tauri-plugin-better-auth 0.0.0-stage → 0.1.0

package/dist/index-DYZxnm2f.d.ts

@@ -0,0 +1,292 @@
+import "zod";
+import { User } from "better-auth";
+//#region src/types.d.ts
+/** Options of the {@link tauri} server plugin. */
+interface TauriOptions {
+  /**
+   * Identifies the desktop app. Must match the Rust plugin and the hand-off
+   * page client.
+   *
+   * @default "tauri"
+   */
+  clientID?: string | undefined;
+  /**
+   * Seconds an authorization code stays valid. Codes are single-use.
+   *
+   * @default 300
+   */
+  codeExpiresIn?: number | undefined;
+  /**
+   * Origins allowed to call `POST /tauri/authorize`, normally just the origin
+   * of your hand-off page. When unset, any origin Better Auth trusts may call
+   * it, which widens the attack surface to every trusted site.
+   */
+  authorizeOrigins?: string[] | undefined;
+  /**
+   * Rate limit for both `/tauri/*` endpoints, per client IP. Better Auth only
+   * enforces rate limits when its own `rateLimit` is enabled (by default in
+   * production). Pass `false` to rely on your global rules instead.
+   *
+   * @default { window: 60, max: 10 }
+   */
+  rateLimit?: {
+    window: number;
+    max: number;
+  } | false | undefined;
+}
+/** Fully resolved options, exposed as `plugin.options`. */
+interface ResolvedTauriOptions {
+  clientID: string;
+  codeExpiresIn: number;
+  authorizeOrigins: string[] | undefined;
+  rateLimit: {
+    window: number;
+    max: number;
+  } | false;
+}
+//#endregion
+//#region src/error-codes.d.ts
+/**
+ * Error codes returned by the `/tauri/*` endpoints. Stable within protocol v1:
+ * the Rust plugin and apps switch on `code`, never on `message`.
+ */
+declare const TAURI_ERROR_CODES: {
+  INVALID_CLIENT_ID: import("better-auth").RawError<"INVALID_CLIENT_ID">;
+  INVALID_CODE_CHALLENGE: import("better-auth").RawError<"INVALID_CODE_CHALLENGE">;
+  INVALID_CODE_VERIFIER: import("better-auth").RawError<"INVALID_CODE_VERIFIER">;
+  INVALID_OR_EXPIRED_CODE: import("better-auth").RawError<"INVALID_OR_EXPIRED_CODE">;
+  INVALID_STATE: import("better-auth").RawError<"INVALID_STATE">;
+  ORIGIN_NOT_ALLOWED: import("better-auth").RawError<"ORIGIN_NOT_ALLOWED">;
+  PKCE_VERIFICATION_FAILED: import("better-auth").RawError<"PKCE_VERIFICATION_FAILED">;
+  SESSION_REJECTED: import("better-auth").RawError<"SESSION_REJECTED">;
+  STATE_MISMATCH: import("better-auth").RawError<"STATE_MISMATCH">;
+  USER_NOT_FOUND: import("better-auth").RawError<"USER_NOT_FOUND">;
+};
+//#endregion
+//#region src/protocol.d.ts
+/**
+ * Wire protocol v1, shared by the server plugin, the web hand-off client and
+ * the Rust plugin. Documented in PROTOCOL.md. Within v1, changes are additive
+ * only: installed desktop apps lag behind servers and must keep working.
+ *
+ * This module has no runtime dependencies so every entry point can import it.
+ */
+/** Protocol version sent as `v` on the sign-in URL and returned by `/tauri/token`. */
+declare const PROTOCOL_VERSION = 1;
+/** Thrown when a configuration value breaks a protocol rule. */
+declare class TauriConfigError extends Error {
+  name: string;
+}
+/** Returns true for a custom URI scheme the app can register. */
+declare function isValidScheme(scheme: string): boolean;
+/**
+ * Returns true when `uri` is a loopback redirect the hand-off page may follow:
+ * exactly `http://127.0.0.1:<port><callbackPath>` or
+ * `http://[::1]:<port><callbackPath>`, with no userinfo, query or fragment.
+ *
+ * Anything else is rejected so that a crafted sign-in link cannot send an
+ * authorization code to a remote server (RFC 8252 §7.3, §8.3).
