@clerk/nextjs 7.2.4-snapshot.v20260421194054 → 7.2.4

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/index.ts"],"sourcesContent":["/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  AuthenticateWithRedirectCallback,\n  ClerkDegraded,\n  ClerkFailed,\n  ClerkLoaded,\n  ClerkLoading,\n  UNSAFE_PortalProvider,\n  RedirectToCreateOrganization,\n  RedirectToOrganizationProfile,\n  RedirectToSignIn,\n  RedirectToSignUp,\n  RedirectToTasks,\n  RedirectToUserProfile,\n} from './client-boundary/controlComponents';\n\n/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  APIKeys,\n  CreateOrganization,\n  GoogleOneTap,\n  OrganizationList,\n  OrganizationProfile,\n  OrganizationSwitcher,\n  PricingTable,\n  SignIn,\n  SignInButton,\n  SignInWithMetamaskButton,\n  SignOutButton,\n  SignUp,\n  SignUpButton,\n  TaskChooseOrganization,\n  TaskResetPassword,\n  TaskSetupMFA,\n  UserAvatar,\n  UserButton,\n  UserProfile,\n  Waitlist,\n} from './client-boundary/uiComponents';\n\n/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  useAuth,\n  useClerk,\n  useEmailLink,\n  useOrganization,\n  useOrganizationCreationDefaults,\n  useOrganizationList,\n  useReverification,\n  useAPIKeys,\n  useSession,\n  useSessionList,\n  useSignIn,\n  useSignUp,\n  useWaitlist,\n  useUser,\n} from './client-boundary/hooks';\n\nexport { getToken } from '@clerk/shared/getToken';\n\n/**\n * Conditionally export components that exhibit different behavior\n * when used in /app vs /pages.\n * We defined the runtime and the type values explicitly,\n * because TS will not recognize the subpath import unless the HOST\n * application sets moduleResolution to 'NodeNext'.\n */\n// @ts-ignore\nimport * as ComponentsModule from '#components';\n\nimport type { ServerComponentsServerModuleTypes } from './components.server';\n\nexport const ClerkProvider = ComponentsModule.ClerkProvider as ServerComponentsServerModuleTypes['ClerkProvider'];\nexport const Show = ComponentsModule.Show as ServerComponentsServerModuleTypes['Show'];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,+BAaO;AAMP,0BAqBO;AAMP,mBAeO;AAEP,sBAAyB;AAUzB,uBAAkC;AAI3B,MAAM,gBAAgB,iBAAiB;AACvC,MAAM,OAAO,iBAAiB;","names":[]}
+{"version":3,"sources":["../../src/index.ts"],"sourcesContent":["/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  AuthenticateWithRedirectCallback,\n  ClerkDegraded,\n  ClerkFailed,\n  ClerkLoaded,\n  ClerkLoading,\n  UNSAFE_PortalProvider,\n  RedirectToCreateOrganization,\n  RedirectToOrganizationProfile,\n  RedirectToSignIn,\n  RedirectToSignUp,\n  RedirectToTasks,\n  RedirectToUserProfile,\n} from './client-boundary/controlComponents';\n\n/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  APIKeys,\n  CreateOrganization,\n  GoogleOneTap,\n  OrganizationList,\n  OrganizationProfile,\n  OrganizationSwitcher,\n  PricingTable,\n  SignIn,\n  SignInButton,\n  SignInWithMetamaskButton,\n  SignOutButton,\n  SignUp,\n  SignUpButton,\n  TaskChooseOrganization,\n  TaskResetPassword,\n  TaskSetupMFA,\n  UserAvatar,\n  UserButton,\n  UserProfile,\n  Waitlist,\n} from './client-boundary/uiComponents';\n\n/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  useAuth,\n  useClerk,\n  useEmailLink,\n  useOrganization,\n  useOrganizationCreationDefaults,\n  useOrganizationList,\n  useReverification,\n  useAPIKeys,\n  useSession,\n  useSessionList,\n  useSignIn,\n  useSignUp,\n  useWaitlist,\n  useUser,\n} from './client-boundary/hooks';\n\nexport { getToken } from '@clerk/shared/getToken';\n\n/**\n * Conditionally export components that exhibit different behavior\n * when used in /app vs /pages.\n * We defined the runtime and the type values explicitly,\n * because TS will not recognize the subpath import unless the HOST\n * application sets moduleResolution to 'NodeNext'.\n */\n// @ts-ignore\nimport * as ComponentsModule from '#components';\n\nimport type { ServerComponentsServerModuleTypes } from './components.server';\n\nexport const ClerkProvider = ComponentsModule.ClerkProvider as ServerComponentsServerModuleTypes['ClerkProvider'];\nexport const Show = ComponentsModule.Show as ServerComponentsServerModuleTypes['Show'];\n\n/**\n * `auth` is not available from this import path.\n *\n * **To fix this error:**\n * ```diff\n * - import { auth } from '@clerk/nextjs'\n * + import { auth } from '@clerk/nextjs/server'\n * ```\n *\n * The `auth` function is only available in server-side contexts:\n * API Routes, Server Components, Server Actions, and Middleware.\n */\nexport declare const auth: never;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,+BAaO;AAMP,0BAqBO;AAMP,mBAeO;AAEP,sBAAyB;AAUzB,uBAAkC;AAI3B,MAAM,gBAAgB,iBAAiB;AACvC,MAAM,OAAO,iBAAiB;","names":[]}

package/dist/cjs/server/clerkMiddleware.js

@@ -27,7 +27,6 @@ var import_proxy = require("@clerk/backend/proxy");
 var import_keys = require("@clerk/shared/keys");
 var import_netlifyCacheHandler = require("@clerk/shared/netlifyCacheHandler");
 var import_pathMatcher = require("@clerk/shared/pathMatcher");
-var import_proxy2 = require("@clerk/shared/proxy");
 var import_navigation = require("next/navigation");
 var import_server = require("next/server");
 var import_utils = require("../utils");
@@ -62,16 +61,10 @@ const clerkMiddleware = ((...args) => {
         resolvedParams.secretKey || import_constants.SECRET_KEY || (keyless == null ? void 0 : keyless.secretKey),
         () => import_errorThrower.errorThrower.throwMissingSecretKeyError()
       );
-      const requestUrl = new URL(request2.nextUrl.href);
-      let frontendApiProxyConfig = resolvedParams.frontendApiProxy;
-      const hasExplicitProxyOrDomain = resolvedParams.proxyUrl || import_constants.PROXY_URL || resolvedParams.domain || import_constants.DOMAIN;
-      if (!frontendApiProxyConfig && !hasExplicitProxyOrDomain && (0, import_keys.isProductionFromPublishableKey)(publishableKey)) {
-        if ((0, import_proxy2.shouldAutoProxy)(requestUrl.hostname)) {
-          frontendApiProxyConfig = { enabled: true };
-        }
-      }
+      const frontendApiProxyConfig = resolvedParams.frontendApiProxy;
       if (frontendApiProxyConfig) {
         const { enabled, path: proxyPath = import_proxy.DEFAULT_PROXY_PATH } = frontendApiProxyConfig;
+        const requestUrl = new URL(request2.url);
         const isEnabled = typeof enabled === "function" ? enabled(requestUrl) : enabled;
         if (isEnabled && (0, import_proxy.matchProxyPath)(request2, { proxyPath })) {
           return (0, import_proxy.clerkFrontendApiProxy)(request2, {

