@farm.js/integration-utils 0.1.0-beta.99 → 0.1.0

package/README.md

@@ -2,10 +2,10 @@
 
 Shared integration utilities for Farm.js
 
-Farm.js is currently in beta.
+See [Stability and Support](https://farmjs.dev/docs/stability) for what this package guarantees.
 
 ```bash
-npm install @farm.js/integration-utils@beta
+npm install @farm.js/integration-utils
 ```
 
 See the [Farm.js repository](https://github.com/farming-labs/farm.js) for documentation, examples, and support.

package/dist/cookies.d.ts

@@ -11,8 +11,10 @@ export interface RequestCookieOptions {
     domain?: string;
     expires?: Date;
 }
+/** Collapse duplicate names using the first value in request-header order. */
 export declare function parseCookieHeaderMap(header: string | null): Record<string, string>;
 export declare function parseCookieHeaderList(header: string | null): ParsedCookie[];
+/** Read the first matching value, consistent with core `cookies().get(name)`. */
 export declare function getCookieValue(headers: Headers, name: string): string | null;
 export declare function createRequestCookie(name: string, value: string, request: Request, options?: RequestCookieOptions): string;
 export declare function clearRequestCookie(name: string, request: Request, options?: Omit<RequestCookieOptions, "maxAge">): string;

package/dist/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAiBD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAelF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,EAAE,CAK3E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE5E;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,oBAAyB,GACjC,MAAM,CA4BR;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GACjD,MAAM,CAKR"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASlF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,EAAE,CAE3E;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5E;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,oBAAyB,GACjC,MAAM,CA4BR;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GACjD,MAAM,CAKR"}

package/dist/cookies.js

@@ -1,39 +1,21 @@
-/**
- * Decode a cookie value, tolerating malformed percent-encoding. A request can
- * carry a cookie whose value is not valid UTF-8 percent-encoding (a latin-1
- * value from an old link, a crawler, or an attacker-planted sibling-domain
- * cookie); `decodeURIComponent` throws `URIError` on those. Falling back to the
- * raw value keeps a single bad cookie from turning every auth route into a 500.
- */
-function decodeCookieValue(value) {
-    try {
-        return decodeURIComponent(value);
-    }
-    catch {
-        return value;
-    }
-}
+import { parseRequestCookieHeader } from "@farm.js/core/internal/request-cookies";
+/** Collapse duplicate names using the first value in request-header order. */
 export function parseCookieHeaderMap(header) {
-    if (!header) {
-        return {};
+    const cookies = Object.create(null);
+    for (const cookie of parseCookieHeaderList(header)) {
+        if (Object.prototype.hasOwnProperty.call(cookies, cookie.name))
+            continue;
+        cookies[cookie.name] = cookie.value;
     }
-    return Object.fromEntries(header
-        .split(";")
-        .map((part) => part.trim())
-        .filter(Boolean)
-        .map((part) => {
-        const [key, ...rest] = part.split("=");
-        return [key, decodeCookieValue(rest.join("="))];
-    }));
+    return cookies;
 }
 export function parseCookieHeaderList(header) {
-    return Object.entries(parseCookieHeaderMap(header)).map(([name, value]) => ({
-        name,
-        value,
-    }));
+    return parseRequestCookieHeader(header);
 }
+/** Read the first matching value, consistent with core `cookies().get(name)`. */
 export function getCookieValue(headers, name) {
-    return parseCookieHeaderMap(headers.get("cookie"))[name] ?? null;
+    return (parseCookieHeaderList(headers.get("cookie")).find((cookie) => cookie.name === name)?.value ??
+        null);
 }
 export function createRequestCookie(name, value, request, options = {}) {
     const requestUrl = new URL(request.url);

package/dist/integration.d.ts

@@ -17,7 +17,7 @@ export declare function createAuthRouteIntegration<TInstance>(config: AuthRouteI
         methods: FarmIntegrationRouteMethod[];
         handler(request: Request, context: FarmIntegrationHandlerContext): Response | Promise<Response>;
     }[];
-}, import("@farm.js/core").FarmIntegrationSchema | undefined>;
+}>;
 export declare function methodNotAllowed(allow: readonly string[]): Response;
 export interface PathInferredClientOperation<TPath extends string = string, TOperation extends FarmIntegrationAPIOperation<any, any, any, any> = FarmIntegrationAPIOperation<any, any, any, any>, TLeafName extends string | undefined = undefined> {
     path: TPath;

