@linkforty/core 1.44.1 → 1.44.2

package/dist/routes/redirect.interstitial.test.js

@@ -1,128 +0,0 @@
-/**
- * The mobile scheme interstitial: the page a phone gets when a link has a URI
- * scheme, which tries the app and falls back to the store.
- *
- * Its two URLs used to be interpolated into JavaScript source with `"` and `<`
- * replaced — enough to keep a value inside its string literal only until the
- * value contained a backslash or a line terminator. They now reach the document
- * as attributes and the script reads them back, so the JavaScript contains no
- * configured value at all.
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import Fastify from 'fastify';
-import { redirectRoutes } from './redirect.js';
-import { safeSchemeHref } from '../lib/link-safety.js';
-const query = vi.fn();
-vi.mock('../lib/database.js', () => ({
-    db: {
-        query: (...args) => query(...args),
-    },
-}));
-const IPHONE_UA = 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1';
-function linkRow(overrides = {}) {
-    return {
-        id: '00000000-0000-0000-0000-0000000000aa',
-        short_code: 'abc123',
-        title: null,
-        og_title: null,
-        original_url: null,
-        web_fallback_url: null,
-        ios_app_store_url: 'https://apps.apple.com/app/id1',
-        android_app_store_url: null,
-        ios_universal_link: null,
-        android_app_link: null,
-        app_scheme: 'demo',
-        deep_link_path: '/p/1',
-        custom_scheme_url: null,
-        launchpad_mode: 'inherit',
-        is_active: true,
-        warn_at: null,
-        owner_suspended_at: null,
-        expires_at: null,
-        targeting_rules: null,
-        template_settings: null,
-        org_settings: null,
-        utm_parameters: null,
-        deep_link_parameters: null,
-        append_click_id: false,
-        ...overrides,
-    };
-}
-function mockDb(row) {
-    query.mockReset();
-    query.mockImplementation(async (sql) => {
-        if (/information_schema\.columns/i.test(sql))
-            return { rows: [{ '?column?': 1 }], rowCount: 1 };
-        if (/FROM links l/i.test(sql))
-            return { rows: row ? [row] : [], rowCount: row ? 1 : 0 };
-        return { rows: [], rowCount: 0 };
-    });
-}
-const get = (app) => app.inject({ method: 'GET', url: '/abc123', headers: { 'user-agent': IPHONE_UA } });
-let app;
-beforeEach(async () => {
-    app = Fastify();
-    await app.register(redirectRoutes);
-    await app.ready();
-});
-afterEach(async () => {
-    await new Promise((r) => setImmediate(r));
-    await app.close();
-});
-describe('scheme interstitial', () => {
-    it('serves the interstitial with the scheme and store URLs as attributes, and no configured value inside the script', async () => {
-        mockDb(linkRow({ deep_link_parameters: { x: '1', y: 'two words' } }));
-        const res = await get(app);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('id="open-btn" href="demo://p/1?x=1&amp;y=two+words"');
-        expect(res.body).toContain('id="store-btn" href="https://apps.apple.com/app/id1"');
-        const script = res.body.slice(res.body.indexOf('<script>'), res.body.indexOf('</script>'));
-        expect(script).not.toContain('demo://');
-        expect(script).not.toContain('apps.apple.com');
-        expect(script).toContain("openBtn.getAttribute('href') + hash");
-        expect(script).toContain("window.location.replace(storeBtn.getAttribute('href'))");
-    });
-    /**
-     * A custom scheme URL is operator-configured free text. A backslash before the
-     * closing quote, or a line terminator, used to end the JavaScript string
-     * literal early and take the whole script — auto-open and fallback timer —
-     * with it. Now it is an attribute value, escaped like any other.
