@mayurajs/auth-clerk 0.0.0-stage → 1.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,8 @@
+Mayura
+Copyright 2026 The Mayura Authors
+
+This product includes software developed by the Mayura contributors.
+
+Third-party dependencies retain their own copyright and license terms. Exact
+resolved versions are recorded in pnpm-lock.yaml and reviewed by the release
+artifact and dependency qualification procedures.

package/README.md

@@ -1,3 +1,45 @@
-# Temporary Holding Version
+# @mayurajs/auth-clerk
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[Clerk](https://clerk.com) session tokens as Mayura server identities: verified with your instance's published keys
+(or its PEM key, with no network), on any runtime, with no dependency.
+
+```bash
+npm install mayura @mayurajs/auth-clerk
+```
+
+```ts
+import { mapCapabilities, principalId } from 'mayura/auth';
+import { clerkAuthenticator } from '@mayurajs/auth-clerk';
+
+const authenticate = clerkAuthenticator({
+  publishableKey: 'pk_live_...',                    // or frontendApi: 'https://clerk.example.com'
+  authorizedParties: ['https://app.example.com'],   // the origins your users sign in from
+  identity: session => session.orgId ? {
+    principalId: principalId('clerk', session.userId),
+    projectId: session.orgId,
+    agentIds: ['support'],
+    capabilities: mapCapabilities(session.orgPermissions, {
+      'org:agents:use': ['runs:submit', 'runs:read'],
+      'org:agents:operate': ['workflows:read', 'workflows:control'],
+    }),
+  } : null,
+});
+// createAgentServer({ ..., authenticate })
+```
+
+- **What is checked.** RS256 tokens issued by your Frontend API (read from the publishable key), signed with its keys
+  from `/.well-known/jwks.json` (or `jwtKey`, your PEM public key, with no network), within their 60-second lifetime
+  (5 s of clock skew, as Clerk's SDK). Their `azp` must be one of `authorizedParties` (Clerk tokens carry no audience;
+  this is what stands for it, against CSRF); `false` turns that off only where no browser is involved. Sessions Clerk
+  marks `pending` are refused unless `allowPending`.
+- **What you get.** `identity` receives the session: `userId`, `sessionId`, `status`, the active organization
+  (`orgId`, `orgSlug`, `orgRole` as `org:admin`) and the user's `orgPermissions` there (`org:<feature>:<permission>`),
+  decoded from version 2 tokens' feature bitmasks exactly as Clerk's SDK decodes them, or read from version 1 tokens;
+  `actor` when someone is impersonating the user; and the raw `claims`. Nothing is granted unless `identity` grants it.
+- `clerkFrontendApi(publishableKey)`, `clerkSession(claims)` and `clerkPermissions(claims)` are exported for your own
+  checks.
+- Clerk API keys are verified by `@mayurajs/km-clerk`.
+- Options: `publishableKey` or `frontendApi`, `jwtKey`, `authorizedParties`, `identity`, `allowPending`, `clockSkewMs`,
+  `maxIdentityMs` (60 s), `fetch`.
+
+See [Authentication and API keys](https://mayurajs.com/docs/guides/authentication/). Apache-2.0.

package/dist/index.d.ts

@@ -0,0 +1,71 @@
+import { type Authenticator, type IdentityGrant, type JwtClaims } from 'mayura/auth';
+/** A verified Clerk session, from its token's claims (version 2, or the older version 1). */
+export interface ClerkSession {
+    /** The user (`sub`). */
+    readonly userId: string;
+    /** The session (`sid`). */
+    readonly sessionId: string;
+    /** The session's status (`sts`), such as `active` or `pending`. */
+    readonly status: string | null;
+    /** The active organization, when there is one. */
+    readonly orgId: string | null;
+    readonly orgSlug: string | null;
+    /** The user's role in it, as Clerk names roles: `org:admin`. */
+    readonly orgRole: string | null;
+    /** The user's permissions in it, as Clerk names them: `org:invoices:read`. */
+    readonly orgPermissions: readonly string[];
+    /** Someone acting as the user (impersonation), from the `act` claim. */
+    readonly actor: {
+        readonly sub?: string;
+        readonly sid?: string;
+        readonly iss?: string;
+    } | null;
+    /** The token's claims, as verified. */
+    readonly claims: JwtClaims;
+}
+export interface ClerkAuthenticatorOptions {
+    /**
+     * Your Clerk publishable key (`pk_live_...` or `pk_test_...`), from which your Frontend API URL (the tokens' issuer
+     * and where its keys are published) is read. Or give `frontendApi`.
+     */
+    readonly publishableKey?: string;
+    /** Your Clerk Frontend API URL, such as `https://clerk.example.com`. */
+    readonly frontendApi?: string;
+    /**
+     * Your instance's JWKS public key (PEM, from the API keys page), to verify with no network at all. Without it, the
+     * keys are fetched from your Frontend API.