+ */
+declare function isLoopbackRedirectUri(uri: string, callbackPath: string): boolean;
+/** Where the hand-off page sends the browser after authorizing. */
+type CallbackTarget = {
+  kind: 'scheme';
+  scheme: string;
+  callbackPath: string;
+} | {
+  kind: 'loopback';
+  redirectUri: string;
+};
+//#endregion
+//#region src/routes.d.ts
+/** Response body of `POST /tauri/token`. */
+interface TauriTokenResponse {
+  /** Session token, used as `Authorization: Bearer` by the app. */
+  token: string;
+  /** The signed-in user, filtered by `parseUserOutput`. */
+  user: User & Record<string, unknown>;
+  /** Wire protocol version (see PROTOCOL.md). */
+  protocol: typeof PROTOCOL_VERSION;
+}
+//#endregion
+//#region src/version.d.ts
+/**
+ * Package version. Released in lockstep with the Rust crate; CI fails when this
+ * constant, `package.json` and `Cargo.toml` disagree.
+ */
+declare const VERSION = "0.1.0";
+//#endregion
+//#region src/index.d.ts
+/** What `init` needs from Better Auth's context. */
+interface InitContext {
+  hasPlugin(pluginId: string): boolean;
+  logger: {
+    warn(message: string, ...args: unknown[]): void;
+  };
+}
+/**
+ * Better Auth server plugin for Tauri desktop apps.
+ *
+ * Adds two endpoints:
+ * - `POST /tauri/authorize`: called by your hand-off web page for the signed-in
+ *   user; returns a single-use code bound to the app's PKCE challenge.
+ * - `POST /tauri/token`: called by the app's Rust plugin; exchanges the code
+ *   and PKCE verifier for a new session created in the app's own request.
+ *
+ * Pair it with the `bearer()` plugin: the app authenticates with
+ * `Authorization: Bearer`, never with cookies.
+ *
+ * @example
+ * ```ts
+ * import { betterAuth } from 'better-auth';
+ * import { bearer } from 'better-auth/plugins';
+ * import { tauri } from 'tauri-plugin-better-auth';
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     bearer(),
+ *     tauri({ clientID: 'com.example.app', authorizeOrigins: ['https://example.com'] }),
+ *   ],
+ * });
+ * ```
+ */
+declare const tauri: (options?: TauriOptions) => {
+  id: "tauri";
+  version: string;
+  init(ctx: InitContext): void;
+  endpoints: {
+    tauriAuthorize: import("better-call").StrictEndpoint<"/tauri/authorize", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        client_id: import("zod").ZodString;
+        state: import("zod").ZodString;
+        code_challenge: import("zod").ZodString;
+        code_challenge_method: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>;
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      allowedMediaTypes: string[];
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                'application/json': {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      code: {
+                        type: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      code: string;
+    }>;
+    tauriToken: import("better-call").StrictEndpoint<"/tauri/token", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        client_id: import("zod").ZodString;
+        code: import("zod").ZodString;
+        state: import("zod").ZodString;
+        code_verifier: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+      allowedMediaTypes: string[];
+      metadata: {
+        scope: "http";
+        noStore: boolean;
+        openapi: {
+          operationId: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                'application/json': {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      token: {
+                        type: string;
+                      };
+                      user: {
+                        $ref: string;
+                      };
+                      protocol: {
+                        type: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      token: string;
+      user: import("better-auth").User & Record<string, unknown>;
+      protocol: 1;
+    }>;
+  };
+  rateLimit: {
+    window: number;
+    max: number;
+    pathMatcher: (path: string) => boolean;
+  }[] | undefined;
+  options: ResolvedTauriOptions;
+  $ERROR_CODES: {
+    INVALID_CLIENT_ID: import("better-auth").RawError<"INVALID_CLIENT_ID">;
+    INVALID_CODE_CHALLENGE: import("better-auth").RawError<"INVALID_CODE_CHALLENGE">;