-     */
-    it('keeps a scheme URL with a quote, a backslash and a line separator out of the script', async () => {
-        mockDb(linkRow({ custom_scheme_url: 'demo://open?q="x"\\
</script><img src=x onerror=alert(1)>' }));
-        const res = await get(app);
-        expect(res.statusCode).toBe(200);
-        expect(res.body.match(/<\/script>/g)).toHaveLength(1);
-        expect(res.body).not.toContain('<img src=x');
-        expect(res.body).toContain('href="demo://open?q=&quot;x&quot;\\
&lt;/script&gt;&lt;img src=x onerror=alert(1)&gt;"');
-    });
-    it('escapes an ampersand in the title, which the old generator left raw', async () => {
-        mockDb(linkRow({ title: 'Cats & Dogs <3' }));
-        const res = await get(app);
-        expect(res.body).toContain('<h1>Opening Cats &amp; Dogs &lt;3...</h1>');
-    });
-    it('treats an executable "scheme" as no scheme: store redirect, no interstitial, no scheme in Location', async () => {
-        mockDb(linkRow({ app_scheme: 'javascript', deep_link_path: '/%0aalert(1)' }));
-        const res = await get(app);
-        expect(res.statusCode).toBe(302);
-        expect(res.headers.location).toBe('https://apps.apple.com/app/id1');
-        expect(res.body).not.toContain('open-btn');
-    });
-    it('refuses an executable custom scheme URL even when app_scheme itself is fine', async () => {
-        mockDb(linkRow({ custom_scheme_url: 'javascript:alert(1)' }));
-        const res = await get(app);
-        expect(res.statusCode).toBe(302);
-        expect(res.headers.location).toBe('demo://p/1');
-    });
-});
-describe('safeSchemeHref', () => {
-    it('accepts app schemes and rejects the ones a browser executes', () => {
-        expect(safeSchemeHref('demo://p/1')).toBe('demo://p/1');
-        expect(safeSchemeHref('com.example.app://p/1')).toBe('com.example.app://p/1');
-        expect(safeSchemeHref('https://example.com/p')).toBe('https://example.com/p');
-        for (const bad of ['javascript:alert(1)', 'JavaScript://%0aalert(1)', 'data:text/html,hi', 'vbscript:x', 'file:///etc/passwd', 'blob:x', 'about:blank', 'no-scheme', '']) {
-            expect(safeSchemeHref(bad)).toBeNull();
-        }
-    });
-});
-//# sourceMappingURL=redirect.interstitial.test.js.map

package/dist/routes/redirect.interstitial.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect.interstitial.test.js","sourceRoot":"","sources":["../../src/routes/redirect.interstitial.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACtB,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;KAC9C;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,SAAS,GACb,yIAAyI,CAAC;AAE5I,SAAS,OAAO,CAAC,YAAqC,EAAE;IACtD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,gCAAgC;QACnD,qBAAqB,EAAE,IAAI;QAC3B,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,MAAM;QAClB,cAAc,EAAE,MAAM;QACtB,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,SAAS;QACzB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,kBAAkB,EAAE,IAAI;QACxB,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,IAAI;QACvB,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,IAAI;QACpB,oBAAoB,EAAE,IAAI;QAC1B,eAAe,EAAE,KAAK;QACtB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAmC;IACjD,KAAK,CAAC,SAAS,EAAE,CAAC;IAClB,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC7C,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAChG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAoB,EAAE,EAAE,CACnC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAEtF,IAAI,GAAoB,CAAC;AACzB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,OAAO,EAAE,CAAC;IAChB,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACnC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,iHAAiH,EAAE,KAAK,IAAI,EAAE;QAC/H,MAAM,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qDAAqD,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sDAAsD,CAAC,CAAC;QAEnF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,wDAAwD,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE;sCACF,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;mDACoB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC9E,MAAM,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC9E,KAAK,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;YACzK,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/routes/redirect.launchpad.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=redirect.launchpad.test.d.ts.map

package/dist/routes/redirect.launchpad.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect.launchpad.test.d.ts","sourceRoot":"","sources":["../../src/routes/redirect.launchpad.test.ts"],"names":[],"mappings":""}

package/dist/routes/redirect.launchpad.test.js

@@ -1,515 +0,0 @@
-/**
- * Route-level tests for the launchpad page: when the redirect serves it, what it
- * carries, and — most importantly — when it does not.
- *
- * Follows redirect.no-web-destination.test.ts: the real `redirectRoutes` plugin
- * through `fastify.inject()`, only the data layer mocked.
