@vibedeckx/linux-x64 0.1.11 → 0.1.15

package/node_modules/@clerk/backend/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/proxy.ts"],"sourcesContent":["import {\n  DEFAULT_PROXY_PATH,\n  LEGACY_DEV_INSTANCE_SUFFIXES,\n  LOCAL_ENV_SUFFIXES,\n  LOCAL_FAPI_URL,\n  PROD_FAPI_URL,\n  STAGING_ENV_SUFFIXES,\n  STAGING_FAPI_URL,\n} from '@clerk/shared/constants';\nimport { parsePublishableKey } from '@clerk/shared/keys';\n\nexport { DEFAULT_PROXY_PATH } from '@clerk/shared/constants';\n\n/**\n * Options for the Frontend API proxy\n */\nexport interface FrontendApiProxyOptions {\n  /**\n   * The path prefix for proxy requests. Defaults to `/__clerk`.\n   */\n  proxyPath?: string;\n  /**\n   * The Clerk publishable key. Falls back to CLERK_PUBLISHABLE_KEY env var.\n   */\n  publishableKey?: string;\n  /**\n   * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.\n   */\n  secretKey?: string;\n}\n\n/**\n * Error codes for proxy errors\n */\nexport type ProxyErrorCode = 'proxy_configuration_error' | 'proxy_path_mismatch' | 'proxy_request_failed';\n\n/**\n * Error response structure for proxy errors\n */\nexport interface ProxyError {\n  code: ProxyErrorCode;\n  message: string;\n}\n\n// Hop-by-hop headers that should not be forwarded\nconst HOP_BY_HOP_HEADERS = new Set([\n  'connection',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailer',\n  'transfer-encoding',\n  'upgrade',\n]);\n\n/**\n * Parses the Connection header to extract dynamically-nominated hop-by-hop\n * header names (RFC 7230 Section 6.1). These headers are specific to the\n * current connection and must not be forwarded by proxies.\n */\nfunction getDynamicHopByHopHeaders(headers: Headers): Set<string> {\n  const connectionValue = headers.get('connection');\n  if (!connectionValue) {\n    return new Set();\n  }\n  return new Set(\n    connectionValue\n      .split(',')\n      .map(h => h.trim().toLowerCase())\n      .filter(h => h.length > 0),\n  );\n}\n\n// Headers to strip from proxied responses. fetch() auto-decompresses\n// response bodies, so Content-Encoding no longer describes the body\n// and Content-Length reflects the compressed size. We request identity\n// encoding upstream to avoid the double compression pass, but strip\n// these defensively since servers may ignore Accept-Encoding: identity.\nconst RESPONSE_HEADERS_TO_STRIP = new Set(['content-encoding', 'content-length']);\n\n/**\n * Derives the Frontend API URL from a publishable key.\n * @param publishableKey - The Clerk publishable key\n * @returns The Frontend API URL for the environment\n */\nexport function fapiUrlFromPublishableKey(publishableKey: string): string {\n  const frontendApi = parsePublishableKey(publishableKey)?.frontendApi;\n\n  if (frontendApi?.startsWith('clerk.') && LEGACY_DEV_INSTANCE_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return PROD_FAPI_URL;\n  }\n\n  if (LOCAL_ENV_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return LOCAL_FAPI_URL;\n  }\n  if (STAGING_ENV_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return STAGING_FAPI_URL;\n  }\n  return PROD_FAPI_URL;\n}\n\n/**\n * Removes trailing slashes from a string without using regex\n * to avoid potential ReDoS concerns flagged by security scanners.\n */\nexport function stripTrailingSlashes(str: string): string {\n  while (str.endsWith('/')) {\n    str = str.slice(0, -1);\n  }\n  return str;\n}\n\n/**\n * Checks if a request path matches the proxy path.\n * @param request - The incoming request\n * @param options - Proxy options including the proxy path\n * @returns True if the request matches the proxy path\n */\nexport function matchProxyPath(request: Request, options?: Pick<FrontendApiProxyOptions, 'proxyPath'>): boolean {\n  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);\n  const url = new URL(request.url);\n  return url.pathname === proxyPath || url.pathname.startsWith(proxyPath + '/');\n}\n\n/**\n * Creates a JSON error response\n */\nfunction createErrorResponse(code: ProxyErrorCode, message: string, status: number): Response {\n  const error: ProxyError = { code, message };\n  return new Response(JSON.stringify({ errors: [error] }), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      'Cache-Control': 'no-store',\n    },\n  });\n}\n\n/**\n * Derives the public-facing origin from forwarded headers, falling back to the raw request URL.\n * Behind a reverse proxy, request.url is typically localhost, but the Clerk-Proxy-Url header\n * and Location rewrites must use the origin visible to the browser.\n */\nfunction derivePublicOrigin(request: Request, requestUrl: URL): string {\n  const forwardedProto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();\n  const forwardedHost = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim();\n\n  if (forwardedProto && forwardedHost) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return requestUrl.origin;\n}\n\n/**\n * Gets the client IP address from various headers\n */\nfunction getClientIp(request: Request): string | undefined {\n  const cfConnectingIp = request.headers.get('cf-connecting-ip');\n  if (cfConnectingIp) {\n    return cfConnectingIp;\n  }\n\n  const xRealIp = request.headers.get('x-real-ip');\n  if (xRealIp) {\n    return xRealIp;\n  }\n\n  const xForwardedFor = request.headers.get('x-forwarded-for');\n  if (xForwardedFor) {\n    // Take the first IP in the chain\n    return xForwardedFor.split(',')[0]?.trim();\n  }\n\n  return undefined;\n}\n\n/**\n * Proxies a request to Clerk's Frontend API.\n *\n * This function handles forwarding requests from your application to Clerk's\n * Frontend API, enabling scenarios where direct communication with Clerk's API\n * is blocked or needs to go through your application server.\n *\n * @param request - The incoming request to proxy\n * @param options - Proxy configuration options\n * @returns A Response from Clerk's Frontend API\n *\n * @example\n * ```typescript\n * import { clerkFrontendApiProxy } from '@clerk/backend/proxy';\n *\n * // In a route handler\n * const response = await clerkFrontendApiProxy(request, {\n *   proxyPath: '/__clerk',\n *   publishableKey: process.env.CLERK_PUBLISHABLE_KEY,\n *   secretKey: process.env.CLERK_SECRET_KEY,\n * });\n * ```\n */\nexport async function clerkFrontendApiProxy(request: Request, options?: FrontendApiProxyOptions): Promise<Response> {\n  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);\n  const publishableKey =\n    options?.publishableKey || (typeof process !== 'undefined' ? process.env?.CLERK_PUBLISHABLE_KEY : undefined);\n  const secretKey = options?.secretKey || (typeof process !== 'undefined' ? process.env?.CLERK_SECRET_KEY : undefined);\n\n  // Validate configuration\n  if (!publishableKey) {\n    return createErrorResponse(\n      'proxy_configuration_error',\n      'Missing publishableKey. Provide it in options or set CLERK_PUBLISHABLE_KEY environment variable.',\n      500,\n    );\n  }\n\n  if (!secretKey) {\n    return createErrorResponse(\n      'proxy_configuration_error',\n      'Missing secretKey. Provide it in options or set CLERK_SECRET_KEY environment variable.',\n      500,\n    );\n  }\n\n  // Get the request URL and validate path\n  const requestUrl = new URL(request.url);\n  const pathMatches = requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + '/');\n  if (!pathMatches) {\n    return createErrorResponse(\n      'proxy_path_mismatch',\n      `Request path \"${requestUrl.pathname}\" does not match proxy path \"${proxyPath}\"`,\n      400,\n    );\n  }\n\n  // Derive the FAPI URL and construct the target URL.\n  // Use string concatenation instead of `new URL(path, base)` to avoid\n  // protocol-relative resolution (e.g., \"//evil.com\" resolving to a different host).\n  const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);\n  const fapiHost = new URL(fapiBaseUrl).host;\n  const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';\n  const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);\n  targetUrl.search = requestUrl.search;\n\n  if (targetUrl.host !== fapiHost) {\n    return createErrorResponse('proxy_request_failed', 'Resolved target does not match the expected host', 400);\n  }\n\n  // Build headers for the proxied request\n  const headers = new Headers();\n\n  // Copy original headers, excluding hop-by-hop headers and any\n  // dynamically-nominated hop-by-hop headers listed in the Connection header (RFC 7230 Section 6.1).\n  const dynamicHopByHop = getDynamicHopByHopHeaders(request.headers);\n  request.headers.forEach((value, key) => {\n    const lower = key.toLowerCase();\n    if (!HOP_BY_HOP_HEADERS.has(lower) && !dynamicHopByHop.has(lower)) {\n      headers.set(key, value);\n    }\n  });\n\n  // Set required Clerk proxy headers\n  // Use the public origin (from forwarded headers) so the Clerk-Proxy-Url\n  // points to the browser-visible host, not localhost behind a reverse proxy.