@clerk/electron 0.0.1-snapshot.v20260617204522

package/dist/cjs/storage/index.js

@@ -0,0 +1,133 @@
+'use strict';
+
+var electron = require('electron');
+var Store = require('electron-store');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var Store__default = /*#__PURE__*/_interopDefault(Store);
+
+// src/storage/index.ts
+var ENCRYPTED_PREFIX = "enc:";
+var RAW_PREFIX = "raw:";
+var syncCipher = {
+  encrypt: (value) => Promise.resolve(electron.safeStorage.encryptString(value).toString("base64")),
+  decrypt: (payload) => Promise.resolve({ value: electron.safeStorage.decryptString(Buffer.from(payload, "base64")), shouldReEncrypt: false })
+};
+function hasAsyncSafeStorage(storage2) {
+  const candidate = storage2;
+  return typeof candidate.encryptStringAsync === "function" && typeof candidate.decryptStringAsync === "function" && typeof candidate.isAsyncEncryptionAvailable === "function";
+}
+function createAsyncCipher(storage2) {
+  return {
+    encrypt: async (value) => (await storage2.encryptStringAsync(value)).toString("base64"),
+    decrypt: async (payload) => {
+      const { result, shouldReEncrypt } = await storage2.decryptStringAsync(Buffer.from(payload, "base64"));
+      return { value: result, shouldReEncrypt };
+    }
+  };
+}
+async function resolveCipher() {
+  if (hasAsyncSafeStorage(electron.safeStorage)) {
+    try {
+      if (await electron.safeStorage.isAsyncEncryptionAvailable()) {
+        return createAsyncCipher(electron.safeStorage);
+      }
+    } catch {
+    }
+  }
+  if (typeof electron.safeStorage.isEncryptionAvailable === "function" && electron.safeStorage.isEncryptionAvailable()) {
+    return syncCipher;
+  }
+  return null;
+}
+function storage(options = {}) {
+  var _a;
+  const store = new Store__default.default({
+    name: (_a = options.name) != null ? _a : "clerk-tokens",
+    ...options.path ? { cwd: options.path } : {}
+  });
+  let cachedCipher = null;
+  let resolving = null;
+  const getCipher = () => {
+    if (cachedCipher) {
+      return Promise.resolve(cachedCipher);
+    }
+    resolving != null ? resolving : resolving = resolveCipher().then((resolved) => {
+      resolving = null;
+      if (resolved) {
+        cachedCipher = resolved;
+      }
+      return resolved;
+    });
+    return resolving;
+  };
+  let warned = false;
+  const warnOnce = (message) => {
+    if (warned) {
+      return;
+    }
+    warned = true;
+    console.warn(message);
+  };
+  return {
+    async getItem(key) {
+      const stored = store.get(key);
+      if (!stored) {
+        return null;
+      }
+      if (stored.startsWith(RAW_PREFIX)) {
+        return stored.slice(RAW_PREFIX.length);
+      }
+      if (stored.startsWith(ENCRYPTED_PREFIX)) {
+        const cipher = await getCipher();
+        if (!cipher) {
+          return null;
+        }
+        const payload = stored.slice(ENCRYPTED_PREFIX.length);
+        try {
+          const { value, shouldReEncrypt } = await cipher.decrypt(payload);
+          if (shouldReEncrypt) {
+            try {
+              store.set(key, ENCRYPTED_PREFIX + await cipher.encrypt(value));
+            } catch {
+            }
+          }
+          return value;
+        } catch {
+          return null;
+        }
+      }
+      store.delete(key);
+      return null;
+    },
+    async setItem(key, value) {
+      const cipher = await getCipher();
+      if (!cipher) {
+        if (options.unencryptedFallback) {
+          warnOnce(
+            "Clerk: OS encryption is unavailable; falling back to unencrypted storage. Session tokens are being stored unencrypted on local disk."
+          );
+          store.set(key, RAW_PREFIX + value);
+        } else {
+          warnOnce(
+            "Clerk: OS encryption is unavailable and unencryptedFallback is not enabled, so tokens are not being persisted. The user will be signed out on the next launch. Pass `storage({ unencryptedFallback: true })` to persist unencrypted (less secure)."
+          );
+        }
+        return;
+      }
+      try {
+        store.set(key, ENCRYPTED_PREFIX + await cipher.encrypt(value));
+      } catch {
+        warnOnce("Clerk: failed to encrypt the session token; it was not persisted.");
+      }
+    },
+    removeItem(key) {
+      store.delete(key);
+    }
+  };
+}
+
+exports.storage = storage;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/cjs/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/storage/index.ts"],"names":["safeStorage","storage","Store"],"mappings":";;;;;;;;;;AAgCA,IAAM,gBAAA,GAAmB,MAAA;AAKzB,IAAM,UAAA,GAAa,MAAA;AAiBnB,IAAM,UAAA,GAAqB;AAAA,EACzB,OAAA,EAAS,CAAA,KAAA,KAAS,OAAA,CAAQ,OAAA,CAAQA,oBAAA,CAAY,cAAc,KAAK,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,EACrF,SAAS,CAAA,OAAA,KACP,OAAA,CAAQ,OAAA,CAAQ,EAAE,OAAOA,oBAAA,CAAY,aAAA,CAAc,MAAA,CAAO,IAAA,CAAK,SAAS,QAAQ,CAAC,CAAA,EAAG,eAAA,EAAiB,OAAO;AAChH,CAAA;AAEA,SAAS,oBAAoBC,QAAAA,EAA+E;AAC1G,EAAA,MAAM,SAAA,GAAYA,QAAAA;AAElB,EAAA,OACE,OAAO,SAAA,CAAU,kBAAA,KAAuB,UAAA,IACxC,OAAO,UAAU,kBAAA,KAAuB,UAAA,IACxC,OAAO,SAAA,CAAU,0BAAA,KAA+B,UAAA;AAEpD;AAEA,SAAS,kBAAkBA,QAAAA,EAAmC;AAC5D,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,OAAM,KAAA,KAAA,CAAU,MAAMA,SAAQ,kBAAA,CAAmB,KAAK,CAAA,EAAG,QAAA,CAAS,QAAQ,CAAA;AAAA,IACnF,OAAA,EAAS,OAAM,OAAA,KAAW;AACxB,MAAA,MAAM,EAAE,MAAA,EAAQ,eAAA,EAAgB,GAAI,MAAMA,QAAAA,CAAQ,kBAAA,CAAmB,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAC,CAAA;AACnG,MAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAAA,IAC1C;AAAA,GACF;AACF;AAKA,eAAe,aAAA,GAAwC;AAErD,EAAA,IAAI,mBAAA,CAAoBD,oBAAW,CAAA,EAAG;AACpC,IAAA,IAAI;AACF,MAAA,IAAI,MAAMA,oBAAA,CAAY,0BAAA,EAA2B,EAAG;AAClD,QAAA,OAAO,kBAAkBA,oBAAW,CAAA;AAAA,MACtC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAGA,EAAA,IAAI,OAAOA,oBAAA,CAAY,qBAAA,KAA0B,UAAA,IAAcA,oBAAA,CAAY,uBAAsB,EAAG;AAClG,IAAA,OAAO,UAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAuBO,SAAS,OAAA,CAAQ,OAAA,GAA0B,EAAC,EAAiB;AA5HpE,EAAA,IAAA,EAAA;AA6HE,EAAA,MAAM,KAAA,GAAQ,IAAIE,sBAAA,CAA8B;AAAA,IAC9C,IAAA,EAAA,CAAM,EAAA,GAAA,OAAA,CAAQ,IAAA,KAAR,IAAA,GAAA,EAAA,GAAgB,cAAA;AAAA,IACtB,GAAI,QAAQ,IAAA,GAAO,EAAE,KAAK,OAAA,CAAQ,IAAA,KAAS;AAAC,GAC7C,CAAA;AAED,EAAA,IAAI,YAAA,GAA8B,IAAA;AAClC,EAAA,IAAI,SAAA,GAA2C,IAAA;AAC/C,EAAA,MAAM,YAAY,MAA8B;AAC9C,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,OAAO,OAAA,CAAQ,QAAQ,YAAY,CAAA;AAAA,IACrC;AACA,IAAA,SAAA,IAAA,IAAA,GAAA,SAAA,GAAA,SAAA,GAAc,aAAA,EAAc,CAAE,IAAA,CAAK,CAAA,QAAA,KAAY;AAC7C,