+     */
+    readonly jwtKey?: string;
+    /**
+     * The origins your users sign in from, which a token's `azp` must be one of, as Clerk advises against CSRF. `false`
+     * only where no browser is involved.
+     */
+    readonly authorizedParties: readonly string[] | false;
+    /** What a signed-in user may do, or null to refuse; for example from `session.orgPermissions` with `mapCapabilities`. */
+    readonly identity: (session: ClerkSession) => IdentityGrant | null | Promise<IdentityGrant | null>;
+    /** Accept sessions Clerk marks `pending` (tasks such as choosing an organization not done yet); refused by default. */
+    readonly allowPending?: boolean;
+    /** Clock difference allowed; 5 s by default, as Clerk's own SDK. */
+    readonly clockSkewMs?: number;
+    /** The longest an identity lasts before the token is checked again; 60 s by default (Clerk tokens last 60 s). */
+    readonly maxIdentityMs?: number;
+    /** For tests and proxies: the fetch to use for the JWKS. */
+    readonly fetch?: typeof fetch;
+}
+/** The Frontend API URL in a publishable key: `pk_<live|test>_` and the base64 of `<host>$`. */
+export declare function clerkFrontendApi(publishableKey: string): string;
+/** Clerk's organization permissions from a version 2 token: features (`fea`), names (`o.per`) and bitmasks (`o.fpm`). */
+export declare function clerkPermissions(claims: {
+    readonly fea?: unknown;
+    readonly o?: unknown;
+    readonly [claim: string]: unknown;
+}): string[];
+/** A Clerk session from verified claims, either token version. */
+export declare function clerkSession(claims: JwtClaims): ClerkSession | undefined;
+/**
+ * A server `authenticate` for Clerk session tokens: RS256 tokens issued by your Frontend API, verified with its
+ * published keys (or your PEM key, with no network), from your own origins (`azp`), active (not `pending`), and
+ * no older than Clerk's 60-second lifetime allows. `identity` decides what the user may do.
+ */
+export declare function clerkAuthenticator(options: ClerkAuthenticatorOptions): Authenticator;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EACvD,MAAM,aAAa,CAAC;AAErB,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,wBAAwB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2BAA2B;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/F,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IACtD,yHAAyH;IACzH,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnG,uHAAuH;IACvH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,iHAAiH;IACjH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B;AAID,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAM/D;AAkBD,yHAAyH;AACzH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAqBtI;AAED,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAexE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,aAAa,CA4BpF"}

package/dist/index.js

@@ -0,0 +1,136 @@
+import { MayuraError } from 'mayura';
+import { jwtAuthenticator, jwtVerifier, remoteJwks, } from 'mayura/auth';
+const decoder = new TextDecoder('utf-8', { fatal: true });
+/** The Frontend API URL in a publishable key: `pk_<live|test>_` and the base64 of `<host>$`. */
+export function clerkFrontendApi(publishableKey) {
+    const match = typeof publishableKey === 'string' ? /^pk_(?:live|test)_([A-Za-z0-9+/=_-]+)$/u.exec(publishableKey) : null;
+    let host;
+    try {
+        host = match ? decoder.decode(Uint8Array.from(atob(match[1].replace(/-/gu, '+').replace(/_/gu, '/')), char => char.charCodeAt(0))) : undefined;
+    }
+    catch {
+        host = undefined;
+    }
+    if (!host || !host.endsWith('$') || !/^[a-z0-9.-]+(?::\d{1,5})?$/iu.test(host.slice(0, -1)))
+        throw new MayuraError('INVALID_CONFIG', 'publishableKey is a Clerk publishable key, pk_live_... or pk_test_....');
+    return `https://${host.slice(0, -1)}`;
+}
+/** A key source for one PEM public key (SPKI), RS256, as Clerk publishes it for networkless verification. */
+function pemKey(pem) {
+    const body = typeof pem === 'string' ? /-----BEGIN PUBLIC KEY-----([A-Za-z0-9+/=\s]+)-----END PUBLIC KEY-----/u.exec(pem)?.[1]?.replace(/\s+/gu, '') : undefined;
+    let der;
+    try {
+        der = Uint8Array.from(atob(body ?? '!'), char => char.charCodeAt(0));
+    }
+    catch {
+        throw new MayuraError('INVALID_CONFIG', 'jwtKey is your instance\'s PEM public key (-----BEGIN PUBLIC KEY-----...).');
+    }
+    const key = crypto.subtle.importKey('spki', der, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']).catch(() => undefined);
+    return Object.freeze({
+        key: async () => {
+            const imported = await key;
+            if (!imported)
+                throw new MayuraError('INVALID_CONFIG', 'jwtKey is not an RSA public key Mayura can use.');
+            // The verifier accepts RS256 alone.
+            return imported;
+        },
+    });
+}
+/** Clerk's organization permissions from a version 2 token: features (`fea`), names (`o.per`) and bitmasks (`o.fpm`). */
+export function clerkPermissions(claims) {
+    const org = claims.o;
+    if (typeof claims.fea !== 'string' || typeof org?.per !== 'string' || typeof org.fpm !== 'string')
+        return [];
+    // Features scoped to organizations: `o:<feature>`, or both (`ou`, `uo`); as Clerk's own SDK reads them.