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import Fastify from 'fastify';
-import { redirectRoutes } from './redirect.js';
-const query = vi.fn();
-vi.mock('../lib/database.js', () => ({
-    db: {
-        query: (...args) => query(...args),
-    },
-}));
-const DESKTOP_UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36';
-const IPHONE_UA = 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1';
-const ANDROID_UA = 'Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Mobile Safari/537.36';
-/** Facebook's iOS in-app browser: Universal Links do not fire here. */
-const FB_IOS_UA = 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [FBAN/FBIOS;FBAV/450.0.0.0.0]';
-function linkRow(overrides = {}) {
-    return {
-        id: '00000000-0000-0000-0000-0000000000aa',
-        short_code: 'abc123',
-        title: null,
-        description: null,
-        og_title: null,
-        og_description: null,
-        og_image_url: null,
-        original_url: null,
-        web_fallback_url: null,
-        ios_app_store_url: 'https://apps.apple.com/app/id1',
-        android_app_store_url: 'https://play.google.com/store/apps/details?id=demo',
-        ios_universal_link: null,
-        android_app_link: null,
-        app_scheme: null,
-        deep_link_path: null,
-        launchpad_mode: 'inherit',
-        is_active: true,
-        warn_at: null,
-        owner_suspended_at: null,
-        expires_at: null,
-        targeting_rules: null,
-        template_settings: null,
-        org_settings: null,
-        utm_parameters: null,
-        deep_link_parameters: null,
-        append_click_id: false,
-        ...overrides,
-    };
-}
-function mockDb(row) {
-    query.mockReset();
-    query.mockImplementation(async (sql) => {
-        if (/information_schema\.columns/i.test(sql)) {
-            return { rows: [{ '?column?': 1 }], rowCount: 1 };
-        }
-        if (/^\s*SELECT\s+l\.\*/i.test(sql) || /FROM links l/i.test(sql)) {
-            return { rows: row ? [row] : [], rowCount: row ? 1 : 0 };
-        }
-        return { rows: [], rowCount: 0 };
-    });
-}
-const get = (app, ua, url = '/abc123') => app.inject({ method: 'GET', url, headers: { 'user-agent': ua, host: 'go.example' } });
-async function build(options = {}) {
-    const app = Fastify();
-    await app.register(redirectRoutes, options);
-    await app.ready();
-    return app;
-}
-let app;
-beforeEach(async () => {
-    app = await build();
-});
-afterEach(async () => {
-    await new Promise((r) => setImmediate(r));
-    await app.close();
-});
-describe('launchpad page — when it is served', () => {
-    it('replaces the plain page for a desktop visitor to a link with no web destination', async () => {
-        mockDb(linkRow({ og_title: 'Example App', og_description: 'A short description of the app' }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.headers['content-type']).toMatch(/text\/html/);
-        expect(res.headers['x-robots-tag']).toBe('noindex, nofollow');
-        expect(res.headers['cache-control']).toBe('no-store');
-        expect(res.headers['content-security-policy']).toMatch(/^default-src 'none'; .*script-src 'nonce-[A-Za-z0-9+/=]+'/);
-        expect(res.body).toContain('<h1>Example App</h1>');
-        expect(res.body).toContain('A short description of the app');
-        expect(res.body).toContain('Download on the App Store');
-        expect(res.body).toContain('Get it on Google Play');
-        expect(res.body).toContain('/api/links/00000000-0000-0000-0000-0000000000aa/qr?format=svg&amp;size=264&amp;url=http%3A%2F%2Fgo.example%2Fabc123"');
-        expect(res.body).toContain('<meta property="og:url" content="http://go.example/abc123">');
-        expect(res.body).not.toContain('This link opens in an app');
-    });
-    it('never attempts a scheme open on desktop, and ships no script when nothing needs one', async () => {
-        mockDb(linkRow({ app_scheme: 'demo', deep_link_path: '/p/1' }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).not.toContain('Open in app');
-        expect(res.body).not.toContain('<script');
-    });
-    it('keeps the 302 for a link with a destination when nobody opted in', async () => {
-        mockDb(linkRow({ web_fallback_url: 'https://example.com/page' }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(302);
