@clerk/electron 0.0.1 → 0.0.2-canary.v20260622192220

package/README.md

@@ -37,6 +37,7 @@ This package exposes entrypoints for Electron's distinct runtime contexts:
 - `@clerk/electron/preload` — for use in Electron **preload** scripts.
 - `@clerk/electron/react` — for use in the Electron **renderer** process.
 - `@clerk/electron/storage` — default token storage backed by `electron-store`.
+- `@clerk/electron/passkeys` — passkey (WebAuthn) support for the **renderer** process.
 
 ```ts
 // main.ts
@@ -52,6 +53,7 @@ createClerkBridge({
     scheme: 'my-app',
     host: 'renderer',
   },
+  passkeys: true,
 });
 
 app.whenReady().then(() => {
@@ -78,16 +80,157 @@ In `my-app://renderer/sign-in`, `my-app` is the scheme, `renderer` is the host,
 // preload.ts
 import { exposeClerkBridge } from '@clerk/electron/preload';
 
-exposeClerkBridge();
+exposeClerkBridge({ passkeys: true });
 ```
 
 ```tsx
 // renderer.tsx
 import { ClerkProvider } from '@clerk/electron/react';
+import { passkeys } from '@clerk/electron/passkeys';
+
+<ClerkProvider
+  publishableKey={import.meta.env.VITE_CLERK_PUBLISHABLE_KEY}
+  passkeys={passkeys}
+>
+  {/* ... */}
+</ClerkProvider>;
+```
+
+## Content Security Policy
+
+`@clerk/electron` loads Clerk's prebuilt UI from Clerk's CDN at runtime rather than bundling it, so your renderer's Content Security Policy must allow Clerk's Frontend API host. If it doesn't, the UI script fails to load and Clerk components never render.
+
+Replace `{fapi_host}` below with your instance's **Frontend API** host, found in the [Clerk Dashboard](https://dashboard.clerk.com) under **API keys**. It includes a `clerk.` segment (for example, `clerk.your-app.com` in production or `your-slug.clerk.accounts.dev` in development). This is _not_ the Account Portal URL (`your-slug.accounts.dev`) — using that host blocks the UI script from loading.
+
+```
+default-src 'self';
+script-src 'self' 'unsafe-inline' https://{fapi_host} https://challenges.cloudflare.com;
+connect-src 'self' https://{fapi_host};
+img-src 'self' https://img.clerk.com data:;
+style-src 'self' 'unsafe-inline';
+worker-src 'self' blob:;
+frame-src 'self' https://challenges.cloudflare.com;
+form-action 'self';
+```
+
+> [!NOTE]
+> This covers sign-in/up and the hotloaded UI. If you use Clerk Billing (Stripe) or other features, you'll need to allow additional origins; see Clerk's [CSP guide](https://clerk.com/docs/guides/secure/best-practices/csp-headers) for the full list.
+
+Apply it either with a `<meta>` tag in your renderer HTML:
+
+```html
+<meta
+  http-equiv="Content-Security-Policy"
+  content="default-src 'self'; script-src 'self' 'unsafe-inline' https://{fapi_host} https://challenges.cloudflare.com; connect-src 'self' https://{fapi_host}; img-src 'self' https://img.clerk.com data:; style-src 'self' 'unsafe-inline'; worker-src 'self' blob:; frame-src 'self' https://challenges.cloudflare.com; form-action 'self';"
+/>
+```
+
+or, as [Electron's security guide](https://www.electronjs.org/docs/latest/tutorial/security#7-define-a-content-security-policy) recommends, as a response header from the main process:
+
+```ts
+// main.ts
+import { app, session } from 'electron';
+
+const fapiHost = 'clerk.your-app.com';
+
+app.whenReady().then(() => {
+  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
+    callback({
+      responseHeaders: {
+        ...details.responseHeaders,
+        'Content-Security-Policy': [
+          [
+            "default-src 'self'",
+            `script-src 'self' 'unsafe-inline' https://${fapiHost} https://challenges.cloudflare.com`,
+            `connect-src 'self' https://${fapiHost}`,
+            "img-src 'self' https://img.clerk.com data:",
+            "style-src 'self' 'unsafe-inline'",
+            "worker-src 'self' blob:",
+            "frame-src 'self' https://challenges.cloudflare.com",
+            "form-action 'self'",
+          ].join('; '),
+        ],
+      },
+    });
+  });
+});
+```
+
+> [!NOTE]
+> Loading the renderer from a dev server (such as Vite) requires looser rules for HMR: add `'unsafe-eval'` to `script-src` and your dev server's origin to `connect-src` (for example, `ws://localhost:<port> http://localhost:<port>`). Many apps skip CSP during development and apply it only to packaged builds.