package/dist/cjs/server/clerkMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/clerkMiddleware.ts"],"sourcesContent":["import type { AuthObject, ClerkClient } from '@clerk/backend';\nimport type {\n  AuthenticatedState,\n  AuthenticateRequestOptions,\n  ClerkRequest,\n  RedirectFun,\n  RequestState,\n  SignedInAuthObject,\n  SignedOutAuthObject,\n  UnauthenticatedState,\n} from '@clerk/backend/internal';\nimport {\n  AuthStatus,\n  constants,\n  createClerkRequest,\n  createRedirect,\n  getAuthObjectForAcceptedToken,\n  isMachineTokenByPrefix,\n  isTokenTypeAccepted,\n  makeAuthObjectSerializable,\n  TokenType,\n} from '@clerk/backend/internal';\nimport { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, matchProxyPath } from '@clerk/backend/proxy';\nimport { isProductionFromPublishableKey, parsePublishableKey } from '@clerk/shared/keys';\nimport { handleNetlifyCacheInDevInstance } from '@clerk/shared/netlifyCacheHandler';\nimport { isMalformedURLError } from '@clerk/shared/pathMatcher';\nimport { shouldAutoProxy } from '@clerk/shared/proxy';\nimport { notFound as nextjsNotFound } from 'next/navigation';\nimport type { NextMiddleware, NextRequest } from 'next/server';\nimport { NextResponse } from 'next/server';\n\nimport type { AuthFn } from '../app-router/server/auth';\nimport type { GetAuthOptions } from '../server/createGetAuth';\nimport { isRedirect, serverRedirectWithAuth, setHeader } from '../utils';\nimport { withLogger } from '../utils/debugLogger';\nimport { canUseKeyless } from '../utils/feature-flags';\nimport { clerkClient } from './clerkClient';\nimport { DOMAIN, PROXY_URL, PUBLISHABLE_KEY, SECRET_KEY, SIGN_IN_URL, SIGN_UP_URL } from './constants';\nimport { type ContentSecurityPolicyOptions, createContentSecurityPolicyHeaders } from './content-security-policy';\nimport { errorThrower } from './errorThrower';\nimport { getHeader } from './headers-utils';\nimport { getKeylessCookieValue } from './keyless';\nimport { clerkMiddlewareRequestDataStorage, clerkMiddlewareRequestDataStore } from './middleware-storage';\nimport {\n  isNextjsNotFoundError,\n  isNextjsRedirectError,\n  isNextjsUnauthorizedError,\n  isRedirectToSignInError,\n  isRedirectToSignUpError,\n  nextjsRedirectError,\n  redirectToSignInError,\n  redirectToSignUpError,\n  unauthorized,\n} from './nextErrors';\nimport type { AuthProtect } from './protect';\nimport { createProtect } from './protect';\nimport type {\n  FrontendApiProxyOptions,\n  NextMiddlewareEvtParam,\n  NextMiddlewareRequestParam,\n  NextMiddlewareReturn,\n} from './types';\nimport {\n  assertKey,\n  decorateRequest,\n  handleMultiDomainAndProxy,\n  redirectAdapter,\n  setRequestHeadersOnNextResponse,\n} from './utils';\n\nexport type ClerkMiddlewareSessionAuthObject = (SignedInAuthObject | SignedOutAuthObject) & {\n  redirectToSignIn: RedirectFun<Response>;\n  redirectToSignUp: RedirectFun<Response>;\n};\n\nexport type ClerkMiddlewareAuth = AuthFn;\n\ntype ClerkMiddlewareHandler = (\n  auth: ClerkMiddlewareAuth,\n  request: NextMiddlewareRequestParam,\n  event: NextMiddlewareEvtParam,\n) => NextMiddlewareReturn;\n\ntype AuthenticateAnyRequestOptions = Omit<AuthenticateRequestOptions, 'acceptsToken'>;\n\n/**\n * The `clerkMiddleware()` function accepts an optional object. The following options are available.\n * @interface\n */\nexport interface ClerkMiddlewareOptions extends AuthenticateAnyRequestOptions {\n  /**\n   * If true, additional debug information will be logged to the console.\n   */\n  debug?: boolean;\n\n  /**\n   * When set, automatically injects a Content-Security-Policy header(s) compatible with Clerk.\n   */\n  contentSecurityPolicy?: ContentSecurityPolicyOptions;\n\n  /**\n   * When set, enables the middleware to proxy Frontend API requests to Clerk.\n   * This is useful when direct communication with Clerk's API is blocked.\n   */\n  frontendApiProxy?: FrontendApiProxyOptions;\n}\n\ntype ClerkMiddlewareOptionsCallback = (req: NextRequest) => ClerkMiddlewareOptions | Promise<ClerkMiddlewareOptions>;\n\n/**\n * Middleware for Next.js that handles authentication and authorization with Clerk.\n * For more details, please refer to the docs: https://clerk.com/docs/reference/nextjs/clerk-middleware\n */\ninterface ClerkMiddleware {\n  /**\n   * @example\n   * export default clerkMiddleware((auth, request, event) => { ... }, options);\n   */\n  (handler: ClerkMiddlewareHandler, options?: ClerkMiddlewareOptions): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware((auth, request, event) => { ... }, (req) => options);\n   */\n  (handler: ClerkMiddlewareHandler, options?: ClerkMiddlewareOptionsCallback): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware(options);\n   */\n  (options?: ClerkMiddlewareOptions): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware;\n   */\n  (request: NextMiddlewareRequestParam, event: NextMiddlewareEvtParam): NextMiddlewareReturn;\n}\n\n/**\n * The `clerkMiddleware()` helper integrates Clerk authentication into your Next.js application through Middleware. `clerkMiddleware()` is compatible with both the App and Pages routers.\n */\nexport const clerkMiddleware = ((...args: unknown[]): NextMiddleware | NextMiddlewareReturn => {\n  const [request, event] = parseRequestAndEvent(args);\n  const [handler, params] = parseHandlerAndOptions(args);\n\n  const middleware = clerkMiddlewareRequestDataStorage.run(clerkMiddlewareRequestDataStore, () => {\n    const baseNextMiddleware: NextMiddleware = withLogger('clerkMiddleware', logger => async (request, event) => {\n      // Handles the case where `options` is a callback function to dynamically access `NextRequest`\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\n\n      const keyless = await getKeylessCookieValue(name => request.cookies.get(name)?.value);\n\n      const publishableKey = assertKey(\n        resolvedParams.publishableKey || PUBLISHABLE_KEY || keyless?.publishableKey,\n        () => errorThrower.throwMissingPublishableKeyError(),\n      );\n\n      const secretKey = assertKey(resolvedParams.secretKey || SECRET_KEY || keyless?.secretKey, () =>\n        errorThrower.throwMissingSecretKeyError(),\n      );\n\n      // Handle Frontend API proxy requests early, before authentication\n      const requestUrl = new URL(request.nextUrl.href);\n      let frontendApiProxyConfig = resolvedParams.frontendApiProxy;\n\n      // Auto-detect when no explicit proxy or domain is configured\n      const hasExplicitProxyOrDomain = resolvedParams.proxyUrl || PROXY_URL || resolvedParams.domain || DOMAIN;\n      if (!frontendApiProxyConfig && !hasExplicitProxyOrDomain && isProductionFromPublishableKey(publishableKey)) {\n        if (shouldAutoProxy(requestUrl.hostname)) {\n          frontendApiProxyConfig = { enabled: true };\n        }\n      }\n      if (frontendApiProxyConfig) {\n        const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = frontendApiProxyConfig;\n\n        // Resolve enabled - either boolean or function\n        const isEnabled = typeof enabled === 'function' ? enabled(requestUrl) : enabled;\n\n        if (isEnabled && matchProxyPath(request, { proxyPath })) {\n          return clerkFrontendApiProxy(request, {\n            proxyPath,\n            publishableKey,\n            secretKey,\n          });\n        }\n      }\n\n      const signInUrl = resolvedParams.signInUrl || SIGN_IN_URL;\n      const signUpUrl = resolvedParams.signUpUrl || SIGN_UP_URL;\n\n      const options = {\n        publishableKey,\n        secretKey,\n        signInUrl,\n        signUpUrl,\n        ...resolvedParams,\n      };\n\n      // Propagates the request data to be accessed on the server application runtime from helpers such as `clerkClient`\n      clerkMiddlewareRequestDataStore.set('requestData', options);\n      const resolvedClerkClient = await clerkClient();\n\n      if (options.debug) {\n        logger.enable();\n      }\n      const clerkRequest = createClerkRequest(request);\n      logger.debug('options', options);\n      logger.debug('url', () => clerkRequest.toJSON());\n\n      const authHeader = request.headers.get(constants.Headers.Authorization);\n      if (authHeader && authHeader.startsWith('Basic ')) {\n        logger.debug('Basic Auth detected');\n      }\n\n      const cspHeader = request.headers.get(constants.Headers.ContentSecurityPolicy);\n      if (cspHeader) {\n        logger.debug('Content-Security-Policy detected', () => ({\n          value: cspHeader,\n        }));\n      }\n\n      const requestState = await resolvedClerkClient.authenticateRequest(\n        clerkRequest,\n        createAuthenticateRequestOptions(clerkRequest, options),\n      );\n\n      logger.debug('requestState', () => ({\n        status: requestState.status,\n        headers: JSON.stringify(Object.fromEntries(requestState.headers)),\n        reason: requestState.reason,\n      }));\n\n      const locationHeader = requestState.headers.get(constants.Headers.Location);\n      if (locationHeader) {\n        handleNetlifyCacheInDevInstance({\n          locationHeader,\n          requestStateHeaders: requestState.headers,\n          publishableKey: requestState.publishableKey,\n        });\n\n        const res = NextResponse.redirect(requestState.headers.get(constants.Headers.Location) || locationHeader);\n        requestState.headers.forEach((value, key) => {\n          if (key === constants.Headers.Location) {\n            return;\n          }\n          res.headers.append(key, value);\n        });\n        return res;\n      } else if (requestState.status === AuthStatus.Handshake) {\n        throw new Error('Clerk: handshake status without redirect');\n      }\n\n      const authObject = requestState.toAuth();\n      logger.debug('auth', () => ({ auth: authObject, debug: authObject.debug() }));\n\n      const redirectToSignIn = createMiddlewareRedirectToSignIn(clerkRequest);\n      const redirectToSignUp = createMiddlewareRedirectToSignUp(clerkRequest);\n      const protect = await createMiddlewareProtect(clerkRequest, authObject, redirectToSignIn);\n\n      const authHandler = createMiddlewareAuthHandler(requestState, redirectToSignIn, redirectToSignUp);\n      authHandler.protect = protect;\n\n      let handlerResult: Response = NextResponse.next();\n      try {\n        const userHandlerResult = await clerkMiddlewareRequestDataStorage.run(\n          clerkMiddlewareRequestDataStore,\n          async () => handler?.(authHandler, request, event),\n        );\n        handlerResult = userHandlerResult || handlerResult;\n      } catch (e: any) {\n        handlerResult = handleControlFlowErrors(e, clerkRequest, request, requestState);\n      }\n      if (options.contentSecurityPolicy) {\n        const { headers } = createContentSecurityPolicyHeaders(\n          (parsePublishableKey(publishableKey)?.frontendApi ?? '').replace('$', ''),\n          options.contentSecurityPolicy,\n        );\n\n        const cspRequestHeaders: Record<string, string> = {};\n        headers.forEach(([key, value]) => {\n          setHeader(handlerResult, key, value);\n          cspRequestHeaders[key] = value;\n        });\n\n        // Forward CSP headers as request headers so server components\n        // can access the nonce via headers()\n        setRequestHeadersOnNextResponse(handlerResult, clerkRequest, cspRequestHeaders);\n\n        logger.debug('Clerk generated CSP', () => ({\n          headers,\n        }));\n      }\n\n      // TODO @nikos: we need to make this more generic\n      // and move the logic in clerk/backend\n      if (requestState.headers) {\n        requestState.headers.forEach((value, key) => {\n          if (key === constants.Headers.ContentSecurityPolicy) {\n            logger.debug('Content-Security-Policy detected', () => ({\n              value,\n            }));\n          }\n          handlerResult.headers.append(key, value);\n        });\n      }\n\n      if (isRedirect(handlerResult)) {\n        logger.debug('handlerResult is redirect');\n        return serverRedirectWithAuth(clerkRequest, handlerResult, options);\n      }\n\n      if (options.debug) {\n        setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });\n      }\n\n      const keylessKeysForRequestData =\n        // Only pass keyless credentials when there are no explicit keys\n        secretKey === keyless?.secretKey\n          ? {\n              publishableKey: keyless?.publishableKey,\n              secretKey: keyless?.secretKey,\n            }\n          : {};\n\n      decorateRequest(\n        clerkRequest,\n        handlerResult,\n        requestState,\n        resolvedParams,\n        keylessKeysForRequestData,\n        authObject.tokenType === 'session_token' ? null : makeAuthObjectSerializable(authObject),\n      );\n\n      return handlerResult;\n    });\n\n    const keylessMiddleware: NextMiddleware = async (request, event) => {\n      /**\n       * This mechanism replaces a full-page reload. Ensures that middleware will re-run and authenticate the request properly without the secret key or publishable key to be missing.\n       */\n      if (isKeylessSyncRequest(request)) {\n        return returnBackFromKeylessSync(request);\n      }\n\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\n      const keyless = await getKeylessCookieValue(name => request.cookies.get(name)?.value);\n\n      const isMissingPublishableKey = !(resolvedParams.publishableKey || PUBLISHABLE_KEY || keyless?.publishableKey);\n      const authHeader = getHeader(request, constants.Headers.Authorization)?.replace('Bearer ', '') ?? '';\n\n      /**\n       * In keyless mode, if the publishable key is missing, let the request through, to render `<ClerkProvider/>` that will resume the flow gracefully.\n       */\n      if (isMissingPublishableKey && !isMachineTokenByPrefix(authHeader)) {\n        const res = NextResponse.next();\n        setRequestHeadersOnNextResponse(res, request, {\n          [constants.Headers.AuthStatus]: 'signed-out',\n        });\n        return res;\n      }\n\n      return baseNextMiddleware(request, event);\n    };\n\n    const nextMiddleware: NextMiddleware = async (request, event) => {\n      if (canUseKeyless) {\n        return keylessMiddleware(request, event);\n      }\n\n      return baseNextMiddleware(request, event);\n    };\n\n    // If we have a request and event, we're being called as a middleware directly\n    // eg, export default clerkMiddleware;\n    if (request && event) {\n      return nextMiddleware(request, event);\n    }\n\n    // Otherwise, return a middleware that can be called with a request and event\n    // eg, export default clerkMiddleware(auth => { ... });\n    return nextMiddleware;\n  });\n\n  return middleware;\n}) as ClerkMiddleware;\n\nconst parseRequestAndEvent = (args: unknown[]) => {\n  return [args[0] instanceof Request ? args[0] : undefined, args[0] instanceof Request ? args[1] : undefined] as [\n    NextMiddlewareRequestParam | undefined,\n    NextMiddlewareEvtParam | undefined,\n  ];\n};\n\nconst parseHandlerAndOptions = (args: unknown[]) => {\n  return [\n    typeof args[0] === 'function' ? args[0] : undefined,\n    (args.length === 2 ? args[1] : typeof args[0] === 'function' ? {} : args[0]) || {},\n  ] as [ClerkMiddlewareHandler | undefined, ClerkMiddlewareOptions | ClerkMiddlewareOptionsCallback];\n};\n\nconst isKeylessSyncRequest = (request: NextMiddlewareRequestParam) =>\n  request.nextUrl.pathname === '/clerk-sync-keyless';\n\nconst returnBackFromKeylessSync = (request: NextMiddlewareRequestParam) => {\n  const returnUrl = request.nextUrl.searchParams.get('returnUrl');\n  const url = new URL(request.url);\n  url.pathname = '';\n\n  return NextResponse.redirect(returnUrl || url.toString());\n};\n\ntype AuthenticateRequest = Pick<ClerkClient, 'authenticateRequest'>['authenticateRequest'];\n\nexport const createAuthenticateRequestOptions = (\n  clerkRequest: ClerkRequest,\n  options: ClerkMiddlewareOptions,\n): Parameters<AuthenticateRequest>[1] => {\n  // Auto-derive proxyUrl from frontendApiProxy config if not explicitly set\n  let resolvedOptions = options;\n  if (options.frontendApiProxy && !options.proxyUrl) {\n    const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = options.frontendApiProxy;\n    const requestUrl = new URL(clerkRequest.url);\n    const isEnabled = typeof enabled === 'function' ? enabled(requestUrl) : enabled;\n\n    if (isEnabled) {\n      const derivedProxyUrl = `${requestUrl.origin}${proxyPath}`;\n      resolvedOptions = { ...options, proxyUrl: derivedProxyUrl };\n    }\n  }\n\n  return {\n    ...resolvedOptions,\n    ...handleMultiDomainAndProxy(clerkRequest, resolvedOptions),\n    // TODO: Leaving the acceptsToken as 'any' opens up the possibility of\n    // an economic attack. We should revisit this and only verify a token\n    // when auth() or auth.protect() is invoked.\n    acceptsToken: 'any',\n  };\n};\n\nconst createMiddlewareRedirectToSignIn = (\n  clerkRequest: ClerkRequest,\n): ClerkMiddlewareSessionAuthObject['redirectToSignIn'] => {\n  return (opts = {}) => {\n    const url = clerkRequest.clerkUrl.toString();\n    redirectToSignInError(url, opts.returnBackUrl);\n  };\n};\n\nconst createMiddlewareRedirectToSignUp = (\n  clerkRequest: ClerkRequest,\n): ClerkMiddlewareSessionAuthObject['redirectToSignUp'] => {\n  return (opts = {}) => {\n    const url = clerkRequest.clerkUrl.toString();\n    redirectToSignUpError(url, opts.returnBackUrl);\n  };\n};\n\nconst createMiddlewareProtect = (\n  clerkRequest: ClerkRequest,\n  rawAuthObject: AuthObject,\n  redirectToSignIn: RedirectFun<Response>,\n) => {\n  return (async (params: any, options: any) => {\n    const notFound = () => nextjsNotFound();\n\n    const redirect = (url: string) =>\n      nextjsRedirectError(url, {\n        redirectUrl: url,\n      });\n\n    const requestedToken = params?.token || options?.token || TokenType.SessionToken;\n    const authObject = getAuthObjectForAcceptedToken({ authObject: rawAuthObject, acceptsToken: requestedToken });\n\n    return createProtect({\n      request: clerkRequest,\n      redirect,\n      notFound,\n      unauthorized,\n      authObject,\n      redirectToSignIn,\n    })(params, options);\n  }) as unknown as Promise<AuthProtect>;\n};\n\n/**\n * Modifies the auth object based on the token type.\n * - For session tokens: adds redirect functions to the auth object\n * - For machine tokens: validates token type and returns appropriate auth object\n */\nconst createMiddlewareAuthHandler = (\n  requestState: AuthenticatedState<'session_token'> | UnauthenticatedState<'session_token'>,\n  redirectToSignIn: RedirectFun<Response>,\n  redirectToSignUp: RedirectFun<Response>,\n): ClerkMiddlewareAuth => {\n  const authHandler = async (options?: GetAuthOptions) => {\n    const rawAuthObject = requestState.toAuth({ treatPendingAsSignedOut: options?.treatPendingAsSignedOut });\n    const acceptsToken = options?.acceptsToken ?? TokenType.SessionToken;\n\n    const authObject = getAuthObjectForAcceptedToken({\n      authObject: rawAuthObject,\n      acceptsToken,\n    });\n\n    if (authObject.tokenType === TokenType.SessionToken && isTokenTypeAccepted(TokenType.SessionToken, acceptsToken)) {\n      return Object.assign(authObject, {\n        redirectToSignIn,\n        redirectToSignUp,\n      });\n    }\n\n    return authObject;\n  };\n\n  return authHandler as ClerkMiddlewareAuth;\n};\n\n// Handle errors thrown by protect() and redirectToSignIn() calls,\n// as we want to align the APIs between middleware, pages and route handlers\n// Normally, middleware requires to explicitly return a response, but we want to\n// avoid discrepancies between the APIs as it's easy to miss the `return` statement\n// especially when copy-pasting code from one place to another.\n// This function handles the known errors thrown by the APIs described above,\n// and returns the appropriate response.\nconst handleControlFlowErrors = (\n  e: any,\n  clerkRequest: ClerkRequest,\n  nextRequest: NextRequest,\n  requestState: RequestState,\n): Response => {\n  if (isMalformedURLError(e)) {\n    return new NextResponse(null, { status: 400, statusText: 'Bad Request' });\n  }\n\n  if (isNextjsUnauthorizedError(e)) {\n    const response = new NextResponse(null, { status: 401 });\n\n    // RequestState.toAuth() returns a session_token type by default.\n    // We need to cast it to the correct type to check for OAuth tokens.\n    const authObject = (requestState as RequestState<TokenType>).toAuth();\n    if (authObject && authObject.tokenType === TokenType.OAuthToken) {\n      // Following MCP spec, we return WWW-Authenticate header on 401 responses\n      // to enable OAuth 2.0 authorization server discovery (RFC9728).\n      // See https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-1-authorization-server-location\n      const publishableKey = parsePublishableKey(requestState.publishableKey);\n      return setHeader(\n        response,\n        'WWW-Authenticate',\n        `Bearer resource_metadata=\"https://${publishableKey?.frontendApi}/.well-known/oauth-protected-resource\"`,\n      );\n    }\n\n    return response;\n  }\n\n  if (isNextjsNotFoundError(e)) {\n    // Rewrite to a bogus URL to force not found error\n    return setHeader(\n      // This is an internal rewrite purely to trigger a not found error. We do not want Next.js to think that the\n      // destination URL is a valid page, so we use `nextRequest.url` as the base for the fake URL, which Next.js\n      // understands is an internal URL and won't run middleware against the request.\n      NextResponse.rewrite(new URL(`/clerk_${Date.now()}`, nextRequest.url)),\n      constants.Headers.AuthReason,\n      'protect-rewrite',\n    );\n  }\n\n  const isRedirectToSignIn = isRedirectToSignInError(e);\n  const isRedirectToSignUp = isRedirectToSignUpError(e);\n\n  if (isRedirectToSignIn || isRedirectToSignUp) {\n    const redirect = createRedirect({\n      redirectAdapter,\n      baseUrl: clerkRequest.clerkUrl,\n      signInUrl: requestState.signInUrl,\n      signUpUrl: requestState.signUpUrl,\n      publishableKey: requestState.publishableKey,\n      sessionStatus: requestState.toAuth()?.sessionStatus,\n      isSatellite: requestState.isSatellite,\n    });\n\n    const { returnBackUrl } = e;\n    return redirect[isRedirectToSignIn ? 'redirectToSignIn' : 'redirectToSignUp']({ returnBackUrl });\n  }\n\n  if (isNextjsRedirectError(e)) {\n    return redirectAdapter(e.redirectUrl);\n  }\n\n  throw e;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,sBAUO;AACP,mBAA0E;AAC1E,kBAAoE;AACpE,iCAAgD;AAChD,yBAAoC;AACpC,IAAAA,gBAAgC;AAChC,wBAA2C;AAE3C,oBAA6B;AAI7B,mBAA8D;AAC9D,yBAA2B;AAC3B,2BAA8B;AAC9B,yBAA4B;AAC5B,uBAAyF;AACzF,qCAAsF;AACtF,0BAA6B;AAC7B,2BAA0B;AAC1B,qBAAsC;AACtC,gCAAmF;AACnF,wBAUO;AAEP,qBAA8B;AAO9B,IAAAC,gBAMO;AA0EA,MAAM,mBAAmB,IAAI,SAA2D;AAC7F,QAAM,CAAC,SAAS,KAAK,IAAI,qBAAqB,IAAI;AAClD,QAAM,CAAC,SAAS,MAAM,IAAI,uBAAuB,IAAI;AAErD,QAAM,aAAa,4DAAkC,IAAI,2DAAiC,MAAM;AAC9F,UAAM,yBAAqC,+BAAW,mBAAmB,YAAU,OAAOC,UAASC,WAAU;AAnJjH;AAqJM,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOD,QAAO,IAAI;AAE9E,YAAM,UAAU,UAAM,sCAAsB,UAAK;AAvJvD,YAAAE;AAuJ0D,gBAAAA,MAAAF,SAAQ,QAAQ,IAAI,IAAI,MAAxB,gBAAAE,IAA2B;AAAA,OAAK;AAEpF,YAAM,qBAAiB;AAAA,QACrB,eAAe,kBAAkB,qCAAmB,mCAAS;AAAA,QAC7D,MAAM,iCAAa,gCAAgC;AAAA,MACrD;AAEA,YAAM,gBAAY;AAAA,QAAU,eAAe,aAAa,gCAAc,mCAAS;AAAA,QAAW,MACxF,iCAAa,2BAA2B;AAAA,MAC1C;AAGA,YAAM,aAAa,IAAI,IAAIF,SAAQ,QAAQ,IAAI;AAC/C,UAAI,yBAAyB,eAAe;AAG5C,YAAM,2BAA2B,eAAe,YAAY,8BAAa,eAAe,UAAU;AAClG,UAAI,CAAC,0BAA0B,CAAC,gCAA4B,4CAA+B,cAAc,GAAG;AAC1G,gBAAI,+BAAgB,WAAW,QAAQ,GAAG;AACxC,mCAAyB,EAAE,SAAS,KAAK;AAAA,QAC3C;AAAA,MACF;AACA,UAAI,wBAAwB;AAC1B,cAAM,EAAE,SAAS,MAAM,YAAY,gCAAmB,IAAI;AAG1D,cAAM,YAAY,OAAO,YAAY,aAAa,QAAQ,UAAU,IAAI;AAExE,YAAI,iBAAa,6BAAeA,UAAS,EAAE,UAAU,CAAC,GAAG;AACvD,qBAAO,oCAAsBA,UAAS;AAAA,YACpC;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,YAAY,eAAe,aAAa;AAC9C,YAAM,YAAY,eAAe,aAAa;AAE9C,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAGA,gEAAgC,IAAI,eAAe,OAAO;AAC1D,YAAM,sBAAsB,UAAM,gCAAY;AAE9C,UAAI,QAAQ,OAAO;AACjB,eAAO,OAAO;AAAA,MAChB;AACA,YAAM,mBAAe,oCAAmBA,QAAO;AAC/C,aAAO,MAAM,WAAW,OAAO;AAC/B,aAAO,MAAM,OAAO,MAAM,aAAa,OAAO,CAAC;AAE/C,YAAM,aAAaA,SAAQ,QAAQ,IAAI,0BAAU,QAAQ,aAAa;AACtE,UAAI,cAAc,WAAW,WAAW,QAAQ,GAAG;AACjD,eAAO,MAAM,qBAAqB;AAAA,MACpC;AAEA,YAAM,YAAYA,SAAQ,QAAQ,IAAI,0BAAU,QAAQ,qBAAqB;AAC7E,UAAI,WAAW;AACb,eAAO,MAAM,oCAAoC,OAAO;AAAA,UACtD,OAAO;AAAA,QACT,EAAE;AAAA,MACJ;AAEA,YAAM,eAAe,MAAM,oBAAoB;AAAA,QAC7C;AAAA,QACA,iCAAiC,cAAc,OAAO;AAAA,MACxD;AAEA,aAAO,MAAM,gBAAgB,OAAO;AAAA,QAClC,QAAQ,aAAa;AAAA,QACrB,SAAS,KAAK,UAAU,OAAO,YAAY,aAAa,OAAO,CAAC;AAAA,QAChE,QAAQ,aAAa;AAAA,MACvB,EAAE;AAEF,YAAM,iBAAiB,aAAa,QAAQ,IAAI,0BAAU,QAAQ,QAAQ;AAC1E,UAAI,gBAAgB;AAClB,wEAAgC;AAAA,UAC9B;AAAA,UACA,qBAAqB,aAAa;AAAA,UAClC,gBAAgB,aAAa;AAAA,QAC/B,CAAC;AAED,cAAM,MAAM,2BAAa,SAAS,aAAa,QAAQ,IAAI,0BAAU,QAAQ,QAAQ,KAAK,cAAc;AACxG,qBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC3C,cAAI,QAAQ,0BAAU,QAAQ,UAAU;AACtC;AAAA,UACF;AACA,cAAI,QAAQ,OAAO,KAAK,KAAK;AAAA,QAC/B,CAAC;AACD,eAAO;AAAA,MACT,WAAW,aAAa,WAAW,2BAAW,WAAW;AACvD,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AAEA,YAAM,aAAa,aAAa,OAAO;AACvC,aAAO,MAAM,QAAQ,OAAO,EAAE,MAAM,YAAY,OAAO,WAAW,MAAM,EAAE,EAAE;AAE5E,YAAM,mBAAmB,iCAAiC,YAAY;AACtE,YAAM,mBAAmB,iCAAiC,YAAY;AACtE,YAAM,UAAU,MAAM,wBAAwB,cAAc,YAAY,gBAAgB;AAExF,YAAM,cAAc,4BAA4B,cAAc,kBAAkB,gBAAgB;AAChG,kBAAY,UAAU;AAEtB,UAAI,gBAA0B,2BAAa,KAAK;AAChD,UAAI;AACF,cAAM,oBAAoB,MAAM,4DAAkC;AAAA,UAChE;AAAA,UACA,YAAY,mCAAU,aAAaA,UAASC;AAAA,QAC9C;AACA,wBAAgB,qBAAqB;AAAA,MACvC,SAAS,GAAQ;AACf,wBAAgB,wBAAwB,GAAG,cAAcD,UAAS,YAAY;AAAA,MAChF;AACA,UAAI,QAAQ,uBAAuB;AACjC,cAAM,EAAE,QAAQ,QAAI;AAAA,YACjB,gDAAoB,cAAc,MAAlC,mBAAqC,gBAArC,YAAoD,IAAI,QAAQ,KAAK,EAAE;AAAA,UACxE,QAAQ;AAAA,QACV;AAEA,cAAM,oBAA4C,CAAC;AACnD,gBAAQ,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAChC,sCAAU,eAAe,KAAK,KAAK;AACnC,4BAAkB,GAAG,IAAI;AAAA,QAC3B,CAAC;AAID,2DAAgC,eAAe,cAAc,iBAAiB;AAE9E,eAAO,MAAM,uBAAuB,OAAO;AAAA,UACzC;AAAA,QACF,EAAE;AAAA,MACJ;AAIA,UAAI,aAAa,SAAS;AACxB,qBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC3C,cAAI,QAAQ,0BAAU,QAAQ,uBAAuB;AACnD,mBAAO,MAAM,oCAAoC,OAAO;AAAA,cACtD;AAAA,YACF,EAAE;AAAA,UACJ;AACA,wBAAc,QAAQ,OAAO,KAAK,KAAK;AAAA,QACzC,CAAC;AAAA,MACH;AAEA,cAAI,yBAAW,aAAa,GAAG;AAC7B,eAAO,MAAM,2BAA2B;AACxC,mBAAO,qCAAuB,cAAc,eAAe,OAAO;AAAA,MACpE;AAEA,UAAI,QAAQ,OAAO;AACjB,2DAAgC,eAAe,cAAc,EAAE,CAAC,0BAAU,QAAQ,WAAW,GAAG,OAAO,CAAC;AAAA,MAC1G;AAEA,YAAM;AAAA;AAAA,QAEJ,eAAc,mCAAS,aACnB;AAAA,UACE,gBAAgB,mCAAS;AAAA,UACzB,WAAW,mCAAS;AAAA,QACtB,IACA,CAAC;AAAA;AAEP;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,cAAc,kBAAkB,WAAO,4CAA2B,UAAU;AAAA,MACzF;AAEA,aAAO;AAAA,IACT,CAAC;AAED,UAAM,oBAAoC,OAAOA,UAASC,WAAU;AAjVxE;AAqVM,UAAI,qBAAqBD,QAAO,GAAG;AACjC,eAAO,0BAA0BA,QAAO;AAAA,MAC1C;AAEA,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOA,QAAO,IAAI;AAC9E,YAAM,UAAU,UAAM,sCAAsB,UAAK;AA1VvD,YAAAE;AA0V0D,gBAAAA,MAAAF,SAAQ,QAAQ,IAAI,IAAI,MAAxB,gBAAAE,IAA2B;AAAA,OAAK;AAEpF,YAAM,0BAA0B,EAAE,eAAe,kBAAkB,qCAAmB,mCAAS;AAC/F,YAAM,cAAa,+CAAUF,UAAS,0BAAU,QAAQ,aAAa,MAAlD,mBAAqD,QAAQ,WAAW,QAAxE,YAA+E;AAKlG,UAAI,2BAA2B,KAAC,wCAAuB,UAAU,GAAG;AAClE,cAAM,MAAM,2BAAa,KAAK;AAC9B,2DAAgC,KAAKA,UAAS;AAAA,UAC5C,CAAC,0BAAU,QAAQ,UAAU,GAAG;AAAA,QAClC,CAAC;AACD,eAAO;AAAA,MACT;AAEA,aAAO,mBAAmBA,UAASC,MAAK;AAAA,IAC1C;AAEA,UAAM,iBAAiC,OAAOD,UAASC,WAAU;AAC/D,UAAI,oCAAe;AACjB,eAAO,kBAAkBD,UAASC,MAAK;AAAA,MACzC;AAEA,aAAO,mBAAmBD,UAASC,MAAK;AAAA,IAC1C;AAIA,QAAI,WAAW,OAAO;AACpB,aAAO,eAAe,SAAS,KAAK;AAAA,IACtC;AAIA,WAAO;AAAA,EACT,CAAC;AAED,SAAO;AACT;AAEA,MAAM,uBAAuB,CAAC,SAAoB;AAChD,SAAO,CAAC,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI,QAAW,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI,MAAS;AAI5G;AAEA,MAAM,yBAAyB,CAAC,SAAoB;AAClD,SAAO;AAAA,IACL,OAAO,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI;AAAA,KACzC,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;AAAA,EACnF;AACF;AAEA,MAAM,uBAAuB,CAAC,YAC5B,QAAQ,QAAQ,aAAa;AAE/B,MAAM,4BAA4B,CAAC,YAAwC;AACzE,QAAM,YAAY,QAAQ,QAAQ,aAAa,IAAI,WAAW;AAC9D,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,MAAI,WAAW;AAEf,SAAO,2BAAa,SAAS,aAAa,IAAI,SAAS,CAAC;AAC1D;AAIO,MAAM,mCAAmC,CAC9C,cACA,YACuC;AAEvC,MAAI,kBAAkB;AACtB,MAAI,QAAQ,oBAAoB,CAAC,QAAQ,UAAU;AACjD,UAAM,EAAE,SAAS,MAAM,YAAY,gCAAmB,IAAI,QAAQ;AAClE,UAAM,aAAa,IAAI,IAAI,aAAa,GAAG;AAC3C,UAAM,YAAY,OAAO,YAAY,aAAa,QAAQ,UAAU,IAAI;AAExE,QAAI,WAAW;AACb,YAAM,kBAAkB,GAAG,WAAW,MAAM,GAAG,SAAS;AACxD,wBAAkB,EAAE,GAAG,SAAS,UAAU,gBAAgB;AAAA,IAC5D;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAG,yCAA0B,cAAc,eAAe;AAAA;AAAA;AAAA;AAAA,IAI1D,cAAc;AAAA,EAChB;AACF;AAEA,MAAM,mCAAmC,CACvC,iBACyD;AACzD,SAAO,CAAC,OAAO,CAAC,MAAM;AACpB,UAAM,MAAM,aAAa,SAAS,SAAS;AAC3C,iDAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AACF;AAEA,MAAM,mCAAmC,CACvC,iBACyD;AACzD,SAAO,CAAC,OAAO,CAAC,MAAM;AACpB,UAAM,MAAM,aAAa,SAAS,SAAS;AAC3C,iDAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AACF;AAEA,MAAM,0BAA0B,CAC9B,cACA,eACA,qBACG;AACH,UAAQ,OAAO,QAAa,YAAiB;AAC3C,UAAM,WAAW,UAAM,kBAAAE,UAAe;AAEtC,UAAM,WAAW,CAAC,YAChB,uCAAoB,KAAK;AAAA,MACvB,aAAa;AAAA,IACf,CAAC;AAEH,UAAM,kBAAiB,iCAAQ,WAAS,mCAAS,UAAS,0BAAU;AACpE,UAAM,iBAAa,+CAA8B,EAAE,YAAY,eAAe,cAAc,eAAe,CAAC;AAE5G,eAAO,8BAAc;AAAA,MACnB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EAAE,QAAQ,OAAO;AAAA,EACpB;AACF;AAOA,MAAM,8BAA8B,CAClC,cACA,kBACA,qBACwB;AACxB,QAAM,cAAc,OAAO,YAA6B;AAhf1D;AAifI,UAAM,gBAAgB,aAAa,OAAO,EAAE,yBAAyB,mCAAS,wBAAwB,CAAC;AACvG,UAAM,gBAAe,wCAAS,iBAAT,YAAyB,0BAAU;AAExD,UAAM,iBAAa,+CAA8B;AAAA,MAC/C,YAAY;AAAA,MACZ;AAAA,IACF,CAAC;AAED,QAAI,WAAW,cAAc,0BAAU,oBAAgB,qCAAoB,0BAAU,cAAc,YAAY,GAAG;AAChH,aAAO,OAAO,OAAO,YAAY;AAAA,QAC/B;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AASA,MAAM,0BAA0B,CAC9B,GACA,cACA,aACA,iBACa;AAlhBf;AAmhBE,UAAI,wCAAoB,CAAC,GAAG;AAC1B,WAAO,IAAI,2BAAa,MAAM,EAAE,QAAQ,KAAK,YAAY,cAAc,CAAC;AAAA,EAC1E;AAEA,UAAI,6CAA0B,CAAC,GAAG;AAChC,UAAM,WAAW,IAAI,2BAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAIvD,UAAM,aAAc,aAAyC,OAAO;AACpE,QAAI,cAAc,WAAW,cAAc,0BAAU,YAAY;AAI/D,YAAM,qBAAiB,iCAAoB,aAAa,cAAc;AACtE,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,qCAAqC,iDAAgB,WAAW;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,UAAI,yCAAsB,CAAC,GAAG;AAE5B,eAAO;AAAA;AAAA;AAAA;AAAA,MAIL,2BAAa,QAAQ,IAAI,IAAI,UAAU,KAAK,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC;AAAA,MACrE,0BAAU,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,yBAAqB,2CAAwB,CAAC;AACpD,QAAM,yBAAqB,2CAAwB,CAAC;AAEpD,MAAI,sBAAsB,oBAAoB;AAC5C,UAAM,eAAW,gCAAe;AAAA,MAC9B;AAAA,MACA,SAAS,aAAa;AAAA,MACtB,WAAW,aAAa;AAAA,MACxB,WAAW,aAAa;AAAA,MACxB,gBAAgB,aAAa;AAAA,MAC7B,gBAAe,kBAAa,OAAO,MAApB,mBAAuB;AAAA,MACtC,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,UAAM,EAAE,cAAc,IAAI;AAC1B,WAAO,SAAS,qBAAqB,qBAAqB,kBAAkB,EAAE,EAAE,cAAc,CAAC;AAAA,EACjG;AAEA,UAAI,yCAAsB,CAAC,GAAG;AAC5B,eAAO,+BAAgB,EAAE,WAAW;AAAA,EACtC;AAEA,QAAM;AACR;","names":["import_proxy","import_utils","request","event","_a","nextjsNotFound"]}
+{"version":3,"sources":["../../../src/server/clerkMiddleware.ts"],"sourcesContent":["import type { AuthObject, ClerkClient } from '@clerk/backend';\nimport type {\n  AuthenticatedState,\n  AuthenticateRequestOptions,\n  ClerkRequest,\n  RedirectFun,\n  RequestState,\n  SignedInAuthObject,\n  SignedOutAuthObject,\n  UnauthenticatedState,\n} from '@clerk/backend/internal';\nimport {\n  AuthStatus,\n  constants,\n  createClerkRequest,\n  createRedirect,\n  getAuthObjectForAcceptedToken,\n  isMachineTokenByPrefix,\n  isTokenTypeAccepted,\n  makeAuthObjectSerializable,\n  TokenType,\n} from '@clerk/backend/internal';\nimport { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, matchProxyPath } from '@clerk/backend/proxy';\nimport { parsePublishableKey } from '@clerk/shared/keys';\nimport { handleNetlifyCacheInDevInstance } from '@clerk/shared/netlifyCacheHandler';\nimport { isMalformedURLError } from '@clerk/shared/pathMatcher';\nimport { notFound as nextjsNotFound } from 'next/navigation';\nimport type { NextMiddleware, NextRequest } from 'next/server';\nimport { NextResponse } from 'next/server';\n\nimport type { AuthFn } from '../app-router/server/auth';\nimport type { GetAuthOptions } from '../server/createGetAuth';\nimport { isRedirect, serverRedirectWithAuth, setHeader } from '../utils';\nimport { withLogger } from '../utils/debugLogger';\nimport { canUseKeyless } from '../utils/feature-flags';\nimport { clerkClient } from './clerkClient';\nimport { PUBLISHABLE_KEY, SECRET_KEY, SIGN_IN_URL, SIGN_UP_URL } from './constants';\nimport { type ContentSecurityPolicyOptions, createContentSecurityPolicyHeaders } from './content-security-policy';\nimport { errorThrower } from './errorThrower';\nimport { getHeader } from './headers-utils';\nimport { getKeylessCookieValue } from './keyless';\nimport { clerkMiddlewareRequestDataStorage, clerkMiddlewareRequestDataStore } from './middleware-storage';\nimport {\n  isNextjsNotFoundError,\n  isNextjsRedirectError,\n  isNextjsUnauthorizedError,\n  isRedirectToSignInError,\n  isRedirectToSignUpError,\n  nextjsRedirectError,\n  redirectToSignInError,\n  redirectToSignUpError,\n  unauthorized,\n} from './nextErrors';\nimport type { AuthProtect } from './protect';\nimport { createProtect } from './protect';\nimport type {\n  FrontendApiProxyOptions,\n  NextMiddlewareEvtParam,\n  NextMiddlewareRequestParam,\n  NextMiddlewareReturn,\n} from './types';\nimport {\n  assertKey,\n  decorateRequest,\n  handleMultiDomainAndProxy,\n  redirectAdapter,\n  setRequestHeadersOnNextResponse,\n} from './utils';\n\nexport type ClerkMiddlewareSessionAuthObject = (SignedInAuthObject | SignedOutAuthObject) & {\n  redirectToSignIn: RedirectFun<Response>;\n  redirectToSignUp: RedirectFun<Response>;\n};\n\nexport type ClerkMiddlewareAuth = AuthFn;\n\ntype ClerkMiddlewareHandler = (\n  auth: ClerkMiddlewareAuth,\n  request: NextMiddlewareRequestParam,\n  event: NextMiddlewareEvtParam,\n) => NextMiddlewareReturn;\n\ntype AuthenticateAnyRequestOptions = Omit<AuthenticateRequestOptions, 'acceptsToken'>;\n\n/**\n * The `clerkMiddleware()` function accepts an optional object. The following options are available.\n * @interface\n */\nexport interface ClerkMiddlewareOptions extends AuthenticateAnyRequestOptions {\n  /**\n   * If true, additional debug information will be logged to the console.\n   */\n  debug?: boolean;\n\n  /**\n   * When set, automatically injects a Content-Security-Policy header(s) compatible with Clerk.\n   */\n  contentSecurityPolicy?: ContentSecurityPolicyOptions;\n\n  /**\n   * When set, enables the middleware to proxy Frontend API requests to Clerk.\n   * This is useful when direct communication with Clerk's API is blocked.\n   */\n  frontendApiProxy?: FrontendApiProxyOptions;\n}\n\ntype ClerkMiddlewareOptionsCallback = (req: NextRequest) => ClerkMiddlewareOptions | Promise<ClerkMiddlewareOptions>;\n\n/**\n * Middleware for Next.js that handles authentication and authorization with Clerk.\n * For more details, please refer to the docs: https://clerk.com/docs/reference/nextjs/clerk-middleware\n */\ninterface ClerkMiddleware {\n  /**\n   * @example\n   * export default clerkMiddleware((auth, request, event) => { ... }, options);\n   */\n  (handler: ClerkMiddlewareHandler, options?: ClerkMiddlewareOptions): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware((auth, request, event) => { ... }, (req) => options);\n   */\n  (handler: ClerkMiddlewareHandler, options?: ClerkMiddlewareOptionsCallback): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware(options);\n   */\n  (options?: ClerkMiddlewareOptions): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware;\n   */\n  (request: NextMiddlewareRequestParam, event: NextMiddlewareEvtParam): NextMiddlewareReturn;\n}\n\n/**\n * The `clerkMiddleware()` helper integrates Clerk authentication into your Next.js application through Middleware. `clerkMiddleware()` is compatible with both the App and Pages routers.\n */\nexport const clerkMiddleware = ((...args: unknown[]): NextMiddleware | NextMiddlewareReturn => {\n  const [request, event] = parseRequestAndEvent(args);\n  const [handler, params] = parseHandlerAndOptions(args);\n\n  const middleware = clerkMiddlewareRequestDataStorage.run(clerkMiddlewareRequestDataStore, () => {\n    const baseNextMiddleware: NextMiddleware = withLogger('clerkMiddleware', logger => async (request, event) => {\n      // Handles the case where `options` is a callback function to dynamically access `NextRequest`\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\n\n      const keyless = await getKeylessCookieValue(name => request.cookies.get(name)?.value);\n\n      const publishableKey = assertKey(\n        resolvedParams.publishableKey || PUBLISHABLE_KEY || keyless?.publishableKey,\n        () => errorThrower.throwMissingPublishableKeyError(),\n      );\n\n      const secretKey = assertKey(resolvedParams.secretKey || SECRET_KEY || keyless?.secretKey, () =>\n        errorThrower.throwMissingSecretKeyError(),\n      );\n\n      // Handle Frontend API proxy requests early, before authentication\n      const frontendApiProxyConfig = resolvedParams.frontendApiProxy;\n      if (frontendApiProxyConfig) {\n        const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = frontendApiProxyConfig;\n\n        // Resolve enabled - either boolean or function\n        const requestUrl = new URL(request.url);\n        const isEnabled = typeof enabled === 'function' ? enabled(requestUrl) : enabled;\n\n        if (isEnabled && matchProxyPath(request, { proxyPath })) {\n          return clerkFrontendApiProxy(request, {\n            proxyPath,\n            publishableKey,\n            secretKey,\n          });\n        }\n      }\n\n      const signInUrl = resolvedParams.signInUrl || SIGN_IN_URL;\n      const signUpUrl = resolvedParams.signUpUrl || SIGN_UP_URL;\n\n      const options = {\n        publishableKey,\n        secretKey,\n        signInUrl,\n        signUpUrl,\n        ...resolvedParams,\n      };\n\n      // Propagates the request data to be accessed on the server application runtime from helpers such as `clerkClient`\n      clerkMiddlewareRequestDataStore.set('requestData', options);\n      const resolvedClerkClient = await clerkClient();\n\n      if (options.debug) {\n        logger.enable();\n      }\n      const clerkRequest = createClerkRequest(request);\n      logger.debug('options', options);\n      logger.debug('url', () => clerkRequest.toJSON());\n\n      const authHeader = request.headers.get(constants.Headers.Authorization);\n      if (authHeader && authHeader.startsWith('Basic ')) {\n        logger.debug('Basic Auth detected');\n      }\n\n      const cspHeader = request.headers.get(constants.Headers.ContentSecurityPolicy);\n      if (cspHeader) {\n        logger.debug('Content-Security-Policy detected', () => ({\n          value: cspHeader,\n        }));\n      }\n\n      const requestState = await resolvedClerkClient.authenticateRequest(\n        clerkRequest,\n        createAuthenticateRequestOptions(clerkRequest, options),\n      );\n\n      logger.debug('requestState', () => ({\n        status: requestState.status,\n        headers: JSON.stringify(Object.fromEntries(requestState.headers)),\n        reason: requestState.reason,\n      }));\n\n      const locationHeader = requestState.headers.get(constants.Headers.Location);\n      if (locationHeader) {\n        handleNetlifyCacheInDevInstance({\n          locationHeader,\n          requestStateHeaders: requestState.headers,\n          publishableKey: requestState.publishableKey,\n        });\n\n        const res = NextResponse.redirect(requestState.headers.get(constants.Headers.Location) || locationHeader);\n        requestState.headers.forEach((value, key) => {\n          if (key === constants.Headers.Location) {\n            return;\n          }\n          res.headers.append(key, value);\n        });\n        return res;\n      } else if (requestState.status === AuthStatus.Handshake) {\n        throw new Error('Clerk: handshake status without redirect');\n      }\n\n      const authObject = requestState.toAuth();\n      logger.debug('auth', () => ({ auth: authObject, debug: authObject.debug() }));\n\n      const redirectToSignIn = createMiddlewareRedirectToSignIn(clerkRequest);\n      const redirectToSignUp = createMiddlewareRedirectToSignUp(clerkRequest);\n      const protect = await createMiddlewareProtect(clerkRequest, authObject, redirectToSignIn);\n\n      const authHandler = createMiddlewareAuthHandler(requestState, redirectToSignIn, redirectToSignUp);\n      authHandler.protect = protect;\n\n      let handlerResult: Response = NextResponse.next();\n      try {\n        const userHandlerResult = await clerkMiddlewareRequestDataStorage.run(\n          clerkMiddlewareRequestDataStore,\n          async () => handler?.(authHandler, request, event),\n        );\n        handlerResult = userHandlerResult || handlerResult;\n      } catch (e: any) {\n        handlerResult = handleControlFlowErrors(e, clerkRequest, request, requestState);\n      }\n      if (options.contentSecurityPolicy) {\n        const { headers } = createContentSecurityPolicyHeaders(\n          (parsePublishableKey(publishableKey)?.frontendApi ?? '').replace('$', ''),\n          options.contentSecurityPolicy,\n        );\n\n        const cspRequestHeaders: Record<string, string> = {};\n        headers.forEach(([key, value]) => {\n          setHeader(handlerResult, key, value);\n          cspRequestHeaders[key] = value;\n        });\n\n        // Forward CSP headers as request headers so server components\n        // can access the nonce via headers()\n        setRequestHeadersOnNextResponse(handlerResult, clerkRequest, cspRequestHeaders);\n\n        logger.debug('Clerk generated CSP', () => ({\n          headers,\n        }));\n      }\n\n      // TODO @nikos: we need to make this more generic\n      // and move the logic in clerk/backend\n      if (requestState.headers) {\n        requestState.headers.forEach((value, key) => {\n          if (key === constants.Headers.ContentSecurityPolicy) {\n            logger.debug('Content-Security-Policy detected', () => ({\n              value,\n            }));\n          }\n          handlerResult.headers.append(key, value);\n        });\n      }\n\n      if (isRedirect(handlerResult)) {\n        logger.debug('handlerResult is redirect');\n        return serverRedirectWithAuth(clerkRequest, handlerResult, options);\n      }\n\n      if (options.debug) {\n        setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });\n      }\n\n      const keylessKeysForRequestData =\n        // Only pass keyless credentials when there are no explicit keys\n        secretKey === keyless?.secretKey\n          ? {\n              publishableKey: keyless?.publishableKey,\n              secretKey: keyless?.secretKey,\n            }\n          : {};\n\n      decorateRequest(\n        clerkRequest,\n        handlerResult,\n        requestState,\n        resolvedParams,\n        keylessKeysForRequestData,\n        authObject.tokenType === 'session_token' ? null : makeAuthObjectSerializable(authObject),\n      );\n\n      return handlerResult;\n    });\n\n    const keylessMiddleware: NextMiddleware = async (request, event) => {\n      /**\n       * This mechanism replaces a full-page reload. Ensures that middleware will re-run and authenticate the request properly without the secret key or publishable key to be missing.\n       */\n      if (isKeylessSyncRequest(request)) {\n        return returnBackFromKeylessSync(request);\n      }\n\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\n      const keyless = await getKeylessCookieValue(name => request.cookies.get(name)?.value);\n\n      const isMissingPublishableKey = !(resolvedParams.publishableKey || PUBLISHABLE_KEY || keyless?.publishableKey);\n      const authHeader = getHeader(request, constants.Headers.Authorization)?.replace('Bearer ', '') ?? '';\n\n      /**\n       * In keyless mode, if the publishable key is missing, let the request through, to render `<ClerkProvider/>` that will resume the flow gracefully.\n       */\n      if (isMissingPublishableKey && !isMachineTokenByPrefix(authHeader)) {\n        const res = NextResponse.next();\n        setRequestHeadersOnNextResponse(res, request, {\n          [constants.Headers.AuthStatus]: 'signed-out',\n        });\n        return res;\n      }\n\n      return baseNextMiddleware(request, event);\n    };\n\n    const nextMiddleware: NextMiddleware = async (request, event) => {\n      if (canUseKeyless) {\n        return keylessMiddleware(request, event);\n      }\n\n      return baseNextMiddleware(request, event);\n    };\n\n    // If we have a request and event, we're being called as a middleware directly\n    // eg, export default clerkMiddleware;\n    if (request && event) {\n      return nextMiddleware(request, event);\n    }\n\n    // Otherwise, return a middleware that can be called with a request and event\n    // eg, export default clerkMiddleware(auth => { ... });\n    return nextMiddleware;\n  });\n\n  return middleware;\n}) as ClerkMiddleware;\n\nconst parseRequestAndEvent = (args: unknown[]) => {\n  return [args[0] instanceof Request ? args[0] : undefined, args[0] instanceof Request ? args[1] : undefined] as [\n    NextMiddlewareRequestParam | undefined,\n    NextMiddlewareEvtParam | undefined,\n  ];\n};\n\nconst parseHandlerAndOptions = (args: unknown[]) => {\n  return [\n    typeof args[0] === 'function' ? args[0] : undefined,\n    (args.length === 2 ? args[1] : typeof args[0] === 'function' ? {} : args[0]) || {},\n  ] as [ClerkMiddlewareHandler | undefined, ClerkMiddlewareOptions | ClerkMiddlewareOptionsCallback];\n};\n\nconst isKeylessSyncRequest = (request: NextMiddlewareRequestParam) =>\n  request.nextUrl.pathname === '/clerk-sync-keyless';\n\nconst returnBackFromKeylessSync = (request: NextMiddlewareRequestParam) => {\n  const returnUrl = request.nextUrl.searchParams.get('returnUrl');\n  const url = new URL(request.url);\n  url.pathname = '';\n\n  return NextResponse.redirect(returnUrl || url.toString());\n};\n\ntype AuthenticateRequest = Pick<ClerkClient, 'authenticateRequest'>['authenticateRequest'];\n\nexport const createAuthenticateRequestOptions = (\n  clerkRequest: ClerkRequest,\n  options: ClerkMiddlewareOptions,\n): Parameters<AuthenticateRequest>[1] => {\n  // Auto-derive proxyUrl from frontendApiProxy config if not explicitly set\n  let resolvedOptions = options;\n  if (options.frontendApiProxy && !options.proxyUrl) {\n    const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = options.frontendApiProxy;\n    const requestUrl = new URL(clerkRequest.url);\n    const isEnabled = typeof enabled === 'function' ? enabled(requestUrl) : enabled;\n\n    if (isEnabled) {\n      const derivedProxyUrl = `${requestUrl.origin}${proxyPath}`;\n      resolvedOptions = { ...options, proxyUrl: derivedProxyUrl };\n    }\n  }\n\n  return {\n    ...resolvedOptions,\n    ...handleMultiDomainAndProxy(clerkRequest, resolvedOptions),\n    // TODO: Leaving the acceptsToken as 'any' opens up the possibility of\n    // an economic attack. We should revisit this and only verify a token\n    // when auth() or auth.protect() is invoked.\n    acceptsToken: 'any',\n  };\n};\n\nconst createMiddlewareRedirectToSignIn = (\n  clerkRequest: ClerkRequest,\n): ClerkMiddlewareSessionAuthObject['redirectToSignIn'] => {\n  return (opts = {}) => {\n    const url = clerkRequest.clerkUrl.toString();\n    redirectToSignInError(url, opts.returnBackUrl);\n  };\n};\n\nconst createMiddlewareRedirectToSignUp = (\n  clerkRequest: ClerkRequest,\n): ClerkMiddlewareSessionAuthObject['redirectToSignUp'] => {\n  return (opts = {}) => {\n    const url = clerkRequest.clerkUrl.toString();\n    redirectToSignUpError(url, opts.returnBackUrl);\n  };\n};\n\nconst createMiddlewareProtect = (\n  clerkRequest: ClerkRequest,\n  rawAuthObject: AuthObject,\n  redirectToSignIn: RedirectFun<Response>,\n) => {\n  return (async (params: any, options: any) => {\n    const notFound = () => nextjsNotFound();\n\n    const redirect = (url: string) =>\n      nextjsRedirectError(url, {\n        redirectUrl: url,\n      });\n\n    const requestedToken = params?.token || options?.token || TokenType.SessionToken;\n    const authObject = getAuthObjectForAcceptedToken({ authObject: rawAuthObject, acceptsToken: requestedToken });\n\n    return createProtect({\n      request: clerkRequest,\n      redirect,\n      notFound,\n      unauthorized,\n      authObject,\n      redirectToSignIn,\n    })(params, options);\n  }) as unknown as Promise<AuthProtect>;\n};\n\n/**\n * Modifies the auth object based on the token type.\n * - For session tokens: adds redirect functions to the auth object\n * - For machine tokens: validates token type and returns appropriate auth object\n */\nconst createMiddlewareAuthHandler = (\n  requestState: AuthenticatedState<'session_token'> | UnauthenticatedState<'session_token'>,\n  redirectToSignIn: RedirectFun<Response>,\n  redirectToSignUp: RedirectFun<Response>,\n): ClerkMiddlewareAuth => {\n  const authHandler = async (options?: GetAuthOptions) => {\n    const rawAuthObject = requestState.toAuth({ treatPendingAsSignedOut: options?.treatPendingAsSignedOut });\n    const acceptsToken = options?.acceptsToken ?? TokenType.SessionToken;\n\n    const authObject = getAuthObjectForAcceptedToken({\n      authObject: rawAuthObject,\n      acceptsToken,\n    });\n\n    if (authObject.tokenType === TokenType.SessionToken && isTokenTypeAccepted(TokenType.SessionToken, acceptsToken)) {\n      return Object.assign(authObject, {\n        redirectToSignIn,\n        redirectToSignUp,\n      });\n    }\n\n    return authObject;\n  };\n\n  return authHandler as ClerkMiddlewareAuth;\n};\n\n// Handle errors thrown by protect() and redirectToSignIn() calls,\n// as we want to align the APIs between middleware, pages and route handlers\n// Normally, middleware requires to explicitly return a response, but we want to\n// avoid discrepancies between the APIs as it's easy to miss the `return` statement\n// especially when copy-pasting code from one place to another.\n// This function handles the known errors thrown by the APIs described above,\n// and returns the appropriate response.\nconst handleControlFlowErrors = (\n  e: any,\n  clerkRequest: ClerkRequest,\n  nextRequest: NextRequest,\n  requestState: RequestState,\n): Response => {\n  if (isMalformedURLError(e)) {\n    return new NextResponse(null, { status: 400, statusText: 'Bad Request' });\n  }\n\n  if (isNextjsUnauthorizedError(e)) {\n    const response = new NextResponse(null, { status: 401 });\n\n    // RequestState.toAuth() returns a session_token type by default.\n    // We need to cast it to the correct type to check for OAuth tokens.\n    const authObject = (requestState as RequestState<TokenType>).toAuth();\n    if (authObject && authObject.tokenType === TokenType.OAuthToken) {\n      // Following MCP spec, we return WWW-Authenticate header on 401 responses\n      // to enable OAuth 2.0 authorization server discovery (RFC9728).\n      // See https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-1-authorization-server-location\n      const publishableKey = parsePublishableKey(requestState.publishableKey);\n      return setHeader(\n        response,\n        'WWW-Authenticate',\n        `Bearer resource_metadata=\"https://${publishableKey?.frontendApi}/.well-known/oauth-protected-resource\"`,\n      );\n    }\n\n    return response;\n  }\n\n  if (isNextjsNotFoundError(e)) {\n    // Rewrite to a bogus URL to force not found error\n    return setHeader(\n      // This is an internal rewrite purely to trigger a not found error. We do not want Next.js to think that the\n      // destination URL is a valid page, so we use `nextRequest.url` as the base for the fake URL, which Next.js\n      // understands is an internal URL and won't run middleware against the request.\n      NextResponse.rewrite(new URL(`/clerk_${Date.now()}`, nextRequest.url)),\n      constants.Headers.AuthReason,\n      'protect-rewrite',\n    );\n  }\n\n  const isRedirectToSignIn = isRedirectToSignInError(e);\n  const isRedirectToSignUp = isRedirectToSignUpError(e);\n\n  if (isRedirectToSignIn || isRedirectToSignUp) {\n    const redirect = createRedirect({\n      redirectAdapter,\n      baseUrl: clerkRequest.clerkUrl,\n      signInUrl: requestState.signInUrl,\n      signUpUrl: requestState.signUpUrl,\n      publishableKey: requestState.publishableKey,\n      sessionStatus: requestState.toAuth()?.sessionStatus,\n      isSatellite: requestState.isSatellite,\n    });\n\n    const { returnBackUrl } = e;\n    return redirect[isRedirectToSignIn ? 'redirectToSignIn' : 'redirectToSignUp']({ returnBackUrl });\n  }\n\n  if (isNextjsRedirectError(e)) {\n    return redirectAdapter(e.redirectUrl);\n  }\n\n  throw e;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,sBAUO;AACP,mBAA0E;AAC1E,kBAAoC;AACpC,iCAAgD;AAChD,yBAAoC;AACpC,wBAA2C;AAE3C,oBAA6B;AAI7B,mBAA8D;AAC9D,yBAA2B;AAC3B,2BAA8B;AAC9B,yBAA4B;AAC5B,uBAAsE;AACtE,qCAAsF;AACtF,0BAA6B;AAC7B,2BAA0B;AAC1B,qBAAsC;AACtC,gCAAmF;AACnF,wBAUO;AAEP,qBAA8B;AAO9B,IAAAA,gBAMO;AA0EA,MAAM,mBAAmB,IAAI,SAA2D;AAC7F,QAAM,CAAC,SAAS,KAAK,IAAI,qBAAqB,IAAI;AAClD,QAAM,CAAC,SAAS,MAAM,IAAI,uBAAuB,IAAI;AAErD,QAAM,aAAa,4DAAkC,IAAI,2DAAiC,MAAM;AAC9F,UAAM,yBAAqC,+BAAW,mBAAmB,YAAU,OAAOC,UAASC,WAAU;AAlJjH;AAoJM,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOD,QAAO,IAAI;AAE9E,YAAM,UAAU,UAAM,sCAAsB,UAAK;AAtJvD,YAAAE;AAsJ0D,gBAAAA,MAAAF,SAAQ,QAAQ,IAAI,IAAI,MAAxB,gBAAAE,IAA2B;AAAA,OAAK;AAEpF,YAAM,qBAAiB;AAAA,QACrB,eAAe,kBAAkB,qCAAmB,mCAAS;AAAA,QAC7D,MAAM,iCAAa,gCAAgC;AAAA,MACrD;AAEA,YAAM,gBAAY;AAAA,QAAU,eAAe,aAAa,gCAAc,mCAAS;AAAA,QAAW,MACxF,iCAAa,2BAA2B;AAAA,MAC1C;AAGA,YAAM,yBAAyB,eAAe;AAC9C,UAAI,wBAAwB;AAC1B,cAAM,EAAE,SAAS,MAAM,YAAY,gCAAmB,IAAI;AAG1D,cAAM,aAAa,IAAI,IAAIF,SAAQ,GAAG;AACtC,cAAM,YAAY,OAAO,YAAY,aAAa,QAAQ,UAAU,IAAI;AAExE,YAAI,iBAAa,6BAAeA,UAAS,EAAE,UAAU,CAAC,GAAG;AACvD,qBAAO,oCAAsBA,UAAS;AAAA,YACpC;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,YAAY,eAAe,aAAa;AAC9C,YAAM,YAAY,eAAe,aAAa;AAE9C,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAGA,gEAAgC,IAAI,eAAe,OAAO;AAC1D,YAAM,sBAAsB,UAAM,gCAAY;AAE9C,UAAI,QAAQ,OAAO;AACjB,eAAO,OAAO;AAAA,MAChB;AACA,YAAM,mBAAe,oCAAmBA,QAAO;AAC/C,aAAO,MAAM,WAAW,OAAO;AAC/B,aAAO,MAAM,OAAO,MAAM,aAAa,OAAO,CAAC;AAE/C,YAAM,aAAaA,SAAQ,QAAQ,IAAI,0BAAU,QAAQ,aAAa;AACtE,UAAI,cAAc,WAAW,WAAW,QAAQ,GAAG;AACjD,eAAO,MAAM,qBAAqB;AAAA,MACpC;AAEA,YAAM,YAAYA,SAAQ,QAAQ,IAAI,0BAAU,QAAQ,qBAAqB;AAC7E,UAAI,WAAW;AACb,eAAO,MAAM,oCAAoC,OAAO;AAAA,UACtD,OAAO;AAAA,QACT,EAAE;AAAA,MACJ;AAEA,YAAM,eAAe,MAAM,oBAAoB;AAAA,QAC7C;AAAA,QACA,iCAAiC,cAAc,OAAO;AAAA,MACxD;AAEA,aAAO,MAAM,gBAAgB,OAAO;AAAA,QAClC,QAAQ,aAAa;AAAA,QACrB,SAAS,KAAK,UAAU,OAAO,YAAY,aAAa,OAAO,CAAC;AAAA,QAChE,QAAQ,aAAa;AAAA,MACvB,EAAE;AAEF,YAAM,iBAAiB,aAAa,QAAQ,IAAI,0BAAU,QAAQ,QAAQ;AAC1E,UAAI,gBAAgB;AAClB,wEAAgC;AAAA,UAC9B;AAAA,UACA,qBAAqB,aAAa;AAAA,UAClC,gBAAgB,aAAa;AAAA,QAC/B,CAAC;AAED,cAAM,MAAM,2BAAa,SAAS,aAAa,QAAQ,IAAI,0BAAU,QAAQ,QAAQ,KAAK,cAAc;AACxG,qBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC3C,cAAI,QAAQ,0BAAU,QAAQ,UAAU;AACtC;AAAA,UACF;AACA,cAAI,QAAQ,OAAO,KAAK,KAAK;AAAA,QAC/B,CAAC;AACD,eAAO;AAAA,MACT,WAAW,aAAa,WAAW,2BAAW,WAAW;AACvD,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AAEA,YAAM,aAAa,aAAa,OAAO;AACvC,aAAO,MAAM,QAAQ,OAAO,EAAE,MAAM,YAAY,OAAO,WAAW,MAAM,EAAE,EAAE;AAE5E,YAAM,mBAAmB,iCAAiC,YAAY;AACtE,YAAM,mBAAmB,iCAAiC,YAAY;AACtE,YAAM,UAAU,MAAM,wBAAwB,cAAc,YAAY,gBAAgB;AAExF,YAAM,cAAc,4BAA4B,cAAc,kBAAkB,gBAAgB;AAChG,kBAAY,UAAU;AAEtB,UAAI,gBAA0B,2BAAa,KAAK;AAChD,UAAI;AACF,cAAM,oBAAoB,MAAM,4DAAkC;AAAA,UAChE;AAAA,UACA,YAAY,mCAAU,aAAaA,UAASC;AAAA,QAC9C;AACA,wBAAgB,qBAAqB;AAAA,MACvC,SAAS,GAAQ;AACf,wBAAgB,wBAAwB,GAAG,cAAcD,UAAS,YAAY;AAAA,MAChF;AACA,UAAI,QAAQ,uBAAuB;AACjC,cAAM,EAAE,QAAQ,QAAI;AAAA,YACjB,gDAAoB,cAAc,MAAlC,mBAAqC,gBAArC,YAAoD,IAAI,QAAQ,KAAK,EAAE;AAAA,UACxE,QAAQ;AAAA,QACV;AAEA,cAAM,oBAA4C,CAAC;AACnD,gBAAQ,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAChC,sCAAU,eAAe,KAAK,KAAK;AACnC,4BAAkB,GAAG,IAAI;AAAA,QAC3B,CAAC;AAID,2DAAgC,eAAe,cAAc,iBAAiB;AAE9E,eAAO,MAAM,uBAAuB,OAAO;AAAA,UACzC;AAAA,QACF,EAAE;AAAA,MACJ;AAIA,UAAI,aAAa,SAAS;AACxB,qBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC3C,cAAI,QAAQ,0BAAU,QAAQ,uBAAuB;AACnD,mBAAO,MAAM,oCAAoC,OAAO;AAAA,cACtD;AAAA,YACF,EAAE;AAAA,UACJ;AACA,wBAAc,QAAQ,OAAO,KAAK,KAAK;AAAA,QACzC,CAAC;AAAA,MACH;AAEA,cAAI,yBAAW,aAAa,GAAG;AAC7B,eAAO,MAAM,2BAA2B;AACxC,mBAAO,qCAAuB,cAAc,eAAe,OAAO;AAAA,MACpE;AAEA,UAAI,QAAQ,OAAO;AACjB,2DAAgC,eAAe,cAAc,EAAE,CAAC,0BAAU,QAAQ,WAAW,GAAG,OAAO,CAAC;AAAA,MAC1G;AAEA,YAAM;AAAA;AAAA,QAEJ,eAAc,mCAAS,aACnB;AAAA,UACE,gBAAgB,mCAAS;AAAA,UACzB,WAAW,mCAAS;AAAA,QACtB,IACA,CAAC;AAAA;AAEP;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,cAAc,kBAAkB,WAAO,4CAA2B,UAAU;AAAA,MACzF;AAEA,aAAO;AAAA,IACT,CAAC;AAED,UAAM,oBAAoC,OAAOA,UAASC,WAAU;AAxUxE;AA4UM,UAAI,qBAAqBD,QAAO,GAAG;AACjC,eAAO,0BAA0BA,QAAO;AAAA,MAC1C;AAEA,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOA,QAAO,IAAI;AAC9E,YAAM,UAAU,UAAM,sCAAsB,UAAK;AAjVvD,YAAAE;AAiV0D,gBAAAA,MAAAF,SAAQ,QAAQ,IAAI,IAAI,MAAxB,gBAAAE,IAA2B;AAAA,OAAK;AAEpF,YAAM,0BAA0B,EAAE,eAAe,kBAAkB,qCAAmB,mCAAS;AAC/F,YAAM,cAAa,+CAAUF,UAAS,0BAAU,QAAQ,aAAa,MAAlD,mBAAqD,QAAQ,WAAW,QAAxE,YAA+E;AAKlG,UAAI,2BAA2B,KAAC,wCAAuB,UAAU,GAAG;AAClE,cAAM,MAAM,2BAAa,KAAK;AAC9B,2DAAgC,KAAKA,UAAS;AAAA,UAC5C,CAAC,0BAAU,QAAQ,UAAU,GAAG;AAAA,QAClC,CAAC;AACD,eAAO;AAAA,MACT;AAEA,aAAO,mBAAmBA,UAASC,MAAK;AAAA,IAC1C;AAEA,UAAM,iBAAiC,OAAOD,UAASC,WAAU;AAC/D,UAAI,oCAAe;AACjB,eAAO,kBAAkBD,UAASC,MAAK;AAAA,MACzC;AAEA,aAAO,mBAAmBD,UAASC,MAAK;AAAA,IAC1C;AAIA,QAAI,WAAW,OAAO;AACpB,aAAO,eAAe,SAAS,KAAK;AAAA,IACtC;AAIA,WAAO;AAAA,EACT,CAAC;AAED,SAAO;AACT;AAEA,MAAM,uBAAuB,CAAC,SAAoB;AAChD,SAAO,CAAC,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI,QAAW,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI,MAAS;AAI5G;AAEA,MAAM,yBAAyB,CAAC,SAAoB;AAClD,SAAO;AAAA,IACL,OAAO,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI;AAAA,KACzC,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;AAAA,EACnF;AACF;AAEA,MAAM,uBAAuB,CAAC,YAC5B,QAAQ,QAAQ,aAAa;AAE/B,MAAM,4BAA4B,CAAC,YAAwC;AACzE,QAAM,YAAY,QAAQ,QAAQ,aAAa,IAAI,WAAW;AAC9D,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,MAAI,WAAW;AAEf,SAAO,2BAAa,SAAS,aAAa,IAAI,SAAS,CAAC;AAC1D;AAIO,MAAM,mCAAmC,CAC9C,cACA,YACuC;AAEvC,MAAI,kBAAkB;AACtB,MAAI,QAAQ,oBAAoB,CAAC,QAAQ,UAAU;AACjD,UAAM,EAAE,SAAS,MAAM,YAAY,gCAAmB,IAAI,QAAQ;AAClE,UAAM,aAAa,IAAI,IAAI,aAAa,GAAG;AAC3C,UAAM,YAAY,OAAO,YAAY,aAAa,QAAQ,UAAU,IAAI;AAExE,QAAI,WAAW;AACb,YAAM,kBAAkB,GAAG,WAAW,MAAM,GAAG,SAAS;AACxD,wBAAkB,EAAE,GAAG,SAAS,UAAU,gBAAgB;AAAA,IAC5D;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAG,yCAA0B,cAAc,eAAe;AAAA;AAAA;AAAA;AAAA,IAI1D,cAAc;AAAA,EAChB;AACF;AAEA,MAAM,mCAAmC,CACvC,iBACyD;AACzD,SAAO,CAAC,OAAO,CAAC,MAAM;AACpB,UAAM,MAAM,aAAa,SAAS,SAAS;AAC3C,iDAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AACF;AAEA,MAAM,mCAAmC,CACvC,iBACyD;AACzD,SAAO,CAAC,OAAO,CAAC,MAAM;AACpB,UAAM,MAAM,aAAa,SAAS,SAAS;AAC3C,iDAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AACF;AAEA,MAAM,0BAA0B,CAC9B,cACA,eACA,qBACG;AACH,UAAQ,OAAO,QAAa,YAAiB;AAC3C,UAAM,WAAW,UAAM,kBAAAE,UAAe;AAEtC,UAAM,WAAW,CAAC,YAChB,uCAAoB,KAAK;AAAA,MACvB,aAAa;AAAA,IACf,CAAC;AAEH,UAAM,kBAAiB,iCAAQ,WAAS,mCAAS,UAAS,0BAAU;AACpE,UAAM,iBAAa,+CAA8B,EAAE,YAAY,eAAe,cAAc,eAAe,CAAC;AAE5G,eAAO,8BAAc;AAAA,MACnB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EAAE,QAAQ,OAAO;AAAA,EACpB;AACF;AAOA,MAAM,8BAA8B,CAClC,cACA,kBACA,qBACwB;AACxB,QAAM,cAAc,OAAO,YAA6B;AAve1D;AAweI,UAAM,gBAAgB,aAAa,OAAO,EAAE,yBAAyB,mCAAS,wBAAwB,CAAC;AACvG,UAAM,gBAAe,wCAAS,iBAAT,YAAyB,0BAAU;AAExD,UAAM,iBAAa,+CAA8B;AAAA,MAC/C,YAAY;AAAA,MACZ;AAAA,IACF,CAAC;AAED,QAAI,WAAW,cAAc,0BAAU,oBAAgB,qCAAoB,0BAAU,cAAc,YAAY,GAAG;AAChH,aAAO,OAAO,OAAO,YAAY;AAAA,QAC/B;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AASA,MAAM,0BAA0B,CAC9B,GACA,cACA,aACA,iBACa;AAzgBf;AA0gBE,UAAI,wCAAoB,CAAC,GAAG;AAC1B,WAAO,IAAI,2BAAa,MAAM,EAAE,QAAQ,KAAK,YAAY,cAAc,CAAC;AAAA,EAC1E;AAEA,UAAI,6CAA0B,CAAC,GAAG;AAChC,UAAM,WAAW,IAAI,2BAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAIvD,UAAM,aAAc,aAAyC,OAAO;AACpE,QAAI,cAAc,WAAW,cAAc,0BAAU,YAAY;AAI/D,YAAM,qBAAiB,iCAAoB,aAAa,cAAc;AACtE,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,qCAAqC,iDAAgB,WAAW;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,UAAI,yCAAsB,CAAC,GAAG;AAE5B,eAAO;AAAA;AAAA;AAAA;AAAA,MAIL,2BAAa,QAAQ,IAAI,IAAI,UAAU,KAAK,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC;AAAA,MACrE,0BAAU,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,yBAAqB,2CAAwB,CAAC;AACpD,QAAM,yBAAqB,2CAAwB,CAAC;AAEpD,MAAI,sBAAsB,oBAAoB;AAC5C,UAAM,eAAW,gCAAe;AAAA,MAC9B;AAAA,MACA,SAAS,aAAa;AAAA,MACtB,WAAW,aAAa;AAAA,MACxB,WAAW,aAAa;AAAA,MACxB,gBAAgB,aAAa;AAAA,MAC7B,gBAAe,kBAAa,OAAO,MAApB,mBAAuB;AAAA,MACtC,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,UAAM,EAAE,cAAc,IAAI;AAC1B,WAAO,SAAS,qBAAqB,qBAAqB,kBAAkB,EAAE,EAAE,cAAc,CAAC;AAAA,EACjG;AAEA,UAAI,yCAAsB,CAAC,GAAG;AAC5B,eAAO,+BAAgB,EAAE,WAAW;AAAA,EACtC;AAEA,QAAM;AACR;","names":["import_utils","request","event","_a","nextjsNotFound"]}