+    const features = [];
+    for (const part of claims.fea.split(',')) {
+        const item = part.trim();
+        const colon = item.indexOf(':');
+        if (colon === -1)
+            return [];
+        if (['o', 'ou', 'uo'].includes(item.slice(0, colon)))
+            features.push(item.slice(colon + 1));
+    }
+    const names = org.per.split(',').map(name => name.trim());
+    const masks = org.fpm.split(',').map(mask => mask.trim());
+    const permissions = [];
+    for (const [index, feature] of features.entries()) {
+        const mask = masks[index];
+        if (mask === undefined || !/^\d{1,300}$/u.test(mask))
+            continue;
+        // Bit 0 (the rightmost) is the first permission name.
+        const bits = BigInt(mask);
+        for (const [bit, name] of names.entries())
+            if ((bits >> BigInt(bit)) & 1n)
+                permissions.push(`org:${feature}:${name}`);
+    }
+    return permissions;
+}
+/** A Clerk session from verified claims, either token version. */
+export function clerkSession(claims) {
+    if (typeof claims.sub !== 'string' || claims.sub === '' || typeof claims['sid'] !== 'string')
+        return undefined;
+    const text = (value) => typeof value === 'string' && value !== '' ? value : null;
+    const actor = claims['act'] && typeof claims['act'] === 'object' ? claims['act'] : null;
+    const base = { userId: claims.sub, sessionId: claims['sid'], status: text(claims['sts']), actor, claims };
+    if (claims['v'] === 2) {
+        const org = claims['o'];
+        const orgId = text(org?.id);
+        return Object.freeze({ ...base, orgId, orgSlug: orgId ? text(org?.slg) : null, orgRole: orgId && text(org?.rol) ? `org:${org.rol}` : null,
+            orgPermissions: Object.freeze(orgId ? clerkPermissions(claims) : []) });
+    }
+    // Version 1 (Clerk stopped issuing these in April 2025).
+    const orgId = text(claims['org_id']);
+    const permissions = claims['org_permissions'];
+    return Object.freeze({ ...base, orgId, orgSlug: orgId ? text(claims['org_slug']) : null, orgRole: orgId ? text(claims['org_role']) : null,
+        orgPermissions: Object.freeze(orgId && Array.isArray(permissions) ? permissions.filter((item) => typeof item === 'string') : []) });
+}
+/**
+ * A server `authenticate` for Clerk session tokens: RS256 tokens issued by your Frontend API, verified with its
+ * published keys (or your PEM key, with no network), from your own origins (`azp`), active (not `pending`), and
+ * no older than Clerk's 60-second lifetime allows. `identity` decides what the user may do.
+ */
+export function clerkAuthenticator(options) {
+    if (!options || typeof options.identity !== 'function')
+        throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): identity decides what a signed-in user may do.');
+    let frontendApi;
+    if (options.frontendApi !== undefined) {
+        let url;
+        try {
+            url = new URL(options.frontendApi);
+        }
+        catch {
+            throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): frontendApi is your Clerk Frontend API URL.');
+        }
+        if (url.protocol !== 'https:' || url.pathname !== '/' || url.search || url.hash || url.username || url.password)
+            throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): frontendApi is an https origin, such as https://clerk.example.com.');
+        frontendApi = url.origin;
+        if (options.publishableKey !== undefined && clerkFrontendApi(options.publishableKey) !== frontendApi)
+            throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): publishableKey and frontendApi name different instances.');
+    }
+    else if (options.publishableKey !== undefined)
+        frontendApi = clerkFrontendApi(options.publishableKey);
+    else
+        throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): give publishableKey (or frontendApi): tokens are checked against your instance.');
+    const parties = options.authorizedParties;
+    if (parties !== false && (!Array.isArray(parties) || parties.length === 0 || parties.some(party => typeof party !== 'string' || !/^https?:\/\/[^/\s]+$/u.test(party)))) {
+        throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): authorizedParties are the origins your users sign in from, such as https://app.example.com, or false where no browser is involved.');
+    }
+    if (options.allowPending !== undefined && typeof options.allowPending !== 'boolean')
+        throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): allowPending must be a boolean.');
+    const keys = options.jwtKey !== undefined ? pemKey(options.jwtKey) : remoteJwks({ url: `${frontendApi}/.well-known/jwks.json`, ...(options.fetch ? { fetch: options.fetch } : {}) });
+    const verifier = jwtVerifier({ issuer: frontendApi, audience: false, algorithms: ['RS256'], keys, clockSkewMs: options.clockSkewMs ?? 5_000 });
+    return jwtAuthenticator({
+        verifier, ...(options.maxIdentityMs !== undefined ? { maxIdentityMs: options.maxIdentityMs } : {}),
+        identity: claims => {
+            // Clerk tokens carry no audience: the origin a token was made for (azp) stands for it.
