@hexclave/shared 1.0.2 → 1.0.5

package/dist/esm/utils/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","names":[],"sources":["../../../src/utils/jwt.tsx"],"mappings":";;;iBAsBsB,UAAA,CAAW,OAAA;EAC/B,GAAA;AAAA,IACD,OAAA;;;;;;;;;;;;;;;;;;;aAF+B,IAAA,CAAA,UAAA;EAAA;AAAA;;;;;;;;;;iBAeV,OAAA,CAAQ,OAAA;EAC5B,MAAA;EACA,QAAA;EACA,OAAA;EACA,cAAA;AAAA,IACD,OAAA;AAAA,iBAaqB,SAAA,CAAU,OAAA;EAC9B,cAAA;EACA,GAAA;AAAA,IACD,OAAA,CAAA,IAAA,CAAA,UAAA;AAAA,KAYW,UAAA;EACV,GAAA;EACA,GAAA;EACA,GAAA;EACA,GAAA;EACA,CAAA;EACA,CAAA;EACA,CAAA;AAAA;;;;AAPF;iBAgCsB,cAAA,CAAe,OAAA;EACnC,QAAA;AAAA,IACE,OAAA,CAAQ,UAAA;AAAA,KAuBA,SAAA;EACV,GAAA;EACA,GAAA;EACA,GAAA;EACA,GAAA;EACA,CAAA;EACA,CAAA;AAAA;AAAA,iBAEoB,eAAA,CAAgB,WAAA,EAAa,UAAA,KAAe,OAAA;EAAU,IAAA,EAAM,SAAA;AAAA;AAAA,iBAsBlE,SAAA,CAAU,OAAA;EACxB,MAAA;AAAA"}
+{"version":3,"file":"jwt.d.ts","names":[],"sources":["../../../src/utils/jwt.tsx"],"mappings":";;;iBAsBsB,UAAA,CAAW,OAAA;EAC/B,GAAA;AAAA,IACD,OAAA;;;;;;;;;;;;;;;;;;;aAF+B,IAAA,CAAA,UAAA;EAAA;AAAA;;;;;;;;;;iBAeV,OAAA,CAAQ,OAAA;EAC5B,MAAA;EACA,QAAA;EACA,OAAA;EACA,cAAA;AAAA,IACD,OAAA;AAAA,iBAaqB,SAAA,CAAU,OAAA;EAC9B,cAAA;EACA,GAAA;AAAA,IACD,OAAA,CAAA,IAAA,CAAA,UAAA;AAAA,KAYW,UAAA;EACV,GAAA;EACA,GAAA;EACA,GAAA;EACA,GAAA;EACA,CAAA;EACA,CAAA;EACA,CAAA;AAAA;;;;AAPF;iBAgCsB,cAAA,CAAe,OAAA;EACnC,QAAA;AAAA,IACE,OAAA,CAAQ,UAAA;AAAA,KA0BA,SAAA;EACV,GAAA;EACA,GAAA;EACA,GAAA;EACA,GAAA;EACA,CAAA;EACA,CAAA;AAAA;AAAA,iBAEoB,eAAA,CAAgB,WAAA,EAAa,UAAA,KAAe,OAAA;EAAU,IAAA,EAAM,SAAA;AAAA;AAAA,iBAsBlE,SAAA,CAAU,OAAA;EACxB,MAAA;AAAA"}

package/dist/esm/utils/jwt.js

@@ -11,7 +11,7 @@ import elliptic from "elliptic";
 import { JOSEError } from "jose/errors";
 
 //#region src/utils/jwt.tsx
-function getStackServerSecret() {
+function getHexclaveServerSecret() {
 	const STACK_SERVER_SECRET = getEnvVariable("STACK_SERVER_SECRET");
 	try {
 		jose.base64url.decode(STACK_SERVER_SECRET);
@@ -71,7 +71,7 @@ async function getPrivateJwkFromDerivedSecret(derivedSecret, kid) {
 async function getPrivateJwks(options) {
 	const getHashOfJwkInfo = (type) => jose.base64url.encode(crypto.createHash("sha256").update(JSON.stringify([
 		type,
-		getStackServerSecret(),
+		getHexclaveServerSecret(),
 		{ audience: options.audience }
 	])).digest());
 	const perAudienceSecret = getHashOfJwkInfo("stack-jwk-audience-secret");
@@ -91,7 +91,7 @@ async function getPublicJwkSet(privateJwks) {
 }
 function oldGetPerAudienceSecret(options) {
 	if (options.audience === "kid") throw new HexclaveAssertionError("You cannot use the 'kid' audience for a per-audience secret, see comment below in jwt.tsx");
-	return jose.base64url.encode(crypto.createHash("sha256").update(JSON.stringify([getStackServerSecret(), options.audience])).digest());
+	return jose.base64url.encode(crypto.createHash("sha256").update(JSON.stringify([getHexclaveServerSecret(), options.audience])).digest());
 }
 function oldGetKid(options) {
 	return jose.base64url.encode(crypto.createHash("sha256").update(JSON.stringify([options.secret, "kid"])).digest()).slice(0, 12);

package/dist/esm/utils/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","names":[],"sources":["../../../src/utils/jwt.tsx"],"sourcesContent":["import crypto from \"crypto\";\nimport elliptic from \"elliptic\";\nimport * as jose from \"jose\";\nimport { JOSEError } from \"jose/errors\";\nimport { encodeBase64Url } from \"./bytes\";\nimport { getEnvVariable } from \"./env\";\nimport { HexclaveAssertionError, errorToNiceString } from \"./errors\";\nimport { globalVar } from \"./globals\";\nimport { pick } from \"./objects\";\nimport { Result } from \"./results\";\nimport { nicify } from \"./strings\";\n\nfunction getStackServerSecret() {\n  const STACK_SERVER_SECRET = getEnvVariable(\"STACK_SERVER_SECRET\");\n  try {\n    jose.base64url.decode(STACK_SERVER_SECRET);\n  } catch (e) {\n    throw new HexclaveAssertionError(\"STACK_SERVER_SECRET is not valid. Please use the generateKeys script to generate a new secret.\", { cause: e });\n  }\n  return STACK_SERVER_SECRET;\n}\n\nexport async function getJwtInfo(options: {\n  jwt: string,\n}) {\n  try {\n    if (typeof options.jwt !== \"string\") return Result.error({ error: \"JWT input is not a string!\", stringifiedInput: nicify(options.jwt) });\n    if (!options.jwt.startsWith(\"ey\")) return Result.error({ error: \"Input is a string, but not a JWT!\", input: options.jwt });\n    const decodedJwt = jose.decodeJwt(options.jwt);\n    return Result.ok({ payload: decodedJwt });\n  } catch (e) {\n    return Result.error({\n      exception: errorToNiceString(e),\n    });\n  }\n}\n\nexport async function signJWT(options: {\n  issuer: string,\n  audience: string,\n  payload: any,\n  expirationTime?: string,\n}) {\n  const privateJwks = await getPrivateJwks({ audience: options.audience });\n  const privateKey = await jose.importJWK(privateJwks[0]);\n\n  return await new jose.SignJWT(options.payload)\n    .setProtectedHeader({ alg: \"ES256\", kid: privateJwks[0].kid })\n    .setIssuer(options.issuer)\n    .setIssuedAt()\n    .setAudience(options.audience)\n    .setExpirationTime(options.expirationTime || \"5m\")\n    .sign(privateKey);\n}\n\nexport async function verifyJWT(options: {\n  allowedIssuers: string[],\n  jwt: string,\n}) {\n  const decodedJwt = jose.decodeJwt(options.jwt);\n  const audience = decodedJwt.aud;\n  if (!audience || typeof audience !== \"string\") {\n    throw new JOSEError(\"Invalid JWT audience\");\n  }\n\n  const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(await getPrivateJwks({ audience })));\n  const verified = await jose.jwtVerify(options.jwt, jwkSet, { issuer: options.allowedIssuers });\n  return verified.payload;\n}\n\nexport type PrivateJwk = {\n  kty: \"EC\",\n  alg: \"ES256\",\n  crv: \"P-256\",\n  kid: string,\n  d: string,\n  x: string,\n  y: string,\n};\nasync function getPrivateJwkFromDerivedSecret(derivedSecret: string, kid: string): Promise<PrivateJwk> {\n  const secretHash = await globalVar.crypto.subtle.digest(\"SHA-256\", jose.base64url.decode(derivedSecret));\n  const priv = new Uint8Array(secretHash);\n\n  const ec = new elliptic.ec('p256');\n  const key = ec.keyFromPrivate(priv);\n  const publicKey = key.getPublic();\n\n  return {\n    kty: 'EC',\n    crv: 'P-256',\n    alg: 'ES256',\n    kid: kid,\n    d: encodeBase64Url(priv),\n    x: encodeBase64Url(publicKey.getX().toBuffer()),\n    y: encodeBase64Url(publicKey.getY().toBuffer()),\n  };\n}\n\n/**\n * Returns a list of valid private JWKs for the given audience, with the first one taking precedence when signing new\n * JWTs.\n */\nexport async function getPrivateJwks(options: {\n  audience: string,\n}): Promise<PrivateJwk[]> {\n  const getHashOfJwkInfo = (type: string) => jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      .update(JSON.stringify([type, getStackServerSecret(), {\n        audience: options.audience,\n      }]))\n      .digest()\n  );\n  const perAudienceSecret = getHashOfJwkInfo(\"stack-jwk-audience-secret\");\n  const perAudienceKid = getHashOfJwkInfo(\"stack-jwk-kid\").slice(0, 12);\n\n  const oldPerAudienceSecret = oldGetPerAudienceSecret({ audience: options.audience });\n  const oldPerAudienceKid = oldGetKid({ secret: oldPerAudienceSecret });\n\n  return [\n    // TODO next-release: make this not take precedence; then, in the release after that, remove it entirely\n    await getPrivateJwkFromDerivedSecret(oldPerAudienceSecret, oldPerAudienceKid),\n\n    await getPrivateJwkFromDerivedSecret(perAudienceSecret, perAudienceKid),\n  ];\n}\n\nexport type PublicJwk = {\n  kty: \"EC\",\n  alg: \"ES256\",\n  crv: \"P-256\",\n  kid: string,\n  x: string,\n  y: string,\n};\nexport async function getPublicJwkSet(privateJwks: PrivateJwk[]): Promise<{ keys: PublicJwk[] }> {\n  return {\n    keys: privateJwks.map(jwk => pick(jwk, [\"kty\", \"alg\", \"crv\", \"x\", \"y\", \"kid\"])),\n  };\n}\n\nfunction oldGetPerAudienceSecret(options: {\n  audience: string,\n}) {\n  if (options.audience === \"kid\") {\n    throw new HexclaveAssertionError(\"You cannot use the 'kid' audience for a per-audience secret, see comment below in jwt.tsx\");\n  }\n  return jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      // TODO we should prefix a string like \"stack-audience-secret\" before we hash so you can't use `getKid(...)` to get the secret for eg. the \"kid\" audience if the same secret value is used\n      // Sadly doing this modification is a bit annoying as we need to leave the old keys to be valid for a little longer\n      .update(JSON.stringify([getStackServerSecret(), options.audience]))\n      .digest()\n  );\n};\n\nexport function oldGetKid(options: {\n  secret: string,\n}) {\n  return jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      .update(JSON.stringify([options.secret, \"kid\"]))  // TODO see above in getPerAudienceSecret\n      .digest()\n  ).slice(0, 12);\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,uBAAuB;CAC9B,MAAM,sBAAsB,eAAe,sBAAsB;AACjE,KAAI;AACF,OAAK,UAAU,OAAO,oBAAoB;UACnC,GAAG;AACV,QAAM,IAAI,uBAAuB,kGAAkG,EAAE,OAAO,GAAG,CAAC;;AAElJ,QAAO;;AAGT,eAAsB,WAAW,SAE9B;AACD,KAAI;AACF,MAAI,OAAO,QAAQ,QAAQ,SAAU,QAAO,OAAO,MAAM;GAAE,OAAO;GAA8B,kBAAkB,OAAO,QAAQ,IAAI;GAAE,CAAC;AACxI,MAAI,CAAC,QAAQ,IAAI,WAAW,KAAK,CAAE,QAAO,OAAO,MAAM;GAAE,OAAO;GAAqC,OAAO,QAAQ;GAAK,CAAC;EAC1H,MAAM,aAAa,KAAK,UAAU,QAAQ,IAAI;AAC9C,SAAO,OAAO,GAAG,EAAE,SAAS,YAAY,CAAC;UAClC,GAAG;AACV,SAAO,OAAO,MAAM,EAClB,WAAW,kBAAkB,EAAE,EAChC,CAAC;;;AAIN,eAAsB,QAAQ,SAK3B;CACD,MAAM,cAAc,MAAM,eAAe,EAAE,UAAU,QAAQ,UAAU,CAAC;CACxE,MAAM,aAAa,MAAM,KAAK,UAAU,YAAY,GAAG;AAEvD,QAAO,MAAM,IAAI,KAAK,QAAQ,QAAQ,QAAQ,CAC3C,mBAAmB;EAAE,KAAK;EAAS,KAAK,YAAY,GAAG;EAAK,CAAC,CAC7D,UAAU,QAAQ,OAAO,CACzB,aAAa,CACb,YAAY,QAAQ,SAAS,CAC7B,kBAAkB,QAAQ,kBAAkB,KAAK,CACjD,KAAK,WAAW;;AAGrB,eAAsB,UAAU,SAG7B;CAED,MAAM,WADa,KAAK,UAAU,QAAQ,IAAI,CAClB;AAC5B,KAAI,CAAC,YAAY,OAAO,aAAa,SACnC,OAAM,IAAI,UAAU,uBAAuB;CAG7C,MAAM,SAAS,KAAK,kBAAkB,MAAM,gBAAgB,MAAM,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhG,SADiB,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,EAAE,QAAQ,QAAQ,gBAAgB,CAAC,EAC9E;;AAYlB,eAAe,+BAA+B,eAAuB,KAAkC;CACrG,MAAM,aAAa,MAAM,UAAU,OAAO,OAAO,OAAO,WAAW,KAAK,UAAU,OAAO,cAAc,CAAC;CACxG,MAAM,OAAO,IAAI,WAAW,WAAW;CAIvC,MAAM,YAFK,IAAI,SAAS,GAAG,OAAO,CACnB,eAAe,KAAK,CACb,WAAW;AAEjC,QAAO;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACA;EACL,GAAG,gBAAgB,KAAK;EACxB,GAAG,gBAAgB,UAAU,MAAM,CAAC,UAAU,CAAC;EAC/C,GAAG,gBAAgB,UAAU,MAAM,CAAC,UAAU,CAAC;EAChD;;;;;;AAOH,eAAsB,eAAe,SAEX;CACxB,MAAM,oBAAoB,SAAiB,KAAK,UAAU,OACxD,OACG,WAAW,SAAS,CACpB,OAAO,KAAK,UAAU;EAAC;EAAM,sBAAsB;EAAE,EACpD,UAAU,QAAQ,UACnB;EAAC,CAAC,CAAC,CACH,QAAQ,CACZ;CACD,MAAM,oBAAoB,iBAAiB,4BAA4B;CACvE,MAAM,iBAAiB,iBAAiB,gBAAgB,CAAC,MAAM,GAAG,GAAG;CAErE,MAAM,uBAAuB,wBAAwB,EAAE,UAAU,QAAQ,UAAU,CAAC;AAGpF,QAAO,CAEL,MAAM,+BAA+B,sBAJb,UAAU,EAAE,QAAQ,sBAAsB,CAAC,CAIU,EAE7E,MAAM,+BAA+B,mBAAmB,eAAe,CACxE;;AAWH,eAAsB,gBAAgB,aAA2D;AAC/F,QAAO,EACL,MAAM,YAAY,KAAI,QAAO,KAAK,KAAK;EAAC;EAAO;EAAO;EAAO;EAAK;EAAK;EAAM,CAAC,CAAC,EAChF;;AAGH,SAAS,wBAAwB,SAE9B;AACD,KAAI,QAAQ,aAAa,MACvB,OAAM,IAAI,uBAAuB,4FAA4F;AAE/H,QAAO,KAAK,UAAU,OACpB,OACG,WAAW,SAAS,CAGpB,OAAO,KAAK,UAAU,CAAC,sBAAsB,EAAE,QAAQ,SAAS,CAAC,CAAC,CAClE,QAAQ,CACZ;;AAGH,SAAgB,UAAU,SAEvB;AACD,QAAO,KAAK,UAAU,OACpB,OACG,WAAW,SAAS,CACpB,OAAO,KAAK,UAAU,CAAC,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAC/C,QAAQ,CACZ,CAAC,MAAM,GAAG,GAAG"}
+{"version":3,"file":"jwt.js","names":[],"sources":["../../../src/utils/jwt.tsx"],"sourcesContent":["import crypto from \"crypto\";\nimport elliptic from \"elliptic\";\nimport * as jose from \"jose\";\nimport { JOSEError } from \"jose/errors\";\nimport { encodeBase64Url } from \"./bytes\";\nimport { getEnvVariable } from \"./env\";\nimport { HexclaveAssertionError, errorToNiceString } from \"./errors\";\nimport { globalVar } from \"./globals\";\nimport { pick } from \"./objects\";\nimport { Result } from \"./results\";\nimport { nicify } from \"./strings\";\n\nfunction getHexclaveServerSecret() {\n  const STACK_SERVER_SECRET = getEnvVariable(\"STACK_SERVER_SECRET\");\n  try {\n    jose.base64url.decode(STACK_SERVER_SECRET);\n  } catch (e) {\n    throw new HexclaveAssertionError(\"STACK_SERVER_SECRET is not valid. Please use the generateKeys script to generate a new secret.\", { cause: e });\n  }\n  return STACK_SERVER_SECRET;\n}\n\nexport async function getJwtInfo(options: {\n  jwt: string,\n}) {\n  try {\n    if (typeof options.jwt !== \"string\") return Result.error({ error: \"JWT input is not a string!\", stringifiedInput: nicify(options.jwt) });\n    if (!options.jwt.startsWith(\"ey\")) return Result.error({ error: \"Input is a string, but not a JWT!\", input: options.jwt });\n    const decodedJwt = jose.decodeJwt(options.jwt);\n    return Result.ok({ payload: decodedJwt });\n  } catch (e) {\n    return Result.error({\n      exception: errorToNiceString(e),\n    });\n  }\n}\n\nexport async function signJWT(options: {\n  issuer: string,\n  audience: string,\n  payload: any,\n  expirationTime?: string,\n}) {\n  const privateJwks = await getPrivateJwks({ audience: options.audience });\n  const privateKey = await jose.importJWK(privateJwks[0]);\n\n  return await new jose.SignJWT(options.payload)\n    .setProtectedHeader({ alg: \"ES256\", kid: privateJwks[0].kid })\n    .setIssuer(options.issuer)\n    .setIssuedAt()\n    .setAudience(options.audience)\n    .setExpirationTime(options.expirationTime || \"5m\")\n    .sign(privateKey);\n}\n\nexport async function verifyJWT(options: {\n  allowedIssuers: string[],\n  jwt: string,\n}) {\n  const decodedJwt = jose.decodeJwt(options.jwt);\n  const audience = decodedJwt.aud;\n  if (!audience || typeof audience !== \"string\") {\n    throw new JOSEError(\"Invalid JWT audience\");\n  }\n\n  const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(await getPrivateJwks({ audience })));\n  const verified = await jose.jwtVerify(options.jwt, jwkSet, { issuer: options.allowedIssuers });\n  return verified.payload;\n}\n\nexport type PrivateJwk = {\n  kty: \"EC\",\n  alg: \"ES256\",\n  crv: \"P-256\",\n  kid: string,\n  d: string,\n  x: string,\n  y: string,\n};\nasync function getPrivateJwkFromDerivedSecret(derivedSecret: string, kid: string): Promise<PrivateJwk> {\n  const secretHash = await globalVar.crypto.subtle.digest(\"SHA-256\", jose.base64url.decode(derivedSecret));\n  const priv = new Uint8Array(secretHash);\n\n  const ec = new elliptic.ec('p256');\n  const key = ec.keyFromPrivate(priv);\n  const publicKey = key.getPublic();\n\n  return {\n    kty: 'EC',\n    crv: 'P-256',\n    alg: 'ES256',\n    kid: kid,\n    d: encodeBase64Url(priv),\n    x: encodeBase64Url(publicKey.getX().toBuffer()),\n    y: encodeBase64Url(publicKey.getY().toBuffer()),\n  };\n}\n\n/**\n * Returns a list of valid private JWKs for the given audience, with the first one taking precedence when signing new\n * JWTs.\n */\nexport async function getPrivateJwks(options: {\n  audience: string,\n}): Promise<PrivateJwk[]> {\n  const getHashOfJwkInfo = (type: string) => jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      .update(JSON.stringify([type, getHexclaveServerSecret(), {\n        audience: options.audience,\n      }]))\n      .digest()\n  );\n  // NOTE (Hexclave rebrand): do NOT rename these \"stack-*\" literals. They are hashed into the\n  // per-audience JWT signing secret and key id (kid); renaming them would rotate every project's\n  // JWKS and invalidate all already-issued access tokens. Internal constants, never user-visible.\n  const perAudienceSecret = getHashOfJwkInfo(\"stack-jwk-audience-secret\");\n  const perAudienceKid = getHashOfJwkInfo(\"stack-jwk-kid\").slice(0, 12);\n\n  const oldPerAudienceSecret = oldGetPerAudienceSecret({ audience: options.audience });\n  const oldPerAudienceKid = oldGetKid({ secret: oldPerAudienceSecret });\n\n  return [\n    // TODO next-release: make this not take precedence; then, in the release after that, remove it entirely\n    await getPrivateJwkFromDerivedSecret(oldPerAudienceSecret, oldPerAudienceKid),\n\n    await getPrivateJwkFromDerivedSecret(perAudienceSecret, perAudienceKid),\n  ];\n}\n\nexport type PublicJwk = {\n  kty: \"EC\",\n  alg: \"ES256\",\n  crv: \"P-256\",\n  kid: string,\n  x: string,\n  y: string,\n};\nexport async function getPublicJwkSet(privateJwks: PrivateJwk[]): Promise<{ keys: PublicJwk[] }> {\n  return {\n    keys: privateJwks.map(jwk => pick(jwk, [\"kty\", \"alg\", \"crv\", \"x\", \"y\", \"kid\"])),\n  };\n}\n\nfunction oldGetPerAudienceSecret(options: {\n  audience: string,\n}) {\n  if (options.audience === \"kid\") {\n    throw new HexclaveAssertionError(\"You cannot use the 'kid' audience for a per-audience secret, see comment below in jwt.tsx\");\n  }\n  return jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      // TODO we should prefix a string like \"stack-audience-secret\" before we hash so you can't use `getKid(...)` to get the secret for eg. the \"kid\" audience if the same secret value is used\n      // Sadly doing this modification is a bit annoying as we need to leave the old keys to be valid for a little longer\n      .update(JSON.stringify([getHexclaveServerSecret(), options.audience]))\n      .digest()\n  );\n};\n\nexport function oldGetKid(options: {\n  secret: string,\n}) {\n  return jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      .update(JSON.stringify([options.secret, \"kid\"]))  // TODO see above in getPerAudienceSecret\n      .digest()\n  ).slice(0, 12);\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,0BAA0B;CACjC,MAAM,sBAAsB,eAAe,sBAAsB;AACjE,KAAI;AACF,OAAK,UAAU,OAAO,oBAAoB;UACnC,GAAG;AACV,QAAM,IAAI,uBAAuB,kGAAkG,EAAE,OAAO,GAAG,CAAC;;AAElJ,QAAO;;AAGT,eAAsB,WAAW,SAE9B;AACD,KAAI;AACF,MAAI,OAAO,QAAQ,QAAQ,SAAU,QAAO,OAAO,MAAM;GAAE,OAAO;GAA8B,kBAAkB,OAAO,QAAQ,IAAI;GAAE,CAAC;AACxI,MAAI,CAAC,QAAQ,IAAI,WAAW,KAAK,CAAE,QAAO,OAAO,MAAM;GAAE,OAAO;GAAqC,OAAO,QAAQ;GAAK,CAAC;EAC1H,MAAM,aAAa,KAAK,UAAU,QAAQ,IAAI;AAC9C,SAAO,OAAO,GAAG,EAAE,SAAS,YAAY,CAAC;UAClC,GAAG;AACV,SAAO,OAAO,MAAM,EAClB,WAAW,kBAAkB,EAAE,EAChC,CAAC;;;AAIN,eAAsB,QAAQ,SAK3B;CACD,MAAM,cAAc,MAAM,eAAe,EAAE,UAAU,QAAQ,UAAU,CAAC;CACxE,MAAM,aAAa,MAAM,KAAK,UAAU,YAAY,GAAG;AAEvD,QAAO,MAAM,IAAI,KAAK,QAAQ,QAAQ,QAAQ,CAC3C,mBAAmB;EAAE,KAAK;EAAS,KAAK,YAAY,GAAG;EAAK,CAAC,CAC7D,UAAU,QAAQ,OAAO,CACzB,aAAa,CACb,YAAY,QAAQ,SAAS,CAC7B,kBAAkB,QAAQ,kBAAkB,KAAK,CACjD,KAAK,WAAW;;AAGrB,eAAsB,UAAU,SAG7B;CAED,MAAM,WADa,KAAK,UAAU,QAAQ,IAAI,CAClB;AAC5B,KAAI,CAAC,YAAY,OAAO,aAAa,SACnC,OAAM,IAAI,UAAU,uBAAuB;CAG7C,MAAM,SAAS,KAAK,kBAAkB,MAAM,gBAAgB,MAAM,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhG,SADiB,MAAM,KAAK,UAAU,QAAQ,KAAK,QAAQ,EAAE,QAAQ,QAAQ,gBAAgB,CAAC,EAC9E;;AAYlB,eAAe,+BAA+B,eAAuB,KAAkC;CACrG,MAAM,aAAa,MAAM,UAAU,OAAO,OAAO,OAAO,WAAW,KAAK,UAAU,OAAO,cAAc,CAAC;CACxG,MAAM,OAAO,IAAI,WAAW,WAAW;CAIvC,MAAM,YAFK,IAAI,SAAS,GAAG,OAAO,CACnB,eAAe,KAAK,CACb,WAAW;AAEjC,QAAO;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACA;EACL,GAAG,gBAAgB,KAAK;EACxB,GAAG,gBAAgB,UAAU,MAAM,CAAC,UAAU,CAAC;EAC/C,GAAG,gBAAgB,UAAU,MAAM,CAAC,UAAU,CAAC;EAChD;;;;;;AAOH,eAAsB,eAAe,SAEX;CACxB,MAAM,oBAAoB,SAAiB,KAAK,UAAU,OACxD,OACG,WAAW,SAAS,CACpB,OAAO,KAAK,UAAU;EAAC;EAAM,yBAAyB;EAAE,EACvD,UAAU,QAAQ,UACnB;EAAC,CAAC,CAAC,CACH,QAAQ,CACZ;CAID,MAAM,oBAAoB,iBAAiB,4BAA4B;CACvE,MAAM,iBAAiB,iBAAiB,gBAAgB,CAAC,MAAM,GAAG,GAAG;CAErE,MAAM,uBAAuB,wBAAwB,EAAE,UAAU,QAAQ,UAAU,CAAC;AAGpF,QAAO,CAEL,MAAM,+BAA+B,sBAJb,UAAU,EAAE,QAAQ,sBAAsB,CAAC,CAIU,EAE7E,MAAM,+BAA+B,mBAAmB,eAAe,CACxE;;AAWH,eAAsB,gBAAgB,aAA2D;AAC/F,QAAO,EACL,MAAM,YAAY,KAAI,QAAO,KAAK,KAAK;EAAC;EAAO;EAAO;EAAO;EAAK;EAAK;EAAM,CAAC,CAAC,EAChF;;AAGH,SAAS,wBAAwB,SAE9B;AACD,KAAI,QAAQ,aAAa,MACvB,OAAM,IAAI,uBAAuB,4FAA4F;AAE/H,QAAO,KAAK,UAAU,OACpB,OACG,WAAW,SAAS,CAGpB,OAAO,KAAK,UAAU,CAAC,yBAAyB,EAAE,QAAQ,SAAS,CAAC,CAAC,CACrE,QAAQ,CACZ;;AAGH,SAAgB,UAAU,SAEvB;AACD,QAAO,KAAK,UAAU,OACpB,OACG,WAAW,SAAS,CACpB,OAAO,KAAK,UAAU,CAAC,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAC/C,QAAQ,CACZ,CAAC,MAAM,GAAG,GAAG"}

