@tern-secure/auth 1.1.0-canary.v20251020170039 → 1.1.0-canary.v20251024005655

package/dist/cjs/resources/SignIn.js

@@ -26,7 +26,7 @@ var import_auth = require("firebase/auth");
 var import_Base = require("./Base");
 class SignIn extends import_Base.TernSecureBase {
   pathRoot = "/sessions/createsession";
-  status;
+  status = null;
   auth;
   csrfToken;
   _currentUser = null;
@@ -81,24 +81,17 @@ class SignIn extends import_Base.TernSecureBase {
       console.error(authError);
     }
   };
-  withSocialProvider = async (provider, options) => {
+  withSocialProvider = async (provider, options = {}) => {
     try {
-      if ((options == null ? void 0 : options.mode) === "redirect") {
+      const { mode = "popup" } = options;
+      if (mode === "redirect") {
         const redirectResult = await this.authRedirectResult();
         if (redirectResult) {
-          if (redirectResult.status === "success") {
-            console.log("Redirect after sign in");
-          }
           return redirectResult;
         }
-        await this._signInWithRedirect(provider);
-        return;
+        return await this._signInWithRedirect(provider, options);
       } else {
-        await this._signInWithPopUp(provider);
-        return {
-          status: "success",
-          message: "Sign in successful"
-        };
+        return await this._signInWithPopUp(provider, options);
       }
     } catch (error) {
       return {
@@ -139,22 +132,27 @@ class SignIn extends import_Base.TernSecureBase {
     switch (providerName.toLowerCase()) {
       case "google": {
         const googleProvider = new import_auth.GoogleAuthProvider();
-        return {
-          provider: googleProvider,
-          customParameters: {
-            login_hint: "user@example.com",
-            prompt: "select_account"
-          }
-        };
+        return { provider: googleProvider };
+      }
+      case "apple": {
+        const appleProvider = new import_auth.OAuthProvider("apple.com");
+        return { provider: appleProvider };
       }
       case "microsoft": {
         const microsoftProvider = new import_auth.OAuthProvider("microsoft.com");
-        return {
-          provider: microsoftProvider,
-          customParameters: {
-            prompt: "consent"
-          }
-        };
+        return { provider: microsoftProvider };
+      }
+      case "github": {
+        const githubProvider = new import_auth.OAuthProvider("github.com");
+        return { provider: githubProvider };
+      }
+      case "twitter": {
+        const twitterProvider = new import_auth.OAuthProvider("twitter.com");
+        return { provider: twitterProvider };
+      }
+      case "facebook": {
+        const facebookProvider = new import_auth.OAuthProvider("facebook.com");
+        return { provider: facebookProvider };
       }
       default:
         throw new Error(`Unsupported provider: ${providerName}`);
@@ -182,12 +180,56 @@ class SignIn extends import_Base.TernSecureBase {
       };
     }
   }
-  async executeAuthMethod(authMethod, providerName) {
-    const config = this.getProviderConfig(providerName);
-    config.provider.setCustomParameters(config.customParameters);
+  /**
+   * Sets custom OAuth parameters on the provider if provided by consumer
+   * @param provider - Firebase auth provider instance
+   * @param customParameters - Consumer-provided OAuth parameters
+   */
+  setProviderCustomParameters(provider, customParameters) {
+    if (!customParameters || Object.keys(customParameters).length === 0) {
+      return;
+    }
+    provider.setCustomParameters(customParameters);
+  }
+  /**
+   * Adds OAuth scopes to the provider if provided by consumer
+   * Handles provider-specific scope setting logic
+   * @param provider - Firebase auth provider instance
+   * @param scopes - Array of OAuth scopes to request
+   */
+  setProviderScopes(provider, scopes) {
+    if (!scopes || scopes.length === 0) {
+      return;
+    }
+    if (provider instanceof import_auth.GoogleAuthProvider) {
+      scopes.forEach((scope) => {
+        provider.addScope(scope);
+      });
+    } else if (provider instanceof import_auth.OAuthProvider) {
+      provider.addScope(scopes.join(" "));
+    }
+  }
+  /**
+   * Configures OAuth provider with consumer-provided options
+   * @param provider - Firebase auth provider instance
+   * @param options - Consumer options containing custom parameters and scopes
+   */
+  configureProvider(provider, options) {
+    this.setProviderCustomParameters(provider, options.customParameters);
+    this.setProviderScopes(provider, options.scopes);
+  }
+  executeAuthMethod = async (authMethod, providerName, options = {}) => {
     try {
-      await authMethod(this.auth, config.provider);
-      return { status: "success", message: "Authentication initiated" };
+      const config = this.getProviderConfig(providerName);
+      this.configureProvider(config.provider, options);
+      const { user, providerId, operationType } = await authMethod(this.auth, config.provider);
+      return {
+        status: "success",
+        message: "Authentication successful",
+        user,
+        providerId,
+        operationType
+      };
     } catch (error) {
       const authError = (0, import_errors.handleFirebaseAuthError)(error);
       return {
@@ -196,12 +238,12 @@ class SignIn extends import_Base.TernSecureBase {
         error: authError.code
       };
     }
+  };
+  async _signInWithRedirect(providerName, options = {}) {
+    return this.executeAuthMethod(import_auth.signInWithRedirect, providerName, options);
   }
-  async _signInWithRedirect(providerName) {
-    return this.executeAuthMethod(import_auth.signInWithRedirect, providerName);
-  }
-  async _signInWithPopUp(providerName) {
-    return this.executeAuthMethod(import_auth.signInWithPopup, providerName);
+  async _signInWithPopUp(providerName, options = {}) {
+    return this.executeAuthMethod(import_auth.signInWithPopup, providerName, options);
   }
   async checkRedirectResult() {
     return this.authRedirectResult();

package/dist/cjs/resources/SignIn.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/resources/SignIn.ts"],"sourcesContent":["import { handleFirebaseAuthError } from '@tern-secure/shared/errors';\nimport type {\n  ResendEmailVerification,\n  SignInFormValues,\n  SignInResource,\n  SignInResponse as SignInResponseFromTypes,\n  SignInStatus,\n  TernSecureUser,\n} from '@tern-secure/types';\nimport type { Auth, UserCredential } from 'firebase/auth';\nimport {\n  getRedirectResult,\n  GoogleAuthProvider,\n  OAuthProvider,\n  sendEmailVerification,\n  signInWithEmailAndPassword,\n  signInWithPopup,\n  signInWithRedirect,\n} from 'firebase/auth';\n\nimport { TernSecureBase } from './Base';\n\ntype SignInResponse = SignInResponseFromTypes;\n\ninterface ProviderConfig {\n  provider: GoogleAuthProvider | OAuthProvider;\n  customParameters: Record<string, string>;\n}\n\nexport type TernRequestInit = RequestInit;\n\nexport type SignInParams = {\n  idToken: string;\n  csrfToken: string | undefined;\n};\n\ntype FirebaseAuthResult = UserCredential | void;\n\ntype AuthMethodFunction = (\n  auth: Auth,\n  provider: GoogleAuthProvider | OAuthProvider,\n) => Promise<FirebaseAuthResult>;\n\nexport class SignIn extends TernSecureBase implements SignInResource {\n  pathRoot = '/sessions/createsession';\n\n  status?: SignInStatus | undefined;\n  private auth: Auth;\n  private csrfToken: string | undefined;\n  private _currentUser: TernSecureUser | null = null;\n\n  constructor(auth: Auth, csrfToken: string | undefined) {\n    super();\n    this.auth = auth;\n    this.csrfToken = csrfToken;\n  }\n\n  signInWithCredential = async (credential: UserCredential) => {\n    const idToken = await credential.user.getIdToken();\n    const params = {\n      idToken: idToken,\n      csrfToken: this.csrfToken,\n    };\n\n    return this._post({\n      path: this.pathRoot,\n      body: params,\n    });\n  };\n\n  withEmailAndPassword = async (params: SignInFormValues): Promise<SignInResponse> => {\n    try {\n      const { email, password } = params;\n      const { user, providerId, operationType } = await signInWithEmailAndPassword(\n        this.auth,\n        email,\n        password,\n      );\n      return {\n        status: 'success',\n        user,\n        providerId,\n        operationType,\n        message: 'Authentication successful',\n        error: !user.emailVerified ? 