+            if (parties !== false && (typeof claims['azp'] !== 'string' || !parties.includes(claims['azp'])))
+                return null;
+            const session = clerkSession(claims);
+            if (!session || (session.status === 'pending' && options.allowPending !== true))
+                return null;
+            return options.identity(session);
+        },
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EACL,gBAAgB,EAAE,WAAW,EAAE,UAAU,GAE1C,MAAM,aAAa,CAAC;AAqDrB,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1D,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,cAAsB;IACrD,MAAM,KAAK,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzH,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,SAAS,CAAC;IAAC,CAAC;IACpL,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,wEAAwE,CAAC,CAAC;IAC/M,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,6GAA6G;AAC7G,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,wEAAwE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjK,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QAAC,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;IAAC,CAAC;IAC9M,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAA8B,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtK,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YAC3B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;YAC1G,oCAAoC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,gBAAgB,CAAC,MAA2F;IAC1H,MAAM,GAAG,GAAG,MAAM,CAAC,CAAiD,CAAC;IACrE,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC7G,wGAAwG;IACxG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,sDAAsD;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE;YAAE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;gBAAE,WAAW,CAAC,IAAI,CAAC,OAAO,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/G,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;IACjH,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC1G,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAA+D,CAAC;QACtF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAI,CAAC,GAAa,EAAE,CAAC,CAAC,CAAC,IAAI;YAClJ,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,yDAAyD;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAAC,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACvI,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACxJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU;QAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,sEAAsE,CAAC,CAAC;IACxK,IAAI,WAAmB,CAAC;IACxB,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,mEAAmE,CAAC,CAAC;QAAC,CAAC;QACnK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,0FAA0F,CAAC,CAAC;QACrP,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,WAAW;YAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,gFAAgF,CAAC,CAAC;IAClO,CAAC;SAAM,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;QAAE,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;;QACnG,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,uGAAuG,CAAC,CAAC;IACtJ,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvK,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,0JAA0J,CAAC,CAAC;IACtM,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IACtL,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,WAAW,wBAAwB,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrL,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC;IAC/I,OAAO,gBAAgB,CAAC;QACtB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,QAAQ,EAAE,MAAM,CAAC,EAAE;YACjB,uFAAuF;YACvF,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9G,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7F,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { MayuraError } from 'mayura';\nimport {\n  jwtAuthenticator, jwtVerifier, remoteJwks,\n  type Authenticator, type IdentityGrant, type JwtClaims, type JwtKeySource,\n} from 'mayura/auth';\n\n/** A verified Clerk session, from its token's claims (version 2, or the older version 1). */\nexport interface ClerkSession {\n  /** The user (`sub`). */\n  readonly userId: string;\n  /** The session (`sid`). */\n  readonly sessionId: string;\n  /** The session's status (`sts`), such as `active` or `pending`. */\n  readonly status: string | null;\n  /** The active organization, when there is one. */\n  readonly orgId: string | null;\n  readonly orgSlug: string | null;\n  /** The user's role in it, as Clerk names roles: `org:admin`. */\n  readonly orgRole: string | null;\n  /** The user's permissions in it, as Clerk names them: `org:invoices:read`. */\n  readonly orgPermissions: readonly string[];\n  /** Someone acting as the user (impersonation), from the `act` claim. */\n  readonly actor: { readonly sub?: string; readonly sid?: string; readonly iss?: string } | null;\n  /** The token's claims, as verified. */\n  readonly claims: JwtClaims;\n}\n\nexport interface ClerkAuthenticatorOptions {\n  /**\n   * Your Clerk publishable key (`pk_live_...` or `pk_test_...`), from which your Frontend API URL (the tokens' issuer\n   * and where its keys are published) is read. Or give `frontendApi`.\n   */\n  readonly publishableKey?: string;\n  /** Your Clerk Frontend API URL, such as `https://clerk.example.com`. */\n  readonly frontendApi?: string;\n  /**\n   * Your instance's JWKS public key (PEM, from the API keys page), to verify with no network at all. Without it, the\n   * keys are fetched from your Frontend API.\n   */\n  readonly jwtKey?: string;\n  /**\n   * The origins your users sign in from, which a token's `azp` must be one of, as Clerk advises against CSRF. `false`\n   * only where no browser is involved.