@clerk/electron 0.0.1-snapshot.v20260617204522

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clerk, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,254 @@
+<p align="center">
+  <a href="https://clerk.com?utm_source=github&utm_medium=clerk_electron" target="_blank" rel="noopener noreferrer">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://images.clerk.com/static/logo-dark-mode-400x400.png">
+      <img src="https://images.clerk.com/static/logo-light-mode-400x400.png" height="64">
+    </picture>
+  </a>
+  <br />
+  <h1 align="center">@clerk/electron</h1>
+</p>
+
+<div align="center">
+
+[![Clerk documentation](https://img.shields.io/badge/documentation-clerk-green.svg)](https://clerk.com/docs?utm_source=github&utm_medium=clerk_electron)
+[![Follow on X](https://img.shields.io/twitter/follow/clerk?style=social)](https://x.com/intent/follow?screen_name=clerk)
+
+[Changelog](https://github.com/clerk/javascript/blob/main/packages/electron/CHANGELOG.md)
+·
+[Report a Bug](https://github.com/clerk/javascript/issues/new?assignees=&labels=needs-triage&projects=&template=BUG_REPORT.yml)
+·
+[Request a Feature](https://feedback.clerk.com/roadmap)
+·
+[Get help](https://clerk.com/contact/support?utm_source=github&utm_medium=clerk_electron)
+
+</div>
+
+## Getting Started
+
+[Clerk](https://clerk.com/?utm_source=github&utm_medium=clerk_electron) is the easiest way to add authentication and user management to your Electron application.
+
+> [!WARNING]
+> `@clerk/electron` is under active development and is not yet ready for production use. The API is incomplete and subject to change.
+
+This package exposes entrypoints for Electron's distinct runtime contexts:
+
+- `@clerk/electron` — for use in the Electron **main** process.
+- `@clerk/electron/preload` — for use in Electron **preload** scripts.
+- `@clerk/electron/react` — for use in the Electron **renderer** process.
+- `@clerk/electron/storage` — default token storage backed by `electron-store`.
+- `@clerk/electron/passkeys` — passkey (WebAuthn) support for the **renderer** process.
+
+```ts
+// main.ts
+import { app, BrowserWindow, net, protocol } from 'electron';
+import { createClerkBridge } from '@clerk/electron';
+import { storage } from '@clerk/electron/storage';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+createClerkBridge({
+  storage: storage(),
+  renderer: {
+    scheme: 'my-app',
+    host: 'renderer',
+  },
+  passkeys: true,
+});
+
+app.whenReady().then(() => {
+  protocol.handle('my-app', request => {
+    const url = new URL(request.url);
+    const file = url.pathname === '/' ? 'index.html' : url.pathname;
+
+    return net.fetch(pathToFileURL(join(__dirname, '../renderer', file)).toString());
+  });
+
+  const win = new BrowserWindow({
+    webPreferences: {
+      preload: join(__dirname, '../preload/index.js'),
+    },
+  });
+
+  win.loadURL('my-app://renderer/');
+});
+```
+
+In `my-app://renderer/sign-in`, `my-app` is the scheme, `renderer` is the host, `my-app://renderer` is the origin, and `/sign-in` is the path. If your renderer uses path-based routing, serve every route from the same origin and fall back to your renderer entrypoint as needed.
+
+```ts
+// preload.ts
+import { exposeClerkBridge } from '@clerk/electron/preload';
+
+exposeClerkBridge({ passkeys: true });
+```
+
+```tsx
+// renderer.tsx
+import { ClerkProvider } from '@clerk/electron/react';
+import { passkeys } from '@clerk/electron/passkeys';
+
+<ClerkProvider
+  publishableKey={import.meta.env.VITE_CLERK_PUBLISHABLE_KEY}
+  passkeys={passkeys}
+>
+  {/* ... */}
+</ClerkProvider>;
+```
+
+## Content Security Policy
+
+`@clerk/electron` loads Clerk's prebuilt UI from Clerk's CDN at runtime rather than bundling it, so your renderer's Content Security Policy must allow Clerk's Frontend API host. If it doesn't, the UI script fails to load and Clerk components never render.
+
+Replace `{fapi_host}` below with your instance's **Frontend API** host, found in the [Clerk Dashboard](https://dashboard.clerk.com) under **API keys**. It includes a `clerk.` segment (for example, `clerk.your-app.com` in production or `your-slug.clerk.accounts.dev` in development). This is _not_ the Account Portal URL (`your-slug.accounts.dev`) — using that host blocks the UI script from loading.
+
+```
+default-src 'self';
+script-src 'self' 'unsafe-inline' https://{fapi_host} https://challenges.cloudflare.com;
+connect-src 'self' https://{fapi_host};
+img-src 'self' https://img.clerk.com data:;
+style-src 'self' 'unsafe-inline';
+worker-src 'self' blob:;
+frame-src 'self' https://challenges.cloudflare.com;
+form-action 'self';
+```
+
+> [!NOTE]
+> This covers sign-in/up and the hotloaded UI. If you use Clerk Billing (Stripe) or other features, you'll need to allow additional origins; see Clerk's [CSP guide](https://clerk.com/docs/guides/secure/best-practices/csp-headers) for the full list.
+
+Apply it either with a `<meta>` tag in your renderer HTML:
+
+```html
+<meta
+  http-equiv="Content-Security-Policy"
+  content="default-src 'self'; script-src 'self' 'unsafe-inline' https://{fapi_host} https://challenges.cloudflare.com; connect-src 'self' https://{fapi_host}; img-src 'self' https://img.clerk.com data:; style-src 'self' 'unsafe-inline'; worker-src 'self' blob:; frame-src 'self' https://challenges.cloudflare.com; form-action 'self';"
+/>
+```
+
+or, as [Electron's security guide](https://www.electronjs.org/docs/latest/tutorial/security#7-define-a-content-security-policy) recommends, as a response header from the main process:
+
+```ts
+// main.ts
+import { app, session } from 'electron';
+
+const fapiHost = 'clerk.your-app.com';
+
+app.whenReady().then(() => {
+  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
+    callback({
+      responseHeaders: {
+        ...details.responseHeaders,
+        'Content-Security-Policy': [
+          [
+            "default-src 'self'",
+            `script-src 'self' 'unsafe-inline' https://${fapiHost} https://challenges.cloudflare.com`,
+            `connect-src 'self' https://${fapiHost}`,
+            "img-src 'self' https://img.clerk.com data:",
+            "style-src 'self' 'unsafe-inline'",
+            "worker-src 'self' blob:",
+            "frame-src 'self' https://challenges.cloudflare.com",
+            "form-action 'self'",
+          ].join('; '),
+        ],
+      },
+    });
+  });
+});
+```
+
+> [!NOTE]
+> Loading the renderer from a dev server (such as Vite) requires looser rules for HMR: add `'unsafe-eval'` to `script-src` and your dev server's origin to `connect-src` (for example, `ws://localhost:<port> http://localhost:<port>`). Many apps skip CSP during development and apply it only to packaged builds.