package/dist/cjs/server/constants.js

@@ -58,7 +58,7 @@ const SIGN_IN_URL = process.env.NEXT_PUBLIC_CLERK_SIGN_IN_URL || "";
 const SIGN_UP_URL = process.env.NEXT_PUBLIC_CLERK_SIGN_UP_URL || "";
 const SDK_METADATA = {
   name: "@clerk/nextjs",
-  version: "7.2.4-snapshot.v20260421194054",
+  version: "7.2.4",
   environment: process.env.NODE_ENV
 };
 const TELEMETRY_DISABLED = (0, import_underscore.isTruthy)(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DISABLED);

package/dist/cjs/server/createClerkClient.js

@@ -28,7 +28,7 @@ const clerkClientDefaultOptions = {
   publishableKey: import_constants.PUBLISHABLE_KEY,
   apiUrl: import_constants.API_URL,
   apiVersion: import_constants.API_VERSION,
-  userAgent: `${"@clerk/nextjs"}@${"7.2.4-snapshot.v20260421194054"}`,
+  userAgent: `${"@clerk/nextjs"}@${"7.2.4"}`,
   proxyUrl: import_constants.PROXY_URL,
   domain: import_constants.DOMAIN,
   isSatellite: import_constants.IS_SATELLITE,

package/dist/cjs/server/createClerkClient.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/createClerkClient.ts"],"sourcesContent":["import { createClerkClient } from '@clerk/backend';\n\nimport {\n  API_URL,\n  API_VERSION,\n  DOMAIN,\n  IS_SATELLITE,\n  MACHINE_SECRET_KEY,\n  PROXY_URL,\n  PUBLISHABLE_KEY,\n  SDK_METADATA,\n  SECRET_KEY,\n  TELEMETRY_DEBUG,\n  TELEMETRY_DISABLED,\n} from './constants';\n\nconst clerkClientDefaultOptions = {\n  secretKey: SECRET_KEY,\n  publishableKey: PUBLISHABLE_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,\n  proxyUrl: PROXY_URL,\n  domain: DOMAIN,\n  isSatellite: IS_SATELLITE,\n  machineSecretKey: MACHINE_SECRET_KEY,\n  sdkMetadata: SDK_METADATA,\n  telemetry: {\n    disabled: TELEMETRY_DISABLED,\n    debug: TELEMETRY_DEBUG,\n  },\n};\n\nexport const createClerkClientWithOptions: typeof createClerkClient = options =>\n  createClerkClient({ ...clerkClientDefaultOptions, ...options });\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAkC;AAElC,uBAYO;AAEP,MAAM,4BAA4B;AAAA,EAChC,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,WAAW,GAAG,eAAY,IAAI,gCAAe;AAAA,EAC7C,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,WAAW;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACF;AAEO,MAAM,+BAAyD,iBACpE,kCAAkB,EAAE,GAAG,2BAA2B,GAAG,QAAQ,CAAC;","names":[]}
+{"version":3,"sources":["../../../src/server/createClerkClient.ts"],"sourcesContent":["import { createClerkClient } from '@clerk/backend';\n\nimport {\n  API_URL,\n  API_VERSION,\n  DOMAIN,\n  IS_SATELLITE,\n  MACHINE_SECRET_KEY,\n  PROXY_URL,\n  PUBLISHABLE_KEY,\n  SDK_METADATA,\n  SECRET_KEY,\n  TELEMETRY_DEBUG,\n  TELEMETRY_DISABLED,\n} from './constants';\n\nconst clerkClientDefaultOptions = {\n  secretKey: SECRET_KEY,\n  publishableKey: PUBLISHABLE_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,\n  proxyUrl: PROXY_URL,\n  domain: DOMAIN,\n  isSatellite: IS_SATELLITE,\n  machineSecretKey: MACHINE_SECRET_KEY,\n  sdkMetadata: SDK_METADATA,\n  telemetry: {\n    disabled: TELEMETRY_DISABLED,\n    debug: TELEMETRY_DEBUG,\n  },\n};\n\nexport const createClerkClientWithOptions: typeof createClerkClient = options =>\n  createClerkClient({ ...clerkClientDefaultOptions, ...options });\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAkC;AAElC,uBAYO;AAEP,MAAM,4BAA4B;AAAA,EAChC,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,WAAW,GAAG,eAAY,IAAI,OAAe;AAAA,EAC7C,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,WAAW;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACF;AAEO,MAAM,+BAAyD,iBACpE,kCAAkB,EAAE,GAAG,2BAA2B,GAAG,QAAQ,CAAC;","names":[]}

package/dist/cjs/server/protect.js

@@ -83,17 +83,24 @@ function createProtect(opts) {
     return handleUnauthorized();
   });
 }
+const AUTH_PARAM_KEYS = ["role", "permission", "feature", "plan", "reverification"];
 const getAuthorizationParams = (arg) => {
   if (!arg) {
     return void 0;
   }
-  if (arg.unauthenticatedUrl || arg.unauthorizedUrl || arg.token) {
-    return void 0;
+  if (typeof arg === "function") {
+    return arg;
+  }
+  const authParams = {};
+  for (const key of AUTH_PARAM_KEYS) {
+    if (arg[key] !== void 0) {
+      authParams[key] = arg[key];
+    }
   }
-  if (Object.keys(arg).length === 1 && "token" in arg) {
+  if (Object.keys(authParams).length === 0) {
     return void 0;
   }
-  return arg;
+  return authParams;
 };
 const isServerActionRequest = (req) => {
   var _a, _b;

package/dist/cjs/server/protect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/protect.ts"],"sourcesContent":["import type { AuthObject } from '@clerk/backend';\nimport type {\n  AuthenticatedMachineObject,\n  AuthenticateRequestOptions,\n  InferAuthObjectFromToken,\n  InferAuthObjectFromTokenArray,\n  RedirectFun,\n  SignedInAuthObject,\n} from '@clerk/backend/internal';\nimport { constants, isTokenTypeAccepted, TokenType } from '@clerk/backend/internal';\nimport type {\n  CheckAuthorizationFromSessionClaims,\n  CheckAuthorizationParamsFromSessionClaims,\n  CheckAuthorizationParamsWithCustomPermissions,\n  CheckAuthorizationWithCustomPermissions,\n  OrganizationCustomPermissionKey,\n} from '@clerk/shared/types';\n\nimport { constants as nextConstants } from '../constants';\nimport { isNextFetcher } from './nextFetcher';\n\ntype AuthProtectOptions = {\n  /**\n   * The token type to check.\n   */\n  token?: AuthenticateRequestOptions['acceptsToken'];\n  /**\n   * The URL to redirect the user to if they are not authorized.\n   */\n  unauthorizedUrl?: string;\n  /**\n   * The URL to redirect the user to if they are not authenticated.\n   */\n  unauthenticatedUrl?: string;\n};\n\n/**\n * Throws a Nextjs notFound error if user is not authenticated or authorized.\n */\nexport interface AuthProtect {\n  /**\n   * @example\n   * auth.protect({ permission: 'org:admin:example1' });\n   * auth.protect({ role: 'admin' });\n   */\n  <P extends OrganizationCustomPermissionKey>(\n    params?: CheckAuthorizationParamsFromSessionClaims<P>,\n    options?: AuthProtectOptions,\n  ): Promise<SignedInAuthObject>;\n\n  /**\n   * @example\n   * auth.protect(has => has({ permission: 'org:admin:example1' }));\n   */\n  (\n    params?: (has: CheckAuthorizationFromSessionClaims) => boolean,\n    options?: AuthProtectOptions,\n  ): Promise<SignedInAuthObject>;\n\n  /**\n   * @example\n   * auth.protect({ token: 'session_token' });\n   */\n  <T extends TokenType>(\n    options?: AuthProtectOptions & { token: T },\n  ): Promise<InferAuthObjectFromToken<T, SignedInAuthObject, AuthenticatedMachineObject>>;\n\n  /**\n   * @example\n   * auth.protect({ token: ['session_token', 'm2m_token'] });\n   */\n  <T extends TokenType[]>(\n    options?: AuthProtectOptions & { token: T },\n  ): Promise<InferAuthObjectFromTokenArray<T, SignedInAuthObject, AuthenticatedMachineObject>>;\n\n  /**\n   * @example\n   * auth.protect({ token: 'any' });\n   */\n  (options?: AuthProtectOptions & { token: 'any' }): Promise<SignedInAuthObject | AuthenticatedMachineObject>;\n\n  /**\n   * @example\n   * auth.protect();\n   */\n  (options?: AuthProtectOptions): Promise<SignedInAuthObject>;\n}\n\nexport function createProtect(opts: {\n  request: Request;\n  authObject: AuthObject;\n  /**\n   * middleware and pages throw a notFound error if signed out\n   * but the middleware needs to throw an error it can catch\n   * use this callback to customise the behavior\n   */\n  notFound: () => never;\n  /**\n   * see {@link notFound} above\n   */\n  redirect: (url: string) => void;\n  /**\n   * For m2m requests, throws a 401 response\n   */\n  unauthorized: () => void;\n  /**\n   * protect() in middleware redirects to signInUrl if signed out\n   * protect() in pages throws a notFound error if signed out\n   * use this callback to customise the behavior\n   */\n  redirectToSignIn: RedirectFun<unknown>;\n}): AuthProtect {\n  const { redirectToSignIn, authObject, redirect, notFound, request, unauthorized } = opts;\n\n  return (async (...args: any[]) => {\n    const paramsOrFunction = getAuthorizationParams(args[0]);\n    const unauthenticatedUrl = (args[0]?.unauthenticatedUrl || args[1]?.unauthenticatedUrl) as string | undefined;\n    const unauthorizedUrl = (args[0]?.unauthorizedUrl || args[1]?.unauthorizedUrl) as string | undefined;\n    const requestedToken = args[0]?.token || args[1]?.token || TokenType.SessionToken;\n\n    const handleUnauthenticated = () => {\n      if (unauthenticatedUrl) {\n        return redirect(unauthenticatedUrl);\n      }\n      if (isPageRequest(request)) {\n        // TODO: Handle runtime values. What happens if runtime values are set in middleware and in ClerkProvider as well?\n        return redirectToSignIn();\n      }\n      if (isServerActionRequest(request)) {\n        return unauthorized();\n      }\n      return notFound();\n    };\n\n    const handleUnauthorized = () => {\n      // Return 401 for machine token contexts: either the auth object itself is a machine token,\n      // or the endpoint was configured to accept machine tokens but auth failed (e.g. middleware\n      // bypassed, so authObject fell back to a signed-out session object).\n      if (\n        authObject.tokenType !== TokenType.SessionToken ||\n        !isTokenTypeAccepted(TokenType.SessionToken, requestedToken)\n      ) {\n        return unauthorized();\n      }\n\n      if (unauthorizedUrl) {\n        return redirect(unauthorizedUrl);\n      }\n      return notFound();\n    };\n\n    if (!isTokenTypeAccepted(authObject.tokenType, requestedToken)) {\n      return handleUnauthorized();\n    }\n\n    if (authObject.tokenType !== TokenType.SessionToken) {\n      // For machine tokens, we only check if they're authenticated\n      // They don't have session status or organization permissions\n      if (!authObject.isAuthenticated) {\n        return handleUnauthorized();\n      }\n      return authObject;\n    }\n\n    /**\n     * Redirects the user back to the tasks URL if their session status is pending\n     */\n    if (authObject.sessionStatus === 'pending') {\n      return handleUnauthenticated();\n    }\n\n    /**\n     * User is not authenticated\n     */\n    if (!authObject.userId) {\n      return handleUnauthenticated();\n    }\n\n    /**\n     * User is authenticated\n     */\n    if (!paramsOrFunction) {\n      return authObject;\n    }\n\n    /**\n     * if a function is passed and returns false then throw not found\n     */\n    if (typeof paramsOrFunction === 'function') {\n      if (paramsOrFunction(authObject.has)) {\n        return authObject;\n      }\n      return handleUnauthorized();\n    }\n\n    /**\n     * Checking if user is authorized when permission or role is passed\n     */\n    if (authObject.has(paramsOrFunction)) {\n      return authObject;\n    }\n\n    return handleUnauthorized();\n  }) as AuthProtect;\n}\n\nconst getAuthorizationParams = (arg: any) => {\n  if (!arg) {\n    return undefined;\n  }\n\n  // Skip authorization check if the arg contains any of these options\n  if (arg.unauthenticatedUrl || arg.unauthorizedUrl || arg.token) {\n    return undefined;\n  }\n\n  // Skip if it's just a token-only object\n  if (Object.keys(arg).length === 1 && 'token' in arg) {\n    return undefined;\n  }\n\n  // Return the authorization params/function\n  return arg as\n    | CheckAuthorizationParamsWithCustomPermissions\n    | ((has: CheckAuthorizationWithCustomPermissions) => boolean);\n};\n\nconst isServerActionRequest = (req: Request) => {\n  return (\n    !!req.headers.get(nextConstants.Headers.NextUrl) &&\n    (req.headers.get(constants.Headers.Accept)?.includes('text/x-component') ||\n      req.headers.get(constants.Headers.ContentType)?.includes('multipart/form-data') ||\n      !!req.headers.get(nextConstants.Headers.NextAction))\n  );\n};\n\nconst isPageRequest = (req: Request): boolean => {\n  return (\n    req.headers.get(constants.Headers.SecFetchDest) === 'document' ||\n    req.headers.get(constants.Headers.SecFetchDest) === 'iframe' ||\n    req.headers.get(constants.Headers.Accept)?.includes('text/html') ||\n    isAppRouterInternalNavigation(req) ||\n    isPagesRouterInternalNavigation(req)\n  );\n};\n\nconst isAppRouterInternalNavigation = (req: Request) =>\n  (!!req.headers.get(nextConstants.Headers.NextUrl) && !isServerActionRequest(req)) || isPagePathAvailable();\n\nconst isPagePathAvailable = () => {\n  const __fetch = globalThis.fetch;\n\n  if (!isNextFetcher(__fetch)) {\n    return false;\n  }\n\n  const { page } = __fetch.__nextGetStaticStore().getStore() || {};\n\n  return Boolean(page);\n};\n\nconst isPagesRouterInternalNavigation = (req: Request) => !!req.headers.get(nextConstants.Headers.NextjsData);\n\n// /**\n//  * In case we want to handle router handlers and server actions differently in the future\n//  */\n// const isApiRouteRequest = (req: Request) => {\n//   return !isPageRequest(req) && !isServerActionRequest(req);\n// };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,sBAA0D;AAS1D,uBAA2C;AAC3C,yBAA8B;AAqEvB,SAAS,cAAc,MAuBd;AACd,QAAM,EAAE,kBAAkB,YAAY,UAAU,UAAU,SAAS,aAAa,IAAI;AAEpF,UAAQ,UAAU,SAAgB;AAlHpC;AAmHI,UAAM,mBAAmB,uBAAuB,KAAK,CAAC,CAAC;AACvD,UAAM,uBAAsB,UAAK,CAAC,MAAN,mBAAS,yBAAsB,UAAK,CAAC,MAAN,mBAAS;AACpE,UAAM,oBAAmB,UAAK,CAAC,MAAN,mBAAS,sBAAmB,UAAK,CAAC,MAAN,mBAAS;AAC9D,UAAM,mBAAiB,UAAK,CAAC,MAAN,mBAAS,YAAS,UAAK,CAAC,MAAN,mBAAS,UAAS,0BAAU;AAErE,UAAM,wBAAwB,MAAM;AAClC,UAAI,oBAAoB;AACtB,eAAO,SAAS,kBAAkB;AAAA,MACpC;AACA,UAAI,cAAc,OAAO,GAAG;AAE1B,eAAO,iBAAiB;AAAA,MAC1B;AACA,UAAI,sBAAsB,OAAO,GAAG;AAClC,eAAO,aAAa;AAAA,MACtB;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,qBAAqB,MAAM;AAI/B,UACE,WAAW,cAAc,0BAAU,gBACnC,KAAC,qCAAoB,0BAAU,cAAc,cAAc,GAC3D;AACA,eAAO,aAAa;AAAA,MACtB;AAEA,UAAI,iBAAiB;AACnB,eAAO,SAAS,eAAe;AAAA,MACjC;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,QAAI,KAAC,qCAAoB,WAAW,WAAW,cAAc,GAAG;AAC9D,aAAO,mBAAmB;AAAA,IAC5B;AAEA,QAAI,WAAW,cAAc,0BAAU,cAAc;AAGnD,UAAI,CAAC,WAAW,iBAAiB;AAC/B,eAAO,mBAAmB;AAAA,MAC5B;AACA,aAAO;AAAA,IACT;AAKA,QAAI,WAAW,kBAAkB,WAAW;AAC1C,aAAO,sBAAsB;AAAA,IAC/B;AAKA,QAAI,CAAC,WAAW,QAAQ;AACtB,aAAO,sBAAsB;AAAA,IAC/B;AAKA,QAAI,CAAC,kBAAkB;AACrB,aAAO;AAAA,IACT;AAKA,QAAI,OAAO,qBAAqB,YAAY;AAC1C,UAAI,iBAAiB,WAAW,GAAG,GAAG;AACpC,eAAO;AAAA,MACT;AACA,aAAO,mBAAmB;AAAA,IAC5B;AAKA,QAAI,WAAW,IAAI,gBAAgB,GAAG;AACpC,aAAO;AAAA,IACT;AAEA,WAAO,mBAAmB;AAAA,EAC5B;AACF;AAEA,MAAM,yBAAyB,CAAC,QAAa;AAC3C,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AAGA,MAAI,IAAI,sBAAsB,IAAI,mBAAmB,IAAI,OAAO;AAC9D,WAAO;AAAA,EACT;AAGA,MAAI,OAAO,KAAK,GAAG,EAAE,WAAW,KAAK,WAAW,KAAK;AACnD,WAAO;AAAA,EACT;AAGA,SAAO;AAGT;AAEA,MAAM,wBAAwB,CAAC,QAAiB;AAnOhD;AAoOE,SACE,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAAA,UAAc,QAAQ,OAAO,QAC9C,SAAI,QAAQ,IAAI,0BAAU,QAAQ,MAAM,MAAxC,mBAA2C,SAAS,0BACnD,SAAI,QAAQ,IAAI,0BAAU,QAAQ,WAAW,MAA7C,mBAAgD,SAAS,2BACzD,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAAA,UAAc,QAAQ,UAAU;AAExD;AAEA,MAAM,gBAAgB,CAAC,QAA0B;AA5OjD;AA6OE,SACE,IAAI,QAAQ,IAAI,0BAAU,QAAQ,YAAY,MAAM,cACpD,IAAI,QAAQ,IAAI,0BAAU,QAAQ,YAAY,MAAM,cACpD,SAAI,QAAQ,IAAI,0BAAU,QAAQ,MAAM,MAAxC,mBAA2C,SAAS,iBACpD,8BAA8B,GAAG,KACjC,gCAAgC,GAAG;AAEvC;AAEA,MAAM,gCAAgC,CAAC,QACpC,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAAA,UAAc,QAAQ,OAAO,KAAK,CAAC,sBAAsB,GAAG,KAAM,oBAAoB;AAE3G,MAAM,sBAAsB,MAAM;AAChC,QAAM,UAAU,WAAW;AAE3B,MAAI,KAAC,kCAAc,OAAO,GAAG;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,KAAK,IAAI,QAAQ,qBAAqB,EAAE,SAAS,KAAK,CAAC;AAE/D,SAAO,QAAQ,IAAI;AACrB;AAEA,MAAM,kCAAkC,CAAC,QAAiB,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAAA,UAAc,QAAQ,UAAU;","names":["nextConstants"]}
+{"version":3,"sources":["../../../src/server/protect.ts"],"sourcesContent":["import type { AuthObject } from '@clerk/backend';\nimport type {\n  AuthenticatedMachineObject,\n  AuthenticateRequestOptions,\n  InferAuthObjectFromToken,\n  InferAuthObjectFromTokenArray,\n  RedirectFun,\n  SignedInAuthObject,\n} from '@clerk/backend/internal';\nimport { constants, isTokenTypeAccepted, TokenType } from '@clerk/backend/internal';\nimport type {\n  CheckAuthorizationFromSessionClaims,\n  CheckAuthorizationParamsFromSessionClaims,\n  CheckAuthorizationParamsWithCustomPermissions,\n  CheckAuthorizationWithCustomPermissions,\n  OrganizationCustomPermissionKey,\n} from '@clerk/shared/types';\n\nimport { constants as nextConstants } from '../constants';\nimport { isNextFetcher } from './nextFetcher';\n\ntype AuthProtectOptions = {\n  /**\n   * The token type to check.\n   */\n  token?: AuthenticateRequestOptions['acceptsToken'];\n  /**\n   * The URL to redirect the user to if they are not authorized.\n   */\n  unauthorizedUrl?: string;\n  /**\n   * The URL to redirect the user to if they are not authenticated.\n   */\n  unauthenticatedUrl?: string;\n};\n\n/**\n * Throws a Nextjs notFound error if user is not authenticated or authorized.\n */\nexport interface AuthProtect {\n  /**\n   * @example\n   * auth.protect({ permission: 'org:admin:example1' });\n   * auth.protect({ role: 'admin' });\n   */\n  <P extends OrganizationCustomPermissionKey>(\n    params?: CheckAuthorizationParamsFromSessionClaims<P>,\n    options?: AuthProtectOptions,\n  ): Promise<SignedInAuthObject>;\n\n  /**\n   * @example\n   * auth.protect(has => has({ permission: 'org:admin:example1' }));\n   */\n  (\n    params?: (has: CheckAuthorizationFromSessionClaims) => boolean,\n    options?: AuthProtectOptions,\n  ): Promise<SignedInAuthObject>;\n\n  /**\n   * @example\n   * auth.protect({ token: 'session_token' });\n   */\n  <T extends TokenType>(\n    options?: AuthProtectOptions & { token: T },\n  ): Promise<InferAuthObjectFromToken<T, SignedInAuthObject, AuthenticatedMachineObject>>;\n\n  /**\n   * @example\n   * auth.protect({ token: ['session_token', 'm2m_token'] });\n   */\n  <T extends TokenType[]>(\n    options?: AuthProtectOptions & { token: T },\n  ): Promise<InferAuthObjectFromTokenArray<T, SignedInAuthObject, AuthenticatedMachineObject>>;\n\n  /**\n   * @example\n   * auth.protect({ token: 'any' });\n   */\n  (options?: AuthProtectOptions & { token: 'any' }): Promise<SignedInAuthObject | AuthenticatedMachineObject>;\n\n  /**\n   * @example\n   * auth.protect();\n   */\n  (options?: AuthProtectOptions): Promise<SignedInAuthObject>;\n}\n\nexport function createProtect(opts: {\n  request: Request;\n  authObject: AuthObject;\n  /**\n   * middleware and pages throw a notFound error if signed out\n   * but the middleware needs to throw an error it can catch\n   * use this callback to customise the behavior\n   */\n  notFound: () => never;\n  /**\n   * see {@link notFound} above\n   */\n  redirect: (url: string) => void;\n  /**\n   * For m2m requests, throws a 401 response\n   */\n  unauthorized: () => void;\n  /**\n   * protect() in middleware redirects to signInUrl if signed out\n   * protect() in pages throws a notFound error if signed out\n   * use this callback to customise the behavior\n   */\n  redirectToSignIn: RedirectFun<unknown>;\n}): AuthProtect {\n  const { redirectToSignIn, authObject, redirect, notFound, request, unauthorized } = opts;\n\n  return (async (...args: any[]) => {\n    const paramsOrFunction = getAuthorizationParams(args[0]);\n    const unauthenticatedUrl = (args[0]?.unauthenticatedUrl || args[1]?.unauthenticatedUrl) as string | undefined;\n    const unauthorizedUrl = (args[0]?.unauthorizedUrl || args[1]?.unauthorizedUrl) as string | undefined;\n    const requestedToken = args[0]?.token || args[1]?.token || TokenType.SessionToken;\n\n    const handleUnauthenticated = () => {\n      if (unauthenticatedUrl) {\n        return redirect(unauthenticatedUrl);\n      }\n      if (isPageRequest(request)) {\n        // TODO: Handle runtime values. What happens if runtime values are set in middleware and in ClerkProvider as well?\n        return redirectToSignIn();\n      }\n      if (isServerActionRequest(request)) {\n        return unauthorized();\n      }\n      return notFound();\n    };\n\n    const handleUnauthorized = () => {\n      // Return 401 for machine token contexts: either the auth object itself is a machine token,\n      // or the endpoint was configured to accept machine tokens but auth failed (e.g. middleware\n      // bypassed, so authObject fell back to a signed-out session object).\n      if (\n        authObject.tokenType !== TokenType.SessionToken ||\n        !isTokenTypeAccepted(TokenType.SessionToken, requestedToken)\n      ) {\n        return unauthorized();\n      }\n\n      if (unauthorizedUrl) {\n        return redirect(unauthorizedUrl);\n      }\n      return notFound();\n    };\n\n    if (!isTokenTypeAccepted(authObject.tokenType, requestedToken)) {\n      return handleUnauthorized();\n    }\n\n    if (authObject.tokenType !== TokenType.SessionToken) {\n      // For machine tokens, we only check if they're authenticated\n      // They don't have session status or organization permissions\n      if (!authObject.isAuthenticated) {\n        return handleUnauthorized();\n      }\n      return authObject;\n    }\n\n    /**\n     * Redirects the user back to the tasks URL if their session status is pending\n     */\n    if (authObject.sessionStatus === 'pending') {\n      return handleUnauthenticated();\n    }\n\n    /**\n     * User is not authenticated\n     */\n    if (!authObject.userId) {\n      return handleUnauthenticated();\n    }\n\n    /**\n     * User is authenticated\n     */\n    if (!paramsOrFunction) {\n      return authObject;\n    }\n\n    /**\n     * if a function is passed and returns false then throw not found\n     */\n    if (typeof paramsOrFunction === 'function') {\n      if (paramsOrFunction(authObject.has)) {\n        return authObject;\n      }\n      return handleUnauthorized();\n    }\n\n    /**\n     * Checking if user is authorized when permission or role is passed\n     */\n    if (authObject.has(paramsOrFunction)) {\n      return authObject;\n    }\n\n    return handleUnauthorized();\n  }) as AuthProtect;\n}\n\nconst AUTH_PARAM_KEYS = ['role', 'permission', 'feature', 'plan', 'reverification'] as const;\n\nconst getAuthorizationParams = (arg: any) => {\n  if (!arg) {\n    return undefined;\n  }\n\n  // Predicate form: always return the function unchanged.\n  if (typeof arg === 'function') {\n    return arg as (has: CheckAuthorizationWithCustomPermissions) => boolean;\n  }\n\n  // Pick only the known authorization keys so option keys (unauthorizedUrl,\n  // token, etc.) and unknown extras do not leak into has().\n  const authParams: Record<string, unknown> = {};\n  for (const key of AUTH_PARAM_KEYS) {\n    if (arg[key] !== undefined) {\n      authParams[key] = arg[key];\n    }\n  }\n\n  if (Object.keys(authParams).length === 0) {\n    return undefined;\n  }\n\n  return authParams as CheckAuthorizationParamsWithCustomPermissions;\n};\n\nconst isServerActionRequest = (req: Request) => {\n  return (\n    !!req.headers.get(nextConstants.Headers.NextUrl) &&\n    (req.headers.get(constants.Headers.Accept)?.includes('text/x-component') ||\n      req.headers.get(constants.Headers.ContentType)?.includes('multipart/form-data') ||\n      !!req.headers.get(nextConstants.Headers.NextAction))\n  );\n};\n\nconst isPageRequest = (req: Request): boolean => {\n  return (\n    req.headers.get(constants.Headers.SecFetchDest) === 'document' ||\n    req.headers.get(constants.Headers.SecFetchDest) === 'iframe' ||\n    req.headers.get(constants.Headers.Accept)?.includes('text/html') ||\n    isAppRouterInternalNavigation(req) ||\n    isPagesRouterInternalNavigation(req)\n  );\n};\n\nconst isAppRouterInternalNavigation = (req: Request) =>\n  (!!req.headers.get(nextConstants.Headers.NextUrl) && !isServerActionRequest(req)) || isPagePathAvailable();\n\nconst isPagePathAvailable = () => {\n  const __fetch = globalThis.fetch;\n\n  if (!isNextFetcher(__fetch)) {\n    return false;\n  }\n\n  const { page } = __fetch.__nextGetStaticStore().getStore() || {};\n\n  return Boolean(page);\n};\n\nconst isPagesRouterInternalNavigation = (req: Request) => !!req.headers.get(nextConstants.Headers.NextjsData);\n\n// /**\n//  * In case we want to handle router handlers and server actions differently in the future\n//  */\n// const isApiRouteRequest = (req: Request) => {\n//   return !isPageRequest(req) && !isServerActionRequest(req);\n// };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,sBAA0D;AAS1D,uBAA2C;AAC3C,yBAA8B;AAqEvB,SAAS,cAAc,MAuBd;AACd,QAAM,EAAE,kBAAkB,YAAY,UAAU,UAAU,SAAS,aAAa,IAAI;AAEpF,UAAQ,UAAU,SAAgB;AAlHpC;AAmHI,UAAM,mBAAmB,uBAAuB,KAAK,CAAC,CAAC;AACvD,UAAM,uBAAsB,UAAK,CAAC,MAAN,mBAAS,yBAAsB,UAAK,CAAC,MAAN,mBAAS;AACpE,UAAM,oBAAmB,UAAK,CAAC,MAAN,mBAAS,sBAAmB,UAAK,CAAC,MAAN,mBAAS;AAC9D,UAAM,mBAAiB,UAAK,CAAC,MAAN,mBAAS,YAAS,UAAK,CAAC,MAAN,mBAAS,UAAS,0BAAU;AAErE,UAAM,wBAAwB,MAAM;AAClC,UAAI,oBAAoB;AACtB,eAAO,SAAS,kBAAkB;AAAA,MACpC;AACA,UAAI,cAAc,OAAO,GAAG;AAE1B,eAAO,iBAAiB;AAAA,MAC1B;AACA,UAAI,sBAAsB,OAAO,GAAG;AAClC,eAAO,aAAa;AAAA,MACtB;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,qBAAqB,MAAM;AAI/B,UACE,WAAW,cAAc,0BAAU,gBACnC,KAAC,qCAAoB,0BAAU,cAAc,cAAc,GAC3D;AACA,eAAO,aAAa;AAAA,MACtB;AAEA,UAAI,iBAAiB;AACnB,eAAO,SAAS,eAAe;AAAA,MACjC;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,QAAI,KAAC,qCAAoB,WAAW,WAAW,cAAc,GAAG;AAC9D,aAAO,mBAAmB;AAAA,IAC5B;AAEA,QAAI,WAAW,cAAc,0BAAU,cAAc;AAGnD,UAAI,CAAC,WAAW,iBAAiB;AAC/B,eAAO,mBAAmB;AAAA,MAC5B;AACA,aAAO;AAAA,IACT;AAKA,QAAI,WAAW,kBAAkB,WAAW;AAC1C,aAAO,sBAAsB;AAAA,IAC/B;AAKA,QAAI,CAAC,WAAW,QAAQ;AACtB,aAAO,sBAAsB;AAAA,IAC/B;AAKA,QAAI,CAAC,kBAAkB;AACrB,aAAO;AAAA,IACT;AAKA,QAAI,OAAO,qBAAqB,YAAY;AAC1C,UAAI,iBAAiB,WAAW,GAAG,GAAG;AACpC,eAAO;AAAA,MACT;AACA,aAAO,mBAAmB;AAAA,IAC5B;AAKA,QAAI,WAAW,IAAI,gBAAgB,GAAG;AACpC,aAAO;AAAA,IACT;AAEA,WAAO,mBAAmB;AAAA,EAC5B;AACF;AAEA,MAAM,kBAAkB,CAAC,QAAQ,cAAc,WAAW,QAAQ,gBAAgB;AAElF,MAAM,yBAAyB,CAAC,QAAa;AAC3C,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AAGA,MAAI,OAAO,QAAQ,YAAY;AAC7B,WAAO;AAAA,EACT;AAIA,QAAM,aAAsC,CAAC;AAC7C,aAAW,OAAO,iBAAiB;AACjC,QAAI,IAAI,GAAG,MAAM,QAAW;AAC1B,iBAAW,GAAG,IAAI,IAAI,GAAG;AAAA,IAC3B;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,UAAU,EAAE,WAAW,GAAG;AACxC,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,MAAM,wBAAwB,CAAC,QAAiB;AA1OhD;AA2OE,SACE,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAAA,UAAc,QAAQ,OAAO,QAC9C,SAAI,QAAQ,IAAI,0BAAU,QAAQ,MAAM,MAAxC,mBAA2C,SAAS,0BACnD,SAAI,QAAQ,IAAI,0BAAU,QAAQ,WAAW,MAA7C,mBAAgD,SAAS,2BACzD,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAAA,UAAc,QAAQ,UAAU;AAExD;AAEA,MAAM,gBAAgB,CAAC,QAA0B;AAnPjD;AAoPE,SACE,IAAI,QAAQ,IAAI,0BAAU,QAAQ,YAAY,MAAM,cACpD,IAAI,QAAQ,IAAI,0BAAU,QAAQ,YAAY,MAAM,cACpD,SAAI,QAAQ,IAAI,0BAAU,QAAQ,MAAM,MAAxC,mBAA2C,SAAS,iBACpD,8BAA8B,GAAG,KACjC,gCAAgC,GAAG;AAEvC;AAEA,MAAM,gCAAgC,CAAC,QACpC,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAAA,UAAc,QAAQ,OAAO,KAAK,CAAC,sBAAsB,GAAG,KAAM,oBAAoB;AAE3G,MAAM,sBAAsB,MAAM;AAChC,QAAM,UAAU,WAAW;AAE3B,MAAI,KAAC,kCAAc,OAAO,GAAG;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,KAAK,IAAI,QAAQ,qBAAqB,EAAE,SAAS,KAAK,CAAC;AAE/D,SAAO,QAAQ,IAAI;AACrB;AAEA,MAAM,kCAAkC,CAAC,QAAiB,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAAA,UAAc,QAAQ,UAAU;","names":["nextConstants"]}

