@vibedeckx/win32-x64 0.1.16 → 0.1.19

package/node_modules/@clerk/backend/dist/internal.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/node_modules/@clerk/backend/dist/jwt/algorithms.d.ts

@@ -1,3 +0,0 @@
-export declare const algs: string[];
-export declare function getCryptoAlgorithm(algorithmName: string): RsaHashedImportParams;
-//# sourceMappingURL=algorithms.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/algorithms.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"algorithms.d.ts","sourceRoot":"","sources":["../../src/jwt/algorithms.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,IAAI,UAAyB,CAAC;AAE3C,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,qBAAqB,CAY/E"}

package/node_modules/@clerk/backend/dist/jwt/assertions.d.ts

@@ -1,10 +0,0 @@
-export type IssuerResolver = string | ((iss: string) => boolean);
-export declare const assertAudienceClaim: (aud?: unknown, audience?: unknown) => void;
-export declare const assertHeaderType: (typ?: unknown, allowedTypes?: string | string[]) => void;
-export declare const assertHeaderAlgorithm: (alg: string) => void;
-export declare const assertSubClaim: (sub?: string) => void;
-export declare const assertAuthorizedPartiesClaim: (azp?: string, authorizedParties?: string[]) => void;
-export declare const assertExpirationClaim: (exp: number, clockSkewInMs: number) => void;
-export declare const assertActivationClaim: (nbf: number | undefined, clockSkewInMs: number) => void;
-export declare const assertIssuedAtClaim: (iat: number | undefined, clockSkewInMs: number) => void;
-//# sourceMappingURL=assertions.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/assertions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assertions.d.ts","sourceRoot":"","sources":["../../src/jwt/assertions.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;AAMjE,eAAO,MAAM,mBAAmB,GAAI,MAAM,OAAO,EAAE,WAAW,OAAO,SAsCpE,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,MAAM,OAAO,EAAE,eAAc,MAAM,GAAG,MAAM,EAAU,SAatF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,SAQhD,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,SAQ1C,CAAC;AAEF,eAAO,MAAM,4BAA4B,GAAI,MAAM,MAAM,EAAE,oBAAoB,MAAM,EAAE,SAWtF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,EAAE,eAAe,MAAM,SAoBvE,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,eAAe,MAAM,SAwBnF,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,eAAe,MAAM,SAwBjF,CAAC"}

package/node_modules/@clerk/backend/dist/jwt/cryptoKeys.d.ts

@@ -1,2 +0,0 @@
-export declare function importKey(key: JsonWebKey | string, algorithm: RsaHashedImportParams, keyUsage: 'verify' | 'sign'): Promise<CryptoKey>;
-//# sourceMappingURL=cryptoKeys.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/cryptoKeys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cryptoKeys.d.ts","sourceRoot":"","sources":["../../src/jwt/cryptoKeys.ts"],"names":[],"mappings":"AAuBA,wBAAgB,SAAS,CACvB,GAAG,EAAE,UAAU,GAAG,MAAM,EACxB,SAAS,EAAE,qBAAqB,EAChC,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAC1B,OAAO,CAAC,SAAS,CAAC,CASpB"}

package/node_modules/@clerk/backend/dist/jwt/index.d.ts

@@ -1,7 +0,0 @@
-export type { VerifyJwtOptions } from './verifyJwt';
-export type { SignJwtOptions } from './signJwt';
-export declare const verifyJwt: (token: string, options: import("./verifyJwt").VerifyJwtOptions) => Promise<NonNullable<import("@clerk/shared/types").JwtPayload | undefined>>;
-export declare const decodeJwt: (token: string) => import("@clerk/shared/types").Jwt;
-export declare const signJwt: (payload: Record<string, unknown>, key: string | JsonWebKey, options: import("./signJwt").SignJwtOptions) => Promise<string>;
-export declare const hasValidSignature: (jwt: import("@clerk/shared/types").Jwt, key: string | JsonWebKey) => Promise<NonNullable<boolean | undefined>>;
-//# sourceMappingURL=index.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":"AAIA,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAKhD,eAAO,MAAM,SAAS,gJAA+B,CAAC;AACtD,eAAO,MAAM,SAAS,sDAAmC,CAAC;AAE1D,eAAO,MAAM,OAAO,8HAA6B,CAAC;AAClD,eAAO,MAAM,iBAAiB,iHAAuC,CAAC"}