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,YAAA,GAAe,QAAA;AAAA,MACjB;AACA,MAAA,OAAO,QAAA;AAAA,IACT,CAAC,CAAA;AACD,IAAA,OAAO,SAAA;AAAA,EACT,CAAA;AAEA,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,MAAM,QAAA,GAAW,CAAC,OAAA,KAAoB;AACpC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA;AAAA,IACF;AACA,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,EACtB,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,QAAQ,GAAA,EAAK;AACjB,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAE5B,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,IAAI,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA,EAAG;AACjC,QAAA,OAAO,MAAA,CAAO,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAAA,MACvC;AAEA,MAAA,IAAI,MAAA,CAAO,UAAA,CAAW,gBAAgB,CAAA,EAAG;AACvC,QAAA,MAAM,MAAA,GAAS,MAAM,SAAA,EAAU;AAG/B,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,OAAO,IAAA;AAAA,QACT;AAEA,QAAA,MAAM,OAAA,GAAU,MAAA,CAAO,KAAA,CAAM,gBAAA,CAAiB,MAAM,CAAA;AAEpD,QAAA,IAAI;AACF,UAAA,MAAM,EAAE,KAAA,EAAO,eAAA,KAAoB,MAAM,MAAA,CAAO,QAAQ,OAAO,CAAA;AAE/D,UAAA,IAAI,eAAA,EAAiB;AAEnB,YAAA,IAAI;AACF,cAAA,KAAA,CAAM,IAAI,GAAA,EAAK,gBAAA,GAAoB,MAAM,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAE,CAAA;AAAA,YACjE,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF;AAEA,UAAA,OAAO,KAAA;AAAA,QACT,CAAA,CAAA,MAAQ;AAEN,UAAA,OAAO,IAAA;AAAA,QACT;AAAA,MACF;AAGA,MAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAChB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAA,EAAO;AACxB,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,EAAU;AAE/B,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,IAAI,QAAQ,mBAAA,EAAqB;AAC/B,UAAA,QAAA;AAAA,YACE;AAAA,WACF;AACA,UAAA,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,UAAA,GAAa,KAAK,CAAA;AAAA,QACnC,CAAA,MAAO;AACL,UAAA,QAAA;AAAA,YACE;AAAA,WACF;AAAA,QACF;AACA,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,KAAA,CAAM,IAAI,GAAA,EAAK,gBAAA,GAAoB,MAAM,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAE,CAAA;AAAA,MACjE,CAAA,CAAA,MAAQ;AAEN,QAAA,QAAA,CAAS,mEAAmE,CAAA;AAAA,MAC9E;AAAA,IACF,CAAA;AAAA,IACA,WAAW,GAAA,EAAK;AACd,MAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,IAClB;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import { safeStorage } from 'electron';\nimport Store from 'electron-store';\n\nimport type { TokenStorage } from '../shared/types';\n\ntype StorageOptions = {\n  /**\n   * The name of the file (without extension) used to persist tokens.\n   *\n   * @default 'clerk-tokens'\n   */\n  name?: string;\n  /**\n   * The directory in which the token file is stored. Maps to `electron-store`'s `cwd` option.\n   * When omitted, the OS default user config directory is used.\n   */\n  path?: string;\n  /**\n   * When OS-level encryption is unavailable (e.g. a Linux machine without a keyring), tokens are\n   * not persisted by default, which signs the user out on the next app launch. Set this to `true`\n   * to instead persist tokens **unencrypted** in that scenario, keeping the user signed in across\n   * restarts at the cost of storing tokens in plaintext on disk.\n   *\n   * @default false\n   */\n  unencryptedFallback?: boolean;\n};\n\n/**\n * Marks a value that was encrypted via {@link safeStorage}; the remainder is base64 ciphertext.\n * values will be stored as: `enc:<encrypted value>`\n */\nconst ENCRYPTED_PREFIX = 'enc:';\n/**\n * Marks a value persisted unencrypted via the `unencryptedFallback` option.\n * values will be stored as: `raw:<value>`\n */\nconst RAW_PREFIX = 'raw:';\n\ntype Cipher = {\n  encrypt: (value: string) => Promise<string>;\n  /**\n   * Decrypts a base64 payload. `shouldReEncrypt` is `true` (async backend only) when the OS key\n   * has rotated and the payload should be re-encrypted with the new key.\n   */\n  decrypt: (payload: string) => Promise<{ value: string; shouldReEncrypt: boolean }>;\n};\n\ntype AsyncSafeStorage = {\n  encryptStringAsync: (plainText: string) => Promise<Buffer>;\n  decryptStringAsync: (encrypted: Buffer) => Promise<{ result: string; shouldReEncrypt: boolean }>;\n  isAsyncEncryptionAvailable: () => Promise<boolean>;\n};\n\nconst syncCipher: Cipher = {\n  encrypt: value => Promise.resolve(safeStorage.encryptString(value).toString('base64')),\n  decrypt: payload =>\n    Promise.resolve({ value: safeStorage.decryptString(Buffer.from(payload, 'base64')), shouldReEncrypt: false }),\n};\n\nfunction hasAsyncSafeStorage(storage: typeof safeStorage): storage is typeof safeStorage & AsyncSafeStorage {\n  const candidate = storage as Partial<AsyncSafeStorage>;\n\n  return (\n    typeof candidate.encryptStringAsync === 'function' &&\n    typeof candidate.decryptStringAsync === 'function' &&\n    typeof candidate.isAsyncEncryptionAvailable === 'function'\n  );\n}\n\nfunction createAsyncCipher(storage: AsyncSafeStorage): Cipher {\n  return {\n    encrypt: async value => (await storage.encryptStringAsync(value)).toString('base64'),\n    decrypt: async payload => {\n      const { result, shouldReEncrypt } = await storage.decryptStringAsync(Buffer.from(payload, 'base64'));\n      return { value: result, shouldReEncrypt };\n    },\n  };\n}\n\n/**\n * Resolves the crypto backend to use, or `null` when no OS encryption is currently available.\n */\nasync function resolveCipher(): Promise<Cipher | null> {\n  // Prefer the async API, but only when the full optional function surface exists.\n  if (hasAsyncSafeStorage(safeStorage)) {\n    try {\n      if (await safeStorage.isAsyncEncryptionAvailable()) {\n        return createAsyncCipher(safeStorage);\n      }\n    } catch {\n      /* fall through to the synchronous API */\n    }\n  }\n\n  // The synchronous API blocks the calling thread on the OS prompt during the first encrypt/decrypt,\n  if (typeof safeStorage.isEncryptionAvailable === 'function' && safeStorage.isEncryptionAvailable()) {\n    return syncCipher;\n  }\n\n  return null;\n}\n\n/**\n * Creates a secure {@link TokenStorage} adapter for the Electron main process.\n *\n * Tokens are persisted with `electron-store` and encrypted at rest using Electron's\n * {@link safeStorage} API, which is backed by the OS keystore (Keychain on macOS, DPAPI on\n * Windows, libsecret/kwallet on Linux). It uses Electron 42's async `safeStorage` API only when it\n * reports itself available (which generally requires a code-signed app) and otherwise falls back to\n * the synchronous API. Pass the result to `createClerkBridge({ storage: storage() })`.