@clerk/fastify 3.1.27-snapshot.v20260515233846 → 3.1.27

package/dist/{index-C5pGnL7a.d.mts → index-CWnSaB0B.d.mts}

@@ -1,12 +1,7 @@
 import '@clerk/shared/types';
-import { ClerkClient, ClerkOptions } from '@clerk/backend';
+import { ClerkOptions } from '@clerk/backend';
 import { ShouldProxyFn } from '@clerk/shared/proxy';
 
-declare module 'fastify' {
-    interface FastifyRequest {
-        clerk: ClerkClient;
-    }
-}
 declare const ALLOWED_HOOKS: readonly ["onRequest", "preHandler"];
 /**
  * Options for the built-in Frontend API proxy.
@@ -25,14 +20,6 @@ interface FrontendApiProxyOptions {
 type ClerkFastifyOptions = ClerkOptions & {
     hookName?: (typeof ALLOWED_HOOKS)[number];
     frontendApiProxy?: FrontendApiProxyOptions;
-    /**
-     * Whether to enable the handshake flow for session verification.
-     * Disable this when using Clerk with a first-party API backend (e.g. a SPA calling
-     * a Fastify server) to prevent handshake nonce cookies set during OAuth callbacks
-     * from blocking authentication on subsequent API requests.
-     * @default true
-     */
-    enableHandshake?: boolean;
 };
 
 export type { ClerkFastifyOptions as C, FrontendApiProxyOptions as F };

package/dist/{index-C5pGnL7a.d.ts → index-CWnSaB0B.d.ts}

@@ -1,12 +1,7 @@
 import '@clerk/shared/types';
-import { ClerkClient, ClerkOptions } from '@clerk/backend';
+import { ClerkOptions } from '@clerk/backend';
 import { ShouldProxyFn } from '@clerk/shared/proxy';
 
-declare module 'fastify' {
-    interface FastifyRequest {
-        clerk: ClerkClient;
-    }
-}
 declare const ALLOWED_HOOKS: readonly ["onRequest", "preHandler"];
 /**
  * Options for the built-in Frontend API proxy.
@@ -25,14 +20,6 @@ interface FrontendApiProxyOptions {
 type ClerkFastifyOptions = ClerkOptions & {
     hookName?: (typeof ALLOWED_HOOKS)[number];
     frontendApiProxy?: FrontendApiProxyOptions;
-    /**
-     * Whether to enable the handshake flow for session verification.
-     * Disable this when using Clerk with a first-party API backend (e.g. a SPA calling
-     * a Fastify server) to prevent handshake nonce cookies set during OAuth callbacks
-     * from blocking authentication on subsequent API requests.
-     * @default true
-     */
-    enableHandshake?: boolean;
 };
 
 export type { ClerkFastifyOptions as C, FrontendApiProxyOptions as F };

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import * as _clerk_backend from '@clerk/backend';
 export * from '@clerk/backend';
-import { C as ClerkFastifyOptions } from './index-C5pGnL7a.mjs';
-export { F as FrontendApiProxyOptions } from './index-C5pGnL7a.mjs';
+import { C as ClerkFastifyOptions } from './index-CWnSaB0B.mjs';
+export { F as FrontendApiProxyOptions } from './index-CWnSaB0B.mjs';
 import { FastifyPluginCallback, FastifyRequest } from 'fastify';
 import { GetAuthFn } from '@clerk/backend/internal';
 import '@clerk/shared/types';

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as _clerk_backend from '@clerk/backend';
 export * from '@clerk/backend';
-import { C as ClerkFastifyOptions } from './index-C5pGnL7a.js';
-export { F as FrontendApiProxyOptions } from './index-C5pGnL7a.js';
+import { C as ClerkFastifyOptions } from './index-CWnSaB0B.js';
+export { F as FrontendApiProxyOptions } from './index-CWnSaB0B.js';
 import { FastifyPluginCallback, FastifyRequest } from 'fastify';
 import { GetAuthFn } from '@clerk/backend/internal';
 import '@clerk/shared/types';

package/dist/index.js

@@ -45,11 +45,13 @@ var import_fastify_plugin = __toESM(require("fastify-plugin"));
 var ALLOWED_HOOKS = ["onRequest", "preHandler"];
 
 // src/withClerkMiddleware.ts
-var import_backend = require("@clerk/backend");
 var import_internal2 = require("@clerk/backend/internal");
 var import_proxy = require("@clerk/backend/proxy");
 var import_stream2 = require("stream");
 
+// src/clerkClient.ts
+var import_backend = require("@clerk/backend");
+
 // src/constants.ts
 var import_internal = require("@clerk/backend/internal");
 var import_apiUrlFromPublishableKey = require("@clerk/shared/apiUrlFromPublishableKey");
@@ -61,11 +63,22 @@ var API_URL = process.env.CLERK_API_URL || (0, import_apiUrlFromPublishableKey.a
 var JWT_KEY = process.env.CLERK_JWT_KEY || "";
 var SDK_METADATA = {
   name: "@clerk/fastify",
-  version: "3.1.27-snapshot.v20260515233846",
+  version: "3.1.27",
   environment: "production"
 };
 var { Cookies, Headers: Headers2 } = import_internal.constants;
 
+// src/clerkClient.ts
+var clerkClient = (0, import_backend.createClerkClient)({
+  secretKey: SECRET_KEY,
+  machineSecretKey: MACHINE_SECRET_KEY,
+  apiUrl: API_URL,
+  apiVersion: API_VERSION,
+  jwtKey: JWT_KEY,
+  userAgent: `${"@clerk/fastify"}@${"3.1.27"}`,
+  sdkMetadata: SDK_METADATA
+});
+
 // src/utils.ts
 var import_stream = require("stream");
 var fastifyRequestToRequest = (req) => {
@@ -118,21 +131,9 @@ var requestToProxyRequest = (req) => {
 var withClerkMiddleware = (options) => {
   const frontendApiProxy = options.frontendApiProxy;
   const proxyPath = (0, import_proxy.stripTrailingSlashes)(frontendApiProxy?.path ?? import_proxy.DEFAULT_PROXY_PATH) || import_proxy.DEFAULT_PROXY_PATH;
-  const publishableKey = options.publishableKey || PUBLISHABLE_KEY;
-  const secretKey = options.secretKey || SECRET_KEY;
-  const clerkClient2 = (0, import_backend.createClerkClient)({
-    ...options,
-    publishableKey,
-    secretKey,
-    machineSecretKey: options.machineSecretKey || MACHINE_SECRET_KEY,
-    apiUrl: options.apiUrl || API_URL,
-    apiVersion: options.apiVersion || API_VERSION,
-    jwtKey: options.jwtKey || JWT_KEY,
-    userAgent: options.userAgent || `${SDK_METADATA.name}@${SDK_METADATA.version}`,
-    sdkMetadata: options.sdkMetadata || SDK_METADATA
-  });
-  const enableHandshake = options.enableHandshake ?? true;
   return async (fastifyRequest, reply) => {
+    const publishableKey = options.publishableKey || PUBLISHABLE_KEY;
+    const secretKey = options.secretKey || SECRET_KEY;
     let resolvedProxyUrl = options.proxyUrl;
     if (frontendApiProxy) {
       const requestUrl = new URL(
@@ -178,7 +179,7 @@ var withClerkMiddleware = (options) => {
       }
     }
     const req = fastifyRequestToRequest(fastifyRequest);
-    const requestState = await clerkClient2.authenticateRequest(req, {
+    const requestState = await clerkClient.authenticateRequest(req, {
       ...options,
       secretKey,
       publishableKey,
@@ -186,23 +187,19 @@ var withClerkMiddleware = (options) => {
       acceptsToken: "any"
     });
     requestState.headers.forEach((value, key) => reply.header(key, value));
-    if (enableHandshake) {
-      const locationHeader = requestState.headers.get(Headers2.Location);
-      if (locationHeader) {
-        return reply.code(307).send();
-      } else if (requestState.status === import_internal2.AuthStatus.Handshake) {
-        throw new Error("Clerk: handshake status without redirect");
-      }
+    const locationHeader = requestState.headers.get(Headers2.Location);
+    if (locationHeader) {
+      return reply.code(307).send();
+    } else if (requestState.status === import_internal2.AuthStatus.Handshake) {
+      throw new Error("Clerk: handshake status without redirect");
     }
     fastifyRequest.auth = requestState.toAuth();
-    fastifyRequest.clerk = clerkClient2;
   };
 };
 
