@soorya-u/better-auth-desktop 0.1.0

package/dist/adapters/electron.mjs

@@ -0,0 +1,205 @@
+import { t as PACKAGE_VERSION } from "../version-1hEssvcU.mjs";
+import { t as createDesktopCookieLayer } from "../client-DhRcoap2.mjs";
+import { n as startAuthFlow, r as fetchUserImage } from "../exchange-DCZ0j_T5.mjs";
+import { Buffer } from "node:buffer";
+import { createServer } from "node:http";
+//#region src/adapters/electron.ts
+const ELECTRON_AUTH_CHANNELS = {
+	requestAuth: "desktop:requestAuth",
+	getUser: "desktop:getUser",
+	signOut: "desktop:signOut",
+	getUserImage: "desktop:getUserImage",
+	onAuthenticated: "desktop:onAuthenticated",
+	onUserUpdated: "desktop:onUserUpdated",
+	onAuthError: "desktop:onAuthError"
+};
+async function loadElectron() {
+	const electron = await import("electron");
+	return {
+		shell: electron.shell,
+		ipcMain: electron.ipcMain
+	};
+}
+const ENC_PREFIX = "enc:";
+async function electronStorage(opts = {}) {
+	const { name = "better-auth-desktop", encrypt = true } = opts;
+	const { default: Store } = await import("electron-store");
+	const store = new Store({ name });
+	let safeStorage = null;
+	if (encrypt) try {
+		const electron = await import("electron");
+		if (electron.safeStorage?.isEncryptionAvailable()) safeStorage = electron.safeStorage;
+	} catch {
+		safeStorage = null;
+	}
+	const seal = (value) => safeStorage ? ENC_PREFIX + safeStorage.encryptString(value).toString("base64") : value;
+	const open = (value) => {
+		if (!safeStorage || !value.startsWith(ENC_PREFIX)) return value;
+		return safeStorage.decryptString(Buffer.from(value.slice(4), "base64"));
+	};
+	return {
+		getItem: (key) => {
+			const raw = store.get(key);
+			if (typeof raw !== "string") return null;
+			try {
+				return open(raw);
+			} catch {
+				return null;
+			}
+		},
+		setItem: (key, value) => {
+			store.set(key, seal(String(value)));
+		}
+	};
+}
+function createLoopbackAdapter(shell, getWindow, storage) {
+	return {
+		openExternal: (url) => shell.openExternal(url),
+		serveLoopback(onRequest, opts) {
+			return new Promise((resolve) => {
+				const server = createServer(async (req, res) => {
+					const url = new URL(req.url ?? "/", "http://127.0.0.1");
+					const query = {};
+					url.searchParams.forEach((value, key) => {
+						query[key] = value;
+					});
+					const out = await onRequest({
+						path: url.pathname,
+						query
+					});
+					res.writeHead(out.status, out.headers);
+					res.end(out.body);
+				});
+				server.listen(opts?.port ?? 0, "127.0.0.1", () => {
+					const address = server.address();
+					resolve({
+						port: typeof address === "object" && address ? address.port : 0,
+						close: () => server.close()
+					});
+				});
+			});
+		},
+		notifyRenderer(event) {
+			const wc = getWindow()?.webContents;
+			if (!wc) return;
+			switch (event.type) {
+				case "authenticated":
+					wc.send(ELECTRON_AUTH_CHANNELS.onAuthenticated, event.user);
+					break;
+				case "user-updated":
+					wc.send(ELECTRON_AUTH_CHANNELS.onUserUpdated, event.user);
+					break;
+				case "error":
+					wc.send(ELECTRON_AUTH_CHANNELS.onAuthError, {
+						error: { message: event.error.message },
+						path: event.path
+					});
+					break;
+			}
+		},
+		storage
+	};
+}
+/**
+* Better Auth client plugin for Electron (main process). Shares the same core
+* as the Electrobun plugin; pulls in **no** Electrobun code. Use it with