package/node_modules/@clerk/backend/dist/jwt/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/jwt/index.ts","../../src/jwt/legacyReturn.ts","../../src/errors.ts","../../src/runtime.ts","../../src/util/rfc4648.ts","../../src/jwt/algorithms.ts","../../src/jwt/cryptoKeys.ts","../../src/jwt/signJwt.ts","../../src/jwt/assertions.ts","../../src/jwt/verifyJwt.ts"],"sourcesContent":["import { withLegacyReturn, withLegacySyncReturn } from './legacyReturn';\nimport { signJwt as _signJwt } from './signJwt';\nimport { decodeJwt as _decodeJwt, hasValidSignature as _hasValidSignature, verifyJwt as _verifyJwt } from './verifyJwt';\n\nexport type { VerifyJwtOptions } from './verifyJwt';\nexport type { SignJwtOptions } from './signJwt';\n\n// Introduce compatibility layer to avoid more breaking changes\n// TODO(dimkl): This (probably be drop in the next major version)\n\nexport const verifyJwt = withLegacyReturn(_verifyJwt);\nexport const decodeJwt = withLegacySyncReturn(_decodeJwt);\n\nexport const signJwt = withLegacyReturn(_signJwt);\nexport const hasValidSignature = withLegacyReturn(_hasValidSignature);\n","import type { JwtReturnType } from './types';\n\n// TODO(dimkl): Will be probably be dropped in next major version\nexport function withLegacyReturn<T extends (...args: any[]) => Promise<JwtReturnType<any, any>>>(cb: T) {\n  return async (...args: Parameters<T>): Promise<NonNullable<Awaited<ReturnType<T>>['data']>> | never => {\n    const { data, errors } = await cb(...args);\n    if (errors) {\n      throw errors[0];\n    }\n    return data;\n  };\n}\n\n// TODO(dimkl): Will be probably be dropped in next major version\nexport function withLegacySyncReturn<T extends (...args: any[]) => JwtReturnType<any, any>>(cb: T) {\n  return (...args: Parameters<T>): NonNullable<Awaited<ReturnType<T>>['data']> | never => {\n    const { data, errors } = cb(...args);\n    if (errors) {\n      throw errors[0];\n    }\n    return data;\n  };\n}\n","import { ClerkError } from '@clerk/shared/error';\n\nexport type TokenCarrier = 'header' | 'cookie';\n\nexport const TokenVerificationErrorCode = {\n  InvalidSecretKey: 'clerk_key_invalid',\n};\n\nexport type TokenVerificationErrorCode = (typeof TokenVerificationErrorCode)[keyof typeof TokenVerificationErrorCode];\n\nexport const TokenVerificationErrorReason = {\n  TokenExpired: 'token-expired',\n  TokenInvalid: 'token-invalid',\n  TokenInvalidAlgorithm: 'token-invalid-algorithm',\n  TokenInvalidAuthorizedParties: 'token-invalid-authorized-parties',\n  TokenInvalidSignature: 'token-invalid-signature',\n  TokenNotActiveYet: 'token-not-active-yet',\n  TokenIatInTheFuture: 'token-iat-in-the-future',\n  TokenVerificationFailed: 'token-verification-failed',\n  InvalidSecretKey: 'secret-key-invalid',\n  LocalJWKMissing: 'jwk-local-missing',\n  RemoteJWKFailedToLoad: 'jwk-remote-failed-to-load',\n  RemoteJWKInvalid: 'jwk-remote-invalid',\n  RemoteJWKMissing: 'jwk-remote-missing',\n  JWKFailedToResolve: 'jwk-failed-to-resolve',\n  JWKKidMismatch: 'jwk-kid-mismatch',\n};\n\nexport type TokenVerificationErrorReason =\n  (typeof TokenVerificationErrorReason)[keyof typeof TokenVerificationErrorReason];\n\nexport const TokenVerificationErrorAction = {\n  ContactSupport: 'Contact support@clerk.com',\n  EnsureClerkJWT: 'Make sure that this is a valid Clerk-generated JWT.',\n  SetClerkJWTKey: 'Set the CLERK_JWT_KEY environment variable.',\n  SetClerkSecretKey: 'Set the CLERK_SECRET_KEY environment variable.',\n  EnsureClockSync: 'Make sure your system clock is in sync (e.g. turn off and on automatic time synchronization).',\n};\n\nexport type TokenVerificationErrorAction =\n  (typeof TokenVerificationErrorAction)[keyof typeof TokenVerificationErrorAction];\n\nexport class TokenVerificationError extends Error {\n  action?: TokenVerificationErrorAction;\n  reason: TokenVerificationErrorReason;\n  tokenCarrier?: TokenCarrier;\n\n  constructor({\n    action,\n    message,\n    reason,\n  }: {\n    action?: TokenVerificationErrorAction;\n    message: string;\n    reason: TokenVerificationErrorReason;\n  }) {\n    super(message);\n\n    Object.setPrototypeOf(this, TokenVerificationError.prototype);\n\n    this.reason = reason;\n    this.message = message;\n    this.action = action;\n  }\n\n  public getFullMessage() {\n    return `${[this.message, this.action].filter(m => m).join(' ')} (reason=${this.reason}, token-carrier=${\n      this.tokenCarrier\n    })`;\n  }\n}\n\nexport class SignJWTError extends Error {}\n\nexport const MachineTokenVerificationErrorCode = {\n  TokenInvalid: 'token-invalid',\n  InvalidSecretKey: 'secret-key-invalid',\n  UnexpectedError: 'unexpected-error',\n  TokenVerificationFailed: 'token-verification-failed',\n} as const;\n\nexport type MachineTokenVerificationErrorCode =\n  (typeof MachineTokenVerificationErrorCode)[keyof typeof MachineTokenVerificationErrorCode];\n\nexport class MachineTokenVerificationError extends ClerkError {\n  static kind = 'MachineTokenVerificationError';\n  declare readonly code: MachineTokenVerificationErrorCode;\n  readonly status?: number;\n  readonly action?: TokenVerificationErrorAction;\n\n  constructor({\n    message,\n    code,\n    status,\n    action,\n  }: {\n    message: string;\n    code: MachineTokenVerificationErrorCode;\n    status?: number;\n    action?: TokenVerificationErrorAction;\n  }) {\n    super({ message, code });\n    Object.setPrototypeOf(this, MachineTokenVerificationError.prototype);\n    this.status = status;\n    this.action = action;\n  }\n\n  // Keep message unformatted, matching ClerkAPIResponseError's approach\n  protected static override formatMessage(_name: string, msg: string, _code: string, _docsUrl: string | undefined) {\n    return msg;\n  }\n\n  public getFullMessage() {\n    return `${this.message} (code=${this.code}, status=${this.status || 'n/a'})`;\n  }\n}\n","/**\n * This file exports APIs that vary across runtimes (i.e. Node & Browser - V8 isolates)\n * as a singleton object.\n *\n * Runtime polyfills are written in VanillaJS for now to avoid TS complication. Moreover,\n * due to this issue https://github.com/microsoft/TypeScript/issues/44848, there is not a good way\n * to tell Typescript which conditional import to use during build type.\n *\n * The Runtime type definition ensures type safety for now.\n * Runtime js modules are copied into dist folder with bash script.\n *\n * TODO: Support TS runtime modules\n */\n\n// @ts-ignore - These are package subpaths\nimport { webcrypto as crypto } from '#crypto';\n\ntype Runtime = {\n  crypto: Crypto;\n  fetch: typeof globalThis.fetch;\n  AbortController: typeof globalThis.AbortController;\n  Blob: typeof globalThis.Blob;\n  FormData: typeof globalThis.FormData;\n  Headers: typeof globalThis.Headers;\n  Request: typeof globalThis.Request;\n  Response: typeof globalThis.Response;\n};\n\n// Invoking the global.fetch without binding it first to the globalObject fails in\n// Cloudflare Workers with an \"Illegal Invocation\" error.\n//\n// The globalThis object is supported for Node >= 12.0.\n//\n// https://github.com/supabase/supabase/issues/4417\nconst globalFetch = fetch.bind(globalThis);\n\nexport const runtime: Runtime = {\n  crypto,\n  get fetch() {\n    // We need to use the globalFetch for Cloudflare Workers but the fetch for testing\n    return process.env.NODE_ENV === 'test' ? fetch : globalFetch;\n  },\n  AbortController: globalThis.AbortController,\n  Blob: globalThis.Blob,\n  FormData: globalThis.FormData,\n  Headers: globalThis.Headers,\n  Request: globalThis.Request,\n  Response: globalThis.Response,\n};\n","/**\n * The base64url helper was extracted from the rfc4648 package\n * in order to resolve CSJ/ESM interoperability issues\n *\n * https://github.com/swansontec/rfc4648.js\n *\n * For more context please refer to:\n * - https://github.com/evanw/esbuild/issues/1719\n * - https://github.com/evanw/esbuild/issues/532\n * - https://github.com/swansontec/rollup-plugin-mjs-entry\n */\nexport const base64url = {\n  parse(string: string, opts?: ParseOptions): Uint8Array {\n    return parse(string, base64UrlEncoding, opts);\n  },\n\n  stringify(data: ArrayLike<number>, opts?: StringifyOptions): string {\n    return stringify(data, base64UrlEncoding, opts);\n  },\n};\n\nconst base64UrlEncoding: Encoding = {\n  chars: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',\n  bits: 6,\n};\n\ninterface Encoding {\n  bits: number;\n  chars: string;\n  codes?: { [char: string]: number };\n}\n\ninterface ParseOptions {\n  loose?: boolean;\n  out?: new (size: number) => { [index: number]: number };\n}\n\ninterface StringifyOptions {\n  pad?: boolean;\n}\n\nfunction parse(string: string, encoding: Encoding, opts: ParseOptions = {}): Uint8Array {\n  // Build the character lookup table:\n  if (!encoding.codes) {\n    encoding.codes = {};\n    for (let i = 0; i < encoding.chars.length; ++i) {\n      encoding.codes[encoding.chars[i]] = i;\n    }\n  }\n\n  // The string must have a whole number of bytes:\n  if (!opts.loose && (string.length * encoding.bits) & 7) {\n    throw new SyntaxError('Invalid padding');\n  }\n\n  // Count the padding bytes:\n  let end = string.length;\n  while (string[end - 1] === '=') {\n    --end;\n\n    // If we get a whole number of bytes, there is too much padding:\n    if (!opts.loose && !(((string.length - end) * encoding.bits) & 7)) {\n      throw new SyntaxError('Invalid padding');\n    }\n  }\n\n  // Allocate the output:\n  const out = new (opts.out ?? Uint8Array)(((end * encoding.bits) / 8) | 0) as Uint8Array;\n\n  // Parse the data:\n  let bits = 0; // Number of bits currently in the buffer\n  let buffer = 0; // Bits waiting to be written out, MSB first\n  let written = 0; // Next byte to write\n  for (let i = 0; i < end; ++i) {\n    // Read one character from the string:\n    const value = encoding.codes[string[i]];\n    if (value === undefined) {\n      throw new SyntaxError('Invalid character ' + string[i]);\n    }\n\n    // Append the bits to the buffer:\n    buffer = (buffer << encoding.bits) | value;\n    bits += encoding.bits;\n\n    // Write out some bits if the buffer has a byte's worth:\n    if (bits >= 8) {\n      bits -= 8;\n      out[written++] = 0xff & (buffer >> bits);\n    }\n  }\n\n  // Verify that we have received just enough bits:\n  if (bits >= encoding.bits || 0xff & (buffer << (8 - bits))) {\n    throw new SyntaxError('Unexpected end of data');\n  }\n\n  return out;\n}\n\nfunction stringify(data: ArrayLike<number>, encoding: Encoding, opts: StringifyOptions = {}): string {\n  const { pad = true } = opts;\n  const mask = (1 << encoding.bits) - 1;\n  let out = '';\n\n  let bits = 0; // Number of bits currently in the buffer\n  let buffer = 0; // Bits waiting to be written out, MSB first\n  for (let i = 0; i < data.length; ++i) {\n    // Slurp data into the buffer:\n    buffer = (buffer << 8) | (0xff & data[i]);\n    bits += 8;\n\n    // Write out as much as we can:\n    while (bits > encoding.bits) {\n      bits -= encoding.bits;\n      out += encoding.chars[mask & (buffer >> bits)];\n    }\n  }\n\n  // Partial character:\n  if (bits) {\n    out += encoding.chars[mask & (buffer << (encoding.bits - bits))];\n  }\n\n  // Add padding characters until we hit a byte boundary:\n  if (pad) {\n    while ((out.length * encoding.bits) & 7) {\n      out += '=';\n    }\n  }\n\n  return out;\n}\n","const algToHash: Record<string, string> = {\n  RS256: 'SHA-256',\n  RS384: 'SHA-384',\n  RS512: 'SHA-512',\n};\nconst RSA_ALGORITHM_NAME = 'RSASSA-PKCS1-v1_5';\n\nconst jwksAlgToCryptoAlg: Record<string, string> = {\n  RS256: RSA_ALGORITHM_NAME,\n  RS384: RSA_ALGORITHM_NAME,\n  RS512: RSA_ALGORITHM_NAME,\n};\n\nexport const algs = Object.keys(algToHash);\n\nexport function getCryptoAlgorithm(algorithmName: string): RsaHashedImportParams {\n  const hash = algToHash[algorithmName];\n  const name = jwksAlgToCryptoAlg[algorithmName];\n\n  if (!hash || !name) {\n    throw new Error(`Unsupported algorithm ${algorithmName}, expected one of ${algs.join(',')}.`);\n  }\n\n  return {\n    hash: { name: algToHash[algorithmName] },\n    name: jwksAlgToCryptoAlg[algorithmName],\n  };\n}\n","import { isomorphicAtob } from '@clerk/shared/isomorphicAtob';\n\nimport { runtime } from '../runtime';\n\n// https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#pkcs_8_import\nfunction pemToBuffer(secret: string): ArrayBuffer {\n  const trimmed = secret\n    .replace(/-----BEGIN.*?-----/g, '')\n    .replace(/-----END.*?-----/g, '')\n    .replace(/\\s/g, '');\n\n  const decoded = isomorphicAtob(trimmed);\n\n  const buffer = new ArrayBuffer(decoded.length);\n  const bufView = new Uint8Array(buffer);\n\n  for (let i = 0, strLen = decoded.length; i < strLen; i++) {\n    bufView[i] = decoded.charCodeAt(i);\n  }\n\n  return bufView;\n}\n\nexport function importKey(\n  key: JsonWebKey | string,\n  algorithm: RsaHashedImportParams,\n  keyUsage: 'verify' | 'sign',\n): Promise<CryptoKey> {\n  if (typeof key === 'object') {\n    return runtime.crypto.subtle.importKey('jwk', key, algorithm, false, [keyUsage]);\n  }\n\n  const keyData = pemToBuffer(key);\n  const format = keyUsage === 'sign' ? 'pkcs8' : 'spki';\n\n  return runtime.crypto.subtle.importKey(format, keyData, algorithm, false, [keyUsage]);\n}\n","import { SignJWTError } from '../errors';\nimport { runtime } from '../runtime';\nimport { base64url } from '../util/rfc4648';\nimport { getCryptoAlgorithm } from './algorithms';\nimport { importKey } from './cryptoKeys';\nimport type { JwtReturnType } from './types';\n\nexport interface SignJwtOptions {\n  algorithm?: string;\n  header?: Record<string, unknown>;\n}\n\nfunction encodeJwtData(value: unknown): string {\n  const stringified = JSON.stringify(value);\n  const encoder = new TextEncoder();\n  const encoded = encoder.encode(stringified);\n  return base64url.stringify(encoded, { pad: false });\n}\n\n/**\n * Signs a JSON Web Token (JWT) with the given payload, key, and options.\n * This function is intended to be used *internally* by other Clerk packages and typically\n * should not be used directly.\n *\n * @internal\n * @param payload The payload to include in the JWT.\n * @param key The key to use for signing the JWT. Can be a string or a JsonWebKey.\n * @param options The options to use for signing the JWT.\n * @returns A Promise that resolves to the signed JWT string.\n * @throws An error if no algorithm is specified or if the specified algorithm is unsupported.\n * @throws An error if there is an issue with importing the key or signing the JWT.\n */\nexport async function signJwt(\n  payload: Record<string, unknown>,\n  key: string | JsonWebKey,\n  options: SignJwtOptions,\n): Promise<JwtReturnType<string, Error>> {\n  if (!options.algorithm) {\n    throw new Error('No algorithm specified');\n  }\n  const encoder = new TextEncoder();\n\n  const algorithm = getCryptoAlgorithm(options.algorithm);\n  if (!algorithm) {\n    return {\n      errors: [new SignJWTError(`Unsupported algorithm ${options.algorithm}`)],\n    };\n  }\n\n  const cryptoKey = await importKey(key, algorithm, 'sign');\n  const header = options.header || { typ: 'JWT' };\n\n  header.alg = options.algorithm;\n  payload.iat = Math.floor(Date.now() / 1000);\n\n  const encodedHeader = encodeJwtData(header);\n  const encodedPayload = encodeJwtData(payload);\n  const firstPart = `${encodedHeader}.${encodedPayload}`;\n\n  try {\n    const signature = await runtime.crypto.subtle.sign(algorithm, cryptoKey, encoder.encode(firstPart));\n    const encodedSignature = `${firstPart}.${base64url.stringify(new Uint8Array(signature), { pad: false })}`;\n    return { data: encodedSignature };\n  } catch (error) {\n    return { errors: [new SignJWTError((error as Error)?.message)] };\n  }\n}\n","import { TokenVerificationError, TokenVerificationErrorAction, TokenVerificationErrorReason } from '../errors';\nimport { algs } from './algorithms';\n\nexport type IssuerResolver = string | ((iss: string) => boolean);\n\nconst isArrayString = (s: unknown): s is string[] => {\n  return Array.isArray(s) && s.length > 0 && s.every(a => typeof a === 'string');\n};\n\nexport const assertAudienceClaim = (aud?: unknown, audience?: unknown) => {\n  const audienceList = [audience].flat().filter(a => !!a);\n  const audList = [aud].flat().filter(a => !!a);\n  const shouldVerifyAudience = audienceList.length > 0 && audList.length > 0;\n\n  if (!shouldVerifyAudience) {\n    // Notice: Clerk JWTs use AZP claim instead of Audience\n    //\n    // return {\n    //   valid: false,\n    //   reason: `Invalid JWT audience claim (aud) ${JSON.stringify(\n    //     aud,\n    //   )}. Expected a string or a non-empty array of strings.`,\n    // };\n    return;\n  }\n\n  if (typeof aud === 'string') {\n    if (!audienceList.includes(aud)) {\n      throw new TokenVerificationError({\n        action: TokenVerificationErrorAction.EnsureClerkJWT,\n        reason: TokenVerificationErrorReason.TokenVerificationFailed,\n        message: `Invalid JWT audience claim (aud) ${JSON.stringify(aud)}. Is not included in \"${JSON.stringify(\n          audienceList,\n        )}\".`,\n      });\n    }\n  } else if (isArrayString(aud)) {\n    if (!aud.some(a => audienceList.includes(a))) {\n      throw new TokenVerificationError({\n        action: TokenVerificationErrorAction.EnsureClerkJWT,\n        reason: TokenVerificationErrorReason.TokenVerificationFailed,\n        message: `Invalid JWT audience claim array (aud) ${JSON.stringify(aud)}. Is not included in \"${JSON.stringify(\n          audienceList,\n        )}\".`,\n      });\n    }\n  }\n};\n\nexport const assertHeaderType = (typ?: unknown, allowedTypes: string | string[] = 'JWT') => {\n  if (typeof typ === 'undefined') {\n    return;\n  }\n\n  const allowed = Array.isArray(allowedTypes) ? allowedTypes : [allowedTypes];\n  if (!allowed.includes(typ as string)) {\n    throw new TokenVerificationError({\n      action: TokenVerificationErrorAction.EnsureClerkJWT,\n      reason: TokenVerificationErrorReason.TokenInvalid,\n      message: `Invalid JWT type ${JSON.stringify(typ)}. Expected \"${allowed.join(', ')}\".`,\n    });\n  }\n};\n\nexport const assertHeaderAlgorithm = (alg: string) => {\n  if (!algs.includes(alg)) {\n    throw new TokenVerificationError({\n      action: TokenVerificationErrorAction.EnsureClerkJWT,\n      reason: TokenVerificationErrorReason.TokenInvalidAlgorithm,\n      message: `Invalid JWT algorithm ${JSON.stringify(alg)}. Supported: ${algs}.`,\n    });\n  }\n};\n\nexport const assertSubClaim = (sub?: string) => {\n  if (typeof sub !== 'string') {\n    throw new TokenVerificationError({\n      action: TokenVerificationErrorAction.EnsureClerkJWT,\n      reason: TokenVerificationErrorReason.TokenVerificationFailed,\n      message: `Subject claim (sub) is required and must be a string. Received ${JSON.stringify(sub)}.`,\n    });\n  }\n};\n\nexport const assertAuthorizedPartiesClaim = (azp?: string, authorizedParties?: string[]) => {\n  if (!azp || !authorizedParties || authorizedParties.length === 0) {\n    return;\n  }\n\n  if (!authorizedParties.includes(azp)) {\n    throw new TokenVerificationError({\n      reason: TokenVerificationErrorReason.TokenInvalidAuthorizedParties,\n      message: `Invalid JWT Authorized party claim (azp) ${JSON.stringify(azp)}. Expected \"${authorizedParties}\".`,\n    });\n  }\n};\n\nexport const assertExpirationClaim = (exp: number, clockSkewInMs: number) => {\n  if (typeof exp !== 'number') {\n    throw new TokenVerificationError({\n      action: TokenVerificationErrorAction.EnsureClerkJWT,\n      reason: TokenVerificationErrorReason.TokenVerificationFailed,\n      message: `Invalid JWT expiry date claim (exp) ${JSON.stringify(exp)}. Expected number.`,\n    });\n  }\n\n  const currentDate = new Date(Date.now());\n  const expiryDate = new Date(0);\n  expiryDate.setUTCSeconds(exp);\n\n  const expired = expiryDate.getTime() <= currentDate.getTime() - clockSkewInMs;\n  if (expired) {\n    throw new TokenVerificationError({\n      reason: TokenVerificationErrorReason.TokenExpired,\n      message: `JWT is expired. Expiry date: ${expiryDate.toUTCString()}, Current date: ${currentDate.toUTCString()}.