\n  const publicOrigin = derivePublicOrigin(request, requestUrl);\n  const proxyUrl = `${publicOrigin}${proxyPath}`;\n  headers.set('Clerk-Proxy-Url', proxyUrl);\n  headers.set('Clerk-Secret-Key', secretKey);\n\n  // Set the host header to the FAPI host\n  headers.set('Host', fapiHost);\n\n  // Request uncompressed responses to avoid a double compression pass.\n  // fetch() auto-decompresses, so without this FAPI compresses → fetch\n  // decompresses → the serving layer re-compresses for the browser.\n  headers.set('Accept-Encoding', 'identity');\n\n  // Set X-Forwarded-* headers for proxy awareness\n  // Only set these if not already present (preserve values from upstream proxies)\n  if (!headers.has('X-Forwarded-Host')) {\n    headers.set('X-Forwarded-Host', requestUrl.host);\n  }\n  if (!headers.has('X-Forwarded-Proto')) {\n    headers.set('X-Forwarded-Proto', requestUrl.protocol.replace(':', ''));\n  }\n\n  // Set X-Forwarded-For to the client IP\n  // In multi-proxy scenarios, we prefer authoritative headers (CF-Connecting-IP, X-Real-IP)\n  // over the existing X-Forwarded-For chain, as they provide the true client IP\n  const clientIp = getClientIp(request);\n  if (clientIp) {\n    headers.set('X-Forwarded-For', clientIp);\n  }\n\n  // Determine if request has a body (handles DELETE-with-body and any other method)\n  const hasBody = request.body !== null;\n\n  try {\n    // Make the proxied request\n    // TODO: Consider adding AbortSignal.timeout(30_000) via AbortSignal.any()\n    const fetchOptions: RequestInit = {\n      method: request.method,\n      headers,\n      redirect: 'manual',\n      signal: request.signal,\n    };\n\n    // Only set duplex when body is present (required for streaming bodies)\n    if (hasBody) {\n      // @ts-expect-error - duplex is required for streaming bodies, but not present on the RequestInit type from undici\n      fetchOptions.duplex = 'half';\n      fetchOptions.body = request.body;\n    }\n\n    const response = await fetch(targetUrl.toString(), fetchOptions);\n\n    // Build response headers, excluding hop-by-hop and encoding headers.\n    // Also strip dynamically-nominated hop-by-hop headers from the response Connection header.\n    const responseDynamicHopByHop = getDynamicHopByHopHeaders(response.headers);\n    const responseHeaders = new Headers();\n    response.headers.forEach((value, key) => {\n      const lower = key.toLowerCase();\n      if (\n        !HOP_BY_HOP_HEADERS.has(lower) &&\n        !RESPONSE_HEADERS_TO_STRIP.has(lower) &&\n        !responseDynamicHopByHop.has(lower)\n      ) {\n        if (lower === 'set-cookie') {\n          responseHeaders.append(key, value);\n        } else {\n          responseHeaders.set(key, value);\n        }\n      }\n    });\n\n    // Rewrite Location header for redirects to go through the proxy\n    const locationHeader = response.headers.get('location');\n    if (locationHeader) {\n      try {\n        const locationUrl = new URL(locationHeader, fapiBaseUrl);\n        // Check if the redirect points to the FAPI host\n        if (locationUrl.host === fapiHost) {\n          // Rewrite to go through the proxy\n          const rewrittenLocation = `${proxyUrl}${locationUrl.pathname}${locationUrl.search}${locationUrl.hash}`;\n          responseHeaders.set('Location', rewrittenLocation);\n        }\n      } catch {\n        // If URL parsing fails, leave the Location header as-is (could be a relative URL)\n      }\n    }\n\n    const proxyResponse = new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers: responseHeaders,\n    });\n\n    // Some runtimes may re-add Content-Length when constructing the Response.\n    // Delete explicitly since fetch() decoded the body and the original values\n    // no longer reflect the actual content.\n    for (const header of RESPONSE_HEADERS_TO_STRIP) {\n      proxyResponse.headers.delete(header);\n    }\n\n    return proxyResponse;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return createErrorResponse('proxy_request_failed', `Failed to proxy request to Clerk FAPI: ${message}`, 502);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAQO;AACP,kBAAoC;AAEpC,IAAAA,oBAAmC;AAkCnC,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,0BAA0B,SAA+B;AAChE,QAAM,kBAAkB,QAAQ,IAAI,YAAY;AAChD,MAAI,CAAC,iBAAiB;AACpB,WAAO,oBAAI,IAAI;AAAA,EACjB;AACA,SAAO,IAAI;AAAA,IACT,gBACG,MAAM,GAAG,EACT,IAAI,OAAK,EAAE,KAAK,EAAE,YAAY,CAAC,EAC/B,OAAO,OAAK,EAAE,SAAS,CAAC;AAAA,EAC7B;AACF;AAOA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,oBAAoB,gBAAgB,CAAC;AAOzE,SAAS,0BAA0B,gBAAgC;AACxE,QAAM,kBAAc,iCAAoB,cAAc,GAAG;AAEzD,MAAI,aAAa,WAAW,QAAQ,KAAK,8CAA6B,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACnH,WAAO;AAAA,EACT;AAEA,MAAI,oCAAmB,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACpE,WAAO;AAAA,EACT;AACA,MAAI,sCAAqB,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACtE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMO,SAAS,qBAAqB,KAAqB;AACxD,SAAO,IAAI,SAAS,GAAG,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAQO,SAAS,eAAe,SAAkB,SAA+D;AAC9G,QAAM,YAAY,qBAAqB,SAAS,aAAa,mCAAkB;AAC/E,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,SAAO,IAAI,aAAa,aAAa,IAAI,SAAS,WAAW,YAAY,GAAG;AAC9E;AAKA,SAAS,oBAAoB,MAAsB,SAAiB,QAA0B;AAC5F,QAAM,QAAoB,EAAE,MAAM,QAAQ;AAC1C,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG;AAAA,IACvD;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACH;AAOA,SAAS,mBAAmB,SAAkB,YAAyB;AACrE,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAEnF,MAAI,kBAAkB,eAAe;AACnC,WAAO,GAAG,cAAc,MAAM,aAAa;AAAA,EAC7C;AAEA,SAAO,WAAW;AACpB;AAKA,SAAS,YAAY,SAAsC;AACzD,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,kBAAkB;AAC7D,MAAI,gBAAgB;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,WAAW;AAC/C,MAAI,SAAS;AACX,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,MAAI,eAAe;AAEjB,WAAO,cAAc,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAAA,EAC3C;AAEA,SAAO;AACT;AAyBA,eAAsB,sBAAsB,SAAkB,SAAsD;AAClH,QAAM,YAAY,qBAAqB,SAAS,aAAa,mCAAkB;AAC/E,QAAM,iBACJ,SAAS,mBAAmB,OAAO,YAAY,cAAc,QAAQ,KAAK,wBAAwB;AACpG,QAAM,YAAY,SAAS,cAAc,OAAO,YAAY,cAAc,QAAQ,KAAK,mBAAmB;AAG1G,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,cAAc,WAAW,aAAa,aAAa,WAAW,SAAS,WAAW,YAAY,GAAG;AACvG,MAAI,CAAC,aAAa;AAChB,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,WAAW,QAAQ,gCAAgC,SAAS;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AAKA,QAAM,cAAc,0BAA0B,cAAc;AAC5D,QAAM,WAAW,IAAI,IAAI,WAAW,EAAE;AACtC,QAAM,aAAa,WAAW,SAAS,MAAM,UAAU,MAAM,KAAK;AAClE,QAAM,YAAY,IAAI,IAAI,GAAG,WAAW,GAAG,UAAU,EAAE;AACvD,YAAU,SAAS,WAAW;AAE9B,MAAI,UAAU,SAAS,UAAU;AAC/B,WAAO,oBAAoB,wBAAwB,oDAAoD,GAAG;AAAA,EAC5G;AAGA,QAAM,UAAU,IAAI,QAAQ;AAI5B,QAAM,kBAAkB,0BAA0B,QAAQ,OAAO;AACjE,UAAQ,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACtC,UAAM,QAAQ,IAAI,YAAY;AAC9B,QAAI,CAAC,mBAAmB,IAAI,KAAK,KAAK,CAAC,gBAAgB,IAAI,KAAK,GAAG;AACjE,cAAQ,IAAI,KAAK,KAAK;AAAA,IACxB;AAAA,EACF,CAAC;AAKD,QAAM,eAAe,mBAAmB,SAAS,UAAU;AAC3D,QAAM,WAAW,GAAG,YAAY,GAAG,SAAS;AAC5C,UAAQ,IAAI,mBAAmB,QAAQ;AACvC,UAAQ,IAAI,oBAAoB,SAAS;AAGzC,UAAQ,IAAI,QAAQ,QAAQ;AAK5B,UAAQ,IAAI,mBAAmB,UAAU;AAIzC,MAAI,CAAC,QAAQ,IAAI,kBAAkB,GAAG;AACpC,YAAQ,IAAI,oBAAoB,WAAW,IAAI;AAAA,EACjD;AACA,MAAI,CAAC,QAAQ,IAAI,mBAAmB,GAAG;AACrC,YAAQ,IAAI,qBAAqB,WAAW,SAAS,QAAQ,KAAK,EAAE,CAAC;AAAA,EACvE;AAKA,QAAM,WAAW,YAAY,OAAO;AACpC,MAAI,UAAU;AACZ,YAAQ,IAAI,mBAAmB,QAAQ;AAAA,EACzC;AAGA,QAAM,UAAU,QAAQ,SAAS;AAEjC,MAAI;AAGF,UAAM,eAA4B;AAAA,MAChC,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,UAAU;AAAA,MACV,QAAQ,QAAQ;AAAA,IAClB;AAGA,QAAI,SAAS;AAEX,mBAAa,SAAS;AACtB,mBAAa,OAAO,QAAQ;AAAA,IAC9B;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,SAAS,GAAG,YAAY;AAI/D,UAAM,0BAA0B,0BAA0B,SAAS,OAAO;AAC1E,UAAM,kBAAkB,IAAI,QAAQ;AACpC,aAAS,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACvC,YAAM,QAAQ,IAAI,YAAY;AAC9B,UACE,CAAC,mBAAmB,IAAI,KAAK,KAC7B,CAAC,0BAA0B,IAAI,KAAK,KACpC,CAAC,wBAAwB,IAAI,KAAK,GAClC;AACA,YAAI,UAAU,cAAc;AAC1B,0BAAgB,OAAO,KAAK,KAAK;AAAA,QACnC,OAAO;AACL,0BAAgB,IAAI,KAAK,KAAK;AAAA,QAChC;AAAA,MACF;AAAA,IACF,CAAC;AAGD,UAAM,iBAAiB,SAAS,QAAQ,IAAI,UAAU;AACtD,QAAI,gBAAgB;AAClB,UAAI;AACF,cAAM,cAAc,IAAI,IAAI,gBAAgB,WAAW;AAEvD,YAAI,YAAY,SAAS,UAAU;AAEjC,gBAAM,oBAAoB,GAAG,QAAQ,GAAG,YAAY,QAAQ,GAAG,YAAY,MAAM,GAAG,YAAY,IAAI;AACpG,0BAAgB,IAAI,YAAY,iBAAiB;AAAA,QACnD;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,gBAAgB,IAAI,SAAS,SAAS,MAAM;AAAA,MAChD,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAKD,eAAW,UAAU,2BAA2B;AAC9C,oBAAc,QAAQ,OAAO,MAAM;AAAA,IACrC;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,oBAAoB,wBAAwB,0CAA0C,OAAO,IAAI,GAAG;AAAA,EAC7G;AACF;","names":["import_constants"]}

