@clerk/eslint-plugin 0.0.1 → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clerk, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,263 @@
+<p align="center">
+  <a href="https://clerk.com?utm_source=github&utm_medium=clerk_eslint_plugin" target="_blank" rel="noopener noreferrer">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://images.clerk.com/static/logo-dark-mode-400x400.png">
+      <img src="https://images.clerk.com/static/logo-light-mode-400x400.png" height="64">
+    </picture>
+  </a>
+  <br />
+</p>
+
+# @clerk/eslint-plugin
+
+<div align="center">
+
+[![Chat on Discord](https://img.shields.io/discord/856971667393609759.svg?logo=discord)](https://clerk.com/discord)
+[![Clerk documentation](https://img.shields.io/badge/documentation-clerk-green.svg)](https://clerk.com/docs?utm_source=github&utm_medium=clerk_eslint_plugin)
+[![Follow on X](https://img.shields.io/twitter/follow/clerk?style=social)](https://x.com/intent/follow?screen_name=clerk)
+
+[Changelog](https://github.com/clerk/javascript/blob/main/packages/eslint-plugin/CHANGELOG.md)
+·
+[Report a Bug](https://github.com/clerk/javascript/issues/new?assignees=&labels=needs-triage&projects=&template=BUG_REPORT.yml)
+·
+[Request a Feature](https://feedback.clerk.com/roadmap)
+·
+[Get help](https://clerk.com/contact/support?utm_source=github&utm_medium=clerk_eslint_plugin)
+
+</div>
+
+## Overview
+
+> [!NOTE]
+> This lint rule is experimental, but should already be working well.
+>
+> We encourage trying it out and getting in touch with us about your experience.
+>
+> If you try it out, pin your version as we might do breaking changes in minors before v1.
+
+ESLint rules to help with Clerk patterns across JavaScript frameworks.
+
+Currently includes a Next.js App Router rule to help enforce protecting resources where they are used. Instead of relying on a proxy matcher, you declare which folders are protected and the `require-auth-protection` rule flags any `page`, `layout`, `template`, `default`, `route`, or Server Function under those folders that doesn't guard itself.
+
+Client components are not checked by the rule. These can only get privileged access through other protected resources, or via external API calls which are assumed to be separately protected.
+
+The rule only detects protected or not, which corresponds to signed in/signed out. You are still responsible for making sure the checks are _correct_ and that the user has the correct permissions to access the resource.
+
+> The config **declares intent for tooling — it does not guard anything at runtime.** Protection only happens when each resource calls `await auth.protect()` (or an equivalent check). This rule verifies that it does.
+
+## Installation
+
+```sh
+npm install --save-dev @clerk/eslint-plugin
+```
+
+Requires ESLint `>=9` (flat config), and also works with Oxlint when configured as a `jsPlugin`.
+
+## Usage
+
+Register the plugin and declare your protected/public folder globs in `eslint.config.mjs`:
+
+```js
+import clerkNext from '@clerk/eslint-plugin/next';
+
+export default [
+  {
+    plugins: { '@clerk/next': clerkNext },
+    rules: {
+      '@clerk/next/require-auth-protection': [
+        'error',
+        {
+          protected: ['app/**'],
+          public: ['app/sign-in/**', 'app/sign-up/**'],
+        },
+      ],
+    },
+  },
+];
+```
+
+This rule also works with Oxlint, you can configure the `rules` just like above after adding the plugin as a `jsPlugin` in `.oxlintrc.json`:
+
+```json
+"jsPlugins": [
+  {
+    "name": "@clerk/next",
+    "specifier": "@clerk/eslint-plugin/next"
+  }
+]
+```
+
+Note that the bulk auto-fixer described further down does require `eslint` to be installed.
+
+## Options
+
+| Option              | Type                  | Default  | Description                                                                                                                                                                                              |
+| ------------------- | --------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `protected`         | `string[]` (required) | —        | Folder globs whose resources must be guarded.                                                                                                                                                            |
+| `public`            | `string[]`            | `[]`     | Folder globs that are exempt.                                                                                                                                                                            |
+| `resources`         | `object`              | all true | Resource groups to check. Supports `routeHandlers`, `serverFunctions`, and `serverComponentEntrypoints`, each as an optional boolean.                                                                    |
+| `mixedScopeLayouts` | `'auto' \| string[]`  | `'auto'` | Layouts/templates that intentionally wrap both protected and public descendants. `'auto'` allows them silently; a list requires each such folder to be acknowledged explicitly.                          |
+| `rootDir`           | `string`              | _(auto)_ | Directory folder globs are resolved against. Defaults to the nearest ancestor `eslint.config.*`, then ESLint `cwd`. Set to `import.meta.dirname` in your config file when auto-discovery is unavailable. |
+
+Globs use a minimal dialect — only `*` (single segment) and `**` (any depth). When a folder matches both `protected` and `public`, the most specific pattern wins, and `protected` wins ties.
