@kikiutils/shared 15.1.0 → 16.0.0

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/types/index.ts"],"mappings":";;;;;;AAWA;KAAY,SAAA,GAAY,MAAA;;;;KAKZ,WAAA,GAAc,WAAA,GAAc,IAAA,GAAO,MAAA,GAAS,IAAA,GAAO,MAAA,GAAW,MAAA,GAAW,UAAA;;;;KAKzE,UAAA;;;;KAKA,YAAA,MAAkB,OAAA,CAAQ,CAAA,IAAK,CAAA;;;;KAK/B,aAAA,MAAmB,QAAA,CAAS,CAAA,IAAK,CAAA;;;;KAKjC,QAAA,aAAqB,CAAA;;;;KAKrB,SAAA;AApBZ;;;AAAA,KAyBY,aAAA,2BAAwC,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,CAAA;;AApBtE;;KAyBY,qBAAA,2BAAgD,QAAA,CAAS,aAAA,CAAc,CAAA,EAAG,CAAA;;;;KAK1E,cAAA,2BAAyC,QAAA,CAAS,MAAA,CAAO,CAAA,EAAG,CAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/types/index.ts"],"mappings":";;;;;;AAWA;KAAY,SAAA,GAAY,MAAM;;;AAAA;KAKlB,WAAA,GAAc,WAAA,GAAc,IAAA,GAAO,MAAA,GAAS,IAAA,GAAO,MAAA,GAAW,MAAA,GAAW,UAAA;;;;KAKzE,UAAA;;;;KAKA,YAAA,MAAkB,OAAA,CAAQ,CAAA,IAAK,CAAA;;;;KAK/B,aAAA,MAAmB,QAAA,CAAS,CAAA,IAAK,CAAA;;;;KAKjC,SAAA;;;;KAKA,aAAA,2BAAwC,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,CAAA;AApBtE;;;AAAA,KAyBY,qBAAA,2BAAgD,QAAA,CAAS,aAAA,CAAc,CAAA,EAAG,CAAA;AAzBhE;AAKtB;;AALsB,KA8BV,cAAA,2BAAyC,QAAA,CAAS,MAAA,CAAO,CAAA,EAAG,CAAA"}

package/dist/types/vue.d.ts

@@ -1,4 +1,3 @@
-import { Nullable } from "./index.js";
 import { GlobalComponents } from "vue";
 
 //#region src/types/vue.d.ts
@@ -15,7 +14,7 @@ import { GlobalComponents } from "vue";
  * const keepAliveRef = ref<ComponentRef<'KeepAlive'>>(null);
  * ```
  */
-type ComponentRef<K extends keyof GlobalComponents> = Nullable<InstanceType<GlobalComponents[K]>>;
+type ComponentRef<K extends keyof GlobalComponents> = InstanceType<GlobalComponents[K]> | null;
 //#endregion
 export { ComponentRef };
 //# sourceMappingURL=vue.d.ts.map

package/dist/types/vue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vue.d.ts","names":[],"sources":["../../src/types/vue.ts"],"mappings":";;;;;;AAiBA;;;;;;;;;;;KAAY,YAAA,iBAA6B,gBAAA,IAAoB,QAAA,CAAS,YAAA,CAAa,gBAAA,CAAiB,CAAA"}
+{"version":3,"file":"vue.d.ts","names":[],"sources":["../../src/types/vue.ts"],"mappings":";;;;;AAeA;;;;;;;;;;;KAAY,YAAA,iBAA6B,gBAAA,IAAoB,YAAA,CAAa,gBAAA,CAAiB,CAAA"}

package/dist/url.d.ts

@@ -6,13 +6,37 @@
  *
  * @param {string} url - The target URL to modify
  * @param {string} redirectPath - The path to use as the redirect destination
- * (must be an absolute path starting with '/')
+ * (must be a safe same-origin application path starting with `/`)
  *
  * @returns {string} A new URL string with the `redirect` query parameter
  *
- * @throws {Error} If redirectPath is not a valid relative path (must start with '/')
+ * @throws {Error} If redirectPath is not a safe same-origin application path
  */
 declare function appendRedirectParamToUrl(url: string, redirectPath: string): string;
+/**
+ * Returns whether a value is a safe same-origin redirect path.
+ *
+ * Safe redirect paths are absolute application paths such as `/dashboard`.
+ * Protocol-relative URLs (`//example.com`), absolute URLs, backslash paths,
+ * and non-string values are rejected.
+ *
+ * @param {unknown} value - The value to check
+ *
+ * @returns {boolean} Whether the value is safe to use as an application redirect path
+ */
+declare function isSafeRedirectPath(value: unknown): value is string;
+/**
+ * Normalizes a redirect value into a safe same-origin application path.
+ *
+ * If an array is provided, the first value is checked. Unsafe values fall back
+ * to the provided fallback path.
+ *
+ * @param {unknown} value - The redirect value to normalize
+ * @param {string} fallback - The safe fallback path
+ *
+ * @returns {string} A safe redirect path
+ */
+declare function normalizeRedirectPath(value: unknown, fallback?: string): string;
 //#endregion
-export { appendRedirectParamToUrl };
+export { appendRedirectParamToUrl, isSafeRedirectPath, normalizeRedirectPath };
 //# sourceMappingURL=url.d.ts.map

package/dist/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","names":[],"sources":["../src/url.ts"],"mappings":";;AAaA;;;;;;;;;;;;iBAAgB,wBAAA,CAAyB,GAAA,UAAa,YAAA"}
+{"version":3,"file":"url.d.ts","names":[],"sources":["../src/url.ts"],"mappings":";;AAaA;;;;AAA0E;AAuB1E;;;;AAAyD;AAmBzD;;iBA1CgB,wBAAA,CAAyB,GAAA,UAAa,YAAoB;;AA0CN;;;;;;;;;;iBAnBpD,kBAAA,CAAmB,KAAA,YAAiB,KAAK;;;;;;;;;;;;iBAmBzC,qBAAA,CAAsB,KAAA,WAAgB,QAAc"}

package/dist/url.js

@@ -6,14 +6,14 @@
 *
 * @param {string} url - The target URL to modify
 * @param {string} redirectPath - The path to use as the redirect destination
-* (must be an absolute path starting with '/')
+* (must be a safe same-origin application path starting with `/`)
 *
 * @returns {string} A new URL string with the `redirect` query parameter
 *
-* @throws {Error} If redirectPath is not a valid relative path (must start with '/')
+* @throws {Error} If redirectPath is not a safe same-origin application path
 */
 function appendRedirectParamToUrl(url, redirectPath) {
-	if (!redirectPath.startsWith("/")) throw new Error(`Invalid redirect path: "${redirectPath}". Redirect paths must be absolute paths starting with '/'.`);
+	if (!isSafeRedirectPath(redirectPath)) throw new Error(`Invalid redirect path: "${redirectPath}". Redirect paths must be safe same-origin paths starting with '/'.`);
 	const [baseAndHash, rawQuery = ""] = url.split("?");
 	const [base, hash] = (baseAndHash || "").split("#");
 	const searchParams = new URLSearchParams(rawQuery);
@@ -21,7 +21,40 @@ function appendRedirectParamToUrl(url, redirectPath) {
 	const queryString = searchParams.toString();
 	return hash ? `${base}?${queryString}#${hash}` : `${base}?${queryString}`;
 }
+/**
+* Returns whether a value is a safe same-origin redirect path.