`,\n    });\n  }\n};\n\nexport const assertActivationClaim = (nbf: number | undefined, clockSkewInMs: number) => {\n  if (typeof nbf === 'undefined') {\n    return;\n  }\n\n  if (typeof nbf !== 'number') {\n    throw new TokenVerificationError({\n      action: TokenVerificationErrorAction.EnsureClerkJWT,\n      reason: TokenVerificationErrorReason.TokenVerificationFailed,\n      message: `Invalid JWT not before date claim (nbf) ${JSON.stringify(nbf)}. Expected number.`,\n    });\n  }\n\n  const currentDate = new Date(Date.now());\n  const notBeforeDate = new Date(0);\n  notBeforeDate.setUTCSeconds(nbf);\n\n  const early = notBeforeDate.getTime() > currentDate.getTime() + clockSkewInMs;\n  if (early) {\n    throw new TokenVerificationError({\n      reason: TokenVerificationErrorReason.TokenNotActiveYet,\n      message: `JWT cannot be used prior to not before date claim (nbf). Not before date: ${notBeforeDate.toUTCString()}; Current date: ${currentDate.toUTCString()};`,\n    });\n  }\n};\n\nexport const assertIssuedAtClaim = (iat: number | undefined, clockSkewInMs: number) => {\n  if (typeof iat === 'undefined') {\n    return;\n  }\n\n  if (typeof iat !== 'number') {\n    throw new TokenVerificationError({\n      action: TokenVerificationErrorAction.EnsureClerkJWT,\n      reason: TokenVerificationErrorReason.TokenVerificationFailed,\n      message: `Invalid JWT issued at date claim (iat) ${JSON.stringify(iat)}. Expected number.`,\n    });\n  }\n\n  const currentDate = new Date(Date.now());\n  const issuedAtDate = new Date(0);\n  issuedAtDate.setUTCSeconds(iat);\n\n  const postIssued = issuedAtDate.getTime() > currentDate.getTime() + clockSkewInMs;\n  if (postIssued) {\n    throw new TokenVerificationError({\n      reason: TokenVerificationErrorReason.TokenIatInTheFuture,\n      message: `JWT issued at date claim (iat) is in the future. Issued at date: ${issuedAtDate.toUTCString()}; Current date: ${currentDate.toUTCString()};`,\n    });\n  }\n};\n","import type { Jwt, JwtPayload } from '@clerk/shared/types';\n\nimport { TokenVerificationError, TokenVerificationErrorAction, TokenVerificationErrorReason } from '../errors';\nimport { runtime } from '../runtime';\nimport { base64url } from '../util/rfc4648';\nimport { getCryptoAlgorithm } from './algorithms';\nimport {\n  assertActivationClaim,\n  assertAudienceClaim,\n  assertAuthorizedPartiesClaim,\n  assertExpirationClaim,\n  assertHeaderAlgorithm,\n  assertHeaderType,\n  assertIssuedAtClaim,\n  assertSubClaim,\n} from './assertions';\nimport { importKey } from './cryptoKeys';\nimport type { JwtReturnType } from './types';\n\nconst DEFAULT_CLOCK_SKEW_IN_MS = 5 * 1000;\n\nexport async function hasValidSignature(jwt: Jwt, key: JsonWebKey | string): Promise<JwtReturnType<boolean, Error>> {\n  const { header, signature, raw } = jwt;\n  const encoder = new TextEncoder();\n  const data = encoder.encode([raw.header, raw.payload].join('.'));\n  const algorithm = getCryptoAlgorithm(header.alg);\n\n  try {\n    const cryptoKey = await importKey(key, algorithm, 'verify');\n\n    const verified = await runtime.crypto.subtle.verify(algorithm.name, cryptoKey, signature, data);\n    return { data: verified };\n  } catch (error) {\n    return {\n      errors: [\n        new TokenVerificationError({\n          reason: TokenVerificationErrorReason.TokenInvalidSignature,\n          message: (error as Error)?.message,\n        }),\n      ],\n    };\n  }\n}\n\nexport function decodeJwt(token: string): JwtReturnType<Jwt, TokenVerificationError> {\n  const tokenParts = (token || '').toString().split('.');\n  if (tokenParts.length !== 3) {\n    return {\n      errors: [\n        new TokenVerificationError({\n          reason: TokenVerificationErrorReason.TokenInvalid,\n          message: `Invalid JWT form. A JWT consists of three parts separated by dots.`,\n        }),\n      ],\n    };\n  }\n\n  const [rawHeader, rawPayload, rawSignature] = tokenParts;\n\n  const decoder = new TextDecoder();\n\n  // To verify a JWS with SubtleCrypto you need to be careful to encode and decode\n  // the data properly between binary and base64url representation. Unfortunately\n  // the standard implementation in the V8 of btoa() and atob() are difficult to\n  // work with as they use \"a Unicode string containing only characters in the\n  // range U+0000 to U+00FF, each representing a binary byte with values 0x00 to\n  // 0xFF respectively\" as the representation of binary data.\n\n  // A better solution to represent binary data in Javascript is to use ES6 TypedArray\n  // and use a Javascript library to convert them to base64url that honors RFC 4648.\n\n  // Side note: The difference between base64 and base64url is the characters selected\n  // for value 62 and 63 in the standard, base64 encode them to + and / while base64url\n  // encode - and _.\n\n  // More info at https://stackoverflow.com/questions/54062583/how-to-verify-a-signed-jwt-with-subtlecrypto-of-the-web-crypto-API\n  const header = JSON.parse(decoder.decode(base64url.parse(rawHeader, { loose: true })));\n  const payload = JSON.parse(decoder.decode(base64url.parse(rawPayload, { loose: true })));\n\n  const signature = base64url.parse(rawSignature, { loose: true });\n\n  const data = {\n    header,\n    payload,\n    signature,\n    raw: {\n      header: rawHeader,\n      payload: rawPayload,\n      signature: rawSignature,\n      text: token,\n    },\n  } satisfies Jwt;\n\n  return { data };\n}\n\n/**\n * @inline\n */\nexport type VerifyJwtOptions = {\n  /**\n   * A string or list of [audiences](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3). If passed, it is checked against the `aud` claim in the token.\n   */\n  audience?: string | string[];\n  /**\n   * An allowlist of origins to verify against, to protect your application from the subdomain cookie leaking attack.\n   * @example\n   * ```ts\n   * ['http://localhost:3000', 'https://example.com']\n   * ```\n   */\n  authorizedParties?: string[];\n  /**\n   * Specifies the allowed time difference (in milliseconds) between the Clerk server (which generates the token) and the clock of the user's application server when validating a token.\n   * @default 5000\n   */\n  clockSkewInMs?: number;\n  /**\n   * @internal\n   */\n  key: JsonWebKey | string;\n  /**\n   * A string or list of allowed [header types](https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.9).\n   * @default 'JWT'\n   */\n  headerType?: string | string[];\n};\n\nexport async function verifyJwt(\n  token: string,\n  options: VerifyJwtOptions,\n): Promise<JwtReturnType<JwtPayload, TokenVerificationError>> {\n  const { audience, authorizedParties, clockSkewInMs, key, headerType } = options;\n  const clockSkew = clockSkewInMs || DEFAULT_CLOCK_SKEW_IN_MS;\n\n  const { data: decoded, errors } = decodeJwt(token);\n  if (errors) {\n    return { errors };\n  }\n\n  const { header, payload } = decoded;\n  try {\n    // Header verifications\n    const { typ, alg } = header;\n\n    assertHeaderType(typ, headerType);\n    assertHeaderAlgorithm(alg);\n\n    // Payload verifications\n    const { azp, sub, aud, iat, exp, nbf } = payload;\n\n    assertSubClaim(sub);\n    assertAudienceClaim([aud], [audience]);\n    assertAuthorizedPartiesClaim(azp, authorizedParties);\n    assertExpirationClaim(exp, clockSkew);\n    assertActivationClaim(nbf, clockSkew);\n    assertIssuedAtClaim(iat, clockSkew);\n  } catch (err) {\n    return { errors: [err as TokenVerificationError] };\n  }\n\n  const { data: signatureValid, errors: signatureErrors } = await hasValidSignature(decoded, key);\n  if (signatureErrors) {\n    return {\n      errors: [\n        new TokenVerificationError({\n          action: TokenVerificationErrorAction.EnsureClerkJWT,\n          reason: TokenVerificationErrorReason.TokenVerificationFailed,\n          message: `Error verifying JWT signature. ${signatureErrors[0]}`,\n        }),\n      ],\n    };\n  }\n\n  if (!signatureValid) {\n    return {\n      errors: [\n        new TokenVerificationError({\n          reason: TokenVerificationErrorReason.TokenInvalidSignature,\n          message: 'JWT signature is invalid.',\n        }),\n      ],\n    };\n  }\n\n  return { data: payload };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA,mBAAAA;AAAA,EAAA,yBAAAC;AAAA,EAAA,eAAAC;AAAA,EAAA,iBAAAC;AAAA;AAAA;;;ACGO,SAAS,iBAAiF,IAAO;AACtG,SAAO,UAAU,SAAsF;AACrG,UAAM,EAAE,MAAM,OAAO,IAAI,MAAM,GAAG,GAAG,IAAI;AACzC,QAAI,QAAQ;AACV,YAAM,OAAO,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AACF;AAGO,SAAS,qBAA4E,IAAO;AACjG,SAAO,IAAI,SAA6E;AACtF,UAAM,EAAE,MAAM,OAAO,IAAI,GAAG,GAAG,IAAI;AACnC,QAAI,QAAQ;AACV,YAAM,OAAO,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AACF;;;ACtBA,mBAA2B;AAUpB,IAAM,+BAA+B;AAAA,EAC1C,cAAc;AAAA,EACd,cAAc;AAAA,EACd,uBAAuB;AAAA,EACvB,+BAA+B;AAAA,EAC/B,uBAAuB;AAAA,EACvB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,yBAAyB;AAAA,EACzB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,uBAAuB;AAAA,EACvB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,gBAAgB;AAClB;AAKO,IAAM,+BAA+B;AAAA,EAC1C,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,iBAAiB;AACnB;AAKO,IAAM,yBAAN,MAAM,gCAA+B,MAAM;AAAA,EAKhD,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,OAAO;AAEb,WAAO,eAAe,MAAM,wBAAuB,SAAS;AAE5D,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,SAAS;AAAA,EAChB;AAAA,EAEO,iBAAiB;AACtB,WAAO,GAAG,CAAC,KAAK,SAAS,KAAK,MAAM,EAAE,OAAO,OAAK,CAAC,EAAE,KAAK,GAAG,CAAC,YAAY,KAAK,MAAM,mBACnF,KAAK,YACP;AAAA,EACF;AACF;AAEO,IAAM,eAAN,cAA2B,MAAM;AAAC;AAYlC,IAAM,iCAAN,MAAM,uCAAsC,wBAAW;AAAA,EAM5D,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAKG;AACD,UAAM,EAAE,SAAS,KAAK,CAAC;AACvB,WAAO,eAAe,MAAM,+BAA8B,SAAS;AACnE,SAAK,SAAS;AACd,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAGA,OAA0B,cAAc,OAAe,KAAa,OAAe,UAA8B;AAC/G,WAAO;AAAA,EACT;AAAA,EAEO,iBAAiB;AACtB,WAAO,GAAG,KAAK,OAAO,UAAU,KAAK,IAAI,YAAY,KAAK,UAAU,KAAK;AAAA,EAC3E;AACF;AA/Ba,+BACJ,OAAO;AADT,IAAM,gCAAN;;;ACrEP,oBAAoC;AAmBpC,IAAM,cAAc,MAAM,KAAK,UAAU;AAElC,IAAM,UAAmB;AAAA,EAC9B,sBAAAC;AAAA,EACA,IAAI,QAAQ;AAEV,WAAO,QAAQ,IAAI,aAAa,SAAS,QAAQ;AAAA,EACnD;AAAA,EACA,iBAAiB,WAAW;AAAA,EAC5B,MAAM,WAAW;AAAA,EACjB,UAAU,WAAW;AAAA,EACrB,SAAS,WAAW;AAAA,EACpB,SAAS,WAAW;AAAA,EACpB,UAAU,WAAW;AACvB;;;ACrCO,IAAM,YAAY;AAAA,EACvB,MAAM,QAAgB,MAAiC;AACrD,WAAO,MAAM,QAAQ,mBAAmB,IAAI;AAAA,EAC9C;AAAA,EAEA,UAAU,MAAyB,MAAiC;AAClE,WAAO,UAAU,MAAM,mBAAmB,IAAI;AAAA,EAChD;AACF;AAEA,IAAM,oBAA8B;AAAA,EAClC,OAAO;AAAA,EACP,MAAM;AACR;AAiBA,SAAS,MAAM,QAAgB,UAAoB,OAAqB,CAAC,GAAe;AAEtF,MAAI,CAAC,SAAS,OAAO;AACnB,aAAS,QAAQ,CAAC;AAClB,aAAS,IAAI,GAAG,IAAI,SAAS,MAAM,QAAQ,EAAE,GAAG;AAC9C,eAAS,MAAM,SAAS,MAAM,CAAC,CAAC,IAAI;AAAA,IACtC;AAAA,EACF;AAGA,MAAI,CAAC,KAAK,SAAU,OAAO,SAAS,SAAS,OAAQ,GAAG;AACtD,UAAM,IAAI,YAAY,iBAAiB;AAAA,EACzC;AAGA,MAAI,MAAM,OAAO;AACjB,SAAO,OAAO,MAAM,CAAC,MAAM,KAAK;AAC9B,MAAE;AAGF,QAAI,CAAC,KAAK,SAAS,GAAI,OAAO,SAAS,OAAO,SAAS,OAAQ,IAAI;AACjE,YAAM,IAAI,YAAY,iBAAiB;AAAA,IACzC;AAAA,EACF;AAGA,QAAM,MAAM,KAAK,KAAK,OAAO,YAAc,MAAM,SAAS,OAAQ,IAAK,CAAC;AAGxE,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,KAAK,EAAE,GAAG;AAE5B,UAAM,QAAQ,SAAS,MAAM,OAAO,CAAC,CAAC;AACtC,QAAI,UAAU,QAAW;AACvB,YAAM,IAAI,YAAY,uBAAuB,OAAO,CAAC,CAAC;AAAA,IACxD;AAGA,aAAU,UAAU,SAAS,OAAQ;AACrC,YAAQ,SAAS;AAGjB,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,UAAI,SAAS,IAAI,MAAQ,UAAU;AAAA,IACrC;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,QAAQ,MAAQ,UAAW,IAAI,MAAQ;AAC1D,UAAM,IAAI,YAAY,wBAAwB;AAAA,EAChD;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,MAAyB,UAAoB,OAAyB,CAAC,GAAW;AACnG,QAAM,EAAE,MAAM,KAAK,IAAI;AACvB,QAAM,QAAQ,KAAK,SAAS,QAAQ;AACpC,MAAI,MAAM;AAEV,MAAI,OAAO;AACX,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,EAAE,GAAG;AAEpC,aAAU,UAAU,IAAM,MAAO,KAAK,CAAC;AACvC,YAAQ;AAGR,WAAO,OAAO,SAAS,MAAM;AAC3B,cAAQ,SAAS;AACjB,aAAO,SAAS,MAAM,OAAQ,UAAU,IAAK;AAAA,IAC/C;AAAA,EACF;AAGA,MAAI,MAAM;AACR,WAAO,SAAS,MAAM,OAAQ,UAAW,SAAS,OAAO,IAAM;AAAA,EACjE;AAGA,MAAI,KAAK;AACP,WAAQ,IAAI,SAAS,SAAS,OAAQ,GAAG;AACvC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;;;ACnIA,IAAM,YAAoC;AAAA,EACxC,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AACT;AACA,IAAM,qBAAqB;AAE3B,IAAM,qBAA6C;AAAA,EACjD,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AACT;AAEO,IAAM,OAAO,OAAO,KAAK,SAAS;AAElC,SAAS,mBAAmB,eAA8C;AAC/E,QAAM,OAAO,UAAU,aAAa;AACpC,QAAM,OAAO,mBAAmB,aAAa;AAE7C,MAAI,CAAC,QAAQ,CAAC,MAAM;AAClB,UAAM,IAAI,MAAM,yBAAyB,aAAa,qBAAqB,KAAK,KAAK,GAAG,CAAC,GAAG;AAAA,EAC9F;AAEA,SAAO;AAAA,IACL,MAAM,EAAE,MAAM,UAAU,aAAa,EAAE;AAAA,IACvC,MAAM,mBAAmB,aAAa;AAAA,EACxC;AACF;;;AC3BA,4BAA+B;AAK/B,SAAS,YAAY,QAA6B;AAChD,QAAM,UAAU,OACb,QAAQ,uBAAuB,EAAE,EACjC,QAAQ,qBAAqB,EAAE,EAC/B,QAAQ,OAAO,EAAE;AAEpB,QAAM,cAAU,sCAAe,OAAO;AAEtC,QAAM,SAAS,IAAI,YAAY,QAAQ,MAAM;AAC7C,QAAM,UAAU,IAAI,WAAW,MAAM;AAErC,WAAS,IAAI,GAAG,SAAS,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACxD,YAAQ,CAAC,IAAI,QAAQ,WAAW,CAAC;AAAA,EACnC;AAEA,SAAO;AACT;AAEO,SAAS,UACd,KACA,WACA,UACoB;AACpB,MAAI,OAAO,QAAQ,UAAU;AAC3B,WAAO,QAAQ,OAAO,OAAO,UAAU,OAAO,KAAK,WAAW,OAAO,CAAC,QAAQ,CAAC;AAAA,EACjF;AAEA,QAAM,UAAU,YAAY,GAAG;AAC/B,QAAM,SAAS,aAAa,SAAS,UAAU;AAE/C,SAAO,QAAQ,OAAO,OAAO,UAAU,QAAQ,SAAS,WAAW,OAAO,CAAC,QAAQ,CAAC;AACtF;;;ACxBA,SAAS,cAAc,OAAwB;AAC7C,QAAM,cAAc,KAAK,UAAU,KAAK;AACxC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,QAAQ,OAAO,WAAW;AAC1C,SAAO,UAAU,UAAU,SAAS,EAAE,KAAK,MAAM,CAAC;AACpD;AAeA,eAAsB,QACpB,SACA,KACA,SACuC;AACvC,MAAI,CAAC,QAAQ,WAAW;AACtB,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,YAAY,mBAAmB,QAAQ,SAAS;AACtD,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,QAAQ,CAAC,IAAI,aAAa,yBAAyB,QAAQ,SAAS,EAAE,CAAC;AAAA,IACzE;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,UAAU,KAAK,WAAW,MAAM;AACxD,QAAM,SAAS,QAAQ,UAAU,EAAE,KAAK,MAAM;AAE9C,SAAO,MAAM,QAAQ;AACrB,UAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE1C,QAAM,gBAAgB,cAAc,MAAM;AAC1C,QAAM,iBAAiB,cAAc,OAAO;AAC5C,QAAM,YAAY,GAAG,aAAa,IAAI,cAAc;AAEpD,MAAI;AACF,UAAM,YAAY,MAAM,QAAQ,OAAO,OAAO,KAAK,WAAW,WAAW,QAAQ,OAAO,SAAS,CAAC;AAClG,UAAM,mBAAmB,GAAG,SAAS,IAAI,UAAU,UAAU,IAAI,WAAW,SAAS,GAAG,EAAE,KAAK,MAAM,CAAC,CAAC;AACvG,WAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC,SAAS,OAAO;AACd,WAAO,EAAE,QAAQ,CAAC,IAAI,aAAc,OAAiB,OAAO,CAAC,EAAE;AAAA,EACjE;AACF;;;AC7DA,IAAM,gBAAgB,CAAC,MAA8B;AACnD,SAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,MAAM,OAAK,OAAO,MAAM,QAAQ;AAC/E;AAEO,IAAM,sBAAsB,CAAC,KAAe,aAAuB;AACxE,QAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,OAAK,CAAC,CAAC,CAAC;AACtD,QAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,OAAK,CAAC,CAAC,CAAC;AAC5C,QAAM,uBAAuB,aAAa,SAAS,KAAK,QAAQ,SAAS;AAEzE,MAAI,CAAC,sBAAsB;AASzB;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI,CAAC,aAAa,SAAS,GAAG,GAAG;AAC/B,YAAM,IAAI,uBAAuB;AAAA,QAC/B,QAAQ,6BAA6B;AAAA,QACrC,QAAQ,6BAA6B;AAAA,QACrC,SAAS,oCAAoC,KAAK,UAAU,GAAG,CAAC,yBAAyB,KAAK;AAAA,UAC5F;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,EACF,WAAW,cAAc,GAAG,GAAG;AAC7B,QAAI,CAAC,IAAI,KAAK,OAAK,aAAa,SAAS,CAAC,CAAC,GAAG;AAC5C,YAAM,IAAI,uBAAuB;AAAA,QAC/B,QAAQ,6BAA6B;AAAA,QACrC,QAAQ,6BAA6B;AAAA,QACrC,SAAS,0CAA0C,KAAK,UAAU,GAAG,CAAC,yBAAyB,KAAK;AAAA,UAClG;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,mBAAmB,CAAC,KAAe,eAAkC,UAAU;AAC1F,MAAI,OAAO,QAAQ,aAAa;AAC9B;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,QAAQ,YAAY,IAAI,eAAe,CAAC,YAAY;AAC1E,MAAI,CAAC,QAAQ,SAAS,GAAa,GAAG;AACpC,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,QAAQ,6BAA6B;AAAA,MACrC,SAAS,oBAAoB,KAAK,UAAU,GAAG,CAAC,eAAe,QAAQ,KAAK,IAAI,CAAC;AAAA,IACnF,CAAC;AAAA,EACH;AACF;AAEO,IAAM,wBAAwB,CAAC,QAAgB;AACpD,MAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AACvB,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,QAAQ,6BAA6B;AAAA,MACrC,SAAS,yBAAyB,KAAK,UAAU,GAAG,CAAC,gBAAgB,IAAI;AAAA,IAC3E,CAAC;AAAA,EACH;AACF;AAEO,IAAM,iBAAiB,CAAC,QAAiB;AAC9C,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,QAAQ,6BAA6B;AAAA,MACrC,SAAS,kEAAkE,KAAK,UAAU,GAAG,CAAC;AAAA,IAChG,CAAC;AAAA,EACH;AACF;AAEO,IAAM,+BAA+B,CAAC,KAAc,sBAAiC;AAC1F,MAAI,CAAC,OAAO,CAAC,qBAAqB,kBAAkB,WAAW,GAAG;AAChE;AAAA,EACF;AAEA,MAAI,CAAC,kBAAkB,SAAS,GAAG,GAAG;AACpC,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,SAAS,4CAA4C,KAAK,UAAU,GAAG,CAAC,eAAe,iBAAiB;AAAA,IAC1G,CAAC;AAAA,EACH;AACF;AAEO,IAAM,wBAAwB,CAAC,KAAa,kBAA0B;AAC3E,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,QAAQ,6BAA6B;AAAA,MACrC,SAAS,uCAAuC,KAAK,UAAU,GAAG,CAAC;AAAA,IACrE,CAAC;AAAA,EACH;AAEA,QAAM,cAAc,IAAI,KAAK,KAAK,IAAI,CAAC;AACvC,QAAM,aAAa,oBAAI,KAAK,CAAC;AAC7B,aAAW,cAAc,GAAG;AAE5B,QAAM,UAAU,WAAW,QAAQ,KAAK,YAAY,QAAQ,IAAI;AAChE,MAAI,SAAS;AACX,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,SAAS,gCAAgC,WAAW,YAAY,CAAC,mBAAmB,YAAY,YAAY,CAAC;AAAA,IAC/G,CAAC;AAAA,EACH;AACF;AAEO,IAAM,wBAAwB,CAAC,KAAyB,kBAA0B;AACvF,MAAI,OAAO,QAAQ,aAAa;AAC9B;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,QAAQ,6BAA6B;AAAA,MACrC,SAAS,2CAA2C,KAAK,UAAU,GAAG,CAAC;AAAA,IACzE,CAAC;AAAA,EACH;AAEA,QAAM,cAAc,IAAI,KAAK,KAAK,IAAI,CAAC;AACvC,QAAM,gBAAgB,oBAAI,KAAK,CAAC;AAChC,gBAAc,cAAc,GAAG;AAE/B,QAAM,QAAQ,cAAc,QAAQ,IAAI,YAAY,QAAQ,IAAI;AAChE,MAAI,OAAO;AACT,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,SAAS,6EAA6E,cAAc,YAAY,CAAC,mBAAmB,YAAY,YAAY,CAAC;AAAA,IAC/J,CAAC;AAAA,EACH;AACF;AAEO,IAAM,sBAAsB,CAAC,KAAyB,kBAA0B;AACrF,MAAI,OAAO,QAAQ,aAAa;AAC9B;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,QAAQ,6BAA6B;AAAA,MACrC,SAAS,0CAA0C,KAAK,UAAU,GAAG,CAAC;AAAA,IACxE,CAAC;AAAA,EACH;AAEA,QAAM,cAAc,IAAI,KAAK,KAAK,IAAI,CAAC;AACvC,QAAM,eAAe,oBAAI,KAAK,CAAC;AAC/B,eAAa,cAAc,GAAG;AAE9B,QAAM,aAAa,aAAa,QAAQ,IAAI,YAAY,QAAQ,IAAI;AACpE,MAAI,YAAY;AACd,UAAM,IAAI,uBAAuB;AAAA,MAC/B,QAAQ,6BAA6B;AAAA,MACrC,SAAS,oEAAoE,aAAa,YAAY,CAAC,mBAAmB,YAAY,YAAY,CAAC;AAAA,IACrJ,CAAC;AAAA,EACH;AACF;;;ACtJA,IAAM,2BAA2B,IAAI;AAErC,eAAsB,kBAAkB,KAAU,KAAkE;AAClH,QAAM,EAAE,QAAQ,WAAW,IAAI,IAAI;AACnC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,CAAC,IAAI,QAAQ,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC;AAC/D,QAAM,YAAY,mBAAmB,OAAO,GAAG;AAE/C,MAAI;AACF,UAAM,YAAY,MAAM,UAAU,KAAK,WAAW,QAAQ;AAE1D,UAAM,WAAW,MAAM,QAAQ,OAAO,OAAO,OAAO,UAAU,MAAM,WAAW,WAAW,IAAI;AAC9F,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B,SAAS,OAAO;AACd,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,IAAI,uBAAuB;AAAA,UACzB,QAAQ,6BAA6B;AAAA,UACrC,SAAU,OAAiB;AAAA,QAC7B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,UAAU,OAA2D;AACnF,QAAM,cAAc,SAAS,IAAI,SAAS,EAAE,MAAM,GAAG;AACrD,MAAI,WAAW,WAAW,GAAG;AAC3B,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,IAAI,uBAAuB;AAAA,UACzB,QAAQ,6BAA6B;AAAA,UACrC,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,CAAC,WAAW,YAAY,YAAY,IAAI;AAE9C,QAAM,UAAU,IAAI,YAAY;AAiBhC,QAAM,SAAS,KAAK,MAAM,QAAQ,OAAO,UAAU,MAAM,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AACrF,QAAM,UAAU,KAAK,MAAM,QAAQ,OAAO,UAAU,MAAM,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AAEvF,QAAM,YAAY,UAAU,MAAM,cAAc,EAAE,OAAO,KAAK,CAAC;AAE/D,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,MACH,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO,EAAE,KAAK;AAChB;AAkCA,eAAsB,UACpB,OACA,SAC4D;AAC5D,QAAM,EAAE,UAAU,mBAAmB,eAAe,KAAK,WAAW,IAAI;AACxE,QAAM,YAAY,iBAAiB;AAEnC,QAAM,EAAE,MAAM,SAAS,OAAO,IAAI,UAAU,KAAK;AACjD,MAAI,QAAQ;AACV,WAAO,EAAE,OAAO;AAAA,EAClB;AAEA,QAAM,EAAE,QAAQ,QAAQ,IAAI;AAC5B,MAAI;AAEF,UAAM,EAAE,KAAK,IAAI,IAAI;AAErB,qBAAiB,KAAK,UAAU;AAChC,0BAAsB,GAAG;AAGzB,UAAM,EAAE,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,IAAI;AAEzC,mBAAe,GAAG;AAClB,wBAAoB,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;AACrC,iCAA6B,KAAK,iBAAiB;AACnD,0BAAsB,KAAK,SAAS;AACpC,0BAAsB,KAAK,SAAS;AACpC,wBAAoB,KAAK,SAAS;AAAA,EACpC,SAAS,KAAK;AACZ,WAAO,EAAE,QAAQ,CAAC,GAA6B,EAAE;AAAA,EACnD;AAEA,QAAM,EAAE,MAAM,gBAAgB,QAAQ,gBAAgB,IAAI,MAAM,kBAAkB,SAAS,GAAG;AAC9F,MAAI,iBAAiB;AACnB,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,IAAI,uBAAuB;AAAA,UACzB,QAAQ,6BAA6B;AAAA,UACrC,QAAQ,6BAA6B;AAAA,UACrC,SAAS,kCAAkC,gBAAgB,CAAC,CAAC;AAAA,QAC/D,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,IAAI,uBAAuB;AAAA,UACzB,QAAQ,6BAA6B;AAAA,UACrC,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,QAAQ;AACzB;;;AThLO,IAAMC,aAAY,iBAAiB,SAAU;AAC7C,IAAMC,aAAY,qBAAqB,SAAU;AAEjD,IAAMC,WAAU,iBAAiB,OAAQ;AACzC,IAAMC,qBAAoB,iBAAiB,iBAAkB;","names":["decodeJwt","hasValidSignature","signJwt","verifyJwt","crypto","verifyJwt","decodeJwt","signJwt","hasValidSignature"]}