+
+## Passkeys
+
+Passkey support works in two modes, selected automatically per request:
+
+- **Renderer mode**: when your window loads content over `https://` from an origin that matches your passkey RP (Relying Party) ID, the renderer's built-in Chromium WebAuthn is used. Credentials are synced by the OS/browser ecosystem (Windows Hello works out of the box; Touch ID on macOS requires Electron ≥ 42 and [`app.configureWebAuthn`](https://www.electronjs.org/docs/latest/api/app#appconfigurewebauthnoptions-macos)).
+- **Native mode**: when your window loads a local bundle (e.g. `scheme://host`), WebAuthn's origin checks reject the request, so the ceremony is routed over IPC to the main process and serviced by the OS WebAuthn APIs (AuthenticationServices on macOS, `webauthn.dll` on Windows) via the optional [`@clerk/electron-passkeys`](https://github.com/clerk/javascript/tree/main/packages/electron-passkeys) native module.
+
+### Setup
+
+Native mode requires the optional native module:
 
-<ClerkProvider publishableKey={import.meta.env.VITE_CLERK_PUBLISHABLE_KEY}>{/* ... */}</ClerkProvider>;
+```sh
+pnpm add @clerk/electron-passkeys
 ```
 
+```ts
+// main process
+import { createClerkBridge } from '@clerk/electron';
+import { storage } from '@clerk/electron/storage';
+
+createClerkBridge({ storage: storage(), passkeys: true });
+```
+
+```ts
+// preload script
+import { exposeClerkBridge } from '@clerk/electron/preload';
+
+exposeClerkBridge({ passkeys: true });
+```
+
+```tsx
+// renderer process (React)
+import { ClerkProvider } from '@clerk/electron/react';
+import { passkeys } from '@clerk/electron/passkeys';
+
+<ClerkProvider
+  publishableKey={publishableKey}
+  passkeys={passkeys}
+>
+  {/* ... */}
+</ClerkProvider>;
+```
+
+Passkey code is only bundled and initialized when you pass the `passkeys` prop. If you manage the Clerk instance yourself instead of using `ClerkProvider`, wire it up before `clerk.load()`:
+
+```ts
+// renderer process (vanilla)
+import { Clerk } from '@clerk/clerk-js';
+import { createPasskeyProvider } from '@clerk/electron/passkeys';
+
+const clerk = new Clerk(publishableKey);
+createPasskeyProvider(clerk);
+await clerk.load();
+```
+
+### macOS requirements for native mode
+
+Like passkeys on iOS, the macOS platform APIs require a verified association between your app and your domain:
+
+1. In the Clerk Dashboard, navigate to the [Native applications](https://dashboard.clerk.com/~/native-applications) page and ensure that the Native API is enabled. This is required to integrate Clerk in your Electron application.
+2. Add an iOS application to the [Native applications](https://dashboard.clerk.com/~/native-applications) page in the Clerk Dashboard. You will need your app's App ID Prefix and Bundle ID. An Electron macOS app uses the same configuration as iOS applications.
+3. Sign your app with `com.apple.developer.associated-domains` containing `webcredentials:<rp-domain>`. This is a _restricted_ entitlement: the build must embed a provisioning profile with the Associated Domains capability for the bundle ID, and the entitlements must also include `com.apple.application-identifier` and `com.apple.developer.team-identifier` matching the profile.
+
+Quick Tips (each of these failure modes produces the same opaque "not associated with domain" error):
+
+- Sign with an **Apple Development** identity (`mac.type: development` in electron-builder) and a **macOS App Development** profile that includes your Mac; also install the profile on the machine (`~/Library/Developer/Xcode/UserData/Provisioning Profiles/<UUID>.provisionprofile`).
+- Copy `.app` bundles with `ditto`. Other copy methods may break the app seal and macOS silently ignores the entitlements of an app whose signature fails `codesign --verify --deep --strict`.