+
+## Passkeys
+
+Passkey support works in two modes, selected automatically per request:
+
+- **Renderer mode** — when your window loads content over `https://` from an origin that matches your passkey RP ID, the renderer's built-in Chromium WebAuthn is used. Credentials are synced by the OS/browser ecosystem (Windows Hello works out of the box; Touch ID on macOS requires Electron ≥ 42 and [`app.configureWebAuthn`](https://www.electronjs.org/docs/latest/api/app#appconfigurewebauthnoptions-macos)).
+- **Native mode** — when your window loads a local bundle (`file://` or a custom protocol), WebAuthn's origin checks reject the request, so the ceremony is routed over IPC to the main process and serviced by the OS WebAuthn APIs (AuthenticationServices on macOS, `webauthn.dll` on Windows) via the optional [`@clerk/electron-passkeys`](https://github.com/clerk/javascript/tree/main/packages/electron-passkeys) native module.
+
+### Setup
+
+Native mode requires the optional native module:
+
+```sh
+pnpm add @clerk/electron-passkeys
+```
+
+```ts
+// main process
+import { createClerkBridge } from '@clerk/electron';
+import { storage } from '@clerk/electron/storage';
+
+createClerkBridge({ storage: storage(), passkeys: true });
+```
+
+```ts
+// preload script
+import { exposeClerkBridge } from '@clerk/electron/preload';
+
+exposeClerkBridge({ passkeys: true });
+```
+
+```tsx
+// renderer process (React)
+import { ClerkProvider } from '@clerk/electron/react';
+import { passkeys } from '@clerk/electron/passkeys';
+
+<ClerkProvider
+  publishableKey={publishableKey}
+  passkeys={passkeys}
+>
+  {/* ... */}
+</ClerkProvider>;
+```
+
+Passkey code is only bundled and initialized when you pass the `passkeys` prop. If you manage the Clerk instance yourself instead of using `ClerkProvider`, wire it up before `clerk.load()`:
+
+```ts
+// renderer process (vanilla)
+import { Clerk } from '@clerk/clerk-js';
+import { createPasskeyProvider } from '@clerk/electron/passkeys';
+
+const clerk = new Clerk(publishableKey);
+createPasskeyProvider(clerk);
+await clerk.load();
+```
+
+### macOS requirements for native mode
+
+Like passkeys on iOS, the macOS platform APIs require a verified association between your app and your domain:
+
+1. Serve an `apple-app-site-association` file from `https://<rp-domain>/.well-known/apple-app-site-association` (https, no redirect, `application/json`) listing your app: `{"webcredentials": {"apps": ["<TEAMID>.<bundle-id>"]}}`. The RP domain must be publicly reachable — Apple's CDN fetches it.
+2. Sign your app with `com.apple.developer.associated-domains` containing `webcredentials:<rp-domain>`. This is a _restricted_ entitlement: the build must embed a provisioning profile with the Associated Domains capability for the bundle ID, and the entitlements must also include `com.apple.application-identifier` and `com.apple.developer.team-identifier` matching the profile.
+
+Hard-won development-build checklist (each of these failure modes produces the same opaque "not associated with domain" error):
+
+- Sign with an **Apple Development** identity (`mac.type: development` in electron-builder) and a **macOS App Development** profile that includes your Mac; also install the profile on the machine (`~/Library/Developer/Xcode/UserData/Provisioning Profiles/<UUID>.provisionprofile`).
+- Copy `.app` bundles with `ditto`, never `cp -R` — `cp` breaks the bundle seal, and macOS silently ignores the entitlements of an app whose signature fails `codesign --verify --deep --strict`.
+- The system registers the domain association via `swcd` when the app launches; verify with `sudo swcutil show`. If state gets stuck, `sudo swcutil reset` and relaunch.
+- Prefer the default (production/CDN) association route. `?mode=developer` + `sudo swcutil developer-mode -e true` exists but is flaky in practice.
+- The system log tells the truth: `log stream --predicate 'process == "swcd" OR composedMessage CONTAINS "your.domain"'` while launching, and look for `taskgated-helper: allowing entitlement(s) ... due to provisioning profile`.
+
+Windows has no equivalent requirement. On Linux there is no native path; passkeys work in renderer mode only (including external security keys).
+
+## Support
+
+For help, visit our [support page](https://clerk.com/contact/support?utm_source=github&utm_medium=clerk_electron).
+
+## Contributing
+
+We're open to all community contributions! If you'd like to contribute in any way, please read [our contribution guidelines](https://github.com/clerk/javascript/blob/main/docs/CONTRIBUTING.md) and [code of conduct](https://github.com/clerk/javascript/blob/main/docs/CODE_OF_CONDUCT.md).
+
+## Security
+
+`@clerk/electron` follows good practices of security, but 100% security cannot be assured.
+
+`@clerk/electron` is provided **"as is"** without any **warranty**. Use at your own risk.
+
+_For more information and to report security issues, please refer to our [security documentation](https://github.com/clerk/javascript/blob/main/docs/SECURITY.md)._
+
+## License
+
+This project is licensed under the **MIT license**.
+
+See [LICENSE](https://github.com/clerk/javascript/blob/main/packages/electron/LICENSE) for more information.