+*
+* Safe redirect paths are absolute application paths such as `/dashboard`.
+* Protocol-relative URLs (`//example.com`), absolute URLs, backslash paths,
+* and non-string values are rejected.
+*
+* @param {unknown} value - The value to check
+*
+* @returns {boolean} Whether the value is safe to use as an application redirect path
+*/
+function isSafeRedirectPath(value) {
+	if (typeof value !== "string") return false;
+	if (!value.startsWith("/")) return false;
+	if (value.startsWith("//")) return false;
+	if (value.includes("\\")) return false;
+	return true;
+}
+/**
+* Normalizes a redirect value into a safe same-origin application path.
+*
+* If an array is provided, the first value is checked. Unsafe values fall back
+* to the provided fallback path.
+*
+* @param {unknown} value - The redirect value to normalize
+* @param {string} fallback - The safe fallback path
+*
+* @returns {string} A safe redirect path
+*/
+function normalizeRedirectPath(value, fallback = "/") {
+	const redirectPath = Array.isArray(value) ? value[0] : value;
+	return isSafeRedirectPath(redirectPath) ? redirectPath : fallback;
+}
 //#endregion
-export { appendRedirectParamToUrl };
+export { appendRedirectParamToUrl, isSafeRedirectPath, normalizeRedirectPath };
 
 //# sourceMappingURL=url.js.map

package/dist/url.js.map

@@ -1 +1 @@
-{"version":3,"file":"url.js","names":[],"sources":["../src/url.ts"],"sourcesContent":["/**\n * Appends or updates the `redirect` query parameter on a given URL.\n *\n * Typically used to preserve the user's current path for post-login navigation.\n *\n * @param {string} url - The target URL to modify\n * @param {string} redirectPath - The path to use as the redirect destination\n * (must be an absolute path starting with '/')\n *\n * @returns {string} A new URL string with the `redirect` query parameter\n *\n * @throws {Error} If redirectPath is not a valid relative path (must start with '/')\n */\nexport function appendRedirectParamToUrl(url: string, redirectPath: string) {\n    if (!redirectPath.startsWith('/')) {\n        throw new Error(\n            `Invalid redirect path: \"${redirectPath}\". Redirect paths must be absolute paths starting with '/'.`,\n        );\n    }\n\n    const [baseAndHash, rawQuery = ''] = url.split('?');\n    const [base, hash] = (baseAndHash || '').split('#');\n    const searchParams = new URLSearchParams(rawQuery);\n    searchParams.set('redirect', redirectPath);\n    const queryString = searchParams.toString();\n    return hash ? `${base}?${queryString}#${hash}` : `${base}?${queryString}`;\n}\n"],"mappings":";;;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,KAAa,cAAsB;CACxE,IAAI,CAAC,aAAa,WAAW,IAAI,EAC7B,MAAM,IAAI,MACN,2BAA2B,aAAa,6DAC3C;CAGL,MAAM,CAAC,aAAa,WAAW,MAAM,IAAI,MAAM,IAAI;CACnD,MAAM,CAAC,MAAM,SAAS,eAAe,IAAI,MAAM,IAAI;CACnD,MAAM,eAAe,IAAI,gBAAgB,SAAS;CAClD,aAAa,IAAI,YAAY,aAAa;CAC1C,MAAM,cAAc,aAAa,UAAU;CAC3C,OAAO,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG,SAAS,GAAG,KAAK,GAAG"}
+{"version":3,"file":"url.js","names":[],"sources":["../src/url.ts"],"sourcesContent":["/**\n * Appends or updates the `redirect` query parameter on a given URL.\n *\n * Typically used to preserve the user's current path for post-login navigation.\n *\n * @param {string} url - The target URL to modify\n * @param {string} redirectPath - The path to use as the redirect destination\n * (must be a safe same-origin application path starting with `/`)\n *\n * @returns {string} A new URL string with the `redirect` query parameter\n *\n * @throws {Error} If redirectPath is not a safe same-origin application path\n */\nexport function appendRedirectParamToUrl(url: string, redirectPath: string) {\n    // eslint-disable-next-line style/max-len\n    if (!isSafeRedirectPath(redirectPath)) throw new Error(`Invalid redirect path: \"${redirectPath}\". Redirect paths must be safe same-origin paths starting with '/'.`);\n\n    const [baseAndHash, rawQuery = ''] = url.split('?');\n    const [base, hash] = (baseAndHash || '').split('#');\n    const searchParams = new URLSearchParams(rawQuery);\n    searchParams.set('redirect', redirectPath);\n    const queryString = searchParams.toString();\n    return hash ? `${base}?${queryString}#${hash}` : `${base}?${queryString}`;\n}\n\n/**\n * Returns whether a value is a safe same-origin redirect path.\n *\n * Safe redirect paths are absolute application paths such as `/dashboard`.\n * Protocol-relative URLs (`//example.com`), absolute URLs, backslash paths,\n * and non-string values are rejected.\n *\n * @param {unknown} value - The value to check\n *\n * @returns {boolean} Whether the value is safe to use as an application redirect path\n */\nexport function isSafeRedirectPath(value: unknown): value is string {\n    if (typeof value !