package/dist/cjs/utils/debugLogger.js

@@ -90,7 +90,7 @@ function debugLogHeader(name) {
   return `[clerk debug start: ${name}]`;
 }
 function debugLogFooter(name) {
-  return `[clerk debug end: ${name}] (@clerk/nextjs=${"7.2.4-snapshot.v20260421194054"},next=${import_package.default.version},timestamp=${Math.round((/* @__PURE__ */ new Date()).getTime() / 1e3)})`;
+  return `[clerk debug end: ${name}] (@clerk/nextjs=${"7.2.4"},next=${import_package.default.version},timestamp=${Math.round((/* @__PURE__ */ new Date()).getTime() / 1e3)})`;
 }
 function truncate(str, maxLength) {
   const encoder = new TextEncoder();

package/dist/cjs/utils/debugLogger.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/debugLogger.ts"],"sourcesContent":["// TODO: Replace with a more sophisticated logging solution\n\nimport nextPkg from 'next/package.json';\n\nimport { logFormatter } from './logFormatter';\n\nexport type Log = string | Record<string, unknown>;\nexport type LogEntry = Log | Log[];\nexport type Logger<L = Log> = {\n  commit: () => void;\n  debug: (...args: Array<L | (() => L)>) => void;\n  enable: () => void;\n};\nexport type LoggerNoCommit<L = Logger> = Omit<L, 'commit'>;\n\nexport const createDebugLogger = (name: string, formatter: (val: LogEntry) => string) => (): Logger => {\n  const entries: LogEntry[] = [];\n  let isEnabled = false;\n\n  return {\n    enable: () => {\n      isEnabled = true;\n    },\n    debug: (...args) => {\n      if (isEnabled) {\n        entries.push(args.map(arg => (typeof arg === 'function' ? arg() : arg)));\n      }\n    },\n    commit: () => {\n      if (isEnabled) {\n        console.log(debugLogHeader(name));\n\n        /**\n         * We buffer each collected log entry so we can format them and log them all at once.\n         * Individual console.log calls are used to ensure we don't hit platform-specific log limits (Vercel and Netlify are 4kb).\n         */\n        for (const log of entries) {\n          let output = formatter(log);\n\n          output = output\n            .split('\\n')\n            .map(l => `  ${l}`)\n            .join('\\n');\n\n          // Vercel errors if the output is > 4kb, so we truncate it\n          if (process.env.VERCEL) {\n            output = truncate(output, 4096);\n          }\n\n          console.log(output);\n        }\n\n        console.log(debugLogFooter(name));\n      }\n    },\n  };\n};\n\ntype WithLogger = <L extends Logger, H extends (...args: any[]) => any>(\n  loggerFactoryOrName: string | (() => L),\n  handlerCtor: (logger: LoggerNoCommit<L>) => H,\n) => H;\n\nexport const withLogger: WithLogger = (loggerFactoryOrName, handlerCtor) => {\n  return ((...args: any) => {\n    const factory =\n      typeof loggerFactoryOrName === 'string'\n        ? createDebugLogger(loggerFactoryOrName, logFormatter)\n        : loggerFactoryOrName;\n\n    const logger = factory();\n    const handler = handlerCtor(logger as any);\n\n    try {\n      const res = handler(...args);\n      if (typeof res === 'object' && 'then' in res && typeof res.then === 'function') {\n        return res\n          .then((val: any) => {\n            logger.commit();\n            return val;\n          })\n          .catch((err: any) => {\n            logger.commit();\n            throw err;\n          });\n      }\n      // handle sync methods\n      logger.commit();\n      return res;\n    } catch (err: any) {\n      logger.commit();\n      throw err;\n    }\n  }) as ReturnType<typeof handlerCtor>;\n};\n\nfunction debugLogHeader(name: string) {\n  return `[clerk debug start: ${name}]`;\n}\n\nfunction debugLogFooter(name: string) {\n  return `[clerk debug end: ${name}] (@clerk/nextjs=${PACKAGE_VERSION},next=${nextPkg.version},timestamp=${Math.round(new Date().getTime() / 1_000)})`;\n}\n\n// ref: https://stackoverflow.com/questions/57769465/javascript-truncate-text-by-bytes-length\nfunction truncate(str: string, maxLength: number) {\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder('utf-8');\n\n  const encodedString = encoder.encode(str);\n  const truncatedString = encodedString.slice(0, maxLength);\n\n  // return the truncated string, removing any replacement characters that result from partially truncated characters\n  return decoder.decode(truncatedString).replace(/\\uFFFD/g, '');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAAoB;AAEpB,0BAA6B;AAWtB,MAAM,oBAAoB,CAAC,MAAc,cAAyC,MAAc;AACrG,QAAM,UAAsB,CAAC;AAC7B,MAAI,YAAY;AAEhB,SAAO;AAAA,IACL,QAAQ,MAAM;AACZ,kBAAY;AAAA,IACd;AAAA,IACA,OAAO,IAAI,SAAS;AAClB,UAAI,WAAW;AACb,gBAAQ,KAAK,KAAK,IAAI,SAAQ,OAAO,QAAQ,aAAa,IAAI,IAAI,GAAI,CAAC;AAAA,MACzE;AAAA,IACF;AAAA,IACA,QAAQ,MAAM;AACZ,UAAI,WAAW;AACb,gBAAQ,IAAI,eAAe,IAAI,CAAC;AAMhC,mBAAW,OAAO,SAAS;AACzB,cAAI,SAAS,UAAU,GAAG;AAE1B,mBAAS,OACN,MAAM,IAAI,EACV,IAAI,OAAK,KAAK,CAAC,EAAE,EACjB,KAAK,IAAI;AAGZ,cAAI,QAAQ,IAAI,QAAQ;AACtB,qBAAS,SAAS,QAAQ,IAAI;AAAA,UAChC;AAEA,kBAAQ,IAAI,MAAM;AAAA,QACpB;AAEA,gBAAQ,IAAI,eAAe,IAAI,CAAC;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAOO,MAAM,aAAyB,CAAC,qBAAqB,gBAAgB;AAC1E,UAAQ,IAAI,SAAc;AACxB,UAAM,UACJ,OAAO,wBAAwB,WAC3B,kBAAkB,qBAAqB,gCAAY,IACnD;AAEN,UAAM,SAAS,QAAQ;AACvB,UAAM,UAAU,YAAY,MAAa;AAEzC,QAAI;AACF,YAAM,MAAM,QAAQ,GAAG,IAAI;AAC3B,UAAI,OAAO,QAAQ,YAAY,UAAU,OAAO,OAAO,IAAI,SAAS,YAAY;AAC9E,eAAO,IACJ,KAAK,CAAC,QAAa;AAClB,iBAAO,OAAO;AACd,iBAAO;AAAA,QACT,CAAC,EACA,MAAM,CAAC,QAAa;AACnB,iBAAO,OAAO;AACd,gBAAM;AAAA,QACR,CAAC;AAAA,MACL;AAEA,aAAO,OAAO;AACd,aAAO;AAAA,IACT,SAAS,KAAU;AACjB,aAAO,OAAO;AACd,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO,uBAAuB,IAAI;AACpC;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO,qBAAqB,IAAI,oBAAoB,gCAAe,SAAS,eAAAA,QAAQ,OAAO,cAAc,KAAK,OAAM,oBAAI,KAAK,GAAE,QAAQ,IAAI,GAAK,CAAC;AACnJ;AAGA,SAAS,SAAS,KAAa,WAAmB;AAChD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY,OAAO;AAEvC,QAAM,gBAAgB,QAAQ,OAAO,GAAG;AACxC,QAAM,kBAAkB,cAAc,MAAM,GAAG,SAAS;AAGxD,SAAO,QAAQ,OAAO,eAAe,EAAE,QAAQ,WAAW,EAAE;AAC9D;","names":["nextPkg"]}
+{"version":3,"sources":["../../../src/utils/debugLogger.ts"],"sourcesContent":["// TODO: Replace with a more sophisticated logging solution\n\nimport nextPkg from 'next/package.json';\n\nimport { logFormatter } from './logFormatter';\n\nexport type Log = string | Record<string, unknown>;\nexport type LogEntry = Log | Log[];\nexport type Logger<L = Log> = {\n  commit: () => void;\n  debug: (...args: Array<L | (() => L)>) => void;\n  enable: () => void;\n};\nexport type LoggerNoCommit<L = Logger> = Omit<L, 'commit'>;\n\nexport const createDebugLogger = (name: string, formatter: (val: LogEntry) => string) => (): Logger => {\n  const entries: LogEntry[] = [];\n  let isEnabled = false;\n\n  return {\n    enable: () => {\n      isEnabled = true;\n    },\n    debug: (...args) => {\n      if (isEnabled) {\n        entries.push(args.map(arg => (typeof arg === 'function' ? arg() : arg)));\n      }\n    },\n    commit: () => {\n      if (isEnabled) {\n        console.log(debugLogHeader(name));\n\n        /**\n         * We buffer each collected log entry so we can format them and log them all at once.\n         * Individual console.log calls are used to ensure we don't hit platform-specific log limits (Vercel and Netlify are 4kb).\n         */\n        for (const log of entries) {\n          let output = formatter(log);\n\n          output = output\n            .split('\\n')\n            .map(l => `  ${l}`)\n            .join('\\n');\n\n          // Vercel errors if the output is > 4kb, so we truncate it\n          if (process.env.VERCEL) {\n            output = truncate(output, 4096);\n          }\n\n          console.log(output);\n        }\n\n        console.log(debugLogFooter(name));\n      }\n    },\n  };\n};\n\ntype WithLogger = <L extends Logger, H extends (...args: any[]) => any>(\n  loggerFactoryOrName: string | (() => L),\n  handlerCtor: (logger: LoggerNoCommit<L>) => H,\n) => H;\n\nexport const withLogger: WithLogger = (loggerFactoryOrName, handlerCtor) => {\n  return ((...args: any) => {\n    const factory =\n      typeof loggerFactoryOrName === 'string'\n        ? createDebugLogger(loggerFactoryOrName, logFormatter)\n        : loggerFactoryOrName;\n\n    const logger = factory();\n    const handler = handlerCtor(logger as any);\n\n    try {\n      const res = handler(...args);\n      if (typeof res === 'object' && 'then' in res && typeof res.then === 'function') {\n        return res\n          .then((val: any) => {\n            logger.commit();\n            return val;\n          })\n          .catch((err: any) => {\n            logger.commit();\n            throw err;\n          });\n      }\n      // handle sync methods\n      logger.commit();\n      return res;\n    } catch (err: any) {\n      logger.commit();\n      throw err;\n    }\n  }) as ReturnType<typeof handlerCtor>;\n};\n\nfunction debugLogHeader(name: string) {\n  return `[clerk debug start: ${name}]`;\n}\n\nfunction debugLogFooter(name: string) {\n  return `[clerk debug end: ${name}] (@clerk/nextjs=${PACKAGE_VERSION},next=${nextPkg.version},timestamp=${Math.round(new Date().getTime() / 1_000)})`;\n}\n\n// ref: https://stackoverflow.com/questions/57769465/javascript-truncate-text-by-bytes-length\nfunction truncate(str: string, maxLength: number) {\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder('utf-8');\n\n  const encodedString = encoder.encode(str);\n  const truncatedString = encodedString.slice(0, maxLength);\n\n  // return the truncated string, removing any replacement characters that result from partially truncated characters\n  return decoder.decode(truncatedString).replace(/\\uFFFD/g, '');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAAoB;AAEpB,0BAA6B;AAWtB,MAAM,oBAAoB,CAAC,MAAc,cAAyC,MAAc;AACrG,QAAM,UAAsB,CAAC;AAC7B,MAAI,YAAY;AAEhB,SAAO;AAAA,IACL,QAAQ,MAAM;AACZ,kBAAY;AAAA,IACd;AAAA,IACA,OAAO,IAAI,SAAS;AAClB,UAAI,WAAW;AACb,gBAAQ,KAAK,KAAK,IAAI,SAAQ,OAAO,QAAQ,aAAa,IAAI,IAAI,GAAI,CAAC;AAAA,MACzE;AAAA,IACF;AAAA,IACA,QAAQ,MAAM;AACZ,UAAI,WAAW;AACb,gBAAQ,IAAI,eAAe,IAAI,CAAC;AAMhC,mBAAW,OAAO,SAAS;AACzB,cAAI,SAAS,UAAU,GAAG;AAE1B,mBAAS,OACN,MAAM,IAAI,EACV,IAAI,OAAK,KAAK,CAAC,EAAE,EACjB,KAAK,IAAI;AAGZ,cAAI,QAAQ,IAAI,QAAQ;AACtB,qBAAS,SAAS,QAAQ,IAAI;AAAA,UAChC;AAEA,kBAAQ,IAAI,MAAM;AAAA,QACpB;AAEA,gBAAQ,IAAI,eAAe,IAAI,CAAC;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAOO,MAAM,aAAyB,CAAC,qBAAqB,gBAAgB;AAC1E,UAAQ,IAAI,SAAc;AACxB,UAAM,UACJ,OAAO,wBAAwB,WAC3B,kBAAkB,qBAAqB,gCAAY,IACnD;AAEN,UAAM,SAAS,QAAQ;AACvB,UAAM,UAAU,YAAY,MAAa;AAEzC,QAAI;AACF,YAAM,MAAM,QAAQ,GAAG,IAAI;AAC3B,UAAI,OAAO,QAAQ,YAAY,UAAU,OAAO,OAAO,IAAI,SAAS,YAAY;AAC9E,eAAO,IACJ,KAAK,CAAC,QAAa;AAClB,iBAAO,OAAO;AACd,iBAAO;AAAA,QACT,CAAC,EACA,MAAM,CAAC,QAAa;AACnB,iBAAO,OAAO;AACd,gBAAM;AAAA,QACR,CAAC;AAAA,MACL;AAEA,aAAO,OAAO;AACd,aAAO;AAAA,IACT,SAAS,KAAU;AACjB,aAAO,OAAO;AACd,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO,uBAAuB,IAAI;AACpC;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO,qBAAqB,IAAI,oBAAoB,OAAe,SAAS,eAAAA,QAAQ,OAAO,cAAc,KAAK,OAAM,oBAAI,KAAK,GAAE,QAAQ,IAAI,GAAK,CAAC;AACnJ;AAGA,SAAS,SAAS,KAAa,WAAmB;AAChD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY,OAAO;AAEvC,QAAM,gBAAgB,QAAQ,OAAO,GAAG;AACxC,QAAM,kBAAkB,cAAc,MAAM,GAAG,SAAS;AAGxD,SAAO,QAAQ,OAAO,eAAe,EAAE,QAAQ,WAAW,EAAE;AAC9D;","names":["nextPkg"]}

package/dist/cjs/utils/mergeNextClerkPropsWithEnv.js

@@ -21,7 +21,6 @@ __export(mergeNextClerkPropsWithEnv_exports, {
   mergeNextClerkPropsWithEnv: () => mergeNextClerkPropsWithEnv
 });
 module.exports = __toCommonJS(mergeNextClerkPropsWithEnv_exports);
-var import_proxy = require("@clerk/shared/proxy");
 var import_underscore = require("@clerk/shared/underscore");
 var import_constants = require("../server/constants");
 function getPrefetchUIFromEnvAndProps(propsPrefetchUI) {
@@ -35,23 +34,16 @@ function getPrefetchUIFromEnvAndProps(propsPrefetchUI) {
 }
 const mergeNextClerkPropsWithEnv = (props) => {
   var _a;
-  const publishableKey = props.publishableKey || process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || "";
-  const proxyUrl = props.proxyUrl || process.env.NEXT_PUBLIC_CLERK_PROXY_URL || "";
-  const domain = props.domain || process.env.NEXT_PUBLIC_CLERK_DOMAIN || "";
   return {
     ...props,
-    publishableKey,
+    publishableKey: props.publishableKey || process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || "",
     __internal_clerkJSUrl: props.__internal_clerkJSUrl || process.env.NEXT_PUBLIC_CLERK_JS_URL,
     __internal_clerkJSVersion: props.__internal_clerkJSVersion || process.env.NEXT_PUBLIC_CLERK_JS_VERSION,
     __internal_clerkUIUrl: props.__internal_clerkUIUrl || process.env.NEXT_PUBLIC_CLERK_UI_URL,
     __internal_clerkUIVersion: props.__internal_clerkUIVersion || process.env.NEXT_PUBLIC_CLERK_UI_VERSION,
     prefetchUI: getPrefetchUIFromEnvAndProps(props.prefetchUI),
-    proxyUrl: proxyUrl || (0, import_proxy.getAutoProxyUrlFromEnvironment)({
-      hasDomain: !!domain,
-      hasProxyUrl: !!proxyUrl,
-      publishableKey
-    }),
-    domain,
+    proxyUrl: props.proxyUrl || process.env.NEXT_PUBLIC_CLERK_PROXY_URL || "",
+    domain: props.domain || process.env.NEXT_PUBLIC_CLERK_DOMAIN || "",
     isSatellite: props.isSatellite || (0, import_underscore.isTruthy)(process.env.NEXT_PUBLIC_CLERK_IS_SATELLITE),
     signInUrl: props.signInUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_URL || "",
     signUpUrl: props.signUpUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_URL || "",

package/dist/cjs/utils/mergeNextClerkPropsWithEnv.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/mergeNextClerkPropsWithEnv.ts"],"sourcesContent":["import type { InternalClerkScriptProps } from '@clerk/react/internal';\nimport { getAutoProxyUrlFromEnvironment } from '@clerk/shared/proxy';\nimport { isTruthy } from '@clerk/shared/underscore';\n\nimport { SDK_METADATA } from '../server/constants';\nimport type { NextClerkProviderProps } from '../types';\n\nfunction getPrefetchUIFromEnvAndProps(propsPrefetchUI: NextClerkProviderProps['prefetchUI']): boolean | undefined {\n  // Props take precedence\n  if (propsPrefetchUI === false) {\n    return false;\n  }\n\n  // Check env var\n  if (process.env.NEXT_PUBLIC_CLERK_PREFETCH_UI === 'false') {\n    return false;\n  }\n\n  return undefined;\n}\n\n// @ts-ignore - https://github.com/microsoft/TypeScript/issues/47663\nexport const mergeNextClerkPropsWithEnv = (\n  props: Omit<NextClerkProviderProps, 'children'> & InternalClerkScriptProps,\n): any => {\n  const publishableKey = props.publishableKey || process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || '';\n  const proxyUrl = props.proxyUrl || process.env.NEXT_PUBLIC_CLERK_PROXY_URL || '';\n  const domain = props.domain || process.env.NEXT_PUBLIC_CLERK_DOMAIN || '';\n\n  return {\n    ...props,\n    publishableKey,\n    __internal_clerkJSUrl: props.__internal_clerkJSUrl || process.env.NEXT_PUBLIC_CLERK_JS_URL,\n    __internal_clerkJSVersion: props.__internal_clerkJSVersion || process.env.NEXT_PUBLIC_CLERK_JS_VERSION,\n    __internal_clerkUIUrl: props.__internal_clerkUIUrl || process.env.NEXT_PUBLIC_CLERK_UI_URL,\n    __internal_clerkUIVersion: props.__internal_clerkUIVersion || process.env.NEXT_PUBLIC_CLERK_UI_VERSION,\n    prefetchUI: getPrefetchUIFromEnvAndProps(props.prefetchUI),\n    proxyUrl:\n      proxyUrl ||\n      getAutoProxyUrlFromEnvironment({\n        hasDomain: !!domain,\n        hasProxyUrl: !!proxyUrl,\n        publishableKey,\n      }),\n    domain,\n    isSatellite: props.isSatellite || isTruthy(process.env.NEXT_PUBLIC_CLERK_IS_SATELLITE),\n    signInUrl: props.signInUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_URL || '',\n    signUpUrl: props.signUpUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_URL || '',\n    signInForceRedirectUrl:\n      props.signInForceRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_FORCE_REDIRECT_URL || '',\n    signUpForceRedirectUrl:\n      props.signUpForceRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_FORCE_REDIRECT_URL || '',\n    signInFallbackRedirectUrl:\n      props.signInFallbackRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_FALLBACK_REDIRECT_URL || '',\n    signUpFallbackRedirectUrl:\n      props.signUpFallbackRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_FALLBACK_REDIRECT_URL || '',\n    newSubscriptionRedirectUrl:\n      props.newSubscriptionRedirectUrl || process.env.NEXT_PUBLIC_CLERK_CHECKOUT_CONTINUE_URL || '',\n    telemetry: props.telemetry ?? {\n      disabled: isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DISABLED),\n      debug: isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DEBUG),\n    },\n    sdkMetadata: SDK_METADATA,\n    unsafe_disableDevelopmentModeConsoleWarning: isTruthy(\n      process.env.NEXT_PUBLIC_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING,\n    ),\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,mBAA+C;AAC/C,wBAAyB;AAEzB,uBAA6B;AAG7B,SAAS,6BAA6B,iBAA4E;AAEhH,MAAI,oBAAoB,OAAO;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,QAAQ,IAAI,kCAAkC,SAAS;AACzD,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAGO,MAAM,6BAA6B,CACxC,UACQ;AAxBV;AAyBE,QAAM,iBAAiB,MAAM,kBAAkB,QAAQ,IAAI,qCAAqC;AAChG,QAAM,WAAW,MAAM,YAAY,QAAQ,IAAI,+BAA+B;AAC9E,QAAM,SAAS,MAAM,UAAU,QAAQ,IAAI,4BAA4B;AAEvE,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,uBAAuB,MAAM,yBAAyB,QAAQ,IAAI;AAAA,IAClE,2BAA2B,MAAM,6BAA6B,QAAQ,IAAI;AAAA,IAC1E,uBAAuB,MAAM,yBAAyB,QAAQ,IAAI;AAAA,IAClE,2BAA2B,MAAM,6BAA6B,QAAQ,IAAI;AAAA,IAC1E,YAAY,6BAA6B,MAAM,UAAU;AAAA,IACzD,UACE,gBACA,6CAA+B;AAAA,MAC7B,WAAW,CAAC,CAAC;AAAA,MACb,aAAa,CAAC,CAAC;AAAA,MACf;AAAA,IACF,CAAC;AAAA,IACH;AAAA,IACA,aAAa,MAAM,mBAAe,4BAAS,QAAQ,IAAI,8BAA8B;AAAA,IACrF,WAAW,MAAM,aAAa,QAAQ,IAAI,iCAAiC;AAAA,IAC3E,WAAW,MAAM,aAAa,QAAQ,IAAI,iCAAiC;AAAA,IAC3E,wBACE,MAAM,0BAA0B,QAAQ,IAAI,gDAAgD;AAAA,IAC9F,wBACE,MAAM,0BAA0B,QAAQ,IAAI,gDAAgD;AAAA,IAC9F,2BACE,MAAM,6BAA6B,QAAQ,IAAI,mDAAmD;AAAA,IACpG,2BACE,MAAM,6BAA6B,QAAQ,IAAI,mDAAmD;AAAA,IACpG,4BACE,MAAM,8BAA8B,QAAQ,IAAI,2CAA2C;AAAA,IAC7F,YAAW,WAAM,cAAN,YAAmB;AAAA,MAC5B,cAAU,4BAAS,QAAQ,IAAI,oCAAoC;AAAA,MACnE,WAAO,4BAAS,QAAQ,IAAI,iCAAiC;AAAA,IAC/D;AAAA,IACA,aAAa;AAAA,IACb,iDAA6C;AAAA,MAC3C,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/utils/mergeNextClerkPropsWithEnv.ts"],"sourcesContent":["import type { InternalClerkScriptProps } from '@clerk/react/internal';\nimport { isTruthy } from '@clerk/shared/underscore';\n\nimport { SDK_METADATA } from '../server/constants';\nimport type { NextClerkProviderProps } from '../types';\n\nfunction getPrefetchUIFromEnvAndProps(propsPrefetchUI: NextClerkProviderProps['prefetchUI']): boolean | undefined {\n  // Props take precedence\n  if (propsPrefetchUI === false) {\n    return false;\n  }\n\n  // Check env var\n  if (process.env.NEXT_PUBLIC_CLERK_PREFETCH_UI === 'false') {\n    return false;\n  }\n\n  return undefined;\n}\n\n// @ts-ignore - https://github.com/microsoft/TypeScript/issues/47663\nexport const mergeNextClerkPropsWithEnv = (\n  props: Omit<NextClerkProviderProps, 'children'> & InternalClerkScriptProps,\n): any => {\n  return {\n    ...props,\n    publishableKey: props.publishableKey || process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || '',\n    __internal_clerkJSUrl: props.__internal_clerkJSUrl || process.env.NEXT_PUBLIC_CLERK_JS_URL,\n    __internal_clerkJSVersion: props.__internal_clerkJSVersion || process.env.NEXT_PUBLIC_CLERK_JS_VERSION,\n    __internal_clerkUIUrl: props.__internal_clerkUIUrl || process.env.NEXT_PUBLIC_CLERK_UI_URL,\n    __internal_clerkUIVersion: props.__internal_clerkUIVersion || process.env.NEXT_PUBLIC_CLERK_UI_VERSION,\n    prefetchUI: getPrefetchUIFromEnvAndProps(props.prefetchUI),\n    proxyUrl: props.proxyUrl || process.env.NEXT_PUBLIC_CLERK_PROXY_URL || '',\n    domain: props.domain || process.env.NEXT_PUBLIC_CLERK_DOMAIN || '',\n    isSatellite: props.isSatellite || isTruthy(process.env.NEXT_PUBLIC_CLERK_IS_SATELLITE),\n    signInUrl: props.signInUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_URL || '',\n    signUpUrl: props.signUpUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_URL || '',\n    signInForceRedirectUrl:\n      props.signInForceRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_FORCE_REDIRECT_URL || '',\n    signUpForceRedirectUrl:\n      props.signUpForceRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_FORCE_REDIRECT_URL || '',\n    signInFallbackRedirectUrl:\n      props.signInFallbackRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_FALLBACK_REDIRECT_URL || '',\n    signUpFallbackRedirectUrl:\n      props.signUpFallbackRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_FALLBACK_REDIRECT_URL || '',\n    newSubscriptionRedirectUrl:\n      props.newSubscriptionRedirectUrl || process.env.NEXT_PUBLIC_CLERK_CHECKOUT_CONTINUE_URL || '',\n    telemetry: props.telemetry ?? {\n      disabled: isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DISABLED),\n      debug: isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DEBUG),\n    },\n    sdkMetadata: SDK_METADATA,\n    unsafe_disableDevelopmentModeConsoleWarning: isTruthy(\n      process.env.NEXT_PUBLIC_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING,\n    ),\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,wBAAyB;AAEzB,uBAA6B;AAG7B,SAAS,6BAA6B,iBAA4E;AAEhH,MAAI,oBAAoB,OAAO;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,QAAQ,IAAI,kCAAkC,SAAS;AACzD,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAGO,MAAM,6BAA6B,CACxC,UACQ;AAvBV;AAwBE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,gBAAgB,MAAM,kBAAkB,QAAQ,IAAI,qCAAqC;AAAA,IACzF,uBAAuB,MAAM,yBAAyB,QAAQ,IAAI;AAAA,IAClE,2BAA2B,MAAM,6BAA6B,QAAQ,IAAI;AAAA,IAC1E,uBAAuB,MAAM,yBAAyB,QAAQ,IAAI;AAAA,IAClE,2BAA2B,MAAM,6BAA6B,QAAQ,IAAI;AAAA,IAC1E,YAAY,6BAA6B,MAAM,UAAU;AAAA,IACzD,UAAU,MAAM,YAAY,QAAQ,IAAI,+BAA+B;AAAA,IACvE,QAAQ,MAAM,UAAU,QAAQ,IAAI,4BAA4B;AAAA,IAChE,aAAa,MAAM,mBAAe,4BAAS,QAAQ,IAAI,8BAA8B;AAAA,IACrF,WAAW,MAAM,aAAa,QAAQ,IAAI,iCAAiC;AAAA,IAC3E,WAAW,MAAM,aAAa,QAAQ,IAAI,iCAAiC;AAAA,IAC3E,wBACE,MAAM,0BAA0B,QAAQ,IAAI,gDAAgD;AAAA,IAC9F,wBACE,MAAM,0BAA0B,QAAQ,IAAI,gDAAgD;AAAA,IAC9F,2BACE,MAAM,6BAA6B,QAAQ,IAAI,mDAAmD;AAAA,IACpG,2BACE,MAAM,6BAA6B,QAAQ,IAAI,mDAAmD;AAAA,IACpG,4BACE,MAAM,8BAA8B,QAAQ,IAAI,2CAA2C;AAAA,IAC7F,YAAW,WAAM,cAAN,YAAmB;AAAA,MAC5B,cAAU,4BAAS,QAAQ,IAAI,oCAAoC;AAAA,MACnE,WAAO,4BAAS,QAAQ,IAAI,iCAAiC;AAAA,IAC/D;AAAA,IACA,aAAa;AAAA,IACb,iDAA6C;AAAA,MAC3C,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AACF;","names":[]}

