@csntgao/uni-base 0.1.0

package/packages/web-components/src/uniplat-base-application-switcher-transport.ts

@@ -0,0 +1,418 @@
+import type {
+  ApplicationEntry,
+  ApplicationSwitcherTransport,
+  OrganizationEntry,
+  OrganizationListResult,
+} from './application-switcher-transport'
+import { resolveUniplatBaseApplicationEntryUrl } from './uniplat-base-application-ticket'
+import { createIdentityTicketLaunchResult } from './uniplat-base-identity-ticket'
+
+export interface UniplatBaseApplicationSwitcherTransportOptions {
+  serviceBaseUrl: string
+  /** @deprecated Application Switcher ticket navigation does not replace the current Host JWT. */
+  setAccessToken?(accessToken: string): void | Promise<void>
+  fetch?: typeof fetch
+}
+
+interface UniplatBaseIdentityTarget {
+  id: string
+  xid: string
+  applicationName: string
+}
+
+interface UniplatBaseApplicationTarget extends UniplatBaseIdentityTarget {
+  organizationId: string
+  applicationScope: 'open' | 'organization'
+  launchTarget:
+    { kind: 'local' } | { kind: 'external'; targetSystem: string; targetApplicationName: string }
+  entry: ApplicationEntry
+}
+
+interface UniplatBaseApplicationSnapshot {
+  currentOrganizationId: string
+  applications: readonly UniplatBaseApplicationTarget[]
+}
+
+const LIST_PATH = 'application.identity/list_available_applications'
+const ORGANIZATIONS_PATH = 'application.identity/list_available_organizations'
+const ISSUE_TICKET_PATH = 'application.identity/issue_ticket'
+
+export function createUniplatBaseApplicationSwitcherTransport(
+  options: UniplatBaseApplicationSwitcherTransportOptions,
+): ApplicationSwitcherTransport {
+  if (!options) throw new TypeError('UniplatBase transport options are required')
+  const serviceBaseUrl = validateServiceBaseUrl(options.serviceBaseUrl)
+  const listEndpoint = `${serviceBaseUrl}/${LIST_PATH}`
+  const organizationsEndpoint = `${serviceBaseUrl}/${ORGANIZATIONS_PATH}`
+  const issueTicketEndpoint = `${serviceBaseUrl}/${ISSUE_TICKET_PATH}`
+  const fetchImplementation = options.fetch ?? globalThis.fetch
+  let pendingApplicationAccessToken = ''
+  let pendingApplications: Promise<UniplatBaseApplicationSnapshot> | null = null
+  let pendingOrganizationAccessToken = ''
+  let pendingOrganizations: Promise<readonly OrganizationEntry[]> | null = null
+  let selectedOrganizationId = ''
+  let selectedCredentialMarker = ''
+
+  const loadApplications = (accessToken: string): Promise<UniplatBaseApplicationSnapshot> => {
+    const token = requireAccessToken(accessToken)
+    if (pendingApplications && pendingApplicationAccessToken === token) return pendingApplications
+
+    pendingApplicationAccessToken = token
+    const request = requestData(fetchImplementation, listEndpoint, token, {}).then(
+      parseApplicationsSnapshot,
+    )
+    pendingApplications = request
+    void request.then(clearPendingApplications, clearPendingApplications)
+    return request
+
+    function clearPendingApplications(): void {
+      if (pendingApplications === request) {
+        pendingApplications = null
+        pendingApplicationAccessToken = ''
+      }
+    }
+  }
+
+  const loadOrganizations = (accessToken: string): Promise<readonly OrganizationEntry[]> => {
+    const token = requireAccessToken(accessToken)
+    if (pendingOrganizations && pendingOrganizationAccessToken === token)
+      return pendingOrganizations
+
+    pendingOrganizationAccessToken = token
+    const request = requestData(fetchImplementation, organizationsEndpoint, token, {}).then(
+      parseOrganizations,
+    )
+    pendingOrganizations = request
+    void request.then(clearPendingOrganizations, clearPendingOrganizations)
+    return request
+
+    function clearPendingOrganizations(): void {
+      if (pendingOrganizations === request) {
+        pendingOrganizations = null
+        pendingOrganizationAccessToken = ''
+      }
+    }
+  }
+
+  const createApplicationTicket = async (
+    accessToken: string,
+    target: UniplatBaseApplicationTarget,
+  ) => {
+    const token = requireAccessToken(accessToken)
+    const entryUrl = resolveUniplatBaseApplicationEntryUrl(target.entry.url)
+    const data = await requestData(fetchImplementation, issueTicketEndpoint, token, {})
+    return createIdentityTicketLaunchResult(
+      entryUrl,
+      data.ticket,
+      data.expires_in,
+      data.source_system,
+    )
+  }
+
+  const resolveSelectedOrganizationId = (
+    snapshot: UniplatBaseApplicationSnapshot,
+    accessToken: string,
+  ): string => {
+    const credentialMarker = markCredentialRevision(accessToken)
+    if (credentialMarker !== selectedCredentialMarker) {
+      selectedCredentialMarker = credentialMarker
+      selectedOrganizationId =
+        snapshot.currentOrganizationId === '0' ? '' : snapshot.currentOrganizationId
+      return selectedOrganizationId
+    }
+    if (selectedOrganizationId) return selectedOrganizationId
+    // oid=0 means the open-application identity is not bound to an organization.