-        expect(res.headers.location).toBe('https://example.com/page');
-    });
-    it("serves the page in front of a destination when the workspace chose 'always'", async () => {
-        mockDb(linkRow({ web_fallback_url: 'https://example.com/page', org_settings: { launchpad: { desktop: 'always' } } }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('class="lp"');
-    });
-    it("under 'always' the page links to the destination the 302 would have used", async () => {
-        mockDb(linkRow({ web_fallback_url: 'https://example.com/page', org_settings: { launchpad: { desktop: 'always' } } }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.body).toContain('href="https://example.com/page">Continue on the web</a>');
-        mockDb(linkRow({ original_url: 'https://example.com/original', org_settings: { launchpad: { desktop: 'always' } } }));
-        const original = await get(app, DESKTOP_UA);
-        expect(original.body).toContain('href="https://example.com/original">Continue on the web</a>');
-    });
-    it('the web link carries the same UTMs, deep-link params and click id the 302 would have', async () => {
-        mockDb(linkRow({
-            web_fallback_url: 'https://example.com/page',
-            utm_parameters: { source: 'newsletter', medium: 'email' },
-            deep_link_parameters: { ref: 'abc' },
-            append_click_id: true,
-            org_settings: { launchpad: { desktop: 'always' } },
-        }));
-        const res = await get(app, DESKTOP_UA);
-        const href = /data-lp-cta="cta_web" href="([^"]+)"/.exec(res.body)?.[1]?.replace(/&amp;/g, '&');
-        expect(href).toBeDefined();
-        const url = new URL(href);
-        expect(url.origin + url.pathname).toBe('https://example.com/page');
-        expect(url.searchParams.get('utm_source')).toBe('newsletter');
-        expect(url.searchParams.get('utm_medium')).toBe('email');
-        expect(url.searchParams.get('ref')).toBe('abc');
-        expect(url.searchParams.get('lf_click')).toMatch(/^[0-9a-f-]{36}$/);
-    });
-    it('has no web link when the link has no web destination', async () => {
-        mockDb(linkRow());
-        expect((await get(app, DESKTOP_UA)).body).not.toContain('Continue on the web');
-    });
-    it("a link set to 'off' wins over a workspace set to 'always'", async () => {
-        mockDb(linkRow({
-            web_fallback_url: 'https://example.com/page',
-            launchpad_mode: 'off',
-            org_settings: { launchpad: { desktop: 'always' } },
-        }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(302);
-    });
-    it("a link set to 'on' wins over the workspace default", async () => {
-        mockDb(linkRow({ web_fallback_url: 'https://example.com/page', launchpad_mode: 'on' }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('class="lp"');
-    });
-    it("a workspace set to 'off' gets the plain page for a link with no destination", async () => {
-        mockDb(linkRow({ org_settings: { launchpad: { desktop: 'off' } } }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('This link opens in an app');
-        expect(res.body).not.toContain('class="lp"');
-    });
-    it('treats a cached row from before the column existed as inherit', async () => {
-        const row = linkRow();
-        delete row.launchpad_mode;
-        mockDb(row);
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('class="lp"');
-    });
-    it('uses the template slug in og:url for a templated short link', async () => {
-        mockDb(linkRow());
-        const res = await get(app, DESKTOP_UA, '/promo/abc123');
-        expect(res.body).toContain('<meta property="og:url" content="http://go.example/promo/abc123">');
-    });
-    it('hands the visitor\'s host, template path and query string to the QR code', async () => {
-        mockDb(linkRow());
-        const res = await get(app, DESKTOP_UA, '/promo/abc123?utm_source=poster&product=42');
-        expect(res.body).toContain('&amp;url=http%3A%2F%2Fgo.example%2Fpromo%2Fabc123%3Futm_source%3Dposter%26product%3D42"');
-        expect(res.body).toContain('og:url" content="http://go.example/promo/abc123?utm_source=poster&amp;product=42"');
-    });