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/index.ts"],"sourcesContent":["/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  AuthenticateWithRedirectCallback,\n  ClerkDegraded,\n  ClerkFailed,\n  ClerkLoaded,\n  ClerkLoading,\n  UNSAFE_PortalProvider,\n  RedirectToCreateOrganization,\n  RedirectToOrganizationProfile,\n  RedirectToSignIn,\n  RedirectToSignUp,\n  RedirectToTasks,\n  RedirectToUserProfile,\n} from './client-boundary/controlComponents';\n\n/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  APIKeys,\n  CreateOrganization,\n  GoogleOneTap,\n  OrganizationList,\n  OrganizationProfile,\n  OrganizationSwitcher,\n  PricingTable,\n  SignIn,\n  SignInButton,\n  SignInWithMetamaskButton,\n  SignOutButton,\n  SignUp,\n  SignUpButton,\n  TaskChooseOrganization,\n  TaskResetPassword,\n  TaskSetupMFA,\n  UserAvatar,\n  UserButton,\n  UserProfile,\n  Waitlist,\n} from './client-boundary/uiComponents';\n\n/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  useAuth,\n  useClerk,\n  useEmailLink,\n  useOrganization,\n  useOrganizationCreationDefaults,\n  useOrganizationList,\n  useReverification,\n  useAPIKeys,\n  useSession,\n  useSessionList,\n  useSignIn,\n  useSignUp,\n  useWaitlist,\n  useUser,\n} from './client-boundary/hooks';\n\nexport { getToken } from '@clerk/shared/getToken';\n\n/**\n * Conditionally export components that exhibit different behavior\n * when used in /app vs /pages.\n * We defined the runtime and the type values explicitly,\n * because TS will not recognize the subpath import unless the HOST\n * application sets moduleResolution to 'NodeNext'.\n */\n// @ts-ignore\nimport * as ComponentsModule from '#components';\n\nimport type { ServerComponentsServerModuleTypes } from './components.server';\n\nexport const ClerkProvider = ComponentsModule.ClerkProvider as ServerComponentsServerModuleTypes['ClerkProvider'];\nexport const Show = ComponentsModule.Show as ServerComponentsServerModuleTypes['Show'];\n"],"mappings":";AAIA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,gBAAgB;AAUzB,YAAY,sBAAsB;AAI3B,MAAM,gBAAgB,iBAAiB;AACvC,MAAM,OAAO,iBAAiB;","names":[]}
+{"version":3,"sources":["../../src/index.ts"],"sourcesContent":["/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  AuthenticateWithRedirectCallback,\n  ClerkDegraded,\n  ClerkFailed,\n  ClerkLoaded,\n  ClerkLoading,\n  UNSAFE_PortalProvider,\n  RedirectToCreateOrganization,\n  RedirectToOrganizationProfile,\n  RedirectToSignIn,\n  RedirectToSignUp,\n  RedirectToTasks,\n  RedirectToUserProfile,\n} from './client-boundary/controlComponents';\n\n/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  APIKeys,\n  CreateOrganization,\n  GoogleOneTap,\n  OrganizationList,\n  OrganizationProfile,\n  OrganizationSwitcher,\n  PricingTable,\n  SignIn,\n  SignInButton,\n  SignInWithMetamaskButton,\n  SignOutButton,\n  SignUp,\n  SignUpButton,\n  TaskChooseOrganization,\n  TaskResetPassword,\n  TaskSetupMFA,\n  UserAvatar,\n  UserButton,\n  UserProfile,\n  Waitlist,\n} from './client-boundary/uiComponents';\n\n/**\n * These need to be explicitly listed. Do not use an * here.\n * If you do, app router will break.\n */\nexport {\n  useAuth,\n  useClerk,\n  useEmailLink,\n  useOrganization,\n  useOrganizationCreationDefaults,\n  useOrganizationList,\n  useReverification,\n  useAPIKeys,\n  useSession,\n  useSessionList,\n  useSignIn,\n  useSignUp,\n  useWaitlist,\n  useUser,\n} from './client-boundary/hooks';\n\nexport { getToken } from '@clerk/shared/getToken';\n\n/**\n * Conditionally export components that exhibit different behavior\n * when used in /app vs /pages.\n * We defined the runtime and the type values explicitly,\n * because TS will not recognize the subpath import unless the HOST\n * application sets moduleResolution to 'NodeNext'.\n */\n// @ts-ignore\nimport * as ComponentsModule from '#components';\n\nimport type { ServerComponentsServerModuleTypes } from './components.server';\n\nexport const ClerkProvider = ComponentsModule.ClerkProvider as ServerComponentsServerModuleTypes['ClerkProvider'];\nexport const Show = ComponentsModule.Show as ServerComponentsServerModuleTypes['Show'];\n\n/**\n * `auth` is not available from this import path.\n *\n * **To fix this error:**\n * ```diff\n * - import { auth } from '@clerk/nextjs'\n * + import { auth } from '@clerk/nextjs/server'\n * ```\n *\n * The `auth` function is only available in server-side contexts:\n * API Routes, Server Components, Server Actions, and Middleware.\n */\nexport declare const auth: never;\n"],"mappings":";AAIA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,gBAAgB;AAUzB,YAAY,sBAAsB;AAI3B,MAAM,gBAAgB,iBAAiB;AACvC,MAAM,OAAO,iBAAiB;","names":[]}

package/dist/esm/server/clerkMiddleware.js

@@ -11,17 +11,16 @@ import {
   TokenType
 } from "@clerk/backend/internal";
 import { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, matchProxyPath } from "@clerk/backend/proxy";
-import { isProductionFromPublishableKey, parsePublishableKey } from "@clerk/shared/keys";
+import { parsePublishableKey } from "@clerk/shared/keys";
 import { handleNetlifyCacheInDevInstance } from "@clerk/shared/netlifyCacheHandler";
 import { isMalformedURLError } from "@clerk/shared/pathMatcher";
-import { shouldAutoProxy } from "@clerk/shared/proxy";
 import { notFound as nextjsNotFound } from "next/navigation";
 import { NextResponse } from "next/server";
 import { isRedirect, serverRedirectWithAuth, setHeader } from "../utils";
 import { withLogger } from "../utils/debugLogger";
 import { canUseKeyless } from "../utils/feature-flags";
 import { clerkClient } from "./clerkClient";
-import { DOMAIN, PROXY_URL, PUBLISHABLE_KEY, SECRET_KEY, SIGN_IN_URL, SIGN_UP_URL } from "./constants";
+import { PUBLISHABLE_KEY, SECRET_KEY, SIGN_IN_URL, SIGN_UP_URL } from "./constants";
 import { createContentSecurityPolicyHeaders } from "./content-security-policy";
 import { errorThrower } from "./errorThrower";
 import { getHeader } from "./headers-utils";
@@ -65,16 +64,10 @@ const clerkMiddleware = ((...args) => {
         resolvedParams.secretKey || SECRET_KEY || (keyless == null ? void 0 : keyless.secretKey),
         () => errorThrower.throwMissingSecretKeyError()
       );
-      const requestUrl = new URL(request2.nextUrl.href);
-      let frontendApiProxyConfig = resolvedParams.frontendApiProxy;
-      const hasExplicitProxyOrDomain = resolvedParams.proxyUrl || PROXY_URL || resolvedParams.domain || DOMAIN;
-      if (!frontendApiProxyConfig && !hasExplicitProxyOrDomain && isProductionFromPublishableKey(publishableKey)) {
-        if (shouldAutoProxy(requestUrl.hostname)) {
-          frontendApiProxyConfig = { enabled: true };
-        }
-      }
+      const frontendApiProxyConfig = resolvedParams.frontendApiProxy;
       if (frontendApiProxyConfig) {
         const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = frontendApiProxyConfig;
+        const requestUrl = new URL(request2.url);
         const isEnabled = typeof enabled === "function" ? enabled(requestUrl) : enabled;
         if (isEnabled && matchProxyPath(request2, { proxyPath })) {
           return clerkFrontendApiProxy(request2, {

