@holo-js/auth-clerk 0.1.4 → 0.1.6

package/dist/index.mjs

@@ -1,7 +1,8 @@
 // src/index.ts
-import { createPublicKey, verify as verifySignature } from "crypto";
-import { authRuntimeInternals } from "@holo-js/auth";
+import { authRuntimeInternals, getAuthRuntime } from "@holo-js/auth";
 import { parseCookieHeader } from "@holo-js/session";
+
+// src/contracts.ts
 var ClerkAuthConflictError = class extends Error {
   code = "clerk_identity_conflict";
   provider;
@@ -15,23 +16,11 @@ var ClerkAuthConflictError = class extends Error {
     this.email = options.email;
   }
 };
-var clerkBindings;
+
+// src/jwt.ts
+import { createPublicKey, verify as verifySignature } from "crypto";
 var CLERK_API_BASE_URL = "https://api.clerk.com";
-var clerkDefaultProviderRuntimeCache = /* @__PURE__ */ new Map();
 var clerkJwksCache = /* @__PURE__ */ new Map();
-var AUTH_PROVIDER_MARKER = /* @__PURE__ */ Symbol.for("holo-js.auth.provider");
-function throwUnconfigured() {
-  throw new Error("[@holo-js/auth-clerk] Clerk auth runtime is not configured yet.");
-}
-function getBindings() {
-  if (!clerkBindings?.identityStore) {
-    throwUnconfigured();
-  }
-  return {
-    providers: clerkBindings.providers ?? {},
-    identityStore: clerkBindings.identityStore
-  };
-}
 function decodeJwtSegment(value, label) {
   try {
     return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
@@ -65,20 +54,6 @@ function verifyJwtSignatureWithJwk(token, jwk) {
       throw new Error(`[@holo-js/auth-clerk] Unsupported Clerk JWT algorithm "${algorithm || "unknown"}".`);
   }
 }
-function verifyJwtSignatureWithPem(token, pem) {
-  const algorithm = typeof token.header.alg === "string" ? token.header.alg : "";
-  const key = createPublicKey(pem.replace(/\\n/g, "\n"));
-  switch (algorithm) {
-    case "RS256":
-      return verifySignature("RSA-SHA256", token.signingInput, key, token.signature);
-    case "RS384":
-      return verifySignature("RSA-SHA384", token.signingInput, key, token.signature);
-    case "RS512":
-      return verifySignature("RSA-SHA512", token.signingInput, key, token.signature);
-    default:
-      throw new Error(`[@holo-js/auth-clerk] Unsupported Clerk JWT algorithm "${algorithm || "unknown"}".`);
-  }
-}
 function resolveClerkJwksUrl(config) {
   const frontendApi = config.frontendApi?.trim();
   if (frontendApi) {
@@ -115,47 +90,170 @@ async function fetchClerkJwks(jwksUrl, options = {}) {
     throw error;
   }
 }
-async function verifyClerkSessionToken(token, config, authorizedParties = []) {
-  const parsed = parseJwt(token);
-  const verified = (() => {
-    const pem = config.jwtKey?.trim();
-    if (pem) {
-      return verifyJwtSignatureWithPem(parsed, pem);
+
+// src/index.ts
+var CLERK_RUNTIME_STATE_KEY = "__holoJsAuthClerkRuntime";
+var clerkDefaultProviderRuntimeCache = /* @__PURE__ */ new Map();
+var clerkIdentitySyncLocks = /* @__PURE__ */ new Map();
+var AUTH_PROVIDER_MARKER = /* @__PURE__ */ Symbol.for("holo-js.auth.provider");
+function getRuntimeState() {
+  const runtimeGlobal = globalThis;
+  const runtimeHost = runtimeGlobal.process ?? runtimeGlobal;
+  if (!runtimeHost[CLERK_RUNTIME_STATE_KEY]) {
+    Object.defineProperty(runtimeHost, CLERK_RUNTIME_STATE_KEY, {
+      value: {},
+      enumerable: false,
+      configurable: true,
+      writable: true
+    });
+  }
+  return runtimeHost[CLERK_RUNTIME_STATE_KEY];
+}
+function throwUnconfigured() {
+  throw new Error("[@holo-js/auth-clerk] Clerk auth runtime is not configured yet.");
+}
+function isPlainHeaderRecord(value) {
+  return Boolean(value) && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
+}
+function appendKnownHeaders(headers, input) {
+  for (const name of ["authorization", "cookie", "host", "x-forwarded-host", "x-forwarded-proto"]) {
+    const value = input.get?.(name);
+    if (typeof value === "string" && value) {
+      headers.set(name, value);
     }
-    return void 0;
-  })();
-  if (verified === false) {
-    throw new Error("[@holo-js/auth-clerk] Clerk token signature verification failed.");
   }
-  if (typeof verified === "undefined") {
-    const headerKid = typeof parsed.header.kid === "string" ? parsed.header.kid : void 0;
-    const jwksUrl = resolveClerkJwksUrl(config);
-    const resolveKey = async (refresh = false) => {
-      const keys = await fetchClerkJwks(jwksUrl, { refresh });
-      return headerKid ? keys.find((candidate) => candidate.kid === headerKid) : keys[0];
-    };
-    let key = await resolveKey();
-    if (!key || !verifyJwtSignatureWithJwk(parsed, key)) {
-      key = await resolveKey(true);
+}
+function hasHeaderForEach(input) {
+  return !Array.isArray(input) && "forEach" in input && typeof input.forEach === "function";
+}
+function hasHeaderEntries(input) {
+  return !Array.isArray(input) && "entries" in input && typeof input.entries === "function";
+}
+function hasHeaderGet(input) {
+  return !Array.isArray(input) && "get" in input && typeof input.get === "function";
+}
+function normalizeRequestHeaders(input) {
+  const headers = new Headers();
+  if (!input) {
+    return headers;
+  }
+  if (input instanceof Headers || Array.isArray(input)) {
+    new Headers(input).forEach((value, name) => headers.append(name, value));
+    return headers;
+  }
+  if (hasHeaderForEach(input)) {
+    input.forEach((value, name) => headers.append(name, value));
+    return headers;
+  }
+  if (hasHeaderEntries(input)) {
+    for (const [name, value] of input.entries()) {
+      headers.append(name, value);
     }
-    if (!key || !verifyJwtSignatureWithJwk(parsed, key)) {
-      throw new Error("[@holo-js/auth-clerk] Clerk token signature verification failed.");
+    return headers;
+  }
+  if (hasHeaderGet(input)) {
+    appendKnownHeaders(headers, input);
+    return headers;
+  }
+  if (isPlainHeaderRecord(input)) {
+    for (const [name, value] of Object.entries(input)) {
+      if (typeof value === "string") {
+        headers.append(name, value);
+        continue;
+      }
+      if (Array.isArray(value)) {
+        const separator = name.toLowerCase() === "cookie" ? "; " : ",";
+        const joined = value.filter((entry) => typeof entry === "string").join(separator);
+        if (joined) {
+          headers.append(name, joined);
+        }
+      }
     }
   }
+  return headers;
+}