package/dist/esm/utils/redirect-urls.d.ts

@@ -7,20 +7,20 @@ declare function getHostedHandlerTrustedDomain(options: {
   projectId: string;
   hostedHandlerDomainSuffix?: string;
   hostedHandlerUrlTemplate?: string;
-  stackPortPrefix?: string;
+  hexclavePortPrefix?: string;
 }): string;
 declare function getHostedHandlerUrlFromConfig(options: {
   projectId: string;
   hostedPath: string;
   hostedHandlerDomainSuffix?: string;
   hostedHandlerUrlTemplate?: string;
-  stackPortPrefix?: string;
+  hexclavePortPrefix?: string;
 }): string;
 declare function getImplicitlyTrustedDomainsForProject(options: {
   projectId: string;
   hostedHandlerDomainSuffix?: string;
   hostedHandlerUrlTemplate?: string;
-  stackPortPrefix?: string;
+  hexclavePortPrefix?: string;
 }): string[];
 declare function isAcceptedNativeAppUrl(urlOrString: string): boolean;
 declare function validateRedirectUrl(urlOrString: string | URL, config: TrustedDomainConfig): boolean;

package/dist/esm/utils/redirect-urls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-urls.d.ts","names":[],"sources":["../../../src/utils/redirect-urls.tsx"],"mappings":";KAGK,mBAAA;EACH,cAAA;EACA,cAAA;AAAA;AAAA,iBAgCc,6BAAA,CAA8B,OAAA;EAC5C,SAAA;EACA,yBAAA;EACA,wBAAA;EACA,eAAA;AAAA;AAAA,iBAQc,6BAAA,CAA8B,OAAA;EAC5C,SAAA;EACA,UAAA;EACA,yBAAA;EACA,wBAAA;EACA,eAAA;AAAA;AAAA,iBA0Bc,qCAAA,CAAsC,OAAA;EACpD,SAAA;EACA,yBAAA;EACA,wBAAA;EACA,eAAA;AAAA;AAAA,iBA0Ec,sBAAA,CAAuB,WAAA;AAAA,iBASvB,mBAAA,CACd,WAAA,WAAsB,GAAA,EACtB,MAAA,EAAQ,mBAAA;AAAA,iBAYM,sBAAA,CAAuB,aAAA,UAAuB,cAAA"}
+{"version":3,"file":"redirect-urls.d.ts","names":[],"sources":["../../../src/utils/redirect-urls.tsx"],"mappings":";KAGK,mBAAA;EACH,cAAA;EACA,cAAA;AAAA;AAAA,iBAgCc,6BAAA,CAA8B,OAAA;EAC5C,SAAA;EACA,yBAAA;EACA,wBAAA;EACA,kBAAA;AAAA;AAAA,iBAQc,6BAAA,CAA8B,OAAA;EAC5C,SAAA;EACA,UAAA;EACA,yBAAA;EACA,wBAAA;EACA,kBAAA;AAAA;AAAA,iBA0Bc,qCAAA,CAAsC,OAAA;EACpD,SAAA;EACA,yBAAA;EACA,wBAAA;EACA,kBAAA;AAAA;AAAA,iBA0Ec,sBAAA,CAAuB,WAAA;AAAA,iBASvB,mBAAA,CACd,WAAA,WAAsB,GAAA,EACtB,MAAA,EAAQ,mBAAA;AAAA,iBAYM,sBAAA,CAAuB,aAAA,UAAuB,cAAA"}

package/dist/esm/utils/redirect-urls.js

@@ -8,9 +8,9 @@ const hostedHandlerPathPlaceholder = "{hostedPath}";
 const defaultPorts = new Map([["https:", "443"], ["http:", "80"]]);
 const hostedHandlerTemplateProjectIdA = "00000000-0000-4000-8000-000000000000";
 const hostedHandlerTemplateProjectIdB = "11111111-1111-4111-8111-111111111111";
-function replaceStackPortPrefix(input, stackPortPrefix) {
+function replaceHexclavePortPrefix(input, hexclavePortPrefix) {
 	if (input == null) return void 0;
-	return stackPortPrefix ? input.replace(/\$\{NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81\}/g, stackPortPrefix) : input;
+	return hexclavePortPrefix ? input.replace(/\$\{NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81\}/g, hexclavePortPrefix) : input;
 }
 function getHostedHandlerUrlFromTemplate(template, projectId, hostedPath) {
 	return template.replaceAll(hostedHandlerProjectIdPlaceholder, projectId).replaceAll(hostedHandlerPathPlaceholder, hostedPath);
@@ -30,9 +30,9 @@ function getHostedHandlerTrustedDomain(options) {
 	})).origin;
 }
 function getHostedHandlerUrlFromConfig(options) {
-	const configuredTemplate = replaceStackPortPrefix(options.hostedHandlerUrlTemplate, options.stackPortPrefix);
+	const configuredTemplate = replaceHexclavePortPrefix(options.hostedHandlerUrlTemplate, options.hexclavePortPrefix);
 	return configuredTemplate == null ? (() => {
-		const domainSuffix = replaceStackPortPrefix(options.hostedHandlerDomainSuffix, options.stackPortPrefix) ?? defaultHostedHandlerDomainSuffix;
+		const domainSuffix = replaceHexclavePortPrefix(options.hostedHandlerDomainSuffix, options.hexclavePortPrefix) ?? defaultHostedHandlerDomainSuffix;
 		if (!domainSuffix.startsWith(".")) throw new HexclaveAssertionError("The hosted handler domain suffix must start with a dot.", {
 			domainSuffix,
 			hint: "Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX to a value like '.built-with-stack-auth.com'."
@@ -149,7 +149,7 @@ function getTrustedParentDomain(currentDomain, trustedDomains) {
 		trustedDomains: getImplicitlyTrustedDomainsForProject({
 			projectId,
 			hostedHandlerUrlTemplate: "http://{projectId}.localhost:${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}09/{hostedPath}",
-			stackPortPrefix: "92"
+			hexclavePortPrefix: "92"
 		})
 	})).toBe(true);
 });