package/dist/cjs/index.js

@@ -0,0 +1,275 @@
+'use strict';
+
+var electron = require('electron');
+
+// src/main/create-clerk-bridge.ts
+
+// src/shared/ipc.ts
+var TOKEN_CACHE_CHANNELS = {
+  getToken: "clerk:token-cache:get",
+  saveToken: "clerk:token-cache:save",
+  clearToken: "clerk:token-cache:clear"
+};
+var OAUTH_TRANSPORT_CHANNELS = {
+  getRedirectUrl: "clerk:oauth-transport:get-redirect-url",
+  open: "clerk:oauth-transport:open"
+};
+var PASSKEY_CHANNELS = {
+  create: "clerk:passkeys:create",
+  get: "clerk:passkeys:get",
+  capabilities: "clerk:passkeys:capabilities"
+};
+
+// src/main/ipc-handlers.ts
+function setupTokenCacheIpcHandlers(storage) {
+  electron.ipcMain.handle(TOKEN_CACHE_CHANNELS.getToken, (_event, key) => {
+    return storage.getItem(key);
+  });
+  electron.ipcMain.handle(TOKEN_CACHE_CHANNELS.saveToken, (_event, key, value) => {
+    return storage.setItem(key, value);
+  });
+  electron.ipcMain.handle(TOKEN_CACHE_CHANNELS.clearToken, (_event, key) => {
+    return storage.removeItem(key);
+  });
+  return () => {
+    electron.ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.getToken);
+    electron.ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.saveToken);
+    electron.ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.clearToken);
+  };
+}
+var CALLBACK_TIMEOUT_MS = 3 * 60 * 1e3;
+function buildRedirectUrl(options) {
+  return `${options.renderer.scheme}://${options.renderer.host}/`;
+}
+function isMatchingCallbackUrl(url, redirectUrl) {
+  try {
+    const callback = new URL(url);
+    const expected = new URL(redirectUrl);
+    return callback.protocol === expected.protocol && callback.host === expected.host && callback.pathname === expected.pathname;
+  } catch {
+    return false;
+  }
+}
+function assertExternalOAuthUrl(url) {
+  const parsedUrl = new URL(url);
+  if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+    throw new TypeError(`Clerk: refusing to open unsupported OAuth URL protocol: ${parsedUrl.protocol}`);
+  }
+}
+function setupOAuthTransportIpcHandlers(options) {
+  const redirectUrl = buildRedirectUrl(options);
+  let pendingOAuthFlow = null;
+  const disposePendingOAuthFlow = (reason) => {
+    if (!pendingOAuthFlow) {
+      return;
+    }
+    const pending = pendingOAuthFlow;
+    clearTimeout(pendingOAuthFlow.timeout);
+    pendingOAuthFlow = null;
+    if (reason) {
+      pending.reject(reason);
+    }
+  };
+  const handleCallbackUrl = (url) => {
+    if (!pendingOAuthFlow || !isMatchingCallbackUrl(url, redirectUrl)) {
+      return;
+    }
+    const pending = pendingOAuthFlow;
+    disposePendingOAuthFlow();
+    pending.resolve({ callbackUrl: url });
+  };
+  const openUrlListener = (event, url) => {
+    if (!isMatchingCallbackUrl(url, redirectUrl)) {
+      return;
+    }
+    event.preventDefault();
+    handleCallbackUrl(url);
+  };
+  const secondInstanceListener = (_event, argv) => {
+    const callbackUrl = argv.find((url) => isMatchingCallbackUrl(url, redirectUrl));
+    if (callbackUrl) {
+      handleCallbackUrl(callbackUrl);
+    }
+  };
+  electron.app.setAsDefaultProtocolClient(options.renderer.scheme);
+  electron.app.on("open-url", openUrlListener);
+  electron.app.on("second-instance", secondInstanceListener);
+  electron.ipcMain.handle(OAUTH_TRANSPORT_CHANNELS.getRedirectUrl, () => {
+    return redirectUrl;
+  });
+  electron.ipcMain.handle(OAUTH_TRANSPORT_CHANNELS.open, async (_event, url) => {
+    if (pendingOAuthFlow) {
+      throw new Error("Clerk: an OAuth flow is already pending.");
+    }
+    assertExternalOAuthUrl(url);
+    const callbackPromise = new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        disposePendingOAuthFlow();
+        reject(new Error("Clerk: OAuth callback timed out."));
+      }, CALLBACK_TIMEOUT_MS);
+      pendingOAuthFlow = { resolve, reject, timeout };
+    });
+    try {
+      await electron.shell.openExternal(url);
+    } catch (err) {
+      disposePendingOAuthFlow(err instanceof Error ? err : new Error(String(err)));
+    }
+    return callbackPromise;
+  });
+  return () => {
+    disposePendingOAuthFlow(new Error("Clerk: OAuth flow was cancelled."));
+    electron.app.removeListener("open-url", openUrlListener);
+    electron.app.removeListener("second-instance", secondInstanceListener);
+    electron.ipcMain.removeHandler(OAUTH_TRANSPORT_CHANNELS.getRedirectUrl);
+    electron.ipcMain.removeHandler(OAUTH_TRANSPORT_CHANNELS.open);
+  };
+}
+var nativeModulePromise;
+function loadNativeModule() {
+  nativeModulePromise != null ? nativeModulePromise : nativeModulePromise = import('@clerk/electron-passkeys').then(
+    (module) => {
+      var _a;
+      return (_a = module.default) != null ? _a : module;
+    },
+    (error) => {
+      nativeModulePromise = void 0;
+      throw new Error(
+        "Clerk: createClerkBridge({ passkeys: true }) requires the optional @clerk/electron-passkeys package. Install it with your package manager to enable native passkey support.",
+        { cause: error }
+      );
+    }
+  );
+  return nativeModulePromise;
+}
+var NATIVE_ERROR_CODES = ["cancelled", "invalid_rp", "not_supported", "timeout", "unknown"];
+function isPasskeyIpcResult(value) {
+  var _a;
+  if (!value || typeof value !== "object" || typeof value.ok !== "boolean") {
+    return false;
+  }
+  const result = value;
+  return result.ok ? result.credential !== void 0 : NATIVE_ERROR_CODES.includes((_a = result.error) == null ? void 0 : _a.code);
+}
+async function invokeNative(method, event, options) {
+  let native;
+  try {
+    native = await loadNativeModule();
+  } catch (error) {
+    return {
+      ok: false,
+      error: { code: "not_supported", message: error instanceof Error ? error.message : String(error) }
+    };
+  }
+  if (!native.isAvailable()) {
+    return {
+      ok: false,
+      error: { code: "not_supported", message: "Native passkeys are not supported on this platform." }
+    };
+  }
+  if (!event.senderFrame || event.senderFrame !== event.sender.mainFrame) {
+    return {
+      ok: false,
+      error: { code: "unknown", message: "The passkey request did not originate from a window's main frame." }
+    };
+  }
+  const window = electron.BrowserWindow.fromWebContents(event.sender);
+  if (!window) {
+    return {
+      ok: false,
+      error: { code: "unknown", message: "The passkey request did not originate from a visible window." }
+    };
+  }
+  try {
+    const resultJson = await native[method](window.getNativeWindowHandle(), JSON.stringify(options));
+    const result = JSON.parse(resultJson);
+    if (!isPasskeyIpcResult(result)) {
+      return { ok: false, error: { code: "unknown", message: "The native module returned an unexpected result." } };
+    }
+    return result;
+  } catch (error) {
+    return { ok: false, error: { code: "unknown", message: error instanceof Error ? error.message : String(error) } };
+  }
+}
+function setupPasskeysMain() {
+  loadNativeModule().catch((error) => console.warn(error.message));
+  electron.ipcMain.handle(
+    PASSKEY_CHANNELS.create,
+    (event, options) => invokeNative("createCredential", event, options)
+  );
+  electron.ipcMain.handle(
+    PASSKEY_CHANNELS.get,
+    (event, options) => invokeNative("getCredential", event, options)
+  );
+  electron.ipcMain.handle(PASSKEY_CHANNELS.capabilities, async () => {
+    try {
+      const native = await loadNativeModule();
+      if (!native.isAvailable()) {
+        return { available: false, platformAuthenticator: false, securityKeys: false };
+      }
+      return { available: true, ...native.capabilities() };
+    } catch {
+      return { available: false, platformAuthenticator: false, securityKeys: false };
+    }
+  });
+  return {
+    cleanup() {
+      electron.ipcMain.removeHandler(PASSKEY_CHANNELS.create);
+      electron.ipcMain.removeHandler(PASSKEY_CHANNELS.get);
+      electron.ipcMain.removeHandler(PASSKEY_CHANNELS.capabilities);
+    }
+  };
+}
+
+// src/main/create-clerk-bridge.ts
+function assertValidRendererOriginConfig(renderer) {
+  if (renderer.scheme.includes(":") || renderer.scheme.includes("/")) {
+    throw new Error(
+      'Clerk: renderer.scheme must be a scheme name like "my-app", not a URL or protocol like "my-app://".'