package/node_modules/@clerk/backend/dist/proxy.mjs

@@ -0,0 +1,208 @@
+import "./chunk-TOROEX6P.mjs";
+
+// src/proxy.ts
+import {
+  DEFAULT_PROXY_PATH,
+  LEGACY_DEV_INSTANCE_SUFFIXES,
+  LOCAL_ENV_SUFFIXES,
+  LOCAL_FAPI_URL,
+  PROD_FAPI_URL,
+  STAGING_ENV_SUFFIXES,
+  STAGING_FAPI_URL
+} from "@clerk/shared/constants";
+import { parsePublishableKey } from "@clerk/shared/keys";
+import { DEFAULT_PROXY_PATH as DEFAULT_PROXY_PATH2 } from "@clerk/shared/constants";
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+function getDynamicHopByHopHeaders(headers) {
+  const connectionValue = headers.get("connection");
+  if (!connectionValue) {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(
+    connectionValue.split(",").map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0)
+  );
+}
+var RESPONSE_HEADERS_TO_STRIP = /* @__PURE__ */ new Set(["content-encoding", "content-length"]);
+function fapiUrlFromPublishableKey(publishableKey) {
+  const frontendApi = parsePublishableKey(publishableKey)?.frontendApi;
+  if (frontendApi?.startsWith("clerk.") && LEGACY_DEV_INSTANCE_SUFFIXES.some((suffix) => frontendApi?.endsWith(suffix))) {
+    return PROD_FAPI_URL;
+  }
+  if (LOCAL_ENV_SUFFIXES.some((suffix) => frontendApi?.endsWith(suffix))) {
+    return LOCAL_FAPI_URL;
+  }
+  if (STAGING_ENV_SUFFIXES.some((suffix) => frontendApi?.endsWith(suffix))) {
+    return STAGING_FAPI_URL;
+  }
+  return PROD_FAPI_URL;
+}
+function stripTrailingSlashes(str) {
+  while (str.endsWith("/")) {
+    str = str.slice(0, -1);
+  }
+  return str;
+}
+function matchProxyPath(request, options) {
+  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);
+  const url = new URL(request.url);
+  return url.pathname === proxyPath || url.pathname.startsWith(proxyPath + "/");
+}
+function createErrorResponse(code, message, status) {
+  const error = { code, message };
+  return new Response(JSON.stringify({ errors: [error] }), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      "Cache-Control": "no-store"
+    }
+  });
+}
+function derivePublicOrigin(request, requestUrl) {
+  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  const forwardedHost = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  if (forwardedProto && forwardedHost) {
+    return `${forwardedProto}://${forwardedHost}`;
+  }
+  return requestUrl.origin;
+}
+function getClientIp(request) {
+  const cfConnectingIp = request.headers.get("cf-connecting-ip");
+  if (cfConnectingIp) {
+    return cfConnectingIp;
+  }
+  const xRealIp = request.headers.get("x-real-ip");
+  if (xRealIp) {
+    return xRealIp;
+  }
+  const xForwardedFor = request.headers.get("x-forwarded-for");
+  if (xForwardedFor) {
+    return xForwardedFor.split(",")[0]?.trim();
+  }
+  return void 0;
+}
+async function clerkFrontendApiProxy(request, options) {
+  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);
+  const publishableKey = options?.publishableKey || (typeof process !== "undefined" ? process.env?.CLERK_PUBLISHABLE_KEY : void 0);
+  const secretKey = options?.secretKey || (typeof process !== "undefined" ? process.env?.CLERK_SECRET_KEY : void 0);
+  if (!publishableKey) {
+    return createErrorResponse(
+      "proxy_configuration_error",
+      "Missing publishableKey. Provide it in options or set CLERK_PUBLISHABLE_KEY environment variable.",
+      500
+    );
+  }
+  if (!secretKey) {
+    return createErrorResponse(
+      "proxy_configuration_error",
+      "Missing secretKey. Provide it in options or set CLERK_SECRET_KEY environment variable.",
+      500
+    );
+  }
+  const requestUrl = new URL(request.url);
+  const pathMatches = requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + "/");
+  if (!pathMatches) {
+    return createErrorResponse(
+      "proxy_path_mismatch",
+      `Request path "${requestUrl.pathname}" does not match proxy path "${proxyPath}"`,
+      400
+    );
+  }
+  const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
+  const fapiHost = new URL(fapiBaseUrl).host;
+  const targetPath = requestUrl.pathname.slice(proxyPath.length) || "/";
+  const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
+  targetUrl.search = requestUrl.search;
+  if (targetUrl.host !== fapiHost) {
+    return createErrorResponse("proxy_request_failed", "Resolved target does not match the expected host", 400);
+  }
+  const headers = new Headers();
+  const dynamicHopByHop = getDynamicHopByHopHeaders(request.headers);
+  request.headers.forEach((value, key) => {
+    const lower = key.toLowerCase();
+    if (!HOP_BY_HOP_HEADERS.has(lower) && !dynamicHopByHop.has(lower)) {
+      headers.set(key, value);
+    }
+  });
+  const publicOrigin = derivePublicOrigin(request, requestUrl);
+  const proxyUrl = `${publicOrigin}${proxyPath}`;
+  headers.set("Clerk-Proxy-Url", proxyUrl);
+  headers.set("Clerk-Secret-Key", secretKey);
+  headers.set("Host", fapiHost);
+  headers.set("Accept-Encoding", "identity");
+  if (!headers.has("X-Forwarded-Host")) {
+    headers.set("X-Forwarded-Host", requestUrl.host);
+  }
+  if (!headers.has("X-Forwarded-Proto")) {
+    headers.set("X-Forwarded-Proto", requestUrl.protocol.replace(":", ""));
+  }
+  const clientIp = getClientIp(request);
+  if (clientIp) {
+    headers.set("X-Forwarded-For", clientIp);
+  }
+  const hasBody = request.body !== null;
+  try {
+    const fetchOptions = {
+      method: request.method,
+      headers,
+      redirect: "manual",
+      signal: request.signal
+    };
+    if (hasBody) {
+      fetchOptions.duplex = "half";
+      fetchOptions.body = request.body;
+    }
+    const response = await fetch(targetUrl.toString(), fetchOptions);
+    const responseDynamicHopByHop = getDynamicHopByHopHeaders(response.headers);
+    const responseHeaders = new Headers();
+    response.headers.forEach((value, key) => {
+      const lower = key.toLowerCase();
+      if (!HOP_BY_HOP_HEADERS.has(lower) && !RESPONSE_HEADERS_TO_STRIP.has(lower) && !responseDynamicHopByHop.has(lower)) {
+        if (lower === "set-cookie") {
+          responseHeaders.append(key, value);
+        } else {
+          responseHeaders.set(key, value);
+        }
+      }
+    });
+    const locationHeader = response.headers.get("location");
+    if (locationHeader) {
+      try {
+        const locationUrl = new URL(locationHeader, fapiBaseUrl);
+        if (locationUrl.host === fapiHost) {
+          const rewrittenLocation = `${proxyUrl}${locationUrl.pathname}${locationUrl.search}${locationUrl.hash}`;
+          responseHeaders.set("Location", rewrittenLocation);
+        }
+      } catch {
+      }
+    }
+    const proxyResponse = new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: responseHeaders
+    });
+    for (const header of RESPONSE_HEADERS_TO_STRIP) {
+      proxyResponse.headers.delete(header);
+    }
+    return proxyResponse;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return createErrorResponse("proxy_request_failed", `Failed to proxy request to Clerk FAPI: ${message}`, 502);
+  }
+}
+export {
+  DEFAULT_PROXY_PATH2 as DEFAULT_PROXY_PATH,
+  clerkFrontendApiProxy,
+  fapiUrlFromPublishableKey,
+  matchProxyPath,
+  stripTrailingSlashes
+};
+//# sourceMappingURL=proxy.mjs.map