+- The system registers the domain association via `swcd` when the app launches; verify with `sudo swcutil show`. If state gets stuck, `sudo swcutil reset` and relaunch.
+- Prefer the default (production/CDN) association route. `?mode=developer` + `sudo swcutil developer-mode -e true` exists but is often flaky.
+
+Windows has no equivalent requirement. On Linux there is no native path; passkeys work in renderer mode only (including external security keys).
+
 ## Support
 
 For help, visit our [support page](https://clerk.com/contact/support?utm_source=github&utm_medium=clerk_electron).

package/dist/index-DdiKCj-P.d.mts

@@ -0,0 +1,70 @@
+import { CredentialReturn, PublicKeyCredentialCreationOptionsWithoutExtensions, PublicKeyCredentialRequestOptionsWithoutExtensions, PublicKeyCredentialWithAuthenticatorAssertionResponse, PublicKeyCredentialWithAuthenticatorAttestationResponse } from "@clerk/shared/types";
+
+//#region src/passkeys/renderer/strategy.d.ts
+type PasskeyMode = 'auto' | 'renderer' | 'native';
+type PasskeyPath = 'renderer' | 'native' | 'unsupported';
+type StrategyEnv = {
+  protocol: string;
+  hostname: string;
+  hasWebAuthn: boolean;
+  nativeAvailable: boolean;
+  platform: string;
+  electronMajor: number;
+};
+//#endregion
+//#region src/passkeys/index.d.ts
+type CreatePasskeysOptions = {
+  /**
+   * WebAuthn implementation to use:
+   * `auto` chooses renderer WebAuthn for valid HTTPS origins and native WebAuthn otherwise.
+   */
+  mode?: PasskeyMode;
+};
+type PasskeySupport = {
+  create: (publicKey: PublicKeyCredentialCreationOptionsWithoutExtensions) => Promise<CredentialReturn<PublicKeyCredentialWithAuthenticatorAttestationResponse>>;
+  get: (args: {
+    publicKeyOptions: PublicKeyCredentialRequestOptionsWithoutExtensions;
+  }) => Promise<CredentialReturn<PublicKeyCredentialWithAuthenticatorAssertionResponse>>;
+  isSupported: () => boolean;
+  isAutoFillSupported: () => Promise<boolean>;
+  isPlatformAuthenticatorSupported: () => Promise<boolean>;
+};
+type ClerkPasskeyHost = {
+  __internal_createPublicCredentials: PasskeySupport['create'] | undefined;
+  __internal_getPublicCredentials: PasskeySupport['get'] | undefined;
+  __internal_isWebAuthnSupported: PasskeySupport['isSupported'] | undefined;
+  __internal_isWebAuthnAutofillSupported: PasskeySupport['isAutoFillSupported'] | undefined;
+  __internal_isWebAuthnPlatformAuthenticatorSupported: PasskeySupport['isPlatformAuthenticatorSupported'] | undefined;
+};
+/** Creates an Electron passkey provider for clerk-js. */
+declare function createPasskeys(options?: CreatePasskeysOptions): PasskeySupport;
+/**
+ * Ready-to-use passkey implementation for the `ClerkProvider` `passkeys` prop.
+ * Chooses renderer or native WebAuthn automatically per request.
+ *
+ * @example
+ * ```tsx
+ * import { ClerkProvider } from '@clerk/electron/react';
+ * import { passkeys } from '@clerk/electron/passkeys';
+ *
+ * <ClerkProvider publishableKey={publishableKey} passkeys={passkeys} />
+ * ```
+ */
+declare const passkeys: PasskeySupport;
+/**
+ * Wires passkey support into a Clerk instance. Call before `clerk.load()`.