\n   */\n  readonly authorizedParties: readonly string[] | false;\n  /** What a signed-in user may do, or null to refuse; for example from `session.orgPermissions` with `mapCapabilities`. */\n  readonly identity: (session: ClerkSession) => IdentityGrant | null | Promise<IdentityGrant | null>;\n  /** Accept sessions Clerk marks `pending` (tasks such as choosing an organization not done yet); refused by default. */\n  readonly allowPending?: boolean;\n  /** Clock difference allowed; 5 s by default, as Clerk's own SDK. */\n  readonly clockSkewMs?: number;\n  /** The longest an identity lasts before the token is checked again; 60 s by default (Clerk tokens last 60 s). */\n  readonly maxIdentityMs?: number;\n  /** For tests and proxies: the fetch to use for the JWKS. */\n  readonly fetch?: typeof fetch;\n}\n\nconst decoder = new TextDecoder('utf-8', { fatal: true });\n\n/** The Frontend API URL in a publishable key: `pk_<live|test>_` and the base64 of `<host>$`. */\nexport function clerkFrontendApi(publishableKey: string): string {\n  const match = typeof publishableKey === 'string' ? /^pk_(?:live|test)_([A-Za-z0-9+/=_-]+)$/u.exec(publishableKey) : null;\n  let host: string | undefined;\n  try { host = match ? decoder.decode(Uint8Array.from(atob(match[1]!.replace(/-/gu, '+').replace(/_/gu, '/')), char => char.charCodeAt(0))) : undefined; } catch { host = undefined; }\n  if (!host || !host.endsWith('$') || !/^[a-z0-9.-]+(?::\\d{1,5})?$/iu.test(host.slice(0, -1))) throw new MayuraError('INVALID_CONFIG', 'publishableKey is a Clerk publishable key, pk_live_... or pk_test_....');\n  return `https://${host.slice(0, -1)}`;\n}\n\n/** A key source for one PEM public key (SPKI), RS256, as Clerk publishes it for networkless verification. */\nfunction pemKey(pem: string): JwtKeySource {\n  const body = typeof pem === 'string' ? /-----BEGIN PUBLIC KEY-----([A-Za-z0-9+/=\\s]+)-----END PUBLIC KEY-----/u.exec(pem)?.[1]?.replace(/\\s+/gu, '') : undefined;\n  let der: Uint8Array;\n  try { der = Uint8Array.from(atob(body ?? '!'), char => char.charCodeAt(0)); } catch { throw new MayuraError('INVALID_CONFIG', 'jwtKey is your instance\\'s PEM public key (-----BEGIN PUBLIC KEY-----...).'); }\n  const key = crypto.subtle.importKey('spki', der as Uint8Array<ArrayBuffer>, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']).catch(() => undefined);\n  return Object.freeze({\n    key: async () => {\n      const imported = await key;\n      if (!imported) throw new MayuraError('INVALID_CONFIG', 'jwtKey is not an RSA public key Mayura can use.');\n      // The verifier accepts RS256 alone.\n      return imported;\n    },\n  });\n}\n\n/** Clerk's organization permissions from a version 2 token: features (`fea`), names (`o.per`) and bitmasks (`o.fpm`). */\nexport function clerkPermissions(claims: { readonly fea?: unknown; readonly o?: unknown; readonly [claim: string]: unknown }): string[] {\n  const org = claims.o as { per?: unknown; fpm?: unknown } | undefined;\n  if (typeof claims.fea !== 'string' || typeof org?.per !== 'string' || typeof org.fpm !== 'string') return [];\n  // Features scoped to organizations: `o:<feature>`, or both (`ou`, `uo`); as Clerk's own SDK reads them.\n  const features: string[] = [];\n  for (const part of claims.fea.split(',')) {\n    const item = part.trim(); const colon = item.indexOf(':');\n    if (colon === -1) return [];\n    if (['o', 'ou', 'uo'].includes(item.slice(0, colon))) features.push(item.slice(colon + 1));\n  }\n  const names = org.per.split(',').map(name => name.trim());\n  const masks = org.fpm.split(',').map(mask => mask.trim());\n  const permissions: string[] = [];\n  for (const [index, feature] of features.entries()) {\n    const mask = masks[index];\n    if (mask === undefined || !/^\\d{1,300}$/u.test(mask)) continue;\n    // Bit 0 (the rightmost) is the first permission name.\n    const bits = BigInt(mask);\n    for (const [bit, name] of names.entries()) if ((bits >> BigInt(bit)) & 1n) permissions.push(`org:${feature}:${name}`);\n  }\n  return permissions;\n}\n\n/** A Clerk session from verified claims, either token version. */\nexport function clerkSession(claims: JwtClaims): ClerkSession | undefined {\n  if (typeof claims.sub !== 'string' || claims.sub === '' || typeof claims['sid'] !== 'string') return undefined;\n  const text = (value: unknown) => typeof value === 'string' && value !== '' ? value : null;\n  const actor = claims['act'] && typeof claims['act'] === 'object' ? claims['act'] as ClerkSession['actor'] : null;\n  const base = { userId: claims.sub, sessionId: claims['sid'], status: text(claims['sts']), actor, claims };\n  if (claims['v'] === 2) {\n    const org = claims['o'] as { id?: unknown; slg?: unknown; rol?: unknown } | undefined;\n    const orgId = text(org?.id);\n    return Object.freeze({ ...base, orgId, orgSlug: orgId ? text(org?.slg) : null, orgRole: orgId && text(org?.rol) ? `org:${org!.rol as string}` : null,\n      orgPermissions: Object.freeze(orgId ? clerkPermissions(claims) : []) });\n  }\n  // Version 1 (Clerk stopped issuing these in April 2025).