@hexclave/shared 1.0.0

package/dist/utils/redirect-urls.js

@@ -0,0 +1,222 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../chunk-BE-pF4vm.js');
+let __errors_js = require("./errors.js");
+let __urls_js = require("./urls.js");
+
+//#region src/utils/redirect-urls.tsx
+const defaultHostedHandlerDomainSuffix = ".built-with-stack-auth.com";
+const hostedHandlerProjectIdPlaceholder = "{projectId}";
+const hostedHandlerPathPlaceholder = "{hostedPath}";
+const defaultPorts = new Map([["https:", "443"], ["http:", "80"]]);
+const hostedHandlerTemplateProjectIdA = "00000000-0000-4000-8000-000000000000";
+const hostedHandlerTemplateProjectIdB = "11111111-1111-4111-8111-111111111111";
+function replaceStackPortPrefix(input, stackPortPrefix) {
+	if (input == null) return void 0;
+	return stackPortPrefix ? input.replace(/\$\{NEXT_PUBLIC_STACK_PORT_PREFIX:-81\}/g, stackPortPrefix) : input;
+}
+function getHostedHandlerUrlFromTemplate(template, projectId, hostedPath) {
+	return template.replaceAll(hostedHandlerProjectIdPlaceholder, projectId).replaceAll(hostedHandlerPathPlaceholder, hostedPath);
+}
+function assertHostedHandlerTemplateHasProjectOrigin(template) {
+	const projectUrlA = new URL(getHostedHandlerUrlFromTemplate(template, hostedHandlerTemplateProjectIdA, "handler"));
+	const projectUrlB = new URL(getHostedHandlerUrlFromTemplate(template, hostedHandlerTemplateProjectIdB, "handler"));
+	if (projectUrlA.origin === projectUrlB.origin || !projectUrlA.hostname.includes(hostedHandlerTemplateProjectIdA)) throw new __errors_js.HexclaveAssertionError("The hosted handler URL template must put {projectId} in the hostname.", {
+		hostedHandlerUrlTemplate: template,
+		hint: "Use a project-specific origin like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}', not a shared-origin path like 'https://example.com/{projectId}/{hostedPath}'."
+	});
+}
+function getHostedHandlerTrustedDomain(options) {
+	return new URL(getHostedHandlerUrlFromConfig({
+		...options,
+		hostedPath: "handler"
+	})).origin;
+}
+function getHostedHandlerUrlFromConfig(options) {
+	const configuredTemplate = replaceStackPortPrefix(options.hostedHandlerUrlTemplate, options.stackPortPrefix);
+	return configuredTemplate == null ? (() => {
+		const domainSuffix = replaceStackPortPrefix(options.hostedHandlerDomainSuffix, options.stackPortPrefix) ?? defaultHostedHandlerDomainSuffix;
+		if (!domainSuffix.startsWith(".")) throw new __errors_js.HexclaveAssertionError("The hosted handler domain suffix must start with a dot.", {
+			domainSuffix,
+			hint: "Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX to a value like '.built-with-stack-auth.com'."
+		});
+		return `https://${options.projectId}${domainSuffix}/${options.hostedPath}`;
+	})() : (() => {
+		if (!configuredTemplate.includes(hostedHandlerProjectIdPlaceholder) || !configuredTemplate.includes(hostedHandlerPathPlaceholder)) throw new __errors_js.HexclaveAssertionError("The hosted handler URL template must contain {projectId} and {hostedPath}.", {
+			hostedHandlerUrlTemplate: configuredTemplate,
+			hint: "Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE to a value like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}'."
+		});
+		assertHostedHandlerTemplateHasProjectOrigin(configuredTemplate);
+		return getHostedHandlerUrlFromTemplate(configuredTemplate, options.projectId, options.hostedPath);
+	})();
+}
+function getImplicitlyTrustedDomainsForProject(options) {
+	return [getHostedHandlerTrustedDomain(options)];
+}
+function normalizePort(url) {
+	const port = url.port || defaultPorts.get(url.protocol) || "";
+	return port ? `${url.hostname}:${port}` : url.hostname;
+}
+function isDefaultPort(url) {
+	return !url.port || url.protocol === "https:" && url.port === "443" || url.protocol === "http:" && url.port === "80";
+}
+function portsMatch(url1, url2) {
+	return normalizePort(url1) === normalizePort(url2);
+}
+function parseWildcardUrlPattern(pattern) {
+	const protocolSeparatorIndex = pattern.indexOf("://");
+	if (protocolSeparatorIndex === -1) return null;
+	const protocol = `${pattern.slice(0, protocolSeparatorIndex)}:`;
+	const hostAndPath = pattern.slice(protocolSeparatorIndex + 3);
+	const pathStartIndex = hostAndPath.indexOf("/");
+	const hostPattern = pathStartIndex === -1 ? hostAndPath : hostAndPath.slice(0, pathStartIndex);
+	if (hostPattern === "") return null;
+	return {
+		protocol,
+		hostPattern
+	};
+}
+function hostPatternWithoutPort(hostPattern) {
+	if (!hostPatternHasExplicitPort(hostPattern)) return hostPattern;
