@clerk/shared 4.8.4-snapshot.v20260423044224 → 4.8.4

package/dist/runtime/internal/clerk-js/completeSignUpFlow.js

@@ -1,10 +1,10 @@
 require('../../constants-WYhx_umW.js');
 require('../../isomorphicAtob-Hkpnx2p8.js');
 require('../../isomorphicBtoa-_pSA92Q9.js');
-require('../../keys-BI9hmfja.js');
-require('../../netlifyCacheHandler-DFm5qdPh.js');
+require('../../keys-D5ahg2Gn.js');
+require('../../netlifyCacheHandler-DMlEakyq.js');
 require('../../constants-BUzkV8jh.js');
-const require_queryParams = require('../../queryParams-DSUymAGT.js');
+const require_queryParams = require('../../queryParams-DFhrd86C.js');
 
 //#region src/internal/clerk-js/completeSignUpFlow.ts
 const completeSignUpFlow = ({ signUp, verifyEmailPath, verifyPhonePath, continuePath, navigate, handleComplete, redirectUrl = "", redirectUrlComplete = "", oidcPrompt }) => {

package/dist/runtime/internal/clerk-js/completeSignUpFlow.mjs

@@ -1,10 +1,10 @@
 import "../../constants-Bta24VLk.mjs";
 import "../../isomorphicAtob-CoF80qYz.mjs";
 import "../../isomorphicBtoa-DWmLcIHi.mjs";
-import "../../keys-DuxzP8MU.mjs";
-import "../../netlifyCacheHandler-Dkdkho_6.mjs";
+import "../../keys-BeVKH43u.mjs";
+import "../../netlifyCacheHandler-Cpx2hZ9E.mjs";
 import "../../constants-BulbbNR9.mjs";
-import { t as forwardClerkQueryParams } from "../../queryParams-Dlt0oVDg.mjs";
+import { t as forwardClerkQueryParams } from "../../queryParams-Bad5kF87.mjs";
 
 //#region src/internal/clerk-js/completeSignUpFlow.ts
 const completeSignUpFlow = ({ signUp, verifyEmailPath, verifyPhonePath, continuePath, navigate, handleComplete, redirectUrl = "", redirectUrlComplete = "", oidcPrompt }) => {

package/dist/runtime/internal/clerk-js/queryParams.js

@@ -1,10 +1,10 @@
 require('../../constants-WYhx_umW.js');
 require('../../isomorphicAtob-Hkpnx2p8.js');
 require('../../isomorphicBtoa-_pSA92Q9.js');
-require('../../keys-BI9hmfja.js');
-require('../../netlifyCacheHandler-DFm5qdPh.js');
+require('../../keys-D5ahg2Gn.js');
+require('../../netlifyCacheHandler-DMlEakyq.js');
 require('../../constants-BUzkV8jh.js');
-const require_queryParams = require('../../queryParams-DSUymAGT.js');
+const require_queryParams = require('../../queryParams-DFhrd86C.js');
 
 exports.forwardClerkQueryParams = require_queryParams.forwardClerkQueryParams;
 exports.getClerkQueryParam = require_queryParams.getClerkQueryParam;

package/dist/runtime/internal/clerk-js/queryParams.mjs

@@ -1,9 +1,9 @@
 import "../../constants-Bta24VLk.mjs";
 import "../../isomorphicAtob-CoF80qYz.mjs";
 import "../../isomorphicBtoa-DWmLcIHi.mjs";
-import "../../keys-DuxzP8MU.mjs";
-import "../../netlifyCacheHandler-Dkdkho_6.mjs";
+import "../../keys-BeVKH43u.mjs";
+import "../../netlifyCacheHandler-Cpx2hZ9E.mjs";
 import "../../constants-BulbbNR9.mjs";
-import { n as getClerkQueryParam, r as removeClerkQueryParam, t as forwardClerkQueryParams } from "../../queryParams-Dlt0oVDg.mjs";
+import { n as getClerkQueryParam, r as removeClerkQueryParam, t as forwardClerkQueryParams } from "../../queryParams-Bad5kF87.mjs";
 
 export { forwardClerkQueryParams, getClerkQueryParam, removeClerkQueryParam };

package/dist/runtime/internal/clerk-js/queryStateParams.js

@@ -1,10 +1,10 @@
 require('../../constants-WYhx_umW.js');
 require('../../isomorphicAtob-Hkpnx2p8.js');
 require('../../isomorphicBtoa-_pSA92Q9.js');
-require('../../keys-BI9hmfja.js');
-require('../../netlifyCacheHandler-DFm5qdPh.js');
+require('../../keys-D5ahg2Gn.js');
+require('../../netlifyCacheHandler-DMlEakyq.js');
 const require_constants$1 = require('../../constants-BUzkV8jh.js');
-const require_queryParams = require('../../queryParams-DSUymAGT.js');
+const require_queryParams = require('../../queryParams-DFhrd86C.js');
 const require_encoders = require('../../encoders-C_EA3--l.js');
 
 //#region src/internal/clerk-js/queryStateParams.ts

package/dist/runtime/internal/clerk-js/queryStateParams.mjs

@@ -1,10 +1,10 @@
 import "../../constants-Bta24VLk.mjs";
 import "../../isomorphicAtob-CoF80qYz.mjs";
 import "../../isomorphicBtoa-DWmLcIHi.mjs";
-import "../../keys-DuxzP8MU.mjs";
-import "../../netlifyCacheHandler-Dkdkho_6.mjs";
+import "../../keys-BeVKH43u.mjs";
+import "../../netlifyCacheHandler-Cpx2hZ9E.mjs";
 import { r as CLERK_MODAL_STATE } from "../../constants-BulbbNR9.mjs";
-import { n as getClerkQueryParam } from "../../queryParams-Dlt0oVDg.mjs";
+import { n as getClerkQueryParam } from "../../queryParams-Bad5kF87.mjs";
 import { n as encodeB64 } from "../../encoders-CAjYroSe.mjs";
 
 //#region src/internal/clerk-js/queryStateParams.ts

package/dist/runtime/internal/clerk-js/redirectUrls.js

@@ -1,7 +1,7 @@
 require('../../constants-WYhx_umW.js');
 require('../../isomorphicAtob-Hkpnx2p8.js');
 require('../../isomorphicBtoa-_pSA92Q9.js');
-require('../../keys-BI9hmfja.js');
+require('../../keys-D5ahg2Gn.js');
 require('../../globs-D0Kpu4g1.js');
 require('../../instance-C1LlVxIp.js');
 require('../../url-sAcxbiir.js');
@@ -10,7 +10,7 @@ const require_object = require('../../object-DklYlVP-.js');
 const require_underscore = require('../../underscore-BX6Ucmg5.js');
 require('../../path-ci3QmWY8.js');
 require('../../querystring-BFj_iDi0.js');
-const require_url$1 = require('../../url-CoXV4i87.js');
+const require_url$1 = require('../../url-Cw4Wpvh3.js');
 
 //#region src/internal/clerk-js/redirectUrls.ts
 var RedirectUrls = class RedirectUrls {

package/dist/runtime/internal/clerk-js/redirectUrls.mjs

@@ -1,7 +1,7 @@
 import "../../constants-Bta24VLk.mjs";
 import "../../isomorphicAtob-CoF80qYz.mjs";
 import "../../isomorphicBtoa-DWmLcIHi.mjs";
-import "../../keys-DuxzP8MU.mjs";
+import "../../keys-BeVKH43u.mjs";
 import "../../globs-u_gXJPLt.mjs";
 import "../../instance-BmZr0cdE.mjs";
 import "../../url-C6gPMFx5.mjs";
@@ -10,7 +10,7 @@ import { n as filterProps, r as removeUndefined, t as applyFunctionToObj } from
 import { t as camelToSnake } from "../../underscore-ClYSgvuy.mjs";
 import "../../path-BLD6zl1u.mjs";
 import "../../querystring-pXtwII0l.mjs";
-import { l as isAllowedRedirect, v as relativeToAbsoluteUrl } from "../../url-DaPDWryr.mjs";
+import { l as isAllowedRedirect, v as relativeToAbsoluteUrl } from "../../url-cNLJYbcB.mjs";
 
 //#region src/internal/clerk-js/redirectUrls.ts
 var RedirectUrls = class RedirectUrls {

package/dist/runtime/internal/clerk-js/sessionTasks.js

@@ -1,18 +1,18 @@
 require('../../constants-WYhx_umW.js');
 require('../../isomorphicAtob-Hkpnx2p8.js');
 require('../../isomorphicBtoa-_pSA92Q9.js');
-require('../../keys-BI9hmfja.js');
+require('../../keys-D5ahg2Gn.js');
 require('../../globs-D0Kpu4g1.js');
 require('../../instance-C1LlVxIp.js');
 require('../../url-sAcxbiir.js');
 const require_logger = require('../../logger-BOte4sQb.js');
-require('../../netlifyCacheHandler-DFm5qdPh.js');
+require('../../netlifyCacheHandler-DMlEakyq.js');
 require('../../underscore-BX6Ucmg5.js');
 require('../../constants-BUzkV8jh.js');
-const require_queryParams = require('../../queryParams-DSUymAGT.js');
+const require_queryParams = require('../../queryParams-DFhrd86C.js');
 require('../../path-ci3QmWY8.js');
 require('../../querystring-BFj_iDi0.js');
-const require_url$1 = require('../../url-CoXV4i87.js');
+const require_url$1 = require('../../url-Cw4Wpvh3.js');
 
 //#region src/internal/clerk-js/sessionTasks.ts
 /**

package/dist/runtime/internal/clerk-js/sessionTasks.mjs

@@ -1,18 +1,18 @@
 import "../../constants-Bta24VLk.mjs";
 import "../../isomorphicAtob-CoF80qYz.mjs";
 import "../../isomorphicBtoa-DWmLcIHi.mjs";
-import "../../keys-DuxzP8MU.mjs";
+import "../../keys-BeVKH43u.mjs";
 import "../../globs-u_gXJPLt.mjs";
 import "../../instance-BmZr0cdE.mjs";
 import "../../url-C6gPMFx5.mjs";
 import { t as logger } from "../../logger-DISzhF9M.mjs";
-import "../../netlifyCacheHandler-Dkdkho_6.mjs";
+import "../../netlifyCacheHandler-Cpx2hZ9E.mjs";
 import "../../underscore-ClYSgvuy.mjs";
 import "../../constants-BulbbNR9.mjs";
-import { t as forwardClerkQueryParams } from "../../queryParams-Dlt0oVDg.mjs";
+import { t as forwardClerkQueryParams } from "../../queryParams-Bad5kF87.mjs";
 import "../../path-BLD6zl1u.mjs";
 import "../../querystring-pXtwII0l.mjs";
-import { t as buildURL } from "../../url-DaPDWryr.mjs";
+import { t as buildURL } from "../../url-cNLJYbcB.mjs";
 
 //#region src/internal/clerk-js/sessionTasks.ts
 /**

package/dist/runtime/internal/clerk-js/url.js

@@ -1,7 +1,7 @@
 require('../../constants-WYhx_umW.js');
 require('../../isomorphicAtob-Hkpnx2p8.js');
 require('../../isomorphicBtoa-_pSA92Q9.js');
-require('../../keys-BI9hmfja.js');
+require('../../keys-D5ahg2Gn.js');
 require('../../globs-D0Kpu4g1.js');
 require('../../instance-C1LlVxIp.js');
 require('../../url-sAcxbiir.js');
@@ -9,7 +9,7 @@ require('../../logger-BOte4sQb.js');
 require('../../underscore-BX6Ucmg5.js');
 require('../../path-ci3QmWY8.js');
 require('../../querystring-BFj_iDi0.js');
-const require_url$1 = require('../../url-CoXV4i87.js');
+const require_url$1 = require('../../url-Cw4Wpvh3.js');
 
 exports.buildURL = require_url$1.buildURL;
 exports.createAllowedRedirectOrigins = require_url$1.createAllowedRedirectOrigins;

package/dist/runtime/internal/clerk-js/url.mjs

@@ -1,7 +1,7 @@
 import "../../constants-Bta24VLk.mjs";
 import "../../isomorphicAtob-CoF80qYz.mjs";
 import "../../isomorphicBtoa-DWmLcIHi.mjs";
-import "../../keys-DuxzP8MU.mjs";
+import "../../keys-BeVKH43u.mjs";
 import "../../globs-u_gXJPLt.mjs";
 import "../../instance-BmZr0cdE.mjs";
 import "../../url-C6gPMFx5.mjs";
@@ -9,6 +9,6 @@ import "../../logger-DISzhF9M.mjs";
 import "../../underscore-ClYSgvuy.mjs";
 import "../../path-BLD6zl1u.mjs";
 import "../../querystring-pXtwII0l.mjs";
-import { C as trimLeadingSlash, S as toURL, _ as pathFromFullPath, a as hasBannedHrefProtocol, b as sanitizeHref, c as hasUrlInFragment, d as isDevAccountPortalOrigin, f as isDevOrStagingUrl, g as mergeFragmentIntoUrl, h as isValidUrl, i as getSearchParameterFromHash, l as isAllowedRedirect, m as isRedirectForFAPIInitiatedFlow, n as createAllowedRedirectOrigins, o as hasBannedProtocol, p as isProblematicUrl, r as getETLDPlusOneFromFrontendApi, s as hasExternalAccountSignUpError, t as buildURL, u as isDataUri, v as relativeToAbsoluteUrl, w as trimTrailingSlash, x as stripOrigin, y as requiresUserInput } from "../../url-DaPDWryr.mjs";
+import { C as trimLeadingSlash, S as toURL, _ as pathFromFullPath, a as hasBannedHrefProtocol, b as sanitizeHref, c as hasUrlInFragment, d as isDevAccountPortalOrigin, f as isDevOrStagingUrl, g as mergeFragmentIntoUrl, h as isValidUrl, i as getSearchParameterFromHash, l as isAllowedRedirect, m as isRedirectForFAPIInitiatedFlow, n as createAllowedRedirectOrigins, o as hasBannedProtocol, p as isProblematicUrl, r as getETLDPlusOneFromFrontendApi, s as hasExternalAccountSignUpError, t as buildURL, u as isDataUri, v as relativeToAbsoluteUrl, w as trimTrailingSlash, x as stripOrigin, y as requiresUserInput } from "../../url-cNLJYbcB.mjs";
 