-    it('drops a query string too long to fit a scannable code', async () => {
-        mockDb(linkRow());
-        const res = await get(app, DESKTOP_UA, '/abc123?x=' + 'a'.repeat(600));
-        expect(res.body).toContain('&amp;url=http%3A%2F%2Fgo.example%2Fabc123"');
-    });
-});
-describe('launchpad page — what does not change', () => {
-    it('leaves an iPhone visitor on the store redirect', async () => {
-        mockDb(linkRow());
-        const res = await get(app, IPHONE_UA);
-        expect(res.statusCode).toBe(302);
-        expect(res.headers.location).toBe('https://apps.apple.com/app/id1');
-    });
-    it("leaves an iPhone visitor on the store redirect even under 'always'", async () => {
-        mockDb(linkRow({ org_settings: { launchpad: { desktop: 'always' } } }));
-        const res = await get(app, IPHONE_UA);
-        expect(res.statusCode).toBe(302);
-    });
-    it('leaves an iPhone visitor on the scheme interstitial when the link has a scheme', async () => {
-        mockDb(linkRow({ app_scheme: 'demo', deep_link_path: '/p/1' }));
-        const res = await get(app, IPHONE_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('Opening');
-        expect(res.body).not.toContain('class="lp"');
-    });
-    it('still 404s an unknown short code', async () => {
-        mockDb(null);
-        expect((await get(app, DESKTOP_UA)).statusCode).toBe(404);
-    });
-    it('still records the click', async () => {
-        mockDb(linkRow());
-        await get(app, DESKTOP_UA);
-        await new Promise((r) => setImmediate(r));
-        expect(query.mock.calls.some(([sql]) => /INSERT INTO click_events/i.test(String(sql)))).toBe(true);
-    });
-});
-describe('launchpad page — content and escaping', () => {
-    it('escapes a title and an image URL carrying HTML', async () => {
-        mockDb(linkRow({ og_title: `<script>alert("xss")</script>`, og_image_url: 'https://cdn.example/a.png?x="y"' }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.body).not.toContain('<script>alert');
-        expect(res.body).toContain('&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;');
-        expect(res.body).toContain('content="https://cdn.example/a.png?x=&quot;y&quot;"');
-        expect(res.body).toContain('src="https://cdn.example/a.png?x=&quot;y&quot;"');
-    });
-    it('applies the workspace theme', async () => {
-        mockDb(linkRow({
-            org_settings: { launchpad: { appName: 'Demo App', appIconUrl: 'https://cdn.example/icon.png', accentColor: '#0f766e' } },
-        }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.body).toContain('<span>Demo App</span>');
-        expect(res.body).toContain('<img src="https://cdn.example/icon.png" alt="" width="48" height="48">');
-        expect(res.body).toContain('--lp-accent: #0f766e;');
-    });
-});
-describe('launchpad page — host hooks', () => {
-    it('inserts heroHtml from resolveContent and keeps the rest of the frame', async () => {
-        await app.close();
-        app = await build({
-            launchpad: {
-                resolveContent: async (link, settings) => ({
-                    title: `Resolved ${link.short_code}`,
-                    description: 'from the host',
-                    imageUrl: null,
-                    heroHtml: `<div class="host-hero">${settings.templateId ?? 'default'}</div>`,
-                    theme: {},
-                }),
-            },
-        });
-        mockDb(linkRow({ org_settings: { launchpad: { templateId: 'hero' } } }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('<div class="host-hero">hero</div>');
-        expect(res.body).toContain('<title>Resolved abc123</title>');
-        expect(res.body).toContain('Download on the App Store');
-    });
-    it('hands resolveContent the decorated web destination, so a host hero can link its title', async () => {
-        await app.close();
-        const seen = [];
-        app = await build({
-            launchpad: {
-                resolveContent: async (_link, _settings, context) => {
-                    seen.push(context);
-                    return null;
-                },
-            },
-        });
-        mockDb(linkRow({
-            web_fallback_url: 'https://example.com/e',
-            deep_link_parameters: { id: '42' },