== 'string') return false;\n    if (!value.startsWith('/')) return false;\n    if (value.startsWith('//')) return false;\n    if (value.includes('\\\\')) return false;\n    return true;\n}\n\n/**\n * Normalizes a redirect value into a safe same-origin application path.\n *\n * If an array is provided, the first value is checked. Unsafe values fall back\n * to the provided fallback path.\n *\n * @param {unknown} value - The redirect value to normalize\n * @param {string} fallback - The safe fallback path\n *\n * @returns {string} A safe redirect path\n */\nexport function normalizeRedirectPath(value: unknown, fallback = '/') {\n    const redirectPath = Array.isArray(value) ? value[0] : value;\n    return isSafeRedirectPath(redirectPath) ? redirectPath : fallback;\n}\n"],"mappings":";;;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,KAAa,cAAsB;CAExE,IAAI,CAAC,mBAAmB,YAAY,GAAG,MAAM,IAAI,MAAM,2BAA2B,aAAa,oEAAoE;CAEnK,MAAM,CAAC,aAAa,WAAW,MAAM,IAAI,MAAM,GAAG;CAClD,MAAM,CAAC,MAAM,SAAS,eAAe,GAAA,CAAI,MAAM,GAAG;CAClD,MAAM,eAAe,IAAI,gBAAgB,QAAQ;CACjD,aAAa,IAAI,YAAY,YAAY;CACzC,MAAM,cAAc,aAAa,SAAS;CAC1C,OAAO,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG,SAAS,GAAG,KAAK,GAAG;AAChE;;;;;;;;;;;;AAaA,SAAgB,mBAAmB,OAAiC;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,CAAC,MAAM,WAAW,GAAG,GAAG,OAAO;CACnC,IAAI,MAAM,WAAW,IAAI,GAAG,OAAO;CACnC,IAAI,MAAM,SAAS,IAAI,GAAG,OAAO;CACjC,OAAO;AACX;;;;;;;;;;;;AAaA,SAAgB,sBAAsB,OAAgB,WAAW,KAAK;CAClE,MAAM,eAAe,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CACvD,OAAO,mBAAmB,YAAY,IAAI,eAAe;AAC7D"}

package/dist/vue.d.ts

@@ -1,4 +1,3 @@
-import { Nullable } from "./types/index.js";
 import { Ref } from "vue";
 
 //#region src/vue.d.ts
@@ -13,15 +12,15 @@ declare function appendRedirectParamFromCurrentRouteToUrl(url: string): string;
 /**
  * Clears an interval referenced by a Vue ref and sets it to null.
  *
- * @param {Ref<Nullable<ReturnType<typeof setInterval>>>} intervalRef - A Vue ref holding a NodeJS.Timeout or null
+ * @param {Ref<null | ReturnType<typeof setInterval>>} intervalRef - A Vue ref holding a NodeJS.Timeout or null
  */
-declare function clearIntervalRef(intervalRef: Ref<Nullable<ReturnType<typeof setInterval>>>): void;
+declare function clearIntervalRef(intervalRef: Ref<null | ReturnType<typeof setInterval>>): void;
 /**
  * Clears a timeout referenced by a Vue ref and sets it to null.
  *
- * @param {Ref<Nullable<ReturnType<typeof setTimeout>>>} timeoutRef - A Vue ref holding a NodeJS.Timeout or null
+ * @param {Ref<null | ReturnType<typeof setTimeout>>} timeoutRef - A Vue ref holding a NodeJS.Timeout or null
  */
-declare function clearTimeoutRef(timeoutRef: Ref<Nullable<ReturnType<typeof setTimeout>>>): void;
+declare function clearTimeoutRef(timeoutRef: Ref<null | ReturnType<typeof setTimeout>>): void;
 /**
  * A Vue composition function that remembers and restores scroll position
  * of a scrollable container across route changes and keep-alive activation.
@@ -34,9 +33,9 @@ declare function clearTimeoutRef(timeoutRef: Ref<Nullable<ReturnType<typeof setT
  *
  * @template T - The type of the scrollable element (defaults to HTMLElement)
  *
- * @param {Ref<Nullable<T>>} containerRef - A ref to the scrollable HTML element
+ * @param {Ref<null | T>} containerRef - A ref to the scrollable HTML element
  */
-declare function usePreserveScroll<T extends Element = HTMLElement>(containerRef: Ref<Nullable<T>>): void;
+declare function usePreserveScroll<T extends Element = HTMLElement>(containerRef: Ref<null | T>): void;
 //#endregion
 export { appendRedirectParamFromCurrentRouteToUrl, clearIntervalRef, clearTimeoutRef, usePreserveScroll };
 //# sourceMappingURL=vue.d.ts.map

package/dist/vue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vue.d.ts","names":[],"sources":["../src/vue.ts"],"mappings":";;;;;;AAiBA;;;;;iBAAgB,wCAAA,CAAyC,GAAA;;;;;;iBASzC,gBAAA,CAAiB,WAAA,EAAa,GAAA,CAAI,QAAA,CAAS,UAAA,QAAkB,WAAA;;;;;;iBAU7D,eAAA,CAAgB,UAAA,EAAY,GAAA,CAAI,QAAA,CAAS,UAAA,QAAkB,UAAA;;;;AAA3E;;;;;;;;;;;iBAmBgB,iBAAA,WAA4B,OAAA,GAAU,WAAA,CAAA,CAAa,YAAA,EAAc,GAAA,CAAI,QAAA,CAAS,CAAA"}
+{"version":3,"file":"vue.d.ts","names":[],"sources":["../src/vue.ts"],"mappings":";;;;;AAgBA;;;;AAAoE;iBAApD,wCAAA,CAAyC,GAAW;;;;;;iBASpD,gBAAA,CAAiB,WAAA,EAAa,GAAA,QAAW,UAAA,QAAkB,WAAA;;;;;;iBAU3D,eAAA,CAAgB,UAAA,EAAY,GAAA,QAAW,UAAA,QAAkB,UAAA;AAVe;AAUxF;;;;;;;;;;;;;AAVwF,iBA6BxE,iBAAA,WAA4B,OAAA,GAAU,WAAA,EAAa,YAAA,EAAc,GAAA,QAAW,CAAA"}

package/dist/vue.js

@@ -15,7 +15,7 @@ function appendRedirectParamFromCurrentRouteToUrl(url) {
 /**
 * Clears an interval referenced by a Vue ref and sets it to null.