+
+Use `resources` to disable whole resource groups when a project only wants this rule to enforce protection for some App Router resources:
+
+```js
+{
+  protected: ['app/**'],
+  resources: {
+    routeHandlers: true,
+    serverFunctions: true,
+    serverComponentEntrypoints: false,
+  },
+}
+```
+
+We recommend leaving all as true, but switching some off can be useful during incremental migrations. This configuration also scopes suggestions and bulk-fix tooling: disabled resource groups are not reported by the rule, so they will not receive editor quick-fixes or bulk-applied fixes.
+
+## What counts as protected
+
+The rule is satisfied when the relevant function guards itself at the top, either by calling `auth.protect()`:
+
+```ts
+import { auth } from '@clerk/nextjs/server';
+
+export default async function Page() {
+  await auth.protect();
+  // A protect call with a more narrow role or permissions check also works:
+  await auth.protect({ role: 'org:admin' });
+
+  // ...
+}
+```
+
+…or by an early-exit check derived from `auth()` that returns, throws, or redirects signed-out users (via Next.js navigation helpers or Clerk's `redirectToSignIn()` / `redirectToSignUp()` from `auth()`):
+
+```ts
+import { auth } from '@clerk/nextjs/server';
+
+export default async function Page() {
+  const { isAuthenticated, redirectToSignIn } = await auth();
+  if (!isAuthenticated) redirectToSignIn();
+  // ...
+}
+```
+
+General protection must happen at the top of the function, but additional narrowing auth checks can happen further down.
+
+## Suggestions
+
+For each unprotected resource it flags, the rule offers an editor quick-fix suggestion that inserts `await auth.protect()` at the top of the function (making it `async` and adding the `import { auth } from '@clerk/nextjs/server'` import if needed). Suggestions are opt-in: they appear in your editor's quick-fix menu and are not applied by `eslint --fix`, since adding a protection check changes runtime behavior.
+
+## Bulk auto-fixing
+
+> [!WARNING]
+> Applying these fixes changes the runtime behavior of your application — `await auth.protect()` enforces authentication where there potentially was none, or might override custom auth checks that were already in place. Always review the changes and test your application afterwards.
+
+Because the protection insertion is a suggestion rather than an autofix, `eslint --fix` deliberately won't apply it. To apply it across many files at once, use the bundled command, which lints with your existing ESLint config (so your protected/public globs are honored) and applies the suggestion to every resource it can safely fix:
+
+```sh
+# Fix everything under the current directory
+npx clerk-next-fix-auth-protection
+
+# Preview without writing
+npx clerk-next-fix-auth-protection --dry-run
+
+# Scope fixes to a specific pattern, this will still
+# use protected/public from your ESLint config, but
+# can be useful to only fix a subset of your application
+npx clerk-next-fix-auth-protection "app/**"
+```
+
+Resources the rule can't safely fix on its own (imported/wrapped exports, unacknowledged mixed-scope layouts) are listed as needing manual attention, and the command exits non-zero when any remain (or when `--dry-run` would make changes).
+
+The same logic is available programmatically:
+
+```ts
+import { fixAuthProtection } from '@clerk/eslint-plugin/next/fix-auth-protection';
+
+const { fixed, unresolved } = await fixAuthProtection({
+  patterns: ['app/**'],
+  dryRun: false,
+});
+```
+
+## Implementation details
+
+This section describes the exact details of how the lint rule works. You normally do not need to read or understand this if you only want to use the rule.
+
+Within folders that are configured as protected (and that eslint covers), this rule checks these resources when their resource group is enabled:
+
+- No files with `'use client'` at the top - Early bailout for these
+- `serverComponentEntrypoints`: the default export of `page`, `layout`, `template`, and `default` files
+- `routeHandlers`: all http verb exports of `route` files (`GET`, `POST` etc - API endpoints)
+- `serverFunctions`: all exports of files with `'use server'` at the top, and all inline functions that have `'use server'` at the top of the function
+
+Notably, it does not:
+
+- Check `loading` or `error` files
+  - These normally don't use privileged resources, but if yours do, make sure you protect them
+- Check arbitrary Server Components
+  - Only the different page entrypoints listed above are checked
+  - If you are importing a Server Component doing privileged access into a non-protected page, like an admin panel on an otherwise public page, it should be guarded but the lint rule does not detect this
+
+At the top of the relevant async function, after any directives or TypeScript-only declarations, to count as protected the rule accepts these patterns:
+
+```tsx
+// -- Using the default .protect() behavior --
+await auth.protect()
+await (await auth()).protect()
+// Any kind of variable declaration is okay
+const { userId } = await auth.protect();
+// More narrow checks are also fine
+await auth.protect({ role: 'org:admin' })
+
+// -- Custom handling --
+const { isAuthenticated, userId, sessionId, redirectToSignIn, redirectToSignUp } = await auth();
+// Any of these checks are okay
+// Note: For useAuth() on the client !userId can also mean
+// "loading", but here it's fine
+if (
+  !userId || userId == null || userId === null ||
+  !sessionId || sessionId == null || sessionId === null ||
+  !isAuthenticated
+) {
+  // It is fine to have arbitrary code here:
+  console.log('Unauthenticated');
+  // To count as protected, the function needs to have an
+  // unconditional "exit" at the top level, these count:
+  return;
+  throw;
+  // Matched by callee identifier name (imports are not traced):
+  redirect();
+  permanentRedirect();
+  notFound();
+  unauthorized();
+  forbidden();
+  redirectToSignIn();
+  redirectToSignUp();
+}
+```
+
+## Support
+
+For help, visit our [support page](https://clerk.com/contact/support?utm_source=github&utm_medium=clerk_eslint_plugin).
