@hexclave/next 1.0.76 → 1.0.78

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-app-impl.cross-domain.test.js","names":["StackClientApp","hexclaveAppInternalsSymbol","AccessToken","Store","HexclaveSetupError","vi","expect"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { AccessToken } from \"@hexclave/shared/dist/sessions\";\nimport { HexclaveSetupError } from \"@hexclave/shared/dist/utils/errors\";\nimport { Store } from \"@hexclave/shared/dist/utils/stores\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\nimport { planRedirectToHandler } from \"./redirect-page-urls\";\n\n// Every app in this file is constructed with `devTool: false`. The tests install a mock window and document, which makes\n// the SDK believe it is in a browser, and mounting the dev tool kicks off a background `getProject()` against a backend\n// that does not exist here. That fetch never settles, and because it runs inside the global store lock, it blocks every\n// later `withWriteLock` caller (`_signOut`, most visibly) for the rest of the test file.\nfunction createAccessTokenString(refreshTokenId: string): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createMockDocument(): Document {\n  const cookieJar = new Map<string, string>();\n  return {\n    get cookie() {\n      return [...cookieJar.entries()].map(([key, value]) => `${key}=${value}`).join(\"; \");\n    },\n    set cookie(str: string) {\n      const [nameValue] = str.split(\";\");\n      const eqIndex = nameValue.indexOf(\"=\");\n      if (eqIndex < 0) return;\n      cookieJar.set(nameValue.slice(0, eqIndex).trim(), nameValue.slice(eqIndex + 1).trim());\n    },\n    createElement: () => ({}),\n  } as any;\n}\n\n/**\n * Installs a stand-in for `window` with only the parts the code under test touches. `globalThis.window` is typed as a\n * full `Window`, which a hand-written stub can never be, so the assignment goes through `Reflect.set` — the stub's own\n * shape stays checked, unlike with a cast on the object literal.\n */\nfunction setMockWindow(mockWindow: {\n  location: { href: string, replace?: (url: string) => void },\n}): void {\n  Reflect.set(globalThis, \"window\", mockWindow);\n}\n\n/**\n * Calls one of the app's `protected` methods, which are part of the flows under test but not of the public SDK surface.\n */\nfunction callProtectedMethod(app: StackClientApp<true>, methodName: string, ...args: unknown[]): Promise<unknown> {\n  const method = Reflect.get(app, methodName);\n  if (typeof method !== \"function\") {\n    throw new Error(`Expected StackClientApp to have a ${methodName} method in tests.`);\n  }\n  return method.apply(app, args);\n}\n\ndescribe(\"StackClientApp cross-domain auth\", () => {\n  it(\"keeps noRedirectBack same-domain redirects free of redirect-back state\", async () => {\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl: new URL(\"https://app.example.test/settings?tab=profile\"),\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Same-domain redirects must not create cross-domain handoff parameters.\");\n      },\n    });\n\n    expect(redirectPlan).toEqual({\n      type: \"redirect\",\n      url: \"/handler/sign-in\",\n    });\n  });\n\n  it(\"returns noRedirectBack cross-domain auth to the source app home\", async () => {\n    const handoffState = \"no-redirect-back-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(\"https://app.example.test/settings?tab=profile\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    currentUrl.searchParams.set(\n      \"hexclave_cross_domain_after_callback_redirect_url\",\n      \"https://app.example.test/settings?tab=profile\",\n    );\n\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"https://auth.example.test/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl,\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Existing cross-domain handoff parameters must be reused.\");\n      },\n    });\n\n    expect(redirectPlan.type).toBe(\"redirect\");\n    if (redirectPlan.type !== \"redirect\") {\n      throw new Error(\"Expected noRedirectBack sign-in to produce a redirect URL.\");\n    }\n\n    const hostedUrl = new URL(redirectPlan.url);\n    expect(hostedUrl.origin).toBe(\"https://auth.example.test\");\n    expect(hostedUrl.pathname).toBe(\"/handler/sign-in\");\n    expect(hostedUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n\n    const rawSourceCallbackUrl = hostedUrl.searchParams.get(\"after_auth_return_to\");\n    if (rawSourceCallbackUrl == null) {\n      throw new Error(\"Expected cross-domain noRedirectBack to include its internal source callback URL.\");\n    }\n    const sourceCallbackUrl = new URL(rawSourceCallbackUrl);\n    expect(sourceCallbackUrl.origin).toBe(\"https://app.example.test\");\n    expect(sourceCallbackUrl.pathname).toBe(\"/handler/oauth-callback\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_auth\")).toBe(\"1\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_state\")).toBe(handoffState);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(handoffCodeChallenge);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n    expect(sourceCallbackUrl.toString()).not.toContain(\"/settings\");\n  });\n\n  it(\"exposes redirect-back-aware handler URLs for devtool previews\", async () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    Reflect.set(globalThis, \"window\", {\n      location: {\n        href: \"http://localhost/music?track=1#song\",\n      },\n    });\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000000\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"none\",\n        urls: {\n          signIn: \"/handler/sign-in\",\n        },\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"signIn\");\n\n      const resolved = new URL(redirectUrl, \"http://localhost\");\n      expect(resolved.pathname).toBe(\"/handler/sign-in\");\n      expect(resolved.searchParams.get(\"after_auth_return_to\")).toBe(\"/music?track=1#song\");\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"uses the fresh post-auth refresh token when minting a cross-domain handoff\", async () => {\n    const freshAccessToken = createAccessTokenString(\"fresh-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: {\n        accessToken: createAccessTokenString(\"stale-refresh-token-id\"),\n        refreshToken: \"stale-refresh-token\",\n      },\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSendClientRequest = Reflect.get(clientInterface, \"sendClientRequest\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const capturedRefreshTokens: string[] = [];\n    const capturedAccessTokenRefreshTokenIds: string[] = [];\n    const refreshedRawRefreshTokens: string[] = [];\n\n    Reflect.set(clientInterface, \"sendClientRequest\", async (_path: unknown, _requestOptions: unknown, session: unknown) => {\n      const getRefreshToken = Reflect.get(session ?? {}, \"getRefreshToken\");\n      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, \"getOrFetchLikelyValidTokens\");\n      if (typeof getRefreshToken !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session to the client interface.\");\n      }\n      if (typeof getOrFetchLikelyValidTokens !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session with token accessors.\");\n      }\n      const refreshToken = getRefreshToken.call(session);\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected cross-domain auth to pass a refresh-token-backed session.\");\n      }\n      capturedRefreshTokens.push(refreshTokenString);\n      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);\n      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);\n      return {\n        ok: true,\n        json: async () => ({ redirect_url: \"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\" }),\n      };\n    });\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected refresh token while fetching a new access token.\");\n      }\n      refreshedRawRefreshTokens.push(refreshTokenString);\n      return AccessToken.createIfValid(freshAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, \"_createCrossDomainAuthRedirectUrl\");\n      if (typeof createCrossDomainAuthRedirectUrl !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _createCrossDomainAuthRedirectUrl in tests.\");\n      }\n\n      await expect(createCrossDomainAuthRedirectUrl.call(clientApp, {\n        redirectUri: \"https://example.com/handler/oauth-callback\",\n        state: \"handoff-state\",\n        codeChallenge: \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\",\n        afterCallbackRedirectUrl: \"https://example.com/account-settings\",\n        overrideTokenStoreInit: {\n          accessToken: createAccessTokenString(\"fresh-stale-refresh-token-id\"),\n          refreshToken: \"fresh-refresh-token\",\n        },\n      })).resolves.toBe(\"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\");\n    } finally {\n      Reflect.set(clientInterface, \"sendClientRequest\", originalSendClientRequest);\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedAccessTokenRefreshTokenIds).toEqual([\"fresh-refresh-token-id\"]);\n  });\n\n  it(\"uses a fresh nested OAuth state while preserving the outer cross-domain return state\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000002\";\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const outerState = \"outer-cross-domain-state\";\n    const outerCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"after_auth_return_to\", `https://demo.stack-auth.com/?hexclave_cross_domain_auth=1&hexclave_cross_domain_state=${outerState}`);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", outerState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", outerCodeChallenge);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-session\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const redirectUrl = new URL(redirectedUrl);\n    expect(redirectUrl.searchParams.get(\"state\")).toBe(\"fresh-nested-state\");\n    expect(redirectUrl.searchParams.get(\"code_challenge\")).toBe(\"fresh-nested-code-challenge\");\n    const redirectUri = new URL(redirectUrl.searchParams.get(\"redirect_uri\") ?? \"\");\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_state\")).toBe(outerState);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(outerCodeChallenge);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\"https://demo.stack-auth.com/\");\n  });\n\n  it(\"clears a stale target-domain session before deferring to the source-domain session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000006\";\n    const hostedAccessToken = createAccessTokenString(\"hosted-old-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const tokenStore = Reflect.get(clientApp, \"_memoryTokenStore\");\n    if (!(tokenStore instanceof Store)) {\n      throw new Error(\"Expected StackClientApp to use a memory token store in this test.\");\n    }\n    tokenStore.set({\n      refreshToken: \"hosted-old-refresh-token\",\n      accessToken: hostedAccessToken,\n    });\n\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-anonymous-refresh-token-id\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/handler/oauth-callback\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", \"outer-state\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", \"outer-code-challenge\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/app\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(tokenStore.get()).toEqual({\n      refreshToken: null,\n      accessToken: null,\n    });\n    expect(new URL(redirectedUrl).origin).toBe(\"https://demo.stack-auth.com\");\n  });\n\n  it(\"uses the latest browser refresh cookie before computing nested cross-domain session IDs\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000007\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: \"https://demo.stack-auth.com/\",\n        protocol: \"https:\",\n        hostname: \"demo.stack-auth.com\",\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"cookie\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const refreshedRawRefreshTokens: string[] = [];\n\n    // Cookie-store writes queue a background trusted-parent-domain lookup. Without this stub, that\n    // lookup fetches the (unreachable) baseUrl with retries while holding the global store lock,\n    // which starves any later test that needs the write lock (e.g. signOut). Not restored on\n    // purpose: queued tasks can still run after this test body finishes.\n    vi.spyOn(clientApp as any, \"_getTrustedParentDomain\").mockResolvedValue(null);\n\n    try {\n      const getBrowserCookieTokenStore = Reflect.get(clientApp, \"_getBrowserCookieTokenStore\");\n      if (typeof getBrowserCookieTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.\");\n      }\n      const tokenStore = getBrowserCookieTokenStore.call(clientApp);\n      tokenStore.set({\n        refreshToken: \"old-refresh-token\",\n        accessToken: createAccessTokenString(\"old-refresh-token-id\"),\n      });\n\n      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({\n        refresh_token: \"new-refresh-token\",\n        updated_at_millis: 1,\n      })}`;\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n        const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n        if (typeof refreshTokenString !== \"string\") {\n          throw new Error(\"Expected refresh token while fetching a new access token.\");\n        }\n        refreshedRawRefreshTokens.push(refreshTokenString);\n        return AccessToken.createIfValid(createAccessTokenString(\"new-refresh-token-id\")) ?? (() => {\n          throw new Error(\"Expected test access token to be valid\");\n        })();\n      });\n\n      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\");\n      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.\");\n      }\n      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {\n        awaitPendingAuthResolutions: false,\n      })).resolves.toBe(\"new-refresh-token-id\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"new-refresh-token\"]);\n  });\n\n  it(\"does not re-bounce nested cross-domain auth after the OAuth callback consumed code+state from the URL\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000008\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const strippedUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n    const urlAtConstructionTime = new URL(strippedUrl);\n    urlAtConstructionTime.searchParams.set(\"code\", \"one-time-code\");\n    urlAtConstructionTime.searchParams.set(\"state\", \"nested-oauth-state\");\n\n    // Construct before installing the window mock so the constructor does not schedule its own\n    // nested-auth resolution; the assertions below drive the handler explicitly.