'REQUIRES_VERIFICATION' : 'AUTHENTICATED',\n      };\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  };\n\n  withCredential = async (params: SignInFormValues): Promise<void> => {\n    try {\n      const { email, password } = params;\n      const userCredential = await signInWithEmailAndPassword(this.auth, email, password);\n      await this.signInWithCredential(userCredential);\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      console.error(authError);\n    }\n  };\n\n  withSocialProvider = async (\n    provider: string,\n    options?: {\n      mode?: 'popup' | 'redirect';\n    },\n  ): Promise<SignInResponse | void> => {\n    try {\n      if (options?.mode === 'redirect') {\n        const redirectResult = await this.authRedirectResult();\n\n        if (redirectResult) {\n          if (redirectResult.status === 'success') {\n            console.log('Redirect after sign in');\n          }\n          return redirectResult;\n        }\n\n        await this._signInWithRedirect(provider);\n        return;\n      } else {\n        await this._signInWithPopUp(provider);\n        return {\n          status: 'success',\n          message: 'Sign in successful',\n        };\n      }\n    } catch (error: any) {\n      return {\n        status: 'error',\n        message: error.message || `Sign in with ${provider} failed`,\n        error,\n      };\n    }\n  };\n\n  completeMfaSignIn = async (_mfaToken: string, _mfaContext?: any): Promise<SignInResponse> => {\n    throw new Error('Method not implemented.');\n  };\n\n  sendPasswordResetEmail = async (email: string): Promise<void> => {\n    console.log(`Sending password reset email to ${email}`);\n  };\n\n  resendEmailVerification = async (): Promise<ResendEmailVerification> => {\n    const user = this._currentUser;\n    if (!user) {\n      throw new Error('No user is currently signed in');\n    }\n\n    await user.reload();\n\n    if (user.emailVerified) {\n      return {\n        isVerified: true,\n      };\n    }\n\n    const actionCodeSettings = {\n      url: '/sign-in', // TODO: Make this configurable\n      handleCodeInApp: true,\n    };\n\n    await sendEmailVerification(user, actionCodeSettings);\n    return {\n      isVerified: false,\n    };\n  };\n\n  private getProviderConfig(providerName: string): ProviderConfig {\n    switch (providerName.toLowerCase()) {\n      case 'google': {\n        const googleProvider = new GoogleAuthProvider();\n        return {\n          provider: googleProvider,\n          customParameters: {\n            login_hint: 'user@example.com',\n            prompt: 'select_account',\n          },\n        };\n      }\n      case 'microsoft': {\n        const microsoftProvider = new OAuthProvider('microsoft.com');\n        return {\n          provider: microsoftProvider,\n          customParameters: {\n            prompt: 'consent',\n          },\n        };\n      }\n      default:\n        throw new Error(`Unsupported provider: ${providerName}`);\n    }\n  }\n\n  private async authRedirectResult(): Promise<SignInResponse | null> {\n    try {\n      const result = await getRedirectResult(this.auth);\n\n      if (result) {\n        const { user, providerId, operationType } = result;\n        return {\n          status: 'success',\n          user,\n          providerId,\n          operationType,\n        };\n      }\n      return null;\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  }\n\n  private async executeAuthMethod(\n    authMethod: AuthMethodFunction,\n    providerName: string,\n  ): Promise<SignInResponse> {\n    const config = this.getProviderConfig(providerName);\n    config.provider.setCustomParameters(config.customParameters);\n    try {\n      await authMethod(this.auth, config.provider);\n      return { status: 'success', message: 'Authentication initiated' };\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  }\n\n  private async _signInWithRedirect(providerName: string): Promise<SignInResponse> {\n    return this.executeAuthMethod(signInWithRedirect, providerName);\n  }\n\n  private async _signInWithPopUp(providerName: string): Promise<SignInResponse> {\n    return this.executeAuthMethod(signInWithPopup, providerName);\n  }\n\n  public async checkRedirectResult(): Promise<SignInResponse | null> {\n    return this.authRedirectResult();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAwC;AAUxC,kBAQO;AAEP,kBAA+B;AAuBxB,MAAM,eAAe,2BAAyC;AAAA,EACnE,WAAW;AAAA,EAEX;AAAA,EACQ;AAAA,EACA;AAAA,EACA,eAAsC;AAAA,EAE9C,YAAY,MAAY,WAA+B;AACrD,UAAM;AACN,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,uBAAuB,OAAO,eAA+B;AAC3D,UAAM,UAAU,MAAM,WAAW,KAAK,WAAW;AACjD,UAAM,SAAS;AAAA,MACb;AAAA,MACA,WAAW,KAAK;AAAA,IAClB;AAEA,WAAO,KAAK,MAAM;AAAA,MAChB,MAAM,KAAK;AAAA,MACX,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA,EAEA,uBAAuB,OAAO,WAAsD;AAClF,QAAI;AACF,YAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,YAAM,EAAE,MAAM,YAAY,cAAc,IAAI,UAAM;AAAA,QAChD,KAAK;AAAA,QACL;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,OAAO,CAAC,KAAK,gBAAgB,0BAA0B;AAAA,MACzD;AAAA,IACF,SAAS,OAAO;AACd,YAAM,gBAAY,uCAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,iBAAiB,OAAO,WAA4C;AAClE,QAAI;AACF,YAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,YAAM,iBAAiB,UAAM,wCAA2B,KAAK,MAAM,OAAO,QAAQ;AAClF,YAAM,KAAK,qBAAqB,cAAc;AAAA,IAChD,SAAS,OAAO;AACd,YAAM,gBAAY,uCAAwB,KAAK;AAC/C,cAAQ,MAAM,SAAS;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,qBAAqB,OACnB,UACA,YAGmC;AACnC,QAAI;AACF,WAAI,mCAAS,UAAS,YAAY;AAChC,cAAM,iBAAiB,MAAM,KAAK,mBAAmB;AAErD,YAAI,gBAAgB;AAClB,cAAI,eAAe,WAAW,WAAW;AACvC,oBAAQ,IAAI,wBAAwB;AAAA,UACtC;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,KAAK,oBAAoB,QAAQ;AACvC;AAAA,MACF,OAAO;AACL,cAAM,KAAK,iBAAiB,QAAQ;AACpC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF,SAAS,OAAY;AACnB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,MAAM,WAAW,gBAAgB,QAAQ;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAoB,OAAO,WAAmB,gBAA+C;AAC3F,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EAEA,yBAAyB,OAAO,UAAiC;AAC/D,YAAQ,IAAI,mCAAmC,KAAK,EAAE;AAAA,EACxD;AAAA,EAEA,0BAA0B,YAA8C;AACtE,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AAEA,UAAM,KAAK,OAAO;AAElB,QAAI,KAAK,eAAe;AACtB,aAAO;AAAA,QACL,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,qBAAqB;AAAA,MACzB,KAAK;AAAA;AAAA,MACL,iBAAiB;AAAA,IACnB;AAEA,cAAM,mCAAsB,MAAM,kBAAkB;AACpD,WAAO;AAAA,MACL,YAAY;AAAA,IACd;AAAA,EACF;AAAA,EAEQ,kBAAkB,cAAsC;AAC9D,YAAQ,aAAa,YAAY,GAAG;AAAA,MAClC,KAAK,UAAU;AACb,cAAM,iBAAiB,IAAI,+BAAmB;AAC9C,eAAO;AAAA,UACL,UAAU;AAAA,UACV,kBAAkB;AAAA,YAChB,YAAY;AAAA,YACZ,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,aAAa;AAChB,cAAM,oBAAoB,IAAI,0BAAc,eAAe;AAC3D,eAAO;AAAA,UACL,UAAU;AAAA,UACV,kBAAkB;AAAA,YAChB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA;AACE,cAAM,IAAI,MAAM,yBAAyB,YAAY,EAAE;AAAA,IAC3D;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqD;AACjE,QAAI;AACF,YAAM,SAAS,UAAM,+BAAkB,KAAK,IAAI;AAEhD,UAAI,QAAQ;AACV,cAAM,EAAE,MAAM,YAAY,cAAc,IAAI;AAC5C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,gBAAY,uCAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,kBACZ,YACA,cACyB;AACzB,UAAM,SAAS,KAAK,kBAAkB,YAAY;AAClD,WAAO,SAAS,oBAAoB,OAAO,gBAAgB;AAC3D,QAAI;AACF,YAAM,WAAW,KAAK,MAAM,OAAO,QAAQ;AAC3C,aAAO,EAAE,QAAQ,WAAW,SAAS,2BAA2B;AAAA,IAClE,SAAS,OAAO;AACd,YAAM,gBAAY,uCAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,cAA+C;AAC/E,WAAO,KAAK,kBAAkB,gCAAoB,YAAY;AAAA,EAChE;AAAA,EAEA,MAAc,iBAAiB,cAA+C;AAC5E,WAAO,KAAK,kBAAkB,6BAAiB,YAAY;AAAA,EAC7D;AAAA,EAEA,MAAa,sBAAsD;AACjE,WAAO,KAAK,mBAAmB;AAAA,EACjC;AACF;","names":[]}
+{"version":3,"sources":["../../../src/resources/SignIn.ts"],"sourcesContent":["import { handleFirebaseAuthError } from '@tern-secure/shared/errors';\nimport type {\n  ResendEmailVerification,\n  SignInFormValues,\n  SignInResource,\n  SignInResponse as SignInResponseFromTypes,\n  SignInStatus,\n  SocialProviderOptions,\n  TernSecureUser,\n} from '@tern-secure/types';\nimport type { Auth, UserCredential } from 'firebase/auth';\nimport {\n  getRedirectResult,\n  GoogleAuthProvider,\n  OAuthProvider,\n  sendEmailVerification,\n  signInWithEmailAndPassword,\n  signInWithPopup,\n  signInWithRedirect,\n} from 'firebase/auth';\n\nimport { TernSecureBase } from './Base';\n\ntype SignInResponse = SignInResponseFromTypes;\n\ninterface ProviderConfig {\n  provider: GoogleAuthProvider | OAuthProvider;\n  //customParameters: Record<string, string>;\n}\n\nexport type TernRequestInit = RequestInit;\n\nexport type SignInParams = {\n  idToken: string;\n  csrfToken: string | undefined;\n};\n\ntype FirebaseAuthResult = UserCredential;\n\ntype AuthMethodFunction = (\n  auth: Auth,\n  provider: GoogleAuthProvider | OAuthProvider,\n) => Promise<FirebaseAuthResult>;\n\n/**\n * Supported OAuth providers\n */\nexport type SupportedProvider =\n  | 'google'\n  | 'apple'\n  | 'microsoft'\n  | 'github'\n  | 'twitter'\n  | 'facebook'\n  | string; // Allow custom providers like 'custom.provider.com'\n\nexport class SignIn extends TernSecureBase implements SignInResource {\n  pathRoot = '/sessions/createsession';\n\n  status: SignInStatus | null = null;\n  private auth: Auth;\n  private csrfToken: string | undefined;\n  private _currentUser: TernSecureUser | null = null;\n\n  constructor(auth: Auth, csrfToken: string | undefined) {\n    super();\n    this.auth = auth;\n    this.csrfToken = csrfToken;\n  }\n\n  signInWithCredential = async (credential: UserCredential) => {\n    const idToken = await credential.user.getIdToken();\n    const params = {\n      idToken: idToken,\n      csrfToken: this.csrfToken,\n    };\n\n    return this._post({\n      path: this.pathRoot,\n      body: params,\n    });\n  };\n\n  withEmailAndPassword = async (params: SignInFormValues): Promise<SignInResponse> => {\n    try {\n      const { email, password } = params;\n      const { user, providerId, operationType } = await signInWithEmailAndPassword(\n        this.auth,\n        email,\n        password,\n      );\n      return {\n        status: 'success',\n        user,\n        providerId,\n        operationType,\n        message: 'Authentication successful',\n        error: !user.emailVerified ? 