-            org_settings: { launchpad: { desktop: 'always' } },
-        }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(seen).toHaveLength(1);
-        const { webUrl } = seen[0];
-        expect(new URL(webUrl).origin + new URL(webUrl).pathname).toBe('https://example.com/e');
-        expect(new URL(webUrl).searchParams.get('id')).toBe('42');
-    });
-    it('links the header to the workspace app website from the settings', async () => {
-        mockDb(linkRow({
-            org_settings: { launchpad: { appName: 'Demo App', appWebsiteUrl: 'https://demo.example' } },
-        }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('<a class="lp-app-link" data-lp-cta="cta_app_website" href="https://demo.example">');
-    });
-    it('falls back to the default content when resolveContent throws or returns null', async () => {
-        await app.close();
-        let calls = 0;
-        app = await build({
-            launchpad: {
-                resolveContent: async () => {
-                    calls++;
-                    if (calls === 1)
-                        throw new Error('boom');
-                    return null;
-                },
-            },
-        });
-        mockDb(linkRow({ og_title: 'Default title' }));
-        const thrown = await get(app, DESKTOP_UA);
-        expect(thrown.statusCode).toBe(200);
-        expect(thrown.body).toContain('<h1>Default title</h1>');
-        const nulled = await get(app, DESKTOP_UA);
-        expect(nulled.statusCode).toBe(200);
-        expect(nulled.body).toContain('<h1>Default title</h1>');
-        expect(calls).toBe(2);
-    });
-    it('emits beacons only when a beacon URL is configured, and admits its origin in the CSP', async () => {
-        mockDb(linkRow());
-        const silent = await get(app, DESKTOP_UA);
-        expect(silent.body).not.toContain('sendBeacon');
-        await app.close();
-        app = await build({ launchpad: { beaconUrl: 'https://events.example/v1/launchpad' } });
-        mockDb(linkRow());
-        const res = await get(app, DESKTOP_UA);
-        expect(res.body.match(/navigator\.sendBeacon\(/g)).toHaveLength(1);
-        expect(res.body).toContain('data-lp-cta="cta_ios"');
-        expect(res.body).toContain('data-lp-cta="cta_android"');
-        expect(res.headers['content-security-policy']).toContain("connect-src 'self' https://events.example");
-    });
-});
-describe('launchpad page — mobile mode', () => {
-    const pageMode = { launchpad: { mobile: 'page' } };
-    it("serves the page to an iPhone with a scheme: 'Open in app' is a button, nothing navigates", async () => {
-        mockDb(linkRow({ app_scheme: 'demo', deep_link_path: '/p/1', deep_link_parameters: { x: '1' }, org_settings: pageMode }));
-        const res = await get(app, IPHONE_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.headers['content-security-policy']).toMatch(/script-src 'nonce-/);
-        expect(res.body).toContain('class="lp"');
-        expect(res.body).toContain('id="lp-open"');
-        expect(res.body).toContain('data-scheme="demo://p/1?x=1"');
-        expect(res.body).toContain('href="demo://p/1?x=1"');
-        expect(res.body).toContain('window.location.hash');
-        expect(res.body).not.toContain('setTimeout');
-        expect(res.body).not.toContain('location.replace');
-        expect(res.body).not.toContain('Opening');
-    });
-    it('shows only the visitor\'s own store, and no QR block', async () => {
-        mockDb(linkRow({ org_settings: pageMode }));
-        const iphone = await get(app, IPHONE_UA);
-        expect(iphone.body).toContain('Download on the App Store');
-        expect(iphone.body).not.toContain('Get it on Google Play');
-        expect(iphone.body).not.toContain('class="lp-qr"');
-        mockDb(linkRow({ org_settings: pageMode }));
-        const android = await get(app, ANDROID_UA);
-        expect(android.body).toContain('Get it on Google Play');
-        expect(android.body).not.toContain('Download on the App Store');
-    });
-    it('serves the page without an Open button when the link has no scheme', async () => {
-        mockDb(linkRow({ org_settings: pageMode }));
-        const res = await get(app, IPHONE_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('class="lp"');