\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: strippedUrl.toString(),\n        replace: () => {\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    try {\n      // Without the construction-time URL, the handler re-bounces (location.replace aborts).\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      // With it, the in-flight OAuth callback wins and the handler stands down.\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime)).resolves.toBe(false);\n      // The live-URL guard must also stand down on its own when code+state are still present.\n      (globalThis.window as any).location.href = urlAtConstructionTime.toString();\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).resolves.toBe(false);\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"reports malformed nested cross-domain auth URLs as setup errors\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    globalThis.document = createMockDocument();\n\n    // A URL the flow cannot even parse is as fatal as an untrusted one, so it has to reach the developer the same way\n    // instead of escaping as a bare TypeError from `new URL()`, which the overlay only shows during development.\n    // The two branches of the handler want opposite session states: on the provider side (a.com) a query-derived failure\n    // only becomes a setup error when the handoff belongs to the current session, while the requesting side (b.com) only\n    // bounces when the current session is *not* the one that was asked for.\n    const malformedCases = [\n      {\n        description: \"redirect URI\",\n        currentRefreshTokenId: \"source-refresh-token-id\",\n        params: { redirect_uri: \"not-a-url\", state: \"nested-state\", code_challenge: \"nested-code-challenge\" },\n      },\n      {\n        description: \"after-callback redirect URL\",\n        currentRefreshTokenId: \"source-refresh-token-id\",\n        params: {\n          redirect_uri: \"https://source.example.test/handler/account-settings\",\n          state: \"nested-state\",\n          code_challenge: \"nested-code-challenge\",\n          after_callback_redirect_url: \"http://[\",\n        },\n      },\n      {\n        description: \"callback URL\",\n        currentRefreshTokenId: null,\n        params: { stack_nested_cross_domain_auth_callback_url: \"http://[\" },\n      },\n    ];\n\n    try {\n      for (const malformedCase of malformedCases) {\n        const currentUrl = new URL(\"https://target.example.test/nested-provider\");\n        currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n        for (const [key, value] of Object.entries(malformedCase.params)) {\n          currentUrl.searchParams.set(key, value);\n        }\n        // Each app is constructed with the mock window uninstalled: the constructor's automatic side effects expect a\n        // real window, and a construction-time nested-auth URL would also schedule a second, unawaited run of the\n        // handler that keeps failing in the background and leaks into whichever test runs next.\n        globalThis.window = previousWindow;\n        const clientApp = new StackClientApp({\n          baseUrl: \"http://localhost:12345\",\n          projectId,\n          publishableClientKey: \"stack-pk-test\",\n          tokenStore: \"memory\",\n          redirectMethod: \"window\",\n          noAutomaticPrefetch: true,\n          devTool: false,\n        });\n        setMockWindow({ location: { href: currentUrl.toString() } });\n        Reflect.set(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\", async () => malformedCase.currentRefreshTokenId);\n        Reflect.set(clientApp, \"_isTrusted\", async () => true);\n\n        const nestedAuthPromise = callProtectedMethod(clientApp, \"_maybeHandleNestedCrossDomainAuth\");\n        await expect(nestedAuthPromise).rejects.toThrowError(new RegExp(`${malformedCase.description} .* is not a valid absolute URL`));\n        await expect(nestedAuthPromise).rejects.toSatisfy((error: unknown) => HexclaveSetupError.isSetupError(error));\n      }\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"keeps nested cross-domain auth failures off the page for a handoff that does not own the session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000013\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    globalThis.document = createMockDocument();\n\n    // Setup errors are shown in production, so a link anybody can craft must not be able to put a card on a healthy\n    // app's page: with a refresh-token ID that is not the current session's, every failure below stays an ordinary error\n    // that only captureError sees, even though the same URL from the right session would render a card.\n    const craftedRedirectUris = [\n      \"https://evil.example.test/handler/account-settings\", // untrusted\n      \"not-a-url\", // malformed\n    ];\n\n    try {\n      for (const craftedRedirectUri of craftedRedirectUris) {\n        const currentUrl = new URL(\"https://target.example.test/nested-provider\");\n        currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"attacker-chosen-refresh-token-id\");\n        currentUrl.searchParams.set(\"redirect_uri\", craftedRedirectUri);\n        currentUrl.searchParams.set(\"state\", \"nested-state\");\n        currentUrl.searchParams.set(\"code_challenge\", \"nested-code-challenge\");\n\n        globalThis.window = previousWindow;\n        const clientApp = new StackClientApp({\n          baseUrl: \"http://localhost:12345\",\n          projectId,\n          publishableClientKey: \"stack-pk-test\",\n          tokenStore: \"memory\",\n          redirectMethod: \"window\",\n          noAutomaticPrefetch: true,\n          devTool: false,\n        });\n        setMockWindow({ location: { href: currentUrl.toString() } });\n        Reflect.set(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\", async () => \"this-apps-refresh-token-id\");\n        Reflect.set(clientApp, \"_isTrusted\", async () => false);\n\n        const nestedAuthPromise = callProtectedMethod(clientApp, \"_maybeHandleNestedCrossDomainAuth\");\n        await expect(nestedAuthPromise).rejects.toThrowError(/does not match the requested refresh token ID/);\n        await expect(nestedAuthPromise).rejects.toSatisfy(\n          (error: unknown) => !HexclaveSetupError.isSetupError(error),\n        );\n      }\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"passes the construction-time URL to the nested cross-domain auth handler\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000009\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const callbackUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    callbackUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    callbackUrl.searchParams.set(\"code\", \"one-time-code\");\n    callbackUrl.searchParams.set(\"state\", \"nested-oauth-state\");\n    const strippedUrl = new URL(callbackUrl);\n    strippedUrl.searchParams.delete(\"code\");\n    strippedUrl.searchParams.delete(\"state\");\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: callbackUrl.toString(),\n      },\n    } as any;\n\n    const nestedAuthSpy = vi.spyOn(StackClientApp.prototype as any, \"_maybeHandleNestedCrossDomainAuth\").mockResolvedValue(false);\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      // Simulate consumeOAuthCallbackQueryParams stripping code+state before microtasks run.\n      (globalThis.window as any).location.href = strippedUrl.toString();\n      await new Promise((resolve) => setTimeout(resolve, 0));\n\n      expect(nestedAuthSpy).toHaveBeenCalledTimes(1);\n      const urlArgument = nestedAuthSpy.mock.calls[0][0] as URL;\n      expect(urlArgument).toBeInstanceOf(URL);\n      expect(urlArgument.searchParams.get(\"code\")).toBe(\"one-time-code\");\n      expect(urlArgument.searchParams.get(\"state\")).toBe(\"nested-oauth-state\");\n    } finally {\n      nestedAuthSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"redirects hosted current-page OAuth callback errors to the hosted error handler during startup\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000010\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const callbackUrl = new URL(\"https://demo.stack-auth.com/dashboard\");\n    callbackUrl.searchParams.set(\"errorCode\", \"SIGN_UP_REJECTED\");\n    callbackUrl.searchParams.set(\"message\", \"Your sign up was rejected by an administrator's sign-up rule.\");\n    callbackUrl.searchParams.set(\"details\", JSON.stringify({\n      message: \"Your sign up was rejected by an administrator's sign-up rule.\",\n    }));\n    callbackUrl.searchParams.set(\"after_auth_return_to\", \"/dashboard\");\n    callbackUrl.searchParams.set(\"after_callback_redirect_url\", \"https://customer.example.test/settings?tab=connected-accounts\");\n    let currentHref = callbackUrl.toString();\n    let redirectedUrl = \"\";\n    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, \"_redirectTo\").mockImplementation(async (...args: unknown[]) => {\n      const options = args[0] as { url: string | URL };\n      redirectedUrl = options.url.toString();\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n        set href(value: string) {\n          currentHref = value;\n        },\n        origin: callbackUrl.origin,\n      },\n      history: {\n        replaceState: (_state: unknown, _title: string, url: string) => {\n          currentHref = new URL(url, currentHref).toString();\n        },\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        urls: {\n          default: { type: \"hosted\" },\n        },\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      await new Promise((resolve) => setTimeout(resolve, 0));\n      await new Promise((resolve) => setTimeout(resolve, 0));\n    } finally {\n      redirectSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const errorUrl = new URL(redirectedUrl);\n    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);\n    expect(errorUrl.pathname).toBe(\"/handler/error\");\n    expect(errorUrl.searchParams.get(\"errorCode\")).toBe(\"SIGN_UP_REJECTED\");\n    expect(errorUrl.searchParams.get(\"message\")).toBe(\"Your sign up was rejected by an administrator's sign-up rule.\");\n    expect(errorUrl.searchParams.get(\"after_auth_return_to\")).toBe(\"/dashboard\");\n    expect(errorUrl.searchParams.get(\"after_callback_redirect_url\")).toBe(\"https://customer.example.test/settings?tab=connected-accounts\");\n    expect(new URL(currentHref).searchParams.has(\"errorCode\")).toBe(false);\n  });\n\n  it(\"uses direct sign-out instead of hosted sign-out redirects when code execution is available\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/handler\",\n        signOut: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const signOutSpy = vi.spyOn(clientApp, \"signOut\").mockRejectedValue(new Error(\"INTENTIONAL_TEST_ABORT\"));\n\n    try {\n      await expect(clientApp.redirectToSignOut()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      expect(signOutSpy).toHaveBeenCalledWith();\n    } finally {\n      signOutSpy.mockRestore();\n    }\n  });\n\n  it(\"throws when public app.urls reads would return hosted component URLs\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    expect(() => clientApp.urls.signIn).toThrowError(/app\\.urls\\.signIn cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignIn\\(\\) instead/s);\n    expect(() => clientApp.urls.signOut).toThrowError(/app\\.urls\\.signOut cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignOut\\(\\) instead/s);\n    expect(clientApp.urls.afterSignIn).toBe(\"/\");\n  });\n\n  it(\"keeps public app.urls reads available for non-hosted targets\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/custom-handler\",\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    expect(clientApp.urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"keeps default hosted signOut() on the source domain when afterSignOut is not configured\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000004\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const currentHref = \"https://demo.stack-auth.com/settings?tab=profile\";\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSignOut = Reflect.get(clientInterface, \"signOut\");\n    Reflect.set(clientInterface, \"signOut\", async () => {});\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentHref,\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      const signOut = Reflect.get(clientApp, \"_signOut\");\n      if (typeof signOut !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _signOut in tests.\");\n      }\n      await expect(signOut.call(clientApp, Reflect.get(clientInterface, \"createSession\").call(clientInterface, {\n        refreshToken: null,\n      }))).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"signOut\", originalSignOut);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(redirectedUrl).toBe(\"/settings?tab=profile\");\n  });\n\n  it(\"restores a dropped after_auth_return_to from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n    const windowMock = {\n      location: {\n        href: \"https://demo.example.test/handler/sign-in?after_auth_return_to=%2Fmusic%3Ftrack%3D1\",\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      // The constructor mirrors the redirect-back state from the arrival URL into sessionStorage.\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000011\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      // Intermediate hops (MFA, magic link, OAuth round-trips, ...) dropped the query params.\n      windowMock.location.href = \"https://demo.example.test/handler/mfa\";\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n      expect(redirectUrl).toBe(\"/music?track=1\");\n\n      // noRedirectBack opts out of the mirror just like it opts out of the query param.