package/node_modules/@clerk/backend/dist/jwt/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/jwt/signJwt.ts","../../src/jwt/index.ts"],"sourcesContent":["import { SignJWTError } from '../errors';\nimport { runtime } from '../runtime';\nimport { base64url } from '../util/rfc4648';\nimport { getCryptoAlgorithm } from './algorithms';\nimport { importKey } from './cryptoKeys';\nimport type { JwtReturnType } from './types';\n\nexport interface SignJwtOptions {\n  algorithm?: string;\n  header?: Record<string, unknown>;\n}\n\nfunction encodeJwtData(value: unknown): string {\n  const stringified = JSON.stringify(value);\n  const encoder = new TextEncoder();\n  const encoded = encoder.encode(stringified);\n  return base64url.stringify(encoded, { pad: false });\n}\n\n/**\n * Signs a JSON Web Token (JWT) with the given payload, key, and options.\n * This function is intended to be used *internally* by other Clerk packages and typically\n * should not be used directly.\n *\n * @internal\n * @param payload The payload to include in the JWT.\n * @param key The key to use for signing the JWT. Can be a string or a JsonWebKey.\n * @param options The options to use for signing the JWT.\n * @returns A Promise that resolves to the signed JWT string.\n * @throws An error if no algorithm is specified or if the specified algorithm is unsupported.\n * @throws An error if there is an issue with importing the key or signing the JWT.\n */\nexport async function signJwt(\n  payload: Record<string, unknown>,\n  key: string | JsonWebKey,\n  options: SignJwtOptions,\n): Promise<JwtReturnType<string, Error>> {\n  if (!options.algorithm) {\n    throw new Error('No algorithm specified');\n  }\n  const encoder = new TextEncoder();\n\n  const algorithm = getCryptoAlgorithm(options.algorithm);\n  if (!algorithm) {\n    return {\n      errors: [new SignJWTError(`Unsupported algorithm ${options.algorithm}`)],\n    };\n  }\n\n  const cryptoKey = await importKey(key, algorithm, 'sign');\n  const header = options.header || { typ: 'JWT' };\n\n  header.alg = options.algorithm;\n  payload.iat = Math.floor(Date.now() / 1000);\n\n  const encodedHeader = encodeJwtData(header);\n  const encodedPayload = encodeJwtData(payload);\n  const firstPart = `${encodedHeader}.${encodedPayload}`;\n\n  try {\n    const signature = await runtime.crypto.subtle.sign(algorithm, cryptoKey, encoder.encode(firstPart));\n    const encodedSignature = `${firstPart}.${base64url.stringify(new Uint8Array(signature), { pad: false })}`;\n    return { data: encodedSignature };\n  } catch (error) {\n    return { errors: [new SignJWTError((error as Error)?.message)] };\n  }\n}\n","import { withLegacyReturn, withLegacySyncReturn } from './legacyReturn';\nimport { signJwt as _signJwt } from './signJwt';\nimport { decodeJwt as _decodeJwt, hasValidSignature as _hasValidSignature, verifyJwt as _verifyJwt } from './verifyJwt';\n\nexport type { VerifyJwtOptions } from './verifyJwt';\nexport type { SignJwtOptions } from './signJwt';\n\n// Introduce compatibility layer to avoid more breaking changes\n// TODO(dimkl): This (probably be drop in the next major version)\n\nexport const verifyJwt = withLegacyReturn(_verifyJwt);\nexport const decodeJwt = withLegacySyncReturn(_decodeJwt);\n\nexport const signJwt = withLegacyReturn(_signJwt);\nexport const hasValidSignature = withLegacyReturn(_hasValidSignature);\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAYA,SAAS,cAAc,OAAwB;AAC7C,QAAM,cAAc,KAAK,UAAU,KAAK;AACxC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,QAAQ,OAAO,WAAW;AAC1C,SAAO,UAAU,UAAU,SAAS,EAAE,KAAK,MAAM,CAAC;AACpD;AAeA,eAAsB,QACpB,SACA,KACA,SACuC;AACvC,MAAI,CAAC,QAAQ,WAAW;AACtB,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,YAAY,mBAAmB,QAAQ,SAAS;AACtD,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,QAAQ,CAAC,IAAI,aAAa,yBAAyB,QAAQ,SAAS,EAAE,CAAC;AAAA,IACzE;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,UAAU,KAAK,WAAW,MAAM;AACxD,QAAM,SAAS,QAAQ,UAAU,EAAE,KAAK,MAAM;AAE9C,SAAO,MAAM,QAAQ;AACrB,UAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE1C,QAAM,gBAAgB,cAAc,MAAM;AAC1C,QAAM,iBAAiB,cAAc,OAAO;AAC5C,QAAM,YAAY,GAAG,aAAa,IAAI,cAAc;AAEpD,MAAI;AACF,UAAM,YAAY,MAAM,QAAQ,OAAO,OAAO,KAAK,WAAW,WAAW,QAAQ,OAAO,SAAS,CAAC;AAClG,UAAM,mBAAmB,GAAG,SAAS,IAAI,UAAU,UAAU,IAAI,WAAW,SAAS,GAAG,EAAE,KAAK,MAAM,CAAC,CAAC;AACvG,WAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC,SAAS,OAAO;AACd,WAAO,EAAE,QAAQ,CAAC,IAAI,aAAc,OAAiB,OAAO,CAAC,EAAE;AAAA,EACjE;AACF;;;ACxDO,IAAMA,aAAY,iBAAiB,SAAU;AAC7C,IAAMC,aAAY,qBAAqB,SAAU;AAEjD,IAAMC,WAAU,iBAAiB,OAAQ;AACzC,IAAMC,qBAAoB,iBAAiB,iBAAkB;","names":["verifyJwt","decodeJwt","signJwt","hasValidSignature"]}