\n  const orgId = text(claims['org_id']); const permissions = claims['org_permissions'];\n  return Object.freeze({ ...base, orgId, orgSlug: orgId ? text(claims['org_slug']) : null, orgRole: orgId ? text(claims['org_role']) : null,\n    orgPermissions: Object.freeze(orgId && Array.isArray(permissions) ? permissions.filter((item): item is string => typeof item === 'string') : []) });\n}\n\n/**\n * A server `authenticate` for Clerk session tokens: RS256 tokens issued by your Frontend API, verified with its\n * published keys (or your PEM key, with no network), from your own origins (`azp`), active (not `pending`), and\n * no older than Clerk's 60-second lifetime allows. `identity` decides what the user may do.\n */\nexport function clerkAuthenticator(options: ClerkAuthenticatorOptions): Authenticator {\n  if (!options || typeof options.identity !== 'function') throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): identity decides what a signed-in user may do.');\n  let frontendApi: string;\n  if (options.frontendApi !== undefined) {\n    let url: URL;\n    try { url = new URL(options.frontendApi); } catch { throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): frontendApi is your Clerk Frontend API URL.'); }\n    if (url.protocol !== 'https:' || url.pathname !== '/' || url.search || url.hash || url.username || url.password) throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): frontendApi is an https origin, such as https://clerk.example.com.');\n    frontendApi = url.origin;\n    if (options.publishableKey !== undefined && clerkFrontendApi(options.publishableKey) !== frontendApi) throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): publishableKey and frontendApi name different instances.');\n  } else if (options.publishableKey !== undefined) frontendApi = clerkFrontendApi(options.publishableKey);\n  else throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): give publishableKey (or frontendApi): tokens are checked against your instance.');\n  const parties = options.authorizedParties;\n  if (parties !== false && (!Array.isArray(parties) || parties.length === 0 || parties.some(party => typeof party !== 'string' || !/^https?:\\/\\/[^/\\s]+$/u.test(party)))) {\n    throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): authorizedParties are the origins your users sign in from, such as https://app.example.com, or false where no browser is involved.');\n  }\n  if (options.allowPending !== undefined && typeof options.allowPending !== 'boolean') throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): allowPending must be a boolean.');\n  const keys = options.jwtKey !== undefined ? pemKey(options.jwtKey) : remoteJwks({ url: `${frontendApi}/.well-known/jwks.json`, ...(options.fetch ? { fetch: options.fetch } : {}) });\n  const verifier = jwtVerifier({ issuer: frontendApi, audience: false, algorithms: ['RS256'], keys, clockSkewMs: options.clockSkewMs ?? 5_000 });\n  return jwtAuthenticator({\n    verifier, ...(options.maxIdentityMs !== undefined ? { maxIdentityMs: options.maxIdentityMs } : {}),\n    identity: claims => {\n      // Clerk tokens carry no audience: the origin a token was made for (azp) stands for it.\n      if (parties !== false && (typeof claims['azp'] !== 'string' || !parties.includes(claims['azp']))) return null;\n      const session = clerkSession(claims);\n      if (!session || (session.status === 'pending' && options.allowPending !== true)) return null;\n      return options.identity(session);\n    },\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@mayurajs/auth-clerk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.1.0",
+  "description": "Clerk session tokens as Mayura server identities, verified with Clerk's published keys or its PEM key.",
+  "author": {
+    "name": "Aryabh",
+    "email": "dev@rokad.co"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/KartikeyAI/mayura.git",
+    "directory": "extensions/auth-clerk"
+  },
+  "homepage": "https://github.com/KartikeyAI/mayura#readme",
+  "bugs": {
+    "url": "https://github.com/KartikeyAI/mayura/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22.12.0 <23 || >=24.14.1 <25"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src/**/*.ts",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "dependencies": {},
+  "peerDependencies": {
+    "mayura": "^1.1.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/src/index.ts

@@ -0,0 +1,160 @@
+import { MayuraError } from 'mayura';
+import {
+  jwtAuthenticator, jwtVerifier, remoteJwks,
+  type Authenticator, type IdentityGrant, type JwtClaims, type JwtKeySource,
+} from 'mayura/auth';
+
+/** A verified Clerk session, from its token's claims (version 2, or the older version 1). */
+export interface ClerkSession {
+  /** The user (`sub`). */
+  readonly userId: string;
+  /** The session (`sid`). */
+  readonly sessionId: string;
+  /** The session's status (`sts`), such as `active` or `pending`. */
+  readonly status: string | null;
+  /** The active organization, when there is one. */
+  readonly orgId: string | null;
+  readonly orgSlug: string | null;
+  /** The user's role in it, as Clerk names roles: `org:admin`. */
+  readonly orgRole: string | null;
+  /** The user's permissions in it, as Clerk names them: `org:invoices:read`. */
+  readonly orgPermissions: readonly string[];
+  /** Someone acting as the user (impersonation), from the `act` claim. */
+  readonly actor: { readonly sub?: string; readonly sid?: string; readonly iss?: string } | null;
+  /** The token's claims, as verified. */
+  readonly claims: JwtClaims;
+}
+
+export interface ClerkAuthenticatorOptions {
+  /**
+   * Your Clerk publishable key (`pk_live_...` or `pk_test_...`), from which your Frontend API URL (the tokens' issuer
+   * and where its keys are published) is read. Or give `frontendApi`.