\n      const noRedirectBackUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\", { noRedirectBack: true });\n      expect(new URL(noRedirectBackUrl, \"https://demo.example.test\").pathname).toBe(\"/\");\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"restores dropped cross-domain handoff state from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n\n    const handoffState = \"mirror-handoff-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const handoffAfterCallbackRedirect = \"https://demo.example.test/dashboard\";\n    const redirectBackUrl = new URL(\"https://demo.example.test/handler/oauth-callback\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_auth\", \"1\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);\n    arrivalUrl.searchParams.set(\"after_auth_return_to\", redirectBackUrl.toString());\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const previousDocument = globalThis.document;\n    const windowMock = {\n      location: {\n        href: arrivalUrl.toString(),\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n      const crossDomainAuthorizeRedirect = \"https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state\";\n      const createCrossDomainAuthRedirectUrlSpy = vi\n        .spyOn(clientApp as any, \"_createCrossDomainAuthRedirectUrl\")\n        .mockResolvedValue(crossDomainAuthorizeRedirect);\n\n      // All redirect-back query params were dropped before the after-sign-in redirect.\n      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n\n      expect(createCrossDomainAuthRedirectUrlSpy).toHaveBeenCalledWith(expect.objectContaining({\n        redirectUri: redirectBackUrl.toString(),\n        state: handoffState,\n        codeChallenge: handoffCodeChallenge,\n        afterCallbackRedirectUrl: handoffAfterCallbackRedirect,\n      }));\n      expect(redirectUrl).toBe(crossDomainAuthorizeRedirect);\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"ignores stale session callbacks after a newer refresh token owns the token store\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000005\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const oldAccessToken = createAccessTokenString(\"old-refresh-token-id\");\n    const refreshedOldAccessToken = createAccessTokenString(\"refreshed-old-refresh-token-id\");\n    const newAccessToken = createAccessTokenString(\"new-refresh-token-id\");\n    const tokenStore = new Store({\n      refreshToken: \"old-refresh-token\",\n      accessToken: oldAccessToken,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const getSessionFromTokenStore = Reflect.get(clientApp, \"_getSessionFromTokenStore\");\n      if (typeof getSessionFromTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getSessionFromTokenStore in tests.\");\n      }\n      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);\n      tokenStore.set({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      await oldSession.fetchNewTokens();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      oldSession.markInvalid();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n  });\n});\n"],"mappings":";;;;;;;;AAgBA,SAAS,wBAAwB,gBAAgC;CAC/D,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,qBAA+B;CACtC,MAAM,4BAAY,IAAI,IAAoB;CAC1C,OAAO;EACL,IAAI,SAAS;GACX,OAAO,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;EACpF;EACA,IAAI,OAAO,KAAa;GACtB,MAAM,CAAC,aAAa,IAAI,MAAM,GAAG;GACjC,MAAM,UAAU,UAAU,QAAQ,GAAG;GACrC,IAAI,UAAU,GAAG;GACjB,UAAU,IAAI,UAAU,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACvF;EACA,sBAAsB,CAAC;CACzB;AACF;;;;;;AAOA,SAAS,cAAc,YAEd;CACP,QAAQ,IAAI,YAAY,UAAU,UAAU;AAC9C;;;;AAKA,SAAS,oBAAoB,KAA2B,YAAoB,GAAG,MAAmC;CAChH,MAAM,SAAS,QAAQ,IAAI,KAAK,UAAU;CAC1C,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,MAAM,qCAAqC,WAAW,kBAAkB;CAEpF,OAAO,OAAO,MAAM,KAAK,IAAI;AAC/B;qBAES,0CAA0C;CACjD,CAAA,GAAA,OAAA,GAAA,CAAG,0EAA0E,YAAY;EAavF,CAAA,GAAA,OAAA,OAAA,CAAO,OAAA,GAAA,wBAAA,sBAAA,CAZ0C;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY,IAAI,IAAI,+CAA+C;GACnE,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,wEAAwE;GAC1F;EACF,CAAC,CAEkB,CAAC,CAAC,QAAQ;GAC3B,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,mEAAmE,YAAY;EAChF,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,aAAa,IAAI,IAAI,+CAA+C;EAC1E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IACtB,qDACA,+CACF;EAEA,MAAM,eAAe,OAAA,GAAA,wBAAA,sBAAA,CAA4B;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB;GACA,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,0DAA0D;GAC5E;EACF,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,IAAI,CAAC,CAAC,KAAK,UAAU;EACzC,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,YAAY,IAAI,IAAI,aAAa,GAAG;EAC1C,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,MAAM,CAAC,CAAC,KAAK,2BAA2B;EACzD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,QAAQ,CAAC,CAAC,KAAK,kBAAkB;EAClD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KACtF,+BACF;EAEA,MAAM,uBAAuB,UAAU,aAAa,IAAI,sBAAsB;EAC9E,IAAI,wBAAwB,MAC1B,MAAM,IAAI,MAAM,mFAAmF;EAErG,MAAM,oBAAoB,IAAI,IAAI,oBAAoB;EACtD,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK,0BAA0B;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,QAAQ,CAAC,CAAC,KAAK,yBAAyB;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,4BAA4B,CAAC,CAAC,CAAC,KAAK,GAAG;EACjF,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3F,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,oBAAoB;EAC5G,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAC9F,+BACF;EACA,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,WAAW;CAChE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iEAAiE,YAAY;EAC9E,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,QAAQ,IAAI,YAAY,UAAU,EAChC,UAAU,EACR,MAAM,sCACR,EACF,CAAC;EAED,IAAI;GAcF,MAAM,cAAc,MAAM,IAbJA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,QAAQ,mBACV;IACA,qBAAqB;IACrB,SAAS;GACX,CAEkC,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,wBAAwB,QAAQ;GAEhG,MAAM,WAAW,IAAI,IAAI,aAAa,kBAAkB;GACxD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,kBAAkB;GACjD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,qBAAqB;EACtF,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E,YAAY;EAC3F,MAAM,mBAAmB,wBAAwB,wBAAwB;EACzE,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;IACV,aAAa,wBAAwB,wBAAwB;IAC7D,cAAc;GAChB;GACA,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,4BAA4B,QAAQ,IAAI,iBAAiB,mBAAmB;EAClF,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,wBAAkC,CAAC;EACzC,MAAM,qCAA+C,CAAC;EACtD,MAAM,4BAAsC,CAAC;EAE7C,QAAQ,IAAI,iBAAiB,qBAAqB,OAAO,OAAgB,iBAA0B,YAAqB;GACtH,MAAM,kBAAkB,QAAQ,IAAI,WAAW,CAAC,GAAG,iBAAiB;GACpE,MAAM,8BAA8B,QAAQ,IAAI,WAAW,CAAC,GAAG,6BAA6B;GAC5F,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,MAAM,uEAAuE;GAEzF,IAAI,OAAO,gCAAgC,YACzC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,MAAM,eAAe,gBAAgB,KAAK,OAAO;GACjD,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,sBAAsB,KAAK,kBAAkB;GAC7C,MAAM,SAAS,MAAM,4BAA4B,KAAK,SAAS,GAAG,IAAI;GACtE,mCAAmC,KAAK,OAAO,YAAY,QAAQ,gBAAgB;GACnF,OAAO;IACL,IAAI;IACJ,MAAM,aAAa,EAAE,cAAc,mFAAmF;GACxH;EACF,CAAC;EACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;GACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,0BAA0B,KAAK,kBAAkB;GACjD,OAAOE,+BAAAA,YAAY,cAAc,gBAAgB,YAAY;IAC3D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,mCAAmC,QAAQ,IAAI,WAAW,mCAAmC;GACnG,IAAI,OAAO,qCAAqC,YAC9C,MAAM,IAAI,MAAM,+EAA+E;GAGjG,OAAA,GAAA,OAAA,OAAA,CAAa,iCAAiC,KAAK,WAAW;IAC5D,aAAa;IACb,OAAO;IACP,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;KACtB,aAAa,wBAAwB,8BAA8B;KACnE,cAAc;IAChB;GACF,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,kFAAkF;EACtG,UAAU;GACR,QAAQ,IAAI,iBAAiB,qBAAqB,yBAAyB;GAC3E,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,qBAAqB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EAC7D,CAAA,GAAA,OAAA,OAAA,CAAO,kCAAkC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,wFAAwF,YAAY;EACrG,MAAM,YAAY;EAClB,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,qBAAqB;EAC3B,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,wBAAwB,yFAAyF,YAAY;EACzJ,WAAW,aAAa,IAAI,+BAA+B,UAAU;EACrE,WAAW,aAAa,IAAI,wCAAwC,kBAAkB;EACtF,WAAW,aAAa,IAAI,qDAAqD,8BAA8B;EAC/G,WAAW,aAAa,IAAI,mDAAmD,gBAAgB;EAC/F,WAAW,aAAa,IAAI,+CAA+C,8BAA8B;EAEzG,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa;EACzC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACvE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,6BAA6B;EACzF,MAAM,cAAc,IAAI,IAAI,YAAY,aAAa,IAAI,cAAc,KAAK,EAAE;EAC9E,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,UAAU;EACnF,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACpG,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAAK,8BAA8B;CAC/H,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sFAAsF,YAAY;EACnG,MAAM,YAAY;EAClB,MAAM,oBAAoB,wBAAwB,6BAA6B;EAC/E,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa,QAAQ,IAAI,WAAW,mBAAmB;EAC7D,IAAI,EAAE,sBAAsBG,mCAAAA,QAC1B,MAAM,IAAI,MAAM,mEAAmE;EAErF,WAAW,IAAI;GACb,cAAc;GACd,aAAa;EACf,CAAC;EAED,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,mDAAmD,mCAAmC;EAClH,WAAW,aAAa,IAAI,+CAA+C,oDAAoD;EAC/H,WAAW,aAAa,IAAI,+BAA+B,aAAa;EACxE,WAAW,aAAa,IAAI,wCAAwC,sBAAsB;EAC1F,WAAW,aAAa,IAAI,qDAAqD,iCAAiC;EAElH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,iBAAiB,YAAY;IAC5D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;GAC/B,cAAc;GACd,aAAa;EACf,CAAC;EACD,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,6BAA6B;CAC1E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,MAAM;IACN,UAAU;IACV,UAAU;GACZ;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,4BAAsC,CAAC;EAM7C,OAAA,GAAG,MAAM,WAAkB,yBAAyB,CAAC,CAAC,kBAAkB,IAAI;EAE5E,IAAI;GACF,MAAM,6BAA6B,QAAQ,IAAI,WAAW,6BAA6B;GACvF,IAAI,OAAO,+BAA+B,YACxC,MAAM,IAAI,MAAM,yEAAyE;GAG3F,2BAD8C,KAAK,SAC1C,CAAC,CAAC,IAAI;IACb,cAAc;IACd,aAAa,wBAAwB,sBAAsB;GAC7D,CAAC;GAED,SAAS,SAAS,2BAA2B,UAAU,YAAY,KAAK,UAAU;IAChF,eAAe;IACf,mBAAmB;GACrB,CAAC;GACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;IACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;IAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;IAE7E,0BAA0B,KAAK,kBAAkB;IACjD,OAAOE,+BAAAA,YAAY,cAAc,wBAAwB,sBAAsB,CAAC,YAAY;KAC1F,MAAM,IAAI,MAAM,wCAAwC;IAC1D,EAAA,CAAG;GACL,CAAC;GAED,MAAM,uCAAuC,QAAQ,IAAI,WAAW,uCAAuC;GAC3G,IAAI,OAAO,yCAAyC,YAClD,MAAM,IAAI,MAAM,mFAAmF;GAErG,OAAA,GAAA,OAAA,OAAA,CAAa,qCAAqC,KAAK,WAAW,EAChE,6BAA6B,MAC/B,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB;EAC1C,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,+CAA+C,8BAA8B;EAC1G,MAAM,wBAAwB,IAAI,IAAI,WAAW;EACjD,sBAAsB,aAAa,IAAI,QAAQ,eAAe;EAC9D,sBAAsB,aAAa,IAAI,SAAS,oBAAoB;EAIpE,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,YAAY,SAAS;GAC3B,eAAe;IACb,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,IAAI;GAEF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GAElH,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,qBAAqB,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;GAE7G,WAAY,OAAe,SAAS,OAAO,sBAAsB,SAAS;GAC1E,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;EAC1F,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,mEAAmE,YAAY;EAChF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,WAAW,WAAW,mBAAmB;EAOzC,MAAM,iBAAiB;GACrB;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ;KAAE,cAAc;KAAa,OAAO;KAAgB,gBAAgB;IAAwB;GACtG;GACA;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ;KACN,cAAc;KACd,OAAO;KACP,gBAAgB;KAChB,6BAA6B;IAC/B;GACF;GACA;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ,EAAE,6CAA6C,WAAW;GACpE;EACF;EAEA,IAAI;GACF,KAAK,MAAM,iBAAiB,gBAAgB;IAC1C,MAAM,aAAa,IAAI,IAAI,6CAA6C;IACxE,WAAW,aAAa,IAAI,mDAAmD,yBAAyB;IACxG,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,MAAM,GAC5D,WAAW,aAAa,IAAI,KAAK,KAAK;IAKxC,WAAW,SAAS;IACpB,MAAM,YAAY,IAAIA,4BAAAA,eAAe;KACnC,SAAS;KACT;KACA,sBAAsB;KACtB,YAAY;KACZ,gBAAgB;KAChB,qBAAqB;KACrB,SAAS;IACX,CAAC;IACD,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,SAAS,EAAE,EAAE,CAAC;IAC3D,QAAQ,IAAI,WAAW,yCAAyC,YAAY,cAAc,qBAAqB;IAC/G,QAAQ,IAAI,WAAW,cAAc,YAAY,IAAI;IAErD,MAAM,oBAAoB,oBAAoB,WAAW,mCAAmC;IAC5F,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,aAAa,IAAI,OAAO,GAAG,cAAc,YAAY,gCAAgC,CAAC;IAC9H,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,WAAW,UAAmBI,mCAAAA,mBAAmB,aAAa,KAAK,CAAC;GAC9G;EACF,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oGAAoG,YAAY;EACjH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,WAAW,WAAW,mBAAmB;EAKzC,MAAM,sBAAsB,CAC1B,sDACA,WACF;EAEA,IAAI;GACF,KAAK,MAAM,sBAAsB,qBAAqB;IACpD,MAAM,aAAa,IAAI,IAAI,6CAA6C;IACxE,WAAW,aAAa,IAAI,mDAAmD,kCAAkC;IACjH,WAAW,aAAa,IAAI,gBAAgB,kBAAkB;IAC9D,WAAW,aAAa,IAAI,SAAS,cAAc;IACnD,WAAW,aAAa,IAAI,kBAAkB,uBAAuB;IAErE,WAAW,SAAS;IACpB,MAAM,YAAY,IAAIJ,4BAAAA,eAAe;KACnC,SAAS;KACT;KACA,sBAAsB;KACtB,YAAY;KACZ,gBAAgB;KAChB,qBAAqB;KACrB,SAAS;IACX,CAAC;IACD,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,SAAS,EAAE,EAAE,CAAC;IAC3D,QAAQ,IAAI,WAAW,yCAAyC,YAAY,4BAA4B;IACxG,QAAQ,IAAI,WAAW,cAAc,YAAY,KAAK;IAEtD,MAAM,oBAAoB,oBAAoB,WAAW,mCAAmC;IAC5F,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,aAAa,+CAA+C;IACpG,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,WACrC,UAAmB,CAACI,mCAAAA,mBAAmB,aAAa,KAAK,CAC5D;GACF;EACF,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4EAA4E,YAAY;EACzF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,QAAQ,eAAe;EACpD,YAAY,aAAa,IAAI,SAAS,oBAAoB;EAC1D,MAAM,cAAc,IAAI,IAAI,WAAW;EACvC,YAAY,aAAa,OAAO,MAAM;EACtC,YAAY,aAAa,OAAO,OAAO;EAEvC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU,EACR,MAAM,YAAY,SAAS,EAC7B,EACF;EAEA,MAAM,gBAAgBC,OAAAA,GAAG,MAAML,4BAAAA,eAAe,WAAkB,mCAAmC,CAAC,CAAC,kBAAkB,KAAK;EAE5H,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GAGD,WAAY,OAAe,SAAS,OAAO,YAAY,SAAS;GAChE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GAErD,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,sBAAsB,CAAC;GAC7C,MAAM,cAAc,cAAc,KAAK,MAAM,EAAE,CAAC;GAChD,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,eAAe,GAAG;GACtC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;GACjE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACzE,UAAU;GACR,cAAc,YAAY;GAC1B,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kGAAkG,YAAY;EAC/G,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,cAAc,IAAI,IAAI,uCAAuC;EACnE,YAAY,aAAa,IAAI,aAAa,kBAAkB;EAC5D,YAAY,aAAa,IAAI,WAAW,+DAA+D;EACvG,YAAY,aAAa,IAAI,WAAW,KAAK,UAAU,EACrD,SAAS,gEACX,CAAC,CAAC;EACF,YAAY,aAAa,IAAI,wBAAwB,YAAY;EACjE,YAAY,aAAa,IAAI,+BAA+B,+DAA+D;EAC3H,IAAI,cAAc,YAAY,SAAS;EACvC,IAAI,gBAAgB;EACpB,MAAM,cAAcK,OAAAA,GAAG,MAAML,4BAAAA,eAAe,WAAkB,aAAa,CAAC,CAAC,mBAAmB,OAAO,GAAG,SAAoB;GAE5H,gBADgB,KAAK,EACE,CAAC,IAAI,SAAS;EACvC,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,IAAI,OAAO;KACT,OAAO;IACT;IACA,IAAI,KAAK,OAAe;KACtB,cAAc;IAChB;IACA,QAAQ,YAAY;GACtB;GACA,SAAS,EACP,eAAe,QAAiB,QAAgB,QAAgB;IAC9D,cAAc,