+    );
+  }
+  if (renderer.host.includes(":") || renderer.host.includes("/")) {
+    throw new Error(
+      'Clerk: renderer.host must be a host name like "renderer", not a URL or origin like "my-app://renderer".'
+    );
+  }
+}
+function createClerkBridge(options) {
+  if (!options.storage) {
+    throw new Error(
+      "Clerk: createClerkBridge requires a storage adapter. Pass createClerkBridge({ storage: storage() }) from @clerk/electron/storage, or provide a custom storage adapter."
+    );
+  }
+  const cleanupTokenPersistence = setupTokenCacheIpcHandlers(options.storage);
+  let cleanupOAuthTransport;
+  const passkeys = options.passkeys ? setupPasskeysMain() : null;
+  if (options.renderer) {
+    assertValidRendererOriginConfig(options.renderer);
+    electron.protocol.registerSchemesAsPrivileged([
+      {
+        scheme: options.renderer.scheme,
+        privileges: {
+          standard: true,
+          secure: true,
+          supportFetchAPI: true,
+          corsEnabled: true,
+          stream: true
+        }
+      }
+    ]);
+    cleanupOAuthTransport = setupOAuthTransportIpcHandlers({
+      renderer: options.renderer
+    });
+  }
+  return {
+    cleanup() {
+      cleanupTokenPersistence();
+      cleanupOAuthTransport == null ? void 0 : cleanupOAuthTransport();
+      passkeys == null ? void 0 : passkeys.cleanup();
+    }
+  };
+}
+
+exports.createClerkBridge = createClerkBridge;
+exports.setupPasskeysMain = setupPasskeysMain;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/shared/ipc.ts","../../src/main/ipc-handlers.ts","../../src/main/oauth-transport.ts","../../src/main/passkey-handlers.ts","../../src/main/create-clerk-bridge.ts"],"names":["ipcMain","app","shell","BrowserWindow","protocol"],"mappings":";;;;;;;AAAO,IAAM,oBAAA,GAAuB;AAAA,EAClC,QAAA,EAAU,uBAAA;AAAA,EACV,SAAA,EAAW,wBAAA;AAAA,EACX,UAAA,EAAY;AACd,CAAA;AAEO,IAAM,wBAAA,GAA2B;AAAA,EACtC,cAAA,EAAgB,wCAAA;AAAA,EAChB,IAAA,EAAM;AACR,CAAA;AAEO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,MAAA,EAAQ,uBAAA;AAAA,EACR,GAAA,EAAK,oBAAA;AAAA,EACL,YAAA,EAAc;AAChB,CAAA;;;ACVO,SAAS,2BAA2B,OAAA,EAAmC;AAC5E,EAAAA,gBAAA,CAAQ,MAAA,CAAO,oBAAA,CAAqB,QAAA,EAAU,CAAC,QAAQ,GAAA,KAAgB;AACrE,IAAA,OAAO,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,EAC5B,CAAC,CAAA;AAED,EAAAA,gBAAA,CAAQ,OAAO,oBAAA,CAAqB,SAAA,EAAW,CAAC,MAAA,EAAQ,KAAa,KAAA,KAAkB;AACrF,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAAA,EACnC,CAAC,CAAA;AAED,EAAAA,gBAAA,CAAQ,MAAA,CAAO,oBAAA,CAAqB,UAAA,EAAY,CAAC,QAAQ,GAAA,KAAgB;AACvE,IAAA,OAAO,OAAA,CAAQ,WAAW,GAAG,CAAA;AAAA,EAC/B,CAAC,CAAA;AAED,EAAA,OAAO,MAAM;AACX,IAAAA,gBAAA,CAAQ,aAAA,CAAc,qBAAqB,QAAQ,CAAA;AACnD,IAAAA,gBAAA,CAAQ,aAAA,CAAc,qBAAqB,SAAS,CAAA;AACpD,IAAAA,gBAAA,CAAQ,aAAA,CAAc,qBAAqB,UAAU,CAAA;AAAA,EACvD,CAAA;AACF;AClBA,IAAM,mBAAA,GAAsB,IAAI,EAAA,GAAK,GAAA;AAYrC,SAAS,iBAAiB,OAAA,EAAwC;AAChE,EAAA,OAAO,GAAG,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,GAAA,EAAM,OAAA,CAAQ,SAAS,IAAI,CAAA,CAAA,CAAA;AAC9D;AAEA,SAAS,qBAAA,CAAsB,KAAa,WAAA,EAA8B;AACxE,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,GAAG,CAAA;AAC5B,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,WAAW,CAAA;AAEpC,IAAA,OACE,QAAA,CAAS,QAAA,KAAa,QAAA,CAAS,QAAA,IAC/B,QAAA,CAAS,SAAS,QAAA,CAAS,IAAA,IAC3B,QAAA,CAAS,QAAA,KAAa,QAAA,CAAS,QAAA;AAAA,EAEnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,uBAAuB,GAAA,EAAmB;AACjD,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAE7B,EAAA,IAAI,SAAA,CAAU,QAAA,KAAa,OAAA,IAAW,SAAA,CAAU,aAAa,QAAA,EAAU;AACrE,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,wDAAA,EAA2D,SAAA,CAAU,QAAQ,CAAA,CAAE,CAAA;AAAA,EACrG;AACF;AAEO,SAAS,+BAA+B,OAAA,EAA4C;AACzF,EAAA,MAAM,WAAA,GAAc,iBAAiB,OAAO,CAAA;AAC5C,EAAA,IAAI,gBAAA,GAA4C,IAAA;AAEhD,EAAA,MAAM,uBAAA,GAA0B,CAAC,MAAA,KAAyB;AACxD,IAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,gBAAA;AAChB,IAAA,YAAA,CAAa,iBAAiB,OAAO,CAAA;AACrC,IAAA,gBAAA,GAAmB,IAAA;AAEnB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,iBAAA,GAAoB,CAAC,GAAA,KAAsB;AAC/C,IAAA,IAAI,CAAC,gBAAA,IAAoB,CAAC,qBAAA,CAAsB,GAAA,EAAK,WAAW,CAAA,EAAG;AACjE,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,gBAAA;AAChB,IAAA,uBAAA,EAAwB;AACxB,IAAA,OAAA,CAAQ,OAAA,CAAQ,EAAE,WAAA,EAAa,GAAA,EAAK,CAAA;AAAA,EACtC,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,KAAA,EAAuB,GAAA,KAAsB;AACpE,IAAA,IAAI,CAAC,qBAAA,CAAsB,GAAA,EAAK,WAAW,CAAA,EAAG;AAC5C,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,cAAA,EAAe;AACrB,IAAA,iBAAA,CAAkB,GAAG,CAAA;AAAA,EACvB,CAAA;AAEA,EAAA,MAAM,sBAAA,GAAyB,CAAC,MAAA,EAAwB,IAAA,KAAyB;AAC/E,IAAA,MAAM,cAAc,IAAA,CAAK,IAAA,CAAK,SAAO,qBAAA,CAAsB,GAAA,EAAK,WAAW,CAAC,CAAA;AAE5E,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,iBAAA,CAAkB,WAAW,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