+	const portSeparatorIndex = hostPattern.lastIndexOf(":");
+	return hostPattern.slice(0, portSeparatorIndex);
+}
+function hostPatternHasExplicitPort(hostPattern) {
+	const portSeparatorIndex = hostPattern.lastIndexOf(":");
+	if (portSeparatorIndex === -1) return false;
+	const port = hostPattern.slice(portSeparatorIndex + 1);
+	return port === "*" || port !== "" && [...port].every((char) => char >= "0" && char <= "9");
+}
+function matchesTrustedDomain(testUrl, pattern) {
+	const baseUrl = (0, __urls_js.createUrlIfValid)(pattern);
+	if (baseUrl != null && !pattern.includes("*")) return baseUrl.protocol === testUrl.protocol && baseUrl.hostname === testUrl.hostname && portsMatch(baseUrl, testUrl);
+	const parsedPattern = parseWildcardUrlPattern(pattern);
+	if (parsedPattern == null) {
+		(0, __errors_js.captureError)("invalid-redirect-domain", new __errors_js.HexclaveAssertionError("Invalid domain pattern", { pattern }));
+		return false;
+	}
+	if (testUrl.protocol !== parsedPattern.protocol) return false;
+	return hostPatternHasExplicitPort(parsedPattern.hostPattern) ? (0, __urls_js.matchHostnamePattern)(parsedPattern.hostPattern, normalizePort(testUrl)) : (0, __urls_js.matchHostnamePattern)(parsedPattern.hostPattern, testUrl.hostname) && isDefaultPort(testUrl);
+}
+function isAcceptedNativeAppUrl(urlOrString) {
+	const url = (0, __urls_js.createUrlIfValid)(urlOrString);
+	if (!url) return false;
+	return url.protocol === "stack-auth-mobile-oauth-url:";
+}
+function validateRedirectUrl(urlOrString, config) {
+	const url = (0, __urls_js.createUrlIfValid)(urlOrString);
+	if (!url) return false;
+	if (config.allowLocalhost === true && (0, __urls_js.isLocalhost)(url)) return true;
+	return config.trustedDomains.some((domain) => domain != null && matchesTrustedDomain(url, domain));
+}
+function getTrustedParentDomain(currentDomain, trustedDomains) {
+	const hostPatterns = trustedDomains.filter((domain) => domain != null).map((domain) => {
+		const url = (0, __urls_js.createUrlIfValid)(domain);
+		if (url != null && !domain.includes("*")) return url.hostname.toLowerCase();
+		const parsedPattern = parseWildcardUrlPattern(domain);
+		return parsedPattern == null ? null : hostPatternWithoutPort(parsedPattern.hostPattern).toLowerCase();
+	}).filter((domain) => domain != null);
+	const parts = currentDomain.toLowerCase().split(".");
+	for (let i = parts.length - 2; i >= 0; i--) {
+		const parentDomain = parts.slice(i).join(".");
+		if (hostPatterns.includes(parentDomain) && hostPatterns.includes(`**.${parentDomain}`)) return parentDomain;
+	}
+	return null;
+}
+(void 0)?.test("validateRedirectUrl matches exact and wildcard trusted domains", ({ expect }) => {
+	expect(validateRedirectUrl("https://example.com", {
+		allowLocalhost: false,
+		trustedDomains: ["https://example.com"]
+	})).toBe(true);
+	expect(validateRedirectUrl("https://api.example.com", {
+		allowLocalhost: false,
+		trustedDomains: ["https://*.example.com"]
+	})).toBe(true);
+	expect(validateRedirectUrl("https://api.v2.example.com", {
+		allowLocalhost: false,
+		trustedDomains: ["https://*.example.com"]
+	})).toBe(false);
+});
+(void 0)?.test("validateRedirectUrl trusts implicit hosted handler domains", ({ expect }) => {
+	const projectId = "12345678-1234-4234-8234-123456789abc";
+	expect(validateRedirectUrl(`https://${projectId}.built-with-stack-auth.com/anything`, {
+		allowLocalhost: false,
+		trustedDomains: getImplicitlyTrustedDomainsForProject({ projectId })
+	})).toBe(true);
+	expect(validateRedirectUrl("https://other-project.built-with-stack-auth.com/anything", {
+		allowLocalhost: false,
+		trustedDomains: getImplicitlyTrustedDomainsForProject({ projectId })
+	})).toBe(false);
+	expect(validateRedirectUrl(`http://${projectId}.localhost:9209/anything`, {
+		allowLocalhost: false,
+		trustedDomains: getImplicitlyTrustedDomainsForProject({
+			projectId,
+			hostedHandlerUrlTemplate: "http://{projectId}.localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09/{hostedPath}",
+			stackPortPrefix: "92"
+		})
+	})).toBe(true);
+});
+(void 0)?.test("getImplicitlyTrustedDomainsForProject rejects shared-origin hosted templates", ({ expect }) => {
+	expect(() => getImplicitlyTrustedDomainsForProject({
+		projectId: "12345678-1234-4234-8234-123456789abc",
+		hostedHandlerUrlTemplate: "https://host.example.com/{projectId}/{hostedPath}"
+	})).toThrowErrorMatchingInlineSnapshot(`
+    [HexclaveAssertionError: The hosted handler URL template must put {projectId} in the hostname.