+
+## Contributing
+
+We're open to all community contributions! Please read [our contribution guidelines](https://github.com/clerk/javascript/blob/main/docs/CONTRIBUTING.md) and [code of conduct](https://github.com/clerk/javascript/blob/main/docs/CODE_OF_CONDUCT.md).
+
+## Security
+
+`@clerk/eslint-plugin` is a static analysis aid, not a runtime guard. It's provided to _help_ you catch missing protections and it does error on the side of caution, but there are no guarantees it will catch everything, there might be edge cases it does not catch.
+
+We aim to fix bugs leading to false negatives promptly, but they are not considered vulnerabilities and will not lead to us posting advisories. You are free to file lint rule bugs via normal [GitHub issues](https://github.com/clerk/javascript/issues/new?assignees=&labels=needs-triage&projects=&template=BUG_REPORT.yml).
+
+_For more information and to report what you think is a security issue, please refer to our [security documentation](https://github.com/clerk/javascript/blob/main/docs/SECURITY.md)._
+
+## License
+
+This project is licensed under the **MIT license**.
+
+See [LICENSE](https://github.com/clerk/javascript/blob/main/packages/eslint-plugin/LICENSE) for more information.

package/dist/chunk-C_NdSu1c.js

@@ -0,0 +1,34 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") {
+		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+			key = keys[i];
+			if (!__hasOwnProp.call(to, key) && key !== except) {
+				__defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+		}
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+
+Object.defineProperty(exports, '__toESM', {
+  enumerable: true,
+  get: function () {
+    return __toESM;
+  }
+});

package/dist/next/fix-auth-protection-cli.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/next/fix-auth-protection-cli.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/next/fix-auth-protection-cli.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+const require_chunk = require('../chunk-C_NdSu1c.js');
+const require_next_fix_auth_protection = require('./fix-auth-protection.js');
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
+let node_util = require("node:util");
+
+//#region src/next/fix-auth-protection-cli.ts
+function relative(filePath) {
+	return node_path.default.relative(process.cwd(), filePath) || filePath;
+}
+const HELP = `clerk-next-fix-auth-protection
+
+Apply the @clerk/eslint-plugin \`require-auth-protection\` rule's
+\`await auth.protect()\` suggestions across your project. Uses your existing
+ESLint config (so the protected/public folder globs are honored).
+
+Usage
+  clerk-next-fix-auth-protection [patterns...] [options]
+
+Arguments
+  patterns            Files, directories, or globs to scan (default: ".")
+
+Options
+  --dry-run           Report what would change without writing any files
+  -h, --help          Show this help
+
+Examples
+  clerk-next-fix-auth-protection
+  clerk-next-fix-auth-protection "app/**" --dry-run
+`;
+function pluralize(count, noun) {
+	return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+async function main() {
+	const { values, positionals } = (0, node_util.parseArgs)({
+		allowPositionals: true,
+		options: {
+			"dry-run": { type: "boolean" },
+			help: {
+				type: "boolean",
+				short: "h"
+			}
+		}
+	});
+	if (values.help) {
+		console.log(HELP);
+		return 0;
+	}
+	const patterns = positionals.length > 0 ? positionals : ["."];
+	const dryRun = Boolean(values["dry-run"]);
+	const verb = dryRun ? "Would protect" : "Protected";
+	console.log(`Scanning: ${patterns.join(", ")}`);
+	const { fixed, unresolved } = await require_next_fix_auth_protection.fixAuthProtection({
+		patterns,
+		dryRun,
+		onConfigResolved(configFile) {
+			console.log(`Config:   ${configFile ? relative(configFile) : "(resolved by ESLint from the working directory)"}`);
+			console.log("");
+			console.log("Scanning for unprotected resources…");
+			console.log("This lints your whole project, so it can take a while on large codebases.");
+		},
+		onScanComplete(fileCount) {
+			if (fileCount === 0) return;
+			console.log("");
+			console.log(`Found ${pluralize(fileCount, "file")} to update. ${dryRun ? "Previewing" : "Applying"} fixes…`);