'REQUIRES_VERIFICATION' : 'AUTHENTICATED',\n      };\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  };\n\n  withCredential = async (params: SignInFormValues): Promise<void> => {\n    try {\n      const { email, password } = params;\n      const userCredential = await signInWithEmailAndPassword(this.auth, email, password);\n      await this.signInWithCredential(userCredential);\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      console.error(authError);\n    }\n  };\n\n  withSocialProvider = async (\n    provider: SupportedProvider,\n    options: SocialProviderOptions = {},\n  ): Promise<SignInResponse> => {\n    try {\n      const { mode = 'popup' } = options;\n      if (mode === 'redirect') {\n        const redirectResult = await this.authRedirectResult();\n\n        if (redirectResult) {\n          return redirectResult;\n        }\n\n        return await this._signInWithRedirect(provider, options);\n      } else {\n        return await this._signInWithPopUp(provider, options);\n      }\n    } catch (error: any) {\n      return {\n        status: 'error',\n        message: error.message || `Sign in with ${provider} failed`,\n        error,\n      };\n    }\n  };\n\n  completeMfaSignIn = async (_mfaToken: string, _mfaContext?: any): Promise<SignInResponse> => {\n    throw new Error('Method not implemented.');\n  };\n\n  sendPasswordResetEmail = async (email: string): Promise<void> => {\n    console.log(`Sending password reset email to ${email}`);\n  };\n\n  resendEmailVerification = async (): Promise<ResendEmailVerification> => {\n    const user = this._currentUser;\n    if (!user) {\n      throw new Error('No user is currently signed in');\n    }\n\n    await user.reload();\n\n    if (user.emailVerified) {\n      return {\n        isVerified: true,\n      };\n    }\n\n    const actionCodeSettings = {\n      url: '/sign-in', // TODO: Make this configurable\n      handleCodeInApp: true,\n    };\n\n    await sendEmailVerification(user, actionCodeSettings);\n    return {\n      isVerified: false,\n    };\n  };\n\n  private getProviderConfig(providerName: SupportedProvider): ProviderConfig {\n    switch (providerName.toLowerCase()) {\n      case 'google': {\n        const googleProvider = new GoogleAuthProvider();\n        return { provider: googleProvider };\n      }\n      case 'apple': {\n        const appleProvider = new OAuthProvider('apple.com');\n        return { provider: appleProvider };\n      }\n      case 'microsoft': {\n        const microsoftProvider = new OAuthProvider('microsoft.com');\n        return { provider: microsoftProvider };\n      }\n      case 'github': {\n        const githubProvider = new OAuthProvider('github.com');\n        return { provider: githubProvider };\n      }\n      case 'twitter': {\n        const twitterProvider = new OAuthProvider('twitter.com');\n        return { provider: twitterProvider };\n      }\n      case 'facebook': {\n        const facebookProvider = new OAuthProvider('facebook.com');\n        return { provider: facebookProvider };\n      }\n      default:\n        throw new Error(`Unsupported provider: ${providerName}`);\n    }\n  }\n\n  private async authRedirectResult(): Promise<SignInResponse | null> {\n    try {\n      const result = await getRedirectResult(this.auth);\n\n      if (result) {\n        const { user, providerId, operationType } = result;\n        return {\n          status: 'success',\n          user,\n          providerId,\n          operationType,\n        };\n      }\n      return null;\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  }\n\n  /**\n   * Sets custom OAuth parameters on the provider if provided by consumer\n   * @param provider - Firebase auth provider instance\n   * @param customParameters - Consumer-provided OAuth parameters\n   */\n  private setProviderCustomParameters(\n    provider: GoogleAuthProvider | OAuthProvider,\n    customParameters?: Record<string, string>,\n  ): void {\n    if (!customParameters || Object.keys(customParameters).length === 0) {\n      return;\n    }\n\n    provider.setCustomParameters(customParameters);\n  }\n\n  /**\n   * Adds OAuth scopes to the provider if provided by consumer\n   * Handles provider-specific scope setting logic\n   * @param provider - Firebase auth provider instance\n   * @param scopes - Array of OAuth scopes to request\n   */\n  private setProviderScopes(provider: GoogleAuthProvider | OAuthProvider, scopes?: string[]): void {\n    if (!scopes || scopes.length === 0) {\n      return;\n    }\n\n    if (provider instanceof GoogleAuthProvider) {\n      // Google provider supports individual scope addition\n      scopes.forEach(scope => {\n        (provider as GoogleAuthProvider).addScope(scope);\n      });\n    } else if (provider instanceof OAuthProvider) {\n      // OAuth providers expect space-separated scope string\n      (provider as OAuthProvider).addScope(scopes.join(' '));\n    }\n  }\n\n  /**\n   * Configures OAuth provider with consumer-provided options\n   * @param provider - Firebase auth provider instance\n   * @param options - Consumer options containing custom parameters and scopes\n   */\n  private configureProvider(\n    provider: GoogleAuthProvider | OAuthProvider,\n    options: SocialProviderOptions,\n  ): void {\n    this.setProviderCustomParameters(provider, options.customParameters);\n    this.setProviderScopes(provider, options.scopes);\n  }\n\n  private executeAuthMethod = async (\n    authMethod: AuthMethodFunction,\n    providerName: SupportedProvider,\n    options: SocialProviderOptions = {},\n  ): Promise<SignInResponse> => {\n    try {\n      const config = this.getProviderConfig(providerName);\n\n      this.configureProvider(config.provider, options);\n\n      const { user, providerId, operationType } = await authMethod(this.auth, config.provider);\n\n      return {\n        status: 'success',\n        message: 'Authentication successful',\n        user,\n        providerId,\n        operationType,\n      };\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  };\n\n  private async _signInWithRedirect(\n    providerName: SupportedProvider,\n    options: SocialProviderOptions = {},\n  ): Promise<SignInResponse> {\n    return this.executeAuthMethod(signInWithRedirect, providerName, options);\n  }\n\n  private async _signInWithPopUp(\n    providerName: SupportedProvider,\n    options: SocialProviderOptions = {},\n  ): Promise<SignInResponse> {\n    return this.executeAuthMethod(signInWithPopup, providerName, options);\n  }\n\n  public async checkRedirectResult(): Promise<SignInResponse | null> {\n    return this.authRedirectResult();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAwC;AAWxC,kBAQO;AAEP,kBAA+B;AAmCxB,MAAM,eAAe,2BAAyC;AAAA,EACnE,WAAW;AAAA,EAEX,SAA8B;AAAA,EACtB;AAAA,EACA;AAAA,EACA,eAAsC;AAAA,EAE9C,YAAY,MAAY,WAA+B;AACrD,UAAM;AACN,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,uBAAuB,OAAO,eAA+B;AAC3D,UAAM,UAAU,MAAM,WAAW,KAAK,WAAW;AACjD,UAAM,SAAS;AAAA,MACb;AAAA,MACA,WAAW,KAAK;AAAA,IAClB;AAEA,WAAO,KAAK,MAAM;AAAA,MAChB,MAAM,KAAK;AAAA,MACX,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA,EAEA,uBAAuB,OAAO,WAAsD;AAClF,QAAI;AACF,YAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,YAAM,EAAE,MAAM,YAAY,cAAc,IAAI,UAAM;AAAA,QAChD,KAAK;AAAA,QACL;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,OAAO,CAAC,KAAK,gBAAgB,0BAA0B;AAAA,MACzD;AAAA,IACF,SAAS,OAAO;AACd,YAAM,gBAAY,uCAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,iBAAiB,OAAO,WAA4C;AAClE,QAAI;AACF,YAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,YAAM,iBAAiB,UAAM,wCAA2B,KAAK,MAAM,OAAO,QAAQ;AAClF,YAAM,KAAK,qBAAqB,cAAc;AAAA,IAChD,SAAS,OAAO;AACd,YAAM,gBAAY,uCAAwB,KAAK;AAC/C,cAAQ,MAAM,SAAS;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,qBAAqB,OACnB,UACA,UAAiC,CAAC,MACN;AAC5B,QAAI;AACF,YAAM,EAAE,OAAO,QAAQ,IAAI;AAC3B,UAAI,SAAS,YAAY;AACvB,cAAM,iBAAiB,MAAM,KAAK,mBAAmB;AAErD,YAAI,gBAAgB;AAClB,iBAAO;AAAA,QACT;AAEA,eAAO,MAAM,KAAK,oBAAoB,UAAU,OAAO;AAAA,MACzD,OAAO;AACL,eAAO,MAAM,KAAK,iBAAiB,UAAU,OAAO;AAAA,MACtD;AAAA,IACF,SAAS,OAAY;AACnB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,MAAM,WAAW,gBAAgB,QAAQ;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAoB,OAAO,WAAmB,gBAA+C;AAC3F,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EAEA,yBAAyB,OAAO,UAAiC;AAC/D,YAAQ,IAAI,mCAAmC,KAAK,EAAE;AAAA,EACxD;AAAA,EAEA,0BAA0B,YAA8C;AACtE,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AAEA,UAAM,KAAK,OAAO;AAElB,QAAI,KAAK,eAAe;AACtB,aAAO;AAAA,QACL,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,qBAAqB;AAAA,MACzB,KAAK;AAAA;AAAA,MACL,iBAAiB;AAAA,IACnB;AAEA,cAAM,mCAAsB,MAAM,kBAAkB;AACpD,WAAO;AAAA,MACL,YAAY;AAAA,IACd;AAAA,EACF;AAAA,EAEQ,kBAAkB,cAAiD;AACzE,YAAQ,aAAa,YAAY,GAAG;AAAA,MAClC,KAAK,UAAU;AACb,cAAM,iBAAiB,IAAI,+BAAmB;AAC9C,eAAO,EAAE,UAAU,eAAe;AAAA,MACpC;AAAA,MACA,KAAK,SAAS;AACZ,cAAM,gBAAgB,IAAI,0BAAc,WAAW;AACnD,eAAO,EAAE,UAAU,cAAc;AAAA,MACnC;AAAA,MACA,KAAK,aAAa;AAChB,cAAM,oBAAoB,IAAI,0BAAc,eAAe;AAC3D,eAAO,EAAE,UAAU,kBAAkB;AAAA,MACvC;AAAA,MACA,KAAK,UAAU;AACb,cAAM,iBAAiB,IAAI,0BAAc,YAAY;AACrD,eAAO,EAAE,UAAU,eAAe;AAAA,MACpC;AAAA,MACA,KAAK,WAAW;AACd,cAAM,kBAAkB,IAAI,0BAAc,aAAa;AACvD,eAAO,EAAE,UAAU,gBAAgB;AAAA,MACrC;AAAA,MACA,KAAK,YAAY;AACf,cAAM,mBAAmB,IAAI,0BAAc,cAAc;AACzD,eAAO,EAAE,UAAU,iBAAiB;AAAA,MACtC;AAAA,MACA;AACE,cAAM,IAAI,MAAM,yBAAyB,YAAY,EAAE;AAAA,IAC3D;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqD;AACjE,QAAI;AACF,YAAM,SAAS,UAAM,+BAAkB,KAAK,IAAI;AAEhD,UAAI,QAAQ;AACV,cAAM,EAAE,MAAM,YAAY,cAAc,IAAI;AAC5C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,gBAAY,uCAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,4BACN,UACA,kBACM;AACN,QAAI,CAAC,oBAAoB,OAAO,KAAK,gBAAgB,EAAE,WAAW,GAAG;AACnE;AAAA,IACF;AAEA,aAAS,oBAAoB,gBAAgB;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAkB,UAA8C,QAAyB;AAC/F,QAAI,CAAC,UAAU,OAAO,WAAW,GAAG;AAClC;AAAA,IACF;AAEA,QAAI,oBAAoB,gCAAoB;AAE1C,aAAO,QAAQ,WAAS;AACtB,QAAC,SAAgC,SAAS,KAAK;AAAA,MACjD,CAAC;AAAA,IACH,WAAW,oBAAoB,2BAAe;AAE5C,MAAC,SAA2B,SAAS,OAAO,KAAK,GAAG,CAAC;AAAA,IACvD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,kBACN,UACA,SACM;AACN,SAAK,4BAA4B,UAAU,QAAQ,gBAAgB;AACnE,SAAK,kBAAkB,UAAU,QAAQ,MAAM;AAAA,EACjD;AAAA,EAEQ,oBAAoB,OAC1B,YACA,cACA,UAAiC,CAAC,MACN;AAC5B,QAAI;AACF,YAAM,SAAS,KAAK,kBAAkB,YAAY;AAElD,WAAK,kBAAkB,OAAO,UAAU,OAAO;AAE/C,YAAM,EAAE,MAAM,YAAY,cAAc,IAAI,MAAM,WAAW,KAAK,MAAM,OAAO,QAAQ;AAEvF,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,YAAM,gBAAY,uCAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,oBACZ,cACA,UAAiC,CAAC,GACT;AACzB,WAAO,KAAK,kBAAkB,gCAAoB,cAAc,OAAO;AAAA,EACzE;AAAA,EAEA,MAAc,iBACZ,cACA,UAAiC,CAAC,GACT;AACzB,WAAO,KAAK,kBAAkB,6BAAiB,cAAc,OAAO;AAAA,EACtE;AAAA,EAEA,MAAa,sBAAsD;AACjE,WAAO,KAAK,mBAAmB;AAAA,EACjC;AACF;","names":[]}