+* `createAuthClient`, then call `setupMain()` (which registers the IPC handlers
+* and the session subscription, and returns a cleanup function):
+*
+* ```ts
+* const authClient = createAuthClient({
+*   baseURL,
+*   plugins: [electronDesktop({ clientID, storage: await electronStorage(), getWindow })],
+* });
+* await authClient.setupMain();
+* ```
+*/
+const electronDesktop = (options) => {
+	const layer = createDesktopCookieLayer(options);
+	const sanitizeUser = async (user) => {
+		if (user !== null && typeof options.sanitizeUser === "function") try {
+			return await options.sanitizeUser(user);
+		} catch (error) {
+			console.error("Error while sanitizing user", error);
+			return null;
+		}
+		return user;
+	};
+	return {
+		id: "desktop",
+		version: PACKAGE_VERSION,
+		fetchPlugins: [layer.fetchPlugin],
+		getActions: ($fetch, $store, clientOptions) => {
+			layer.bindStore($store);
+			layer.bindServerOrigin(clientOptions?.baseURL);
+			const getCookie = layer.getCookie;
+			return {
+				getCookie,
+				setupMain: async () => {
+					const { shell, ipcMain } = await loadElectron();
+					const adapter = createLoopbackAdapter(shell, options.getWindow, options.storage);
+					ipcMain.handle(ELECTRON_AUTH_CHANNELS.requestAuth, async (_event, cfg) => {
+						await startAuthFlow({
+							adapter,
+							$fetch,
+							clientOptions,
+							options,
+							cfg,
+							onAuthenticated: (user) => adapter.notifyRenderer({
+								type: "authenticated",
+								user
+							}),
+							onError: (error) => adapter.notifyRenderer({
+								type: "error",
+								error: error instanceof Error ? error : new Error(String(error)),
+								path: "/desktop/init-oauth-proxy"
+							})
+						});
+					});
+					ipcMain.handle(ELECTRON_AUTH_CHANNELS.getUser, async () => {
+						return await sanitizeUser((await $fetch("/get-session", {
+							method: "GET",
+							headers: {
+								cookie: getCookie(),
+								"content-type": "application/json"
+							}
+						})).data?.user ?? null);
+					});
+					ipcMain.handle(ELECTRON_AUTH_CHANNELS.signOut, async () => {
+						await $fetch("/sign-out", {
+							method: "POST",
+							body: "{}",
+							headers: {
+								cookie: getCookie(),
+								"content-type": "application/json"
+							}
+						});
+					});
+					ipcMain.handle(ELECTRON_AUTH_CHANNELS.getUserImage, async (_event, url) => {
+						const result = await fetchUserImage(clientOptions?.baseURL, url);
+						if (!result) return { dataUrl: null };
+						const { base64 } = await import("@better-auth/utils/base64");
+						return { dataUrl: `data:${result.mimeType};base64,${base64.encode(result.bytes)}` };
+					});
+					const unsub = $store.atoms.session?.subscribe(async (state) => {
+						if (state.isPending === true) return;
+						const user = await sanitizeUser(state.data?.user ?? null);
+						adapter.notifyRenderer({
+							type: "user-updated",
+							user
+						});
+					});
+					return () => {
+						unsub?.();
+						ipcMain.removeHandler(ELECTRON_AUTH_CHANNELS.requestAuth);
+						ipcMain.removeHandler(ELECTRON_AUTH_CHANNELS.getUser);
+						ipcMain.removeHandler(ELECTRON_AUTH_CHANNELS.signOut);
+						ipcMain.removeHandler(ELECTRON_AUTH_CHANNELS.getUserImage);
+					};
+				}
+			};
+		}
+	};
+};
+//#endregion
+export { ELECTRON_AUTH_CHANNELS, electronDesktop, electronStorage };