 *
-* @param {Ref<Nullable<ReturnType<typeof setInterval>>>} intervalRef - A Vue ref holding a NodeJS.Timeout or null
+* @param {Ref<null | ReturnType<typeof setInterval>>} intervalRef - A Vue ref holding a NodeJS.Timeout or null
 */
 function clearIntervalRef(intervalRef) {
 	if (intervalRef.value) clearInterval(intervalRef.value);
@@ -24,7 +24,7 @@ function clearIntervalRef(intervalRef) {
 /**
 * Clears a timeout referenced by a Vue ref and sets it to null.
 *
-* @param {Ref<Nullable<ReturnType<typeof setTimeout>>>} timeoutRef - A Vue ref holding a NodeJS.Timeout or null
+* @param {Ref<null | ReturnType<typeof setTimeout>>} timeoutRef - A Vue ref holding a NodeJS.Timeout or null
 */
 function clearTimeoutRef(timeoutRef) {
 	if (timeoutRef.value) clearTimeout(timeoutRef.value);
@@ -42,7 +42,7 @@ function clearTimeoutRef(timeoutRef) {
 *
 * @template T - The type of the scrollable element (defaults to HTMLElement)
 *
-* @param {Ref<Nullable<T>>} containerRef - A ref to the scrollable HTML element
+* @param {Ref<null | T>} containerRef - A ref to the scrollable HTML element
 */
 function usePreserveScroll(containerRef) {
 	let scrollLeft = 0;

package/dist/vue.js.map

@@ -1 +1 @@
-{"version":3,"file":"vue.js","names":[],"sources":["../src/vue.ts"],"sourcesContent":["import { onActivated } from 'vue';\nimport type { Ref } from 'vue';\nimport {\n    onBeforeRouteLeave,\n    useRoute,\n} from 'vue-router';\n\nimport type { Nullable } from './types';\nimport { appendRedirectParamToUrl } from './url';\n\n/**\n * Appends the current Vue Router route's fullPath as the `redirect` query parameter to the given URL.\n *\n * @param {string} url - The base URL to modify\n *\n * @returns {string} A new URL with the current route fullPath as the `redirect` parameter\n */\nexport function appendRedirectParamFromCurrentRouteToUrl(url: string) {\n    return appendRedirectParamToUrl(url, useRoute().fullPath);\n}\n\n/**\n * Clears an interval referenced by a Vue ref and sets it to null.\n *\n * @param {Ref<Nullable<ReturnType<typeof setInterval>>>} intervalRef - A Vue ref holding a NodeJS.Timeout or null\n */\nexport function clearIntervalRef(intervalRef: Ref<Nullable<ReturnType<typeof setInterval>>>) {\n    if (intervalRef.value) clearInterval(intervalRef.value);\n    intervalRef.value = null;\n}\n\n/**\n * Clears a timeout referenced by a Vue ref and sets it to null.\n *\n * @param {Ref<Nullable<ReturnType<typeof setTimeout>>>} timeoutRef - A Vue ref holding a NodeJS.Timeout or null\n */\nexport function clearTimeoutRef(timeoutRef: Ref<Nullable<ReturnType<typeof setTimeout>>>) {\n    if (timeoutRef.value) clearTimeout(timeoutRef.value);\n    timeoutRef.value = null;\n}\n\n/**\n * A Vue composition function that remembers and restores scroll position\n * of a scrollable container across route changes and keep-alive activation.\n *\n * Designed for use with `<KeepAlive>` components. Scroll state is saved on\n * route leave and restored when the component is activated again.\n *\n * Note: Without `<KeepAlive>`, the component state is destroyed on unmount,\n * so scroll position will not be preserved.\n *\n * @template T - The type of the scrollable element (defaults to HTMLElement)\n *\n * @param {Ref<Nullable<T>>} containerRef - A ref to the scrollable HTML element\n */\nexport function usePreserveScroll<T extends Element = HTMLElement>(containerRef: Ref<Nullable<T>>) {\n    let scrollLeft = 0;\n    let scrollTop = 0;\n    onActivated(() => {\n        if (!containerRef.value) return;\n        containerRef.value.scrollLeft = scrollLeft;\n        containerRef.value.scrollTop = scrollTop;\n    });\n\n    onBeforeRouteLeave(() => {\n        scrollLeft = containerRef.value?.scrollLeft || 0;\n        scrollTop = containerRef.value?.scrollTop || 0;\n    });\n}\n"],"mappings":";;;;;;;;;;;AAiBA,SAAgB,yCAAyC,KAAa;CAClE,OAAO,yBAAyB,KAAK,UAAU,CAAC,SAAS;;;;;;;AAQ7D,SAAgB,iBAAiB,aAA4D;CACzF,IAAI,YAAY,OAAO,cAAc,YAAY,MAAM;CACvD,YAAY,QAAQ;;;;;;;AAQxB,SAAgB,gBAAgB,YAA0D;CACtF,IAAI,WAAW,OAAO,aAAa,WAAW,MAAM;CACpD,WAAW,QAAQ;;;;;;;;;;;;;;;;AAiBvB,SAAgB,kBAAmD,cAAgC;CAC/F,IAAI,aAAa;CACjB,IAAI,YAAY;CAChB,kBAAkB;EACd,IAAI,CAAC,aAAa,OAAO;EACzB,aAAa,MAAM,aAAa;EAChC,aAAa,MAAM,YAAY;GACjC;CAEF,yBAAyB;EACrB,aAAa,aAAa,OAAO,cAAc;EAC/C,YAAY,aAAa,OAAO,aAAa;GAC/C"}
+{"version":3,"file":"vue.js","names":[],"sources":["../src/vue.ts"],"sourcesContent":["import { onActivated } from 'vue';\nimport type { Ref } from 'vue';\nimport {\n    onBeforeRouteLeave,\n    useRoute,\n} from 'vue-router';\n\nimport { appendRedirectParamToUrl } from './url';\n\n/**\n * Appends the current Vue Router route's fullPath as the `redirect` query parameter to the given URL.\n *\n * @param {string} url - The base URL to modify\n *\n * @returns {string} A new URL with the current route fullPath as the `redirect` parameter\n */\nexport function appendRedirectParamFromCurrentRouteToUrl(url: string) {\n    return appendRedirectParamToUrl(url, useRoute().fullPath);\n}\n\n/**\n * Clears an interval referenced by a Vue ref and sets it to null.