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,SAAS;GACnD,EACF;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;IACA,qBAAqB;IACrB,SAAS;GACX,CAAC;GAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GACrD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;EACvD,UAAU;GACR,YAAY,YAAY;GACxB,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,WAAW,IAAI,IAAI,aAAa;EACtC,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,MAAM,CAAC,CAAC,KAAK,WAAW,UAAU,yBAAyB;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,gBAAgB;EAC/C,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACtE,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACjH,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,WAAW,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK;CACvE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8FAA8F,YAAY;EAC3G,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM;IACJ,SAAS;IACT,SAAS,EAAE,MAAM,SAAS;GAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAaK,OAAAA,GAAG,MAAM,WAAW,SAAS,CAAC,CAAC,kCAAkB,IAAI,MAAM,wBAAwB,CAAC;EAEvG,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAa,UAAU,kBAAkB,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GACzF,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,CAAC,CAAC,qBAAqB;EAC1C,UAAU;GACR,WAAW,YAAY;EACzB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E;EAC/E,MAAM,YAAY,IAAIL,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,MAAM,CAAC,CAAC,aAAa,+HAA+H;EAChL,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,OAAO,CAAC,CAAC,aAAa,iIAAiI;EACnL,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,KAAK,WAAW,CAAC,CAAC,KAAK,GAAG;CAC7C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE;EAcvE,CAAA,GAAA,OAAA,OAAA,CAAO,IAbeA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,kBACX;GACA,qBAAqB;GACrB,SAAS;EACX,CAEe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,yBAAyB;CAC9D,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,cAAc;EAEpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,kBAAkB,QAAQ,IAAI,iBAAiB,SAAS;EAC9D,QAAQ,IAAI,iBAAiB,WAAW,YAAY,CAAC,CAAC;EACtD,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EAEpB,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM;GACN,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,UAAU,QAAQ,IAAI,WAAW,UAAU;GACjD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,sDAAsD;GAExE,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,KAAK,WAAW,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CAAC,KAAK,iBAAiB,EACvG,cAAc,KAChB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpD,UAAU;GACR,QAAQ,IAAI,iBAAiB,WAAW,eAAe;GACvD,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,uBAAuB;CACpD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAClD,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,sFACR;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GAEF,MAAM,YAAY,IAAIA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GAGD,WAAW,SAAS,OAAO;GAG3B,CAAA,GAAA,OAAA,OAAA,CAAO,MADmB,UAAUC,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa,CACnF,CAAC,CAAC,KAAK,gBAAgB;GAGzC,MAAM,oBAAoB,MAAM,UAAUA,gBAAAA,2BAA2B,CAAC,wBAAwB,eAAe,EAAE,gBAAgB,KAAK,CAAC;GACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,mBAAmB,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG;EACnF,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6GAA6G,YAAY;EAC1H,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAElD,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,+BAA+B;EACrC,MAAM,kBAAkB,IAAI,IAAI,kDAAkD;EAClF,gBAAgB,aAAa,IAAI,8BAA8B,GAAG;EAClE,gBAAgB,aAAa,IAAI,+BAA+B,YAAY;EAC5E,gBAAgB,aAAa,IAAI,wCAAwC,oBAAoB;EAC7F,gBAAgB,aAAa,IAAI,qDAAqD,4BAA4B;EAElH,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,yCAAyC;EACzF,WAAW,aAAa,IAAI,wBAAwB,gBAAgB,SAAS,CAAC;EAC9E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IAAI,qDAAqD,4BAA4B;EAE7G,MAAM,mBAAmB,WAAW;EACpC,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,WAAW,SAAS,EAC5B;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GACF,MAAM,YAAY,IAAID,4BAAAA,eAAe;IACnC,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GACD,MAAM,+BAA+B;GACrC,MAAM,sCAAsCK,OAAAA,GACzC,MAAM,WAAkB,mCAAmC,CAAC,CAC5D,kBAAkB,4BAA4B;GAGjD,WAAW,SAAS,OAAO,WAAW,UAAU;GAEhD,MAAM,cAAc,MAAM,UAAUJ,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa;GAErG,CAAA,GAAA,OAAA,OAAA,CAAO,mCAAmC,CAAC,CAAC,qBAAqBK,OAAAA,OAAO,iBAAiB;IACvF,aAAa,gBAAgB,SAAS;IACtC,OAAO;IACP,eAAe;IACf,0BAA0B;GAC5B,CAAC,CAAC;GACF,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,KAAK,4BAA4B;EACvD,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oFAAoF,YAAY;EACjG,MAAM,YAAY,IAAIN,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,0BAA0B,wBAAwB,gCAAgC;EACxF,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,aAAa,IAAIG,mCAAAA,MAAM;GAC3B,cAAc;GACd,aAAa;EACf,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,uBAAuB,YAAY;IAClE,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,2BAA2B,QAAQ,IAAI,WAAW,2BAA2B;GACnF,IAAI,OAAO,6BAA6B,YACtC,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,aAAa,yBAAyB,KAAK,WAAW,UAAU;GACtE,WAAW,IAAI;IACb,cAAc;IACd,aAAa;GACf,CAAC;GAED,MAAM,WAAW,eAAe;GAChC,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;GAED,WAAW,YAAY;GACvB,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;EACH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"client-app-impl.cross-domain.test.js","names":["StackClientApp","hexclaveAppInternalsSymbol","AccessToken","Store","HexclaveSetupError","vi","expect"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it, vi } from \"vitest\";\nimport { AccessToken } from \"@hexclave/shared/dist/sessions\";\nimport { HexclaveSetupError } from \"@hexclave/shared/dist/utils/errors\";\nimport { Store } from \"@hexclave/shared/dist/utils/stores\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { StackClientApp } from \"../interfaces/client-app\";\nimport { planRedirectToHandler } from \"./redirect-page-urls\";\n\n// Every app in this file is constructed with `devTool: false`. The tests install a mock window and document, which makes\n// the SDK believe it is in a browser; mounting the dev tool would then start background requests against a backend that\n// does not exist here and leak that work across test cases.\nfunction createAccessTokenString(refreshTokenId: string): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createMockDocument(): Document {\n  const cookieJar = new Map<string, string>();\n  return {\n    get cookie() {\n      return [...cookieJar.entries()].map(([key, value]) => `${key}=${value}`).join(\"; \");\n    },\n    set cookie(str: string) {\n      const [nameValue] = str.split(\";\");\n      const eqIndex = nameValue.indexOf(\"=\");\n      if (eqIndex < 0) return;\n      cookieJar.set(nameValue.slice(0, eqIndex).trim(), nameValue.slice(eqIndex + 1).trim());\n    },\n    createElement: () => ({}),\n  } as any;\n}\n\n/**\n * Installs a stand-in for `window` with only the parts the code under test touches. `globalThis.window` is typed as a\n * full `Window`, which a hand-written stub can never be, so the assignment goes through `Reflect.set` — the stub's own\n * shape stays checked, unlike with a cast on the object literal.\n */\nfunction setMockWindow(mockWindow: {\n  location: { href: string, replace?: (url: string) => void },\n}): void {\n  Reflect.set(globalThis, \"window\", mockWindow);\n}\n\n/**\n * Calls one of the app's `protected` methods, which are part of the flows under test but not of the public SDK surface.\n */\nfunction callProtectedMethod(app: StackClientApp<true>, methodName: string, ...args: unknown[]): Promise<unknown> {\n  const method = Reflect.get(app, methodName);\n  if (typeof method !== \"function\") {\n    throw new Error(`Expected StackClientApp to have a ${methodName} method in tests.`);\n  }\n  return method.apply(app, args);\n}\n\ndescribe(\"StackClientApp cross-domain auth\", () => {\n  it(\"keeps noRedirectBack same-domain redirects free of redirect-back state\", async () => {\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl: new URL(\"https://app.example.test/settings?tab=profile\"),\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Same-domain redirects must not create cross-domain handoff parameters.\");\n      },\n    });\n\n    expect(redirectPlan).toEqual({\n      type: \"redirect\",\n      url: \"/handler/sign-in\",\n    });\n  });\n\n  it(\"returns noRedirectBack cross-domain auth to the source app home\", async () => {\n    const handoffState = \"no-redirect-back-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(\"https://app.example.test/settings?tab=profile\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    currentUrl.searchParams.set(\n      \"hexclave_cross_domain_after_callback_redirect_url\",\n      \"https://app.example.test/settings?tab=profile\",\n    );\n\n    const redirectPlan = await planRedirectToHandler({\n      handlerName: \"signIn\",\n      rawHandlerUrl: \"https://auth.example.test/handler/sign-in\",\n      noRedirectBack: true,\n      currentUrl,\n      localOAuthCallbackUrl: \"/handler/oauth-callback\",\n      rawHomeUrl: \"/home\",\n      getCrossDomainHandoffParams: async () => {\n        throw new Error(\"Existing cross-domain handoff parameters must be reused.\");\n      },\n    });\n\n    expect(redirectPlan.type).toBe(\"redirect\");\n    if (redirectPlan.type !== \"redirect\") {\n      throw new Error(\"Expected noRedirectBack sign-in to produce a redirect URL.\");\n    }\n\n    const hostedUrl = new URL(redirectPlan.url);\n    expect(hostedUrl.origin).toBe(\"https://auth.example.test\");\n    expect(hostedUrl.pathname).toBe(\"/handler/sign-in\");\n    expect(hostedUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n\n    const rawSourceCallbackUrl = hostedUrl.searchParams.get(\"after_auth_return_to\");\n    if (rawSourceCallbackUrl == null) {\n      throw new Error(\"Expected cross-domain noRedirectBack to include its internal source callback URL.\");\n    }\n    const sourceCallbackUrl = new URL(rawSourceCallbackUrl);\n    expect(sourceCallbackUrl.origin).toBe(\"https://app.example.test\");\n    expect(sourceCallbackUrl.pathname).toBe(\"/handler/oauth-callback\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_auth\")).toBe(\"1\");\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_state\")).toBe(handoffState);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(handoffCodeChallenge);\n    expect(sourceCallbackUrl.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\n      \"https://app.example.test/home\",\n    );\n    expect(sourceCallbackUrl.toString()).not.toContain(\"/settings\");\n  });\n\n  it(\"exposes redirect-back-aware handler URLs for devtool previews\", async () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    Reflect.set(globalThis, \"window\", {\n      location: {\n        href: \"http://localhost/music?track=1#song\",\n      },\n    });\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000000\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"none\",\n        urls: {\n          signIn: \"/handler/sign-in\",\n        },\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"signIn\");\n\n      const resolved = new URL(redirectUrl, \"http://localhost\");\n      expect(resolved.pathname).toBe(\"/handler/sign-in\");\n      expect(resolved.searchParams.get(\"after_auth_return_to\")).toBe(\"/music?track=1#song\");\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"uses the fresh post-auth refresh token when minting a cross-domain handoff\", async () => {\n    const freshAccessToken = createAccessTokenString(\"fresh-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000000\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: {\n        accessToken: createAccessTokenString(\"stale-refresh-token-id\"),\n        refreshToken: \"stale-refresh-token\",\n      },\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSendClientRequest = Reflect.get(clientInterface, \"sendClientRequest\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const capturedRefreshTokens: string[] = [];\n    const capturedAccessTokenRefreshTokenIds: string[] = [];\n    const refreshedRawRefreshTokens: string[] = [];\n\n    Reflect.set(clientInterface, \"sendClientRequest\", async (_path: unknown, _requestOptions: unknown, session: unknown) => {\n      const getRefreshToken = Reflect.get(session ?? {}, \"getRefreshToken\");\n      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, \"getOrFetchLikelyValidTokens\");\n      if (typeof getRefreshToken !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session to the client interface.\");\n      }\n      if (typeof getOrFetchLikelyValidTokens !== \"function\") {\n        throw new Error(\"Expected cross-domain auth to pass a session with token accessors.\");\n      }\n      const refreshToken = getRefreshToken.call(session);\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected cross-domain auth to pass a refresh-token-backed session.\");\n      }\n      capturedRefreshTokens.push(refreshTokenString);\n      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);\n      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);\n      return {\n        ok: true,\n        json: async () => ({ redirect_url: \"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\" }),\n      };\n    });\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n      const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n      if (typeof refreshTokenString !== \"string\") {\n        throw new Error(\"Expected refresh token while fetching a new access token.\");\n      }\n      refreshedRawRefreshTokens.push(refreshTokenString);\n      return AccessToken.createIfValid(freshAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, \"_createCrossDomainAuthRedirectUrl\");\n      if (typeof createCrossDomainAuthRedirectUrl !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _createCrossDomainAuthRedirectUrl in tests.