+
+    This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]
+  `);
+});
+(void 0)?.test("validateRedirectUrl respects default and explicit ports", ({ expect }) => {
+	expect(validateRedirectUrl("https://example.com:443/path", {
+		allowLocalhost: false,
+		trustedDomains: ["https://example.com"]
+	})).toBe(true);
+	expect(validateRedirectUrl("http://api.example.com:3000", {
+		allowLocalhost: false,
+		trustedDomains: ["http://*.example.com:3000"]
+	})).toBe(true);
+	expect(validateRedirectUrl("http://api.example.com", {
+		allowLocalhost: false,
+		trustedDomains: ["http://*.example.com:3000"]
+	})).toBe(false);
+	expect(validateRedirectUrl("http://api.example.com:1234", {
+		allowLocalhost: false,
+		trustedDomains: ["http://*.example.com:*"]
+	})).toBe(true);
+});
+(void 0)?.test("validateRedirectUrl respects localhost allowance and invalid patterns", ({ expect }) => {
+	const originalConsoleError = console.error;
+	console.error = () => {};
+	try {
+		expect(validateRedirectUrl("http://localhost:3000", {
+			allowLocalhost: true,
+			trustedDomains: []
+		})).toBe(true);
+		expect(validateRedirectUrl("http://localhost:3000", {
+			allowLocalhost: false,
+			trustedDomains: []
+		})).toBe(false);
+		expect(validateRedirectUrl("https://example.com", {
+			allowLocalhost: false,
+			trustedDomains: ["not a url"]
+		})).toBe(false);
+	} finally {
+		console.error = originalConsoleError;
+	}
+});
+(void 0)?.test("getTrustedParentDomain ignores empty entries and strips ports", ({ expect }) => {
+	expect(getTrustedParentDomain("app.example.com", [
+		null,
+		void 0,
+		"https://example.com",
+		"https://**.example.com:*"
+	])).toBe("example.com");
+});
+
+//#endregion
+exports.getHostedHandlerTrustedDomain = getHostedHandlerTrustedDomain;
+exports.getHostedHandlerUrlFromConfig = getHostedHandlerUrlFromConfig;
+exports.getImplicitlyTrustedDomainsForProject = getImplicitlyTrustedDomainsForProject;
+exports.getTrustedParentDomain = getTrustedParentDomain;
+exports.isAcceptedNativeAppUrl = isAcceptedNativeAppUrl;
+exports.validateRedirectUrl = validateRedirectUrl;
+//# sourceMappingURL=redirect-urls.js.map

package/dist/utils/redirect-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-urls.js","names":[],"sources":["../../src/utils/redirect-urls.tsx"],"sourcesContent":["import { HexclaveAssertionError, captureError } from \"./errors\";\nimport { createUrlIfValid, isLocalhost, matchHostnamePattern } from \"./urls\";\n\ntype TrustedDomainConfig = {\n  allowLocalhost?: boolean,\n  trustedDomains: readonly (string | null | undefined)[],\n};\n\nconst defaultHostedHandlerDomainSuffix = \".built-with-stack-auth.com\";\nconst hostedHandlerProjectIdPlaceholder = \"{projectId}\";\nconst hostedHandlerPathPlaceholder = \"{hostedPath}\";\nconst defaultPorts = new Map<string, string>([['https:', '443'], ['http:', '80']]);\nconst hostedHandlerTemplateProjectIdA = \"00000000-0000-4000-8000-000000000000\";\nconst hostedHandlerTemplateProjectIdB = \"11111111-1111-4111-8111-111111111111\";\n\nfunction replaceStackPortPrefix(input: string | undefined, stackPortPrefix: string | undefined): string | undefined {\n  if (input == null) return undefined;\n  return stackPortPrefix ? input.replace(/\\$\\{NEXT_PUBLIC_STACK_PORT_PREFIX:-81\\}/g, stackPortPrefix) : input;\n}\n\nfunction getHostedHandlerUrlFromTemplate(template: string, projectId: string, hostedPath: string): string {\n  return template\n    .replaceAll(hostedHandlerProjectIdPlaceholder, projectId)\n    .replaceAll(hostedHandlerPathPlaceholder, hostedPath);\n}\n\nfunction assertHostedHandlerTemplateHasProjectOrigin(template: string): void {\n  const projectUrlA = new URL(getHostedHandlerUrlFromTemplate(template, hostedHandlerTemplateProjectIdA, \"handler\"));\n  const projectUrlB = new URL(getHostedHandlerUrlFromTemplate(template, hostedHandlerTemplateProjectIdB, \"handler\"));\n  if (projectUrlA.origin === projectUrlB.origin || !projectUrlA.hostname.includes(hostedHandlerTemplateProjectIdA)) {\n    throw new HexclaveAssertionError(\"The hosted handler URL template must put {projectId} in the hostname.\", {\n      hostedHandlerUrlTemplate: template,\n      hint: \"Use a project-specific origin like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}', not a shared-origin path like 'https://example.com/{projectId}/{hostedPath}'.