 export { buildURL, createAllowedRedirectOrigins, getETLDPlusOneFromFrontendApi, getSearchParameterFromHash, hasBannedHrefProtocol, hasBannedProtocol, hasExternalAccountSignUpError, hasUrlInFragment, isAllowedRedirect, isDataUri, isDevAccountPortalOrigin, isDevOrStagingUrl, isProblematicUrl, isRedirectForFAPIInitiatedFlow, isValidUrl, mergeFragmentIntoUrl, pathFromFullPath, relativeToAbsoluteUrl, requiresUserInput, sanitizeHref, stripOrigin, toURL, trimLeadingSlash, trimTrailingSlash };

package/dist/runtime/{keys-DuxzP8MU.mjs → keys-BeVKH43u.mjs}

@@ -22,6 +22,36 @@ function buildPublishableKey(frontendApi) {
 	return `${PUBLISHABLE_FRONTEND_API_DEV_REGEX.test(frontendApi) || frontendApi.startsWith("clerk.") && LEGACY_DEV_INSTANCE_SUFFIXES.some((s) => frontendApi.endsWith(s)) ? PUBLISHABLE_KEY_TEST_PREFIX : PUBLISHABLE_KEY_LIVE_PREFIX}${isomorphicBtoa(`${frontendApi}$`)}`;
 }
 /**
+* Derives a publishable key from the current hostname. Intended for multi-domain
+* setups (e.g. custom domains on top of a default domain) where the correct key
+* must be resolved per request.
+*
+* Pass the configured publishable key as `fallbackKey` so that development
+* instances (pk_test_) are returned as-is instead of being incorrectly derived
+* from the host (e.g. localhost).
+*
+* @example
+* // React (use window.location.hostname, not window.location.host, to avoid including the port)
+* <ClerkProvider publishableKey={publishableKeyFromHost(window.location.hostname, import.meta.env.VITE_CLERK_PUBLISHABLE_KEY)}>
+*
+* @example
+* // Express (inside clerkMiddleware callback)
+* // Validate req.hostname against a known allowlist before passing it in.
+* // When `trust proxy` is enabled, req.hostname reads from X-Forwarded-Host
+* // and can be spoofed if your proxy is not properly configured.
+* const ALLOWED_HOSTS = ['domain-a.com', 'domain-b.com'];
+* clerkMiddleware((req) => {
+*   if (!ALLOWED_HOSTS.includes(req.hostname)) throw new Error('Unknown host');
+*   return { publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY) };
+* })
+*/
+function publishableKeyFromHost(host, fallbackKey) {
+	if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) return fallbackKey;
+	const hostname = host.toLowerCase().replace(/:\d+$/, "");
+	if (!hostname) throw new Error("Host must not be empty.");
+	return buildPublishableKey(`clerk.${hostname}`);
+}
+/**
 * Validates that a decoded publishable key has the correct format.
 * The decoded value should be a frontend API followed by exactly one '$' at the end.
 *
@@ -177,5 +207,5 @@ const getSuffixedCookieName = (cookieName, cookieSuffix) => {
 };
 
 //#endregion
-export { isDevelopmentFromPublishableKey as a, isProductionFromSecretKey as c, getSuffixedCookieName as i, isPublishableKey as l, createDevOrStagingUrlCache as n, isDevelopmentFromSecretKey as o, getCookieSuffix as r, isProductionFromPublishableKey as s, buildPublishableKey as t, parsePublishableKey as u };
-//# sourceMappingURL=keys-DuxzP8MU.mjs.map
+export { isDevelopmentFromPublishableKey as a, isProductionFromSecretKey as c, publishableKeyFromHost as d, getSuffixedCookieName as i, isPublishableKey as l, createDevOrStagingUrlCache as n, isDevelopmentFromSecretKey as o, getCookieSuffix as r, isProductionFromPublishableKey as s, buildPublishableKey as t, parsePublishableKey as u };
+//# sourceMappingURL=keys-BeVKH43u.mjs.map

package/dist/runtime/keys-BeVKH43u.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-BeVKH43u.mjs","names":["decodedFrontendApi: string"],"sources":["../../src/keys.ts"],"sourcesContent":["import { DEV_OR_STAGING_SUFFIXES, LEGACY_DEV_INSTANCE_SUFFIXES } from './constants';\nimport { isomorphicAtob } from './isomorphicAtob';\nimport { isomorphicBtoa } from './isomorphicBtoa';\nimport type { PublishableKey } from './types';\n\n/**\n * Configuration options for parsing publishable keys.\n */\ntype ParsePublishableKeyOptions = {\n  /** Whether to throw an error if parsing fails */\n  fatal?: boolean;\n  /** Custom domain to use for satellite instances */\n  domain?: string;\n  /** Proxy URL to use instead of the decoded frontend API */\n  proxyUrl?: string;\n  /** Whether this is a satellite instance */\n  isSatellite?: boolean;\n};\n\n/** Prefix used for production publishable keys */\nconst PUBLISHABLE_KEY_LIVE_PREFIX = 'pk_live_';\n\n/** Prefix used for development publishable keys */\nconst PUBLISHABLE_KEY_TEST_PREFIX = 'pk_test_';\n\n/**\n * Regular expression that matches development frontend API keys.\n * Matches patterns like: foo-bar-13.clerk.accounts.dev.\n */\nconst PUBLISHABLE_FRONTEND_API_DEV_REGEX = /^(([a-z]+)-){2}([0-9]{1,2})\\.clerk\\.accounts([a-z.]*)(dev|com)$/i;\n\n/**\n * Converts a frontend API URL into a base64-encoded publishable key.\n *\n * @param frontendApi - The frontend API URL (e.g., 'clerk.example.com').\n * @returns A base64-encoded publishable key with appropriate prefix (pk_live_ or pk_test_).\n */\nexport function buildPublishableKey(frontendApi: string): string {\n  const isDevKey =\n    PUBLISHABLE_FRONTEND_API_DEV_REGEX.test(frontendApi) ||\n    (frontendApi.startsWith('clerk.') && LEGACY_DEV_INSTANCE_SUFFIXES.some(s => frontendApi.endsWith(s)));\n  const keyPrefix = isDevKey ? PUBLISHABLE_KEY_TEST_PREFIX : PUBLISHABLE_KEY_LIVE_PREFIX;\n  return `${keyPrefix}${isomorphicBtoa(`${frontendApi}$`)}`;\n}\n\n/**\n * Derives a publishable key from the current hostname. Intended for multi-domain\n * setups (e.g. custom domains on top of a default domain) where the correct key\n * must be resolved per request.\n *\n * Pass the configured publishable key as `fallbackKey` so that development\n * instances (pk_test_) are returned as-is instead of being incorrectly derived\n * from the host (e.g. localhost).\n *\n * @example\n * // React (use window.location.hostname, not window.location.host, to avoid including the port)\n * <ClerkProvider publishableKey={publishableKeyFromHost(window.location.hostname, import.meta.env.VITE_CLERK_PUBLISHABLE_KEY)}>\n *\n * @example\n * // Express (inside clerkMiddleware callback)\n * // Validate req.hostname against a known allowlist before passing it in.\n * // When `trust proxy` is enabled, req.hostname reads from X-Forwarded-Host\n * // and can be spoofed if your proxy is not properly configured.\n * const ALLOWED_HOSTS = ['domain-a.com', 'domain-b.com'];\n * clerkMiddleware((req) => {\n *   if (!ALLOWED_HOSTS.includes(req.hostname)) throw new Error('Unknown host');\n *   return { publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY) };\n * })\n */\nexport function publishableKeyFromHost(host: string, fallbackKey?: string): string {\n  if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {\n    return fallbackKey;\n  }\n  const hostname = host.toLowerCase().replace(/:\\d+$/, '');\n  if (!hostname) {\n    throw new Error('Host must not be empty.');\n  }\n  return buildPublishableKey(`clerk.${hostname}`);\n}\n\n/**\n * Validates that a decoded publishable key has the correct format.\n * The decoded value should be a frontend API followed by exactly one '$' at the end.\n *\n * @param decoded - The decoded publishable key string to validate.\n * @returns `true` if the decoded key has valid format, `false` otherwise.\n */\nfunction isValidDecodedPublishableKey(decoded: string): boolean {\n  if (!decoded.endsWith('$')) {\n    return false;\n  }\n\n  const withoutTrailing = decoded.slice(0, -1);\n  if (withoutTrailing.includes('$')) {\n    return false;\n  }\n\n  return withoutTrailing.includes('.');\n}\n\nexport function parsePublishableKey(\n  key: string | undefined,\n  options: ParsePublishableKeyOptions & { fatal: true },\n): PublishableKey;\nexport function parsePublishableKey(\n  key: string | undefined,\n  options?: ParsePublishableKeyOptions,\n): PublishableKey | null;\n/**\n * Parses and validates a publishable key, extracting the frontend API and instance type.\n *\n * @param key - The publishable key to parse.\n * @param options - Configuration options for parsing.\n * @param options.fatal\n * @param options.domain\n * @param options.proxyUrl\n * @param options.isSatellite\n * @returns Parsed publishable key object with instanceType and frontendApi, or null if invalid.\n *\n * @throws {Error} When options.fatal is true and key is missing or invalid.\n */\nexport function parsePublishableKey(\n  key: string | undefined,\n  options: { fatal?: boolean; domain?: string; proxyUrl?: string; isSatellite?: boolean } = {},\n): PublishableKey | null {\n  key = key || '';\n\n  if (!key || !isPublishableKey(key)) {\n    if (options.fatal && !key) {\n      throw new Error(\n        'Publishable key is missing. Ensure that your publishable key is correctly configured. Double-check your environment configuration for your keys, or access them here: https://dashboard.clerk.com/last-active?path=api-keys',\n      );\n    }\n    if (options.fatal && !isPublishableKey(key)) {\n      throw new Error('Publishable key not valid.');\n    }\n    return null;\n  }\n\n  const instanceType = key.startsWith(PUBLISHABLE_KEY_LIVE_PREFIX) ? 'production' : 'development';\n\n  let decodedFrontendApi: string;\n  try {\n    decodedFrontendApi = isomorphicAtob(key.split('_')[2]);\n  } catch {\n    if (options.fatal) {\n      throw new Error('Publishable key not valid: Failed to decode key.');\n    }\n    return null;\n  }\n\n  if (!isValidDecodedPublishableKey(decodedFrontendApi)) {\n    if (options.fatal) {\n      throw new Error('Publishable key not valid: Decoded key has invalid format.');\n    }\n    return null;\n  }\n\n  let frontendApi = decodedFrontendApi.slice(0, -1);\n\n  if (options.proxyUrl) {\n    frontendApi = options.proxyUrl;\n  } else if (instanceType !== 'development' && options.domain && options.isSatellite) {\n    frontendApi = `clerk.${options.domain}`;\n  }\n\n  return {\n    instanceType,\n    frontendApi,\n  };\n}\n\n/**\n * Checks if the provided key is a valid publishable key.\n *\n * @param key - The key to be checked. Defaults to an empty string if not provided.\n * @returns `true` if 'key' is a valid publishable key, `false` otherwise.\n */\nexport function isPublishableKey(key: string = '') {\n  try {\n    const hasValidPrefix = key.startsWith(PUBLISHABLE_KEY_LIVE_PREFIX) || key.startsWith(PUBLISHABLE_KEY_TEST_PREFIX);\n\n    if (!hasValidPrefix) {\n      return false;\n    }\n\n    const parts = key.split('_');\n    if (parts.length !== 3) {\n      return false;\n    }\n\n    const encodedPart = parts[2];\n    if (!encodedPart) {\n      return false;\n    }\n\n    const decoded = isomorphicAtob(encodedPart);\n    return isValidDecodedPublishableKey(decoded);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Creates a memoized cache for checking if URLs are development or staging environments.\n * Uses a Map to cache results for better performance on repeated checks.\n *\n * @returns An object with an isDevOrStagingUrl method that checks if a URL is dev/staging.\n */\nexport function createDevOrStagingUrlCache() {\n  const devOrStagingUrlCache = new Map<string, boolean>();\n\n  return {\n    /**\n     * Checks if a URL is a development or staging environment.\n     *\n     * @param url - The URL to check (string or URL object).\n     * @returns `true` if the URL is a development or staging environment, `false` otherwise.\n     */\n    isDevOrStagingUrl: (url: string | URL): boolean => {\n      if (!url) {\n        return false;\n      }\n\n      const hostname = typeof url === 'string' ? url : url.hostname;\n      let res = devOrStagingUrlCache.get(hostname);\n      if (res === undefined) {\n        res = DEV_OR_STAGING_SUFFIXES.some(s => hostname.endsWith(s));\n        devOrStagingUrlCache.set(hostname, res);\n      }\n      return res;\n    },\n  };\n}\n\n/**\n * Checks if a publishable key is for a development environment.\n * Supports both legacy format (test_) and new format (pk_test_).\n *\n * @param apiKey - The API key to check.\n * @returns `true` if the key is for development, `false` otherwise.\n */\nexport function isDevelopmentFromPublishableKey(apiKey: string): boolean {\n  return apiKey.startsWith('test_') || apiKey.startsWith('pk_test_');\n}\n\n/**\n * Checks if a publishable key is for a production environment.\n * Supports both legacy format (live_) and new format (pk_live_).\n *\n * @param apiKey - The API key to check.\n * @returns `true` if the key is for production, `false` otherwise.\n */\nexport function isProductionFromPublishableKey(apiKey: string): boolean {\n  return apiKey.startsWith('live_') || apiKey.startsWith('pk_live_');\n}\n\n/**\n * Checks if a secret key is for a development environment.\n * Supports both legacy format (test_) and new format (sk_test_).\n *\n * @param apiKey - The secret key to check.\n * @returns `true` if the key is for development, `false` otherwise.\n */\nexport function isDevelopmentFromSecretKey(apiKey: string): boolean {\n  return apiKey.startsWith('test_') || apiKey.startsWith('sk_test_');\n}\n\n/**\n * Checks if a secret key is for a production environment.\n * Supports both legacy format (live_) and new format (sk_live_).\n *\n * @param apiKey - The secret key to check.\n * @returns `true` if the key is for production, `false` otherwise.\n */\nexport function isProductionFromSecretKey(apiKey: string): boolean {\n  return apiKey.startsWith('live_') || apiKey.startsWith('sk_live_');\n}\n\n/**\n * Generates a unique cookie suffix based on the publishable key using SHA-1 hashing.\n * The suffix is base64-encoded and URL-safe (+ and / characters are replaced).\n *\n * @param publishableKey - The publishable key to generate suffix from.\n * @param subtle - The SubtleCrypto interface to use for hashing (defaults to globalThis.crypto.subtle).\n * @returns A promise that resolves to an 8-character URL-safe base64 string.\n */\nexport async function getCookieSuffix(\n  publishableKey: string,\n  subtle: SubtleCrypto = globalThis.crypto.subtle,\n): Promise<string> {\n  const data = new TextEncoder().encode(publishableKey);\n  const digest = await subtle.digest('sha-1', data);\n  const stringDigest = String.fromCharCode(...new Uint8Array(digest));\n  // Base 64 Encoding with URL and Filename Safe Alphabet: https://datatracker.ietf.org/doc/html/rfc4648#section-5\n  return isomorphicBtoa(stringDigest).replace(/\\+/gi, '-').replace(/\\//gi, '_').substring(0, 8);\n}\n\n/**\n * Creates a suffixed cookie name by appending the cookie suffix to the base name.\n * Used to create unique cookie names based on the publishable key.\n *\n * @param cookieName - The base cookie name.\n * @param cookieSuffix - The suffix to append (typically generated by getCookieSuffix).\n * @returns The suffixed cookie name in format: `${cookieName}_${cookieSuffix}`.\n */\nexport const getSuffixedCookieName = (cookieName: string, cookieSuffix: string): string => {\n  return `${cookieName}_${cookieSuffix}`;\n};\n"],"mappings":";;;;;;AAoBA,MAAM,8BAA8B;;AAGpC,MAAM,8BAA8B;;;;;AAMpC,MAAM,qCAAqC;;;;;;;AAQ3C,SAAgB,oBAAoB,aAA6B;AAK/D,QAAO,GAHL,mCAAmC,KAAK,YAAY,IACnD,YAAY,WAAW,SAAS,IAAI,6BAA6B,MAAK,MAAK,YAAY,SAAS,EAAE,CAAC,GACzE,8BAA8B,8BACrC,eAAe,GAAG,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BzD,SAAgB,uBAAuB,MAAc,aAA8B;AACjF,KAAI,eAAe,gCAAgC,YAAY,CAC7D,QAAO;CAET,MAAM,WAAW,KAAK,aAAa,CAAC,QAAQ,SAAS,GAAG;AACxD,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,0BAA0B;AAE5C,QAAO,oBAAoB,SAAS,WAAW;;;;;;;;;AAUjD,SAAS,6BAA6B,SAA0B;AAC9D,KAAI,CAAC,QAAQ,SAAS,IAAI,CACxB,QAAO;CAGT,MAAM,kBAAkB,QAAQ,MAAM,GAAG,GAAG;AAC5C,KAAI,gBAAgB,SAAS,IAAI,CAC/B,QAAO;AAGT,QAAO,gBAAgB,SAAS,IAAI;;;;;;;;;;;;;;;AAwBtC,SAAgB,oBACd,KACA,UAA0F,EAAE,EACrE;AACvB,OAAM,OAAO;AAEb,KAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE;AAClC,MAAI,QAAQ,SAAS,CAAC,IACpB,OAAM,IAAI,MACR,8NACD;AAEH,MAAI,QAAQ,SAAS,CAAC,iBAAiB,IAAI,CACzC,OAAM,IAAI,MAAM,6BAA6B;AAE/C,SAAO;;CAGT,MAAM,eAAe,IAAI,WAAW,4BAA4B,GAAG,eAAe;CAElF,IAAIA;AACJ,KAAI;AACF,uBAAqB,eAAe,IAAI,MAAM,IAAI,CAAC,GAAG;SAChD;AACN,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,mDAAmD;AAErE,SAAO;;AAGT,KAAI,CAAC,6BAA6B,mBAAmB,EAAE;AACrD,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,6DAA6D;AAE/E,SAAO;;CAGT,IAAI,cAAc,mBAAmB,MAAM,GAAG,GAAG;AAEjD,KAAI,QAAQ,SACV,eAAc,QAAQ;UACb,iBAAiB,iBAAiB,QAAQ,UAAU,QAAQ,YACrE,eAAc,SAAS,QAAQ;AAGjC,QAAO;EACL;EACA;EACD;;;;;;;;AASH,SAAgB,iBAAiB,MAAc,IAAI;AACjD,KAAI;AAGF,MAAI,EAFmB,IAAI,WAAW,4BAA4B,IAAI,IAAI,WAAW,4BAA4B,EAG/G,QAAO;EAGT,MAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,MAAI,MAAM,WAAW,EACnB,QAAO;EAGT,MAAM,cAAc,MAAM;AAC1B,MAAI,CAAC,YACH,QAAO;AAIT,SAAO,6BADS,eAAe,YAAY,CACC;SACtC;AACN,SAAO;;;;;;;;;AAUX,SAAgB,6BAA6B;CAC3C,MAAM,uCAAuB,IAAI,KAAsB;AAEvD,QAAO,EAOL,oBAAoB,QAA+B;AACjD,MAAI,CAAC,IACH,QAAO;EAGT,MAAM,WAAW,OAAO,QAAQ,WAAW,MAAM,IAAI;EACrD,IAAI,MAAM,qBAAqB,IAAI,SAAS;AAC5C,MAAI,QAAQ,QAAW;AACrB,SAAM,wBAAwB,MAAK,MAAK,SAAS,SAAS,EAAE,CAAC;AAC7D,wBAAqB,IAAI,UAAU,IAAI;;AAEzC,SAAO;IAEV;;;;;;;;;AAUH,SAAgB,gCAAgC,QAAyB;AACvE,QAAO,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,WAAW;;;;;;;;;AAUpE,SAAgB,+BAA+B,QAAyB;AACtE,QAAO,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,WAAW;;;;;;;;;AAUpE,SAAgB,2BAA2B,QAAyB;AAClE,QAAO,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,WAAW;;;;;;;;;AAUpE,SAAgB,0BAA0B,QAAyB;AACjE,QAAO,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,WAAW;;;;;;;;;;AAWpE,eAAsB,gBACpB,gBACA,SAAuB,WAAW,OAAO,QACxB;CACjB,MAAM,OAAO,IAAI,aAAa,CAAC,OAAO,eAAe;CACrD,MAAM,SAAS,MAAM,OAAO,OAAO,SAAS,KAAK;AAGjD,QAAO,eAFc,OAAO,aAAa,GAAG,IAAI,WAAW,OAAO,CAAC,CAEhC,CAAC,QAAQ,QAAQ,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,UAAU,GAAG,EAAE;;;;;;;;;;AAW/F,MAAa,yBAAyB,YAAoB,iBAAiC;AACzF,QAAO,GAAG,WAAW,GAAG"}