+   */
+  readonly publishableKey?: string;
+  /** Your Clerk Frontend API URL, such as `https://clerk.example.com`. */
+  readonly frontendApi?: string;
+  /**
+   * Your instance's JWKS public key (PEM, from the API keys page), to verify with no network at all. Without it, the
+   * keys are fetched from your Frontend API.
+   */
+  readonly jwtKey?: string;
+  /**
+   * The origins your users sign in from, which a token's `azp` must be one of, as Clerk advises against CSRF. `false`
+   * only where no browser is involved.
+   */
+  readonly authorizedParties: readonly string[] | false;
+  /** What a signed-in user may do, or null to refuse; for example from `session.orgPermissions` with `mapCapabilities`. */
+  readonly identity: (session: ClerkSession) => IdentityGrant | null | Promise<IdentityGrant | null>;
+  /** Accept sessions Clerk marks `pending` (tasks such as choosing an organization not done yet); refused by default. */
+  readonly allowPending?: boolean;
+  /** Clock difference allowed; 5 s by default, as Clerk's own SDK. */
+  readonly clockSkewMs?: number;
+  /** The longest an identity lasts before the token is checked again; 60 s by default (Clerk tokens last 60 s). */
+  readonly maxIdentityMs?: number;
+  /** For tests and proxies: the fetch to use for the JWKS. */
+  readonly fetch?: typeof fetch;
+}
+
+const decoder = new TextDecoder('utf-8', { fatal: true });
+
+/** The Frontend API URL in a publishable key: `pk_<live|test>_` and the base64 of `<host>$`. */
+export function clerkFrontendApi(publishableKey: string): string {
+  const match = typeof publishableKey === 'string' ? /^pk_(?:live|test)_([A-Za-z0-9+/=_-]+)$/u.exec(publishableKey) : null;
+  let host: string | undefined;
+  try { host = match ? decoder.decode(Uint8Array.from(atob(match[1]!.replace(/-/gu, '+').replace(/_/gu, '/')), char => char.charCodeAt(0))) : undefined; } catch { host = undefined; }
+  if (!host || !host.endsWith('$') || !/^[a-z0-9.-]+(?::\d{1,5})?$/iu.test(host.slice(0, -1))) throw new MayuraError('INVALID_CONFIG', 'publishableKey is a Clerk publishable key, pk_live_... or pk_test_....');
+  return `https://${host.slice(0, -1)}`;
+}
+
+/** A key source for one PEM public key (SPKI), RS256, as Clerk publishes it for networkless verification. */
+function pemKey(pem: string): JwtKeySource {
+  const body = typeof pem === 'string' ? /-----BEGIN PUBLIC KEY-----([A-Za-z0-9+/=\s]+)-----END PUBLIC KEY-----/u.exec(pem)?.[1]?.replace(/\s+/gu, '') : undefined;
+  let der: Uint8Array;
+  try { der = Uint8Array.from(atob(body ?? '!'), char => char.charCodeAt(0)); } catch { throw new MayuraError('INVALID_CONFIG', 'jwtKey is your instance\'s PEM public key (-----BEGIN PUBLIC KEY-----...).'); }
+  const key = crypto.subtle.importKey('spki', der as Uint8Array<ArrayBuffer>, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']).catch(() => undefined);
+  return Object.freeze({
+    key: async () => {
+      const imported = await key;
+      if (!imported) throw new MayuraError('INVALID_CONFIG', 'jwtKey is not an RSA public key Mayura can use.');
+      // The verifier accepts RS256 alone.
+      return imported;
+    },
+  });
+}
+
+/** Clerk's organization permissions from a version 2 token: features (`fea`), names (`o.per`) and bitmasks (`o.fpm`). */
+export function clerkPermissions(claims: { readonly fea?: unknown; readonly o?: unknown; readonly [claim: string]: unknown }): string[] {
+  const org = claims.o as { per?: unknown; fpm?: unknown } | undefined;
+  if (typeof claims.fea !== 'string' || typeof org?.per !== 'string' || typeof org.fpm !== 'string') return [];
+  // Features scoped to organizations: `o:<feature>`, or both (`ou`, `uo`); as Clerk's own SDK reads them.