+    INVALID_CODE_VERIFIER: import("better-auth").RawError<"INVALID_CODE_VERIFIER">;
+    INVALID_OR_EXPIRED_CODE: import("better-auth").RawError<"INVALID_OR_EXPIRED_CODE">;
+    INVALID_STATE: import("better-auth").RawError<"INVALID_STATE">;
+    ORIGIN_NOT_ALLOWED: import("better-auth").RawError<"ORIGIN_NOT_ALLOWED">;
+    PKCE_VERIFICATION_FAILED: import("better-auth").RawError<"PKCE_VERIFICATION_FAILED">;
+    SESSION_REJECTED: import("better-auth").RawError<"SESSION_REJECTED">;
+    STATE_MISMATCH: import("better-auth").RawError<"STATE_MISMATCH">;
+    USER_NOT_FOUND: import("better-auth").RawError<"USER_NOT_FOUND">;
+  };
+};
+declare module '@better-auth/core' {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    tauri: {
+      creator: typeof tauri;
+    };
+  }
+}
+//#endregion
+export { PROTOCOL_VERSION as a, isValidScheme as c, TauriOptions as d, CallbackTarget as i, TAURI_ERROR_CODES as l, VERSION as n, TauriConfigError as o, TauriTokenResponse as r, isLoopbackRedirectUri as s, tauri as t, ResolvedTauriOptions as u };

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+import { a as PROTOCOL_VERSION, c as isValidScheme, d as TauriOptions, l as TAURI_ERROR_CODES, n as VERSION, o as TauriConfigError, r as TauriTokenResponse, s as isLoopbackRedirectUri, t as tauri, u as ResolvedTauriOptions } from "./index-DYZxnm2f.js";
+export { PROTOCOL_VERSION, type ResolvedTauriOptions, TAURI_ERROR_CODES, TauriConfigError, type TauriOptions, type TauriTokenResponse, VERSION, isLoopbackRedirectUri, isValidScheme, tauri };

package/dist/index.js

@@ -0,0 +1,235 @@
+import { a as CODE_VERIFIER_PATTERN, c as PROTOCOL_VERSION, d as TauriConfigError, f as assertClientId, g as isValidScheme, h as isLoopbackRedirectUri, i as CODE_PATTERN, n as CODE_CHALLENGE_PATTERN, r as CODE_IDENTIFIER_PREFIX, u as STATE_PATTERN } from "./protocol-Fcr7NzIh.js";
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+import { APIError } from "@better-auth/core/error";
+import { createAuthEndpoint, sensitiveSessionMiddleware } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { constantTimeEqual, generateRandomString } from "better-auth/crypto";
+import { parseUserOutput } from "better-auth/db";
+import { generateCodeChallenge } from "better-auth/oauth2";
+import * as z from "zod";
+//#region src/error-codes.ts
+/**
+* Error codes returned by the `/tauri/*` endpoints. Stable within protocol v1:
+* the Rust plugin and apps switch on `code`, never on `message`.
+*/
+const TAURI_ERROR_CODES = defineErrorCodes({
+	INVALID_CLIENT_ID: "Unknown client id",
+	ORIGIN_NOT_ALLOWED: "This origin may not authorize a desktop sign-in",
+	INVALID_STATE: "Invalid state parameter",
+	INVALID_CODE_CHALLENGE: "Invalid PKCE code challenge (S256 required)",
+	INVALID_CODE_VERIFIER: "Invalid PKCE code verifier",
+	INVALID_OR_EXPIRED_CODE: "Invalid or expired authorization code",
+	STATE_MISMATCH: "State does not match the authorization request",
+	PKCE_VERIFICATION_FAILED: "PKCE verification failed",
+	USER_NOT_FOUND: "The user for this authorization no longer exists",
+	SESSION_REJECTED: "The server rejected the new session"
+});
+//#endregion
+//#region src/routes.ts
+const authorizeBody = z.object({
+	client_id: z.string().max(64),
+	state: z.string().max(256),
+	code_challenge: z.string().max(256),
+	code_challenge_method: z.string().max(16).optional()
+});
+const tokenBody = z.object({
+	client_id: z.string().max(64),
+	code: z.string().max(256),
+	state: z.string().max(256),
+	code_verifier: z.string().max(256)
+});
+/** What `/tauri/authorize` stores under `tauri:<code>`. */
+const storedGrant = z.object({
+	userId: z.string().min(1),
+	clientId: z.string().min(1),
+	codeChallenge: z.string().regex(CODE_CHALLENGE_PATTERN),
+	state: z.string().regex(STATE_PATTERN)
+});
+function parseStoredGrant(value) {
+	try {
+		return storedGrant.safeParse(JSON.parse(value));
+	} catch {
+		return null;
+	}
+}
+const createAuthorizeEndpoint = (opts) => createAuthEndpoint("/tauri/authorize", {
+	method: "POST",
+	body: authorizeBody,
+	use: [sensitiveSessionMiddleware],
+	allowedMediaTypes: ["application/json"],
+	metadata: {
+		noStore: true,
+		openapi: {
+			operationId: "tauriAuthorize",