AAEA,EAAAC,YAAA,CAAI,0BAAA,CAA2B,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA;AACtD,EAAAA,YAAA,CAAI,EAAA,CAAG,YAAY,eAAe,CAAA;AAClC,EAAAA,YAAA,CAAI,EAAA,CAAG,mBAAmB,sBAAsB,CAAA;AAEhD,EAAAD,gBAAAA,CAAQ,MAAA,CAAO,wBAAA,CAAyB,cAAA,EAAgB,MAAM;AAC5D,IAAA,OAAO,WAAA;AAAA,EACT,CAAC,CAAA;AAED,EAAAA,iBAAQ,MAAA,CAAO,wBAAA,CAAyB,IAAA,EAAM,OAAO,QAAQ,GAAA,KAAgB;AAC3E,IAAA,IAAI,gBAAA,EAAkB;AACpB,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,sBAAA,CAAuB,GAAG,CAAA;AAE1B,IAAA,MAAM,eAAA,GAAkB,IAAI,OAAA,CAAiC,CAAC,SAAS,MAAA,KAAW;AAChF,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,uBAAA,EAAwB;AACxB,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,kCAAkC,CAAC,CAAA;AAAA,MACtD,GAAG,mBAAmB,CAAA;AAEtB,MAAA,gBAAA,GAAmB,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAQ;AAAA,IAChD,CAAC,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAME,cAAA,CAAM,aAAa,GAAG,CAAA;AAAA,IAC9B,SAAS,GAAA,EAAK;AACZ,MAAA,uBAAA,CAAwB,GAAA,YAAe,QAAQ,GAAA,GAAM,IAAI,MAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,IAC7E;AAEA,IAAA,OAAO,eAAA;AAAA,EACT,CAAC,CAAA;AAED,EAAA,OAAO,MAAM;AACX,IAAA,uBAAA,CAAwB,IAAI,KAAA,CAAM,kCAAkC,CAAC,CAAA;AACrE,IAAAD,YAAA,CAAI,cAAA,CAAe,YAAY,eAAe,CAAA;AAC9C,IAAAA,YAAA,CAAI,cAAA,CAAe,mBAAmB,sBAAsB,CAAA;AAC5D,IAAAD,gBAAAA,CAAQ,aAAA,CAAc,wBAAA,CAAyB,cAAc,CAAA;AAC7D,IAAAA,gBAAAA,CAAQ,aAAA,CAAc,wBAAA,CAAyB,IAAI,CAAA;AAAA,EACrD,CAAA;AACF;ACvGA,IAAI,mBAAA;AAEJ,SAAS,gBAAA,GAAkD;AAEzD,EAAA,mBAAA,IAAA,IAAA,GAAA,mBAAA,GAAA,mBAAA,GAAwB,OAAO,0BAA0B,CAAA,CAAE,IAAA;AAAA,IACzD,CAAC,MAAA,KAAmE;AA/BxE,MAAA,IAAA,EAAA;AA+B2E,MAAA,OAAA,CAAA,EAAA,GAAA,MAAA,CAAO,YAAP,IAAA,GAAA,EAAA,GAAkB,MAAA;AAAA,IAAA,CAAA;AAAA,IACzF,CAAA,KAAA,KAAS;AACP,MAAA,mBAAA,GAAsB,MAAA;AACtB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,6KAAA;AAAA,QACA,EAAE,OAAO,KAAA;AAAM,OACjB;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,mBAAA;AACT;AAEA,IAAM,qBAA+C,CAAC,WAAA,EAAa,YAAA,EAAc,eAAA,EAAiB,WAAW,SAAS,CAAA;AAEtH,SAAS,mBAAsB,KAAA,EAA8C;AA7C7E,EAAA,IAAA,EAAA;AA8CE,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,OAAQ,KAAA,CAA2B,OAAO,SAAA,EAAW;AAC9F,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,OAAO,MAAA,CAAO,EAAA,GACV,MAAA,CAAO,UAAA,KAAe,MAAA,GACtB,mBAAmB,QAAA,CAAA,CAAS,EAAA,GAAA,MAAA,CAAO,KAAA,KAAP,IAAA,GAAA,MAAA,GAAA,EAAA,CAAc,IAA8B,CAAA;AAC9E;AAEA,eAAe,YAAA,CACb,MAAA,EACA,KAAA,EACA,OAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,gBAAA,EAAiB;AAAA,EAClC,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,EAAE,IAAA,EAAM,eAAA,EAAiB,OAAA,EAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAA;AAAE,KAClG;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,WAAA,EAAY,EAAG;AACzB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,EAAE,IAAA,EAAM,eAAA,EAAiB,SAAS,qDAAA;AAAsD,KACjG;AAAA,EACF;AAIA,EAAA,IAAI,CAAC,KAAA,CAAM,WAAA,IAAe,MAAM,WAAA,KAAgB,KAAA,CAAM,OAAO,SAAA,EAAW;AACtE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,SAAS,mEAAA;AAAoE,KACzG;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAASG,sBAAA,CAAc,eAAA,CAAgB,KAAA,CAAM,MAAM,CAAA;AACzD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,SAAS,8DAAA;AAA+D,KACpG;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,MAAM,CAAA,CAAE,MAAA,CAAO,qBAAA,EAAsB,EAAG,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAC/F,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA;AAC7C,IAAA,IAAI,CAAC,kBAAA,CAAsB,MAAM,CAAA,EAAG;AAClC,MAAA,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,kDAAA,EAAmD,EAAE;AAAA,IAC9G;AACA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,GAAE,EAAE;AAAA,EAClH;AACF;AAGO,SAAS,iBAAA,GAA6C;AAE3D,EAAA,gBAAA,EAAiB,CAAE,MAAM,CAAC,KAAA,KAAiB,QAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAC,CAAA;AAEtE,EAAAH,gBAAAA,CAAQ,MAAA;AAAA,IACN,gBAAA,CAAiB,MAAA;AAAA,IACjB,CACE,KAAA,EACA,OAAA,KACwD,YAAA,CAAa,kBAAA,EAAoB,OAAO,OAAO;AAAA,GAC3G;AAEA,EAAAA,gBAAAA,CAAQ,MAAA;AAAA,IACN,gBAAA,CAAiB,GAAA;AAAA,IACjB,CACE,KAAA,EACA,OAAA,KAC0D,YAAA,CAAa,eAAA,EAAiB,OAAO,OAAO;AAAA,GAC1G;AAEA,EAAAA,gBAAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,YAAA,EAAc,YAA0C;AACtF,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,MAAA,IAAI,CAAC,MAAA,CAAO,WAAA,EAAY,EAAG;AACzB,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,qBAAA,EAAuB,KAAA,EAAO,cAAc,KAAA,EAAM;AAAA,MAC/E;AACA,MAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,GAAG,MAAA,CAAO,cAAa,EAAE;AAAA,IACrD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,qBAAA,EAAuB,KAAA,EAAO,cAAc,KAAA,EAAM;AAAA,IAC/E;AAAA,EACF,CAAC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAAA,gBAAAA,CAAQ,aAAA,CAAc,gBAAA,CAAiB,MAAM,CAAA;AAC7C,MAAAA,gBAAAA,CAAQ,aAAA,CAAc,gBAAA,CAAiB,GAAG,CAAA;AAC1C,MAAAA,gBAAAA,CAAQ,aAAA,CAAc,gBAAA,CAAiB,YAAY,CAAA;AAAA,IACrD;AAAA,GACF;AACF;;;AC3IA,SAAS,gCAAgC,QAAA,EAAmE;AAC1G,EAAA,IAAI,QAAA,CAAS,OAAO,QAAA,CAAS,GAAG,KAAK,QAAA,CAAS,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,EAAG;AAClE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,KAAK,QAAA,CAAS,GAAG,KAAK,QAAA,CAAS,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACF;AASO,SAAS,kBAAkB,OAAA,EAAgD;AAChF,EAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,uBAAA,GAA0B,0BAAA,CAA2B,OAAA,CAAQ,OAAO,CAAA;AAC1E,EAAA,IAAI,qBAAA;AACJ,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,GAAW,iBAAA,EAAkB,GAAI,IAAA;AAE1D,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,+BAAA,CAAgC,QAAQ,QAAQ,CAAA;AAEhD,IAAAI,iBAAA,CAAS,2BAAA,CAA4B;AAAA,MACnC;AAAA,QACE,MAAA,EAAQ,QAAQ,QAAA,CAAS,MAAA;AAAA,QACzB,UAAA,EAAY;AAAA,UACV,QAAA,EAAU,IAAA;AAAA,UACV,MAAA,EAAQ,IAAA;AAAA,UACR,eAAA,EAAiB,IAAA;AAAA,UACjB,WAAA,EAAa,IAAA;AAAA,UACb,MAAA,EAAQ;AAAA;AACV;AACF,KACD,CAAA;AAED,IAAA,qBAAA,GAAwB,8BAAA,CAA+B;AAAA,MACrD,UAAU,OAAA,CAAQ;AAAA,KACnB,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,uBAAA,EAAwB;AACxB,MAAA,qBAAA,IAAA,IAAA,GAAA,MAAA,GAAA,qBAAA,EAAA;AACA,MAAA,QAAA,IAAA,IAAA,GAAA,MAAA,GAAA,QAAA,CAAU,OAAA,EAAA;AAAA,IACZ;AAAA,GACF;AACF","file":"index.js","sourcesContent":["export const TOKEN_CACHE_CHANNELS = {\n  getToken: 'clerk:token-cache:get',\n  saveToken: 'clerk:token-cache:save',\n  clearToken: 'clerk:token-cache:clear',\n} as const;\n\nexport const OAUTH_TRANSPORT_CHANNELS = {\n  getRedirectUrl: 'clerk:oauth-transport:get-redirect-url',\n  open: 'clerk:oauth-transport:open',\n} as const;\n\nexport const PASSKEY_CHANNELS = {\n  create: 'clerk:passkeys:create',\n  get: 'clerk:passkeys:get',\n  capabilities: 'clerk:passkeys:capabilities',\n} as const;\n","import { ipcMain } from 'electron';\n\nimport { TOKEN_CACHE_CHANNELS } from '../shared/ipc';\nimport type { TokenStorage } from '../shared/types';\n\nexport function setupTokenCacheIpcHandlers(storage: TokenStorage): () => void {\n  ipcMain.handle(TOKEN_CACHE_CHANNELS.getToken, (_event, key: string) => {\n    return storage.getItem(key);\n  });\n\n  ipcMain.handle(TOKEN_CACHE_CHANNELS.saveToken, (_event, key: string, value: string) => {\n    return storage.setItem(key, value);\n  });\n\n  ipcMain.handle(TOKEN_CACHE_CHANNELS.clearToken, (_event, key: string) => {\n    return storage.removeItem(key);\n  });\n\n  return () => {\n    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.getToken);\n    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.saveToken);\n    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.clearToken);\n  };\n}\n","import { app, ipcMain, shell } from 'electron';\n\nimport { OAUTH_TRANSPORT_CHANNELS } from '../shared/ipc';\nimport type { RendererSchemeOptions } from '../shared/types';\n\nconst CALLBACK_TIMEOUT_MS = 3 * 60 * 1000;\n\ntype PendingOAuthFlow = {\n  resolve: (value: { callbackUrl: string }) => void;\n  reject: (reason: Error) => void;\n  timeout: NodeJS.Timeout;\n};\n\ntype OAuthTransportOptions = {\n  renderer: RendererSchemeOptions;\n};\n\nfunction buildRedirectUrl(options: OAuthTransportOptions): string {\n  return `${options.renderer.scheme}://${options.renderer.host}/`;\n}\n\nfunction isMatchingCallbackUrl(url: string, redirectUrl: string): boolean {\n  try {\n    const callback = new URL(url);\n    const expected = new URL(redirectUrl);\n\n    return (\n      callback.protocol === expected.protocol &&\n      callback.host === expected.host &&\n      callback.pathname === expected.pathname\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction assertExternalOAuthUrl(url: string): void {\n  const parsedUrl = new URL(url);\n\n  if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {\n    throw new TypeError(`Clerk: refusing to open unsupported OAuth URL protocol: ${parsedUrl.protocol}`);\n  }\n}\n\nexport function setupOAuthTransportIpcHandlers(options: OAuthTransportOptions): () => void {\n  const redirectUrl = buildRedirectUrl(options);\n  let pendingOAuthFlow: PendingOAuthFlow | null = null;\n\n  const disposePendingOAuthFlow = (reason?: Error): void => {\n    if (!pendingOAuthFlow) {\n      return;\n    }\n\n    const pending = pendingOAuthFlow;\n    clearTimeout(pendingOAuthFlow.timeout);\n    pendingOAuthFlow = null;\n\n    if (reason) {\n      pending.reject(reason);\n    }\n  };\n\n  const handleCallbackUrl = (url: string): void => {\n    if (!pendingOAuthFlow || !isMatchingCallbackUrl(url, redirectUrl)) {\n      return;\n    }\n\n    const pending = pendingOAuthFlow;\n    disposePendingOAuthFlow();\n    pending.resolve({ callbackUrl: url });\n  };\n\n  const openUrlListener = (event: Electron.Event, url: string): void => {\n    if (!isMatchingCallbackUrl(url, redirectUrl)) {\n      return;\n    }\n\n    event.preventDefault();\n    handleCallbackUrl(url);\n  };\n\n  const