+ *
+ * @example
+ * ```ts
+ * import { Clerk } from '@clerk/clerk-js';
+ * import { createPasskeyProvider } from '@clerk/electron/passkeys';
+ *
+ * const clerk = new Clerk(publishableKey);
+ * createPasskeyProvider(clerk);
+ * await clerk.load();
+ * ```
+ */
+declare function createPasskeyProvider(clerk: ClerkPasskeyHost, options?: CreatePasskeysOptions): PasskeySupport;
+//#endregion
+export { createPasskeys as a, PasskeyPath as c, createPasskeyProvider as i, StrategyEnv as l, CreatePasskeysOptions as n, passkeys as o, PasskeySupport as r, PasskeyMode as s, ClerkPasskeyHost as t };
+//# sourceMappingURL=index-DdiKCj-P.d.mts.map

package/dist/index-DdiKCj-P.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-DdiKCj-P.d.mts","names":[],"sources":["../src/passkeys/renderer/strategy.ts","../src/passkeys/index.ts"],"mappings":";;;KAAY,WAAA;AAAA,KACA,WAAA;AAAA,KAEA,WAAA;EACV,QAAA;EACA,QAAA;EACA,WAAA;EACA,eAAA;EACA,QAAA;EACA,aAAA;AAAA;;;KCQU,qBAAA;EDjBW;;;AAAA;ECsBrB,IAAA,GAAO,WAAW;AAAA;AAAA,KAGR,cAAA;EACV,MAAA,GACE,SAAA,EAAW,mDAAA,KACR,OAAA,CAAQ,gBAAA,CAAiB,uDAAA;EAC9B,GAAA,GAAM,IAAA;IACJ,gBAAA,EAAkB,kDAAA;EAAA,MACd,OAAA,CAAQ,gBAAA,CAAiB,qDAAA;EAC/B,WAAA;EACA,mBAAA,QAA2B,OAAA;EAC3B,gCAAA,QAAwC,OAAA;AAAA;AAAA,KAG9B,gBAAA;EACV,kCAAA,EAAoC,cAAA;EACpC,+BAAA,EAAiC,cAAA;EACjC,8BAAA,EAAgC,cAAA;EAChC,sCAAA,EAAwC,cAAA;EACxC,mDAAA,EAAqD,cAAA;AAAA;;iBAyCvC,cAAA,CAAe,OAAA,GAAU,qBAAA,GAAwB,cAAc;AAlE/E;;;;AAKoB;AAGpB;;;;;;;AARA,cAuJa,QAAA,EAAU,cAAiC;;;;;;;;;;;;;;iBAexC,qBAAA,CAAsB,KAAA,EAAO,gBAAA,EAAkB,OAAA,GAAU,qBAAA,GAAwB,cAAA"}

package/dist/index-DdiKCj-P.d.ts

@@ -0,0 +1,70 @@
+import { CredentialReturn, PublicKeyCredentialCreationOptionsWithoutExtensions, PublicKeyCredentialRequestOptionsWithoutExtensions, PublicKeyCredentialWithAuthenticatorAssertionResponse, PublicKeyCredentialWithAuthenticatorAttestationResponse } from "@clerk/shared/types";
+
+//#region src/passkeys/renderer/strategy.d.ts
+type PasskeyMode = 'auto' | 'renderer' | 'native';
+type PasskeyPath = 'renderer' | 'native' | 'unsupported';
+type StrategyEnv = {
+  protocol: string;
+  hostname: string;
+  hasWebAuthn: boolean;
+  nativeAvailable: boolean;
+  platform: string;
+  electronMajor: number;
+};
+//#endregion
+//#region src/passkeys/index.d.ts
+type CreatePasskeysOptions = {
+  /**
+   * WebAuthn implementation to use:
+   * `auto` chooses renderer WebAuthn for valid HTTPS origins and native WebAuthn otherwise.
+   */
+  mode?: PasskeyMode;
+};
+type PasskeySupport = {
+  create: (publicKey: PublicKeyCredentialCreationOptionsWithoutExtensions) => Promise<CredentialReturn<PublicKeyCredentialWithAuthenticatorAttestationResponse>>;
+  get: (args: {
+    publicKeyOptions: PublicKeyCredentialRequestOptionsWithoutExtensions;
+  }) => Promise<CredentialReturn<PublicKeyCredentialWithAuthenticatorAssertionResponse>>;
+  isSupported: () => boolean;
+  isAutoFillSupported: () => Promise<boolean>;
+  isPlatformAuthenticatorSupported: () => Promise<boolean>;
+};
+type ClerkPasskeyHost = {
+  __internal_createPublicCredentials: PasskeySupport['create'] | undefined;
+  __internal_getPublicCredentials: PasskeySupport['get'] | undefined;
+  __internal_isWebAuthnSupported: PasskeySupport['isSupported'] | undefined;
+  __internal_isWebAuthnAutofillSupported: PasskeySupport['isAutoFillSupported'] | undefined;
+  __internal_isWebAuthnPlatformAuthenticatorSupported: PasskeySupport['isPlatformAuthenticatorSupported'] | undefined;
+};
+/** Creates an Electron passkey provider for clerk-js. */
+declare function createPasskeys(options?: CreatePasskeysOptions): PasskeySupport;
+/**
+ * Ready-to-use passkey implementation for the `ClerkProvider` `passkeys` prop.