package/dist/cjs/utils/construct.js

@@ -22,19 +22,28 @@ __export(construct_exports, {
   constructFullUrl: () => constructFullUrl,
   getPreviousPath: () => getPreviousPath,
   getValidRedirectUrl: () => getValidRedirectUrl,
+  hasBannedProtocol: () => hasBannedProtocol,
   hasRedirectLoop: () => hasRedirectLoop,
+  isAllowedRedirect: () => isAllowedRedirect,
+  isProblematicUrl: () => isProblematicUrl,
+  isValidUrl: () => isValidUrl,
+  relativeToAbsoluteUrl: () => relativeToAbsoluteUrl,
   storePreviousPath: () => storePreviousPath,
+  stripOrigin: () => stripOrigin,
   toURL: () => toURL,
+  trimTrailingSlash: () => trimTrailingSlash,
   urlWithRedirect: () => urlWithRedirect
 });
 module.exports = __toCommonJS(construct_exports);
 var import_caseUtils = require("@tern-secure/shared/caseUtils");
+var import_globs = require("@tern-secure/shared/globs");
+var import_logger = require("@tern-secure/shared/logger");
 var import_path = require("./path");
 var import_querystring = require("./querystring");
 const DUMMY_URL_BASE = "http://ternsecure-dummy";
+const BANNED_URI_PROTOCOLS = ["javascript:"];
 function buildURL(params, options = {}) {
   const { base, hashPath, hashSearch, searchParams, hashSearchParams, ...rest } = params;
-  const { stringify, skipOrigin } = options;
   let baseFallback = "";
   if (typeof window !== "undefined" && !!window.location) {
     baseFallback = window.location.href;
@@ -45,7 +54,7 @@ function buildURL(params, options = {}) {
   if (searchParams instanceof URLSearchParams) {
     searchParams.forEach((value, key) => {
       if (value !== null && value !== void 0) {
-        url.searchParams.set(key, value);
+        url.searchParams.set((0, import_caseUtils.camelToSnake)(key), value);
       }
     });
   }
@@ -57,8 +66,6 @@ function buildURL(params, options = {}) {
     for (const [key, val] of Object.entries(searchParamsFromHashSearchString)) {
       dummyUrlForHash.searchParams.append(key, val);
     }
-    const finalHashPath = hashPath || "";
-    const queryForHash = new URLSearchParams(hashSearch || "");
     if (hashSearchParams) {
       const paramsArr = Array.isArray(hashSearchParams) ? hashSearchParams : [hashSearchParams];
       for (const _params of paramsArr) {
@@ -78,6 +85,7 @@ function buildURL(params, options = {}) {
       url.hash = newHash;
     }
   }
+  const { stringify, skipOrigin } = options;
   if (stringify) {
     return skipOrigin ? url.href.replace(url.origin, "") : url.href;
   }
@@ -152,15 +160,94 @@ const validateUrl = (url) => {
 function toURL(url) {
   return new URL(url.toString(), window.location.origin);
 }
+function stripOrigin(url) {
+  url = toURL(url);
+  return url.href.replace(url.origin, "");
+}
+const trimTrailingSlash = (path) => {
+  return (path || "").replace(/\/+$/, "");
+};
+function isValidUrl(val) {
+  if (!val) {
+    return false;
+  }
+  try {
+    new URL(val);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function relativeToAbsoluteUrl(url, origin) {
+  try {
+    return new URL(url);
+  } catch {
+    return new URL(url, origin);
+  }
+}
+const disallowedPatterns = [
+  /\0/,
+  // Null bytes
+  /^\/\//,
+  // Protocol-relative
+  // eslint-disable-next-line no-control-regex
+  /[\x00-\x1F]/
+  // Control characters
+];
+function isProblematicUrl(url) {
+  if (hasBannedProtocol(url)) {
+    return true;
+  }
+  for (const pattern of disallowedPatterns) {
+    if (pattern.test(url.pathname)) {
+      return true;
+    }
+  }
+  return false;
+}
+function hasBannedProtocol(val) {
+  if (!isValidUrl(val)) {
+    return false;
+  }
+  const protocol = new URL(val).protocol;
+  return BANNED_URI_PROTOCOLS.some((bp) => bp === protocol);
+}
+const isAllowedRedirect = (allowedRedirectOrigins, currentOrigin) => (_url) => {
+  if (!currentOrigin) return true;
+  let url = _url;
+  if (typeof url === "string") {
+    url = relativeToAbsoluteUrl(url, currentOrigin);
+  }
+  if (!allowedRedirectOrigins) {
+    return true;
+  }
+  const isSameOrigin = currentOrigin === url.origin;
+  const isAllowed = !isProblematicUrl(url) && (isSameOrigin || allowedRedirectOrigins.map(
+    (origin) => typeof origin === "string" ? import_globs.globs.toRegexp(trimTrailingSlash(origin)) : origin
+  ).some((origin) => origin.test(trimTrailingSlash(url.origin))));
+  if (!isAllowed) {
+    import_logger.logger.warnOnce(
+      `Clerk: Redirect URL ${url} is not on one of the allowedRedirectOrigins, falling back to the default redirect URL.`
+    );
+  }
+  return isAllowed;
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   buildURL,
   constructFullUrl,
   getPreviousPath,
   getValidRedirectUrl,
+  hasBannedProtocol,
   hasRedirectLoop,
+  isAllowedRedirect,
+  isProblematicUrl,
+  isValidUrl,
+  relativeToAbsoluteUrl,
   storePreviousPath,
+  stripOrigin,
   toURL,
+  trimTrailingSlash,
   urlWithRedirect
 });
 //# sourceMappingURL=construct.js.map

package/dist/cjs/utils/construct.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/construct.ts"],"sourcesContent":["import { camelToSnake } from '@tern-secure/shared/caseUtils'\n\nimport { joinPaths } from './path';\nimport { getQueryParams } from './querystring';\n\nconst DUMMY_URL_BASE = 'http://ternsecure-dummy';\n\nexport type constructUrlWithRedirectProps = {\n  signInUrl: string;\n  signInPathParam?: string;\n  currentPath: string;\n  signUpUrl?: string;\n  signUpPathParam?: string;\n};\n\ninterface BuildURLParams extends Partial<URL> {\n  base?: string;\n  hashPath?: string;\n  hashSearch?: string;\n  hashSearchParams?:\n    | URLSearchParams\n    | Record<string, string>\n    | Array<URLSearchParams | Record<string, string>>;\n}\n\ninterface BuildURLOptions<T> {\n  skipOrigin?: boolean;\n  stringify?: T;\n}\n\n/**\n *\n * buildURL(params: URLParams, options: BuildURLOptions): string\n *\n * Builds a URL safely by using the native URL() constructor. It can\n * also build a secondary path and search URL that lives inside the hash\n * of the main URL. For example:\n *\n * https://foo.com/bar?qux=42#/hash-bar?hash-qux=42\n *\n * References:\n * https://developer.mozilla.org/en-US/docs/Web/API/URL\n *\n * @param {BuildURLParams} params\n * @param {BuildURLOptions} options\n * @returns {URL | string} Returns the URL href\n */\nexport function buildURL<B extends boolean>(\n  params: BuildURLParams,\n  options?: BuildURLOptions<B>,\n): B extends true ? string : URL;\n\n/**\n * Builds a URL from given parameters, handling search and hash parameters\n * @param params - The parameters to construct the URL\n * @param options - Options for building the URL\n * @returns The constructed URL as a string or URL object\n */\nexport function buildURL(\n  params: BuildURLParams,\n  options: BuildURLOptions<boolean> = {},\n): URL | string {\n  const { base, hashPath, hashSearch, searchParams, hashSearchParams, ...rest } = params;\n  const { stringify, skipOrigin } = options;\n\n  let baseFallback = '';\n  if (typeof window !== 'undefined' && !!window.location) {\n    baseFallback = window.location.href;\n  } else {\n    baseFallback = 'http://react-native-fake-base-url';\n  }\n\n  const url = new URL(base || '', baseFallback);\n\n  // Handle search parameters\n  // params.searchParams comes from Partial<URL>, so it's URLSearchParams | undefined\n  if (searchParams instanceof URLSearchParams) {\n    searchParams.forEach((value, key) => {\n      if (value !== null && value !== undefined) {\n        url.searchParams.set(key, value); //camelToSnake(key), value\n      }\n    });\n  }\n\n  Object.assign(url, rest);\n\n  // Handle hash-related parameters\n  if (hashPath || hashSearch || hashSearchParams) {\n    const dummyUrlForHash = new URL(DUMMY_URL_BASE + url.hash.substring(1));\n\n    dummyUrlForHash.pathname = joinPaths(dummyUrlForHash.pathname, hashPath || '');\n\n    const searchParamsFromHashSearchString = getQueryParams(hashSearch || '');\n\n    for (const [key, val] of Object.entries(searchParamsFromHashSearchString)) {\n      dummyUrlForHash.searchParams.append(key, val);\n    }\n    const finalHashPath = hashPath || '';\n    const queryForHash = new URLSearchParams(hashSearch || '');\n\n    if (hashSearchParams) {\n      const paramsArr = Array.isArray(hashSearchParams) ? hashSearchParams : [hashSearchParams];\n      for (const _params of paramsArr) {\n        if (!(_params instanceof URLSearchParams) && typeof _params !== 'object') {\n          continue;\n        }\n        const params = new URLSearchParams(_params);\n        params.forEach((value, key) => {\n          if (value !== null && value !