 // src/clerkPlugin.ts
 var plugin = (instance, opts, done) => {
   instance.decorateRequest("auth", null);
-  instance.decorateRequest("clerk", null);
   const hookName = opts.hookName || "preHandler";
   if (!ALLOWED_HOOKS.includes(hookName)) {
     throw new Error(`Unsupported hookName: ${hookName}`);
@@ -243,18 +240,6 @@ var getAuth = ((req, options) => {
   }
   return (0, import_internal3.getAuthObjectForAcceptedToken)({ authObject: authReq.auth, acceptsToken: options?.acceptsToken });
 });
-
-// src/clerkClient.ts
-var import_backend2 = require("@clerk/backend");
-var clerkClient = (0, import_backend2.createClerkClient)({
-  secretKey: SECRET_KEY,
-  machineSecretKey: MACHINE_SECRET_KEY,
-  apiUrl: API_URL,
-  apiVersion: API_VERSION,
-  jwtKey: JWT_KEY,
-  userAgent: `${"@clerk/fastify"}@${"3.1.27-snapshot.v20260515233846"}`,
-  sdkMetadata: SDK_METADATA
-});
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   clerkClient,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/clerkPlugin.ts","../src/types.ts","../src/withClerkMiddleware.ts","../src/constants.ts","../src/utils.ts","../src/getAuth.ts","../src/errors.ts","../src/clerkClient.ts"],"sourcesContent":["export * from '@clerk/backend';\n\nexport type { ClerkFastifyOptions, FrontendApiProxyOptions } from './types';\n\nexport { clerkPlugin } from './clerkPlugin';\nexport { getAuth } from './getAuth';\nexport { clerkClient } from './clerkClient';\n","import type { FastifyInstance, FastifyPluginCallback } from 'fastify';\nimport fp from 'fastify-plugin';\n\nimport type { ClerkFastifyOptions } from './types';\nimport { ALLOWED_HOOKS } from './types';\nimport { withClerkMiddleware } from './withClerkMiddleware';\n\nconst plugin: FastifyPluginCallback<ClerkFastifyOptions> = (\n  instance: FastifyInstance,\n  opts: ClerkFastifyOptions,\n  done,\n) => {\n  instance.decorateRequest('auth', null);\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  instance.decorateRequest('clerk', null as any);\n  // run clerk as a middleware to all scoped routes\n  const hookName = opts.hookName || 'preHandler';\n  if (!ALLOWED_HOOKS.includes(hookName)) {\n    throw new Error(`Unsupported hookName: ${hookName}`);\n  }\n\n  instance.addHook(hookName, withClerkMiddleware(opts));\n\n  done();\n};\n\nexport const clerkPlugin = fp(plugin, {\n  name: '@clerk/fastify',\n  fastify: '5.x',\n});\n","import type { ClerkClient, ClerkOptions } from '@clerk/backend';\nimport type { ShouldProxyFn } from '@clerk/shared/proxy';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    clerk: ClerkClient;\n  }\n}\n\nexport const ALLOWED_HOOKS = ['onRequest', 'preHandler'] as const;\n\n/**\n * Options for the built-in Frontend API proxy.\n *\n * When enabled, the middleware intercepts requests that match the proxy path\n * (default `/__clerk`) and forwards them to the Clerk Frontend API, allowing\n * the Clerk frontend SDKs to communicate with Clerk without third-party\n * cookie or ad-blocker issues.\n */\nexport interface FrontendApiProxyOptions {\n  /** Toggle the proxy on/off, or supply a function that decides per-request. */\n  enabled: boolean | ShouldProxyFn;\n  /** Custom path prefix for the proxy (default: `/__clerk`). */\n  path?: string;\n}\n\nexport type ClerkFastifyOptions = ClerkOptions & {\n  hookName?: (typeof ALLOWED_HOOKS)[number];\n  frontendApiProxy?: FrontendApiProxyOptions;\n  /**\n   * Whether to enable the handshake flow for session verification.\n   * Disable this when using Clerk with a first-party API backend (e.g. a SPA calling\n   * a Fastify server) to prevent handshake nonce cookies set during OAuth callbacks\n   * from blocking authentication on subsequent API requests.\n   * @default true\n   */\n  enableHandshake?: boolean;\n};\n","import { createClerkClient } from '@clerk/backend';\nimport { AuthStatus } from '@clerk/backend/internal';\nimport { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, stripTrailingSlashes } from '@clerk/backend/proxy';\nimport type { FastifyReply, FastifyRequest } from 'fastify';\nimport { Readable } from 'stream';\n\nimport * as constants from './constants';\nimport type { ClerkFastifyOptions } from './types';\nimport { fastifyRequestToRequest, requestToProxyRequest } from './utils';\n\nexport const withClerkMiddleware = (options: ClerkFastifyOptions) => {\n  const frontendApiProxy = options.frontendApiProxy;\n  const proxyPath = stripTrailingSlashes(frontendApiProxy?.path ?? DEFAULT_PROXY_PATH) || DEFAULT_PROXY_PATH;\n  const publishableKey = options.publishableKey || constants.PUBLISHABLE_KEY;\n  const secretKey = options.secretKey || constants.SECRET_KEY;\n  const clerkClient = createClerkClient({\n    ...options,\n    publishableKey,\n    secretKey,\n    machineSecretKey: options.machineSecretKey || constants.MACHINE_SECRET_KEY,\n    apiUrl: options.apiUrl || constants.API_URL,\n    apiVersion: options.apiVersion || constants.API_VERSION,\n    jwtKey: options.jwtKey || constants.JWT_KEY,\n    userAgent: options.userAgent || `${constants.SDK_METADATA.name}@${constants.SDK_METADATA.version}`,\n    sdkMetadata: options.sdkMetadata || constants.SDK_METADATA,\n  });\n  const enableHandshake = options.enableHandshake ?? true;\n\n  return async (fastifyRequest: FastifyRequest, reply: FastifyReply) => {\n    // Handle Frontend API proxy requests and auto-derive proxyUrl\n    let resolvedProxyUrl = options.proxyUrl;\n    if (frontendApiProxy) {\n      const requestUrl = new URL(\n        fastifyRequest.url,\n        `${fastifyRequest.protocol}://${fastifyRequest.hostname || 'localhost'}`,\n      );\n      const isEnabled =\n        typeof frontendApiProxy.enabled === 'function'\n          ? frontendApiProxy.enabled(requestUrl)\n          : frontendApiProxy.enabled;\n\n      if (isEnabled) {\n        if (requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + '/')) {\n          const proxyRequest = requestToProxyRequest(fastifyRequest);\n\n          const proxyResponse = await clerkFrontendApiProxy(proxyRequest, {\n            proxyPath,\n            publishableKey,\n            secretKey,\n          });\n\n          reply.code(proxyResponse.status);\n          proxyResponse.headers.forEach((value, key) => {\n            reply.header(key, value);\n          });\n\n          if (proxyResponse.body) {\n            const reader = proxyResponse.body.getReader();\n            const stream = new Readable({\n              async read() {\n                try {\n                  const { done, value } = await reader.read();\n                  if (done) {\n                    this.push(null);\n                  } else {\n                    this.push(Buffer.from(value));\n                  }\n                } catch (error) {\n                  this.destroy(error instanceof Error ? error : new Error(String(error)));\n                }\n              },\n            });\n            return reply.send(stream);\n          }\n          return reply.send();\n        }\n\n        // Pass just the path - the backend resolves it against the request's\n        // public origin (from x-forwarded-* headers).\n        if (!resolvedProxyUrl) {\n          resolvedProxyUrl = proxyPath;\n        }\n      }\n    }\n\n    const req = fastifyRequestToRequest(fastifyRequest);\n\n    const requestState = await clerkClient.authenticateRequest(req, {\n      ...options,\n      secretKey,\n      publishableKey,\n      proxyUrl: resolvedProxyUrl,\n      acceptsToken: 'any',\n    });\n\n    requestState.headers.forEach((value, key) => reply.header(key, value));\n\n    if (enableHandshake) {\n      const locationHeader = requestState.headers.get(constants.Headers.Location);\n      if (locationHeader) {\n        return reply.code(307).send();\n      } else if (requestState.status === AuthStatus.Handshake) {\n        throw new Error('Clerk: handshake status without redirect');\n      }\n    }\n\n    // @ts-expect-error Inject auth so getAuth can read it\n    fastifyRequest.auth = requestState.toAuth();\n    fastifyRequest.clerk = clerkClient;\n  };\n};\n","import { constants } from '@clerk/backend/internal';\nimport { apiUrlFromPublishableKey } from '@clerk/shared/apiUrlFromPublishableKey';\n\nexport const API_VERSION = process.env.CLERK_API_VERSION || 'v1';\nexport const SECRET_KEY = process.env.CLERK_SECRET_KEY || '';\nexport const MACHINE_SECRET_KEY = process.env.CLERK_MACHINE_SECRET_KEY || '';\nexport const PUBLISHABLE_KEY = process.env.CLERK_PUBLISHABLE_KEY || '';\nexport const API_URL = process.env.CLERK_API_URL || apiUrlFromPublishableKey(PUBLISHABLE_KEY);\nexport const JWT_KEY = process.env.CLERK_JWT_KEY || '';\nexport const SDK_METADATA = {\n  name: PACKAGE_NAME,\n  version: PACKAGE_VERSION,\n  environment: process.env.NODE_ENV,\n};\n\nexport const { Cookies, Headers } = constants;\n","import type { FastifyRequest } from 'fastify';\nimport { Readable } from 'stream';\n\nexport const fastifyRequestToRequest = (req: FastifyRequest): Request => {\n  const headers = new Headers(\n    Object.keys(req.headers).reduce((acc, key) => {\n      const value = req.headers[key];\n      if (!value) {\n        return acc;\n      }\n\n      if (typeof value === 'string') {\n        acc.set(key, value);\n      } else {\n        acc.set(key, value.join(','));\n      }\n      return acc;\n    }, new Headers()),\n  );\n\n  // Making some manual tests it seems that FastifyRequest populates the req protocol / hostname\n  // based on the forwarded headers. Nevertheless, we are gonna use a dummy base and the request\n  // will be fixed by the internals of the clerk/backend package\n  const dummyOriginReqUrl = new URL(req.url || '', `${req.protocol}://clerk-dummy`);\n  return new Request(dummyOriginReqUrl, {\n    method: req.method,\n    headers,\n  });\n};\n\n/**\n * Converts a Fastify request to a Fetch API Request with full headers and body streaming,\n * suitable for proxy forwarding.\n */\nexport const requestToProxyRequest = (req: FastifyRequest): Request => {\n  const headers = new Headers();\n  Object.entries(req.headers).forEach(([key, value]) => {\n    if (value) {\n      headers.set(key, Array.isArray(value) ? value.join(', ') : value);\n    }\n  });\n\n  const forwardedProto = req.headers['x-forwarded-proto'];\n  const protoHeader = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;\n  const proto = (protoHeader || '').split(',')[0].trim();\n  const protocol = proto === 'https' || req.protocol === 'https' ? 'https' : 'http';\n\n  const forwardedHost = req.headers['x-forwarded-host'];\n  const hostHeader = Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost;\n  const host = (hostHeader || '').split(',')[0].trim() || req.hostname || 'localhost';\n\n  const url = new URL(req.url || '', `${protocol}://${host}`);\n\n  const hasBody = ['POST', 'PUT', 'PATCH'].includes(req.method);\n\n  return new Request(url.toString(), {\n    method: req.method,\n    headers,\n    body: hasBody ? (Readable.toWeb(req.raw) as ReadableStream) : undefined,\n    // @ts-expect-error - duplex required for streaming bodies but not in all TS definitions\n    duplex: hasBody ? 