package/node_modules/@clerk/backend/dist/proxy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/proxy.ts"],"sourcesContent":["import {\n  DEFAULT_PROXY_PATH,\n  LEGACY_DEV_INSTANCE_SUFFIXES,\n  LOCAL_ENV_SUFFIXES,\n  LOCAL_FAPI_URL,\n  PROD_FAPI_URL,\n  STAGING_ENV_SUFFIXES,\n  STAGING_FAPI_URL,\n} from '@clerk/shared/constants';\nimport { parsePublishableKey } from '@clerk/shared/keys';\n\nexport { DEFAULT_PROXY_PATH } from '@clerk/shared/constants';\n\n/**\n * Options for the Frontend API proxy\n */\nexport interface FrontendApiProxyOptions {\n  /**\n   * The path prefix for proxy requests. Defaults to `/__clerk`.\n   */\n  proxyPath?: string;\n  /**\n   * The Clerk publishable key. Falls back to CLERK_PUBLISHABLE_KEY env var.\n   */\n  publishableKey?: string;\n  /**\n   * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.\n   */\n  secretKey?: string;\n}\n\n/**\n * Error codes for proxy errors\n */\nexport type ProxyErrorCode = 'proxy_configuration_error' | 'proxy_path_mismatch' | 'proxy_request_failed';\n\n/**\n * Error response structure for proxy errors\n */\nexport interface ProxyError {\n  code: ProxyErrorCode;\n  message: string;\n}\n\n// Hop-by-hop headers that should not be forwarded\nconst HOP_BY_HOP_HEADERS = new Set([\n  'connection',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailer',\n  'transfer-encoding',\n  'upgrade',\n]);\n\n/**\n * Parses the Connection header to extract dynamically-nominated hop-by-hop\n * header names (RFC 7230 Section 6.1). These headers are specific to the\n * current connection and must not be forwarded by proxies.\n */\nfunction getDynamicHopByHopHeaders(headers: Headers): Set<string> {\n  const connectionValue = headers.get('connection');\n  if (!connectionValue) {\n    return new Set();\n  }\n  return new Set(\n    connectionValue\n      .split(',')\n      .map(h => h.trim().toLowerCase())\n      .filter(h => h.length > 0),\n  );\n}\n\n// Headers to strip from proxied responses. fetch() auto-decompresses\n// response bodies, so Content-Encoding no longer describes the body\n// and Content-Length reflects the compressed size. We request identity\n// encoding upstream to avoid the double compression pass, but strip\n// these defensively since servers may ignore Accept-Encoding: identity.\nconst RESPONSE_HEADERS_TO_STRIP = new Set(['content-encoding', 'content-length']);\n\n/**\n * Derives the Frontend API URL from a publishable key.\n * @param publishableKey - The Clerk publishable key\n * @returns The Frontend API URL for the environment\n */\nexport function fapiUrlFromPublishableKey(publishableKey: string): string {\n  const frontendApi = parsePublishableKey(publishableKey)?.frontendApi;\n\n  if (frontendApi?.startsWith('clerk.') && LEGACY_DEV_INSTANCE_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return PROD_FAPI_URL;\n  }\n\n  if (LOCAL_ENV_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return LOCAL_FAPI_URL;\n  }\n  if (STAGING_ENV_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return STAGING_FAPI_URL;\n  }\n  return PROD_FAPI_URL;\n}\n\n/**\n * Removes trailing slashes from a string without using regex\n * to avoid potential ReDoS concerns flagged by security scanners.\n */\nexport function stripTrailingSlashes(str: string): string {\n  while (str.endsWith('/')) {\n    str = str.slice(0, -1);\n  }\n  return str;\n}\n\n/**\n * Checks if a request path matches the proxy path.\n * @param request - The incoming request\n * @param options - Proxy options including the proxy path\n * @returns True if the request matches the proxy path\n */\nexport function matchProxyPath(request: Request, options?: Pick<FrontendApiProxyOptions, 'proxyPath'>): boolean {\n  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);\n  const url = new URL(request.url);\n  return url.pathname === proxyPath || url.pathname.startsWith(proxyPath + '/');\n}\n\n/**\n * Creates a JSON error response\n */\nfunction createErrorResponse(code: ProxyErrorCode, message: string, status: number): Response {\n  const error: ProxyError = { code, message };\n  return new Response(JSON.stringify({ errors: [error] }), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      'Cache-Control': 'no-store',\n    },\n  });\n}\n\n/**\n * Derives the public-facing origin from forwarded headers, falling back to the raw request URL.\n * Behind a reverse proxy, request.url is typically localhost, but the Clerk-Proxy-Url header\n * and Location rewrites must use the origin visible to the browser.\n */\nfunction derivePublicOrigin(request: Request, requestUrl: URL): string {\n  const forwardedProto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();\n  const forwardedHost = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim();\n\n  if (forwardedProto && forwardedHost) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return requestUrl.origin;\n}\n\n/**\n * Gets the client IP address from various headers\n */\nfunction getClientIp(request: Request): string | undefined {\n  const cfConnectingIp = request.headers.get('cf-connecting-ip');\n  if (cfConnectingIp) {\n    return cfConnectingIp;\n  }\n\n  const xRealIp = request.headers.get('x-real-ip');\n  if (xRealIp) {\n    return xRealIp;\n  }\n\n  const xForwardedFor = request.headers.get('x-forwarded-for');\n  if (xForwardedFor) {\n    // Take the first IP in the chain\n    return xForwardedFor.split(',')[0]?.trim();\n  }\n\n  return undefined;\n}\n\n/**\n * Proxies a request to Clerk's Frontend API.\n *\n * This function handles forwarding requests from your application to Clerk's\n * Frontend API, enabling scenarios where direct communication with Clerk's API\n * is blocked or needs to go through your application server.\n *\n * @param request - The incoming request to proxy\n * @param options - Proxy configuration options\n * @returns A Response from Clerk's Frontend API\n *\n * @example\n * ```typescript\n * import { clerkFrontendApiProxy } from '@clerk/backend/proxy';\n *\n * // In a route handler\n * const response = await clerkFrontendApiProxy(request, {\n *   proxyPath: '/__clerk',\n *   publishableKey: process.env.CLERK_PUBLISHABLE_KEY,\n *   secretKey: process.env.CLERK_SECRET_KEY,\n * });\n * ```\n */\nexport async function clerkFrontendApiProxy(request: Request, options?: FrontendApiProxyOptions): Promise<Response> {\n  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);\n  const publishableKey =\n    options?.publishableKey || (typeof process !== 'undefined' ? process.env?.CLERK_PUBLISHABLE_KEY : undefined);\n  const secretKey = options?.secretKey || (typeof process !== 'undefined' ? process.env?.CLERK_SECRET_KEY : undefined);\n\n  // Validate configuration\n  if (!publishableKey) {\n    return createErrorResponse(\n      'proxy_configuration_error',\n      'Missing publishableKey. Provide it in options or set CLERK_PUBLISHABLE_KEY environment variable.',\n      500,\n    );\n  }\n\n  if (!secretKey) {\n    return createErrorResponse(\n      'proxy_configuration_error',\n      'Missing secretKey. Provide it in options or set CLERK_SECRET_KEY environment variable.',\n      500,\n    );\n  }\n\n  // Get the request URL and validate path\n  const requestUrl = new URL(request.url);\n  const pathMatches = requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + '/');\n  if (!pathMatches) {\n    return createErrorResponse(\n      'proxy_path_mismatch',\n      `Request path \"${requestUrl.pathname}\" does not match proxy path \"${proxyPath}\"`,\n      400,\n    );\n  }\n\n  // Derive the FAPI URL and construct the target URL.\n  // Use string concatenation instead of `new URL(path, base)` to avoid\n  // protocol-relative resolution (e.g., \"//evil.com\" resolving to a different host).\n  const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);\n  const fapiHost = new URL(fapiBaseUrl).host;\n  const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';\n  const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);\n  targetUrl.search = requestUrl.search;\n\n  if (targetUrl.host !== fapiHost) {\n    return createErrorResponse('proxy_request_failed', 'Resolved target does not match the expected host', 400);\n  }\n\n  // Build headers for the proxied request\n  const headers = new Headers();\n\n  // Copy original headers, excluding hop-by-hop headers and any\n  // dynamically-nominated hop-by-hop headers listed in the Connection header (RFC 7230 Section 6.1).\n  const dynamicHopByHop = getDynamicHopByHopHeaders(request.headers);\n  request.headers.forEach((value, key) => {\n    const lower = key.toLowerCase();\n    if (!HOP_BY_HOP_HEADERS.has(lower) && !dynamicHopByHop.has(lower)) {\n      headers.set(key, value);\n    }\n  });\n\n  // Set required Clerk proxy headers\n  // Use the public origin (from forwarded headers) so the Clerk-Proxy-Url\n  // points to the browser-visible host, not localhost behind a reverse proxy.