+    // Do not silently select the first available organization: that would expose
+    // organization-scoped applications before the user chooses an organization.
+    selectedOrganizationId =
+      snapshot.currentOrganizationId === '0' ? '' : snapshot.currentOrganizationId
+    return selectedOrganizationId
+  }
+
+  return {
+    async listApplications(accessToken) {
+      const snapshot = await loadApplications(accessToken)
+      const organizationId = resolveSelectedOrganizationId(snapshot, accessToken)
+      return snapshot.applications
+        .filter(
+          (target) =>
+            target.organizationId === organizationId || target.applicationScope === 'open',
+        )
+        .map((target) => ({ ...target.entry }))
+    },
+    async listOrganizations(accessToken): Promise<OrganizationListResult> {
+      const [snapshot, organizations] = await Promise.all([
+        loadApplications(accessToken),
+        loadOrganizations(accessToken),
+      ])
+      const currentOrganizationId = resolveSelectedOrganizationId(snapshot, accessToken)
+      return {
+        organizations: organizations.map((organization) => ({ ...organization })),
+        currentOrganizationId,
+      }
+    },
+    async switchOrganization(accessToken, organizationId) {
+      const token = requireAccessToken(accessToken)
+      const organizations = await loadOrganizations(accessToken)
+      const normalizedOrganizationId = organizationId.trim()
+      const available = organizations.some((candidate) => candidate.id === normalizedOrganizationId)
+      if (!available) throw new Error('Organization is unavailable')
+      selectedCredentialMarker = markCredentialRevision(token)
+      selectedOrganizationId = normalizedOrganizationId
+    },
+    async switchApplication(accessToken, applicationId) {
+      const snapshot = await loadApplications(accessToken)
+      const organizationId = resolveSelectedOrganizationId(snapshot, accessToken)
+      const selectedTarget = snapshot.applications.find(
+        (candidate) =>
+          candidate.id === applicationId.trim() &&
+          (candidate.organizationId === organizationId || candidate.applicationScope === 'open'),
+      )
+      if (!selectedTarget) throw new Error('Application is unavailable')
+      return createApplicationTicket(accessToken, selectedTarget)
+    },
+  }
+}
+
+function markCredentialRevision(accessToken: string): string {
+  let first = 0x811c9dc5
+  let second = 0x9e3779b9
+  for (let index = 0; index < accessToken.length; index += 1) {
+    const code = accessToken.charCodeAt(index)
+    first = Math.imul(first ^ code, 0x01000193)
+    second = Math.imul(second ^ (code + index), 0x85ebca6b)
+  }
+  return `${accessToken.length}:${(first >>> 0).toString(16)}:${(second >>> 0).toString(16)}`
+}
+
+async function requestData(
+  fetchImplementation: typeof fetch | undefined,
+  endpoint: string,
+  accessToken: string,
+  body: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  if (!fetchImplementation) throw new Error('Fetch is unavailable')
+  const response = await fetchImplementation(endpoint, {
+    method: 'POST',
+    credentials: 'include',
+    headers: {
+      accept: 'application/json',
+      authorization: `Bearer ${accessToken}`,
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify(body),
+  })
+  if (!response.ok) throw new Error('UniplatBase application request failed')
+
+  const envelope = asRecord(await response.json())
+  if (number(envelope.rescode) !== 0) throw new Error('UniplatBase application request failed')
+  const data = asRecord(envelope.data)
+  if (Object.keys(data).length === 0) throw new Error('UniplatBase application response is invalid')
+  return data
+}
+
+function parseApplicationsSnapshot(
+  applicationsData: Record<string, unknown>,
+): UniplatBaseApplicationSnapshot {
+  const currentIdentity = asRecord(applicationsData.current_identity)
+  const currentOrganizationId = identifier(currentIdentity.oid)
+  const currentApplicationName = text(currentIdentity.application_name).trim()
+  if (
+    !applicationIdentifier(currentIdentity.xid) ||