\",\n    });\n  }\n}\n\nexport function getHostedHandlerTrustedDomain(options: {\n  projectId: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  stackPortPrefix?: string,\n}): string {\n  return new URL(getHostedHandlerUrlFromConfig({\n    ...options,\n    hostedPath: \"handler\",\n  })).origin;\n}\n\nexport function getHostedHandlerUrlFromConfig(options: {\n  projectId: string,\n  hostedPath: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  stackPortPrefix?: string,\n}): string {\n  const configuredTemplate = replaceStackPortPrefix(options.hostedHandlerUrlTemplate, options.stackPortPrefix);\n  return configuredTemplate == null\n    ? (() => {\n      const domainSuffix = replaceStackPortPrefix(options.hostedHandlerDomainSuffix, options.stackPortPrefix) ?? defaultHostedHandlerDomainSuffix;\n      if (!domainSuffix.startsWith(\".\")) {\n        throw new HexclaveAssertionError(\"The hosted handler domain suffix must start with a dot.\", {\n          domainSuffix,\n          hint: \"Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX to a value like '.built-with-stack-auth.com'.\",\n        });\n      }\n      return `https://${options.projectId}${domainSuffix}/${options.hostedPath}`;\n    })()\n    : (() => {\n      if (!configuredTemplate.includes(hostedHandlerProjectIdPlaceholder) || !configuredTemplate.includes(hostedHandlerPathPlaceholder)) {\n        throw new HexclaveAssertionError(\"The hosted handler URL template must contain {projectId} and {hostedPath}.\", {\n          hostedHandlerUrlTemplate: configuredTemplate,\n          hint: \"Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE to a value like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}'.\",\n        });\n      }\n      assertHostedHandlerTemplateHasProjectOrigin(configuredTemplate);\n      return getHostedHandlerUrlFromTemplate(configuredTemplate, options.projectId, options.hostedPath);\n    })();\n}\n\nexport function getImplicitlyTrustedDomainsForProject(options: {\n  projectId: string,\n  hostedHandlerDomainSuffix?: string,\n  hostedHandlerUrlTemplate?: string,\n  stackPortPrefix?: string,\n}): string[] {\n  return [getHostedHandlerTrustedDomain(options)];\n}\n\nfunction normalizePort(url: URL): string {\n  const port = url.port || defaultPorts.get(url.protocol) || '';\n  return port ? `${url.hostname}:${port}` : url.hostname;\n}\n\nfunction isDefaultPort(url: URL): boolean {\n  return !url.port ||\n    (url.protocol === 'https:' && url.port === '443') ||\n    (url.protocol === 'http:' && url.port === '80');\n}\n\nfunction portsMatch(url1: URL, url2: URL): boolean {\n  return normalizePort(url1) === normalizePort(url2);\n}\n\nfunction parseWildcardUrlPattern(pattern: string): { protocol: string, hostPattern: string } | null {\n  const protocolSeparatorIndex = pattern.indexOf(\"://\");\n  if (protocolSeparatorIndex === -1) return null;\n\n  const protocol = `${pattern.slice(0, protocolSeparatorIndex)}:`;\n  const hostAndPath = pattern.slice(protocolSeparatorIndex + \"://\".length);\n  const pathStartIndex = hostAndPath.indexOf(\"/\");\n  const hostPattern = pathStartIndex === -1 ? hostAndPath : hostAndPath.slice(0, pathStartIndex);\n  if (hostPattern === \"\") return null;\n  return { protocol, hostPattern };\n}\n\nfunction hostPatternWithoutPort(hostPattern: string): string {\n  if (!hostPatternHasExplicitPort(hostPattern)) {\n    return hostPattern;\n  }\n  const portSeparatorIndex = hostPattern.lastIndexOf(\":\");\n  return hostPattern.slice(0, portSeparatorIndex);\n}\n\nfunction hostPatternHasExplicitPort(hostPattern: string): boolean {\n  const portSeparatorIndex = hostPattern.lastIndexOf(\":\");\n  if (portSeparatorIndex === -1) {\n    return false;\n  }\n  const port = hostPattern.slice(portSeparatorIndex + 1);\n  return port === \"*\" || (port !== \"\" && [...port].every(char => char >= \"0\" && char <= \"9\"));\n}\n\nfunction matchesTrustedDomain(testUrl: URL, pattern: string): boolean {\n  const baseUrl = createUrlIfValid(pattern);\n\n  if (baseUrl != null && !pattern.includes('*')) {\n    return baseUrl.protocol === testUrl.protocol &&\n      baseUrl.hostname === testUrl.hostname &&\n      portsMatch(baseUrl, testUrl);\n  }\n\n  const parsedPattern = parseWildcardUrlPattern(pattern);\n  if (parsedPattern == null) {\n    captureError(\"invalid-redirect-domain\", new HexclaveAssertionError(\"Invalid domain pattern\", { pattern }));\n    return false;\n  }\n\n  if (testUrl.protocol !