package/dist/runtime/{keys-BI9hmfja.js → keys-D5ahg2Gn.js}

@@ -22,6 +22,36 @@ function buildPublishableKey(frontendApi) {
 	return `${PUBLISHABLE_FRONTEND_API_DEV_REGEX.test(frontendApi) || frontendApi.startsWith("clerk.") && require_constants.LEGACY_DEV_INSTANCE_SUFFIXES.some((s) => frontendApi.endsWith(s)) ? PUBLISHABLE_KEY_TEST_PREFIX : PUBLISHABLE_KEY_LIVE_PREFIX}${require_isomorphicBtoa.isomorphicBtoa(`${frontendApi}$`)}`;
 }
 /**
+* Derives a publishable key from the current hostname. Intended for multi-domain
+* setups (e.g. custom domains on top of a default domain) where the correct key
+* must be resolved per request.
+*
+* Pass the configured publishable key as `fallbackKey` so that development
+* instances (pk_test_) are returned as-is instead of being incorrectly derived
+* from the host (e.g. localhost).
+*
+* @example
+* // React (use window.location.hostname, not window.location.host, to avoid including the port)
+* <ClerkProvider publishableKey={publishableKeyFromHost(window.location.hostname, import.meta.env.VITE_CLERK_PUBLISHABLE_KEY)}>
+*
+* @example
+* // Express (inside clerkMiddleware callback)
+* // Validate req.hostname against a known allowlist before passing it in.
+* // When `trust proxy` is enabled, req.hostname reads from X-Forwarded-Host
+* // and can be spoofed if your proxy is not properly configured.
+* const ALLOWED_HOSTS = ['domain-a.com', 'domain-b.com'];
+* clerkMiddleware((req) => {
+*   if (!ALLOWED_HOSTS.includes(req.hostname)) throw new Error('Unknown host');
+*   return { publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY) };
+* })
+*/
+function publishableKeyFromHost(host, fallbackKey) {
+	if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) return fallbackKey;
+	const hostname = host.toLowerCase().replace(/:\d+$/, "");
+	if (!hostname) throw new Error("Host must not be empty.");
+	return buildPublishableKey(`clerk.${hostname}`);
+}
+/**
 * Validates that a decoded publishable key has the correct format.
 * The decoded value should be a frontend API followed by exactly one '$' at the end.
 *
@@ -237,4 +267,10 @@ Object.defineProperty(exports, 'parsePublishableKey', {
     return parsePublishableKey;
   }
 });
-//# sourceMappingURL=keys-BI9hmfja.js.map
+Object.defineProperty(exports, 'publishableKeyFromHost', {
+  enumerable: true,
+  get: function () {
+    return publishableKeyFromHost;
+  }
+});
+//# sourceMappingURL=keys-D5ahg2Gn.js.map