'half' : undefined,\n  });\n};\n","import type { AuthOptions, GetAuthFn, SignedInAuthObject, SignedOutAuthObject } from '@clerk/backend/internal';\nimport { getAuthObjectForAcceptedToken } from '@clerk/backend/internal';\nimport type { FastifyRequest } from 'fastify';\n\nimport { pluginRegistrationRequired } from './errors';\n\nexport const getAuth: GetAuthFn<FastifyRequest> = ((req: FastifyRequest, options?: AuthOptions) => {\n  const authReq = req as FastifyRequest & { auth: SignedInAuthObject | SignedOutAuthObject };\n\n  if (!authReq.auth) {\n    throw new Error(pluginRegistrationRequired);\n  }\n\n  return getAuthObjectForAcceptedToken({ authObject: authReq.auth, acceptsToken: options?.acceptsToken });\n}) as GetAuthFn<FastifyRequest>;\n","// https://github.com/clerk/javascript/blob/main/packages/remix/src/errors.ts#L1-L0\nconst createErrorMessage = (msg: string) => {\n  return `🔒 Clerk: ${msg.trim()}\n\nFor more info, check out the docs: https://clerk.com/docs,\nor come say hi in our discord server: https://clerk.com/discord\n`;\n};\n\nexport const pluginRegistrationRequired =\n  createErrorMessage(`The \"clerkPlugin\" should be registered before using the \"getAuth\".\nExample:\n\nimport { clerkPlugin } from '@clerk/fastify';\n\nconst server: FastifyInstance = Fastify({ logger: true });\nserver.register(clerkPlugin);\n`);\n","import { createClerkClient } from '@clerk/backend';\n\nimport { API_URL, API_VERSION, JWT_KEY, MACHINE_SECRET_KEY, SDK_METADATA, SECRET_KEY } from './constants';\n\nexport const clerkClient = createClerkClient({\n  secretKey: SECRET_KEY,\n  machineSecretKey: MACHINE_SECRET_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n  jwtKey: JWT_KEY,\n  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,\n  sdkMetadata: SDK_METADATA,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAAc,2BAAd;;;ACCA,4BAAe;;;ACQR,IAAM,gBAAgB,CAAC,aAAa,YAAY;;;ACTvD,qBAAkC;AAClC,IAAAA,mBAA2B;AAC3B,mBAAgF;AAEhF,IAAAC,iBAAyB;;;ACJzB,sBAA0B;AAC1B,sCAAyC;AAElC,IAAM,cAAc,QAAQ,IAAI,qBAAqB;AACrD,IAAM,aAAa,QAAQ,IAAI,oBAAoB;AACnD,IAAM,qBAAqB,QAAQ,IAAI,4BAA4B;AACnE,IAAM,kBAAkB,QAAQ,IAAI,yBAAyB;AAC7D,IAAM,UAAU,QAAQ,IAAI,qBAAiB,0DAAyB,eAAe;AACrF,IAAM,UAAU,QAAQ,IAAI,iBAAiB;AAC7C,IAAM,eAAe;AAAA,EAC1B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,aAAa;AACf;AAEO,IAAM,EAAE,SAAS,SAAAC,SAAQ,IAAI;;;ACdpC,oBAAyB;AAElB,IAAM,0BAA0B,CAAC,QAAiC;AACvE,QAAM,UAAU,IAAI;AAAA,IAClB,OAAO,KAAK,IAAI,OAAO,EAAE,OAAO,CAAC,KAAK,QAAQ;AAC5C,YAAM,QAAQ,IAAI,QAAQ,GAAG;AAC7B,UAAI,CAAC,OAAO;AACV,eAAO;AAAA,MACT;AAEA,UAAI,OAAO,UAAU,UAAU;AAC7B,YAAI,IAAI,KAAK,KAAK;AAAA,MACpB,OAAO;AACL,YAAI,IAAI,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,MAC9B;AACA,aAAO;AAAA,IACT,GAAG,IAAI,QAAQ,CAAC;AAAA,EAClB;AAKA,QAAM,oBAAoB,IAAI,IAAI,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,gBAAgB;AAChF,SAAO,IAAI,QAAQ,mBAAmB;AAAA,IACpC,QAAQ,IAAI;AAAA,IACZ;AAAA,EACF,CAAC;AACH;AAMO,IAAM,wBAAwB,CAAC,QAAiC;AACrE,QAAM,UAAU,IAAI,QAAQ;AAC5B,SAAO,QAAQ,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,QAAI,OAAO;AACT,cAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;AAAA,IAClE;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,IAAI,QAAQ,mBAAmB;AACtD,QAAM,cAAc,MAAM,QAAQ,cAAc,IAAI,eAAe,CAAC,IAAI;AACxE,QAAM,SAAS,eAAe,IAAI,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AACrD,QAAM,WAAW,UAAU,WAAW,IAAI,aAAa,UAAU,UAAU;AAE3E,QAAM,gBAAgB,IAAI,QAAQ,kBAAkB;AACpD,QAAM,aAAa,MAAM,QAAQ,aAAa,IAAI,cAAc,CAAC,IAAI;AACrE,QAAM,QAAQ,cAAc,IAAI,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,KAAK,IAAI,YAAY;AAExE,QAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,GAAG,QAAQ,MAAM,IAAI,EAAE;AAE1D,QAAM,UAAU,CAAC,QAAQ,OAAO,OAAO,EAAE,SAAS,IAAI,MAAM;AAE5D,SAAO,IAAI,QAAQ,IAAI,SAAS,GAAG;AAAA,IACjC,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,UAAW,uBAAS,MAAM,IAAI,GAAG,IAAuB;AAAA;AAAA,IAE9D,QAAQ,UAAU,SAAS;AAAA,EAC7B,CAAC;AACH;;;AFpDO,IAAM,sBAAsB,CAAC,YAAiC;AACnE,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAY,mCAAqB,kBAAkB,QAAQ,+BAAkB,KAAK;AACxF,QAAM,iBAAiB,QAAQ,kBAA4B;AAC3D,QAAM,YAAY,QAAQ,aAAuB;AACjD,QAAMC,mBAAc,kCAAkB;AAAA,IACpC,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA,kBAAkB,QAAQ,oBAA8B;AAAA,IACxD,QAAQ,QAAQ,UAAoB;AAAA,IACpC,YAAY,QAAQ,cAAwB;AAAA,IAC5C,QAAQ,QAAQ,UAAoB;AAAA,IACpC,WAAW,QAAQ,aAAa,GAAa,aAAa,IAAI,IAAc,aAAa,OAAO;AAAA,IAChG,aAAa,QAAQ,eAAyB;AAAA,EAChD,CAAC;AACD,QAAM,kBAAkB,QAAQ,mBAAmB;AAEnD,SAAO,OAAO,gBAAgC,UAAwB;AAEpE,QAAI,mBAAmB,QAAQ;AAC/B,QAAI,kBAAkB;AACpB,YAAM,aAAa,IAAI;AAAA,QACrB,eAAe;AAAA,QACf,GAAG,eAAe,QAAQ,MAAM,eAAe,YAAY,WAAW;AAAA,MACxE;AACA,YAAM,YACJ,OAAO,iBAAiB,YAAY,aAChC,iBAAiB,QAAQ,UAAU,IACnC,iBAAiB;AAEvB,UAAI,WAAW;AACb,YAAI,WAAW,aAAa,aAAa,WAAW,SAAS,WAAW,YAAY,GAAG,GAAG;AACxF,gBAAM,eAAe,sBAAsB,cAAc;AAEzD,gBAAM,gBAAgB,UAAM,oCAAsB,cAAc;AAAA,YAC9D;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,gBAAM,KAAK,cAAc,MAAM;AAC/B,wBAAc,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC5C,kBAAM,OAAO,KAAK,KAAK;AAAA,UACzB,CAAC;AAED,cAAI,cAAc,MAAM;AACtB,kBAAM,SAAS,cAAc,KAAK,UAAU;AAC5C,kBAAM,SAAS,IAAI,wBAAS;AAAA,cAC1B,MAAM,OAAO;AACX,oBAAI;AACF,wBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,sBAAI,MAAM;AACR,yBAAK,KAAK,IAAI;AAAA,kBAChB,OAAO;AACL,yBAAK,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,kBAC9B;AAAA,gBACF,SAAS,OAAO;AACd,uBAAK,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,gBACxE;AAAA,cACF;AAAA,YACF,CAAC;AACD,mBAAO,MAAM,KAAK,MAAM;AAAA,UAC1B;AACA,iBAAO,MAAM,KAAK;AAAA,QACpB;AAIA,YAAI,CAAC,kBAAkB;AACrB,6BAAmB;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,wBAAwB,cAAc;AAElD,UAAM,eAAe,MAAMA,aAAY,oBAAoB,KAAK;AAAA,MAC9D,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,IAChB,CAAC;AAED,iBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ,MAAM,OAAO,KAAK,KAAK,CAAC;AAErE,QAAI,iBAAiB;AACnB,YAAM,iBAAiB,aAAa,QAAQ,IAAcC,SAAQ,QAAQ;AAC1E,UAAI,gBAAgB;AAClB,eAAO,MAAM,KAAK,GAAG,EAAE,KAAK;AAAA,MAC9B,WAAW,aAAa,WAAW,4BAAW,WAAW;AACvD,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AAAA,IACF;AAGA,mBAAe,OAAO,aAAa,OAAO;AAC1C,mBAAe,QAAQD;AAAA,EACzB;AACF;;;AFvGA,IAAM,SAAqD,CACzD,UACA,MACA,SACG;AACH,WAAS,gBAAgB,QAAQ,IAAI;AAErC,WAAS,gBAAgB,SAAS,IAAW;AAE7C,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,CAAC,cAAc,SAAS,QAAQ,GAAG;AACrC,UAAM,IAAI,MAAM,yBAAyB,QAAQ,EAAE;AAAA,EACrD;AAEA,WAAS,QAAQ,UAAU,oBAAoB,IAAI,CAAC;AAEpD,OAAK;AACP;AAEO,IAAM,kBAAc,sBAAAE,SAAG,QAAQ;AAAA,EACpC,MAAM;AAAA,EACN,SAAS;AACX,CAAC;;;AK5BD,IAAAC,mBAA8C;;;ACA9C,IAAM,qBAAqB,CAAC,QAAgB;AAC1C,SAAO,oBAAa,IAAI,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAKhC;AAEO,IAAM,6BACX,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOpB;;;ADXM,IAAM,WAAsC,CAAC,KAAqB,YAA0B;AACjG,QAAM,UAAU;AAEhB,MAAI,CAAC,QAAQ,MAAM;AACjB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,aAAO,gDAA8B,EAAE,YAAY,QAAQ,MAAM,cAAc,SAAS,aAAa,CAAC;AACxG;;;AEdA,IAAAC,kBAAkC;AAI3B,IAAM,kBAAc,mCAAkB;AAAA,EAC3C,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,WAAW,GAAG,gBAAY,IAAI,iCAAe;AAAA,EAC7C,aAAa;AACf,CAAC;","names":["import_internal","import_stream","Headers","clerkClient","Headers","fp","import_internal","import_backend"]}
+{"version":3,"sources":["../src/index.ts","../src/clerkPlugin.ts","../src/types.ts","../src/withClerkMiddleware.ts","../src/clerkClient.ts","../src/constants.ts","../src/utils.ts","../src/getAuth.ts","../src/errors.ts"],"sourcesContent":["export * from '@clerk/backend';\n\nexport type { ClerkFastifyOptions, FrontendApiProxyOptions } from './types';\n\nexport { clerkPlugin } from './clerkPlugin';\nexport { getAuth } from './getAuth';\nexport { clerkClient } from './clerkClient';\n","import type { FastifyInstance, FastifyPluginCallback } from 'fastify';\nimport fp from 'fastify-plugin';\n\nimport type { ClerkFastifyOptions } from './types';\nimport { ALLOWED_HOOKS } from './types';\nimport { withClerkMiddleware } from './withClerkMiddleware';\n\nconst plugin: FastifyPluginCallback<ClerkFastifyOptions> = (\n  instance: FastifyInstance,\n  opts: ClerkFastifyOptions,\n  done,\n) => {\n  instance.decorateRequest('auth', null);\n  // run clerk as a middleware to all scoped routes\n  const hookName = opts.hookName || 'preHandler';\n  if (!ALLOWED_HOOKS.includes(hookName)) {\n    throw new Error(`Unsupported hookName: ${hookName}`);\n  }\n\n  instance.addHook(hookName, withClerkMiddleware(opts));\n\n  done();\n};\n\nexport const clerkPlugin = fp(plugin, {\n  name: '@clerk/fastify',\n  fastify: '5.x',\n});\n","import type { ClerkOptions } from '@clerk/backend';\nimport type { ShouldProxyFn } from '@clerk/shared/proxy';\n\nexport const ALLOWED_HOOKS = ['onRequest', 'preHandler'] as const;\n\n/**\n * Options for the built-in Frontend API proxy.\n *\n * When enabled, the middleware intercepts requests that match the proxy path\n * (default `/__clerk`) and forwards them to the Clerk Frontend API, allowing\n * the Clerk frontend SDKs to communicate with Clerk without third-party\n * cookie or ad-blocker issues.\n */\nexport interface FrontendApiProxyOptions {\n  /** Toggle the proxy on/off, or supply a function that decides per-request. */\n  enabled: boolean | ShouldProxyFn;\n  /** Custom path prefix for the proxy (default: `/__clerk`). */\n  path?: string;\n}\n\nexport type ClerkFastifyOptions = ClerkOptions & {\n  hookName?: (typeof ALLOWED_HOOKS)[number];\n  frontendApiProxy?: FrontendApiProxyOptions;\n};\n","import { AuthStatus } from '@clerk/backend/internal';\nimport { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, stripTrailingSlashes } from '@clerk/backend/proxy';\nimport type { FastifyReply, FastifyRequest } from 'fastify';\nimport { Readable } from 'stream';\n\nimport { clerkClient } from './clerkClient';\nimport * as constants from './constants';\nimport type { ClerkFastifyOptions } from './types';\nimport { fastifyRequestToRequest, requestToProxyRequest } from './utils';\n\nexport const withClerkMiddleware = (options: ClerkFastifyOptions) => {\n  const frontendApiProxy = options.frontendApiProxy;\n  const proxyPath = stripTrailingSlashes(frontendApiProxy?.path ?? DEFAULT_PROXY_PATH) || DEFAULT_PROXY_PATH;\n\n  return async (fastifyRequest: FastifyRequest, reply: FastifyReply) => {\n    const publishableKey = options.publishableKey || constants.PUBLISHABLE_KEY;\n    const secretKey = options.secretKey || constants.SECRET_KEY;\n\n    // Handle Frontend API proxy requests and auto-derive proxyUrl\n    let resolvedProxyUrl = options.proxyUrl;\n    if (frontendApiProxy) {\n      const requestUrl = new URL(\n        fastifyRequest.url,\n        `${fastifyRequest.protocol}://${fastifyRequest.hostname || 'localhost'}`,\n      );\n      const isEnabled =\n        typeof frontendApiProxy.enabled === 'function'\n          ? frontendApiProxy.enabled(requestUrl)\n          : frontendApiProxy.enabled;\n\n      if (isEnabled) {\n        if (requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + '/')) {\n          const proxyRequest = requestToProxyRequest(fastifyRequest);\n\n          const proxyResponse = await clerkFrontendApiProxy(proxyRequest, {\n            proxyPath,\n            publishableKey,\n            secretKey,\n          });\n\n          reply.code(proxyResponse.status);\n          proxyResponse.headers.forEach((value, key) => {\n            reply.header(key, value);\n          });\n\n          if (proxyResponse.body) {\n            const reader = proxyResponse.body.getReader();\n            const stream = new Readable({\n              async read() {\n                try {\n                  const { done, value } = await reader.read();\n                  if (done) {\n                    this.push(null);\n                  } else {\n                    this.push(Buffer.from(value));\n                  }\n                } catch (error) {\n                  this.destroy(error instanceof Error ? error : new Error(String(error)));\n                }\n              },\n            });\n            return reply.send(stream);\n          }\n          return reply.send();\n        }\n\n        // Pass just the path - the backend resolves it against the request's\n        // public origin (from x-forwarded-* headers).