+function getRequestFromLikeInput(input) {
+  return input.request ?? input.web?.request ?? (input.req instanceof Request ? input.req : void 0);
+}
+function getRequestLikeHeaders(input) {
+  return input.headers ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.headers : void 0) ?? input.node?.req?.headers;
+}
+function getRequestLikeMethod(input) {
+  return input.method ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.method : void 0) ?? input.node?.req?.method ?? "GET";
+}
+function getRequestLikeUrl(input, headers) {
+  const url = (typeof input.url === "string" ? input.url : input.url?.toString()) ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.url : void 0) ?? input.node?.req?.url ?? input.path ?? "/";
+  try {
+    return new URL(url).toString();
+  } catch {
+    const protocol = headers.get("x-forwarded-proto") ?? "http";
+    const host = headers.get("x-forwarded-host") ?? headers.get("host") ?? "localhost";
+    return new URL(url, `${protocol}://${host}`).toString();
+  }
+}
+function normalizeClerkRequest(input) {
+  if (input instanceof Request) {
+    return input;
+  }
+  const request = getRequestFromLikeInput(input);
+  if (request) {
+    return request;
+  }
+  const headers = normalizeRequestHeaders(getRequestLikeHeaders(input));
+  return new Request(getRequestLikeUrl(input, headers), {
+    method: getRequestLikeMethod(input),
+    headers
+  });
+}
+function getBindings() {
+  const clerkBindings = getRuntimeState().bindings;
+  if (!clerkBindings?.identityStore) {
+    throwUnconfigured();
+  }
+  return {
+    providers: clerkBindings.providers ?? {},
+    identityStore: clerkBindings.identityStore
+  };
+}
+async function verifyClerkSessionToken(token, config, authorizedParties = []) {
+  const parsed = parseJwt(token);
+  const headerKid = typeof parsed.header.kid === "string" ? parsed.header.kid : void 0;
+  const jwksUrl = resolveClerkJwksUrl(config);
+  const resolveKey = async (refresh = false) => {
+    const keys = await fetchClerkJwks(jwksUrl, { refresh });
+    return headerKid ? keys.find((candidate) => candidate.kid === headerKid) : keys[0];
+  };
+  let key = await resolveKey();
+  if (!key || !verifyJwtSignatureWithJwk(parsed, key)) {
+    key = await resolveKey(true);
+  }
+  if (!key || !verifyJwtSignatureWithJwk(parsed, key)) {
+    throw new Error("[@holo-js/auth-clerk] Clerk token signature verification failed.");
+  }
   const exp = typeof parsed.payload.exp === "number" ? parsed.payload.exp : void 0;
-  if (typeof exp === "number" && exp * 1e3 <= Date.now()) {
+  if (typeof exp !== "number") {
+    throw new Error("[@holo-js/auth-clerk] Clerk token did not include an expiration.");
+  }
+  if (exp * 1e3 <= Date.now()) {
     throw new Error("[@holo-js/auth-clerk] Clerk token has expired.");
   }
+  if (typeof parsed.payload.sub !== "string" || !parsed.payload.sub.trim()) {
+    throw new Error("[@holo-js/auth-clerk] Clerk token did not include a subject.");
+  }
+  if ((typeof parsed.payload.sid !== "string" || !parsed.payload.sid.trim()) && (typeof parsed.payload.session_id !== "string" || !parsed.payload.session_id.trim())) {
+    throw new Error("[@holo-js/auth-clerk] Clerk token did not include a session id.");
+  }
   const nbf = typeof parsed.payload.nbf === "number" ? parsed.payload.nbf : void 0;
   if (typeof nbf === "number" && nbf * 1e3 > Date.now()) {
     throw new Error("[@holo-js/auth-clerk] Clerk token is not valid yet.");
   }
   const azp = typeof parsed.payload.azp === "string" ? parsed.payload.azp.trim() : "";
-  if (azp) {
-    const allowedAuthorizedParties = authorizedParties.map((value) => value.trim()).filter(Boolean);
-    if (allowedAuthorizedParties.length > 0 && !allowedAuthorizedParties.includes(azp)) {
-      throw new Error(`[@holo-js/auth-clerk] Clerk token authorized party "${azp}" is not allowed.`);
-    }
+  const allowedAuthorizedParties = authorizedParties.map((value) => value.trim()).filter(Boolean);
+  if (allowedAuthorizedParties.length > 0 && !azp) {
+    throw new Error("[@holo-js/auth-clerk] Clerk token did not include an authorized party.");
+  }
+  if (azp && allowedAuthorizedParties.length > 0 && !allowedAuthorizedParties.includes(azp)) {
+    throw new Error(`[@holo-js/auth-clerk] Clerk token authorized party "${azp}" is not allowed.`);
   }
   return parsed.payload;
 }
@@ -168,16 +266,24 @@ function normalizeClerkEmailAddress(value) {
   });
 }
 function normalizeClerkUserProfile(user) {
+  const emailAddresses = Array.isArray(user.emailAddresses) ? user.emailAddresses.map((entry) => normalizeClerkEmailAddress(entry)) : Array.isArray(user.email_addresses) ? user.email_addresses.map((entry) => normalizeClerkEmailAddress(entry)) : void 0;
+  const primaryEmailAddressId = typeof user.primaryEmailAddressId === "string" ? user.primaryEmailAddressId : typeof user.primary_email_address_id === "string" ? user.primary_email_address_id : void 0;
+  const email = typeof user.email === "string" && user.email.trim() ? user.email.trim() : (emailAddresses?.find((entry) => entry.id === primaryEmailAddressId) ?? emailAddresses?.[0])?.emailAddress.trim() ?? "";
+  const emailVerified = user.emailVerified === true || user.email_verified === true || (emailAddresses?.find((entry) => entry.id === primaryEmailAddressId) ?? emailAddresses?.[0])?.verificationStatus === "verified";
+  const firstName = typeof user.firstName === "string" ? user.firstName : typeof user.first_name === "string" ? user.first_name : void 0;
+  const lastName = typeof user.lastName === "string" ? user.lastName : typeof user.last_name === "string" ? user.last_name : void 0;
+  const explicitName = typeof user.name === "string" ? user.name.trim() : "";
+  const name = explicitName || [firstName?.trim(), lastName?.trim()].filter(Boolean).join(" ").trim();
   return Object.freeze({
     id: String(user.id ?? ""),
-    email: typeof user.email === "string" ? user.email : void 0,
-    emailVerified: user.emailVerified === true || user.email_verified === true,
-    firstName: typeof user.firstName === "string" ? user.firstName : typeof user.first_name === "string" ? user.first_name : void 0,
-    lastName: typeof user.lastName === "string" ? user.lastName : typeof user.last_name === "string" ? user.last_name : void 0,
-    name: typeof user.name === "string" ? user.name : void 0,