== parsedPattern.protocol) {\n    return false;\n  }\n\n  const hasPortInPattern = hostPatternHasExplicitPort(parsedPattern.hostPattern);\n  return hasPortInPattern\n    ? matchHostnamePattern(parsedPattern.hostPattern, normalizePort(testUrl))\n    : matchHostnamePattern(parsedPattern.hostPattern, testUrl.hostname) && isDefaultPort(testUrl);\n}\n\nexport function isAcceptedNativeAppUrl(urlOrString: string): boolean {\n  const url = createUrlIfValid(urlOrString);\n  if (!url) return false;\n\n  return url.protocol === 'stack-auth-mobile-oauth-url:';\n}\n\nexport function validateRedirectUrl(\n  urlOrString: string | URL,\n  config: TrustedDomainConfig,\n): boolean {\n  const url = createUrlIfValid(urlOrString);\n  if (!url) return false;\n\n  if (config.allowLocalhost === true && isLocalhost(url)) {\n    return true;\n  }\n\n  return config.trustedDomains.some(domain => domain != null && matchesTrustedDomain(url, domain));\n}\n\nexport function getTrustedParentDomain(currentDomain: string, trustedDomains: readonly (string | null | undefined)[]): string | null {\n  const hostPatterns = trustedDomains\n    .filter((domain): domain is string => domain != null)\n    .map((domain) => {\n      const url = createUrlIfValid(domain);\n      if (url != null && !domain.includes(\"*\")) {\n        return url.hostname.toLowerCase();\n      }\n      const parsedPattern = parseWildcardUrlPattern(domain);\n      return parsedPattern == null ? null : hostPatternWithoutPort(parsedPattern.hostPattern).toLowerCase();\n    })\n    .filter((domain): domain is string => domain != null);\n\n  const parts = currentDomain.toLowerCase().split('.');\n  for (let i = parts.length - 2; i >= 0; i--) {\n    const parentDomain = parts.slice(i).join('.');\n    if (hostPatterns.includes(parentDomain) && hostPatterns.includes(`**.${parentDomain}`)) {\n      return parentDomain;\n    }\n  }\n\n  return null;\n}\n\nimport.meta.vitest?.test(\"validateRedirectUrl matches exact and wildcard trusted domains\", ({ expect }) => {\n  expect(validateRedirectUrl(\"https://example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://api.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://*.example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://api.v2.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://*.example.com\"],\n  })).toBe(false);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl trusts implicit hosted handler domains\", ({ expect }) => {\n  const projectId = \"12345678-1234-4234-8234-123456789abc\";\n  expect(validateRedirectUrl(`https://${projectId}.built-with-stack-auth.com/anything`, {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({ projectId }),\n  })).toBe(true);\n  expect(validateRedirectUrl(\"https://other-project.built-with-stack-auth.com/anything\", {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({ projectId }),\n  })).toBe(false);\n  expect(validateRedirectUrl(`http://${projectId}.localhost:9209/anything`, {\n    allowLocalhost: false,\n    trustedDomains: getImplicitlyTrustedDomainsForProject({\n      projectId,\n      hostedHandlerUrlTemplate: \"http://{projectId}.localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09/{hostedPath}\",\n      stackPortPrefix: \"92\",\n    }),\n  })).toBe(true);\n});\n\nimport.meta.vitest?.test(\"getImplicitlyTrustedDomainsForProject rejects shared-origin hosted templates\", ({ expect }) => {\n  expect(() => getImplicitlyTrustedDomainsForProject({\n    projectId: \"12345678-1234-4234-8234-123456789abc\",\n    hostedHandlerUrlTemplate: \"https://host.example.com/{projectId}/{hostedPath}\",\n  })).toThrowErrorMatchingInlineSnapshot(`\n    [HexclaveAssertionError: The hosted handler URL template must put {projectId} in the hostname.\n\n    This is likely an error in Hexclave. Please make sure you are running the newest version and report it.]