+  const features: string[] = [];
+  for (const part of claims.fea.split(',')) {
+    const item = part.trim(); const colon = item.indexOf(':');
+    if (colon === -1) return [];
+    if (['o', 'ou', 'uo'].includes(item.slice(0, colon))) features.push(item.slice(colon + 1));
+  }
+  const names = org.per.split(',').map(name => name.trim());
+  const masks = org.fpm.split(',').map(mask => mask.trim());
+  const permissions: string[] = [];
+  for (const [index, feature] of features.entries()) {
+    const mask = masks[index];
+    if (mask === undefined || !/^\d{1,300}$/u.test(mask)) continue;
+    // Bit 0 (the rightmost) is the first permission name.
+    const bits = BigInt(mask);
+    for (const [bit, name] of names.entries()) if ((bits >> BigInt(bit)) & 1n) permissions.push(`org:${feature}:${name}`);
+  }
+  return permissions;
+}
+
+/** A Clerk session from verified claims, either token version. */
+export function clerkSession(claims: JwtClaims): ClerkSession | undefined {
+  if (typeof claims.sub !== 'string' || claims.sub === '' || typeof claims['sid'] !== 'string') return undefined;
+  const text = (value: unknown) => typeof value === 'string' && value !== '' ? value : null;
+  const actor = claims['act'] && typeof claims['act'] === 'object' ? claims['act'] as ClerkSession['actor'] : null;
+  const base = { userId: claims.sub, sessionId: claims['sid'], status: text(claims['sts']), actor, claims };
+  if (claims['v'] === 2) {
+    const org = claims['o'] as { id?: unknown; slg?: unknown; rol?: unknown } | undefined;
+    const orgId = text(org?.id);
+    return Object.freeze({ ...base, orgId, orgSlug: orgId ? text(org?.slg) : null, orgRole: orgId && text(org?.rol) ? `org:${org!.rol as string}` : null,
+      orgPermissions: Object.freeze(orgId ? clerkPermissions(claims) : []) });
+  }
+  // Version 1 (Clerk stopped issuing these in April 2025).
+  const orgId = text(claims['org_id']); const permissions = claims['org_permissions'];
+  return Object.freeze({ ...base, orgId, orgSlug: orgId ? text(claims['org_slug']) : null, orgRole: orgId ? text(claims['org_role']) : null,
+    orgPermissions: Object.freeze(orgId && Array.isArray(permissions) ? permissions.filter((item): item is string => typeof item === 'string') : []) });
+}
+
+/**
+ * A server `authenticate` for Clerk session tokens: RS256 tokens issued by your Frontend API, verified with its
+ * published keys (or your PEM key, with no network), from your own origins (`azp`), active (not `pending`), and
+ * no older than Clerk's 60-second lifetime allows. `identity` decides what the user may do.
+ */
+export function clerkAuthenticator(options: ClerkAuthenticatorOptions): Authenticator {
+  if (!options || typeof options.identity !== 'function') throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): identity decides what a signed-in user may do.');
+  let frontendApi: string;
+  if (options.frontendApi !== undefined) {
+    let url: URL;
+    try { url = new URL(options.frontendApi); } catch { throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): frontendApi is your Clerk Frontend API URL.'); }
+    if (url.protocol !== 'https:' || url.pathname !== '/' || url.search || url.hash || url.username || url.password) throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): frontendApi is an https origin, such as https://clerk.example.com.');
+    frontendApi = url.origin;
+    if (options.publishableKey !== undefined && clerkFrontendApi(options.publishableKey) !== frontendApi) throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): publishableKey and frontendApi name different instances.');
+  } else if (options.publishableKey !== undefined) frontendApi = clerkFrontendApi(options.publishableKey);
+  else throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): give publishableKey (or frontendApi): tokens are checked against your instance.');
+  const parties = options.authorizedParties;
+  if (parties !== false && (!Array.isArray(parties) || parties.length === 0 || parties.some(party => typeof party !== 'string' || !/^https?:\/\/[^/\s]+$/u.test(party)))) {
+    throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): authorizedParties are the origins your users sign in from, such as https://app.example.com, or false where no browser is involved.');
+  }
+  if (options.allowPending !== undefined && typeof options.allowPending !== 'boolean') throw new MayuraError('INVALID_CONFIG', 'clerkAuthenticator(): allowPending must be a boolean.');
+  const keys = options.jwtKey !== undefined ? pemKey(options.jwtKey) : remoteJwks({ url: `${frontendApi}/.well-known/jwks.json`, ...(options.fetch ? { fetch: options.fetch } : {}) });
+  const verifier = jwtVerifier({ issuer: frontendApi, audience: false, algorithms: ['RS256'], keys, clockSkewMs: options.clockSkewMs ?? 5_000 });
+  return jwtAuthenticator({
+    verifier, ...(options.maxIdentityMs !== undefined ? { maxIdentityMs: options.maxIdentityMs } : {}),
+    identity: claims => {
+      // Clerk tokens carry no audience: the origin a token was made for (azp) stands for it.
+      if (parties !== false && (typeof claims['azp'] !== 'string' || !parties.includes(claims['azp']))) return null;
+      const session = clerkSession(claims);
+      if (!session || (session.status === 'pending' && options.allowPending !== true)) return null;
+      return options.identity(session);
+    },
+  });
+}