package/dist/client-De_zQzE1.d.mts

@@ -0,0 +1,34 @@
+import { i as DesktopClientOptions, l as Storage } from "./types-h9AEfSnq.mjs";
+import { BetterFetch, BetterFetchPlugin } from "@better-fetch/fetch";
+import { BetterAuthClientOptions, ClientStore } from "@better-auth/core";
+
+//#region src/core/client.d.ts
+type DesktopClientPluginOptions = DesktopClientOptions & {
+  storage: Storage;
+};
+type DesktopClientInternals = {
+  $fetch: BetterFetch;
+  $store: ClientStore;
+  clientOptions: BetterAuthClientOptions | undefined;
+  getCookie: () => string;
+  clearSession: () => void;
+};
+type DesktopCookieLayer = {
+  fetchPlugin: BetterFetchPlugin;
+  getCookie: () => string;
+  clearSession: () => void;
+  bindStore: (store: ClientStore) => void;
+  bindServerOrigin: (baseURL: string | undefined) => void;
+};
+declare function createDesktopCookieLayer(options: DesktopClientPluginOptions): DesktopCookieLayer;
+declare const desktopClient: (options: DesktopClientPluginOptions) => {
+  id: "desktop";
+  version: string;
+  fetchPlugins: BetterFetchPlugin[];
+  getActions: ($fetch: BetterFetch, $store: ClientStore, clientOptions: BetterAuthClientOptions | undefined) => {
+    getCookie: () => string;
+    getDesktopInternals: () => DesktopClientInternals;
+  };
+};
+//#endregion
+export { desktopClient as a, createDesktopCookieLayer as i, DesktopClientPluginOptions as n, DesktopCookieLayer as r, DesktopClientInternals as t };