-        expect(res.body).not.toContain('id="lp-open"');
-        expect(res.body).not.toContain('<script');
-    });
-    it('keeps the 302 to a Universal Link / App Link — the OS owns the installed case', async () => {
-        mockDb(linkRow({ ios_universal_link: 'https://app.example/p/1', org_settings: pageMode }));
-        const ios = await get(app, IPHONE_UA);
-        expect(ios.statusCode).toBe(302);
-        expect(ios.headers.location).toBe('https://app.example/p/1');
-        mockDb(linkRow({ android_app_link: 'https://app.example/p/1', org_settings: pageMode }));
-        const android = await get(app, ANDROID_UA);
-        expect(android.statusCode).toBe(302);
-    });
-    it('a Universal Link for iOS does not stop the page on Android', async () => {
-        mockDb(linkRow({ ios_universal_link: 'https://app.example/p/1', org_settings: pageMode }));
-        const android = await get(app, ANDROID_UA);
-        expect(android.statusCode).toBe(200);
-        expect(android.body).toContain('class="lp"');
-    });
-    it('serves the page inside an in-app browser, where a bare scheme redirect fails silently', async () => {
-        mockDb(linkRow({ app_scheme: 'demo', deep_link_path: '/p/1', web_fallback_url: 'https://example.com/p/1', org_settings: pageMode }));
-        const res = await get(app, FB_IOS_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('id="lp-open"');
-    });
-    /**
-     * In-app browsers bypass Universal Links, so the store redirect that a regular
-     * browser gets would send someone who has the app to the store. The redirect
-     * path handles that by preferring the web fallback there (pickMobileFallbackUrl),
-     * which gives the OS a second chance to open the app on the next hop. In page
-     * mode that hop must still exist — as a link.
-     */
-    it('keeps the web fallback reachable from the page, so the Universal Link second chance survives', async () => {
-        mockDb(linkRow({ web_fallback_url: 'https://app.example/p/1', org_settings: pageMode }));
-        const inApp = await get(app, FB_IOS_UA);
-        expect(inApp.statusCode).toBe(200);
-        expect(inApp.body).toContain('href="https://app.example/p/1">Continue on the web</a>');
-        expect(inApp.body).toContain('Download on the App Store');
-        // Store mode is untouched either way: regular browser → store, in-app browser → web fallback.
-        mockDb(linkRow({ web_fallback_url: 'https://app.example/p/1' }));
-        const safari = await get(app, IPHONE_UA);
-        expect(safari.statusCode).toBe(302);
-        expect(safari.headers.location).toBe('https://apps.apple.com/app/id1');
-        mockDb(linkRow({ web_fallback_url: 'https://app.example/p/1' }));
-        const fb = await get(app, FB_IOS_UA);
-        expect(fb.statusCode).toBe(302);
-        expect(fb.headers.location).toBe('https://app.example/p/1');
-    });
-    it("a link set to 'off' keeps the store behaviour under 'page'", async () => {
-        mockDb(linkRow({ launchpad_mode: 'off', org_settings: pageMode }));
-        const res = await get(app, IPHONE_UA);
-        expect(res.statusCode).toBe(302);
-        expect(res.headers.location).toBe('https://apps.apple.com/app/id1');
-    });
-    it("a link set to 'on' does not force the page onto a workspace that chose 'store'", async () => {
-        mockDb(linkRow({ launchpad_mode: 'on' }));
-        const res = await get(app, IPHONE_UA);
-        expect(res.statusCode).toBe(302);
-    });
-    it("'store' and an absent setting produce the same interstitial, byte for byte", async () => {
-        const row = { app_scheme: 'demo', deep_link_path: '/p/1', deep_link_parameters: { x: '1', y: 'two words' } };
-        mockDb(linkRow(row));
-        const absent = await get(app, IPHONE_UA);
-        mockDb(linkRow({ ...row, org_settings: { launchpad: { mobile: 'store' } } }));
-        const explicit = await get(app, IPHONE_UA);
-        expect(absent.statusCode).toBe(200);
-        expect(absent.body).toContain('Opening');
-        expect(absent.body).toContain('setTimeout');
-        expect(absent.body).toContain('id="open-btn" href="demo://p/1?x=1&amp;y=two+words"');
-        expect(absent.body).not.toContain('class="lp"');