+    email,
+    emailVerified,
+    firstName,
+    lastName,
+    name: name || email || String(user.id ?? ""),
     imageUrl: typeof user.imageUrl === "string" ? user.imageUrl : typeof user.image_url === "string" ? user.image_url : void 0,
-    primaryEmailAddressId: typeof user.primaryEmailAddressId === "string" ? user.primaryEmailAddressId : typeof user.primary_email_address_id === "string" ? user.primary_email_address_id : void 0,
-    emailAddresses: Array.isArray(user.emailAddresses) ? user.emailAddresses.map((entry) => normalizeClerkEmailAddress(entry)) : Array.isArray(user.email_addresses) ? user.email_addresses.map((entry) => normalizeClerkEmailAddress(entry)) : void 0,
+    primaryEmailAddressId,
+    emailAddresses,
     raw: user
   });
 }
@@ -203,7 +309,6 @@ function createDefaultProviderRuntime(providerName, config) {
     providerName,
     config.apiUrl ?? "",
     config.frontendApi ?? "",
-    config.jwtKey ?? "",
     config.secretKey ?? "",
     [...config.authorizedParties ?? []].sort()
   ]);
@@ -239,7 +344,11 @@ function resolveConfiguredProviderName(provider) {
   if (provider?.trim()) {
     return provider.trim();
   }
-  const configuredProviders = Object.keys(bindings.config.clerk);
+  const configuredDefaultProvider = typeof bindings.config.clerk.provider === "string" ? bindings.config.clerk.provider.trim() : "";
+  if (configuredDefaultProvider) {
+    return configuredDefaultProvider;
+  }
+  const configuredProviders = Object.entries(bindings.config.clerk).flatMap(([name, value]) => name !== "provider" && name !== "identityStore" && isNormalizedClerkProviderConfig(value) ? [name] : []);
   if (configuredProviders.length === 0) {
     return "default";
   }
@@ -251,20 +360,23 @@ function resolveConfiguredProviderName(provider) {
   }
   throw new Error("[@holo-js/auth-clerk] Clerk provider name is required when multiple auth.clerk entries exist.");
 }
+function isNormalizedClerkProviderConfig(value) {
+  return value !== null && typeof value === "object" && "sessionCookie" in value && typeof value.sessionCookie === "string" && "authorizedParties" in value && Array.isArray(value.authorizedParties);
+}
 function getConfiguredProviderConfig(provider) {
   const providerName = resolveConfiguredProviderName(provider);
   const authBindings = authRuntimeInternals.getRuntimeBindings();
   const configured = authBindings.config.clerk[providerName];
-  if (!configured) {
+  if (!isNormalizedClerkProviderConfig(configured)) {
     throw new Error(`[@holo-js/auth-clerk] Clerk provider "${providerName}" is not configured in auth.clerk.`);
   }
   return {
     name: providerName,
     publishableKey: configured.publishableKey,
     secretKey: configured.secretKey,
-    jwtKey: configured.jwtKey,
     apiUrl: configured.apiUrl,
     frontendApi: configured.frontendApi,
+    redirectUri: configured.redirectUri,
     sessionCookie: configured.sessionCookie,
     authorizedParties: configured.authorizedParties ?? [],
     guard: configured.guard,
@@ -275,6 +387,73 @@ function getProviderRuntime(provider) {
   const providerName = resolveConfiguredProviderName(provider);
   return getBindings().providers[providerName] ?? createDefaultProviderRuntime(providerName, getConfiguredProviderConfig(providerName));
 }
+function requireClerkHostedConfig(config) {
+  const frontendApi = config.frontendApi?.trim();
+  const redirectUri = config.redirectUri?.trim();
+  if (!frontendApi) {
+    throw new Error("[@holo-js/auth-clerk] Clerk hosted auth requires frontendApi to be configured.");
+  }
+  if (!redirectUri) {
+    throw new Error("[@holo-js/auth-clerk] Clerk hosted auth requires redirectUri to be configured.");
+  }
+  return { frontendApi, redirectUri };
+}
+function resolveClerkAccountPortalUrl(frontendApi) {
+  const url = new URL(frontendApi);
+  if (url.hostname.endsWith(".clerk.accounts.dev")) {
+    url.hostname = `${url.hostname.slice(0, -".clerk.accounts.dev".length)}.accounts.dev`;
+  } else if (url.hostname.startsWith("clerk.")) {
+    url.hostname = `accounts.${url.hostname.slice("clerk.".length)}`;
+  }
+  url.pathname = "/";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function createAuthorizationUrl(config, page) {
+  const { frontendApi, redirectUri } = requireClerkHostedConfig(config);
+  const portalBaseUrl = resolveClerkAccountPortalUrl(frontendApi);
+  const url = new URL(page, portalBaseUrl);
+  url.searchParams.set("redirect_url", redirectUri);
+  return url.toString();
+}
+function createClerkReturnUrl(request, returnTo) {
+  const requestUrl = new URL(request.url);
+  const safeDefault = new URL("/", requestUrl).toString();
+  const trimmed = returnTo?.trim();
+  if (!trimmed || hasControlCharacter(trimmed)) {
+    return safeDefault;
+  }
+  try {
+    const parsed = new URL(trimmed, requestUrl);
+    const isRelativePath = trimmed.startsWith("/") && !trimmed.startsWith("//");
+    const isAbsoluteUrl = /^[a-z][a-z\d+.-]*:/iu.test(trimmed);
+    if (parsed.origin !== requestUrl.origin || !parsed.pathname.startsWith("/") || !isRelativePath && !isAbsoluteUrl) {
+      return safeDefault;
+    }
+    return parsed.toString();
+  } catch {
+    return safeDefault;
+  }
+}
+function hasControlCharacter(value) {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (typeof codePoint === "number" && (codePoint < 32 || codePoint === 127)) {
+      return true;
+    }
+  }
+  return false;
+}
+function createClerkErrorResponse(error, code) {
+  return Response.json({
+    ok: false,
+    code,
+    message: getErrorMessage(error)
+  }, {
+    status: error instanceof ClerkAuthConflictError ? 409 : 422
+  });
+}
 function resolveGuardAndProvider(provider) {
   const authBindings = authRuntimeInternals.getRuntimeBindings();
   const providerConfig = getConfiguredProviderConfig(provider);
@@ -313,6 +492,46 @@ function requireUserRecord(user, message) {
   }
   return user;
 }
+function requireSerializedUser(user, message) {
+  if (typeof user.id === "string" || typeof user.id === "number") {
+    return user;
+  }
+  throw new Error(message);
+}
+function createClerkSessionPayload(authenticated, session) {
+  const user = requireSerializedUser(
+    authenticated.user,
+    "[@holo-js/auth-clerk] Clerk-authenticated local users must expose a serializable id."