package/dist/runtime/keys-D5ahg2Gn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-D5ahg2Gn.js","names":["LEGACY_DEV_INSTANCE_SUFFIXES","isomorphicBtoa","decodedFrontendApi: string","isomorphicAtob","DEV_OR_STAGING_SUFFIXES"],"sources":["../../src/keys.ts"],"sourcesContent":["import { DEV_OR_STAGING_SUFFIXES, LEGACY_DEV_INSTANCE_SUFFIXES } from './constants';\nimport { isomorphicAtob } from './isomorphicAtob';\nimport { isomorphicBtoa } from './isomorphicBtoa';\nimport type { PublishableKey } from './types';\n\n/**\n * Configuration options for parsing publishable keys.\n */\ntype ParsePublishableKeyOptions = {\n  /** Whether to throw an error if parsing fails */\n  fatal?: boolean;\n  /** Custom domain to use for satellite instances */\n  domain?: string;\n  /** Proxy URL to use instead of the decoded frontend API */\n  proxyUrl?: string;\n  /** Whether this is a satellite instance */\n  isSatellite?: boolean;\n};\n\n/** Prefix used for production publishable keys */\nconst PUBLISHABLE_KEY_LIVE_PREFIX = 'pk_live_';\n\n/** Prefix used for development publishable keys */\nconst PUBLISHABLE_KEY_TEST_PREFIX = 'pk_test_';\n\n/**\n * Regular expression that matches development frontend API keys.\n * Matches patterns like: foo-bar-13.clerk.accounts.dev.\n */\nconst PUBLISHABLE_FRONTEND_API_DEV_REGEX = /^(([a-z]+)-){2}([0-9]{1,2})\\.clerk\\.accounts([a-z.]*)(dev|com)$/i;\n\n/**\n * Converts a frontend API URL into a base64-encoded publishable key.\n *\n * @param frontendApi - The frontend API URL (e.g., 'clerk.example.com').\n * @returns A base64-encoded publishable key with appropriate prefix (pk_live_ or pk_test_).\n */\nexport function buildPublishableKey(frontendApi: string): string {\n  const isDevKey =\n    PUBLISHABLE_FRONTEND_API_DEV_REGEX.test(frontendApi) ||\n    (frontendApi.startsWith('clerk.') && LEGACY_DEV_INSTANCE_SUFFIXES.some(s => frontendApi.endsWith(s)));\n  const keyPrefix = isDevKey ? PUBLISHABLE_KEY_TEST_PREFIX : PUBLISHABLE_KEY_LIVE_PREFIX;\n  return `${keyPrefix}${isomorphicBtoa(`${frontendApi}$`)}`;\n}\n\n/**\n * Derives a publishable key from the current hostname. Intended for multi-domain\n * setups (e.g. custom domains on top of a default domain) where the correct key\n * must be resolved per request.\n *\n * Pass the configured publishable key as `fallbackKey` so that development\n * instances (pk_test_) are returned as-is instead of being incorrectly derived\n * from the host (e.g. localhost).\n *\n * @example\n * // React (use window.location.hostname, not window.location.host, to avoid including the port)\n * <ClerkProvider publishableKey={publishableKeyFromHost(window.location.hostname, import.meta.env.VITE_CLERK_PUBLISHABLE_KEY)}>\n *\n * @example\n * // Express (inside clerkMiddleware callback)\n * // Validate req.hostname against a known allowlist before passing it in.\n * // When `trust proxy` is enabled, req.hostname reads from X-Forwarded-Host\n * // and can be spoofed if your proxy is not properly configured.\n * const ALLOWED_HOSTS = ['domain-a.com', 'domain-b.com'];\n * clerkMiddleware((req) => {\n *   if (!ALLOWED_HOSTS.includes(req.hostname)) throw new Error('Unknown host');\n *   return { publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY) };\n * })\n */\nexport function publishableKeyFromHost(host: string, fallbackKey?: string): string {\n  if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {\n    return fallbackKey;\n  }\n  const hostname = host.toLowerCase().replace(/:\\d+$/, '');\n  if (!hostname) {\n    throw new Error('Host must not be empty.');\n  }\n  return buildPublishableKey(`clerk.${hostname}`);\n}\n\n/**\n * Validates that a decoded publishable key has the correct format.\n * The decoded value should be a frontend API followed by exactly one '$' at the end.\n *\n * @param decoded - The decoded publishable key string to validate.\n * @returns `true` if the decoded key has valid format, `false` otherwise.\n */\nfunction isValidDecodedPublishableKey(decoded: string): boolean {\n  if (!decoded.endsWith('$')) {\n    return false;\n  }\n\n  const withoutTrailing = decoded.slice(0, -1);\n  if (withoutTrailing.includes('$')) {\n    return false;\n  }\n\n  return withoutTrailing.includes('.');\n}\n\nexport function parsePublishableKey(\n  key: string | undefined,\n  options: ParsePublishableKeyOptions & { fatal: true },\n): PublishableKey;\nexport function parsePublishableKey(\n  key: string | undefined,\n  options?: ParsePublishableKeyOptions,\n): PublishableKey | null;\n/**\n * Parses and validates a publishable key, extracting the frontend API and instance type.\n *\n * @param key - The publishable key to parse.\n * @param options - Configuration options for parsing.\n * @param options.fatal\n * @param options.domain\n * @param options.proxyUrl\n * @param options.isSatellite\n * @returns Parsed publishable key object with instanceType and frontendApi, or null if invalid.\n *\n * @throws {Error} When options.fatal is true and key is missing or invalid.\n */\nexport function parsePublishableKey(\n  key: string | undefined,\n  options: { fatal?: boolean; domain?: string; proxyUrl?: string; isSatellite?: boolean } = {},\n): PublishableKey | null {\n  key = key || '';\n\n  if (!key || !isPublishableKey(key)) {\n    if (options.fatal && !key) {\n      throw new Error(\n        'Publishable key is missing. Ensure that your publishable key is correctly configured. Double-check your environment configuration for your keys, or access them here: https://dashboard.clerk.com/last-active?path=api-keys',\n      );\n    }\n    if (options.fatal && !isPublishableKey(key)) {\n      throw new Error('Publishable key not valid.');\n    }\n    return null;\n  }\n\n  const instanceType = key.startsWith(PUBLISHABLE_KEY_LIVE_PREFIX) ? 'production' : 'development';\n\n  let decodedFrontendApi: string;\n  try {\n    decodedFrontendApi = isomorphicAtob(key.split('_')[2]);\n  } catch {\n    if (options.fatal) {\n      throw new Error('Publishable key not valid: Failed to decode key.');\n    }\n    return null;\n  }\n\n  if (!isValidDecodedPublishableKey(decodedFrontendApi)) {\n    if (options.fatal) {\n      throw new Error('Publishable key not valid: Decoded key has invalid format.');\n    }\n    return null;\n  }\n\n  let frontendApi = decodedFrontendApi.slice(0, -1);\n\n  if (options.proxyUrl) {\n    frontendApi = options.proxyUrl;\n  } else if (instanceType !== 'development' && options.domain && options.isSatellite) {\n    frontendApi = `clerk.${options.domain}`;\n  }\n\n  return {\n    instanceType,\n    frontendApi,\n  };\n}\n\n/**\n * Checks if the provided key is a valid publishable key.\n *\n * @param key - The key to be checked. Defaults to an empty string if not provided.\n * @returns `true` if 'key' is a valid publishable key, `false` otherwise.\n */\nexport function isPublishableKey(key: string = '') {\n  try {\n    const hasValidPrefix = key.startsWith(PUBLISHABLE_KEY_LIVE_PREFIX) || key.startsWith(PUBLISHABLE_KEY_TEST_PREFIX);\n\n    if (!hasValidPrefix) {\n      return false;\n    }\n\n    const parts = key.split('_');\n    if (parts.length !== 3) {\n      return false;\n    }\n\n    const encodedPart = parts[2];\n    if (!encodedPart) {\n      return false;\n    }\n\n    const decoded = isomorphicAtob(encodedPart);\n    return isValidDecodedPublishableKey(decoded);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Creates a memoized cache for checking if URLs are development or staging environments.\n * Uses a Map to cache results for better performance on repeated checks.\n *\n * @returns An object with an isDevOrStagingUrl method that checks if a URL is dev/staging.\n */\nexport function createDevOrStagingUrlCache() {\n  const devOrStagingUrlCache = new Map<string, boolean>();\n\n  return {\n    /**\n     * Checks if a URL is a development or staging environment.\n     *\n     * @param url - The URL to check (string or URL object).\n     * @returns `true` if the URL is a development or staging environment, `false` otherwise.\n     */\n    isDevOrStagingUrl: (url: string | URL): boolean => {\n      if (!url) {\n        return false;\n      }\n\n      const hostname = typeof url === 'string' ? url : url.hostname;\n      let res = devOrStagingUrlCache.get(hostname);\n      if (res === undefined) {\n        res = DEV_OR_STAGING_SUFFIXES.some(s => hostname.endsWith(s));\n        devOrStagingUrlCache.set(hostname, res);\n      }\n      return res;\n    },\n  };\n}\n\n/**\n * Checks if a publishable key is for a development environment.\n * Supports both legacy format (test_) and new format (pk_test_).\n *\n * @param apiKey - The API key to check.\n * @returns `true` if the key is for development, `false` otherwise.\n */\nexport function isDevelopmentFromPublishableKey(apiKey: string): boolean {\n  return apiKey.startsWith('test_') || apiKey.startsWith('pk_test_');\n}\n\n/**\n * Checks if a publishable key is for a production environment.\n * Supports both legacy format (live_) and new format (pk_live_).\n *\n * @param apiKey - The API key to check.\n * @returns `true` if the key is for production, `false` otherwise.\n */\nexport function isProductionFromPublishableKey(apiKey: string): boolean {\n  return apiKey.startsWith('live_') || apiKey.startsWith('pk_live_');\n}\n\n/**\n * Checks if a secret key is for a development environment.\n * Supports both legacy format (test_) and new format (sk_test_).\n *\n * @param apiKey - The secret key to check.\n * @returns `true` if the key is for development, `false` otherwise.\n */\nexport function isDevelopmentFromSecretKey(apiKey: string): boolean {\n  return apiKey.startsWith('test_') || apiKey.startsWith('sk_test_');\n}\n\n/**\n * Checks if a secret key is for a production environment.\n * Supports both legacy format (live_) and new format (sk_live_).\n *\n * @param apiKey - The secret key to check.\n * @returns `true` if the key is for production, `false` otherwise.\n */\nexport function isProductionFromSecretKey(apiKey: string): boolean {\n  return apiKey.startsWith('live_') || apiKey.startsWith('sk_live_');\n}\n\n/**\n * Generates a unique cookie suffix based on the publishable key using SHA-1 hashing.\n * The suffix is base64-encoded and URL-safe (+ and / characters are replaced).\n *\n * @param publishableKey - The publishable key to generate suffix from.\n * @param subtle - The SubtleCrypto interface to use for hashing (defaults to globalThis.crypto.subtle).\n * @returns A promise that resolves to an 8-character URL-safe base64 string.\n */\nexport async function getCookieSuffix(\n  publishableKey: string,\n  subtle: SubtleCrypto = globalThis.crypto.subtle,\n): Promise<string> {\n  const data = new TextEncoder().encode(publishableKey);\n  const digest = await subtle.digest('sha-1', data);\n  const stringDigest = String.fromCharCode(...new Uint8Array(digest));\n  // Base 64 Encoding with URL and Filename Safe Alphabet: https://datatracker.ietf.org/doc/html/rfc4648#section-5\n  return isomorphicBtoa(stringDigest).replace(/\\+/gi, '-').replace(/\\//gi, '_').substring(0, 8);\n}\n\n/**\n * Creates a suffixed cookie name by appending the cookie suffix to the base name.\n * Used to create unique cookie names based on the publishable key.\n *\n * @param cookieName - The base cookie name.\n * @param cookieSuffix - The suffix to append (typically generated by getCookieSuffix).\n * @returns The suffixed cookie name in format: `${cookieName}_${cookieSuffix}`.\n */\nexport const getSuffixedCookieName = (cookieName: string, cookieSuffix: string): string => {\n  return `${cookieName}_${cookieSuffix}`;\n};\n"],"mappings":";;;;;;AAoBA,MAAM,8BAA8B;;AAGpC,MAAM,8BAA8B;;;;;AAMpC,MAAM,qCAAqC;;;;;;;AAQ3C,SAAgB,oBAAoB,aAA6B;AAK/D,QAAO,GAHL,mCAAmC,KAAK,YAAY,IACnD,YAAY,WAAW,SAAS,IAAIA,+CAA6B,MAAK,MAAK,YAAY,SAAS,EAAE,CAAC,GACzE,8BAA8B,8BACrCC,sCAAe,GAAG,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BzD,SAAgB,uBAAuB,MAAc,aAA8B;AACjF,KAAI,eAAe,gCAAgC,YAAY,CAC7D,QAAO;CAET,MAAM,WAAW,KAAK,aAAa,CAAC,QAAQ,SAAS,GAAG;AACxD,KAAI,CAAC,SACH,OAAM,IAAI,MAAM,0BAA0B;AAE5C,QAAO,oBAAoB,SAAS,WAAW;;;;;;;;;AAUjD,SAAS,6BAA6B,SAA0B;AAC9D,KAAI,CAAC,QAAQ,SAAS,IAAI,CACxB,QAAO;CAGT,MAAM,kBAAkB,QAAQ,MAAM,GAAG,GAAG;AAC5C,KAAI,gBAAgB,SAAS,IAAI,CAC/B,QAAO;AAGT,QAAO,gBAAgB,SAAS,IAAI;;;;;;;;;;;;;;;AAwBtC,SAAgB,oBACd,KACA,UAA0F,EAAE,EACrE;AACvB,OAAM,OAAO;AAEb,KAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE;AAClC,MAAI,QAAQ,SAAS,CAAC,IACpB,OAAM,IAAI,MACR,8NACD;AAEH,MAAI,QAAQ,SAAS,CAAC,iBAAiB,IAAI,CACzC,OAAM,IAAI,MAAM,6BAA6B;AAE/C,SAAO;;CAGT,MAAM,eAAe,IAAI,WAAW,4BAA4B,GAAG,eAAe;CAElF,IAAIC;AACJ,KAAI;AACF,uBAAqBC,sCAAe,IAAI,MAAM,IAAI,CAAC,GAAG;SAChD;AACN,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,mDAAmD;AAErE,SAAO;;AAGT,KAAI,CAAC,6BAA6B,mBAAmB,EAAE;AACrD,MAAI,QAAQ,MACV,OAAM,IAAI,MAAM,6DAA6D;AAE/E,SAAO;;CAGT,IAAI,cAAc,mBAAmB,MAAM,GAAG,GAAG;AAEjD,KAAI,QAAQ,SACV,eAAc,QAAQ;UACb,iBAAiB,iBAAiB,QAAQ,UAAU,QAAQ,YACrE,eAAc,SAAS,QAAQ;AAGjC,QAAO;EACL;EACA;EACD;;;;;;;;AASH,SAAgB,iBAAiB,MAAc,IAAI;AACjD,KAAI;AAGF,MAAI,EAFmB,IAAI,WAAW,4BAA4B,IAAI,IAAI,WAAW,4BAA4B,EAG/G,QAAO;EAGT,MAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,MAAI,MAAM,WAAW,EACnB,QAAO;EAGT,MAAM,cAAc,MAAM;AAC1B,MAAI,CAAC,YACH,QAAO;AAIT,SAAO,6BADSA,sCAAe,YAAY,CACC;SACtC;AACN,SAAO;;;;;;;;;AAUX,SAAgB,6BAA6B;CAC3C,MAAM,uCAAuB,IAAI,KAAsB;AAEvD,QAAO,EAOL,oBAAoB,QAA+B;AACjD,MAAI,CAAC,IACH,QAAO;EAGT,MAAM,WAAW,OAAO,QAAQ,WAAW,MAAM,IAAI;EACrD,IAAI,MAAM,qBAAqB,IAAI,SAAS;AAC5C,MAAI,QAAQ,QAAW;AACrB,SAAMC,0CAAwB,MAAK,MAAK,SAAS,SAAS,EAAE,CAAC;AAC7D,wBAAqB,IAAI,UAAU,IAAI;;AAEzC,SAAO;IAEV;;;;;;;;;AAUH,SAAgB,gCAAgC,QAAyB;AACvE,QAAO,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,WAAW;;;;;;;;;AAUpE,SAAgB,+BAA+B,QAAyB;AACtE,QAAO,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,WAAW;;;;;;;;;AAUpE,SAAgB,2BAA2B,QAAyB;AAClE,QAAO,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,WAAW;;;;;;;;;AAUpE,SAAgB,0BAA0B,QAAyB;AACjE,QAAO,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,WAAW;;;;;;;;;;AAWpE,eAAsB,gBACpB,gBACA,SAAuB,WAAW,OAAO,QACxB;CACjB,MAAM,OAAO,IAAI,aAAa,CAAC,OAAO,eAAe;CACrD,MAAM,SAAS,MAAM,OAAO,OAAO,SAAS,KAAK;AAGjD,QAAOH,sCAFc,OAAO,aAAa,GAAG,IAAI,WAAW,OAAO,CAAC,CAEhC,CAAC,QAAQ,QAAQ,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,UAAU,GAAG,EAAE;;;;;;;;;;AAW/F,MAAa,yBAAyB,YAAoB,iBAAiC;AACzF,QAAO,GAAG,WAAW,GAAG"}

package/dist/runtime/keys.d.mts

@@ -22,6 +22,31 @@ type ParsePublishableKeyOptions = {
  * @returns A base64-encoded publishable key with appropriate prefix (pk_live_ or pk_test_).
  */
 declare function buildPublishableKey(frontendApi: string): string;
+/**
+ * Derives a publishable key from the current hostname. Intended for multi-domain
+ * setups (e.g. custom domains on top of a default domain) where the correct key
+ * must be resolved per request.
+ *
+ * Pass the configured publishable key as `fallbackKey` so that development
+ * instances (pk_test_) are returned as-is instead of being incorrectly derived
+ * from the host (e.g. localhost).
+ *
+ * @example
+ * // React (use window.location.hostname, not window.location.host, to avoid including the port)
+ * <ClerkProvider publishableKey={publishableKeyFromHost(window.location.hostname, import.meta.env.VITE_CLERK_PUBLISHABLE_KEY)}>
+ *
+ * @example
+ * // Express (inside clerkMiddleware callback)
+ * // Validate req.hostname against a known allowlist before passing it in.
+ * // When `trust proxy` is enabled, req.hostname reads from X-Forwarded-Host
+ * // and can be spoofed if your proxy is not properly configured.
+ * const ALLOWED_HOSTS = ['domain-a.com', 'domain-b.com'];
+ * clerkMiddleware((req) => {
+ *   if (!ALLOWED_HOSTS.includes(req.hostname)) throw new Error('Unknown host');
+ *   return { publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY) };
+ * })
+ */
+declare function publishableKeyFromHost(host: string, fallbackKey?: string): string;
 declare function parsePublishableKey(key: string | undefined, options: ParsePublishableKeyOptions & {
   fatal: true;
 }): PublishableKey;
@@ -99,5 +124,5 @@ declare function getCookieSuffix(publishableKey: string, subtle?: SubtleCrypto):
  */
 declare const getSuffixedCookieName: (cookieName: string, cookieSuffix: string) => string;
 //#endregion
-export { buildPublishableKey, createDevOrStagingUrlCache, getCookieSuffix, getSuffixedCookieName, isDevelopmentFromPublishableKey, isDevelopmentFromSecretKey, isProductionFromPublishableKey, isProductionFromSecretKey, isPublishableKey, parsePublishableKey };
+export { buildPublishableKey, createDevOrStagingUrlCache, getCookieSuffix, getSuffixedCookieName, isDevelopmentFromPublishableKey, isDevelopmentFromSecretKey, isProductionFromPublishableKey, isProductionFromSecretKey, isPublishableKey, parsePublishableKey, publishableKeyFromHost };
 //# sourceMappingURL=keys.d.mts.map