package/dist/esm/utils/redirect-urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-urls.js","names":[],"sources":["../../../src/utils/redirect-urls.tsx"],"sourcesContent":["import { HexclaveAssertionError, captureError } from \"./errors\";\nimport { createUrlIfValid, isLocalhost, matchHostnamePattern } from \"./urls\";\n\ntype TrustedDomainConfig = {\n  allowLocalhost?: boolean,\n  trustedDomains: readonly (string | null | undefined)[],\n};\n\nconst defaultHostedHandlerDomainSuffix = \".built-with-stack-auth.com\";\nconst hostedHandlerProjectIdPlaceholder = \"{projectId}\";\nconst hostedHandlerPathPlaceholder = \"{hostedPath}\";\nconst defaultPorts = new Map<string, string>([['https:', '443'], ['http:', '80']]);\nconst hostedHandlerTemplateProjectIdA = \"00000000-0000-4000-8000-000000000000\";\nconst hostedHandlerTemplateProjectIdB = \"11111111-1111-4111-8111-111111111111\";\n\nfunction replaceStackPortPrefix(input: string | undefined, stackPortPrefix: string | undefined): string | undefined {\n  if (input == null) return undefined;\n  return stackPortPrefix ? input.replace(/\\$\\{NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81\\}/g, stackPortPrefix) : input;\n}\n\nfunction getHostedHandlerUrlFromTemplate(template: string, projectId: string, hostedPath: string): string {\n  return template\n    .replaceAll(hostedHandlerProjectIdPlaceholder, projectId)\n    .replaceAll(hostedHandlerPathPlaceholder, hostedPath);\n}\n\nfunction assertHostedHandlerTemplateHasProjectOrigin(template: string): void {\n  const projectUrlA = new URL(getHostedHandlerUrlFromTemplate(template, hostedHandlerTemplateProjectIdA, \"handler\"));\n  const projectUrlB = new URL(getHostedHandlerUrlFromTemplate(template, hostedHandlerTemplateProjectIdB, \"handler\"));\n  if (projectUrlA.origin === projectUrlB.origin || !projectUrlA.hostname.includes(hostedHandlerTemplateProjectIdA)) {\n    throw new HexclaveAssertionError(\"The hosted handler URL template must put {projectId} in the hostname.\", {\n      hostedHandlerUrlTemplate: template,\n      hint: \"Use a project-specific origin like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}', not a shared-origin path like 'https://example.com/{projectId}/{hostedPath}'.\",\n    });\n  }\n}\n\nexport function getHostedHandlerTrustedDomain(options: {\n  projectId: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  stackPortPrefix?: string,\n}): string {\n  return new URL(getHostedHandlerUrlFromConfig({\n    ...options,\n    hostedPath: \"handler\",\n  })).origin;\n}\n\nexport function getHostedHandlerUrlFromConfig(options: {\n  projectId: string,\n  hostedPath: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  stackPortPrefix?: string,\n}): string {\n  const configuredTemplate = replaceStackPortPrefix(options.hostedHandlerUrlTemplate, options.stackPortPrefix);\n  return configuredTemplate == null\n    ? (() => {\n      const domainSuffix = replaceStackPortPrefix(options.hostedHandlerDomainSuffix, options.stackPortPrefix) ?? defaultHostedHandlerDomainSuffix;\n      if (!domainSuffix.startsWith(\".\")) {\n        throw new HexclaveAssertionError(\"The hosted handler domain suffix must start with a dot.\", {\n          domainSuffix,\n          hint: \"Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX to a value like '.built-with-stack-auth.com'.\",\n        });\n      }\n      return `https://${options.projectId}${domainSuffix}/${options.hostedPath}`;\n    })()\n    : (() => {\n      if (!configuredTemplate.includes(hostedHandlerProjectIdPlaceholder) || !configuredTemplate.includes(hostedHandlerPathPlaceholder)) {\n        throw new HexclaveAssertionError(\"The hosted handler URL template must contain {projectId} and {hostedPath}.\", {\n          hostedHandlerUrlTemplate: configuredTemplate,\n          hint: \"Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE to a value like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}'.\",\n        });\n      }\n      assertHostedHandlerTemplateHasProjectOrigin(configuredTemplate);\n      return getHostedHandlerUrlFromTemplate(configuredTemplate, options.projectId, options.hostedPath);\n    })();\n}\n\nexport function getImplicitlyTrustedDomainsForProject(options: {\n  projectId: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  stackPortPrefix?: string,\n}): string[] {\n  return [getHostedHandlerTrustedDomain(options)];\n}\n\nfunction normalizePort(url: URL): string {\n  const port = url.port || defaultPorts.get(url.protocol) || '';\n  return port ? `${url.hostname}:${port}` : url.hostname;\n}\n\nfunction isDefaultPort(url: URL): boolean {\n  return !url.port ||\n    (url.protocol === 'https:' && url.port === '443') ||\n    (url.protocol === 'http:' && url.port === '80');\n}\n\nfunction portsMatch(url1: URL, url2: URL): boolean {\n  return normalizePort(url1) === normalizePort(url2);\n}\n\nfunction parseWildcardUrlPattern(pattern: string): { protocol: string, hostPattern: string } | null {\n  const protocolSeparatorIndex = pattern.indexOf(\"://\");\n  if (protocolSeparatorIndex === -1) return null;\n\n  const protocol = `${pattern.slice(0, protocolSeparatorIndex)}:`;\n  const hostAndPath = pattern.slice(protocolSeparatorIndex + \"://\".length);\n  const pathStartIndex = hostAndPath.indexOf(\"/\");\n  const hostPattern = pathStartIndex === -1 ? hostAndPath : hostAndPath.slice(0, pathStartIndex);\n  if (hostPattern === \"\") return null;\n  return { protocol, hostPattern };\n}\n\nfunction hostPatternWithoutPort(hostPattern: string): string {\n  if (!hostPatternHasExplicitPort(hostPattern)) {\n    return hostPattern;\n  }\n  const portSeparatorIndex = hostPattern.lastIndexOf(\":\");\n  return hostPattern.slice(0, portSeparatorIndex);\n}\n\nfunction hostPatternHasExplicitPort(hostPattern: string): boolean {\n  const portSeparatorIndex = hostPattern.lastIndexOf(\":\");\n  if (portSeparatorIndex === -1) {\n    return false;\n  }\n  const port = hostPattern.slice(portSeparatorIndex + 1);\n  return port === \"*\" || (port !== \"\" && [...port].every(char => char >= \"0\" && char <= \"9\"));\n}\n\nfunction matchesTrustedDomain(testUrl: URL, pattern: string): boolean {\n  const baseUrl = createUrlIfValid(pattern);\n\n  if (baseUrl != null && !pattern.includes('*')) {\n    return baseUrl.protocol === testUrl.protocol &&\n      baseUrl.hostname === testUrl.hostname &&\n      portsMatch(baseUrl, testUrl);\n  }\n\n  const parsedPattern = parseWildcardUrlPattern(pattern);\n  if (parsedPattern == null) {\n    captureError(\"invalid-redirect-domain\", new HexclaveAssertionError(\"Invalid domain pattern\", { pattern }));\n    return false;\n  }\n\n  if (testUrl.protocol !== parsedPattern.protocol) {\n    return false;\n  }\n\n  const hasPortInPattern = hostPatternHasExplicitPort(parsedPattern.hostPattern);\n  return hasPortInPattern\n    ? matchHostnamePattern(parsedPattern.hostPattern, normalizePort(testUrl))\n    : matchHostnamePattern(parsedPattern.hostPattern, testUrl.hostname) && isDefaultPort(testUrl);\n}\n\nexport function isAcceptedNativeAppUrl(urlOrString: string): boolean {\n  const url = createUrlIfValid(urlOrString);\n  if (!url) return false;\n\n  // Legacy scheme accepted indefinitely; baked into already-shipped Swift SDK binaries.\n  return url.protocol === 'stack-auth-mobile-oauth-url:'\n    || url.protocol === 'hexclave-mobile-oauth-url:';\n}\n\nexport function validateRedirectUrl(\n  urlOrString: string | URL,\n  config: TrustedDomainConfig,\n): boolean {\n  const url = createUrlIfValid(urlOrString);\n  if (!url) return false;\n\n  if (config.allowLocalhost === true && isLocalhost(url)) {\n    return true;\n  }\n\n  return config.trustedDomains.some(domain => domain != null && matchesTrustedDomain(url, domain));\n}\n\nexport function getTrustedParentDomain(currentDomain: string, trustedDomains: readonly (string | null | undefined)[]): string | null {\n  const hostPatterns = trustedDomains\n    .filter((domain): domain is string => domain != null)\n    .map((domain) => {\n      const url = createUrlIfValid(domain);\n      if (url != null && !domain.includes(\"*\")) {\n        return url.hostname.toLowerCase();\n      }\n      const parsedPattern = parseWildcardUrlPattern(domain);\n      return parsedPattern == null ? null : hostPatternWithoutPort(parsedPattern.hostPattern).toLowerCase();\n    })\n    .filter((domain): domain is string => domain != null);\n\n  const parts = currentDomain.toLowerCase().split('.');\n  for (let i = parts.length - 2; i >= 0; i--) {\n    const parentDomain = parts.slice(i).join('.');\n    if (hostPatterns.includes(parentDomain) && hostPatterns.includes(`**.${parentDomain}`)) {\n      return parentDomain;\n    }\n  }\n\n  return null;\n}\n\nimport.meta.vitest?.test(\"validateRedirectUrl matches exact and wildcard trusted domains\", ({ expect }) => {\n  expect(validateRedirectUrl(\"https://example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://api.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://*.example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://api.v2.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://*.example.com\"],\n  })).toBe(false);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl trusts implicit hosted handler domains\", ({ expect }) => {\n  const projectId = \"12345678-1234-4234-8234-123456789abc\";\n  expect(validateRedirectUrl(`https://${projectId}.built-with-stack-auth.com/anything`, {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({ projectId }),\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://other-project.built-with-stack-auth.com/anything\", {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({ projectId }),\n  })).toBe(false);\n  expect(validateRedirectUrl(`http://${projectId}.localhost:9209/anything`, {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({\n      projectId,\n      hostedHandlerUrlTemplate: \"http://{projectId}.localhost:${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}09/{hostedPath}\",\n      stackPortPrefix: \"92\",\n    }),\n  })).toBe(true);\n});\n\nimport.meta.vitest?.test(\"getImplicitlyTrustedDomainsForProject rejects shared-origin hosted templates\", ({ expect }) => {\n  expect(() => getImplicitlyTrustedDomainsForProject({\n    projectId: \"12345678-1234-4234-8234-123456789abc\",\n    hostedHandlerUrlTemplate: \"https://host.example.com/{projectId}/{hostedPath}\",\n  })).toThrowErrorMatchingInlineSnapshot(`\n    [HexclaveAssertionError: The hosted handler URL template must put {projectId} in the hostname.\n\n    This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n  `);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl respects default and explicit ports\", ({ expect }) => {\n  expect(validateRedirectUrl(\"https://example.com:443/path\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"http://api.example.com:3000\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:3000\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"http://api.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:3000\"],\n  })).toBe(false);\n  expect(validateRedirectUrl(\"http://api.example.com:1234\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:*\"],\n  })).toBe(true);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl respects localhost allowance and invalid patterns\", ({ expect }) => {\n  const originalConsoleError = console.error;\n  console.error = () => {};\n  try {\n    expect(validateRedirectUrl(\"http://localhost:3000\", {\n      allowLocalhost: true,\n      trustedDomains: [],\n    })).toBe(true);\n    expect(validateRedirectUrl(\"http://localhost:3000\", {\n      allowLocalhost: false,\n      trustedDomains: [],\n    })).toBe(false);\n    expect(validateRedirectUrl(\"https://example.com\", {\n      allowLocalhost: false,\n      trustedDomains: [\"not a url\"],\n    })).toBe(false);\n  } finally {\n    console.error = originalConsoleError;\n  }\n});\n\nimport.meta.vitest?.test(\"getTrustedParentDomain ignores empty entries and strips ports\", ({ expect }) => {\n  expect(getTrustedParentDomain(\"app.example.com\", [\n    null,\n    undefined,\n    \"https://example.com\",\n    \"https://**.example.com:*\",\n  ])).toBe(\"example.com\");\n});\n"],"mappings":";;;;AAQA,MAAM,mCAAmC;AACzC,MAAM,oCAAoC;AAC1C,MAAM,+BAA+B;AACrC,MAAM,eAAe,IAAI,IAAoB,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC;AAClF,MAAM,kCAAkC;AACxC,MAAM,kCAAkC;AAExC,SAAS,uBAAuB,OAA2B,iBAAyD;AAClH,KAAI,SAAS,KAAM,QAAO;AAC1B,QAAO,kBAAkB,MAAM,QAAQ,+CAA+C,gBAAgB,GAAG;;AAG3G,SAAS,gCAAgC,UAAkB,WAAmB,YAA4B;AACxG,QAAO,SACJ,WAAW,mCAAmC,UAAS,CACvD,WAAW,8BAA8B,WAAW;;AAGzD,SAAS,4CAA4C,UAAwB;CAC3E,MAAM,cAAc,IAAI,IAAI,gCAAgC,UAAU,iCAAiC,UAAU,CAAC;CAClH,MAAM,cAAc,IAAI,IAAI,gCAAgC,UAAU,iCAAiC,UAAU,CAAC;AAClH,KAAI,YAAY,WAAW,YAAY,UAAU,CAAC,YAAY,SAAS,SAAS,gCAAgC,CAC9G,OAAM,IAAI,uBAAuB,yEAAyE;EACxG,0BAA0B;EAC1B,MAAM;EACP,CAAC;;AAIN,SAAgB,8BAA8B,SAKnC;AACT,QAAO,IAAI,IAAI,8BAA8B;EAC3C,GAAG;EACH,YAAY;EACb,CAAC,CAAC,CAAC;;AAGN,SAAgB,8BAA8B,SAMnC;CACT,MAAM,qBAAqB,uBAAuB,QAAQ,0BAA0B,QAAQ,gBAAgB;AAC5G,QAAO,sBAAsB,cAClB;EACP,MAAM,eAAe,uBAAuB,QAAQ,2BAA2B,QAAQ,gBAAgB,IAAI;AAC3G,MAAI,CAAC,aAAa,WAAW,IAAI,CAC/B,OAAM,IAAI,uBAAuB,2DAA2D;GAC1F;GACA,MAAM;GACP,CAAC;AAEJ,SAAO,WAAW,QAAQ,YAAY,aAAa,GAAG,QAAQ;KAC7D,UACM;AACP,MAAI,CAAC,mBAAmB,SAAS,kCAAkC,IAAI,CAAC,mBAAmB,SAAS,6BAA6B,CAC/H,OAAM,IAAI,uBAAuB,8EAA8E;GAC7G,0BAA0B;GAC1B,MAAM;GACP,CAAC;AAEJ,8CAA4C,mBAAmB;AAC/D,SAAO,gCAAgC,oBAAoB,QAAQ,WAAW,QAAQ,WAAW;KAC/F;;AAGR,SAAgB,sCAAsC,SAKzC;AACX,QAAO,CAAC,8BAA8B,QAAQ,CAAC;;AAGjD,SAAS,cAAc,KAAkB;CACvC,MAAM,OAAO,IAAI,QAAQ,aAAa,IAAI,IAAI,SAAS,IAAI;AAC3D,QAAO,OAAO,GAAG,IAAI,SAAS,GAAG,SAAS,IAAI;;AAGhD,SAAS,cAAc,KAAmB;AACxC,QAAO,CAAC,IAAI,QACT,IAAI,aAAa,YAAY,IAAI,SAAS,SAC1C,IAAI,aAAa,WAAW,IAAI,SAAS;;AAG9C,SAAS,WAAW,MAAW,MAAoB;AACjD,QAAO,cAAc,KAAK,KAAK,cAAc,KAAK;;AAGpD,SAAS,wBAAwB,SAAmE;CAClG,MAAM,yBAAyB,QAAQ,QAAQ,MAAM;AACrD,KAAI,2BAA2B,GAAI,QAAO;CAE1C,MAAM,WAAW,GAAG,QAAQ,MAAM,GAAG,uBAAuB,CAAC;CAC7D,MAAM,cAAc,QAAQ,MAAM,yBAAyB,EAAa;CACxE,MAAM,iBAAiB,YAAY,QAAQ,IAAI;CAC/C,MAAM,cAAc,mBAAmB,KAAK,cAAc,YAAY,MAAM,GAAG,eAAe;AAC9F,KAAI,gBAAgB,GAAI,QAAO;AAC/B,QAAO;EAAE;EAAU;EAAa;;AAGlC,SAAS,uBAAuB,aAA6B;AAC3D,KAAI,CAAC,2BAA2B,YAAY,CAC1C,QAAO;CAET,MAAM,qBAAqB,YAAY,YAAY,IAAI;AACvD,QAAO,YAAY,MAAM,GAAG,mBAAmB;;AAGjD,SAAS,2BAA2B,aAA8B;CAChE,MAAM,qBAAqB,YAAY,YAAY,IAAI;AACvD,KAAI,uBAAuB,GACzB,QAAO;CAET,MAAM,OAAO,YAAY,MAAM,qBAAqB,EAAE;AACtD,QAAO,SAAS,OAAQ,SAAS,MAAM,CAAC,GAAG,KAAK,CAAC,OAAM,SAAQ,QAAQ,OAAO,QAAQ,IAAI;;AAG5F,SAAS,qBAAqB,SAAc,SAA0B;CACpE,MAAM,UAAU,iBAAiB,QAAQ;AAEzC,KAAI,WAAW,QAAQ,CAAC,QAAQ,SAAS,IAAI,CAC3C,QAAO,QAAQ,aAAa,QAAQ,YAClC,QAAQ,aAAa,QAAQ,YAC7B,WAAW,SAAS,QAAQ;CAGhC,MAAM,gBAAgB,wBAAwB,QAAQ;AACtD,KAAI,iBAAiB,MAAM;AACzB,eAAa,2BAA2B,IAAI,uBAAuB,0BAA0B,EAAE,SAAS,CAAC,CAAC;AAC1G,SAAO;;AAGT,KAAI,QAAQ,aAAa,cAAc,SACrC,QAAO;AAIT,QADyB,2BAA2B,cAAc,YAAY,GAE1E,qBAAqB,cAAc,aAAa,cAAc,QAAQ,CAAA,GACtE,qBAAqB,cAAc,aAAa,QAAQ,SAAS,IAAI,cAAc,QAAQ;;AAGjG,SAAgB,uBAAuB,aAA8B;CACnE,MAAM,MAAM,iBAAiB,YAAY;AACzC,KAAI,CAAC,IAAK,QAAO;AAGjB,QAAO,IAAI,aAAa,kCACnB,IAAI,aAAa;;AAGxB,SAAgB,oBACd,aACA,QACS;CACT,MAAM,MAAM,iBAAiB,YAAY;AACzC,KAAI,CAAC,IAAK,QAAO;AAEjB,KAAI,OAAO,mBAAmB,QAAQ,YAAY,IAAI,CACpD,QAAO;AAGT,QAAO,OAAO,eAAe,MAAK,WAAU,UAAU,QAAQ,qBAAqB,KAAK,OAAO,CAAC;;AAGlG,SAAgB,uBAAuB,eAAuB,gBAAuE;CACnI,MAAM,eAAe,eAClB,QAAQ,WAA6B,UAAU,KAAI,CACnD,KAAK,WAAW;EACf,MAAM,MAAM,iBAAiB,OAAO;AACpC,MAAI,OAAO,QAAQ,CAAC,OAAO,SAAS,IAAI,CACtC,QAAO,IAAI,SAAS,aAAa;EAEnC,MAAM,gBAAgB,wBAAwB,OAAO;AACrD,SAAO,iBAAiB,OAAO,OAAO,uBAAuB,cAAc,YAAY,CAAC,aAAa;GACtG,CACA,QAAQ,WAA6B,UAAU,KAAK;CAEvD,MAAM,QAAQ,cAAc,aAAa,CAAC,MAAM,IAAI;AACpD,MAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;EAC1C,MAAM,eAAe,MAAM,MAAM,EAAE,CAAC,KAAK,IAAI;AAC7C,MAAI,aAAa,SAAS,aAAa,IAAI,aAAa,SAAS,MAAM,eAAe,CACpF,QAAO;;AAIX,QAAO;;CAGT,SAAW,KAAC,mEAAqE,EAAA,aAAa;AAC5F,QAAO,oBAAoB,uBAAuB;EAChD,gBAAgB;EAChB,gBAAgB,CAAC,sBAAsB;EACxC,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,2BAA2B;EACpD,gBAAgB;EAChB,gBAAgB,CAAC,wBAAwB;EAC1C,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,8BAA8B;EACvD,gBAAgB;EAChB,gBAAgB,CAAC,wBAAwB;EAC1C,CAAC,CAAC,CAAC,KAAK,MAAM;EACf;CAEF,SAAW,KAAC,+DAAiE,EAAA,aAAa;CACxF,MAAM,YAAY;AAClB,QAAO,oBAAoB,WAAW,UAAU,sCAAsC;EACpF,gBAAgB;EAChB,gBAAgB,sCAAsC,EAAE,WAAW,CAAC;EACrE,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,4DAA4D;EACrF,gBAAgB;EAChB,gBAAgB,sCAAsC,EAAE,WAAW,CAAC;EACrE,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,QAAO,oBAAoB,UAAU,UAAU,2BAA2B;EACxE,gBAAgB;EAChB,gBAAgB,sCAAsC;GACpD;GACA,0BAA0B;GAC1B,iBAAiB;GAClB,CAAC;EACH,CAAC,CAAC,CAAC,KAAK,KAAK;EACd;CAEF,SAAW,KAAC,iFAAiF,EAAA,aAAe;AAC1G,cAAa,sCAAsC;EACjD,WAAW;EACX,0BAA0B;EAC3B,CAAC,CAAC,CAAC,mCAAmC;;;;IAIrC;EACF;CAEF,SAAW,KAAC,4DAAgE,EAAA,aAAW;AACrF,QAAO,oBAAoB,gCAAgC;EACzD,gBAAgB;EAChB,gBAAgB,CAAC,sBAAsB;EACxC,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,+BAA+B;EACxD,gBAAgB;EAChB,gBAAgB,CAAC,4BAA4B;EAC9C,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,0BAA0B;EACnD,gBAAgB;EAChB,gBAAgB,CAAC,4BAA4B;EAC9C,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,QAAO,oBAAoB,+BAA+B;EACxD,gBAAgB;EAChB,gBAAgB,CAAC,yBAAyB;EAC3C,CAAC,CAAC,CAAC,KAAK,KAAK;EACd;CAEF,SAAW,KAAC,0EAA2E,EAAA,aAAc;CACnG,MAAM,uBAAuB,QAAQ;AACrC,SAAQ,cAAc;AACtB,KAAI;AACF,SAAO,oBAAoB,yBAAyB;GAClD,gBAAgB;GAChB,gBAAgB,EAAE;GACnB,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,SAAO,oBAAoB,yBAAyB;GAClD,gBAAgB;GAChB,gBAAgB,EAAE;GACnB,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,SAAO,oBAAoB,uBAAuB;GAChD,gBAAgB;GAChB,gBAAgB,CAAC,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,MAAM;WACP;AACR,UAAQ,QAAQ;;EAElB;CAEF,SAAW,KAAC,kEAAsE,EAAA,aAAW;AAC3F,QAAO,uBAAuB,mBAAmB;EAC/C;EACA;EACA;EACA;EACD,CAAC,CAAC,CAAC,KAAK,cAAc;EACvB"}
+{"version":3,"file":"redirect-urls.js","names":[],"sources":["../../../src/utils/redirect-urls.tsx"],"sourcesContent":["import { HexclaveAssertionError, captureError } from \"./errors\";\nimport { createUrlIfValid, isLocalhost, matchHostnamePattern } from \"./urls\";\n\ntype TrustedDomainConfig = {\n  allowLocalhost?: boolean,\n  trustedDomains: readonly (string | null | undefined)[],\n};\n\nconst defaultHostedHandlerDomainSuffix = \".built-with-stack-auth.com\";\nconst hostedHandlerProjectIdPlaceholder = \"{projectId}\";\nconst hostedHandlerPathPlaceholder = \"{hostedPath}\";\nconst defaultPorts = new Map<string, string>([['https:', '443'], ['http:', '80']]);\nconst hostedHandlerTemplateProjectIdA = \"00000000-0000-4000-8000-000000000000\";\nconst hostedHandlerTemplateProjectIdB = \"11111111-1111-4111-8111-111111111111\";\n\nfunction replaceHexclavePortPrefix(input: string | undefined, hexclavePortPrefix: string | undefined): string | undefined {\n  if (input == null) return undefined;\n  return hexclavePortPrefix ? input.replace(/\\$\\{NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81\\}/g, hexclavePortPrefix) : input;\n}\n\nfunction getHostedHandlerUrlFromTemplate(template: string, projectId: string, hostedPath: string): string {\n  return template\n    .replaceAll(hostedHandlerProjectIdPlaceholder, projectId)\n    .replaceAll(hostedHandlerPathPlaceholder, hostedPath);\n}\n\nfunction assertHostedHandlerTemplateHasProjectOrigin(template: string): void {\n  const projectUrlA = new URL(getHostedHandlerUrlFromTemplate(template, hostedHandlerTemplateProjectIdA, \"handler\"));\n  const projectUrlB = new URL(getHostedHandlerUrlFromTemplate(template, hostedHandlerTemplateProjectIdB, \"handler\"));\n  if (projectUrlA.origin === projectUrlB.origin || !projectUrlA.hostname.includes(hostedHandlerTemplateProjectIdA)) {\n    throw new HexclaveAssertionError(\"The hosted handler URL template must put {projectId} in the hostname.\", {\n      hostedHandlerUrlTemplate: template,\n      hint: \"Use a project-specific origin like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}', not a shared-origin path like 'https://example.com/{projectId}/{hostedPath}'.\",\n    });\n  }\n}\n\nexport function getHostedHandlerTrustedDomain(options: {\n  projectId: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  hexclavePortPrefix?: string,\n}): string {\n  return new URL(getHostedHandlerUrlFromConfig({\n    ...options,\n    hostedPath: \"handler\",\n  })).origin;\n}\n\nexport function getHostedHandlerUrlFromConfig(options: {\n  projectId: string,\n  hostedPath: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  hexclavePortPrefix?: string,\n}): string {\n  const configuredTemplate = replaceHexclavePortPrefix(options.hostedHandlerUrlTemplate, options.hexclavePortPrefix);\n  return configuredTemplate == null\n    ? (() => {\n      const domainSuffix = replaceHexclavePortPrefix(options.hostedHandlerDomainSuffix, options.hexclavePortPrefix) ?? defaultHostedHandlerDomainSuffix;\n      if (!domainSuffix.startsWith(\".\")) {\n        throw new HexclaveAssertionError(\"The hosted handler domain suffix must start with a dot.\", {\n          domainSuffix,\n          hint: \"Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX to a value like '.built-with-stack-auth.com'.\",\n        });\n      }\n      return `https://${options.projectId}${domainSuffix}/${options.hostedPath}`;\n    })()\n    : (() => {\n      if (!configuredTemplate.includes(hostedHandlerProjectIdPlaceholder) || !configuredTemplate.includes(hostedHandlerPathPlaceholder)) {\n        throw new HexclaveAssertionError(\"The hosted handler URL template must contain {projectId} and {hostedPath}.\", {\n          hostedHandlerUrlTemplate: configuredTemplate,\n          hint: \"Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE to a value like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}'.\",\n        });\n      }\n      assertHostedHandlerTemplateHasProjectOrigin(configuredTemplate);\n      return getHostedHandlerUrlFromTemplate(configuredTemplate, options.projectId, options.hostedPath);\n    })();\n}\n\nexport function getImplicitlyTrustedDomainsForProject(options: {\n  projectId: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  hexclavePortPrefix?: string,\n}): string[] {\n  return [getHostedHandlerTrustedDomain(options)];\n}\n\nfunction normalizePort(url: URL): string {\n  const port = url.port || defaultPorts.get(url.protocol) || '';\n  return port ? `${url.hostname}:${port}` : url.hostname;\n}\n\nfunction isDefaultPort(url: URL): boolean {\n  return !url.port ||\n    (url.protocol === 'https:' && url.port === '443') ||\n    (url.protocol === 'http:' && url.port === '80');\n}\n\nfunction portsMatch(url1: URL, url2: URL): boolean {\n  return normalizePort(url1) === normalizePort(url2);\n}\n\nfunction parseWildcardUrlPattern(pattern: string): { protocol: string, hostPattern: string } | null {\n  const protocolSeparatorIndex = pattern.indexOf(\"://\");\n  if (protocolSeparatorIndex === -1) return null;\n\n  const protocol = `${pattern.slice(0, protocolSeparatorIndex)}:`;\n  const hostAndPath = pattern.slice(protocolSeparatorIndex + \"://\".length);\n  const pathStartIndex = hostAndPath.indexOf(\"/\");\n  const hostPattern = pathStartIndex === -1 ? hostAndPath : hostAndPath.slice(0, pathStartIndex);\n  if (hostPattern === \"\") return null;\n  return { protocol, hostPattern };\n}\n\nfunction hostPatternWithoutPort(hostPattern: string): string {\n  if (!hostPatternHasExplicitPort(hostPattern)) {\n    return hostPattern;\n  }\n  const portSeparatorIndex = hostPattern.lastIndexOf(\":\");\n  return hostPattern.slice(0, portSeparatorIndex);\n}\n\nfunction hostPatternHasExplicitPort(hostPattern: string): boolean {\n  const portSeparatorIndex = hostPattern.lastIndexOf(\":\");\n  if (portSeparatorIndex === -1) {\n    return false;\n  }\n  const port = hostPattern.slice(portSeparatorIndex + 1);\n  return port === \"*\" || (port !== \"\" && [...port].every(char => char >= \"0\" && char <= \"9\"));\n}\n\nfunction matchesTrustedDomain(testUrl: URL, pattern: string): boolean {\n  const baseUrl = createUrlIfValid(pattern);\n\n  if (baseUrl != null && !pattern.includes('*')) {\n    return baseUrl.protocol === testUrl.protocol &&\n      baseUrl.hostname === testUrl.hostname &&\n      portsMatch(baseUrl, testUrl);\n  }\n\n  const parsedPattern = parseWildcardUrlPattern(pattern);\n  if (parsedPattern == null) {\n    captureError(\"invalid-redirect-domain\", new HexclaveAssertionError(\"Invalid domain pattern\", { pattern }));\n    return false;\n  }\n\n  if (testUrl.protocol !== parsedPattern.protocol) {\n    return false;\n  }\n\n  const hasPortInPattern = hostPatternHasExplicitPort(parsedPattern.hostPattern);\n  return hasPortInPattern\n    ? matchHostnamePattern(parsedPattern.hostPattern, normalizePort(testUrl))\n    : matchHostnamePattern(parsedPattern.hostPattern, testUrl.hostname) && isDefaultPort(testUrl);\n}\n\nexport function isAcceptedNativeAppUrl(urlOrString: string): boolean {\n  const url = createUrlIfValid(urlOrString);\n  if (!url) return false;\n\n  // Legacy scheme accepted indefinitely; baked into already-shipped Swift SDK binaries.\n  return url.protocol === 'stack-auth-mobile-oauth-url:'\n    || url.protocol === 'hexclave-mobile-oauth-url:';\n}\n\nexport function validateRedirectUrl(\n  urlOrString: string | URL,\n  config: TrustedDomainConfig,\n): boolean {\n  const url = createUrlIfValid(urlOrString);\n  if (!url) return false;\n\n  if (config.allowLocalhost === true && isLocalhost(url)) {\n    return true;\n  }\n\n  return config.trustedDomains.some(domain => domain != null && matchesTrustedDomain(url, domain));\n}\n\nexport function getTrustedParentDomain(currentDomain: string, trustedDomains: readonly (string | null | undefined)[]): string | null {\n  const hostPatterns = trustedDomains\n    .filter((domain): domain is string => domain != null)\n    .map((domain) => {\n      const url = createUrlIfValid(domain);\n      if (url != null && !domain.includes(\"*\")) {\n        return url.hostname.toLowerCase();\n      }\n      const parsedPattern = parseWildcardUrlPattern(domain);\n      return parsedPattern == null ? null : hostPatternWithoutPort(parsedPattern.hostPattern).toLowerCase();\n    })\n    .filter((domain): domain is string => domain != null);\n\n  const parts = currentDomain.toLowerCase().split('.');\n  for (let i = parts.length - 2; i >= 0; i--) {\n    const parentDomain = parts.slice(i).join('.');\n    if (hostPatterns.includes(parentDomain) && hostPatterns.includes(`**.${parentDomain}`)) {\n      return parentDomain;\n    }\n  }\n\n  return null;\n}\n\nimport.meta.vitest?.test(\"validateRedirectUrl matches exact and wildcard trusted domains\", ({ expect }) => {\n  expect(validateRedirectUrl(\"https://example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://api.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://*.example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://api.v2.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://*.example.com\"],\n  })).toBe(false);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl trusts implicit hosted handler domains\", ({ expect }) => {\n  const projectId = \"12345678-1234-4234-8234-123456789abc\";\n  expect(validateRedirectUrl(`https://${projectId}.built-with-stack-auth.com/anything`, {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({ projectId }),\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://other-project.built-with-stack-auth.com/anything\", {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({ projectId }),\n  })).toBe(false);\n  expect(validateRedirectUrl(`http://${projectId}.localhost:9209/anything`, {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({\n      projectId,\n      hostedHandlerUrlTemplate: \"http://{projectId}.localhost:${NEXT_PUBLIC_HEXCLAVE_PORT_PREFIX:-81}09/{hostedPath}\",\n      hexclavePortPrefix: \"92\",\n    }),\n  })).toBe(true);\n});\n\nimport.meta.vitest?.test(\"getImplicitlyTrustedDomainsForProject rejects shared-origin hosted templates\", ({ expect }) => {\n  expect(() => getImplicitlyTrustedDomainsForProject({\n    projectId: \"12345678-1234-4234-8234-123456789abc\",\n    hostedHandlerUrlTemplate: \"https://host.example.com/{projectId}/{hostedPath}\",\n  })).toThrowErrorMatchingInlineSnapshot(`\n    [HexclaveAssertionError: The hosted handler URL template must put {projectId} in the hostname.\n\n    This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n  `);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl respects default and explicit ports\", ({ expect }) => {\n  expect(validateRedirectUrl(\"https://example.com:443/path\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"http://api.example.com:3000\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:3000\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"http://api.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:3000\"],\n  })).toBe(false);\n  expect(validateRedirectUrl(\"http://api.example.com:1234\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:*\"],\n  })).toBe(true);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl respects localhost allowance and invalid patterns\", ({ expect }) => {\n  const originalConsoleError = console.error;\n  console.error = () => {};\n  try {\n    expect(validateRedirectUrl(\"http://localhost:3000\", {\n      allowLocalhost: true,\n      trustedDomains: [],\n    })).toBe(true);\n    expect(validateRedirectUrl(\"http://localhost:3000\", {\n      allowLocalhost: false,\n      trustedDomains: [],\n    })).toBe(false);\n    expect(validateRedirectUrl(\"https://example.com\", {\n      allowLocalhost: false,\n      trustedDomains: [\"not a url\"],\n    })).toBe(false);\n  } finally {\n    console.error = originalConsoleError;\n  }\n});\n\nimport.meta.vitest?.test(\"getTrustedParentDomain ignores empty entries and strips ports\", ({ expect }) => {\n  expect(getTrustedParentDomain(\"app.example.com\", [\n    null,\n    undefined,\n    \"https://example.com\",\n    \"https://**.example.com:*\",\n  ])).toBe(\"example.com\");\n});\n"],"mappings":";;;;AAQA,MAAM,mCAAmC;AACzC,MAAM,oCAAoC;AAC1C,MAAM,+BAA+B;AACrC,MAAM,eAAe,IAAI,IAAoB,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC;AAClF,MAAM,kCAAkC;AACxC,MAAM,kCAAkC;AAExC,SAAS,0BAA0B,OAA2B,oBAA4D;AACxH,KAAI,SAAS,KAAM,QAAO;AAC1B,QAAO,qBAAqB,MAAM,QAAQ,+CAA+C,mBAAmB,GAAG;;AAGjH,SAAS,gCAAgC,UAAkB,WAAmB,YAA4B;AACxG,QAAO,SACJ,WAAW,mCAAmC,UAAS,CACvD,WAAW,8BAA8B,WAAW;;AAGzD,SAAS,4CAA4C,UAAwB;CAC3E,MAAM,cAAc,IAAI,IAAI,gCAAgC,UAAU,iCAAiC,UAAU,CAAC;CAClH,MAAM,cAAc,IAAI,IAAI,gCAAgC,UAAU,iCAAiC,UAAU,CAAC;AAClH,KAAI,YAAY,WAAW,YAAY,UAAU,CAAC,YAAY,SAAS,SAAS,gCAAgC,CAC9G,OAAM,IAAI,uBAAuB,yEAAyE;EACxG,0BAA0B;EAC1B,MAAM;EACP,CAAC;;AAIN,SAAgB,8BAA8B,SAKnC;AACT,QAAO,IAAI,IAAI,8BAA8B;EAC3C,GAAG;EACH,YAAY;EACb,CAAC,CAAC,CAAC;;AAGN,SAAgB,8BAA8B,SAMnC;CACT,MAAM,qBAAqB,0BAA0B,QAAQ,0BAA0B,QAAQ,mBAAmB;AAClH,QAAO,sBAAsB,cAClB;EACP,MAAM,eAAe,0BAA0B,QAAQ,2BAA2B,QAAQ,mBAAmB,IAAI;AACjH,MAAI,CAAC,aAAa,WAAW,IAAI,CAC/B,OAAM,IAAI,uBAAuB,2DAA2D;GAC1F;GACA,MAAM;GACP,CAAC;AAEJ,SAAO,WAAW,QAAQ,YAAY,aAAa,GAAG,QAAQ;KAC7D,UACM;AACP,MAAI,CAAC,mBAAmB,SAAS,kCAAkC,IAAI,CAAC,mBAAmB,SAAS,6BAA6B,CAC/H,OAAM,IAAI,uBAAuB,8EAA8E;GAC7G,0BAA0B;GAC1B,MAAM;GACP,CAAC;AAEJ,8CAA4C,mBAAmB;AAC/D,SAAO,gCAAgC,oBAAoB,QAAQ,WAAW,QAAQ,WAAW;KAC/F;;AAGR,SAAgB,sCAAsC,SAKzC;AACX,QAAO,CAAC,8BAA8B,QAAQ,CAAC;;AAGjD,SAAS,cAAc,KAAkB;CACvC,MAAM,OAAO,IAAI,QAAQ,aAAa,IAAI,IAAI,SAAS,IAAI;AAC3D,QAAO,OAAO,GAAG,IAAI,SAAS,GAAG,SAAS,IAAI;;AAGhD,SAAS,cAAc,KAAmB;AACxC,QAAO,CAAC,IAAI,QACT,IAAI,aAAa,YAAY,IAAI,SAAS,SAC1C,IAAI,aAAa,WAAW,IAAI,SAAS;;AAG9C,SAAS,WAAW,MAAW,MAAoB;AACjD,QAAO,cAAc,KAAK,KAAK,cAAc,KAAK;;AAGpD,SAAS,wBAAwB,SAAmE;CAClG,MAAM,yBAAyB,QAAQ,QAAQ,MAAM;AACrD,KAAI,2BAA2B,GAAI,QAAO;CAE1C,MAAM,WAAW,GAAG,QAAQ,MAAM,GAAG,uBAAuB,CAAC;CAC7D,MAAM,cAAc,QAAQ,MAAM,yBAAyB,EAAa;CACxE,MAAM,iBAAiB,YAAY,QAAQ,IAAI;CAC/C,MAAM,cAAc,mBAAmB,KAAK,cAAc,YAAY,MAAM,GAAG,eAAe;AAC9F,KAAI,gBAAgB,GAAI,QAAO;AAC/B,QAAO;EAAE;EAAU;EAAa;;AAGlC,SAAS,uBAAuB,aAA6B;AAC3D,KAAI,CAAC,2BAA2B,YAAY,CAC1C,QAAO;CAET,MAAM,qBAAqB,YAAY,YAAY,IAAI;AACvD,QAAO,YAAY,MAAM,GAAG,mBAAmB;;AAGjD,SAAS,2BAA2B,aAA8B;CAChE,MAAM,qBAAqB,YAAY,YAAY,IAAI;AACvD,KAAI,uBAAuB,GACzB,QAAO;CAET,MAAM,OAAO,YAAY,MAAM,qBAAqB,EAAE;AACtD,QAAO,SAAS,OAAQ,SAAS,MAAM,CAAC,GAAG,KAAK,CAAC,OAAM,SAAQ,QAAQ,OAAO,QAAQ,IAAI;;AAG5F,SAAS,qBAAqB,SAAc,SAA0B;CACpE,MAAM,UAAU,iBAAiB,QAAQ;AAEzC,KAAI,WAAW,QAAQ,CAAC,QAAQ,SAAS,IAAI,CAC3C,QAAO,QAAQ,aAAa,QAAQ,YAClC,QAAQ,aAAa,QAAQ,YAC7B,WAAW,SAAS,QAAQ;CAGhC,MAAM,gBAAgB,wBAAwB,QAAQ;AACtD,KAAI,iBAAiB,MAAM;AACzB,eAAa,2BAA2B,IAAI,uBAAuB,0BAA0B,EAAE,SAAS,CAAC,CAAC;AAC1G,SAAO;;AAGT,KAAI,QAAQ,aAAa,cAAc,SACrC,QAAO;AAIT,QADyB,2BAA2B,cAAc,YAAY,GAE1E,qBAAqB,cAAc,aAAa,cAAc,QAAQ,CAAA,GACtE,qBAAqB,cAAc,aAAa,QAAQ,SAAS,IAAI,cAAc,QAAQ;;AAGjG,SAAgB,uBAAuB,aAA8B;CACnE,MAAM,MAAM,iBAAiB,YAAY;AACzC,KAAI,CAAC,IAAK,QAAO;AAGjB,QAAO,IAAI,aAAa,kCACnB,IAAI,aAAa;;AAGxB,SAAgB,oBACd,aACA,QACS;CACT,MAAM,MAAM,iBAAiB,YAAY;AACzC,KAAI,CAAC,IAAK,QAAO;AAEjB,KAAI,OAAO,mBAAmB,QAAQ,YAAY,IAAI,CACpD,QAAO;AAGT,QAAO,OAAO,eAAe,MAAK,WAAU,UAAU,QAAQ,qBAAqB,KAAK,OAAO,CAAC;;AAGlG,SAAgB,uBAAuB,eAAuB,gBAAuE;CACnI,MAAM,eAAe,eAClB,QAAQ,WAA6B,UAAU,KAAI,CACnD,KAAK,WAAW;EACf,MAAM,MAAM,iBAAiB,OAAO;AACpC,MAAI,OAAO,QAAQ,CAAC,OAAO,SAAS,IAAI,CACtC,QAAO,IAAI,SAAS,aAAa;EAEnC,MAAM,gBAAgB,wBAAwB,OAAO;AACrD,SAAO,iBAAiB,OAAO,OAAO,uBAAuB,cAAc,YAAY,CAAC,aAAa;GACtG,CACA,QAAQ,WAA6B,UAAU,KAAK;CAEvD,MAAM,QAAQ,cAAc,aAAa,CAAC,MAAM,IAAI;AACpD,MAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;EAC1C,MAAM,eAAe,MAAM,MAAM,EAAE,CAAC,KAAK,IAAI;AAC7C,MAAI,aAAa,SAAS,aAAa,IAAI,aAAa,SAAS,MAAM,eAAe,CACpF,QAAO;;AAIX,QAAO;;CAGT,SAAW,KAAC,mEAAqE,EAAA,aAAa;AAC5F,QAAO,oBAAoB,uBAAuB;EAChD,gBAAgB;EAChB,gBAAgB,CAAC,sBAAsB;EACxC,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,2BAA2B;EACpD,gBAAgB;EAChB,gBAAgB,CAAC,wBAAwB;EAC1C,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,8BAA8B;EACvD,gBAAgB;EAChB,gBAAgB,CAAC,wBAAwB;EAC1C,CAAC,CAAC,CAAC,KAAK,MAAM;EACf;CAEF,SAAW,KAAC,+DAAiE,EAAA,aAAa;CACxF,MAAM,YAAY;AAClB,QAAO,oBAAoB,WAAW,UAAU,sCAAsC;EACpF,gBAAgB;EAChB,gBAAgB,sCAAsC,EAAE,WAAW,CAAC;EACrE,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,4DAA4D;EACrF,gBAAgB;EAChB,gBAAgB,sCAAsC,EAAE,WAAW,CAAC;EACrE,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,QAAO,oBAAoB,UAAU,UAAU,2BAA2B;EACxE,gBAAgB;EAChB,gBAAgB,sCAAsC;GACpD;GACA,0BAA0B;GAC1B,oBAAoB;GACrB,CAAC;EACH,CAAC,CAAC,CAAC,KAAK,KAAK;EACd;CAEF,SAAW,KAAC,iFAAiF,EAAA,aAAe;AAC1G,cAAa,sCAAsC;EACjD,WAAW;EACX,0BAA0B;EAC3B,CAAC,CAAC,CAAC,mCAAmC;;;;IAIrC;EACF;CAEF,SAAW,KAAC,4DAAgE,EAAA,aAAW;AACrF,QAAO,oBAAoB,gCAAgC;EACzD,gBAAgB;EAChB,gBAAgB,CAAC,sBAAsB;EACxC,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,+BAA+B;EACxD,gBAAgB;EAChB,gBAAgB,CAAC,4BAA4B;EAC9C,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,0BAA0B;EACnD,gBAAgB;EAChB,gBAAgB,CAAC,4BAA4B;EAC9C,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,QAAO,oBAAoB,+BAA+B;EACxD,gBAAgB;EAChB,gBAAgB,CAAC,yBAAyB;EAC3C,CAAC,CAAC,CAAC,KAAK,KAAK;EACd;CAEF,SAAW,KAAC,0EAA2E,EAAA,aAAc;CACnG,MAAM,uBAAuB,QAAQ;AACrC,SAAQ,cAAc;AACtB,KAAI;AACF,SAAO,oBAAoB,yBAAyB;GAClD,gBAAgB;GAChB,gBAAgB,EAAE;GACnB,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,SAAO,oBAAoB,yBAAyB;GAClD,gBAAgB;GAChB,gBAAgB,EAAE;GACnB,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,SAAO,oBAAoB,uBAAuB;GAChD,gBAAgB;GAChB,gBAAgB,CAAC,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,MAAM;WACP;AACR,UAAQ,QAAQ;;EAElB;CAEF,SAAW,KAAC,kEAAsE,EAAA,aAAW;AAC3F,QAAO,uBAAuB,mBAAmB;EAC/C;EACA;EACA;EACA;EACD,CAAC,CAAC,CAAC,KAAK,cAAc;EACvB"}