\n *\n * @param {Ref<null | ReturnType<typeof setInterval>>} intervalRef - A Vue ref holding a NodeJS.Timeout or null\n */\nexport function clearIntervalRef(intervalRef: Ref<null | ReturnType<typeof setInterval>>) {\n    if (intervalRef.value) clearInterval(intervalRef.value);\n    intervalRef.value = null;\n}\n\n/**\n * Clears a timeout referenced by a Vue ref and sets it to null.\n *\n * @param {Ref<null | ReturnType<typeof setTimeout>>} timeoutRef - A Vue ref holding a NodeJS.Timeout or null\n */\nexport function clearTimeoutRef(timeoutRef: Ref<null | ReturnType<typeof setTimeout>>) {\n    if (timeoutRef.value) clearTimeout(timeoutRef.value);\n    timeoutRef.value = null;\n}\n\n/**\n * A Vue composition function that remembers and restores scroll position\n * of a scrollable container across route changes and keep-alive activation.\n *\n * Designed for use with `<KeepAlive>` components. Scroll state is saved on\n * route leave and restored when the component is activated again.\n *\n * Note: Without `<KeepAlive>`, the component state is destroyed on unmount,\n * so scroll position will not be preserved.\n *\n * @template T - The type of the scrollable element (defaults to HTMLElement)\n *\n * @param {Ref<null | T>} containerRef - A ref to the scrollable HTML element\n */\nexport function usePreserveScroll<T extends Element = HTMLElement>(containerRef: Ref<null | T>) {\n    let scrollLeft = 0;\n    let scrollTop = 0;\n    onActivated(() => {\n        if (!containerRef.value) return;\n        containerRef.value.scrollLeft = scrollLeft;\n        containerRef.value.scrollTop = scrollTop;\n    });\n\n    onBeforeRouteLeave(() => {\n        scrollLeft = containerRef.value?.scrollLeft || 0;\n        scrollTop = containerRef.value?.scrollTop || 0;\n    });\n}\n"],"mappings":";;;;;;;;;;;AAgBA,SAAgB,yCAAyC,KAAa;CAClE,OAAO,yBAAyB,KAAK,SAAS,CAAC,CAAC,QAAQ;AAC5D;;;;;;AAOA,SAAgB,iBAAiB,aAAyD;CACtF,IAAI,YAAY,OAAO,cAAc,YAAY,KAAK;CACtD,YAAY,QAAQ;AACxB;;;;;;AAOA,SAAgB,gBAAgB,YAAuD;CACnF,IAAI,WAAW,OAAO,aAAa,WAAW,KAAK;CACnD,WAAW,QAAQ;AACvB;;;;;;;;;;;;;;;AAgBA,SAAgB,kBAAmD,cAA6B;CAC5F,IAAI,aAAa;CACjB,IAAI,YAAY;CAChB,kBAAkB;EACd,IAAI,CAAC,aAAa,OAAO;EACzB,aAAa,MAAM,aAAa;EAChC,aAAa,MAAM,YAAY;CACnC,CAAC;CAED,yBAAyB;EACrB,aAAa,aAAa,OAAO,cAAc;EAC/C,YAAY,aAAa,OAAO,aAAa;CACjD,CAAC;AACL"}

package/dist/web.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web.d.ts","names":[],"sources":["../src/web.ts"],"mappings":";;AASA;;;;;AAeA;iBAfgB,2CAAA,CAA4C,GAAA;;;;;;;;;;;iBAe5C,6CAAA,CAA8C,GAAA,UAAa,OAAA,YAAgB,MAAA,CAAA,OAAA"}
+{"version":3,"file":"web.d.ts","names":[],"sources":["../src/web.ts"],"mappings":";;AASA;;;;AAAuE;AAevE;iBAfgB,2CAAA,CAA4C,GAAW;;;;;;;;AAeoB;;;iBAA3E,6CAAA,CAA8C,GAAA,UAAa,OAAA,YAAgB,MAAA,CAAA,OAAA"}

package/dist/web.js.map

@@ -1 +1 @@
-{"version":3,"file":"web.js","names":[],"sources":["../src/web.ts"],"sourcesContent":["import { appendRedirectParamToUrl } from './url';\n\n/**\n * Appends the current browser URL (including path, query, and hash) as the `redirect` query parameter to the given URL.\n *\n * @param {string} url - The base URL to modify\n *\n * @returns {string} A new URL with the current location as the `redirect` parameter\n */\nexport function appendRedirectParamFromCurrentLocationToUrl(url: string) {\n    const currentPath = `${window.location.pathname}${window.location.search}${window.location.hash}`;\n    return appendRedirectParamToUrl(url, currentPath);\n}\n\n/**\n * Navigates to the given URL, appending the current browser location\n * (path, query, and hash) as the `redirect` query parameter.\n *\n * Useful for redirecting to login or other gateways while preserving\n * the current location for post-auth navigation.\n *\n * @param {string} url - The destination URL to navigate to\n * @param {number} [delayMs] - Optional delay in milliseconds before navigation\n */\nexport function assignUrlWithRedirectParamFromCurrentLocation(url: string, delayMs?: number) {\n    if (delayMs === undefined) window.location.assign(appendRedirectParamFromCurrentLocationToUrl(url));\n    else return setTimeout(() => window.location.assign(appendRedirectParamFromCurrentLocationToUrl(url)), delayMs);\n}\n"],"mappings":";;;;;;;;;AASA,SAAgB,4CAA4C,KAAa;CAErE,OAAO,yBAAyB,KAAK,GADd,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,OAC1C;;;;;;;;;;;;AAarD,SAAgB,8CAA8C,KAAa,SAAkB;CACzF,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS,OAAO,4CAA4C,IAAI,CAAC;MAC9F,OAAO,iBAAiB,OAAO,SAAS,OAAO,4CAA4C,IAAI,CAAC,EAAE,QAAQ"}