\n        if (!resolvedProxyUrl) {\n          resolvedProxyUrl = proxyPath;\n        }\n      }\n    }\n\n    const req = fastifyRequestToRequest(fastifyRequest);\n\n    const requestState = await clerkClient.authenticateRequest(req, {\n      ...options,\n      secretKey,\n      publishableKey,\n      proxyUrl: resolvedProxyUrl,\n      acceptsToken: 'any',\n    });\n\n    requestState.headers.forEach((value, key) => reply.header(key, value));\n\n    const locationHeader = requestState.headers.get(constants.Headers.Location);\n    if (locationHeader) {\n      return reply.code(307).send();\n    } else if (requestState.status === AuthStatus.Handshake) {\n      throw new Error('Clerk: handshake status without redirect');\n    }\n\n    // @ts-expect-error Inject auth so getAuth can read it\n    fastifyRequest.auth = requestState.toAuth();\n  };\n};\n","import { createClerkClient } from '@clerk/backend';\n\nimport { API_URL, API_VERSION, JWT_KEY, MACHINE_SECRET_KEY, SDK_METADATA, SECRET_KEY } from './constants';\n\nexport const clerkClient = createClerkClient({\n  secretKey: SECRET_KEY,\n  machineSecretKey: MACHINE_SECRET_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n  jwtKey: JWT_KEY,\n  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,\n  sdkMetadata: SDK_METADATA,\n});\n","import { constants } from '@clerk/backend/internal';\nimport { apiUrlFromPublishableKey } from '@clerk/shared/apiUrlFromPublishableKey';\n\nexport const API_VERSION = process.env.CLERK_API_VERSION || 'v1';\nexport const SECRET_KEY = process.env.CLERK_SECRET_KEY || '';\nexport const MACHINE_SECRET_KEY = process.env.CLERK_MACHINE_SECRET_KEY || '';\nexport const PUBLISHABLE_KEY = process.env.CLERK_PUBLISHABLE_KEY || '';\nexport const API_URL = process.env.CLERK_API_URL || apiUrlFromPublishableKey(PUBLISHABLE_KEY);\nexport const JWT_KEY = process.env.CLERK_JWT_KEY || '';\nexport const SDK_METADATA = {\n  name: PACKAGE_NAME,\n  version: PACKAGE_VERSION,\n  environment: process.env.NODE_ENV,\n};\n\nexport const { Cookies, Headers } = constants;\n","import type { FastifyRequest } from 'fastify';\nimport { Readable } from 'stream';\n\nexport const fastifyRequestToRequest = (req: FastifyRequest): Request => {\n  const headers = new Headers(\n    Object.keys(req.headers).reduce((acc, key) => {\n      const value = req.headers[key];\n      if (!value) {\n        return acc;\n      }\n\n      if (typeof value === 'string') {\n        acc.set(key, value);\n      } else {\n        acc.set(key, value.join(','));\n      }\n      return acc;\n    }, new Headers()),\n  );\n\n  // Making some manual tests it seems that FastifyRequest populates the req protocol / hostname\n  // based on the forwarded headers. Nevertheless, we are gonna use a dummy base and the request\n  // will be fixed by the internals of the clerk/backend package\n  const dummyOriginReqUrl = new URL(req.url || '', `${req.protocol}://clerk-dummy`);\n  return new Request(dummyOriginReqUrl, {\n    method: req.method,\n    headers,\n  });\n};\n\n/**\n * Converts a Fastify request to a Fetch API Request with full headers and body streaming,\n * suitable for proxy forwarding.\n */\nexport const requestToProxyRequest = (req: FastifyRequest): Request => {\n  const headers = new Headers();\n  Object.entries(req.headers).forEach(([key, value]) => {\n    if (value) {\n      headers.set(key, Array.isArray(value) ? value.join(', ') : value);\n    }\n  });\n\n  const forwardedProto = req.headers['x-forwarded-proto'];\n  const protoHeader = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;\n  const proto = (protoHeader || '').split(',')[0].trim();\n  const protocol = proto === 'https' || req.protocol === 'https' ? 'https' : 'http';\n\n  const forwardedHost = req.headers['x-forwarded-host'];\n  const hostHeader = Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost;\n  const host = (hostHeader || '').split(',')[0].trim() || req.hostname || 'localhost';\n\n  const url = new URL(req.url || '', `${protocol}://${host}`);\n\n  const hasBody = ['POST', 'PUT', 'PATCH'].includes(req.method);\n\n  return new Request(url.toString(), {\n    method: req.method,\n    headers,\n    body: hasBody ? (Readable.toWeb(req.raw) as ReadableStream) : undefined,\n    // @ts-expect-error - duplex required for streaming bodies but not in all TS definitions\n    duplex: hasBody ? 'half' : undefined,\n  });\n};\n","import type { AuthOptions, GetAuthFn, SignedInAuthObject, SignedOutAuthObject } from '@clerk/backend/internal';\nimport { getAuthObjectForAcceptedToken } from '@clerk/backend/internal';\nimport type { FastifyRequest } from 'fastify';\n\nimport { pluginRegistrationRequired } from './errors';\n\nexport const getAuth: GetAuthFn<FastifyRequest> = ((req: FastifyRequest, options?: AuthOptions) => {\n  const authReq = req as FastifyRequest & { auth: SignedInAuthObject | SignedOutAuthObject };\n\n  if (!authReq.auth) {\n    throw new Error(pluginRegistrationRequired);\n  }\n\n  return getAuthObjectForAcceptedToken({ authObject: authReq.auth, acceptsToken: options?.acceptsToken });\n}) as GetAuthFn<FastifyRequest>;\n","// https://github.com/clerk/javascript/blob/main/packages/remix/src/errors.ts#L1-L0\nconst createErrorMessage = (msg: string) => {\n  return `🔒 Clerk: ${msg.trim()}\n\nFor more info, check out the docs: https://clerk.com/docs,\nor come say hi in our discord server: https://clerk.com/discord\n`;\n};\n\nexport const pluginRegistrationRequired =\n  createErrorMessage(`The \"clerkPlugin\" should be registered before using the \"getAuth\".\nExample:\n\nimport { clerkPlugin } from '@clerk/fastify';\n\nconst server: FastifyInstance = Fastify({ logger: true });\nserver.register(clerkPlugin);\n`);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAAc,2BAAd;;;ACCA,4BAAe;;;ACER,IAAM,gBAAgB,CAAC,aAAa,YAAY;;;ACHvD,IAAAA,mBAA2B;AAC3B,mBAAgF;AAEhF,IAAAC,iBAAyB;;;ACHzB,qBAAkC;;;ACAlC,sBAA0B;AAC1B,sCAAyC;AAElC,IAAM,cAAc,QAAQ,IAAI,qBAAqB;AACrD,IAAM,aAAa,QAAQ,IAAI,oBAAoB;AACnD,IAAM,qBAAqB,QAAQ,IAAI,4BAA4B;AACnE,IAAM,kBAAkB,QAAQ,IAAI,yBAAyB;AAC7D,IAAM,UAAU,QAAQ,IAAI,qBAAiB,0DAAyB,eAAe;AACrF,IAAM,UAAU,QAAQ,IAAI,iBAAiB;AAC7C,IAAM,eAAe;AAAA,EAC1B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,aAAa;AACf;AAEO,IAAM,EAAE,SAAS,SAAAC,SAAQ,IAAI;;;ADX7B,IAAM,kBAAc,kCAAkB;AAAA,EAC3C,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,WAAW,GAAG,gBAAY,IAAI,QAAe;AAAA,EAC7C,aAAa;AACf,CAAC;;;AEXD,oBAAyB;AAElB,IAAM,0BAA0B,CAAC,QAAiC;AACvE,QAAM,UAAU,IAAI;AAAA,IAClB,OAAO,KAAK,IAAI,OAAO,EAAE,OAAO,CAAC,KAAK,QAAQ;AAC5C,YAAM,QAAQ,IAAI,QAAQ,GAAG;AAC7B,UAAI,CAAC,OAAO;AACV,eAAO;AAAA,MACT;AAEA,UAAI,OAAO,UAAU,UAAU;AAC7B,YAAI,IAAI,KAAK,KAAK;AAAA,MACpB,OAAO;AACL,YAAI,IAAI,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,MAC9B;AACA,aAAO;AAAA,IACT,GAAG,IAAI,QAAQ,CAAC;AAAA,EAClB;AAKA,QAAM,oBAAoB,IAAI,IAAI,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,gBAAgB;AAChF,SAAO,IAAI,QAAQ,mBAAmB;AAAA,IACpC,QAAQ,IAAI;AAAA,IACZ;AAAA,EACF,CAAC;AACH;AAMO,IAAM,wBAAwB,CAAC,QAAiC;AACrE,QAAM,UAAU,IAAI,QAAQ;AAC5B,SAAO,QAAQ,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,QAAI,OAAO;AACT,cAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;AAAA,IAClE;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,IAAI,QAAQ,mBAAmB;AACtD,QAAM,cAAc,MAAM,QAAQ,cAAc,IAAI,eAAe,CAAC,IAAI;AACxE,QAAM,SAAS,eAAe,IAAI,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AACrD,QAAM,WAAW,UAAU,WAAW,IAAI,aAAa,UAAU,UAAU;AAE3E,QAAM,gBAAgB,IAAI,QAAQ,kBAAkB;AACpD,QAAM,aAAa,MAAM,QAAQ,aAAa,IAAI,cAAc,CAAC,IAAI;AACrE,QAAM,QAAQ,cAAc,IAAI,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,KAAK,IAAI,YAAY;AAExE,QAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,GAAG,QAAQ,MAAM,IAAI,EAAE;AAE1D,QAAM,UAAU,CAAC,QAAQ,OAAO,OAAO,EAAE,SAAS,IAAI,MAAM;AAE5D,SAAO,IAAI,QAAQ,IAAI,SAAS,GAAG;AAAA,IACjC,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,UAAW,uBAAS,MAAM,IAAI,GAAG,IAAuB;AAAA;AAAA,IAE9D,QAAQ,UAAU,SAAS;AAAA,EAC7B,CAAC;AACH;;;AHpDO,IAAM,sBAAsB,CAAC,YAAiC;AACnE,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAY,mCAAqB,kBAAkB,QAAQ,+BAAkB,KAAK;AAExF,SAAO,OAAO,gBAAgC,UAAwB;AACpE,UAAM,iBAAiB,QAAQ,kBAA4B;AAC3D,UAAM,YAAY,QAAQ,aAAuB;AAGjD,QAAI,mBAAmB,QAAQ;AAC/B,QAAI,kBAAkB;AACpB,YAAM,aAAa,IAAI;AAAA,QACrB,eAAe;AAAA,QACf,GAAG,eAAe,QAAQ,MAAM,eAAe,YAAY,WAAW;AAAA,MACxE;AACA,YAAM,YACJ,OAAO,iBAAiB,YAAY,aAChC,iBAAiB,QAAQ,UAAU,IACnC,iBAAiB;AAEvB,UAAI,WAAW;AACb,YAAI,WAAW,aAAa,aAAa,WAAW,SAAS,WAAW,YAAY,GAAG,GAAG;AACxF,gBAAM,eAAe,sBAAsB,cAAc;AAEzD,gBAAM,gBAAgB,UAAM,oCAAsB,cAAc;AAAA,YAC9D;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,gBAAM,KAAK,cAAc,MAAM;AAC/B,wBAAc,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC5C,kBAAM,OAAO,KAAK,KAAK;AAAA,UACzB,CAAC;AAED,cAAI,cAAc,MAAM;AACtB,kBAAM,SAAS,cAAc,KAAK,UAAU;AAC5C,kBAAM,SAAS,IAAI,wBAAS;AAAA,cAC1B,MAAM,OAAO;AACX,oBAAI;AACF,wBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,sBAAI,MAAM;AACR,yBAAK,KAAK,IAAI;AAAA,kBAChB,OAAO;AACL,yBAAK,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,kBAC9B;AAAA,gBACF,SAAS,OAAO;AACd,uBAAK,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,gBACxE;AAAA,cACF;AAAA,YACF,CAAC;AACD,mBAAO,MAAM,KAAK,MAAM;AAAA,UAC1B;AACA,iBAAO,MAAM,KAAK;AAAA,QACpB;AAIA,YAAI,CAAC,kBAAkB;AACrB,6BAAmB;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,wBAAwB,cAAc;AAElD,UAAM,eAAe,MAAM,YAAY,oBAAoB,KAAK;AAAA,MAC9D,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,IAChB,CAAC;AAED,iBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ,MAAM,OAAO,KAAK,KAAK,CAAC;AAErE,UAAM,iBAAiB,aAAa,QAAQ,IAAcC,SAAQ,QAAQ;AAC1E,QAAI,gBAAgB;AAClB,aAAO,MAAM,KAAK,GAAG,EAAE,KAAK;AAAA,IAC9B,WAAW,aAAa,WAAW,4BAAW,WAAW;AACvD,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAGA,mBAAe,OAAO,aAAa,OAAO;AAAA,EAC5C;AACF;;;AFzFA,IAAM,SAAqD,CACzD,UACA,MACA,SACG;AACH,WAAS,gBAAgB,QAAQ,IAAI;AAErC,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,CAAC,cAAc,SAAS,QAAQ,GAAG;AACrC,UAAM,IAAI,MAAM,yBAAyB,QAAQ,EAAE;AAAA,EACrD;AAEA,WAAS,QAAQ,UAAU,oBAAoB,IAAI,CAAC;AAEpD,OAAK;AACP;AAEO,IAAM,kBAAc,sBAAAC,SAAG,QAAQ;AAAA,EACpC,MAAM;AAAA,EACN,SAAS;AACX,CAAC;;;AM1BD,IAAAC,mBAA8C;;;ACA9C,IAAM,qBAAqB,CAAC,QAAgB;AAC1C,SAAO,oBAAa,IAAI,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAKhC;AAEO,IAAM,6BACX,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOpB;;;ADXM,IAAM,WAAsC,CAAC,KAAqB,YAA0B;AACjG,QAAM,UAAU;AAEhB,MAAI,CAAC,QAAQ,MAAM;AACjB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,aAAO,gDAA8B,EAAE,YAAY,QAAQ,MAAM,cAAc,SAAS,aAAa,CAAC;AACxG;","names":["import_internal","import_stream","Headers","Headers","fp","import_internal"]}