package/dist/esm/utils/urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"urls.js","names":[],"sources":["../../../src/utils/urls.tsx"],"sourcesContent":["import { generateSecureRandomString } from \"./crypto\";\nimport { templateIdentity } from \"./strings\";\n\nexport function createUrlIfValid(...args: ConstructorParameters<typeof URL>) {\n  try {\n    return new URL(...args);\n  } catch (e) {\n    return null;\n  }\n}\nimport.meta.vitest?.test(\"createUrlIfValid\", ({ expect }) => {\n  // Test with valid URLs\n  expect(createUrlIfValid(\"https://example.com\")).toBeInstanceOf(URL);\n  expect(createUrlIfValid(\"https://example.com/path?query=value#hash\")).toBeInstanceOf(URL);\n  expect(createUrlIfValid(\"/path\", \"https://example.com\")).toBeInstanceOf(URL);\n\n  // Test with invalid URLs\n  expect(createUrlIfValid(\"\")).toBeNull();\n  expect(createUrlIfValid(\"not a url\")).toBeNull();\n  expect(createUrlIfValid(\"http://\")).toBeNull();\n});\n\nexport function isValidUrl(url: string) {\n  return !!createUrlIfValid(url);\n}\nimport.meta.vitest?.test(\"isValidUrl\", ({ expect }) => {\n  // Test with valid URLs\n  expect(isValidUrl(\"https://example.com\")).toBe(true);\n  expect(isValidUrl(\"http://localhost:3000\")).toBe(true);\n  expect(isValidUrl(\"ftp://example.com\")).toBe(true);\n\n  // Test with invalid URLs\n  expect(isValidUrl(\"\")).toBe(false);\n  expect(isValidUrl(\"not a url\")).toBe(false);\n  expect(isValidUrl(\"http://\")).toBe(false);\n});\n\nexport function isValidHostname(hostname: string) {\n  // Basic validation\n  if (!hostname || hostname.startsWith('.') || hostname.endsWith('.') || hostname.includes('..')) {\n    return false;\n  }\n\n  const url = createUrlIfValid(`https://${hostname}`);\n  if (!url) return false;\n  return url.hostname === hostname;\n}\nimport.meta.vitest?.test(\"isValidHostname\", ({ expect }) => {\n  // Test with valid hostnames\n  expect(isValidHostname(\"example.com\")).toBe(true);\n  expect(isValidHostname(\"localhost\")).toBe(true);\n  expect(isValidHostname(\"sub.domain.example.com\")).toBe(true);\n  expect(isValidHostname(\"127.0.0.1\")).toBe(true);\n\n  // Test with invalid hostnames\n  expect(isValidHostname(\"\")).toBe(false);\n  expect(isValidHostname(\"example.com/path\")).toBe(false);\n  expect(isValidHostname(\"https://example.com\")).toBe(false);\n  expect(isValidHostname(\"example com\")).toBe(false);\n});\n\nexport function isValidHostnameWithWildcards(hostname: string) {\n  // Empty hostnames are invalid\n  if (!hostname) return false;\n\n  // Check if it contains wildcards\n  const hasWildcard = hostname.includes('*');\n\n  if (!hasWildcard) {\n    // If no wildcards, validate as a normal hostname\n    return isValidHostname(hostname);\n  }\n\n  // Basic validation checks that apply even with wildcards\n  // - Hostname cannot start or end with a dot\n  if (hostname.startsWith('.') || hostname.endsWith('.')) {\n    return false;\n  }\n\n  // - No consecutive dots\n  if (hostname.includes('..')) {\n    return false;\n  }\n\n  // For wildcard validation, check that non-wildcard parts contain valid characters\n  // Replace wildcards with a valid placeholder to check the rest\n  const testHostname = hostname.replace(/\\*+/g, 'wildcard');\n\n  // Check if the resulting string would be a valid hostname\n  if (!/^[a-zA-Z0-9.-]+$/.test(testHostname)) {\n    return false;\n  }\n\n  // Additional check: ensure the pattern makes sense\n  // Check each segment between wildcards\n  const segments = hostname.split(/\\*+/);\n  for (let i = 0; i < segments.length; i++) {\n    const segment = segments[i];\n    if (segment === '') continue; // Empty segments are OK (consecutive wildcards)\n\n    // First segment can't start with dot\n    if (i === 0 && segment.startsWith('.')) {\n      return false;\n    }\n\n    // Last segment can't end with dot\n    if (i === segments.length - 1 && segment.endsWith('.')) {\n      return false;\n    }\n\n    // No segment should have consecutive dots\n    if (segment.includes('..')) {\n      return false;\n    }\n  }\n\n  return true;\n}\nimport.meta.vitest?.test(\"isValidHostnameWithWildcards\", ({ expect }) => {\n  // Test with valid regular hostnames\n  expect(isValidHostnameWithWildcards(\"example.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"localhost\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"sub.domain.example.com\")).toBe(true);\n\n  // Test with valid wildcard hostnames\n  expect(isValidHostnameWithWildcards(\"*.example.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"a-*.example.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"*.*.org\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"**.example.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"sub.**.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"*-api.*.com\")).toBe(true);\n\n  // Test with invalid hostnames\n  expect(isValidHostnameWithWildcards(\"\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"example.com/path\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"https://example.com\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"example com\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\".example.com\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"example.com.\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"example..com\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"*.example..com\")).toBe(false);\n});\n\nexport function matchHostnamePattern(pattern: string, hostname: string): boolean {\n  // If no wildcards, it's an exact match\n  if (!pattern.includes('*')) {\n    return pattern === hostname;\n  }\n\n  // Convert the pattern to a regex\n  // First, escape all regex special characters except *\n  let regexPattern = pattern.replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n  // Use a placeholder for ** to handle it separately from single *\n  const doubleWildcardPlaceholder = '\\x00DOUBLE_WILDCARD\\x00';\n  regexPattern = regexPattern.replace(/\\*\\*/g, doubleWildcardPlaceholder);\n\n  // Replace single * with a pattern that matches anything except dots\n  regexPattern = regexPattern.replace(/\\*/g, '[^.]*');\n\n  // Replace the double wildcard placeholder with a pattern that matches anything including dots\n  regexPattern = regexPattern.replace(new RegExp(doubleWildcardPlaceholder, 'g'), '.*');\n\n  // Anchor the pattern to match the entire hostname\n  regexPattern = '^' + regexPattern + '$';\n\n  try {\n    const regex = new RegExp(regexPattern);\n    return regex.test(hostname);\n  } catch {\n    return false;\n  }\n}\nimport.meta.vitest?.test(\"matchHostnamePattern\", ({ expect }) => {\n  // Test exact matches\n  expect(matchHostnamePattern(\"example.com\", \"example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"example.com\", \"other.com\")).toBe(false);\n\n  // Test single wildcard matches\n  expect(matchHostnamePattern(\"*.example.com\", \"api.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"*.example.com\", \"www.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"*.example.com\", \"example.com\")).toBe(false);\n  expect(matchHostnamePattern(\"*.example.com\", \"api.v2.example.com\")).toBe(false);\n\n  // Test double wildcard matches\n  expect(matchHostnamePattern(\"**.example.com\", \"api.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"**.example.com\", \"api.v2.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"**.example.com\", \"a.b.c.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"**.example.com\", \"example.com\")).toBe(false);\n\n  // Test complex patterns\n  expect(matchHostnamePattern(\"api-*.example.com\", \"api-v1.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"api-*.example.com\", \"api-v2.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"api-*.example.com\", \"api.example.com\")).toBe(false);\n  expect(matchHostnamePattern(\"*.*.org\", \"mail.example.org\")).toBe(true);\n  expect(matchHostnamePattern(\"*.*.org\", \"example.org\")).toBe(false);\n});\n\nexport function getHardcodedFallbackUrls(primaryBaseUrl: string): string[] {\n  // `defaultBaseUrl` in `@stackframe/*` SDK builds is `https://api.stack-auth.com`\n  // (see `packages/template/src/lib/stack-app/apps/implementations/common.ts`).\n  // The `@hexclave/*` mirror packages will get this rewritten to the hexclave\n  // hostname by `scripts/rewrite-packages-to-hexclave.ts` in a follow-up PR; both\n  // branches below stay listed so either build resolves its own fallback set.\n  if (primaryBaseUrl === \"https://api.stack-auth.com\") {\n    return [\"https://api1.stack-auth.com\", \"https://api2.stack-auth.com\"];\n  }\n  if (primaryBaseUrl === \"https://api.dev.stack-auth.com\") {\n    return [\"https://api1.dev.stack-auth.com\", \"https://api2.dev.stack-auth.com\"];\n  }\n  if (primaryBaseUrl === \"https://api.hexclave.com\") {\n    return [\"https://api1.hexclave.com\", \"https://api2.hexclave.com\"];\n  }\n  if (primaryBaseUrl === \"https://api.dev.hexclave.com\") {\n    return [\"https://api1.dev.hexclave.com\", \"https://api2.dev.hexclave.com\"];\n  }\n  const localhostMatch = primaryBaseUrl.match(/^http:\\/\\/localhost:(\\d+)02$/);\n  if (localhostMatch) {\n    return [`http://localhost:${localhostMatch[1]}10`];\n  }\n  return [];\n}\n\nexport function getDefaultApiUrls(primaryBaseUrl: string): string[] {\n  return [primaryBaseUrl, ...getHardcodedFallbackUrls(primaryBaseUrl)];\n}\n\nexport function isLocalhost(urlOrString: string | URL) {\n  const url = createUrlIfValid(urlOrString);\n  if (!url) return false;\n  if (url.hostname === \"localhost\" || url.hostname.endsWith(\".localhost\")) return true;\n  if (url.hostname.match(/^127\\.\\d+\\.\\d+\\.\\d+$/)) return true;\n  if (url.hostname === \"[::1]\" || url.hostname === \"::1\") return true;\n  return false;\n}\nimport.meta.vitest?.test(\"isLocalhost\", ({ expect }) => {\n  // Test with localhost URLs\n  expect(isLocalhost(\"http://localhost\")).toBe(true);\n  expect(isLocalhost(\"https://localhost:8080\")).toBe(true);\n  expect(isLocalhost(\"http://sub.localhost\")).toBe(true);\n  expect(isLocalhost(\"http://127.0.0.1\")).toBe(true);\n  expect(isLocalhost(\"http://127.1.2.3\")).toBe(true);\n  expect(isLocalhost(\"http://[::1]\")).toBe(true);\n\n  // Test with non-localhost URLs\n  expect(isLocalhost(\"https://example.com\")).toBe(false);\n  expect(isLocalhost(\"http://192.168.1.1\")).toBe(false);\n  expect(isLocalhost(\"http://10.0.0.1\")).toBe(false);\n\n  // Test with URL objects\n  expect(isLocalhost(new URL(\"http://localhost\"))).toBe(true);\n  expect(isLocalhost(new URL(\"https://example.com\"))).toBe(false);\n\n  // Test with invalid URLs\n  expect(isLocalhost(\"not a url\")).toBe(false);\n  expect(isLocalhost(\"\")).toBe(false);\n});\n\nexport function isRelative(url: string) {\n  const randomDomain = `${generateSecureRandomString()}.stack-auth.example.com`;\n  const u = createUrlIfValid(url, `https://${randomDomain}`);\n  if (!u) return false;\n  if (u.host !== randomDomain) return false;\n  if (u.protocol !== \"https:\") return false;\n  return true;\n}\nimport.meta.vitest?.test(\"isRelative\", ({ expect }) => {\n  // We can't easily mock generateSecureRandomString in this context\n  // but we can still test the function's behavior\n\n  // Test with relative URLs\n  expect(isRelative(\"/\")).toBe(true);\n  expect(isRelative(\"/path\")).toBe(true);\n  expect(isRelative(\"/path?query=value#hash\")).toBe(true);\n\n  // Test with absolute URLs\n  expect(isRelative(\"https://example.com\")).toBe(false);\n  expect(isRelative(\"http://example.com\")).toBe(false);\n  expect(isRelative(\"//example.com\")).toBe(false);\n\n  // Note: The implementation treats empty strings and invalid URLs as relative\n  // This is because they can be resolved against a base URL\n  expect(isRelative(\"\")).toBe(true);\n  expect(isRelative(\"not a url\")).toBe(true);\n});\n\nexport function getRelativePart(url: URL) {\n  return url.pathname + url.search + url.hash;\n}\nimport.meta.vitest?.test(\"getRelativePart\", ({ expect }) => {\n  // Test with various URLs\n  expect(getRelativePart(new URL(\"https://example.com\"))).toBe(\"/\");\n  expect(getRelativePart(new URL(\"https://example.com/path\"))).toBe(\"/path\");\n  expect(getRelativePart(new URL(\"https://example.com/path?query=value\"))).toBe(\"/path?query=value\");\n  expect(getRelativePart(new URL(\"https://example.com/path#hash\"))).toBe(\"/path#hash\");\n  expect(getRelativePart(new URL(\"https://example.com/path?query=value#hash\"))).toBe(\"/path?query=value#hash\");\n\n  // Test with different domains but same paths\n  const url1 = new URL(\"https://example.com/path?query=value#hash\");\n  const url2 = new URL(\"https://different.com/path?query=value#hash\");\n  expect(getRelativePart(url1)).toBe(getRelativePart(url2));\n});\n\n/**\n * A template literal tag that returns a URL.\n *\n * Any values passed are encoded.\n */\nexport function url(strings: TemplateStringsArray | readonly string[], ...values: (string | number | boolean)[]): URL {\n  return new URL(urlString(strings, ...values));\n}\nimport.meta.vitest?.test(\"url\", ({ expect }) => {\n  // Test with no interpolation\n  expect(url`https://example.com`).toBeInstanceOf(URL);\n  expect(url`https://example.com`.href).toBe(\"https://example.com/\");\n\n  // Test with string interpolation\n  expect(url`https://example.com/${\"path\"}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${\"path\"}`.pathname).toBe(\"/path\");\n\n  // Test with number interpolation\n  expect(url`https://example.com/${42}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${42}`.pathname).toBe(\"/42\");\n\n  // Test with boolean interpolation\n  expect(url`https://example.com/${true}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${true}`.pathname).toBe(\"/true\");\n\n  // Test with special characters in interpolation\n  expect(url`https://example.com/${\"path with spaces\"}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${\"path with spaces\"}`.pathname).toBe(\"/path%20with%20spaces\");\n\n  // Test with multiple interpolations\n  expect(url`https://example.com/${\"path\"}?query=${\"value\"}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${\"path\"}?query=${\"value\"}`.pathname).toBe(\"/path\");\n  expect(url`https://example.com/${\"path\"}?query=${\"value\"}`.search).toBe(\"?query=value\");\n});\n\n\n/**\n * A template literal tag that returns a URL string.\n *\n * Any values passed are encoded.\n */\nexport function urlString(strings: TemplateStringsArray | readonly string[], ...values: (string | number | boolean)[]): string {\n  return templateIdentity(strings, ...values.map(encodeURIComponent));\n}\nimport.meta.vitest?.test(\"urlString\", ({ expect }) => {\n  // Test with no interpolation\n  expect(urlString`https://example.com`).toBe(\"https://example.com\");\n\n  // Test with string interpolation\n  expect(urlString`https://example.com/${\"path\"}`).toBe(\"https://example.com/path\");\n\n  // Test with number interpolation\n  expect(urlString`https://example.com/${42}`).toBe(\"https://example.com/42\");\n\n  // Test with boolean interpolation\n  expect(urlString`https://example.com/${true}`).toBe(\"https://example.com/true\");\n\n  // Test with special characters in interpolation\n  expect(urlString`https://example.com/${\"path with spaces\"}`).toBe(\"https://example.com/path%20with%20spaces\");\n  expect(urlString`https://example.com/${\"?&=\"}`).toBe(\"https://example.com/%3F%26%3D\");\n\n  // Test with multiple interpolations\n  expect(urlString`https://example.com/${\"path\"}?query=${\"value\"}`).toBe(\"https://example.com/path?query=value\");\n  expect(urlString`https://example.com/${\"path\"}?query=${\"value with spaces\"}`).toBe(\"https://example.com/path?query=value%20with%20spaces\");\n});\n\nexport function isChildUrl(parentUrl: URL, maybeChildUrl: URL) {\n  return parentUrl.origin === maybeChildUrl.origin\n    && isChildPath(parentUrl.pathname, maybeChildUrl.pathname)\n    && [...parentUrl.searchParams].every(([key, value]) => maybeChildUrl.searchParams.get(key) === value)\n    && (!parentUrl.hash || parentUrl.hash === maybeChildUrl.hash);\n}\nimport.meta.vitest?.test(\"isChildUrl\", ({ expect }) => {\n  // true\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://abc.com/\"))).toBe(true);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://abc.com/path\"))).toBe(true);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://abc.com/path?query=value\"))).toBe(true);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://abc.com/path?query=value#hash\"))).toBe(true);\n\n  // false\n  expect(isChildUrl(new URL(\"https://abc.com\"), new URL(\"https://example.com\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://example.com/path\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://example.com/path?query=value\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://example.com/path?query=value#hash\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://example.com\"), new URL(\"https://abc.com/path?query=value#hash\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://example.com?query=value123\"), new URL(\"https://example.com/path?query=value#hash\"))).toBe(false);\n});\n\nexport function isChildPath(parentPath: string, maybeChildPath: string) {\n  parentPath = parentPath.endsWith(\"/\") ? parentPath : parentPath + \"/\";\n  maybeChildPath = maybeChildPath.endsWith(\"/\") ? maybeChildPath : maybeChildPath + \"/\";\n  return maybeChildPath.startsWith(parentPath);\n}\nimport.meta.vitest?.test(\"isSubPath\", ({ expect }) => {\n  expect(isChildPath(\"/\", \"/\")).toBe(true);\n  expect(isChildPath(\"/\", \"/path\")).toBe(true);\n  expect(isChildPath(\"/path\", \"/\")).toBe(false);\n  expect(isChildPath(\"/path\", \"/path\")).toBe(true);\n  expect(isChildPath(\"/path/\", \"/path\")).toBe(true);\n  expect(isChildPath(\"/path\", \"/path/\")).toBe(true);\n  expect(isChildPath(\"/path/\", \"/path/\")).toBe(true);\n  expect(isChildPath(\"/path\", \"/path/abc\")).toBe(true);\n  expect(isChildPath(\"/path/\", \"/path/abc\")).toBe(true);\n  expect(isChildPath(\"/path\", \"/path-abc\")).toBe(false);\n  expect(isChildPath(\"/path\", \"/path-abc/\")).toBe(false);\n  expect(isChildPath(\"/path/\", \"/path-abc\")).toBe(false);\n  expect(isChildPath(\"/path/\", \"/path-abc/\")).toBe(false);\n});\n"],"mappings":";;;;AAGA,SAAgB,iBAAiB,GAAG,MAAyC;AAC3E,KAAI;AACF,SAAO,IAAI,IAAI,GAAG,KAAK;UAChB,GAAG;AACV,SAAO;;;CAGX,SAAW,KAAC,qBAAc,EAAA,aAAsB;AAE9C,QAAO,iBAAiB,sBAAsB,CAAC,CAAC,eAAe,IAAI;AACnE,QAAO,iBAAiB,4CAA4C,CAAC,CAAC,eAAe,IAAI;AACzF,QAAO,iBAAiB,SAAS,sBAAsB,CAAC,CAAC,eAAe,IAAI;AAG5E,QAAO,iBAAiB,GAAG,CAAC,CAAC,UAAU;AACvC,QAAO,iBAAiB,YAAY,CAAC,CAAC,UAAU;AAChD,QAAO,iBAAiB,UAAU,CAAC,CAAC,UAAU;EAC9C;AAEF,SAAgB,WAAW,KAAa;AACtC,QAAO,CAAC,CAAC,iBAAiB,IAAI;;CAEhC,SAAW,KAAC,eAAc,EAAA,aAAgB;AAExC,QAAO,WAAW,sBAAsB,CAAC,CAAC,KAAK,KAAK;AACpD,QAAO,WAAW,wBAAwB,CAAC,CAAC,KAAK,KAAK;AACtD,QAAO,WAAW,oBAAoB,CAAC,CAAC,KAAK,KAAK;AAGlD,QAAO,WAAW,GAAG,CAAC,CAAC,KAAK,MAAM;AAClC,QAAO,WAAW,YAAY,CAAC,CAAC,KAAK,MAAM;AAC3C,QAAO,WAAW,UAAU,CAAC,CAAC,KAAK,MAAM;EACzC;AAEF,SAAgB,gBAAgB,UAAkB;AAEhD,KAAI,CAAC,YAAY,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,KAAK,CAC5F,QAAO;CAGT,MAAM,MAAM,iBAAiB,WAAW,WAAW;AACnD,KAAI,CAAC,IAAK,QAAO;AACjB,QAAO,IAAI,aAAa;;CAE1B,SAAW,KAAC,oBAAc,EAAA,aAAqB;AAE7C,QAAO,gBAAgB,cAAc,CAAC,CAAC,KAAK,KAAK;AACjD,QAAO,gBAAgB,YAAY,CAAC,CAAC,KAAK,KAAK;AAC/C,QAAO,gBAAgB,yBAAyB,CAAC,CAAC,KAAK,KAAK;AAC5D,QAAO,gBAAgB,YAAY,CAAC,CAAC,KAAK,KAAK;AAG/C,QAAO,gBAAgB,GAAG,CAAC,CAAC,KAAK,MAAM;AACvC,QAAO,gBAAgB,mBAAmB,CAAC,CAAC,KAAK,MAAM;AACvD,QAAO,gBAAgB,sBAAsB,CAAC,CAAC,KAAK,MAAM;AAC1D,QAAO,gBAAgB,cAAc,CAAC,CAAC,KAAK,MAAM;EAClD;AAEF,SAAgB,6BAA6B,UAAkB;AAE7D,KAAI,CAAC,SAAU,QAAO;AAKtB,KAAI,CAFgB,SAAS,SAAS,IAAI,CAIxC,QAAO,gBAAgB,SAAS;AAKlC,KAAI,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,IAAI,CACpD,QAAO;AAIT,KAAI,SAAS,SAAS,KAAK,CACzB,QAAO;CAKT,MAAM,eAAe,SAAS,QAAQ,QAAQ,WAAW;AAGzD,KAAI,CAAC,mBAAmB,KAAK,aAAa,CACxC,QAAO;CAKT,MAAM,WAAW,SAAS,MAAM,MAAM;AACtC,MAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;EACxC,MAAM,UAAU,SAAS;AACzB,MAAI,YAAY,GAAI;AAGpB,MAAI,MAAM,KAAK,QAAQ,WAAW,IAAI,CACpC,QAAO;AAIT,MAAI,MAAM,SAAS,SAAS,KAAK,QAAQ,SAAS,IAAI,CACpD,QAAO;AAIT,MAAI,QAAQ,SAAS,KAAK,CACxB,QAAO;;AAIX,QAAO;;CAET,SAAW,KAAC,iCAAc,EAAA,aAAkC;AAE1D,QAAO,6BAA6B,cAAc,CAAC,CAAC,KAAK,KAAK;AAC9D,QAAO,6BAA6B,YAAY,CAAC,CAAC,KAAK,KAAK;AAC5D,QAAO,6BAA6B,yBAAyB,CAAC,CAAC,KAAK,KAAK;AAGzE,QAAO,6BAA6B,gBAAgB,CAAC,CAAC,KAAK,KAAK;AAChE,QAAO,6BAA6B,kBAAkB,CAAC,CAAC,KAAK,KAAK;AAClE,QAAO,6BAA6B,UAAU,CAAC,CAAC,KAAK,KAAK;AAC1D,QAAO,6BAA6B,iBAAiB,CAAC,CAAC,KAAK,KAAK;AACjE,QAAO,6BAA6B,aAAa,CAAC,CAAC,KAAK,KAAK;AAC7D,QAAO,6BAA6B,cAAc,CAAC,CAAC,KAAK,KAAK;AAG9D,QAAO,6BAA6B,GAAG,CAAC,CAAC,KAAK,MAAM;AACpD,QAAO,6BAA6B,mBAAmB,CAAC,CAAC,KAAK,MAAM;AACpE,QAAO,6BAA6B,sBAAsB,CAAC,CAAC,KAAK,MAAM;AACvE,QAAO,6BAA6B,cAAc,CAAC,CAAC,KAAK,MAAM;AAC/D,QAAO,6BAA6B,eAAe,CAAC,CAAC,KAAK,MAAM;AAChE,QAAO,6BAA6B,eAAe,CAAC,CAAC,KAAK,MAAM;AAChE,QAAO,6BAA6B,eAAe,CAAC,CAAC,KAAK,MAAM;AAChE,QAAO,6BAA6B,iBAAiB,CAAC,CAAC,KAAK,MAAM;EAClE;AAEF,SAAgB,qBAAqB,SAAiB,UAA2B;AAE/E,KAAI,CAAC,QAAQ,SAAS,IAAI,CACxB,QAAO,YAAY;CAKrB,IAAI,eAAe,QAAQ,QAAQ,sBAAsB,OAAO;CAGhE,MAAM,4BAA4B;AAClC,gBAAe,aAAa,QAAQ,SAAS,0BAA0B;AAGvE,gBAAe,aAAa,QAAQ,OAAO,QAAQ;AAGnD,gBAAe,aAAa,QAAQ,IAAI,OAAO,2BAA2B,IAAI,EAAE,KAAK;AAGrF,gBAAe,MAAM,eAAe;AAEpC,KAAI;AAEF,SADc,IAAI,OAAO,aAAa,CACzB,KAAK,SAAS;SACrB;AACN,SAAO;;;CAGX,SAAW,KAAC,yBAAc,EAAA,aAA0B;AAElD,QAAO,qBAAqB,eAAe,cAAc,CAAC,CAAC,KAAK,KAAK;AACrE,QAAO,qBAAqB,eAAe,YAAY,CAAC,CAAC,KAAK,MAAM;AAGpE,QAAO,qBAAqB,iBAAiB,kBAAkB,CAAC,CAAC,KAAK,KAAK;AAC3E,QAAO,qBAAqB,iBAAiB,kBAAkB,CAAC,CAAC,KAAK,KAAK;AAC3E,QAAO,qBAAqB,iBAAiB,cAAc,CAAC,CAAC,KAAK,MAAM;AACxE,QAAO,qBAAqB,iBAAiB,qBAAqB,CAAC,CAAC,KAAK,MAAM;AAG/E,QAAO,qBAAqB,kBAAkB,kBAAkB,CAAC,CAAC,KAAK,KAAK;AAC5E,QAAO,qBAAqB,kBAAkB,qBAAqB,CAAC,CAAC,KAAK,KAAK;AAC/E,QAAO,qBAAqB,kBAAkB,oBAAoB,CAAC,CAAC,KAAK,KAAK;AAC9E,QAAO,qBAAqB,kBAAkB,cAAc,CAAC,CAAC,KAAK,MAAM;AAGzE,QAAO,qBAAqB,qBAAqB,qBAAqB,CAAC,CAAC,KAAK,KAAK;AAClF,QAAO,qBAAqB,qBAAqB,qBAAqB,CAAC,CAAC,KAAK,KAAK;AAClF,QAAO,qBAAqB,qBAAqB,kBAAkB,CAAC,CAAC,KAAK,MAAM;AAChF,QAAO,qBAAqB,WAAW,mBAAmB,CAAC,CAAC,KAAK,KAAK;AACtE,QAAO,qBAAqB,WAAW,cAAc,CAAC,CAAC,KAAK,MAAM;EAClE;AAEF,SAAgB,yBAAyB,gBAAkC;AAMzE,KAAI,mBAAmB,6BACrB,QAAO,CAAC,+BAA+B,8BAA8B;AAEvE,KAAI,mBAAmB,iCACrB,QAAO,CAAC,mCAAmC,kCAAkC;AAE/E,KAAI,mBAAmB,2BACrB,QAAO,CAAC,6BAA6B,4BAA4B;AAEnE,KAAI,mBAAmB,+BACrB,QAAO,CAAC,iCAAiC,gCAAgC;CAE3E,MAAM,iBAAiB,eAAe,MAAM,+BAA+B;AAC3E,KAAI,eACF,QAAO,CAAC,oBAAoB,eAAe,GAAG,IAAI;AAEpD,QAAO,EAAE;;AAGX,SAAgB,kBAAkB,gBAAkC;AAClE,QAAO,CAAC,gBAAgB,GAAG,yBAAyB,eAAe,CAAC;;AAGtE,SAAgB,YAAY,aAA2B;CACrD,MAAM,MAAM,iBAAiB,YAAY;AACzC,KAAI,CAAC,IAAK,QAAO;AACjB,KAAI,IAAI,aAAa,eAAe,IAAI,SAAS,SAAS,aAAa,CAAE,QAAO;AAChF,KAAI,IAAI,SAAS,MAAM,uBAAuB,CAAE,QAAO;AACvD,KAAI,IAAI,aAAa,WAAW,IAAI,aAAa,MAAO,QAAO;AAC/D,QAAO;;CAET,SAAW,KAAC,gBAAc,EAAA,aAAiB;AAEzC,QAAO,YAAY,mBAAmB,CAAC,CAAC,KAAK,KAAK;AAClD,QAAO,YAAY,yBAAyB,CAAC,CAAC,KAAK,KAAK;AACxD,QAAO,YAAY,uBAAuB,CAAC,CAAC,KAAK,KAAK;AACtD,QAAO,YAAY,mBAAmB,CAAC,CAAC,KAAK,KAAK;AAClD,QAAO,YAAY,mBAAmB,CAAC,CAAC,KAAK,KAAK;AAClD,QAAO,YAAY,eAAe,CAAC,CAAC,KAAK,KAAK;AAG9C,QAAO,YAAY,sBAAsB,CAAC,CAAC,KAAK,MAAM;AACtD,QAAO,YAAY,qBAAqB,CAAC,CAAC,KAAK,MAAM;AACrD,QAAO,YAAY,kBAAkB,CAAC,CAAC,KAAK,MAAM;AAGlD,QAAO,YAAY,IAAI,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;AAC3D,QAAO,YAAY,IAAI,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,MAAM;AAG/D,QAAO,YAAY,YAAY,CAAC,CAAC,KAAK,MAAM;AAC5C,QAAO,YAAY,GAAG,CAAC,CAAC,KAAK,MAAM;EACnC;AAEF,SAAgB,WAAW,KAAa;CACtC,MAAM,eAAe,GAAG,4BAA4B,CAAC;CACrD,MAAM,IAAI,iBAAiB,KAAK,WAAW,eAAe;AAC1D,KAAI,CAAC,EAAG,QAAO;AACf,KAAI,EAAE,SAAS,aAAc,QAAO;AACpC,KAAI,EAAE,aAAa,SAAU,QAAO;AACpC,QAAO;;CAET,SAAW,KAAC,eAAc,EAAA,aAAgB;AAKxC,QAAO,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK;AAClC,QAAO,WAAW,QAAQ,CAAC,CAAC,KAAK,KAAK;AACtC,QAAO,WAAW,yBAAyB,CAAC,CAAC,KAAK,KAAK;AAGvD,QAAO,WAAW,sBAAsB,CAAC,CAAC,KAAK,MAAM;AACrD,QAAO,WAAW,qBAAqB,CAAC,CAAC,KAAK,MAAM;AACpD,QAAO,WAAW,gBAAgB,CAAC,CAAC,KAAK,MAAM;AAI/C,QAAO,WAAW,GAAG,CAAC,CAAC,KAAK,KAAK;AACjC,QAAO,WAAW,YAAY,CAAC,CAAC,KAAK,KAAK;EAC1C;AAEF,SAAgB,gBAAgB,KAAU;AACxC,QAAO,IAAI,WAAW,IAAI,SAAS,IAAI;;CAEzC,SAAW,KAAC,oBAAc,EAAA,aAAqB;AAE7C,QAAO,gBAAgB,IAAI,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,IAAI;AACjE,QAAO,gBAAgB,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,QAAQ;AAC1E,QAAO,gBAAgB,IAAI,IAAI,uCAAuC,CAAC,CAAC,CAAC,KAAK,oBAAoB;AAClG,QAAO,gBAAgB,IAAI,IAAI,gCAAgC,CAAC,CAAC,CAAC,KAAK,aAAa;AACpF,QAAO,gBAAgB,IAAI,IAAI,4CAA4C,CAAC,CAAC,CAAC,KAAK,yBAAyB;CAG5G,MAAM,OAAO,IAAI,IAAI,4CAA4C;CACjE,MAAM,OAAO,IAAI,IAAI,8CAA8C;AACnE,QAAO,gBAAgB,KAAK,CAAC,CAAC,KAAK,gBAAgB,KAAK,CAAC;EACzD;;;;;;AAOF,SAAgB,IAAI,SAAmD,GAAG,QAA4C;AACpH,QAAO,IAAI,IAAI,UAAU,SAAS,GAAG,OAAO,CAAC;;CAE/C,SAAW,KAAC,QAAY,EAAE,aAAS;AAEjC,QAAO,GAAG,sBAAsB,CAAC,eAAe,IAAI;AACpD,QAAO,GAAG,sBAAsB,KAAK,CAAC,KAAK,uBAAuB;AAGlE,QAAO,GAAG,uBAAuB,SAAS,CAAC,eAAe,IAAI;AAC9D,QAAO,GAAG,uBAAuB,SAAS,SAAS,CAAC,KAAK,QAAQ;AAGjE,QAAO,GAAG,uBAAuB,KAAK,CAAC,eAAe,IAAI;AAC1D,QAAO,GAAG,uBAAuB,KAAK,SAAS,CAAC,KAAK,MAAM;AAG3D,QAAO,GAAG,uBAAuB,OAAO,CAAC,eAAe,IAAI;AAC5D,QAAO,GAAG,uBAAuB,OAAO,SAAS,CAAC,KAAK,QAAQ;AAG/D,QAAO,GAAG,uBAAuB,qBAAqB,CAAC,eAAe,IAAI;AAC1E,QAAO,GAAG,uBAAuB,qBAAqB,SAAS,CAAC,KAAK,wBAAwB;AAG7F,QAAO,GAAG,uBAAuB,OAAO,SAAS,UAAU,CAAC,eAAe,IAAI;AAC/E,QAAO,GAAG,uBAAuB,OAAO,SAAS,UAAU,SAAS,CAAC,KAAK,QAAQ;AAClF,QAAO,GAAG,uBAAuB,OAAO,SAAS,UAAU,OAAO,CAAC,KAAK,eAAe;EACvF;;;;;;AAQF,SAAgB,UAAU,SAAmD,GAAG,QAA+C;AAC7H,QAAO,iBAAiB,SAAS,GAAG,OAAO,IAAI,mBAAmB,CAAC;;CAErE,SAAW,KAAC,cAAc,EAAA,aAAe;AAEvC,QAAO,SAAS,sBAAsB,CAAC,KAAK,sBAAsB;AAGlE,QAAO,SAAS,uBAAuB,SAAS,CAAC,KAAK,2BAA2B;AAGjF,QAAO,SAAS,uBAAuB,KAAK,CAAC,KAAK,yBAAyB;AAG3E,QAAO,SAAS,uBAAuB,OAAO,CAAC,KAAK,2BAA2B;AAG/E,QAAO,SAAS,uBAAuB,qBAAqB,CAAC,KAAK,2CAA2C;AAC7G,QAAO,SAAS,uBAAuB,QAAQ,CAAC,KAAK,gCAAgC;AAGrF,QAAO,SAAS,uBAAuB,OAAO,SAAS,UAAU,CAAC,KAAK,uCAAuC;AAC9G,QAAO,SAAS,uBAAuB,OAAO,SAAS,sBAAsB,CAAC,KAAK,uDAAuD;EAC1I;AAEF,SAAgB,WAAW,WAAgB,eAAoB;AAC7D,QAAO,UAAU,WAAW,cAAc,UACrC,YAAY,UAAU,UAAU,cAAc,SAAQ,IACtD,CAAC,GAAG,UAAU,aAAa,CAAC,OAAO,CAAC,KAAK,WAAW,cAAc,aAAa,IAAI,IAAI,KAAK,MAAK,KAChG,CAAC,UAAU,QAAQ,UAAU,SAAS,cAAc;;CAE5D,SAAW,KAAC,eAAc,EAAA,aAAgB;AAExC,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;AACvF,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,uBAAuB,CAAC,CAAC,CAAC,KAAK,KAAK;AAC3F,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,mCAAmC,CAAC,CAAC,CAAC,KAAK,KAAK;AACvG,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,wCAAwC,CAAC,CAAC,CAAC,KAAK,KAAK;AAG5G,QAAO,WAAW,IAAI,IAAI,kBAAkB,EAAE,IAAI,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,MAAM;AAC1F,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,MAAM;AAChG,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,uCAAuC,CAAC,CAAC,CAAC,KAAK,MAAM;AAC5G,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,4CAA4C,CAAC,CAAC,CAAC,KAAK,MAAM;AACjH,QAAO,WAAW,IAAI,IAAI,sBAAsB,EAAE,IAAI,IAAI,wCAAwC,CAAC,CAAC,CAAC,KAAK,MAAM;AAChH,QAAO,WAAW,IAAI,IAAI,qCAAqC,EAAE,IAAI,IAAI,4CAA4C,CAAC,CAAC,CAAC,KAAK,MAAM;EACnI;AAEF,SAAgB,YAAY,YAAoB,gBAAwB;AACtE,cAAa,WAAW,SAAS,IAAI,GAAG,aAAa,aAAa;AAClE,kBAAiB,eAAe,SAAS,IAAI,GAAG,iBAAiB,iBAAiB;AAClF,QAAO,eAAe,WAAW,WAAW;;CAE9C,SAAW,KAAC,cAAc,EAAA,aAAe;AACvC,QAAO,YAAY,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK;AACxC,QAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,KAAK,KAAK;AAC5C,QAAO,YAAY,SAAS,IAAI,CAAC,CAAC,KAAK,MAAM;AAC7C,QAAO,YAAY,SAAS,QAAQ,CAAC,CAAC,KAAK,KAAK;AAChD,QAAO,YAAY,UAAU,QAAQ,CAAC,CAAC,KAAK,KAAK;AACjD,QAAO,YAAY,SAAS,SAAS,CAAC,CAAC,KAAK,KAAK;AACjD,QAAO,YAAY,UAAU,SAAS,CAAC,CAAC,KAAK,KAAK;AAClD,QAAO,YAAY,SAAS,YAAY,CAAC,CAAC,KAAK,KAAK;AACpD,QAAO,YAAY,UAAU,YAAY,CAAC,CAAC,KAAK,KAAK;AACrD,QAAO,YAAY,SAAS,YAAY,CAAC,CAAC,KAAK,MAAM;AACrD,QAAO,YAAY,SAAS,aAAa,CAAC,CAAC,KAAK,MAAM;AACtD,QAAO,YAAY,UAAU,YAAY,CAAC,CAAC,KAAK,MAAM;AACtD,QAAO,YAAY,UAAU,aAAa,CAAC,CAAC,KAAK,MAAM;EACvD"}