== undefined) {\n            dummyUrlForHash.searchParams.set(camelToSnake(key), value);\n          }\n        });\n      }\n    }\n\n    const newHash = dummyUrlForHash.href.replace(DUMMY_URL_BASE, '');\n    if (newHash !== '/') {\n      // Assign them to the hash of the main url\n      url.hash = newHash;\n    }\n  }\n\n  if (stringify) {\n    return skipOrigin ? url.href.replace(url.origin, '') : url.href;\n  }\n  return url;\n}\n\n/**\n * Constructs a full URL with the current origin\n * @param path - The path to construct the URL for\n * @returns The full URL with origin\n */\nexport const constructFullUrl = (path: string) => {\n  if (typeof window === 'undefined') return path;\n  const baseUrl = window.location.origin;\n  if (path.startsWith('http')) {\n    return path;\n  }\n  return `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;\n};\n\n/**\n * Checks if the current URL has a redirect loop\n * @param currentPath - The current pathname\n * @param redirectPath - The path we're trying to redirect to\n * @returns boolean indicating if there's a redirect loop\n */\nexport const hasRedirectLoop = (currentPath: string, redirectPath: string): boolean => {\n  if (!currentPath || !redirectPath) return false;\n\n  // Remove any query parameters for comparison\n  const cleanCurrentPath = currentPath.split('?')[0];\n  const cleanRedirectPath = redirectPath.split('?')[0];\n\n  return cleanCurrentPath === cleanRedirectPath;\n};\n\nexport const urlWithRedirect = (options: constructUrlWithRedirectProps): string => {\n  const {\n    signInUrl,\n    signInPathParam = '/sign-in',\n    currentPath,\n    signUpUrl,\n    signUpPathParam = '/sign-up',\n  } = options;\n\n  const baseUrl = window.location.origin;\n\n  if (typeof window === 'undefined') {\n    return signInUrl;\n  }\n\n  const url = new URL(signInUrl, baseUrl);\n\n  if (!currentPath.includes(signInPathParam) && !currentPath.includes(signUpPathParam)) {\n    url.searchParams.set('redirect', currentPath);\n  }\n\n  return url.toString();\n};\n\n/**\n * Stores the current path before signing out\n */\nexport const storePreviousPath = (path: string): void => {\n  if (typeof window !== 'undefined') {\n    sessionStorage.setItem('previousPath', path);\n  }\n};\n\n/**\n * Gets the stored previous path\n */\nexport const getPreviousPath = (): string | null => {\n  if (typeof window !== 'undefined') {\n    return sessionStorage.getItem('previousPath');\n  }\n  return null;\n};\n\n/**\n * Gets a validated redirect URL ensuring it's from the same origin\n * @param redirectUrl - The URL to validate\n * @param searchParams - The search parameters to check for redirect\n * @returns A validated redirect URL\n */\nexport const getValidRedirectUrl = (\n  searchParams: URLSearchParams,\n  configuredRedirect?: string,\n): string => {\n  // Check URL search param first (highest priority)\n  const urlRedirect = searchParams.get('redirect');\n  if (urlRedirect) {\n    return validateUrl(urlRedirect);\n  }\n\n  // Then check configured redirect (for first visits)\n  if (configuredRedirect) {\n    return validateUrl(configuredRedirect);\n  }\n\n  // Default fallback\n  return '/';\n};\n\n/**\n * Validates and sanitizes URLs\n */\nconst validateUrl = (url: string): string => {\n  try {\n    // For absolute URLs\n    if (url.startsWith('http')) {\n      const urlObj = new URL(url);\n      if (typeof window !== 'undefined' && urlObj.origin !== window.location.origin) {\n        return '/';\n      }\n    }\n\n    // For relative URLs\n    return '/';\n  } catch {\n    return '/';\n  }\n};\n\nexport function toURL(url: string | URL): URL {\n  return new URL(url.toString(), window.location.origin);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAA6B;AAE7B,kBAA0B;AAC1B,yBAA+B;AAE/B,MAAM,iBAAiB;AAqDhB,SAAS,SACd,QACA,UAAoC,CAAC,GACvB;AACd,QAAM,EAAE,MAAM,UAAU,YAAY,cAAc,kBAAkB,GAAG,KAAK,IAAI;AAChF,QAAM,EAAE,WAAW,WAAW,IAAI;AAElC,MAAI,eAAe;AACnB,MAAI,OAAO,WAAW,eAAe,CAAC,CAAC,OAAO,UAAU;AACtD,mBAAe,OAAO,SAAS;AAAA,EACjC,OAAO;AACL,mBAAe;AAAA,EACjB;AAEA,QAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,YAAY;AAI5C,MAAI,wBAAwB,iBAAiB;AAC3C,iBAAa,QAAQ,CAAC,OAAO,QAAQ;AACnC,UAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,YAAI,aAAa,IAAI,KAAK,KAAK;AAAA,MACjC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,OAAO,KAAK,IAAI;AAGvB,MAAI,YAAY,cAAc,kBAAkB;AAC9C,UAAM,kBAAkB,IAAI,IAAI,iBAAiB,IAAI,KAAK,UAAU,CAAC,CAAC;AAEtE,oBAAgB,eAAW,uBAAU,gBAAgB,UAAU,YAAY,EAAE;AAE7E,UAAM,uCAAmC,mCAAe,cAAc,EAAE;AAExE,eAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,gCAAgC,GAAG;AACzE,sBAAgB,aAAa,OAAO,KAAK,GAAG;AAAA,IAC9C;AACA,UAAM,gBAAgB,YAAY;AAClC,UAAM,eAAe,IAAI,gBAAgB,cAAc,EAAE;AAEzD,QAAI,kBAAkB;AACpB,YAAM,YAAY,MAAM,QAAQ,gBAAgB,IAAI,mBAAmB,CAAC,gBAAgB;AACxF,iBAAW,WAAW,WAAW;AAC/B,YAAI,EAAE,mBAAmB,oBAAoB,OAAO,YAAY,UAAU;AACxE;AAAA,QACF;AACA,cAAMA,UAAS,IAAI,gBAAgB,OAAO;AAC1C,QAAAA,QAAO,QAAQ,CAAC,OAAO,QAAQ;AAC7B,cAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,4BAAgB,aAAa,QAAI,+BAAa,GAAG,GAAG,KAAK;AAAA,UAC3D;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,UAAU,gBAAgB,KAAK,QAAQ,gBAAgB,EAAE;AAC/D,QAAI,YAAY,KAAK;AAEnB,UAAI,OAAO;AAAA,IACb;AAAA,EACF;AAEA,MAAI,WAAW;AACb,WAAO,aAAa,IAAI,KAAK,QAAQ,IAAI,QAAQ,EAAE,IAAI,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;AAOO,MAAM,mBAAmB,CAAC,SAAiB;AAChD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,SAAO,GAAG,OAAO,GAAG,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI,EAAE;AAC9D;AAQO,MAAM,kBAAkB,CAAC,aAAqB,iBAAkC;AACrF,MAAI,CAAC,eAAe,CAAC,aAAc,QAAO;AAG1C,QAAM,mBAAmB,YAAY,MAAM,GAAG,EAAE,CAAC;AACjD,QAAM,oBAAoB,aAAa,MAAM,GAAG,EAAE,CAAC;AAEnD,SAAO,qBAAqB;AAC9B;AAEO,MAAM,kBAAkB,CAAC,YAAmD;AACjF,QAAM;AAAA,IACJ;AAAA,IACA,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,EACpB,IAAI;AAEJ,QAAM,UAAU,OAAO,SAAS;AAEhC,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,IAAI,IAAI,WAAW,OAAO;AAEtC,MAAI,CAAC,YAAY,SAAS,eAAe,KAAK,CAAC,YAAY,SAAS,eAAe,GAAG;AACpF,QAAI,aAAa,IAAI,YAAY,WAAW;AAAA,EAC9C;AAEA,SAAO,IAAI,SAAS;AACtB;AAKO,MAAM,oBAAoB,CAAC,SAAuB;AACvD,MAAI,OAAO,WAAW,aAAa;AACjC,mBAAe,QAAQ,gBAAgB,IAAI;AAAA,EAC7C;AACF;AAKO,MAAM,kBAAkB,MAAqB;AAClD,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,eAAe,QAAQ,cAAc;AAAA,EAC9C;AACA,SAAO;AACT;AAQO,MAAM,sBAAsB,CACjC,cACA,uBACW;AAEX,QAAM,cAAc,aAAa,IAAI,UAAU;AAC/C,MAAI,aAAa;AACf,WAAO,YAAY,WAAW;AAAA,EAChC;AAGA,MAAI,oBAAoB;AACtB,WAAO,YAAY,kBAAkB;AAAA,EACvC;AAGA,SAAO;AACT;AAKA,MAAM,cAAc,CAAC,QAAwB;AAC3C,MAAI;AAEF,QAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,YAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,UAAI,OAAO,WAAW,eAAe,OAAO,WAAW,OAAO,SAAS,QAAQ;AAC7E,eAAO;AAAA,MACT;AAAA,IACF;AAGA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,MAAM,KAAwB;AAC5C,SAAO,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,SAAS,MAAM;AACvD;","names":["params"]}
+{"version":3,"sources":["../../../src/utils/construct.ts"],"sourcesContent":["import { camelToSnake } from '@tern-secure/shared/caseUtils';\nimport { globs } from '@tern-secure/shared/globs';\nimport { logger } from '@tern-secure/shared/logger';\n\nimport { joinPaths } from './path';\nimport { getQueryParams } from './querystring';\n\nconst DUMMY_URL_BASE = 'http://ternsecure-dummy';\n\nconst BANNED_URI_PROTOCOLS = ['javascript:'] as const;\n\nexport type constructUrlWithRedirectProps = {\n  signInUrl: string;\n  signInPathParam?: string;\n  currentPath: string;\n  signUpUrl?: string;\n  signUpPathParam?: string;\n};\n\ninterface BuildURLParams extends Partial<URL> {\n  base?: string;\n  hashPath?: string;\n  hashSearch?: string;\n  hashSearchParams?:\n    | URLSearchParams\n    | Record<string, string>\n    | Array<URLSearchParams | Record<string, string>>;\n}\n\ninterface BuildURLOptions<T> {\n  skipOrigin?: boolean;\n  stringify?: T;\n}\n\n/**\n *\n * buildURL(params: URLParams, options: BuildURLOptions): string\n *\n * Builds a URL safely by using the native URL() constructor. It can\n * also build a secondary path and search URL that lives inside the hash\n * of the main URL. For example:\n *\n * https://foo.com/bar?qux=42#/hash-bar?hash-qux=42\n *\n * References:\n * https://developer.mozilla.org/en-US/docs/Web/API/URL\n *\n * @param {BuildURLParams} params\n * @param {BuildURLOptions} options\n * @returns {URL | string} Returns the URL href\n */\nexport function buildURL<B extends boolean>(\n  params: BuildURLParams,\n  options?: BuildURLOptions<B>,\n): B extends true ? string : URL;\n\nexport function buildURL(\n  params: BuildURLParams,\n  options: BuildURLOptions<boolean> = {},\n): URL | string {\n  const { base, hashPath, hashSearch, searchParams, hashSearchParams, ...rest } = params;\n\n  let baseFallback = '';\n  if (typeof window !== 'undefined' && !!window.location) {\n    baseFallback = window.location.href;\n  } else {\n    baseFallback = 'http://react-native-fake-base-url';\n  }\n\n  const url = new URL(base || '', baseFallback);\n\n  // Handle search parameters\n  // params.searchParams comes from Partial<URL>, so it's URLSearchParams | undefined\n  if (searchParams instanceof URLSearchParams) {\n    searchParams.forEach((value, key) => {\n      if (value !== null && value !== undefined) {\n        url.searchParams.set(camelToSnake(key), value);\n      }\n    });\n  }\n\n  Object.assign(url, rest);\n\n  // Handle hash-related parameters\n  if (hashPath || hashSearch || hashSearchParams) {\n    const dummyUrlForHash = new URL(DUMMY_URL_BASE + url.hash.substring(1));\n\n    dummyUrlForHash.pathname = joinPaths(dummyUrlForHash.pathname, hashPath || '');\n\n    const searchParamsFromHashSearchString = getQueryParams(hashSearch || '');\n\n    for (const [key, val] of Object.entries(searchParamsFromHashSearchString)) {\n      dummyUrlForHash.searchParams.append(key, val);\n    }\n\n    if (hashSearchParams) {\n      const paramsArr = Array.isArray(hashSearchParams) ? hashSearchParams : [hashSearchParams];\n      for (const _params of paramsArr) {\n        if (!