package/dist/index.mjs

@@ -13,11 +13,13 @@ import fp from "fastify-plugin";
 var ALLOWED_HOOKS = ["onRequest", "preHandler"];
 
 // src/withClerkMiddleware.ts
-import { createClerkClient } from "@clerk/backend";
 import { AuthStatus } from "@clerk/backend/internal";
 import { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, stripTrailingSlashes } from "@clerk/backend/proxy";
 import { Readable } from "stream";
 
+// src/clerkClient.ts
+import { createClerkClient } from "@clerk/backend";
+
 // src/constants.ts
 import { constants } from "@clerk/backend/internal";
 import { apiUrlFromPublishableKey } from "@clerk/shared/apiUrlFromPublishableKey";
@@ -29,30 +31,29 @@ var API_URL = process.env.CLERK_API_URL || apiUrlFromPublishableKey(PUBLISHABLE_
 var JWT_KEY = process.env.CLERK_JWT_KEY || "";
 var SDK_METADATA = {
   name: "@clerk/fastify",
-  version: "3.1.27-snapshot.v20260515233846",
+  version: "3.1.27",
   environment: "production"
 };
 var { Cookies, Headers } = constants;
 
+// src/clerkClient.ts
+var clerkClient = createClerkClient({
+  secretKey: SECRET_KEY,
+  machineSecretKey: MACHINE_SECRET_KEY,
+  apiUrl: API_URL,
+  apiVersion: API_VERSION,
+  jwtKey: JWT_KEY,
+  userAgent: `${"@clerk/fastify"}@${"3.1.27"}`,
+  sdkMetadata: SDK_METADATA
+});
+
 // src/withClerkMiddleware.ts
 var withClerkMiddleware = (options) => {
   const frontendApiProxy = options.frontendApiProxy;
   const proxyPath = stripTrailingSlashes(frontendApiProxy?.path ?? DEFAULT_PROXY_PATH) || DEFAULT_PROXY_PATH;
-  const publishableKey = options.publishableKey || PUBLISHABLE_KEY;
-  const secretKey = options.secretKey || SECRET_KEY;
-  const clerkClient2 = createClerkClient({
-    ...options,
-    publishableKey,
-    secretKey,
-    machineSecretKey: options.machineSecretKey || MACHINE_SECRET_KEY,
-    apiUrl: options.apiUrl || API_URL,
-    apiVersion: options.apiVersion || API_VERSION,
-    jwtKey: options.jwtKey || JWT_KEY,
-    userAgent: options.userAgent || `${SDK_METADATA.name}@${SDK_METADATA.version}`,
-    sdkMetadata: options.sdkMetadata || SDK_METADATA
-  });
-  const enableHandshake = options.enableHandshake ?? true;
   return async (fastifyRequest, reply) => {
+    const publishableKey = options.publishableKey || PUBLISHABLE_KEY;
+    const secretKey = options.secretKey || SECRET_KEY;
     let resolvedProxyUrl = options.proxyUrl;
     if (frontendApiProxy) {
       const requestUrl = new URL(
@@ -98,7 +99,7 @@ var withClerkMiddleware = (options) => {
       }
     }
     const req = fastifyRequestToRequest(fastifyRequest);
-    const requestState = await clerkClient2.authenticateRequest(req, {
+    const requestState = await clerkClient.authenticateRequest(req, {
       ...options,
       secretKey,
       publishableKey,
@@ -106,23 +107,19 @@ var withClerkMiddleware = (options) => {
       acceptsToken: "any"
     });
     requestState.headers.forEach((value, key) => reply.header(key, value));
-    if (enableHandshake) {
-      const locationHeader = requestState.headers.get(Headers.Location);
-      if (locationHeader) {
-        return reply.code(307).send();
-      } else if (requestState.status === AuthStatus.Handshake) {
-        throw new Error("Clerk: handshake status without redirect");
-      }
+    const locationHeader = requestState.headers.get(Headers.Location);
+    if (locationHeader) {
+      return reply.code(307).send();
+    } else if (requestState.status === AuthStatus.Handshake) {
+      throw new Error("Clerk: handshake status without redirect");
     }
     fastifyRequest.auth = requestState.toAuth();
-    fastifyRequest.clerk = clerkClient2;
   };
 };
 
 // src/clerkPlugin.ts
 var plugin = (instance, opts, done) => {
   instance.decorateRequest("auth", null);
-  instance.decorateRequest("clerk", null);
   const hookName = opts.hookName || "preHandler";
   if (!ALLOWED_HOOKS.includes(hookName)) {
     throw new Error(`Unsupported hookName: ${hookName}`);
@@ -163,18 +160,6 @@ var getAuth = ((req, options) => {
   }
   return getAuthObjectForAcceptedToken({ authObject: authReq.auth, acceptsToken: options?.acceptsToken });
 });
-
-// src/clerkClient.ts
-import { createClerkClient as createClerkClient2 } from "@clerk/backend";
-var clerkClient = createClerkClient2({
-  secretKey: SECRET_KEY,
-  machineSecretKey: MACHINE_SECRET_KEY,
-  apiUrl: API_URL,
-  apiVersion: API_VERSION,
-  jwtKey: JWT_KEY,
-  userAgent: `${"@clerk/fastify"}@${"3.1.27-snapshot.v20260515233846"}`,
-  sdkMetadata: SDK_METADATA
-});
 export {
   clerkClient,
   clerkPlugin,

