@hexclave/next 1.0.75 → 1.0.77

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-app-impl.automatic-side-effects.test.js","names":["HexclaveClientApp","hexclaveAppInternalsSymbol"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it } from \"vitest\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { HexclaveClientApp, HexclaveClientAppConstructorOptions, HexclaveClientAppJson } from \"../interfaces/client-app\";\n\nconst baseOptions = {\n  baseUrl: \"http://localhost:12345\",\n  projectId: \"00000000-0000-4000-8000-000000000000\",\n  publishableClientKey: \"stack-pk-test\",\n  tokenStore: \"memory\",\n  redirectMethod: \"none\",\n} satisfies HexclaveClientAppConstructorOptions<true, string>;\n\ndescribe(\"HexclaveClientApp automatic side effects\", () => {\n  it(\"does not inspect browser state when disabled\", () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const previousDocument = Reflect.get(globalThis, \"document\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const hadPreviousDocument = Reflect.has(globalThis, \"document\");\n    const browserGlobal = {};\n    Object.defineProperty(browserGlobal, \"location\", {\n      get() {\n        throw new Error(\"Construction must not inspect the current URL when automatic side effects are disabled\");\n      },\n    });\n\n    Reflect.set(globalThis, \"window\", browserGlobal);\n    Object.defineProperty(globalThis, \"document\", {\n      configurable: true,\n      get() {\n        throw new Error(\"Construction must not access the document when automatic side effects are disabled\");\n      },\n    });\n\n    try {\n      expect(() => new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      })).not.toThrow();\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n      if (hadPreviousDocument) {\n        Object.defineProperty(globalThis, \"document\", {\n          configurable: true,\n          value: previousDocument,\n          writable: true,\n        });\n      } else {\n        Reflect.deleteProperty(globalThis, \"document\");\n      }\n    }\n  });\n\n  it(\"does not initialize automatic side effects when disabled\", () => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      });\n\n      expect(initializationCalls).toBe(0);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it.each([undefined, true])(\"retains automatic initialization when automaticSideEffects is %s\", (automaticSideEffects) => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects,\n      });\n\n      expect(initializationCalls).toBe(1);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it(\"preserves the option through serialization\", () => {\n    const app = new HexclaveClientApp({\n      ...baseOptions,\n      automaticSideEffects: false,\n    });\n\n    expect(app[hexclaveAppInternalsSymbol].toClientJson().automaticSideEffects).toBe(false);\n  });\n\n  it(\"preserves stable identity when deserializing with automatic side effects disabled\", () => {\n    const json: HexclaveClientAppJson<false, string> = {\n      baseUrl: baseOptions.baseUrl,\n      projectId: baseOptions.projectId,\n      publishableClientKey: baseOptions.publishableClientKey,\n      tokenStore: null,\n      redirectMethod: baseOptions.redirectMethod,\n      automaticSideEffects: false,\n      uniqueIdentifier: \"00000000-0000-4000-8000-000000000001\",\n    };\n\n    const first = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n    const second = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n\n    expect(second).toBe(first);\n  });\n});\n"],"mappings":";;;;AAQA,MAAM,cAAc;CAClB,SAAS;CACT,WAAW;CACX,sBAAsB;CACtB,YAAY;CACZ,gBAAgB;AAClB;qBAES,kDAAkD;CACzD,CAAA,GAAA,OAAA,GAAA,CAAG,sDAAsD;EACvD,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,mBAAmB,QAAQ,IAAI,YAAY,UAAU;EAC3D,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,sBAAsB,QAAQ,IAAI,YAAY,UAAU;EAC9D,MAAM,gBAAgB,CAAC;EACvB,OAAO,eAAe,eAAe,YAAY,EAC/C,MAAM;GACJ,MAAM,IAAI,MAAM,wFAAwF;EAC1G,EACF,CAAC;EAED,QAAQ,IAAI,YAAY,UAAU,aAAa;EAC/C,OAAO,eAAe,YAAY,YAAY;GAC5C,cAAc;GACd,MAAM;IACJ,MAAM,IAAI,MAAM,oFAAoF;GACtG;EACF,CAAC;EAED,IAAI;GACF,CAAA,GAAA,OAAA,OAAA,OAAa,IAAIA,4BAAAA,kBAAkB;IACjC,GAAG;IACH,sBAAsB;GACxB,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ;EAClB,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;GAE7C,IAAI,qBACF,OAAO,eAAe,YAAY,YAAY;IAC5C,cAAc;IACd,OAAO;IACP,UAAU;GACZ,CAAC;QAED,QAAQ,eAAe,YAAY,UAAU;EAEjD;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kEAAkE;EACnE,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAIA,4BAAAA,kBAAkB;IACpB,GAAG;IACH,sBAAsB;GACxB,CAAC;GAED,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,OAAA,GAAG,KAAK,CAAC,KAAA,GAAW,IAAI,CAAC,CAAC,CAAC,qEAAqE,yBAAyB;EACvH,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAIA,4BAAAA,kBAAkB;IACpB,GAAG;IACH;GACF,CAAC;GAED,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oDAAoD;EAMrD,CAAA,GAAA,OAAA,OAAA,CAAO,IALSA,4BAAAA,kBAAkB;GAChC,GAAG;GACH,sBAAsB;EACxB,CAES,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,CAAC,KAAK,KAAK;CACxF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F;EAC5F,MAAM,OAA6C;GACjD,SAAS,YAAY;GACrB,WAAW,YAAY;GACvB,sBAAsB,YAAY;GAClC,YAAY;GACZ,gBAAgB,YAAY;GAC5B,sBAAsB;GACtB,kBAAkB;EACpB;EAEA,MAAM,QAAQD,4BAAAA,kBAAkBC,gBAAAA,2BAA2B,CAAC,eAAe,IAAI;EAG/E,CAAA,GAAA,OAAA,OAAA,CAFeD,4BAAAA,kBAAkBC,gBAAAA,2BAA2B,CAAC,eAAe,IAEhE,CAAC,CAAC,CAAC,KAAK,KAAK;CAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"client-app-impl.automatic-side-effects.test.js","names":["HexclaveClientApp","hexclaveAppInternalsSymbol"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { HexclaveClientApp, HexclaveClientAppConstructorOptions, HexclaveClientAppJson } from \"../interfaces/client-app\";\nimport { stripBrowserActionQueryParam } from \"./client-app-impl\";\n\nconst baseOptions = {\n  baseUrl: \"http://localhost:12345\",\n  projectId: \"00000000-0000-4000-8000-000000000000\",\n  publishableClientKey: \"stack-pk-test\",\n  tokenStore: \"memory\",\n  redirectMethod: \"none\",\n} satisfies HexclaveClientAppConstructorOptions<true, string>;\n\ndescribe(\"HexclaveClientApp automatic side effects\", () => {\n  it(\"does not inspect browser state when disabled\", () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const previousDocument = Reflect.get(globalThis, \"document\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const hadPreviousDocument = Reflect.has(globalThis, \"document\");\n    const browserGlobal = {};\n    Object.defineProperty(browserGlobal, \"location\", {\n      get() {\n        throw new Error(\"Construction must not inspect the current URL when automatic side effects are disabled\");\n      },\n    });\n\n    Reflect.set(globalThis, \"window\", browserGlobal);\n    Object.defineProperty(globalThis, \"document\", {\n      configurable: true,\n      get() {\n        throw new Error(\"Construction must not access the document when automatic side effects are disabled\");\n      },\n    });\n\n    try {\n      expect(() => new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      })).not.toThrow();\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n      if (hadPreviousDocument) {\n        Object.defineProperty(globalThis, \"document\", {\n          configurable: true,\n          value: previousDocument,\n          writable: true,\n        });\n      } else {\n        Reflect.deleteProperty(globalThis, \"document\");\n      }\n    }\n  });\n\n  it(\"does not initialize automatic side effects when disabled\", () => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      });\n\n      expect(initializationCalls).toBe(0);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it.each([undefined, true])(\"retains automatic initialization when automaticSideEffects is %s\", (automaticSideEffects) => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects,\n      });\n\n      expect(initializationCalls).toBe(1);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it(\"preserves the option through serialization\", () => {\n    const app = new HexclaveClientApp({\n      ...baseOptions,\n      automaticSideEffects: false,\n    });\n\n    expect(app[hexclaveAppInternalsSymbol].toClientJson().automaticSideEffects).toBe(false);\n  });\n\n  it(\"preserves stable identity when deserializing with automatic side effects disabled\", () => {\n    const json: HexclaveClientAppJson<false, string> = {\n      baseUrl: baseOptions.baseUrl,\n      projectId: baseOptions.projectId,\n      publishableClientKey: baseOptions.publishableClientKey,\n      tokenStore: null,\n      redirectMethod: baseOptions.redirectMethod,\n      automaticSideEffects: false,\n      uniqueIdentifier: \"00000000-0000-4000-8000-000000000001\",\n    };\n\n    const first = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n    const second = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n\n    expect(second).toBe(first);\n  });\n\n  it(\"keeps stripping the browser action parameter after a router restores it\", () => {\n    vi.useFakeTimers();\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    let currentHref = \"http://localhost:12345/?hexclave_action_id=action-id\";\n    const browserGlobal = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n      },\n      history: {\n        state: null,\n        replaceState: (_state: null, _title: string, url: string | URL) => {\n          currentHref = String(url);\n        },\n      },\n      setTimeout,\n    };\n\n    Reflect.set(globalThis, \"window\", browserGlobal);\n    try {\n      stripBrowserActionQueryParam();\n      currentHref = \"http://localhost:12345/?hexclave_action_id=action-id\";\n      vi.runAllTimers();\n      expect(currentHref).toBe(\"http://localhost:12345/\");\n    } finally {\n      vi.useRealTimers();\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n});\n"],"mappings":";;;;;AASA,MAAM,cAAc;CAClB,SAAS;CACT,WAAW;CACX,sBAAsB;CACtB,YAAY;CACZ,gBAAgB;AAClB;qBAES,kDAAkD;CACzD,CAAA,GAAA,OAAA,GAAA,CAAG,sDAAsD;EACvD,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,mBAAmB,QAAQ,IAAI,YAAY,UAAU;EAC3D,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,sBAAsB,QAAQ,IAAI,YAAY,UAAU;EAC9D,MAAM,gBAAgB,CAAC;EACvB,OAAO,eAAe,eAAe,YAAY,EAC/C,MAAM;GACJ,MAAM,IAAI,MAAM,wFAAwF;EAC1G,EACF,CAAC;EAED,QAAQ,IAAI,YAAY,UAAU,aAAa;EAC/C,OAAO,eAAe,YAAY,YAAY;GAC5C,cAAc;GACd,MAAM;IACJ,MAAM,IAAI,MAAM,oFAAoF;GACtG;EACF,CAAC;EAED,IAAI;GACF,CAAA,GAAA,OAAA,OAAA,OAAa,IAAIA,4BAAAA,kBAAkB;IACjC,GAAG;IACH,sBAAsB;GACxB,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ;EAClB,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;GAE7C,IAAI,qBACF,OAAO,eAAe,YAAY,YAAY;IAC5C,cAAc;IACd,OAAO;IACP,UAAU;GACZ,CAAC;QAED,QAAQ,eAAe,YAAY,UAAU;EAEjD;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kEAAkE;EACnE,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAIA,4BAAAA,kBAAkB;IACpB,GAAG;IACH,sBAAsB;GACxB,CAAC;GAED,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,OAAA,GAAG,KAAK,CAAC,KAAA,GAAW,IAAI,CAAC,CAAC,CAAC,qEAAqE,yBAAyB;EACvH,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAIA,4BAAAA,kBAAkB;IACpB,GAAG;IACH;GACF,CAAC;GAED,CAAA,GAAA,OAAA,OAAA,CAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAIA,4BAAAA,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oDAAoD;EAMrD,CAAA,GAAA,OAAA,OAAA,CAAO,IALSA,4BAAAA,kBAAkB;GAChC,GAAG;GACH,sBAAsB;EACxB,CAES,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,CAAC,KAAK,KAAK;CACxF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F;EAC5F,MAAM,OAA6C;GACjD,SAAS,YAAY;GACrB,WAAW,YAAY;GACvB,sBAAsB,YAAY;GAClC,YAAY;GACZ,gBAAgB,YAAY;GAC5B,sBAAsB;GACtB,kBAAkB;EACpB;EAEA,MAAM,QAAQD,4BAAAA,kBAAkBC,gBAAAA,2BAA2B,CAAC,eAAe,IAAI;EAG/E,CAAA,GAAA,OAAA,OAAA,CAFeD,4BAAAA,kBAAkBC,gBAAAA,2BAA2B,CAAC,eAAe,IAEhE,CAAC,CAAC,CAAC,KAAK,KAAK;CAC3B,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iFAAiF;EAClF,OAAA,GAAG,cAAc;EACjB,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,IAAI,cAAc;EAgBlB,QAAQ,IAAI,YAAY,UAAU;GAdhC,UAAU,EACR,IAAI,OAAO;IACT,OAAO;GACT,EACF;GACA,SAAS;IACP,OAAO;IACP,eAAe,QAAc,QAAgB,QAAsB;KACjE,cAAc,OAAO,GAAG;IAC1B;GACF;GACA;EAG4C,CAAC;EAC/C,IAAI;GACF,CAAA,GAAA,qBAAA,6BAAA,CAA6B;GAC7B,cAAc;GACd,OAAA,GAAG,aAAa;GAChB,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,KAAK,yBAAyB;EACpD,UAAU;GACR,OAAA,GAAG,cAAc;GACjB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;AACH,CAAC"}