+    currentOrganizationId === '' ||
+    !currentApplicationName
+  ) {
+    throw new Error('UniplatBase current identity is invalid')
+  }
+
+  const availableApplications = applicationsData.available_applications
+  if (!Array.isArray(availableApplications)) {
+    throw new Error('UniplatBase application response is invalid')
+  }
+
+  const applicationEntryKeys = new Set<string>()
+  const parsedApplications: Array<{
+    target: UniplatBaseApplicationTarget
+    baseId: string
+    entryName: string
+  }> = []
+  for (const candidate of availableApplications) {
+    const record = asRecord(candidate)
+    const xid = applicationIdentifier(record.xid)
+    const applicationName = text(record.application_name).trim()
+    const organizationId = identifier(record.oid)
+    const applicationScope = applicationScopeValue(record.application_scope, organizationId)
+    const name = text(record.application_title).trim()
+    const url = text(record.entry_url).trim()
+    const entryName = text(record.entry_name).trim()
+    if (!xid || !applicationName || organizationId === '' || !name || !url) {
+      continue
+    }
+
+    // An application identity can expose multiple entries.  In particular,
+    // OfficialWebsite has the shared open identity (xid=0) for its main,
+    // personal and organizational entries.  Deduplicating only by identity
+    // would silently collapse those entries into one tile.
+    const identityKey = `${applicationName}:${xid}`
+    const entryKey = JSON.stringify([applicationName, xid, entryName, url])
+    if (applicationEntryKeys.has(entryKey)) continue
+    const entry: ApplicationEntry = { id: '', name, url }
+    const launchTarget = parseApplicationLaunchTarget(record)
+    const iconUrl = text(record.icon_url).trim()
+    const description = text(record.description).trim()
+    if (iconUrl) entry.iconUrl = iconUrl
+    if (description) entry.description = description
+    if (record.open_mode === 'blank') entry.openMode = 'blank'
+    parsedApplications.push({
+      target: {
+        id: '',
+        xid,
+        applicationName,
+        organizationId,
+        applicationScope,
+        launchTarget,
+        entry,
+      },
+      baseId: xid === '0' ? identityKey : xid,
+      entryName,
+    })
+    applicationEntryKeys.add(entryKey)
+  }
+
+  const baseIdCounts = new Map<string, number>()
+  for (const { baseId } of parsedApplications) {
+    baseIdCounts.set(baseId, (baseIdCounts.get(baseId) ?? 0) + 1)
+  }
+  const usedApplicationIds = new Set<string>()
+  const applications: UniplatBaseApplicationTarget[] = []
+  for (const [index, parsed] of parsedApplications.entries()) {
+    let id = parsed.baseId
+    if ((baseIdCounts.get(id) ?? 0) > 1) {
+      const normalizedEntryName = parsed.entryName
+        .replace(/[^a-zA-Z0-9_-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48)
+      const baseEntryId = `${id}:${normalizedEntryName || `entry-${index + 1}`}`
+      id = baseEntryId
+      let collision = 2
+      while (usedApplicationIds.has(id)) {
+        id = `${baseEntryId}-${collision}`
+        collision += 1
+      }
+    }
+    parsed.target.id = id
+    parsed.target.entry.id = id
+    usedApplicationIds.add(id)
+    applications.push(parsed.target)
+  }
+
+  return { currentOrganizationId, applications }
+}
+
+function parseApplicationLaunchTarget(
+  application: Record<string, unknown>,
+): UniplatBaseApplicationTarget['launchTarget'] {
+  if (!Object.prototype.hasOwnProperty.call(application, 'launch_target')) {
+    return { kind: 'local' }
+  }
+  const launchTarget = asRecord(application.launch_target)
+  const keys = Object.keys(launchTarget).sort()
+  const expectedKeys = ['application_name', 'target_system', 'type']
+  const targetSystem = text(launchTarget.target_system).trim()
+  const targetApplicationName = text(launchTarget.application_name).trim()
+  if (
+    keys.length !== expectedKeys.length ||
+    keys.some((key, index) => key !== expectedKeys[index]) ||
+    launchTarget.type !== 'external' ||
+    !targetSystem ||
+    targetSystem.length > 128 ||
+    !targetApplicationName ||