+  );
+  return Object.freeze({
+    guard: authenticated.guard,
+    provider: authenticated.authProvider,
+    userId: user.id,
+    user,
+    clerk: Object.freeze({
+      provider: authenticated.provider,
+      sessionId: session.sessionId
+    })
+  });
+}
+function getClerkLogoutSession(payload, providerName) {
+  if (!payload || typeof payload !== "object" || !("clerk" in payload)) {
+    return null;
+  }
+  const clerk = payload.clerk;
+  if (!clerk || typeof clerk !== "object") {
+    return null;
+  }
+  const provider = clerk.provider;
+  const sessionId = clerk.sessionId;
+  if (provider !== providerName || typeof sessionId !== "string" || !sessionId.trim()) {
+    return null;
+  }
+  return Object.freeze({
+    provider,
+    sessionId
+  });
+}
 function serializeLocalUser(adapter, user, providerName) {
   const id = adapter.getId(user);
   const serialized = adapter.serialize ? adapter.serialize(user) : { ...user };
@@ -325,6 +544,11 @@ function serializeLocalUser(adapter, user, providerName) {
     enumerable: false,
     configurable: true
   });
+  Object.defineProperty(result, "can", {
+    value: () => false,
+    enumerable: false,
+    configurable: true
+  });
   return Object.freeze(result);
 }
 function resolvePrimaryEmail(profile) {
@@ -351,7 +575,7 @@ function resolveDisplayName(profile) {
     return profile.name.trim();
   }
   const fullName = [profile.firstName?.trim(), profile.lastName?.trim()].filter(Boolean).join(" ").trim();
-  return fullName || void 0;
+  return fullName || profile.email || profile.id;
 }
 function resolveEmailForCreation(profile) {
   const primary = resolvePrimaryEmail(profile).email;
@@ -360,6 +584,34 @@ function resolveEmailForCreation(profile) {
   }
   return `${profile.id}@clerk.hosted.local`;
 }
+function toAdapterInput(input) {
+  return Object.freeze(Object.fromEntries(
+    Object.entries(input).filter((entry) => typeof entry[1] !== "undefined")
+  ));
+}
+function withRequiredUserFields(input, profile) {
+  return Object.freeze({
+    ...input,
+    email: typeof input.email === "undefined" ? resolveEmailForCreation(profile) : input.email,
+    name: typeof input.name === "undefined" ? resolveDisplayName(profile) : input.name
+  });
+}
+function resolveCreateUserInput(profile, mapper) {
+  return toAdapterInput(withRequiredUserFields({
+    password: null,
+    avatar: profile.imageUrl ?? null,
+    email_verified_at: profile.emailVerified ? /* @__PURE__ */ new Date() : null,
+    ...mapper?.(profile) ?? {}
+  }, profile));
+}
+function resolveUpdateUserInput(profile, mapper) {
+  return toAdapterInput(withRequiredUserFields({
+    email: profile.email.trim() || void 0,
+    avatar: profile.imageUrl,
+    email_verified_at: profile.emailVerified ? /* @__PURE__ */ new Date() : void 0,
+    ...mapper?.(profile) ?? {}
+  }, profile));
+}
 function normalizeHostedProfile(profile) {
   const resolvedEmail = resolvePrimaryEmail(profile);
   return Object.freeze({
@@ -383,21 +635,20 @@ async function findUserByEmail(adapter, email) {
   return user ? requireUserRecord(user, "[@holo-js/auth-clerk] Auth provider lookups must return object users.") : null;
 }
 async function updateLocalUser(adapter, user, input) {
-  const nextInput = {
-    name: input.name,
-    email: input.email,
-    avatar: typeof input.avatar === "undefined" ? void 0 : input.avatar,
-    email_verified_at: input.emailVerified === true ? /* @__PURE__ */ new Date() : void 0
-  };
   const current = user;
-  const changed = typeof nextInput.name !== "undefined" && nextInput.name !== current.name || typeof nextInput.email !== "undefined" && nextInput.email !== current.email || typeof nextInput.avatar !== "undefined" && nextInput.avatar !== (current.avatar ?? void 0) || input.emailVerified === true && !current.email_verified_at;
+  const changed = Object.entries(input).some(([key, value]) => {
+    if (key === "email_verified_at") {
+      return value instanceof Date && !current.email_verified_at;
+    }
+    return !Object.is(value, user[key]);
+  });
   if (!changed) {
     return { user, changed: false };
   }
   if (adapter.update) {
     return {
       user: requireUserRecord(
-        await adapter.update(user, nextInput),
+        await adapter.update(user, input),
         "[@holo-js/auth-clerk] Auth provider updates must return object users."
       ),
       changed: true
@@ -407,7 +658,7 @@ async function updateLocalUser(adapter, user, input) {
     "[@holo-js/auth-clerk] Auth provider adapters must implement update() to persist profile changes."
   );
 }
-async function ensureNoUnexpectedEmailCollision(adapter, authProvider, profile, currentUserId) {
+async function ensureNoUnexpectedEmailCollision(adapter, providerName, profile, currentUserId) {
   const resolvedEmail = resolvePrimaryEmail(profile).email;
   if (!resolvedEmail) {
     return;
@@ -422,28 +673,13 @@ async function ensureNoUnexpectedEmailCollision(adapter, authProvider, profile,
     "[@holo-js/auth-clerk] Matched local users must expose a serializable id."
   ) !== currentUserId) {
     throw new ClerkAuthConflictError({
-      provider: "clerk",
+      provider: providerName,
       clerkUserId: profile.id,
       email: resolvedEmail,
       message: `[@holo-js/auth-clerk] Clerk email "${resolvedEmail}" collides with a different local user.`
     });
   }
 }
-async function assertUserLinkAvailable(providerName, authProvider, adapter, user, clerkUserId) {
-  const existing = await getBindings().identityStore.findByUserId(
-    providerName,
-    authProvider,
-    requireUserId(adapter, user, "[@holo-js/auth-clerk] Linked users must expose a serializable id.")