+{"version":3,"file":"web.js","names":[],"sources":["../src/web.ts"],"sourcesContent":["import { appendRedirectParamToUrl } from './url';\n\n/**\n * Appends the current browser URL (including path, query, and hash) as the `redirect` query parameter to the given URL.\n *\n * @param {string} url - The base URL to modify\n *\n * @returns {string} A new URL with the current location as the `redirect` parameter\n */\nexport function appendRedirectParamFromCurrentLocationToUrl(url: string) {\n    const currentPath = `${window.location.pathname}${window.location.search}${window.location.hash}`;\n    return appendRedirectParamToUrl(url, currentPath);\n}\n\n/**\n * Navigates to the given URL, appending the current browser location\n * (path, query, and hash) as the `redirect` query parameter.\n *\n * Useful for redirecting to login or other gateways while preserving\n * the current location for post-auth navigation.\n *\n * @param {string} url - The destination URL to navigate to\n * @param {number} [delayMs] - Optional delay in milliseconds before navigation\n */\nexport function assignUrlWithRedirectParamFromCurrentLocation(url: string, delayMs?: number) {\n    if (delayMs === undefined) window.location.assign(appendRedirectParamFromCurrentLocationToUrl(url));\n    else return setTimeout(() => window.location.assign(appendRedirectParamFromCurrentLocationToUrl(url)), delayMs);\n}\n"],"mappings":";;;;;;;;;AASA,SAAgB,4CAA4C,KAAa;CAErE,OAAO,yBAAyB,KAAK,GADd,OAAO,SAAS,WAAW,OAAO,SAAS,SAAS,OAAO,SAAS,MAC3C;AACpD;;;;;;;;;;;AAYA,SAAgB,8CAA8C,KAAa,SAAkB;CACzF,IAAI,YAAY,KAAA,GAAW,OAAO,SAAS,OAAO,4CAA4C,GAAG,CAAC;MAC7F,OAAO,iBAAiB,OAAO,SAAS,OAAO,4CAA4C,GAAG,CAAC,GAAG,OAAO;AAClH"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kikiutils/shared",
   "type": "module",
-  "version": "15.1.0",
+  "version": "16.0.0",
   "description": "A lightweight and modular utility library for modern JavaScript and TypeScript — includes secure hashing, flexible logging, datetime tools, Vue/web helpers, storage abstraction, and more.",
   "author": "kiki-kanri",
   "license": "MIT",
@@ -70,18 +70,18 @@
     "@noble/hashes": "^2.2.0",
     "@types/ssh2": "^1.15.5",
     "async-validator": "^4.2.5",
-    "bson": "^7.2.0",
+    "bson": "^7.3.1",
     "consola": "^3.4.2",
-    "date-fns": "^4.1.0",
+    "date-fns": "^4.4.0",
     "decimal.js": "^10.6.0",
-    "element-plus": "^2.13.7",
-    "lru-cache": "^11.3.5",
+    "element-plus": "^2.14.2",
+    "lru-cache": "^11.5.2",
     "millify": "^6.1.0",
-    "msgpackr": "^2.0.1",
+    "msgpackr": "^2.0.4",
     "node-ssh": "^13.2.1",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "vue": "^3.5.32",
+    "vue": "^3.5.39",
     "vue-router": ">= 4.6.4"
   },
   "peerDependenciesMeta": {
@@ -135,35 +135,36 @@
     }
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^8.2.0",
-    "@kikiutils/eslint-config": "^9.1.2",
-    "@kikiutils/tsconfigs": "^6.0.0",
+    "@antfu/eslint-config": "^9.1.0",
+    "@kikiutils/eslint-config": "^9.2.0",
+    "@kikiutils/tsconfigs": "^7.0.0",
     "@noble/hashes": "^2.2.0",
-    "@types/node": "^25.6.2",
+    "@types/node": "^26.1.0",
     "@types/ssh2": "^1.15.5",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.10",
     "async-validator": "^4.2.5",
-    "bson": "^7.2.0",
+    "bson": "^7.3.1",
     "changelogen": "^0.6.2",
     "consola": "^3.4.2",
     "cross-env": "^10.1.0",
-    "date-fns": "^4.1.0",
+    "date-fns": "^4.4.0",
     "decimal.js": "^10.6.0",
-    "element-plus": "^2.14.0",
+    "element-plus": "^2.14.2",
+    "eslint": "^10.6.0",
     "jsdom": "^29.1.1",
-    "knip": "^6.12.2",
-    "lru-cache": "^11.3.6",
+    "knip": "^6.25.0",
+    "lru-cache": "^11.5.2",
     "millify": "^6.1.0",
-    "msgpackr": "^2.0.1",
+    "msgpackr": "^2.0.4",
     "node-ssh": "^13.2.1",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "publint": "^0.3.20",
-    "tsdown": "^0.22.0",
+    "publint": "^0.3.21",
+    "tsdown": "^0.22.3",
     "typescript": "^6.0.3",
     "unplugin-unused": "^0.5.7",
-    "vitest": "^4.1.5",
-    "vue": "^3.5.34",
-    "vue-router": "^5.0.6"
+    "vitest": "^4.1.10",
+    "vue": "^3.5.39",
+    "vue-router": "^5.1.0"
   }
 }

package/src/classes/ssh-client.ts

@@ -12,8 +12,6 @@ import type {
     TransferOptions,
 } from 'ssh2';
 
-import type { Nullable } from '../types';
-
 import type { PathLike } from './path';
 
 const loggerLevelStringToConsolaLogLevelMap = {
@@ -101,8 +99,8 @@ export class SshClient {
     async getFile(
         localFile: PathLike,
         remoteFile: PathLike,
-        givenSftp?: Nullable<SFTPWrapper>,
-        transferOptions?: Nullable<TransferOptions>,
+        givenSftp?: null | SFTPWrapper,
+        transferOptions?: null | TransferOptions,
     ) {
         try {
             await this.#nodeSsh.getFile(localFile.toString(), remoteFile.toString(), givenSftp, transferOptions);
@@ -141,8 +139,8 @@ export class SshClient {
     async putFile(
         localFile: PathLike,
         remoteFile: PathLike,
-        givenSftp?: Nullable<SFTPWrapper>,
-        transferOptions?: Nullable<TransferOptions>,
+        givenSftp?: null | SFTPWrapper,
+        transferOptions?: null | TransferOptions,
     ) {
         try {
             await this.#nodeSsh.putFile(localFile.toString(), remoteFile.toString(), givenSftp, transferOptions);

package/src/crypto-hash.ts

@@ -1,14 +1,12 @@
+import { Buffer } from 'node:buffer';
 import { createHash } from 'node:crypto';
-import type {
-    BinaryLike,
-    BinaryToTextEncoding,
-} from 'node:crypto';
+import type { BinaryLike } from 'node:crypto';
 
 /**
  * Computes the MD5 hash of the given data.