\");\n      }\n\n      await expect(createCrossDomainAuthRedirectUrl.call(clientApp, {\n        redirectUri: \"https://example.com/handler/oauth-callback\",\n        state: \"handoff-state\",\n        codeChallenge: \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\",\n        afterCallbackRedirectUrl: \"https://example.com/account-settings\",\n        overrideTokenStoreInit: {\n          accessToken: createAccessTokenString(\"fresh-stale-refresh-token-id\"),\n          refreshToken: \"fresh-refresh-token\",\n        },\n      })).resolves.toBe(\"https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state\");\n    } finally {\n      Reflect.set(clientInterface, \"sendClientRequest\", originalSendClientRequest);\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedRefreshTokens).toEqual([\"fresh-refresh-token\"]);\n    expect(capturedAccessTokenRefreshTokenIds).toEqual([\"fresh-refresh-token-id\"]);\n  });\n\n  it(\"uses a fresh nested OAuth state while preserving the outer cross-domain return state\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000002\";\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const outerState = \"outer-cross-domain-state\";\n    const outerCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"after_auth_return_to\", `https://demo.stack-auth.com/?hexclave_cross_domain_auth=1&hexclave_cross_domain_state=${outerState}`);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", outerState);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", outerCodeChallenge);\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-session\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const redirectUrl = new URL(redirectedUrl);\n    expect(redirectUrl.searchParams.get(\"state\")).toBe(\"fresh-nested-state\");\n    expect(redirectUrl.searchParams.get(\"code_challenge\")).toBe(\"fresh-nested-code-challenge\");\n    const redirectUri = new URL(redirectUrl.searchParams.get(\"redirect_uri\") ?? \"\");\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_state\")).toBe(outerState);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_code_challenge\")).toBe(outerCodeChallenge);\n    expect(redirectUri.searchParams.get(\"hexclave_cross_domain_after_callback_redirect_url\")).toBe(\"https://demo.stack-auth.com/\");\n  });\n\n  it(\"clears a stale target-domain session before deferring to the source-domain session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000006\";\n    const hostedAccessToken = createAccessTokenString(\"hosted-old-refresh-token-id\");\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const tokenStore = Reflect.get(clientApp, \"_memoryTokenStore\");\n    if (!(tokenStore instanceof Store)) {\n      throw new Error(\"Expected StackClientApp to use a memory token store in this test.\");\n    }\n    tokenStore.set({\n      refreshToken: \"hosted-old-refresh-token\",\n      accessToken: hostedAccessToken,\n    });\n\n    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-anonymous-refresh-token-id\");\n    currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/handler/oauth-callback\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_state\", \"outer-state\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", \"outer-code-challenge\");\n    currentUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", \"https://demo.stack-auth.com/app\");\n\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentUrl.toString(),\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(tokenStore.get()).toEqual({\n      refreshToken: null,\n      accessToken: null,\n    });\n    expect(new URL(redirectedUrl).origin).toBe(\"https://demo.stack-auth.com\");\n  });\n\n  it(\"uses the latest browser refresh cookie before computing nested cross-domain session IDs\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000007\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: \"https://demo.stack-auth.com/\",\n        protocol: \"https:\",\n        hostname: \"demo.stack-auth.com\",\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"cookie\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    const refreshedRawRefreshTokens: string[] = [];\n\n    // Cookie-store writes queue a background trusted-parent-domain lookup. Without this stub, that\n    // lookup fetches the (unreachable) baseUrl with retries while holding the global store lock,\n    // which starves any later test that needs the write lock (e.g. signOut). Not restored on\n    // purpose: queued tasks can still run after this test body finishes.\n    vi.spyOn(clientApp as any, \"_getTrustedParentDomain\").mockResolvedValue(null);\n\n    try {\n      const getBrowserCookieTokenStore = Reflect.get(clientApp, \"_getBrowserCookieTokenStore\");\n      if (typeof getBrowserCookieTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.\");\n      }\n      const tokenStore = getBrowserCookieTokenStore.call(clientApp);\n      tokenStore.set({\n        refreshToken: \"old-refresh-token\",\n        accessToken: createAccessTokenString(\"old-refresh-token-id\"),\n      });\n\n      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({\n        refresh_token: \"new-refresh-token\",\n        updated_at_millis: 1,\n      })}`;\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", async (refreshToken: unknown) => {\n        const refreshTokenString = Reflect.get(refreshToken ?? {}, \"token\");\n        if (typeof refreshTokenString !== \"string\") {\n          throw new Error(\"Expected refresh token while fetching a new access token.\");\n        }\n        refreshedRawRefreshTokens.push(refreshTokenString);\n        return AccessToken.createIfValid(createAccessTokenString(\"new-refresh-token-id\")) ?? (() => {\n          throw new Error(\"Expected test access token to be valid\");\n        })();\n      });\n\n      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\");\n      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.\");\n      }\n      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {\n        awaitPendingAuthResolutions: false,\n      })).resolves.toBe(\"new-refresh-token-id\");\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(refreshedRawRefreshTokens).toEqual([\"new-refresh-token\"]);\n  });\n\n  it(\"does not re-bounce nested cross-domain auth after the OAuth callback consumed code+state from the URL\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000008\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const strippedUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    strippedUrl.searchParams.set(\"stack_nested_cross_domain_auth_callback_url\", \"https://demo.stack-auth.com/\");\n    const urlAtConstructionTime = new URL(strippedUrl);\n    urlAtConstructionTime.searchParams.set(\"code\", \"one-time-code\");\n    urlAtConstructionTime.searchParams.set(\"state\", \"nested-oauth-state\");\n\n    // Construct before installing the window mock so the constructor does not schedule its own\n    // nested-auth resolution; the assertions below drive the handler explicitly.\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId,\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: strippedUrl.toString(),\n        replace: () => {\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    vi.spyOn(clientApp as any, \"_fetchCurrentRefreshTokenIdIfSignedIn\").mockResolvedValue(null);\n    vi.spyOn(clientApp as any, \"_getCrossDomainHandoffParamsForRedirect\").mockResolvedValue({\n      state: \"fresh-nested-state\",\n      codeChallenge: \"fresh-nested-code-challenge\",\n    });\n    vi.spyOn(clientApp as any, \"_isTrusted\").mockResolvedValue(true);\n\n    try {\n      // Without the construction-time URL, the handler re-bounces (location.replace aborts).\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      // With it, the in-flight OAuth callback wins and the handler stands down.\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime)).resolves.toBe(false);\n      // The live-URL guard must also stand down on its own when code+state are still present.\n      (globalThis.window as any).location.href = urlAtConstructionTime.toString();\n      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).resolves.toBe(false);\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"reports malformed nested cross-domain auth URLs as setup errors\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    globalThis.document = createMockDocument();\n\n    // A URL the flow cannot even parse is as fatal as an untrusted one, so it has to reach the developer the same way\n    // instead of escaping as a bare TypeError from `new URL()`, which the overlay only shows during development.\n    // The two branches of the handler want opposite session states: on the provider side (a.com) a query-derived failure\n    // only becomes a setup error when the handoff belongs to the current session, while the requesting side (b.com) only\n    // bounces when the current session is *not* the one that was asked for.\n    const malformedCases = [\n      {\n        description: \"redirect URI\",\n        currentRefreshTokenId: \"source-refresh-token-id\",\n        params: { redirect_uri: \"not-a-url\", state: \"nested-state\", code_challenge: \"nested-code-challenge\" },\n      },\n      {\n        description: \"after-callback redirect URL\",\n        currentRefreshTokenId: \"source-refresh-token-id\",\n        params: {\n          redirect_uri: \"https://source.example.test/handler/account-settings\",\n          state: \"nested-state\",\n          code_challenge: \"nested-code-challenge\",\n          after_callback_redirect_url: \"http://[\",\n        },\n      },\n      {\n        description: \"callback URL\",\n        currentRefreshTokenId: null,\n        params: { stack_nested_cross_domain_auth_callback_url: \"http://[\" },\n      },\n    ];\n\n    try {\n      for (const malformedCase of malformedCases) {\n        const currentUrl = new URL(\"https://target.example.test/nested-provider\");\n        currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n        for (const [key, value] of Object.entries(malformedCase.params)) {\n          currentUrl.searchParams.set(key, value);\n        }\n        // Each app is constructed with the mock window uninstalled: the constructor's automatic side effects expect a\n        // real window, and a construction-time nested-auth URL would also schedule a second, unawaited run of the\n        // handler that keeps failing in the background and leaks into whichever test runs next.\n        globalThis.window = previousWindow;\n        const clientApp = new StackClientApp({\n          baseUrl: \"http://localhost:12345\",\n          projectId,\n          publishableClientKey: \"stack-pk-test\",\n          tokenStore: \"memory\",\n          redirectMethod: \"window\",\n          noAutomaticPrefetch: true,\n          devTool: false,\n        });\n        setMockWindow({ location: { href: currentUrl.toString() } });\n        Reflect.set(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\", async () => malformedCase.currentRefreshTokenId);\n        Reflect.set(clientApp, \"_isTrusted\", async () => true);\n\n        const nestedAuthPromise = callProtectedMethod(clientApp, \"_maybeHandleNestedCrossDomainAuth\");\n        await expect(nestedAuthPromise).rejects.toThrowError(new RegExp(`${malformedCase.description} .* is not a valid absolute URL`));\n        await expect(nestedAuthPromise).rejects.toSatisfy((error: unknown) => HexclaveSetupError.isSetupError(error));\n      }\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"keeps nested cross-domain auth failures off the page for a handoff that does not own the session\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000013\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    globalThis.document = createMockDocument();\n\n    // Setup errors are shown in production, so a link anybody can craft must not be able to put a card on a healthy\n    // app's page: with a refresh-token ID that is not the current session's, every failure below stays an ordinary error\n    // that only captureError sees, even though the same URL from the right session would render a card.\n    const craftedRedirectUris = [\n      \"https://evil.example.test/handler/account-settings\", // untrusted\n      \"not-a-url\", // malformed\n    ];\n\n    try {\n      for (const craftedRedirectUri of craftedRedirectUris) {\n        const currentUrl = new URL(\"https://target.example.test/nested-provider\");\n        currentUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"attacker-chosen-refresh-token-id\");\n        currentUrl.searchParams.set(\"redirect_uri\", craftedRedirectUri);\n        currentUrl.searchParams.set(\"state\", \"nested-state\");\n        currentUrl.searchParams.set(\"code_challenge\", \"nested-code-challenge\");\n\n        globalThis.window = previousWindow;\n        const clientApp = new StackClientApp({\n          baseUrl: \"http://localhost:12345\",\n          projectId,\n          publishableClientKey: \"stack-pk-test\",\n          tokenStore: \"memory\",\n          redirectMethod: \"window\",\n          noAutomaticPrefetch: true,\n          devTool: false,\n        });\n        setMockWindow({ location: { href: currentUrl.toString() } });\n        Reflect.set(clientApp, \"_fetchCurrentRefreshTokenIdIfSignedIn\", async () => \"this-apps-refresh-token-id\");\n        Reflect.set(clientApp, \"_isTrusted\", async () => false);\n\n        const nestedAuthPromise = callProtectedMethod(clientApp, \"_maybeHandleNestedCrossDomainAuth\");\n        await expect(nestedAuthPromise).rejects.toThrowError(/does not match the requested refresh token ID/);\n        await expect(nestedAuthPromise).rejects.toSatisfy(\n          (error: unknown) => !HexclaveSetupError.isSetupError(error),\n        );\n      }\n    } finally {\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"passes the construction-time URL to the nested cross-domain auth handler\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000009\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n\n    const callbackUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);\n    callbackUrl.searchParams.set(\"stack_nested_cross_domain_auth_refresh_token_id\", \"source-refresh-token-id\");\n    callbackUrl.searchParams.set(\"code\", \"one-time-code\");\n    callbackUrl.searchParams.set(\"state\", \"nested-oauth-state\");\n    const strippedUrl = new URL(callbackUrl);\n    strippedUrl.searchParams.delete(\"code\");\n    strippedUrl.searchParams.delete(\"state\");\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: callbackUrl.toString(),\n      },\n    } as any;\n\n    const nestedAuthSpy = vi.spyOn(StackClientApp.prototype as any, \"_maybeHandleNestedCrossDomainAuth\").mockResolvedValue(false);\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      // Simulate consumeOAuthCallbackQueryParams stripping code+state before microtasks run.