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js

@@ -1,3 +1,4 @@
+let _hexclave_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
 let vitest = require("vitest");
 let ______common_js = require("../../common.js");
 let ___interfaces_client_app_js = require("../interfaces/client-app.js");
@@ -51,6 +52,22 @@ function createMockDocument() {
 		createElement: () => ({})
 	};
 }
+/**
+* Installs a stand-in for `window` with only the parts the code under test touches. `globalThis.window` is typed as a
+* full `Window`, which a hand-written stub can never be, so the assignment goes through `Reflect.set` — the stub's own
+* shape stays checked, unlike with a cast on the object literal.
+*/
+function setMockWindow(mockWindow) {
+	Reflect.set(globalThis, "window", mockWindow);
+}
+/**
+* Calls one of the app's `protected` methods, which are part of the flows under test but not of the public SDK surface.
+*/
+function callProtectedMethod(app, methodName, ...args) {
+	const method = Reflect.get(app, methodName);
+	if (typeof method !== "function") throw new Error(`Expected StackClientApp to have a ${methodName} method in tests.`);
+	return method.apply(app, args);
+}
 (0, vitest.describe)("StackClientApp cross-domain auth", () => {
 	(0, vitest.it)("keeps noRedirectBack same-domain redirects free of redirect-back state", async () => {
 		(0, vitest.expect)(await (0, __redirect_page_urls_js.planRedirectToHandler)({
@@ -115,7 +132,8 @@ function createMockDocument() {
 				tokenStore: "memory",
 				redirectMethod: "none",
 				urls: { signIn: "/handler/sign-in" },
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			})[______common_js.hexclaveAppInternalsSymbol].getRedirectToHandlerUrl("signIn");
 			const resolved = new URL(redirectUrl, "http://localhost");
 			(0, vitest.expect)(resolved.pathname).toBe("/handler/sign-in");
@@ -136,7 +154,8 @@ function createMockDocument() {
 				refreshToken: "stale-refresh-token"
 			},
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const clientInterface = Reflect.get(clientApp, "_interface");
 		const originalSendClientRequest = Reflect.get(clientInterface, "sendClientRequest");
@@ -198,7 +217,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const outerState = "outer-cross-domain-state";
 		const outerCodeChallenge = "abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~";
@@ -250,7 +270,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const tokenStore = Reflect.get(clientApp, "_memoryTokenStore");
 		if (!(tokenStore instanceof _hexclave_shared_dist_utils_stores.Store)) throw new Error("Expected StackClientApp to use a memory token store in this test.");
@@ -316,7 +337,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "cookie",
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const clientInterface = Reflect.get(clientApp, "_interface");
 		const originalFetchNewAccessToken = Reflect.get(clientInterface, "fetchNewAccessToken");
@@ -367,7 +389,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "memory",
 			redirectMethod: "window",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		globalThis.document = createMockDocument();
 		globalThis.window = { location: {
@@ -392,6 +415,99 @@ function createMockDocument() {
 			globalThis.document = previousDocument;
 		}
 	});