-        expect(explicit.body).toBe(absent.body);
-        expect(explicit.headers['content-type']).toBe(absent.headers['content-type']);
-    });
-    it('page mode changes nothing on desktop', async () => {
-        mockDb(linkRow({ web_fallback_url: 'https://example.com/page', org_settings: pageMode }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(302);
-    });
-});
-describe('launchpad page — instance defaults (linkforty.config.json)', () => {
-    /** The page carries a fresh nonce per response; everything else must match. */
-    const withoutNonce = (html) => html.replace(/nonce-[A-Za-z0-9+/=]+|nonce="[A-Za-z0-9+/=]+"/g, 'nonce');
-    it('changes nothing when there are no defaults', async () => {
-        const rows = [
-            linkRow({ og_title: 'Example App' }),
-            linkRow({ org_settings: { launchpad: { appName: 'Demo App', accentColor: '#0f766e', desktop: 'always' } }, web_fallback_url: 'https://example.com/page' }),
-        ];
-        const withEmpty = await build({ launchpad: { defaults: {} } });
-        try {
-            for (const row of rows) {
-                for (const ua of [DESKTOP_UA, IPHONE_UA]) {
-                    mockDb(row);
-                    const before = await get(app, ua);
-                    mockDb(row);
-                    const after = await get(withEmpty, ua);
-                    expect(after.statusCode).toBe(before.statusCode);
-                    expect(after.headers.location).toBe(before.headers.location);
-                    expect(withoutNonce(after.body)).toBe(withoutNonce(before.body));
-                }
-            }
-        }
-        finally {
-            await new Promise((r) => setImmediate(r));
-            await withEmpty.close();
-        }
-    });
-    it("serves the page in front of a destination when the instance chose 'always'", async () => {
-        await app.close();
-        app = await build({ launchpad: { defaults: { desktop: 'always' } } });
-        mockDb(linkRow({ web_fallback_url: 'https://example.com/page' }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('class="lp"');
-    });
-    it('themes a link that has no organization', async () => {
-        await app.close();
-        app = await build({ launchpad: { defaults: { appName: 'Instance App', accentColor: '#123456' } } });
-        mockDb(linkRow());
-        const res = await get(app, DESKTOP_UA);
-        expect(res.body).toContain('<span>Instance App</span>');
-        expect(res.body).toContain('--lp-accent: #123456;');
-    });
-    it("lets the organization override per field, keeping the instance's other fields", async () => {
-        await app.close();
-        app = await build({ launchpad: { defaults: { appName: 'Instance App', accentColor: '#123456' } } });
-        mockDb(linkRow({ org_settings: { launchpad: { appName: 'Org App' } } }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.body).toContain('<span>Org App</span>');
-        expect(res.body).not.toContain('Instance App');
-        expect(res.body).toContain('--lp-accent: #123456;');
-    });
-    it("serves the page to an iPhone when the instance chose mobile 'page'", async () => {
-        await app.close();
-        app = await build({ launchpad: { defaults: { mobile: 'page' } } });
-        mockDb(linkRow());
-        const res = await get(app, IPHONE_UA);
-        expect(res.statusCode).toBe(200);
-        expect(res.body).toContain('class="lp"');
-    });
-    it("a link set to 'off' still wins over an instance set to 'always'", async () => {
-        await app.close();
-        app = await build({ launchpad: { defaults: { desktop: 'always' } } });
-        mockDb(linkRow({ web_fallback_url: 'https://example.com/page', launchpad_mode: 'off' }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(302);
-    });
-    it("an organization set to 'off' wins over an instance set to 'always'", async () => {
-        await app.close();
-        app = await build({ launchpad: { defaults: { desktop: 'always' } } });
-        mockDb(linkRow({ web_fallback_url: 'https://example.com/page', org_settings: { launchpad: { desktop: 'off' } } }));
-        const res = await get(app, DESKTOP_UA);
-        expect(res.statusCode).toBe(302);
-    });
-});
-//# sourceMappingURL=redirect.launchpad.test.js.map