+			description: "Mint a single-use code that hands the signed-in user's sign-in to a Tauri app. Called by the hand-off page after the user consents.",
+			responses: { 200: {
+				description: "A single-use authorization code",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: { code: { type: "string" } },
+					required: ["code"]
+				} } }
+			} }
+		}
+	}
+}, async (ctx) => {
+	if (opts.authorizeOrigins && ctx.request) {
+		const origin = ctx.request.headers.get("origin");
+		if (!origin || !opts.authorizeOrigins.includes(origin)) throw APIError.from("FORBIDDEN", TAURI_ERROR_CODES.ORIGIN_NOT_ALLOWED);
+	}
+	const { client_id, state, code_challenge, code_challenge_method } = ctx.body;
+	if (client_id !== opts.clientID) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_CLIENT_ID);
+	if (!STATE_PATTERN.test(state)) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_STATE);
+	if (!CODE_CHALLENGE_PATTERN.test(code_challenge) || code_challenge_method !== void 0 && code_challenge_method !== "S256") throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_CODE_CHALLENGE);
+	const code = generateRandomString(32, "a-z", "A-Z", "0-9");
+	await ctx.context.internalAdapter.createVerificationValue({
+		identifier: `${CODE_IDENTIFIER_PREFIX}${code}`,
+		value: JSON.stringify({
+			userId: ctx.context.session.user.id,
+			clientId: client_id,
+			codeChallenge: code_challenge,
+			state
+		}),
+		expiresAt: new Date(Date.now() + opts.codeExpiresIn * 1e3)
+	});
+	return ctx.json({ code });
+});
+const createTokenEndpoint = (opts) => createAuthEndpoint("/tauri/token", {
+	method: "POST",
+	body: tokenBody,
+	allowedMediaTypes: ["application/json"],
+	metadata: {
+		scope: "http",
+		noStore: true,
+		openapi: {
+			operationId: "tauriToken",
+			description: "Exchange a single-use authorization code and PKCE verifier for a new session. Called by the Tauri app, never by a browser.",
+			responses: { 200: {
+				description: "The new session token and the user",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						token: { type: "string" },
+						user: { $ref: "#/components/schemas/User" },
+						protocol: { type: "number" }
+					},
+					required: [
+						"token",
+						"user",
+						"protocol"
+					]
+				} } }
+			} }
+		}
+	}
+}, async (ctx) => {
+	const { client_id, code, state, code_verifier } = ctx.body;
+	if (client_id !== opts.clientID) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_CLIENT_ID);
+	if (!CODE_PATTERN.test(code)) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_OR_EXPIRED_CODE);
+	if (!STATE_PATTERN.test(state)) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_STATE);
+	if (!CODE_VERIFIER_PATTERN.test(code_verifier)) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_CODE_VERIFIER);
+	const record = await ctx.context.internalAdapter.consumeVerificationValue(`${CODE_IDENTIFIER_PREFIX}${code}`);
+	if (!record) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_OR_EXPIRED_CODE);
+	const grant = parseStoredGrant(record.value);
+	if (!grant?.success) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_OR_EXPIRED_CODE);
+	if (!constantTimeEqual(grant.data.clientId, client_id)) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.INVALID_CLIENT_ID);
+	if (!constantTimeEqual(grant.data.state, state)) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.STATE_MISMATCH);
+	const challenge = await generateCodeChallenge(code_verifier);
+	if (!constantTimeEqual(challenge, grant.data.codeChallenge)) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.PKCE_VERIFICATION_FAILED);
+	const user = await ctx.context.internalAdapter.findUserById(grant.data.userId);
+	if (!user) throw APIError.from("BAD_REQUEST", TAURI_ERROR_CODES.USER_NOT_FOUND);
+	const session = await ctx.context.internalAdapter.createSession(user.id);
+	if (!session) throw APIError.from("FORBIDDEN", TAURI_ERROR_CODES.SESSION_REJECTED);
+	await setSessionCookie(ctx, {
+		session,
+		user
+	});
+	return ctx.json({
+		token: session.token,
+		user: parseUserOutput(ctx.context.options, user),
+		protocol: 1
+	});
+});
+//#endregion
+//#region src/version.ts
+/**
+* Package version. Released in lockstep with the Rust crate; CI fails when this
+* constant, `package.json` and `Cargo.toml` disagree.