secondInstanceListener = (_event: Electron.Event, argv: string[]): void => {\n    const callbackUrl = argv.find(url => isMatchingCallbackUrl(url, redirectUrl));\n\n    if (callbackUrl) {\n      handleCallbackUrl(callbackUrl);\n    }\n  };\n\n  app.setAsDefaultProtocolClient(options.renderer.scheme);\n  app.on('open-url', openUrlListener);\n  app.on('second-instance', secondInstanceListener);\n\n  ipcMain.handle(OAUTH_TRANSPORT_CHANNELS.getRedirectUrl, () => {\n    return redirectUrl;\n  });\n\n  ipcMain.handle(OAUTH_TRANSPORT_CHANNELS.open, async (_event, url: string) => {\n    if (pendingOAuthFlow) {\n      throw new Error('Clerk: an OAuth flow is already pending.');\n    }\n\n    assertExternalOAuthUrl(url);\n\n    const callbackPromise = new Promise<{ callbackUrl: string }>((resolve, reject) => {\n      const timeout = setTimeout(() => {\n        disposePendingOAuthFlow();\n        reject(new Error('Clerk: OAuth callback timed out.'));\n      }, CALLBACK_TIMEOUT_MS);\n\n      pendingOAuthFlow = { resolve, reject, timeout };\n    });\n\n    try {\n      await shell.openExternal(url);\n    } catch (err) {\n      disposePendingOAuthFlow(err instanceof Error ? err : new Error(String(err)));\n    }\n\n    return callbackPromise;\n  });\n\n  return () => {\n    disposePendingOAuthFlow(new Error('Clerk: OAuth flow was cancelled.'));\n    app.removeListener('open-url', openUrlListener);\n    app.removeListener('second-instance', secondInstanceListener);\n    ipcMain.removeHandler(OAUTH_TRANSPORT_CHANNELS.getRedirectUrl);\n    ipcMain.removeHandler(OAUTH_TRANSPORT_CHANNELS.open);\n  };\n}\n","import type { IpcMainInvokeEvent } from 'electron';\nimport { BrowserWindow, ipcMain } from 'electron';\n\nimport { PASSKEY_CHANNELS } from '../shared/ipc';\nimport type {\n  AuthenticationResponseJSON,\n  PasskeyCapabilities,\n  PasskeyIpcResult,\n  PasskeyNativeErrorCode,\n  RegistrationResponseJSON,\n  SerializedPublicKeyCredentialCreationOptions,\n  SerializedPublicKeyCredentialRequestOptions,\n  SetupPasskeysMainReturn,\n} from '../shared/types';\n\n/**\n * Optional native module. Ceremony failures resolve as JSON envelopes so error\n * codes survive both the FFI and Electron IPC boundaries.\n */\ntype NativePasskeysModule = {\n  isAvailable: () => boolean;\n  capabilities: () => Omit<PasskeyCapabilities, 'available'>;\n  createCredential: (windowHandle: Buffer, optionsJson: string) => Promise<string>;\n  getCredential: (windowHandle: Buffer, optionsJson: string) => Promise<string>;\n};\n\nlet nativeModulePromise: Promise<NativePasskeysModule> | undefined;\n\nfunction loadNativeModule(): Promise<NativePasskeysModule> {\n  // Keep the native module optional for apps that do not use passkeys.\n  nativeModulePromise ??= import('@clerk/electron-passkeys').then(\n    (module: { default?: NativePasskeysModule } & NativePasskeysModule) => module.default ?? module,\n    error => {\n      nativeModulePromise = undefined;\n      throw new Error(\n        'Clerk: createClerkBridge({ passkeys: true }) requires the optional @clerk/electron-passkeys package. Install it with your package manager to enable native passkey support.',\n        { cause: error },\n      );\n    },\n  );\n  return nativeModulePromise;\n}\n\nconst NATIVE_ERROR_CODES: PasskeyNativeErrorCode[] = ['cancelled', 'invalid_rp', 'not_supported', 'timeout', 'unknown'];\n\nfunction isPasskeyIpcResult<T>(value: unknown): value is PasskeyIpcResult<T> {\n  if (!value || typeof value !== 'object' || typeof (value as { ok?: unknown }).ok !== 'boolean') {\n    return false;\n  }\n  const result = value as { ok: boolean; credential?: unknown; error?: { code?: unknown } };\n  return result.ok\n    ? result.credential !== undefined\n    : NATIVE_ERROR_CODES.includes(result.error?.code as PasskeyNativeErrorCode);\n}\n\nasync function invokeNative<T>(\n  method: 'createCredential' | 'getCredential',\n  event: IpcMainInvokeEvent,\n  options: SerializedPublicKeyCredentialCreationOptions | SerializedPublicKeyCredentialRequestOptions,\n): Promise<PasskeyIpcResult<T>> {\n  let native: NativePasskeysModule;\n  try {\n    native = await loadNativeModule();\n  } catch (error) {\n    return {\n      ok: false,\n      error: { code: 'not_supported', message: error instanceof Error ? error.message : String(error) },\n    };\n  }\n\n  if (!native.isAvailable()) {\n    return {\n      ok: false,\n      error: { code: 'not_supported', message: 'Native passkeys are not supported on this platform.' },\n    };\n  }\n\n  // Subframes and webviews can host third-party content that must not be able\n  // to run credential ceremonies for the app's RP ID.\n  if (!event.senderFrame || event.senderFrame !