\n  `);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl respects default and explicit ports\", ({ expect }) => {\n  expect(validateRedirectUrl(\"https://example.com:443/path\", {\n    allowLocalhost: false,\n    trustedDomains: [\"https://example.com\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"http://api.example.com:3000\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:3000\"],\n  })).toBe(true);\n  expect(validateRedirectUrl(\"http://api.example.com\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:3000\"],\n  })).toBe(false);\n  expect(validateRedirectUrl(\"http://api.example.com:1234\", {\n    allowLocalhost: false,\n    trustedDomains: [\"http://*.example.com:*\"],\n  })).toBe(true);\n});\n\nimport.meta.vitest?.test(\"validateRedirectUrl respects localhost allowance and invalid patterns\", ({ expect }) => {\n  const originalConsoleError = console.error;\n  console.error = () => {};\n  try {\n    expect(validateRedirectUrl(\"http://localhost:3000\", {\n      allowLocalhost: true,\n      trustedDomains: [],\n    })).toBe(true);\n    expect(validateRedirectUrl(\"http://localhost:3000\", {\n      allowLocalhost: false,\n      trustedDomains: [],\n    })).toBe(false);\n    expect(validateRedirectUrl(\"https://example.com\", {\n      allowLocalhost: false,\n      trustedDomains: [\"not a url\"],\n    })).toBe(false);\n  } finally {\n    console.error = originalConsoleError;\n  }\n});\n\nimport.meta.vitest?.test(\"getTrustedParentDomain ignores empty entries and strips ports\", ({ expect }) => {\n  expect(getTrustedParentDomain(\"app.example.com\", [\n    null,\n    undefined,\n    \"https://example.com\",\n    \"https://**.example.com:*\",\n  ])).toBe(\"example.com\");\n});\n"],"mappings":";;;;;;AAQA,MAAM,mCAAmC;AACzC,MAAM,oCAAoC;AAC1C,MAAM,+BAA+B;AACrC,MAAM,eAAe,IAAI,IAAoB,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC;AAClF,MAAM,kCAAkC;AACxC,MAAM,kCAAkC;AAExC,SAAS,uBAAuB,OAA2B,iBAAyD;AAClH,KAAI,SAAS,KAAM,QAAO;AAC1B,QAAO,kBAAkB,MAAM,QAAQ,4CAA4C,gBAAgB,GAAG;;AAGxG,SAAS,gCAAgC,UAAkB,WAAmB,YAA4B;AACxG,QAAO,SACJ,WAAW,mCAAmC,UAAS,CACvD,WAAW,8BAA8B,WAAW;;AAGzD,SAAS,4CAA4C,UAAwB;CAC3E,MAAM,cAAc,IAAI,IAAI,gCAAgC,UAAU,iCAAiC,UAAU,CAAC;CAClH,MAAM,cAAc,IAAI,IAAI,gCAAgC,UAAU,iCAAiC,UAAU,CAAC;AAClH,KAAI,YAAY,WAAW,YAAY,UAAU,CAAC,YAAY,SAAS,SAAS,gCAAgC,CAC9G,OAAM,IAAI,mCAAuB,yEAAyE;EACxG,0BAA0B;EAC1B,MAAM;EACP,CAAC;;AAIN,SAAgB,8BAA8B,SAKnC;AACT,QAAO,IAAI,IAAI,8BAA8B;EAC3C,GAAG;EACH,YAAY;EACb,CAAC,CAAC,CAAC;;AAGN,SAAgB,8BAA8B,SAMnC;CACT,MAAM,qBAAqB,uBAAuB,QAAQ,0BAA0B,QAAQ,gBAAgB;AAC5G,QAAO,sBAAsB,cAClB;EACP,MAAM,eAAe,uBAAuB,QAAQ,2BAA2B,QAAQ,gBAAgB,IAAI;AAC3G,MAAI,CAAC,aAAa,WAAW,IAAI,CAC/B,OAAM,IAAI,mCAAuB,2DAA2D;GAC1F;GACA,MAAM;GACP,CAAC;AAEJ,SAAO,WAAW,QAAQ,YAAY,aAAa,GAAG,QAAQ;KAC7D,UACM;AACP,MAAI,CAAC,mBAAmB,SAAS,kCAAkC,IAAI,CAAC,mBAAmB,SAAS,6BAA6B,CAC/H,OAAM,IAAI,mCAAuB,8EAA8E;GAC7G,0BAA0B;GAC1B,MAAM;GACP,CAAC;AAEJ,8CAA4C,mBAAmB;AAC/D,SAAO,gCAAgC,oBAAoB,QAAQ,WAAW,QAAQ,WAAW;KAC/F;;AAGR,SAAgB,sCAAsC,SAKzC;AACX,QAAO,CAAC,8BAA8B,QAAQ,CAAC;;AAGjD,SAAS,cAAc,KAAkB;CACvC,MAAM,OAAO,IAAI,QAAQ,aAAa,IAAI,IAAI,SAAS,IAAI;AAC3D,QAAO,OAAO,GAAG,IAAI,SAAS,GAAG,SAAS,IAAI;;AAGhD,SAAS,cAAc,KAAmB;AACxC,QAAO,CAAC,IAAI,QACT,IAAI,aAAa,YAAY,IAAI,SAAS,SAC1C,IAAI,aAAa,WAAW,IAAI,SAAS;;AAG9C,SAAS,WAAW,MAAW,MAAoB;AACjD,QAAO,cAAc,KAAK,KAAK,cAAc,KAAK;;AAGpD,SAAS,wBAAwB,SAAmE;CAClG,MAAM,yBAAyB,QAAQ,QAAQ,MAAM;AACrD,KAAI,2BAA2B,GAAI,QAAO;CAE1C,MAAM,WAAW,GAAG,QAAQ,MAAM,GAAG,uBAAuB,CAAC;CAC7D,MAAM,cAAc,QAAQ,MAAM,yBAAyB,EAAa;CACxE,MAAM,iBAAiB,YAAY,QAAQ,IAAI;CAC/C,MAAM,cAAc,mBAAmB,KAAK,cAAc,YAAY,MAAM,GAAG,eAAe;AAC9F,KAAI,gBAAgB,GAAI,QAAO;AAC/B,QAAO;EAAE;EAAU;EAAa;;AAGlC,SAAS,uBAAuB,aAA6B;AAC3D,KAAI,CAAC,2BAA2B,YAAY,CAC1C,QAAO;CAET,MAAM,qBAAqB,YAAY,YAAY,IAAI;AACvD,QAAO,YAAY,MAAM,GAAG,mBAAmB;;AAGjD,SAAS,2BAA2B,aAA8B;CAChE,MAAM,qBAAqB,YAAY,YAAY,IAAI;AACvD,KAAI,uBAAuB,GACzB,QAAO;CAET,MAAM,OAAO,YAAY,MAAM,qBAAqB,EAAE;AACtD,QAAO,SAAS,OAAQ,SAAS,MAAM,CAAC,GAAG,KAAK,CAAC,OAAM,SAAQ,QAAQ,OAAO,QAAQ,IAAI;;AAG5F,SAAS,qBAAqB,SAAc,SAA0B;CACpE,MAAM,0CAA2B,QAAQ;AAEzC,KAAI,WAAW,QAAQ,CAAC,QAAQ,SAAS,IAAI,CAC3C,QAAO,QAAQ,aAAa,QAAQ,YAClC,QAAQ,aAAa,QAAQ,YAC7B,WAAW,SAAS,QAAQ;CAGhC,MAAM,gBAAgB,wBAAwB,QAAQ;AACtD,KAAI,iBAAiB,MAAM;AACzB,gCAAa,2BAA2B,IAAI,mCAAuB,0BAA0B,EAAE,SAAS,CAAC,CAAC;AAC1G,SAAO;;AAGT,KAAI,QAAQ,aAAa,cAAc,SACrC,QAAO;AAIT,QADyB,2BAA2B,cAAc,YAAY,uCAErD,cAAc,aAAa,cAAc,QAAQ,CAAA,uCACjD,cAAc,aAAa,QAAQ,SAAS,IAAI,cAAc,QAAQ;;AAGjG,SAAgB,uBAAuB,aAA8B;CACnE,MAAM,sCAAuB,YAAY;AACzC,KAAI,CAAC,IAAK,QAAO;AAEjB,QAAO,IAAI,aAAa