+{"version":3,"file":"urls.js","names":[],"sources":["../../../src/utils/urls.tsx"],"sourcesContent":["import { generateSecureRandomString } from \"./crypto\";\nimport { templateIdentity } from \"./strings\";\n\nexport function createUrlIfValid(...args: ConstructorParameters<typeof URL>) {\n  try {\n    return new URL(...args);\n  } catch (e) {\n    return null;\n  }\n}\nimport.meta.vitest?.test(\"createUrlIfValid\", ({ expect }) => {\n  // Test with valid URLs\n  expect(createUrlIfValid(\"https://example.com\")).toBeInstanceOf(URL);\n  expect(createUrlIfValid(\"https://example.com/path?query=value#hash\")).toBeInstanceOf(URL);\n  expect(createUrlIfValid(\"/path\", \"https://example.com\")).toBeInstanceOf(URL);\n\n  // Test with invalid URLs\n  expect(createUrlIfValid(\"\")).toBeNull();\n  expect(createUrlIfValid(\"not a url\")).toBeNull();\n  expect(createUrlIfValid(\"http://\")).toBeNull();\n});\n\nexport function isValidUrl(url: string) {\n  return !!createUrlIfValid(url);\n}\nimport.meta.vitest?.test(\"isValidUrl\", ({ expect }) => {\n  // Test with valid URLs\n  expect(isValidUrl(\"https://example.com\")).toBe(true);\n  expect(isValidUrl(\"http://localhost:3000\")).toBe(true);\n  expect(isValidUrl(\"ftp://example.com\")).toBe(true);\n\n  // Test with invalid URLs\n  expect(isValidUrl(\"\")).toBe(false);\n  expect(isValidUrl(\"not a url\")).toBe(false);\n  expect(isValidUrl(\"http://\")).toBe(false);\n});\n\nexport function isValidHostname(hostname: string) {\n  // Basic validation\n  if (!hostname || hostname.startsWith('.') || hostname.endsWith('.') || hostname.includes('..')) {\n    return false;\n  }\n\n  const url = createUrlIfValid(`https://${hostname}`);\n  if (!url) return false;\n  return url.hostname === hostname;\n}\nimport.meta.vitest?.test(\"isValidHostname\", ({ expect }) => {\n  // Test with valid hostnames\n  expect(isValidHostname(\"example.com\")).toBe(true);\n  expect(isValidHostname(\"localhost\")).toBe(true);\n  expect(isValidHostname(\"sub.domain.example.com\")).toBe(true);\n  expect(isValidHostname(\"127.0.0.1\")).toBe(true);\n\n  // Test with invalid hostnames\n  expect(isValidHostname(\"\")).toBe(false);\n  expect(isValidHostname(\"example.com/path\")).toBe(false);\n  expect(isValidHostname(\"https://example.com\")).toBe(false);\n  expect(isValidHostname(\"example com\")).toBe(false);\n});\n\nexport function isValidHostnameWithWildcards(hostname: string) {\n  // Empty hostnames are invalid\n  if (!hostname) return false;\n\n  // Check if it contains wildcards\n  const hasWildcard = hostname.includes('*');\n\n  if (!hasWildcard) {\n    // If no wildcards, validate as a normal hostname\n    return isValidHostname(hostname);\n  }\n\n  // Basic validation checks that apply even with wildcards\n  // - Hostname cannot start or end with a dot\n  if (hostname.startsWith('.') || hostname.endsWith('.')) {\n    return false;\n  }\n\n  // - No consecutive dots\n  if (hostname.includes('..')) {\n    return false;\n  }\n\n  // For wildcard validation, check that non-wildcard parts contain valid characters\n  // Replace wildcards with a valid placeholder to check the rest\n  const testHostname = hostname.replace(/\\*+/g, 'wildcard');\n\n  // Check if the resulting string would be a valid hostname\n  if (!/^[a-zA-Z0-9.-]+$/.test(testHostname)) {\n    return false;\n  }\n\n  // Additional check: ensure the pattern makes sense\n  // Check each segment between wildcards\n  const segments = hostname.split(/\\*+/);\n  for (let i = 0; i < segments.length; i++) {\n    const segment = segments[i];\n    if (segment === '') continue; // Empty segments are OK (consecutive wildcards)\n\n    // First segment can't start with dot\n    if (i === 0 && segment.startsWith('.')) {\n      return false;\n    }\n\n    // Last segment can't end with dot\n    if (i === segments.length - 1 && segment.endsWith('.')) {\n      return false;\n    }\n\n    // No segment should have consecutive dots\n    if (segment.includes('..')) {\n      return false;\n    }\n  }\n\n  return true;\n}\nimport.meta.vitest?.test(\"isValidHostnameWithWildcards\", ({ expect }) => {\n  // Test with valid regular hostnames\n  expect(isValidHostnameWithWildcards(\"example.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"localhost\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"sub.domain.example.com\")).toBe(true);\n\n  // Test with valid wildcard hostnames\n  expect(isValidHostnameWithWildcards(\"*.example.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"a-*.example.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"*.*.org\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"**.example.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"sub.**.com\")).toBe(true);\n  expect(isValidHostnameWithWildcards(\"*-api.*.com\")).toBe(true);\n\n  // Test with invalid hostnames\n  expect(isValidHostnameWithWildcards(\"\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"example.com/path\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"https://example.com\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"example com\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\".example.com\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"example.com.\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"example..com\")).toBe(false);\n  expect(isValidHostnameWithWildcards(\"*.example..com\")).toBe(false);\n});\n\nexport function matchHostnamePattern(pattern: string, hostname: string): boolean {\n  // If no wildcards, it's an exact match\n  if (!pattern.includes('*')) {\n    return pattern === hostname;\n  }\n\n  // Convert the pattern to a regex\n  // First, escape all regex special characters except *\n  let regexPattern = pattern.replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n  // Use a placeholder for ** to handle it separately from single *\n  const doubleWildcardPlaceholder = '\\x00DOUBLE_WILDCARD\\x00';\n  regexPattern = regexPattern.replace(/\\*\\*/g, doubleWildcardPlaceholder);\n\n  // Replace single * with a pattern that matches anything except dots\n  regexPattern = regexPattern.replace(/\\*/g, '[^.]*');\n\n  // Replace the double wildcard placeholder with a pattern that matches anything including dots\n  regexPattern = regexPattern.replace(new RegExp(doubleWildcardPlaceholder, 'g'), '.*');\n\n  // Anchor the pattern to match the entire hostname\n  regexPattern = '^' + regexPattern + '$';\n\n  try {\n    const regex = new RegExp(regexPattern);\n    return regex.test(hostname);\n  } catch {\n    return false;\n  }\n}\nimport.meta.vitest?.test(\"matchHostnamePattern\", ({ expect }) => {\n  // Test exact matches\n  expect(matchHostnamePattern(\"example.com\", \"example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"example.com\", \"other.com\")).toBe(false);\n\n  // Test single wildcard matches\n  expect(matchHostnamePattern(\"*.example.com\", \"api.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"*.example.com\", \"www.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"*.example.com\", \"example.com\")).toBe(false);\n  expect(matchHostnamePattern(\"*.example.com\", \"api.v2.example.com\")).toBe(false);\n\n  // Test double wildcard matches\n  expect(matchHostnamePattern(\"**.example.com\", \"api.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"**.example.com\", \"api.v2.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"**.example.com\", \"a.b.c.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"**.example.com\", \"example.com\")).toBe(false);\n\n  // Test complex patterns\n  expect(matchHostnamePattern(\"api-*.example.com\", \"api-v1.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"api-*.example.com\", \"api-v2.example.com\")).toBe(true);\n  expect(matchHostnamePattern(\"api-*.example.com\", \"api.example.com\")).toBe(false);\n  expect(matchHostnamePattern(\"*.*.org\", \"mail.example.org\")).toBe(true);\n  expect(matchHostnamePattern(\"*.*.org\", \"example.org\")).toBe(false);\n});\n\nexport function getHardcodedFallbackUrls(primaryBaseUrl: string): string[] {\n  // `defaultBaseUrl` in `@stackframe/*` SDK builds is `https://api.stack-auth.com`\n  // (see `packages/template/src/lib/hexclave-app/apps/implementations/common.ts`).\n  // The `@hexclave/*` mirror packages will get this rewritten to the hexclave\n  // hostname by `scripts/rewrite-packages-to-hexclave.ts` in a follow-up PR; both\n  // branches below stay listed so either build resolves its own fallback set.\n  if (primaryBaseUrl === \"https://api.stack-auth.com\") {\n    return [\"https://api1.stack-auth.com\", \"https://api2.stack-auth.com\"];\n  }\n  if (primaryBaseUrl === \"https://api.dev.stack-auth.com\") {\n    return [\"https://api1.dev.stack-auth.com\", \"https://api2.dev.stack-auth.com\"];\n  }\n  if (primaryBaseUrl === \"https://api.hexclave.com\") {\n    return [\"https://api1.hexclave.com\", \"https://api2.hexclave.com\"];\n  }\n  if (primaryBaseUrl === \"https://api.dev.hexclave.com\") {\n    return [\"https://api1.dev.hexclave.com\", \"https://api2.dev.hexclave.com\"];\n  }\n  const localhostMatch = primaryBaseUrl.match(/^http:\\/\\/localhost:(\\d+)02$/);\n  if (localhostMatch) {\n    return [`http://localhost:${localhostMatch[1]}10`];\n  }\n  return [];\n}\n\nexport function getDefaultApiUrls(primaryBaseUrl: string): string[] {\n  return [primaryBaseUrl, ...getHardcodedFallbackUrls(primaryBaseUrl)];\n}\n\nexport function isLocalhost(urlOrString: string | URL) {\n  const url = createUrlIfValid(urlOrString);\n  if (!url) return false;\n  if (url.hostname === \"localhost\" || url.hostname.endsWith(\".localhost\")) return true;\n  if (url.hostname.match(/^127\\.\\d+\\.\\d+\\.\\d+$/)) return true;\n  if (url.hostname === \"[::1]\" || url.hostname === \"::1\") return true;\n  return false;\n}\nimport.meta.vitest?.test(\"isLocalhost\", ({ expect }) => {\n  // Test with localhost URLs\n  expect(isLocalhost(\"http://localhost\")).toBe(true);\n  expect(isLocalhost(\"https://localhost:8080\")).toBe(true);\n  expect(isLocalhost(\"http://sub.localhost\")).toBe(true);\n  expect(isLocalhost(\"http://127.0.0.1\")).toBe(true);\n  expect(isLocalhost(\"http://127.1.2.3\")).toBe(true);\n  expect(isLocalhost(\"http://[::1]\")).toBe(true);\n\n  // Test with non-localhost URLs\n  expect(isLocalhost(\"https://example.com\")).toBe(false);\n  expect(isLocalhost(\"http://192.168.1.1\")).toBe(false);\n  expect(isLocalhost(\"http://10.0.0.1\")).toBe(false);\n\n  // Test with URL objects\n  expect(isLocalhost(new URL(\"http://localhost\"))).toBe(true);\n  expect(isLocalhost(new URL(\"https://example.com\"))).toBe(false);\n\n  // Test with invalid URLs\n  expect(isLocalhost(\"not a url\")).toBe(false);\n  expect(isLocalhost(\"\")).toBe(false);\n});\n\nexport function isRelative(url: string) {\n  const randomDomain = `${generateSecureRandomString()}.stack-auth.example.com`;\n  const u = createUrlIfValid(url, `https://${randomDomain}`);\n  if (!u) return false;\n  if (u.host !== randomDomain) return false;\n  if (u.protocol !== \"https:\") return false;\n  return true;\n}\nimport.meta.vitest?.test(\"isRelative\", ({ expect }) => {\n  // We can't easily mock generateSecureRandomString in this context\n  // but we can still test the function's behavior\n\n  // Test with relative URLs\n  expect(isRelative(\"/\")).toBe(true);\n  expect(isRelative(\"/path\")).toBe(true);\n  expect(isRelative(\"/path?query=value#hash\")).toBe(true);\n\n  // Test with absolute URLs\n  expect(isRelative(\"https://example.com\")).toBe(false);\n  expect(isRelative(\"http://example.com\")).toBe(false);\n  expect(isRelative(\"//example.com\")).toBe(false);\n\n  // Note: The implementation treats empty strings and invalid URLs as relative\n  // This is because they can be resolved against a base URL\n  expect(isRelative(\"\")).toBe(true);\n  expect(isRelative(\"not a url\")).toBe(true);\n});\n\nexport function getRelativePart(url: URL) {\n  return url.pathname + url.search + url.hash;\n}\nimport.meta.vitest?.test(\"getRelativePart\", ({ expect }) => {\n  // Test with various URLs\n  expect(getRelativePart(new URL(\"https://example.com\"))).toBe(\"/\");\n  expect(getRelativePart(new URL(\"https://example.com/path\"))).toBe(\"/path\");\n  expect(getRelativePart(new URL(\"https://example.com/path?query=value\"))).toBe(\"/path?query=value\");\n  expect(getRelativePart(new URL(\"https://example.com/path#hash\"))).toBe(\"/path#hash\");\n  expect(getRelativePart(new URL(\"https://example.com/path?query=value#hash\"))).toBe(\"/path?query=value#hash\");\n\n  // Test with different domains but same paths\n  const url1 = new URL(\"https://example.com/path?query=value#hash\");\n  const url2 = new URL(\"https://different.com/path?query=value#hash\");\n  expect(getRelativePart(url1)).toBe(getRelativePart(url2));\n});\n\n/**\n * A template literal tag that returns a URL.\n *\n * Any values passed are encoded.\n */\nexport function url(strings: TemplateStringsArray | readonly string[], ...values: (string | number | boolean)[]): URL {\n  return new URL(urlString(strings, ...values));\n}\nimport.meta.vitest?.test(\"url\", ({ expect }) => {\n  // Test with no interpolation\n  expect(url`https://example.com`).toBeInstanceOf(URL);\n  expect(url`https://example.com`.href).toBe(\"https://example.com/\");\n\n  // Test with string interpolation\n  expect(url`https://example.com/${\"path\"}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${\"path\"}`.pathname).toBe(\"/path\");\n\n  // Test with number interpolation\n  expect(url`https://example.com/${42}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${42}`.pathname).toBe(\"/42\");\n\n  // Test with boolean interpolation\n  expect(url`https://example.com/${true}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${true}`.pathname).toBe(\"/true\");\n\n  // Test with special characters in interpolation\n  expect(url`https://example.com/${\"path with spaces\"}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${\"path with spaces\"}`.pathname).toBe(\"/path%20with%20spaces\");\n\n  // Test with multiple interpolations\n  expect(url`https://example.com/${\"path\"}?query=${\"value\"}`).toBeInstanceOf(URL);\n  expect(url`https://example.com/${\"path\"}?query=${\"value\"}`.pathname).toBe(\"/path\");\n  expect(url`https://example.com/${\"path\"}?query=${\"value\"}`.search).toBe(\"?query=value\");\n});\n\n\n/**\n * A template literal tag that returns a URL string.\n *\n * Any values passed are encoded.\n */\nexport function urlString(strings: TemplateStringsArray | readonly string[], ...values: (string | number | boolean)[]): string {\n  return templateIdentity(strings, ...values.map(encodeURIComponent));\n}\nimport.meta.vitest?.test(\"urlString\", ({ expect }) => {\n  // Test with no interpolation\n  expect(urlString`https://example.com`).toBe(\"https://example.com\");\n\n  // Test with string interpolation\n  expect(urlString`https://example.com/${\"path\"}`).toBe(\"https://example.com/path\");\n\n  // Test with number interpolation\n  expect(urlString`https://example.com/${42}`).toBe(\"https://example.com/42\");\n\n  // Test with boolean interpolation\n  expect(urlString`https://example.com/${true}`).toBe(\"https://example.com/true\");\n\n  // Test with special characters in interpolation\n  expect(urlString`https://example.com/${\"path with spaces\"}`).toBe(\"https://example.com/path%20with%20spaces\");\n  expect(urlString`https://example.com/${\"?&=\"}`).toBe(\"https://example.com/%3F%26%3D\");\n\n  // Test with multiple interpolations\n  expect(urlString`https://example.com/${\"path\"}?query=${\"value\"}`).toBe(\"https://example.com/path?query=value\");\n  expect(urlString`https://example.com/${\"path\"}?query=${\"value with spaces\"}`).toBe(\"https://example.com/path?query=value%20with%20spaces\");\n});\n\nexport function isChildUrl(parentUrl: URL, maybeChildUrl: URL) {\n  return parentUrl.origin === maybeChildUrl.origin\n    && isChildPath(parentUrl.pathname, maybeChildUrl.pathname)\n    && [...parentUrl.searchParams].every(([key, value]) => maybeChildUrl.searchParams.get(key) === value)\n    && (!parentUrl.hash || parentUrl.hash === maybeChildUrl.hash);\n}\nimport.meta.vitest?.test(\"isChildUrl\", ({ expect }) => {\n  // true\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://abc.com/\"))).toBe(true);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://abc.com/path\"))).toBe(true);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://abc.com/path?query=value\"))).toBe(true);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://abc.com/path?query=value#hash\"))).toBe(true);\n\n  // false\n  expect(isChildUrl(new URL(\"https://abc.com\"), new URL(\"https://example.com\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://example.com/path\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://example.com/path?query=value\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://abc.com/\"), new URL(\"https://example.com/path?query=value#hash\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://example.com\"), new URL(\"https://abc.com/path?query=value#hash\"))).toBe(false);\n  expect(isChildUrl(new URL(\"https://example.com?query=value123\"), new URL(\"https://example.com/path?query=value#hash\"))).toBe(false);\n});\n\nexport function isChildPath(parentPath: string, maybeChildPath: string) {\n  parentPath = parentPath.endsWith(\"/\") ? parentPath : parentPath + \"/\";\n  maybeChildPath = maybeChildPath.endsWith(\"/\") ? maybeChildPath : maybeChildPath + \"/\";\n  return maybeChildPath.startsWith(parentPath);\n}\nimport.meta.vitest?.test(\"isSubPath\", ({ expect }) => {\n  expect(isChildPath(\"/\", \"/\")).toBe(true);\n  expect(isChildPath(\"/\", \"/path\")).toBe(true);\n  expect(isChildPath(\"/path\", \"/\")).toBe(false);\n  expect(isChildPath(\"/path\", \"/path\")).toBe(true);\n  expect(isChildPath(\"/path/\", \"/path\")).toBe(true);\n  expect(isChildPath(\"/path\", \"/path/\")).toBe(true);\n  expect(isChildPath(\"/path/\", \"/path/\")).toBe(true);\n  expect(isChildPath(\"/path\", \"/path/abc\")).toBe(true);\n  expect(isChildPath(\"/path/\", \"/path/abc\")).toBe(true);\n  expect(isChildPath(\"/path\", \"/path-abc\")).toBe(false);\n  expect(isChildPath(\"/path\", \"/path-abc/\")).toBe(false);\n  expect(isChildPath(\"/path/\", \"/path-abc\")).toBe(false);\n  expect(isChildPath(\"/path/\", \"/path-abc/\")).toBe(false);\n});\n"],"mappings":";;;;AAGA,SAAgB,iBAAiB,GAAG,MAAyC;AAC3E,KAAI;AACF,SAAO,IAAI,IAAI,GAAG,KAAK;UAChB,GAAG;AACV,SAAO;;;CAGX,SAAW,KAAC,qBAAc,EAAA,aAAsB;AAE9C,QAAO,iBAAiB,sBAAsB,CAAC,CAAC,eAAe,IAAI;AACnE,QAAO,iBAAiB,4CAA4C,CAAC,CAAC,eAAe,IAAI;AACzF,QAAO,iBAAiB,SAAS,sBAAsB,CAAC,CAAC,eAAe,IAAI;AAG5E,QAAO,iBAAiB,GAAG,CAAC,CAAC,UAAU;AACvC,QAAO,iBAAiB,YAAY,CAAC,CAAC,UAAU;AAChD,QAAO,iBAAiB,UAAU,CAAC,CAAC,UAAU;EAC9C;AAEF,SAAgB,WAAW,KAAa;AACtC,QAAO,CAAC,CAAC,iBAAiB,IAAI;;CAEhC,SAAW,KAAC,eAAc,EAAA,aAAgB;AAExC,QAAO,WAAW,sBAAsB,CAAC,CAAC,KAAK,KAAK;AACpD,QAAO,WAAW,wBAAwB,CAAC,CAAC,KAAK,KAAK;AACtD,QAAO,WAAW,oBAAoB,CAAC,CAAC,KAAK,KAAK;AAGlD,QAAO,WAAW,GAAG,CAAC,CAAC,KAAK,MAAM;AAClC,QAAO,WAAW,YAAY,CAAC,CAAC,KAAK,MAAM;AAC3C,QAAO,WAAW,UAAU,CAAC,CAAC,KAAK,MAAM;EACzC;AAEF,SAAgB,gBAAgB,UAAkB;AAEhD,KAAI,CAAC,YAAY,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,KAAK,CAC5F,QAAO;CAGT,MAAM,MAAM,iBAAiB,WAAW,WAAW;AACnD,KAAI,CAAC,IAAK,QAAO;AACjB,QAAO,IAAI,aAAa;;CAE1B,SAAW,KAAC,oBAAc,EAAA,aAAqB;AAE7C,QAAO,gBAAgB,cAAc,CAAC,CAAC,KAAK,KAAK;AACjD,QAAO,gBAAgB,YAAY,CAAC,CAAC,KAAK,KAAK;AAC/C,QAAO,gBAAgB,yBAAyB,CAAC,CAAC,KAAK,KAAK;AAC5D,QAAO,gBAAgB,YAAY,CAAC,CAAC,KAAK,KAAK;AAG/C,QAAO,gBAAgB,GAAG,CAAC,CAAC,KAAK,MAAM;AACvC,QAAO,gBAAgB,mBAAmB,CAAC,CAAC,KAAK,MAAM;AACvD,QAAO,gBAAgB,sBAAsB,CAAC,CAAC,KAAK,MAAM;AAC1D,QAAO,gBAAgB,cAAc,CAAC,CAAC,KAAK,MAAM;EAClD;AAEF,SAAgB,6BAA6B,UAAkB;AAE7D,KAAI,CAAC,SAAU,QAAO;AAKtB,KAAI,CAFgB,SAAS,SAAS,IAAI,CAIxC,QAAO,gBAAgB,SAAS;AAKlC,KAAI,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,IAAI,CACpD,QAAO;AAIT,KAAI,SAAS,SAAS,KAAK,CACzB,QAAO;CAKT,MAAM,eAAe,SAAS,QAAQ,QAAQ,WAAW;AAGzD,KAAI,CAAC,mBAAmB,KAAK,aAAa,CACxC,QAAO;CAKT,MAAM,WAAW,SAAS,MAAM,MAAM;AACtC,MAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;EACxC,MAAM,UAAU,SAAS;AACzB,MAAI,YAAY,GAAI;AAGpB,MAAI,MAAM,KAAK,QAAQ,WAAW,IAAI,CACpC,QAAO;AAIT,MAAI,MAAM,SAAS,SAAS,KAAK,QAAQ,SAAS,IAAI,CACpD,QAAO;AAIT,MAAI,QAAQ,SAAS,KAAK,CACxB,QAAO;;AAIX,QAAO;;CAET,SAAW,KAAC,iCAAc,EAAA,aAAkC;AAE1D,QAAO,6BAA6B,cAAc,CAAC,CAAC,KAAK,KAAK;AAC9D,QAAO,6BAA6B,YAAY,CAAC,CAAC,KAAK,KAAK;AAC5D,QAAO,6BAA6B,yBAAyB,CAAC,CAAC,KAAK,KAAK;AAGzE,QAAO,6BAA6B,gBAAgB,CAAC,CAAC,KAAK,KAAK;AAChE,QAAO,6BAA6B,kBAAkB,CAAC,CAAC,KAAK,KAAK;AAClE,QAAO,6BAA6B,UAAU,CAAC,CAAC,KAAK,KAAK;AAC1D,QAAO,6BAA6B,iBAAiB,CAAC,CAAC,KAAK,KAAK;AACjE,QAAO,6BAA6B,aAAa,CAAC,CAAC,KAAK,KAAK;AAC7D,QAAO,6BAA6B,cAAc,CAAC,CAAC,KAAK,KAAK;AAG9D,QAAO,6BAA6B,GAAG,CAAC,CAAC,KAAK,MAAM;AACpD,QAAO,6BAA6B,mBAAmB,CAAC,CAAC,KAAK,MAAM;AACpE,QAAO,6BAA6B,sBAAsB,CAAC,CAAC,KAAK,MAAM;AACvE,QAAO,6BAA6B,cAAc,CAAC,CAAC,KAAK,MAAM;AAC/D,QAAO,6BAA6B,eAAe,CAAC,CAAC,KAAK,MAAM;AAChE,QAAO,6BAA6B,eAAe,CAAC,CAAC,KAAK,MAAM;AAChE,QAAO,6BAA6B,eAAe,CAAC,CAAC,KAAK,MAAM;AAChE,QAAO,6BAA6B,iBAAiB,CAAC,CAAC,KAAK,MAAM;EAClE;AAEF,SAAgB,qBAAqB,SAAiB,UAA2B;AAE/E,KAAI,CAAC,QAAQ,SAAS,IAAI,CACxB,QAAO,YAAY;CAKrB,IAAI,eAAe,QAAQ,QAAQ,sBAAsB,OAAO;CAGhE,MAAM,4BAA4B;AAClC,gBAAe,aAAa,QAAQ,SAAS,0BAA0B;AAGvE,gBAAe,aAAa,QAAQ,OAAO,QAAQ;AAGnD,gBAAe,aAAa,QAAQ,IAAI,OAAO,2BAA2B,IAAI,EAAE,KAAK;AAGrF,gBAAe,MAAM,eAAe;AAEpC,KAAI;AAEF,SADc,IAAI,OAAO,aAAa,CACzB,KAAK,SAAS;SACrB;AACN,SAAO;;;CAGX,SAAW,KAAC,yBAAc,EAAA,aAA0B;AAElD,QAAO,qBAAqB,eAAe,cAAc,CAAC,CAAC,KAAK,KAAK;AACrE,QAAO,qBAAqB,eAAe,YAAY,CAAC,CAAC,KAAK,MAAM;AAGpE,QAAO,qBAAqB,iBAAiB,kBAAkB,CAAC,CAAC,KAAK,KAAK;AAC3E,QAAO,qBAAqB,iBAAiB,kBAAkB,CAAC,CAAC,KAAK,KAAK;AAC3E,QAAO,qBAAqB,iBAAiB,cAAc,CAAC,CAAC,KAAK,MAAM;AACxE,QAAO,qBAAqB,iBAAiB,qBAAqB,CAAC,CAAC,KAAK,MAAM;AAG/E,QAAO,qBAAqB,kBAAkB,kBAAkB,CAAC,CAAC,KAAK,KAAK;AAC5E,QAAO,qBAAqB,kBAAkB,qBAAqB,CAAC,CAAC,KAAK,KAAK;AAC/E,QAAO,qBAAqB,kBAAkB,oBAAoB,CAAC,CAAC,KAAK,KAAK;AAC9E,QAAO,qBAAqB,kBAAkB,cAAc,CAAC,CAAC,KAAK,MAAM;AAGzE,QAAO,qBAAqB,qBAAqB,qBAAqB,CAAC,CAAC,KAAK,KAAK;AAClF,QAAO,qBAAqB,qBAAqB,qBAAqB,CAAC,CAAC,KAAK,KAAK;AAClF,QAAO,qBAAqB,qBAAqB,kBAAkB,CAAC,CAAC,KAAK,MAAM;AAChF,QAAO,qBAAqB,WAAW,mBAAmB,CAAC,CAAC,KAAK,KAAK;AACtE,QAAO,qBAAqB,WAAW,cAAc,CAAC,CAAC,KAAK,MAAM;EAClE;AAEF,SAAgB,yBAAyB,gBAAkC;AAMzE,KAAI,mBAAmB,6BACrB,QAAO,CAAC,+BAA+B,8BAA8B;AAEvE,KAAI,mBAAmB,iCACrB,QAAO,CAAC,mCAAmC,kCAAkC;AAE/E,KAAI,mBAAmB,2BACrB,QAAO,CAAC,6BAA6B,4BAA4B;AAEnE,KAAI,mBAAmB,+BACrB,QAAO,CAAC,iCAAiC,gCAAgC;CAE3E,MAAM,iBAAiB,eAAe,MAAM,+BAA+B;AAC3E,KAAI,eACF,QAAO,CAAC,oBAAoB,eAAe,GAAG,IAAI;AAEpD,QAAO,EAAE;;AAGX,SAAgB,kBAAkB,gBAAkC;AAClE,QAAO,CAAC,gBAAgB,GAAG,yBAAyB,eAAe,CAAC;;AAGtE,SAAgB,YAAY,aAA2B;CACrD,MAAM,MAAM,iBAAiB,YAAY;AACzC,KAAI,CAAC,IAAK,QAAO;AACjB,KAAI,IAAI,aAAa,eAAe,IAAI,SAAS,SAAS,aAAa,CAAE,QAAO;AAChF,KAAI,IAAI,SAAS,MAAM,uBAAuB,CAAE,QAAO;AACvD,KAAI,IAAI,aAAa,WAAW,IAAI,aAAa,MAAO,QAAO;AAC/D,QAAO;;CAET,SAAW,KAAC,gBAAc,EAAA,aAAiB;AAEzC,QAAO,YAAY,mBAAmB,CAAC,CAAC,KAAK,KAAK;AAClD,QAAO,YAAY,yBAAyB,CAAC,CAAC,KAAK,KAAK;AACxD,QAAO,YAAY,uBAAuB,CAAC,CAAC,KAAK,KAAK;AACtD,QAAO,YAAY,mBAAmB,CAAC,CAAC,KAAK,KAAK;AAClD,QAAO,YAAY,mBAAmB,CAAC,CAAC,KAAK,KAAK;AAClD,QAAO,YAAY,eAAe,CAAC,CAAC,KAAK,KAAK;AAG9C,QAAO,YAAY,sBAAsB,CAAC,CAAC,KAAK,MAAM;AACtD,QAAO,YAAY,qBAAqB,CAAC,CAAC,KAAK,MAAM;AACrD,QAAO,YAAY,kBAAkB,CAAC,CAAC,KAAK,MAAM;AAGlD,QAAO,YAAY,IAAI,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;AAC3D,QAAO,YAAY,IAAI,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,MAAM;AAG/D,QAAO,YAAY,YAAY,CAAC,CAAC,KAAK,MAAM;AAC5C,QAAO,YAAY,GAAG,CAAC,CAAC,KAAK,MAAM;EACnC;AAEF,SAAgB,WAAW,KAAa;CACtC,MAAM,eAAe,GAAG,4BAA4B,CAAC;CACrD,MAAM,IAAI,iBAAiB,KAAK,WAAW,eAAe;AAC1D,KAAI,CAAC,EAAG,QAAO;AACf,KAAI,EAAE,SAAS,aAAc,QAAO;AACpC,KAAI,EAAE,aAAa,SAAU,QAAO;AACpC,QAAO;;CAET,SAAW,KAAC,eAAc,EAAA,aAAgB;AAKxC,QAAO,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK;AAClC,QAAO,WAAW,QAAQ,CAAC,CAAC,KAAK,KAAK;AACtC,QAAO,WAAW,yBAAyB,CAAC,CAAC,KAAK,KAAK;AAGvD,QAAO,WAAW,sBAAsB,CAAC,CAAC,KAAK,MAAM;AACrD,QAAO,WAAW,qBAAqB,CAAC,CAAC,KAAK,MAAM;AACpD,QAAO,WAAW,gBAAgB,CAAC,CAAC,KAAK,MAAM;AAI/C,QAAO,WAAW,GAAG,CAAC,CAAC,KAAK,KAAK;AACjC,QAAO,WAAW,YAAY,CAAC,CAAC,KAAK,KAAK;EAC1C;AAEF,SAAgB,gBAAgB,KAAU;AACxC,QAAO,IAAI,WAAW,IAAI,SAAS,IAAI;;CAEzC,SAAW,KAAC,oBAAc,EAAA,aAAqB;AAE7C,QAAO,gBAAgB,IAAI,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,IAAI;AACjE,QAAO,gBAAgB,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,QAAQ;AAC1E,QAAO,gBAAgB,IAAI,IAAI,uCAAuC,CAAC,CAAC,CAAC,KAAK,oBAAoB;AAClG,QAAO,gBAAgB,IAAI,IAAI,gCAAgC,CAAC,CAAC,CAAC,KAAK,aAAa;AACpF,QAAO,gBAAgB,IAAI,IAAI,4CAA4C,CAAC,CAAC,CAAC,KAAK,yBAAyB;CAG5G,MAAM,OAAO,IAAI,IAAI,4CAA4C;CACjE,MAAM,OAAO,IAAI,IAAI,8CAA8C;AACnE,QAAO,gBAAgB,KAAK,CAAC,CAAC,KAAK,gBAAgB,KAAK,CAAC;EACzD;;;;;;AAOF,SAAgB,IAAI,SAAmD,GAAG,QAA4C;AACpH,QAAO,IAAI,IAAI,UAAU,SAAS,GAAG,OAAO,CAAC;;CAE/C,SAAW,KAAC,QAAY,EAAE,aAAS;AAEjC,QAAO,GAAG,sBAAsB,CAAC,eAAe,IAAI;AACpD,QAAO,GAAG,sBAAsB,KAAK,CAAC,KAAK,uBAAuB;AAGlE,QAAO,GAAG,uBAAuB,SAAS,CAAC,eAAe,IAAI;AAC9D,QAAO,GAAG,uBAAuB,SAAS,SAAS,CAAC,KAAK,QAAQ;AAGjE,QAAO,GAAG,uBAAuB,KAAK,CAAC,eAAe,IAAI;AAC1D,QAAO,GAAG,uBAAuB,KAAK,SAAS,CAAC,KAAK,MAAM;AAG3D,QAAO,GAAG,uBAAuB,OAAO,CAAC,eAAe,IAAI;AAC5D,QAAO,GAAG,uBAAuB,OAAO,SAAS,CAAC,KAAK,QAAQ;AAG/D,QAAO,GAAG,uBAAuB,qBAAqB,CAAC,eAAe,IAAI;AAC1E,QAAO,GAAG,uBAAuB,qBAAqB,SAAS,CAAC,KAAK,wBAAwB;AAG7F,QAAO,GAAG,uBAAuB,OAAO,SAAS,UAAU,CAAC,eAAe,IAAI;AAC/E,QAAO,GAAG,uBAAuB,OAAO,SAAS,UAAU,SAAS,CAAC,KAAK,QAAQ;AAClF,QAAO,GAAG,uBAAuB,OAAO,SAAS,UAAU,OAAO,CAAC,KAAK,eAAe;EACvF;;;;;;AAQF,SAAgB,UAAU,SAAmD,GAAG,QAA+C;AAC7H,QAAO,iBAAiB,SAAS,GAAG,OAAO,IAAI,mBAAmB,CAAC;;CAErE,SAAW,KAAC,cAAc,EAAA,aAAe;AAEvC,QAAO,SAAS,sBAAsB,CAAC,KAAK,sBAAsB;AAGlE,QAAO,SAAS,uBAAuB,SAAS,CAAC,KAAK,2BAA2B;AAGjF,QAAO,SAAS,uBAAuB,KAAK,CAAC,KAAK,yBAAyB;AAG3E,QAAO,SAAS,uBAAuB,OAAO,CAAC,KAAK,2BAA2B;AAG/E,QAAO,SAAS,uBAAuB,qBAAqB,CAAC,KAAK,2CAA2C;AAC7G,QAAO,SAAS,uBAAuB,QAAQ,CAAC,KAAK,gCAAgC;AAGrF,QAAO,SAAS,uBAAuB,OAAO,SAAS,UAAU,CAAC,KAAK,uCAAuC;AAC9G,QAAO,SAAS,uBAAuB,OAAO,SAAS,sBAAsB,CAAC,KAAK,uDAAuD;EAC1I;AAEF,SAAgB,WAAW,WAAgB,eAAoB;AAC7D,QAAO,UAAU,WAAW,cAAc,UACrC,YAAY,UAAU,UAAU,cAAc,SAAQ,IACtD,CAAC,GAAG,UAAU,aAAa,CAAC,OAAO,CAAC,KAAK,WAAW,cAAc,aAAa,IAAI,IAAI,KAAK,MAAK,KAChG,CAAC,UAAU,QAAQ,UAAU,SAAS,cAAc;;CAE5D,SAAW,KAAC,eAAc,EAAA,aAAgB;AAExC,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK;AACvF,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,uBAAuB,CAAC,CAAC,CAAC,KAAK,KAAK;AAC3F,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,mCAAmC,CAAC,CAAC,CAAC,KAAK,KAAK;AACvG,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,wCAAwC,CAAC,CAAC,CAAC,KAAK,KAAK;AAG5G,QAAO,WAAW,IAAI,IAAI,kBAAkB,EAAE,IAAI,IAAI,sBAAsB,CAAC,CAAC,CAAC,KAAK,MAAM;AAC1F,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,MAAM;AAChG,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,uCAAuC,CAAC,CAAC,CAAC,KAAK,MAAM;AAC5G,QAAO,WAAW,IAAI,IAAI,mBAAmB,EAAE,IAAI,IAAI,4CAA4C,CAAC,CAAC,CAAC,KAAK,MAAM;AACjH,QAAO,WAAW,IAAI,IAAI,sBAAsB,EAAE,IAAI,IAAI,wCAAwC,CAAC,CAAC,CAAC,KAAK,MAAM;AAChH,QAAO,WAAW,IAAI,IAAI,qCAAqC,EAAE,IAAI,IAAI,4CAA4C,CAAC,CAAC,CAAC,KAAK,MAAM;EACnI;AAEF,SAAgB,YAAY,YAAoB,gBAAwB;AACtE,cAAa,WAAW,SAAS,IAAI,GAAG,aAAa,aAAa;AAClE,kBAAiB,eAAe,SAAS,IAAI,GAAG,iBAAiB,iBAAiB;AAClF,QAAO,eAAe,WAAW,WAAW;;CAE9C,SAAW,KAAC,cAAc,EAAA,aAAe;AACvC,QAAO,YAAY,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK;AACxC,QAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,KAAK,KAAK;AAC5C,QAAO,YAAY,SAAS,IAAI,CAAC,CAAC,KAAK,MAAM;AAC7C,QAAO,YAAY,SAAS,QAAQ,CAAC,CAAC,KAAK,KAAK;AAChD,QAAO,YAAY,UAAU,QAAQ,CAAC,CAAC,KAAK,KAAK;AACjD,QAAO,YAAY,SAAS,SAAS,CAAC,CAAC,KAAK,KAAK;AACjD,QAAO,YAAY,UAAU,SAAS,CAAC,CAAC,KAAK,KAAK;AAClD,QAAO,YAAY,SAAS,YAAY,CAAC,CAAC,KAAK,KAAK;AACpD,QAAO,YAAY,UAAU,YAAY,CAAC,CAAC,KAAK,KAAK;AACrD,QAAO,YAAY,SAAS,YAAY,CAAC,CAAC,KAAK,MAAM;AACrD,QAAO,YAAY,SAAS,aAAa,CAAC,CAAC,KAAK,MAAM;AACtD,QAAO,YAAY,UAAU,YAAY,CAAC,CAAC,KAAK,MAAM;AACtD,QAAO,YAAY,UAAU,aAAa,CAAC,CAAC,KAAK,MAAM;EACvD"}