\n *\n * Behavior is secure by default: when OS encryption is unavailable the adapter does not persist\n * tokens (the user will be signed out on restart) unless {@link StorageOptions.unencryptedFallback}\n * is enabled. Undecryptable entries return `null`.\n *\n * @example\n * ```ts\n * import { createClerkBridge } from '@clerk/electron';\n * import { storage } from '@clerk/electron/storage';\n *\n * createClerkBridge({ storage: storage({ name: 'my-app-tokens' }) });\n * ```\n */\nexport function storage(options: StorageOptions = {}): TokenStorage {\n  const store = new Store<Record<string, string>>({\n    name: options.name ?? 'clerk-tokens',\n    ...(options.path ? { cwd: options.path } : {}),\n  });\n\n  let cachedCipher: Cipher | null = null;\n  let resolving: Promise<Cipher | null> | null = null;\n  const getCipher = (): Promise<Cipher | null> => {\n    if (cachedCipher) {\n      return Promise.resolve(cachedCipher);\n    }\n    resolving ??= resolveCipher().then(resolved => {\n      resolving = null;\n      if (resolved) {\n        cachedCipher = resolved;\n      }\n      return resolved;\n    });\n    return resolving;\n  };\n\n  let warned = false;\n  const warnOnce = (message: string) => {\n    if (warned) {\n      return;\n    }\n    warned = true;\n    console.warn(message);\n  };\n\n  return {\n    async getItem(key) {\n      const stored = store.get(key);\n\n      if (!stored) {\n        return null;\n      }\n\n      if (stored.startsWith(RAW_PREFIX)) {\n        return stored.slice(RAW_PREFIX.length);\n      }\n\n      if (stored.startsWith(ENCRYPTED_PREFIX)) {\n        const cipher = await getCipher();\n\n        // No usable OS encryption, preserve entry.\n        if (!cipher) {\n          return null;\n        }\n\n        const payload = stored.slice(ENCRYPTED_PREFIX.length);\n\n        try {\n          const { value, shouldReEncrypt } = await cipher.decrypt(payload);\n\n          if (shouldReEncrypt) {\n            // OS key has rotated, persist with new value\n            try {\n              store.set(key, ENCRYPTED_PREFIX + (await cipher.encrypt(value)));\n            } catch {\n              // keep the existing payload; it still decrypts for now\n            }\n          }\n\n          return value;\n        } catch {\n          // Decryption failed, preserve the entry, new write on next sign-in.\n          return null;\n        }\n      }\n\n      // Unknown or unrecognized format, drop the entry so we don't repeatedly fail on it.\n      store.delete(key);\n      return null;\n    },\n    async setItem(key, value) {\n      const cipher = await getCipher();\n\n      if (!cipher) {\n        if (options.unencryptedFallback) {\n          warnOnce(\n            'Clerk: OS encryption is unavailable; falling back to unencrypted storage. Session tokens are being stored unencrypted on local disk.',\n          );\n          store.set(key, RAW_PREFIX + value);\n        } else {\n          warnOnce(\n            'Clerk: OS encryption is unavailable and unencryptedFallback is not enabled, so tokens are not being persisted. The user will be signed out on the next launch. Pass `storage({ unencryptedFallback: true })` to persist unencrypted (less secure).',\n          );\n        }\n        return;\n      }\n\n      try {\n        store.set(key, ENCRYPTED_PREFIX + (await cipher.encrypt(value)));\n      } catch {\n        // Encryption is available but encryption failed\n        warnOnce('Clerk: failed to encrypt the session token; it was not persisted.');\n      }\n    },\n    removeItem(key) {\n      store.delete(key);\n    },\n  };\n}\n"]}

package/dist/esm/chunk-ICCH5DQT.js

@@ -0,0 +1,19 @@
+// src/shared/ipc.ts
+var TOKEN_CACHE_CHANNELS = {
+  getToken: "clerk:token-cache:get",
+  saveToken: "clerk:token-cache:save",
+  clearToken: "clerk:token-cache:clear"
+};
+var OAUTH_TRANSPORT_CHANNELS = {
+  getRedirectUrl: "clerk:oauth-transport:get-redirect-url",
+  open: "clerk:oauth-transport:open"
+};
+var PASSKEY_CHANNELS = {
+  create: "clerk:passkeys:create",
+  get: "clerk:passkeys:get",
+  capabilities: "clerk:passkeys:capabilities"
+};
+
+export { OAUTH_TRANSPORT_CHANNELS, PASSKEY_CHANNELS, TOKEN_CACHE_CHANNELS };
+//# sourceMappingURL=chunk-ICCH5DQT.js.map
+//# sourceMappingURL=chunk-ICCH5DQT.js.map

package/dist/esm/chunk-ICCH5DQT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/shared/ipc.ts"],"names":[],"mappings":";AAAO,IAAM,oBAAA,GAAuB;AAAA,EAClC,QAAA,EAAU,uBAAA;AAAA,EACV,SAAA,EAAW,wBAAA;AAAA,EACX,UAAA,EAAY;AACd;AAEO,IAAM,wBAAA,GAA2B;AAAA,EACtC,cAAA,EAAgB,wCAAA;AAAA,EAChB,IAAA,EAAM;AACR;AAEO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,MAAA,EAAQ,uBAAA;AAAA,EACR,GAAA,EAAK,oBAAA;AAAA,EACL,YAAA,EAAc;AAChB","file":"chunk-ICCH5DQT.js","sourcesContent":["export const TOKEN_CACHE_CHANNELS = {\n  getToken: 'clerk:token-cache:get',\n  saveToken: 'clerk:token-cache:save',\n  clearToken: 'clerk:token-cache:clear',\n} as const;\n\nexport const OAUTH_TRANSPORT_CHANNELS = {\n  getRedirectUrl: 'clerk:oauth-transport:get-redirect-url',\n  open: 'clerk:oauth-transport:open',\n} as const;\n\nexport const PASSKEY_CHANNELS = {\n  create: 'clerk:passkeys:create',\n  get: 'clerk:passkeys:get',\n  capabilities: 'clerk:passkeys:capabilities',\n} as const;\n"]}

package/dist/esm/index.js

@@ -0,0 +1,254 @@
+import { PASSKEY_CHANNELS, TOKEN_CACHE_CHANNELS, OAUTH_TRANSPORT_CHANNELS } from './chunk-ICCH5DQT.js';
+import { ipcMain, protocol, BrowserWindow, app, shell } from 'electron';
+
+function setupTokenCacheIpcHandlers(storage) {
+  ipcMain.handle(TOKEN_CACHE_CHANNELS.getToken, (_event, key) => {
+    return storage.getItem(key);
+  });
+  ipcMain.handle(TOKEN_CACHE_CHANNELS.saveToken, (_event, key, value) => {
+    return storage.setItem(key, value);
+  });
+  ipcMain.handle(TOKEN_CACHE_CHANNELS.clearToken, (_event, key) => {
+    return storage.removeItem(key);
+  });
+  return () => {
+    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.getToken);
+    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.saveToken);
+    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.clearToken);
+  };
+}
+var CALLBACK_TIMEOUT_MS = 3 * 60 * 1e3;
+function buildRedirectUrl(options) {
+  return `${options.renderer.scheme}://${options.renderer.host}/`;
+}
+function isMatchingCallbackUrl(url, redirectUrl) {
+  try {
+    const callback = new URL(url);
+    const expected = new URL(redirectUrl);
+    return callback.protocol === expected.protocol && callback.host === expected.host && callback.pathname === expected.pathname;