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/clerkPlugin.ts","../src/types.ts","../src/withClerkMiddleware.ts","../src/constants.ts","../src/getAuth.ts","../src/errors.ts","../src/clerkClient.ts"],"sourcesContent":["export * from '@clerk/backend';\n\nexport type { ClerkFastifyOptions, FrontendApiProxyOptions } from './types';\n\nexport { clerkPlugin } from './clerkPlugin';\nexport { getAuth } from './getAuth';\nexport { clerkClient } from './clerkClient';\n","import type { FastifyInstance, FastifyPluginCallback } from 'fastify';\nimport fp from 'fastify-plugin';\n\nimport type { ClerkFastifyOptions } from './types';\nimport { ALLOWED_HOOKS } from './types';\nimport { withClerkMiddleware } from './withClerkMiddleware';\n\nconst plugin: FastifyPluginCallback<ClerkFastifyOptions> = (\n  instance: FastifyInstance,\n  opts: ClerkFastifyOptions,\n  done,\n) => {\n  instance.decorateRequest('auth', null);\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  instance.decorateRequest('clerk', null as any);\n  // run clerk as a middleware to all scoped routes\n  const hookName = opts.hookName || 'preHandler';\n  if (!ALLOWED_HOOKS.includes(hookName)) {\n    throw new Error(`Unsupported hookName: ${hookName}`);\n  }\n\n  instance.addHook(hookName, withClerkMiddleware(opts));\n\n  done();\n};\n\nexport const clerkPlugin = fp(plugin, {\n  name: '@clerk/fastify',\n  fastify: '5.x',\n});\n","import type { ClerkClient, ClerkOptions } from '@clerk/backend';\nimport type { ShouldProxyFn } from '@clerk/shared/proxy';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    clerk: ClerkClient;\n  }\n}\n\nexport const ALLOWED_HOOKS = ['onRequest', 'preHandler'] as const;\n\n/**\n * Options for the built-in Frontend API proxy.\n *\n * When enabled, the middleware intercepts requests that match the proxy path\n * (default `/__clerk`) and forwards them to the Clerk Frontend API, allowing\n * the Clerk frontend SDKs to communicate with Clerk without third-party\n * cookie or ad-blocker issues.\n */\nexport interface FrontendApiProxyOptions {\n  /** Toggle the proxy on/off, or supply a function that decides per-request. */\n  enabled: boolean | ShouldProxyFn;\n  /** Custom path prefix for the proxy (default: `/__clerk`). */\n  path?: string;\n}\n\nexport type ClerkFastifyOptions = ClerkOptions & {\n  hookName?: (typeof ALLOWED_HOOKS)[number];\n  frontendApiProxy?: FrontendApiProxyOptions;\n  /**\n   * Whether to enable the handshake flow for session verification.\n   * Disable this when using Clerk with a first-party API backend (e.g. a SPA calling\n   * a Fastify server) to prevent handshake nonce cookies set during OAuth callbacks\n   * from blocking authentication on subsequent API requests.\n   * @default true\n   */\n  enableHandshake?: boolean;\n};\n","import { createClerkClient } from '@clerk/backend';\nimport { AuthStatus } from '@clerk/backend/internal';\nimport { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, stripTrailingSlashes } from '@clerk/backend/proxy';\nimport type { FastifyReply, FastifyRequest } from 'fastify';\nimport { Readable } from 'stream';\n\nimport * as constants from './constants';\nimport type { ClerkFastifyOptions } from './types';\nimport { fastifyRequestToRequest, requestToProxyRequest } from './utils';\n\nexport const withClerkMiddleware = (options: ClerkFastifyOptions) => {\n  const frontendApiProxy = options.frontendApiProxy;\n  const proxyPath = stripTrailingSlashes(frontendApiProxy?.path ?? DEFAULT_PROXY_PATH) || DEFAULT_PROXY_PATH;\n  const publishableKey = options.publishableKey || constants.PUBLISHABLE_KEY;\n  const secretKey = options.secretKey || constants.SECRET_KEY;\n  const clerkClient = createClerkClient({\n    ...options,\n    publishableKey,\n    secretKey,\n    machineSecretKey: options.machineSecretKey || constants.MACHINE_SECRET_KEY,\n    apiUrl: options.apiUrl || constants.API_URL,\n    apiVersion: options.apiVersion || constants.API_VERSION,\n    jwtKey: options.jwtKey || constants.JWT_KEY,\n    userAgent: options.userAgent || `${constants.SDK_METADATA.name}@${constants.SDK_METADATA.version}`,\n    sdkMetadata: options.sdkMetadata || constants.SDK_METADATA,\n  });\n  const enableHandshake = options.enableHandshake ?? true;\n\n  return async (fastifyRequest: FastifyRequest, reply: FastifyReply) => {\n    // Handle Frontend API proxy requests and auto-derive proxyUrl\n    let resolvedProxyUrl = options.proxyUrl;\n    if (frontendApiProxy) {\n      const requestUrl = new URL(\n        fastifyRequest.url,\n        `${fastifyRequest.protocol}://${fastifyRequest.hostname || 'localhost'}`,\n      );\n      const isEnabled =\n        typeof frontendApiProxy.enabled === 'function'\n          ? frontendApiProxy.enabled(requestUrl)\n          : frontendApiProxy.enabled;\n\n      if (isEnabled) {\n        if (requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + '/')) {\n          const proxyRequest = requestToProxyRequest(fastifyRequest);\n\n          const proxyResponse = await clerkFrontendApiProxy(proxyRequest, {\n            proxyPath,\n            publishableKey,\n            secretKey,\n          });\n\n          reply.code(proxyResponse.status);\n          proxyResponse.headers.forEach((value, key) => {\n            reply.header(key, value);\n          });\n\n          if (proxyResponse.body) {\n            const reader = proxyResponse.body.getReader();\n            const stream = new Readable({\n              async read() {\n                try {\n                  const { done, value } = await reader.read();\n                  if (done) {\n                    this.push(null);\n                  } else {\n                    this.push(Buffer.from(value));\n                  }\n                } catch (error) {\n                  this.destroy(error instanceof Error ? error : new Error(String(error)));\n                }\n              },\n            });\n            return reply.send(stream);\n          }\n          return reply.send();\n        }\n\n        // Pass just the path - the backend resolves it against the request's\n        // public origin (from x-forwarded-* headers).\n        if (!resolvedProxyUrl) {\n          resolvedProxyUrl = proxyPath;\n        }\n      }\n    }\n\n    const req = fastifyRequestToRequest(fastifyRequest);\n\n    const requestState = await clerkClient.authenticateRequest(req, {\n      ...options,\n      secretKey,\n      publishableKey,\n      proxyUrl: resolvedProxyUrl,\n      acceptsToken: 'any',\n    });\n\n    requestState.headers.forEach((value, key) => reply.header(key, value));\n\n    if (enableHandshake) {\n      const locationHeader = requestState.headers.get(constants.Headers.Location);\n      if (locationHeader) {\n        return reply.code(307).send();\n      } else if (requestState.status === AuthStatus.Handshake) {\n        throw new Error('Clerk: handshake status without redirect');\n      }\n    }\n\n    // @ts-expect-error Inject auth so getAuth can read it\n    fastifyRequest.auth = requestState.toAuth();\n    fastifyRequest.clerk = clerkClient;\n  };\n};\n","import { constants } from '@clerk/backend/internal';\nimport { apiUrlFromPublishableKey } from '@clerk/shared/apiUrlFromPublishableKey';\n\nexport const API_VERSION = process.env.CLERK_API_VERSION || 'v1';\nexport const SECRET_KEY = process.env.CLERK_SECRET_KEY || '';\nexport const MACHINE_SECRET_KEY = process.env.CLERK_MACHINE_SECRET_KEY || '';\nexport const PUBLISHABLE_KEY = process.env.CLERK_PUBLISHABLE_KEY || '';\nexport const API_URL = process.env.CLERK_API_URL || apiUrlFromPublishableKey(PUBLISHABLE_KEY);\nexport const JWT_KEY = process.env.CLERK_JWT_KEY || '';\nexport const SDK_METADATA = {\n  name: PACKAGE_NAME,\n  version: PACKAGE_VERSION,\n  environment: process.env.NODE_ENV,\n};\n\nexport const { Cookies, Headers } = constants;\n","import type { AuthOptions, GetAuthFn, SignedInAuthObject, SignedOutAuthObject } from '@clerk/backend/internal';\nimport { getAuthObjectForAcceptedToken } from '@clerk/backend/internal';\nimport type { FastifyRequest } from 'fastify';\n\nimport { pluginRegistrationRequired } from './errors';\n\nexport const getAuth: GetAuthFn<FastifyRequest> = ((req: FastifyRequest, options?: AuthOptions) => {\n  const authReq = req as FastifyRequest & { auth: SignedInAuthObject | SignedOutAuthObject };\n\n  if (!authReq.auth) {\n    throw new Error(pluginRegistrationRequired);\n  }\n\n  return getAuthObjectForAcceptedToken({ authObject: authReq.auth, acceptsToken: options?.acceptsToken });\n}) as GetAuthFn<FastifyRequest>;\n","// https://github.com/clerk/javascript/blob/main/packages/remix/src/errors.ts#L1-L0\nconst createErrorMessage = (msg: string) => {\n  return `🔒 Clerk: ${msg.trim()}\n\nFor more info, check out the docs: https://clerk.com/docs,\nor come say hi in our discord server: https://clerk.com/discord\n`;\n};\n\nexport const pluginRegistrationRequired =\n  createErrorMessage(`The \"clerkPlugin\" should be registered before using the \"getAuth\".\nExample:\n\nimport { clerkPlugin } from '@clerk/fastify';\n\nconst server: FastifyInstance = Fastify({ logger: true });\nserver.register(clerkPlugin);\n`);\n","import { createClerkClient } from '@clerk/backend';\n\nimport { API_URL, API_VERSION, JWT_KEY, MACHINE_SECRET_KEY, SDK_METADATA, SECRET_KEY } from './constants';\n\nexport const clerkClient = createClerkClient({\n  secretKey: SECRET_KEY,\n  machineSecretKey: MACHINE_SECRET_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n  jwtKey: JWT_KEY,\n  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,\n  sdkMetadata: SDK_METADATA,\n});\n"],"mappings":";;;;;;AAAA,cAAc;;;ACCd,OAAO,QAAQ;;;ACQR,IAAM,gBAAgB,CAAC,aAAa,YAAY;;;ACTvD,SAAS,yBAAyB;AAClC,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB,oBAAoB,4BAA4B;AAEhF,SAAS,gBAAgB;;;ACJzB,SAAS,iBAAiB;AAC1B,SAAS,gCAAgC;AAElC,IAAM,cAAc,QAAQ,IAAI,qBAAqB;AACrD,IAAM,aAAa,QAAQ,IAAI,oBAAoB;AACnD,IAAM,qBAAqB,QAAQ,IAAI,4BAA4B;AACnE,IAAM,kBAAkB,QAAQ,IAAI,yBAAyB;AAC7D,IAAM,UAAU,QAAQ,IAAI,iBAAiB,yBAAyB,eAAe;AACrF,IAAM,UAAU,QAAQ,IAAI,iBAAiB;AAC7C,IAAM,eAAe;AAAA,EAC1B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,aAAa;AACf;AAEO,IAAM,EAAE,SAAS,QAAQ,IAAI;;;ADL7B,IAAM,sBAAsB,CAAC,YAAiC;AACnE,QAAM,mBAAmB,QAAQ;AACjC,QAAM,YAAY,qBAAqB,kBAAkB,QAAQ,kBAAkB,KAAK;AACxF,QAAM,iBAAiB,QAAQ,kBAA4B;AAC3D,QAAM,YAAY,QAAQ,aAAuB;AACjD,QAAMA,eAAc,kBAAkB;AAAA,IACpC,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA,kBAAkB,QAAQ,oBAA8B;AAAA,IACxD,QAAQ,QAAQ,UAAoB;AAAA,IACpC,YAAY,QAAQ,cAAwB;AAAA,IAC5C,QAAQ,QAAQ,UAAoB;AAAA,IACpC,WAAW,QAAQ,aAAa,GAAa,aAAa,IAAI,IAAc,aAAa,OAAO;AAAA,IAChG,aAAa,QAAQ,eAAyB;AAAA,EAChD,CAAC;AACD,QAAM,kBAAkB,QAAQ,mBAAmB;AAEnD,SAAO,OAAO,gBAAgC,UAAwB;AAEpE,QAAI,mBAAmB,QAAQ;AAC/B,QAAI,kBAAkB;AACpB,YAAM,aAAa,IAAI;AAAA,QACrB,eAAe;AAAA,QACf,GAAG,eAAe,QAAQ,MAAM,eAAe,YAAY,WAAW;AAAA,MACxE;AACA,YAAM,YACJ,OAAO,iBAAiB,YAAY,aAChC,iBAAiB,QAAQ,UAAU,IACnC,iBAAiB;AAEvB,UAAI,WAAW;AACb,YAAI,WAAW,aAAa,aAAa,WAAW,SAAS,WAAW,YAAY,GAAG,GAAG;AACxF,gBAAM,eAAe,sBAAsB,cAAc;AAEzD,gBAAM,gBAAgB,MAAM,sBAAsB,cAAc;AAAA,YAC9D;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,gBAAM,KAAK,cAAc,MAAM;AAC/B,wBAAc,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC5C,kBAAM,OAAO,KAAK,KAAK;AAAA,UACzB,CAAC;AAED,cAAI,cAAc,MAAM;AACtB,kBAAM,SAAS,cAAc,KAAK,UAAU;AAC5C,kBAAM,SAAS,IAAI,SAAS;AAAA,cAC1B,MAAM,OAAO;AACX,oBAAI;AACF,wBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,sBAAI,MAAM;AACR,yBAAK,KAAK,IAAI;AAAA,kBAChB,OAAO;AACL,yBAAK,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,kBAC9B;AAAA,gBACF,SAAS,OAAO;AACd,uBAAK,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,gBACxE;AAAA,cACF;AAAA,YACF,CAAC;AACD,mBAAO,MAAM,KAAK,MAAM;AAAA,UAC1B;AACA,iBAAO,MAAM,KAAK;AAAA,QACpB;AAIA,YAAI,CAAC,kBAAkB;AACrB,6BAAmB;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,wBAAwB,cAAc;AAElD,UAAM,eAAe,MAAMA,aAAY,oBAAoB,KAAK;AAAA,MAC9D,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,IAChB,CAAC;AAED,iBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ,MAAM,OAAO,KAAK,KAAK,CAAC;AAErE,QAAI,iBAAiB;AACnB,YAAM,iBAAiB,aAAa,QAAQ,IAAc,QAAQ,QAAQ;AAC1E,UAAI,gBAAgB;AAClB,eAAO,MAAM,KAAK,GAAG,EAAE,KAAK;AAAA,MAC9B,WAAW,aAAa,WAAW,WAAW,WAAW;AACvD,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AAAA,IACF;AAGA,mBAAe,OAAO,aAAa,OAAO;AAC1C,mBAAe,QAAQA;AAAA,EACzB;AACF;;;AFvGA,IAAM,SAAqD,CACzD,UACA,MACA,SACG;AACH,WAAS,gBAAgB,QAAQ,IAAI;AAErC,WAAS,gBAAgB,SAAS,IAAW;AAE7C,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,CAAC,cAAc,SAAS,QAAQ,GAAG;AACrC,UAAM,IAAI,MAAM,yBAAyB,QAAQ,EAAE;AAAA,EACrD;AAEA,WAAS,QAAQ,UAAU,oBAAoB,IAAI,CAAC;AAEpD,OAAK;AACP;AAEO,IAAM,cAAc,GAAG,QAAQ;AAAA,EACpC,MAAM;AAAA,EACN,SAAS;AACX,CAAC;;;AI5BD,SAAS,qCAAqC;;;ACA9C,IAAM,qBAAqB,CAAC,QAAgB;AAC1C,SAAO,oBAAa,IAAI,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAKhC;AAEO,IAAM,6BACX,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOpB;;;ADXM,IAAM,WAAsC,CAAC,KAAqB,YAA0B;AACjG,QAAM,UAAU;AAEhB,MAAI,CAAC,QAAQ,MAAM;AACjB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,SAAO,8BAA8B,EAAE,YAAY,QAAQ,MAAM,cAAc,SAAS,aAAa,CAAC;AACxG;;;AEdA,SAAS,qBAAAC,0BAAyB;AAI3B,IAAM,cAAcC,mBAAkB;AAAA,EAC3C,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,WAAW,GAAG,gBAAY,IAAI,iCAAe;AAAA,EAC7C,aAAa;AACf,CAAC;","names":["clerkClient","createClerkClient","createClerkClient"]}