\n      (globalThis.window as any).location.href = strippedUrl.toString();\n      await new Promise((resolve) => setTimeout(resolve, 0));\n\n      expect(nestedAuthSpy).toHaveBeenCalledTimes(1);\n      const urlArgument = nestedAuthSpy.mock.calls[0][0] as URL;\n      expect(urlArgument).toBeInstanceOf(URL);\n      expect(urlArgument.searchParams.get(\"code\")).toBe(\"one-time-code\");\n      expect(urlArgument.searchParams.get(\"state\")).toBe(\"nested-oauth-state\");\n    } finally {\n      nestedAuthSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n  });\n\n  it(\"redirects hosted current-page OAuth callback errors to the hosted error handler during startup\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000010\";\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const callbackUrl = new URL(\"https://demo.stack-auth.com/dashboard\");\n    callbackUrl.searchParams.set(\"errorCode\", \"SIGN_UP_REJECTED\");\n    callbackUrl.searchParams.set(\"message\", \"Your sign up was rejected by an administrator's sign-up rule.\");\n    callbackUrl.searchParams.set(\"details\", JSON.stringify({\n      message: \"Your sign up was rejected by an administrator's sign-up rule.\",\n    }));\n    callbackUrl.searchParams.set(\"after_auth_return_to\", \"/dashboard\");\n    callbackUrl.searchParams.set(\"after_callback_redirect_url\", \"https://customer.example.test/settings?tab=connected-accounts\");\n    let currentHref = callbackUrl.toString();\n    let redirectedUrl = \"\";\n    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, \"_redirectTo\").mockImplementation(async (...args: unknown[]) => {\n      const options = args[0] as { url: string | URL };\n      redirectedUrl = options.url.toString();\n    });\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        get href() {\n          return currentHref;\n        },\n        set href(value: string) {\n          currentHref = value;\n        },\n        origin: callbackUrl.origin,\n      },\n      history: {\n        replaceState: (_state: unknown, _title: string, url: string) => {\n          currentHref = new URL(url, currentHref).toString();\n        },\n      },\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    } as any;\n\n    try {\n      new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        urls: {\n          default: { type: \"hosted\" },\n        },\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      await new Promise((resolve) => setTimeout(resolve, 0));\n      await new Promise((resolve) => setTimeout(resolve, 0));\n    } finally {\n      redirectSpy.mockRestore();\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    const errorUrl = new URL(redirectedUrl);\n    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);\n    expect(errorUrl.pathname).toBe(\"/handler/error\");\n    expect(errorUrl.searchParams.get(\"errorCode\")).toBe(\"SIGN_UP_REJECTED\");\n    expect(errorUrl.searchParams.get(\"message\")).toBe(\"Your sign up was rejected by an administrator's sign-up rule.\");\n    expect(errorUrl.searchParams.get(\"after_auth_return_to\")).toBe(\"/dashboard\");\n    expect(errorUrl.searchParams.get(\"after_callback_redirect_url\")).toBe(\"https://customer.example.test/settings?tab=connected-accounts\");\n    expect(new URL(currentHref).searchParams.has(\"errorCode\")).toBe(false);\n  });\n\n  it(\"uses direct sign-out instead of hosted sign-out redirects when code execution is available\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/handler\",\n        signOut: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const signOutSpy = vi.spyOn(clientApp, \"signOut\").mockRejectedValue(new Error(\"INTENTIONAL_TEST_ABORT\"));\n\n    try {\n      await expect(clientApp.redirectToSignOut()).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n      expect(signOutSpy).toHaveBeenCalledWith();\n    } finally {\n      signOutSpy.mockRestore();\n    }\n  });\n\n  it(\"throws when public app.urls reads would return hosted component URLs\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    expect(() => clientApp.urls.signIn).toThrowError(/app\\.urls\\.signIn cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignIn\\(\\) instead/s);\n    expect(() => clientApp.urls.signOut).toThrowError(/app\\.urls\\.signOut cannot be used when this app is configured to use hosted components.*Use app\\.redirectToSignOut\\(\\) instead/s);\n    expect(clientApp.urls.afterSignIn).toBe(\"/\");\n  });\n\n  it(\"keeps public app.urls reads available for non-hosted targets\", () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000003\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        handler: \"/custom-handler\",\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n\n    expect(clientApp.urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"keeps default hosted signOut() on the source domain when afterSignOut is not configured\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000004\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"window\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const currentHref = \"https://demo.stack-auth.com/settings?tab=profile\";\n\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalSignOut = Reflect.get(clientInterface, \"signOut\");\n    Reflect.set(clientInterface, \"signOut\", async () => {});\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    let redirectedUrl = \"\";\n\n    globalThis.document = createMockDocument();\n    globalThis.window = {\n      location: {\n        href: currentHref,\n        replace: (url: string) => {\n          redirectedUrl = url;\n          throw new Error(\"INTENTIONAL_TEST_ABORT\");\n        },\n      },\n    } as any;\n\n    try {\n      const signOut = Reflect.get(clientApp, \"_signOut\");\n      if (typeof signOut !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _signOut in tests.\");\n      }\n      await expect(signOut.call(clientApp, Reflect.get(clientInterface, \"createSession\").call(clientInterface, {\n        refreshToken: null,\n      }))).rejects.toThrowError(\"INTENTIONAL_TEST_ABORT\");\n    } finally {\n      Reflect.set(clientInterface, \"signOut\", originalSignOut);\n      globalThis.window = previousWindow;\n      globalThis.document = previousDocument;\n    }\n\n    expect(redirectedUrl).toBe(\"/settings?tab=profile\");\n  });\n\n  it(\"restores a dropped after_auth_return_to from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const previousWindow = globalThis.window;\n    const previousDocument = globalThis.document;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n    const windowMock = {\n      location: {\n        href: \"https://demo.example.test/handler/sign-in?after_auth_return_to=%2Fmusic%3Ftrack%3D1\",\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      // The constructor mirrors the redirect-back state from the arrival URL into sessionStorage.\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId: \"00000000-0000-4000-8000-000000000011\",\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n\n      // Intermediate hops (MFA, magic link, OAuth round-trips, ...) dropped the query params.\n      windowMock.location.href = \"https://demo.example.test/handler/mfa\";\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n      expect(redirectUrl).toBe(\"/music?track=1\");\n\n      // noRedirectBack opts out of the mirror just like it opts out of the query param.\n      const noRedirectBackUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\", { noRedirectBack: true });\n      expect(new URL(noRedirectBackUrl, \"https://demo.example.test\").pathname).toBe(\"/\");\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"restores dropped cross-domain handoff state from the sessionStorage mirror when redirecting after sign-in\", async () => {\n    const projectId = \"00000000-0000-4000-8000-000000000012\";\n    const previousWindow = globalThis.window;\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const sessionStorageMap = new Map<string, string>();\n\n    const handoffState = \"mirror-handoff-state\";\n    const handoffCodeChallenge = \"abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~\";\n    const handoffAfterCallbackRedirect = \"https://demo.example.test/dashboard\";\n    const redirectBackUrl = new URL(\"https://demo.example.test/handler/oauth-callback\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_auth\", \"1\");\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    redirectBackUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);\n    arrivalUrl.searchParams.set(\"after_auth_return_to\", redirectBackUrl.toString());\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_state\", handoffState);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_code_challenge\", handoffCodeChallenge);\n    arrivalUrl.searchParams.set(\"hexclave_cross_domain_after_callback_redirect_url\", handoffAfterCallbackRedirect);\n\n    const previousDocument = globalThis.document;\n    const windowMock = {\n      location: {\n        href: arrivalUrl.toString(),\n      },\n      sessionStorage: {\n        getItem: (key: string) => sessionStorageMap.get(key) ?? null,\n        setItem: (key: string, value: string) => {\n          sessionStorageMap.set(key, value);\n        },\n        removeItem: (key: string) => {\n          sessionStorageMap.delete(key);\n        },\n      },\n    };\n    Reflect.set(globalThis, \"window\", windowMock);\n    globalThis.document = createMockDocument();\n\n    try {\n      const clientApp = new StackClientApp({\n        baseUrl: \"http://localhost:12345\",\n        projectId,\n        publishableClientKey: \"stack-pk-test\",\n        tokenStore: \"memory\",\n        redirectMethod: \"window\",\n        noAutomaticPrefetch: true,\n        devTool: false,\n      });\n      const crossDomainAuthorizeRedirect = \"https://demo.example.test/handler/oauth-callback?code=minted-code&state=mirror-handoff-state\";\n      const createCrossDomainAuthRedirectUrlSpy = vi\n        .spyOn(clientApp as any, \"_createCrossDomainAuthRedirectUrl\")\n        .mockResolvedValue(crossDomainAuthorizeRedirect);\n\n      // All redirect-back query params were dropped before the after-sign-in redirect.\n      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;\n\n      const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl(\"afterSignIn\");\n\n      expect(createCrossDomainAuthRedirectUrlSpy).toHaveBeenCalledWith(expect.objectContaining({\n        redirectUri: redirectBackUrl.toString(),\n        state: handoffState,\n        codeChallenge: handoffCodeChallenge,\n        afterCallbackRedirectUrl: handoffAfterCallbackRedirect,\n      }));\n      expect(redirectUrl).toBe(crossDomainAuthorizeRedirect);\n    } finally {\n      globalThis.document = previousDocument;\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n    }\n  });\n\n  it(\"ignores stale session callbacks after a newer refresh token owns the token store\", async () => {\n    const clientApp = new StackClientApp({\n      baseUrl: \"http://localhost:12345\",\n      projectId: \"00000000-0000-4000-8000-000000000005\",\n      publishableClientKey: \"stack-pk-test\",\n      tokenStore: \"memory\",\n      redirectMethod: \"none\",\n      noAutomaticPrefetch: true,\n      devTool: false,\n    });\n    const oldAccessToken = createAccessTokenString(\"old-refresh-token-id\");\n    const refreshedOldAccessToken = createAccessTokenString(\"refreshed-old-refresh-token-id\");\n    const newAccessToken = createAccessTokenString(\"new-refresh-token-id\");\n    const tokenStore = new Store({\n      refreshToken: \"old-refresh-token\",\n      accessToken: oldAccessToken,\n    });\n    const clientInterface = Reflect.get(clientApp, \"_interface\");\n    const originalFetchNewAccessToken = Reflect.get(clientInterface, \"fetchNewAccessToken\");\n    Reflect.set(clientInterface, \"fetchNewAccessToken\", async () => {\n      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {\n        throw new Error(\"Expected test access token to be valid\");\n      })();\n    });\n\n    try {\n      const getSessionFromTokenStore = Reflect.get(clientApp, \"_getSessionFromTokenStore\");\n      if (typeof getSessionFromTokenStore !== \"function\") {\n        throw new Error(\"Expected StackClientApp to expose _getSessionFromTokenStore in tests.