-  );
-  if (existing && existing.providerUserId !== clerkUserId) {
-    throw new ClerkAuthConflictError({
-      provider: providerName,
-      clerkUserId,
-      email: existing.email,
-      message: `[@holo-js/auth-clerk] Local user is already linked to Clerk identity "${existing.providerUserId}".`
-    });
-  }
-}
 function isEmailVerificationRequired() {
   return authRuntimeInternals.getRuntimeBindings().config.emailVerification.required === true;
 }
@@ -463,6 +699,47 @@ function createIdentityRecord(input) {
     updatedAt: now
   });
 }
+async function withIdentitySyncLock(key, callback) {
+  const previous = clerkIdentitySyncLocks.get(key) ?? Promise.resolve();
+  let release = () => {
+  };
+  const current = previous.then(() => new Promise((resolve) => {
+    release = resolve;
+  }));
+  clerkIdentitySyncLocks.set(key, current);
+  await previous;
+  try {
+    return await callback();
+  } finally {
+    release();
+    if (clerkIdentitySyncLocks.get(key) === current) {
+      clerkIdentitySyncLocks.delete(key);
+    }
+  }
+}
+async function claimNewIdentity(identityStore, identity) {
+  if (identityStore.claim) {
+    return await identityStore.claim(identity);
+  }
+  await identityStore.save(identity);
+  return identity;
+}
+function sameUserId(left, right) {
+  return String(left) === String(right);
+}
+async function resolveClaimedIdentityUser(adapter, identity, fallback) {
+  if (sameUserId(identity.userId, fallback.userId)) {
+    return fallback.user;
+  }
+  const claimedUser = requireUserRecord(
+    await adapter.findById(identity.userId),
+    "[@holo-js/auth-clerk] Claimed Clerk identities must reference an existing local user."
+  );
+  if (fallback.deleteOnMismatch && adapter.delete) {
+    await adapter.delete(fallback.userId);
+  }
+  return claimedUser;
+}
 function getSessionTokenFromRequest(request, sessionCookie) {
   const authorization = request.headers.get("authorization")?.trim();
   if (authorization) {
@@ -474,6 +751,53 @@ function getSessionTokenFromRequest(request, sessionCookie) {
   const cookies = parseCookieHeader(request.headers.get("cookie"));
   return cookies[sessionCookie] ?? null;
 }
+function hasClerkCallbackState(request) {
+  const url = new URL(request.url);
+  return [...url.searchParams.keys()].some((key) => key.startsWith("__clerk"));
+}
+function hasClerkHandshakeAttempt(request) {
+  const url = new URL(request.url);
+  if (url.searchParams.has("__clerk_handshake") || url.searchParams.has("__clerk_handshake_nonce") || url.searchParams.has("__clerk_synced")) {
+    return true;
+  }
+  const cookies = parseCookieHeader(request.headers.get("cookie"));
+  const redirectCount = cookies.__clerk_redirect_count;
+  return typeof redirectCount === "string" && redirectCount !== "" && redirectCount !== "0";
+}
+function isConfiguredClerkRedirectRequest(request, config) {
+  const redirectUri = config.redirectUri?.trim();
+  if (!redirectUri) {
+    return hasClerkCallbackState(request);
+  }
+  try {
+    const requestUrl = new URL(request.url);
+    const configuredUrl = new URL(redirectUri, requestUrl.origin);
+    return requestUrl.origin === configuredUrl.origin && requestUrl.pathname === configuredUrl.pathname;
+  } catch {
+    return false;
+  }
+}
+function splitSetCookieHeader(value) {
+  return value.split(/,(?=\s*[^;,=\s]+=)/g).map((cookie) => cookie.trim()).filter(Boolean);
+}
+function getSetCookieHeaders(headers) {
+  const withGetSetCookie = headers;
+  const explicit = withGetSetCookie.getSetCookie?.();
+  if (explicit?.length) {
+    return explicit;
+  }
+  const combined = headers.get("set-cookie");
+  return combined ? splitSetCookieHeader(combined) : [];
+}
+async function appendClerkResponseCookies(headers) {
+  const append = authRuntimeInternals.getRuntimeBindings().context.appendResponseCookie;
+  if (!append) {
+    return;
+  }
+  for (const cookie of getSetCookieHeaders(headers)) {
+    await append(cookie);
+  }
+}
 function getHoloSessionIdFromRequest(request) {
   const cookieHeader = authRuntimeInternals.getRuntimeBindings().session.sessionCookie("");
   const separator = cookieHeader.indexOf("=");
@@ -496,9 +820,16 @@ async function reuseExistingHoloSession(request, authenticated) {
   if (!payload || payload.guard !== authenticated.guard || payload.provider !== authenticated.authProvider || String(payload.userId) !== String(authenticated.user.id)) {
     return null;
   }
+  const source = payload;
+  if (source.clerk && typeof source.clerk === "object") {
+    if (typeof source.clerk.provider !== "string" || source.clerk.provider !== authenticated.provider) {
+      return null;
+    }
+  }
   bindings.context.setCachedUser(authenticated.guard, authenticated.user);
   return Object.freeze({
     guard: authenticated.guard,
+    provider: source.clerk && typeof source.clerk === "object" ? "clerk" : payload.provider,
     user: authenticated.user,
     sessionId,
     cookies: Object.freeze([])
@@ -516,7 +847,71 @@ async function verifySession(token, provider) {
     config: providerConfig
   });
 }
-async function verifyRequest(request, provider) {
+function resolveRequestAuthorizedParties(config, request) {
+  return Object.freeze([
+    .../* @__PURE__ */ new Set([
+      ...config.authorizedParties ?? [],
+      new URL(request.url).origin
+    ])
+  ]);
+}
+async function verifyDefaultSessionToken(token, providerConfig, authorizedParties) {
+  const config = {
+    ...providerConfig,
+    authorizedParties
+  };
+  const defaultRuntime = createDefaultProviderRuntime(providerConfig.name, config);
+  if (!defaultRuntime.verifySession) {
+    throw new Error(`[@holo-js/auth-clerk] Clerk provider runtime "${providerConfig.name}" does not implement verifySession().`);
+  }
+  return defaultRuntime.verifySession({
+    provider: providerConfig.name,
+    token,
+    config
+  });
+}
+async function verifyRequestWithClerkBackendSdk(request, providerConfig) {
+  const publishableKey = providerConfig.publishableKey?.trim();
+  const secretKey = providerConfig.secretKey?.trim();
+  if (!publishableKey || !secretKey) {
+    return null;
+  }