\n  const publicOrigin = derivePublicOrigin(request, requestUrl);\n  const proxyUrl = `${publicOrigin}${proxyPath}`;\n  headers.set('Clerk-Proxy-Url', proxyUrl);\n  headers.set('Clerk-Secret-Key', secretKey);\n\n  // Set the host header to the FAPI host\n  headers.set('Host', fapiHost);\n\n  // Request uncompressed responses to avoid a double compression pass.\n  // fetch() auto-decompresses, so without this FAPI compresses → fetch\n  // decompresses → the serving layer re-compresses for the browser.\n  headers.set('Accept-Encoding', 'identity');\n\n  // Set X-Forwarded-* headers for proxy awareness\n  // Only set these if not already present (preserve values from upstream proxies)\n  if (!headers.has('X-Forwarded-Host')) {\n    headers.set('X-Forwarded-Host', requestUrl.host);\n  }\n  if (!headers.has('X-Forwarded-Proto')) {\n    headers.set('X-Forwarded-Proto', requestUrl.protocol.replace(':', ''));\n  }\n\n  // Set X-Forwarded-For to the client IP\n  // In multi-proxy scenarios, we prefer authoritative headers (CF-Connecting-IP, X-Real-IP)\n  // over the existing X-Forwarded-For chain, as they provide the true client IP\n  const clientIp = getClientIp(request);\n  if (clientIp) {\n    headers.set('X-Forwarded-For', clientIp);\n  }\n\n  // Determine if request has a body (handles DELETE-with-body and any other method)\n  const hasBody = request.body !== null;\n\n  try {\n    // Make the proxied request\n    // TODO: Consider adding AbortSignal.timeout(30_000) via AbortSignal.any()\n    const fetchOptions: RequestInit = {\n      method: request.method,\n      headers,\n      redirect: 'manual',\n      signal: request.signal,\n    };\n\n    // Only set duplex when body is present (required for streaming bodies)\n    if (hasBody) {\n      // @ts-expect-error - duplex is required for streaming bodies, but not present on the RequestInit type from undici\n      fetchOptions.duplex = 'half';\n      fetchOptions.body = request.body;\n    }\n\n    const response = await fetch(targetUrl.toString(), fetchOptions);\n\n    // Build response headers, excluding hop-by-hop and encoding headers.\n    // Also strip dynamically-nominated hop-by-hop headers from the response Connection header.\n    const responseDynamicHopByHop = getDynamicHopByHopHeaders(response.headers);\n    const responseHeaders = new Headers();\n    response.headers.forEach((value, key) => {\n      const lower = key.toLowerCase();\n      if (\n        !HOP_BY_HOP_HEADERS.has(lower) &&\n        !RESPONSE_HEADERS_TO_STRIP.has(lower) &&\n        !responseDynamicHopByHop.has(lower)\n      ) {\n        if (lower === 'set-cookie') {\n          responseHeaders.append(key, value);\n        } else {\n          responseHeaders.set(key, value);\n        }\n      }\n    });\n\n    // Rewrite Location header for redirects to go through the proxy\n    const locationHeader = response.headers.get('location');\n    if (locationHeader) {\n      try {\n        const locationUrl = new URL(locationHeader, fapiBaseUrl);\n        // Check if the redirect points to the FAPI host\n        if (locationUrl.host === fapiHost) {\n          // Rewrite to go through the proxy\n          const rewrittenLocation = `${proxyUrl}${locationUrl.pathname}${locationUrl.search}${locationUrl.hash}`;\n          responseHeaders.set('Location', rewrittenLocation);\n        }\n      } catch {\n        // If URL parsing fails, leave the Location header as-is (could be a relative URL)\n      }\n    }\n\n    const proxyResponse = new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers: responseHeaders,\n    });\n\n    // Some runtimes may re-add Content-Length when constructing the Response.\n    // Delete explicitly since fetch() decoded the body and the original values\n    // no longer reflect the actual content.\n    for (const header of RESPONSE_HEADERS_TO_STRIP) {\n      proxyResponse.headers.delete(header);\n    }\n\n    return proxyResponse;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return createErrorResponse('proxy_request_failed', `Failed to proxy request to Clerk FAPI: ${message}`, 502);\n  }\n}\n"],"mappings":";;;AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAEpC,SAAS,sBAAAA,2BAA0B;AAkCnC,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,0BAA0B,SAA+B;AAChE,QAAM,kBAAkB,QAAQ,IAAI,YAAY;AAChD,MAAI,CAAC,iBAAiB;AACpB,WAAO,oBAAI,IAAI;AAAA,EACjB;AACA,SAAO,IAAI;AAAA,IACT,gBACG,MAAM,GAAG,EACT,IAAI,OAAK,EAAE,KAAK,EAAE,YAAY,CAAC,EAC/B,OAAO,OAAK,EAAE,SAAS,CAAC;AAAA,EAC7B;AACF;AAOA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,oBAAoB,gBAAgB,CAAC;AAOzE,SAAS,0BAA0B,gBAAgC;AACxE,QAAM,cAAc,oBAAoB,cAAc,GAAG;AAEzD,MAAI,aAAa,WAAW,QAAQ,KAAK,6BAA6B,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACnH,WAAO;AAAA,EACT;AAEA,MAAI,mBAAmB,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACpE,WAAO;AAAA,EACT;AACA,MAAI,qBAAqB,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACtE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMO,SAAS,qBAAqB,KAAqB;AACxD,SAAO,IAAI,SAAS,GAAG,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAQO,SAAS,eAAe,SAAkB,SAA+D;AAC9G,QAAM,YAAY,qBAAqB,SAAS,aAAa,kBAAkB;AAC/E,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,SAAO,IAAI,aAAa,aAAa,IAAI,SAAS,WAAW,YAAY,GAAG;AAC9E;AAKA,SAAS,oBAAoB,MAAsB,SAAiB,QAA0B;AAC5F,QAAM,QAAoB,EAAE,MAAM,QAAQ;AAC1C,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG;AAAA,IACvD;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACH;AAOA,SAAS,mBAAmB,SAAkB,YAAyB;AACrE,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAEnF,MAAI,kBAAkB,eAAe;AACnC,WAAO,GAAG,cAAc,MAAM,aAAa;AAAA,EAC7C;AAEA,SAAO,WAAW;AACpB;AAKA,SAAS,YAAY,SAAsC;AACzD,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,kBAAkB;AAC7D,MAAI,gBAAgB;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,WAAW;AAC/C,MAAI,SAAS;AACX,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,MAAI,eAAe;AAEjB,WAAO,cAAc,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAAA,EAC3C;AAEA,SAAO;AACT;AAyBA,eAAsB,sBAAsB,SAAkB,SAAsD;AAClH,QAAM,YAAY,qBAAqB,SAAS,aAAa,kBAAkB;AAC/E,QAAM,iBACJ,SAAS,mBAAmB,OAAO,YAAY,cAAc,QAAQ,KAAK,wBAAwB;AACpG,QAAM,YAAY,SAAS,cAAc,OAAO,YAAY,cAAc,QAAQ,KAAK,mBAAmB;AAG1G,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,cAAc,WAAW,aAAa,aAAa,WAAW,SAAS,WAAW,YAAY,GAAG;AACvG,MAAI,CAAC,aAAa;AAChB,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,WAAW,QAAQ,gCAAgC,SAAS;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AAKA,QAAM,cAAc,0BAA0B,cAAc;AAC5D,QAAM,WAAW,IAAI,IAAI,WAAW,EAAE;AACtC,QAAM,aAAa,WAAW,SAAS,MAAM,UAAU,MAAM,KAAK;AAClE,QAAM,YAAY,IAAI,IAAI,GAAG,WAAW,GAAG,UAAU,EAAE;AACvD,YAAU,SAAS,WAAW;AAE9B,MAAI,UAAU,SAAS,UAAU;AAC/B,WAAO,oBAAoB,wBAAwB,oDAAoD,GAAG;AAAA,EAC5G;AAGA,QAAM,UAAU,IAAI,QAAQ;AAI5B,QAAM,kBAAkB,0BAA0B,QAAQ,OAAO;AACjE,UAAQ,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACtC,UAAM,QAAQ,IAAI,YAAY;AAC9B,QAAI,CAAC,mBAAmB,IAAI,KAAK,KAAK,CAAC,gBAAgB,IAAI,KAAK,GAAG;AACjE,cAAQ,IAAI,KAAK,KAAK;AAAA,IACxB;AAAA,EACF,CAAC;AAKD,QAAM,eAAe,mBAAmB,SAAS,UAAU;AAC3D,QAAM,WAAW,GAAG,YAAY,GAAG,SAAS;AAC5C,UAAQ,IAAI,mBAAmB,QAAQ;AACvC,UAAQ,IAAI,oBAAoB,SAAS;AAGzC,UAAQ,IAAI,QAAQ,QAAQ;AAK5B,UAAQ,IAAI,mBAAmB,UAAU;AAIzC,MAAI,CAAC,QAAQ,IAAI,kBAAkB,GAAG;AACpC,YAAQ,IAAI,oBAAoB,WAAW,IAAI;AAAA,EACjD;AACA,MAAI,CAAC,QAAQ,IAAI,mBAAmB,GAAG;AACrC,YAAQ,IAAI,qBAAqB,WAAW,SAAS,QAAQ,KAAK,EAAE,CAAC;AAAA,EACvE;AAKA,QAAM,WAAW,YAAY,OAAO;AACpC,MAAI,UAAU;AACZ,YAAQ,IAAI,mBAAmB,QAAQ;AAAA,EACzC;AAGA,QAAM,UAAU,QAAQ,SAAS;AAEjC,MAAI;AAGF,UAAM,eAA4B;AAAA,MAChC,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,UAAU;AAAA,MACV,QAAQ,QAAQ;AAAA,IAClB;AAGA,QAAI,SAAS;AAEX,mBAAa,SAAS;AACtB,mBAAa,OAAO,QAAQ;AAAA,IAC9B;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,SAAS,GAAG,YAAY;AAI/D,UAAM,0BAA0B,0BAA0B,SAAS,OAAO;AAC1E,UAAM,kBAAkB,IAAI,QAAQ;AACpC,aAAS,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACvC,YAAM,QAAQ,IAAI,YAAY;AAC9B,UACE,CAAC,mBAAmB,IAAI,KAAK,KAC7B,CAAC,0BAA0B,IAAI,KAAK,KACpC,CAAC,wBAAwB,IAAI,KAAK,GAClC;AACA,YAAI,UAAU,cAAc;AAC1B,0BAAgB,OAAO,KAAK,KAAK;AAAA,QACnC,OAAO;AACL,0BAAgB,IAAI,KAAK,KAAK;AAAA,QAChC;AAAA,MACF;AAAA,IACF,CAAC;AAGD,UAAM,iBAAiB,SAAS,QAAQ,IAAI,UAAU;AACtD,QAAI,gBAAgB;AAClB,UAAI;AACF,cAAM,cAAc,IAAI,IAAI,gBAAgB,WAAW;AAEvD,YAAI,YAAY,SAAS,UAAU;AAEjC,gBAAM,oBAAoB,GAAG,QAAQ,GAAG,YAAY,QAAQ,GAAG,YAAY,MAAM,GAAG,YAAY,IAAI;AACpG,0BAAgB,IAAI,YAAY,iBAAiB;AAAA,QACnD;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,gBAAgB,IAAI,SAAS,SAAS,MAAM;AAAA,MAChD,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAKD,eAAW,UAAU,2BAA2B;AAC9C,oBAAc,QAAQ,OAAO,MAAM;AAAA,IACrC;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,oBAAoB,wBAAwB,0CAA0C,OAAO,IAAI,GAAG;AAAA,EAC7G;AACF;","names":["DEFAULT_PROXY_PATH"]}