+	(0, vitest.it)("reports malformed nested cross-domain auth URLs as setup errors", async () => {
+		const projectId = "00000000-0000-4000-8000-000000000012";
+		const previousWindow = globalThis.window;
+		const previousDocument = globalThis.document;
+		globalThis.document = createMockDocument();
+		const malformedCases = [
+			{
+				description: "redirect URI",
+				currentRefreshTokenId: "source-refresh-token-id",
+				params: {
+					redirect_uri: "not-a-url",
+					state: "nested-state",
+					code_challenge: "nested-code-challenge"
+				}
+			},
+			{
+				description: "after-callback redirect URL",
+				currentRefreshTokenId: "source-refresh-token-id",
+				params: {
+					redirect_uri: "https://source.example.test/handler/account-settings",
+					state: "nested-state",
+					code_challenge: "nested-code-challenge",
+					after_callback_redirect_url: "http://["
+				}
+			},
+			{
+				description: "callback URL",
+				currentRefreshTokenId: null,
+				params: { stack_nested_cross_domain_auth_callback_url: "http://[" }
+			}
+		];
+		try {
+			for (const malformedCase of malformedCases) {
+				const currentUrl = new URL("https://target.example.test/nested-provider");
+				currentUrl.searchParams.set("stack_nested_cross_domain_auth_refresh_token_id", "source-refresh-token-id");
+				for (const [key, value] of Object.entries(malformedCase.params)) currentUrl.searchParams.set(key, value);
+				globalThis.window = previousWindow;
+				const clientApp = new ___interfaces_client_app_js.StackClientApp({
+					baseUrl: "http://localhost:12345",
+					projectId,
+					publishableClientKey: "stack-pk-test",
+					tokenStore: "memory",
+					redirectMethod: "window",
+					noAutomaticPrefetch: true,
+					devTool: false
+				});
+				setMockWindow({ location: { href: currentUrl.toString() } });
+				Reflect.set(clientApp, "_fetchCurrentRefreshTokenIdIfSignedIn", async () => malformedCase.currentRefreshTokenId);
+				Reflect.set(clientApp, "_isTrusted", async () => true);
+				const nestedAuthPromise = callProtectedMethod(clientApp, "_maybeHandleNestedCrossDomainAuth");
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toThrowError(new RegExp(`${malformedCase.description} .* is not a valid absolute URL`));
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toSatisfy((error) => _hexclave_shared_dist_utils_errors.HexclaveSetupError.isSetupError(error));
+			}
+		} finally {
+			globalThis.window = previousWindow;
+			globalThis.document = previousDocument;
+		}
+	});
+	(0, vitest.it)("keeps nested cross-domain auth failures off the page for a handoff that does not own the session", async () => {
+		const projectId = "00000000-0000-4000-8000-000000000013";
+		const previousWindow = globalThis.window;
+		const previousDocument = globalThis.document;
+		globalThis.document = createMockDocument();
+		const craftedRedirectUris = ["https://evil.example.test/handler/account-settings", "not-a-url"];
+		try {
+			for (const craftedRedirectUri of craftedRedirectUris) {
+				const currentUrl = new URL("https://target.example.test/nested-provider");
+				currentUrl.searchParams.set("stack_nested_cross_domain_auth_refresh_token_id", "attacker-chosen-refresh-token-id");
+				currentUrl.searchParams.set("redirect_uri", craftedRedirectUri);
+				currentUrl.searchParams.set("state", "nested-state");
+				currentUrl.searchParams.set("code_challenge", "nested-code-challenge");
+				globalThis.window = previousWindow;
+				const clientApp = new ___interfaces_client_app_js.StackClientApp({
+					baseUrl: "http://localhost:12345",
+					projectId,
+					publishableClientKey: "stack-pk-test",
+					tokenStore: "memory",
+					redirectMethod: "window",
+					noAutomaticPrefetch: true,
+					devTool: false
+				});
+				setMockWindow({ location: { href: currentUrl.toString() } });
+				Reflect.set(clientApp, "_fetchCurrentRefreshTokenIdIfSignedIn", async () => "this-apps-refresh-token-id");