package/node_modules/@clerk/backend/dist/jwt/legacyReturn.d.ts

@@ -1,4 +0,0 @@
-import type { JwtReturnType } from './types';
-export declare function withLegacyReturn<T extends (...args: any[]) => Promise<JwtReturnType<any, any>>>(cb: T): (...args: Parameters<T>) => Promise<NonNullable<Awaited<ReturnType<T>>["data"]>> | never;
-export declare function withLegacySyncReturn<T extends (...args: any[]) => JwtReturnType<any, any>>(cb: T): (...args: Parameters<T>) => NonNullable<Awaited<ReturnType<T>>["data"]> | never;
-//# sourceMappingURL=legacyReturn.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/legacyReturn.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"legacyReturn.d.ts","sourceRoot":"","sources":["../../src/jwt/legacyReturn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAG7C,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IACtF,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAOpG;AAGD,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,IACvF,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAOrF"}

package/node_modules/@clerk/backend/dist/jwt/signJwt.d.ts

@@ -1,20 +0,0 @@
-import type { JwtReturnType } from './types';
-export interface SignJwtOptions {
-    algorithm?: string;
-    header?: Record<string, unknown>;
-}
-/**
- * Signs a JSON Web Token (JWT) with the given payload, key, and options.
- * This function is intended to be used *internally* by other Clerk packages and typically
- * should not be used directly.
- *
- * @internal
- * @param payload The payload to include in the JWT.
- * @param key The key to use for signing the JWT. Can be a string or a JsonWebKey.
- * @param options The options to use for signing the JWT.
- * @returns A Promise that resolves to the signed JWT string.
- * @throws An error if no algorithm is specified or if the specified algorithm is unsupported.
- * @throws An error if there is an issue with importing the key or signing the JWT.
- */
-export declare function signJwt(payload: Record<string, unknown>, key: string | JsonWebKey, options: SignJwtOptions): Promise<JwtReturnType<string, Error>>;
-//# sourceMappingURL=signJwt.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/signJwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signJwt.d.ts","sourceRoot":"","sources":["../../src/jwt/signJwt.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AASD;;;;;;;;;;;;GAYG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CA8BvC"}

package/node_modules/@clerk/backend/dist/jwt/types.d.ts

@@ -1,18 +0,0 @@
-import type { MachineTokenType } from '../tokens/tokenTypes';
-export type JwtReturnType<R, E extends Error> = {
-    data: R;
-    errors?: undefined;
-} | {
-    data?: undefined;
-    errors: [E];
-};
-export type MachineTokenReturnType<R, E extends Error> = {
-    data: R;
-    tokenType: MachineTokenType;
-    errors?: undefined;
-} | {
-    data?: undefined;
-    tokenType: MachineTokenType;
-    errors: [E];
-};
-//# sourceMappingURL=types.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/jwt/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,IACxC;IACE,IAAI,EAAE,CAAC,CAAC;IACR,MAAM,CAAC,EAAE,SAAS,CAAC;CACpB,GACD;IACE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;CACb,CAAC;AAEN,MAAM,MAAM,sBAAsB,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,IACjD;IACE,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,CAAC,EAAE,SAAS,CAAC;CACpB,GACD;IACE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;CACb,CAAC"}

package/node_modules/@clerk/backend/dist/jwt/verifyJwt.d.ts

@@ -1,38 +0,0 @@
-import type { Jwt, JwtPayload } from '@clerk/shared/types';
-import { TokenVerificationError } from '../errors';
-import type { JwtReturnType } from './types';
-export declare function hasValidSignature(jwt: Jwt, key: JsonWebKey | string): Promise<JwtReturnType<boolean, Error>>;
-export declare function decodeJwt(token: string): JwtReturnType<Jwt, TokenVerificationError>;
-/**
- * @inline
- */
-export type VerifyJwtOptions = {
-    /**
-     * A string or list of [audiences](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3). If passed, it is checked against the `aud` claim in the token.
-     */
-    audience?: string | string[];
-    /**
-     * An allowlist of origins to verify against, to protect your application from the subdomain cookie leaking attack.
-     * @example
-     * ```ts
-     * ['http://localhost:3000', 'https://example.com']
-     * ```
-     */
-    authorizedParties?: string[];
-    /**
-     * Specifies the allowed time difference (in milliseconds) between the Clerk server (which generates the token) and the clock of the user's application server when validating a token.
-     * @default 5000
-     */
-    clockSkewInMs?: number;
-    /**
-     * @internal
-     */
-    key: JsonWebKey | string;
-    /**
-     * A string or list of allowed [header types](https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.9).
-     * @default 'JWT'
-     */
-    headerType?: string | string[];
-};
-export declare function verifyJwt(token: string, options: VerifyJwtOptions): Promise<JwtReturnType<JwtPayload, TokenVerificationError>>;
-//# sourceMappingURL=verifyJwt.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/verifyJwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyJwt.d.ts","sourceRoot":"","sources":["../../src/jwt/verifyJwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,sBAAsB,EAA8D,MAAM,WAAW,CAAC;AAe/G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAI7C,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAqBlH;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAkDnF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,GAAG,EAAE,UAAU,GAAG,MAAM,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAChC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAuD5D"}

package/node_modules/@clerk/backend/dist/jwt/verifyMachineJwt.d.ts

@@ -1,19 +0,0 @@
-import type { Jwt } from '@clerk/shared/types';
-import { IdPOAuthAccessToken } from '../api/resources/IdPOAuthAccessToken';
-import { M2MToken } from '../api/resources/M2MToken';
-import { MachineTokenVerificationError } from '../errors';
-import type { MachineTokenReturnType } from '../jwt/types';
-import type { LoadClerkJWKFromRemoteOptions } from '../tokens/keys';
-export type JwtMachineVerifyOptions = Pick<LoadClerkJWKFromRemoteOptions, 'secretKey' | 'apiUrl' | 'skipJwksCache'> & {
-    jwtKey?: string;
-    clockSkewInMs?: number;
-};
-/**
- * Verifies a pre-decoded M2M JWT (identified by `sub` starting with `mch_`).
- */
-export declare function verifyM2MJwt(token: string, decoded: Jwt, options: JwtMachineVerifyOptions): Promise<MachineTokenReturnType<M2MToken, MachineTokenVerificationError>>;
-/**
- * Verifies a pre-decoded OAuth access token JWT (identified by `typ: at+jwt` or `application/at+jwt`).
- */
-export declare function verifyOAuthJwt(token: string, decoded: Jwt, options: JwtMachineVerifyOptions): Promise<MachineTokenReturnType<IdPOAuthAccessToken, MachineTokenVerificationError>>;
-//# sourceMappingURL=verifyMachineJwt.d.ts.map

package/node_modules/@clerk/backend/dist/jwt/verifyMachineJwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyMachineJwt.d.ts","sourceRoot":"","sources":["../../src/jwt/verifyMachineJwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAc,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EACL,6BAA6B,EAG9B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAKpE,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,6BAA6B,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC,GAAG;IACpH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AA6DF;;GAEG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC,CAY1E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CAAC,CAYrF"}

package/node_modules/@clerk/backend/dist/mock-server.d.ts

@@ -1,4 +0,0 @@
-import { type DefaultBodyType, type HttpResponseResolver, type PathParams } from 'msw';
-export declare const server: import("msw/node").SetupServerApi;
-export declare function validateHeaders<Params extends PathParams, RequestBodyType extends DefaultBodyType, ResponseBodyType extends DefaultBodyType>(resolver: HttpResponseResolver<Params, RequestBodyType, ResponseBodyType>): HttpResponseResolver<Params, RequestBodyType, ResponseBodyType>;
-//# sourceMappingURL=mock-server.d.ts.map

package/node_modules/@clerk/backend/dist/mock-server.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mock-server.d.ts","sourceRoot":"","sources":["../src/mock-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAgB,KAAK,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,KAAK,CAAC;AAKrG,eAAO,MAAM,MAAM,mCAAiC,CAAC;AAGrD,wBAAgB,eAAe,CAC7B,MAAM,SAAS,UAAU,EACzB,eAAe,SAAS,eAAe,EACvC,gBAAgB,SAAS,eAAe,EAExC,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,gBAAgB,CAAC,GACxE,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAgCjE"}

package/node_modules/@clerk/backend/dist/proxy.d.ts

@@ -1,72 +0,0 @@
-export { DEFAULT_PROXY_PATH } from '@clerk/shared/constants';
-/**
- * Options for the Frontend API proxy
- */
-export interface FrontendApiProxyOptions {
-    /**
-     * The path prefix for proxy requests. Defaults to `/__clerk`.
-     */
-    proxyPath?: string;
-    /**
-     * The Clerk publishable key. Falls back to CLERK_PUBLISHABLE_KEY env var.
-     */
-    publishableKey?: string;
-    /**
-     * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
-     */
-    secretKey?: string;
-}
-/**
- * Error codes for proxy errors
- */
-export type ProxyErrorCode = 'proxy_configuration_error' | 'proxy_path_mismatch' | 'proxy_request_failed';
-/**
- * Error response structure for proxy errors
- */
-export interface ProxyError {
-    code: ProxyErrorCode;
-    message: string;
-}
-/**
- * Derives the Frontend API URL from a publishable key.
- * @param publishableKey - The Clerk publishable key
- * @returns The Frontend API URL for the environment
- */
-export declare function fapiUrlFromPublishableKey(publishableKey: string): string;
-/**
- * Removes trailing slashes from a string without using regex
- * to avoid potential ReDoS concerns flagged by security scanners.
- */
-export declare function stripTrailingSlashes(str: string): string;
-/**
- * Checks if a request path matches the proxy path.
- * @param request - The incoming request
- * @param options - Proxy options including the proxy path
- * @returns True if the request matches the proxy path
- */
-export declare function matchProxyPath(request: Request, options?: Pick<FrontendApiProxyOptions, 'proxyPath'>): boolean;
-/**
- * Proxies a request to Clerk's Frontend API.
- *
- * This function handles forwarding requests from your application to Clerk's
- * Frontend API, enabling scenarios where direct communication with Clerk's API
- * is blocked or needs to go through your application server.
- *
- * @param request - The incoming request to proxy
- * @param options - Proxy configuration options
- * @returns A Response from Clerk's Frontend API
- *
- * @example
- * ```typescript
- * import { clerkFrontendApiProxy } from '@clerk/backend/proxy';
- *
- * // In a route handler
- * const response = await clerkFrontendApiProxy(request, {
- *   proxyPath: '/__clerk',
- *   publishableKey: process.env.CLERK_PUBLISHABLE_KEY,
- *   secretKey: process.env.CLERK_SECRET_KEY,
- * });
- * ```
- */
-export declare function clerkFrontendApiProxy(request: Request, options?: FrontendApiProxyOptions): Promise<Response>;
-//# sourceMappingURL=proxy.d.ts.map