package/dist/runtime/keys.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.mts","names":[],"sources":["../../src/keys.ts"],"sourcesContent":[],"mappings":";;;;;;;AAG8C,KAKzC,0BAAA,GAA0B;EA6Bf;EA4BA,KAAA,CAAA,EAAA,OAAA;EAIA;EA0EA,MAAA,CAAA,EAAA,MAAA;EA+BA;EAiCA,QAAA,CAAA,EAAA,MAAA;EAWA;EAWA,WAAA,CAAA,EAAA,OAAA;AAWhB,CAAA;AAYA;AAmBA;;;;;iBA1OgB,mBAAA;iBA4BA,mBAAA,mCAEL;;IACR;iBACa,mBAAA,oCAEJ,6BACT;;;;;;;iBAuEa,gBAAA;;;;;;;iBA+BA,0BAAA,CAAA;;;;;;;oCAUsB;;;;;;;;;iBAuBtB,+BAAA;;;;;;;;iBAWA,8BAAA;;;;;;;;iBAWA,0BAAA;;;;;;;;iBAWA,yBAAA;;;;;;;;;iBAYM,eAAA,kCAEZ,eACP;;;;;;;;;cAgBU"}
+{"version":3,"file":"keys.d.mts","names":[],"sources":["../../src/keys.ts"],"sourcesContent":[],"mappings":";;;;;;;AAG8C,KAKzC,0BAAA,GAA0B;EA6Bf;EAgCA,KAAA,CAAA,EAAA,OAAA;EA+BA;EAIA,MAAA,CAAA,EAAA,MAAA;EA0EA;EA+BA,QAAA,CAAA,EAAA,MAAA;EAiCA;EAWA,WAAA,CAAA,EAAA,OAAA;AAWhB,CAAA;AAWA;AAYA;AAmBA;;;;iBA7QgB,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;iBAgCA,sBAAA;iBA+BA,mBAAA,mCAEL;;IACR;iBACa,mBAAA,oCAEJ,6BACT;;;;;;;iBAuEa,gBAAA;;;;;;;iBA+BA,0BAAA,CAAA;;;;;;;oCAUsB;;;;;;;;;iBAuBtB,+BAAA;;;;;;;;iBAWA,8BAAA;;;;;;;;iBAWA,0BAAA;;;;;;;;iBAWA,yBAAA;;;;;;;;;iBAYM,eAAA,kCAEZ,eACP;;;;;;;;;cAgBU"}

package/dist/runtime/keys.d.ts

@@ -22,6 +22,31 @@ type ParsePublishableKeyOptions = {
  * @returns A base64-encoded publishable key with appropriate prefix (pk_live_ or pk_test_).
  */
 declare function buildPublishableKey(frontendApi: string): string;
+/**
+ * Derives a publishable key from the current hostname. Intended for multi-domain
+ * setups (e.g. custom domains on top of a default domain) where the correct key
+ * must be resolved per request.
+ *
+ * Pass the configured publishable key as `fallbackKey` so that development
+ * instances (pk_test_) are returned as-is instead of being incorrectly derived
+ * from the host (e.g. localhost).
+ *
+ * @example
+ * // React (use window.location.hostname, not window.location.host, to avoid including the port)
+ * <ClerkProvider publishableKey={publishableKeyFromHost(window.location.hostname, import.meta.env.VITE_CLERK_PUBLISHABLE_KEY)}>
+ *
+ * @example
+ * // Express (inside clerkMiddleware callback)
+ * // Validate req.hostname against a known allowlist before passing it in.
+ * // When `trust proxy` is enabled, req.hostname reads from X-Forwarded-Host
+ * // and can be spoofed if your proxy is not properly configured.
+ * const ALLOWED_HOSTS = ['domain-a.com', 'domain-b.com'];
+ * clerkMiddleware((req) => {
+ *   if (!ALLOWED_HOSTS.includes(req.hostname)) throw new Error('Unknown host');
+ *   return { publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY) };
+ * })
+ */
+declare function publishableKeyFromHost(host: string, fallbackKey?: string): string;
 declare function parsePublishableKey(key: string | undefined, options: ParsePublishableKeyOptions & {
   fatal: true;
 }): PublishableKey;
@@ -99,5 +124,5 @@ declare function getCookieSuffix(publishableKey: string, subtle?: SubtleCrypto):
  */
 declare const getSuffixedCookieName: (cookieName: string, cookieSuffix: string) => string;
 //#endregion
-export { buildPublishableKey, createDevOrStagingUrlCache, getCookieSuffix, getSuffixedCookieName, isDevelopmentFromPublishableKey, isDevelopmentFromSecretKey, isProductionFromPublishableKey, isProductionFromSecretKey, isPublishableKey, parsePublishableKey };
+export { buildPublishableKey, createDevOrStagingUrlCache, getCookieSuffix, getSuffixedCookieName, isDevelopmentFromPublishableKey, isDevelopmentFromSecretKey, isProductionFromPublishableKey, isProductionFromSecretKey, isPublishableKey, parsePublishableKey, publishableKeyFromHost };
 //# sourceMappingURL=keys.d.ts.map

package/dist/runtime/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","names":[],"sources":["../../src/keys.ts"],"sourcesContent":[],"mappings":";;;;;;;AAG8C,KAKzC,0BAAA,GAA0B;EA6Bf;EA4BA,KAAA,CAAA,EAAA,OAAA;EAIA;EA0EA,MAAA,CAAA,EAAA,MAAA;EA+BA;EAiCA,QAAA,CAAA,EAAA,MAAA;EAWA;EAWA,WAAA,CAAA,EAAA,OAAA;AAWhB,CAAA;AAYA;AAmBA;;;;;iBA1OgB,mBAAA;iBA4BA,mBAAA,mCAEL;;IACR;iBACa,mBAAA,oCAEJ,6BACT;;;;;;;iBAuEa,gBAAA;;;;;;;iBA+BA,0BAAA,CAAA;;;;;;;oCAUsB;;;;;;;;;iBAuBtB,+BAAA;;;;;;;;iBAWA,8BAAA;;;;;;;;iBAWA,0BAAA;;;;;;;;iBAWA,yBAAA;;;;;;;;;iBAYM,eAAA,kCAEZ,eACP;;;;;;;;;cAgBU"}
+{"version":3,"file":"keys.d.ts","names":[],"sources":["../../src/keys.ts"],"sourcesContent":[],"mappings":";;;;;;;AAG8C,KAKzC,0BAAA,GAA0B;EA6Bf;EAgCA,KAAA,CAAA,EAAA,OAAA;EA+BA;EAIA,MAAA,CAAA,EAAA,MAAA;EA0EA;EA+BA,QAAA,CAAA,EAAA,MAAA;EAiCA;EAWA,WAAA,CAAA,EAAA,OAAA;AAWhB,CAAA;AAWA;AAYA;AAmBA;;;;iBA7QgB,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;iBAgCA,sBAAA;iBA+BA,mBAAA,mCAEL;;IACR;iBACa,mBAAA,oCAEJ,6BACT;;;;;;;iBAuEa,gBAAA;;;;;;;iBA+BA,0BAAA,CAAA;;;;;;;oCAUsB;;;;;;;;;iBAuBtB,+BAAA;;;;;;;;iBAWA,8BAAA;;;;;;;;iBAWA,0BAAA;;;;;;;;iBAWA,yBAAA;;;;;;;;;iBAYM,eAAA,kCAEZ,eACP;;;;;;;;;cAgBU"}

package/dist/runtime/keys.js

@@ -1,7 +1,7 @@
 require('./constants-WYhx_umW.js');
 require('./isomorphicAtob-Hkpnx2p8.js');
 require('./isomorphicBtoa-_pSA92Q9.js');
-const require_keys = require('./keys-BI9hmfja.js');
+const require_keys = require('./keys-D5ahg2Gn.js');
 
 exports.buildPublishableKey = require_keys.buildPublishableKey;
 exports.createDevOrStagingUrlCache = require_keys.createDevOrStagingUrlCache;
@@ -12,4 +12,5 @@ exports.isDevelopmentFromSecretKey = require_keys.isDevelopmentFromSecretKey;
 exports.isProductionFromPublishableKey = require_keys.isProductionFromPublishableKey;
 exports.isProductionFromSecretKey = require_keys.isProductionFromSecretKey;
 exports.isPublishableKey = require_keys.isPublishableKey;
-exports.parsePublishableKey = require_keys.parsePublishableKey;
+exports.parsePublishableKey = require_keys.parsePublishableKey;
+exports.publishableKeyFromHost = require_keys.publishableKeyFromHost;

package/dist/runtime/keys.mjs

@@ -1,6 +1,6 @@
 import "./constants-Bta24VLk.mjs";
 import "./isomorphicAtob-CoF80qYz.mjs";
 import "./isomorphicBtoa-DWmLcIHi.mjs";
-import { a as isDevelopmentFromPublishableKey, c as isProductionFromSecretKey, i as getSuffixedCookieName, l as isPublishableKey, n as createDevOrStagingUrlCache, o as isDevelopmentFromSecretKey, r as getCookieSuffix, s as isProductionFromPublishableKey, t as buildPublishableKey, u as parsePublishableKey } from "./keys-DuxzP8MU.mjs";
+import { a as isDevelopmentFromPublishableKey, c as isProductionFromSecretKey, d as publishableKeyFromHost, i as getSuffixedCookieName, l as isPublishableKey, n as createDevOrStagingUrlCache, o as isDevelopmentFromSecretKey, r as getCookieSuffix, s as isProductionFromPublishableKey, t as buildPublishableKey, u as parsePublishableKey } from "./keys-BeVKH43u.mjs";
 
-export { buildPublishableKey, createDevOrStagingUrlCache, getCookieSuffix, getSuffixedCookieName, isDevelopmentFromPublishableKey, isDevelopmentFromSecretKey, isProductionFromPublishableKey, isProductionFromSecretKey, isPublishableKey, parsePublishableKey };
+export { buildPublishableKey, createDevOrStagingUrlCache, getCookieSuffix, getSuffixedCookieName, isDevelopmentFromPublishableKey, isDevelopmentFromSecretKey, isProductionFromPublishableKey, isProductionFromSecretKey, isPublishableKey, parsePublishableKey, publishableKeyFromHost };

package/dist/runtime/loadClerkJsScript.js

@@ -1,7 +1,7 @@
 require('./constants-WYhx_umW.js');
 require('./isomorphicAtob-Hkpnx2p8.js');
 require('./isomorphicBtoa-_pSA92Q9.js');
-const require_keys = require('./keys-BI9hmfja.js');
+const require_keys = require('./keys-D5ahg2Gn.js');
 const require_clerkRuntimeError = require('./clerkRuntimeError-CaS4sM5w.js');
 const require_error = require('./error-BkPoOeMv.js');
 require('./retry-DGCmqlcR.js');
@@ -9,7 +9,7 @@ const require_loadScript = require('./loadScript-BnB9d_IW.js');
 const require_proxy = require('./proxy-DahrnOq8.js');
 require('./instance-C1LlVxIp.js');
 const require_url = require('./url-sAcxbiir.js');
-const require_versionSelector = require('./versionSelector-CY7koW8Z.js');
+const require_versionSelector = require('./versionSelector-C1hK82gB.js');
 
 //#region src/loadClerkJsScript.ts
 const { isDevOrStagingUrl } = require_keys.createDevOrStagingUrlCache();
@@ -146,7 +146,7 @@ const clerkUIScriptUrl = (opts) => {
 		publishableKey,
 		proxyUrl,
 		domain
-	})}/npm/@clerk/ui@${require_versionSelector.versionSelector(__internal_clerkUIVersion, "1.6.5-snapshot.v20260423044224")}/dist/ui.browser.js`;
+	})}/npm/@clerk/ui@${require_versionSelector.versionSelector(__internal_clerkUIVersion, "1.6.6")}/dist/ui.browser.js`;
 };
 const buildClerkJSScriptAttributes = (options) => {
 	const obj = {};