  *
  * @param {BinaryLike} data - The input data to hash
- * @param {BinaryToTextEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
+ * @param {BufferEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
  *
  * @returns {string | Buffer} The hash digest in the specified encoding
  *
@@ -19,8 +17,8 @@ import type {
  * console.log(cryptoMd5('test')); // 098f6bcd4621d373cade4e832627b4f6
  * ```
  */
-export function cryptoMd5(data: BinaryLike, outputEncoding: BinaryToTextEncoding = 'hex') {
-    return createHash('md5').update(data).digest(outputEncoding);
+export function cryptoMd5(data: BinaryLike, outputEncoding: BufferEncoding = 'hex') {
+    return createHash('md5').update(normalizeHashData(data)).digest(outputEncoding);
 }
 
 /**
@@ -38,14 +36,14 @@ export function cryptoMd5(data: BinaryLike, outputEncoding: BinaryToTextEncoding
  * ```
  */
 export function cryptoMd5ToBuffer(data: BinaryLike) {
-    return createHash('md5').update(data).digest();
+    return createHash('md5').update(normalizeHashData(data)).digest();
 }
 
 /**
  * Computes the SHA-3 hash of the given data using the 224-bit digest.
  *
  * @param {BinaryLike} data - The input data to hash
- * @param {BinaryToTextEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
+ * @param {BufferEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
  *
  * @returns {string | Buffer} The hash digest in the specified encoding
  *
@@ -56,8 +54,8 @@ export function cryptoMd5ToBuffer(data: BinaryLike) {
  * console.log(cryptoSha3224('test')); // 3797bf0afbbfca4a7bbba7602a2b552746876517a7f9b7ce2db0ae7b
  * ```
  */
-export function cryptoSha3224(data: BinaryLike, outputEncoding: BinaryToTextEncoding = 'hex') {
-    return createHash('sha3-224').update(data).digest(outputEncoding);
+export function cryptoSha3224(data: BinaryLike, outputEncoding: BufferEncoding = 'hex') {
+    return createHash('sha3-224').update(normalizeHashData(data)).digest(outputEncoding);
 }
 
 /**
@@ -75,14 +73,14 @@ export function cryptoSha3224(data: BinaryLike, outputEncoding: BinaryToTextEnco
  * ```
  */
 export function cryptoSha3224ToBuffer(data: BinaryLike) {
-    return createHash('sha3-224').update(data).digest();
+    return createHash('sha3-224').update(normalizeHashData(data)).digest();
 }
 
 /**
  * Computes the SHA-3 hash of the given data using the 256-bit digest.
  *
  * @param {BinaryLike} data - The input data to hash
- * @param {BinaryToTextEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
+ * @param {BufferEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
  *
  * @returns {string | Buffer} The hash digest in the specified encoding
  *
@@ -93,8 +91,8 @@ export function cryptoSha3224ToBuffer(data: BinaryLike) {
  * console.log(cryptoSha3256('test')); // 36f028580bb02cc8272a9a020f4200e346e276ae664e45ee80745574e2f5ab80
  * ```
  */
-export function cryptoSha3256(data: BinaryLike, outputEncoding: BinaryToTextEncoding = 'hex') {
-    return createHash('sha3-256').update(data).digest(outputEncoding);
+export function cryptoSha3256(data: BinaryLike, outputEncoding: BufferEncoding = 'hex') {
+    return createHash('sha3-256').update(normalizeHashData(data)).digest(outputEncoding);
 }
 
 /**
@@ -112,14 +110,14 @@ export function cryptoSha3256(data: BinaryLike, outputEncoding: BinaryToTextEnco
  * ```
  */
 export function cryptoSha3256ToBuffer(data: BinaryLike) {
-    return createHash('sha3-256').update(data).digest();
+    return createHash('sha3-256').update(normalizeHashData(data)).digest();
 }
 
 /**
  * Computes the SHA-3 hash of the given data using the 384-bit digest.
  *
  * @param {BinaryLike} data - The input data to hash
- * @param {BinaryToTextEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
+ * @param {BufferEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
  *
  * @returns {string | Buffer} The hash digest in the specified encoding
  *
@@ -130,8 +128,8 @@ export function cryptoSha3256ToBuffer(data: BinaryLike) {
  * console.log(cryptoSha3384('test')); // e516dabb23b6e30026863543282780a3ae0dccf05551cf0295178d7f...
  * ```
  */
-export function cryptoSha3384(data: BinaryLike, outputEncoding: BinaryToTextEncoding = 'hex') {
-    return createHash('sha3-384').update(data).digest(outputEncoding);
+export function cryptoSha3384(data: BinaryLike, outputEncoding: BufferEncoding = 'hex') {
+    return createHash('sha3-384').update(normalizeHashData(data)).digest(outputEncoding);
 }
 
 /**
@@ -149,14 +147,14 @@ export function cryptoSha3384(data: BinaryLike, outputEncoding: BinaryToTextEnco
  * ```
  */
 export function cryptoSha3384ToBuffer(data: BinaryLike) {
-    return createHash('sha3-384').update(data).digest();
+    return createHash('sha3-384').update(normalizeHashData(data)).digest();
 }
 
 /**
  * Computes the SHA-3 hash of the given data using the 512-bit digest.