;;AAG1B,SAAgB,oBACd,aACA,QACS;CACT,MAAM,sCAAuB,YAAY;AACzC,KAAI,CAAC,IAAK,QAAO;AAEjB,KAAI,OAAO,mBAAmB,mCAAoB,IAAI,CACpD,QAAO;AAGT,QAAO,OAAO,eAAe,MAAK,WAAU,UAAU,QAAQ,qBAAqB,KAAK,OAAO,CAAC;;AAGlG,SAAgB,uBAAuB,eAAuB,gBAAuE;CACnI,MAAM,eAAe,eAClB,QAAQ,WAA6B,UAAU,KAAI,CACnD,KAAK,WAAW;EACf,MAAM,sCAAuB,OAAO;AACpC,MAAI,OAAO,QAAQ,CAAC,OAAO,SAAS,IAAI,CACtC,QAAO,IAAI,SAAS,aAAa;EAEnC,MAAM,gBAAgB,wBAAwB,OAAO;AACrD,SAAO,iBAAiB,OAAO,OAAO,uBAAuB,cAAc,YAAY,CAAC,aAAa;GACtG,CACA,QAAQ,WAA6B,UAAU,KAAK;CAEvD,MAAM,QAAQ,cAAc,aAAa,CAAC,MAAM,IAAI;AACpD,MAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;EAC1C,MAAM,eAAe,MAAM,MAAM,EAAE,CAAC,KAAK,IAAI;AAC7C,MAAI,aAAa,SAAS,aAAa,IAAI,aAAa,SAAS,MAAM,eAAe,CACpF,QAAO;;AAIX,QAAO;;CAGT,SAAW,KAAC,mEAAqE,EAAA,aAAa;AAC5F,QAAO,oBAAoB,uBAAuB;EAChD,gBAAgB;EAChB,gBAAgB,CAAC,sBAAsB;EACxC,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,2BAA2B;EACpD,gBAAgB;EAChB,gBAAgB,CAAC,wBAAwB;EAC1C,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,8BAA8B;EACvD,gBAAgB;EAChB,gBAAgB,CAAC,wBAAwB;EAC1C,CAAC,CAAC,CAAC,KAAK,MAAM;EACf;CAEF,SAAW,KAAC,+DAAiE,EAAA,aAAa;CACxF,MAAM,YAAY;AAClB,QAAO,oBAAoB,WAAW,UAAU,sCAAsC;EACpF,gBAAgB;EAChB,gBAAgB,sCAAsC,EAAE,WAAW,CAAC;EACrE,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,4DAA4D;EACrF,gBAAgB;EAChB,gBAAgB,sCAAsC,EAAE,WAAW,CAAC;EACrE,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,QAAO,oBAAoB,UAAU,UAAU,2BAA2B;EACxE,gBAAgB;EAChB,gBAAgB,sCAAsC;GACpD;GACA,0BAA0B;GAC1B,iBAAiB;GAClB,CAAC;EACH,CAAC,CAAC,CAAC,KAAK,KAAK;EACd;CAEF,SAAW,KAAC,iFAAiF,EAAA,aAAe;AAC1G,cAAa,sCAAsC;EACjD,WAAW;EACX,0BAA0B;EAC3B,CAAC,CAAC,CAAC,mCAAmC;;;;IAIrC;EACF;CAEF,SAAW,KAAC,4DAAgE,EAAA,aAAW;AACrF,QAAO,oBAAoB,gCAAgC;EACzD,gBAAgB;EAChB,gBAAgB,CAAC,sBAAsB;EACxC,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,+BAA+B;EACxD,gBAAgB;EAChB,gBAAgB,CAAC,4BAA4B;EAC9C,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,QAAO,oBAAoB,0BAA0B;EACnD,gBAAgB;EAChB,gBAAgB,CAAC,4BAA4B;EAC9C,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,QAAO,oBAAoB,+BAA+B;EACxD,gBAAgB;EAChB,gBAAgB,CAAC,yBAAyB;EAC3C,CAAC,CAAC,CAAC,KAAK,KAAK;EACd;CAEF,SAAW,KAAC,0EAA2E,EAAA,aAAc;CACnG,MAAM,uBAAuB,QAAQ;AACrC,SAAQ,cAAc;AACtB,KAAI;AACF,SAAO,oBAAoB,yBAAyB;GAClD,gBAAgB;GAChB,gBAAgB,EAAE;GACnB,CAAC,CAAC,CAAC,KAAK,KAAK;AACd,SAAO,oBAAoB,yBAAyB;GAClD,gBAAgB;GAChB,gBAAgB,EAAE;GACnB,CAAC,CAAC,CAAC,KAAK,MAAM;AACf,SAAO,oBAAoB,uBAAuB;GAChD,gBAAgB;GAChB,gBAAgB,CAAC,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,MAAM;WACP;AACR,UAAQ,QAAQ;;EAElB;CAEF,SAAW,KAAC,kEAAsE,EAAA,aAAW;AAC3F,QAAO,uBAAuB,mBAAmB;EAC/C;EACA;EACA;EACA;EACD,CAAC,CAAC,CAAC,KAAK,cAAc;EACvB"}

package/dist/utils/regex.d.ts

@@ -0,0 +1,5 @@
+//#region src/utils/regex.d.ts
+declare function createCachedRegex(pattern: string): RegExp;
+//#endregion
+export { createCachedRegex };
+//# sourceMappingURL=regex.d.ts.map

package/dist/utils/regex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex.d.ts","names":[],"sources":["../../src/utils/regex.tsx"],"mappings":";iBAEgB,iBAAA,CAAkB,OAAA,WAAe,MAAA"}

package/dist/utils/regex.js

@@ -0,0 +1,15 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/utils/regex.tsx
+const cachedRegexes = /* @__PURE__ */ new Map();
+function createCachedRegex(pattern) {
+	const cached = cachedRegexes.get(pattern);
+	if (cached) return cached;
+	const regex = new RegExp(pattern);
+	cachedRegexes.set(pattern, regex);
+	return regex;
+}
+
+//#endregion
+exports.createCachedRegex = createCachedRegex;
+//# sourceMappingURL=regex.js.map

package/dist/utils/regex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex.js","names":[],"sources":["../../src/utils/regex.tsx"],"sourcesContent":["const cachedRegexes = new Map<string, RegExp>();\n\nexport function createCachedRegex(pattern: string) {\n  const cached = cachedRegexes.get(pattern);\n  if (cached) return cached;\n\n  const regex = new RegExp(pattern);\n  cachedRegexes.set(pattern, regex);\n  return regex;\n}\n"],"mappings":";;;AAAA,MAAM,gCAAgB,IAAI,KAAqB;AAE/C,SAAgB,kBAAkB,SAAiB;CACjD,MAAM,SAAS,cAAc,IAAI,QAAQ;AACzC,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,IAAI,OAAO,QAAQ;AACjC,eAAc,IAAI,SAAS,MAAM;AACjC,QAAO"}

package/dist/utils/results.d.ts

@@ -0,0 +1,70 @@
+//#region src/utils/results.d.ts
+type Result<T, E = unknown> = {
+  status: "ok";
+  data: T;
+} | {