package/node_modules/@clerk/backend/dist/runtime/browser/crypto.mjs

@@ -0,0 +1 @@
+export const webcrypto = crypto;

package/node_modules/@clerk/backend/dist/runtime/node/crypto.js

@@ -0,0 +1 @@
+module.exports.webcrypto = require('node:crypto').webcrypto;

package/node_modules/@clerk/backend/dist/runtime/node/crypto.mjs

@@ -0,0 +1 @@
+export { webcrypto } from 'node:crypto';

package/node_modules/@clerk/backend/dist/runtime.d.ts

@@ -0,0 +1,26 @@
+/**
+ * This file exports APIs that vary across runtimes (i.e. Node & Browser - V8 isolates)
+ * as a singleton object.
+ *
+ * Runtime polyfills are written in VanillaJS for now to avoid TS complication. Moreover,
+ * due to this issue https://github.com/microsoft/TypeScript/issues/44848, there is not a good way
+ * to tell Typescript which conditional import to use during build type.
+ *
+ * The Runtime type definition ensures type safety for now.
+ * Runtime js modules are copied into dist folder with bash script.
+ *
+ * TODO: Support TS runtime modules
+ */
+type Runtime = {
+    crypto: Crypto;
+    fetch: typeof globalThis.fetch;
+    AbortController: typeof globalThis.AbortController;
+    Blob: typeof globalThis.Blob;
+    FormData: typeof globalThis.FormData;
+    Headers: typeof globalThis.Headers;
+    Request: typeof globalThis.Request;
+    Response: typeof globalThis.Response;
+};
+export declare const runtime: Runtime;
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/node_modules/@clerk/backend/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,KAAK,OAAO,GAAG;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,eAAe,EAAE,OAAO,UAAU,CAAC,eAAe,CAAC;IACnD,IAAI,EAAE,OAAO,UAAU,CAAC,IAAI,CAAC;IAC7B,QAAQ,EAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;IACrC,OAAO,EAAE,OAAO,UAAU,CAAC,OAAO,CAAC;IACnC,OAAO,EAAE,OAAO,UAAU,CAAC,OAAO,CAAC;IACnC,QAAQ,EAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;CACtC,CAAC;AAUF,eAAO,MAAM,OAAO,EAAE,OAYrB,CAAC"}