+{"version":3,"sources":["../src/index.ts","../src/clerkPlugin.ts","../src/types.ts","../src/withClerkMiddleware.ts","../src/clerkClient.ts","../src/constants.ts","../src/getAuth.ts","../src/errors.ts"],"sourcesContent":["export * from '@clerk/backend';\n\nexport type { ClerkFastifyOptions, FrontendApiProxyOptions } from './types';\n\nexport { clerkPlugin } from './clerkPlugin';\nexport { getAuth } from './getAuth';\nexport { clerkClient } from './clerkClient';\n","import type { FastifyInstance, FastifyPluginCallback } from 'fastify';\nimport fp from 'fastify-plugin';\n\nimport type { ClerkFastifyOptions } from './types';\nimport { ALLOWED_HOOKS } from './types';\nimport { withClerkMiddleware } from './withClerkMiddleware';\n\nconst plugin: FastifyPluginCallback<ClerkFastifyOptions> = (\n  instance: FastifyInstance,\n  opts: ClerkFastifyOptions,\n  done,\n) => {\n  instance.decorateRequest('auth', null);\n  // run clerk as a middleware to all scoped routes\n  const hookName = opts.hookName || 'preHandler';\n  if (!ALLOWED_HOOKS.includes(hookName)) {\n    throw new Error(`Unsupported hookName: ${hookName}`);\n  }\n\n  instance.addHook(hookName, withClerkMiddleware(opts));\n\n  done();\n};\n\nexport const clerkPlugin = fp(plugin, {\n  name: '@clerk/fastify',\n  fastify: '5.x',\n});\n","import type { ClerkOptions } from '@clerk/backend';\nimport type { ShouldProxyFn } from '@clerk/shared/proxy';\n\nexport const ALLOWED_HOOKS = ['onRequest', 'preHandler'] as const;\n\n/**\n * Options for the built-in Frontend API proxy.\n *\n * When enabled, the middleware intercepts requests that match the proxy path\n * (default `/__clerk`) and forwards them to the Clerk Frontend API, allowing\n * the Clerk frontend SDKs to communicate with Clerk without third-party\n * cookie or ad-blocker issues.\n */\nexport interface FrontendApiProxyOptions {\n  /** Toggle the proxy on/off, or supply a function that decides per-request. */\n  enabled: boolean | ShouldProxyFn;\n  /** Custom path prefix for the proxy (default: `/__clerk`). */\n  path?: string;\n}\n\nexport type ClerkFastifyOptions = ClerkOptions & {\n  hookName?: (typeof ALLOWED_HOOKS)[number];\n  frontendApiProxy?: FrontendApiProxyOptions;\n};\n","import { AuthStatus } from '@clerk/backend/internal';\nimport { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, stripTrailingSlashes } from '@clerk/backend/proxy';\nimport type { FastifyReply, FastifyRequest } from 'fastify';\nimport { Readable } from 'stream';\n\nimport { clerkClient } from './clerkClient';\nimport * as constants from './constants';\nimport type { ClerkFastifyOptions } from './types';\nimport { fastifyRequestToRequest, requestToProxyRequest } from './utils';\n\nexport const withClerkMiddleware = (options: ClerkFastifyOptions) => {\n  const frontendApiProxy = options.frontendApiProxy;\n  const proxyPath = stripTrailingSlashes(frontendApiProxy?.path ?? DEFAULT_PROXY_PATH) || DEFAULT_PROXY_PATH;\n\n  return async (fastifyRequest: FastifyRequest, reply: FastifyReply) => {\n    const publishableKey = options.publishableKey || constants.PUBLISHABLE_KEY;\n    const secretKey = options.secretKey || constants.SECRET_KEY;\n\n    // Handle Frontend API proxy requests and auto-derive proxyUrl\n    let resolvedProxyUrl = options.proxyUrl;\n    if (frontendApiProxy) {\n      const requestUrl = new URL(\n        fastifyRequest.url,\n        `${fastifyRequest.protocol}://${fastifyRequest.hostname || 'localhost'}`,\n      );\n      const isEnabled =\n        typeof frontendApiProxy.enabled === 'function'\n          ? frontendApiProxy.enabled(requestUrl)\n          : frontendApiProxy.enabled;\n\n      if (isEnabled) {\n        if (requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + '/')) {\n          const proxyRequest = requestToProxyRequest(fastifyRequest);\n\n          const proxyResponse = await clerkFrontendApiProxy(proxyRequest, {\n            proxyPath,\n            publishableKey,\n            secretKey,\n          });\n\n          reply.code(proxyResponse.status);\n          proxyResponse.headers.forEach((value, key) => {\n            reply.header(key, value);\n          });\n\n          if (proxyResponse.body) {\n            const reader = proxyResponse.body.getReader();\n            const stream = new Readable({\n              async read() {\n                try {\n                  const { done, value } = await reader.read();\n                  if (done) {\n                    this.push(null);\n                  } else {\n                    this.push(Buffer.from(value));\n                  }\n                } catch (error) {\n                  this.destroy(error instanceof Error ? error : new Error(String(error)));\n                }\n              },\n            });\n            return reply.send(stream);\n          }\n          return reply.send();\n        }\n\n        // Pass just the path - the backend resolves it against the request's\n        // public origin (from x-forwarded-* headers).\n        if (!resolvedProxyUrl) {\n          resolvedProxyUrl = proxyPath;\n        }\n      }\n    }\n\n    const req = fastifyRequestToRequest(fastifyRequest);\n\n    const requestState = await clerkClient.authenticateRequest(req, {\n      ...options,\n      secretKey,\n      publishableKey,\n      proxyUrl: resolvedProxyUrl,\n      acceptsToken: 'any',\n    });\n\n    requestState.headers.forEach((value, key) => reply.header(key, value));\n\n    const locationHeader = requestState.headers.get(constants.Headers.Location);\n    if (locationHeader) {\n      return reply.code(307).send();\n    } else if (requestState.status === AuthStatus.Handshake) {\n      throw new Error('Clerk: handshake status without redirect');\n    }\n\n    // @ts-expect-error Inject auth so getAuth can read it\n    fastifyRequest.auth = requestState.toAuth();\n  };\n};\n","import { createClerkClient } from '@clerk/backend';\n\nimport { API_URL, API_VERSION, JWT_KEY, MACHINE_SECRET_KEY, SDK_METADATA, SECRET_KEY } from './constants';\n\nexport const clerkClient = createClerkClient({\n  secretKey: SECRET_KEY,\n  machineSecretKey: MACHINE_SECRET_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n  jwtKey: JWT_KEY,\n  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,\n  sdkMetadata: SDK_METADATA,\n});\n","import { constants } from '@clerk/backend/internal';\nimport { apiUrlFromPublishableKey } from '@clerk/shared/apiUrlFromPublishableKey';\n\nexport const API_VERSION = process.env.CLERK_API_VERSION || 'v1';\nexport const SECRET_KEY = process.env.CLERK_SECRET_KEY || '';\nexport const MACHINE_SECRET_KEY = process.env.CLERK_MACHINE_SECRET_KEY || '';\nexport const PUBLISHABLE_KEY = process.env.CLERK_PUBLISHABLE_KEY || '';\nexport const API_URL = process.env.CLERK_API_URL || apiUrlFromPublishableKey(PUBLISHABLE_KEY);\nexport const JWT_KEY = process.env.CLERK_JWT_KEY || '';\nexport const SDK_METADATA = {\n  name: PACKAGE_NAME,\n  version: PACKAGE_VERSION,\n  environment: process.env.NODE_ENV,\n};\n\nexport const { Cookies, Headers } = constants;\n","import type { AuthOptions, GetAuthFn, SignedInAuthObject, SignedOutAuthObject } from '@clerk/backend/internal';\nimport { getAuthObjectForAcceptedToken } from '@clerk/backend/internal';\nimport type { FastifyRequest } from 'fastify';\n\nimport { pluginRegistrationRequired } from './errors';\n\nexport const getAuth: GetAuthFn<FastifyRequest> = ((req: FastifyRequest, options?: AuthOptions) => {\n  const authReq = req as FastifyRequest & { auth: SignedInAuthObject | SignedOutAuthObject };\n\n  if (!authReq.auth) {\n    throw new Error(pluginRegistrationRequired);\n  }\n\n  return getAuthObjectForAcceptedToken({ authObject: authReq.auth, acceptsToken: options?.acceptsToken });\n}) as GetAuthFn<FastifyRequest>;\n","// https://github.com/clerk/javascript/blob/main/packages/remix/src/errors.ts#L1-L0\nconst createErrorMessage = (msg: string) => {\n  return `🔒 Clerk: ${msg.trim()}\n\nFor more info, check out the docs: https://clerk.com/docs,\nor come say hi in our discord server: https://clerk.com/discord\n`;\n};\n\nexport const pluginRegistrationRequired =\n  createErrorMessage(`The \"clerkPlugin\" should be registered before using the \"getAuth\".\nExample:\n\nimport { clerkPlugin } from '@clerk/fastify';\n\nconst server: FastifyInstance = Fastify({ logger: true });\nserver.register(clerkPlugin);\n`);\n"],"mappings":";;;;;;AAAA,cAAc;;;ACCd,OAAO,QAAQ;;;ACER,IAAM,gBAAgB,CAAC,aAAa,YAAY;;;ACHvD,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB,oBAAoB,4BAA4B;AAEhF,SAAS,gBAAgB;;;ACHzB,SAAS,yBAAyB;;;ACAlC,SAAS,iBAAiB;AAC1B,SAAS,gCAAgC;AAElC,IAAM,cAAc,QAAQ,IAAI,qBAAqB;AACrD,IAAM,aAAa,QAAQ,IAAI,oBAAoB;AACnD,IAAM,qBAAqB,QAAQ,IAAI,4BAA4B;AACnE,IAAM,kBAAkB,QAAQ,IAAI,yBAAyB;AAC7D,IAAM,UAAU,QAAQ,IAAI,iBAAiB,yBAAyB,eAAe;AACrF,IAAM,UAAU,QAAQ,IAAI,iBAAiB;AAC7C,IAAM,eAAe;AAAA,EAC1B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,aAAa;AACf;AAEO,IAAM,EAAE,SAAS,QAAQ,IAAI;;;ADX7B,IAAM,cAAc,kBAAkB;AAAA,EAC3C,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,WAAW,GAAG,gBAAY,IAAI,QAAe;AAAA,EAC7C,aAAa;AACf,CAAC;;;ADFM,IAAM,sBAAsB,CAAC,YAAiC;AACnE,QAAM,mBAAmB,QAAQ;AACjC,QAAM,YAAY,qBAAqB,kBAAkB,QAAQ,kBAAkB,KAAK;AAExF,SAAO,OAAO,gBAAgC,UAAwB;AACpE,UAAM,iBAAiB,QAAQ,kBAA4B;AAC3D,UAAM,YAAY,QAAQ,aAAuB;AAGjD,QAAI,mBAAmB,QAAQ;AAC/B,QAAI,kBAAkB;AACpB,YAAM,aAAa,IAAI;AAAA,QACrB,eAAe;AAAA,QACf,GAAG,eAAe,QAAQ,MAAM,eAAe,YAAY,WAAW;AAAA,MACxE;AACA,YAAM,YACJ,OAAO,iBAAiB,YAAY,aAChC,iBAAiB,QAAQ,UAAU,IACnC,iBAAiB;AAEvB,UAAI,WAAW;AACb,YAAI,WAAW,aAAa,aAAa,WAAW,SAAS,WAAW,YAAY,GAAG,GAAG;AACxF,gBAAM,eAAe,sBAAsB,cAAc;AAEzD,gBAAM,gBAAgB,MAAM,sBAAsB,cAAc;AAAA,YAC9D;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,gBAAM,KAAK,cAAc,MAAM;AAC/B,wBAAc,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC5C,kBAAM,OAAO,KAAK,KAAK;AAAA,UACzB,CAAC;AAED,cAAI,cAAc,MAAM;AACtB,kBAAM,SAAS,cAAc,KAAK,UAAU;AAC5C,kBAAM,SAAS,IAAI,SAAS;AAAA,cAC1B,MAAM,OAAO;AACX,oBAAI;AACF,wBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,sBAAI,MAAM;AACR,yBAAK,KAAK,IAAI;AAAA,kBAChB,OAAO;AACL,yBAAK,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,kBAC9B;AAAA,gBACF,SAAS,OAAO;AACd,uBAAK,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;AAAA,gBACxE;AAAA,cACF;AAAA,YACF,CAAC;AACD,mBAAO,MAAM,KAAK,MAAM;AAAA,UAC1B;AACA,iBAAO,MAAM,KAAK;AAAA,QACpB;AAIA,YAAI,CAAC,kBAAkB;AACrB,6BAAmB;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,wBAAwB,cAAc;AAElD,UAAM,eAAe,MAAM,YAAY,oBAAoB,KAAK;AAAA,MAC9D,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,IAChB,CAAC;AAED,iBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ,MAAM,OAAO,KAAK,KAAK,CAAC;AAErE,UAAM,iBAAiB,aAAa,QAAQ,IAAc,QAAQ,QAAQ;AAC1E,QAAI,gBAAgB;AAClB,aAAO,MAAM,KAAK,GAAG,EAAE,KAAK;AAAA,IAC9B,WAAW,aAAa,WAAW,WAAW,WAAW;AACvD,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAGA,mBAAe,OAAO,aAAa,OAAO;AAAA,EAC5C;AACF;;;AFzFA,IAAM,SAAqD,CACzD,UACA,MACA,SACG;AACH,WAAS,gBAAgB,QAAQ,IAAI;AAErC,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,CAAC,cAAc,SAAS,QAAQ,GAAG;AACrC,UAAM,IAAI,MAAM,yBAAyB,QAAQ,EAAE;AAAA,EACrD;AAEA,WAAS,QAAQ,UAAU,oBAAoB,IAAI,CAAC;AAEpD,OAAK;AACP;AAEO,IAAM,cAAc,GAAG,QAAQ;AAAA,EACpC,MAAM;AAAA,EACN,SAAS;AACX,CAAC;;;AK1BD,SAAS,qCAAqC;;;ACA9C,IAAM,qBAAqB,CAAC,QAAgB;AAC1C,SAAO,oBAAa,IAAI,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAKhC;AAEO,IAAM,6BACX,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOpB;;;ADXM,IAAM,WAAsC,CAAC,KAAqB,YAA0B;AACjG,QAAM,UAAU;AAEhB,MAAI,CAAC,QAAQ,MAAM;AACjB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,SAAO,8BAA8B,EAAE,YAAY,QAAQ,MAAM,cAAc,SAAS,aAAa,CAAC;AACxG;","names":[]}