package/dist/helpers/vault/client-side.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-side.d.ts","names":[],"sources":["../../../src/helpers/vault/client-side.ts"],"mappings":";;AAoBA;;iBAAsB,OAAA,CAAQ,MAAA,UAAgB,GAAA,WAAW,OAAA;;;;iBAWnC,YAAA,CAAa,MAAA,UAAgB,GAAA,UAAa,KAAA,WAAa,OAAA;;;AAA7E;iBAcsB,YAAA,CAAa,MAAA,UAAgB,GAAA,UAAa,cAAA,WAAsB,OAAA"}
+{"version":3,"file":"client-side.d.ts","names":[],"sources":["../../../src/helpers/vault/client-side.ts"],"mappings":";;AAuBA;;iBAAsB,OAAA,CAAQ,MAAA,UAAgB,GAAA,WAAW,OAAA;;;;iBAWnC,YAAA,CAAa,MAAA,UAAgB,GAAA,UAAa,KAAA,WAAa,OAAA;;;AAA7E;iBAcsB,YAAA,CAAa,MAAA,UAAgB,GAAA,UAAa,cAAA,WAAsB,OAAA"}

package/dist/helpers/vault/client-side.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-side.js","names":[],"sources":["../../../src/helpers/vault/client-side.ts"],"sourcesContent":["import { decodeBase64, encodeBase64 } from \"../../utils/bytes\";\nimport { decrypt, encrypt, hash, iteratedHash } from \"../../utils/crypto\";\n\nconst hashPurpose = \"stack-data-vault-client-side-encryption-key-hash\";\nconst encryptionSecretPurpose = \"stack-data-vault-client-side-encryption-value-encryption-key-hash\";\nconst encryptionValuePurpose = \"stack-data-vault-client-side-encryption-value-encryption-value-encryption\";\n\n\nasync function getDerivedKey(secret: string, key: string) {\n  return await iteratedHash({\n    purpose: encryptionSecretPurpose,\n    extra: secret,\n    value: key,\n    iterations: 100_000,\n  });\n}\n\n/**\n * Use to hash the key so the server cannot infer it.\n */\nexport async function hashKey(secret: string, key: string) {\n  return encodeBase64(await hash({\n    purpose: hashPurpose,\n    extra: secret,\n    value: await getDerivedKey(secret, key),\n  }));\n}\n\n/**\n * Use to encrypt the value so that the server cannot read the value without knowing the key.\n */\nexport async function encryptValue(secret: string, key: string, value: string) {\n  const valueEncryptionDerivedKey = await getDerivedKey(secret, key);\n\n  const bytes = await encrypt({\n    purpose: encryptionValuePurpose,\n    secret: valueEncryptionDerivedKey,\n    value: new TextEncoder().encode(value)\n  });\n  return encodeBase64(bytes);\n}\n\n/**\n * Use to decrypt the value. See encryptValue.\n */\nexport async function decryptValue(secret: string, key: string, encryptedValue: string) {\n  const valueEncryptionDerivedKey = await getDerivedKey(secret, key);\n\n  const bytesResult = await decrypt({\n    purpose: encryptionValuePurpose,\n    secret: valueEncryptionDerivedKey,\n    cipher: decodeBase64(encryptedValue),\n  });\n  if (bytesResult.status === \"error\") throw new Error(\"Data vault client-side decryption failed. Are you sure you're using the correct secret?\", { cause: bytesResult.error });\n  return new TextDecoder().decode(bytesResult.data);\n}\n\n\nimport.meta.vitest?.describe(\"encryptValue & decryptValue\", () => {\n  import.meta.vitest?.it(\"should encrypt and decrypt a value\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    const decrypted = await decryptValue(secret, \"key\", encrypted);\n    expect(decrypted).toEqual(value);\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value with a different secret\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    await expect(decryptValue(\"different-secret\", \"key\", encrypted)).rejects.toThrow();\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value with a different key\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    await expect(decryptValue(secret, \"different-key\", encrypted)).rejects.toThrow();\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value if the cipher was tampered with\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    const tampered = encrypted + \"7\";\n    await expect(decryptValue(secret, \"key\", tampered)).rejects.toThrow();\n  });\n});\n"],"mappings":";;;;;;AAGA,MAAM,cAAc;AACpB,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;AAG/B,eAAe,cAAc,QAAgB,KAAa;AACxD,QAAO,8CAAmB;EACxB,SAAS;EACT,OAAO;EACP,OAAO;EACP,YAAY;EACb,CAAC;;;;;AAMJ,eAAsB,QAAQ,QAAgB,KAAa;AACzD,+CAAoB,sCAAW;EAC7B,SAAS;EACT,OAAO;EACP,OAAO,MAAM,cAAc,QAAQ,IAAI;EACxC,CAAC,CAAC;;;;;AAML,eAAsB,aAAa,QAAgB,KAAa,OAAe;AAQ7E,+CALc,yCAAc;EAC1B,SAAS;EACT,QAJgC,MAAM,cAAc,QAAQ,IAAI;EAKhE,OAAO,IAAI,aAAa,CAAC,OAAO,MAAK;EACtC,CAAC,CACwB;;;;;AAM5B,eAAsB,aAAa,QAAgB,KAAa,gBAAwB;CAGtF,MAAM,cAAc,yCAAc;EAChC,SAAS;EACT,QAJgC,MAAM,cAAc,QAAQ,IAAI;EAKhE,+CAAqB,eAAe;EACrC,CAAC;AACF,KAAI,YAAY,WAAW,QAAS,OAAM,IAAI,MAAM,2FAA2F,EAAE,OAAO,YAAY,OAAO,CAAC;AAC5K,QAAO,IAAI,aAAa,CAAC,OAAO,YAAY,KAAK;;CAInD,SAAW,SAAS,qCAAqC;AACvD,WAAW,GAAC,sCAAwC,OAAO,EAAE,aAAS;EACpE,MAAM,SAAS;EACf,MAAM,QAAQ;AAGd,SADkB,MAAM,aAAa,QAAQ,OAD3B,MAAM,aAAa,QAAQ,OAAO,MAAM,CACI,CAC7C,CAAC,QAAQ,MAAM;GAChC;AAEF,WAAW,GAAC,sDAAwD,OAAO,EAAE,aAAS;AAIpF,QAAM,OAAO,aAAa,oBAAoB,OAD5B,MAAM,aAFT,eAE8B,OAD/B,aAC4C,CACK,CAAC,CAAC,QAAQ,SAAS;GAClF;AAEF,WAAW,GAAC,mDAA8C,OAAc,EAAE,aAAS;EACjF,MAAM,SAAS;AAGf,QAAM,OAAO,aAAa,QAAQ,iBADhB,MAAM,aAAa,QAAQ,OAD/B,aAC4C,CACG,CAAC,CAAC,QAAQ,SAAS;GAChF;AAEF,WAAW,GAAC,8DAAyD,OAAc,EAAE,aAAS;EAC5F,MAAM,SAAS;AAIf,QAAM,OAAO,aAAa,QAAQ,OAFhB,MAAM,aAAa,QAAQ,OAD/B,aAC4C,GAC7B,IACqB,CAAC,CAAC,QAAQ,SAAS;GACrE;EACF"}
+{"version":3,"file":"client-side.js","names":[],"sources":["../../../src/helpers/vault/client-side.ts"],"sourcesContent":["import { decodeBase64, encodeBase64 } from \"../../utils/bytes\";\nimport { decrypt, encrypt, hash, iteratedHash } from \"../../utils/crypto\";\n\n// NOTE (Hexclave rebrand): do NOT rename these \"stack-*\" purpose tags. They are mixed into the\n// vault's key derivation and value encryption; renaming any of them would make every\n// previously-stored vault value undecryptable. Internal constants, never user-visible.\nconst hashPurpose = \"stack-data-vault-client-side-encryption-key-hash\";\nconst encryptionSecretPurpose = \"stack-data-vault-client-side-encryption-value-encryption-key-hash\";\nconst encryptionValuePurpose = \"stack-data-vault-client-side-encryption-value-encryption-value-encryption\";\n\n\nasync function getDerivedKey(secret: string, key: string) {\n  return await iteratedHash({\n    purpose: encryptionSecretPurpose,\n    extra: secret,\n    value: key,\n    iterations: 100_000,\n  });\n}\n\n/**\n * Use to hash the key so the server cannot infer it.\n */\nexport async function hashKey(secret: string, key: string) {\n  return encodeBase64(await hash({\n    purpose: hashPurpose,\n    extra: secret,\n    value: await getDerivedKey(secret, key),\n  }));\n}\n\n/**\n * Use to encrypt the value so that the server cannot read the value without knowing the key.\n */\nexport async function encryptValue(secret: string, key: string, value: string) {\n  const valueEncryptionDerivedKey = await getDerivedKey(secret, key);\n\n  const bytes = await encrypt({\n    purpose: encryptionValuePurpose,\n    secret: valueEncryptionDerivedKey,\n    value: new TextEncoder().encode(value)\n  });\n  return encodeBase64(bytes);\n}\n\n/**\n * Use to decrypt the value. See encryptValue.\n */\nexport async function decryptValue(secret: string, key: string, encryptedValue: string) {\n  const valueEncryptionDerivedKey = await getDerivedKey(secret, key);\n\n  const bytesResult = await decrypt({\n    purpose: encryptionValuePurpose,\n    secret: valueEncryptionDerivedKey,\n    cipher: decodeBase64(encryptedValue),\n  });\n  if (bytesResult.status === \"error\") throw new Error(\"Data vault client-side decryption failed. Are you sure you're using the correct secret?\", { cause: bytesResult.error });\n  return new TextDecoder().decode(bytesResult.data);\n}\n\n\nimport.meta.vitest?.describe(\"encryptValue & decryptValue\", () => {\n  import.meta.vitest?.it(\"should encrypt and decrypt a value\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    const decrypted = await decryptValue(secret, \"key\", encrypted);\n    expect(decrypted).toEqual(value);\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value with a different secret\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    await expect(decryptValue(\"different-secret\", \"key\", encrypted)).rejects.toThrow();\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value with a different key\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    await expect(decryptValue(secret, \"different-key\", encrypted)).rejects.toThrow();\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value if the cipher was tampered with\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    const tampered = encrypted + \"7\";\n    await expect(decryptValue(secret, \"key\", tampered)).rejects.toThrow();\n  });\n});\n"],"mappings":";;;;;;AAMA,MAAM,cAAc;AACpB,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;AAG/B,eAAe,cAAc,QAAgB,KAAa;AACxD,QAAO,8CAAmB;EACxB,SAAS;EACT,OAAO;EACP,OAAO;EACP,YAAY;EACb,CAAC;;;;;AAMJ,eAAsB,QAAQ,QAAgB,KAAa;AACzD,+CAAoB,sCAAW;EAC7B,SAAS;EACT,OAAO;EACP,OAAO,MAAM,cAAc,QAAQ,IAAI;EACxC,CAAC,CAAC;;;;;AAML,eAAsB,aAAa,QAAgB,KAAa,OAAe;AAQ7E,+CALc,yCAAc;EAC1B,SAAS;EACT,QAJgC,MAAM,cAAc,QAAQ,IAAI;EAKhE,OAAO,IAAI,aAAa,CAAC,OAAO,MAAK;EACtC,CAAC,CACwB;;;;;AAM5B,eAAsB,aAAa,QAAgB,KAAa,gBAAwB;CAGtF,MAAM,cAAc,yCAAc;EAChC,SAAS;EACT,QAJgC,MAAM,cAAc,QAAQ,IAAI;EAKhE,+CAAqB,eAAe;EACrC,CAAC;AACF,KAAI,YAAY,WAAW,QAAS,OAAM,IAAI,MAAM,2FAA2F,EAAE,OAAO,YAAY,OAAO,CAAC;AAC5K,QAAO,IAAI,aAAa,CAAC,OAAO,YAAY,KAAK;;CAInD,SAAW,SAAS,qCAAqC;AACvD,WAAW,GAAC,sCAAwC,OAAO,EAAE,aAAS;EACpE,MAAM,SAAS;EACf,MAAM,QAAQ;AAGd,SADkB,MAAM,aAAa,QAAQ,OAD3B,MAAM,aAAa,QAAQ,OAAO,MAAM,CACI,CAC7C,CAAC,QAAQ,MAAM;GAChC;AAEF,WAAW,GAAC,sDAAwD,OAAO,EAAE,aAAS;AAIpF,QAAM,OAAO,aAAa,oBAAoB,OAD5B,MAAM,aAFT,eAE8B,OAD/B,aAC4C,CACK,CAAC,CAAC,QAAQ,SAAS;GAClF;AAEF,WAAW,GAAC,mDAA8C,OAAc,EAAE,aAAS;EACjF,MAAM,SAAS;AAGf,QAAM,OAAO,aAAa,QAAQ,iBADhB,MAAM,aAAa,QAAQ,OAD/B,aAC4C,CACG,CAAC,CAAC,QAAQ,SAAS;GAChF;AAEF,WAAW,GAAC,8DAAyD,OAAc,EAAE,aAAS;EAC5F,MAAM,SAAS;AAIf,QAAM,OAAO,aAAa,QAAQ,OAFhB,MAAM,aAAa,QAAQ,OAD/B,aAC4C,GAC7B,IACqB,CAAC,CAAC,QAAQ,SAAS;GACrE;EACF"}