package/dist/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../src/integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAChC,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,0BAA0B,CAAC,SAAS;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,SAAS,CAAC;IACpB,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACtC,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,6BAA6B,EACtC,QAAQ,EAAE,SAAS,KAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACnC;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAClD,MAAM,EAAE,0BAA0B,CAAC,SAAS,CAAC;;;;;;;;yBAWtB,OAAO,WAAW,6BAA6B;;8DAMvE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAOnE;AAED,MAAM,WAAW,2BAA2B,CAC1C,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,UAAU,SAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,2BAA2B,CAC9F,GAAG,EACH,GAAG,EACH,GAAG,EACH,GAAG,CACJ,EACD,SAAS,SAAS,MAAM,GAAG,SAAS,GAAG,SAAS;IAEhD,IAAI,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED,KAAK,kBAAkB,CACrB,KAAK,SAAS,MAAM,EACpB,SAAS,SAAS,MAAM,GAAG,SAAS,GAAG,SAAS,IAC9C,SAAS,SAAS,MAAM,GACxB,KAAK,SAAS,GAAG,MAAM,KAAK,IAAI,MAAM,EAAE,GACtC,GAAG,KAAK,IAAI,SAAS,EAAE,GACvB,SAAS,GACX,KAAK,CAAC;AAEV,KAAK,sBAAsB,CAAC,KAAK,SAAS,MAAM,IAAI,KAAK,SAAS,QAAQ,MAAM,IAAI,MAAM,KAAK,EAAE,GAC7F,KAAK,GACL,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,KAAK,EAAE,GACvC,KAAK,GACL,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,GAC7B,KAAK,GACL,KAAK,CAAC;AAEd,KAAK,qBAAqB,CAAC,QAAQ,SAAS,MAAM,IAChD,QAAQ,SAAS,GAAG,MAAM,KAAK,IAAI,MAAM,KAAK,EAAE,GAC5C,GAAG,KAAK,GAAG,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,GACrD,QAAQ,CAAC;AAEf,KAAK,+BAA+B,CAAC,QAAQ,SAAS,MAAM,IAC1D,QAAQ,SAAS,OAAO,MAAM,KAAK,GAAG,GAClC,KAAK,GACL,QAAQ,SAAS,IAAI,MAAM,KAAK,GAAG,GACjC,KAAK,GACL,QAAQ,SAAS,GAAG,MAAM,KAAK,IAAI,MAAM,EAAE,GACzC,KAAK,GACL,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAE1C,KAAK,4BAA4B,CAC/B,KAAK,SAAS,MAAM,EACpB,UAAU,SAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAChE,KAAK,SAAS,GAAG,MAAM,KAAK,IAAI,MAAM,KAAK,EAAE,GAC7C;KACG,IAAI,IAAI,+BAA+B,CAAC,KAAK,CAAC,GAAG,4BAA4B,CAC5E,KAAK,EACL,UAAU,CACX;CACF,GACD;KACG,IAAI,IAAI,+BAA+B,CAAC,KAAK,CAAC,GAAG;SAC/C,OAAO,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,GAAG,UAAU;KAClE;CACF,CAAC;AAEN,KAAK,mBAAmB,CAAC,MAAM,IAAI,CACjC,MAAM,SAAS,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,KAAK,CACzD,SAAS,CAAC,KAAK,EAAE,MAAM,aAAa,KAAK,IAAI,GAC1C,aAAa,GACb,KAAK,CAAC;AAEV,KAAK,iBAAiB,CAAC,MAAM,IAAI,MAAM,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GACnE,MAAM,GACN,MAAM,SAAS,MAAM,GACnB;KAAG,IAAI,IAAI,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAAE,GAC3D,MAAM,CAAC;AAEb,KAAK,cAAc,CAAC,MAAM,SAAS,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAC9E,MAAM,SAAS,2BAA2B,CACxC,MAAM,KAAK,SAAS,MAAM,EAC1B,MAAM,UAAU,SAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACxE,MAAM,SAAS,SAAS,MAAM,GAAG,SAAS,CAC3C,GACG,4BAA4B,CAC1B,sBAAsB,CAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAC5D,UAAU,CACX,GACD,KAAK,CAAC;AAEZ,KAAK,gBAAgB,CAAC,QAAQ,SAAS,SAAS,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,IAC7F,iBAAiB,CAAC,mBAAmB,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3E,MAAM,MAAM,0BAA0B,CACpC,QAAQ,SAAS,SAAS,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,IACvE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAuE/B,wBAAgB,2BAA2B,CACzC,KAAK,CAAC,QAAQ,SAAS,SAAS,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAC/E,GAAG,OAAO,EAAE,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAiB5D"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../src/integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAChC,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,0BAA0B,CAAC,SAAS;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,SAAS,CAAC;IACpB,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACtC,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,6BAA6B,EACtC,QAAQ,EAAE,SAAS,KAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACnC;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAClD,MAAM,EAAE,0BAA0B,CAAC,SAAS,CAAC;;;;;;;;yBAWtB,OAAO,WAAW,6BAA6B;;GAMvE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAOnE;AAED,MAAM,WAAW,2BAA2B,CAC1C,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,UAAU,SAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,2BAA2B,CAC9F,GAAG,EACH,GAAG,EACH,GAAG,EACH,GAAG,CACJ,EACD,SAAS,SAAS,MAAM,GAAG,SAAS,GAAG,SAAS;IAEhD,IAAI,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED,KAAK,kBAAkB,CACrB,KAAK,SAAS,MAAM,EACpB,SAAS,SAAS,MAAM,GAAG,SAAS,GAAG,SAAS,IAC9C,SAAS,SAAS,MAAM,GACxB,KAAK,SAAS,GAAG,MAAM,KAAK,IAAI,MAAM,EAAE,GACtC,GAAG,KAAK,IAAI,SAAS,EAAE,GACvB,SAAS,GACX,KAAK,CAAC;AAEV,KAAK,sBAAsB,CAAC,KAAK,SAAS,MAAM,IAAI,KAAK,SAAS,QAAQ,MAAM,IAAI,MAAM,KAAK,EAAE,GAC7F,KAAK,GACL,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,KAAK,EAAE,GACvC,KAAK,GACL,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,GAC7B,KAAK,GACL,KAAK,CAAC;AAEd,KAAK,qBAAqB,CAAC,QAAQ,SAAS,MAAM,IAChD,QAAQ,SAAS,GAAG,MAAM,KAAK,IAAI,MAAM,KAAK,EAAE,GAC5C,GAAG,KAAK,GAAG,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,GACrD,QAAQ,CAAC;AAEf,KAAK,+BAA+B,CAAC,QAAQ,SAAS,MAAM,IAC1D,QAAQ,SAAS,OAAO,MAAM,KAAK,GAAG,GAClC,KAAK,GACL,QAAQ,SAAS,IAAI,MAAM,KAAK,GAAG,GACjC,KAAK,GACL,QAAQ,SAAS,GAAG,MAAM,KAAK,IAAI,MAAM,EAAE,GACzC,KAAK,GACL,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAE1C,KAAK,4BAA4B,CAC/B,KAAK,SAAS,MAAM,EACpB,UAAU,SAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAChE,KAAK,SAAS,GAAG,MAAM,KAAK,IAAI,MAAM,KAAK,EAAE,GAC7C;KACG,IAAI,IAAI,+BAA+B,CAAC,KAAK,CAAC,GAAG,4BAA4B,CAC5E,KAAK,EACL,UAAU,CACX;CACF,GACD;KACG,IAAI,IAAI,+BAA+B,CAAC,KAAK,CAAC,GAAG;SAC/C,OAAO,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,GAAG,UAAU;KAClE;CACF,CAAC;AAEN,KAAK,mBAAmB,CAAC,MAAM,IAAI,CACjC,MAAM,SAAS,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,KAAK,CACzD,SAAS,CAAC,KAAK,EAAE,MAAM,aAAa,KAAK,IAAI,GAC1C,aAAa,GACb,KAAK,CAAC;AAEV,KAAK,iBAAiB,CAAC,MAAM,IAAI,MAAM,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GACnE,MAAM,GACN,MAAM,SAAS,MAAM,GACnB;KAAG,IAAI,IAAI,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAAE,GAC3D,MAAM,CAAC;AAEb,KAAK,cAAc,CAAC,MAAM,SAAS,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAC9E,MAAM,SAAS,2BAA2B,CACxC,MAAM,KAAK,SAAS,MAAM,EAC1B,MAAM,UAAU,SAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACxE,MAAM,SAAS,SAAS,MAAM,GAAG,SAAS,CAC3C,GACG,4BAA4B,CAC1B,sBAAsB,CAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAC5D,UAAU,CACX,GACD,KAAK,CAAC;AAEZ,KAAK,gBAAgB,CAAC,QAAQ,SAAS,SAAS,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,IAC7F,iBAAiB,CAAC,mBAAmB,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3E,MAAM,MAAM,0BAA0B,CACpC,QAAQ,SAAS,SAAS,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,IACvE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAuE/B,wBAAgB,2BAA2B,CACzC,KAAK,CAAC,QAAQ,SAAS,SAAS,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAC/E,GAAG,OAAO,EAAE,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAiB5D"}