+    targetApplicationName.length > 255
+  ) {
+    throw new Error('UniplatBase external application target is invalid')
+  }
+  return { kind: 'external', targetSystem, targetApplicationName }
+}
+
+function parseOrganizations(
+  organizationsData: Record<string, unknown>,
+): readonly OrganizationEntry[] {
+  if (!Array.isArray(organizationsData.organizations)) {
+    throw new Error('UniplatBase organization response is invalid')
+  }
+  const organizationIds = new Set<string>()
+  const organizations: OrganizationEntry[] = []
+  for (const candidate of organizationsData.organizations) {
+    const record = asRecord(candidate)
+    const id = identifier(record.oid)
+    if (id === '' || organizationIds.has(id)) {
+      continue
+    }
+    const name = text(record.team_name).trim() || `组织 ${id}`
+    organizations.push({ id, name })
+    organizationIds.add(id)
+  }
+
+  return organizations
+}
+
+function validateServiceBaseUrl(rawValue: string): string {
+  const value = typeof rawValue === 'string' ? rawValue.trim() : ''
+  if (!value) throw new TypeError('UniplatBase serviceBaseUrl is required')
+  const documentBase = typeof document === 'undefined' ? 'https://localhost/' : document.baseURI
+  let url: URL
+  try {
+    url = new URL(value, documentBase)
+  } catch {
+    throw new TypeError('UniplatBase serviceBaseUrl is invalid')
+  }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+    throw new TypeError('UniplatBase serviceBaseUrl must use HTTP(S) without user credentials')
+  }
+  if (url.search || url.hash) {
+    throw new TypeError('UniplatBase serviceBaseUrl must not contain query or hash')
+  }
+  return url.href.replace(/\/+$/, '')
+}
+
+function requireAccessToken(accessToken: string): string {
+  const token = accessToken.trim()
+  if (!token) throw new Error('Access token is required')
+  return token
+}
+
+function applicationIdentifier(value: unknown): string {
+  const normalized = identifier(value)
+  // xid=0 is the valid global instance identity for an open application.
+  if (!normalized || !/^\d+$/.test(normalized)) return ''
+  return normalized
+}
+
+function identifier(value: unknown): string {
+  const normalized =
+    typeof value === 'string'
+      ? value.trim()
+      : typeof value === 'number' && Number.isSafeInteger(value) && value >= 0
+        ? String(value)
+        : ''
+  return /^\d+$/.test(normalized) ? normalized : ''
+}
+
+function applicationScopeValue(value: unknown, organizationId: string): 'open' | 'organization' {
+  if (value === 'open' || value === 'organization') return value
+  return organizationId === '0' ? 'open' : 'organization'
+}
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {}
+}
+
+function text(value: unknown): string {
+  return typeof value === 'string' ? value : ''
+}
+
+function number(value: unknown): number {
+  return typeof value === 'number' && Number.isFinite(value) ? value : Number.NaN
+}

package/packages/web-components/src/uniplat-base-application-ticket.ts

@@ -0,0 +1,254 @@
+import type { ApplicationLaunchResult } from './application-switcher-transport'
+
+export const UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY = 'uniplat_application_ticket'
+export const UNIPLAT_APPLICATION_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY = 'source_system'
+export const UNIPLAT_APPLICATION_TICKET_APPLICATION_NAME_FRAGMENT_KEY = 'application_name'
+
+export interface UniplatBaseApplicationTicketExchangeOptions {
+  serviceBaseUrl: string
+  applicationName: string
+  setAccessToken(accessToken: string): void | Promise<void>
+  fetch?: typeof fetch
+}
+
+const EXCHANGE_PATH = 'anonymous/application.identity/exchange_application_ticket'
+const MIN_TICKET_LENGTH = 22
+const MAX_TICKET_LENGTH = 512
+const MAX_TICKET_LIFETIME_SECONDS = 60
+
+export async function exchangeUniplatBaseApplicationTicket(
+  options: UniplatBaseApplicationTicketExchangeOptions,
+): Promise<boolean> {
+  if (!options || typeof options.setAccessToken !== 'function') {
+    throw new TypeError('Application ticket exchange requires setAccessToken()')
+  }
+  const serviceBaseUrl = validateServiceBaseUrl(options.serviceBaseUrl)
