAAc;GACd,aAAa;EACf,CAAC;EACD,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,6BAA6B;CAC1E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,MAAM;IACN,UAAU;IACV,UAAU;GACZ;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,4BAAsC,CAAC;EAM7C,OAAA,GAAG,MAAM,WAAkB,yBAAyB,CAAC,CAAC,kBAAkB,IAAI;EAE5E,IAAI;GACF,MAAM,6BAA6B,QAAQ,IAAI,WAAW,6BAA6B;GACvF,IAAI,OAAO,+BAA+B,YACxC,MAAM,IAAI,MAAM,yEAAyE;GAG3F,2BAD8C,KAAK,SAC1C,CAAC,CAAC,IAAI;IACb,cAAc;IACd,aAAa,wBAAwB,sBAAsB;GAC7D,CAAC;GAED,SAAS,SAAS,2BAA2B,UAAU,YAAY,KAAK,UAAU;IAChF,eAAe;IACf,mBAAmB;GACrB,CAAC;GACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;IACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;IAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;IAE7E,0BAA0B,KAAK,kBAAkB;IACjD,OAAOE,+BAAAA,YAAY,cAAc,wBAAwB,sBAAsB,CAAC,YAAY;KAC1F,MAAM,IAAI,MAAM,wCAAwC;IAC1D,EAAA,CAAG;GACL,CAAC;GAED,MAAM,uCAAuC,QAAQ,IAAI,WAAW,uCAAuC;GAC3G,IAAI,OAAO,yCAAyC,YAClD,MAAM,IAAI,MAAM,mFAAmF;GAErG,OAAA,GAAA,OAAA,OAAA,CAAa,qCAAqC,KAAK,WAAW,EAChE,6BAA6B,MAC/B,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB;EAC1C,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,+CAA+C,8BAA8B;EAC1G,MAAM,wBAAwB,IAAI,IAAI,WAAW;EACjD,sBAAsB,aAAa,IAAI,QAAQ,eAAe;EAC9D,sBAAsB,aAAa,IAAI,SAAS,oBAAoB;EAIpE,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,YAAY,SAAS;GAC3B,eAAe;IACb,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,IAAI;GAEF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GAElH,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,qBAAqB,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;GAE7G,WAAY,OAAe,SAAS,OAAO,sBAAsB,SAAS;GAC1E,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;EAC1F,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,mEAAmE,YAAY;EAChF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,WAAW,WAAW,mBAAmB;EAOzC,MAAM,iBAAiB;GACrB;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ;KAAE,cAAc;KAAa,OAAO;KAAgB,gBAAgB;IAAwB;GACtG;GACA;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ;KACN,cAAc;KACd,OAAO;KACP,gBAAgB;KAChB,6BAA6B;IAC/B;GACF;GACA;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ,EAAE,6CAA6C,WAAW;GACpE;EACF;EAEA,IAAI;GACF,KAAK,MAAM,iBAAiB,gBAAgB;IAC1C,MAAM,aAAa,IAAI,IAAI,6CAA6C;IACxE,WAAW,aAAa,IAAI,mDAAmD,yBAAyB;IACxG,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,MAAM,GAC5D,WAAW,aAAa,IAAI,KAAK,KAAK;IAKxC,WAAW,SAAS;IACpB,MAAM,YAAY,IAAIA,4BAAAA,eAAe;KACnC,SAAS;KACT;KACA,sBAAsB;KACtB,YAAY;KACZ,gBAAgB;KAChB,qBAAqB;KACrB,SAAS;IACX,CAAC;IACD,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,SAAS,EAAE,EAAE,CAAC;IAC3D,QAAQ,IAAI,WAAW,yCAAyC,YAAY,cAAc,qBAAqB;IAC/G,QAAQ,IAAI,WAAW,cAAc,YAAY,IAAI;IAErD,MAAM,oBAAoB,oBAAoB,WAAW,mCAAmC;IAC5F,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,aAAa,IAAI,OAAO,GAAG,cAAc,YAAY,gCAAgC,CAAC;IAC9H,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,WAAW,UAAmBI,mCAAAA,mBAAmB,aAAa,KAAK,CAAC;GAC9G;EACF,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oGAAoG,YAAY;EACjH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,WAAW,WAAW,mBAAmB;EAKzC,MAAM,sBAAsB,CAC1B,sDACA,WACF;EAEA,IAAI;GACF,KAAK,MAAM,sBAAsB,qBAAqB;IACpD,MAAM,aAAa,IAAI,IAAI,6CAA6C;IACxE,WAAW,aAAa,IAAI,mDAAmD,kCAAkC;IACjH,WAAW,aAAa,IAAI,gBAAgB,kBAAkB;IAC9D,WAAW,aAAa,IAAI,SAAS,cAAc;IACnD,WAAW,aAAa,IAAI,kBAAkB,uBAAuB;IAErE,WAAW,SAAS;IACpB,MAAM,YAAY,IAAIJ,4BAAAA,eAAe;KACnC,SAAS;KACT;KACA,sBAAsB;KACtB,YAAY;KACZ,gBAAgB;KAChB,qBAAqB;KACrB,SAAS;IACX,CAAC;IACD,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,SAAS,EAAE,EAAE,CAAC;IAC3D,QAAQ,IAAI,WAAW,yCAAyC,YAAY,4BAA4B;IACxG,QAAQ,IAAI,WAAW,cAAc,YAAY,KAAK;IAEtD,MAAM,oBAAoB,oBAAoB,WAAW,mCAAmC;IAC5F,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,aAAa,+CAA+C;IACpG,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,WACrC,UAAmB,CAACI,mCAAAA,mBAAmB,aAAa,KAAK,CAC5D;GACF;EACF,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4EAA4E,YAAY;EACzF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,QAAQ,eAAe;EACpD,YAAY,aAAa,IAAI,SAAS,oBAAoB;EAC1D,MAAM,cAAc,IAAI,IAAI,WAAW;EACvC,YAAY,aAAa,OAAO,MAAM;EACtC,YAAY,aAAa,OAAO,OAAO;EAEvC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU,EACR,MAAM,YAAY,SAAS,EAC7B,EACF;EAEA,MAAM,gBAAgBC,OAAAA,GAAG,MAAML,4BAAAA,eAAe,WAAkB,mCAAmC,CAAC,CAAC,kBAAkB,KAAK;EAE5H,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GAGD,WAAY,OAAe,SAAS,OAAO,YAAY,SAAS;GAChE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GAErD,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,sBAAsB,CAAC;GAC7C,MAAM,cAAc,cAAc,KAAK,MAAM,EAAE,CAAC;GAChD,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,eAAe,GAAG;GACtC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;GACjE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACzE,UAAU;GACR,cAAc,YAAY;GAC1B,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kGAAkG,YAAY;EAC/G,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,cAAc,IAAI,IAAI,uCAAuC;EACnE,YAAY,aAAa,IAAI,aAAa,kBAAkB;EAC5D,YAAY,aAAa,IAAI,WAAW,+DAA+D;EACvG,YAAY,aAAa,IAAI,WAAW,KAAK,UAAU,EACrD,SAAS,gEACX,CAAC,CAAC;EACF,YAAY,aAAa,IAAI,wBAAwB,YAAY;EACjE,YAAY,aAAa,IAAI,+BAA+B,+DAA+D;EAC3H,IAAI,cAAc,YAAY,SAAS;EACvC,IAAI,gBAAgB;EACpB,MAAM,cAAcK,OAAAA,GAAG,MAAML,4BAAAA,eAAe,WAAkB,aAAa,CAAC,CAAC,mBAAmB,OAAO,GAAG,SAAoB;GAE5H,gBADgB,KAAK,EACE,CAAC,IAAI,SAAS;EACvC,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,IAAI,OAAO;KACT,OAAO;IACT;IACA,IAAI,KAAK,OAAe;KACtB,cAAc;IAChB;IACA,QAAQ,YAAY;GACtB;GACA,SAAS,EACP,eAAe,QAAiB,QAAgB,QAAgB;IAC9D,cAAc,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,SAAS;GACnD,EACF;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;IACA,qBAAqB;IACrB,SAAS;GACX,CAAC;GAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GACrD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;EACvD,UAAU;GACR,YAAY,YAAY;GACxB,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,WAAW,IAAI,IAAI,aAAa;EACtC,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,MAAM,CAAC,CAAC,KAAK,WAAW,UAAU,yBAAyB;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,gBAAgB;EAC/C,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACtE,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACjH,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,WAAW,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK;CACvE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8FAA8F,YAAY;EAC3G,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM;IACJ,SAAS;IACT,SAAS,EAAE,MAAM,SAAS;GAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAaK,OAAAA,GAAG,MAAM,WAAW,SAAS,CAAC,CAAC,kCAAkB,IAAI,MAAM,wBAAwB,CAAC;EAEvG,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAa,UAAU,kBAAkB,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GACzF,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,CAAC,CAAC,qBAAqB;EAC1C,UAAU;GACR,WAAW,YAAY;EACzB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E;EAC/E,MAAM,YAAY,IAAIL,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,MAAM,CAAC,CAAC,aAAa,+HAA+H;EAChL,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,OAAO,CAAC,CAAC,aAAa,iIAAiI;EACnL,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,KAAK,WAAW,CAAC,CAAC,KAAK,GAAG;CAC7C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE;EAcvE,CAAA,GAAA,OAAA,OAAA,CAAO,IAbeA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,kBACX;GACA,qBAAqB;GACrB,SAAS;EACX,CAEe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,yBAAyB;CAC9D,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,cAAc;EAEpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,kBAAkB,QAAQ,IAAI,iBAAiB,SAAS;EAC9D,QAAQ,IAAI,iBAAiB,WAAW,YAAY,CAAC,CAAC;EACtD,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EAEpB,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM;GACN,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,UAAU,QAAQ,IAAI,WAAW,UAAU;GACjD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,sDAAsD;GAExE,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,KAAK,WAAW,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CAAC,KAAK,iBAAiB,EACvG,cAAc,KAChB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpD,UAAU;GACR,QAAQ,IAAI,iBAAiB,WAAW,eAAe;GACvD,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,uBAAuB;CACpD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAClD,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,sFACR;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GAEF,MAAM,YAAY,IAAIA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GAGD,WAAW,SAAS,OAAO;GAG3B,CAAA,GAAA,OAAA,OAAA,CAAO,MADmB,UAAUC,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa,CACnF,CAAC,CAAC,KAAK,gBAAgB;GAGzC,MAAM,oBAAoB,MAAM,UAAUA,gBAAAA,2BAA2B,CAAC,wBAAwB,eAAe,EAAE,gBAAgB,KAAK,CAAC;GACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,mBAAmB,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG;EACnF,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6GAA6G,YAAY;EAC1H,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAElD,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,+BAA+B;EACrC,MAAM,kBAAkB,IAAI,IAAI,kDAAkD;EAClF,gBAAgB,aAAa,IAAI,8BAA8B,GAAG;EAClE,gBAAgB,aAAa,IAAI,+BAA+B,YAAY;EAC5E,gBAAgB,aAAa,IAAI,wCAAwC,oBAAoB;EAC7F,gBAAgB,aAAa,IAAI,qDAAqD,4BAA4B;EAElH,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,yCAAyC;EACzF,WAAW,aAAa,IAAI,wBAAwB,gBAAgB,SAAS,CAAC;EAC9E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IAAI,qDAAqD,4BAA4B;EAE7G,MAAM,mBAAmB,WAAW;EACpC,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,WAAW,SAAS,EAC5B;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GACF,MAAM,YAAY,IAAID,4BAAAA,eAAe;IACnC,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GACD,MAAM,+BAA+B;GACrC,MAAM,sCAAsCK,OAAAA,GACzC,MAAM,WAAkB,mCAAmC,CAAC,CAC5D,kBAAkB,4BAA4B;GAGjD,WAAW,SAAS,OAAO,WAAW,UAAU;GAEhD,MAAM,cAAc,MAAM,UAAUJ,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa;GAErG,CAAA,GAAA,OAAA,OAAA,CAAO,mCAAmC,CAAC,CAAC,qBAAqBK,OAAAA,OAAO,iBAAiB;IACvF,aAAa,gBAAgB,SAAS;IACtC,OAAO;IACP,eAAe;IACf,0BAA0B;GAC5B,CAAC,CAAC;GACF,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,KAAK,4BAA4B;EACvD,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oFAAoF,YAAY;EACjG,MAAM,YAAY,IAAIN,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,0BAA0B,wBAAwB,gCAAgC;EACxF,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,aAAa,IAAIG,mCAAAA,MAAM;GAC3B,cAAc;GACd,aAAa;EACf,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,uBAAuB,YAAY;IAClE,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,2BAA2B,QAAQ,IAAI,WAAW,2BAA2B;GACnF,IAAI,OAAO,6BAA6B,YACtC,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,aAAa,yBAAyB,KAAK,WAAW,UAAU;GACtE,WAAW,IAAI;IACb,cAAc;IACd,aAAa;GACf,CAAC;GAED,MAAM,WAAW,eAAe;GAChC,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;GAED,WAAW,YAAY;GACvB,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;EACH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;CACF,CAAC;AACH,CAAC"}

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.d.ts

@@ -1,2 +1,2 @@
-import { r as _HexclaveClientAppImplIncomplete } from "../../../../admin-app-impl-FZdANO62.js";
+import { r as _HexclaveClientAppImplIncomplete } from "../../../../admin-app-impl-CsH-gVGz.js";
 export { _HexclaveClientAppImplIncomplete };