package/dist/client-DhRcoap2.mjs

@@ -0,0 +1,157 @@
+import { t as PACKAGE_VERSION } from "./version-1hEssvcU.mjs";
+import { cookieNameRegex, parseSetCookieHeader } from "better-auth/cookies";
+//#region src/core/cookies.ts
+function getSetCookie(header, prevCookie) {
+	const parsed = parseSetCookieHeader(header);
+	let toSetCookie = {};
+	parsed.forEach((cookie, key) => {
+		const expiresAt = cookie.expires;
+		const maxAge = cookie["max-age"];
+		const expires = maxAge ? new Date(Date.now() + Number(maxAge) * 1e3) : expiresAt ? new Date(String(expiresAt)) : null;
+		toSetCookie[key] = {
+			value: cookie.value,
+			expires: expires ? expires.toISOString() : null
+		};
+	});
+	if (prevCookie) try {
+		toSetCookie = {
+			...JSON.parse(prevCookie),
+			...toSetCookie
+		};
+	} catch {}
+	return JSON.stringify(toSetCookie);
+}
+function getCookie(cookie) {
+	let parsed = {};
+	try {
+		parsed = JSON.parse(cookie);
+	} catch (_e) {}
+	const pairs = [];
+	for (const [key, value] of Object.entries(parsed)) {
+		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) continue;
+		if (!cookieNameRegex.test(key)) continue;
+		pairs.push(`${key}=${encodeURIComponent(value.value)}`);
+	}
+	return pairs.join("; ");
+}
+function hasBetterAuthCookies(setCookieHeader, cookiePrefix) {
+	const cookies = parseSetCookieHeader(setCookieHeader);
+	const cookieSuffixes = ["session_token", "session_data"];
+	const prefixes = Array.isArray(cookiePrefix) ? cookiePrefix : [cookiePrefix];
+	for (const name of cookies.keys()) {
+		const nameWithoutSecure = name.startsWith("__Secure-") ? name.slice(9) : name;
+		for (const prefix of prefixes) if (prefix) {
+			if (nameWithoutSecure.startsWith(prefix)) return true;
+		} else for (const suffix of cookieSuffixes) if (nameWithoutSecure.endsWith(suffix)) return true;
+	}
+	return false;
+}
+//#endregion
+//#region src/core/client.ts
+const USER_AGENT = `better-auth-desktop/${PACKAGE_VERSION}`;
+function createDesktopCookieLayer(options) {
+	const opts = {
+		storagePrefix: "better-auth",
+		cookiePrefix: "better-auth",
+		...options
+	};
+	const cookieName = `${opts.storagePrefix}.cookie`;
+	const localCacheName = `${opts.storagePrefix}.local_cache`;
+	const getStored = (name) => {
+		const item = opts.storage.getItem(name);
+		return typeof item === "string" ? item : null;
+	};
+	const setStored = (name, value) => {
+		try {
+			opts.storage.setItem(name, value);
+		} catch {}
+	};
+	let store = null;
+	let serverOrigin;
+	const originOf = (url) => {
+		if (serverOrigin) return serverOrigin;
+		try {
+			return new URL(url).origin;
+		} catch {
+			return "";
+		}
+	};
+	const getCookieFn = () => getCookie(getStored(cookieName) || "");
+	const clearSession = () => {
+		setStored(cookieName, "");
+		setStored(localCacheName, "");
+		store?.atoms.session?.set({
+			...store.atoms.session.get(),
+			data: null,
+			error: null,
+			isPending: false
+		});
+	};
+	return {
+		fetchPlugin: {
+			id: "desktop",
+			name: "Desktop",
+			async init(url, fetchOptions) {
+				const resolvedOptions = fetchOptions ?? {};
+				resolvedOptions.credentials = "omit";
+				resolvedOptions.headers = {
+					...resolvedOptions.headers,
+					cookie: getCookieFn(),
+					"user-agent": USER_AGENT,
+					"desktop-origin": originOf(url),
+					"x-skip-oauth-proxy": "true"
+				};
+				if (url.endsWith("/sign-out")) clearSession();
+				return {
+					url,
+					options: resolvedOptions
+				};
+			},
+			hooks: { onSuccess: async (context) => {
+				const setCookie = context.response.headers.get("set-cookie");
+				if (setCookie && hasBetterAuthCookies(setCookie, opts.cookiePrefix)) {
+					setStored(cookieName, getSetCookie(setCookie, getStored(cookieName) ?? void 0));
+					store?.notify("$sessionSignal");
+				}
+				const requestUrl = context.request.url.toString();
+				if (requestUrl.includes("/get-session") && !opts.disableCache) setStored(localCacheName, JSON.stringify(context.data));
+				if (requestUrl.includes("/sign-out")) clearSession();
+			} }
+		},
+		getCookie: getCookieFn,
+		clearSession,
+		bindStore: (s) => {
+			store = s;
+		},
+		bindServerOrigin: (baseURL) => {
+			if (!baseURL) return;
+			try {
+				serverOrigin = new URL(baseURL).origin;
+			} catch {}
+		}
+	};
+}
+const desktopClient = (options) => {
+	const layer = createDesktopCookieLayer(options);
+	return {
+		id: "desktop",
+		version: PACKAGE_VERSION,
+		fetchPlugins: [layer.fetchPlugin],
+		getActions: ($fetch, $store, clientOptions) => {
+			layer.bindStore($store);
+			layer.bindServerOrigin(clientOptions?.baseURL);
+			return {
+				getCookie: layer.getCookie,
+				getDesktopInternals: () => ({
+					$fetch,
+					$store,
+					clientOptions,
+					getCookie: layer.getCookie,
+					clearSession: layer.clearSession
+				})
+			};
+		}
+	};
+};
+//#endregion
+export { desktopClient as n, createDesktopCookieLayer as t };

package/dist/client.d.mts

@@ -0,0 +1,3 @@
+import { i as DesktopClientOptions, l as Storage } from "./types-h9AEfSnq.mjs";
+import { a as desktopClient, n as DesktopClientPluginOptions, t as DesktopClientInternals } from "./client-De_zQzE1.mjs";
+export { type DesktopClientInternals, type DesktopClientOptions, type DesktopClientPluginOptions, type Storage, desktopClient };

package/dist/client.mjs

@@ -0,0 +1,2 @@
+import { n as desktopClient } from "./client-DhRcoap2.mjs";
+export { desktopClient };