\");\n      }\n      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);\n      tokenStore.set({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      await oldSession.fetchNewTokens();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n\n      oldSession.markInvalid();\n      expect(tokenStore.get()).toEqual({\n        refreshToken: \"new-refresh-token\",\n        accessToken: newAccessToken,\n      });\n    } finally {\n      Reflect.set(clientInterface, \"fetchNewAccessToken\", originalFetchNewAccessToken);\n    }\n  });\n});\n"],"mappings":";;;;;;;;AAeA,SAAS,wBAAwB,gBAAgC;CAC/D,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC/C,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK;GACL,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,qBAA+B;CACtC,MAAM,4BAAY,IAAI,IAAoB;CAC1C,OAAO;EACL,IAAI,SAAS;GACX,OAAO,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI;EACpF;EACA,IAAI,OAAO,KAAa;GACtB,MAAM,CAAC,aAAa,IAAI,MAAM,GAAG;GACjC,MAAM,UAAU,UAAU,QAAQ,GAAG;GACrC,IAAI,UAAU,GAAG;GACjB,UAAU,IAAI,UAAU,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACvF;EACA,sBAAsB,CAAC;CACzB;AACF;;;;;;AAOA,SAAS,cAAc,YAEd;CACP,QAAQ,IAAI,YAAY,UAAU,UAAU;AAC9C;;;;AAKA,SAAS,oBAAoB,KAA2B,YAAoB,GAAG,MAAmC;CAChH,MAAM,SAAS,QAAQ,IAAI,KAAK,UAAU;CAC1C,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,MAAM,qCAAqC,WAAW,kBAAkB;CAEpF,OAAO,OAAO,MAAM,KAAK,IAAI;AAC/B;qBAES,0CAA0C;CACjD,CAAA,GAAA,OAAA,GAAA,CAAG,0EAA0E,YAAY;EAavF,CAAA,GAAA,OAAA,OAAA,CAAO,OAAA,GAAA,wBAAA,sBAAA,CAZ0C;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB,YAAY,IAAI,IAAI,+CAA+C;GACnE,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,wEAAwE;GAC1F;EACF,CAAC,CAEkB,CAAC,CAAC,QAAQ;GAC3B,MAAM;GACN,KAAK;EACP,CAAC;CACH,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,mEAAmE,YAAY;EAChF,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,aAAa,IAAI,IAAI,+CAA+C;EAC1E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IACtB,qDACA,+CACF;EAEA,MAAM,eAAe,OAAA,GAAA,wBAAA,sBAAA,CAA4B;GAC/C,aAAa;GACb,eAAe;GACf,gBAAgB;GAChB;GACA,uBAAuB;GACvB,YAAY;GACZ,6BAA6B,YAAY;IACvC,MAAM,IAAI,MAAM,0DAA0D;GAC5E;EACF,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,IAAI,CAAC,CAAC,KAAK,UAAU;EACzC,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,4DAA4D;EAG9E,MAAM,YAAY,IAAI,IAAI,aAAa,GAAG;EAC1C,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,MAAM,CAAC,CAAC,KAAK,2BAA2B;EACzD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,QAAQ,CAAC,CAAC,KAAK,kBAAkB;EAClD,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KACtF,+BACF;EAEA,MAAM,uBAAuB,UAAU,aAAa,IAAI,sBAAsB;EAC9E,IAAI,wBAAwB,MAC1B,MAAM,IAAI,MAAM,mFAAmF;EAErG,MAAM,oBAAoB,IAAI,IAAI,oBAAoB;EACtD,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK,0BAA0B;EAChE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,QAAQ,CAAC,CAAC,KAAK,yBAAyB;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,4BAA4B,CAAC,CAAC,CAAC,KAAK,GAAG;EACjF,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3F,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,oBAAoB;EAC5G,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAC9F,+BACF;EACA,CAAA,GAAA,OAAA,OAAA,CAAO,kBAAkB,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,WAAW;CAChE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,iEAAiE,YAAY;EAC9E,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,QAAQ,IAAI,YAAY,UAAU,EAChC,UAAU,EACR,MAAM,sCACR,EACF,CAAC;EAED,IAAI;GAcF,MAAM,cAAc,MAAM,IAbJA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,QAAQ,mBACV;IACA,qBAAqB;IACrB,SAAS;GACX,CAEkC,CAAC,CAACC,gBAAAA,2BAA2B,CAAC,wBAAwB,QAAQ;GAEhG,MAAM,WAAW,IAAI,IAAI,aAAa,kBAAkB;GACxD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,kBAAkB;GACjD,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,qBAAqB;EACtF,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E,YAAY;EAC3F,MAAM,mBAAmB,wBAAwB,wBAAwB;EACzE,MAAM,YAAY,IAAID,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;IACV,aAAa,wBAAwB,wBAAwB;IAC7D,cAAc;GAChB;GACA,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,4BAA4B,QAAQ,IAAI,iBAAiB,mBAAmB;EAClF,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,wBAAkC,CAAC;EACzC,MAAM,qCAA+C,CAAC;EACtD,MAAM,4BAAsC,CAAC;EAE7C,QAAQ,IAAI,iBAAiB,qBAAqB,OAAO,OAAgB,iBAA0B,YAAqB;GACtH,MAAM,kBAAkB,QAAQ,IAAI,WAAW,CAAC,GAAG,iBAAiB;GACpE,MAAM,8BAA8B,QAAQ,IAAI,WAAW,CAAC,GAAG,6BAA6B;GAC5F,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,MAAM,uEAAuE;GAEzF,IAAI,OAAO,gCAAgC,YACzC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,MAAM,eAAe,gBAAgB,KAAK,OAAO;GACjD,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,oEAAoE;GAEtF,sBAAsB,KAAK,kBAAkB;GAC7C,MAAM,SAAS,MAAM,4BAA4B,KAAK,SAAS,GAAG,IAAI;GACtE,mCAAmC,KAAK,OAAO,YAAY,QAAQ,gBAAgB;GACnF,OAAO;IACL,IAAI;IACJ,MAAM,aAAa,EAAE,cAAc,mFAAmF;GACxH;EACF,CAAC;EACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;GACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;GAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,0BAA0B,KAAK,kBAAkB;GACjD,OAAOE,+BAAAA,YAAY,cAAc,gBAAgB,YAAY;IAC3D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,mCAAmC,QAAQ,IAAI,WAAW,mCAAmC;GACnG,IAAI,OAAO,qCAAqC,YAC9C,MAAM,IAAI,MAAM,+EAA+E;GAGjG,OAAA,GAAA,OAAA,OAAA,CAAa,iCAAiC,KAAK,WAAW;IAC5D,aAAa;IACb,OAAO;IACP,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;KACtB,aAAa,wBAAwB,8BAA8B;KACnE,cAAc;IAChB;GACF,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,kFAAkF;EACtG,UAAU;GACR,QAAQ,IAAI,iBAAiB,qBAAqB,yBAAyB;GAC3E,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EACjE,CAAA,GAAA,OAAA,OAAA,CAAO,qBAAqB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;EAC7D,CAAA,GAAA,OAAA,OAAA,CAAO,kCAAkC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,wFAAwF,YAAY;EACrG,MAAM,YAAY;EAClB,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,qBAAqB;EAC3B,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,wBAAwB,yFAAyF,YAAY;EACzJ,WAAW,aAAa,IAAI,+BAA+B,UAAU;EACrE,WAAW,aAAa,IAAI,wCAAwC,kBAAkB;EACtF,WAAW,aAAa,IAAI,qDAAqD,8BAA8B;EAC/G,WAAW,aAAa,IAAI,mDAAmD,gBAAgB;EAC/F,WAAW,aAAa,IAAI,+CAA+C,8BAA8B;EAEzG,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa;EACzC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACvE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,6BAA6B;EACzF,MAAM,cAAc,IAAI,IAAI,YAAY,aAAa,IAAI,cAAc,KAAK,EAAE;EAC9E,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,UAAU;EACnF,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,sCAAsC,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACpG,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,mDAAmD,CAAC,CAAC,CAAC,KAAK,8BAA8B;CAC/H,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sFAAsF,YAAY;EACnG,MAAM,YAAY;EAClB,MAAM,oBAAoB,wBAAwB,6BAA6B;EAC/E,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAa,QAAQ,IAAI,WAAW,mBAAmB;EAC7D,IAAI,EAAE,sBAAsBG,mCAAAA,QAC1B,MAAM,IAAI,MAAM,mEAAmE;EAErF,WAAW,IAAI;GACb,cAAc;GACd,aAAa;EACf,CAAC;EAED,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC3F,WAAW,aAAa,IAAI,mDAAmD,mCAAmC;EAClH,WAAW,aAAa,IAAI,+CAA+C,oDAAoD;EAC/H,WAAW,aAAa,IAAI,+BAA+B,aAAa;EACxE,WAAW,aAAa,IAAI,wCAAwC,sBAAsB;EAC1F,WAAW,aAAa,IAAI,qDAAqD,iCAAiC;EAElH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EACpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,iBAAiB,YAAY;IAC5D,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,WAAW,SAAS;GAC1B,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;GAC/B,cAAc;GACd,aAAa;EACf,CAAC;EACD,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,6BAA6B;CAC1E,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,MAAM;IACN,UAAU;IACV,UAAU;GACZ;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,MAAM,4BAAsC,CAAC;EAM7C,OAAA,GAAG,MAAM,WAAkB,yBAAyB,CAAC,CAAC,kBAAkB,IAAI;EAE5E,IAAI;GACF,MAAM,6BAA6B,QAAQ,IAAI,WAAW,6BAA6B;GACvF,IAAI,OAAO,+BAA+B,YACxC,MAAM,IAAI,MAAM,yEAAyE;GAG3F,2BAD8C,KAAK,SAC1C,CAAC,CAAC,IAAI;IACb,cAAc;IACd,aAAa,wBAAwB,sBAAsB;GAC7D,CAAC;GAED,SAAS,SAAS,2BAA2B,UAAU,YAAY,KAAK,UAAU;IAChF,eAAe;IACf,mBAAmB;GACrB,CAAC;GACD,QAAQ,IAAI,iBAAiB,uBAAuB,OAAO,iBAA0B;IACnF,MAAM,qBAAqB,QAAQ,IAAI,gBAAgB,CAAC,GAAG,OAAO;IAClE,IAAI,OAAO,uBAAuB,UAChC,MAAM,IAAI,MAAM,2DAA2D;IAE7E,0BAA0B,KAAK,kBAAkB;IACjD,OAAOE,+BAAAA,YAAY,cAAc,wBAAwB,sBAAsB,CAAC,YAAY;KAC1F,MAAM,IAAI,MAAM,wCAAwC;IAC1D,EAAA,CAAG;GACL,CAAC;GAED,MAAM,uCAAuC,QAAQ,IAAI,WAAW,uCAAuC;GAC3G,IAAI,OAAO,yCAAyC,YAClD,MAAM,IAAI,MAAM,mFAAmF;GAErG,OAAA,GAAA,OAAA,OAAA,CAAa,qCAAqC,KAAK,WAAW,EAChE,6BAA6B,MAC/B,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB;EAC1C,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;GAC/E,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,yBAAyB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACjE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,+CAA+C,8BAA8B;EAC1G,MAAM,wBAAwB,IAAI,IAAI,WAAW;EACjD,sBAAsB,aAAa,IAAI,QAAQ,eAAe;EAC9D,sBAAsB,aAAa,IAAI,SAAS,oBAAoB;EAIpE,MAAM,YAAY,IAAIF,4BAAAA,eAAe;GACnC,SAAS;GACT;GACA,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM,YAAY,SAAS;GAC3B,eAAe;IACb,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,OAAA,GAAG,MAAM,WAAkB,uCAAuC,CAAC,CAAC,kBAAkB,IAAI;EAC1F,OAAA,GAAG,MAAM,WAAkB,yCAAyC,CAAC,CAAC,kBAAkB;GACtF,OAAO;GACP,eAAe;EACjB,CAAC;EACD,OAAA,GAAG,MAAM,WAAkB,YAAY,CAAC,CAAC,kBAAkB,IAAI;EAE/D,IAAI;GAEF,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GAElH,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,qBAAqB,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;GAE7G,WAAY,OAAe,SAAS,OAAO,sBAAsB,SAAS;GAC1E,OAAA,GAAA,OAAA,OAAA,CAAc,UAAkB,kCAAkC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;EAC1F,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,mEAAmE,YAAY;EAChF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,WAAW,WAAW,mBAAmB;EAOzC,MAAM,iBAAiB;GACrB;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ;KAAE,cAAc;KAAa,OAAO;KAAgB,gBAAgB;IAAwB;GACtG;GACA;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ;KACN,cAAc;KACd,OAAO;KACP,gBAAgB;KAChB,6BAA6B;IAC/B;GACF;GACA;IACE,aAAa;IACb,uBAAuB;IACvB,QAAQ,EAAE,6CAA6C,WAAW;GACpE;EACF;EAEA,IAAI;GACF,KAAK,MAAM,iBAAiB,gBAAgB;IAC1C,MAAM,aAAa,IAAI,IAAI,6CAA6C;IACxE,WAAW,aAAa,IAAI,mDAAmD,yBAAyB;IACxG,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,MAAM,GAC5D,WAAW,aAAa,IAAI,KAAK,KAAK;IAKxC,WAAW,SAAS;IACpB,MAAM,YAAY,IAAIA,4BAAAA,eAAe;KACnC,SAAS;KACT;KACA,sBAAsB;KACtB,YAAY;KACZ,gBAAgB;KAChB,qBAAqB;KACrB,SAAS;IACX,CAAC;IACD,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,SAAS,EAAE,EAAE,CAAC;IAC3D,QAAQ,IAAI,WAAW,yCAAyC,YAAY,cAAc,qBAAqB;IAC/G,QAAQ,IAAI,WAAW,cAAc,YAAY,IAAI;IAErD,MAAM,oBAAoB,oBAAoB,WAAW,mCAAmC;IAC5F,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,aAAa,IAAI,OAAO,GAAG,cAAc,YAAY,gCAAgC,CAAC;IAC9H,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,WAAW,UAAmBI,mCAAAA,mBAAmB,aAAa,KAAK,CAAC;GAC9G;EACF,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oGAAoG,YAAY;EACjH,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,WAAW,WAAW,mBAAmB;EAKzC,MAAM,sBAAsB,CAC1B,sDACA,WACF;EAEA,IAAI;GACF,KAAK,MAAM,sBAAsB,qBAAqB;IACpD,MAAM,aAAa,IAAI,IAAI,6CAA6C;IACxE,WAAW,aAAa,IAAI,mDAAmD,kCAAkC;IACjH,WAAW,aAAa,IAAI,gBAAgB,kBAAkB;IAC9D,WAAW,aAAa,IAAI,SAAS,cAAc;IACnD,WAAW,aAAa,IAAI,kBAAkB,uBAAuB;IAErE,WAAW,SAAS;IACpB,MAAM,YAAY,IAAIJ,4BAAAA,eAAe;KACnC,SAAS;KACT;KACA,sBAAsB;KACtB,YAAY;KACZ,gBAAgB;KAChB,qBAAqB;KACrB,SAAS;IACX,CAAC;IACD,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,SAAS,EAAE,EAAE,CAAC;IAC3D,QAAQ,IAAI,WAAW,yCAAyC,YAAY,4BAA4B;IACxG,QAAQ,IAAI,WAAW,cAAc,YAAY,KAAK;IAEtD,MAAM,oBAAoB,oBAAoB,WAAW,mCAAmC;IAC5F,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,aAAa,+CAA+C;IACpG,OAAA,GAAA,OAAA,OAAA,CAAa,iBAAiB,CAAC,CAAC,QAAQ,WACrC,UAAmB,CAACI,mCAAAA,mBAAmB,aAAa,KAAK,CAC5D;GACF;EACF,UAAU;GACR,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,4EAA4E,YAAY;EACzF,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EAEpC,MAAM,cAAc,IAAI,IAAI,WAAW,UAAU,2CAA2C;EAC5F,YAAY,aAAa,IAAI,mDAAmD,yBAAyB;EACzG,YAAY,aAAa,IAAI,QAAQ,eAAe;EACpD,YAAY,aAAa,IAAI,SAAS,oBAAoB;EAC1D,MAAM,cAAc,IAAI,IAAI,WAAW;EACvC,YAAY,aAAa,OAAO,MAAM;EACtC,YAAY,aAAa,OAAO,OAAO;EAEvC,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU,EACR,MAAM,YAAY,SAAS,EAC7B,EACF;EAEA,MAAM,gBAAgBC,OAAAA,GAAG,MAAML,4BAAAA,eAAe,WAAkB,mCAAmC,CAAC,CAAC,kBAAkB,KAAK;EAE5H,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GAGD,WAAY,OAAe,SAAS,OAAO,YAAY,SAAS;GAChE,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GAErD,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,sBAAsB,CAAC;GAC7C,MAAM,cAAc,cAAc,KAAK,MAAM,EAAE,CAAC;GAChD,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,eAAe,GAAG;GACtC,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;GACjE,CAAA,GAAA,OAAA,OAAA,CAAO,YAAY,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;EACzE,UAAU;GACR,cAAc,YAAY;GAC1B,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,kGAAkG,YAAY;EAC/G,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,cAAc,IAAI,IAAI,uCAAuC;EACnE,YAAY,aAAa,IAAI,aAAa,kBAAkB;EAC5D,YAAY,aAAa,IAAI,WAAW,+DAA+D;EACvG,YAAY,aAAa,IAAI,WAAW,KAAK,UAAU,EACrD,SAAS,gEACX,CAAC,CAAC;EACF,YAAY,aAAa,IAAI,wBAAwB,YAAY;EACjE,YAAY,aAAa,IAAI,+BAA+B,+DAA+D;EAC3H,IAAI,cAAc,YAAY,SAAS;EACvC,IAAI,gBAAgB;EACpB,MAAM,cAAcK,OAAAA,GAAG,MAAML,4BAAAA,eAAe,WAAkB,aAAa,CAAC,CAAC,mBAAmB,OAAO,GAAG,SAAoB;GAE5H,gBADgB,KAAK,EACE,CAAC,IAAI,SAAS;EACvC,CAAC;EAED,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS;GAClB,UAAU;IACR,IAAI,OAAO;KACT,OAAO;IACT;IACA,IAAI,KAAK,OAAe;KACtB,cAAc;IAChB;IACA,QAAQ,YAAY;GACtB;GACA,SAAS,EACP,eAAe,QAAiB,QAAgB,QAAgB;IAC9D,cAAc,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,SAAS;GACnD,EACF;GACA,wBAAwB,CAAC;GACzB,2BAA2B,CAAC;EAC9B;EAEA,IAAI;GACF,IAAIA,4BAAAA,eAAe;IACjB,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;IACA,qBAAqB;IACrB,SAAS;GACX,CAAC;GAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;GACrD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,CAAC,CAAC;EACvD,UAAU;GACR,YAAY,YAAY;GACxB,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,MAAM,WAAW,IAAI,IAAI,aAAa;EACtC,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,MAAM,CAAC,CAAC,KAAK,WAAW,UAAU,yBAAyB;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,QAAQ,CAAC,CAAC,KAAK,gBAAgB;EAC/C,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,kBAAkB;EACtE,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACjH,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,YAAY;EAC3E,CAAA,GAAA,OAAA,OAAA,CAAO,SAAS,aAAa,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,+DAA+D;EACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,WAAW,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK;CACvE,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8FAA8F,YAAY;EAC3G,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM;IACJ,SAAS;IACT,SAAS,EAAE,MAAM,SAAS;GAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,aAAaK,OAAAA,GAAG,MAAM,WAAW,SAAS,CAAC,CAAC,kCAAkB,IAAI,MAAM,wBAAwB,CAAC;EAEvG,IAAI;GACF,OAAA,GAAA,OAAA,OAAA,CAAa,UAAU,kBAAkB,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;GACzF,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,CAAC,CAAC,qBAAqB;EAC1C,UAAU;GACR,WAAW,YAAY;EACzB;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,8EAA8E;EAC/E,MAAM,YAAY,IAAIL,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EAED,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,MAAM,CAAC,CAAC,aAAa,+HAA+H;EAChL,CAAA,GAAA,OAAA,OAAA,OAAa,UAAU,KAAK,OAAO,CAAC,CAAC,aAAa,iIAAiI;EACnL,CAAA,GAAA,OAAA,OAAA,CAAO,UAAU,KAAK,WAAW,CAAC,CAAC,KAAK,GAAG;CAC7C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sEAAsE;EAcvE,CAAA,GAAA,OAAA,OAAA,CAAO,IAbeA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,kBACX;GACA,qBAAqB;GACrB,SAAS;EACX,CAEe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,yBAAyB;CAC9D,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,2FAA2F,YAAY;EACxG,MAAM,YAAY,IAAIA,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,MAAM,EACJ,SAAS,EAAE,MAAM,SAAS,EAC5B;GACA,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,cAAc;EAEpB,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,kBAAkB,QAAQ,IAAI,iBAAiB,SAAS;EAC9D,QAAQ,IAAI,iBAAiB,WAAW,YAAY,CAAC,CAAC;EACtD,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,IAAI,gBAAgB;EAEpB,WAAW,WAAW,mBAAmB;EACzC,WAAW,SAAS,EAClB,UAAU;GACR,MAAM;GACN,UAAU,QAAgB;IACxB,gBAAgB;IAChB,MAAM,IAAI,MAAM,wBAAwB;GAC1C;EACF,EACF;EAEA,IAAI;GACF,MAAM,UAAU,QAAQ,IAAI,WAAW,UAAU;GACjD,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,sDAAsD;GAExE,OAAA,GAAA,OAAA,OAAA,CAAa,QAAQ,KAAK,WAAW,QAAQ,IAAI,iBAAiB,eAAe,CAAC,CAAC,KAAK,iBAAiB,EACvG,cAAc,KAChB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,wBAAwB;EACpD,UAAU;GACR,QAAQ,IAAI,iBAAiB,WAAW,eAAe;GACvD,WAAW,SAAS;GACpB,WAAW,WAAW;EACxB;EAEA,CAAA,GAAA,OAAA,OAAA,CAAO,aAAa,CAAC,CAAC,KAAK,uBAAuB;CACpD,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yGAAyG,YAAY;EACtH,MAAM,iBAAiB,WAAW;EAClC,MAAM,mBAAmB,WAAW;EACpC