(_params instanceof URLSearchParams) && typeof _params !== 'object') {\n          continue;\n        }\n        const params = new URLSearchParams(_params);\n        params.forEach((value, key) => {\n          if (value !== null && value !== undefined) {\n            dummyUrlForHash.searchParams.set(camelToSnake(key), value);\n          }\n        });\n      }\n    }\n\n    const newHash = dummyUrlForHash.href.replace(DUMMY_URL_BASE, '');\n    if (newHash !== '/') {\n      // Assign them to the hash of the main url\n      url.hash = newHash;\n    }\n  }\n\n  const { stringify, skipOrigin } = options;\n  if (stringify) {\n    return skipOrigin ? url.href.replace(url.origin, '') : url.href;\n  }\n  return url;\n}\n\n/**\n * Constructs a full URL with the current origin\n * @param path - The path to construct the URL for\n * @returns The full URL with origin\n */\nexport const constructFullUrl = (path: string) => {\n  if (typeof window === 'undefined') return path;\n  const baseUrl = window.location.origin;\n  if (path.startsWith('http')) {\n    return path;\n  }\n  return `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;\n};\n\n/**\n * Checks if the current URL has a redirect loop\n * @param currentPath - The current pathname\n * @param redirectPath - The path we're trying to redirect to\n * @returns boolean indicating if there's a redirect loop\n */\nexport const hasRedirectLoop = (currentPath: string, redirectPath: string): boolean => {\n  if (!currentPath || !redirectPath) return false;\n\n  // Remove any query parameters for comparison\n  const cleanCurrentPath = currentPath.split('?')[0];\n  const cleanRedirectPath = redirectPath.split('?')[0];\n\n  return cleanCurrentPath === cleanRedirectPath;\n};\n\nexport const urlWithRedirect = (options: constructUrlWithRedirectProps): string => {\n  const {\n    signInUrl,\n    signInPathParam = '/sign-in',\n    currentPath,\n    signUpUrl,\n    signUpPathParam = '/sign-up',\n  } = options;\n\n  const baseUrl = window.location.origin;\n\n  if (typeof window === 'undefined') {\n    return signInUrl;\n  }\n\n  const url = new URL(signInUrl, baseUrl);\n\n  if (!currentPath.includes(signInPathParam) && !currentPath.includes(signUpPathParam)) {\n    url.searchParams.set('redirect', currentPath);\n  }\n\n  return url.toString();\n};\n\n/**\n * Stores the current path before signing out\n */\nexport const storePreviousPath = (path: string): void => {\n  if (typeof window !== 'undefined') {\n    sessionStorage.setItem('previousPath', path);\n  }\n};\n\n/**\n * Gets the stored previous path\n */\nexport const getPreviousPath = (): string | null => {\n  if (typeof window !== 'undefined') {\n    return sessionStorage.getItem('previousPath');\n  }\n  return null;\n};\n\n/**\n * Gets a validated redirect URL ensuring it's from the same origin\n * @param redirectUrl - The URL to validate\n * @param searchParams - The search parameters to check for redirect\n * @returns A validated redirect URL\n */\nexport const getValidRedirectUrl = (\n  searchParams: URLSearchParams,\n  configuredRedirect?: string,\n): string => {\n  // Check URL search param first (highest priority)\n  const urlRedirect = searchParams.get('redirect');\n  if (urlRedirect) {\n    return validateUrl(urlRedirect);\n  }\n\n  // Then check configured redirect (for first visits)\n  if (configuredRedirect) {\n    return validateUrl(configuredRedirect);\n  }\n\n  // Default fallback\n  return '/';\n};\n\n/**\n * Validates and sanitizes URLs\n */\nconst validateUrl = (url: string): string => {\n  try {\n    // For absolute URLs\n    if (url.startsWith('http')) {\n      const urlObj = new URL(url);\n      if (typeof window !== 'undefined' && urlObj.origin !== window.location.origin) {\n        return '/';\n      }\n    }\n\n    // For relative URLs\n    return '/';\n  } catch {\n    return '/';\n  }\n};\n\nexport function toURL(url: string | URL): URL {\n  return new URL(url.toString(), window.location.origin);\n}\n\n/**\n *\n * stripOrigin(url: URL | string): string\n *\n * Strips the origin part of a URL and preserves path, search and hash is applicable\n *\n * References:\n * https://developer.mozilla.org/en-US/docs/Web/API/URL\n *\n * @param {URL | string} url\n * @returns {string} Returns the URL href without the origin\n */\nexport function stripOrigin(url: URL | string): string {\n  url = toURL(url);\n  return url.href.replace(url.origin, '');\n}\n\n/**\n * trimTrailingSlash(path: string): string\n *\n * Strips the trailing slashes from a string\n *\n * @returns {string} Returns the string without trailing slashes\n * @param path\n */\nexport const trimTrailingSlash = (path: string): string => {\n  return (path || '').replace(/\\/+$/, '');\n};\n\nexport function isValidUrl(val: unknown): val is string {\n  if (!val) {\n    return false;\n  }\n\n  try {\n    new URL(val as string);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function relativeToAbsoluteUrl(url: string, origin: string | URL): URL {\n  try {\n    return new URL(url);\n  } catch {\n    return new URL(url, origin);\n  }\n}\n\n// Regular expression to detect disallowed patterns\nconst disallowedPatterns = [\n  /\\0/, // Null bytes\n  /^\\/\\//, // Protocol-relative\n  // eslint-disable-next-line no-control-regex\n  /[\\x00-\\x1F]/, // Control characters\n];\n\n/**\n * Check for potentially problematic URLs that could have been crafted to intentionally bypass the origin check. Note that the URLs passed to this\n * function are assumed to be from an \"allowed origin\", so we are not executing origin-specific checks here.\n */\nexport function isProblematicUrl(url: URL): boolean {\n  if (hasBannedProtocol(url)) {\n    return true;\n  }\n  // Check against disallowed patterns\n  for (const pattern of disallowedPatterns) {\n    if (pattern.test(url.pathname)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nexport function hasBannedProtocol(val: string | URL) {\n  if (!isValidUrl(val)) {\n    return false;\n  }\n  const protocol = new URL(val).protocol;\n  return BANNED_URI_PROTOCOLS.some(bp => bp === protocol);\n}\n\nexport const isAllowedRedirect =\n  (allowedRedirectOrigins: Array<string | RegExp> | undefined, currentOrigin: string) =>\n  (_url: URL | string) => {\n    // On server-side (no origin), allow all redirects\n    // They will be validated on client-side\n    if (!currentOrigin) return true;\n\n    let url = _url;\n    if (typeof url === 'string') {\n      url = relativeToAbsoluteUrl(url, currentOrigin);\n    }\n\n    if (!allowedRedirectOrigins) {\n      return true;\n    }\n\n    const isSameOrigin = currentOrigin === url.origin;\n\n    const isAllowed =\n      !isProblematicUrl(url) &&\n      (isSameOrigin ||\n        allowedRedirectOrigins\n          .map(origin =>\n            typeof origin === 'string' ? globs.toRegexp(trimTrailingSlash(origin)) : origin,\n          )\n          .some(origin => origin.test(trimTrailingSlash(url.origin))));\n\n    if (!isAllowed) {\n      logger.warnOnce(\n        `Clerk: Redirect URL ${url} is not on one of the allowedRedirectOrigins, falling back to the default redirect URL.`,\n      );\n    }\n    return isAllowed;\n  };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAA6B;AAC7B,mBAAsB;AACtB,oBAAuB;AAEvB,kBAA0B;AAC1B,yBAA+B;AAE/B,MAAM,iBAAiB;AAEvB,MAAM,uBAAuB,CAAC,aAAa;AA+CpC,SAAS,SACd,QACA,UAAoC,CAAC,GACvB;AACd,QAAM,EAAE,MAAM,UAAU,YAAY,cAAc,kBAAkB,GAAG,KAAK,IAAI;AAEhF,MAAI,eAAe;AACnB,MAAI,OAAO,WAAW,eAAe,CAAC,CAAC,OAAO,UAAU;AACtD,mBAAe,OAAO,SAAS;AAAA,EACjC,OAAO;AACL,mBAAe;AAAA,EACjB;AAEA,QAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,YAAY;AAI5C,MAAI,wBAAwB,iBAAiB;AAC3C,iBAAa,QAAQ,CAAC,OAAO,QAAQ;AACnC,UAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,YAAI,aAAa,QAAI,+BAAa,GAAG,GAAG,KAAK;AAAA,MAC/C;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,OAAO,KAAK,IAAI;AAGvB,MAAI,YAAY,cAAc,kBAAkB;AAC9C,UAAM,kBAAkB,IAAI,IAAI,iBAAiB,IAAI,KAAK,UAAU,CAAC,CAAC;AAEtE,oBAAgB,eAAW,uBAAU,gBAAgB,UAAU,YAAY,EAAE;AAE7E,UAAM,uCAAmC,mCAAe,cAAc,EAAE;AAExE,eAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,gCAAgC,GAAG;AACzE,sBAAgB,aAAa,OAAO,KAAK,GAAG;AAAA,IAC9C;AAEA,QAAI,kBAAkB;AACpB,YAAM,YAAY,MAAM,QAAQ,gBAAgB,IAAI,mBAAmB,CAAC,gBAAgB;AACxF,iBAAW,WAAW,WAAW;AAC/B,YAAI,EAAE,mBAAmB,oBAAoB,OAAO,YAAY,UAAU;AACxE;AAAA,QACF;AACA,cAAMA,UAAS,IAAI,gBAAgB,OAAO;AAC1C,QAAAA,QAAO,QAAQ,CAAC,OAAO,QAAQ;AAC7B,cAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,4BAAgB,aAAa,QAAI,+BAAa,GAAG,GAAG,KAAK;AAAA,UAC3D;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,UAAU,gBAAgB,KAAK,QAAQ,gBAAgB,EAAE;AAC/D,QAAI,YAAY,KAAK;AAEnB,UAAI,OAAO;AAAA,IACb;AAAA,EACF;AAEA,QAAM,EAAE,WAAW,WAAW,IAAI;AAClC,MAAI,WAAW;AACb,WAAO,aAAa,IAAI,KAAK,QAAQ,IAAI,QAAQ,EAAE,IAAI,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;AAOO,MAAM,mBAAmB,CAAC,SAAiB;AAChD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,SAAO,GAAG,OAAO,GAAG,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI,EAAE;AAC9D;AAQO,MAAM,kBAAkB,CAAC,aAAqB,iBAAkC;AACrF,MAAI,CAAC,eAAe,CAAC,aAAc,QAAO;AAG1C,QAAM,mBAAmB,YAAY,MAAM,GAAG,EAAE,CAAC;AACjD,QAAM,oBAAoB,aAAa,MAAM,GAAG,EAAE,CAAC;AAEnD,