package/dist/core/index.d.mts

@@ -0,0 +1,6 @@
+import { a as LoopbackRequest, c as RequestAuthOptions, i as DesktopClientOptions, l as Storage, n as AuthUser, o as LoopbackResponse, r as DesktopAdapter, s as LoopbackServer, t as AuthEvent } from "../types-h9AEfSnq.mjs";
+import { a as desktopClient, i as createDesktopCookieLayer, n as DesktopClientPluginOptions, r as DesktopCookieLayer, t as DesktopClientInternals } from "../client-De_zQzE1.mjs";
+import { n as keychainStorage, t as KeychainStorageOptions } from "../storage-DtgX_vmE.mjs";
+import { a as StartAuthFlowArgs, i as ExchangeTokenArgs, n as fetchUserImage, o as exchangeToken, r as normalizeUserOutput, s as startAuthFlow, t as FetchUserImageResult } from "../index-CP_2Wlut.mjs";
+import { a as isAllowedLoopbackPort, i as generateNonce, n as LOOPBACK_HOST, o as parseLoopbackUrl, r as buildLoopbackUrl, s as successPage, t as AllowedLoopbackPorts } from "../loopback-ClkAoS2u.mjs";
+export { AllowedLoopbackPorts, AuthEvent, AuthUser, DesktopAdapter, DesktopClientInternals, DesktopClientOptions, DesktopClientPluginOptions, DesktopCookieLayer, ExchangeTokenArgs, FetchUserImageResult, KeychainStorageOptions, LOOPBACK_HOST, LoopbackRequest, LoopbackResponse, LoopbackServer, RequestAuthOptions, StartAuthFlowArgs, Storage, buildLoopbackUrl, createDesktopCookieLayer, desktopClient, exchangeToken, fetchUserImage, generateNonce, isAllowedLoopbackPort, keychainStorage, normalizeUserOutput, parseLoopbackUrl, startAuthFlow, successPage };

package/dist/core/index.mjs

@@ -0,0 +1,5 @@
+import { n as desktopClient, t as createDesktopCookieLayer } from "../client-DhRcoap2.mjs";
+import { a as parseLoopbackUrl, i as isAllowedLoopbackPort, n as buildLoopbackUrl, o as successPage, r as generateNonce, t as LOOPBACK_HOST } from "../loopback-DTQgg1Za.mjs";
+import { i as normalizeUserOutput, n as startAuthFlow, r as fetchUserImage, t as exchangeToken } from "../exchange-DCZ0j_T5.mjs";
+import { t as keychainStorage } from "../storage-BcwDmS-W.mjs";
+export { LOOPBACK_HOST, buildLoopbackUrl, createDesktopCookieLayer, desktopClient, exchangeToken, fetchUserImage, generateNonce, isAllowedLoopbackPort, keychainStorage, normalizeUserOutput, parseLoopbackUrl, startAuthFlow, successPage };