package/dist/esm/server/clerkMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/clerkMiddleware.ts"],"sourcesContent":["import type { AuthObject, ClerkClient } from '@clerk/backend';\nimport type {\n  AuthenticatedState,\n  AuthenticateRequestOptions,\n  ClerkRequest,\n  RedirectFun,\n  RequestState,\n  SignedInAuthObject,\n  SignedOutAuthObject,\n  UnauthenticatedState,\n} from '@clerk/backend/internal';\nimport {\n  AuthStatus,\n  constants,\n  createClerkRequest,\n  createRedirect,\n  getAuthObjectForAcceptedToken,\n  isMachineTokenByPrefix,\n  isTokenTypeAccepted,\n  makeAuthObjectSerializable,\n  TokenType,\n} from '@clerk/backend/internal';\nimport { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, matchProxyPath } from '@clerk/backend/proxy';\nimport { isProductionFromPublishableKey, parsePublishableKey } from '@clerk/shared/keys';\nimport { handleNetlifyCacheInDevInstance } from '@clerk/shared/netlifyCacheHandler';\nimport { isMalformedURLError } from '@clerk/shared/pathMatcher';\nimport { shouldAutoProxy } from '@clerk/shared/proxy';\nimport { notFound as nextjsNotFound } from 'next/navigation';\nimport type { NextMiddleware, NextRequest } from 'next/server';\nimport { NextResponse } from 'next/server';\n\nimport type { AuthFn } from '../app-router/server/auth';\nimport type { GetAuthOptions } from '../server/createGetAuth';\nimport { isRedirect, serverRedirectWithAuth, setHeader } from '../utils';\nimport { withLogger } from '../utils/debugLogger';\nimport { canUseKeyless } from '../utils/feature-flags';\nimport { clerkClient } from './clerkClient';\nimport { DOMAIN, PROXY_URL, PUBLISHABLE_KEY, SECRET_KEY, SIGN_IN_URL, SIGN_UP_URL } from './constants';\nimport { type ContentSecurityPolicyOptions, createContentSecurityPolicyHeaders } from './content-security-policy';\nimport { errorThrower } from './errorThrower';\nimport { getHeader } from './headers-utils';\nimport { getKeylessCookieValue } from './keyless';\nimport { clerkMiddlewareRequestDataStorage, clerkMiddlewareRequestDataStore } from './middleware-storage';\nimport {\n  isNextjsNotFoundError,\n  isNextjsRedirectError,\n  isNextjsUnauthorizedError,\n  isRedirectToSignInError,\n  isRedirectToSignUpError,\n  nextjsRedirectError,\n  redirectToSignInError,\n  redirectToSignUpError,\n  unauthorized,\n} from './nextErrors';\nimport type { AuthProtect } from './protect';\nimport { createProtect } from './protect';\nimport type {\n  FrontendApiProxyOptions,\n  NextMiddlewareEvtParam,\n  NextMiddlewareRequestParam,\n  NextMiddlewareReturn,\n} from './types';\nimport {\n  assertKey,\n  decorateRequest,\n  handleMultiDomainAndProxy,\n  redirectAdapter,\n  setRequestHeadersOnNextResponse,\n} from './utils';\n\nexport type ClerkMiddlewareSessionAuthObject = (SignedInAuthObject | SignedOutAuthObject) & {\n  redirectToSignIn: RedirectFun<Response>;\n  redirectToSignUp: RedirectFun<Response>;\n};\n\nexport type ClerkMiddlewareAuth = AuthFn;\n\ntype ClerkMiddlewareHandler = (\n  auth: ClerkMiddlewareAuth,\n  request: NextMiddlewareRequestParam,\n  event: NextMiddlewareEvtParam,\n) => NextMiddlewareReturn;\n\ntype AuthenticateAnyRequestOptions = Omit<AuthenticateRequestOptions, 'acceptsToken'>;\n\n/**\n * The `clerkMiddleware()` function accepts an optional object. The following options are available.\n * @interface\n */\nexport interface ClerkMiddlewareOptions extends AuthenticateAnyRequestOptions {\n  /**\n   * If true, additional debug information will be logged to the console.\n   */\n  debug?: boolean;\n\n  /**\n   * When set, automatically injects a Content-Security-Policy header(s) compatible with Clerk.\n   */\n  contentSecurityPolicy?: ContentSecurityPolicyOptions;\n\n  /**\n   * When set, enables the middleware to proxy Frontend API requests to Clerk.\n   * This is useful when direct communication with Clerk's API is blocked.\n   */\n  frontendApiProxy?: FrontendApiProxyOptions;\n}\n\ntype ClerkMiddlewareOptionsCallback = (req: NextRequest) => ClerkMiddlewareOptions | Promise<ClerkMiddlewareOptions>;\n\n/**\n * Middleware for Next.js that handles authentication and authorization with Clerk.\n * For more details, please refer to the docs: https://clerk.com/docs/reference/nextjs/clerk-middleware\n */\ninterface ClerkMiddleware {\n  /**\n   * @example\n   * export default clerkMiddleware((auth, request, event) => { ... }, options);\n   */\n  (handler: ClerkMiddlewareHandler, options?: ClerkMiddlewareOptions): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware((auth, request, event) => { ... }, (req) => options);\n   */\n  (handler: ClerkMiddlewareHandler, options?: ClerkMiddlewareOptionsCallback): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware(options);\n   */\n  (options?: ClerkMiddlewareOptions): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware;\n   */\n  (request: NextMiddlewareRequestParam, event: NextMiddlewareEvtParam): NextMiddlewareReturn;\n}\n\n/**\n * The `clerkMiddleware()` helper integrates Clerk authentication into your Next.js application through Middleware. `clerkMiddleware()` is compatible with both the App and Pages routers.\n */\nexport const clerkMiddleware = ((...args: unknown[]): NextMiddleware | NextMiddlewareReturn => {\n  const [request, event] = parseRequestAndEvent(args);\n  const [handler, params] = parseHandlerAndOptions(args);\n\n  const middleware = clerkMiddlewareRequestDataStorage.run(clerkMiddlewareRequestDataStore, () => {\n    const baseNextMiddleware: NextMiddleware = withLogger('clerkMiddleware', logger => async (request, event) => {\n      // Handles the case where `options` is a callback function to dynamically access `NextRequest`\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\n\n      const keyless = await getKeylessCookieValue(name => request.cookies.get(name)?.value);\n\n      const publishableKey = assertKey(\n        resolvedParams.publishableKey || PUBLISHABLE_KEY || keyless?.publishableKey,\n        () => errorThrower.throwMissingPublishableKeyError(),\n      );\n\n      const secretKey = assertKey(resolvedParams.secretKey || SECRET_KEY || keyless?.secretKey, () =>\n        errorThrower.throwMissingSecretKeyError(),\n      );\n\n      // Handle Frontend API proxy requests early, before authentication\n      const requestUrl = new URL(request.nextUrl.href);\n      let frontendApiProxyConfig = resolvedParams.frontendApiProxy;\n\n      // Auto-detect when no explicit proxy or domain is configured\n      const hasExplicitProxyOrDomain = resolvedParams.proxyUrl || PROXY_URL || resolvedParams.domain || DOMAIN;\n      if (!frontendApiProxyConfig && !hasExplicitProxyOrDomain && isProductionFromPublishableKey(publishableKey)) {\n        if (shouldAutoProxy(requestUrl.hostname)) {\n          frontendApiProxyConfig = { enabled: true };\n        }\n      }\n      if (frontendApiProxyConfig) {\n        const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = frontendApiProxyConfig;\n\n        // Resolve enabled - either boolean or function\n        const isEnabled = typeof enabled === 'function' ? enabled(requestUrl) : enabled;\n\n        if (isEnabled && matchProxyPath(request, { proxyPath })) {\n          return clerkFrontendApiProxy(request, {\n            proxyPath,\n            publishableKey,\n            secretKey,\n          });\n        }\n      }\n\n      const signInUrl = resolvedParams.signInUrl || SIGN_IN_URL;\n      const signUpUrl = resolvedParams.signUpUrl || SIGN_UP_URL;\n\n      const options = {\n        publishableKey,\n        secretKey,\n        signInUrl,\n        signUpUrl,\n        ...resolvedParams,\n      };\n\n      // Propagates the request data to be accessed on the server application runtime from helpers such as `clerkClient`\n      clerkMiddlewareRequestDataStore.set('requestData', options);\n      const resolvedClerkClient = await clerkClient();\n\n      if (options.debug) {\n        logger.enable();\n      }\n      const clerkRequest = createClerkRequest(request);\n      logger.debug('options', options);\n      logger.debug('url', () => clerkRequest.toJSON());\n\n      const authHeader = request.headers.get(constants.Headers.Authorization);\n      if (authHeader && authHeader.startsWith('Basic ')) {\n        logger.debug('Basic Auth detected');\n      }\n\n      const cspHeader = request.headers.get(constants.Headers.ContentSecurityPolicy);\n      if (cspHeader) {\n        logger.debug('Content-Security-Policy detected', () => ({\n          value: cspHeader,\n        }));\n      }\n\n      const requestState = await resolvedClerkClient.authenticateRequest(\n        clerkRequest,\n        createAuthenticateRequestOptions(clerkRequest, options),\n      );\n\n      logger.debug('requestState', () => ({\n        status: requestState.status,\n        headers: JSON.stringify(Object.fromEntries(requestState.headers)),\n        reason: requestState.reason,\n      }));\n\n      const locationHeader = requestState.headers.get(constants.Headers.Location);\n      if (locationHeader) {\n        handleNetlifyCacheInDevInstance({\n          locationHeader,\n          requestStateHeaders: requestState.headers,\n          publishableKey: requestState.publishableKey,\n        });\n\n        const res = NextResponse.redirect(requestState.headers.get(constants.Headers.Location) || locationHeader);\n        requestState.headers.forEach((value, key) => {\n          if (key === constants.Headers.Location) {\n            return;\n          }\n          res.headers.append(key, value);\n        });\n        return res;\n      } else if (requestState.status === AuthStatus.Handshake) {\n        throw new Error('Clerk: handshake status without redirect');\n      }\n\n      const authObject = requestState.toAuth();\n      logger.debug('auth', () => ({ auth: authObject, debug: authObject.debug() }));\n\n      const redirectToSignIn = createMiddlewareRedirectToSignIn(clerkRequest);\n      const redirectToSignUp = createMiddlewareRedirectToSignUp(clerkRequest);\n      const protect = await createMiddlewareProtect(clerkRequest, authObject, redirectToSignIn);\n\n      const authHandler = createMiddlewareAuthHandler(requestState, redirectToSignIn, redirectToSignUp);\n      authHandler.protect = protect;\n\n      let handlerResult: Response = NextResponse.next();\n      try {\n        const userHandlerResult = await clerkMiddlewareRequestDataStorage.run(\n          clerkMiddlewareRequestDataStore,\n          async () => handler?.(authHandler, request, event),\n        );\n        handlerResult = userHandlerResult || handlerResult;\n      } catch (e: any) {\n        handlerResult = handleControlFlowErrors(e, clerkRequest, request, requestState);\n      }\n      if (options.contentSecurityPolicy) {\n        const { headers } = createContentSecurityPolicyHeaders(\n          (parsePublishableKey(publishableKey)?.frontendApi ?? '').replace('$', ''),\n          options.contentSecurityPolicy,\n        );\n\n        const cspRequestHeaders: Record<string, string> = {};\n        headers.forEach(([key, value]) => {\n          setHeader(handlerResult, key, value);\n          cspRequestHeaders[key] = value;\n        });\n\n        // Forward CSP headers as request headers so server components\n        // can access the nonce via headers()\n        setRequestHeadersOnNextResponse(handlerResult, clerkRequest, cspRequestHeaders);\n\n        logger.debug('Clerk generated CSP', () => ({\n          headers,\n        }));\n      }\n\n      // TODO @nikos: we need to make this more generic\n      // and move the logic in clerk/backend\n      if (requestState.headers) {\n        requestState.headers.forEach((value, key) => {\n          if (key === constants.Headers.ContentSecurityPolicy) {\n            logger.debug('Content-Security-Policy detected', () => ({\n              value,\n            }));\n          }\n          handlerResult.headers.append(key, value);\n        });\n      }\n\n      if (isRedirect(handlerResult)) {\n        logger.debug('handlerResult is redirect');\n        return serverRedirectWithAuth(clerkRequest, handlerResult, options);\n      }\n\n      if (options.debug) {\n        setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });\n      }\n\n      const keylessKeysForRequestData =\n        // Only pass keyless credentials when there are no explicit keys\n        secretKey === keyless?.secretKey\n          ? {\n              publishableKey: keyless?.publishableKey,\n              secretKey: keyless?.secretKey,\n            }\n          : {};\n\n      decorateRequest(\n        clerkRequest,\n        handlerResult,\n        requestState,\n        resolvedParams,\n        keylessKeysForRequestData,\n        authObject.tokenType === 'session_token' ? null : makeAuthObjectSerializable(authObject),\n      );\n\n      return handlerResult;\n    });\n\n    const keylessMiddleware: NextMiddleware = async (request, event) => {\n      /**\n       * This mechanism replaces a full-page reload. Ensures that middleware will re-run and authenticate the request properly without the secret key or publishable key to be missing.\n       */\n      if (isKeylessSyncRequest(request)) {\n        return returnBackFromKeylessSync(request);\n      }\n\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\n      const keyless = await getKeylessCookieValue(name => request.cookies.get(name)?.value);\n\n      const isMissingPublishableKey = !(resolvedParams.publishableKey || PUBLISHABLE_KEY || keyless?.publishableKey);\n      const authHeader = getHeader(request, constants.Headers.Authorization)?.replace('Bearer ', '') ?? '';\n\n      /**\n       * In keyless mode, if the publishable key is missing, let the request through, to render `<ClerkProvider/>` that will resume the flow gracefully.\n       */\n      if (isMissingPublishableKey && !isMachineTokenByPrefix(authHeader)) {\n        const res = NextResponse.next();\n        setRequestHeadersOnNextResponse(res, request, {\n          [constants.Headers.AuthStatus]: 'signed-out',\n        });\n        return res;\n      }\n\n      return baseNextMiddleware(request, event);\n    };\n\n    const nextMiddleware: NextMiddleware = async (request, event) => {\n      if (canUseKeyless) {\n        return keylessMiddleware(request, event);\n      }\n\n      return baseNextMiddleware(request, event);\n    };\n\n    // If we have a request and event, we're being called as a middleware directly\n    // eg, export default clerkMiddleware;\n    if (request && event) {\n      return nextMiddleware(request, event);\n    }\n\n    // Otherwise, return a middleware that can be called with a request and event\n    // eg, export default clerkMiddleware(auth => { ... });\n    return nextMiddleware;\n  });\n\n  return middleware;\n}) as ClerkMiddleware;\n\nconst parseRequestAndEvent = (args: unknown[]) => {\n  return [args[0] instanceof Request ? args[0] : undefined, args[0] instanceof Request ? args[1] : undefined] as [\n    NextMiddlewareRequestParam | undefined,\n    NextMiddlewareEvtParam | undefined,\n  ];\n};\n\nconst parseHandlerAndOptions = (args: unknown[]) => {\n  return [\n    typeof args[0] === 'function' ? args[0] : undefined,\n    (args.length === 2 ? args[1] : typeof args[0] === 'function' ? {} : args[0]) || {},\n  ] as [ClerkMiddlewareHandler | undefined, ClerkMiddlewareOptions | ClerkMiddlewareOptionsCallback];\n};\n\nconst isKeylessSyncRequest = (request: NextMiddlewareRequestParam) =>\n  request.nextUrl.pathname === '/clerk-sync-keyless';\n\nconst returnBackFromKeylessSync = (request: NextMiddlewareRequestParam) => {\n  const returnUrl = request.nextUrl.searchParams.get('returnUrl');\n  const url = new URL(request.url);\n  url.pathname = '';\n\n  return NextResponse.redirect(returnUrl || url.toString());\n};\n\ntype AuthenticateRequest = Pick<ClerkClient, 'authenticateRequest'>['authenticateRequest'];\n\nexport const createAuthenticateRequestOptions = (\n  clerkRequest: ClerkRequest,\n  options: ClerkMiddlewareOptions,\n): Parameters<AuthenticateRequest>[1] => {\n  // Auto-derive proxyUrl from frontendApiProxy config if not explicitly set\n  let resolvedOptions = options;\n  if (options.frontendApiProxy && !options.proxyUrl) {\n    const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = options.frontendApiProxy;\n    const requestUrl = new URL(clerkRequest.url);\n    const isEnabled = typeof enabled === 'function' ? enabled(requestUrl) : enabled;\n\n    if (isEnabled) {\n      const derivedProxyUrl = `${requestUrl.origin}${proxyPath}`;\n      resolvedOptions = { ...options, proxyUrl: derivedProxyUrl };\n    }\n  }\n\n  return {\n    ...resolvedOptions,\n    ...handleMultiDomainAndProxy(clerkRequest, resolvedOptions),\n    // TODO: Leaving the acceptsToken as 'any' opens up the possibility of\n    // an economic attack. We should revisit this and only verify a token\n    // when auth() or auth.protect() is invoked.\n    acceptsToken: 'any',\n  };\n};\n\nconst createMiddlewareRedirectToSignIn = (\n  clerkRequest: ClerkRequest,\n): ClerkMiddlewareSessionAuthObject['redirectToSignIn'] => {\n  return (opts = {}) => {\n    const url = clerkRequest.clerkUrl.toString();\n    redirectToSignInError(url, opts.returnBackUrl);\n  };\n};\n\nconst createMiddlewareRedirectToSignUp = (\n  clerkRequest: ClerkRequest,\n): ClerkMiddlewareSessionAuthObject['redirectToSignUp'] => {\n  return (opts = {}) => {\n    const url = clerkRequest.clerkUrl.toString();\n    redirectToSignUpError(url, opts.returnBackUrl);\n  };\n};\n\nconst createMiddlewareProtect = (\n  clerkRequest: ClerkRequest,\n  rawAuthObject: AuthObject,\n  redirectToSignIn: RedirectFun<Response>,\n) => {\n  return (async (params: any, options: any) => {\n    const notFound = () => nextjsNotFound();\n\n    const redirect = (url: string) =>\n      nextjsRedirectError(url, {\n        redirectUrl: url,\n      });\n\n    const requestedToken = params?.token || options?.token || TokenType.SessionToken;\n    const authObject = getAuthObjectForAcceptedToken({ authObject: rawAuthObject, acceptsToken: requestedToken });\n\n    return createProtect({\n      request: clerkRequest,\n      redirect,\n      notFound,\n      unauthorized,\n      authObject,\n      redirectToSignIn,\n    })(params, options);\n  }) as unknown as Promise<AuthProtect>;\n};\n\n/**\n * Modifies the auth object based on the token type.\n * - For session tokens: adds redirect functions to the auth object\n * - For machine tokens: validates token type and returns appropriate auth object\n */\nconst createMiddlewareAuthHandler = (\n  requestState: AuthenticatedState<'session_token'> | UnauthenticatedState<'session_token'>,\n  redirectToSignIn: RedirectFun<Response>,\n  redirectToSignUp: RedirectFun<Response>,\n): ClerkMiddlewareAuth => {\n  const authHandler = async (options?: GetAuthOptions) => {\n    const rawAuthObject = requestState.toAuth({ treatPendingAsSignedOut: options?.treatPendingAsSignedOut });\n    const acceptsToken = options?.acceptsToken ?? TokenType.SessionToken;\n\n    const authObject = getAuthObjectForAcceptedToken({\n      authObject: rawAuthObject,\n      acceptsToken,\n    });\n\n    if (authObject.tokenType === TokenType.SessionToken && isTokenTypeAccepted(TokenType.SessionToken, acceptsToken)) {\n      return Object.assign(authObject, {\n        redirectToSignIn,\n        redirectToSignUp,\n      });\n    }\n\n    return authObject;\n  };\n\n  return authHandler as ClerkMiddlewareAuth;\n};\n\n// Handle errors thrown by protect() and redirectToSignIn() calls,\n// as we want to align the APIs between middleware, pages and route handlers\n// Normally, middleware requires to explicitly return a response, but we want to\n// avoid discrepancies between the APIs as it's easy to miss the `return` statement\n// especially when copy-pasting code from one place to another.\n// This function handles the known errors thrown by the APIs described above,\n// and returns the appropriate response.\nconst handleControlFlowErrors = (\n  e: any,\n  clerkRequest: ClerkRequest,\n  nextRequest: NextRequest,\n  requestState: RequestState,\n): Response => {\n  if (isMalformedURLError(e)) {\n    return new NextResponse(null, { status: 400, statusText: 'Bad Request' });\n  }\n\n  if (isNextjsUnauthorizedError(e)) {\n    const response = new NextResponse(null, { status: 401 });\n\n    // RequestState.toAuth() returns a session_token type by default.\n    // We need to cast it to the correct type to check for OAuth tokens.\n    const authObject = (requestState as RequestState<TokenType>).toAuth();\n    if (authObject && authObject.tokenType === TokenType.OAuthToken) {\n      // Following MCP spec, we return WWW-Authenticate header on 401 responses\n      // to enable OAuth 2.0 authorization server discovery (RFC9728).\n      // See https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-1-authorization-server-location\n      const publishableKey = parsePublishableKey(requestState.publishableKey);\n      return setHeader(\n        response,\n        'WWW-Authenticate',\n        `Bearer resource_metadata=\"https://${publishableKey?.frontendApi}/.well-known/oauth-protected-resource\"`,\n      );\n    }\n\n    return response;\n  }\n\n  if (isNextjsNotFoundError(e)) {\n    // Rewrite to a bogus URL to force not found error\n    return setHeader(\n      // This is an internal rewrite purely to trigger a not found error. We do not want Next.js to think that the\n      // destination URL is a valid page, so we use `nextRequest.url` as the base for the fake URL, which Next.js\n      // understands is an internal URL and won't run middleware against the request.\n      NextResponse.rewrite(new URL(`/clerk_${Date.now()}`, nextRequest.url)),\n      constants.Headers.AuthReason,\n      'protect-rewrite',\n    );\n  }\n\n  const isRedirectToSignIn = isRedirectToSignInError(e);\n  const isRedirectToSignUp = isRedirectToSignUpError(e);\n\n  if (isRedirectToSignIn || isRedirectToSignUp) {\n    const redirect = createRedirect({\n      redirectAdapter,\n      baseUrl: clerkRequest.clerkUrl,\n      signInUrl: requestState.signInUrl,\n      signUpUrl: requestState.signUpUrl,\n      publishableKey: requestState.publishableKey,\n      sessionStatus: requestState.toAuth()?.sessionStatus,\n      isSatellite: requestState.isSatellite,\n    });\n\n    const { returnBackUrl } = e;\n    return redirect[isRedirectToSignIn ? 'redirectToSignIn' : 'redirectToSignUp']({ returnBackUrl });\n  }\n\n  if (isNextjsRedirectError(e)) {\n    return redirectAdapter(e.redirectUrl);\n  }\n\n  throw e;\n};\n"],"mappings":";AAWA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB,oBAAoB,sBAAsB;AAC1E,SAAS,gCAAgC,2BAA2B;AACpE,SAAS,uCAAuC;AAChD,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,YAAY,sBAAsB;AAE3C,SAAS,oBAAoB;AAI7B,SAAS,YAAY,wBAAwB,iBAAiB;AAC9D,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,mBAAmB;AAC5B,SAAS,QAAQ,WAAW,iBAAiB,YAAY,aAAa,mBAAmB;AACzF,SAA4C,0CAA0C;AACtF,SAAS,oBAAoB;AAC7B,SAAS,iBAAiB;AAC1B,SAAS,6BAA6B;AACtC,SAAS,mCAAmC,uCAAuC;AACnF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,qBAAqB;AAO9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA0EA,MAAM,mBAAmB,IAAI,SAA2D;AAC7F,QAAM,CAAC,SAAS,KAAK,IAAI,qBAAqB,IAAI;AAClD,QAAM,CAAC,SAAS,MAAM,IAAI,uBAAuB,IAAI;AAErD,QAAM,aAAa,kCAAkC,IAAI,iCAAiC,MAAM;AAC9F,UAAM,qBAAqC,WAAW,mBAAmB,YAAU,OAAOA,UAASC,WAAU;AAnJjH;AAqJM,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOD,QAAO,IAAI;AAE9E,YAAM,UAAU,MAAM,sBAAsB,UAAK;AAvJvD,YAAAE;AAuJ0D,gBAAAA,MAAAF,SAAQ,QAAQ,IAAI,IAAI,MAAxB,gBAAAE,IAA2B;AAAA,OAAK;AAEpF,YAAM,iBAAiB;AAAA,QACrB,eAAe,kBAAkB,oBAAmB,mCAAS;AAAA,QAC7D,MAAM,aAAa,gCAAgC;AAAA,MACrD;AAEA,YAAM,YAAY;AAAA,QAAU,eAAe,aAAa,eAAc,mCAAS;AAAA,QAAW,MACxF,aAAa,2BAA2B;AAAA,MAC1C;AAGA,YAAM,aAAa,IAAI,IAAIF,SAAQ,QAAQ,IAAI;AAC/C,UAAI,yBAAyB,eAAe;AAG5C,YAAM,2BAA2B,eAAe,YAAY,aAAa,eAAe,UAAU;AAClG,UAAI,CAAC,0BAA0B,CAAC,4BAA4B,+BAA+B,cAAc,GAAG;AAC1G,YAAI,gBAAgB,WAAW,QAAQ,GAAG;AACxC,mCAAyB,EAAE,SAAS,KAAK;AAAA,QAC3C;AAAA,MACF;AACA,UAAI,wBAAwB;AAC1B,cAAM,EAAE,SAAS,MAAM,YAAY,mBAAmB,IAAI;AAG1D,cAAM,YAAY,OAAO,YAAY,aAAa,QAAQ,UAAU,IAAI;AAExE,YAAI,aAAa,eAAeA,UAAS,EAAE,UAAU,CAAC,GAAG;AACvD,iBAAO,sBAAsBA,UAAS;AAAA,YACpC;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,YAAY,eAAe,aAAa;AAC9C,YAAM,YAAY,eAAe,aAAa;AAE9C,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAGA,sCAAgC,IAAI,eAAe,OAAO;AAC1D,YAAM,sBAAsB,MAAM,YAAY;AAE9C,UAAI,QAAQ,OAAO;AACjB,eAAO,OAAO;AAAA,MAChB;AACA,YAAM,eAAe,mBAAmBA,QAAO;AAC/C,aAAO,MAAM,WAAW,OAAO;AAC/B,aAAO,MAAM,OAAO,MAAM,aAAa,OAAO,CAAC;AAE/C,YAAM,aAAaA,SAAQ,QAAQ,IAAI,UAAU,QAAQ,aAAa;AACtE,UAAI,cAAc,WAAW,WAAW,QAAQ,GAAG;AACjD,eAAO,MAAM,qBAAqB;AAAA,MACpC;AAEA,YAAM,YAAYA,SAAQ,QAAQ,IAAI,UAAU,QAAQ,qBAAqB;AAC7E,UAAI,WAAW;AACb,eAAO,MAAM,oCAAoC,OAAO;AAAA,UACtD,OAAO;AAAA,QACT,EAAE;AAAA,MACJ;AAEA,YAAM,eAAe,MAAM,oBAAoB;AAAA,QAC7C;AAAA,QACA,iCAAiC,cAAc,OAAO;AAAA,MACxD;AAEA,aAAO,MAAM,gBAAgB,OAAO;AAAA,QAClC,QAAQ,aAAa;AAAA,QACrB,SAAS,KAAK,UAAU,OAAO,YAAY,aAAa,OAAO,CAAC;AAAA,QAChE,QAAQ,aAAa;AAAA,MACvB,EAAE;AAEF,YAAM,iBAAiB,aAAa,QAAQ,IAAI,UAAU,QAAQ,QAAQ;AAC1E,UAAI,gBAAgB;AAClB,wCAAgC;AAAA,UAC9B;AAAA,UACA,qBAAqB,aAAa;AAAA,UAClC,gBAAgB,aAAa;AAAA,QAC/B,CAAC;AAED,cAAM,MAAM,aAAa,SAAS,aAAa,QAAQ,IAAI,UAAU,QAAQ,QAAQ,KAAK,cAAc;AACxG,qBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC3C,cAAI,QAAQ,UAAU,QAAQ,UAAU;AACtC;AAAA,UACF;AACA,cAAI,QAAQ,OAAO,KAAK,KAAK;AAAA,QAC/B,CAAC;AACD,eAAO;AAAA,MACT,WAAW,aAAa,WAAW,WAAW,WAAW;AACvD,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AAEA,YAAM,aAAa,aAAa,OAAO;AACvC,aAAO,MAAM,QAAQ,OAAO,EAAE,MAAM,YAAY,OAAO,WAAW,MAAM,EAAE,EAAE;AAE5E,YAAM,mBAAmB,iCAAiC,YAAY;AACtE,YAAM,mBAAmB,iCAAiC,YAAY;AACtE,YAAM,UAAU,MAAM,wBAAwB,cAAc,YAAY,gBAAgB;AAExF,YAAM,cAAc,4BAA4B,cAAc,kBAAkB,gBAAgB;AAChG,kBAAY,UAAU;AAEtB,UAAI,gBAA0B,aAAa,KAAK;AAChD,UAAI;AACF,cAAM,oBAAoB,MAAM,kCAAkC;AAAA,UAChE;AAAA,UACA,YAAY,mCAAU,aAAaA,UAASC;AAAA,QAC9C;AACA,wBAAgB,qBAAqB;AAAA,MACvC,SAAS,GAAQ;AACf,wBAAgB,wBAAwB,GAAG,cAAcD,UAAS,YAAY;AAAA,MAChF;AACA,UAAI,QAAQ,uBAAuB;AACjC,cAAM,EAAE,QAAQ,IAAI;AAAA,YACjB,+BAAoB,cAAc,MAAlC,mBAAqC,gBAArC,YAAoD,IAAI,QAAQ,KAAK,EAAE;AAAA,UACxE,QAAQ;AAAA,QACV;AAEA,cAAM,oBAA4C,CAAC;AACnD,gBAAQ,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAChC,oBAAU,eAAe,KAAK,KAAK;AACnC,4BAAkB,GAAG,IAAI;AAAA,QAC3B,CAAC;AAID,wCAAgC,eAAe,cAAc,iBAAiB;AAE9E,eAAO,MAAM,uBAAuB,OAAO;AAAA,UACzC;AAAA,QACF,EAAE;AAAA,MACJ;AAIA,UAAI,aAAa,SAAS;AACxB,qBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC3C,cAAI,QAAQ,UAAU,QAAQ,uBAAuB;AACnD,mBAAO,MAAM,oCAAoC,OAAO;AAAA,cACtD;AAAA,YACF,EAAE;AAAA,UACJ;AACA,wBAAc,QAAQ,OAAO,KAAK,KAAK;AAAA,QACzC,CAAC;AAAA,MACH;AAEA,UAAI,WAAW,aAAa,GAAG;AAC7B,eAAO,MAAM,2BAA2B;AACxC,eAAO,uBAAuB,cAAc,eAAe,OAAO;AAAA,MACpE;AAEA,UAAI,QAAQ,OAAO;AACjB,wCAAgC,eAAe,cAAc,EAAE,CAAC,UAAU,QAAQ,WAAW,GAAG,OAAO,CAAC;AAAA,MAC1G;AAEA,YAAM;AAAA;AAAA,QAEJ,eAAc,mCAAS,aACnB;AAAA,UACE,gBAAgB,mCAAS;AAAA,UACzB,WAAW,mCAAS;AAAA,QACtB,IACA,CAAC;AAAA;AAEP;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,cAAc,kBAAkB,OAAO,2BAA2B,UAAU;AAAA,MACzF;AAEA,aAAO;AAAA,IACT,CAAC;AAED,UAAM,oBAAoC,OAAOA,UAASC,WAAU;AAjVxE;AAqVM,UAAI,qBAAqBD,QAAO,GAAG;AACjC,eAAO,0BAA0BA,QAAO;AAAA,MAC1C;AAEA,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOA,QAAO,IAAI;AAC9E,YAAM,UAAU,MAAM,sBAAsB,UAAK;AA1VvD,YAAAE;AA0V0D,gBAAAA,MAAAF,SAAQ,QAAQ,IAAI,IAAI,MAAxB,gBAAAE,IAA2B;AAAA,OAAK;AAEpF,YAAM,0BAA0B,EAAE,eAAe,kBAAkB,oBAAmB,mCAAS;AAC/F,YAAM,cAAa,qBAAUF,UAAS,UAAU,QAAQ,aAAa,MAAlD,mBAAqD,QAAQ,WAAW,QAAxE,YAA+E;AAKlG,UAAI,2BAA2B,CAAC,uBAAuB,UAAU,GAAG;AAClE,cAAM,MAAM,aAAa,KAAK;AAC9B,wCAAgC,KAAKA,UAAS;AAAA,UAC5C,CAAC,UAAU,QAAQ,UAAU,GAAG;AAAA,QAClC,CAAC;AACD,eAAO;AAAA,MACT;AAEA,aAAO,mBAAmBA,UAASC,MAAK;AAAA,IAC1C;AAEA,UAAM,iBAAiC,OAAOD,UAASC,WAAU;AAC/D,UAAI,eAAe;AACjB,eAAO,kBAAkBD,UAASC,MAAK;AAAA,MACzC;AAEA,aAAO,mBAAmBD,UAASC,MAAK;AAAA,IAC1C;AAIA,QAAI,WAAW,OAAO;AACpB,aAAO,eAAe,SAAS,KAAK;AAAA,IACtC;AAIA,WAAO;AAAA,EACT,CAAC;AAED,SAAO;AACT;AAEA,MAAM,uBAAuB,CAAC,SAAoB;AAChD,SAAO,CAAC,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI,QAAW,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI,MAAS;AAI5G;AAEA,MAAM,yBAAyB,CAAC,SAAoB;AAClD,SAAO;AAAA,IACL,OAAO,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI;AAAA,KACzC,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;AAAA,EACnF;AACF;AAEA,MAAM,uBAAuB,CAAC,YAC5B,QAAQ,QAAQ,aAAa;AAE/B,MAAM,4BAA4B,CAAC,YAAwC;AACzE,QAAM,YAAY,QAAQ,QAAQ,aAAa,IAAI,WAAW;AAC9D,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,MAAI,WAAW;AAEf,SAAO,aAAa,SAAS,aAAa,IAAI,SAAS,CAAC;AAC1D;AAIO,MAAM,mCAAmC,CAC9C,cACA,YACuC;AAEvC,MAAI,kBAAkB;AACtB,MAAI,QAAQ,oBAAoB,CAAC,QAAQ,UAAU;AACjD,UAAM,EAAE,SAAS,MAAM,YAAY,mBAAmB,IAAI,QAAQ;AAClE,UAAM,aAAa,IAAI,IAAI,aAAa,GAAG;AAC3C,UAAM,YAAY,OAAO,YAAY,aAAa,QAAQ,UAAU,IAAI;AAExE,QAAI,WAAW;AACb,YAAM,kBAAkB,GAAG,WAAW,MAAM,GAAG,SAAS;AACxD,wBAAkB,EAAE,GAAG,SAAS,UAAU,gBAAgB;AAAA,IAC5D;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG,0BAA0B,cAAc,eAAe;AAAA;AAAA;AAAA;AAAA,IAI1D,cAAc;AAAA,EAChB;AACF;AAEA,MAAM,mCAAmC,CACvC,iBACyD;AACzD,SAAO,CAAC,OAAO,CAAC,MAAM;AACpB,UAAM,MAAM,aAAa,SAAS,SAAS;AAC3C,0BAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AACF;AAEA,MAAM,mCAAmC,CACvC,iBACyD;AACzD,SAAO,CAAC,OAAO,CAAC,MAAM;AACpB,UAAM,MAAM,aAAa,SAAS,SAAS;AAC3C,0BAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AACF;AAEA,MAAM,0BAA0B,CAC9B,cACA,eACA,qBACG;AACH,UAAQ,OAAO,QAAa,YAAiB;AAC3C,UAAM,WAAW,MAAM,eAAe;AAEtC,UAAM,WAAW,CAAC,QAChB,oBAAoB,KAAK;AAAA,MACvB,aAAa;AAAA,IACf,CAAC;AAEH,UAAM,kBAAiB,iCAAQ,WAAS,mCAAS,UAAS,UAAU;AACpE,UAAM,aAAa,8BAA8B,EAAE,YAAY,eAAe,cAAc,eAAe,CAAC;AAE5G,WAAO,cAAc;AAAA,MACnB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EAAE,QAAQ,OAAO;AAAA,EACpB;AACF;AAOA,MAAM,8BAA8B,CAClC,cACA,kBACA,qBACwB;AACxB,QAAM,cAAc,OAAO,YAA6B;AAhf1D;AAifI,UAAM,gBAAgB,aAAa,OAAO,EAAE,yBAAyB,mCAAS,wBAAwB,CAAC;AACvG,UAAM,gBAAe,wCAAS,iBAAT,YAAyB,UAAU;AAExD,UAAM,aAAa,8BAA8B;AAAA,MAC/C,YAAY;AAAA,MACZ;AAAA,IACF,CAAC;AAED,QAAI,WAAW,cAAc,UAAU,gBAAgB,oBAAoB,UAAU,cAAc,YAAY,GAAG;AAChH,aAAO,OAAO,OAAO,YAAY;AAAA,QAC/B;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AASA,MAAM,0BAA0B,CAC9B,GACA,cACA,aACA,iBACa;AAlhBf;AAmhBE,MAAI,oBAAoB,CAAC,GAAG;AAC1B,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,KAAK,YAAY,cAAc,CAAC;AAAA,EAC1E;AAEA,MAAI,0BAA0B,CAAC,GAAG;AAChC,UAAM,WAAW,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAIvD,UAAM,aAAc,aAAyC,OAAO;AACpE,QAAI,cAAc,WAAW,cAAc,UAAU,YAAY;AAI/D,YAAM,iBAAiB,oBAAoB,aAAa,cAAc;AACtE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,qCAAqC,iDAAgB,WAAW;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,MAAI,sBAAsB,CAAC,GAAG;AAE5B,WAAO;AAAA;AAAA;AAAA;AAAA,MAIL,aAAa,QAAQ,IAAI,IAAI,UAAU,KAAK,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,qBAAqB,wBAAwB,CAAC;AACpD,QAAM,qBAAqB,wBAAwB,CAAC;AAEpD,MAAI,sBAAsB,oBAAoB;AAC5C,UAAM,WAAW,eAAe;AAAA,MAC9B;AAAA,MACA,SAAS,aAAa;AAAA,MACtB,WAAW,aAAa;AAAA,MACxB,WAAW,aAAa;AAAA,MACxB,gBAAgB,aAAa;AAAA,MAC7B,gBAAe,kBAAa,OAAO,MAApB,mBAAuB;AAAA,MACtC,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,UAAM,EAAE,cAAc,IAAI;AAC1B,WAAO,SAAS,qBAAqB,qBAAqB,kBAAkB,EAAE,EAAE,cAAc,CAAC;AAAA,EACjG;AAEA,MAAI,sBAAsB,CAAC,GAAG;AAC5B,WAAO,gBAAgB,EAAE,WAAW;AAAA,EACtC;AAEA,QAAM;AACR;","names":["request","event","_a"]}
+{"version":3,"sources":["../../../src/server/clerkMiddleware.ts"],"sourcesContent":["import type { AuthObject, ClerkClient } from '@clerk/backend';\nimport type {\n  AuthenticatedState,\n  AuthenticateRequestOptions,\n  ClerkRequest,\n  RedirectFun,\n  RequestState,\n  SignedInAuthObject,\n  SignedOutAuthObject,\n  UnauthenticatedState,\n} from '@clerk/backend/internal';\nimport {\n  AuthStatus,\n  constants,\n  createClerkRequest,\n  createRedirect,\n  getAuthObjectForAcceptedToken,\n  isMachineTokenByPrefix,\n  isTokenTypeAccepted,\n  makeAuthObjectSerializable,\n  TokenType,\n} from '@clerk/backend/internal';\nimport { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, matchProxyPath } from '@clerk/backend/proxy';\nimport { parsePublishableKey } from '@clerk/shared/keys';\nimport { handleNetlifyCacheInDevInstance } from '@clerk/shared/netlifyCacheHandler';\nimport { isMalformedURLError } from '@clerk/shared/pathMatcher';\nimport { notFound as nextjsNotFound } from 'next/navigation';\nimport type { NextMiddleware, NextRequest } from 'next/server';\nimport { NextResponse } from 'next/server';\n\nimport type { AuthFn } from '../app-router/server/auth';\nimport type { GetAuthOptions } from '../server/createGetAuth';\nimport { isRedirect, serverRedirectWithAuth, setHeader } from '../utils';\nimport { withLogger } from '../utils/debugLogger';\nimport { canUseKeyless } from '../utils/feature-flags';\nimport { clerkClient } from './clerkClient';\nimport { PUBLISHABLE_KEY, SECRET_KEY, SIGN_IN_URL, SIGN_UP_URL } from './constants';\nimport { type ContentSecurityPolicyOptions, createContentSecurityPolicyHeaders } from './content-security-policy';\nimport { errorThrower } from './errorThrower';\nimport { getHeader } from './headers-utils';\nimport { getKeylessCookieValue } from './keyless';\nimport { clerkMiddlewareRequestDataStorage, clerkMiddlewareRequestDataStore } from './middleware-storage';\nimport {\n  isNextjsNotFoundError,\n  isNextjsRedirectError,\n  isNextjsUnauthorizedError,\n  isRedirectToSignInError,\n  isRedirectToSignUpError,\n  nextjsRedirectError,\n  redirectToSignInError,\n  redirectToSignUpError,\n  unauthorized,\n} from './nextErrors';\nimport type { AuthProtect } from './protect';\nimport { createProtect } from './protect';\nimport type {\n  FrontendApiProxyOptions,\n  NextMiddlewareEvtParam,\n  NextMiddlewareRequestParam,\n  NextMiddlewareReturn,\n} from './types';\nimport {\n  assertKey,\n  decorateRequest,\n  handleMultiDomainAndProxy,\n  redirectAdapter,\n  setRequestHeadersOnNextResponse,\n} from './utils';\n\nexport type ClerkMiddlewareSessionAuthObject = (SignedInAuthObject | SignedOutAuthObject) & {\n  redirectToSignIn: RedirectFun<Response>;\n  redirectToSignUp: RedirectFun<Response>;\n};\n\nexport type ClerkMiddlewareAuth = AuthFn;\n\ntype ClerkMiddlewareHandler = (\n  auth: ClerkMiddlewareAuth,\n  request: NextMiddlewareRequestParam,\n  event: NextMiddlewareEvtParam,\n) => NextMiddlewareReturn;\n\ntype AuthenticateAnyRequestOptions = Omit<AuthenticateRequestOptions, 'acceptsToken'>;\n\n/**\n * The `clerkMiddleware()` function accepts an optional object. The following options are available.\n * @interface\n */\nexport interface ClerkMiddlewareOptions extends AuthenticateAnyRequestOptions {\n  /**\n   * If true, additional debug information will be logged to the console.\n   */\n  debug?: boolean;\n\n  /**\n   * When set, automatically injects a Content-Security-Policy header(s) compatible with Clerk.\n   */\n  contentSecurityPolicy?: ContentSecurityPolicyOptions;\n\n  /**\n   * When set, enables the middleware to proxy Frontend API requests to Clerk.\n   * This is useful when direct communication with Clerk's API is blocked.\n   */\n  frontendApiProxy?: FrontendApiProxyOptions;\n}\n\ntype ClerkMiddlewareOptionsCallback = (req: NextRequest) => ClerkMiddlewareOptions | Promise<ClerkMiddlewareOptions>;\n\n/**\n * Middleware for Next.js that handles authentication and authorization with Clerk.\n * For more details, please refer to the docs: https://clerk.com/docs/reference/nextjs/clerk-middleware\n */\ninterface ClerkMiddleware {\n  /**\n   * @example\n   * export default clerkMiddleware((auth, request, event) => { ... }, options);\n   */\n  (handler: ClerkMiddlewareHandler, options?: ClerkMiddlewareOptions): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware((auth, request, event) => { ... }, (req) => options);\n   */\n  (handler: ClerkMiddlewareHandler, options?: ClerkMiddlewareOptionsCallback): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware(options);\n   */\n  (options?: ClerkMiddlewareOptions): NextMiddleware;\n\n  /**\n   * @example\n   * export default clerkMiddleware;\n   */\n  (request: NextMiddlewareRequestParam, event: NextMiddlewareEvtParam): NextMiddlewareReturn;\n}\n\n/**\n * The `clerkMiddleware()` helper integrates Clerk authentication into your Next.js application through Middleware. `clerkMiddleware()` is compatible with both the App and Pages routers.\n */\nexport const clerkMiddleware = ((...args: unknown[]): NextMiddleware | NextMiddlewareReturn => {\n  const [request, event] = parseRequestAndEvent(args);\n  const [handler, params] = parseHandlerAndOptions(args);\n\n  const middleware = clerkMiddlewareRequestDataStorage.run(clerkMiddlewareRequestDataStore, () => {\n    const baseNextMiddleware: NextMiddleware = withLogger('clerkMiddleware', logger => async (request, event) => {\n      // Handles the case where `options` is a callback function to dynamically access `NextRequest`\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\n\n      const keyless = await getKeylessCookieValue(name => request.cookies.get(name)?.value);\n\n      const publishableKey = assertKey(\n        resolvedParams.publishableKey || PUBLISHABLE_KEY || keyless?.publishableKey,\n        () => errorThrower.throwMissingPublishableKeyError(),\n      );\n\n      const secretKey = assertKey(resolvedParams.secretKey || SECRET_KEY || keyless?.secretKey, () =>\n        errorThrower.throwMissingSecretKeyError(),\n      );\n\n      // Handle Frontend API proxy requests early, before authentication\n      const frontendApiProxyConfig = resolvedParams.frontendApiProxy;\n      if (frontendApiProxyConfig) {\n        const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = frontendApiProxyConfig;\n\n        // Resolve enabled - either boolean or function\n        const requestUrl = new URL(request.url);\n        const isEnabled = typeof enabled === 'function' ? enabled(requestUrl) : enabled;\n\n        if (isEnabled && matchProxyPath(request, { proxyPath })) {\n          return clerkFrontendApiProxy(request, {\n            proxyPath,\n            publishableKey,\n            secretKey,\n          });\n        }\n      }\n\n      const signInUrl = resolvedParams.signInUrl || SIGN_IN_URL;\n      const signUpUrl = resolvedParams.signUpUrl || SIGN_UP_URL;\n\n      const options = {\n        publishableKey,\n        secretKey,\n        signInUrl,\n        signUpUrl,\n        ...resolvedParams,\n      };\n\n      // Propagates the request data to be accessed on the server application runtime from helpers such as `clerkClient`\n      clerkMiddlewareRequestDataStore.set('requestData', options);\n      const resolvedClerkClient = await clerkClient();\n\n      if (options.debug) {\n        logger.enable();\n      }\n      const clerkRequest = createClerkRequest(request);\n      logger.debug('options', options);\n      logger.debug('url', () => clerkRequest.toJSON());\n\n      const authHeader = request.headers.get(constants.Headers.Authorization);\n      if (authHeader && authHeader.startsWith('Basic ')) {\n        logger.debug('Basic Auth detected');\n      }\n\n      const cspHeader = request.headers.get(constants.Headers.ContentSecurityPolicy);\n      if (cspHeader) {\n        logger.debug('Content-Security-Policy detected', () => ({\n          value: cspHeader,\n        }));\n      }\n\n      const requestState = await resolvedClerkClient.authenticateRequest(\n        clerkRequest,\n        createAuthenticateRequestOptions(clerkRequest, options),\n      );\n\n      logger.debug('requestState', () => ({\n        status: requestState.status,\n        headers: JSON.stringify(Object.fromEntries(requestState.headers)),\n        reason: requestState.reason,\n      }));\n\n      const locationHeader = requestState.headers.get(constants.Headers.Location);\n      if (locationHeader) {\n        handleNetlifyCacheInDevInstance({\n          locationHeader,\n          requestStateHeaders: requestState.headers,\n          publishableKey: requestState.publishableKey,\n        });\n\n        const res = NextResponse.redirect(requestState.headers.get(constants.Headers.Location) || locationHeader);\n        requestState.headers.forEach((value, key) => {\n          if (key === constants.Headers.Location) {\n            return;\n          }\n          res.headers.append(key, value);\n        });\n        return res;\n      } else if (requestState.status === AuthStatus.Handshake) {\n        throw new Error('Clerk: handshake status without redirect');\n      }\n\n      const authObject = requestState.toAuth();\n      logger.debug('auth', () => ({ auth: authObject, debug: authObject.debug() }));\n\n      const redirectToSignIn = createMiddlewareRedirectToSignIn(clerkRequest);\n      const redirectToSignUp = createMiddlewareRedirectToSignUp(clerkRequest);\n      const protect = await createMiddlewareProtect(clerkRequest, authObject, redirectToSignIn);\n\n      const authHandler = createMiddlewareAuthHandler(requestState, redirectToSignIn, redirectToSignUp);\n      authHandler.protect = protect;\n\n      let handlerResult: Response = NextResponse.next();\n      try {\n        const userHandlerResult = await clerkMiddlewareRequestDataStorage.run(\n          clerkMiddlewareRequestDataStore,\n          async () => handler?.(authHandler, request, event),\n        );\n        handlerResult = userHandlerResult || handlerResult;\n      } catch (e: any) {\n        handlerResult = handleControlFlowErrors(e, clerkRequest, request, requestState);\n      }\n      if (options.contentSecurityPolicy) {\n        const { headers } = createContentSecurityPolicyHeaders(\n          (parsePublishableKey(publishableKey)?.frontendApi ?? '').replace('$', ''),\n          options.contentSecurityPolicy,\n        );\n\n        const cspRequestHeaders: Record<string, string> = {};\n        headers.forEach(([key, value]) => {\n          setHeader(handlerResult, key, value);\n          cspRequestHeaders[key] = value;\n        });\n\n        // Forward CSP headers as request headers so server components\n        // can access the nonce via headers()\n        setRequestHeadersOnNextResponse(handlerResult, clerkRequest, cspRequestHeaders);\n\n        logger.debug('Clerk generated CSP', () => ({\n          headers,\n        }));\n      }\n\n      // TODO @nikos: we need to make this more generic\n      // and move the logic in clerk/backend\n      if (requestState.headers) {\n        requestState.headers.forEach((value, key) => {\n          if (key === constants.Headers.ContentSecurityPolicy) {\n            logger.debug('Content-Security-Policy detected', () => ({\n              value,\n            }));\n          }\n          handlerResult.headers.append(key, value);\n        });\n      }\n\n      if (isRedirect(handlerResult)) {\n        logger.debug('handlerResult is redirect');\n        return serverRedirectWithAuth(clerkRequest, handlerResult, options);\n      }\n\n      if (options.debug) {\n        setRequestHeadersOnNextResponse(handlerResult, clerkRequest, { [constants.Headers.EnableDebug]: 'true' });\n      }\n\n      const keylessKeysForRequestData =\n        // Only pass keyless credentials when there are no explicit keys\n        secretKey === keyless?.secretKey\n          ? {\n              publishableKey: keyless?.publishableKey,\n              secretKey: keyless?.secretKey,\n            }\n          : {};\n\n      decorateRequest(\n        clerkRequest,\n        handlerResult,\n        requestState,\n        resolvedParams,\n        keylessKeysForRequestData,\n        authObject.tokenType === 'session_token' ? null : makeAuthObjectSerializable(authObject),\n      );\n\n      return handlerResult;\n    });\n\n    const keylessMiddleware: NextMiddleware = async (request, event) => {\n      /**\n       * This mechanism replaces a full-page reload. Ensures that middleware will re-run and authenticate the request properly without the secret key or publishable key to be missing.\n       */\n      if (isKeylessSyncRequest(request)) {\n        return returnBackFromKeylessSync(request);\n      }\n\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\n      const keyless = await getKeylessCookieValue(name => request.cookies.get(name)?.value);\n\n      const isMissingPublishableKey = !(resolvedParams.publishableKey || PUBLISHABLE_KEY || keyless?.publishableKey);\n      const authHeader = getHeader(request, constants.Headers.Authorization)?.replace('Bearer ', '') ?? '';\n\n      /**\n       * In keyless mode, if the publishable key is missing, let the request through, to render `<ClerkProvider/>` that will resume the flow gracefully.\n       */\n      if (isMissingPublishableKey && !isMachineTokenByPrefix(authHeader)) {\n        const res = NextResponse.next();\n        setRequestHeadersOnNextResponse(res, request, {\n          [constants.Headers.AuthStatus]: 'signed-out',\n        });\n        return res;\n      }\n\n      return baseNextMiddleware(request, event);\n    };\n\n    const nextMiddleware: NextMiddleware = async (request, event) => {\n      if (canUseKeyless) {\n        return keylessMiddleware(request, event);\n      }\n\n      return baseNextMiddleware(request, event);\n    };\n\n    // If we have a request and event, we're being called as a middleware directly\n    // eg, export default clerkMiddleware;\n    if (request && event) {\n      return nextMiddleware(request, event);\n    }\n\n    // Otherwise, return a middleware that can be called with a request and event\n    // eg, export default clerkMiddleware(auth => { ... });\n    return nextMiddleware;\n  });\n\n  return middleware;\n}) as ClerkMiddleware;\n\nconst parseRequestAndEvent = (args: unknown[]) => {\n  return [args[0] instanceof Request ? args[0] : undefined, args[0] instanceof Request ? args[1] : undefined] as [\n    NextMiddlewareRequestParam | undefined,\n    NextMiddlewareEvtParam | undefined,\n  ];\n};\n\nconst parseHandlerAndOptions = (args: unknown[]) => {\n  return [\n    typeof args[0] === 'function' ? args[0] : undefined,\n    (args.length === 2 ? args[1] : typeof args[0] === 'function' ? {} : args[0]) || {},\n  ] as [ClerkMiddlewareHandler | undefined, ClerkMiddlewareOptions | ClerkMiddlewareOptionsCallback];\n};\n\nconst isKeylessSyncRequest = (request: NextMiddlewareRequestParam) =>\n  request.nextUrl.pathname === '/clerk-sync-keyless';\n\nconst returnBackFromKeylessSync = (request: NextMiddlewareRequestParam) => {\n  const returnUrl = request.nextUrl.searchParams.get('returnUrl');\n  const url = new URL(request.url);\n  url.pathname = '';\n\n  return NextResponse.redirect(returnUrl || url.toString());\n};\n\ntype AuthenticateRequest = Pick<ClerkClient, 'authenticateRequest'>['authenticateRequest'];\n\nexport const createAuthenticateRequestOptions = (\n  clerkRequest: ClerkRequest,\n  options: ClerkMiddlewareOptions,\n): Parameters<AuthenticateRequest>[1] => {\n  // Auto-derive proxyUrl from frontendApiProxy config if not explicitly set\n  let resolvedOptions = options;\n  if (options.frontendApiProxy && !options.proxyUrl) {\n    const { enabled, path: proxyPath = DEFAULT_PROXY_PATH } = options.frontendApiProxy;\n    const requestUrl = new URL(clerkRequest.url);\n    const isEnabled = typeof enabled === 'function' ? enabled(requestUrl) : enabled;\n\n    if (isEnabled) {\n      const derivedProxyUrl = `${requestUrl.origin}${proxyPath}`;\n      resolvedOptions = { ...options, proxyUrl: derivedProxyUrl };\n    }\n  }\n\n  return {\n    ...resolvedOptions,\n    ...handleMultiDomainAndProxy(clerkRequest, resolvedOptions),\n    // TODO: Leaving the acceptsToken as 'any' opens up the possibility of\n    // an economic attack. We should revisit this and only verify a token\n    // when auth() or auth.protect() is invoked.\n    acceptsToken: 'any',\n  };\n};\n\nconst createMiddlewareRedirectToSignIn = (\n  clerkRequest: ClerkRequest,\n): ClerkMiddlewareSessionAuthObject['redirectToSignIn'] => {\n  return (opts = {}) => {\n    const url = clerkRequest.clerkUrl.toString();\n    redirectToSignInError(url, opts.returnBackUrl);\n  };\n};\n\nconst createMiddlewareRedirectToSignUp = (\n  clerkRequest: ClerkRequest,\n): ClerkMiddlewareSessionAuthObject['redirectToSignUp'] => {\n  return (opts = {}) => {\n    const url = clerkRequest.clerkUrl.toString();\n    redirectToSignUpError(url, opts.returnBackUrl);\n  };\n};\n\nconst createMiddlewareProtect = (\n  clerkRequest: ClerkRequest,\n  rawAuthObject: AuthObject,\n  redirectToSignIn: RedirectFun<Response>,\n) => {\n  return (async (params: any, options: any) => {\n    const notFound = () => nextjsNotFound();\n\n    const redirect = (url: string) =>\n      nextjsRedirectError(url, {\n        redirectUrl: url,\n      });\n\n    const requestedToken = params?.token || options?.token || TokenType.SessionToken;\n    const authObject = getAuthObjectForAcceptedToken({ authObject: rawAuthObject, acceptsToken: requestedToken });\n\n    return createProtect({\n      request: clerkRequest,\n      redirect,\n      notFound,\n      unauthorized,\n      authObject,\n      redirectToSignIn,\n    })(params, options);\n  }) as unknown as Promise<AuthProtect>;\n};\n\n/**\n * Modifies the auth object based on the token type.\n * - For session tokens: adds redirect functions to the auth object\n * - For machine tokens: validates token type and returns appropriate auth object\n */\nconst createMiddlewareAuthHandler = (\n  requestState: AuthenticatedState<'session_token'> | UnauthenticatedState<'session_token'>,\n  redirectToSignIn: RedirectFun<Response>,\n  redirectToSignUp: RedirectFun<Response>,\n): ClerkMiddlewareAuth => {\n  const authHandler = async (options?: GetAuthOptions) => {\n    const rawAuthObject = requestState.toAuth({ treatPendingAsSignedOut: options?.treatPendingAsSignedOut });\n    const acceptsToken = options?.acceptsToken ?? TokenType.SessionToken;\n\n    const authObject = getAuthObjectForAcceptedToken({\n      authObject: rawAuthObject,\n      acceptsToken,\n    });\n\n    if (authObject.tokenType === TokenType.SessionToken && isTokenTypeAccepted(TokenType.SessionToken, acceptsToken)) {\n      return Object.assign(authObject, {\n        redirectToSignIn,\n        redirectToSignUp,\n      });\n    }\n\n    return authObject;\n  };\n\n  return authHandler as ClerkMiddlewareAuth;\n};\n\n// Handle errors thrown by protect() and redirectToSignIn() calls,\n// as we want to align the APIs between middleware, pages and route handlers\n// Normally, middleware requires to explicitly return a response, but we want to\n// avoid discrepancies between the APIs as it's easy to miss the `return` statement\n// especially when copy-pasting code from one place to another.\n// This function handles the known errors thrown by the APIs described above,\n// and returns the appropriate response.\nconst handleControlFlowErrors = (\n  e: any,\n  clerkRequest: ClerkRequest,\n  nextRequest: NextRequest,\n  requestState: RequestState,\n): Response => {\n  if (isMalformedURLError(e)) {\n    return new NextResponse(null, { status: 400, statusText: 'Bad Request' });\n  }\n\n  if (isNextjsUnauthorizedError(e)) {\n    const response = new NextResponse(null, { status: 401 });\n\n    // RequestState.toAuth() returns a session_token type by default.\n    // We need to cast it to the correct type to check for OAuth tokens.\n    const authObject = (requestState as RequestState<TokenType>).toAuth();\n    if (authObject && authObject.tokenType === TokenType.OAuthToken) {\n      // Following MCP spec, we return WWW-Authenticate header on 401 responses\n      // to enable OAuth 2.0 authorization server discovery (RFC9728).\n      // See https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-1-authorization-server-location\n      const publishableKey = parsePublishableKey(requestState.publishableKey);\n      return setHeader(\n        response,\n        'WWW-Authenticate',\n        `Bearer resource_metadata=\"https://${publishableKey?.frontendApi}/.well-known/oauth-protected-resource\"`,\n      );\n    }\n\n    return response;\n  }\n\n  if (isNextjsNotFoundError(e)) {\n    // Rewrite to a bogus URL to force not found error\n    return setHeader(\n      // This is an internal rewrite purely to trigger a not found error. We do not want Next.js to think that the\n      // destination URL is a valid page, so we use `nextRequest.url` as the base for the fake URL, which Next.js\n      // understands is an internal URL and won't run middleware against the request.\n      NextResponse.rewrite(new URL(`/clerk_${Date.now()}`, nextRequest.url)),\n      constants.Headers.AuthReason,\n      'protect-rewrite',\n    );\n  }\n\n  const isRedirectToSignIn = isRedirectToSignInError(e);\n  const isRedirectToSignUp = isRedirectToSignUpError(e);\n\n  if (isRedirectToSignIn || isRedirectToSignUp) {\n    const redirect = createRedirect({\n      redirectAdapter,\n      baseUrl: clerkRequest.clerkUrl,\n      signInUrl: requestState.signInUrl,\n      signUpUrl: requestState.signUpUrl,\n      publishableKey: requestState.publishableKey,\n      sessionStatus: requestState.toAuth()?.sessionStatus,\n      isSatellite: requestState.isSatellite,\n    });\n\n    const { returnBackUrl } = e;\n    return redirect[isRedirectToSignIn ? 'redirectToSignIn' : 'redirectToSignUp']({ returnBackUrl });\n  }\n\n  if (isNextjsRedirectError(e)) {\n    return redirectAdapter(e.redirectUrl);\n  }\n\n  throw e;\n};\n"],"mappings":";AAWA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB,oBAAoB,sBAAsB;AAC1E,SAAS,2BAA2B;AACpC,SAAS,uCAAuC;AAChD,SAAS,2BAA2B;AACpC,SAAS,YAAY,sBAAsB;AAE3C,SAAS,oBAAoB;AAI7B,SAAS,YAAY,wBAAwB,iBAAiB;AAC9D,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,mBAAmB;AAC5B,SAAS,iBAAiB,YAAY,aAAa,mBAAmB;AACtE,SAA4C,0CAA0C;AACtF,SAAS,oBAAoB;AAC7B,SAAS,iBAAiB;AAC1B,SAAS,6BAA6B;AACtC,SAAS,mCAAmC,uCAAuC;AACnF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,qBAAqB;AAO9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA0EA,MAAM,mBAAmB,IAAI,SAA2D;AAC7F,QAAM,CAAC,SAAS,KAAK,IAAI,qBAAqB,IAAI;AAClD,QAAM,CAAC,SAAS,MAAM,IAAI,uBAAuB,IAAI;AAErD,QAAM,aAAa,kCAAkC,IAAI,iCAAiC,MAAM;AAC9F,UAAM,qBAAqC,WAAW,mBAAmB,YAAU,OAAOA,UAASC,WAAU;AAlJjH;AAoJM,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOD,QAAO,IAAI;AAE9E,YAAM,UAAU,MAAM,sBAAsB,UAAK;AAtJvD,YAAAE;AAsJ0D,gBAAAA,MAAAF,SAAQ,QAAQ,IAAI,IAAI,MAAxB,gBAAAE,IAA2B;AAAA,OAAK;AAEpF,YAAM,iBAAiB;AAAA,QACrB,eAAe,kBAAkB,oBAAmB,mCAAS;AAAA,QAC7D,MAAM,aAAa,gCAAgC;AAAA,MACrD;AAEA,YAAM,YAAY;AAAA,QAAU,eAAe,aAAa,eAAc,mCAAS;AAAA,QAAW,MACxF,aAAa,2BAA2B;AAAA,MAC1C;AAGA,YAAM,yBAAyB,eAAe;AAC9C,UAAI,wBAAwB;AAC1B,cAAM,EAAE,SAAS,MAAM,YAAY,mBAAmB,IAAI;AAG1D,cAAM,aAAa,IAAI,IAAIF,SAAQ,GAAG;AACtC,cAAM,YAAY,OAAO,YAAY,aAAa,QAAQ,UAAU,IAAI;AAExE,YAAI,aAAa,eAAeA,UAAS,EAAE,UAAU,CAAC,GAAG;AACvD,iBAAO,sBAAsBA,UAAS;AAAA,YACpC;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,YAAY,eAAe,aAAa;AAC9C,YAAM,YAAY,eAAe,aAAa;AAE9C,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAGA,sCAAgC,IAAI,eAAe,OAAO;AAC1D,YAAM,sBAAsB,MAAM,YAAY;AAE9C,UAAI,QAAQ,OAAO;AACjB,eAAO,OAAO;AAAA,MAChB;AACA,YAAM,eAAe,mBAAmBA,QAAO;AAC/C,aAAO,MAAM,WAAW,OAAO;AAC/B,aAAO,MAAM,OAAO,MAAM,aAAa,OAAO,CAAC;AAE/C,YAAM,aAAaA,SAAQ,QAAQ,IAAI,UAAU,QAAQ,aAAa;AACtE,UAAI,cAAc,WAAW,WAAW,QAAQ,GAAG;AACjD,eAAO,MAAM,qBAAqB;AAAA,MACpC;AAEA,YAAM,YAAYA,SAAQ,QAAQ,IAAI,UAAU,QAAQ,qBAAqB;AAC7E,UAAI,WAAW;AACb,eAAO,MAAM,oCAAoC,OAAO;AAAA,UACtD,OAAO;AAAA,QACT,EAAE;AAAA,MACJ;AAEA,YAAM,eAAe,MAAM,oBAAoB;AAAA,QAC7C;AAAA,QACA,iCAAiC,cAAc,OAAO;AAAA,MACxD;AAEA,aAAO,MAAM,gBAAgB,OAAO;AAAA,QAClC,QAAQ,aAAa;AAAA,QACrB,SAAS,KAAK,UAAU,OAAO,YAAY,aAAa,OAAO,CAAC;AAAA,QAChE,QAAQ,aAAa;AAAA,MACvB,EAAE;AAEF,YAAM,iBAAiB,aAAa,QAAQ,IAAI,UAAU,QAAQ,QAAQ;AAC1E,UAAI,gBAAgB;AAClB,wCAAgC;AAAA,UAC9B;AAAA,UACA,qBAAqB,aAAa;AAAA,UAClC,gBAAgB,aAAa;AAAA,QAC/B,CAAC;AAED,cAAM,MAAM,aAAa,SAAS,aAAa,QAAQ,IAAI,UAAU,QAAQ,QAAQ,KAAK,cAAc;AACxG,qBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC3C,cAAI,QAAQ,UAAU,QAAQ,UAAU;AACtC;AAAA,UACF;AACA,cAAI,QAAQ,OAAO,KAAK,KAAK;AAAA,QAC/B,CAAC;AACD,eAAO;AAAA,MACT,WAAW,aAAa,WAAW,WAAW,WAAW;AACvD,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AAEA,YAAM,aAAa,aAAa,OAAO;AACvC,aAAO,MAAM,QAAQ,OAAO,EAAE,MAAM,YAAY,OAAO,WAAW,MAAM,EAAE,EAAE;AAE5E,YAAM,mBAAmB,iCAAiC,YAAY;AACtE,YAAM,mBAAmB,iCAAiC,YAAY;AACtE,YAAM,UAAU,MAAM,wBAAwB,cAAc,YAAY,gBAAgB;AAExF,YAAM,cAAc,4BAA4B,cAAc,kBAAkB,gBAAgB;AAChG,kBAAY,UAAU;AAEtB,UAAI,gBAA0B,aAAa,KAAK;AAChD,UAAI;AACF,cAAM,oBAAoB,MAAM,kCAAkC;AAAA,UAChE;AAAA,UACA,YAAY,mCAAU,aAAaA,UAASC;AAAA,QAC9C;AACA,wBAAgB,qBAAqB;AAAA,MACvC,SAAS,GAAQ;AACf,wBAAgB,wBAAwB,GAAG,cAAcD,UAAS,YAAY;AAAA,MAChF;AACA,UAAI,QAAQ,uBAAuB;AACjC,cAAM,EAAE,QAAQ,IAAI;AAAA,YACjB,+BAAoB,cAAc,MAAlC,mBAAqC,gBAArC,YAAoD,IAAI,QAAQ,KAAK,EAAE;AAAA,UACxE,QAAQ;AAAA,QACV;AAEA,cAAM,oBAA4C,CAAC;AACnD,gBAAQ,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAChC,oBAAU,eAAe,KAAK,KAAK;AACnC,4BAAkB,GAAG,IAAI;AAAA,QAC3B,CAAC;AAID,wCAAgC,eAAe,cAAc,iBAAiB;AAE9E,eAAO,MAAM,uBAAuB,OAAO;AAAA,UACzC;AAAA,QACF,EAAE;AAAA,MACJ;AAIA,UAAI,aAAa,SAAS;AACxB,qBAAa,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC3C,cAAI,QAAQ,UAAU,QAAQ,uBAAuB;AACnD,mBAAO,MAAM,oCAAoC,OAAO;AAAA,cACtD;AAAA,YACF,EAAE;AAAA,UACJ;AACA,wBAAc,QAAQ,OAAO,KAAK,KAAK;AAAA,QACzC,CAAC;AAAA,MACH;AAEA,UAAI,WAAW,aAAa,GAAG;AAC7B,eAAO,MAAM,2BAA2B;AACxC,eAAO,uBAAuB,cAAc,eAAe,OAAO;AAAA,MACpE;AAEA,UAAI,QAAQ,OAAO;AACjB,wCAAgC,eAAe,cAAc,EAAE,CAAC,UAAU,QAAQ,WAAW,GAAG,OAAO,CAAC;AAAA,MAC1G;AAEA,YAAM;AAAA;AAAA,QAEJ,eAAc,mCAAS,aACnB;AAAA,UACE,gBAAgB,mCAAS;AAAA,UACzB,WAAW,mCAAS;AAAA,QACtB,IACA,CAAC;AAAA;AAEP;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,cAAc,kBAAkB,OAAO,2BAA2B,UAAU;AAAA,MACzF;AAEA,aAAO;AAAA,IACT,CAAC;AAED,UAAM,oBAAoC,OAAOA,UAASC,WAAU;AAxUxE;AA4UM,UAAI,qBAAqBD,QAAO,GAAG;AACjC,eAAO,0BAA0BA,QAAO;AAAA,MAC1C;AAEA,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOA,QAAO,IAAI;AAC9E,YAAM,UAAU,MAAM,sBAAsB,UAAK;AAjVvD,YAAAE;AAiV0D,gBAAAA,MAAAF,SAAQ,QAAQ,IAAI,IAAI,MAAxB,gBAAAE,IAA2B;AAAA,OAAK;AAEpF,YAAM,0BAA0B,EAAE,eAAe,kBAAkB,oBAAmB,mCAAS;AAC/F,YAAM,cAAa,qBAAUF,UAAS,UAAU,QAAQ,aAAa,MAAlD,mBAAqD,QAAQ,WAAW,QAAxE,YAA+E;AAKlG,UAAI,2BAA2B,CAAC,uBAAuB,UAAU,GAAG;AAClE,cAAM,MAAM,aAAa,KAAK;AAC9B,wCAAgC,KAAKA,UAAS;AAAA,UAC5C,CAAC,UAAU,QAAQ,UAAU,GAAG;AAAA,QAClC,CAAC;AACD,eAAO;AAAA,MACT;AAEA,aAAO,mBAAmBA,UAASC,MAAK;AAAA,IAC1C;AAEA,UAAM,iBAAiC,OAAOD,UAASC,WAAU;AAC/D,UAAI,eAAe;AACjB,eAAO,kBAAkBD,UAASC,MAAK;AAAA,MACzC;AAEA,aAAO,mBAAmBD,UAASC,MAAK;AAAA,IAC1C;AAIA,QAAI,WAAW,OAAO;AACpB,aAAO,eAAe,SAAS,KAAK;AAAA,IACtC;AAIA,WAAO;AAAA,EACT,CAAC;AAED,SAAO;AACT;AAEA,MAAM,uBAAuB,CAAC,SAAoB;AAChD,SAAO,CAAC,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI,QAAW,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI,MAAS;AAI5G;AAEA,MAAM,yBAAyB,CAAC,SAAoB;AAClD,SAAO;AAAA,IACL,OAAO,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI;AAAA,KACzC,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;AAAA,EACnF;AACF;AAEA,MAAM,uBAAuB,CAAC,YAC5B,QAAQ,QAAQ,aAAa;AAE/B,MAAM,4BAA4B,CAAC,YAAwC;AACzE,QAAM,YAAY,QAAQ,QAAQ,aAAa,IAAI,WAAW;AAC9D,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,MAAI,WAAW;AAEf,SAAO,aAAa,SAAS,aAAa,IAAI,SAAS,CAAC;AAC1D;AAIO,MAAM,mCAAmC,CAC9C,cACA,YACuC;AAEvC,MAAI,kBAAkB;AACtB,MAAI,QAAQ,oBAAoB,CAAC,QAAQ,UAAU;AACjD,UAAM,EAAE,SAAS,MAAM,YAAY,mBAAmB,IAAI,QAAQ;AAClE,UAAM,aAAa,IAAI,IAAI,aAAa,GAAG;AAC3C,UAAM,YAAY,OAAO,YAAY,aAAa,QAAQ,UAAU,IAAI;AAExE,QAAI,WAAW;AACb,YAAM,kBAAkB,GAAG,WAAW,MAAM,GAAG,SAAS;AACxD,wBAAkB,EAAE,GAAG,SAAS,UAAU,gBAAgB;AAAA,IAC5D;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG,0BAA0B,cAAc,eAAe;AAAA;AAAA;AAAA;AAAA,IAI1D,cAAc;AAAA,EAChB;AACF;AAEA,MAAM,mCAAmC,CACvC,iBACyD;AACzD,SAAO,CAAC,OAAO,CAAC,MAAM;AACpB,UAAM,MAAM,aAAa,SAAS,SAAS;AAC3C,0BAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AACF;AAEA,MAAM,mCAAmC,CACvC,iBACyD;AACzD,SAAO,CAAC,OAAO,CAAC,MAAM;AACpB,UAAM,MAAM,aAAa,SAAS,SAAS;AAC3C,0BAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AACF;AAEA,MAAM,0BAA0B,CAC9B,cACA,eACA,qBACG;AACH,UAAQ,OAAO,QAAa,YAAiB;AAC3C,UAAM,WAAW,MAAM,eAAe;AAEtC,UAAM,WAAW,CAAC,QAChB,oBAAoB,KAAK;AAAA,MACvB,aAAa;AAAA,IACf,CAAC;AAEH,UAAM,kBAAiB,iCAAQ,WAAS,mCAAS,UAAS,UAAU;AACpE,UAAM,aAAa,8BAA8B,EAAE,YAAY,eAAe,cAAc,eAAe,CAAC;AAE5G,WAAO,cAAc;AAAA,MACnB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EAAE,QAAQ,OAAO;AAAA,EACpB;AACF;AAOA,MAAM,8BAA8B,CAClC,cACA,kBACA,qBACwB;AACxB,QAAM,cAAc,OAAO,YAA6B;AAve1D;AAweI,UAAM,gBAAgB,aAAa,OAAO,EAAE,yBAAyB,mCAAS,wBAAwB,CAAC;AACvG,UAAM,gBAAe,wCAAS,iBAAT,YAAyB,UAAU;AAExD,UAAM,aAAa,8BAA8B;AAAA,MAC/C,YAAY;AAAA,MACZ;AAAA,IACF,CAAC;AAED,QAAI,WAAW,cAAc,UAAU,gBAAgB,oBAAoB,UAAU,cAAc,YAAY,GAAG;AAChH,aAAO,OAAO,OAAO,YAAY;AAAA,QAC/B;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AASA,MAAM,0BAA0B,CAC9B,GACA,cACA,aACA,iBACa;AAzgBf;AA0gBE,MAAI,oBAAoB,CAAC,GAAG;AAC1B,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,KAAK,YAAY,cAAc,CAAC;AAAA,EAC1E;AAEA,MAAI,0BAA0B,CAAC,GAAG;AAChC,UAAM,WAAW,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAIvD,UAAM,aAAc,aAAyC,OAAO;AACpE,QAAI,cAAc,WAAW,cAAc,UAAU,YAAY;AAI/D,YAAM,iBAAiB,oBAAoB,aAAa,cAAc;AACtE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,qCAAqC,iDAAgB,WAAW;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,MAAI,sBAAsB,CAAC,GAAG;AAE5B,WAAO;AAAA;AAAA;AAAA;AAAA,MAIL,aAAa,QAAQ,IAAI,IAAI,UAAU,KAAK,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,qBAAqB,wBAAwB,CAAC;AACpD,QAAM,qBAAqB,wBAAwB,CAAC;AAEpD,MAAI,sBAAsB,oBAAoB;AAC5C,UAAM,WAAW,eAAe;AAAA,MAC9B;AAAA,MACA,SAAS,aAAa;AAAA,MACtB,WAAW,aAAa;AAAA,MACxB,WAAW,aAAa;AAAA,MACxB,gBAAgB,aAAa;AAAA,MAC7B,gBAAe,kBAAa,OAAO,MAApB,mBAAuB;AAAA,MACtC,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,UAAM,EAAE,cAAc,IAAI;AAC1B,WAAO,SAAS,qBAAqB,qBAAqB,kBAAkB,EAAE,EAAE,cAAc,CAAC;AAAA,EACjG;AAEA,MAAI,sBAAsB,CAAC,GAAG;AAC5B,WAAO,gBAAgB,EAAE,WAAW;AAAA,EACtC;AAEA,QAAM;AACR;","names":["request","event","_a"]}