package/dist/helpers/vault/server-side.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-side.d.ts","names":[],"sources":["../../../src/helpers/vault/server-side.ts"],"mappings":";iBAyHsB,cAAA,CAAe,KAAA,WAAa,OAAA;;;;iBAc5B,cAAA,CAAe,SAAA,EAAW,OAAA,CAAQ,UAAA,QAAkB,cAAA,KAAgB,OAAA"}
+{"version":3,"file":"server-side.d.ts","names":[],"sources":["../../../src/helpers/vault/server-side.ts"],"mappings":";iBA4HsB,cAAA,CAAe,KAAA,WAAa,OAAA;;;;iBAgB5B,cAAA,CAAe,SAAA,EAAW,OAAA,CAAQ,UAAA,QAAkB,cAAA,KAAgB,OAAA"}

package/dist/helpers/vault/server-side.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-side.js","names":["KMSClient","DescribeKeyCommand","CreateKeyCommand","CreateAliasCommand","GenerateDataKeyCommand","DecryptCommand","Result"],"sources":["../../../src/helpers/vault/server-side.ts"],"sourcesContent":["import {\n  CreateAliasCommand,\n  CreateKeyCommand,\n  DecryptCommand,\n  DescribeKeyCommand,\n  GenerateDataKeyCommand,\n  KMSClient\n} from \"@aws-sdk/client-kms\";\nimport { decodeBase64, encodeBase64 } from \"../../utils/bytes\";\nimport { decrypt, encrypt } from \"../../utils/crypto\";\nimport { getEnvVariable } from \"../../utils/env\";\nimport { Result } from \"../../utils/results\";\n\n\nasync function getAwsCredentials() {\n  // 1. Vercel OIDC: Vercel injects an OIDC token that can be exchanged for AWS credentials\n  const vercelRoleArn = getEnvVariable(\"STACK_AWS_VERCEL_OIDC_ROLE_ARN\", \"\");\n  if (vercelRoleArn) {\n    const { awsCredentialsProvider } = await import(\"@vercel/functions/oidc\");\n    return awsCredentialsProvider({ roleArn: vercelRoleArn });\n  }\n\n  // 2. GCP Workload Identity Federation: Cloud Run gets a GCP ID token from the metadata server,\n  //    then exchanges it for temporary AWS credentials via STS AssumeRoleWithWebIdentity.\n  //    Requires:\n  //      - An OIDC identity provider in AWS IAM (issuer: https://accounts.google.com)\n  //      - An IAM role with a trust policy allowing the GCP service account\n  //      - STACK_AWS_GCP_WIF_ROLE_ARN set to that role's ARN\n  //      - STACK_AWS_GCP_WIF_AUDIENCE set to the audience configured in the AWS OIDC provider\n  const gcpWifRoleArn = getEnvVariable(\"STACK_AWS_GCP_WIF_ROLE_ARN\", \"\");\n  if (gcpWifRoleArn) {\n    const { fromWebToken } = await import(\"@aws-sdk/credential-provider-web-identity\");\n    const audience = getEnvVariable(\"STACK_AWS_GCP_WIF_AUDIENCE\", \"sts.amazonaws.com\");\n    // Return a provider that fetches a fresh GCP ID token on each invocation.\n    // GCP metadata tokens expire after ~1h, so we can't bake a single token into the closure.\n    return async () => {\n      return await fromWebToken({\n        roleArn: gcpWifRoleArn,\n        roleSessionName: \"stack-backend-cloudrun\",\n        webIdentityToken: await fetchGcpIdToken(audience),\n      })();\n    };\n  }\n\n  // 3. Static credentials: fallback for self-hosted / local development\n  return {\n    accessKeyId: getEnvVariable(\"STACK_AWS_ACCESS_KEY_ID\"),\n    secretAccessKey: getEnvVariable(\"STACK_AWS_SECRET_ACCESS_KEY\"),\n  };\n}\n\n/**\n * Fetches a GCP ID token from the metadata server (available on Cloud Run, GCE, GKE).\n * The token is a Google-signed JWT with the specified audience, suitable for\n * AWS STS AssumeRoleWithWebIdentity.\n */\nasync function fetchGcpIdToken(audience: string): Promise<string> {\n  const metadataUrl = `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=${encodeURIComponent(audience)}`;\n  const response = await fetch(metadataUrl, {\n    headers: { \"Metadata-Flavor\": \"Google\" },\n  });\n  if (!response.ok) {\n    throw new Error(`Failed to fetch GCP ID token: ${response.status} ${await response.text()}`);\n  }\n  return await response.text();\n}\n\nlet kmsClientCache: KMSClient | undefined;\n\nasync function getKmsClient() {\n  if (!kmsClientCache) {\n    kmsClientCache = new KMSClient({\n      region: getEnvVariable(\"STACK_AWS_REGION\"),\n      endpoint: getEnvVariable(\"STACK_AWS_KMS_ENDPOINT\"),\n      credentials: await getAwsCredentials(),\n    });\n  }\n  return kmsClientCache;\n}\n\nasync function getOrCreateKekId(): Promise<string> {\n  const id = \"alias/stack-data-vault-server-side-kek\";\n  const kms = await getKmsClient();\n  try {\n    const describeResult = await kms.send(new DescribeKeyCommand({ KeyId: id }));\n    if (describeResult.KeyMetadata?.KeyId) return describeResult.KeyMetadata.KeyId;\n  } catch (e) {\n    if (e instanceof Error && e.name !== \"NotFoundException\") {\n      throw e;\n    }\n  }\n  const { KeyMetadata } = await kms.send(new CreateKeyCommand({\n    KeyUsage: \"ENCRYPT_DECRYPT\",\n    Description: \"DataVault KEK\"\n  }));\n  await kms.send(new CreateAliasCommand({ AliasName: id, TargetKeyId: KeyMetadata!.KeyId! }));\n  return id;\n}\n\nasync function genDEK() {\n  const kekId = await getOrCreateKekId();\n  const kms = await getKmsClient();\n  const out = await kms.send(new GenerateDataKeyCommand({ KeyId: kekId, KeySpec: \"AES_256\" }));\n  if (!out.Plaintext || !out.CiphertextBlob) throw new Error(\"GenerateDataKey failed\");\n  return {\n    dekBytes: out.Plaintext,\n    edkBytes: out.CiphertextBlob,\n  };\n}\n\nasync function unwrapDEK(edk_b64: string) {\n  const edkBytes = decodeBase64(edk_b64);\n  const kms = await getKmsClient();\n  const out = await kms.send(new DecryptCommand({ CiphertextBlob: edkBytes }));\n  if (!out.Plaintext) throw new Error(\"KMS Decrypt failed\");\n  return {\n    dekBytes: out.Plaintext,\n    edkBytes,\n  };\n}\n\nexport async function encryptWithKms(value: string) {\n  const { dekBytes, edkBytes } = await genDEK();\n  try {\n    const ciphertext = await encrypt({\n      purpose: \"stack-data-vault-server-side-encryption\",\n      secret: dekBytes,\n      value: new TextEncoder().encode(value),\n    });\n    return { edkBase64: encodeBase64(edkBytes), ciphertextBase64: encodeBase64(ciphertext) };\n  } finally {\n    dekBytes.fill(0);\n  }\n}\n\nexport async function decryptWithKms(encrypted: Awaited<ReturnType<typeof encryptWithKms>>) {\n  const { dekBytes } = await unwrapDEK(encrypted.edkBase64);\n  try {\n    const value = Result.orThrow(await decrypt({\n      purpose: \"stack-data-vault-server-side-encryption\",\n      secret: dekBytes,\n      cipher: decodeBase64(encrypted.ciphertextBase64),\n    }));\n    return new TextDecoder().decode(value);\n  } finally {\n    dekBytes.fill(0);\n  }\n}\n"],"mappings":";;;;;;;;;AAcA,eAAe,oBAAoB;CAEjC,MAAM,uDAA+B,kCAAkC,GAAG;AAC1E,KAAI,eAAe;EACjB,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAChD,SAAO,uBAAuB,EAAE,SAAS,eAAe,CAAC;;CAU3D,MAAM,uDAA+B,8BAA8B,GAAG;AACtE,KAAI,eAAe;EACjB,MAAM,EAAE,iBAAiB,MAAM,OAAO;EACtC,MAAM,kDAA0B,8BAA8B,oBAAoB;AAGlF,SAAO,YAAY;AACjB,UAAO,MAAM,aAAa;IACxB,SAAS;IACT,iBAAiB;IACjB,kBAAkB,MAAM,gBAAgB,SAAS;IAClD,CAAC,EAAE;;;AAKR,QAAO;EACL,oDAA4B,0BAA0B;EACtD,wDAAgC,8BAA8B;EAC/D;;;;;;;AAQH,eAAe,gBAAgB,UAAmC;CAChE,MAAM,cAAc,0GAA0G,mBAAmB,SAAS;CAC1J,MAAM,WAAW,MAAM,MAAM,aAAa,EACxC,SAAS,EAAE,mBAAmB,UAAU,EACzC,CAAC;AACF,KAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,iCAAiC,SAAS,OAAO,GAAG,MAAM,SAAS,MAAM,GAAG;AAE9F,QAAO,MAAM,SAAS,MAAM;;AAG9B,IAAI;AAEJ,eAAe,eAAe;AAC5B,KAAI,CAAC,eACH,kBAAiB,IAAIA,8BAAU;EAC7B,+CAAuB,mBAAmB;EAC1C,iDAAyB,yBAAyB;EAClD,aAAa,MAAM,mBAAmB;EACvC,CAAC;AAEJ,QAAO;;AAGT,eAAe,mBAAoC;CACjD,MAAM,KAAK;CACX,MAAM,MAAM,MAAM,cAAc;AAChC,KAAI;EACF,MAAM,iBAAiB,MAAM,IAAI,KAAK,IAAIC,uCAAmB,EAAE,OAAO,IAAI,CAAC,CAAC;AAC5E,MAAI,eAAe,aAAa,MAAO,QAAO,eAAe,YAAY;UAClE,GAAG;AACV,MAAI,aAAa,SAAS,EAAE,SAAS,oBACnC,OAAM;;CAGV,MAAM,EAAE,gBAAgB,MAAM,IAAI,KAAK,IAAIC,qCAAiB;EAC1D,UAAU;EACV,aAAa;EACd,CAAC,CAAC;AACH,OAAM,IAAI,KAAK,IAAIC,uCAAmB;EAAE,WAAW;EAAI,aAAa,YAAa;EAAQ,CAAC,CAAC;AAC3F,QAAO;;AAGT,eAAe,SAAS;CACtB,MAAM,QAAQ,MAAM,kBAAkB;CAEtC,MAAM,MAAM,OADA,MAAM,cAAc,EACV,KAAK,IAAIC,2CAAuB;EAAE,OAAO;EAAO,SAAS;EAAW,CAAC,CAAC;AAC5F,KAAI,CAAC,IAAI,aAAa,CAAC,IAAI,eAAgB,OAAM,IAAI,MAAM,yBAAyB;AACpF,QAAO;EACL,UAAU,IAAI;EACd,UAAU,IAAI;EACf;;AAGH,eAAe,UAAU,SAAiB;CACxC,MAAM,kDAAwB,QAAQ;CAEtC,MAAM,MAAM,OADA,MAAM,cAAc,EACV,KAAK,IAAIC,mCAAe,EAAE,gBAAgB,UAAU,CAAC,CAAC;AAC5E,KAAI,CAAC,IAAI,UAAW,OAAM,IAAI,MAAM,qBAAqB;AACzD,QAAO;EACL,UAAU,IAAI;EACd;EACD;;AAGH,eAAsB,eAAe,OAAe;CAClD,MAAM,EAAE,UAAU,aAAa,MAAM,QAAQ;AAC7C,KAAI;EACF,MAAM,aAAa,yCAAc;GAC/B,SAAS;GACT,QAAQ;GACR,OAAO,IAAI,aAAa,CAAC,OAAO,MAAM;GACvC,CAAC;AACF,SAAO;GAAE,kDAAwB,SAAS;GAAE,yDAA+B,WAAW;GAAE;WAChF;AACR,WAAS,KAAK,EAAE;;;AAIpB,eAAsB,eAAe,WAAuD;CAC1F,MAAM,EAAE,aAAa,MAAM,UAAU,UAAU,UAAU;AACzD,KAAI;EACF,MAAM,QAAQC,8BAAO,QAAQ,yCAAc;GACzC,SAAS;GACT,QAAQ;GACR,+CAAqB,UAAU,iBAAiB;GACjD,CAAC,CAAC;AACH,SAAO,IAAI,aAAa,CAAC,OAAO,MAAM;WAC9B;AACR,WAAS,KAAK,EAAE"}
+{"version":3,"file":"server-side.js","names":["KMSClient","DescribeKeyCommand","CreateKeyCommand","CreateAliasCommand","GenerateDataKeyCommand","DecryptCommand","Result"],"sources":["../../../src/helpers/vault/server-side.ts"],"sourcesContent":["import {\n  CreateAliasCommand,\n  CreateKeyCommand,\n  DecryptCommand,\n  DescribeKeyCommand,\n  GenerateDataKeyCommand,\n  KMSClient\n} from \"@aws-sdk/client-kms\";\nimport { decodeBase64, encodeBase64 } from \"../../utils/bytes\";\nimport { decrypt, encrypt } from \"../../utils/crypto\";\nimport { getEnvVariable } from \"../../utils/env\";\nimport { Result } from \"../../utils/results\";\n\n\nasync function getAwsCredentials() {\n  // 1. Vercel OIDC: Vercel injects an OIDC token that can be exchanged for AWS credentials\n  const vercelRoleArn = getEnvVariable(\"STACK_AWS_VERCEL_OIDC_ROLE_ARN\", \"\");\n  if (vercelRoleArn) {\n    const { awsCredentialsProvider } = await import(\"@vercel/functions/oidc\");\n    return awsCredentialsProvider({ roleArn: vercelRoleArn });\n  }\n\n  // 2. GCP Workload Identity Federation: Cloud Run gets a GCP ID token from the metadata server,\n  //    then exchanges it for temporary AWS credentials via STS AssumeRoleWithWebIdentity.\n  //    Requires:\n  //      - An OIDC identity provider in AWS IAM (issuer: https://accounts.google.com)\n  //      - An IAM role with a trust policy allowing the GCP service account\n  //      - STACK_AWS_GCP_WIF_ROLE_ARN set to that role's ARN\n  //      - STACK_AWS_GCP_WIF_AUDIENCE set to the audience configured in the AWS OIDC provider\n  const gcpWifRoleArn = getEnvVariable(\"STACK_AWS_GCP_WIF_ROLE_ARN\", \"\");\n  if (gcpWifRoleArn) {\n    const { fromWebToken } = await import(\"@aws-sdk/credential-provider-web-identity\");\n    const audience = getEnvVariable(\"STACK_AWS_GCP_WIF_AUDIENCE\", \"sts.amazonaws.com\");\n    // Return a provider that fetches a fresh GCP ID token on each invocation.\n    // GCP metadata tokens expire after ~1h, so we can't bake a single token into the closure.\n    return async () => {\n      return await fromWebToken({\n        roleArn: gcpWifRoleArn,\n        roleSessionName: \"stack-backend-cloudrun\",\n        webIdentityToken: await fetchGcpIdToken(audience),\n      })();\n    };\n  }\n\n  // 3. Static credentials: fallback for self-hosted / local development\n  return {\n    accessKeyId: getEnvVariable(\"STACK_AWS_ACCESS_KEY_ID\"),\n    secretAccessKey: getEnvVariable(\"STACK_AWS_SECRET_ACCESS_KEY\"),\n  };\n}\n\n/**\n * Fetches a GCP ID token from the metadata server (available on Cloud Run, GCE, GKE).\n * The token is a Google-signed JWT with the specified audience, suitable for\n * AWS STS AssumeRoleWithWebIdentity.\n */\nasync function fetchGcpIdToken(audience: string): Promise<string> {\n  const metadataUrl = `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=${encodeURIComponent(audience)}`;\n  const response = await fetch(metadataUrl, {\n    headers: { \"Metadata-Flavor\": \"Google\" },\n  });\n  if (!response.ok) {\n    throw new Error(`Failed to fetch GCP ID token: ${response.status} ${await response.text()}`);\n  }\n  return await response.text();\n}\n\nlet kmsClientCache: KMSClient | undefined;\n\nasync function getKmsClient() {\n  if (!kmsClientCache) {\n    kmsClientCache = new KMSClient({\n      region: getEnvVariable(\"STACK_AWS_REGION\"),\n      endpoint: getEnvVariable(\"STACK_AWS_KMS_ENDPOINT\"),\n      credentials: await getAwsCredentials(),\n    });\n  }\n  return kmsClientCache;\n}\n\nasync function getOrCreateKekId(): Promise<string> {\n  // NOTE (Hexclave rebrand): do NOT rename this \"stack-*\" alias. It is the AWS KMS key alias for\n  // the existing key-encryption key; renaming it would point at a non-existent key and break\n  // wrap/unwrap of all stored data keys. Internal infrastructure constant, never user-visible.\n  const id = \"alias/stack-data-vault-server-side-kek\";\n  const kms = await getKmsClient();\n  try {\n    const describeResult = await kms.send(new DescribeKeyCommand({ KeyId: id }));\n    if (describeResult.KeyMetadata?.KeyId) return describeResult.KeyMetadata.KeyId;\n  } catch (e) {\n    if (e instanceof Error && e.name !== \"NotFoundException\") {\n      throw e;\n    }\n  }\n  const { KeyMetadata } = await kms.send(new CreateKeyCommand({\n    KeyUsage: \"ENCRYPT_DECRYPT\",\n    Description: \"DataVault KEK\"\n  }));\n  await kms.send(new CreateAliasCommand({ AliasName: id, TargetKeyId: KeyMetadata!.KeyId! }));\n  return id;\n}\n\nasync function genDEK() {\n  const kekId = await getOrCreateKekId();\n  const kms = await getKmsClient();\n  const out = await kms.send(new GenerateDataKeyCommand({ KeyId: kekId, KeySpec: \"AES_256\" }));\n  if (!out.Plaintext || !out.CiphertextBlob) throw new Error(\"GenerateDataKey failed\");\n  return {\n    dekBytes: out.Plaintext,\n    edkBytes: out.CiphertextBlob,\n  };\n}\n\nasync function unwrapDEK(edk_b64: string) {\n  const edkBytes = decodeBase64(edk_b64);\n  const kms = await getKmsClient();\n  const out = await kms.send(new DecryptCommand({ CiphertextBlob: edkBytes }));\n  if (!out.Plaintext) throw new Error(\"KMS Decrypt failed\");\n  return {\n    dekBytes: out.Plaintext,\n    edkBytes,\n  };\n}\n\nexport async function encryptWithKms(value: string) {\n  const { dekBytes, edkBytes } = await genDEK();\n  try {\n    const ciphertext = await encrypt({\n      // NOTE (Hexclave rebrand): do NOT rename this \"stack-*\" purpose tag — it must match the one\n      // used in decryptWithKms below, or already-encrypted values become undecryptable.\n      purpose: \"stack-data-vault-server-side-encryption\",\n      secret: dekBytes,\n      value: new TextEncoder().encode(value),\n    });\n    return { edkBase64: encodeBase64(edkBytes), ciphertextBase64: encodeBase64(ciphertext) };\n  } finally {\n    dekBytes.fill(0);\n  }\n}\n\nexport async function decryptWithKms(encrypted: Awaited<ReturnType<typeof encryptWithKms>>) {\n  const { dekBytes } = await unwrapDEK(encrypted.edkBase64);\n  try {\n    const value = Result.orThrow(await decrypt({\n      purpose: \"stack-data-vault-server-side-encryption\",\n      secret: dekBytes,\n      cipher: decodeBase64(encrypted.ciphertextBase64),\n    }));\n    return new TextDecoder().decode(value);\n  } finally {\n    dekBytes.fill(0);\n  }\n}\n"],"mappings":";;;;;;;;;AAcA,eAAe,oBAAoB;CAEjC,MAAM,uDAA+B,kCAAkC,GAAG;AAC1E,KAAI,eAAe;EACjB,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAChD,SAAO,uBAAuB,EAAE,SAAS,eAAe,CAAC;;CAU3D,MAAM,uDAA+B,8BAA8B,GAAG;AACtE,KAAI,eAAe;EACjB,MAAM,EAAE,iBAAiB,MAAM,OAAO;EACtC,MAAM,kDAA0B,8BAA8B,oBAAoB;AAGlF,SAAO,YAAY;AACjB,UAAO,MAAM,aAAa;IACxB,SAAS;IACT,iBAAiB;IACjB,kBAAkB,MAAM,gBAAgB,SAAS;IAClD,CAAC,EAAE;;;AAKR,QAAO;EACL,oDAA4B,0BAA0B;EACtD,wDAAgC,8BAA8B;EAC/D;;;;;;;AAQH,eAAe,gBAAgB,UAAmC;CAChE,MAAM,cAAc,0GAA0G,mBAAmB,SAAS;CAC1J,MAAM,WAAW,MAAM,MAAM,aAAa,EACxC,SAAS,EAAE,mBAAmB,UAAU,EACzC,CAAC;AACF,KAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,iCAAiC,SAAS,OAAO,GAAG,MAAM,SAAS,MAAM,GAAG;AAE9F,QAAO,MAAM,SAAS,MAAM;;AAG9B,IAAI;AAEJ,eAAe,eAAe;AAC5B,KAAI,CAAC,eACH,kBAAiB,IAAIA,8BAAU;EAC7B,+CAAuB,mBAAmB;EAC1C,iDAAyB,yBAAyB;EAClD,aAAa,MAAM,mBAAmB;EACvC,CAAC;AAEJ,QAAO;;AAGT,eAAe,mBAAoC;CAIjD,MAAM,KAAK;CACX,MAAM,MAAM,MAAM,cAAc;AAChC,KAAI;EACF,MAAM,iBAAiB,MAAM,IAAI,KAAK,IAAIC,uCAAmB,EAAE,OAAO,IAAI,CAAC,CAAC;AAC5E,MAAI,eAAe,aAAa,MAAO,QAAO,eAAe,YAAY;UAClE,GAAG;AACV,MAAI,aAAa,SAAS,EAAE,SAAS,oBACnC,OAAM;;CAGV,MAAM,EAAE,gBAAgB,MAAM,IAAI,KAAK,IAAIC,qCAAiB;EAC1D,UAAU;EACV,aAAa;EACd,CAAC,CAAC;AACH,OAAM,IAAI,KAAK,IAAIC,uCAAmB;EAAE,WAAW;EAAI,aAAa,YAAa;EAAQ,CAAC,CAAC;AAC3F,QAAO;;AAGT,eAAe,SAAS;CACtB,MAAM,QAAQ,MAAM,kBAAkB;CAEtC,MAAM,MAAM,OADA,MAAM,cAAc,EACV,KAAK,IAAIC,2CAAuB;EAAE,OAAO;EAAO,SAAS;EAAW,CAAC,CAAC;AAC5F,KAAI,CAAC,IAAI,aAAa,CAAC,IAAI,eAAgB,OAAM,IAAI,MAAM,yBAAyB;AACpF,QAAO;EACL,UAAU,IAAI;EACd,UAAU,IAAI;EACf;;AAGH,eAAe,UAAU,SAAiB;CACxC,MAAM,kDAAwB,QAAQ;CAEtC,MAAM,MAAM,OADA,MAAM,cAAc,EACV,KAAK,IAAIC,mCAAe,EAAE,gBAAgB,UAAU,CAAC,CAAC;AAC5E,KAAI,CAAC,IAAI,UAAW,OAAM,IAAI,MAAM,qBAAqB;AACzD,QAAO;EACL,UAAU,IAAI;EACd;EACD;;AAGH,eAAsB,eAAe,OAAe;CAClD,MAAM,EAAE,UAAU,aAAa,MAAM,QAAQ;AAC7C,KAAI;EACF,MAAM,aAAa,yCAAc;GAG/B,SAAS;GACT,QAAQ;GACR,OAAO,IAAI,aAAa,CAAC,OAAO,MAAM;GACvC,CAAC;AACF,SAAO;GAAE,kDAAwB,SAAS;GAAE,yDAA+B,WAAW;GAAE;WAChF;AACR,WAAS,KAAK,EAAE;;;AAIpB,eAAsB,eAAe,WAAuD;CAC1F,MAAM,EAAE,aAAa,MAAM,UAAU,UAAU,UAAU;AACzD,KAAI;EACF,MAAM,QAAQC,8BAAO,QAAQ,yCAAc;GACzC,SAAS;GACT,QAAQ;GACR,+CAAqB,UAAU,iBAAiB;GACjD,CAAC,CAAC;AACH,SAAO,IAAI,aAAa,CAAC,OAAO,MAAM;WAC9B;AACR,WAAS,KAAK,EAAE"}