package/dist/runtime/loadClerkJsScript.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadClerkJsScript.js","names":["createDevOrStagingUrlCache","buildErrorThrower","ClerkRuntimeError","versionSelector","obj: Record<string, string>","isValidProxyUrl","proxyUrlToAbsoluteURL","parsePublishableKey","addClerkPrefix","timeoutId","pollInterval"],"sources":["../../src/loadClerkJsScript.ts"],"sourcesContent":["import { buildErrorThrower, ClerkRuntimeError } from './error';\nimport { createDevOrStagingUrlCache, parsePublishableKey } from './keys';\nimport { loadScript } from './loadScript';\nimport { isValidProxyUrl, proxyUrlToAbsoluteURL } from './proxy';\nimport type { SDKMetadata } from './types';\nimport { addClerkPrefix } from './url';\nimport { versionSelector } from './versionSelector';\n\nconst { isDevOrStagingUrl } = createDevOrStagingUrlCache();\n\nconst errorThrower = buildErrorThrower({ packageName: '@clerk/shared' });\n\nexport type LoadClerkJSScriptOptions = {\n  publishableKey: string;\n  /** @internal */\n  __internal_clerkJSUrl?: string;\n  /** @internal */\n  __internal_clerkJSVersion?: string;\n  sdkMetadata?: SDKMetadata;\n  proxyUrl?: string;\n  domain?: string;\n  nonce?: string;\n  /**\n   * Timeout in milliseconds to wait for clerk-js to load before considering it failed.\n   *\n   * @default 15000 (15 seconds)\n   */\n  scriptLoadTimeout?: number;\n};\n\n/**\n * @deprecated Use `LoadClerkJSScriptOptions` instead. This alias will be removed in a future major version.\n */\nexport type LoadClerkJsScriptOptions = LoadClerkJSScriptOptions;\n\nexport type LoadClerkUIScriptOptions = {\n  publishableKey: string;\n  /** @internal */\n  __internal_clerkUIUrl?: string;\n  /** @internal */\n  __internal_clerkUIVersion?: string;\n  proxyUrl?: string;\n  domain?: string;\n  nonce?: string;\n  scriptLoadTimeout?: number;\n};\n\n/**\n * Validates that window.Clerk exists and is properly initialized.\n * This ensures we don't have false positives where the script loads but Clerk is malformed.\n *\n * @returns `true` if window.Clerk exists and has the expected structure with a load method.\n */\nfunction isClerkGlobalProperlyLoaded(prop: 'Clerk' | '__internal_ClerkUICtor'): boolean {\n  if (typeof window === 'undefined' || !(window as any)[prop]) {\n    return false;\n  }\n\n  // Basic validation that window.Clerk has the expected structure\n  const val = (window as any)[prop];\n  return !!val;\n}\nconst isClerkProperlyLoaded = () => isClerkGlobalProperlyLoaded('Clerk');\nconst isClerkUIProperlyLoaded = () => isClerkGlobalProperlyLoaded('__internal_ClerkUICtor');\n\n/**\n * Checks if an existing script has a request error using Performance API.\n *\n * @param scriptUrl - The URL of the script to check.\n * @returns True if the script has failed to load due to a network/HTTP error.\n */\nfunction hasScriptRequestError(scriptUrl: string): boolean {\n  if (typeof window === 'undefined' || !window.performance) {\n    return false;\n  }\n\n  const entries = performance.getEntriesByName(scriptUrl, 'resource') as PerformanceResourceTiming[];\n\n  if (entries.length === 0) {\n    return false;\n  }\n\n  const scriptEntry = entries[entries.length - 1];\n\n  // transferSize === 0 with responseEnd === 0 indicates network failure\n  // transferSize === 0 with responseEnd > 0 might be a 4xx/5xx error or blocked request\n  if (scriptEntry.transferSize === 0 && scriptEntry.decodedBodySize === 0) {\n    // If there was no response at all, it's definitely an error\n    if (scriptEntry.responseEnd === 0) {\n      return true;\n    }\n    // If we got a response but no content, likely an HTTP error (4xx/5xx)\n    if (scriptEntry.responseEnd > 0 && scriptEntry.responseStart > 0) {\n      return true;\n    }\n\n    if ('responseStatus' in scriptEntry) {\n      const status = (scriptEntry as any).responseStatus;\n      if (status >= 400) {\n        return true;\n      }\n      if (scriptEntry.responseStatus === 0) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n}\n\n/**\n * Hotloads the Clerk JS script with robust failure detection.\n *\n * Uses a timeout-based approach to ensure absolute certainty about load success/failure.\n * If the script fails to load within the timeout period, or loads but doesn't create\n * a proper Clerk instance, the promise rejects with an error.\n *\n * @param opts - The options used to build the Clerk JS script URL and load the script.\n *               Must include a `publishableKey` if no existing script is found.\n * @returns Promise that resolves with null if Clerk loads successfully, or rejects with an error.\n *\n * @example\n * ```typescript\n * try {\n *   await loadClerkJsScript({ publishableKey: 'pk_test_...' });\n *   console.log('Clerk loaded successfully');\n * } catch (error) {\n *   console.error('Failed to load Clerk:', error.message);\n * }\n * ```\n */\nexport const loadClerkJSScript = async (opts?: LoadClerkJSScriptOptions): Promise<HTMLScriptElement | null> => {\n  const timeout = opts?.scriptLoadTimeout ?? 15000;\n  const rejectWith = (error?: Error) =>\n    new ClerkRuntimeError('Failed to load Clerk JS' + (error?.message ? `, ${error.message}` : ''), {\n      code: 'failed_to_load_clerk_js',\n      cause: error,\n    });\n\n  if (isClerkProperlyLoaded()) {\n    return null;\n  }\n\n  if (!opts?.publishableKey) {\n    errorThrower.throwMissingPublishableKeyError();\n    return null;\n  }\n\n  const scriptUrl = clerkJSScriptUrl(opts);\n  const existingScript = document.querySelector<HTMLScriptElement>('script[data-clerk-js-script]');\n\n  if (existingScript) {\n    if (hasScriptRequestError(scriptUrl)) {\n      existingScript.remove();\n    } else {\n      try {\n        await waitForPredicateWithTimeout(timeout, isClerkProperlyLoaded, rejectWith(), existingScript);\n        return null;\n      } catch {\n        existingScript.remove();\n      }\n    }\n  }\n\n  const loadPromise = waitForPredicateWithTimeout(timeout, isClerkProperlyLoaded, rejectWith());\n\n  loadScript(scriptUrl, {\n    async: true,\n    crossOrigin: 'anonymous',\n    nonce: opts.nonce,\n    beforeLoad: applyAttributesToScript(buildClerkJSScriptAttributes(opts)),\n  }).catch(error => {\n    throw rejectWith(error);\n  });\n\n  return loadPromise;\n};\n\nexport const loadClerkUIScript = async (opts?: LoadClerkUIScriptOptions): Promise<HTMLScriptElement | null> => {\n  const timeout = opts?.scriptLoadTimeout ?? 15000;\n  const rejectWith = (error?: Error) =>\n    new ClerkRuntimeError('Failed to load Clerk UI' + (error?.message ? `, ${error.message}` : ''), {\n      code: 'failed_to_load_clerk_ui',\n      cause: error,\n    });\n\n  if (isClerkUIProperlyLoaded()) {\n    return null;\n  }\n\n  if (!opts?.publishableKey) {\n    errorThrower.throwMissingPublishableKeyError();\n    return null;\n  }\n\n  const scriptUrl = clerkUIScriptUrl(opts);\n  const existingScript = document.querySelector<HTMLScriptElement>('script[data-clerk-ui-script]');\n\n  if (existingScript) {\n    if (hasScriptRequestError(scriptUrl)) {\n      existingScript.remove();\n    } else {\n      try {\n        await waitForPredicateWithTimeout(timeout, isClerkUIProperlyLoaded, rejectWith(), existingScript);\n        return null;\n      } catch {\n        existingScript.remove();\n      }\n    }\n  }\n\n  const loadPromise = waitForPredicateWithTimeout(timeout, isClerkUIProperlyLoaded, rejectWith());\n\n  loadScript(scriptUrl, {\n    async: true,\n    crossOrigin: 'anonymous',\n    nonce: opts.nonce,\n    beforeLoad: applyAttributesToScript(buildClerkUIScriptAttributes(opts)),\n  }).catch(error => {\n    throw rejectWith(error);\n  });\n\n  return loadPromise;\n};\n\nexport const clerkJSScriptUrl = (opts: LoadClerkJSScriptOptions) => {\n  const { __internal_clerkJSUrl, __internal_clerkJSVersion, proxyUrl, domain, publishableKey } = opts;\n\n  if (__internal_clerkJSUrl) {\n    return __internal_clerkJSUrl;\n  }\n\n  const scriptHost = buildScriptHost({ publishableKey, proxyUrl, domain });\n  const version = versionSelector(__internal_clerkJSVersion);\n  return `https://${scriptHost}/npm/@clerk/clerk-js@${version}/dist/clerk.browser.js`;\n};\n\nexport const clerkUIScriptUrl = (opts: LoadClerkUIScriptOptions) => {\n  const { __internal_clerkUIUrl, __internal_clerkUIVersion, proxyUrl, domain, publishableKey } = opts;\n\n  if (__internal_clerkUIUrl) {\n    return __internal_clerkUIUrl;\n  }\n\n  const scriptHost = buildScriptHost({ publishableKey, proxyUrl, domain });\n  const version = versionSelector(__internal_clerkUIVersion, UI_PACKAGE_VERSION);\n  return `https://${scriptHost}/npm/@clerk/ui@${version}/dist/ui.browser.js`;\n};\n\nexport const buildClerkJSScriptAttributes = (options: LoadClerkJSScriptOptions) => {\n  const obj: Record<string, string> = {};\n\n  if (options.publishableKey) {\n    obj['data-clerk-publishable-key'] = options.publishableKey;\n  }\n\n  if (options.proxyUrl) {\n    obj['data-clerk-proxy-url'] = options.proxyUrl;\n  }\n\n  if (options.domain) {\n    obj['data-clerk-domain'] = options.domain;\n  }\n\n  if (options.nonce) {\n    obj.nonce = options.nonce;\n  }\n\n  return obj;\n};\n\nexport const buildClerkUIScriptAttributes = (options: LoadClerkUIScriptOptions) => {\n  // TODO @nikos do we need this?\n  return buildClerkJSScriptAttributes(options);\n};\n\nconst applyAttributesToScript = (attributes: Record<string, string>) => (script: HTMLScriptElement) => {\n  for (const attribute in attributes) {\n    script.setAttribute(attribute, attributes[attribute]);\n  }\n};\n\nexport const buildScriptHost = (opts: { publishableKey: string; proxyUrl?: string; domain?: string }) => {\n  const { proxyUrl, domain, publishableKey } = opts;\n\n  if (!!proxyUrl && isValidProxyUrl(proxyUrl)) {\n    return proxyUrlToAbsoluteURL(proxyUrl).replace(/http(s)?:\\/\\//, '');\n  } else if (domain && !isDevOrStagingUrl(parsePublishableKey(publishableKey)?.frontendApi || '')) {\n    return addClerkPrefix(domain);\n  } else {\n    return parsePublishableKey(publishableKey)?.frontendApi || '';\n  }\n};\n\nfunction waitForPredicateWithTimeout(\n  timeoutMs: number,\n  predicate: () => boolean,\n  rejectWith: Error,\n  existingScript?: HTMLScriptElement,\n): Promise<HTMLScriptElement | null> {\n  return new Promise((resolve, reject) => {\n    let resolved = false;\n\n    const cleanup = (timeoutId: ReturnType<typeof setTimeout>, pollInterval: ReturnType<typeof setInterval>) => {\n      clearTimeout(timeoutId);\n      clearInterval(pollInterval);\n    };\n\n    // Bail out early if the script fails to load, instead of waiting for the entire timeout\n    existingScript?.addEventListener('error', () => {\n      cleanup(timeoutId, pollInterval);\n      reject(rejectWith);\n    });\n\n    const checkAndResolve = () => {\n      if (resolved) {\n        return;\n      }\n\n      if (predicate()) {\n        resolved = true;\n        cleanup(timeoutId, pollInterval);\n        resolve(null);\n      }\n    };\n\n    const handleTimeout = () => {\n      if (resolved) {\n        return;\n      }\n\n      resolved = true;\n      cleanup(timeoutId, pollInterval);\n\n      if (!predicate()) {\n        reject(rejectWith);\n      } else {\n        resolve(null);\n      }\n    };\n\n    const timeoutId = setTimeout(handleTimeout, timeoutMs);\n\n    checkAndResolve();\n\n    const pollInterval = setInterval(() => {\n      if (resolved) {\n        clearInterval(pollInterval);\n        return;\n      }\n      checkAndResolve();\n    }, 100);\n  });\n}\n\nexport function setClerkJSLoadingErrorPackageName(packageName: string) {\n  errorThrower.setPackageName({ packageName });\n}\n\n/**\n * @deprecated Use `loadClerkJSScript` instead. This alias will be removed in a future major version.