+		},
+		onFileFixed(file) {
+			console.log(`  ${verb} ${relative(file.filePath)} (${pluralize(file.protections, "resource")})`);
+		}
+	});
+	if (fixed.length === 0 && unresolved.length === 0) {
+		console.log("");
+		console.log("No unprotected resources found. Nothing to do.");
+		return 0;
+	}
+	if (unresolved.length > 0) {
+		console.log("");
+		console.log("Needs manual attention (no safe automatic fix):");
+		for (const file of unresolved) for (const issue of file.issues) console.log(`  ${relative(file.filePath)}:${issue.line}:${issue.column} ${issue.message}`);
+	}
+	const totalProtections = fixed.reduce((sum, file) => sum + file.protections, 0);
+	console.log("");
+	console.log(`${verb} ${pluralize(totalProtections, "resource")} across ${pluralize(fixed.length, "file")}.` + (dryRun ? " Run without --dry-run to apply." : ""));
+	if (fixed.length > 0) {
+		console.log("");
+		console.log("Warning: Adding `await auth.protect()` changes your application’s runtime behavior — it enforces");
+		console.log("authentication where there potentially was none, or might override custom auth checks that were");
+		console.log("already in place. Always review the changes and test your application.");
+	}
+	return unresolved.length > 0 || dryRun && fixed.length > 0 ? 1 : 0;
+}
+main().then((code) => {
+	process.exitCode = code;
+}).catch((error) => {
+	console.error(error instanceof Error ? error.message : error);
+	process.exitCode = 1;
+});
+
+//#endregion
+//# sourceMappingURL=fix-auth-protection-cli.js.map

package/dist/next/fix-auth-protection-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-auth-protection-cli.js","names":["path","fixAuthProtection"],"sources":["../../src/next/fix-auth-protection-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport path from 'node:path';\nimport { parseArgs } from 'node:util';\n\nimport { fixAuthProtection } from './fix-auth-protection';\n\nfunction relative(filePath: string): string {\n  return path.relative(process.cwd(), filePath) || filePath;\n}\n\nconst HELP = `clerk-next-fix-auth-protection\n\nApply the @clerk/eslint-plugin \\`require-auth-protection\\` rule's\n\\`await auth.protect()\\` suggestions across your project. Uses your existing\nESLint config (so the protected/public folder globs are honored).\n\nUsage\n  clerk-next-fix-auth-protection [patterns...] [options]\n\nArguments\n  patterns            Files, directories, or globs to scan (default: \".\")\n\nOptions\n  --dry-run           Report what would change without writing any files\n  -h, --help          Show this help\n\nExamples\n  clerk-next-fix-auth-protection\n  clerk-next-fix-auth-protection \"app/**\" --dry-run\n`;\n\nfunction pluralize(count: number, noun: string): string {\n  return `${count} ${noun}${count === 1 ? '' : 's'}`;\n}\n\nasync function main(): Promise<number> {\n  const { values, positionals } = parseArgs({\n    allowPositionals: true,\n    options: {\n      'dry-run': { type: 'boolean' },\n      help: { type: 'boolean', short: 'h' },\n    },\n  });\n\n  if (values.help) {\n    console.log(HELP);\n    return 0;\n  }\n\n  const patterns = positionals.length > 0 ? positionals : ['.'];\n  const dryRun = Boolean(values['dry-run']);\n  const verb = dryRun ? 'Would protect' : 'Protected';\n\n  console.log(`Scanning: ${patterns.join(', ')}`);\n\n  const { fixed, unresolved } = await fixAuthProtection({\n    patterns,\n    dryRun,\n    onConfigResolved(configFile) {\n      console.log(`Config:   ${configFile ? relative(configFile) : '(resolved by ESLint from the working directory)'}`);\n      console.log('');\n      console.log('Scanning for unprotected resources…');\n      console.log('This lints your whole project, so it can take a while on large codebases.');\n    },\n    onScanComplete(fileCount) {\n      if (fileCount === 0) {\n        return;\n      }\n      console.log('');\n      console.log(`Found ${pluralize(fileCount, 'file')} to update. ${dryRun ? 