+  const applicationName = requireText(options.applicationName, 'Application name')
+  if (typeof window === 'undefined') return false
+
+  const fragment = readTicketFragment(window.location.hash)
+  let ticket = fragment.ticket
+  if (!ticket) return false
+  clearTicketFragment()
+  ticket = requireTicket(ticket)
+  const sourceSystem = fragment.sourceSystem
+
+  const fetchImplementation = options.fetch ?? globalThis.fetch
+  const endpoint = `${serviceBaseUrl}/${EXCHANGE_PATH}`
+  let accessToken = ''
+  let publicErrorMessage = ''
+  try {
+    if (!fetchImplementation) throw new Error('Fetch is unavailable')
+    const body: Record<string, string> = { ticket }
+    if (fragment.hasSourceSystem) {
+      body.source_system = sourceSystem
+      body.application_name = applicationName
+    }
+    const response = await fetchImplementation(endpoint, {
+      method: 'POST',
+      credentials: 'omit',
+      headers: {
+        accept: 'application/json',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    })
+    if (!response.ok) throw new Error('Application ticket exchange failed')
+    const envelope = asRecord(await response.json())
+    if (number(envelope.rescode) !== 0) {
+      publicErrorMessage = federatedPublicErrorMessage(envelope)
+      throw new Error('Application ticket exchange failed')
+    }
+    const data = asRecord(envelope.data)
+    accessToken = text(data.token).trim()
+    const responseApplicationName = text(data.application_name).trim()
+    if (!accessToken || responseApplicationName !== applicationName) {
+      throw new Error('Application ticket exchange failed')
+    }
+    await options.setAccessToken(accessToken)
+    return true
+  } catch {
+    throw new Error(publicErrorMessage || 'Application ticket exchange failed')
+  } finally {
+    accessToken = ''
+    ticket = ''
+  }
+}
+
+export function createApplicationTicketLaunchResult(
+  entryUrl: string,
+  rawTicket: unknown,
+  rawExpiresIn: unknown,
+): ApplicationLaunchResult {
+  const ticket = requireTicket(rawTicket)
+  validateTicketLifetime(rawExpiresIn)
+
+  const url = new URL(resolveUniplatBaseApplicationEntryUrl(entryUrl))
+  url.hash = new URLSearchParams([[UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY, ticket]]).toString()
+  return { url: url.href }
+}
+
+export function createExternalApplicationTicketLaunchResult(
+  rawRedirectUrl: unknown,
+  rawTicket: unknown,
+  rawExpiresIn: unknown,
+  targetApplicationName: string,
+): ApplicationLaunchResult {
+  const ticket = requireTicket(rawTicket)
+  validateTicketLifetime(rawExpiresIn)
+  const expectedApplicationName = requireText(targetApplicationName, 'Target application name')
+  const documentBase = typeof document === 'undefined' ? 'https://localhost/' : document.baseURI
+  let url: URL
+  try {
+    url = new URL(text(rawRedirectUrl).trim(), documentBase)
+  } catch {
+    throw new Error('External application redirect URL is invalid')
+  }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+    throw new Error('External application redirect URL is invalid')
+  }
+  const params = new URLSearchParams(url.hash.slice(1))
+  const expectedKeys = [
+    UNIPLAT_APPLICATION_TICKET_APPLICATION_NAME_FRAGMENT_KEY,
+    UNIPLAT_APPLICATION_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY,
+    UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY,
+  ]
+  const actualKeys = [...params.keys()].sort()
+  if (
+    actualKeys.length !== expectedKeys.length ||
+    actualKeys.some((key, index) => key !== expectedKeys[index]) ||
+    params.get(UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY) !== ticket ||
+    !params.get(UNIPLAT_APPLICATION_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY)?.trim() ||
+    params.get(UNIPLAT_APPLICATION_TICKET_APPLICATION_NAME_FRAGMENT_KEY) !== expectedApplicationName
+  ) {
+    throw new Error('External application redirect URL is invalid')
+  }
+  return { url: url.href }
+}
+
+/**
+ * Resolves a launcher entry before a ticket is requested, so the URL sent to
+ * UniplatBase is exactly the URL that will subsequently receive the ticket.