+  status: "error";
+  error: E;
+};
+type AsyncResult<T, E = unknown, P = void> = Result<T, E> | ({
+  status: "pending";
+} & {
+  progress: P;
+});
+declare const Result: {
+  fromThrowing: typeof fromThrowing;
+  fromThrowingAsync: typeof fromThrowingAsync;
+  fromPromise: typeof promiseToResult;
+  ok<T>(data: T): Result<T, never> & {
+    status: "ok";
+  };
+  error<E>(error: E): Result<never, E> & {
+    status: "error";
+  };
+  map: typeof mapResult;
+  or: <T, E, U>(result: Result<T, E>, fallback: U) => T | U;
+  orThrow: <T, E>(result: Result<T, E>) => T;
+  orThrowAsync: <T, E>(result: Promise<Result<T, E>>) => Promise<T>;
+  retry: typeof retry;
+};
+declare const AsyncResult: {
+  fromThrowing: typeof fromThrowing;
+  fromPromise: typeof promiseToResult;
+  ok: <T>(data: T) => Result<T, never> & {
+    status: "ok";
+  };
+  error: <E>(error: E) => Result<never, E> & {
+    status: "error";
+  };
+  pending: typeof pending;
+  map: typeof mapResult;
+  or: <T, E, P, U>(result: AsyncResult<T, E, P>, fallback: U) => T | U;
+  orThrow: <T, E, P>(result: AsyncResult<T, E, P>) => T;
+  retry: typeof retry;
+};
+declare function pending(): AsyncResult<never, never, void> & {
+  status: "pending";
+};
+declare function pending<P>(progress: P): AsyncResult<never, never, P> & {
+  status: "pending";
+};
+declare function promiseToResult<T>(promise: Promise<T>): Promise<Result<T>>;
+declare function fromThrowing<T>(fn: () => T): Result<T, unknown>;
+declare function fromThrowingAsync<T>(fn: () => Promise<T>): Promise<Result<T, unknown>>;
+declare function mapResult<T, U, E = unknown, P = unknown>(result: Result<T, E>, fn: (data: T) => U): Result<U, E>;
+declare function mapResult<T, U, E = unknown, P = unknown>(result: AsyncResult<T, E, P>, fn: (data: T) => U): AsyncResult<U, E, P>;
+declare class RetryError<E = unknown> extends AggregateError {
+  readonly errors: E[];
+  constructor(errors: E[]);
+  get attempts(): number;
+}
+declare function retry<T, E>(fn: (attemptIndex: number) => Result<T, E> | Promise<Result<T, E>>, totalAttempts: number, {
+  exponentialDelayBase
+}?: {
+  exponentialDelayBase?: number | undefined;
+}): Promise<Result<T, RetryError<E>> & {
+  attempts: number;
+}>;
+//#endregion
+export { AsyncResult, Result };
+//# sourceMappingURL=results.d.ts.map

package/dist/utils/results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.d.ts","names":[],"sources":["../../src/utils/results.tsx"],"mappings":";KAGY,MAAA;EAER,MAAA;EACA,IAAA,EAAM,CAAA;AAAA;EAGN,MAAA;EACA,KAAA,EAAO,CAAA;AAAA;AAAA,KAGC,WAAA,6BACR,MAAA,CAAO,CAAA,EAAG,CAAA;EAGR,MAAA;AAAA;EAGA,QAAA,EAAU,CAAA;AAAA;AAAA,cAKH,MAAA;;;;QAIP,IAAA,EAAQ,CAAA,GAAI,MAAA,CAAO,CAAA;IAAc,MAAA;EAAA;WAM9B,KAAA,EAAS,CAAA,GAAI,MAAA,QAAc,CAAA;IAAO,MAAA;EAAA;;gBAO7B,MAAA,EAAU,MAAA,CAAO,CAAA,EAAG,CAAA,GAAE,QAAA,EAAY,CAAA,KAAI,CAAA,GAAI,CAAA;kBAGxC,MAAA,EAAU,MAAA,CAAO,CAAA,EAAG,CAAA,MAAK,CAAA;uBAMd,MAAA,EAAU,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,CAAA,OAAM,OAAA,CAAQ,CAAA;;;cAkDxD,WAAA;;;UAxEP,IAAA,EAAQ,CAAA,KAAI,MAAA,CAAO,CAAA;IAAc,MAAA;EAAA;aAM9B,KAAA,EAAS,CAAA,KAAI,MAAA,QAAc,CAAA;IAAO,MAAA;EAAA;;;mBAyE1B,MAAA,EAAU,WAAA,CAAY,CAAA,EAAG,CAAA,EAAG,CAAA,GAAE,QAAA,EAAY,CAAA,KAAI,CAAA,GAAI,CAAA;qBAMhD,MAAA,EAAU,WAAA,CAAY,CAAA,EAAG,CAAA,EAAG,CAAA,MAAK,CAAA;;;iBAqC3C,OAAA,CAAA,GAAW,WAAA;EAAoC,MAAA;AAAA;AAAA,iBAC/C,OAAA,GAAA,CAAW,QAAA,EAAU,CAAA,GAAI,WAAA,eAA0B,CAAA;EAAO,MAAA;AAAA;AAAA,iBAoBpD,eAAA,GAAA,CAAmB,OAAA,EAAS,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,CAAA;AAAA,iBA2B9D,YAAA,GAAA,CAAgB,EAAA,QAAU,CAAA,GAAI,MAAA,CAAO,CAAA;AAAA,iBA4B/B,iBAAA,GAAA,CAAqB,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,CAAA;AAAA,iBA4BjE,SAAA,gCAAA,CAA0C,MAAA,EAAQ,MAAA,CAAO,CAAA,EAAG,CAAA,GAAI,EAAA,GAAK,IAAA,EAAM,CAAA,KAAM,CAAA,GAAI,MAAA,CAAO,CAAA,EAAG,CAAA;AAAA,iBAC/F,SAAA,gCAAA,CAA0C,MAAA,EAAQ,WAAA,CAAY,CAAA,EAAG,CAAA,EAAG,CAAA,GAAI,EAAA,GAAK,IAAA,EAAM,CAAA,KAAM,CAAA,GAAI,WAAA,CAAY,CAAA,EAAG,CAAA,EAAG,CAAA;AAAA,cAiDlH,UAAA,sBAAgC,cAAA;EAAA,SACR,MAAA,EAAQ,CAAA;cAAR,MAAA,EAAQ,CAAA;EAAA,IAqBhC,QAAA,CAAA;AAAA;AAAA,iBAuCS,KAAA,MAAA,CACb,EAAA,GAAK,YAAA,aAAyB,MAAA,CAAO,CAAA,EAAG,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,CAAA,IAC/D,aAAA;EACE;AAAA;;IACD,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,UAAA,CAAW,CAAA;EAAQ,QAAA;AAAA"}