+  } catch {
+    return false;
+  }
+}
+function assertExternalOAuthUrl(url) {
+  const parsedUrl = new URL(url);
+  if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+    throw new TypeError(`Clerk: refusing to open unsupported OAuth URL protocol: ${parsedUrl.protocol}`);
+  }
+}
+function setupOAuthTransportIpcHandlers(options) {
+  const redirectUrl = buildRedirectUrl(options);
+  let pendingOAuthFlow = null;
+  const disposePendingOAuthFlow = (reason) => {
+    if (!pendingOAuthFlow) {
+      return;
+    }
+    const pending = pendingOAuthFlow;
+    clearTimeout(pendingOAuthFlow.timeout);
+    pendingOAuthFlow = null;
+    if (reason) {
+      pending.reject(reason);
+    }
+  };
+  const handleCallbackUrl = (url) => {
+    if (!pendingOAuthFlow || !isMatchingCallbackUrl(url, redirectUrl)) {
+      return;
+    }
+    const pending = pendingOAuthFlow;
+    disposePendingOAuthFlow();
+    pending.resolve({ callbackUrl: url });
+  };
+  const openUrlListener = (event, url) => {
+    if (!isMatchingCallbackUrl(url, redirectUrl)) {
+      return;
+    }
+    event.preventDefault();
+    handleCallbackUrl(url);
+  };
+  const secondInstanceListener = (_event, argv) => {
+    const callbackUrl = argv.find((url) => isMatchingCallbackUrl(url, redirectUrl));
+    if (callbackUrl) {
+      handleCallbackUrl(callbackUrl);
+    }
+  };
+  app.setAsDefaultProtocolClient(options.renderer.scheme);
+  app.on("open-url", openUrlListener);
+  app.on("second-instance", secondInstanceListener);
+  ipcMain.handle(OAUTH_TRANSPORT_CHANNELS.getRedirectUrl, () => {
+    return redirectUrl;
+  });
+  ipcMain.handle(OAUTH_TRANSPORT_CHANNELS.open, async (_event, url) => {
+    if (pendingOAuthFlow) {
+      throw new Error("Clerk: an OAuth flow is already pending.");
+    }
+    assertExternalOAuthUrl(url);
+    const callbackPromise = new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        disposePendingOAuthFlow();
+        reject(new Error("Clerk: OAuth callback timed out."));
+      }, CALLBACK_TIMEOUT_MS);
+      pendingOAuthFlow = { resolve, reject, timeout };
+    });
+    try {
+      await shell.openExternal(url);
+    } catch (err) {
+      disposePendingOAuthFlow(err instanceof Error ? err : new Error(String(err)));
+    }
+    return callbackPromise;
+  });
+  return () => {
+    disposePendingOAuthFlow(new Error("Clerk: OAuth flow was cancelled."));
+    app.removeListener("open-url", openUrlListener);
+    app.removeListener("second-instance", secondInstanceListener);
+    ipcMain.removeHandler(OAUTH_TRANSPORT_CHANNELS.getRedirectUrl);
+    ipcMain.removeHandler(OAUTH_TRANSPORT_CHANNELS.open);
+  };
+}
+var nativeModulePromise;
+function loadNativeModule() {
+  nativeModulePromise != null ? nativeModulePromise : nativeModulePromise = import('@clerk/electron-passkeys').then(
+    (module) => {
+      var _a;
+      return (_a = module.default) != null ? _a : module;
+    },
+    (error) => {
+      nativeModulePromise = void 0;
+      throw new Error(
+        "Clerk: createClerkBridge({ passkeys: true }) requires the optional @clerk/electron-passkeys package. Install it with your package manager to enable native passkey support.",
+        { cause: error }
+      );
+    }
+  );
+  return nativeModulePromise;
+}
+var NATIVE_ERROR_CODES = ["cancelled", "invalid_rp", "not_supported", "timeout", "unknown"];
+function isPasskeyIpcResult(value) {
+  var _a;
+  if (!value || typeof value !== "object" || typeof value.ok !== "boolean") {
+    return false;
+  }
+  const result = value;
+  return result.ok ? result.credential !== void 0 : NATIVE_ERROR_CODES.includes((_a = result.error) == null ? void 0 : _a.code);
+}
+async function invokeNative(method, event, options) {
+  let native;
+  try {
+    native = await loadNativeModule();
+  } catch (error) {
+    return {
+      ok: false,
+      error: { code: "not_supported", message: error instanceof Error ? error.message : String(error) }
+    };
+  }
+  if (!native.isAvailable()) {
+    return {
+      ok: false,
+      error: { code: "not_supported", message: "Native passkeys are not supported on this platform." }
+    };
+  }
+  if (!event.senderFrame || event.senderFrame !== event.sender.mainFrame) {
+    return {
+      ok: false,
+      error: { code: "unknown", message: "The passkey request did not originate from a window's main frame." }
+    };
+  }
+  const window = BrowserWindow.fromWebContents(event.sender);
+  if (!window) {
+    return {
+      ok: false,
+      error: { code: "unknown", message: "The passkey request did not originate from a visible window." }
+    };
+  }
+  try {
+    const resultJson = await native[method](window.getNativeWindowHandle(), JSON.stringify(options));
+    const result = JSON.parse(resultJson);
+    if (!isPasskeyIpcResult(result)) {
+      return { ok: false, error: { code: "unknown", message: "The native module returned an unexpected result." } };
+    }
+    return result;
+  } catch (error) {
+    return { ok: false, error: { code: "unknown", message: error instanceof Error ? error.message : String(error) } };
+  }
+}
+function setupPasskeysMain() {
+  loadNativeModule().catch((error) => console.warn(error.message));
+  ipcMain.handle(
+    PASSKEY_CHANNELS.create,
+    (event, options) => invokeNative("createCredential", event, options)
+  );
+  ipcMain.handle(
+    PASSKEY_CHANNELS.get,
+    (event, options) => invokeNative("getCredential", event, options)
+  );
+  ipcMain.handle(PASSKEY_CHANNELS.capabilities, async () => {
+    try {
+      const native = await loadNativeModule();
+      if (!native.isAvailable()) {
+        return { available: false, platformAuthenticator: false, securityKeys: false };
+      }
+      return { available: true, ...native.capabilities() };
+    } catch {
+      return { available: false, platformAuthenticator: false, securityKeys: false };
+    }
+  });
+  return {
+    cleanup() {
+      ipcMain.removeHandler(PASSKEY_CHANNELS.create);
+      ipcMain.removeHandler(PASSKEY_CHANNELS.get);
+      ipcMain.removeHandler(PASSKEY_CHANNELS.capabilities);
+    }
+  };
+}
+
+// src/main/create-clerk-bridge.ts
+function assertValidRendererOriginConfig(renderer) {
+  if (renderer.scheme.includes(":") || renderer.scheme.includes("/")) {
+    throw new Error(
+      'Clerk: renderer.scheme must be a scheme name like "my-app", not a URL or protocol like "my-app://".'