package/dist/esm/server/constants.js

@@ -18,7 +18,7 @@ const SIGN_IN_URL = process.env.NEXT_PUBLIC_CLERK_SIGN_IN_URL || "";
 const SIGN_UP_URL = process.env.NEXT_PUBLIC_CLERK_SIGN_UP_URL || "";
 const SDK_METADATA = {
   name: "@clerk/nextjs",
-  version: "7.2.4-snapshot.v20260421194054",
+  version: "7.2.4",
   environment: process.env.NODE_ENV
 };
 const TELEMETRY_DISABLED = isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DISABLED);

package/dist/esm/server/createClerkClient.js

@@ -18,7 +18,7 @@ const clerkClientDefaultOptions = {
   publishableKey: PUBLISHABLE_KEY,
   apiUrl: API_URL,
   apiVersion: API_VERSION,
-  userAgent: `${"@clerk/nextjs"}@${"7.2.4-snapshot.v20260421194054"}`,
+  userAgent: `${"@clerk/nextjs"}@${"7.2.4"}`,
   proxyUrl: PROXY_URL,
   domain: DOMAIN,
   isSatellite: IS_SATELLITE,

package/dist/esm/server/createClerkClient.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/createClerkClient.ts"],"sourcesContent":["import { createClerkClient } from '@clerk/backend';\n\nimport {\n  API_URL,\n  API_VERSION,\n  DOMAIN,\n  IS_SATELLITE,\n  MACHINE_SECRET_KEY,\n  PROXY_URL,\n  PUBLISHABLE_KEY,\n  SDK_METADATA,\n  SECRET_KEY,\n  TELEMETRY_DEBUG,\n  TELEMETRY_DISABLED,\n} from './constants';\n\nconst clerkClientDefaultOptions = {\n  secretKey: SECRET_KEY,\n  publishableKey: PUBLISHABLE_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,\n  proxyUrl: PROXY_URL,\n  domain: DOMAIN,\n  isSatellite: IS_SATELLITE,\n  machineSecretKey: MACHINE_SECRET_KEY,\n  sdkMetadata: SDK_METADATA,\n  telemetry: {\n    disabled: TELEMETRY_DISABLED,\n    debug: TELEMETRY_DEBUG,\n  },\n};\n\nexport const createClerkClientWithOptions: typeof createClerkClient = options =>\n  createClerkClient({ ...clerkClientDefaultOptions, ...options });\n"],"mappings":";AAAA,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,4BAA4B;AAAA,EAChC,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,WAAW,GAAG,eAAY,IAAI,gCAAe;AAAA,EAC7C,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,WAAW;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACF;AAEO,MAAM,+BAAyD,aACpE,kBAAkB,EAAE,GAAG,2BAA2B,GAAG,QAAQ,CAAC;","names":[]}
+{"version":3,"sources":["../../../src/server/createClerkClient.ts"],"sourcesContent":["import { createClerkClient } from '@clerk/backend';\n\nimport {\n  API_URL,\n  API_VERSION,\n  DOMAIN,\n  IS_SATELLITE,\n  MACHINE_SECRET_KEY,\n  PROXY_URL,\n  PUBLISHABLE_KEY,\n  SDK_METADATA,\n  SECRET_KEY,\n  TELEMETRY_DEBUG,\n  TELEMETRY_DISABLED,\n} from './constants';\n\nconst clerkClientDefaultOptions = {\n  secretKey: SECRET_KEY,\n  publishableKey: PUBLISHABLE_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,\n  proxyUrl: PROXY_URL,\n  domain: DOMAIN,\n  isSatellite: IS_SATELLITE,\n  machineSecretKey: MACHINE_SECRET_KEY,\n  sdkMetadata: SDK_METADATA,\n  telemetry: {\n    disabled: TELEMETRY_DISABLED,\n    debug: TELEMETRY_DEBUG,\n  },\n};\n\nexport const createClerkClientWithOptions: typeof createClerkClient = options =>\n  createClerkClient({ ...clerkClientDefaultOptions, ...options });\n"],"mappings":";AAAA,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,4BAA4B;AAAA,EAChC,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,WAAW,GAAG,eAAY,IAAI,OAAe;AAAA,EAC7C,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,WAAW;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AACF;AAEO,MAAM,+BAAyD,aACpE,kBAAkB,EAAE,GAAG,2BAA2B,GAAG,QAAQ,CAAC;","names":[]}

package/dist/esm/server/protect.js

@@ -61,17 +61,24 @@ function createProtect(opts) {
     return handleUnauthorized();
   });
 }
+const AUTH_PARAM_KEYS = ["role", "permission", "feature", "plan", "reverification"];
 const getAuthorizationParams = (arg) => {
   if (!arg) {
     return void 0;
   }
-  if (arg.unauthenticatedUrl || arg.unauthorizedUrl || arg.token) {
-    return void 0;
+  if (typeof arg === "function") {
+    return arg;
+  }
+  const authParams = {};
+  for (const key of AUTH_PARAM_KEYS) {
+    if (arg[key] !== void 0) {
+      authParams[key] = arg[key];
+    }
   }
-  if (Object.keys(arg).length === 1 && "token" in arg) {
+  if (Object.keys(authParams).length === 0) {
     return void 0;
   }
-  return arg;
+  return authParams;
 };
 const isServerActionRequest = (req) => {
   var _a, _b;

package/dist/esm/server/protect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/protect.ts"],"sourcesContent":["import type { AuthObject } from '@clerk/backend';\nimport type {\n  AuthenticatedMachineObject,\n  AuthenticateRequestOptions,\n  InferAuthObjectFromToken,\n  InferAuthObjectFromTokenArray,\n  RedirectFun,\n  SignedInAuthObject,\n} from '@clerk/backend/internal';\nimport { constants, isTokenTypeAccepted, TokenType } from '@clerk/backend/internal';\nimport type {\n  CheckAuthorizationFromSessionClaims,\n  CheckAuthorizationParamsFromSessionClaims,\n  CheckAuthorizationParamsWithCustomPermissions,\n  CheckAuthorizationWithCustomPermissions,\n  OrganizationCustomPermissionKey,\n} from '@clerk/shared/types';\n\nimport { constants as nextConstants } from '../constants';\nimport { isNextFetcher } from './nextFetcher';\n\ntype AuthProtectOptions = {\n  /**\n   * The token type to check.\n   */\n  token?: AuthenticateRequestOptions['acceptsToken'];\n  /**\n   * The URL to redirect the user to if they are not authorized.\n   */\n  unauthorizedUrl?: string;\n  /**\n   * The URL to redirect the user to if they are not authenticated.\n   */\n  unauthenticatedUrl?: string;\n};\n\n/**\n * Throws a Nextjs notFound error if user is not authenticated or authorized.\n */\nexport interface AuthProtect {\n  /**\n   * @example\n   * auth.protect({ permission: 'org:admin:example1' });\n   * auth.protect({ role: 'admin' });\n   */\n  <P extends OrganizationCustomPermissionKey>(\n    params?: CheckAuthorizationParamsFromSessionClaims<P>,\n    options?: AuthProtectOptions,\n  ): Promise<SignedInAuthObject>;\n\n  /**\n   * @example\n   * auth.protect(has => has({ permission: 'org:admin:example1' }));\n   */\n  (\n    params?: (has: CheckAuthorizationFromSessionClaims) => boolean,\n    options?: AuthProtectOptions,\n  ): Promise<SignedInAuthObject>;\n\n  /**\n   * @example\n   * auth.protect({ token: 'session_token' });\n   */\n  <T extends TokenType>(\n    options?: AuthProtectOptions & { token: T },\n  ): Promise<InferAuthObjectFromToken<T, SignedInAuthObject, AuthenticatedMachineObject>>;\n\n  /**\n   * @example\n   * auth.protect({ token: ['session_token', 'm2m_token'] });\n   */\n  <T extends TokenType[]>(\n    options?: AuthProtectOptions & { token: T },\n  ): Promise<InferAuthObjectFromTokenArray<T, SignedInAuthObject, AuthenticatedMachineObject>>;\n\n  /**\n   * @example\n   * auth.protect({ token: 'any' });\n   */\n  (options?: AuthProtectOptions & { token: 'any' }): Promise<SignedInAuthObject | AuthenticatedMachineObject>;\n\n  /**\n   * @example\n   * auth.protect();\n   */\n  (options?: AuthProtectOptions): Promise<SignedInAuthObject>;\n}\n\nexport function createProtect(opts: {\n  request: Request;\n  authObject: AuthObject;\n  /**\n   * middleware and pages throw a notFound error if signed out\n   * but the middleware needs to throw an error it can catch\n   * use this callback to customise the behavior\n   */\n  notFound: () => never;\n  /**\n   * see {@link notFound} above\n   */\n  redirect: (url: string) => void;\n  /**\n   * For m2m requests, throws a 401 response\n   */\n  unauthorized: () => void;\n  /**\n   * protect() in middleware redirects to signInUrl if signed out\n   * protect() in pages throws a notFound error if signed out\n   * use this callback to customise the behavior\n   */\n  redirectToSignIn: RedirectFun<unknown>;\n}): AuthProtect {\n  const { redirectToSignIn, authObject, redirect, notFound, request, unauthorized } = opts;\n\n  return (async (...args: any[]) => {\n    const paramsOrFunction = getAuthorizationParams(args[0]);\n    const unauthenticatedUrl = (args[0]?.unauthenticatedUrl || args[1]?.unauthenticatedUrl) as string | undefined;\n    const unauthorizedUrl = (args[0]?.unauthorizedUrl || args[1]?.unauthorizedUrl) as string | undefined;\n    const requestedToken = args[0]?.token || args[1]?.token || TokenType.SessionToken;\n\n    const handleUnauthenticated = () => {\n      if (unauthenticatedUrl) {\n        return redirect(unauthenticatedUrl);\n      }\n      if (isPageRequest(request)) {\n        // TODO: Handle runtime values. What happens if runtime values are set in middleware and in ClerkProvider as well?\n        return redirectToSignIn();\n      }\n      if (isServerActionRequest(request)) {\n        return unauthorized();\n      }\n      return notFound();\n    };\n\n    const handleUnauthorized = () => {\n      // Return 401 for machine token contexts: either the auth object itself is a machine token,\n      // or the endpoint was configured to accept machine tokens but auth failed (e.g. middleware\n      // bypassed, so authObject fell back to a signed-out session object).\n      if (\n        authObject.tokenType !== TokenType.SessionToken ||\n        !isTokenTypeAccepted(TokenType.SessionToken, requestedToken)\n      ) {\n        return unauthorized();\n      }\n\n      if (unauthorizedUrl) {\n        return redirect(unauthorizedUrl);\n      }\n      return notFound();\n    };\n\n    if (!isTokenTypeAccepted(authObject.tokenType, requestedToken)) {\n      return handleUnauthorized();\n    }\n\n    if (authObject.tokenType !== TokenType.SessionToken) {\n      // For machine tokens, we only check if they're authenticated\n      // They don't have session status or organization permissions\n      if (!authObject.isAuthenticated) {\n        return handleUnauthorized();\n      }\n      return authObject;\n    }\n\n    /**\n     * Redirects the user back to the tasks URL if their session status is pending\n     */\n    if (authObject.sessionStatus === 'pending') {\n      return handleUnauthenticated();\n    }\n\n    /**\n     * User is not authenticated\n     */\n    if (!authObject.userId) {\n      return handleUnauthenticated();\n    }\n\n    /**\n     * User is authenticated\n     */\n    if (!paramsOrFunction) {\n      return authObject;\n    }\n\n    /**\n     * if a function is passed and returns false then throw not found\n     */\n    if (typeof paramsOrFunction === 'function') {\n      if (paramsOrFunction(authObject.has)) {\n        return authObject;\n      }\n      return handleUnauthorized();\n    }\n\n    /**\n     * Checking if user is authorized when permission or role is passed\n     */\n    if (authObject.has(paramsOrFunction)) {\n      return authObject;\n    }\n\n    return handleUnauthorized();\n  }) as AuthProtect;\n}\n\nconst getAuthorizationParams = (arg: any) => {\n  if (!arg) {\n    return undefined;\n  }\n\n  // Skip authorization check if the arg contains any of these options\n  if (arg.unauthenticatedUrl || arg.unauthorizedUrl || arg.token) {\n    return undefined;\n  }\n\n  // Skip if it's just a token-only object\n  if (Object.keys(arg).length === 1 && 'token' in arg) {\n    return undefined;\n  }\n\n  // Return the authorization params/function\n  return arg as\n    | CheckAuthorizationParamsWithCustomPermissions\n    | ((has: CheckAuthorizationWithCustomPermissions) => boolean);\n};\n\nconst isServerActionRequest = (req: Request) => {\n  return (\n    !!req.headers.get(nextConstants.Headers.NextUrl) &&\n    (req.headers.get(constants.Headers.Accept)?.includes('text/x-component') ||\n      req.headers.get(constants.Headers.ContentType)?.includes('multipart/form-data') ||\n      !!req.headers.get(nextConstants.Headers.NextAction))\n  );\n};\n\nconst isPageRequest = (req: Request): boolean => {\n  return (\n    req.headers.get(constants.Headers.SecFetchDest) === 'document' ||\n    req.headers.get(constants.Headers.SecFetchDest) === 'iframe' ||\n    req.headers.get(constants.Headers.Accept)?.includes('text/html') ||\n    isAppRouterInternalNavigation(req) ||\n    isPagesRouterInternalNavigation(req)\n  );\n};\n\nconst isAppRouterInternalNavigation = (req: Request) =>\n  (!!req.headers.get(nextConstants.Headers.NextUrl) && !isServerActionRequest(req)) || isPagePathAvailable();\n\nconst isPagePathAvailable = () => {\n  const __fetch = globalThis.fetch;\n\n  if (!isNextFetcher(__fetch)) {\n    return false;\n  }\n\n  const { page } = __fetch.__nextGetStaticStore().getStore() || {};\n\n  return Boolean(page);\n};\n\nconst isPagesRouterInternalNavigation = (req: Request) => !!req.headers.get(nextConstants.Headers.NextjsData);\n\n// /**\n//  * In case we want to handle router handlers and server actions differently in the future\n//  */\n// const isApiRouteRequest = (req: Request) => {\n//   return !isPageRequest(req) && !isServerActionRequest(req);\n// };\n"],"mappings":";AASA,SAAS,WAAW,qBAAqB,iBAAiB;AAS1D,SAAS,aAAa,qBAAqB;AAC3C,SAAS,qBAAqB;AAqEvB,SAAS,cAAc,MAuBd;AACd,QAAM,EAAE,kBAAkB,YAAY,UAAU,UAAU,SAAS,aAAa,IAAI;AAEpF,UAAQ,UAAU,SAAgB;AAlHpC;AAmHI,UAAM,mBAAmB,uBAAuB,KAAK,CAAC,CAAC;AACvD,UAAM,uBAAsB,UAAK,CAAC,MAAN,mBAAS,yBAAsB,UAAK,CAAC,MAAN,mBAAS;AACpE,UAAM,oBAAmB,UAAK,CAAC,MAAN,mBAAS,sBAAmB,UAAK,CAAC,MAAN,mBAAS;AAC9D,UAAM,mBAAiB,UAAK,CAAC,MAAN,mBAAS,YAAS,UAAK,CAAC,MAAN,mBAAS,UAAS,UAAU;AAErE,UAAM,wBAAwB,MAAM;AAClC,UAAI,oBAAoB;AACtB,eAAO,SAAS,kBAAkB;AAAA,MACpC;AACA,UAAI,cAAc,OAAO,GAAG;AAE1B,eAAO,iBAAiB;AAAA,MAC1B;AACA,UAAI,sBAAsB,OAAO,GAAG;AAClC,eAAO,aAAa;AAAA,MACtB;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,qBAAqB,MAAM;AAI/B,UACE,WAAW,cAAc,UAAU,gBACnC,CAAC,oBAAoB,UAAU,cAAc,cAAc,GAC3D;AACA,eAAO,aAAa;AAAA,MACtB;AAEA,UAAI,iBAAiB;AACnB,eAAO,SAAS,eAAe;AAAA,MACjC;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,QAAI,CAAC,oBAAoB,WAAW,WAAW,cAAc,GAAG;AAC9D,aAAO,mBAAmB;AAAA,IAC5B;AAEA,QAAI,WAAW,cAAc,UAAU,cAAc;AAGnD,UAAI,CAAC,WAAW,iBAAiB;AAC/B,eAAO,mBAAmB;AAAA,MAC5B;AACA,aAAO;AAAA,IACT;AAKA,QAAI,WAAW,kBAAkB,WAAW;AAC1C,aAAO,sBAAsB;AAAA,IAC/B;AAKA,QAAI,CAAC,WAAW,QAAQ;AACtB,aAAO,sBAAsB;AAAA,IAC/B;AAKA,QAAI,CAAC,kBAAkB;AACrB,aAAO;AAAA,IACT;AAKA,QAAI,OAAO,qBAAqB,YAAY;AAC1C,UAAI,iBAAiB,WAAW,GAAG,GAAG;AACpC,eAAO;AAAA,MACT;AACA,aAAO,mBAAmB;AAAA,IAC5B;AAKA,QAAI,WAAW,IAAI,gBAAgB,GAAG;AACpC,aAAO;AAAA,IACT;AAEA,WAAO,mBAAmB;AAAA,EAC5B;AACF;AAEA,MAAM,yBAAyB,CAAC,QAAa;AAC3C,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AAGA,MAAI,IAAI,sBAAsB,IAAI,mBAAmB,IAAI,OAAO;AAC9D,WAAO;AAAA,EACT;AAGA,MAAI,OAAO,KAAK,GAAG,EAAE,WAAW,KAAK,WAAW,KAAK;AACnD,WAAO;AAAA,EACT;AAGA,SAAO;AAGT;AAEA,MAAM,wBAAwB,CAAC,QAAiB;AAnOhD;AAoOE,SACE,CAAC,CAAC,IAAI,QAAQ,IAAI,cAAc,QAAQ,OAAO,QAC9C,SAAI,QAAQ,IAAI,UAAU,QAAQ,MAAM,MAAxC,mBAA2C,SAAS,0BACnD,SAAI,QAAQ,IAAI,UAAU,QAAQ,WAAW,MAA7C,mBAAgD,SAAS,2BACzD,CAAC,CAAC,IAAI,QAAQ,IAAI,cAAc,QAAQ,UAAU;AAExD;AAEA,MAAM,gBAAgB,CAAC,QAA0B;AA5OjD;AA6OE,SACE,IAAI,QAAQ,IAAI,UAAU,QAAQ,YAAY,MAAM,cACpD,IAAI,QAAQ,IAAI,UAAU,QAAQ,YAAY,MAAM,cACpD,SAAI,QAAQ,IAAI,UAAU,QAAQ,MAAM,MAAxC,mBAA2C,SAAS,iBACpD,8BAA8B,GAAG,KACjC,gCAAgC,GAAG;AAEvC;AAEA,MAAM,gCAAgC,CAAC,QACpC,CAAC,CAAC,IAAI,QAAQ,IAAI,cAAc,QAAQ,OAAO,KAAK,CAAC,sBAAsB,GAAG,KAAM,oBAAoB;AAE3G,MAAM,sBAAsB,MAAM;AAChC,QAAM,UAAU,WAAW;AAE3B,MAAI,CAAC,cAAc,OAAO,GAAG;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,KAAK,IAAI,QAAQ,qBAAqB,EAAE,SAAS,KAAK,CAAC;AAE/D,SAAO,QAAQ,IAAI;AACrB;AAEA,MAAM,kCAAkC,CAAC,QAAiB,CAAC,CAAC,IAAI,QAAQ,IAAI,cAAc,QAAQ,UAAU;","names":[]}
+{"version":3,"sources":["../../../src/server/protect.ts"],"sourcesContent":["import type { AuthObject } from '@clerk/backend';\nimport type {\n  AuthenticatedMachineObject,\n  AuthenticateRequestOptions,\n  InferAuthObjectFromToken,\n  InferAuthObjectFromTokenArray,\n  RedirectFun,\n  SignedInAuthObject,\n} from '@clerk/backend/internal';\nimport { constants, isTokenTypeAccepted, TokenType } from '@clerk/backend/internal';\nimport type {\n  CheckAuthorizationFromSessionClaims,\n  CheckAuthorizationParamsFromSessionClaims,\n  CheckAuthorizationParamsWithCustomPermissions,\n  CheckAuthorizationWithCustomPermissions,\n  OrganizationCustomPermissionKey,\n} from '@clerk/shared/types';\n\nimport { constants as nextConstants } from '../constants';\nimport { isNextFetcher } from './nextFetcher';\n\ntype AuthProtectOptions = {\n  /**\n   * The token type to check.\n   */\n  token?: AuthenticateRequestOptions['acceptsToken'];\n  /**\n   * The URL to redirect the user to if they are not authorized.\n   */\n  unauthorizedUrl?: string;\n  /**\n   * The URL to redirect the user to if they are not authenticated.\n   */\n  unauthenticatedUrl?: string;\n};\n\n/**\n * Throws a Nextjs notFound error if user is not authenticated or authorized.\n */\nexport interface AuthProtect {\n  /**\n   * @example\n   * auth.protect({ permission: 'org:admin:example1' });\n   * auth.protect({ role: 'admin' });\n   */\n  <P extends OrganizationCustomPermissionKey>(\n    params?: CheckAuthorizationParamsFromSessionClaims<P>,\n    options?: AuthProtectOptions,\n  ): Promise<SignedInAuthObject>;\n\n  /**\n   * @example\n   * auth.protect(has => has({ permission: 'org:admin:example1' }));\n   */\n  (\n    params?: (has: CheckAuthorizationFromSessionClaims) => boolean,\n    options?: AuthProtectOptions,\n  ): Promise<SignedInAuthObject>;\n\n  /**\n   * @example\n   * auth.protect({ token: 'session_token' });\n   */\n  <T extends TokenType>(\n    options?: AuthProtectOptions & { token: T },\n  ): Promise<InferAuthObjectFromToken<T, SignedInAuthObject, AuthenticatedMachineObject>>;\n\n  /**\n   * @example\n   * auth.protect({ token: ['session_token', 'm2m_token'] });\n   */\n  <T extends TokenType[]>(\n    options?: AuthProtectOptions & { token: T },\n  ): Promise<InferAuthObjectFromTokenArray<T, SignedInAuthObject, AuthenticatedMachineObject>>;\n\n  /**\n   * @example\n   * auth.protect({ token: 'any' });\n   */\n  (options?: AuthProtectOptions & { token: 'any' }): Promise<SignedInAuthObject | AuthenticatedMachineObject>;\n\n  /**\n   * @example\n   * auth.protect();\n   */\n  (options?: AuthProtectOptions): Promise<SignedInAuthObject>;\n}\n\nexport function createProtect(opts: {\n  request: Request;\n  authObject: AuthObject;\n  /**\n   * middleware and pages throw a notFound error if signed out\n   * but the middleware needs to throw an error it can catch\n   * use this callback to customise the behavior\n   */\n  notFound: () => never;\n  /**\n   * see {@link notFound} above\n   */\n  redirect: (url: string) => void;\n  /**\n   * For m2m requests, throws a 401 response\n   */\n  unauthorized: () => void;\n  /**\n   * protect() in middleware redirects to signInUrl if signed out\n   * protect() in pages throws a notFound error if signed out\n   * use this callback to customise the behavior\n   */\n  redirectToSignIn: RedirectFun<unknown>;\n}): AuthProtect {\n  const { redirectToSignIn, authObject, redirect, notFound, request, unauthorized } = opts;\n\n  return (async (...args: any[]) => {\n    const paramsOrFunction = getAuthorizationParams(args[0]);\n    const unauthenticatedUrl = (args[0]?.unauthenticatedUrl || args[1]?.unauthenticatedUrl) as string | undefined;\n    const unauthorizedUrl = (args[0]?.unauthorizedUrl || args[1]?.unauthorizedUrl) as string | undefined;\n    const requestedToken = args[0]?.token || args[1]?.token || TokenType.SessionToken;\n\n    const handleUnauthenticated = () => {\n      if (unauthenticatedUrl) {\n        return redirect(unauthenticatedUrl);\n      }\n      if (isPageRequest(request)) {\n        // TODO: Handle runtime values. What happens if runtime values are set in middleware and in ClerkProvider as well?\n        return redirectToSignIn();\n      }\n      if (isServerActionRequest(request)) {\n        return unauthorized();\n      }\n      return notFound();\n    };\n\n    const handleUnauthorized = () => {\n      // Return 401 for machine token contexts: either the auth object itself is a machine token,\n      // or the endpoint was configured to accept machine tokens but auth failed (e.g. middleware\n      // bypassed, so authObject fell back to a signed-out session object).\n      if (\n        authObject.tokenType !== TokenType.SessionToken ||\n        !isTokenTypeAccepted(TokenType.SessionToken, requestedToken)\n      ) {\n        return unauthorized();\n      }\n\n      if (unauthorizedUrl) {\n        return redirect(unauthorizedUrl);\n      }\n      return notFound();\n    };\n\n    if (!isTokenTypeAccepted(authObject.tokenType, requestedToken)) {\n      return handleUnauthorized();\n    }\n\n    if (authObject.tokenType !== TokenType.SessionToken) {\n      // For machine tokens, we only check if they're authenticated\n      // They don't have session status or organization permissions\n      if (!authObject.isAuthenticated) {\n        return handleUnauthorized();\n      }\n      return authObject;\n    }\n\n    /**\n     * Redirects the user back to the tasks URL if their session status is pending\n     */\n    if (authObject.sessionStatus === 'pending') {\n      return handleUnauthenticated();\n    }\n\n    /**\n     * User is not authenticated\n     */\n    if (!authObject.userId) {\n      return handleUnauthenticated();\n    }\n\n    /**\n     * User is authenticated\n     */\n    if (!paramsOrFunction) {\n      return authObject;\n    }\n\n    /**\n     * if a function is passed and returns false then throw not found\n     */\n    if (typeof paramsOrFunction === 'function') {\n      if (paramsOrFunction(authObject.has)) {\n        return authObject;\n      }\n      return handleUnauthorized();\n    }\n\n    /**\n     * Checking if user is authorized when permission or role is passed\n     */\n    if (authObject.has(paramsOrFunction)) {\n      return authObject;\n    }\n\n    return handleUnauthorized();\n  }) as AuthProtect;\n}\n\nconst AUTH_PARAM_KEYS = ['role', 'permission', 'feature', 'plan', 'reverification'] as const;\n\nconst getAuthorizationParams = (arg: any) => {\n  if (!arg) {\n    return undefined;\n  }\n\n  // Predicate form: always return the function unchanged.\n  if (typeof arg === 'function') {\n    return arg as (has: CheckAuthorizationWithCustomPermissions) => boolean;\n  }\n\n  // Pick only the known authorization keys so option keys (unauthorizedUrl,\n  // token, etc.) and unknown extras do not leak into has().\n  const authParams: Record<string, unknown> = {};\n  for (const key of AUTH_PARAM_KEYS) {\n    if (arg[key] !== undefined) {\n      authParams[key] = arg[key];\n    }\n  }\n\n  if (Object.keys(authParams).length === 0) {\n    return undefined;\n  }\n\n  return authParams as CheckAuthorizationParamsWithCustomPermissions;\n};\n\nconst isServerActionRequest = (req: Request) => {\n  return (\n    !!req.headers.get(nextConstants.Headers.NextUrl) &&\n    (req.headers.get(constants.Headers.Accept)?.includes('text/x-component') ||\n      req.headers.get(constants.Headers.ContentType)?.includes('multipart/form-data') ||\n      !!req.headers.get(nextConstants.Headers.NextAction))\n  );\n};\n\nconst isPageRequest = (req: Request): boolean => {\n  return (\n    req.headers.get(constants.Headers.SecFetchDest) === 'document' ||\n    req.headers.get(constants.Headers.SecFetchDest) === 'iframe' ||\n    req.headers.get(constants.Headers.Accept)?.includes('text/html') ||\n    isAppRouterInternalNavigation(req) ||\n    isPagesRouterInternalNavigation(req)\n  );\n};\n\nconst isAppRouterInternalNavigation = (req: Request) =>\n  (!!req.headers.get(nextConstants.Headers.NextUrl) && !isServerActionRequest(req)) || isPagePathAvailable();\n\nconst isPagePathAvailable = () => {\n  const __fetch = globalThis.fetch;\n\n  if (!isNextFetcher(__fetch)) {\n    return false;\n  }\n\n  const { page } = __fetch.__nextGetStaticStore().getStore() || {};\n\n  return Boolean(page);\n};\n\nconst isPagesRouterInternalNavigation = (req: Request) => !!req.headers.get(nextConstants.Headers.NextjsData);\n\n// /**\n//  * In case we want to handle router handlers and server actions differently in the future\n//  */\n// const isApiRouteRequest = (req: Request) => {\n//   return !isPageRequest(req) && !isServerActionRequest(req);\n// };\n"],"mappings":";AASA,SAAS,WAAW,qBAAqB,iBAAiB;AAS1D,SAAS,aAAa,qBAAqB;AAC3C,SAAS,qBAAqB;AAqEvB,SAAS,cAAc,MAuBd;AACd,QAAM,EAAE,kBAAkB,YAAY,UAAU,UAAU,SAAS,aAAa,IAAI;AAEpF,UAAQ,UAAU,SAAgB;AAlHpC;AAmHI,UAAM,mBAAmB,uBAAuB,KAAK,CAAC,CAAC;AACvD,UAAM,uBAAsB,UAAK,CAAC,MAAN,mBAAS,yBAAsB,UAAK,CAAC,MAAN,mBAAS;AACpE,UAAM,oBAAmB,UAAK,CAAC,MAAN,mBAAS,sBAAmB,UAAK,CAAC,MAAN,mBAAS;AAC9D,UAAM,mBAAiB,UAAK,CAAC,MAAN,mBAAS,YAAS,UAAK,CAAC,MAAN,mBAAS,UAAS,UAAU;AAErE,UAAM,wBAAwB,MAAM;AAClC,UAAI,oBAAoB;AACtB,eAAO,SAAS,kBAAkB;AAAA,MACpC;AACA,UAAI,cAAc,OAAO,GAAG;AAE1B,eAAO,iBAAiB;AAAA,MAC1B;AACA,UAAI,sBAAsB,OAAO,GAAG;AAClC,eAAO,aAAa;AAAA,MACtB;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,qBAAqB,MAAM;AAI/B,UACE,WAAW,cAAc,UAAU,gBACnC,CAAC,oBAAoB,UAAU,cAAc,cAAc,GAC3D;AACA,eAAO,aAAa;AAAA,MACtB;AAEA,UAAI,iBAAiB;AACnB,eAAO,SAAS,eAAe;AAAA,MACjC;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,QAAI,CAAC,oBAAoB,WAAW,WAAW,cAAc,GAAG;AAC9D,aAAO,mBAAmB;AAAA,IAC5B;AAEA,QAAI,WAAW,cAAc,UAAU,cAAc;AAGnD,UAAI,CAAC,WAAW,iBAAiB;AAC/B,eAAO,mBAAmB;AAAA,MAC5B;AACA,aAAO;AAAA,IACT;AAKA,QAAI,WAAW,kBAAkB,WAAW;AAC1C,aAAO,sBAAsB;AAAA,IAC/B;AAKA,QAAI,CAAC,WAAW,QAAQ;AACtB,aAAO,sBAAsB;AAAA,IAC/B;AAKA,QAAI,CAAC,kBAAkB;AACrB,aAAO;AAAA,IACT;AAKA,QAAI,OAAO,qBAAqB,YAAY;AAC1C,UAAI,iBAAiB,WAAW,GAAG,GAAG;AACpC,eAAO;AAAA,MACT;AACA,aAAO,mBAAmB;AAAA,IAC5B;AAKA,QAAI,WAAW,IAAI,gBAAgB,GAAG;AACpC,aAAO;AAAA,IACT;AAEA,WAAO,mBAAmB;AAAA,EAC5B;AACF;AAEA,MAAM,kBAAkB,CAAC,QAAQ,cAAc,WAAW,QAAQ,gBAAgB;AAElF,MAAM,yBAAyB,CAAC,QAAa;AAC3C,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AAGA,MAAI,OAAO,QAAQ,YAAY;AAC7B,WAAO;AAAA,EACT;AAIA,QAAM,aAAsC,CAAC;AAC7C,aAAW,OAAO,iBAAiB;AACjC,QAAI,IAAI,GAAG,MAAM,QAAW;AAC1B,iBAAW,GAAG,IAAI,IAAI,GAAG;AAAA,IAC3B;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,UAAU,EAAE,WAAW,GAAG;AACxC,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,MAAM,wBAAwB,CAAC,QAAiB;AA1OhD;AA2OE,SACE,CAAC,CAAC,IAAI,QAAQ,IAAI,cAAc,QAAQ,OAAO,QAC9C,SAAI,QAAQ,IAAI,UAAU,QAAQ,MAAM,MAAxC,mBAA2C,SAAS,0BACnD,SAAI,QAAQ,IAAI,UAAU,QAAQ,WAAW,MAA7C,mBAAgD,SAAS,2BACzD,CAAC,CAAC,IAAI,QAAQ,IAAI,cAAc,QAAQ,UAAU;AAExD;AAEA,MAAM,gBAAgB,CAAC,QAA0B;AAnPjD;AAoPE,SACE,IAAI,QAAQ,IAAI,UAAU,QAAQ,YAAY,MAAM,cACpD,IAAI,QAAQ,IAAI,UAAU,QAAQ,YAAY,MAAM,cACpD,SAAI,QAAQ,IAAI,UAAU,QAAQ,MAAM,MAAxC,mBAA2C,SAAS,iBACpD,8BAA8B,GAAG,KACjC,gCAAgC,GAAG;AAEvC;AAEA,MAAM,gCAAgC,CAAC,QACpC,CAAC,CAAC,IAAI,QAAQ,IAAI,cAAc,QAAQ,OAAO,KAAK,CAAC,sBAAsB,GAAG,KAAM,oBAAoB;AAE3G,MAAM,sBAAsB,MAAM;AAChC,QAAM,UAAU,WAAW;AAE3B,MAAI,CAAC,cAAc,OAAO,GAAG;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,KAAK,IAAI,QAAQ,qBAAqB,EAAE,SAAS,KAAK,CAAC;AAE/D,SAAO,QAAQ,IAAI;AACrB;AAEA,MAAM,kCAAkC,CAAC,QAAiB,CAAC,CAAC,IAAI,QAAQ,IAAI,cAAc,QAAQ,UAAU;","names":[]}