\n */\nexport const loadClerkJsScript = loadClerkJSScript;\n\n/**\n * @deprecated Use `clerkJSScriptUrl` instead. This alias will be removed in a future major version.\n */\nexport const clerkJsScriptUrl = clerkJSScriptUrl;\n\n/**\n * @deprecated Use `buildClerkJSScriptAttributes` instead. This alias will be removed in a future major version.\n */\nexport const buildClerkJsScriptAttributes = buildClerkJSScriptAttributes;\n\n/**\n * @deprecated Use `setClerkJSLoadingErrorPackageName` instead. This alias will be removed in a future major version.\n */\nexport const setClerkJsLoadingErrorPackageName = setClerkJSLoadingErrorPackageName;\n"],"mappings":";;;;;;;;;;;;;;AAQA,MAAM,EAAE,sBAAsBA,yCAA4B;AAE1D,MAAM,eAAeC,gCAAkB,EAAE,aAAa,iBAAiB,CAAC;;;;;;;AA2CxE,SAAS,4BAA4B,MAAmD;AACtF,KAAI,OAAO,WAAW,eAAe,CAAE,OAAe,MACpD,QAAO;AAKT,QAAO,CAAC,CADK,OAAe;;AAG9B,MAAM,8BAA8B,4BAA4B,QAAQ;AACxE,MAAM,gCAAgC,4BAA4B,yBAAyB;;;;;;;AAQ3F,SAAS,sBAAsB,WAA4B;AACzD,KAAI,OAAO,WAAW,eAAe,CAAC,OAAO,YAC3C,QAAO;CAGT,MAAM,UAAU,YAAY,iBAAiB,WAAW,WAAW;AAEnE,KAAI,QAAQ,WAAW,EACrB,QAAO;CAGT,MAAM,cAAc,QAAQ,QAAQ,SAAS;AAI7C,KAAI,YAAY,iBAAiB,KAAK,YAAY,oBAAoB,GAAG;AAEvE,MAAI,YAAY,gBAAgB,EAC9B,QAAO;AAGT,MAAI,YAAY,cAAc,KAAK,YAAY,gBAAgB,EAC7D,QAAO;AAGT,MAAI,oBAAoB,aAAa;AAEnC,OADgB,YAAoB,kBACtB,IACZ,QAAO;AAET,OAAI,YAAY,mBAAmB,EACjC,QAAO;;;AAKb,QAAO;;;;;;;;;;;;;;;;;;;;;;;AAwBT,MAAa,oBAAoB,OAAO,SAAuE;CAC7G,MAAM,UAAU,MAAM,qBAAqB;CAC3C,MAAM,cAAc,UAClB,IAAIC,4CAAkB,6BAA6B,OAAO,UAAU,KAAK,MAAM,YAAY,KAAK;EAC9F,MAAM;EACN,OAAO;EACR,CAAC;AAEJ,KAAI,uBAAuB,CACzB,QAAO;AAGT,KAAI,CAAC,MAAM,gBAAgB;AACzB,eAAa,iCAAiC;AAC9C,SAAO;;CAGT,MAAM,YAAY,iBAAiB,KAAK;CACxC,MAAM,iBAAiB,SAAS,cAAiC,+BAA+B;AAEhG,KAAI,eACF,KAAI,sBAAsB,UAAU,CAClC,gBAAe,QAAQ;KAEvB,KAAI;AACF,QAAM,4BAA4B,SAAS,uBAAuB,YAAY,EAAE,eAAe;AAC/F,SAAO;SACD;AACN,iBAAe,QAAQ;;CAK7B,MAAM,cAAc,4BAA4B,SAAS,uBAAuB,YAAY,CAAC;AAE7F,+BAAW,WAAW;EACpB,OAAO;EACP,aAAa;EACb,OAAO,KAAK;EACZ,YAAY,wBAAwB,6BAA6B,KAAK,CAAC;EACxE,CAAC,CAAC,OAAM,UAAS;AAChB,QAAM,WAAW,MAAM;GACvB;AAEF,QAAO;;AAGT,MAAa,oBAAoB,OAAO,SAAuE;CAC7G,MAAM,UAAU,MAAM,qBAAqB;CAC3C,MAAM,cAAc,UAClB,IAAIA,4CAAkB,6BAA6B,OAAO,UAAU,KAAK,MAAM,YAAY,KAAK;EAC9F,MAAM;EACN,OAAO;EACR,CAAC;AAEJ,KAAI,yBAAyB,CAC3B,QAAO;AAGT,KAAI,CAAC,MAAM,gBAAgB;AACzB,eAAa,iCAAiC;AAC9C,SAAO;;CAGT,MAAM,YAAY,iBAAiB,KAAK;CACxC,MAAM,iBAAiB,SAAS,cAAiC,+BAA+B;AAEhG,KAAI,eACF,KAAI,sBAAsB,UAAU,CAClC,gBAAe,QAAQ;KAEvB,KAAI;AACF,QAAM,4BAA4B,SAAS,yBAAyB,YAAY,EAAE,eAAe;AACjG,SAAO;SACD;AACN,iBAAe,QAAQ;;CAK7B,MAAM,cAAc,4BAA4B,SAAS,yBAAyB,YAAY,CAAC;AAE/F,+BAAW,WAAW;EACpB,OAAO;EACP,aAAa;EACb,OAAO,KAAK;EACZ,YAAY,wBAAwB,6BAA6B,KAAK,CAAC;EACxE,CAAC,CAAC,OAAM,UAAS;AAChB,QAAM,WAAW,MAAM;GACvB;AAEF,QAAO;;AAGT,MAAa,oBAAoB,SAAmC;CAClE,MAAM,EAAE,uBAAuB,2BAA2B,UAAU,QAAQ,mBAAmB;AAE/F,KAAI,sBACF,QAAO;AAKT,QAAO,WAFY,gBAAgB;EAAE;EAAgB;EAAU;EAAQ,CAAC,CAE3C,uBADbC,wCAAgB,0BAA0B,CACE;;AAG9D,MAAa,oBAAoB,SAAmC;CAClE,MAAM,EAAE,uBAAuB,2BAA2B,UAAU,QAAQ,mBAAmB;AAE/F,KAAI,sBACF,QAAO;AAKT,QAAO,WAFY,gBAAgB;EAAE;EAAgB;EAAU;EAAQ,CAAC,CAE3C,iBADbA,wCAAgB,4DAA8C,CACxB;;AAGxD,MAAa,gCAAgC,YAAsC;CACjF,MAAMC,MAA8B,EAAE;AAEtC,KAAI,QAAQ,eACV,KAAI,gCAAgC,QAAQ;AAG9C,KAAI,QAAQ,SACV,KAAI,0BAA0B,QAAQ;AAGxC,KAAI,QAAQ,OACV,KAAI,uBAAuB,QAAQ;AAGrC,KAAI,QAAQ,MACV,KAAI,QAAQ,QAAQ;AAGtB,QAAO;;AAGT,MAAa,gCAAgC,YAAsC;AAEjF,QAAO,6BAA6B,QAAQ;;AAG9C,MAAM,2BAA2B,gBAAwC,WAA8B;AACrG,MAAK,MAAM,aAAa,WACtB,QAAO,aAAa,WAAW,WAAW,WAAW;;AAIzD,MAAa,mBAAmB,SAAyE;CACvG,MAAM,EAAE,UAAU,QAAQ,mBAAmB;AAE7C,KAAI,CAAC,CAAC,YAAYC,8BAAgB,SAAS,CACzC,QAAOC,oCAAsB,SAAS,CAAC,QAAQ,iBAAiB,GAAG;UAC1D,UAAU,CAAC,kBAAkBC,iCAAoB,eAAe,EAAE,eAAe,GAAG,CAC7F,QAAOC,2BAAe,OAAO;KAE7B,QAAOD,iCAAoB,eAAe,EAAE,eAAe;;AAI/D,SAAS,4BACP,WACA,WACA,YACA,gBACmC;AACnC,QAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,WAAW;EAEf,MAAM,WAAW,aAA0C,mBAAiD;AAC1G,gBAAaE,YAAU;AACvB,iBAAcC,eAAa;;AAI7B,kBAAgB,iBAAiB,eAAe;AAC9C,WAAQ,WAAW,aAAa;AAChC,UAAO,WAAW;IAClB;EAEF,MAAM,wBAAwB;AAC5B,OAAI,SACF;AAGF,OAAI,WAAW,EAAE;AACf,eAAW;AACX,YAAQ,WAAW,aAAa;AAChC,YAAQ,KAAK;;;EAIjB,MAAM,sBAAsB;AAC1B,OAAI,SACF;AAGF,cAAW;AACX,WAAQ,WAAW,aAAa;AAEhC,OAAI,CAAC,WAAW,CACd,QAAO,WAAW;OAElB,SAAQ,KAAK;;EAIjB,MAAM,YAAY,WAAW,eAAe,UAAU;AAEtD,mBAAiB;EAEjB,MAAM,eAAe,kBAAkB;AACrC,OAAI,UAAU;AACZ,kBAAc,aAAa;AAC3B;;AAEF,oBAAiB;KAChB,IAAI;GACP;;AAGJ,SAAgB,kCAAkC,aAAqB;AACrE,cAAa,eAAe,EAAE,aAAa,CAAC;;;;;AAM9C,MAAa,oBAAoB;;;;AAKjC,MAAa,mBAAmB;;;;AAKhC,MAAa,+BAA+B;;;;AAK5C,MAAa,oCAAoC"}
+{"version":3,"file":"loadClerkJsScript.js","names":["createDevOrStagingUrlCache","buildErrorThrower","ClerkRuntimeError","versionSelector","obj: Record<string, string>","isValidProxyUrl","proxyUrlToAbsoluteURL","parsePublishableKey","addClerkPrefix","timeoutId","pollInterval"],"sources":["../../src/loadClerkJsScript.ts"],"sourcesContent":["import { buildErrorThrower, ClerkRuntimeError } from './error';\nimport { createDevOrStagingUrlCache, parsePublishableKey } from './keys';\nimport { loadScript } from './loadScript';\nimport { isValidProxyUrl, proxyUrlToAbsoluteURL } from './proxy';\nimport type { SDKMetadata } from './types';\nimport { addClerkPrefix } from './url';\nimport { versionSelector } from './versionSelector';\n\nconst { isDevOrStagingUrl } = createDevOrStagingUrlCache();\n\nconst errorThrower = buildErrorThrower({ packageName: '@clerk/shared' });\n\nexport type LoadClerkJSScriptOptions = {\n  publishableKey: string;\n  /** @internal */\n  __internal_clerkJSUrl?: string;\n  /** @internal */\n  __internal_clerkJSVersion?: string;\n  sdkMetadata?: SDKMetadata;\n  proxyUrl?: string;\n  domain?: string;\n  nonce?: string;\n  /**\n   * Timeout in milliseconds to wait for clerk-js to load before considering it failed.\n   *\n   * @default 15000 (15 seconds)\n   */\n  scriptLoadTimeout?: number;\n};\n\n/**\n * @deprecated Use `LoadClerkJSScriptOptions` instead. This alias will be removed in a future major version.\n */\nexport type LoadClerkJsScriptOptions = LoadClerkJSScriptOptions;\n\nexport type LoadClerkUIScriptOptions = {\n  publishableKey: string;\n  /** @internal */\n  __internal_clerkUIUrl?: string;\n  /** @internal */\n  __internal_clerkUIVersion?: string;\n  proxyUrl?: string;\n  domain?: string;\n  nonce?: string;\n  scriptLoadTimeout?: number;\n};\n\n/**\n * Validates that window.Clerk exists and is properly initialized.\n * This ensures we don't have false positives where the script loads but Clerk is malformed.\n *\n * @returns `true` if window.Clerk exists and has the expected structure with a load method.\n */\nfunction isClerkGlobalProperlyLoaded(prop: 'Clerk' | '__internal_ClerkUICtor'): boolean {\n  if (typeof window === 'undefined' || !(window as any)[prop]) {\n    return false;\n  }\n\n  // Basic validation that window.Clerk has the expected structure\n  const val = (window as any)[prop];\n  return !!val;\n}\nconst isClerkProperlyLoaded = () => isClerkGlobalProperlyLoaded('Clerk');\nconst isClerkUIProperlyLoaded = () => isClerkGlobalProperlyLoaded('__internal_ClerkUICtor');\n\n/**\n * Checks if an existing script has a request error using Performance API.\n *\n * @param scriptUrl - The URL of the script to check.\n * @returns True if the script has failed to load due to a network/HTTP error.\n */\nfunction hasScriptRequestError(scriptUrl: string): boolean {\n  if (typeof window === 'undefined' || !window.performance) {\n    return false;\n  }\n\n  const entries = performance.getEntriesByName(scriptUrl, 'resource') as PerformanceResourceTiming[];\n\n  if (entries.length === 0) {\n    return false;\n  }\n\n  const scriptEntry = entries[entries.length - 1];\n\n  // transferSize === 0 with responseEnd === 0 indicates network failure\n  // transferSize === 0 with responseEnd > 0 might be a 4xx/5xx error or blocked request\n  if (scriptEntry.transferSize === 0 && scriptEntry.decodedBodySize === 0) {\n    // If there was no response at all, it's definitely an error\n    if (scriptEntry.responseEnd === 0) {\n      return true;\n    }\n    // If we got a response but no content, likely an HTTP error (4xx/5xx)\n    if (scriptEntry.responseEnd > 0 && scriptEntry.responseStart > 0) {\n      return true;\n    }\n\n    if ('responseStatus' in scriptEntry) {\n      const status = (scriptEntry as any).responseStatus;\n      if (status >= 400) {\n        return true;\n      }\n      if (scriptEntry.responseStatus === 0) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n}\n\n/**\n * Hotloads the Clerk JS script with robust failure detection.\n *\n * Uses a timeout-based approach to ensure absolute certainty about load success/failure.\n * If the script fails to load within the timeout period, or loads but doesn't create\n * a proper Clerk instance, the promise rejects with an error.\n *\n * @param opts - The options used to build the Clerk JS script URL and load the script.\n *               Must include a `publishableKey` if no existing script is found.\n * @returns Promise that resolves with null if Clerk loads successfully, or rejects with an error.\n *\n * @example\n * ```typescript\n * try {\n *   await loadClerkJsScript({ publishableKey: 'pk_test_...' });\n *   console.log('Clerk loaded successfully');\n * } catch (error) {\n *   console.error('Failed to load Clerk:', error.message);\n * }\n * ```\n */\nexport const loadClerkJSScript = async (opts?: LoadClerkJSScriptOptions): Promise<HTMLScriptElement | null> => {\n  const timeout = opts?.scriptLoadTimeout ?? 