+				Reflect.set(clientApp, "_isTrusted", async () => false);
+				const nestedAuthPromise = callProtectedMethod(clientApp, "_maybeHandleNestedCrossDomainAuth");
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toThrowError(/does not match the requested refresh token ID/);
+				await (0, vitest.expect)(nestedAuthPromise).rejects.toSatisfy((error) => !_hexclave_shared_dist_utils_errors.HexclaveSetupError.isSetupError(error));
+			}
+		} finally {
+			globalThis.window = previousWindow;
+			globalThis.document = previousDocument;
+		}
+	});
 	(0, vitest.it)("passes the construction-time URL to the nested cross-domain auth handler", async () => {
 		const projectId = "00000000-0000-4000-8000-000000000009";
 		const previousWindow = globalThis.window;
@@ -413,7 +529,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			globalThis.window.location.href = strippedUrl.toString();
 			await new Promise((resolve) => setTimeout(resolve, 0));
@@ -468,7 +585,8 @@ function createMockDocument() {
 				tokenStore: "memory",
 				redirectMethod: "window",
 				urls: { default: { type: "hosted" } },
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			await new Promise((resolve) => setTimeout(resolve, 0));
 			await new Promise((resolve) => setTimeout(resolve, 0));
@@ -497,7 +615,8 @@ function createMockDocument() {
 				handler: "/handler",
 				signOut: { type: "hosted" }
 			},
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const signOutSpy = vitest.vi.spyOn(clientApp, "signOut").mockRejectedValue(/* @__PURE__ */ new Error("INTENTIONAL_TEST_ABORT"));
 		try {
@@ -515,7 +634,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		(0, vitest.expect)(() => clientApp.urls.signIn).toThrowError(/app\.urls\.signIn cannot be used when this app is configured to use hosted components.*Use app\.redirectToSignIn\(\) instead/s);
 		(0, vitest.expect)(() => clientApp.urls.signOut).toThrowError(/app\.urls\.signOut cannot be used when this app is configured to use hosted components.*Use app\.redirectToSignOut\(\) instead/s);
@@ -529,7 +649,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { handler: "/custom-handler" },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		}).urls.signIn).toBe("/custom-handler/sign-in");
 	});
 	(0, vitest.it)("keeps default hosted signOut() on the source domain when afterSignOut is not configured", async () => {
@@ -540,7 +661,8 @@ function createMockDocument() {
 			tokenStore: "memory",
 			redirectMethod: "window",
 			urls: { default: { type: "hosted" } },
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const currentHref = "https://demo.stack-auth.com/settings?tab=profile";
 		const clientInterface = Reflect.get(clientApp, "_interface");
@@ -594,7 +716,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			windowMock.location.href = "https://demo.example.test/handler/mfa";
 			(0, vitest.expect)(await clientApp[______common_js.hexclaveAppInternalsSymbol].getRedirectToHandlerUrl("afterSignIn")).toBe("/music?track=1");
@@ -646,7 +769,8 @@ function createMockDocument() {
 				publishableClientKey: "stack-pk-test",
 				tokenStore: "memory",
 				redirectMethod: "window",
-				noAutomaticPrefetch: true
+				noAutomaticPrefetch: true,
+				devTool: false
 			});
 			const crossDomainAuthorizeRedirect = "https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state";
 			const createCrossDomainAuthRedirectUrlSpy = vitest.vi.spyOn(clientApp, "_createCrossDomainAuthRedirectUrl").mockResolvedValue(crossDomainAuthorizeRedirect);
@@ -672,7 +796,8 @@ function createMockDocument() {
 			publishableClientKey: "stack-pk-test",
 			tokenStore: "memory",
 			redirectMethod: "none",
-			noAutomaticPrefetch: true
+			noAutomaticPrefetch: true,
+			devTool: false
 		});
 		const oldAccessToken = createAccessTokenString("old-refresh-token-id");
 		const refreshedOldAccessToken = createAccessTokenString("refreshed-old-refresh-token-id");