  *
  * @param {BinaryLike} data - The input data to hash
- * @param {BinaryToTextEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
+ * @param {BufferEncoding} [outputEncoding] - The output encoding (default: `'hex'`)
  *
  * @returns {string | Buffer} The hash digest in the specified encoding
  *
@@ -167,8 +165,8 @@ export function cryptoSha3384ToBuffer(data: BinaryLike) {
  * console.log(cryptoSha3512('test')); // 9ece086e9bac491fac5c1d1046ca11d737b92a2b2ebd93f005d7...
  * ```
  */
-export function cryptoSha3512(data: BinaryLike, outputEncoding: BinaryToTextEncoding = 'hex') {
-    return createHash('sha3-512').update(data).digest(outputEncoding);
+export function cryptoSha3512(data: BinaryLike, outputEncoding: BufferEncoding = 'hex') {
+    return createHash('sha3-512').update(normalizeHashData(data)).digest(outputEncoding);
 }
 
 /**
@@ -186,5 +184,9 @@ export function cryptoSha3512(data: BinaryLike, outputEncoding: BinaryToTextEnco
  * ```
  */
 export function cryptoSha3512ToBuffer(data: BinaryLike) {
-    return createHash('sha3-512').update(data).digest();
+    return createHash('sha3-512').update(normalizeHashData(data)).digest();
+}
+
+function normalizeHashData(data: BinaryLike): NodeJS.ArrayBufferView | string {
+    return typeof data === 'string' || ArrayBuffer.isView(data) ? data : Buffer.from(data);
 }

package/src/storages/redis/types.ts

@@ -1,5 +1,3 @@
-import type { Nullable } from '../../types';
-
 /**
  * Low-level Redis-like adapter interface for raw buffer operations.
  */
@@ -12,7 +10,7 @@ export interface RedisLikeAdapter {
     /**
      * Gets the raw buffer value for a key.
      */
-    getBuffer: (key: string) => Promise<Nullable<Uint8Array>>;
+    getBuffer: (key: string) => Promise<null | Uint8Array>;
 
     /**
      * Checks if a key exists.
@@ -42,7 +40,7 @@ export interface RedisLikeStorage {
     /**
      * Gets a deserialized value by key.
      */
-    getItem: <T = unknown>(key: string) => Promise<Nullable<T>>;
+    getItem: <T = unknown>(key: string) => Promise<null | T>;
 
     /**
      * Gets the TTL of a key in seconds.

package/src/types/index.ts

@@ -31,11 +31,6 @@ export type MaybePartial<T> = Partial<T> | T;
  */
 export type MaybeReadonly<T> = Readonly<T> | T;
 
-/**
- * Explicitly nullable value helper.
- */
-export type Nullable<T> = null | T;
-
 /**
  * Number-like value represented as a number or a numeric string.
  */

package/src/types/vue.ts

@@ -1,7 +1,5 @@
 import type { GlobalComponents } from 'vue';
 
-import type { Nullable } from './';
-
 /**
  * A type that represents a reference to a Vue component instance.
  * The reference can be either an instance of the specified component or null.
@@ -15,4 +13,4 @@ import type { Nullable } from './';
  * const keepAliveRef = ref<ComponentRef<'KeepAlive'>>(null);
  * ```
  */
-export type ComponentRef<K extends keyof GlobalComponents> = Nullable<InstanceType<GlobalComponents[K]>>;
+export type ComponentRef<K extends keyof GlobalComponents> = InstanceType<GlobalComponents[K]> | null;

package/src/url.ts

@@ -5,18 +5,15 @@
  *
  * @param {string} url - The target URL to modify
  * @param {string} redirectPath - The path to use as the redirect destination
- * (must be an absolute path starting with '/')
+ * (must be a safe same-origin application path starting with `/`)
  *
  * @returns {string} A new URL string with the `redirect` query parameter
  *
- * @throws {Error} If redirectPath is not a valid relative path (must start with '/')
+ * @throws {Error} If redirectPath is not a safe same-origin application path
  */
 export function appendRedirectParamToUrl(url: string, redirectPath: string) {
-    if (!redirectPath.startsWith('/')) {
-        throw new Error(
-            `Invalid redirect path: "${redirectPath}". Redirect paths must be absolute paths starting with '/'.`,
-        );
-    }
+    // eslint-disable-next-line style/max-len
+    if (!isSafeRedirectPath(redirectPath)) throw new Error(`Invalid redirect path: "${redirectPath}". Redirect paths must be safe same-origin paths starting with '/'.`);
 
     const [baseAndHash, rawQuery = ''] = url.split('?');
     const [base, hash] = (baseAndHash || '').split('#');
@@ -25,3 +22,38 @@ export function appendRedirectParamToUrl(url: string, redirectPath: string) {
     const queryString = searchParams.toString();
     return hash ? `${base}?${queryString}#${hash}` : `${base}?${queryString}`;
 }
+
+/**
+ * Returns whether a value is a safe same-origin redirect path.
+ *
+ * Safe redirect paths are absolute application paths such as `/dashboard`.
+ * Protocol-relative URLs (`//example.com`), absolute URLs, backslash paths,
+ * and non-string values are rejected.
+ *
+ * @param {unknown} value - The value to check
+ *
+ * @returns {boolean} Whether the value is safe to use as an application redirect path
+ */
+export function isSafeRedirectPath(value: unknown): value is string {
+    if (typeof value !== 'string') return false;
+    if (!value.startsWith('/')) return false;
+    if (value.startsWith('//')) return false;
+    if (value.includes('\\')) return false;
+    return true;
+}
+
+/**
+ * Normalizes a redirect value into a safe same-origin application path.
+ *
+ * If an array is provided, the first value is checked. Unsafe values fall back
+ * to the provided fallback path.
+ *
+ * @param {unknown} value - The redirect value to normalize
+ * @param {string} fallback - The safe fallback path
+ *
+ * @returns {string} A safe redirect path
+ */
+export function normalizeRedirectPath(value: unknown, fallback = '/') {
+    const redirectPath = Array.isArray(value) ? value[0] : value;
+    return isSafeRedirectPath(redirectPath) ? redirectPath : fallback;
+}