package/dist/esm/utils/debugLogger.js

@@ -57,7 +57,7 @@ function debugLogHeader(name) {
   return `[clerk debug start: ${name}]`;
 }
 function debugLogFooter(name) {
-  return `[clerk debug end: ${name}] (@clerk/nextjs=${"7.2.4-snapshot.v20260421194054"},next=${nextPkg.version},timestamp=${Math.round((/* @__PURE__ */ new Date()).getTime() / 1e3)})`;
+  return `[clerk debug end: ${name}] (@clerk/nextjs=${"7.2.4"},next=${nextPkg.version},timestamp=${Math.round((/* @__PURE__ */ new Date()).getTime() / 1e3)})`;
 }
 function truncate(str, maxLength) {
   const encoder = new TextEncoder();

package/dist/esm/utils/debugLogger.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/debugLogger.ts"],"sourcesContent":["// TODO: Replace with a more sophisticated logging solution\n\nimport nextPkg from 'next/package.json';\n\nimport { logFormatter } from './logFormatter';\n\nexport type Log = string | Record<string, unknown>;\nexport type LogEntry = Log | Log[];\nexport type Logger<L = Log> = {\n  commit: () => void;\n  debug: (...args: Array<L | (() => L)>) => void;\n  enable: () => void;\n};\nexport type LoggerNoCommit<L = Logger> = Omit<L, 'commit'>;\n\nexport const createDebugLogger = (name: string, formatter: (val: LogEntry) => string) => (): Logger => {\n  const entries: LogEntry[] = [];\n  let isEnabled = false;\n\n  return {\n    enable: () => {\n      isEnabled = true;\n    },\n    debug: (...args) => {\n      if (isEnabled) {\n        entries.push(args.map(arg => (typeof arg === 'function' ? arg() : arg)));\n      }\n    },\n    commit: () => {\n      if (isEnabled) {\n        console.log(debugLogHeader(name));\n\n        /**\n         * We buffer each collected log entry so we can format them and log them all at once.\n         * Individual console.log calls are used to ensure we don't hit platform-specific log limits (Vercel and Netlify are 4kb).\n         */\n        for (const log of entries) {\n          let output = formatter(log);\n\n          output = output\n            .split('\\n')\n            .map(l => `  ${l}`)\n            .join('\\n');\n\n          // Vercel errors if the output is > 4kb, so we truncate it\n          if (process.env.VERCEL) {\n            output = truncate(output, 4096);\n          }\n\n          console.log(output);\n        }\n\n        console.log(debugLogFooter(name));\n      }\n    },\n  };\n};\n\ntype WithLogger = <L extends Logger, H extends (...args: any[]) => any>(\n  loggerFactoryOrName: string | (() => L),\n  handlerCtor: (logger: LoggerNoCommit<L>) => H,\n) => H;\n\nexport const withLogger: WithLogger = (loggerFactoryOrName, handlerCtor) => {\n  return ((...args: any) => {\n    const factory =\n      typeof loggerFactoryOrName === 'string'\n        ? createDebugLogger(loggerFactoryOrName, logFormatter)\n        : loggerFactoryOrName;\n\n    const logger = factory();\n    const handler = handlerCtor(logger as any);\n\n    try {\n      const res = handler(...args);\n      if (typeof res === 'object' && 'then' in res && typeof res.then === 'function') {\n        return res\n          .then((val: any) => {\n            logger.commit();\n            return val;\n          })\n          .catch((err: any) => {\n            logger.commit();\n            throw err;\n          });\n      }\n      // handle sync methods\n      logger.commit();\n      return res;\n    } catch (err: any) {\n      logger.commit();\n      throw err;\n    }\n  }) as ReturnType<typeof handlerCtor>;\n};\n\nfunction debugLogHeader(name: string) {\n  return `[clerk debug start: ${name}]`;\n}\n\nfunction debugLogFooter(name: string) {\n  return `[clerk debug end: ${name}] (@clerk/nextjs=${PACKAGE_VERSION},next=${nextPkg.version},timestamp=${Math.round(new Date().getTime() / 1_000)})`;\n}\n\n// ref: https://stackoverflow.com/questions/57769465/javascript-truncate-text-by-bytes-length\nfunction truncate(str: string, maxLength: number) {\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder('utf-8');\n\n  const encodedString = encoder.encode(str);\n  const truncatedString = encodedString.slice(0, maxLength);\n\n  // return the truncated string, removing any replacement characters that result from partially truncated characters\n  return decoder.decode(truncatedString).replace(/\\uFFFD/g, '');\n}\n"],"mappings":";AAEA,OAAO,aAAa;AAEpB,SAAS,oBAAoB;AAWtB,MAAM,oBAAoB,CAAC,MAAc,cAAyC,MAAc;AACrG,QAAM,UAAsB,CAAC;AAC7B,MAAI,YAAY;AAEhB,SAAO;AAAA,IACL,QAAQ,MAAM;AACZ,kBAAY;AAAA,IACd;AAAA,IACA,OAAO,IAAI,SAAS;AAClB,UAAI,WAAW;AACb,gBAAQ,KAAK,KAAK,IAAI,SAAQ,OAAO,QAAQ,aAAa,IAAI,IAAI,GAAI,CAAC;AAAA,MACzE;AAAA,IACF;AAAA,IACA,QAAQ,MAAM;AACZ,UAAI,WAAW;AACb,gBAAQ,IAAI,eAAe,IAAI,CAAC;AAMhC,mBAAW,OAAO,SAAS;AACzB,cAAI,SAAS,UAAU,GAAG;AAE1B,mBAAS,OACN,MAAM,IAAI,EACV,IAAI,OAAK,KAAK,CAAC,EAAE,EACjB,KAAK,IAAI;AAGZ,cAAI,QAAQ,IAAI,QAAQ;AACtB,qBAAS,SAAS,QAAQ,IAAI;AAAA,UAChC;AAEA,kBAAQ,IAAI,MAAM;AAAA,QACpB;AAEA,gBAAQ,IAAI,eAAe,IAAI,CAAC;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAOO,MAAM,aAAyB,CAAC,qBAAqB,gBAAgB;AAC1E,UAAQ,IAAI,SAAc;AACxB,UAAM,UACJ,OAAO,wBAAwB,WAC3B,kBAAkB,qBAAqB,YAAY,IACnD;AAEN,UAAM,SAAS,QAAQ;AACvB,UAAM,UAAU,YAAY,MAAa;AAEzC,QAAI;AACF,YAAM,MAAM,QAAQ,GAAG,IAAI;AAC3B,UAAI,OAAO,QAAQ,YAAY,UAAU,OAAO,OAAO,IAAI,SAAS,YAAY;AAC9E,eAAO,IACJ,KAAK,CAAC,QAAa;AAClB,iBAAO,OAAO;AACd,iBAAO;AAAA,QACT,CAAC,EACA,MAAM,CAAC,QAAa;AACnB,iBAAO,OAAO;AACd,gBAAM;AAAA,QACR,CAAC;AAAA,MACL;AAEA,aAAO,OAAO;AACd,aAAO;AAAA,IACT,SAAS,KAAU;AACjB,aAAO,OAAO;AACd,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO,uBAAuB,IAAI;AACpC;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO,qBAAqB,IAAI,oBAAoB,gCAAe,SAAS,QAAQ,OAAO,cAAc,KAAK,OAAM,oBAAI,KAAK,GAAE,QAAQ,IAAI,GAAK,CAAC;AACnJ;AAGA,SAAS,SAAS,KAAa,WAAmB;AAChD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY,OAAO;AAEvC,QAAM,gBAAgB,QAAQ,OAAO,GAAG;AACxC,QAAM,kBAAkB,cAAc,MAAM,GAAG,SAAS;AAGxD,SAAO,QAAQ,OAAO,eAAe,EAAE,QAAQ,WAAW,EAAE;AAC9D;","names":[]}
+{"version":3,"sources":["../../../src/utils/debugLogger.ts"],"sourcesContent":["// TODO: Replace with a more sophisticated logging solution\n\nimport nextPkg from 'next/package.json';\n\nimport { logFormatter } from './logFormatter';\n\nexport type Log = string | Record<string, unknown>;\nexport type LogEntry = Log | Log[];\nexport type Logger<L = Log> = {\n  commit: () => void;\n  debug: (...args: Array<L | (() => L)>) => void;\n  enable: () => void;\n};\nexport type LoggerNoCommit<L = Logger> = Omit<L, 'commit'>;\n\nexport const createDebugLogger = (name: string, formatter: (val: LogEntry) => string) => (): Logger => {\n  const entries: LogEntry[] = [];\n  let isEnabled = false;\n\n  return {\n    enable: () => {\n      isEnabled = true;\n    },\n    debug: (...args) => {\n      if (isEnabled) {\n        entries.push(args.map(arg => (typeof arg === 'function' ? arg() : arg)));\n      }\n    },\n    commit: () => {\n      if (isEnabled) {\n        console.log(debugLogHeader(name));\n\n        /**\n         * We buffer each collected log entry so we can format them and log them all at once.\n         * Individual console.log calls are used to ensure we don't hit platform-specific log limits (Vercel and Netlify are 4kb).\n         */\n        for (const log of entries) {\n          let output = formatter(log);\n\n          output = output\n            .split('\\n')\n            .map(l => `  ${l}`)\n            .join('\\n');\n\n          // Vercel errors if the output is > 4kb, so we truncate it\n          if (process.env.VERCEL) {\n            output = truncate(output, 4096);\n          }\n\n          console.log(output);\n        }\n\n        console.log(debugLogFooter(name));\n      }\n    },\n  };\n};\n\ntype WithLogger = <L extends Logger, H extends (...args: any[]) => any>(\n  loggerFactoryOrName: string | (() => L),\n  handlerCtor: (logger: LoggerNoCommit<L>) => H,\n) => H;\n\nexport const withLogger: WithLogger = (loggerFactoryOrName, handlerCtor) => {\n  return ((...args: any) => {\n    const factory =\n      typeof loggerFactoryOrName === 'string'\n        ? createDebugLogger(loggerFactoryOrName, logFormatter)\n        : loggerFactoryOrName;\n\n    const logger = factory();\n    const handler = handlerCtor(logger as any);\n\n    try {\n      const res = handler(...args);\n      if (typeof res === 'object' && 'then' in res && typeof res.then === 'function') {\n        return res\n          .then((val: any) => {\n            logger.commit();\n            return val;\n          })\n          .catch((err: any) => {\n            logger.commit();\n            throw err;\n          });\n      }\n      // handle sync methods\n      logger.commit();\n      return res;\n    } catch (err: any) {\n      logger.commit();\n      throw err;\n    }\n  }) as ReturnType<typeof handlerCtor>;\n};\n\nfunction debugLogHeader(name: string) {\n  return `[clerk debug start: ${name}]`;\n}\n\nfunction debugLogFooter(name: string) {\n  return `[clerk debug end: ${name}] (@clerk/nextjs=${PACKAGE_VERSION},next=${nextPkg.version},timestamp=${Math.round(new Date().getTime() / 1_000)})`;\n}\n\n// ref: https://stackoverflow.com/questions/57769465/javascript-truncate-text-by-bytes-length\nfunction truncate(str: string, maxLength: number) {\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder('utf-8');\n\n  const encodedString = encoder.encode(str);\n  const truncatedString = encodedString.slice(0, maxLength);\n\n  // return the truncated string, removing any replacement characters that result from partially truncated characters\n  return decoder.decode(truncatedString).replace(/\\uFFFD/g, '');\n}\n"],"mappings":";AAEA,OAAO,aAAa;AAEpB,SAAS,oBAAoB;AAWtB,MAAM,oBAAoB,CAAC,MAAc,cAAyC,MAAc;AACrG,QAAM,UAAsB,CAAC;AAC7B,MAAI,YAAY;AAEhB,SAAO;AAAA,IACL,QAAQ,MAAM;AACZ,kBAAY;AAAA,IACd;AAAA,IACA,OAAO,IAAI,SAAS;AAClB,UAAI,WAAW;AACb,gBAAQ,KAAK,KAAK,IAAI,SAAQ,OAAO,QAAQ,aAAa,IAAI,IAAI,GAAI,CAAC;AAAA,MACzE;AAAA,IACF;AAAA,IACA,QAAQ,MAAM;AACZ,UAAI,WAAW;AACb,gBAAQ,IAAI,eAAe,IAAI,CAAC;AAMhC,mBAAW,OAAO,SAAS;AACzB,cAAI,SAAS,UAAU,GAAG;AAE1B,mBAAS,OACN,MAAM,IAAI,EACV,IAAI,OAAK,KAAK,CAAC,EAAE,EACjB,KAAK,IAAI;AAGZ,cAAI,QAAQ,IAAI,QAAQ;AACtB,qBAAS,SAAS,QAAQ,IAAI;AAAA,UAChC;AAEA,kBAAQ,IAAI,MAAM;AAAA,QACpB;AAEA,gBAAQ,IAAI,eAAe,IAAI,CAAC;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAOO,MAAM,aAAyB,CAAC,qBAAqB,gBAAgB;AAC1E,UAAQ,IAAI,SAAc;AACxB,UAAM,UACJ,OAAO,wBAAwB,WAC3B,kBAAkB,qBAAqB,YAAY,IACnD;AAEN,UAAM,SAAS,QAAQ;AACvB,UAAM,UAAU,YAAY,MAAa;AAEzC,QAAI;AACF,YAAM,MAAM,QAAQ,GAAG,IAAI;AAC3B,UAAI,OAAO,QAAQ,YAAY,UAAU,OAAO,OAAO,IAAI,SAAS,YAAY;AAC9E,eAAO,IACJ,KAAK,CAAC,QAAa;AAClB,iBAAO,OAAO;AACd,iBAAO;AAAA,QACT,CAAC,EACA,MAAM,CAAC,QAAa;AACnB,iBAAO,OAAO;AACd,gBAAM;AAAA,QACR,CAAC;AAAA,MACL;AAEA,aAAO,OAAO;AACd,aAAO;AAAA,IACT,SAAS,KAAU;AACjB,aAAO,OAAO;AACd,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO,uBAAuB,IAAI;AACpC;AAEA,SAAS,eAAe,MAAc;AACpC,SAAO,qBAAqB,IAAI,oBAAoB,OAAe,SAAS,QAAQ,OAAO,cAAc,KAAK,OAAM,oBAAI,KAAK,GAAE,QAAQ,IAAI,GAAK,CAAC;AACnJ;AAGA,SAAS,SAAS,KAAa,WAAmB;AAChD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY,OAAO;AAEvC,QAAM,gBAAgB,QAAQ,OAAO,GAAG;AACxC,QAAM,kBAAkB,cAAc,MAAM,GAAG,SAAS;AAGxD,SAAO,QAAQ,OAAO,eAAe,EAAE,QAAQ,WAAW,EAAE;AAC9D;","names":[]}

package/dist/esm/utils/mergeNextClerkPropsWithEnv.js

@@ -1,5 +1,4 @@
 import "../chunk-BUSYA2B4.js";
-import { getAutoProxyUrlFromEnvironment } from "@clerk/shared/proxy";
 import { isTruthy } from "@clerk/shared/underscore";
 import { SDK_METADATA } from "../server/constants";
 function getPrefetchUIFromEnvAndProps(propsPrefetchUI) {
@@ -13,23 +12,16 @@ function getPrefetchUIFromEnvAndProps(propsPrefetchUI) {
 }
 const mergeNextClerkPropsWithEnv = (props) => {
   var _a;
-  const publishableKey = props.publishableKey || process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || "";
-  const proxyUrl = props.proxyUrl || process.env.NEXT_PUBLIC_CLERK_PROXY_URL || "";
-  const domain = props.domain || process.env.NEXT_PUBLIC_CLERK_DOMAIN || "";
   return {
     ...props,
-    publishableKey,
+    publishableKey: props.publishableKey || process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || "",
     __internal_clerkJSUrl: props.__internal_clerkJSUrl || process.env.NEXT_PUBLIC_CLERK_JS_URL,
     __internal_clerkJSVersion: props.__internal_clerkJSVersion || process.env.NEXT_PUBLIC_CLERK_JS_VERSION,
     __internal_clerkUIUrl: props.__internal_clerkUIUrl || process.env.NEXT_PUBLIC_CLERK_UI_URL,
     __internal_clerkUIVersion: props.__internal_clerkUIVersion || process.env.NEXT_PUBLIC_CLERK_UI_VERSION,
     prefetchUI: getPrefetchUIFromEnvAndProps(props.prefetchUI),
-    proxyUrl: proxyUrl || getAutoProxyUrlFromEnvironment({
-      hasDomain: !!domain,
-      hasProxyUrl: !!proxyUrl,
-      publishableKey
-    }),
-    domain,
+    proxyUrl: props.proxyUrl || process.env.NEXT_PUBLIC_CLERK_PROXY_URL || "",
+    domain: props.domain || process.env.NEXT_PUBLIC_CLERK_DOMAIN || "",
     isSatellite: props.isSatellite || isTruthy(process.env.NEXT_PUBLIC_CLERK_IS_SATELLITE),
     signInUrl: props.signInUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_URL || "",
     signUpUrl: props.signUpUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_URL || "",

package/dist/esm/utils/mergeNextClerkPropsWithEnv.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/mergeNextClerkPropsWithEnv.ts"],"sourcesContent":["import type { InternalClerkScriptProps } from '@clerk/react/internal';\nimport { getAutoProxyUrlFromEnvironment } from '@clerk/shared/proxy';\nimport { isTruthy } from '@clerk/shared/underscore';\n\nimport { SDK_METADATA } from '../server/constants';\nimport type { NextClerkProviderProps } from '../types';\n\nfunction getPrefetchUIFromEnvAndProps(propsPrefetchUI: NextClerkProviderProps['prefetchUI']): boolean | undefined {\n  // Props take precedence\n  if (propsPrefetchUI === false) {\n    return false;\n  }\n\n  // Check env var\n  if (process.env.NEXT_PUBLIC_CLERK_PREFETCH_UI === 'false') {\n    return false;\n  }\n\n  return undefined;\n}\n\n// @ts-ignore - https://github.com/microsoft/TypeScript/issues/47663\nexport const mergeNextClerkPropsWithEnv = (\n  props: Omit<NextClerkProviderProps, 'children'> & InternalClerkScriptProps,\n): any => {\n  const publishableKey = props.publishableKey || process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || '';\n  const proxyUrl = props.proxyUrl || process.env.NEXT_PUBLIC_CLERK_PROXY_URL || '';\n  const domain = props.domain || process.env.NEXT_PUBLIC_CLERK_DOMAIN || '';\n\n  return {\n    ...props,\n    publishableKey,\n    __internal_clerkJSUrl: props.__internal_clerkJSUrl || process.env.NEXT_PUBLIC_CLERK_JS_URL,\n    __internal_clerkJSVersion: props.__internal_clerkJSVersion || process.env.NEXT_PUBLIC_CLERK_JS_VERSION,\n    __internal_clerkUIUrl: props.__internal_clerkUIUrl || process.env.NEXT_PUBLIC_CLERK_UI_URL,\n    __internal_clerkUIVersion: props.__internal_clerkUIVersion || process.env.NEXT_PUBLIC_CLERK_UI_VERSION,\n    prefetchUI: getPrefetchUIFromEnvAndProps(props.prefetchUI),\n    proxyUrl:\n      proxyUrl ||\n      getAutoProxyUrlFromEnvironment({\n        hasDomain: !!domain,\n        hasProxyUrl: !!proxyUrl,\n        publishableKey,\n      }),\n    domain,\n    isSatellite: props.isSatellite || isTruthy(process.env.NEXT_PUBLIC_CLERK_IS_SATELLITE),\n    signInUrl: props.signInUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_URL || '',\n    signUpUrl: props.signUpUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_URL || '',\n    signInForceRedirectUrl:\n      props.signInForceRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_FORCE_REDIRECT_URL || '',\n    signUpForceRedirectUrl:\n      props.signUpForceRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_FORCE_REDIRECT_URL || '',\n    signInFallbackRedirectUrl:\n      props.signInFallbackRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_FALLBACK_REDIRECT_URL || '',\n    signUpFallbackRedirectUrl:\n      props.signUpFallbackRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_FALLBACK_REDIRECT_URL || '',\n    newSubscriptionRedirectUrl:\n      props.newSubscriptionRedirectUrl || process.env.NEXT_PUBLIC_CLERK_CHECKOUT_CONTINUE_URL || '',\n    telemetry: props.telemetry ?? {\n      disabled: isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DISABLED),\n      debug: isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DEBUG),\n    },\n    sdkMetadata: SDK_METADATA,\n    unsafe_disableDevelopmentModeConsoleWarning: isTruthy(\n      process.env.NEXT_PUBLIC_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING,\n    ),\n  };\n};\n"],"mappings":";AACA,SAAS,sCAAsC;AAC/C,SAAS,gBAAgB;AAEzB,SAAS,oBAAoB;AAG7B,SAAS,6BAA6B,iBAA4E;AAEhH,MAAI,oBAAoB,OAAO;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,QAAQ,IAAI,kCAAkC,SAAS;AACzD,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAGO,MAAM,6BAA6B,CACxC,UACQ;AAxBV;AAyBE,QAAM,iBAAiB,MAAM,kBAAkB,QAAQ,IAAI,qCAAqC;AAChG,QAAM,WAAW,MAAM,YAAY,QAAQ,IAAI,+BAA+B;AAC9E,QAAM,SAAS,MAAM,UAAU,QAAQ,IAAI,4BAA4B;AAEvE,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,uBAAuB,MAAM,yBAAyB,QAAQ,IAAI;AAAA,IAClE,2BAA2B,MAAM,6BAA6B,QAAQ,IAAI;AAAA,IAC1E,uBAAuB,MAAM,yBAAyB,QAAQ,IAAI;AAAA,IAClE,2BAA2B,MAAM,6BAA6B,QAAQ,IAAI;AAAA,IAC1E,YAAY,6BAA6B,MAAM,UAAU;AAAA,IACzD,UACE,YACA,+BAA+B;AAAA,MAC7B,WAAW,CAAC,CAAC;AAAA,MACb,aAAa,CAAC,CAAC;AAAA,MACf;AAAA,IACF,CAAC;AAAA,IACH;AAAA,IACA,aAAa,MAAM,eAAe,SAAS,QAAQ,IAAI,8BAA8B;AAAA,IACrF,WAAW,MAAM,aAAa,QAAQ,IAAI,iCAAiC;AAAA,IAC3E,WAAW,MAAM,aAAa,QAAQ,IAAI,iCAAiC;AAAA,IAC3E,wBACE,MAAM,0BAA0B,QAAQ,IAAI,gDAAgD;AAAA,IAC9F,wBACE,MAAM,0BAA0B,QAAQ,IAAI,gDAAgD;AAAA,IAC9F,2BACE,MAAM,6BAA6B,QAAQ,IAAI,mDAAmD;AAAA,IACpG,2BACE,MAAM,6BAA6B,QAAQ,IAAI,mDAAmD;AAAA,IACpG,4BACE,MAAM,8BAA8B,QAAQ,IAAI,2CAA2C;AAAA,IAC7F,YAAW,WAAM,cAAN,YAAmB;AAAA,MAC5B,UAAU,SAAS,QAAQ,IAAI,oCAAoC;AAAA,MACnE,OAAO,SAAS,QAAQ,IAAI,iCAAiC;AAAA,IAC/D;AAAA,IACA,aAAa;AAAA,IACb,6CAA6C;AAAA,MAC3C,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/utils/mergeNextClerkPropsWithEnv.ts"],"sourcesContent":["import type { InternalClerkScriptProps } from '@clerk/react/internal';\nimport { isTruthy } from '@clerk/shared/underscore';\n\nimport { SDK_METADATA } from '../server/constants';\nimport type { NextClerkProviderProps } from '../types';\n\nfunction getPrefetchUIFromEnvAndProps(propsPrefetchUI: NextClerkProviderProps['prefetchUI']): boolean | undefined {\n  // Props take precedence\n  if (propsPrefetchUI === false) {\n    return false;\n  }\n\n  // Check env var\n  if (process.env.NEXT_PUBLIC_CLERK_PREFETCH_UI === 'false') {\n    return false;\n  }\n\n  return undefined;\n}\n\n// @ts-ignore - https://github.com/microsoft/TypeScript/issues/47663\nexport const mergeNextClerkPropsWithEnv = (\n  props: Omit<NextClerkProviderProps, 'children'> & InternalClerkScriptProps,\n): any => {\n  return {\n    ...props,\n    publishableKey: props.publishableKey || process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY || '',\n    __internal_clerkJSUrl: props.__internal_clerkJSUrl || process.env.NEXT_PUBLIC_CLERK_JS_URL,\n    __internal_clerkJSVersion: props.__internal_clerkJSVersion || process.env.NEXT_PUBLIC_CLERK_JS_VERSION,\n    __internal_clerkUIUrl: props.__internal_clerkUIUrl || process.env.NEXT_PUBLIC_CLERK_UI_URL,\n    __internal_clerkUIVersion: props.__internal_clerkUIVersion || process.env.NEXT_PUBLIC_CLERK_UI_VERSION,\n    prefetchUI: getPrefetchUIFromEnvAndProps(props.prefetchUI),\n    proxyUrl: props.proxyUrl || process.env.NEXT_PUBLIC_CLERK_PROXY_URL || '',\n    domain: props.domain || process.env.NEXT_PUBLIC_CLERK_DOMAIN || '',\n    isSatellite: props.isSatellite || isTruthy(process.env.NEXT_PUBLIC_CLERK_IS_SATELLITE),\n    signInUrl: props.signInUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_URL || '',\n    signUpUrl: props.signUpUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_URL || '',\n    signInForceRedirectUrl:\n      props.signInForceRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_FORCE_REDIRECT_URL || '',\n    signUpForceRedirectUrl:\n      props.signUpForceRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_FORCE_REDIRECT_URL || '',\n    signInFallbackRedirectUrl:\n      props.signInFallbackRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_IN_FALLBACK_REDIRECT_URL || '',\n    signUpFallbackRedirectUrl:\n      props.signUpFallbackRedirectUrl || process.env.NEXT_PUBLIC_CLERK_SIGN_UP_FALLBACK_REDIRECT_URL || '',\n    newSubscriptionRedirectUrl:\n      props.newSubscriptionRedirectUrl || process.env.NEXT_PUBLIC_CLERK_CHECKOUT_CONTINUE_URL || '',\n    telemetry: props.telemetry ?? {\n      disabled: isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DISABLED),\n      debug: isTruthy(process.env.NEXT_PUBLIC_CLERK_TELEMETRY_DEBUG),\n    },\n    sdkMetadata: SDK_METADATA,\n    unsafe_disableDevelopmentModeConsoleWarning: isTruthy(\n      process.env.NEXT_PUBLIC_CLERK_UNSAFE_DISABLE_DEVELOPMENT_MODE_CONSOLE_WARNING,\n    ),\n  };\n};\n"],"mappings":";AACA,SAAS,gBAAgB;AAEzB,SAAS,oBAAoB;AAG7B,SAAS,6BAA6B,iBAA4E;AAEhH,MAAI,oBAAoB,OAAO;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,QAAQ,IAAI,kCAAkC,SAAS;AACzD,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAGO,MAAM,6BAA6B,CACxC,UACQ;AAvBV;AAwBE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,gBAAgB,MAAM,kBAAkB,QAAQ,IAAI,qCAAqC;AAAA,IACzF,uBAAuB,MAAM,yBAAyB,QAAQ,IAAI;AAAA,IAClE,2BAA2B,MAAM,6BAA6B,QAAQ,IAAI;AAAA,IAC1E,uBAAuB,MAAM,yBAAyB,QAAQ,IAAI;AAAA,IAClE,2BAA2B,MAAM,6BAA6B,QAAQ,IAAI;AAAA,IAC1E,YAAY,6BAA6B,MAAM,UAAU;AAAA,IACzD,UAAU,MAAM,YAAY,QAAQ,IAAI,+BAA+B;AAAA,IACvE,QAAQ,MAAM,UAAU,QAAQ,IAAI,4BAA4B;AAAA,IAChE,aAAa,MAAM,eAAe,SAAS,QAAQ,IAAI,8BAA8B;AAAA,IACrF,WAAW,MAAM,aAAa,QAAQ,IAAI,iCAAiC;AAAA,IAC3E,WAAW,MAAM,aAAa,QAAQ,IAAI,iCAAiC;AAAA,IAC3E,wBACE,MAAM,0BAA0B,QAAQ,IAAI,gDAAgD;AAAA,IAC9F,wBACE,MAAM,0BAA0B,QAAQ,IAAI,gDAAgD;AAAA,IAC9F,2BACE,MAAM,6BAA6B,QAAQ,IAAI,mDAAmD;AAAA,IACpG,2BACE,MAAM,6BAA6B,QAAQ,IAAI,mDAAmD;AAAA,IACpG,4BACE,MAAM,8BAA8B,QAAQ,IAAI,2CAA2C;AAAA,IAC7F,YAAW,WAAM,cAAN,YAAmB;AAAA,MAC5B,UAAU,SAAS,QAAQ,IAAI,oCAAoC;AAAA,MACnE,OAAO,SAAS,QAAQ,IAAI,iCAAiC;AAAA,IAC/D;AAAA,IACA,aAAa;AAAA,IACb,6CAA6C;AAAA,MAC3C,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AACF;","names":[]}

package/dist/types/index.d.ts

@@ -17,4 +17,17 @@ export { getToken } from '@clerk/shared/getToken';
 import type { ServerComponentsServerModuleTypes } from './components.server';
 export declare const ClerkProvider: ServerComponentsServerModuleTypes["ClerkProvider"];
 export declare const Show: ServerComponentsServerModuleTypes["Show"];
+/**
+ * `auth` is not available from this import path.
+ *
+ * **To fix this error:**
+ * ```diff
+ * - import { auth } from '@clerk/nextjs'
+ * + import { auth } from '@clerk/nextjs/server'
+ * ```
+ *
+ * The `auth` function is only available in server-side contexts:
+ * API Routes, Server Components, Server Actions, and Middleware.
+ */
+export declare const auth: never;
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACZ,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,qCAAqC,CAAC;AAE7C;;;GAGG;AACH,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,MAAM,EACN,YAAY,EACZ,wBAAwB,EACxB,aAAa,EACb,MAAM,EACN,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,EACX,QAAQ,GACT,MAAM,gCAAgC,CAAC;AAExC;;;GAGG;AACH,OAAO,EACL,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,cAAc,EACd,SAAS,EACT,SAAS,EACT,WAAW,EACX,OAAO,GACR,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAYlD,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAE7E,eAAO,MAAM,aAAa,EAAqC,iCAAiC,CAAC,eAAe,CAAC,CAAC;AAClH,eAAO,MAAM,IAAI,EAA4B,iCAAiC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACZ,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,qCAAqC,CAAC;AAE7C;;;GAGG;AACH,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,MAAM,EACN,YAAY,EACZ,wBAAwB,EACxB,aAAa,EACb,MAAM,EACN,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,EACX,QAAQ,GACT,MAAM,gCAAgC,CAAC;AAExC;;;GAGG;AACH,OAAO,EACL,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,cAAc,EACd,SAAS,EACT,SAAS,EACT,WAAW,EACX,OAAO,GACR,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAYlD,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAE7E,eAAO,MAAM,aAAa,EAAqC,iCAAiC,CAAC,eAAe,CAAC,CAAC;AAClH,eAAO,MAAM,IAAI,EAA4B,iCAAiC,CAAC,MAAM,CAAC,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC"}

package/dist/types/server/clerkMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clerkMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/clerkMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAEV,0BAA0B,EAC1B,YAAY,EACZ,WAAW,EAEX,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,yBAAyB,CAAC;AAkBjC,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAOxD,OAAO,EAAE,KAAK,4BAA4B,EAAsC,MAAM,2BAA2B,CAAC;AAkBlH,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,SAAS,CAAC;AASjB,MAAM,MAAM,gCAAgC,GAAG,CAAC,kBAAkB,GAAG,mBAAmB,CAAC,GAAG;IAC1F,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEzC,KAAK,sBAAsB,GAAG,CAC5B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,0BAA0B,EACnC,KAAK,EAAE,sBAAsB,KAC1B,oBAAoB,CAAC;AAE1B,KAAK,6BAA6B,GAAG,IAAI,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,6BAA6B;IAC3E;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;CAC5C;AAED,KAAK,8BAA8B,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErH;;;GAGG;AACH,UAAU,eAAe;IACvB;;;OAGG;IACH,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,cAAc,CAAC;IAEpF;;;OAGG;IACH,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,CAAC,EAAE,8BAA8B,GAAG,cAAc,CAAC;IAE5F;;;OAGG;IACH,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,cAAc,CAAC;IAEnD;;;OAGG;IACH,CAAC,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,sBAAsB,GAAG,oBAAoB,CAAC;CAC5F;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,EAmPtB,eAAe,CAAC;AA2BtB,KAAK,mBAAmB,GAAG,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,qBAAqB,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,GAC3C,cAAc,YAAY,EAC1B,SAAS,sBAAsB,KAC9B,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAsBnC,CAAC"}
+{"version":3,"file":"clerkMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/clerkMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAEV,0BAA0B,EAC1B,YAAY,EACZ,WAAW,EAEX,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,yBAAyB,CAAC;AAiBjC,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAOxD,OAAO,EAAE,KAAK,4BAA4B,EAAsC,MAAM,2BAA2B,CAAC;AAkBlH,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,SAAS,CAAC;AASjB,MAAM,MAAM,gCAAgC,GAAG,CAAC,kBAAkB,GAAG,mBAAmB,CAAC,GAAG;IAC1F,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEzC,KAAK,sBAAsB,GAAG,CAC5B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,0BAA0B,EACnC,KAAK,EAAE,sBAAsB,KAC1B,oBAAoB,CAAC;AAE1B,KAAK,6BAA6B,GAAG,IAAI,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,6BAA6B;IAC3E;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAErD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;CAC5C;AAED,KAAK,8BAA8B,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErH;;;GAGG;AACH,UAAU,eAAe;IACvB;;;OAGG;IACH,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,cAAc,CAAC;IAEpF;;;OAGG;IACH,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,CAAC,EAAE,8BAA8B,GAAG,cAAc,CAAC;IAE5F;;;OAGG;IACH,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,cAAc,CAAC;IAEnD;;;OAGG;IACH,CAAC,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,sBAAsB,GAAG,oBAAoB,CAAC;CAC5F;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,EA2OtB,eAAe,CAAC;AA2BtB,KAAK,mBAAmB,GAAG,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,qBAAqB,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,GAC3C,cAAc,YAAY,EAC1B,SAAS,sBAAsB,KAC9B,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAsBnC,CAAC"}

package/dist/types/utils/mergeNextClerkPropsWithEnv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mergeNextClerkPropsWithEnv.d.ts","sourceRoot":"","sources":["../../../src/utils/mergeNextClerkPropsWithEnv.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAKtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAiBvD,eAAO,MAAM,0BAA0B,GACrC,OAAO,IAAI,CAAC,sBAAsB,EAAE,UAAU,CAAC,GAAG,wBAAwB,KACzE,GA2CF,CAAC"}
+{"version":3,"file":"mergeNextClerkPropsWithEnv.d.ts","sourceRoot":"","sources":["../../../src/utils/mergeNextClerkPropsWithEnv.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAItE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAiBvD,eAAO,MAAM,0BAA0B,GACrC,OAAO,IAAI,CAAC,sBAAsB,EAAE,UAAU,CAAC,GAAG,wBAAwB,KACzE,GAiCF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clerk/nextjs",
-  "version": "7.2.4-snapshot.v20260421194054",
+  "version": "7.2.4",
   "description": "Clerk SDK for NextJS",
   "keywords": [
     "clerk",
@@ -72,9 +72,9 @@
   "dependencies": {
     "server-only": "0.0.1",
     "tslib": "2.8.1",
-    "@clerk/react": "6.4.3-snapshot.v20260421194054",
-    "@clerk/backend": "3.2.14-snapshot.v20260421194054",
-    "@clerk/shared": "4.8.3-snapshot.v20260421194054"
+    "@clerk/shared": "^4.8.3",
+    "@clerk/backend": "^3.2.14",
+    "@clerk/react": "^6.4.3"
   },
   "devDependencies": {
     "crypto-es": "^2.1.0",