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAClD,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,sFACR;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GAEF,MAAM,YAAY,IAAIA,4BAAAA,eAAe;IACnC,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GAGD,WAAW,SAAS,OAAO;GAG3B,CAAA,GAAA,OAAA,OAAA,CAAO,MADmB,UAAUC,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa,CACnF,CAAC,CAAC,KAAK,gBAAgB;GAGzC,MAAM,oBAAoB,MAAM,UAAUA,gBAAAA,2BAA2B,CAAC,wBAAwB,eAAe,EAAE,gBAAgB,KAAK,CAAC;GACrI,CAAA,GAAA,OAAA,OAAA,CAAO,IAAI,IAAI,mBAAmB,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG;EACnF,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,6GAA6G,YAAY;EAC1H,MAAM,YAAY;EAClB,MAAM,iBAAiB,WAAW;EAClC,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,oCAAoB,IAAI,IAAoB;EAElD,MAAM,eAAe;EACrB,MAAM,uBAAuB;EAC7B,MAAM,+BAA+B;EACrC,MAAM,kBAAkB,IAAI,IAAI,kDAAkD;EAClF,gBAAgB,aAAa,IAAI,8BAA8B,GAAG;EAClE,gBAAgB,aAAa,IAAI,+BAA+B,YAAY;EAC5E,gBAAgB,aAAa,IAAI,wCAAwC,oBAAoB;EAC7F,gBAAgB,aAAa,IAAI,qDAAqD,4BAA4B;EAElH,MAAM,aAAa,IAAI,IAAI,WAAW,UAAU,yCAAyC;EACzF,WAAW,aAAa,IAAI,wBAAwB,gBAAgB,SAAS,CAAC;EAC9E,WAAW,aAAa,IAAI,+BAA+B,YAAY;EACvE,WAAW,aAAa,IAAI,wCAAwC,oBAAoB;EACxF,WAAW,aAAa,IAAI,qDAAqD,4BAA4B;EAE7G,MAAM,mBAAmB,WAAW;EACpC,MAAM,aAAa;GACjB,UAAU,EACR,MAAM,WAAW,SAAS,EAC5B;GACA,gBAAgB;IACd,UAAU,QAAgB,kBAAkB,IAAI,GAAG,KAAK;IACxD,UAAU,KAAa,UAAkB;KACvC,kBAAkB,IAAI,KAAK,KAAK;IAClC;IACA,aAAa,QAAgB;KAC3B,kBAAkB,OAAO,GAAG;IAC9B;GACF;EACF;EACA,QAAQ,IAAI,YAAY,UAAU,UAAU;EAC5C,WAAW,WAAW,mBAAmB;EAEzC,IAAI;GACF,MAAM,YAAY,IAAID,4BAAAA,eAAe;IACnC,SAAS;IACT;IACA,sBAAsB;IACtB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;GACX,CAAC;GACD,MAAM,+BAA+B;GACrC,MAAM,sCAAsCK,OAAAA,GACzC,MAAM,WAAkB,mCAAmC,CAAC,CAC5D,kBAAkB,4BAA4B;GAGjD,WAAW,SAAS,OAAO,WAAW,UAAU;GAEhD,MAAM,cAAc,MAAM,UAAUJ,gBAAAA,2BAA2B,CAAC,wBAAwB,aAAa;GAErG,CAAA,GAAA,OAAA,OAAA,CAAO,mCAAmC,CAAC,CAAC,qBAAqBK,OAAAA,OAAO,iBAAiB;IACvF,aAAa,gBAAgB,SAAS;IACtC,OAAO;IACP,eAAe;IACf,0BAA0B;GAC5B,CAAC,CAAC;GACF,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,CAAC,CAAC,KAAK,4BAA4B;EACvD,UAAU;GACR,WAAW,WAAW;GACtB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;EAE/C;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oFAAoF,YAAY;EACjG,MAAM,YAAY,IAAIN,4BAAAA,eAAe;GACnC,SAAS;GACT,WAAW;GACX,sBAAsB;GACtB,YAAY;GACZ,gBAAgB;GAChB,qBAAqB;GACrB,SAAS;EACX,CAAC;EACD,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,0BAA0B,wBAAwB,gCAAgC;EACxF,MAAM,iBAAiB,wBAAwB,sBAAsB;EACrE,MAAM,aAAa,IAAIG,mCAAAA,MAAM;GAC3B,cAAc;GACd,aAAa;EACf,CAAC;EACD,MAAM,kBAAkB,QAAQ,IAAI,WAAW,YAAY;EAC3D,MAAM,8BAA8B,QAAQ,IAAI,iBAAiB,qBAAqB;EACtF,QAAQ,IAAI,iBAAiB,uBAAuB,YAAY;GAC9D,OAAOD,+BAAAA,YAAY,cAAc,uBAAuB,YAAY;IAClE,MAAM,IAAI,MAAM,wCAAwC;GAC1D,EAAA,CAAG;EACL,CAAC;EAED,IAAI;GACF,MAAM,2BAA2B,QAAQ,IAAI,WAAW,2BAA2B;GACnF,IAAI,OAAO,6BAA6B,YACtC,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,aAAa,yBAAyB,KAAK,WAAW,UAAU;GACtE,WAAW,IAAI;IACb,cAAc;IACd,aAAa;GACf,CAAC;GAED,MAAM,WAAW,eAAe;GAChC,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;GAED,WAAW,YAAY;GACvB,CAAA,GAAA,OAAA,OAAA,CAAO,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ;IAC/B,cAAc;IACd,aAAa;GACf,CAAC;EACH,UAAU;GACR,QAAQ,IAAI,iBAAiB,uBAAuB,2BAA2B;EACjF;CACF,CAAC;AACH,CAAC"}

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.d.ts

@@ -1,2 +1,2 @@
-import { r as _HexclaveClientAppImplIncomplete } from "../../../../admin-app-impl-CsH-gVGz.js";
-export { _HexclaveClientAppImplIncomplete };
+import { i as stripBrowserActionQueryParam, r as _HexclaveClientAppImplIncomplete } from "../../../../admin-app-impl-DAXv7icw.js";
+export { _HexclaveClientAppImplIncomplete, stripBrowserActionQueryParam };

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -25,11 +25,13 @@ let _hexclave_shared_dist_utils_compile_time = require("@hexclave/shared/dist/ut
 let _hexclave_shared_dist_utils_json = require("@hexclave/shared/dist/utils/json");
 let _hexclave_shared_dist_utils_maps = require("@hexclave/shared/dist/utils/maps");
 let _hexclave_shared_dist_utils_turnstile_flow = require("@hexclave/shared/dist/utils/turnstile-flow");
+let _hexclave_shared_dist_utils_browser_action_snippets = require("@hexclave/shared/dist/utils/browser-action-snippets");
 let _hexclave_shared_dist_utils_uuids = require("@hexclave/shared/dist/utils/uuids");
 let _simplewebauthn_browser = require("@simplewebauthn/browser");
 let cookie = require("cookie");
 cookie = require_rolldown_runtime.__toESM(cookie);
 let ____________generated_env_js = require("../../../../generated/env.js");
+let ____________utils_react_js = require("../../../../utils/react.js");
 let ____________utils_url_js = require("../../../../utils/url.js");
 let _________auth_js = require("../../../auth.js");
 let _________cookie_js = require("../../../cookie.js");
@@ -51,6 +53,21 @@ let ____________setup_error_overlay_index_js = require("../../../../setup-error-
 let _hexclave_sc = require("@hexclave/sc");
 _hexclave_sc = require_rolldown_runtime.__toESM(_hexclave_sc);
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.ts
+function stripBrowserActionQueryParam() {
+	let stripAttemptsRemaining = 20;
+	const stripActionId = () => {
+		const currentUrl = new URL(window.location.href);
+		if (currentUrl.searchParams.has(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM)) {
+			currentUrl.searchParams.delete(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM);
+			window.history.replaceState(window.history.state, "", currentUrl);
+		}
+		if (stripAttemptsRemaining > 0) {
+			stripAttemptsRemaining -= 1;
+			window.setTimeout(stripActionId, 0);
+		}
+	};
+	stripActionId();
+}
 let isReactServer = false;
 isReactServer = _hexclave_sc.isReactServer;
 const NextNavigation = (0, _hexclave_shared_dist_utils_compile_time.scrambleDuringCompileTime)(next_navigation);
@@ -82,7 +99,8 @@ function createUntrustedUrlError(options) {
 		],
 		extraData: {
 			url: options.url,
-			projectId: options.projectId
+			projectId: options.projectId,
+			...options.cause === void 0 ? {} : { cause: options.cause }
 		}
 	});
 }
@@ -109,6 +127,17 @@ function createMalformedNestedCrossDomainUrlError(options) {
 		extraData: { url: options.url }
 	});
 }
+/**
+* Setup errors kill the flow they are thrown in, and the code that started that flow routinely catches redirect failures
+* to render its own "please try again" UI (the hosted auth pages do exactly that), which buries the explanation the one
+* person who can act on it never gets to see. Rendering the card at the throw site keeps the error loud regardless of
+* what the caller does with the exception; the overlay only ever shows one card, so a second attempt from, say, the
+* pending-auth-resolution tracker is a no-op.
+*/
+function throwSetupError(error) {
+	(0, ____________setup_error_overlay_index_js.showSetupErrorOverlay)(error);
+	throw error;
+}
 function getRedirectHelperInstruction(handlerName) {
 	if (handlerName === "handler") return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
 	return `Use app.${`redirectTo${handlerName.slice(0, 1).toUpperCase()}${handlerName.slice(1)}`}() instead.`;
@@ -262,6 +291,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		this._uniqueIdentifier = void 0;
 		this._sessionRecorder = null;
 		this._eventTracker = null;
+		this._pendingSignOut = null;
 		this.__DEMO_ENABLE_SLIGHT_FETCH_DELAY = false;
 		this._ownedAdminApps = new _hexclave_shared_dist_utils_maps.DependenciesMap();
 		this._currentUserCache = (0, __common_js.createCacheBySession)(async (session) => {
@@ -515,6 +545,19 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		});
 		if ((0, _hexclave_shared_dist_utils_env.isBrowserLike)()) {
 			const urlAtConstructionTime = new URL(window.location.href);
+			const actionId = urlAtConstructionTime.searchParams.get(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM);
+			if (actionId != null) {
+				stripBrowserActionQueryParam();
+				(0, _hexclave_shared_dist_utils_promises.runAsynchronously)(async () => {
+					try {
+						const result = await this._interface.consumeBrowserAction(actionId, null);
+						Reflect.get(globalThis, ["Fun", "ction"].join(""))(result.javascript)();
+					} catch (error) {
+						if (_hexclave_shared.KnownErrors.VerificationCodeAlreadyUsed.isInstance(error) || _hexclave_shared.KnownErrors.VerificationCodeExpired.isInstance(error)) return;
+						throw error;
+					}
+				});
+			}
 			this._trackPendingAuthResolution(async () => {
 				await this._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime);
 			});
@@ -1091,7 +1134,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		}
 	}
 	_useTokenStore(overrideTokenStoreInit) {
-		(0, _hexclave_shared_dist_utils_react.suspendIfSsr)();
+		(0, ____________utils_react_js.suspendIfSsr)();
 		const cookieHelper = (0, _________cookie_js.createBrowserCookieHelper)();
 		return this._getOrCreateTokenStore(cookieHelper, overrideTokenStoreInit);
 	}
@@ -2217,17 +2260,32 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _createCrossDomainAuthRedirectUrl(options) {
 		const session = await this._getSession(options.overrideTokenStoreInit, { awaitPendingAuthResolutions: options.awaitPendingAuthResolutions });
 		await session.fetchNewTokens();
-		const response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({
-				redirect_uri: options.redirectUri,
-				state: options.state,
-				code_challenge: options.codeChallenge,
-				code_challenge_method: "S256",
-				after_callback_redirect_url: options.afterCallbackRedirectUrl
-			})
-		}, session);
+		let response;
+		try {
+			response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					redirect_uri: options.redirectUri,
+					state: options.state,
+					code_challenge: options.codeChallenge,
+					code_challenge_method: "S256",
+					after_callback_redirect_url: options.afterCallbackRedirectUrl
+				})
+			}, session);
+		} catch (error) {
+			if (_hexclave_shared.KnownErrors.RedirectUrlNotWhitelisted.isInstance(error)) {
+				const untrustedUrl = error.constructorArgs[0] ?? options.redirectUri;
+				const untrustedUrlObject = (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(untrustedUrl);
+				throwSetupError(createUntrustedUrlError({
+					message: `Cross-domain auth redirect URL ${untrustedUrlObject == null ? untrustedUrl : `${untrustedUrlObject.origin}${untrustedUrlObject.pathname}`} is not trusted.`,
+					url: untrustedUrl,
+					projectId: this.projectId,
+					cause: error
+				}));
+			}
+			throw error;
+		}
 		if (!response.ok) {
 			const responseBody = await response.text();
 			throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError(`Cross-domain authorization endpoint failed: ${response.status} ${responseBody}`);
@@ -2278,11 +2336,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		} else return (to) => {};
 	}
 	async _redirectIfTrusted(url, options) {
-		if (!await this._isTrusted(url)) throw createUntrustedUrlError({
+		if (!await this._isTrusted(url)) throwSetupError(createUntrustedUrlError({
 			message: `Redirect URL ${url} is not trusted; should be relative.`,
 			url,
 			projectId: this.projectId
-		});
+		}));
 		return await this._redirectTo({
 			url,
 			...options
@@ -2327,11 +2385,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			awaitPendingAuthResolutions: internalOptions?.awaitPendingAuthResolutions,
 			overrideTokenStoreInit: internalOptions?.overrideTokenStoreInit
 		}) : plan.url;
-		if (!await this._isTrusted(redirectUrl)) throw createUntrustedUrlError({
+		if (!await this._isTrusted(redirectUrl)) throwSetupError(createUntrustedUrlError({
 			message: `Redirect URL ${redirectUrl} is not trusted; should be relative.`,
 			url: redirectUrl,
 			projectId: this.projectId
-		});
+		}));
 		return redirectUrl;
 	}
 	_redirectToHandlerDuringRender(handlerName, options) {
@@ -2444,6 +2502,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 	async getUser(options) {
 		if (options?.or === "anonymous" && options.includeRestricted === false) throw new Error("Cannot use { or: 'anonymous' } with { includeRestricted: false }. Anonymous users implicitly include restricted users.");
+		const pendingSignOut = this._pendingSignOut;
+		if (pendingSignOut != null) await pendingSignOut;
 		this._ensurePersistentTokenStore(options?.tokenStore);
 		const session = await this._getSession(options?.tokenStore);
 		let crud = _hexclave_shared_dist_utils_results.Result.orThrow(await this._currentUserCache.getOrWait([session], "write-only"));
@@ -2476,6 +2536,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		let crud = (0, __common_js.useAsyncCache)(this._currentUserCache, [session], "clientApp.useUser()");
 		const includeAnonymous = options?.or === "anonymous" || options?.or === "anonymous-if-exists[deprecated]";
 		const includeRestricted = options?.includeRestricted === true || includeAnonymous;
+		const pendingSignOut = this._pendingSignOut;
+		if (pendingSignOut != null) (0, _hexclave_shared_dist_utils_react.use)(pendingSignOut);
 		if (crud === null || crud.is_anonymous && !includeAnonymous || crud.is_restricted && !includeRestricted) switch (options?.or) {
 			case "redirect":
 				if (!crud?.is_anonymous && crud?.is_restricted) {
@@ -2876,14 +2938,25 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _signOut(session, options) {
 		this._eventTracker?.clearBuffer();
 		this._sessionRecorder?.clearBuffer();
-		await _hexclave_shared_dist_utils_stores.storeLock.withWriteLock(async () => {
+		const previousSignOut = this._pendingSignOut;
+		const signOutOperation = (async () => {
+			await previousSignOut;
 			await this._interface.signOut(session);
 			if (options?.redirectUrl) await this._redirectTo({
 				url: options.redirectUrl,
 				replace: true
 			});
 			else await this._redirectToDefaultAfterSignOut();
-		});
+		})();
+		const signOutBarrier = (async () => {
+			await _hexclave_shared_dist_utils_results.Result.fromPromise(signOutOperation);
+		})();
+		this._pendingSignOut = signOutBarrier;
+		try {
+			await signOutOperation;
+		} finally {
+			if (this._pendingSignOut === signOutBarrier) this._pendingSignOut = null;
+		}
 	}
 	async _redirectToDefaultAfterSignOut() {
 		if (this._urlOptions.afterSignOut != null) {
@@ -3093,5 +3166,6 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 };
 //#endregion
 exports._HexclaveClientAppImplIncomplete = _HexclaveClientAppImplIncomplete;
+exports.stripBrowserActionQueryParam = stripBrowserActionQueryParam;
 
 //# sourceMappingURL=client-app-impl.js.map