+  const { createClerkClient } = await import("@clerk/backend");
+  const client = createClerkClient({
+    apiUrl: providerConfig.apiUrl,
+    publishableKey,
+    secretKey
+  });
+  const authenticateOptions = {
+    apiUrl: providerConfig.apiUrl,
+    authorizedParties: [...resolveRequestAuthorizedParties(providerConfig, request)],
+    publishableKey,
+    secretKey
+  };
+  const requestState = await client.authenticateRequest(request, authenticateOptions);
+  await appendClerkResponseCookies(requestState.headers);
+  if (requestState.status === "handshake") {
+    const redirectUrl = requestState.headers.get("location");
+    if (redirectUrl && !hasClerkHandshakeAttempt(request)) {
+      await authRuntimeInternals.redirectResponse(
+        authRuntimeInternals.getRuntimeBindings(),
+        new URL(redirectUrl, request.url).toString(),
+        307
+      );
+    }
+    return null;
+  }
+  if (requestState.status !== "signed-in") {
+    return null;
+  }
+  return verifyDefaultSessionToken(
+    requestState.token,
+    providerConfig,
+    resolveRequestAuthorizedParties(providerConfig, request)
+  );
+}
+async function verifyRequest(input, provider) {
+  const request = normalizeClerkRequest(input);
   const providerConfig = getConfiguredProviderConfig(provider);
   const configuredRuntime = getBindings().providers[providerConfig.name];
   const runtime = configuredRuntime ?? getProviderRuntime(providerConfig.name);
@@ -528,6 +923,12 @@ async function verifyRequest(request, provider) {
     });
   }
   const token = getSessionTokenFromRequest(request, providerConfig.sessionCookie);
+  if (!configuredRuntime && (hasClerkCallbackState(request) || isConfiguredClerkRedirectRequest(request, providerConfig))) {
+    const clerkSession = await verifyRequestWithClerkBackendSdk(request, providerConfig);
+    if (clerkSession) {
+      return clerkSession;
+    }
+  }
   if (!token) {
     return null;
   }
@@ -541,34 +942,9 @@ async function verifyRequest(request, provider) {
       config: providerConfig
     });
   }
-  const requestOrigin = new URL(request.url).origin;
-  const defaultRuntime = createDefaultProviderRuntime(providerConfig.name, {
-    ...providerConfig,
-    authorizedParties: Object.freeze([
-      .../* @__PURE__ */ new Set([
-        ...providerConfig.authorizedParties ?? [],
-        requestOrigin
-      ])
-    ])
-  });
-  if (!defaultRuntime.verifySession) {
-    throw new Error(`[@holo-js/auth-clerk] Clerk provider runtime "${providerConfig.name}" does not implement verifySession().`);
-  }
-  return defaultRuntime.verifySession({
-    provider: providerConfig.name,
-    token,
-    config: {
-      ...providerConfig,
-      authorizedParties: Object.freeze([
-        .../* @__PURE__ */ new Set([
-          ...providerConfig.authorizedParties ?? [],
-          requestOrigin
-        ])
-      ])
-    }
-  });
+  return verifyDefaultSessionToken(token, providerConfig, resolveRequestAuthorizedParties(providerConfig, request));
 }
-async function syncIdentity(session, provider) {
+async function syncIdentity(session, provider, options = {}) {
   const providerConfig = getConfiguredProviderConfig(provider);
   const providerName = providerConfig.name;
   const profile = session.user;
@@ -579,155 +955,129 @@ async function syncIdentity(session, provider) {
   if (verificationRequired && !verifiedEmail) {
     throw new Error(`[@holo-js/auth-clerk] Clerk identity "${profile.id}" must provide a verified email address.`);
   }
-  const identityStore = getBindings().identityStore;
-  const existingIdentity = await identityStore.findByProviderUserId(providerName, profile.id);
-  if (existingIdentity) {
-    const existingLinkedUser = await adapter.findById(existingIdentity.userId);
-    let linkedUser = existingLinkedUser ? requireUserRecord(existingLinkedUser, "[@holo-js/auth-clerk] Auth provider lookups must return object users.") : null;
-    if (!linkedUser) {
-      linkedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
-      if (linkedUser) {
-        await assertUserLinkAvailable(providerName, authProvider, adapter, linkedUser, profile.id);
-      }
+  return await withIdentitySyncLock(`${providerName}:${profile.id}`, async () => {
+    const identityStore = getBindings().identityStore;
+    const existingIdentity = await identityStore.findByProviderUserId(providerName, profile.id);
+    if (existingIdentity) {
+      const existingLinkedUser = await adapter.findById(existingIdentity.userId);
+      let linkedUser = existingLinkedUser ? requireUserRecord(existingLinkedUser, "[@holo-js/auth-clerk] Auth provider lookups must return object users.") : null;
       if (!linkedUser) {
-        linkedUser = requireUserRecord(await adapter.create({
-          name: resolveDisplayName(profile),
-          email: resolveEmailForCreation(profile),
-          password: null,
-          avatar: profile.imageUrl ?? null,
-          email_verified_at: resolvedEmail.emailVerified ? /* @__PURE__ */ new Date() : null
-        }), "[@holo-js/auth-clerk] Auth provider create() must return an object user.");
+        const emailMatchedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
+        if (emailMatchedUser) {
+          throw new ClerkAuthConflictError({
+            provider: providerName,
+            clerkUserId: profile.id,
+            email: verifiedEmail,
+            message: `[@holo-js/auth-clerk] Clerk email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
+          });
+        }
+        linkedUser = requireUserRecord(
+          await adapter.create(resolveCreateUserInput(profile, options.user)),
+          "[@holo-js/auth-clerk] Auth provider create() must return an object user."
+        );
+        const relinked = await updateLocalUser(adapter, linkedUser, resolveUpdateUserInput(profile, options.user));
+        const relinkedUser = relinked.user;
+        const identity3 = createIdentityRecord({
+          provider: providerName,
+          guard,
+          authProvider,
+          userId: requireUserId(
+            adapter,
+            relinkedUser,
+            "[@holo-js/auth-clerk] Relinked local users must expose a serializable id."