package/node_modules/@clerk/backend/dist/tokens/authObjects.d.ts

@@ -0,0 +1,193 @@
+import type { CheckAuthorizationFromSessionClaims, Jwt, JwtPayload, PendingSessionOptions, ServerGetToken, SessionStatusClaim, SharedSignedInAuthObjectProperties } from '@clerk/shared/types';
+import type { CreateBackendApiOptions } from '../api';
+import type { AuthenticateContext } from './authenticateContext';
+import type { MachineTokenType, SessionTokenType } from './tokenTypes';
+import type { AuthenticateRequestOptions, MachineAuthType } from './types';
+/**
+ * @inline
+ */
+type AuthObjectDebugData = Record<string, any>;
+/**
+ * @inline
+ */
+type AuthObjectDebug = () => AuthObjectDebugData;
+type Claims = Record<string, any>;
+/**
+ * @internal
+ */
+export type SignedInAuthObjectOptions = CreateBackendApiOptions & {
+    token: string;
+};
+/**
+ * @internal
+ */
+export type SignedInAuthObject = SharedSignedInAuthObjectProperties & {
+    /**
+     * The allowed token type.
+     */
+    tokenType: SessionTokenType;
+    /**
+     * A function that gets the current user's [session token](https://clerk.com/docs/guides/sessions/session-tokens) or a [custom JWT template](https://clerk.com/docs/guides/sessions/jwt-templates).
+     */
+    getToken: ServerGetToken;
+    /**
+     * A function that checks if the user has an Organization Role or Custom Permission.
+     */
+    has: CheckAuthorizationFromSessionClaims;
+    /**
+     * Used to help debug issues when using Clerk in development.
+     */
+    debug: AuthObjectDebug;
+    isAuthenticated: true;
+};
+/**
+ * @internal
+ */
+export type SignedOutAuthObject = {
+    sessionClaims: null;
+    sessionId: null;
+    sessionStatus: SessionStatusClaim | null;
+    actor: null;
+    tokenType: SessionTokenType;
+    userId: null;
+    orgId: null;
+    orgRole: null;
+    orgSlug: null;
+    orgPermissions: null;
+    factorVerificationAge: null;
+    getToken: ServerGetToken;
+    has: CheckAuthorizationFromSessionClaims;
+    debug: AuthObjectDebug;
+    isAuthenticated: false;
+};
+/**
+ * Extended properties specific to each machine token type.
+ * While all machine token types share common properties (id, name, subject, etc),
+ * this type defines the additional properties that are unique to each token type.
+ *
+ * @template TAuthenticated - Whether the machine object is authenticated or not
+ */
+type MachineObjectExtendedProperties<TAuthenticated extends boolean> = {
+    api_key: TAuthenticated extends true ? {
+        name: string;
+        claims: Claims | null;
+        userId: string;
+        orgId: null;
+    } | {
+        name: string;
+        claims: Claims | null;
+        userId: null;
+        orgId: string;
+    } : {
+        name: null;
+        claims: null;
+        userId: null;
+        orgId: null;
+    };
+    m2m_token: {
+        claims: TAuthenticated extends true ? Claims | null : null;
+        machineId: TAuthenticated extends true ? string : null;
+    };
+    oauth_token: {
+        userId: TAuthenticated extends true ? string : null;
+        clientId: TAuthenticated extends true ? string : null;
+    };
+};
+/**
+ * @internal
+ *
+ * Uses `T extends any` to create a distributive conditional type.
+ * This ensures that union types like `'api_key' | 'oauth_token'` are processed
+ * individually, creating proper discriminated unions where each token type
+ * gets its own distinct properties (e.g., oauth_token won't have claims).
+ */
+export type AuthenticatedMachineObject<T extends MachineTokenType = MachineTokenType> = T extends any ? {
+    id: string;
+    subject: string;
+    scopes: string[];
+    getToken: () => Promise<string>;
+    has: CheckAuthorizationFromSessionClaims;
+    debug: AuthObjectDebug;
+    tokenType: T;
+    isAuthenticated: true;
+} & MachineObjectExtendedProperties<true>[T] : never;
+/**
+ * @internal
+ *
+ * Uses `T extends any` to create a distributive conditional type.
+ * This ensures that union types like `'api_key' | 'oauth_token'` are processed
+ * individually, creating proper discriminated unions where each token type
+ * gets its own distinct properties (e.g., oauth_token won't have claims).
+ */
+export type UnauthenticatedMachineObject<T extends MachineTokenType = MachineTokenType> = T extends any ? {
+    id: null;
+    subject: null;
+    scopes: null;
+    getToken: () => Promise<null>;
+    has: CheckAuthorizationFromSessionClaims;
+    debug: AuthObjectDebug;
+    tokenType: T;
+    isAuthenticated: false;
+} & MachineObjectExtendedProperties<false>[T] : never;
+export type InvalidTokenAuthObject = {
+    isAuthenticated: false;
+    tokenType: null;
+    getToken: () => Promise<null>;
+    has: () => false;
+    debug: AuthObjectDebug;
+};
+/**
+ * @interface
+ */
+export type AuthObject = SignedInAuthObject | SignedOutAuthObject | AuthenticatedMachineObject | UnauthenticatedMachineObject | InvalidTokenAuthObject;
+/**
+ * @internal
+ */
+export declare function signedInAuthObject(authenticateContext: Partial<AuthenticateContext>, sessionToken: string, sessionClaims: JwtPayload): SignedInAuthObject;
+/**
+ * @internal
+ */
+export declare function signedOutAuthObject(debugData?: AuthObjectDebugData, initialSessionStatus?: SessionStatusClaim): SignedOutAuthObject;
+/**
+ * @internal
+ */
+export declare function authenticatedMachineObject<T extends MachineTokenType>(tokenType: T, token: string, verificationResult: MachineAuthType, debugData?: AuthObjectDebugData): AuthenticatedMachineObject<T>;
+/**
+ * @internal
+ */
+export declare function unauthenticatedMachineObject<T extends MachineTokenType>(tokenType: T, debugData?: AuthObjectDebugData): UnauthenticatedMachineObject<T>;
+/**
+ * @internal
+ */
+export declare function invalidTokenAuthObject(): InvalidTokenAuthObject;
+/**
+ * Auth objects moving through the server -> client boundary need to be serializable
+ * as we need to ensure that they can be transferred via the network as pure strings.
+ * Some frameworks like Remix or Next (/pages dir only) handle this serialization by simply
+ * ignoring any non-serializable keys, however Nextjs /app directory is stricter and
+ * throws an error if a non-serializable value is found.
+ *
+ * @internal
+ */
+export declare const makeAuthObjectSerializable: <T extends Record<string, unknown>>(obj: T) => T;
+/**
+ * @internal
+ */
+export declare const getAuthObjectFromJwt: (jwt: Jwt, { treatPendingAsSignedOut, ...options }: PendingSessionOptions & Partial<AuthenticateContext>) => SignedInAuthObject | SignedOutAuthObject;
+/**
+ * @internal
+ * Returns an auth object matching the requested token type(s).
+ *
+ * If the parsed token type does not match any in acceptsToken, returns:
+ *   - an invalid token auth object if the token is not in the accepted array
+ *   - an unauthenticated machine object for machine tokens, or
+ *   - a signed-out session object otherwise.
+ *
+ * This ensures the returned object always matches the developer's intent.
+ */
+export declare const getAuthObjectForAcceptedToken: ({ authObject, acceptsToken, }: {
+    authObject: AuthObject;
+    acceptsToken: AuthenticateRequestOptions["acceptsToken"];
+}) => AuthObject;
+export {};
+//# sourceMappingURL=authObjects.d.ts.map