SAAO,qBAAqB;AAC9B;AAEO,MAAM,kBAAkB,CAAC,YAAmD;AACjF,QAAM;AAAA,IACJ;AAAA,IACA,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,EACpB,IAAI;AAEJ,QAAM,UAAU,OAAO,SAAS;AAEhC,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,IAAI,IAAI,WAAW,OAAO;AAEtC,MAAI,CAAC,YAAY,SAAS,eAAe,KAAK,CAAC,YAAY,SAAS,eAAe,GAAG;AACpF,QAAI,aAAa,IAAI,YAAY,WAAW;AAAA,EAC9C;AAEA,SAAO,IAAI,SAAS;AACtB;AAKO,MAAM,oBAAoB,CAAC,SAAuB;AACvD,MAAI,OAAO,WAAW,aAAa;AACjC,mBAAe,QAAQ,gBAAgB,IAAI;AAAA,EAC7C;AACF;AAKO,MAAM,kBAAkB,MAAqB;AAClD,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,eAAe,QAAQ,cAAc;AAAA,EAC9C;AACA,SAAO;AACT;AAQO,MAAM,sBAAsB,CACjC,cACA,uBACW;AAEX,QAAM,cAAc,aAAa,IAAI,UAAU;AAC/C,MAAI,aAAa;AACf,WAAO,YAAY,WAAW;AAAA,EAChC;AAGA,MAAI,oBAAoB;AACtB,WAAO,YAAY,kBAAkB;AAAA,EACvC;AAGA,SAAO;AACT;AAKA,MAAM,cAAc,CAAC,QAAwB;AAC3C,MAAI;AAEF,QAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,YAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,UAAI,OAAO,WAAW,eAAe,OAAO,WAAW,OAAO,SAAS,QAAQ;AAC7E,eAAO;AAAA,MACT;AAAA,IACF;AAGA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,MAAM,KAAwB;AAC5C,SAAO,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,SAAS,MAAM;AACvD;AAcO,SAAS,YAAY,KAA2B;AACrD,QAAM,MAAM,GAAG;AACf,SAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,EAAE;AACxC;AAUO,MAAM,oBAAoB,CAAC,SAAyB;AACzD,UAAQ,QAAQ,IAAI,QAAQ,QAAQ,EAAE;AACxC;AAEO,SAAS,WAAW,KAA6B;AACtD,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AAEA,MAAI;AACF,QAAI,IAAI,GAAa;AACrB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,sBAAsB,KAAa,QAA2B;AAC5E,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO,IAAI,IAAI,KAAK,MAAM;AAAA,EAC5B;AACF;AAGA,MAAM,qBAAqB;AAAA,EACzB;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAEA;AAAA;AACF;AAMO,SAAS,iBAAiB,KAAmB;AAClD,MAAI,kBAAkB,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AAEA,aAAW,WAAW,oBAAoB;AACxC,QAAI,QAAQ,KAAK,IAAI,QAAQ,GAAG;AAC9B,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,kBAAkB,KAAmB;AACnD,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,IAAI,IAAI,GAAG,EAAE;AAC9B,SAAO,qBAAqB,KAAK,QAAM,OAAO,QAAQ;AACxD;AAEO,MAAM,oBACX,CAAC,wBAA4D,kBAC7D,CAAC,SAAuB;AAGtB,MAAI,CAAC,cAAe,QAAO;AAE3B,MAAI,MAAM;AACV,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,sBAAsB,KAAK,aAAa;AAAA,EAChD;AAEA,MAAI,CAAC,wBAAwB;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,kBAAkB,IAAI;AAE3C,QAAM,YACJ,CAAC,iBAAiB,GAAG,MACpB,gBACC,uBACG;AAAA,IAAI,YACH,OAAO,WAAW,WAAW,mBAAM,SAAS,kBAAkB,MAAM,CAAC,IAAI;AAAA,EAC3E,EACC,KAAK,YAAU,OAAO,KAAK,kBAAkB,IAAI,MAAM,CAAC,CAAC;AAEhE,MAAI,CAAC,WAAW;AACd,yBAAO;AAAA,MACL,uBAAuB,GAAG;AAAA,IAC5B;AAAA,EACF;AACA,SAAO;AACT;","names":["params"]}

package/dist/cjs/utils/index.js

@@ -17,9 +17,13 @@ var utils_exports = {};
 module.exports = __toCommonJS(utils_exports);
 __reExport(utils_exports, require("./construct"), module.exports);
 __reExport(utils_exports, require("./querystring"), module.exports);
+__reExport(utils_exports, require("./redirectUrls"), module.exports);
+__reExport(utils_exports, require("./windowNavigate"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ...require("./construct"),
-  ...require("./querystring")
+  ...require("./querystring"),
+  ...require("./redirectUrls"),
+  ...require("./windowNavigate")
 });
 //# sourceMappingURL=index.js.map

package/dist/cjs/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/index.ts"],"sourcesContent":["export * from './construct';\nexport * from './querystring';\n"],"mappings":";;;;;;;;;;;;;;;AAAA;AAAA;AAAA,0BAAc,wBAAd;AACA,0BAAc,0BADd;","names":[]}
+{"version":3,"sources":["../../../src/utils/index.ts"],"sourcesContent":["export * from './construct';\nexport * from './querystring';\nexport * from './redirectUrls';\nexport * from './windowNavigate';\n"],"mappings":";;;;;;;;;;;;;;;AAAA;AAAA;AAAA,0BAAc,wBAAd;AACA,0BAAc,0BADd;AAEA,0BAAc,2BAFd;AAGA,0BAAc,6BAHd;","names":[]}

package/dist/cjs/utils/redirectUrls.js

@@ -0,0 +1,156 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var redirectUrls_exports = {};
+__export(redirectUrls_exports, {
+  RedirectUrls: () => RedirectUrls
+});
+module.exports = __toCommonJS(redirectUrls_exports);
+var import_caseUtils = require("@tern-secure/shared/caseUtils");
+var import_object = require("@tern-secure/shared/object");
+var import_construct = require("./construct");
+class RedirectUrls {
+  static keys = [
+    "signInForceRedirectUrl",
+    "signInFallbackRedirectUrl",
+    "signUpForceRedirectUrl",
+    "signUpFallbackRedirectUrl",
+    "afterSignInUrl",
+    "afterSignUpUrl",
+    "redirectUrl"
+  ];
+  static preserved = ["redirectUrl"];
+  options;
+  fromOptions;
+  fromProps;
+  fromSearchParams;
+  constructor(options, props = {}, searchParams = {}) {
+    this.options = options;
+    this.fromOptions = this.#parse(options || {});
+    this.fromProps = this.#parse(props || {});
+    this.fromSearchParams = this.#parseSearchParams(searchParams || {});
+  }
+  getAfterSignInUrl() {
+    return this.#getRedirectUrl("signIn");
+  }
+  getAfterSignUpUrl() {
+    return this.#getRedirectUrl("signUp");
+  }
+  getPreservedSearchParams() {
+    return this.#toSearchParams(this.#flattenPreserved());
+  }
+  toSearchParams() {
+    return this.#toSearchParams(this.#flattenAll());
+  }
+  #toSearchParams(obj) {
+    const camelCased = Object.fromEntries(
+      Object.entries(obj).map(([key, value]) => [(0, import_caseUtils.camelToSnake)(key), value])
+    );
+    return new URLSearchParams((0, import_object.removeUndefined)(camelCased));
+  }
+  #flattenPreserved() {
+    return Object.fromEntries(
+      Object.entries({ ...this.fromSearchParams }).filter(
+        ([key]) => RedirectUrls.preserved.includes(key)
+      )
+    );
+  }
+  #flattenAll() {
+    const signUpForceRedirectUrl = this.fromSearchParams.signUpForceRedirectUrl || this.fromProps.signUpForceRedirectUrl || this.fromOptions.signUpForceRedirectUrl;
+    const signUpFallbackRedirectUrl = this.fromSearchParams.signUpFallbackRedirectUrl || this.fromProps.signUpFallbackRedirectUrl || this.fromOptions.signUpFallbackRedirectUrl;
+    const signInForceRedirectUrl = this.fromSearchParams.signInForceRedirectUrl || this.fromProps.signInForceRedirectUrl || this.fromOptions.signInForceRedirectUrl;
+    const signInFallbackRedirectUrl = this.fromSearchParams.signInFallbackRedirectUrl || this.fromProps.signInFallbackRedirectUrl || this.fromOptions.signInFallbackRedirectUrl;
+    const afterSignInUrl = this.fromSearchParams.afterSignInUrl || this.fromProps.afterSignInUrl || this.fromOptions.afterSignInUrl;
+    const afterSignUpUrl = this.fromSearchParams.afterSignUpUrl || this.fromProps.afterSignUpUrl || this.fromOptions.afterSignUpUrl;
+    const redirectUrl = this.fromSearchParams.redirectUrl || this.fromProps.redirectUrl || this.fromOptions.redirectUrl;
+    const res = {
+      signUpForceRedirectUrl,
+      signUpFallbackRedirectUrl,
+      signInForceRedirectUrl,
+      signInFallbackRedirectUrl,
+      afterSignInUrl,
+      afterSignUpUrl,
+      redirectUrl
+    };
+    return res;
+  }
+  #getRedirectUrl(prefix) {
+    const forceKey = `${prefix}ForceRedirectUrl`;
+    const fallbackKey = `${prefix}FallbackRedirectUrl`;
+    let newKeyInUse;
+    let result;
+    result = this.fromSearchParams[forceKey] || this.fromProps[forceKey] || this.fromOptions[forceKey];
+    if (result) {
+      newKeyInUse = forceKey;
+    }
+    result ||= this.fromSearchParams.redirectUrl;
+    if (result) {
+      newKeyInUse = "redirectUrl";
+    }
+    result ||= this.fromSearchParams[fallbackKey] || this.fromProps[fallbackKey] || this.fromOptions[fallbackKey];
+    if (result) {
+      newKeyInUse = fallbackKey;
+    }
+    if (!result) {
+      if (typeof window === "undefined") {
+        return "/";
+      }
+      return window.location.href;
+    }
+    return result || "/";
+  }
+  #parse(obj) {
+    const res = {};
+    RedirectUrls.keys.forEach((key) => {
+      res[key] = obj[key];
+    });
+    return (0, import_object.applyFunctionToObj)(
+      this.#filterRedirects(this.#toAbsoluteUrls((0, import_object.filterProps)(res, Boolean))),
+      (val) => val.toString()
+    );
+  }
+  #parseSearchParams(obj) {
+    const res = {};
+    RedirectUrls.keys.forEach((key) => {
+      if (obj instanceof URLSearchParams) {
+        res[key] = obj.get((0, import_caseUtils.camelToSnake)(key));
+      } else {
+        res[key] = obj[(0, import_caseUtils.camelToSnake)(key)];
+      }
+    });
+    return (0, import_object.applyFunctionToObj)(
+      this.#filterRedirects(this.#toAbsoluteUrls((0, import_object.filterProps)(res, Boolean))),
+      (val) => val.toString()
+    );
+  }
+  #toAbsoluteUrls(obj) {
+    const origin = typeof window !== "undefined" ? window.location.origin : "";
+    if (!origin) return obj;
+    return (0, import_object.applyFunctionToObj)(obj, (url) => (0, import_construct.relativeToAbsoluteUrl)(url, origin));
+  }
+  #filterRedirects = (obj) => {
+    var _a;
+    const origin = typeof window !== "undefined" ? window.location.origin : "";
+    return (0, import_object.filterProps)(obj, (0, import_construct.isAllowedRedirect)((_a = this.options) == null ? void 0 : _a.allowedRedirectOrigins, origin));
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RedirectUrls
+});
+//# sourceMappingURL=redirectUrls.js.map