+          ),
+          profile,
+          previous: existingIdentity
+        });
+        await identityStore.save(identity3);
+        return Object.freeze({
+          provider: providerName,
+          guard,
+          authProvider,
+          status: "relinked",
+          user: serializeLocalUser(adapter, relinkedUser, authProvider),
+          identity: identity3,
+          session
+        });
       }
-      const relinked = await updateLocalUser(adapter, linkedUser, {
-        name: resolveDisplayName(profile),
-        email: resolvedEmail.email,
-        avatar: profile.imageUrl,
-        emailVerified: resolvedEmail.emailVerified
-      });
-      const relinkedUser = relinked.user;
-      const identity3 = createIdentityRecord({
+      await ensureNoUnexpectedEmailCollision(
+        adapter,
+        providerName,
+        profile,
+        requireUserId(
+          adapter,
+          linkedUser,
+          "[@holo-js/auth-clerk] Linked local users must expose a serializable id."
+        )
+      );
+      const updated = await updateLocalUser(adapter, linkedUser, resolveUpdateUserInput(profile, options.user));
+      const identity2 = createIdentityRecord({
         provider: providerName,
         guard,
         authProvider,
         userId: requireUserId(
           adapter,
-          relinkedUser,
-          "[@holo-js/auth-clerk] Relinked local users must expose a serializable id."
+          updated.user,
+          "[@holo-js/auth-clerk] Updated local users must expose a serializable id."
         ),
         profile,
         previous: existingIdentity
       });
-      await identityStore.save(identity3);
+      await identityStore.save(identity2);
       return Object.freeze({
         provider: providerName,
         guard,
         authProvider,
-        status: "relinked",
-        user: serializeLocalUser(adapter, relinkedUser, authProvider),
-        identity: identity3,
+        status: updated.changed ? "updated" : "linked",
+        user: serializeLocalUser(adapter, updated.user, authProvider),
+        identity: identity2,
         session
       });
     }
-    await ensureNoUnexpectedEmailCollision(
-      adapter,
-      authProvider,
-      profile,
-      requireUserId(
-        adapter,
-        linkedUser,
-        "[@holo-js/auth-clerk] Linked local users must expose a serializable id."
-      )
+    let localUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
+    if (localUser) {
+      throw new ClerkAuthConflictError({
+        provider: providerName,
+        clerkUserId: profile.id,
+        email: verifiedEmail,
+        message: `[@holo-js/auth-clerk] Clerk email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
+      });
+    }
+    localUser = requireUserRecord(
+      await adapter.create(resolveCreateUserInput(profile, options.user)),
+      "[@holo-js/auth-clerk] Auth provider create() must return an object user."
     );
-    const updated = await updateLocalUser(adapter, linkedUser, {
-      name: resolveDisplayName(profile),
-      email: resolvedEmail.email,
-      avatar: profile.imageUrl,
-      emailVerified: resolvedEmail.emailVerified
-    });
-    const identity2 = createIdentityRecord({
+    const identity = createIdentityRecord({
       provider: providerName,
       guard,
       authProvider,
       userId: requireUserId(
         adapter,
-        updated.user,
-        "[@holo-js/auth-clerk] Updated local users must expose a serializable id."
-      ),
-      profile,
-      previous: existingIdentity
-    });
-    await identityStore.save(identity2);
-    return Object.freeze({
-      provider: providerName,
-      guard,
-      authProvider,
-      status: updated.changed ? "updated" : "linked",
-      user: serializeLocalUser(adapter, updated.user, authProvider),
-      identity: identity2,
-      session
-    });
-  }
-  let localUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
-  if (localUser) {
-    await assertUserLinkAvailable(providerName, authProvider, adapter, localUser, profile.id);
-    const linked = await updateLocalUser(adapter, localUser, {
-      name: resolveDisplayName(profile),
-      email: resolvedEmail.email,
-      avatar: profile.imageUrl,
-      emailVerified: resolvedEmail.emailVerified
-    });
-    const identity2 = createIdentityRecord({
-      provider: providerName,
-      guard,
-      authProvider,
-      userId: requireUserId(
-        adapter,
-        linked.user,
-        "[@holo-js/auth-clerk] Linked local users must expose a serializable id."
+        localUser,
+        "[@holo-js/auth-clerk] Created local users must expose a serializable id."
       ),
       profile
     });
-    await identityStore.save(identity2);
+    const claimedIdentity = await claimNewIdentity(identityStore, identity);
+    const claimedUser = await resolveClaimedIdentityUser(adapter, claimedIdentity, {
+      user: localUser,
+      userId: identity.userId,
+      deleteOnMismatch: true
+    });
+    const claimedStatus = sameUserId(claimedIdentity.userId, identity.userId) ? "created" : "linked";
     return Object.freeze({
       provider: providerName,
       guard,
       authProvider,
-      status: "linked",
-      user: serializeLocalUser(adapter, linked.user, authProvider),
-      identity: identity2,
+      status: claimedStatus,
+      user: serializeLocalUser(adapter, claimedUser, authProvider),
+      identity: claimedIdentity,
       session
     });
-  }
-  localUser = requireUserRecord(await adapter.create({
-    name: resolveDisplayName(profile),
-    email: resolveEmailForCreation(profile),
-    password: null,
-    avatar: profile.imageUrl ?? null,
-    email_verified_at: resolvedEmail.emailVerified ? /* @__PURE__ */ new Date() : null
-  }), "[@holo-js/auth-clerk] Auth provider create() must return an object user.");
-  const identity = createIdentityRecord({
-    provider: providerName,
-    guard,
-    authProvider,
-    userId: requireUserId(
-      adapter,
-      localUser,
-      "[@holo-js/auth-clerk] Created local users must expose a serializable id."