package/node_modules/@clerk/backend/dist/tokens/authObjects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authObjects.d.ts","sourceRoot":"","sources":["../../src/tokens/authObjects.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,mCAAmC,EACnC,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,cAAc,EAEd,kBAAkB,EAClB,kCAAkC,EACnC,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAU,uBAAuB,EAAiC,MAAM,QAAQ,CAAC;AAG7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,KAAK,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE3E;;GAEG;AACH,KAAK,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/C;;GAEG;AACH,KAAK,eAAe,GAAG,MAAM,mBAAmB,CAAC;AAEjD,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,GAAG;IAChE,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,kCAAkC,GAAG;IACpE;;OAEG;IACH,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;OAEG;IACH,QAAQ,EAAE,cAAc,CAAC;IACzB;;OAEG;IACH,GAAG,EAAE,mCAAmC,CAAC;IACzC;;OAEG;IACH,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,IAAI,CAAC;CACvB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,IAAI,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACzC,KAAK,EAAE,IAAI,CAAC;IACZ,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,IAAI,CAAC;IACb,KAAK,EAAE,IAAI,CAAC;IACZ,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,IAAI,CAAC;IACd,cAAc,EAAE,IAAI,CAAC;IACrB,qBAAqB,EAAE,IAAI,CAAC;IAC5B,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,mCAAmC,CAAC;IACzC,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF;;;;;;GAMG;AACH,KAAK,+BAA+B,CAAC,cAAc,SAAS,OAAO,IAAI;IACrE,OAAO,EAAE,cAAc,SAAS,IAAI,GAE5B;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,GACpE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACxE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAC;IAC5D,SAAS,EAAE;QACT,MAAM,EAAE,cAAc,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;QAC3D,SAAS,EAAE,cAAc,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;KACxD,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,cAAc,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;QACpD,QAAQ,EAAE,cAAc,SAAS,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;KACvD,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI,CAAC,SAAS,GAAG,GACjG;IACE,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,GAAG,EAAE,mCAAmC,CAAC;IACzC,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC;IACb,eAAe,EAAE,IAAI,CAAC;CACvB,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAC5C,KAAK,CAAC;AAEV;;;;;;;GAOG;AACH,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI,CAAC,SAAS,GAAG,GACnG;IACE,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,IAAI,CAAC;IACb,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,GAAG,EAAE,mCAAmC,CAAC;IACzC,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC;IACb,eAAe,EAAE,KAAK,CAAC;CACxB,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAC7C,KAAK,CAAC;AAEV,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,KAAK,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,GAAG,EAAE,MAAM,KAAK,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,0BAA0B,GAC1B,4BAA4B,GAC5B,sBAAsB,CAAC;AAW3B;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,CAAC,EACjD,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,UAAU,GACxB,kBAAkB,CAmCpB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,CAAC,EAAE,mBAAmB,EAC/B,oBAAoB,CAAC,EAAE,kBAAkB,GACxC,mBAAmB,CAkBrB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,gBAAgB,EACnE,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,eAAe,EACnC,SAAS,CAAC,EAAE,mBAAmB,GAC9B,0BAA0B,CAAC,CAAC,CAAC,CAkD/B;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,gBAAgB,EACrE,SAAS,EAAE,CAAC,EACZ,SAAS,CAAC,EAAE,mBAAmB,GAC9B,4BAA4B,CAAC,CAAC,CAAC,CA4CjC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,sBAAsB,CAQ/D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,KAAG,CAKtF,CAAC;AAiDF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAC/B,KAAK,GAAG,EACR,yCAAgD,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,6CASrG,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,GAAI,+BAG3C;IACD,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,0BAA0B,CAAC,cAAc,CAAC,CAAC;CAC1D,KAAG,UAwBH,CAAC"}

package/node_modules/@clerk/backend/dist/tokens/authStatus.d.ts

@@ -0,0 +1,120 @@
+import type { JwtPayload, PendingSessionOptions } from '@clerk/shared/types';
+import type { TokenVerificationErrorReason } from '../errors';
+import type { AuthenticateContext } from './authenticateContext';
+import type { AuthenticatedMachineObject, InvalidTokenAuthObject, SignedInAuthObject, SignedOutAuthObject, UnauthenticatedMachineObject } from './authObjects';
+import type { MachineTokenType, SessionTokenType } from './tokenTypes';
+import { TokenType } from './tokenTypes';
+import type { MachineAuthType } from './types';
+export declare const AuthStatus: {
+    readonly SignedIn: "signed-in";
+    readonly SignedOut: "signed-out";
+    readonly Handshake: "handshake";
+};
+export type AuthStatus = (typeof AuthStatus)[keyof typeof AuthStatus];
+type ToAuth<T extends TokenType | null, Authenticated extends boolean> = T extends null ? () => InvalidTokenAuthObject : T extends SessionTokenType ? Authenticated extends true ? (opts?: PendingSessionOptions) => SignedInAuthObject : () => SignedOutAuthObject : Authenticated extends true ? () => AuthenticatedMachineObject<Exclude<T, SessionTokenType | null>> : () => UnauthenticatedMachineObject<Exclude<T, SessionTokenType | null>>;
+export type AuthenticatedState<T extends TokenType = SessionTokenType> = {
+    status: typeof AuthStatus.SignedIn;
+    reason: null;
+    message: null;
+    proxyUrl?: string;
+    publishableKey: string;
+    isSatellite: boolean;
+    domain: string;
+    signInUrl: string;
+    signUpUrl: string;
+    afterSignInUrl: string;
+    afterSignUpUrl: string;
+    /**
+     * @deprecated Use `isAuthenticated` instead.
+     */
+    isSignedIn: true;
+    isAuthenticated: true;
+    headers: Headers;
+    token: string;
+    tokenType: T;
+    toAuth: ToAuth<T, true>;
+};
+export type UnauthenticatedState<T extends TokenType | null = SessionTokenType> = {
+    status: typeof AuthStatus.SignedOut;
+    reason: AuthReason;
+    message: string;
+    proxyUrl?: string;
+    publishableKey: string;
+    isSatellite: boolean;
+    domain: string;
+    signInUrl: string;
+    signUpUrl: string;
+    afterSignInUrl: string;
+    afterSignUpUrl: string;
+    /**
+     * @deprecated Use `isAuthenticated` instead.
+     */
+    isSignedIn: false;
+    isAuthenticated: false;
+    tokenType: T;
+    headers: Headers;
+    token: null;
+    toAuth: ToAuth<T, false>;
+};
+export type HandshakeState = Omit<UnauthenticatedState<SessionTokenType>, 'status' | 'toAuth' | 'tokenType'> & {
+    tokenType: SessionTokenType;
+    status: typeof AuthStatus.Handshake;
+    headers: Headers;
+    toAuth: () => null;
+};
+/**
+ * @deprecated Use AuthenticatedState instead
+ */
+export type SignedInState = AuthenticatedState<SessionTokenType>;
+/**
+ * @deprecated Use UnauthenticatedState instead
+ */
+export type SignedOutState = UnauthenticatedState<SessionTokenType>;
+export declare const AuthErrorReason: {
+    readonly ClientUATWithoutSessionToken: "client-uat-but-no-session-token";
+    readonly DevBrowserMissing: "dev-browser-missing";
+    readonly DevBrowserSync: "dev-browser-sync";
+    readonly PrimaryRespondsToSyncing: "primary-responds-to-syncing";
+    readonly PrimaryDomainCrossOriginSync: "primary-domain-cross-origin-sync";
+    readonly SatelliteCookieNeedsSyncing: "satellite-needs-syncing";
+    readonly SessionTokenAndUATMissing: "session-token-and-uat-missing";
+    readonly SessionTokenMissing: "session-token-missing";
+    readonly SessionTokenExpired: "session-token-expired";
+    readonly SessionTokenIATBeforeClientUAT: "session-token-iat-before-client-uat";
+    readonly SessionTokenNBF: "session-token-nbf";
+    readonly SessionTokenIatInTheFuture: "session-token-iat-in-the-future";
+    readonly SessionTokenWithoutClientUAT: "session-token-but-no-client-uat";
+    readonly ActiveOrganizationMismatch: "active-organization-mismatch";
+    readonly TokenTypeMismatch: "token-type-mismatch";
+    readonly UnexpectedError: "unexpected-error";
+};
+export type AuthErrorReason = (typeof AuthErrorReason)[keyof typeof AuthErrorReason];
+export type AuthReason = AuthErrorReason | TokenVerificationErrorReason;
+export type RequestState<T extends TokenType | null = SessionTokenType> = AuthenticatedState<T extends null ? never : T> | UnauthenticatedState<T> | (T extends SessionTokenType ? HandshakeState : never);
+type BaseSignedInParams = {
+    authenticateContext: AuthenticateContext;
+    headers?: Headers;
+    token: string;
+    tokenType: TokenType;
+};
+type SignedInParams = (BaseSignedInParams & {
+    tokenType: SessionTokenType;
+    sessionClaims: JwtPayload;
+}) | (BaseSignedInParams & {
+    tokenType: MachineTokenType;
+    machineData: MachineAuthType;
+});
+export declare function signedIn<T extends TokenType>(params: SignedInParams & {
+    tokenType: T;
+}): AuthenticatedState<T>;
+type SignedOutParams = Omit<BaseSignedInParams, 'token'> & {
+    reason: AuthReason;
+    message?: string;
+};
+export declare function signedOut<T extends TokenType>(params: SignedOutParams & {
+    tokenType: T;
+}): UnauthenticatedState<T>;
+export declare function handshake(authenticateContext: AuthenticateContext, reason: AuthReason, message: string | undefined, headers: Headers): HandshakeState;
+export declare function signedOutInvalidToken(): UnauthenticatedState<null>;
+export {};
+//# sourceMappingURL=authStatus.d.ts.map