+    );
+  }
+  if (renderer.host.includes(":") || renderer.host.includes("/")) {
+    throw new Error(
+      'Clerk: renderer.host must be a host name like "renderer", not a URL or origin like "my-app://renderer".'
+    );
+  }
+}
+function createClerkBridge(options) {
+  if (!options.storage) {
+    throw new Error(
+      "Clerk: createClerkBridge requires a storage adapter. Pass createClerkBridge({ storage: storage() }) from @clerk/electron/storage, or provide a custom storage adapter."
+    );
+  }
+  const cleanupTokenPersistence = setupTokenCacheIpcHandlers(options.storage);
+  let cleanupOAuthTransport;
+  const passkeys = options.passkeys ? setupPasskeysMain() : null;
+  if (options.renderer) {
+    assertValidRendererOriginConfig(options.renderer);
+    protocol.registerSchemesAsPrivileged([
+      {
+        scheme: options.renderer.scheme,
+        privileges: {
+          standard: true,
+          secure: true,
+          supportFetchAPI: true,
+          corsEnabled: true,
+          stream: true
+        }
+      }
+    ]);
+    cleanupOAuthTransport = setupOAuthTransportIpcHandlers({
+      renderer: options.renderer
+    });
+  }
+  return {
+    cleanup() {
+      cleanupTokenPersistence();
+      cleanupOAuthTransport == null ? void 0 : cleanupOAuthTransport();
+      passkeys == null ? void 0 : passkeys.cleanup();
+    }
+  };
+}
+
+export { createClerkBridge, setupPasskeysMain };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/main/ipc-handlers.ts","../../src/main/oauth-transport.ts","../../src/main/passkey-handlers.ts","../../src/main/create-clerk-bridge.ts"],"names":["ipcMain"],"mappings":";;;AAKO,SAAS,2BAA2B,OAAA,EAAmC;AAC5E,EAAA,OAAA,CAAQ,MAAA,CAAO,oBAAA,CAAqB,QAAA,EAAU,CAAC,QAAQ,GAAA,KAAgB;AACrE,IAAA,OAAO,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,EAC5B,CAAC,CAAA;AAED,EAAA,OAAA,CAAQ,OAAO,oBAAA,CAAqB,SAAA,EAAW,CAAC,MAAA,EAAQ,KAAa,KAAA,KAAkB;AACrF,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAAA,EACnC,CAAC,CAAA;AAED,EAAA,OAAA,CAAQ,MAAA,CAAO,oBAAA,CAAqB,UAAA,EAAY,CAAC,QAAQ,GAAA,KAAgB;AACvE,IAAA,OAAO,OAAA,CAAQ,WAAW,GAAG,CAAA;AAAA,EAC/B,CAAC,CAAA;AAED,EAAA,OAAO,MAAM;AACX,IAAA,OAAA,CAAQ,aAAA,CAAc,qBAAqB,QAAQ,CAAA;AACnD,IAAA,OAAA,CAAQ,aAAA,CAAc,qBAAqB,SAAS,CAAA;AACpD,IAAA,OAAA,CAAQ,aAAA,CAAc,qBAAqB,UAAU,CAAA;AAAA,EACvD,CAAA;AACF;AClBA,IAAM,mBAAA,GAAsB,IAAI,EAAA,GAAK,GAAA;AAYrC,SAAS,iBAAiB,OAAA,EAAwC;AAChE,EAAA,OAAO,GAAG,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,GAAA,EAAM,OAAA,CAAQ,SAAS,IAAI,CAAA,CAAA,CAAA;AAC9D;AAEA,SAAS,qBAAA,CAAsB,KAAa,WAAA,EAA8B;AACxE,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,GAAG,CAAA;AAC5B,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,WAAW,CAAA;AAEpC,IAAA,OACE,QAAA,CAAS,QAAA,KAAa,QAAA,CAAS,QAAA,IAC/B,QAAA,CAAS,SAAS,QAAA,CAAS,IAAA,IAC3B,QAAA,CAAS,QAAA,KAAa,QAAA,CAAS,QAAA;AAAA,EAEnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,uBAAuB,GAAA,EAAmB;AACjD,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAE7B,EAAA,IAAI,SAAA,CAAU,QAAA,KAAa,OAAA,IAAW,SAAA,CAAU,aAAa,QAAA,EAAU;AACrE,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,wDAAA,EAA2D,SAAA,CAAU,QAAQ,CAAA,CAAE,CAAA;AAAA,EACrG;AACF;AAEO,SAAS,+BAA+B,OAAA,EAA4C;AACzF,EAAA,MAAM,WAAA,GAAc,iBAAiB,OAAO,CAAA;AAC5C,EAAA,IAAI,gBAAA,GAA4C,IAAA;AAEhD,EAAA,MAAM,uBAAA,GAA0B,CAAC,MAAA,KAAyB;AACxD,IAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,gBAAA;AAChB,IAAA,YAAA,CAAa,iBAAiB,OAAO,CAAA;AACrC,IAAA,gBAAA,GAAmB,IAAA;AAEnB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,iBAAA,GAAoB,CAAC,GAAA,KAAsB;AAC/C,IAAA,IAAI,CAAC,gBAAA,IAAoB,CAAC,qBAAA,CAAsB,GAAA,EAAK,WAAW,CAAA,EAAG;AACjE,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,gBAAA;AAChB,IAAA,uBAAA,EAAwB;AACxB,IAAA,OAAA,CAAQ,OAAA,CAAQ,EAAE,WAAA,EAAa,GAAA,EAAK,CAAA;AAAA,EACtC,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,KAAA,EAAuB,GAAA,KAAsB;AACpE,IAAA,IAAI,CAAC,qBAAA,CAAsB,GAAA,EAAK,WAAW,CAAA,EAAG;AAC5C,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,cAAA,EAAe;AACrB,IAAA,iBAAA,CAAkB,GAAG,CAAA;AAAA,EACvB,CAAA;AAEA,EAAA,MAAM,sBAAA,GAAyB,CAAC,MAAA,EAAwB,IAAA,KAAyB;AAC/E,IAAA,MAAM,cAAc,IAAA,CAAK,IAAA,CAAK,SAAO,qBAAA,CAAsB,GAAA,EAAK,WAAW,CAAC,CAAA;AAE5E,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,iBAAA,CAAkB,WAAW,CAAA;AAAA,IAC/B;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,0BAAA,CAA2B,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA;AACtD,EAAA,GAAA,CAAI,EAAA,CAAG,YAAY,eAAe,CAAA;AAClC,EAAA,GAAA,CAAI,EAAA,CAAG,mBAAmB,sBAAsB,CAAA;AAEhD,EAAAA,OAAAA,CAAQ,MAAA,CAAO,wBAAA,CAAyB,cAAA,EAAgB,MAAM;AAC5D,IAAA,OAAO,WAAA;AAAA,EACT,CAAC,CAAA;AAED,EAAAA,QAAQ,MAAA,CAAO,wBAAA,CAAyB,IAAA,EAAM,OAAO,QAAQ,GAAA,KAAgB;AAC3E,IAAA,IAAI,gBAAA,EAAkB;AACpB,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,sBAAA,CAAuB,GAAG,CAAA;AAE1B,IAAA,MAAM,eAAA,GAAkB,IAAI,OAAA,CAAiC,CAAC,SAAS,MAAA,KAAW;AAChF,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,uBAAA,EAAwB;AACxB,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,kCAAkC,CAAC,CAAA;AAAA,MACtD,GAAG,mBAAmB,CAAA;AAEtB,MAAA,gBAAA,GAAmB,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAQ;AAAA,IAChD,CAAC,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,CAAM,aAAa,GAAG,CAAA;AAAA,IAC9B,SAAS,GAAA,EAAK;AACZ,MAAA,uBAAA,CAAwB,GAAA,YAAe,QAAQ,GAAA,GAAM,IAAI,MAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,IAC7E;AAEA,IAAA,OAAO,eAAA;AAAA,EACT,CAAC,CAAA;AAED,EAAA,OAAO,MAAM;AACX,IAAA,uBAAA,CAAwB,IAAI,KAAA,CAAM,kCAAkC,CAAC,CAAA;AACrE,IAAA,GAAA,CAAI,cAAA,CAAe,YAAY,eAAe,CAAA;AAC9C,IAAA,GAAA,CAAI,cAAA,CAAe,mBAAmB,sBAAsB,CAAA;AAC5D,IAAAA,OAAAA,CAAQ,aAAA,CAAc,wBAAA,CAAyB,cAAc,CAAA;AAC7D,IAAAA,OAAAA,CAAQ,aAAA,CAAc,wBAAA,CAAyB,IAAI,CAAA;AAAA,EACrD,CAAA;AACF;ACvGA,IAAI,mBAAA;AAEJ,SAAS,gBAAA,GAAkD;AAEzD,EAAA,mBAAA,IAAA,IAAA,GAAA,mBAAA,GAAA,mBAAA,GAAwB,OAAO,0BAA0B,CAAA,CAAE,IAAA;AAAA,IACzD,CAAC,MAAA,KAAmE;AA/BxE,MAAA,IAAA,EAAA;AA+B2E,MAAA,OAAA,CAAA,EAAA,GAAA,MAAA,CAAO,YAAP,IAAA,GAAA,EAAA,GAAkB,MAAA;AAAA,IAAA,CAAA;AAAA,IACzF,CAAA,KAAA,KAAS;AACP,MAAA,mBAAA,GAAsB,MAAA;AACtB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,6KAAA;AAAA,QACA,EAAE,OAAO,KAAA;AAAM,OACjB;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,mBAAA;AACT;AAEA,IAAM,qBAA+C,CAAC,WAAA,EAAa,YAAA,EAAc,eAAA,EAAiB,WAAW,SAAS,CAAA;AAEtH,SAAS,mBAAsB,KAAA,EAA8C;AA7C7E,EAAA,IAAA,EAAA;AA8CE,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,OAAQ,KAAA,CAA2B,OAAO,SAAA,EAAW;AAC9F,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,OAAO,MAAA,CAAO,EAAA,GACV,MAAA,CAAO,UAAA,KAAe,MAAA,GACtB,mBAAmB,QAAA,CAAA,CAAS,EAAA,GAAA,MAAA,CAAO,KAAA,KAAP,IAAA,GAAA,MAAA,GAAA,EAAA,CAAc,IAA8B,CAAA;AAC9E;AAEA,eAAe,YAAA,CACb,MAAA,EACA,KAAA,EACA,OAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,gBAAA,EAAiB;AAAA,EAClC,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,EAAE,IAAA,EAAM,eAAA,EAAiB,OAAA,EAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAA;AAAE,KAClG;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,WAAA,EAAY,EAAG;AACzB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,EAAE,IAAA,EAAM,eAAA,EAAiB,SAAS,qDAAA;AAAsD,KACjG;AAAA,EACF;AAIA,EAAA,IAAI,CAAC,KAAA,CAAM,WAAA,IAAe,MAAM,WAAA,KAAgB,KAAA,CAAM,OAAO,SAAA,EAAW;AACtE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,SAAS,mEAAA;AAAoE,KACzG;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,aAAA,CAAc,eAAA,CAAgB,KAAA,CAAM,MAAM,CAAA;AACzD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,SAAS,8DAAA;AAA+D,KACpG;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,MAAM,CAAA,CAAE,MAAA,CAAO,qBAAA,EAAsB,EAAG,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAC/F,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA;AAC7C,IAAA,IAAI,CAAC,kBAAA,CAAsB,MAAM,CAAA,EAAG;AAClC,MAAA,OAAO,EAAE,IAAI,KAAA,EAAO,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,kDAAA,EAAmD,EAAE;AAAA,IAC9G;AACA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,GAAE,EAAE;AAAA,EAClH;AACF;AAGO,SAAS,iBAAA,GAA6C;AAE3D,EAAA,gBAAA,EAAiB,CAAE,MAAM,CAAC,KAAA,KAAiB,QAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAC,CAAA;AAEtE,EAAAA,OAAAA,CAAQ,MAAA;AAAA,IACN,gBAAA,CAAiB,MAAA;AAAA,IACjB,CACE,KAAA,EACA,OAAA,KACwD,YAAA,CAAa,kBAAA,EAAoB,OAAO,OAAO;AAAA,GAC3G;AAEA,EAAAA,OAAAA,CAAQ,MAAA;AAAA,IACN,gBAAA,CAAiB,GAAA;AAAA,IACjB,CACE,KAAA,EACA,OAAA,KAC0D,YAAA,CAAa,eAAA,EAAiB,OAAO,OAAO;AAAA,GAC1G;AAEA,EAAAA,OAAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,YAAA,EAAc,YAA0C;AACtF,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,MAAA,IAAI,CAAC,MAAA,CAAO,WAAA,EAAY,EAAG;AACzB,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,qBAAA,EAAuB,KAAA,EAAO,cAAc,KAAA,EAAM;AAAA,MAC/E;AACA,MAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,GAAG,MAAA,CAAO,cAAa,EAAE;AAAA,IACrD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,qBAAA,EAAuB,KAAA,EAAO,cAAc,KAAA,EAAM;AAAA,IAC/E;AAAA,EACF,CAAC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAAA,OAAAA,CAAQ,aAAA,CAAc,gBAAA,CAAiB,MAAM,CAAA;AAC7C,MAAAA,OAAAA,CAAQ,aAAA,CAAc,gBAAA,CAAiB,GAAG,CAAA;AAC1C,MAAAA,OAAAA,CAAQ,aAAA,CAAc,gBAAA,CAAiB,YAAY,CAAA;AAAA,IACrD;AAAA,GACF;AACF;;;AC3IA,SAAS,gCAAgC,QAAA,EAAmE;AAC1G,EAAA,IAAI,QAAA,CAAS,OAAO,QAAA,CAAS,GAAG,KAAK,QAAA,CAAS,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,EAAG;AAClE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,KAAK,QAAA,CAAS,GAAG,KAAK,QAAA,CAAS,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACF;AASO,SAAS,kBAAkB,OAAA,EAAgD;AAChF,EAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,uBAAA,GAA0B,0BAAA,CAA2B,OAAA,CAAQ,OAAO,CAAA;AAC1E,EAAA,IAAI,qBAAA;AACJ,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,GAAW,iBAAA,EAAkB,GAAI,IAAA;AAE1D,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,+BAAA,CAAgC,QAAQ,QAAQ,CAAA;AAEhD,IAAA,QAAA,CAAS,2BAAA,CAA4B;AAAA,MACnC;AAAA,QACE,MAAA,EAAQ,QAAQ,QAAA,CAAS,MAAA;AAAA,QACzB,UAAA,EAAY;AAAA,UACV,QAAA,EAAU,IAAA;AAAA,UACV,MAAA,EAAQ,IAAA;AAAA,UACR,eAAA,EAAiB,IAAA;AAAA,UACjB,WAAA,EAAa,IAAA;AAAA,UACb,MAAA,EAAQ;AAAA;AACV;AACF,KACD,CAAA;AAED,IAAA,qBAAA,GAAwB,8BAAA,CAA+B;AAAA,MACrD,UAAU,OAAA,CAAQ;AAAA,KACnB,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,uBAAA,EAAwB;AACxB,MAAA,qBAAA,IAAA,IAAA,GAAA,MAAA,GAAA,qBAAA,EAAA;AACA,MAAA,QAAA,IAAA,IAAA,GAAA,MAAA,GAAA,QAAA,CAAU,OAAA,EAAA;AAAA,IACZ;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import { ipcMain } from 'electron';\n\nimport { TOKEN_CACHE_CHANNELS } from '../shared/ipc';\nimport type { TokenStorage } from '../shared/types';\n\nexport function setupTokenCacheIpcHandlers(storage: TokenStorage): () => void {\n  ipcMain.handle(TOKEN_CACHE_CHANNELS.getToken, (_event, key: string) => {\n    return storage.getItem(key);\n  });\n\n  ipcMain.handle(TOKEN_CACHE_CHANNELS.saveToken, (_event, key: string, value: string) => {\n    return storage.setItem(key, value);\n  });\n\n  ipcMain.handle(TOKEN_CACHE_CHANNELS.clearToken, (_event, key: string) => {\n    return storage.removeItem(key);\n  });\n\n  return () => {\n    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.getToken);\n    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.saveToken);\n    ipcMain.removeHandler(TOKEN_CACHE_CHANNELS.clearToken);\n  };\n}\n","import { app, ipcMain, shell } from 'electron';\n\nimport { OAUTH_TRANSPORT_CHANNELS } from '../shared/ipc';\nimport type { RendererSchemeOptions } from '../shared/types';\n\nconst CALLBACK_TIMEOUT_MS = 3 * 60 * 1000;\n\ntype PendingOAuthFlow = {\n  resolve: (value: { callbackUrl: string }) => void;\n  reject: (reason: Error) => void;\n  timeout: NodeJS.Timeout;\n};\n\ntype OAuthTransportOptions = {\n  renderer: RendererSchemeOptions;\n};\n\nfunction buildRedirectUrl(options: OAuthTransportOptions): string {\n  return `${options.renderer.scheme}://${options.renderer.host}/`;\n}\n\nfunction isMatchingCallbackUrl(url: string, redirectUrl: string): boolean {\n  try {\n    const callback = new URL(url);\n    const expected = new URL(redirectUrl);\n\n    return (\n      callback.protocol === expected.protocol &&\n      callback.host === expected.host &&\n      callback.pathname === expected.pathname\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction assertExternalOAuthUrl(url: string): void {\n  const parsedUrl = new URL(url);\n\n  if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {\n    throw new TypeError(`Clerk: refusing to open unsupported OAuth URL protocol: ${parsedUrl.protocol}`);\n  }\n}\n\nexport function setupOAuthTransportIpcHandlers(options: OAuthTransportOptions): () => void {\n  const redirectUrl = buildRedirectUrl(options);\n  let pendingOAuthFlow: PendingOAuthFlow | null = null;\n\n  const disposePendingOAuthFlow = (reason?: Error): void => {\n    if (!pendingOAuthFlow) {\n      return;\n    }\n\n    const pending = pendingOAuthFlow;\n    clearTimeout(pendingOAuthFlow.timeout);\n    pendingOAuthFlow = null;\n\n    if (reason) {\n      pending.reject(reason);\n    }\n  };\n\n  const handleCallbackUrl = (url: string): void => {\n    if (!pendingOAuthFlow || !isMatchingCallbackUrl(url, redirectUrl)) {\n      return;\n    }\n\n    const pending = pendingOAuthFlow;\n    disposePendingOAuthFlow();\n    pending.resolve({ callbackUrl: url });\n  };\n\n  const openUrlListener = (event: Electron.Event, url: string): void => {\n    if (!isMatchingCallbackUrl(url, redirectUrl)) {\n      return;\n    }\n\n    event.preventDefault();\n    handleCallbackUrl(url);\n  };\n\n  const secondInstanceListener = (_event: Electron.Event, argv: string[]): void => {\n    const callbackUrl = argv.find(url => isMatchingCallbackUrl(url, redirectUrl));\n\n    if (callbackUrl) {\n      handleCallbackUrl(callbackUrl);\n    }\n  };\n\n  app.setAsDefaultProtocolClient(options.renderer.scheme);\n  app.on('open-url', openUrlListener);\n  app.on('second-instance', secondInstanceListener);\n\n  ipcMain.handle(OAUTH_TRANSPORT_CHANNELS.getRedirectUrl, () => {\n    return redirectUrl;\n  });\n\n  ipcMain.handle(OAUTH_TRANSPORT_CHANNELS.open, async (_event, url: string) => {\n    if (pendingOAuthFlow) {\n      throw new Error('Clerk: an OAuth flow is already pending.');\n    }\n\n    assertExternalOAuthUrl(url);\n\n    const callbackPromise = new Promise<{ callbackUrl: string }>((resolve, reject) => {\n      const timeout = setTimeout(() => {\n        disposePendingOAuthFlow();\n        reject(new Error('Clerk: OAuth callback timed out.'));\n      }, CALLBACK_TIMEOUT_MS);\n\n      pendingOAuthFlow = { resolve, reject, timeout };\n    });\n\n    try {\n      await shell.openExternal(url);\n    } catch (err) {\n      disposePendingOAuthFlow(err instanceof Error ? err : new Error(String(err)));\n    }\n\n    return callbackPromise;\n  });\n\n  return () => {\n    disposePendingOAuthFlow(new Error('Clerk: OAuth flow was cancelled.'));\n    app.removeListener('open-url', openUrlListener);\n    app.removeListener('second-instance', secondInstanceListener);\n    ipcMain.removeHandler(OAUTH_TRANSPORT_CHANNELS.getRedirectUrl);\n    ipcMain.removeHandler(OAUTH_TRANSPORT_CHANNELS.open);\n  };\n}\n","import type { IpcMainInvokeEvent } from 'electron';\nimport { BrowserWindow, ipcMain } from 'electron';\n\nimport { PASSKEY_CHANNELS } from '../shared/ipc';\nimport type {\n  AuthenticationResponseJSON,\n  PasskeyCapabilities,\n  PasskeyIpcResult,\n  PasskeyNativeErrorCode,\n  RegistrationResponseJSON,\n  SerializedPublicKeyCredentialCreationOptions,\n  SerializedPublicKeyCredentialRequestOptions,\n  SetupPasskeysMainReturn,\n} from '../shared/types';\n\n/**\n * Optional native module. Ceremony failures resolve as JSON envelopes so error\n * codes survive both the FFI and Electron IPC boundaries.\n */\ntype NativePasskeysModule = {\n  isAvailable: () => boolean;\n  capabilities: () => Omit<PasskeyCapabilities, 'available'>;\n  createCredential: (windowHandle: Buffer, optionsJson: string) => Promise<string>;\n  getCredential: (windowHandle: Buffer, optionsJson: string) => Promise<string>;\n};\n\nlet nativeModulePromise: Promise<NativePasskeysModule> | undefined;\n\nfunction loadNativeModule(): Promise<NativePasskeysModule> {\n  // Keep the native module optional for apps that do not use passkeys.\n  nativeModulePromise ??= import('@clerk/electron-passkeys').then(\n    (module: { default?: NativePasskeysModule } & NativePasskeysModule) => module.default ?? module,\n    error => {\n      nativeModulePromise = undefined;\n      throw new Error(\n        'Clerk: createClerkBridge({ passkeys: true }) requires the optional @clerk/electron-passkeys package. Install it with your package manager to enable native passkey support.',\n        { cause: error },\n      );\n    },\n  );\n  return nativeModulePromise;\n}\n\nconst NATIVE_ERROR_CODES: PasskeyNativeErrorCode[] = ['cancelled', 'invalid_rp', 'not_supported', 'timeout', 'unknown'];\n\nfunction isPasskeyIpcResult<T>(value: unknown): value is PasskeyIpcResult<T> {\n  if (!value || typeof value !== 'object' || typeof (value as { ok?: unknown }).ok !== 'boolean') {\n    return false;\n  }\n  const result = value as { ok: boolean; credential?: unknown; error?: { code?: unknown } };\n  return result.ok\n    ? result.credential !