'Previewing' : 'Applying'} fixes…`);\n    },\n    onFileFixed(file) {\n      console.log(`  ${verb} ${relative(file.filePath)} (${pluralize(file.protections, 'resource')})`);\n    },\n  });\n\n  if (fixed.length === 0 && unresolved.length === 0) {\n    console.log('');\n    console.log('No unprotected resources found. Nothing to do.');\n    return 0;\n  }\n\n  if (unresolved.length > 0) {\n    console.log('');\n    console.log('Needs manual attention (no safe automatic fix):');\n    for (const file of unresolved) {\n      for (const issue of file.issues) {\n        console.log(`  ${relative(file.filePath)}:${issue.line}:${issue.column} ${issue.message}`);\n      }\n    }\n  }\n\n  const totalProtections = fixed.reduce((sum, file) => sum + file.protections, 0);\n  console.log('');\n  console.log(\n    `${verb} ${pluralize(totalProtections, 'resource')} across ${pluralize(fixed.length, 'file')}.` +\n      (dryRun ? ' Run without --dry-run to apply.' : ''),\n  );\n\n  if (fixed.length > 0) {\n    console.log('');\n    console.log(\n      'Warning: Adding `await auth.protect()` changes your application\\u2019s runtime behavior \\u2014 it enforces',\n    );\n    console.log('authentication where there potentially was none, or might override custom auth checks that were');\n    console.log('already in place. Always review the changes and test your application.');\n  }\n\n  // Non-zero when there is still work to do (manual fixes, or pending changes in\n  // a dry run) so CI can gate on it.\n  return unresolved.length > 0 || (dryRun && fixed.length > 0) ? 1 : 0;\n}\n\nmain()\n  .then(code => {\n    process.exitCode = code;\n  })\n  .catch((error: unknown) => {\n    console.error(error instanceof Error ? error.message : error);\n    process.exitCode = 1;\n  });\n"],"mappings":";;;;;;;;AAMA,SAAS,SAAS,UAA0B;CAC1C,OAAOA,kBAAK,SAAS,QAAQ,IAAI,GAAG,QAAQ,KAAK;AACnD;AAEA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;AAqBb,SAAS,UAAU,OAAe,MAAsB;CACtD,OAAO,GAAG,MAAM,GAAG,OAAO,UAAU,IAAI,KAAK;AAC/C;AAEA,eAAe,OAAwB;CACrC,MAAM,EAAE,QAAQ,yCAA0B;EACxC,kBAAkB;EAClB,SAAS;GACP,WAAW,EAAE,MAAM,UAAU;GAC7B,MAAM;IAAE,MAAM;IAAW,OAAO;GAAI;EACtC;CACF,CAAC;CAED,IAAI,OAAO,MAAM;EACf,QAAQ,IAAI,IAAI;EAChB,OAAO;CACT;CAEA,MAAM,WAAW,YAAY,SAAS,IAAI,cAAc,CAAC,GAAG;CAC5D,MAAM,SAAS,QAAQ,OAAO,UAAU;CACxC,MAAM,OAAO,SAAS,kBAAkB;CAExC,QAAQ,IAAI,aAAa,SAAS,KAAK,IAAI,GAAG;CAE9C,MAAM,EAAE,OAAO,eAAe,MAAMC,mDAAkB;EACpD;EACA;EACA,iBAAiB,YAAY;GAC3B,QAAQ,IAAI,aAAa,aAAa,SAAS,UAAU,IAAI,mDAAmD;GAChH,QAAQ,IAAI,EAAE;GACd,QAAQ,IAAI,qCAAqC;GACjD,QAAQ,IAAI,2EAA2E;EACzF;EACA,eAAe,WAAW;GACxB,IAAI,cAAc,GAChB;GAEF,QAAQ,IAAI,EAAE;GACd,QAAQ,IAAI,SAAS,UAAU,WAAW,MAAM,EAAE,cAAc,SAAS,eAAe,WAAW,QAAQ;EAC7G;EACA,YAAY,MAAM;GAChB,QAAQ,IAAI,KAAK,KAAK,GAAG,SAAS,KAAK,QAAQ,EAAE,IAAI,UAAU,KAAK,aAAa,UAAU,EAAE,EAAE;EACjG;CACF,CAAC;CAED,IAAI,MAAM,WAAW,KAAK,WAAW,WAAW,GAAG;EACjD,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,gDAAgD;EAC5D,OAAO;CACT;CAEA,IAAI,WAAW,SAAS,GAAG;EACzB,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,iDAAiD;EAC7D,KAAK,MAAM,QAAQ,YACjB,KAAK,MAAM,SAAS,KAAK,QACvB,QAAQ,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,GAAG,MAAM,KAAK,GAAG,MAAM,OAAO,GAAG,MAAM,SAAS;CAG/F;CAEA,MAAM,mBAAmB,MAAM,QAAQ,KAAK,SAAS,MAAM,KAAK,aAAa,CAAC;CAC9E,QAAQ,IAAI,EAAE;CACd,QAAQ,IACN,GAAG,KAAK,GAAG,UAAU,kBAAkB,UAAU,EAAE,UAAU,UAAU,MAAM,QAAQ,MAAM,EAAE,MAC1F,SAAS,qCAAqC,GACnD;CAEA,IAAI,MAAM,SAAS,GAAG;EACpB,QAAQ,IAAI,EAAE;EACd,QAAQ,IACN,kGACF;EACA,QAAQ,IAAI,iGAAiG;EAC7G,QAAQ,IAAI,wEAAwE;CACtF;CAIA,OAAO,WAAW,SAAS,KAAM,UAAU,MAAM,SAAS,IAAK,IAAI;AACrE;AAEA,KAAK,CAAC,CACH,MAAK,SAAQ;CACZ,QAAQ,WAAW;AACrB,CAAC,CAAC,CACD,OAAO,UAAmB;CACzB,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,KAAK;CAC5D,QAAQ,WAAW;AACrB,CAAC"}

package/dist/next/fix-auth-protection-cli.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import { fixAuthProtection } from "./fix-auth-protection.mjs";
+import path from "node:path";
+import { parseArgs } from "node:util";
+
+//#region src/next/fix-auth-protection-cli.ts
+function relative(filePath) {
+	return path.relative(process.cwd(), filePath) || filePath;
+}
+const HELP = `clerk-next-fix-auth-protection
+
+Apply the @clerk/eslint-plugin \`require-auth-protection\` rule's
+\`await auth.protect()\` suggestions across your project. Uses your existing
+ESLint config (so the protected/public folder globs are honored).
+
+Usage
+  clerk-next-fix-auth-protection [patterns...] [options]
+
+Arguments
+  patterns            Files, directories, or globs to scan (default: ".")