+ * Chooses renderer or native WebAuthn automatically per request.
+ *
+ * @example
+ * ```tsx
+ * import { ClerkProvider } from '@clerk/electron/react';
+ * import { passkeys } from '@clerk/electron/passkeys';
+ *
+ * <ClerkProvider publishableKey={publishableKey} passkeys={passkeys} />
+ * ```
+ */
+declare const passkeys: PasskeySupport;
+/**
+ * Wires passkey support into a Clerk instance. Call before `clerk.load()`.
+ *
+ * @example
+ * ```ts
+ * import { Clerk } from '@clerk/clerk-js';
+ * import { createPasskeyProvider } from '@clerk/electron/passkeys';
+ *
+ * const clerk = new Clerk(publishableKey);
+ * createPasskeyProvider(clerk);
+ * await clerk.load();
+ * ```
+ */
+declare function createPasskeyProvider(clerk: ClerkPasskeyHost, options?: CreatePasskeysOptions): PasskeySupport;
+//#endregion
+export { createPasskeys as a, PasskeyPath as c, createPasskeyProvider as i, StrategyEnv as l, CreatePasskeysOptions as n, passkeys as o, PasskeySupport as r, PasskeyMode as s, ClerkPasskeyHost as t };
+//# sourceMappingURL=index-DdiKCj-P.d.ts.map

package/dist/index-DdiKCj-P.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-DdiKCj-P.d.ts","names":[],"sources":["../src/passkeys/renderer/strategy.ts","../src/passkeys/index.ts"],"mappings":";;;KAAY,WAAA;AAAA,KACA,WAAA;AAAA,KAEA,WAAA;EACV,QAAA;EACA,QAAA;EACA,WAAA;EACA,eAAA;EACA,QAAA;EACA,aAAA;AAAA;;;KCQU,qBAAA;EDjBW;;;AAAA;ECsBrB,IAAA,GAAO,WAAW;AAAA;AAAA,KAGR,cAAA;EACV,MAAA,GACE,SAAA,EAAW,mDAAA,KACR,OAAA,CAAQ,gBAAA,CAAiB,uDAAA;EAC9B,GAAA,GAAM,IAAA;IACJ,gBAAA,EAAkB,kDAAA;EAAA,MACd,OAAA,CAAQ,gBAAA,CAAiB,qDAAA;EAC/B,WAAA;EACA,mBAAA,QAA2B,OAAA;EAC3B,gCAAA,QAAwC,OAAA;AAAA;AAAA,KAG9B,gBAAA;EACV,kCAAA,EAAoC,cAAA;EACpC,+BAAA,EAAiC,cAAA;EACjC,8BAAA,EAAgC,cAAA;EAChC,sCAAA,EAAwC,cAAA;EACxC,mDAAA,EAAqD,cAAA;AAAA;;iBAyCvC,cAAA,CAAe,OAAA,GAAU,qBAAA,GAAwB,cAAc;AAlE/E;;;;AAKoB;AAGpB;;;;;;;AARA,cAuJa,QAAA,EAAU,cAAiC;;;;;;;;;;;;;;iBAexC,qBAAA,CAAsB,KAAA,EAAO,gBAAA,EAAkB,OAAA,GAAU,qBAAA,GAAwB,cAAA"}

package/dist/index.d.mts

@@ -0,0 +1,18 @@
+import { a as TokenStorage, i as SetupPasskeysMainReturn, n as CreateClerkBridgeOptions, r as ExposeClerkBridgeOptions, t as ClerkBridge } from "./types-nWjUdPq4.mjs";
+
+//#region src/main/create-clerk-bridge.d.ts
+/**
+ * Creates the Clerk bridge for Electron's main process.
+ *
+ * The bridge owns Clerk's main-process IPC handlers, token persistence, and OAuth deep-link
+ * transport. Call this before creating renderer windows, and call the returned `cleanup` method
+ * when tearing down the app or test environment.