package/dist/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,SAAM,GAAG,MAAM,CAgBvF;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,iBAAiB,CAAC,EAAE,MAAM,GACzB,GAAG,CAML;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,CAUjG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU1F;AAQD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,EACnC,iBAAiB,CAAC,EAAE,MAAM,GACzB;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,KAAK,MAAM,CAAC;CAClG,CAkCA"}
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,SAAM,GAAG,MAAM,CAWvF;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,iBAAiB,CAAC,EAAE,MAAM,GACzB,GAAG,CAML;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,CAUjG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU1F;AAiBD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,EACnC,iBAAiB,CAAC,EAAE,MAAM,GACzB;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,KAAK,MAAM,CAAC;CAClG,CAkCA"}

package/dist/url.js

@@ -7,11 +7,7 @@ export function getReturnTo(rawValue, fallback = "/") {
     // and the URL parser treat "\" as "/") both begin with "/" yet resolve to a
     // foreign origin when passed to `new URL(returnTo, origin)`, giving an open
     // redirect after a legitimate login.
-    if (!rawValue || !rawValue.startsWith("/")) {
-        return fallback;
-    }
-    const second = rawValue[1];
-    if (second === "/" || second === "\\") {
+    if (!rawValue || !isSameOriginRootRelativePath(rawValue)) {
         return fallback;
     }
     return rawValue;
@@ -45,8 +41,18 @@ export function resolveAppPath(path, label) {
 function isSameOriginRootRelativePath(value) {
     if (!value.startsWith("/"))
         return false;
-    const second = value[1];
-    return second !== "/" && second !== "\\";
+    // The URL parser removes ASCII tab, carriage return, and line feed before
+    // parsing. Reject them before resolution so `/\n/evil.example` cannot turn
+    // into the protocol-relative URL `//evil.example`.
+    if (/[\t\n\r]/.test(value))
+        return false;
+    const trustedOrigin = "https://farm.invalid";
+    try {
+        return new URL(value, trustedOrigin).origin === trustedOrigin;
+    }
+    catch {
+        return false;
+    }
 }
 export function resolveCallbackSettings(input, configuredBaseUrl) {
     if (input.callbackUrl) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/integration-utils",
-  "version": "0.1.0-beta.99",
+  "version": "0.1.0",
   "description": "Shared integration utilities for Farm.js",
   "license": "MIT",
   "repository": {
@@ -53,7 +53,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@farm.js/core": "0.1.0-beta.99"
+    "@farm.js/core": "0.1.0"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",