package/dist/types.d.mts

@@ -1,4 +1,4 @@
 export * from '@clerk/shared/types';
-export { C as ClerkFastifyOptions } from './index-C5pGnL7a.mjs';
+export { C as ClerkFastifyOptions } from './index-CWnSaB0B.mjs';
 import '@clerk/backend';
 import '@clerk/shared/proxy';

package/dist/types.d.ts

@@ -1,4 +1,4 @@
 export * from '@clerk/shared/types';
-export { C as ClerkFastifyOptions } from './index-C5pGnL7a.js';
+export { C as ClerkFastifyOptions } from './index-CWnSaB0B.js';
 import '@clerk/backend';
 import '@clerk/shared/proxy';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clerk/fastify",
-  "version": "3.1.27-snapshot.v20260515233846",
+  "version": "3.1.27",
   "description": "Clerk SDK for Fastify",
   "keywords": [
     "auth",
@@ -62,8 +62,8 @@
   "dependencies": {
     "cookies": "0.9.1",
     "fastify-plugin": "^5.1.0",
-    "@clerk/backend": "3.4.9-snapshot.v20260515233846",
-    "@clerk/shared": "4.12.0-snapshot.v20260515233846"
+    "@clerk/backend": "^3.4.9",
+    "@clerk/shared": "^4.12.0"
   },
   "devDependencies": {
     "fastify": "^5.8.5"