+ */
+declare function createClerkBridge(options: CreateClerkBridgeOptions): ClerkBridge;
+//#endregion
+//#region src/main/passkey-handlers.d.ts
+/** Registers IPC handlers for native platform WebAuthn. */
+declare function setupPasskeysMain(): SetupPasskeysMainReturn;
+//#endregion
+export { type ClerkBridge, type CreateClerkBridgeOptions, type ExposeClerkBridgeOptions, type TokenStorage, createClerkBridge, setupPasskeysMain };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/main/create-clerk-bridge.ts","../src/main/passkey-handlers.ts"],"mappings":";;;;;AA4BA;;;;;iBAAgB,iBAAA,CAAkB,OAAA,EAAS,wBAAA,GAA2B,WAAW;;;;iBC+EjE,iBAAA,IAAqB,uBAAuB"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+import { a as TokenStorage, i as SetupPasskeysMainReturn, n as CreateClerkBridgeOptions, r as ExposeClerkBridgeOptions, t as ClerkBridge } from "./types-nWjUdPq4.js";
+
+//#region src/main/create-clerk-bridge.d.ts
+/**
+ * Creates the Clerk bridge for Electron's main process.
+ *
+ * The bridge owns Clerk's main-process IPC handlers, token persistence, and OAuth deep-link
+ * transport. Call this before creating renderer windows, and call the returned `cleanup` method
+ * when tearing down the app or test environment.
+ */
+declare function createClerkBridge(options: CreateClerkBridgeOptions): ClerkBridge;
+//#endregion
+//#region src/main/passkey-handlers.d.ts
+/** Registers IPC handlers for native platform WebAuthn. */
+declare function setupPasskeysMain(): SetupPasskeysMainReturn;
+//#endregion
+export { type ClerkBridge, type CreateClerkBridgeOptions, type ExposeClerkBridgeOptions, type TokenStorage, createClerkBridge, setupPasskeysMain };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/main/create-clerk-bridge.ts","../src/main/passkey-handlers.ts"],"mappings":";;;;;AA4BA;;;;;iBAAgB,iBAAA,CAAkB,OAAA,EAAS,wBAAA,GAA2B,WAAW;;;;iBC+EjE,iBAAA,IAAqB,uBAAuB"}

package/dist/index.js

@@ -0,0 +1,255 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_ipc = require('./ipc-ByXFj84s.js');
+let electron = require("electron");
+
+//#region src/main/ipc-handlers.ts
+function setupTokenCacheIpcHandlers(storage) {
+	electron.ipcMain.handle(require_ipc.TOKEN_CACHE_CHANNELS.getToken, (_event, key) => {
+		return storage.getItem(key);
+	});
+	electron.ipcMain.handle(require_ipc.TOKEN_CACHE_CHANNELS.saveToken, (_event, key, value) => {
+		return storage.setItem(key, value);
+	});
+	electron.ipcMain.handle(require_ipc.TOKEN_CACHE_CHANNELS.clearToken, (_event, key) => {
+		return storage.removeItem(key);
+	});
+	return () => {
+		electron.ipcMain.removeHandler(require_ipc.TOKEN_CACHE_CHANNELS.getToken);
+		electron.ipcMain.removeHandler(require_ipc.TOKEN_CACHE_CHANNELS.saveToken);
+		electron.ipcMain.removeHandler(require_ipc.TOKEN_CACHE_CHANNELS.clearToken);
+	};
+}
+
+//#endregion
+//#region src/main/oauth-transport.ts
+const CALLBACK_TIMEOUT_MS = 180 * 1e3;
+function buildRedirectUrl(options) {
+	return `${options.renderer.scheme}://${options.renderer.host}/`;
+}
+function isMatchingCallbackUrl(url, redirectUrl) {
+	try {
+		const callback = new URL(url);
+		const expected = new URL(redirectUrl);
+		return callback.protocol === expected.protocol && callback.host === expected.host && callback.pathname === expected.pathname;
+	} catch {
+		return false;
+	}
+}
+function assertExternalOAuthUrl(url) {
+	const parsedUrl = new URL(url);
+	if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new TypeError(`Clerk: refusing to open unsupported OAuth URL protocol: ${parsedUrl.protocol}`);
+}
+function setupOAuthTransportIpcHandlers(options) {
+	const redirectUrl = buildRedirectUrl(options);
+	let pendingOAuthFlow = null;
+	const disposePendingOAuthFlow = (reason) => {