+
+Options
+  --dry-run           Report what would change without writing any files
+  -h, --help          Show this help
+
+Examples
+  clerk-next-fix-auth-protection
+  clerk-next-fix-auth-protection "app/**" --dry-run
+`;
+function pluralize(count, noun) {
+	return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+async function main() {
+	const { values, positionals } = parseArgs({
+		allowPositionals: true,
+		options: {
+			"dry-run": { type: "boolean" },
+			help: {
+				type: "boolean",
+				short: "h"
+			}
+		}
+	});
+	if (values.help) {
+		console.log(HELP);
+		return 0;
+	}
+	const patterns = positionals.length > 0 ? positionals : ["."];
+	const dryRun = Boolean(values["dry-run"]);
+	const verb = dryRun ? "Would protect" : "Protected";
+	console.log(`Scanning: ${patterns.join(", ")}`);
+	const { fixed, unresolved } = await fixAuthProtection({
+		patterns,
+		dryRun,
+		onConfigResolved(configFile) {
+			console.log(`Config:   ${configFile ? relative(configFile) : "(resolved by ESLint from the working directory)"}`);
+			console.log("");
+			console.log("Scanning for unprotected resources…");
+			console.log("This lints your whole project, so it can take a while on large codebases.");
+		},
+		onScanComplete(fileCount) {
+			if (fileCount === 0) return;
+			console.log("");
+			console.log(`Found ${pluralize(fileCount, "file")} to update. ${dryRun ? "Previewing" : "Applying"} fixes…`);
+		},
+		onFileFixed(file) {
+			console.log(`  ${verb} ${relative(file.filePath)} (${pluralize(file.protections, "resource")})`);
+		}
+	});
+	if (fixed.length === 0 && unresolved.length === 0) {
+		console.log("");
+		console.log("No unprotected resources found. Nothing to do.");
+		return 0;
+	}
+	if (unresolved.length > 0) {
+		console.log("");
+		console.log("Needs manual attention (no safe automatic fix):");
+		for (const file of unresolved) for (const issue of file.issues) console.log(`  ${relative(file.filePath)}:${issue.line}:${issue.column} ${issue.message}`);
+	}
+	const totalProtections = fixed.reduce((sum, file) => sum + file.protections, 0);
+	console.log("");
+	console.log(`${verb} ${pluralize(totalProtections, "resource")} across ${pluralize(fixed.length, "file")}.` + (dryRun ? " Run without --dry-run to apply." : ""));
+	if (fixed.length > 0) {
+		console.log("");
+		console.log("Warning: Adding `await auth.protect()` changes your application’s runtime behavior — it enforces");
+		console.log("authentication where there potentially was none, or might override custom auth checks that were");
+		console.log("already in place. Always review the changes and test your application.");
+	}
+	return unresolved.length > 0 || dryRun && fixed.length > 0 ? 1 : 0;
+}
+main().then((code) => {
+	process.exitCode = code;
+}).catch((error) => {
+	console.error(error instanceof Error ? error.message : error);
+	process.exitCode = 1;
+});
+
+//#endregion
+export {  };
+//# sourceMappingURL=fix-auth-protection-cli.mjs.map

package/dist/next/fix-auth-protection-cli.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-auth-protection-cli.mjs","names":[],"sources":["../../src/next/fix-auth-protection-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport path from 'node:path';\nimport { parseArgs } from 'node:util';\n\nimport { fixAuthProtection } from './fix-auth-protection';\n\nfunction relative(filePath: string): string {\n  return path.relative(process.cwd(), filePath) || filePath;\n}\n\nconst HELP = `clerk-next-fix-auth-protection\n\nApply the @clerk/eslint-plugin \\`require-auth-protection\\` rule's\n\\`await auth.protect()\\` suggestions across your project. Uses your existing\nESLint config (so the protected/public folder globs are honored).\n\nUsage\n  clerk-next-fix-auth-protection [patterns...] [options]\n\nArguments\n  patterns            Files, directories, or globs to scan (default: \".