package/node_modules/@clerk/backend/dist/proxy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,2BAA2B,GAAG,qBAAqB,GAAG,sBAAsB,CAAC;AAE1G;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAuCD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAcxE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKxD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAAG,OAAO,CAI9G;AAuDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwKlH"}

package/node_modules/@clerk/backend/dist/proxy.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/proxy.ts"],"sourcesContent":["import {\n  DEFAULT_PROXY_PATH,\n  LEGACY_DEV_INSTANCE_SUFFIXES,\n  LOCAL_ENV_SUFFIXES,\n  LOCAL_FAPI_URL,\n  PROD_FAPI_URL,\n  STAGING_ENV_SUFFIXES,\n  STAGING_FAPI_URL,\n} from '@clerk/shared/constants';\nimport { parsePublishableKey } from '@clerk/shared/keys';\n\nexport { DEFAULT_PROXY_PATH } from '@clerk/shared/constants';\n\n/**\n * Options for the Frontend API proxy\n */\nexport interface FrontendApiProxyOptions {\n  /**\n   * The path prefix for proxy requests. Defaults to `/__clerk`.\n   */\n  proxyPath?: string;\n  /**\n   * The Clerk publishable key. Falls back to CLERK_PUBLISHABLE_KEY env var.\n   */\n  publishableKey?: string;\n  /**\n   * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.\n   */\n  secretKey?: string;\n}\n\n/**\n * Error codes for proxy errors\n */\nexport type ProxyErrorCode = 'proxy_configuration_error' | 'proxy_path_mismatch' | 'proxy_request_failed';\n\n/**\n * Error response structure for proxy errors\n */\nexport interface ProxyError {\n  code: ProxyErrorCode;\n  message: string;\n}\n\n// Hop-by-hop headers that should not be forwarded\nconst HOP_BY_HOP_HEADERS = new Set([\n  'connection',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailer',\n  'transfer-encoding',\n  'upgrade',\n]);\n\n/**\n * Parses the Connection header to extract dynamically-nominated hop-by-hop\n * header names (RFC 7230 Section 6.1). These headers are specific to the\n * current connection and must not be forwarded by proxies.\n */\nfunction getDynamicHopByHopHeaders(headers: Headers): Set<string> {\n  const connectionValue = headers.get('connection');\n  if (!connectionValue) {\n    return new Set();\n  }\n  return new Set(\n    connectionValue\n      .split(',')\n      .map(h => h.trim().toLowerCase())\n      .filter(h => h.length > 0),\n  );\n}\n\n// Headers to strip from proxied responses. fetch() auto-decompresses\n// response bodies, so Content-Encoding no longer describes the body\n// and Content-Length reflects the compressed size. We request identity\n// encoding upstream to avoid the double compression pass, but strip\n// these defensively since servers may ignore Accept-Encoding: identity.\nconst RESPONSE_HEADERS_TO_STRIP = new Set(['content-encoding', 'content-length']);\n\n/**\n * Derives the Frontend API URL from a publishable key.\n * @param publishableKey - The Clerk publishable key\n * @returns The Frontend API URL for the environment\n */\nexport function fapiUrlFromPublishableKey(publishableKey: string): string {\n  const frontendApi = parsePublishableKey(publishableKey)?.frontendApi;\n\n  if (frontendApi?.startsWith('clerk.') && LEGACY_DEV_INSTANCE_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return PROD_FAPI_URL;\n  }\n\n  if (LOCAL_ENV_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return LOCAL_FAPI_URL;\n  }\n  if (STAGING_ENV_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return STAGING_FAPI_URL;\n  }\n  return PROD_FAPI_URL;\n}\n\n/**\n * Removes trailing slashes from a string without using regex\n * to avoid potential ReDoS concerns flagged by security scanners.\n */\nexport function stripTrailingSlashes(str: string): string {\n  while (str.endsWith('/')) {\n    str = str.slice(0, -1);\n  }\n  return str;\n}\n\n/**\n * Checks if a request path matches the proxy path.\n * @param request - The incoming request\n * @param options - Proxy options including the proxy path\n * @returns True if the request matches the proxy path\n */\nexport function matchProxyPath(request: Request, options?: Pick<FrontendApiProxyOptions, 'proxyPath'>): boolean {\n  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);\n  const url = new URL(request.url);\n  return url.pathname === proxyPath || url.pathname.startsWith(proxyPath + '/');\n}\n\n/**\n * Creates a JSON error response\n */\nfunction createErrorResponse(code: ProxyErrorCode, message: string, status: number): Response {\n  const error: ProxyError = { code, message };\n  return new Response(JSON.stringify({ errors: [error] }), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      'Cache-Control': 'no-store',\n    },\n  });\n}\n\n/**\n * Derives the public-facing origin from forwarded headers, falling back to the raw request URL.\n * Behind a reverse proxy, request.url is typically localhost, but the Clerk-Proxy-Url header\n * and Location rewrites must use the origin visible to the browser.\n */\nfunction derivePublicOrigin(request: Request, requestUrl: URL): string {\n  const forwardedProto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();\n  const forwardedHost = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim();\n\n  if (forwardedProto && forwardedHost) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return requestUrl.origin;\n}\n\n/**\n * Gets the client IP address from various headers\n */\nfunction getClientIp(request: Request): string | undefined {\n  const cfConnectingIp = request.headers.get('cf-connecting-ip');\n  if (cfConnectingIp) {\n    return cfConnectingIp;\n  }\n\n  const xRealIp = request.headers.get('x-real-ip');\n  if (xRealIp) {\n    return xRealIp;\n  }\n\n  const xForwardedFor = request.headers.get('x-forwarded-for');\n  if (xForwardedFor) {\n    // Take the first IP in the chain\n    return xForwardedFor.split(',')[0]?.trim();\n  }\n\n  return undefined;\n}\n\n/**\n * Proxies a request to Clerk's Frontend API.\n *\n * This function handles forwarding requests from your application to Clerk's\n * Frontend API, enabling scenarios where direct communication with Clerk's API\n * is blocked or needs to go through your application server.\n *\n * @param request - The incoming request to proxy\n * @param options - Proxy configuration options\n * @returns A Response from Clerk's Frontend API\n *\n * @example\n * ```typescript\n * import { clerkFrontendApiProxy } from '@clerk/backend/proxy';\n *\n * // In a route handler\n * const response = await clerkFrontendApiProxy(request, {\n *   proxyPath: '/__clerk',\n *   publishableKey: process.env.CLERK_PUBLISHABLE_KEY,\n *   secretKey: process.env.CLERK_SECRET_KEY,\n * });\n * ```\n */\nexport async function clerkFrontendApiProxy(request: Request, options?: FrontendApiProxyOptions): Promise<Response> {\n  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);\n  const publishableKey =\n    options?.publishableKey || (typeof process !== 'undefined' ? process.env?.CLERK_PUBLISHABLE_KEY : undefined);\n  const secretKey = options?.secretKey || (typeof process !== 'undefined' ? process.env?.CLERK_SECRET_KEY : undefined);\n\n  // Validate configuration\n  if (!publishableKey) {\n    return createErrorResponse(\n      'proxy_configuration_error',\n      'Missing publishableKey. Provide it in options or set CLERK_PUBLISHABLE_KEY environment variable.',\n      500,\n    );\n  }\n\n  if (!secretKey) {\n    return createErrorResponse(\n      'proxy_configuration_error',\n      'Missing secretKey. Provide it in options or set CLERK_SECRET_KEY environment variable.',\n      500,\n    );\n  }\n\n  // Get the request URL and validate path\n  const requestUrl = new URL(request.url);\n  const pathMatches = requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + '/');\n  if (!pathMatches) {\n    return createErrorResponse(\n      'proxy_path_mismatch',\n      `Request path \"${requestUrl.pathname}\" does not match proxy path \"${proxyPath}\"`,\n      400,\n    );\n  }\n\n  // Derive the FAPI URL and construct the target URL.\n  // Use string concatenation instead of `new URL(path, base)` to avoid\n  // protocol-relative resolution (e.g., \"//evil.com\" resolving to a different host).\n  const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);\n  const fapiHost = new URL(fapiBaseUrl).host;\n  const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';\n  const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);\n  targetUrl.search = requestUrl.search;\n\n  if (targetUrl.host !== fapiHost) {\n    return createErrorResponse('proxy_request_failed', 'Resolved target does not match the expected host', 400);\n  }\n\n  // Build headers for the proxied request\n  const headers = new Headers();\n\n  // Copy original headers, excluding hop-by-hop headers and any\n  // dynamically-nominated hop-by-hop headers listed in the Connection header (RFC 7230 Section 6.1).\n  const dynamicHopByHop = getDynamicHopByHopHeaders(request.headers);\n  request.headers.forEach((value, key) => {\n    const lower = key.toLowerCase();\n    if (!HOP_BY_HOP_HEADERS.has(lower) && !dynamicHopByHop.has(lower)) {\n      headers.set(key, value);\n    }\n  });\n\n  // Set required Clerk proxy headers\n  // Use the public origin (from forwarded headers) so the Clerk-Proxy-Url\n  // points to the browser-visible host, not localhost behind a reverse proxy.\n  const publicOrigin = derivePublicOrigin(request, requestUrl);\n  const proxyUrl = `${publicOrigin}${proxyPath}`;\n  headers.set('Clerk-Proxy-Url', proxyUrl);\n  headers.set('Clerk-Secret-Key', secretKey);\n\n  // Set the host header to the FAPI host\n  headers.set('Host', fapiHost);\n\n  // Request uncompressed responses to avoid a double compression pass.\n  // fetch() auto-decompresses, so without this FAPI compresses → fetch\n  // decompresses → the serving layer re-compresses for the browser.\n  headers.set('Accept-Encoding', 'identity');\n\n  // Set X-Forwarded-* headers for proxy awareness\n  // Only set these if not already present (preserve values from upstream proxies)\n  if (!headers.has('X-Forwarded-Host')) {\n    headers.set('X-Forwarded-Host', requestUrl.host);\n  }\n  if (!headers.has('X-Forwarded-Proto')) {\n    headers.set('X-Forwarded-Proto', requestUrl.protocol.replace(':', ''));\n  }\n\n  // Set X-Forwarded-For to the client IP\n  // In multi-proxy scenarios, we prefer authoritative headers (CF-Connecting-IP, X-Real-IP)\n  // over the existing X-Forwarded-For chain, as they provide the true client IP\n  const clientIp = getClientIp(request);\n  if (clientIp) {\n    headers.set('X-Forwarded-For', clientIp);\n  }\n\n  // Determine if request has a body (handles DELETE-with-body and any other method)\n  const hasBody = request.body !== null;\n\n  try {\n    // Make the proxied request\n    // TODO: Consider adding AbortSignal.timeout(30_000) via AbortSignal.any()\n    const fetchOptions: RequestInit = {\n      method: request.method,\n      headers,\n      redirect: 'manual',\n      signal: request.signal,\n    };\n\n    // Only set duplex when body is present (required for streaming bodies)\n    if (hasBody) {\n      // @ts-expect-error - duplex is required for streaming bodies, but not present on the RequestInit type from undici\n      fetchOptions.duplex = 'half';\n      fetchOptions.body = request.body;\n    }\n\n    const response = await fetch(targetUrl.toString(), fetchOptions);\n\n    // Build response headers, excluding hop-by-hop and encoding headers.\n    // Also strip dynamically-nominated hop-by-hop headers from the response Connection header.\n    const responseDynamicHopByHop = getDynamicHopByHopHeaders(response.headers);\n    const responseHeaders = new Headers();\n    response.headers.forEach((value, key) => {\n      const lower = key.toLowerCase();\n      if (\n        !HOP_BY_HOP_HEADERS.has(lower) &&\n        !RESPONSE_HEADERS_TO_STRIP.has(lower) &&\n        !responseDynamicHopByHop.has(lower)\n      ) {\n        if (lower === 'set-cookie') {\n          responseHeaders.append(key, value);\n        } else {\n          responseHeaders.set(key, value);\n        }\n      }\n    });\n\n    // Rewrite Location header for redirects to go through the proxy\n    const locationHeader = response.headers.get('location');\n    if (locationHeader) {\n      try {\n        const locationUrl = new URL(locationHeader, fapiBaseUrl);\n        // Check if the redirect points to the FAPI host\n        if (locationUrl.host === fapiHost) {\n          // Rewrite to go through the proxy\n          const rewrittenLocation = `${proxyUrl}${locationUrl.pathname}${locationUrl.search}${locationUrl.hash}`;\n          responseHeaders.set('Location', rewrittenLocation);\n        }\n      } catch {\n        // If URL parsing fails, leave the Location header as-is (could be a relative URL)\n      }\n    }\n\n    const proxyResponse = new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers: responseHeaders,\n    });\n\n    // Some runtimes may re-add Content-Length when constructing the Response.\n    // Delete explicitly since fetch() decoded the body and the original values\n    // no longer reflect the actual content.\n    for (const header of RESPONSE_HEADERS_TO_STRIP) {\n      proxyResponse.headers.delete(header);\n    }\n\n    return proxyResponse;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return createErrorResponse('proxy_request_failed', `Failed to proxy request to Clerk FAPI: ${message}`, 502);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAQO;AACP,kBAAoC;AAEpC,IAAAA,oBAAmC;AAkCnC,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,0BAA0B,SAA+B;AAChE,QAAM,kBAAkB,QAAQ,IAAI,YAAY;AAChD,MAAI,CAAC,iBAAiB;AACpB,WAAO,oBAAI,IAAI;AAAA,EACjB;AACA,SAAO,IAAI;AAAA,IACT,gBACG,MAAM,GAAG,EACT,IAAI,OAAK,EAAE,KAAK,EAAE,YAAY,CAAC,EAC/B,OAAO,OAAK,EAAE,SAAS,CAAC;AAAA,EAC7B;AACF;AAOA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,oBAAoB,gBAAgB,CAAC;AAOzE,SAAS,0BAA0B,gBAAgC;AACxE,QAAM,kBAAc,iCAAoB,cAAc,GAAG;AAEzD,MAAI,aAAa,WAAW,QAAQ,KAAK,8CAA6B,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACnH,WAAO;AAAA,EACT;AAEA,MAAI,oCAAmB,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACpE,WAAO;AAAA,EACT;AACA,MAAI,sCAAqB,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACtE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMO,SAAS,qBAAqB,KAAqB;AACxD,SAAO,IAAI,SAAS,GAAG,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAQO,SAAS,eAAe,SAAkB,SAA+D;AAC9G,QAAM,YAAY,qBAAqB,SAAS,aAAa,mCAAkB;AAC/E,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,SAAO,IAAI,aAAa,aAAa,IAAI,SAAS,WAAW,YAAY,GAAG;AAC9E;AAKA,SAAS,oBAAoB,MAAsB,SAAiB,QAA0B;AAC5F,QAAM,QAAoB,EAAE,MAAM,QAAQ;AAC1C,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG;AAAA,IACvD;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACH;AAOA,SAAS,mBAAmB,SAAkB,YAAyB;AACrE,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAEnF,MAAI,kBAAkB,eAAe;AACnC,WAAO,GAAG,cAAc,MAAM,aAAa;AAAA,EAC7C;AAEA,SAAO,WAAW;AACpB;AAKA,SAAS,YAAY,SAAsC;AACzD,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,kBAAkB;AAC7D,MAAI,gBAAgB;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,WAAW;AAC/C,MAAI,SAAS;AACX,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,MAAI,eAAe;AAEjB,WAAO,cAAc,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAAA,EAC3C;AAEA,SAAO;AACT;AAyBA,eAAsB,sBAAsB,SAAkB,SAAsD;AAClH,QAAM,YAAY,qBAAqB,SAAS,aAAa,mCAAkB;AAC/E,QAAM,iBACJ,SAAS,mBAAmB,OAAO,YAAY,cAAc,QAAQ,KAAK,wBAAwB;AACpG,QAAM,YAAY,SAAS,cAAc,OAAO,YAAY,cAAc,QAAQ,KAAK,mBAAmB;AAG1G,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,cAAc,WAAW,aAAa,aAAa,WAAW,SAAS,WAAW,YAAY,GAAG;AACvG,MAAI,CAAC,aAAa;AAChB,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,WAAW,QAAQ,gCAAgC,SAAS;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AAKA,QAAM,cAAc,0BAA0B,cAAc;AAC5D,QAAM,WAAW,IAAI,IAAI,WAAW,EAAE;AACtC,QAAM,aAAa,WAAW,SAAS,MAAM,UAAU,MAAM,KAAK;AAClE,QAAM,YAAY,IAAI,IAAI,GAAG,WAAW,GAAG,UAAU,EAAE;AACvD,YAAU,SAAS,WAAW;AAE9B,MAAI,UAAU,SAAS,UAAU;AAC/B,WAAO,oBAAoB,wBAAwB,oDAAoD,GAAG;AAAA,EAC5G;AAGA,QAAM,UAAU,IAAI,QAAQ;AAI5B,QAAM,kBAAkB,0BAA0B,QAAQ,OAAO;AACjE,UAAQ,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACtC,UAAM,QAAQ,IAAI,YAAY;AAC9B,QAAI,CAAC,mBAAmB,IAAI,KAAK,KAAK,CAAC,gBAAgB,IAAI,KAAK,GAAG;AACjE,cAAQ,IAAI,KAAK,KAAK;AAAA,IACxB;AAAA,EACF,CAAC;AAKD,QAAM,eAAe,mBAAmB,SAAS,UAAU;AAC3D,QAAM,WAAW,GAAG,YAAY,GAAG,SAAS;AAC5C,UAAQ,IAAI,mBAAmB,QAAQ;AACvC,UAAQ,IAAI,oBAAoB,SAAS;AAGzC,UAAQ,IAAI,QAAQ,QAAQ;AAK5B,UAAQ,IAAI,mBAAmB,UAAU;AAIzC,MAAI,CAAC,QAAQ,IAAI,kBAAkB,GAAG;AACpC,YAAQ,IAAI,oBAAoB,WAAW,IAAI;AAAA,EACjD;AACA,MAAI,CAAC,QAAQ,IAAI,mBAAmB,GAAG;AACrC,YAAQ,IAAI,qBAAqB,WAAW,SAAS,QAAQ,KAAK,EAAE,CAAC;AAAA,EACvE;AAKA,QAAM,WAAW,YAAY,OAAO;AACpC,MAAI,UAAU;AACZ,YAAQ,IAAI,mBAAmB,QAAQ;AAAA,EACzC;AAGA,QAAM,UAAU,QAAQ,SAAS;AAEjC,MAAI;AAGF,UAAM,eAA4B;AAAA,MAChC,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,UAAU;AAAA,MACV,QAAQ,QAAQ;AAAA,IAClB;AAGA,QAAI,SAAS;AAEX,mBAAa,SAAS;AACtB,mBAAa,OAAO,QAAQ;AAAA,IAC9B;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,SAAS,GAAG,YAAY;AAI/D,UAAM,0BAA0B,0BAA0B,SAAS,OAAO;AAC1E,UAAM,kBAAkB,IAAI,QAAQ;AACpC,aAAS,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACvC,YAAM,QAAQ,IAAI,YAAY;AAC9B,UACE,CAAC,mBAAmB,IAAI,KAAK,KAC7B,CAAC,0BAA0B,IAAI,KAAK,KACpC,CAAC,wBAAwB,IAAI,KAAK,GAClC;AACA,YAAI,UAAU,cAAc;AAC1B,0BAAgB,OAAO,KAAK,KAAK;AAAA,QACnC,OAAO;AACL,0BAAgB,IAAI,KAAK,KAAK;AAAA,QAChC;AAAA,MACF;AAAA,IACF,CAAC;AAGD,UAAM,iBAAiB,SAAS,QAAQ,IAAI,UAAU;AACtD,QAAI,gBAAgB;AAClB,UAAI;AACF,cAAM,cAAc,IAAI,IAAI,gBAAgB,WAAW;AAEvD,YAAI,YAAY,SAAS,UAAU;AAEjC,gBAAM,oBAAoB,GAAG,QAAQ,GAAG,YAAY,QAAQ,GAAG,YAAY,MAAM,GAAG,YAAY,IAAI;AACpG,0BAAgB,IAAI,YAAY,iBAAiB;AAAA,QACnD;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,gBAAgB,IAAI,SAAS,SAAS,MAAM;AAAA,MAChD,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAKD,eAAW,UAAU,2BAA2B;AAC9C,oBAAc,QAAQ,OAAO,MAAM;AAAA,IACrC;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,oBAAoB,wBAAwB,0CAA0C,OAAO,IAAI,GAAG;AAAA,EAC7G;AACF;","names":["import_constants"]}