+		if (!pendingOAuthFlow) return;
+		const pending = pendingOAuthFlow;
+		clearTimeout(pendingOAuthFlow.timeout);
+		pendingOAuthFlow = null;
+		if (reason) pending.reject(reason);
+	};
+	const handleCallbackUrl = (url) => {
+		if (!pendingOAuthFlow || !isMatchingCallbackUrl(url, redirectUrl)) return;
+		const pending = pendingOAuthFlow;
+		disposePendingOAuthFlow();
+		pending.resolve({ callbackUrl: url });
+	};
+	const openUrlListener = (event, url) => {
+		if (!isMatchingCallbackUrl(url, redirectUrl)) return;
+		event.preventDefault();
+		handleCallbackUrl(url);
+	};
+	const secondInstanceListener = (_event, argv) => {
+		const callbackUrl = argv.find((url) => isMatchingCallbackUrl(url, redirectUrl));
+		if (callbackUrl) handleCallbackUrl(callbackUrl);
+	};
+	electron.app.setAsDefaultProtocolClient(options.renderer.scheme);
+	electron.app.on("open-url", openUrlListener);
+	electron.app.on("second-instance", secondInstanceListener);
+	electron.ipcMain.handle(require_ipc.OAUTH_TRANSPORT_CHANNELS.getRedirectUrl, () => {
+		return redirectUrl;
+	});
+	electron.ipcMain.handle(require_ipc.OAUTH_TRANSPORT_CHANNELS.open, async (_event, url) => {
+		if (pendingOAuthFlow) throw new Error("Clerk: an OAuth flow is already pending.");
+		assertExternalOAuthUrl(url);
+		const callbackPromise = new Promise((resolve, reject) => {
+			pendingOAuthFlow = {
+				resolve,
+				reject,
+				timeout: setTimeout(() => {
+					disposePendingOAuthFlow();
+					reject(/* @__PURE__ */ new Error("Clerk: OAuth callback timed out."));
+				}, CALLBACK_TIMEOUT_MS)
+			};
+		});
+		try {
+			await electron.shell.openExternal(url);
+		} catch (err) {
+			disposePendingOAuthFlow(err instanceof Error ? err : new Error(String(err)));
+		}
+		return callbackPromise;
+	});
+	return () => {
+		disposePendingOAuthFlow(/* @__PURE__ */ new Error("Clerk: OAuth flow was cancelled."));
+		electron.app.removeListener("open-url", openUrlListener);
+		electron.app.removeListener("second-instance", secondInstanceListener);
+		electron.ipcMain.removeHandler(require_ipc.OAUTH_TRANSPORT_CHANNELS.getRedirectUrl);
+		electron.ipcMain.removeHandler(require_ipc.OAUTH_TRANSPORT_CHANNELS.open);
+	};
+}
+
+//#endregion
+//#region src/main/passkey-handlers.ts
+let nativeModulePromise;
+function loadNativeModule() {
+	nativeModulePromise ??= import("@clerk/electron-passkeys").then((module) => module.default ?? module, (error) => {
+		nativeModulePromise = void 0;
+		throw new Error("Clerk: createClerkBridge({ passkeys: true }) requires the optional @clerk/electron-passkeys package. Install it with your package manager to enable native passkey support.", { cause: error });
+	});
+	return nativeModulePromise;
+}
+const NATIVE_ERROR_CODES = [
+	"cancelled",
+	"invalid_rp",
+	"not_supported",
+	"timeout",
+	"unknown"
+];
+function isPasskeyIpcResult(value) {
+	if (!value || typeof value !== "object" || typeof value.ok !== "boolean") return false;
+	const result = value;
+	return result.ok ? result.credential !== void 0 : NATIVE_ERROR_CODES.includes(result.error?.code);
+}
+async function invokeNative(method, event, options) {
+	let native;
+	try {
+		native = await loadNativeModule();
+	} catch (error) {
+		return {
+			ok: false,
+			error: {
+				code: "not_supported",
+				message: error instanceof Error ? error.message : String(error)
+			}
+		};
+	}
+	if (!native.isAvailable()) return {
+		ok: false,
+		error: {
+			code: "not_supported",
+			message: "Native passkeys are not supported on this platform."
+		}
+	};
+	if (!event.senderFrame || event.senderFrame !== event.sender.mainFrame) return {
+		ok: false,
+		error: {
+			code: "unknown",
+			message: "The passkey request did not originate from a window's main frame."