package/dist/hexclave-config-file.d.ts

@@ -0,0 +1,15 @@
+//#region src/hexclave-config-file.d.ts
+declare const showOnboardingHexclaveConfigValue = "show-onboarding";
+/**
+ * Renders a config object into the source text of a `stack.config.ts` file.
+ *
+ * Browser-safe: kept here (next to `parseHexclaveConfigFileContent`) instead of in
+ * `config-rendering.ts` so dashboard client code can render config files
+ * without pulling in `fs` / `path`.
+ */
+declare function renderConfigFileContent(config: unknown, importPackage?: string): string;
+type ParsedStackConfig = Record<string, unknown> | typeof showOnboardingHexclaveConfigValue;
+declare function parseHexclaveConfigFileContent(content: string, filePath: string): ParsedStackConfig;
+//#endregion
+export { parseHexclaveConfigFileContent, renderConfigFileContent, showOnboardingHexclaveConfigValue };
+//# sourceMappingURL=hexclave-config-file.d.ts.map

package/dist/hexclave-config-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hexclave-config-file.d.ts","names":[],"sources":["../src/hexclave-config-file.ts"],"mappings":";cAIa,iCAAA;AAAb;;;;;AAWA;;AAXA,iBAWgB,uBAAA,CAAwB,MAAA,WAAiB,aAAA;AAAA,KAmBpD,iBAAA,GAAoB,MAAA,2BAAiC,iCAAA;AAAA,iBA8D1C,8BAAA,CAA+B,OAAA,UAAiB,QAAA,WAAmB,iBAAA"}

package/dist/{stack-config-file.js → hexclave-config-file.js}

@@ -6,13 +6,13 @@ let _babel_types = require("@babel/types");
 _babel_types = require_chunk.__toESM(_babel_types);
 let __config_format_js = require("./config/format.js");
 
-//#region src/stack-config-file.ts
-const showOnboardingStackConfigValue = "show-onboarding";
+//#region src/hexclave-config-file.ts
+const showOnboardingHexclaveConfigValue = "show-onboarding";
 const DEFAULT_CONFIG_IMPORT_PACKAGE = "@hexclave/js";
 /**
 * Renders a config object into the source text of a `stack.config.ts` file.
 *
-* Browser-safe: kept here (next to `parseStackConfigFileContent`) instead of in
+* Browser-safe: kept here (next to `parseHexclaveConfigFileContent`) instead of in
 * `config-rendering.ts` so dashboard client code can render config files
 * without pulling in `fs` / `path`.
 */
@@ -25,7 +25,7 @@ function renderConfigFileContent(config, importPackage) {
 		droppedKeys
 	});
 	if (droppedKeys.length > 0) throw new Error(`Config has conflicting keys that would be dropped during normalization: ${droppedKeys.map((k) => JSON.stringify(k)).join(", ")}`);
-	return `${`import type { StackConfig } from "${importPackage ?? DEFAULT_CONFIG_IMPORT_PACKAGE}";`}\n\nexport const config: StackConfig = ${JSON.stringify(normalizedConfig, null, 2)};\n`;
+	return `${`import type { HexclaveConfig } from "${importPackage ?? DEFAULT_CONFIG_IMPORT_PACKAGE}";`}\n\nexport const config: HexclaveConfig = ${JSON.stringify(normalizedConfig, null, 2)};\n`;
 }
 function unwrapStaticConfigExpression(expression) {
 	if (_babel_types.isTSAsExpression(expression) || _babel_types.isTSSatisfiesExpression(expression) || _babel_types.isTSTypeAssertion(expression) || _babel_types.isTSNonNullExpression(expression)) return unwrapStaticConfigExpression(expression.expression);
@@ -58,7 +58,7 @@ function evaluateStaticConfigExpression(expression) {
 	}
 	throw new Error(`Unsupported config expression: ${unwrapped.type}`);
 }
-function parseStackConfigFileContent(content, filePath) {
+function parseHexclaveConfigFileContent(content, filePath) {
 	if (content.trim() === "") return {};
 	const ast = _babel_parser.parse(content, {
 		sourceType: "module",
@@ -76,7 +76,7 @@ function parseStackConfigFileContent(content, filePath) {
 }
 
 //#endregion
-exports.parseStackConfigFileContent = parseStackConfigFileContent;
+exports.parseHexclaveConfigFileContent = parseHexclaveConfigFileContent;
 exports.renderConfigFileContent = renderConfigFileContent;
-exports.showOnboardingStackConfigValue = showOnboardingStackConfigValue;
-//# sourceMappingURL=stack-config-file.js.map
+exports.showOnboardingHexclaveConfigValue = showOnboardingHexclaveConfigValue;
+//# sourceMappingURL=hexclave-config-file.js.map

package/dist/hexclave-config-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hexclave-config-file.js","names":["t","parser"],"sources":["../src/hexclave-config-file.ts"],"sourcesContent":["import * as parser from \"@babel/parser\";\nimport * as t from \"@babel/types\";\nimport { isValidConfig, normalize } from \"./config/format\";\n\nexport const showOnboardingHexclaveConfigValue = \"show-onboarding\";\n\nconst DEFAULT_CONFIG_IMPORT_PACKAGE = \"@hexclave/js\";\n\n/**\n * Renders a config object into the source text of a `stack.config.ts` file.\n *\n * Browser-safe: kept here (next to `parseHexclaveConfigFileContent`) instead of in\n * `config-rendering.ts` so dashboard client code can render config files\n * without pulling in `fs` / `path`.\n */\nexport function renderConfigFileContent(config: unknown, importPackage?: string): string {\n  if (!isValidConfig(config)) {\n    throw new Error(\"Invalid config: expected a plain object.\");\n  }\n\n  const droppedKeys: string[] = [];\n  const normalizedConfig = normalize(config, {\n    onDotIntoNonObject: \"ignore\",\n    onDotIntoNull: \"empty-object\",\n    droppedKeys,\n  });\n  if (droppedKeys.length > 0) {\n    throw new Error(`Config has conflicting keys that would be dropped during normalization: ${droppedKeys.map(k => JSON.stringify(k)).join(\", \")}`);\n  }\n  const pkg = importPackage ?? DEFAULT_CONFIG_IMPORT_PACKAGE;\n  const importLine = `import type { HexclaveConfig } from \"${pkg}\";`;\n  return `${importLine}\\n\\nexport const config: HexclaveConfig = ${JSON.stringify(normalizedConfig, null, 2)};\\n`;\n}\n\ntype ParsedStackConfig = Record<string, unknown> | typeof showOnboardingHexclaveConfigValue;\n\nfunction unwrapStaticConfigExpression(expression: t.Expression): t.Expression {\n  if (\n    t.isTSAsExpression(expression)\n    || t.isTSSatisfiesExpression(expression)\n    || t.isTSTypeAssertion(expression)\n    || t.isTSNonNullExpression(expression)\n  ) {\n    return unwrapStaticConfigExpression(expression.expression);\n  }\n  return expression;\n}\n\nfunction evaluateStaticConfigExpression(expression: t.Expression): unknown {\n  const unwrapped = unwrapStaticConfigExpression(expression);\n  if (t.isStringLiteral(unwrapped)) return unwrapped.value;\n  if (t.isBooleanLiteral(unwrapped)) return unwrapped.value;\n  if (t.isNumericLiteral(unwrapped)) return unwrapped.value;\n  if (t.isNullLiteral(unwrapped)) return null;\n  if (t.isIdentifier(unwrapped) && unwrapped.name === \"undefined\") return undefined;\n  if (t.isUnaryExpression(unwrapped) && unwrapped.operator === \"-\" && t.isNumericLiteral(unwrapped.argument)) {\n    return -unwrapped.argument.value;\n  }\n  if (t.isArrayExpression(unwrapped)) {\n    return unwrapped.elements.map((element) => {\n      if (element == null || t.isSpreadElement(element)) {\n        throw new Error(\"Config arrays cannot contain holes or spreads.\");\n      }\n      return evaluateStaticConfigExpression(element);\n    });\n  }\n  if (t.isObjectExpression(unwrapped)) {\n    const result: Record<string, unknown> = {};\n    for (const property of unwrapped.properties) {\n      if (t.isSpreadElement(property)) {\n        throw new Error(\"Config objects cannot contain spreads.\");\n      }\n      if (property.computed) {\n        throw new Error(\"Config object keys cannot be computed.\");\n      }\n      const key = t.isIdentifier(property.key)\n        ? property.key.name\n        : t.isStringLiteral(property.key) || t.isNumericLiteral(property.key)\n          ? String(property.key.value)\n          : null;\n      if (key == null) {\n        throw new Error(\"Unsupported config object key.\");\n      }\n      if (t.isObjectMethod(property)) {\n        throw new Error(\"Config objects cannot contain methods.\");\n      }\n      if (!t.isExpression(property.value)) {\n        throw new Error(\"Unsupported config object value.\");\n      }\n      result[key] = evaluateStaticConfigExpression(property.value);\n    }\n    return result;\n  }\n  throw new Error(`Unsupported config expression: ${unwrapped.type}`);\n}\n\nexport function parseHexclaveConfigFileContent(content: string, filePath: string): ParsedStackConfig {\n  if (content.trim() === \"\") return {};\n  const ast = parser.parse(content, {\n    sourceType: \"module\",\n    plugins: [\"typescript\"],\n  });\n\n  for (const statement of ast.program.body) {\n    if (!t.isExportNamedDeclaration(statement) || !t.isVariableDeclaration(statement.declaration)) {\n      continue;\n    }\n    for (const declaration of statement.declaration.declarations) {\n      if (!t.isIdentifier(declaration.id) || declaration.id.name !== \"config\") {\n        continue;\n      }\n      if (declaration.init == null || !t.isExpression(declaration.init)) {\n        throw new Error(`Config export in ${filePath} must have an initializer.`);\n      }\n      return evaluateStaticConfigExpression(declaration.init) as ParsedStackConfig;\n    }\n  }\n\n  throw new Error(`Invalid config in ${filePath}. The file must export a plain \\`config\\` object or \"show-onboarding\".`);\n}\n"],"mappings":";;;;;;;;;AAIA,MAAa,oCAAoC;AAEjD,MAAM,gCAAgC;;;;;;;;AAStC,SAAgB,wBAAwB,QAAiB,eAAgC;AACvF,KAAI,uCAAe,OAAO,CACxB,OAAM,IAAI,MAAM,2CAA2C;CAG7D,MAAM,cAAwB,EAAE;CAChC,MAAM,qDAA6B,QAAQ;EACzC,oBAAoB;EACpB,eAAe;EACf;EACD,CAAC;AACF,KAAI,YAAY,SAAS,EACvB,OAAM,IAAI,MAAM,2EAA2E,YAAY,KAAI,MAAK,KAAK,UAAU,EAAE,CAAC,CAAC,KAAK,KAAK,GAAG;AAIlJ,QAAO,GADY,wCADP,iBAAiB,8BACkC,IAC1C,4CAA4C,KAAK,UAAU,kBAAkB,MAAM,EAAE,CAAC;;AAK7G,SAAS,6BAA6B,YAAwC;AAC5E,KACEA,aAAE,iBAAiB,WAAW,IAC3BA,aAAE,wBAAwB,WAAW,IACrCA,aAAE,kBAAkB,WAAW,IAC/BA,aAAE,sBAAsB,WAAW,CAEtC,QAAO,6BAA6B,WAAW,WAAW;AAE5D,QAAO;;AAGT,SAAS,+BAA+B,YAAmC;CACzE,MAAM,YAAY,6BAA6B,WAAW;AAC1D,KAAIA,aAAE,gBAAgB,UAAU,CAAE,QAAO,UAAU;AACnD,KAAIA,aAAE,iBAAiB,UAAU,CAAE,QAAO,UAAU;AACpD,KAAIA,aAAE,iBAAiB,UAAU,CAAE,QAAO,UAAU;AACpD,KAAIA,aAAE,cAAc,UAAU,CAAE,QAAO;AACvC,KAAIA,aAAE,aAAa,UAAU,IAAI,UAAU,SAAS,YAAa,QAAO;AACxE,KAAIA,aAAE,kBAAkB,UAAU,IAAI,UAAU,aAAa,OAAOA,aAAE,iBAAiB,UAAU,SAAS,CACxG,QAAO,CAAC,UAAU,SAAS;AAE7B,KAAIA,aAAE,kBAAkB,UAAU,CAChC,QAAO,UAAU,SAAS,KAAK,YAAY;AACzC,MAAI,WAAW,QAAQA,aAAE,gBAAgB,QAAQ,CAC/C,OAAM,IAAI,MAAM,iDAAiD;AAEnE,SAAO,+BAA+B,QAAQ;GAC9C;AAEJ,KAAIA,aAAE,mBAAmB,UAAU,EAAE;EACnC,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,YAAY,UAAU,YAAY;AAC3C,OAAIA,aAAE,gBAAgB,SAAS,CAC7B,OAAM,IAAI,MAAM,yCAAyC;AAE3D,OAAI,SAAS,SACX,OAAM,IAAI,MAAM,yCAAyC;GAE3D,MAAM,MAAMA,aAAE,aAAa,SAAS,IAAI,GACpC,SAAS,IAAI,OACbA,aAAE,gBAAgB,SAAS,IAAI,IAAIA,aAAE,iBAAiB,SAAS,IAAI,GACjE,OAAO,SAAS,IAAI,MAAM,GAC1B;AACN,OAAI,OAAO,KACT,OAAM,IAAI,MAAM,iCAAiC;AAEnD,OAAIA,aAAE,eAAe,SAAS,CAC5B,OAAM,IAAI,MAAM,yCAAyC;AAE3D,OAAI,CAACA,aAAE,aAAa,SAAS,MAAM,CACjC,OAAM,IAAI,MAAM,mCAAmC;AAErD,UAAO,OAAO,+BAA+B,SAAS,MAAM;;AAE9D,SAAO;;AAET,OAAM,IAAI,MAAM,kCAAkC,UAAU,OAAO;;AAGrE,SAAgB,+BAA+B,SAAiB,UAAqC;AACnG,KAAI,QAAQ,MAAM,KAAK,GAAI,QAAO,EAAE;CACpC,MAAM,MAAMC,cAAO,MAAM,SAAS;EAChC,YAAY;EACZ,SAAS,CAAC,aAAa;EACxB,CAAC;AAEF,MAAK,MAAM,aAAa,IAAI,QAAQ,MAAM;AACxC,MAAI,CAACD,aAAE,yBAAyB,UAAU,IAAI,CAACA,aAAE,sBAAsB,UAAU,YAAY,CAC3F;AAEF,OAAK,MAAM,eAAe,UAAU,YAAY,cAAc;AAC5D,OAAI,CAACA,aAAE,aAAa,YAAY,GAAG,IAAI,YAAY,GAAG,SAAS,SAC7D;AAEF,OAAI,YAAY,QAAQ,QAAQ,CAACA,aAAE,aAAa,YAAY,KAAK,CAC/D,OAAM,IAAI,MAAM,oBAAoB,SAAS,4BAA4B;AAE3E,UAAO,+BAA+B,YAAY,KAAK;;;AAI3D,OAAM,IAAI,MAAM,qBAAqB,SAAS,wEAAwE"}

package/dist/hooks/use-async-callback.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../chunk-BE-pF4vm.js');
+let ___utils_errors_js = require("../utils/errors.js");
 let react = require("react");
 react = require_chunk.__toESM(react);
-let ___utils_errors_js = require("../utils/errors.js");
 
 //#region src/hooks/use-async-callback.tsx
 function useAsyncCallback(callback, deps) {

package/dist/hooks/use-async-external-store.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../chunk-BE-pF4vm.js');
-let react = require("react");
 let ___utils_results_js = require("../utils/results.js");
+let react = require("react");
 
 //#region src/hooks/use-async-external-store.tsx
 function useAsyncExternalStore(subscribe) {

package/dist/hooks/use-strict-memo.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../chunk-BE-pF4vm.js');
-let react = require("react");
 let ___utils_results_js = require("../utils/results.js");
+let react = require("react");
 
 //#region src/hooks/use-strict-memo.tsx
 const cached = /* @__PURE__ */ new Map();