package/node_modules/@clerk/backend/dist/proxy.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/proxy.ts"],"sourcesContent":["import {\n  DEFAULT_PROXY_PATH,\n  LEGACY_DEV_INSTANCE_SUFFIXES,\n  LOCAL_ENV_SUFFIXES,\n  LOCAL_FAPI_URL,\n  PROD_FAPI_URL,\n  STAGING_ENV_SUFFIXES,\n  STAGING_FAPI_URL,\n} from '@clerk/shared/constants';\nimport { parsePublishableKey } from '@clerk/shared/keys';\n\nexport { DEFAULT_PROXY_PATH } from '@clerk/shared/constants';\n\n/**\n * Options for the Frontend API proxy\n */\nexport interface FrontendApiProxyOptions {\n  /**\n   * The path prefix for proxy requests. Defaults to `/__clerk`.\n   */\n  proxyPath?: string;\n  /**\n   * The Clerk publishable key. Falls back to CLERK_PUBLISHABLE_KEY env var.\n   */\n  publishableKey?: string;\n  /**\n   * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.\n   */\n  secretKey?: string;\n}\n\n/**\n * Error codes for proxy errors\n */\nexport type ProxyErrorCode = 'proxy_configuration_error' | 'proxy_path_mismatch' | 'proxy_request_failed';\n\n/**\n * Error response structure for proxy errors\n */\nexport interface ProxyError {\n  code: ProxyErrorCode;\n  message: string;\n}\n\n// Hop-by-hop headers that should not be forwarded\nconst HOP_BY_HOP_HEADERS = new Set([\n  'connection',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailer',\n  'transfer-encoding',\n  'upgrade',\n]);\n\n/**\n * Parses the Connection header to extract dynamically-nominated hop-by-hop\n * header names (RFC 7230 Section 6.1). These headers are specific to the\n * current connection and must not be forwarded by proxies.\n */\nfunction getDynamicHopByHopHeaders(headers: Headers): Set<string> {\n  const connectionValue = headers.get('connection');\n  if (!connectionValue) {\n    return new Set();\n  }\n  return new Set(\n    connectionValue\n      .split(',')\n      .map(h => h.trim().toLowerCase())\n      .filter(h => h.length > 0),\n  );\n}\n\n// Headers to strip from proxied responses. fetch() auto-decompresses\n// response bodies, so Content-Encoding no longer describes the body\n// and Content-Length reflects the compressed size. We request identity\n// encoding upstream to avoid the double compression pass, but strip\n// these defensively since servers may ignore Accept-Encoding: identity.\nconst RESPONSE_HEADERS_TO_STRIP = new Set(['content-encoding', 'content-length']);\n\n/**\n * Derives the Frontend API URL from a publishable key.\n * @param publishableKey - The Clerk publishable key\n * @returns The Frontend API URL for the environment\n */\nexport function fapiUrlFromPublishableKey(publishableKey: string): string {\n  const frontendApi = parsePublishableKey(publishableKey)?.frontendApi;\n\n  if (frontendApi?.startsWith('clerk.') && LEGACY_DEV_INSTANCE_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return PROD_FAPI_URL;\n  }\n\n  if (LOCAL_ENV_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return LOCAL_FAPI_URL;\n  }\n  if (STAGING_ENV_SUFFIXES.some(suffix => frontendApi?.endsWith(suffix))) {\n    return STAGING_FAPI_URL;\n  }\n  return PROD_FAPI_URL;\n}\n\n/**\n * Removes trailing slashes from a string without using regex\n * to avoid potential ReDoS concerns flagged by security scanners.\n */\nexport function stripTrailingSlashes(str: string): string {\n  while (str.endsWith('/')) {\n    str = str.slice(0, -1);\n  }\n  return str;\n}\n\n/**\n * Checks if a request path matches the proxy path.\n * @param request - The incoming request\n * @param options - Proxy options including the proxy path\n * @returns True if the request matches the proxy path\n */\nexport function matchProxyPath(request: Request, options?: Pick<FrontendApiProxyOptions, 'proxyPath'>): boolean {\n  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);\n  const url = new URL(request.url);\n  return url.pathname === proxyPath || url.pathname.startsWith(proxyPath + '/');\n}\n\n/**\n * Creates a JSON error response\n */\nfunction createErrorResponse(code: ProxyErrorCode, message: string, status: number): Response {\n  const error: ProxyError = { code, message };\n  return new Response(JSON.stringify({ errors: [error] }), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      'Cache-Control': 'no-store',\n    },\n  });\n}\n\n/**\n * Derives the public-facing origin from forwarded headers, falling back to the raw request URL.\n * Behind a reverse proxy, request.url is typically localhost, but the Clerk-Proxy-Url header\n * and Location rewrites must use the origin visible to the browser.\n */\nfunction derivePublicOrigin(request: Request, requestUrl: URL): string {\n  const forwardedProto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();\n  const forwardedHost = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim();\n\n  if (forwardedProto && forwardedHost) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return requestUrl.origin;\n}\n\n/**\n * Gets the client IP address from various headers\n */\nfunction getClientIp(request: Request): string | undefined {\n  const cfConnectingIp = request.headers.get('cf-connecting-ip');\n  if (cfConnectingIp) {\n    return cfConnectingIp;\n  }\n\n  const xRealIp = request.headers.get('x-real-ip');\n  if (xRealIp) {\n    return xRealIp;\n  }\n\n  const xForwardedFor = request.headers.get('x-forwarded-for');\n  if (xForwardedFor) {\n    // Take the first IP in the chain\n    return xForwardedFor.split(',')[0]?.trim();\n  }\n\n  return undefined;\n}\n\n/**\n * Proxies a request to Clerk's Frontend API.\n *\n * This function handles forwarding requests from your application to Clerk's\n * Frontend API, enabling scenarios where direct communication with Clerk's API\n * is blocked or needs to go through your application server.\n *\n * @param request - The incoming request to proxy\n * @param options - Proxy configuration options\n * @returns A Response from Clerk's Frontend API\n *\n * @example\n * ```typescript\n * import { clerkFrontendApiProxy } from '@clerk/backend/proxy';\n *\n * // In a route handler\n * const response = await clerkFrontendApiProxy(request, {\n *   proxyPath: '/__clerk',\n *   publishableKey: process.env.CLERK_PUBLISHABLE_KEY,\n *   secretKey: process.env.CLERK_SECRET_KEY,\n * });\n * ```\n */\nexport async function clerkFrontendApiProxy(request: Request, options?: FrontendApiProxyOptions): Promise<Response> {\n  const proxyPath = stripTrailingSlashes(options?.proxyPath || DEFAULT_PROXY_PATH);\n  const publishableKey =\n    options?.publishableKey || (typeof process !== 'undefined' ? process.env?.CLERK_PUBLISHABLE_KEY : undefined);\n  const secretKey = options?.secretKey || (typeof process !== 'undefined' ? process.env?.CLERK_SECRET_KEY : undefined);\n\n  // Validate configuration\n  if (!publishableKey) {\n    return createErrorResponse(\n      'proxy_configuration_error',\n      'Missing publishableKey. Provide it in options or set CLERK_PUBLISHABLE_KEY environment variable.',\n      500,\n    );\n  }\n\n  if (!secretKey) {\n    return createErrorResponse(\n      'proxy_configuration_error',\n      'Missing secretKey. Provide it in options or set CLERK_SECRET_KEY environment variable.',\n      500,\n    );\n  }\n\n  // Get the request URL and validate path\n  const requestUrl = new URL(request.url);\n  const pathMatches = requestUrl.pathname === proxyPath || requestUrl.pathname.startsWith(proxyPath + '/');\n  if (!pathMatches) {\n    return createErrorResponse(\n      'proxy_path_mismatch',\n      `Request path \"${requestUrl.pathname}\" does not match proxy path \"${proxyPath}\"`,\n      400,\n    );\n  }\n\n  // Derive the FAPI URL and construct the target URL.\n  // Use string concatenation instead of `new URL(path, base)` to avoid\n  // protocol-relative resolution (e.g., \"//evil.com\" resolving to a different host).\n  const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);\n  const fapiHost = new URL(fapiBaseUrl).host;\n  const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';\n  const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);\n  targetUrl.search = requestUrl.search;\n\n  if (targetUrl.host !== fapiHost) {\n    return createErrorResponse('proxy_request_failed', 'Resolved target does not match the expected host', 400);\n  }\n\n  // Build headers for the proxied request\n  const headers = new Headers();\n\n  // Copy original headers, excluding hop-by-hop headers and any\n  // dynamically-nominated hop-by-hop headers listed in the Connection header (RFC 7230 Section 6.1).\n  const dynamicHopByHop = getDynamicHopByHopHeaders(request.headers);\n  request.headers.forEach((value, key) => {\n    const lower = key.toLowerCase();\n    if (!HOP_BY_HOP_HEADERS.has(lower) && !dynamicHopByHop.has(lower)) {\n      headers.set(key, value);\n    }\n  });\n\n  // Set required Clerk proxy headers\n  // Use the public origin (from forwarded headers) so the Clerk-Proxy-Url\n  // points to the browser-visible host, not localhost behind a reverse proxy.\n  const publicOrigin = derivePublicOrigin(request, requestUrl);\n  const proxyUrl = `${publicOrigin}${proxyPath}`;\n  headers.set('Clerk-Proxy-Url', proxyUrl);\n  headers.set('Clerk-Secret-Key', secretKey);\n\n  // Set the host header to the FAPI host\n  headers.set('Host', fapiHost);\n\n  // Request uncompressed responses to avoid a double compression pass.\n  // fetch() auto-decompresses, so without this FAPI compresses → fetch\n  // decompresses → the serving layer re-compresses for the browser.\n  headers.set('Accept-Encoding', 'identity');\n\n  // Set X-Forwarded-* headers for proxy awareness\n  // Only set these if not already present (preserve values from upstream proxies)\n  if (!headers.has('X-Forwarded-Host')) {\n    headers.set('X-Forwarded-Host', requestUrl.host);\n  }\n  if (!headers.has('X-Forwarded-Proto')) {\n    headers.set('X-Forwarded-Proto', requestUrl.protocol.replace(':', ''));\n  }\n\n  // Set X-Forwarded-For to the client IP\n  // In multi-proxy scenarios, we prefer authoritative headers (CF-Connecting-IP, X-Real-IP)\n  // over the existing X-Forwarded-For chain, as they provide the true client IP\n  const clientIp = getClientIp(request);\n  if (clientIp) {\n    headers.set('X-Forwarded-For', clientIp);\n  }\n\n  // Determine if request has a body (handles DELETE-with-body and any other method)\n  const hasBody = request.body !== null;\n\n  try {\n    // Make the proxied request\n    // TODO: Consider adding AbortSignal.timeout(30_000) via AbortSignal.any()\n    const fetchOptions: RequestInit = {\n      method: request.method,\n      headers,\n      redirect: 'manual',\n      signal: request.signal,\n    };\n\n    // Only set duplex when body is present (required for streaming bodies)\n    if (hasBody) {\n      // @ts-expect-error - duplex is required for streaming bodies, but not present on the RequestInit type from undici\n      fetchOptions.duplex = 'half';\n      fetchOptions.body = request.body;\n    }\n\n    const response = await fetch(targetUrl.toString(), fetchOptions);\n\n    // Build response headers, excluding hop-by-hop and encoding headers.\n    // Also strip dynamically-nominated hop-by-hop headers from the response Connection header.\n    const responseDynamicHopByHop = getDynamicHopByHopHeaders(response.headers);\n    const responseHeaders = new Headers();\n    response.headers.forEach((value, key) => {\n      const lower = key.toLowerCase();\n      if (\n        !HOP_BY_HOP_HEADERS.has(lower) &&\n        !RESPONSE_HEADERS_TO_STRIP.has(lower) &&\n        !responseDynamicHopByHop.has(lower)\n      ) {\n        if (lower === 'set-cookie') {\n          responseHeaders.append(key, value);\n        } else {\n          responseHeaders.set(key, value);\n        }\n      }\n    });\n\n    // Rewrite Location header for redirects to go through the proxy\n    const locationHeader = response.headers.get('location');\n    if (locationHeader) {\n      try {\n        const locationUrl = new URL(locationHeader, fapiBaseUrl);\n        // Check if the redirect points to the FAPI host\n        if (locationUrl.host === fapiHost) {\n          // Rewrite to go through the proxy\n          const rewrittenLocation = `${proxyUrl}${locationUrl.pathname}${locationUrl.search}${locationUrl.hash}`;\n          responseHeaders.set('Location', rewrittenLocation);\n        }\n      } catch {\n        // If URL parsing fails, leave the Location header as-is (could be a relative URL)\n      }\n    }\n\n    const proxyResponse = new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers: responseHeaders,\n    });\n\n    // Some runtimes may re-add Content-Length when constructing the Response.\n    // Delete explicitly since fetch() decoded the body and the original values\n    // no longer reflect the actual content.\n    for (const header of RESPONSE_HEADERS_TO_STRIP) {\n      proxyResponse.headers.delete(header);\n    }\n\n    return proxyResponse;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    return createErrorResponse('proxy_request_failed', `Failed to proxy request to Clerk FAPI: ${message}`, 502);\n  }\n}\n"],"mappings":";;;AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AAEpC,SAAS,sBAAAA,2BAA0B;AAkCnC,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,0BAA0B,SAA+B;AAChE,QAAM,kBAAkB,QAAQ,IAAI,YAAY;AAChD,MAAI,CAAC,iBAAiB;AACpB,WAAO,oBAAI,IAAI;AAAA,EACjB;AACA,SAAO,IAAI;AAAA,IACT,gBACG,MAAM,GAAG,EACT,IAAI,OAAK,EAAE,KAAK,EAAE,YAAY,CAAC,EAC/B,OAAO,OAAK,EAAE,SAAS,CAAC;AAAA,EAC7B;AACF;AAOA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,oBAAoB,gBAAgB,CAAC;AAOzE,SAAS,0BAA0B,gBAAgC;AACxE,QAAM,cAAc,oBAAoB,cAAc,GAAG;AAEzD,MAAI,aAAa,WAAW,QAAQ,KAAK,6BAA6B,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACnH,WAAO;AAAA,EACT;AAEA,MAAI,mBAAmB,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACpE,WAAO;AAAA,EACT;AACA,MAAI,qBAAqB,KAAK,YAAU,aAAa,SAAS,MAAM,CAAC,GAAG;AACtE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMO,SAAS,qBAAqB,KAAqB;AACxD,SAAO,IAAI,SAAS,GAAG,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAQO,SAAS,eAAe,SAAkB,SAA+D;AAC9G,QAAM,YAAY,qBAAqB,SAAS,aAAa,kBAAkB;AAC/E,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,SAAO,IAAI,aAAa,aAAa,IAAI,SAAS,WAAW,YAAY,GAAG;AAC9E;AAKA,SAAS,oBAAoB,MAAsB,SAAiB,QAA0B;AAC5F,QAAM,QAAoB,EAAE,MAAM,QAAQ;AAC1C,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG;AAAA,IACvD;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACH;AAOA,SAAS,mBAAmB,SAAkB,YAAyB;AACrE,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAEnF,MAAI,kBAAkB,eAAe;AACnC,WAAO,GAAG,cAAc,MAAM,aAAa;AAAA,EAC7C;AAEA,SAAO,WAAW;AACpB;AAKA,SAAS,YAAY,SAAsC;AACzD,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,kBAAkB;AAC7D,MAAI,gBAAgB;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,WAAW;AAC/C,MAAI,SAAS;AACX,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,MAAI,eAAe;AAEjB,WAAO,cAAc,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAAA,EAC3C;AAEA,SAAO;AACT;AAyBA,eAAsB,sBAAsB,SAAkB,SAAsD;AAClH,QAAM,YAAY,qBAAqB,SAAS,aAAa,kBAAkB;AAC/E,QAAM,iBACJ,SAAS,mBAAmB,OAAO,YAAY,cAAc,QAAQ,KAAK,wBAAwB;AACpG,QAAM,YAAY,SAAS,cAAc,OAAO,YAAY,cAAc,QAAQ,KAAK,mBAAmB;AAG1G,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,cAAc,WAAW,aAAa,aAAa,WAAW,SAAS,WAAW,YAAY,GAAG;AACvG,MAAI,CAAC,aAAa;AAChB,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,WAAW,QAAQ,gCAAgC,SAAS;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AAKA,QAAM,cAAc,0BAA0B,cAAc;AAC5D,QAAM,WAAW,IAAI,IAAI,WAAW,EAAE;AACtC,QAAM,aAAa,WAAW,SAAS,MAAM,UAAU,MAAM,KAAK;AAClE,QAAM,YAAY,IAAI,IAAI,GAAG,WAAW,GAAG,UAAU,EAAE;AACvD,YAAU,SAAS,WAAW;AAE9B,MAAI,UAAU,SAAS,UAAU;AAC/B,WAAO,oBAAoB,wBAAwB,oDAAoD,GAAG;AAAA,EAC5G;AAGA,QAAM,UAAU,IAAI,QAAQ;AAI5B,QAAM,kBAAkB,0BAA0B,QAAQ,OAAO;AACjE,UAAQ,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACtC,UAAM,QAAQ,IAAI,YAAY;AAC9B,QAAI,CAAC,mBAAmB,IAAI,KAAK,KAAK,CAAC,gBAAgB,IAAI,KAAK,GAAG;AACjE,cAAQ,IAAI,KAAK,KAAK;AAAA,IACxB;AAAA,EACF,CAAC;AAKD,QAAM,eAAe,mBAAmB,SAAS,UAAU;AAC3D,QAAM,WAAW,GAAG,YAAY,GAAG,SAAS;AAC5C,UAAQ,IAAI,mBAAmB,QAAQ;AACvC,UAAQ,IAAI,oBAAoB,SAAS;AAGzC,UAAQ,IAAI,QAAQ,QAAQ;AAK5B,UAAQ,IAAI,mBAAmB,UAAU;AAIzC,MAAI,CAAC,QAAQ,IAAI,kBAAkB,GAAG;AACpC,YAAQ,IAAI,oBAAoB,WAAW,IAAI;AAAA,EACjD;AACA,MAAI,CAAC,QAAQ,IAAI,mBAAmB,GAAG;AACrC,YAAQ,IAAI,qBAAqB,WAAW,SAAS,QAAQ,KAAK,EAAE,CAAC;AAAA,EACvE;AAKA,QAAM,WAAW,YAAY,OAAO;AACpC,MAAI,UAAU;AACZ,YAAQ,IAAI,mBAAmB,QAAQ;AAAA,EACzC;AAGA,QAAM,UAAU,QAAQ,SAAS;AAEjC,MAAI;AAGF,UAAM,eAA4B;AAAA,MAChC,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,UAAU;AAAA,MACV,QAAQ,QAAQ;AAAA,IAClB;AAGA,QAAI,SAAS;AAEX,mBAAa,SAAS;AACtB,mBAAa,OAAO,QAAQ;AAAA,IAC9B;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU,SAAS,GAAG,YAAY;AAI/D,UAAM,0BAA0B,0BAA0B,SAAS,OAAO;AAC1E,UAAM,kBAAkB,IAAI,QAAQ;AACpC,aAAS,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACvC,YAAM,QAAQ,IAAI,YAAY;AAC9B,UACE,CAAC,mBAAmB,IAAI,KAAK,KAC7B,CAAC,0BAA0B,IAAI,KAAK,KACpC,CAAC,wBAAwB,IAAI,KAAK,GAClC;AACA,YAAI,UAAU,cAAc;AAC1B,0BAAgB,OAAO,KAAK,KAAK;AAAA,QACnC,OAAO;AACL,0BAAgB,IAAI,KAAK,KAAK;AAAA,QAChC;AAAA,MACF;AAAA,IACF,CAAC;AAGD,UAAM,iBAAiB,SAAS,QAAQ,IAAI,UAAU;AACtD,QAAI,gBAAgB;AAClB,UAAI;AACF,cAAM,cAAc,IAAI,IAAI,gBAAgB,WAAW;AAEvD,YAAI,YAAY,SAAS,UAAU;AAEjC,gBAAM,oBAAoB,GAAG,QAAQ,GAAG,YAAY,QAAQ,GAAG,YAAY,MAAM,GAAG,YAAY,IAAI;AACpG,0BAAgB,IAAI,YAAY,iBAAiB;AAAA,QACnD;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,gBAAgB,IAAI,SAAS,SAAS,MAAM;AAAA,MAChD,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAKD,eAAW,UAAU,2BAA2B;AAC9C,oBAAc,QAAQ,OAAO,MAAM;AAAA,IACrC;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,oBAAoB,wBAAwB,0CAA0C,OAAO,IAAI,GAAG;AAAA,EAC7G;AACF;","names":["DEFAULT_PROXY_PATH"]}