+		}
+	};
+	const window = electron.BrowserWindow.fromWebContents(event.sender);
+	if (!window) return {
+		ok: false,
+		error: {
+			code: "unknown",
+			message: "The passkey request did not originate from a visible window."
+		}
+	};
+	try {
+		const resultJson = await native[method](window.getNativeWindowHandle(), JSON.stringify(options));
+		const result = JSON.parse(resultJson);
+		if (!isPasskeyIpcResult(result)) return {
+			ok: false,
+			error: {
+				code: "unknown",
+				message: "The native module returned an unexpected result."
+			}
+		};
+		return result;
+	} catch (error) {
+		return {
+			ok: false,
+			error: {
+				code: "unknown",
+				message: error instanceof Error ? error.message : String(error)
+			}
+		};
+	}
+}
+/** Registers IPC handlers for native platform WebAuthn. */
+function setupPasskeysMain() {
+	loadNativeModule().catch((error) => console.warn(error.message));
+	electron.ipcMain.handle(require_ipc.PASSKEY_CHANNELS.create, (event, options) => invokeNative("createCredential", event, options));
+	electron.ipcMain.handle(require_ipc.PASSKEY_CHANNELS.get, (event, options) => invokeNative("getCredential", event, options));
+	electron.ipcMain.handle(require_ipc.PASSKEY_CHANNELS.capabilities, async () => {
+		try {
+			const native = await loadNativeModule();
+			if (!native.isAvailable()) return {
+				available: false,
+				platformAuthenticator: false,
+				securityKeys: false
+			};
+			return {
+				available: true,
+				...native.capabilities()
+			};
+		} catch {
+			return {
+				available: false,
+				platformAuthenticator: false,
+				securityKeys: false
+			};
+		}
+	});
+	return { cleanup() {
+		electron.ipcMain.removeHandler(require_ipc.PASSKEY_CHANNELS.create);
+		electron.ipcMain.removeHandler(require_ipc.PASSKEY_CHANNELS.get);
+		electron.ipcMain.removeHandler(require_ipc.PASSKEY_CHANNELS.capabilities);
+	} };
+}
+
+//#endregion
+//#region src/main/create-clerk-bridge.ts
+function assertValidRendererOriginConfig(renderer) {
+	if (renderer.scheme.includes(":") || renderer.scheme.includes("/")) throw new Error("Clerk: renderer.scheme must be a scheme name like \"my-app\", not a URL or protocol like \"my-app://\".");
+	if (renderer.host.includes(":") || renderer.host.includes("/")) throw new Error("Clerk: renderer.host must be a host name like \"renderer\", not a URL or origin like \"my-app://renderer\".");
+}
+/**
+* Creates the Clerk bridge for Electron's main process.
+*
+* The bridge owns Clerk's main-process IPC handlers, token persistence, and OAuth deep-link
+* transport. Call this before creating renderer windows, and call the returned `cleanup` method
+* when tearing down the app or test environment.
+*/
+function createClerkBridge(options) {
+	if (!options.storage) throw new Error("Clerk: createClerkBridge requires a storage adapter. Pass createClerkBridge({ storage: storage() }) from @clerk/electron/storage, or provide a custom storage adapter.");
+	const cleanupTokenPersistence = setupTokenCacheIpcHandlers(options.storage);
+	let cleanupOAuthTransport;
+	const passkeys = options.passkeys ? setupPasskeysMain() : null;
+	if (options.renderer) {
+		assertValidRendererOriginConfig(options.renderer);
+		electron.protocol.registerSchemesAsPrivileged([{
+			scheme: options.renderer.scheme,
+			privileges: {
+				standard: true,
+				secure: true,
+				supportFetchAPI: true,
+				corsEnabled: true,
+				stream: true,
+				...options.renderer.privileges
+			}
+		}]);
+		cleanupOAuthTransport = setupOAuthTransportIpcHandlers({ renderer: options.renderer });
+	}
+	return { cleanup() {
+		cleanupTokenPersistence();
+		cleanupOAuthTransport?.();
+		passkeys?.cleanup();
+	} };
+}
+
+//#endregion
+exports.createClerkBridge = createClerkBridge;
+exports.setupPasskeysMain = setupPasskeysMain;
+//# sourceMappingURL=index.js.map