15000;\n  const rejectWith = (error?: Error) =>\n    new ClerkRuntimeError('Failed to load Clerk JS' + (error?.message ? `, ${error.message}` : ''), {\n      code: 'failed_to_load_clerk_js',\n      cause: error,\n    });\n\n  if (isClerkProperlyLoaded()) {\n    return null;\n  }\n\n  if (!opts?.publishableKey) {\n    errorThrower.throwMissingPublishableKeyError();\n    return null;\n  }\n\n  const scriptUrl = clerkJSScriptUrl(opts);\n  const existingScript = document.querySelector<HTMLScriptElement>('script[data-clerk-js-script]');\n\n  if (existingScript) {\n    if (hasScriptRequestError(scriptUrl)) {\n      existingScript.remove();\n    } else {\n      try {\n        await waitForPredicateWithTimeout(timeout, isClerkProperlyLoaded, rejectWith(), existingScript);\n        return null;\n      } catch {\n        existingScript.remove();\n      }\n    }\n  }\n\n  const loadPromise = waitForPredicateWithTimeout(timeout, isClerkProperlyLoaded, rejectWith());\n\n  loadScript(scriptUrl, {\n    async: true,\n    crossOrigin: 'anonymous',\n    nonce: opts.nonce,\n    beforeLoad: applyAttributesToScript(buildClerkJSScriptAttributes(opts)),\n  }).catch(error => {\n    throw rejectWith(error);\n  });\n\n  return loadPromise;\n};\n\nexport const loadClerkUIScript = async (opts?: LoadClerkUIScriptOptions): Promise<HTMLScriptElement | null> => {\n  const timeout = opts?.scriptLoadTimeout ?? 15000;\n  const rejectWith = (error?: Error) =>\n    new ClerkRuntimeError('Failed to load Clerk UI' + (error?.message ? `, ${error.message}` : ''), {\n      code: 'failed_to_load_clerk_ui',\n      cause: error,\n    });\n\n  if (isClerkUIProperlyLoaded()) {\n    return null;\n  }\n\n  if (!opts?.publishableKey) {\n    errorThrower.throwMissingPublishableKeyError();\n    return null;\n  }\n\n  const scriptUrl = clerkUIScriptUrl(opts);\n  const existingScript = document.querySelector<HTMLScriptElement>('script[data-clerk-ui-script]');\n\n  if (existingScript) {\n    if (hasScriptRequestError(scriptUrl)) {\n      existingScript.remove();\n    } else {\n      try {\n        await waitForPredicateWithTimeout(timeout, isClerkUIProperlyLoaded, rejectWith(), existingScript);\n        return null;\n      } catch {\n        existingScript.remove();\n      }\n    }\n  }\n\n  const loadPromise = waitForPredicateWithTimeout(timeout, isClerkUIProperlyLoaded, rejectWith());\n\n  loadScript(scriptUrl, {\n    async: true,\n    crossOrigin: 'anonymous',\n    nonce: opts.nonce,\n    beforeLoad: applyAttributesToScript(buildClerkUIScriptAttributes(opts)),\n  }).catch(error => {\n    throw rejectWith(error);\n  });\n\n  return loadPromise;\n};\n\nexport const clerkJSScriptUrl = (opts: LoadClerkJSScriptOptions) => {\n  const { __internal_clerkJSUrl, __internal_clerkJSVersion, proxyUrl, domain, publishableKey } = opts;\n\n  if (__internal_clerkJSUrl) {\n    return __internal_clerkJSUrl;\n  }\n\n  const scriptHost = buildScriptHost({ publishableKey, proxyUrl, domain });\n  const version = versionSelector(__internal_clerkJSVersion);\n  return `https://${scriptHost}/npm/@clerk/clerk-js@${version}/dist/clerk.browser.js`;\n};\n\nexport const clerkUIScriptUrl = (opts: LoadClerkUIScriptOptions) => {\n  const { __internal_clerkUIUrl, __internal_clerkUIVersion, proxyUrl, domain, publishableKey } = opts;\n\n  if (__internal_clerkUIUrl) {\n    return __internal_clerkUIUrl;\n  }\n\n  const scriptHost = buildScriptHost({ publishableKey, proxyUrl, domain });\n  const version = versionSelector(__internal_clerkUIVersion, UI_PACKAGE_VERSION);\n  return `https://${scriptHost}/npm/@clerk/ui@${version}/dist/ui.browser.js`;\n};\n\nexport const buildClerkJSScriptAttributes = (options: LoadClerkJSScriptOptions) => {\n  const obj: Record<string, string> = {};\n\n  if (options.publishableKey) {\n    obj['data-clerk-publishable-key'] = options.publishableKey;\n  }\n\n  if (options.proxyUrl) {\n    obj['data-clerk-proxy-url'] = options.proxyUrl;\n  }\n\n  if (options.domain) {\n    obj['data-clerk-domain'] = options.domain;\n  }\n\n  if (options.nonce) {\n    obj.nonce = options.nonce;\n  }\n\n  return obj;\n};\n\nexport const buildClerkUIScriptAttributes = (options: LoadClerkUIScriptOptions) => {\n  // TODO @nikos do we need this?\n  return buildClerkJSScriptAttributes(options);\n};\n\nconst applyAttributesToScript = (attributes: Record<string, string>) => (script: HTMLScriptElement) => {\n  for (const attribute in attributes) {\n    script.setAttribute(attribute, attributes[attribute]);\n  }\n};\n\nexport const buildScriptHost = (opts: { publishableKey: string; proxyUrl?: string; domain?: string }) => {\n  const { proxyUrl, domain, publishableKey } = opts;\n\n  if (!!proxyUrl && isValidProxyUrl(proxyUrl)) {\n    return proxyUrlToAbsoluteURL(proxyUrl).replace(/http(s)?:\\/\\//, '');\n  } else if (domain && !isDevOrStagingUrl(parsePublishableKey(publishableKey)?.frontendApi || '')) {\n    return addClerkPrefix(domain);\n  } else {\n    return parsePublishableKey(publishableKey)?.frontendApi || '';\n  }\n};\n\nfunction waitForPredicateWithTimeout(\n  timeoutMs: number,\n  predicate: () => boolean,\n  rejectWith: Error,\n  existingScript?: HTMLScriptElement,\n): Promise<HTMLScriptElement | null> {\n  return new Promise((resolve, reject) => {\n    let resolved = false;\n\n    const cleanup = (timeoutId: ReturnType<typeof setTimeout>, pollInterval: ReturnType<typeof setInterval>) => {\n      clearTimeout(timeoutId);\n      clearInterval(pollInterval);\n    };\n\n    // Bail out early if the script fails to load, instead of waiting for the entire timeout\n    existingScript?.addEventListener('error', () => {\n      cleanup(timeoutId, pollInterval);\n      reject(rejectWith);\n    });\n\n    const checkAndResolve = () => {\n      if (resolved) {\n        return;\n      }\n\n      if (predicate()) {\n        resolved = true;\n        cleanup(timeoutId, pollInterval);\n        resolve(null);\n      }\n    };\n\n    const handleTimeout = () => {\n      if (resolved) {\n        return;\n      }\n\n      resolved = true;\n      cleanup(timeoutId, pollInterval);\n\n      if (!predicate()) {\n        reject(rejectWith);\n      } else {\n        resolve(null);\n      }\n    };\n\n    const timeoutId = setTimeout(handleTimeout, timeoutMs);\n\n    checkAndResolve();\n\n    const pollInterval = setInterval(() => {\n      if (resolved) {\n        clearInterval(pollInterval);\n        return;\n      }\n      checkAndResolve();\n    }, 100);\n  });\n}\n\nexport function setClerkJSLoadingErrorPackageName(packageName: string) {\n  errorThrower.setPackageName({ packageName });\n}\n\n/**\n * @deprecated Use `loadClerkJSScript` instead. This alias will be removed in a future major version.\n */\nexport const loadClerkJsScript = loadClerkJSScript;\n\n/**\n * @deprecated Use `clerkJSScriptUrl` instead. This alias will be removed in a future major version.\n */\nexport const clerkJsScriptUrl = clerkJSScriptUrl;\n\n/**\n * @deprecated Use `buildClerkJSScriptAttributes` instead. This alias will be removed in a future major version.\n */\nexport const buildClerkJsScriptAttributes = buildClerkJSScriptAttributes;\n\n/**\n * @deprecated Use `setClerkJSLoadingErrorPackageName` instead. This alias will be removed in a future major version.\n */\nexport const setClerkJsLoadingErrorPackageName = setClerkJSLoadingErrorPackageName;\n"],"mappings":";;;;;;;;;;;;;;AAQA,MAAM,EAAE,sBAAsBA,yCAA4B;AAE1D,MAAM,eAAeC,gCAAkB,EAAE,aAAa,iBAAiB,CAAC;;;;;;;AA2CxE,SAAS,4BAA4B,MAAmD;AACtF,KAAI,OAAO,WAAW,eAAe,CAAE,OAAe,MACpD,QAAO;AAKT,QAAO,CAAC,CADK,OAAe;;AAG9B,MAAM,8BAA8B,4BAA4B,QAAQ;AACxE,MAAM,gCAAgC,4BAA4B,yBAAyB;;;;;;;AAQ3F,SAAS,sBAAsB,WAA4B;AACzD,KAAI,OAAO,WAAW,eAAe,CAAC,OAAO,YAC3C,QAAO;CAGT,MAAM,UAAU,YAAY,iBAAiB,WAAW,WAAW;AAEnE,KAAI,QAAQ,WAAW,EACrB,QAAO;CAGT,MAAM,cAAc,QAAQ,QAAQ,SAAS;AAI7C,KAAI,YAAY,iBAAiB,KAAK,YAAY,oBAAoB,GAAG;AAEvE,MAAI,YAAY,gBAAgB,EAC9B,QAAO;AAGT,MAAI,YAAY,cAAc,KAAK,YAAY,gBAAgB,EAC7D,QAAO;AAGT,MAAI,oBAAoB,aAAa;AAEnC,OADgB,YAAoB,kBACtB,IACZ,QAAO;AAET,OAAI,YAAY,mBAAmB,EACjC,QAAO;;;AAKb,QAAO;;;;;;;;;;;;;;;;;;;;;;;AAwBT,MAAa,oBAAoB,OAAO,SAAuE;CAC7G,MAAM,UAAU,MAAM,qBAAqB;CAC3C,MAAM,cAAc,UAClB,IAAIC,4CAAkB,6BAA6B,OAAO,UAAU,KAAK,MAAM,YAAY,KAAK;EAC9F,MAAM;EACN,OAAO;EACR,CAAC;AAEJ,KAAI,uBAAuB,CACzB,QAAO;AAGT,KAAI,CAAC,MAAM,gBAAgB;AACzB,eAAa,iCAAiC;AAC9C,SAAO;;CAGT,MAAM,YAAY,iBAAiB,KAAK;CACxC,MAAM,iBAAiB,SAAS,cAAiC,+BAA+B;AAEhG,KAAI,eACF,KAAI,sBAAsB,UAAU,CAClC,gBAAe,QAAQ;KAEvB,KAAI;AACF,QAAM,4BAA4B,SAAS,uBAAuB,YAAY,EAAE,eAAe;AAC/F,SAAO;SACD;AACN,iBAAe,QAAQ;;CAK7B,MAAM,cAAc,4BAA4B,SAAS,uBAAuB,YAAY,CAAC;AAE7F,+BAAW,WAAW;EACpB,OAAO;EACP,aAAa;EACb,OAAO,KAAK;EACZ,YAAY,wBAAwB,6BAA6B,KAAK,CAAC;EACxE,CAAC,CAAC,OAAM,UAAS;AAChB,QAAM,WAAW,MAAM;GACvB;AAEF,QAAO;;AAGT,MAAa,oBAAoB,OAAO,SAAuE;CAC7G,MAAM,UAAU,MAAM,qBAAqB;CAC3C,MAAM,cAAc,UAClB,IAAIA,4CAAkB,6BAA6B,OAAO,UAAU,KAAK,MAAM,YAAY,KAAK;EAC9F,MAAM;EACN,OAAO;EACR,CAAC;AAEJ,KAAI,yBAAyB,CAC3B,QAAO;AAGT,KAAI,CAAC,MAAM,gBAAgB;AACzB,eAAa,iCAAiC;AAC9C,SAAO;;CAGT,MAAM,YAAY,iBAAiB,KAAK;CACxC,MAAM,iBAAiB,SAAS,cAAiC,+BAA+B;AAEhG,KAAI,eACF,KAAI,sBAAsB,UAAU,CAClC,gBAAe,QAAQ;KAEvB,KAAI;AACF,QAAM,4BAA4B,SAAS,yBAAyB,YAAY,EAAE,eAAe;AACjG,SAAO;SACD;AACN,iBAAe,QAAQ;;CAK7B,MAAM,cAAc,4BAA4B,SAAS,yBAAyB,YAAY,CAAC;AAE/F,+BAAW,WAAW;EACpB,OAAO;EACP,aAAa;EACb,OAAO,KAAK;EACZ,YAAY,wBAAwB,6BAA6B,KAAK,CAAC;EACxE,CAAC,CAAC,OAAM,UAAS;AAChB,QAAM,WAAW,MAAM;GACvB;AAEF,QAAO;;AAGT,MAAa,oBAAoB,SAAmC;CAClE,MAAM,EAAE,uBAAuB,2BAA2B,UAAU,QAAQ,mBAAmB;AAE/F,KAAI,sBACF,QAAO;AAKT,QAAO,WAFY,gBAAgB;EAAE;EAAgB;EAAU;EAAQ,CAAC,CAE3C,uBADbC,wCAAgB,0BAA0B,CACE;;AAG9D,MAAa,oBAAoB,SAAmC;CAClE,MAAM,EAAE,uBAAuB,2BAA2B,UAAU,QAAQ,mBAAmB;AAE/F,KAAI,sBACF,QAAO;AAKT,QAAO,WAFY,gBAAgB;EAAE;EAAgB;EAAU;EAAQ,CAAC,CAE3C,iBADbA,wCAAgB,mCAA8C,CACxB;;AAGxD,MAAa,gCAAgC,YAAsC;CACjF,MAAMC,MAA8B,EAAE;AAEtC,KAAI,QAAQ,eACV,KAAI,gCAAgC,QAAQ;AAG9C,KAAI,QAAQ,SACV,KAAI,0BAA0B,QAAQ;AAGxC,KAAI,QAAQ,OACV,KAAI,uBAAuB,QAAQ;AAGrC,KAAI,QAAQ,MACV,KAAI,QAAQ,QAAQ;AAGtB,QAAO;;AAGT,MAAa,gCAAgC,YAAsC;AAEjF,QAAO,6BAA6B,QAAQ;;AAG9C,MAAM,2BAA2B,gBAAwC,WAA8B;AACrG,MAAK,MAAM,aAAa,WACtB,QAAO,aAAa,WAAW,WAAW,WAAW;;AAIzD,MAAa,mBAAmB,SAAyE;CACvG,MAAM,EAAE,UAAU,QAAQ,mBAAmB;AAE7C,KAAI,CAAC,CAAC,YAAYC,8BAAgB,SAAS,CACzC,QAAOC,oCAAsB,SAAS,CAAC,QAAQ,iBAAiB,GAAG;UAC1D,UAAU,CAAC,kBAAkBC,iCAAoB,eAAe,EAAE,eAAe,GAAG,CAC7F,QAAOC,2BAAe,OAAO;KAE7B,QAAOD,iCAAoB,eAAe,EAAE,eAAe;;AAI/D,SAAS,4BACP,WACA,WACA,YACA,gBACmC;AACnC,QAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,WAAW;EAEf,MAAM,WAAW,aAA0C,mBAAiD;AAC1G,gBAAaE,YAAU;AACvB,iBAAcC,eAAa;;AAI7B,kBAAgB,iBAAiB,eAAe;AAC9C,WAAQ,WAAW,aAAa;AAChC,UAAO,WAAW;IAClB;EAEF,MAAM,wBAAwB;AAC5B,OAAI,SACF;AAGF,OAAI,WAAW,EAAE;AACf,eAAW;AACX,YAAQ,WAAW,aAAa;AAChC,YAAQ,KAAK;;;EAIjB,MAAM,sBAAsB;AAC1B,OAAI,SACF;AAGF,cAAW;AACX,WAAQ,WAAW,aAAa;AAEhC,OAAI,CAAC,WAAW,CACd,QAAO,WAAW;OAElB,SAAQ,KAAK;;EAIjB,MAAM,YAAY,WAAW,eAAe,UAAU;AAEtD,mBAAiB;EAEjB,MAAM,eAAe,kBAAkB;AACrC,OAAI,UAAU;AACZ,kBAAc,aAAa;AAC3B;;AAEF,oBAAiB;KAChB,IAAI;GACP;;AAGJ,SAAgB,kCAAkC,aAAqB;AACrE,cAAa,eAAe,EAAE,aAAa,CAAC;;;;;AAM9C,MAAa,oBAAoB;;;;AAKjC,MAAa,mBAAmB;;;;AAKhC,MAAa,+BAA+B;;;;AAK5C,MAAa,oCAAoC"}