\")\n\nOptions\n  --dry-run           Report what would change without writing any files\n  -h, --help          Show this help\n\nExamples\n  clerk-next-fix-auth-protection\n  clerk-next-fix-auth-protection \"app/**\" --dry-run\n`;\n\nfunction pluralize(count: number, noun: string): string {\n  return `${count} ${noun}${count === 1 ? '' : 's'}`;\n}\n\nasync function main(): Promise<number> {\n  const { values, positionals } = parseArgs({\n    allowPositionals: true,\n    options: {\n      'dry-run': { type: 'boolean' },\n      help: { type: 'boolean', short: 'h' },\n    },\n  });\n\n  if (values.help) {\n    console.log(HELP);\n    return 0;\n  }\n\n  const patterns = positionals.length > 0 ? positionals : ['.'];\n  const dryRun = Boolean(values['dry-run']);\n  const verb = dryRun ? 'Would protect' : 'Protected';\n\n  console.log(`Scanning: ${patterns.join(', ')}`);\n\n  const { fixed, unresolved } = await fixAuthProtection({\n    patterns,\n    dryRun,\n    onConfigResolved(configFile) {\n      console.log(`Config:   ${configFile ? relative(configFile) : '(resolved by ESLint from the working directory)'}`);\n      console.log('');\n      console.log('Scanning for unprotected resources…');\n      console.log('This lints your whole project, so it can take a while on large codebases.');\n    },\n    onScanComplete(fileCount) {\n      if (fileCount === 0) {\n        return;\n      }\n      console.log('');\n      console.log(`Found ${pluralize(fileCount, 'file')} to update. ${dryRun ? 'Previewing' : 'Applying'} fixes…`);\n    },\n    onFileFixed(file) {\n      console.log(`  ${verb} ${relative(file.filePath)} (${pluralize(file.protections, 'resource')})`);\n    },\n  });\n\n  if (fixed.length === 0 && unresolved.length === 0) {\n    console.log('');\n    console.log('No unprotected resources found. Nothing to do.');\n    return 0;\n  }\n\n  if (unresolved.length > 0) {\n    console.log('');\n    console.log('Needs manual attention (no safe automatic fix):');\n    for (const file of unresolved) {\n      for (const issue of file.issues) {\n        console.log(`  ${relative(file.filePath)}:${issue.line}:${issue.column} ${issue.message}`);\n      }\n    }\n  }\n\n  const totalProtections = fixed.reduce((sum, file) => sum + file.protections, 0);\n  console.log('');\n  console.log(\n    `${verb} ${pluralize(totalProtections, 'resource')} across ${pluralize(fixed.length, 'file')}.` +\n      (dryRun ? ' Run without --dry-run to apply.' : ''),\n  );\n\n  if (fixed.length > 0) {\n    console.log('');\n    console.log(\n      'Warning: Adding `await auth.protect()` changes your application\\u2019s runtime behavior \\u2014 it enforces',\n    );\n    console.log('authentication where there potentially was none, or might override custom auth checks that were');\n    console.log('already in place. Always review the changes and test your application.');\n  }\n\n  // Non-zero when there is still work to do (manual fixes, or pending changes in\n  // a dry run) so CI can gate on it.\n  return unresolved.length > 0 || (dryRun && fixed.length > 0) ? 1 : 0;\n}\n\nmain()\n  .then(code => {\n    process.exitCode = code;\n  })\n  .catch((error: unknown) => {\n    console.error(error instanceof Error ? error.message : error);\n    process.exitCode = 1;\n  });\n"],"mappings":";;;;;;AAMA,SAAS,SAAS,UAA0B;CAC1C,OAAO,KAAK,SAAS,QAAQ,IAAI,GAAG,QAAQ,KAAK;AACnD;AAEA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;AAqBb,SAAS,UAAU,OAAe,MAAsB;CACtD,OAAO,GAAG,MAAM,GAAG,OAAO,UAAU,IAAI,KAAK;AAC/C;AAEA,eAAe,OAAwB;CACrC,MAAM,EAAE,QAAQ,gBAAgB,UAAU;EACxC,kBAAkB;EAClB,SAAS;GACP,WAAW,EAAE,MAAM,UAAU;GAC7B,MAAM;IAAE,MAAM;IAAW,OAAO;GAAI;EACtC;CACF,CAAC;CAED,IAAI,OAAO,MAAM;EACf,QAAQ,IAAI,IAAI;EAChB,OAAO;CACT;CAEA,MAAM,WAAW,YAAY,SAAS,IAAI,cAAc,CAAC,GAAG;CAC5D,MAAM,SAAS,QAAQ,OAAO,UAAU;CACxC,MAAM,OAAO,SAAS,kBAAkB;CAExC,QAAQ,IAAI,aAAa,SAAS,KAAK,IAAI,GAAG;CAE9C,MAAM,EAAE,OAAO,eAAe,MAAM,kBAAkB;EACpD;EACA;EACA,iBAAiB,YAAY;GAC3B,QAAQ,IAAI,aAAa,aAAa,SAAS,UAAU,IAAI,mDAAmD;GAChH,QAAQ,IAAI,EAAE;GACd,QAAQ,IAAI,qCAAqC;GACjD,QAAQ,IAAI,2EAA2E;EACzF;EACA,eAAe,WAAW;GACxB,IAAI,cAAc,GAChB;GAEF,QAAQ,IAAI,EAAE;GACd,QAAQ,IAAI,SAAS,UAAU,WAAW,MAAM,EAAE,cAAc,SAAS,eAAe,WAAW,QAAQ;EAC7G;EACA,YAAY,MAAM;GAChB,QAAQ,IAAI,KAAK,KAAK,GAAG,SAAS,KAAK,QAAQ,EAAE,IAAI,UAAU,KAAK,aAAa,UAAU,EAAE,EAAE;EACjG;CACF,CAAC;CAED,IAAI,MAAM,WAAW,KAAK,WAAW,WAAW,GAAG;EACjD,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,gDAAgD;EAC5D,OAAO;CACT;CAEA,IAAI,WAAW,SAAS,GAAG;EACzB,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,iDAAiD;EAC7D,KAAK,MAAM,QAAQ,YACjB,KAAK,MAAM,SAAS,KAAK,QACvB,QAAQ,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,GAAG,MAAM,KAAK,GAAG,MAAM,OAAO,GAAG,MAAM,SAAS;CAG/F;CAEA,MAAM,mBAAmB,MAAM,QAAQ,KAAK,SAAS,MAAM,KAAK,aAAa,CAAC;CAC9E,QAAQ,IAAI,EAAE;CACd,QAAQ,IACN,GAAG,KAAK,GAAG,UAAU,kBAAkB,UAAU,EAAE,UAAU,UAAU,MAAM,QAAQ,MAAM,EAAE,MAC1F,SAAS,qCAAqC,GACnD;CAEA,IAAI,MAAM,SAAS,GAAG;EACpB,QAAQ,IAAI,EAAE;EACd,QAAQ,IACN,kGACF;EACA,QAAQ,IAAI,iGAAiG;EAC7G,QAAQ,IAAI,wEAAwE;CACtF;CAIA,OAAO,WAAW,SAAS,KAAM,UAAU,MAAM,SAAS,IAAK,IAAI;AACrE;AAEA,KAAK,CAAC,CACH,MAAK,SAAQ;CACZ,QAAQ,WAAW;AACrB,CAAC,CAAC,CACD,OAAO,UAAmB;CACzB,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,KAAK;CAC5D,QAAQ,WAAW;AACrB,CAAC"}

package/dist/next/fix-auth-protection.d.mts

@@ -0,0 +1,59 @@
+import { ESLint } from "eslint";
+
+//#region src/next/fix-auth-protection.d.ts
+interface FixAuthProtectionOptions {
+  /** File, directory, or glob patterns to scan. Defaults to `['.']`. */
+  patterns?: string[];
+  /** Working directory ESLint resolves config and files against. Defaults to `process.cwd()`. */
+  cwd?: string;
+  /** Compute the changes without writing them to disk. */
+  dryRun?: boolean;
+  /**
+   * Advanced/escape hatch: a pre-configured ESLint instance to lint with. When
+   * omitted, a default `new ESLint({ cwd })` is used, which discovers the
+   * consumer's flat config. Mainly useful for tests.
+   */
+  eslint?: ESLint;
+  /**
+   * Called before scanning with the path to the ESLint config file that will be
+   * used (or `undefined` when none is found / an instance was injected).
+   */
+  onConfigResolved?: (configFilePath: string | undefined) => void;
+  /**
+   * Called once linting finishes and per-file fixing begins, with the number of
+   * files that have flagged resources. Useful for reporting progress, since the
+   * initial lint can be slow on large projects.
+   */
+  onScanComplete?: (fileCount: number) => void;
+  /** Called after each file is fixed (or, in `dryRun`, would be fixed). */
+  onFileFixed?: (file: FixedFile) => void;
+}
+interface FixedFile {
+  filePath: string;
+  /** Number of resources that had `await auth.protect()` applied. */
+  protections: number;
+}
+interface UnresolvedIssue {
+  line: number;
+  column: number;
+  message: string;
+}
+interface UnresolvedFile {
+  filePath: string;
+  issues: UnresolvedIssue[];
+}
+interface FixAuthProtectionResult {
+  /** Files that were (or, in `dryRun`, would be) modified. */
+  fixed: FixedFile[];
+  /** Files with flagged resources that have no safe automatic fix. */
+  unresolved: UnresolvedFile[];
+}
+/**
+ * Lint the given patterns with the consumer's ESLint config and apply the
+ * `require-auth-protection` rule's `await auth.protect()` suggestions to every
+ * resource it can safely fix.
+ */
+declare function fixAuthProtection(options?: FixAuthProtectionOptions): Promise<FixAuthProtectionResult>;
+//#endregion
+export { FixAuthProtectionOptions, FixAuthProtectionResult, FixedFile, UnresolvedFile, UnresolvedIssue, fixAuthProtection };
+//# sourceMappingURL=fix-auth-protection.d.mts.map

package/dist/next/fix-auth-protection.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-auth-protection.d.mts","names":[],"sources":["../../src/next/fix-auth-protection.ts"],"mappings":";;;UAyBiB,wBAAA;EAyBA;EAvBf,QAAA;EAuB8B;EArB9B,GAAA;EAwBwB;EAtBxB,MAAA;EAuBA;AAEW;AAGb;;;EAtBE,MAAA,GAAS,MAAA;EAuBT;;;;EAlBA,gBAAA,IAAoB,cAAA;EAuBL;;;;;EAjBf,cAAA,IAAkB,SAAA;EAmBV;EAjBR,WAAA,IAAe,IAAA,EAAM,SAAS;AAAA;AAAA,UAGf,SAAA;EACf,QAAA;;EAEA,WAAW;AAAA;AAAA,UAGI,eAAA;EACf,IAAA;EACA,MAAA;EACA,OAAA;AAAA;AAAA,UAGe,cAAA;EACf,QAAA;EACA,MAAA,EAAQ,eAAe;AAAA;AAAA,UAGR,uBAAA;EAmGgE;EAjG/E,KAAA,EAAO,SAAA;EAiG+E;EA/FtF,UAAA,EAAY,cAAc;AAAA;;;;AA+FoF;;iBAA1F,iBAAA,CAAkB,OAAA,GAAS,wBAAA,GAAgC,OAAA,CAAQ,uBAAA"}