package/dist/cjs/utils/redirectUrls.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/redirectUrls.ts"],"sourcesContent":["import { camelToSnake } from '@tern-secure/shared/caseUtils';\nimport { applyFunctionToObj, filterProps, removeUndefined } from '@tern-secure/shared/object';\nimport type { RedirectOptions, TernSecureAuthOptions } from '@tern-secure/types';\n\nimport { isAllowedRedirect, relativeToAbsoluteUrl } from './construct';\n\n/**\n * RedirectUrls class handles all redirect URL construction logic\n * for sign-in, sign-up, and post-authentication flows.\n *\n * This class centralizes the redirect logic previously scattered across\n * multiple methods, making it reusable and maintainable.\n */\nexport class RedirectUrls {\n  private static keys: (keyof RedirectOptions)[] = [\n    'signInForceRedirectUrl',\n    'signInFallbackRedirectUrl',\n    'signUpForceRedirectUrl',\n    'signUpFallbackRedirectUrl',\n    'afterSignInUrl',\n    'afterSignUpUrl',\n    'redirectUrl',\n  ];\n\n  private static preserved = ['redirectUrl'];\n\n  private readonly options: TernSecureAuthOptions;\n  private readonly fromOptions: RedirectOptions;\n  private readonly fromProps: RedirectOptions;\n  private readonly fromSearchParams: RedirectOptions & { redirectUrl?: string | null };\n\n  constructor(options: TernSecureAuthOptions, props: RedirectOptions = {}, searchParams: any = {}) {\n    this.options = options;\n    this.fromOptions = this.#parse(options || {});\n    this.fromProps = this.#parse(props || {});\n    this.fromSearchParams = this.#parseSearchParams(searchParams || {});\n  }\n\n  getAfterSignInUrl() {\n    return this.#getRedirectUrl('signIn');\n  }\n\n  getAfterSignUpUrl() {\n    return this.#getRedirectUrl('signUp');\n  }\n\n  getPreservedSearchParams() {\n    return this.#toSearchParams(this.#flattenPreserved());\n  }\n\n  toSearchParams() {\n    return this.#toSearchParams(this.#flattenAll());\n  }\n\n  #toSearchParams(obj: Record<string, string | undefined | null>): URLSearchParams {\n    const camelCased = Object.fromEntries(\n      Object.entries(obj).map(([key, value]) => [camelToSnake(key), value]),\n    );\n    return new URLSearchParams(removeUndefined(camelCased) as Record<string, string>);\n  }\n\n  #flattenPreserved() {\n    return Object.fromEntries(\n      Object.entries({ ...this.fromSearchParams }).filter(([key]) =>\n        RedirectUrls.preserved.includes(key),\n      ),\n    );\n  }\n\n  #flattenAll() {\n    const signUpForceRedirectUrl =\n      this.fromSearchParams.signUpForceRedirectUrl ||\n      this.fromProps.signUpForceRedirectUrl ||\n      this.fromOptions.signUpForceRedirectUrl;\n    const signUpFallbackRedirectUrl =\n      this.fromSearchParams.signUpFallbackRedirectUrl ||\n      this.fromProps.signUpFallbackRedirectUrl ||\n      this.fromOptions.signUpFallbackRedirectUrl;\n    const signInForceRedirectUrl =\n      this.fromSearchParams.signInForceRedirectUrl ||\n      this.fromProps.signInForceRedirectUrl ||\n      this.fromOptions.signInForceRedirectUrl;\n    const signInFallbackRedirectUrl =\n      this.fromSearchParams.signInFallbackRedirectUrl ||\n      this.fromProps.signInFallbackRedirectUrl ||\n      this.fromOptions.signInFallbackRedirectUrl;\n    const afterSignInUrl =\n      this.fromSearchParams.afterSignInUrl ||\n      this.fromProps.afterSignInUrl ||\n      this.fromOptions.afterSignInUrl;\n    const afterSignUpUrl =\n      this.fromSearchParams.afterSignUpUrl ||\n      this.fromProps.afterSignUpUrl ||\n      this.fromOptions.afterSignUpUrl;\n    const redirectUrl =\n      this.fromSearchParams.redirectUrl ||\n      this.fromProps.redirectUrl ||\n      this.fromOptions.redirectUrl;\n\n    const res: RedirectOptions = {\n      signUpForceRedirectUrl,\n      signUpFallbackRedirectUrl,\n      signInForceRedirectUrl,\n      signInFallbackRedirectUrl,\n      afterSignInUrl,\n      afterSignUpUrl,\n      redirectUrl,\n    };\n    return res;\n  }\n\n  #getRedirectUrl(prefix: 'signIn' | 'signUp') {\n    const forceKey = `${prefix}ForceRedirectUrl` as const;\n    const fallbackKey = `${prefix}FallbackRedirectUrl` as const;\n\n    let newKeyInUse: string | undefined;\n\n    let result;\n    // Prioritize forceRedirectUrl\n    result =\n      this.fromSearchParams[forceKey] || this.fromProps[forceKey] || this.fromOptions[forceKey];\n    if (result) {\n      newKeyInUse = forceKey;\n    }\n\n    // Try to get redirect_url, only allowed as a search param\n    result ||= this.fromSearchParams.redirectUrl;\n    if (result) {\n      newKeyInUse = 'redirectUrl';\n    }\n\n    // Otherwise, fallback to fallbackRedirectUrl\n    result ||=\n      this.fromSearchParams[fallbackKey] ||\n      this.fromProps[fallbackKey] ||\n      this.fromOptions[fallbackKey];\n    if (result) {\n      newKeyInUse = fallbackKey;\n    }\n\n    if (!result) {\n      if (typeof window === 'undefined') {\n        return '/';\n      }\n      return window.location.href;\n    }\n    return result || '/';\n  }\n\n  #parse(obj: unknown) {\n    const res = {} as RedirectOptions;\n    RedirectUrls.keys.forEach(key => {\n      // @ts-expect-error\n      res[key] = obj[key];\n    });\n\n    //const absoluteUrls = this.#toAbsoluteUrls(filterProps(res, Boolean));\n    //const filtered = this.#filterRedirects(absoluteUrls);\n    //return applyFunctionToObj(filtered, val => val.toString());\n\n    return applyFunctionToObj(\n      this.#filterRedirects(this.#toAbsoluteUrls(filterProps(res, Boolean))),\n      val => val.toString(),\n    );\n  }\n\n  #parseSearchParams(obj: any) {\n    const res = {} as typeof this.fromSearchParams;\n    RedirectUrls.keys.forEach(key => {\n      if (obj instanceof URLSearchParams) {\n        res[key] = obj.get(camelToSnake(key));\n      } else {\n        res[key] = obj[camelToSnake(key)];\n      }\n    });\n\n    return applyFunctionToObj(\n      this.#filterRedirects(this.#toAbsoluteUrls(filterProps(res, Boolean))),\n      val => val.toString(),\n    );\n  }\n\n  #toAbsoluteUrls(obj: RedirectOptions) {\n    const origin = typeof window !== 'undefined' ? window.location.origin : '';\n    // If no origin (server-side), return URLs as-is without conversion\n    // They will be properly converted on the client-side\n    if (!origin) return obj;\n\n    return applyFunctionToObj(obj, (url: string) => relativeToAbsoluteUrl(url, origin));\n  }\n\n  #filterRedirects = (obj: RedirectOptions) => {\n    const origin = typeof window !== 'undefined' ? window.location.origin : '';\n    return filterProps(obj, isAllowedRedirect(this.options?.allowedRedirectOrigins, origin));\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAA6B;AAC7B,oBAAiE;AAGjE,uBAAyD;AASlD,MAAM,aAAa;AAAA,EACxB,OAAe,OAAkC;AAAA,IAC/C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAe,YAAY,CAAC,aAAa;AAAA,EAExB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAgC,QAAyB,CAAC,GAAG,eAAoB,CAAC,GAAG;AAC/F,SAAK,UAAU;AACf,SAAK,cAAc,KAAK,OAAO,WAAW,CAAC,CAAC;AAC5C,SAAK,YAAY,KAAK,OAAO,SAAS,CAAC,CAAC;AACxC,SAAK,mBAAmB,KAAK,mBAAmB,gBAAgB,CAAC,CAAC;AAAA,EACpE;AAAA,EAEA,oBAAoB;AAClB,WAAO,KAAK,gBAAgB,QAAQ;AAAA,EACtC;AAAA,EAEA,oBAAoB;AAClB,WAAO,KAAK,gBAAgB,QAAQ;AAAA,EACtC;AAAA,EAEA,2BAA2B;AACzB,WAAO,KAAK,gBAAgB,KAAK,kBAAkB,CAAC;AAAA,EACtD;AAAA,EAEA,iBAAiB;AACf,WAAO,KAAK,gBAAgB,KAAK,YAAY,CAAC;AAAA,EAChD;AAAA,EAEA,gBAAgB,KAAiE;AAC/E,UAAM,aAAa,OAAO;AAAA,MACxB,OAAO,QAAQ,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,KAAC,+BAAa,GAAG,GAAG,KAAK,CAAC;AAAA,IACtE;AACA,WAAO,IAAI,oBAAgB,+BAAgB,UAAU,CAA2B;AAAA,EAClF;AAAA,EAEA,oBAAoB;AAClB,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,EAAE,GAAG,KAAK,iBAAiB,CAAC,EAAE;AAAA,QAAO,CAAC,CAAC,GAAG,MACvD,aAAa,UAAU,SAAS,GAAG;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,cAAc;AACZ,UAAM,yBACJ,KAAK,iBAAiB,0BACtB,KAAK,UAAU,0BACf,KAAK,YAAY;AACnB,UAAM,4BACJ,KAAK,iBAAiB,6BACtB,KAAK,UAAU,6BACf,KAAK,YAAY;AACnB,UAAM,yBACJ,KAAK,iBAAiB,0BACtB,KAAK,UAAU,0BACf,KAAK,YAAY;AACnB,UAAM,4BACJ,KAAK,iBAAiB,6BACtB,KAAK,UAAU,6BACf,KAAK,YAAY;AACnB,UAAM,iBACJ,KAAK,iBAAiB,kBACtB,KAAK,UAAU,kBACf,KAAK,YAAY;AACnB,UAAM,iBACJ,KAAK,iBAAiB,kBACtB,KAAK,UAAU,kBACf,KAAK,YAAY;AACnB,UAAM,cACJ,KAAK,iBAAiB,eACtB,KAAK,UAAU,eACf,KAAK,YAAY;AAEnB,UAAM,MAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,QAA6B;AAC3C,UAAM,WAAW,GAAG,MAAM;AAC1B,UAAM,cAAc,GAAG,MAAM;AAE7B,QAAI;AAEJ,QAAI;AAEJ,aACE,KAAK,iBAAiB,QAAQ,KAAK,KAAK,UAAU,QAAQ,KAAK,KAAK,YAAY,QAAQ;AAC1F,QAAI,QAAQ;AACV,oBAAc;AAAA,IAChB;AAGA,eAAW,KAAK,iBAAiB;AACjC,QAAI,QAAQ;AACV,oBAAc;AAAA,IAChB;AAGA,eACE,KAAK,iBAAiB,WAAW,KACjC,KAAK,UAAU,WAAW,KAC1B,KAAK,YAAY,WAAW;AAC9B,QAAI,QAAQ;AACV,oBAAc;AAAA,IAChB;AAEA,QAAI,CAAC,QAAQ;AACX,UAAI,OAAO,WAAW,aAAa;AACjC,eAAO;AAAA,MACT;AACA,aAAO,OAAO,SAAS;AAAA,IACzB;AACA,WAAO,UAAU;AAAA,EACnB;AAAA,EAEA,OAAO,KAAc;AACnB,UAAM,MAAM,CAAC;AACb,iBAAa,KAAK,QAAQ,SAAO;AAE/B,UAAI,GAAG,IAAI,IAAI,GAAG;AAAA,IACpB,CAAC;AAMD,eAAO;AAAA,MACL,KAAK,iBAAiB,KAAK,oBAAgB,2BAAY,KAAK,OAAO,CAAC,CAAC;AAAA,MACrE,SAAO,IAAI,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,mBAAmB,KAAU;AAC3B,UAAM,MAAM,CAAC;AACb,iBAAa,KAAK,QAAQ,SAAO;AAC/B,UAAI,eAAe,iBAAiB;AAClC,YAAI,GAAG,IAAI,IAAI,QAAI,+BAAa,GAAG,CAAC;AAAA,MACtC,OAAO;AACL,YAAI,GAAG,IAAI,QAAI,+BAAa,GAAG,CAAC;AAAA,MAClC;AAAA,IACF,CAAC;AAED,eAAO;AAAA,MACL,KAAK,iBAAiB,KAAK,oBAAgB,2BAAY,KAAK,OAAO,CAAC,CAAC;AAAA,MACrE,SAAO,IAAI,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,gBAAgB,KAAsB;AACpC,UAAM,SAAS,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS;AAGxE,QAAI,CAAC,OAAQ,QAAO;AAEpB,eAAO,kCAAmB,KAAK,CAAC,YAAgB,wCAAsB,KAAK,MAAM,CAAC;AAAA,EACpF;AAAA,EAEA,mBAAmB,CAAC,QAAyB;AA/L/C;AAgMI,UAAM,SAAS,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS;AACxE,eAAO,2BAAY,SAAK,qCAAkB,UAAK,YAAL,mBAAc,wBAAwB,MAAM,CAAC;AAAA,EACzF;AACF;","names":[]}