== event.sender.mainFrame) {\n    return {\n      ok: false,\n      error: { code: 'unknown', message: \"The passkey request did not originate from a window's main frame.\" },\n    };\n  }\n\n  const window = BrowserWindow.fromWebContents(event.sender);\n  if (!window) {\n    return {\n      ok: false,\n      error: { code: 'unknown', message: 'The passkey request did not originate from a visible window.' },\n    };\n  }\n\n  try {\n    const resultJson = await native[method](window.getNativeWindowHandle(), JSON.stringify(options));\n    const result: unknown = JSON.parse(resultJson);\n    if (!isPasskeyIpcResult<T>(result)) {\n      return { ok: false, error: { code: 'unknown', message: 'The native module returned an unexpected result.' } };\n    }\n    return result;\n  } catch (error) {\n    return { ok: false, error: { code: 'unknown', message: error instanceof Error ? error.message : String(error) } };\n  }\n}\n\n/** Registers IPC handlers for native platform WebAuthn. */\nexport function setupPasskeysMain(): SetupPasskeysMainReturn {\n  // Surface a missing optional dependency during setup, before the first ceremony.\n  loadNativeModule().catch((error: Error) => console.warn(error.message));\n\n  ipcMain.handle(\n    PASSKEY_CHANNELS.create,\n    (\n      event,\n      options: SerializedPublicKeyCredentialCreationOptions,\n    ): Promise<PasskeyIpcResult<RegistrationResponseJSON>> => invokeNative('createCredential', event, options),\n  );\n\n  ipcMain.handle(\n    PASSKEY_CHANNELS.get,\n    (\n      event,\n      options: SerializedPublicKeyCredentialRequestOptions,\n    ): Promise<PasskeyIpcResult<AuthenticationResponseJSON>> => invokeNative('getCredential', event, options),\n  );\n\n  ipcMain.handle(PASSKEY_CHANNELS.capabilities, async (): Promise<PasskeyCapabilities> => {\n    try {\n      const native = await loadNativeModule();\n      if (!native.isAvailable()) {\n        return { available: false, platformAuthenticator: false, securityKeys: false };\n      }\n      return { available: true, ...native.capabilities() };\n    } catch {\n      return { available: false, platformAuthenticator: false, securityKeys: false };\n    }\n  });\n\n  return {\n    cleanup() {\n      ipcMain.removeHandler(PASSKEY_CHANNELS.create);\n      ipcMain.removeHandler(PASSKEY_CHANNELS.get);\n      ipcMain.removeHandler(PASSKEY_CHANNELS.capabilities);\n    },\n  };\n}\n","import { protocol } from 'electron';\n\nimport type { ClerkBridge, CreateClerkBridgeOptions } from '../shared/types';\nimport { setupTokenCacheIpcHandlers } from './ipc-handlers';\nimport { setupOAuthTransportIpcHandlers } from './oauth-transport';\nimport { setupPasskeysMain } from './passkey-handlers';\n\nfunction assertValidRendererOriginConfig(renderer: NonNullable<CreateClerkBridgeOptions['renderer']>): void {\n  if (renderer.scheme.includes(':') || renderer.scheme.includes('/')) {\n    throw new Error(\n      'Clerk: renderer.scheme must be a scheme name like \"my-app\", not a URL or protocol like \"my-app://\".',\n    );\n  }\n\n  if (renderer.host.includes(':') || renderer.host.includes('/')) {\n    throw new Error(\n      'Clerk: renderer.host must be a host name like \"renderer\", not a URL or origin like \"my-app://renderer\".',\n    );\n  }\n}\n\n/**\n * Creates the Clerk bridge for Electron's main process.\n *\n * The bridge owns Clerk's main-process IPC handlers, token persistence, and OAuth deep-link\n * transport. Call this before creating renderer windows, and call the returned `cleanup` method\n * when tearing down the app or test environment.\n */\nexport function createClerkBridge(options: CreateClerkBridgeOptions): ClerkBridge {\n  if (!options.storage) {\n    throw new Error(\n      'Clerk: createClerkBridge requires a storage adapter. Pass createClerkBridge({ storage: storage() }) from @clerk/electron/storage, or provide a custom storage adapter.',\n    );\n  }\n\n  const cleanupTokenPersistence = setupTokenCacheIpcHandlers(options.storage);\n  let cleanupOAuthTransport: (() => void) | undefined;\n  const passkeys = options.passkeys ? setupPasskeysMain() : null;\n\n  if (options.renderer) {\n    assertValidRendererOriginConfig(options.renderer);\n\n    protocol.registerSchemesAsPrivileged([\n      {\n        scheme: options.renderer.scheme,\n        privileges: {\n          standard: true,\n          secure: true,\n          supportFetchAPI: true,\n          corsEnabled: true,\n          stream: true,\n        },\n      },\n    ]);\n\n    cleanupOAuthTransport = setupOAuthTransportIpcHandlers({\n      renderer: options.renderer,\n    });\n  }\n\n  return {\n    cleanup() {\n      cleanupTokenPersistence();\n      cleanupOAuthTransport?.();\n      passkeys?.cleanup();\n    },\n  };\n}\n"]}