-    ),
-    profile
-  });
-  await identityStore.save(identity);
-  return Object.freeze({
-    provider: providerName,
-    guard,
-    authProvider,
-    status: "created",
-    user: serializeLocalUser(adapter, localUser, authProvider),
-    identity,
-    session
   });
 }
-async function authenticate(request, provider) {
+async function authenticate(input, provider) {
+  const request = normalizeClerkRequest(input);
   const session = await verifyRequest(request, provider);
   if (!session) {
     return null;
@@ -735,28 +1085,177 @@ async function authenticate(request, provider) {
   const authenticated = await syncIdentity(session, provider);
   const authSession = await reuseExistingHoloSession(request, authenticated) ?? await authRuntimeInternals.establishSessionForUser(authenticated.user, {
     guard: authenticated.guard,
-    provider: authenticated.authProvider
+    provider: authenticated.authProvider,
+    payload: createClerkSessionPayload(authenticated, session)
   });
   return Object.freeze({
     ...authenticated,
     authSession
   });
 }
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : "Clerk authentication failed.";
+}
+function createHostedAuthSuccess(data) {
+  return Object.freeze({
+    data,
+    error: null
+  });
+}
+function createHostedAuthFailure(code, message, status) {
+  return Object.freeze({
+    data: null,
+    error: Object.freeze({
+      code,
+      message,
+      status,
+      fields: Object.freeze({
+        _root: Object.freeze([message])
+      })
+    })
+  });
+}
+async function loginWithClerk(_input, options = {}) {
+  try {
+    const providerConfig = getConfiguredProviderConfig(options.provider);
+    return Response.redirect(createAuthorizationUrl(providerConfig, "sign-in"), 302);
+  } catch (error) {
+    return createClerkErrorResponse(error, "clerk_login_failed");
+  }
+}
+async function registerWithClerk(_input, options = {}) {
+  try {
+    const providerConfig = getConfiguredProviderConfig(options.provider);
+    return Response.redirect(createAuthorizationUrl(providerConfig, "sign-up"), 302);
+  } catch (error) {
+    return createClerkErrorResponse(error, "clerk_register_failed");
+  }
+}
+async function readCurrentClerkLogoutSession(guard, providerName) {
+  const bindings = authRuntimeInternals.getRuntimeBindings();
+  const sessionId = bindings.context.getSessionId(guard);
+  if (!sessionId) {
+    return null;
+  }
+  const record = await bindings.session.read(sessionId);
+  return getClerkLogoutSession(authRuntimeInternals.readSessionPayload(record, guard), providerName);
+}
+async function revokeClerkSession(config, sessionId) {
+  const secretKey = config.secretKey?.trim();
+  if (!secretKey) {
+    throw new Error("[@holo-js/auth-clerk] Clerk logout requires secretKey to be configured.");
+  }
+  const apiBase = config.apiUrl?.trim() || CLERK_API_BASE_URL;
+  const response = await fetch(`${apiBase.replace(/\/$/, "")}/v1/sessions/${encodeURIComponent(sessionId)}/revoke`, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${secretKey}`
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`[@holo-js/auth-clerk] Failed to revoke Clerk session "${sessionId}".`);
+  }
+}
+async function logoutWithClerk(input, options = {}) {
+  const request = normalizeClerkRequest(input);
+  try {
+    const providerConfig = getConfiguredProviderConfig(options.provider);
+    const providerName = providerConfig.name;
+    const { guard } = resolveGuardAndProvider(providerName);
+    const requestSessionId = getHoloSessionIdFromRequest(request);
+    if (requestSessionId) {
+      authRuntimeInternals.getRuntimeBindings().context.setSessionId(guard, requestSessionId);
+    }
+    const clerkSession = await readCurrentClerkLogoutSession(guard, providerName);
+    if (!clerkSession) {
+      return createHostedAuthFailure(
+        "clerk_session_missing",
+        "The current Holo session was not created by Clerk.",
+        422
+      );
+    }
+    await revokeClerkSession(providerConfig, clerkSession.sessionId);
+    const local = await getAuthRuntime().guard(guard).logout();
+    return createHostedAuthSuccess(Object.freeze({
+      url: createClerkReturnUrl(request, options.returnTo),
+      local
+    }));
+  } catch {
+    return createHostedAuthFailure("clerk_logout_failed", "Unable to complete Clerk logout.", 500);
+  }
+}
+async function completeClerkAuth(input, options = {}) {
+  try {
+    const request = normalizeClerkRequest(input);
+    const url = new URL(request.url);
+    const callbackError = url.searchParams.get("error")?.trim();
+    if (callbackError) {
+      return createHostedAuthFailure(
+        callbackError,
+        url.searchParams.get("error_description")?.trim() || "Clerk authentication failed.",
+        422
+      );
+    }
+    const providerConfig = getConfiguredProviderConfig(options.provider);
+    const session = await verifyRequest(request, providerConfig.name);
+    if (!session) {
+      return createHostedAuthFailure(
+        "clerk_session_required",
+        "Clerk callback did not include an active session.",
+        422
+      );
+    }
+    const authenticated = await syncIdentity(session, providerConfig.name, {
+      user: options.user
+    });
+    const authSession = await authRuntimeInternals.establishSessionForUser(authenticated.user, {
+      guard: authenticated.guard,
+      provider: authenticated.authProvider,
+      payload: createClerkSessionPayload(authenticated, session)
+    });
+    return createHostedAuthSuccess(Object.freeze({
+      provider: authenticated.provider,
+      guard: authenticated.guard,
+      authProvider: authenticated.authProvider,
+      status: authenticated.status,
+      user: authenticated.user,
+      identity: authenticated.identity,
+      session,
+      authSession
+    }));
+  } catch (error) {
+    if (authRuntimeInternals.isResponseInterrupt(error)) {
+      throw error;
+    }
+    return createHostedAuthFailure(
+      error instanceof ClerkAuthConflictError ? error.code : "clerk_auth_failed",
+      getErrorMessage(error),
+      error instanceof ClerkAuthConflictError ? 409 : 422
+    );
+  }
+}
 function configureClerkAuthRuntime(bindings) {
+  const runtimeState = getRuntimeState();
   if (!bindings) {
-    clerkBindings = void 0;
+    runtimeState.bindings = void 0;
     return;
   }
-  clerkBindings = Object.freeze({
-    providers: bindings.providers ?? clerkBindings?.providers,
-    identityStore: bindings.identityStore ?? clerkBindings?.identityStore
+  runtimeState.bindings = Object.freeze({
+    providers: bindings.providers ?? runtimeState.bindings?.providers,
+    identityStore: bindings.identityStore ?? runtimeState.bindings?.identityStore
   });
 }
 function resetClerkAuthRuntime() {
-  clerkBindings = void 0;
+  getRuntimeState().bindings = void 0;
+  clerkDefaultProviderRuntimeCache.clear();
 }
 var clerkAuth = Object.freeze({
   authenticate,
+  completeClerkAuth,
+  loginWithClerk,
+  logoutWithClerk,
+  registerWithClerk,
   syncIdentity,
   verifyRequest,
   verifySession
@@ -765,6 +1264,7 @@ var clerkAuthInternals = {
   getBindings,
   getConfiguredProviderConfig,
   getSessionTokenFromRequest,
+  normalizeClerkUserProfile,
   normalizeHostedProfile,
   resolveConfiguredProviderName,
   resolveDisplayName,
@@ -777,7 +1277,11 @@ export {
   authenticate,
   clerkAuth,
   clerkAuthInternals,
+  completeClerkAuth,
   configureClerkAuthRuntime,
+  loginWithClerk,
+  logoutWithClerk,
+  registerWithClerk,
   resetClerkAuthRuntime,
   syncIdentity,
   verifyRequest,