+*/
+const VERSION = "0.1.0";
+//#endregion
+//#region src/index.ts
+function resolveOptions(options = {}) {
+	const clientID = assertClientId(options.clientID ?? "tauri");
+	const codeExpiresIn = options.codeExpiresIn ?? 300;
+	if (!Number.isInteger(codeExpiresIn) || codeExpiresIn < 30 || codeExpiresIn > 3600) throw new TauriConfigError(`codeExpiresIn must be a whole number of seconds between 30 and 3600, got ${codeExpiresIn}.`);
+	return {
+		clientID,
+		codeExpiresIn,
+		authorizeOrigins: options.authorizeOrigins?.map((origin) => {
+			let parsed;
+			try {
+				parsed = new URL(origin);
+			} catch {
+				throw new TauriConfigError(`authorizeOrigins entry "${origin}" is not a valid URL origin.`);
+			}
+			if (parsed.origin === "null" || parsed.origin !== origin.replace(/\/$/, "")) throw new TauriConfigError(`authorizeOrigins entry "${origin}" must be a bare origin such as "https://example.com".`);
+			return parsed.origin;
+		}),
+		rateLimit: options.rateLimit ?? {
+			window: 60,
+			max: 10
+		}
+	};
+}
+/**
+* Better Auth server plugin for Tauri desktop apps.
+*
+* Adds two endpoints:
+* - `POST /tauri/authorize`: called by your hand-off web page for the signed-in
+*   user; returns a single-use code bound to the app's PKCE challenge.
+* - `POST /tauri/token`: called by the app's Rust plugin; exchanges the code
+*   and PKCE verifier for a new session created in the app's own request.
+*
+* Pair it with the `bearer()` plugin: the app authenticates with
+* `Authorization: Bearer`, never with cookies.
+*
+* @example
+* ```ts
+* import { betterAuth } from 'better-auth';
+* import { bearer } from 'better-auth/plugins';
+* import { tauri } from 'tauri-plugin-better-auth';
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     bearer(),
+*     tauri({ clientID: 'com.example.app', authorizeOrigins: ['https://example.com'] }),
+*   ],
+* });
+* ```
+*/
+const tauri = (options) => {
+	const opts = resolveOptions(options);
+	const endpoints = {
+		tauriAuthorize: createAuthorizeEndpoint(opts),
+		tauriToken: createTokenEndpoint(opts)
+	};
+	const isTauriPath = (path) => path === "/tauri/authorize" || path === "/tauri/token";
+	return {
+		id: "tauri",
+		version: VERSION,
+		init(ctx) {
+			if (!ctx.hasPlugin("bearer")) ctx.logger.warn("[tauri-plugin-better-auth] The bearer() plugin is not registered. Tauri apps authenticate with \"Authorization: Bearer\"; add bearer() from \"better-auth/plugins\" to your plugins.");
+		},
+		endpoints,
+		rateLimit: opts.rateLimit === false ? void 0 : [{
+			window: opts.rateLimit.window,
+			max: opts.rateLimit.max,
+			pathMatcher: isTauriPath
+		}],
+		options: opts,
+		$ERROR_CODES: TAURI_ERROR_CODES
+	};
+};
+//#endregion
+export { PROTOCOL_VERSION, TAURI_ERROR_CODES, TauriConfigError, VERSION, isLoopbackRedirectUri, isValidScheme, tauri };

package/dist/protocol-Fcr7NzIh.js

@@ -0,0 +1,111 @@
+//#region src/protocol.ts
+/**
+* Wire protocol v1, shared by the server plugin, the web hand-off client and
+* the Rust plugin. Documented in PROTOCOL.md. Within v1, changes are additive
+* only: installed desktop apps lag behind servers and must keep working.
+*
+* This module has no runtime dependencies so every entry point can import it.
+*/
+/** Protocol version sent as `v` on the sign-in URL and returned by `/tauri/token`. */
+const PROTOCOL_VERSION = 1;
+/** Default client id when none is configured. */
+const DEFAULT_CLIENT_ID = "tauri";
+/** Default path of the app callback (`<scheme>://auth/callback`). */
+const DEFAULT_CALLBACK_PATH = "/auth/callback";
+/** Prefix of the verification identifier that stores an authorization code. */
+const CODE_IDENTIFIER_PREFIX = "tauri:";
+/** OAuth `state`: 16–128 unreserved characters (RFC 3986). */
+const STATE_PATTERN = /^[A-Za-z0-9._~-]{16,128}$/;
+/** PKCE S256 challenge: base64url of a SHA-256 digest, no padding. */
+const CODE_CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+/** PKCE verifier: 43–128 unreserved characters (RFC 7636 §4.1). */
+const CODE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+/** Authorization code minted by `/tauri/authorize`. */
+const CODE_PATTERN = /^[A-Za-z0-9]{32}$/;
+/** Client id shared by the server, the hand-off page and the app. */
+const CLIENT_ID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+/** Social provider id forwarded from the app to the hand-off page. */
+const PROVIDER_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const SCHEME_PATTERN = /^[a-z][a-z0-9+.-]{1,62}$/;
+const CALLBACK_PATH_PATTERN = /^\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*$/;
+/**
+* Schemes that must never be used for the app callback: they are either
+* web schemes, browser-internal, or Tauri's own.