+ */
+export function resolveUniplatBaseApplicationEntryUrl(entryUrl: string): string {
+  const documentBase = typeof document === 'undefined' ? 'https://localhost/' : document.baseURI
+  let url: URL
+  try {
+    url = new URL(entryUrl, documentBase)
+  } catch {
+    throw new Error('Application entry URL is invalid')
+  }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash) {
+    throw new Error('Application entry URL is invalid')
+  }
+  return url.href
+}
+
+function readTicketFragment(hash: string): {
+  ticket: string
+  sourceSystem: string
+  hasSourceSystem: boolean
+} {
+  const fragment = hash.startsWith('#') ? hash.slice(1) : hash
+  const params = new URLSearchParams(fragment)
+  return {
+    ticket: params.get(UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY)?.trim() ?? '',
+    sourceSystem: params.get(UNIPLAT_APPLICATION_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY) ?? '',
+    hasSourceSystem: params.has(UNIPLAT_APPLICATION_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY),
+  }
+}
+
+function federatedPublicErrorMessage(envelope: Record<string, unknown>): string {
+  const code = text(envelope.error_code)
+  const allowedCodes = new Set([
+    'FEDERATED_SYSTEM_UNAVAILABLE',
+    'FEDERATED_TICKET_INVALID',
+    'FEDERATED_SOURCE_UNAVAILABLE',
+    'FEDERATED_IDENTITY_NOT_READY',
+    'FEDERATED_APPLICATION_ACCESS_DENIED',
+    'FEDERATED_LOGIN_FAILED',
+  ])
+  const message = text(envelope.msg)
+  if (
+    !allowedCodes.has(code) ||
+    !message ||
+    message.length > 200 ||
+    [...message].some((character) => {
+      const codePoint = character.charCodeAt(0)
+      return codePoint <= 31 || codePoint === 127
+    })
+  ) {
+    return ''
+  }
+  return message
+}
+
+function clearTicketFragment(): void {
+  const fragment = window.location.hash.startsWith('#')
+    ? window.location.hash.slice(1)
+    : window.location.hash
+  const params = new URLSearchParams(fragment)
+  params.delete(UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY)
+  params.delete(UNIPLAT_APPLICATION_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY)
+  const remainingFragment = params.toString()
+  const cleanUrl = `${window.location.pathname}${window.location.search}${remainingFragment ? `#${remainingFragment}` : ''}`
+  window.history.replaceState(window.history.state, '', cleanUrl)
+}
+
+function requireTicket(rawValue: unknown): string {
+  const ticket = text(rawValue).trim()
+  if (
+    ticket.length < MIN_TICKET_LENGTH ||
+    ticket.length > MAX_TICKET_LENGTH ||
+    !/^[A-Za-z0-9_-]+$/.test(ticket)
+  ) {
+    throw new Error('Application ticket response is invalid')
+  }
+  return ticket
+}
+
+function validateTicketLifetime(rawExpiresIn: unknown): void {
+  const expiresIn = number(rawExpiresIn)
+  if (!Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > MAX_TICKET_LIFETIME_SECONDS) {
+    throw new Error('Application ticket response is invalid')
+  }
+}
+
+function validateServiceBaseUrl(rawValue: string): string {
+  const value = typeof rawValue === 'string' ? rawValue.trim() : ''
+  if (!value) throw new TypeError('UniplatBase serviceBaseUrl is required')
+  const documentBase = typeof document === 'undefined' ? 'https://localhost/' : document.baseURI
+  let url: URL
+  try {
+    url = new URL(value, documentBase)
+  } catch {
+    throw new TypeError('UniplatBase serviceBaseUrl is invalid')
+  }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+    throw new TypeError('UniplatBase serviceBaseUrl must use HTTP(S) without user credentials')
+  }
+  if (url.search || url.hash) {
+    throw new TypeError('UniplatBase serviceBaseUrl must not contain query or hash')
+  }
+  return url.href.replace(/\/+$/, '')
+}
+
+function requireText(rawValue: unknown, label: string): string {
+  const value = text(rawValue).trim()
+  if (!value) throw new TypeError(`${label} is required`)
+  return value
+}
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {}
+}
+
+function text(value: unknown): string {
+  return typeof value === 'string' ? value : ''
+}
+
+function number(value: unknown): number {
+  return typeof value === 'number' && Number.isFinite(value) ? value : Number.NaN
+}