package/dist/exchange-DCZ0j_T5.mjs

@@ -0,0 +1,217 @@
+import { n as buildLoopbackUrl, o as successPage, r as generateNonce } from "./loopback-DTQgg1Za.mjs";
+import { BetterAuthError } from "@better-auth/core/error";
+import { base64, base64Url } from "@better-auth/utils/base64";
+import { createHash } from "@better-auth/utils/hash";
+import { getBaseURL, safeJSONParse } from "better-auth";
+import { generateRandomString } from "better-auth/crypto";
+//#region src/core/user.ts
+const DEFAULT_MAX_BYTES = 1024 * 1024 * 5;
+async function fetchUserImage(baseURL, url) {
+	const decoded = await decodeDataImageUrl(url);
+	if (decoded) return {
+		bytes: decoded.bytes,
+		mimeType: decoded.mimeType
+	};
+	let resolvedUrl;
+	try {
+		let parsed;
+		try {
+			parsed = new URL(url);
+		} catch {
+			if (!baseURL) return null;
+			const base = baseURL.endsWith("/") ? baseURL : `${baseURL}/`;
+			const relative = url.startsWith("/") ? url.slice(1) : url;
+			parsed = new URL(relative, base);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+		resolvedUrl = parsed.href;
+	} catch {
+		return null;
+	}
+	const response = await fetch(resolvedUrl, {
+		method: "GET",
+		headers: { accept: "image/*" }
+	});
+	if (!response.ok) return null;
+	const contentType = response.headers.get("content-type");
+	if (!contentType?.startsWith("image/") || contentType.startsWith("image/svg")) return null;
+	const contentLength = response.headers.get("content-length");
+	if (contentLength && Number(contentLength) > DEFAULT_MAX_BYTES) return null;
+	const buf = await response.arrayBuffer();
+	const bytes = new Uint8Array(buf);
+	if (bytes.byteLength > DEFAULT_MAX_BYTES) return null;
+	return {
+		bytes,
+		mimeType: contentType.split(";")[0]?.trim() || "image/png"
+	};
+}
+function normalizeUserOutput(user, _options) {
+	return { ...user };
+}
+async function decodeDataImageUrl(url) {
+	const maxBase64Size = Math.ceil(DEFAULT_MAX_BYTES * 4 / 3);
+	const lower = url.toLowerCase();
+	if (!lower.startsWith("data:image/") || lower.startsWith("data:image/svg")) return null;
+	const markerIdx = lower.indexOf(";base64,");
+	if (markerIdx === -1) return null;
+	const mimeType = url.substring(5, markerIdx);
+	const payload = url.substring(markerIdx + 8);
+	if (!payload || payload.length > maxBase64Size) return null;
+	try {
+		const bytes = base64.decode(payload);
+		if (!detectImageType(bytes)) return null;
+		return {
+			bytes,
+			mimeType
+		};
+	} catch {
+		return null;
+	}
+}
+function detectImageType(bytes) {
+	if (bytes.length < 12) return null;
+	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71 && bytes[4] === 13 && bytes[5] === 10 && bytes[6] === 26 && bytes[7] === 10) return "image/png";
+	if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpg";
+	if (bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 56 && (bytes[4] === 55 || bytes[4] === 57) && bytes[5] === 97) return "image/gif";
+	if (bytes.length >= 12 && bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) return "image/webp";
+	if (bytes[0] === 66 && bytes[1] === 77) return "image/bmp";
+	if (bytes[0] === 73 && bytes[1] === 73 && bytes[2] === 42 && bytes[3] === 0 || bytes[0] === 77 && bytes[1] === 77 && bytes[2] === 0 && bytes[3] === 42) return "image/tiff";
+	if (bytes[0] === 0 && bytes[1] === 0 && bytes[2] === 1 && bytes[3] === 0) return "image/x-icon";
+	if (bytes.length < 16) return null;
+	if (String.fromCharCode(...bytes.slice(4, 8)) !== "ftyp") return null;
+	const brand = String.fromCharCode(...bytes.slice(8, 12));
+	if (brand === "avif" || brand === "heic" || brand === "heif") return `image/${brand}`;
+	if (brand === "heix" || brand === "hevc" || brand === "mif1" || brand === "msf1") return "image/heic";
+	return null;
+}
+//#endregion
+//#region src/core/exchange.ts
+const verifierStore = /* @__PURE__ */ new Map();
+const DEFAULT_LOOPBACK_PATH = "/callback";
+const DEFAULT_LOOPBACK_TIMEOUT = 3e5;
+function randomVerifier() {
+	const bytes = new Uint8Array(32);
+	crypto.getRandomValues(bytes);
+	return base64Url.encode(bytes);
+}