+*/
+const RESERVED_SCHEMES = /* @__PURE__ */ new Set([
+	"about",
+	"asset",
+	"blob",
+	"data",
+	"file",
+	"ftp",
+	"http",
+	"https",
+	"ipc",
+	"javascript",
+	"mailto",
+	"tauri",
+	"ws",
+	"wss"
+]);
+/** Thrown when a configuration value breaks a protocol rule. */
+var TauriConfigError = class extends Error {
+	name = "TauriConfigError";
+};
+/** Returns true for a custom URI scheme the app can register. */
+function isValidScheme(scheme) {
+	return SCHEME_PATTERN.test(scheme) && !RESERVED_SCHEMES.has(scheme);
+}
+/** Validates a scheme, throwing {@link TauriConfigError} with the reason. */
+function assertScheme(scheme) {
+	if (!isValidScheme(scheme)) throw new TauriConfigError(`Invalid callback scheme "${scheme}". Use a lowercase custom scheme such as "com.example.app" (RFC 8252 §7.1); web and Tauri schemes are not allowed.`);
+	return scheme;
+}
+/** Normalizes and validates the callback path (`/auth/callback`). */
+function normalizeCallbackPath(path) {
+	const normalized = path.startsWith("/") ? path : `/${path}`;
+	if (!CALLBACK_PATH_PATTERN.test(normalized) || normalized.length > 64) throw new TauriConfigError(`Invalid callback path "${path}". Use 1–64 characters of letters, digits, "_", "-" and "/" segments, like "/auth/callback".`);
+	return normalized;
+}
+/** Validates a client id, throwing {@link TauriConfigError} with the reason. */
+function assertClientId(clientId) {
+	if (!CLIENT_ID_PATTERN.test(clientId)) throw new TauriConfigError(`Invalid client id "${clientId}". Use 1–64 characters of letters, digits, ".", "_" and "-".`);
+	return clientId;
+}
+/**
+* Returns true when `uri` is a loopback redirect the hand-off page may follow:
+* exactly `http://127.0.0.1:<port><callbackPath>` or
+* `http://[::1]:<port><callbackPath>`, with no userinfo, query or fragment.
+*
+* Anything else is rejected so that a crafted sign-in link cannot send an
+* authorization code to a remote server (RFC 8252 §7.3, §8.3).
+*/
+function isLoopbackRedirectUri(uri, callbackPath) {
+	if (!uri.startsWith("http://127.0.0.1:") && !uri.startsWith("http://[::1]:")) return false;
+	let url;
+	try {
+		url = new URL(uri);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:") return false;
+	if (url.username !== "" || url.password !== "") return false;
+	if (url.search !== "" || url.hash !== "") return false;
+	if (uri.includes("?") || uri.includes("#")) return false;
+	if (url.hostname !== "127.0.0.1" && url.hostname !== "[::1]") return false;
+	if (url.port === "") return false;
+	const port = Number(url.port);
+	if (!Number.isInteger(port) || port < 1024 || port > 65535) return false;
+	return url.pathname === callbackPath;
+}
+/**
+* Builds the URL the browser opens to hand the result back to the app:
+* `<scheme>://auth/callback?code=…&state=…` or the loopback redirect URI.
+*/
+function buildCallbackUrl(target, params) {
+	const search = new URLSearchParams(params).toString();
+	if (target.kind === "loopback") return `${target.redirectUri}?${search}`;
+	return `${target.scheme}://${target.callbackPath.slice(1)}?${search}`;
+}
+//#endregion
+export { normalizeCallbackPath as _, CODE_VERIFIER_PATTERN as a, PROTOCOL_VERSION as c, TauriConfigError as d, assertClientId as f, isValidScheme as g, isLoopbackRedirectUri as h, CODE_PATTERN as i, PROVIDER_PATTERN as l, buildCallbackUrl as m, CODE_CHALLENGE_PATTERN as n, DEFAULT_CALLBACK_PATH as o, assertScheme as p, CODE_IDENTIFIER_PREFIX as r, DEFAULT_CLIENT_ID as s, CLIENT_ID_PATTERN as t, STATE_PATTERN as u };