== undefined\n    : NATIVE_ERROR_CODES.includes(result.error?.code as PasskeyNativeErrorCode);\n}\n\nasync function invokeNative<T>(\n  method: 'createCredential' | 'getCredential',\n  event: IpcMainInvokeEvent,\n  options: SerializedPublicKeyCredentialCreationOptions | SerializedPublicKeyCredentialRequestOptions,\n): Promise<PasskeyIpcResult<T>> {\n  let native: NativePasskeysModule;\n  try {\n    native = await loadNativeModule();\n  } catch (error) {\n    return {\n      ok: false,\n      error: { code: 'not_supported', message: error instanceof Error ? error.message : String(error) },\n    };\n  }\n\n  if (!native.isAvailable()) {\n    return {\n      ok: false,\n      error: { code: 'not_supported', message: 'Native passkeys are not supported on this platform.' },\n    };\n  }\n\n  // Subframes and webviews can host third-party content that must not be able\n  // to run credential ceremonies for the app's RP ID.\n  if (!event.senderFrame || event.senderFrame !== event.sender.mainFrame) {\n    return {\n      ok: false,\n      error: { code: 'unknown', message: \"The passkey request did not originate from a window's main frame.\" },\n    };\n  }\n\n  const window = BrowserWindow.fromWebContents(event.sender);\n  if (!window) {\n    return {\n      ok: false,\n      error: { code: 'unknown', message: 'The passkey request did not originate from a visible window.' },\n    };\n  }\n\n  try {\n    const resultJson = await native[method](window.getNativeWindowHandle(), JSON.stringify(options));\n    const result: unknown = JSON.parse(resultJson);\n    if (!isPasskeyIpcResult<T>(result)) {\n      return { ok: false, error: { code: 'unknown', message: 'The native module returned an unexpected result.' } };\n    }\n    return result;\n  } catch (error) {\n    return { ok: false, error: { code: 'unknown', message: error instanceof Error ? error.message : String(error) } };\n  }\n}\n\n/** Registers IPC handlers for native platform WebAuthn. */\nexport function setupPasskeysMain(): SetupPasskeysMainReturn {\n  // Surface a missing optional dependency during setup, before the first ceremony.\n  loadNativeModule().catch((error: Error) => console.warn(error.message));\n\n  ipcMain.handle(\n    PASSKEY_CHANNELS.create,\n    (\n      event,\n      options: SerializedPublicKeyCredentialCreationOptions,\n    ): Promise<PasskeyIpcResult<RegistrationResponseJSON>> => invokeNative('createCredential', event, options),\n  );\n\n  ipcMain.handle(\n    PASSKEY_CHANNELS.get,\n    (\n      event,\n      options: SerializedPublicKeyCredentialRequestOptions,\n    ): Promise<PasskeyIpcResult<AuthenticationResponseJSON>> => invokeNative('getCredential', event, options),\n  );\n\n  ipcMain.handle(PASSKEY_CHANNELS.capabilities, async (): Promise<PasskeyCapabilities> => {\n    try {\n      const native = await loadNativeModule();\n      if (!native.isAvailable()) {\n        return { available: false, platformAuthenticator: false, securityKeys: false };\n      }\n      return { available: true, ...native.capabilities() };\n    } catch {\n      return { available: false, platformAuthenticator: false, securityKeys: false };\n    }\n  });\n\n  return {\n    cleanup() {\n      ipcMain.removeHandler(PASSKEY_CHANNELS.create);\n      ipcMain.removeHandler(PASSKEY_CHANNELS.get);\n      ipcMain.removeHandler(PASSKEY_CHANNELS.capabilities);\n    },\n  };\n}\n","import { protocol } from 'electron';\n\nimport type { ClerkBridge, CreateClerkBridgeOptions } from '../shared/types';\nimport { setupTokenCacheIpcHandlers } from './ipc-handlers';\nimport { setupOAuthTransportIpcHandlers } from './oauth-transport';\nimport { setupPasskeysMain } from './passkey-handlers';\n\nfunction assertValidRendererOriginConfig(renderer: NonNullable<CreateClerkBridgeOptions['renderer']>): void {\n  if (renderer.scheme.includes(':') || renderer.scheme.includes('/')) {\n    throw new Error(\n      'Clerk: renderer.scheme must be a scheme name like \"my-app\", not a URL or protocol like \"my-app://\".',\n    );\n  }\n\n  if (renderer.host.includes(':') || renderer.host.includes('/')) {\n    throw new Error(\n      'Clerk: renderer.host must be a host name like \"renderer\", not a URL or origin like \"my-app://renderer\".',\n    );\n  }\n}\n\n/**\n * Creates the Clerk bridge for Electron's main process.\n *\n * The bridge owns Clerk's main-process IPC handlers, token persistence, and OAuth deep-link\n * transport. Call this before creating renderer windows, and call the returned `cleanup` method\n * when tearing down the app or test environment.\n */\nexport function createClerkBridge(options: CreateClerkBridgeOptions): ClerkBridge {\n  if (!options.storage) {\n    throw new Error(\n      'Clerk: createClerkBridge requires a storage adapter. Pass createClerkBridge({ storage: storage() }) from @clerk/electron/storage, or provide a custom storage adapter.',\n    );\n  }\n\n  const cleanupTokenPersistence = setupTokenCacheIpcHandlers(options.storage);\n  let cleanupOAuthTransport: (() => void) | undefined;\n  const passkeys = options.passkeys ? setupPasskeysMain() : null;\n\n  if (options.renderer) {\n    assertValidRendererOriginConfig(options.renderer);\n\n    protocol.registerSchemesAsPrivileged([\n      {\n        scheme: options.renderer.scheme,\n        privileges: {\n          standard: true,\n          secure: true,\n          supportFetchAPI: true,\n          corsEnabled: true,\n          stream: true,\n        },\n      },\n    ]);\n\n    cleanupOAuthTransport = setupOAuthTransportIpcHandlers({\n      renderer: options.renderer,\n    });\n  }\n\n  return {\n    cleanup() {\n      cleanupTokenPersistence();\n      cleanupOAuthTransport?.();\n      passkeys?.cleanup();\n    },\n  };\n}\n"]}