+function loopbackSuccessResponse(success) {
+	if (success && typeof success === "object") return {
+		status: 302,
+		headers: { location: success.redirectTo },
+		body: ""
+	};
+	return {
+		status: 200,
+		headers: { "content-type": "text/html; charset=utf-8" },
+		body: success ?? successPage()
+	};
+}
+async function sanitize(user, options) {
+	let u = user;
+	if (u !== null && typeof options.sanitizeUser === "function") try {
+		u = await options.sanitizeUser(u);
+	} catch (error) {
+		console.error("Error while sanitizing user", error);
+		u = null;
+	}
+	if (u !== null) u = normalizeUserOutput(u, options);
+	return u;
+}
+async function exchangeToken({ $fetch, options, token, onAuthenticated, fetchOptions }) {
+	const decoded = safeJSONParse(new TextDecoder().decode(base64Url.decode(decodeURIComponent(token))));
+	const codeVerifier = decoded ? verifierStore.get(decoded.state) : void 0;
+	if (decoded) verifierStore.delete(decoded.state);
+	if (!decoded || !codeVerifier) throw new BetterAuthError("Code verifier not found.");
+	return await $fetch("/desktop/token", {
+		...fetchOptions,
+		method: "POST",
+		body: {
+			...fetchOptions?.body || {},
+			token: decoded.identifier,
+			state: decoded.state,
+			code_verifier: codeVerifier
+		},
+		onSuccess: async (ctx) => {
+			const user = await sanitize(ctx.data?.user ?? null, options);
+			if (user === null) return;
+			await fetchOptions?.onSuccess?.(ctx);
+			onAuthenticated(user);
+		}
+	});
+}
+async function startAuthFlow({ adapter, $fetch, clientOptions, options, cfg, onAuthenticated, onError }) {
+	const baseURL = getBaseURL(clientOptions?.baseURL, clientOptions?.basePath, void 0, true);
+	if (!baseURL) throw new BetterAuthError("Base URL is required to start a desktop sign-in flow.");
+	const state = generateRandomString(16, "A-Z", "a-z", "0-9");
+	const codeVerifier = randomVerifier();
+	const codeChallenge = base64Url.encode(await createHash("SHA-256").digest(codeVerifier));
+	verifierStore.set(state, codeVerifier);
+	const nonce = generateNonce();
+	const loopbackPath = options.loopbackPath ?? DEFAULT_LOOPBACK_PATH;
+	let server = null;
+	let timer = null;
+	const cleanup = () => {
+		if (timer) clearTimeout(timer);
+		timer = null;
+		server?.close();
+		server = null;
+		verifierStore.delete(state);
+	};
+	server = await adapter.serveLoopback(async (req) => {
+		if (req.path !== loopbackPath) return {
+			status: 404,
+			body: "Not found"
+		};
+		if (req.query.nonce !== nonce) return {
+			status: 403,
+			body: "Forbidden"
+		};
+		const token = req.query.token;
+		if (!token) return {
+			status: 400,
+			body: "Missing token"
+		};
+		try {
+			await exchangeToken({
+				$fetch,
+				options,
+				token,
+				onAuthenticated,
+				fetchOptions: { throw: true }
+			});
+		} catch (error) {
+			cleanup();
+			onError?.(error);
+			return {
+				status: 500,
+				headers: { "content-type": "text/plain; charset=utf-8" },
+				body: "Sign-in failed. You can close this tab."
+			};
+		}
+		cleanup();
+		return loopbackSuccessResponse(options.loopbackSuccess);
+	}, { port: options.loopbackPort });
+	const loopbackUrl = buildLoopbackUrl(server.port, loopbackPath, nonce);
+	const url = new URL(`${baseURL}/desktop/init-oauth-proxy`);
+	for (const [key, value] of Object.entries(cfg)) {
+		if (value === void 0) continue;
+		url.searchParams.set(key, typeof value === "string" ? value : JSON.stringify(value));
+	}
+	url.searchParams.set("client_id", options.clientID ?? "desktop");
+	url.searchParams.set("code_challenge", codeChallenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	url.searchParams.set("state", state);
+	url.searchParams.set("callbackURL", loopbackUrl);
+	timer = setTimeout(() => {
+		cleanup();
+		onError?.(new BetterAuthError("Desktop sign-in timed out."));
+	}, options.loopbackTimeout ?? DEFAULT_LOOPBACK_TIMEOUT);
+	try {
+		await adapter.openExternal(url.toString());
+	} catch (error) {
+		cleanup();
+		throw error;
+	}
+}
+//#endregion
+export { normalizeUserOutput as i, startAuthFlow as n, fetchUserImage as r, exchangeToken as t };