package/node_modules/@clerk/backend/dist/runtime.d.ts

@@ -1,26 +0,0 @@
-/**
- * This file exports APIs that vary across runtimes (i.e. Node & Browser - V8 isolates)
- * as a singleton object.
- *
- * Runtime polyfills are written in VanillaJS for now to avoid TS complication. Moreover,
- * due to this issue https://github.com/microsoft/TypeScript/issues/44848, there is not a good way
- * to tell Typescript which conditional import to use during build type.
- *
- * The Runtime type definition ensures type safety for now.
- * Runtime js modules are copied into dist folder with bash script.
- *
- * TODO: Support TS runtime modules
- */
-type Runtime = {
-    crypto: Crypto;
-    fetch: typeof globalThis.fetch;
-    AbortController: typeof globalThis.AbortController;
-    Blob: typeof globalThis.Blob;
-    FormData: typeof globalThis.FormData;
-    Headers: typeof globalThis.Headers;
-    Request: typeof globalThis.Request;
-    Response: typeof globalThis.Response;
-};
-export declare const runtime: Runtime;
-export {};
-//# sourceMappingURL=runtime.d.ts.map

package/node_modules/@clerk/backend/dist/runtime.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,KAAK,OAAO,GAAG;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,eAAe,EAAE,OAAO,UAAU,CAAC,eAAe,CAAC;IACnD,IAAI,EAAE,OAAO,UAAU,CAAC,IAAI,CAAC;IAC7B,QAAQ,EAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;IACrC,OAAO,EAAE,OAAO,UAAU,CAAC,OAAO,CAAC;IACnC,OAAO,EAAE,OAAO,UAAU,CAAC,OAAO,CAAC;IACnC,QAAQ,EAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;CACtC,CAAC;AAUF,eAAO,MAAM,OAAO,EAAE,OAYrB,CAAC"}