@growth-labs/auth 0.10.0 → 0.10.2

package/dist/routes/callback.js

@@ -2,6 +2,7 @@ import { getConfig } from '../config-store.js';
 import { getRuntimeEnv } from '../runtime.js';
 import { analyticsAvailable, emitAuthFailureEvent, emitAuthSuccessEvent, } from '../utils/analytics.js';
 import { clearAuthFlowCookies, getCookie, setIdentityCookie, setTokenCookies, } from '../utils/cookies.js';
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js';
 import { canonicalIdentitySubject } from '../utils/identity.js';
 import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js';
 import { exchangeCode } from '../utils/openauth.js';
@@ -63,13 +64,21 @@ export async function GET(context) {
         return loginErrorResponse(request, url.origin, options.loginPath);
     }
     // Exchange code for tokens
-    const tokenResponse = await exchangeCode(url, code, codeVerifier, provider === 'google' || provider === 'password' || provider === 'email-code'
+    const exchangeResult = await exchangeCode(url, code, codeVerifier, provider === 'google' || provider === 'password' || provider === 'email-code'
         ? provider
-        : undefined);
-    if (!tokenResponse) {
+        : undefined, request);
+    // Typed distinction: secret binding failure → fail closed; other failure → auth_failed.
+    if (exchangeResult !== null && 'secretFailed' in exchangeResult) {
+        return secretResolutionFailureResponse(request, {
+            surface: 'callback_exchange',
+            code: exchangeResult.code,
+        });
+    }
+    if (!exchangeResult) {
         queueAuthFailure(context, provider, 'token_exchange_failed');
         return loginErrorResponse(request, url.origin, options.loginPath);
     }
+    const tokenResponse = exchangeResult;
     // Build redirect response
     const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/';
     const redirect = new URL(redirectPath, url.origin).toString();

package/dist/routes/callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EACN,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAazD,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClD,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,MAAc,EAAE,SAAiB;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,oBAAoB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7E,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,gBAAgB,CACxB,OAAwB,EACxB,QAAuB,EACvB,MAAqB;IAErB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAM;IACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;QAC7C,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CAAA;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAA;IAExF,IAAI,KAAK,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;QACtD,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CACvC,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,YAAY;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,CACZ,CAAA;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;QAC5D,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAEnC,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC9C,kEAAkE;IAClE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,eAAe,GAAG,wBAAwB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;IAC1C,IAAI,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC;YACJ,iBAAiB,CAChB,eAAe,EACf,MAAM,kBAAkB,CACvB,MAAM,2BAA2B,CAAC,eAAe,EAAE,cAAc,CAAC,EAClE,cAAc,CACd,CACD,CAAA;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iFAAiF;QAClF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,2DAA2D;IAC3D,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;YAC7C,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,QAAQ;YACR,cAAc,EAAE,eAAe;SAC/B,CAAC,CAAA;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EACN,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAazD,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClD,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,MAAc,EAAE,SAAiB;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,oBAAoB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7E,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,gBAAgB,CACxB,OAAwB,EACxB,QAAuB,EACvB,MAAqB;IAErB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAM;IACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;QAC7C,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CAAA;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAA;IAExF,IAAI,KAAK,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;QACtD,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,2BAA2B;IAC3B,MAAM,cAAc,GAAG,MAAM,YAAY,CACxC,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,YAAY;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,EACZ,OAAO,CACP,CAAA;IACD,wFAAwF;IACxF,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,IAAI,cAAc,EAAE,CAAC;QACjE,OAAO,+BAA+B,CAAC,OAAO,EAAE;YAC/C,OAAO,EAAE,mBAAmB;YAC5B,IAAI,EAAE,cAAc,CAAC,IAAI;SACzB,CAAC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;QAC5D,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,aAAa,GAAG,cAAc,CAAA;IAEpC,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAEnC,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC9C,kEAAkE;IAClE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,eAAe,GAAG,wBAAwB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;IAC1C,IAAI,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC;YACJ,iBAAiB,CAChB,eAAe,EACf,MAAM,kBAAkB,CACvB,MAAM,2BAA2B,CAAC,eAAe,EAAE,cAAc,CAAC,EAClE,cAAc,CACd,CACD,CAAA;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iFAAiF;QAClF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,2DAA2D;IAC3D,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;YAC7C,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,QAAQ;YACR,cAAc,EAAE,eAAe;SAC/B,CAAC,CAAA;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/routes/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAYA,UAAU,aAAa;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IAIR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyCnE"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAcA,UAAU,aAAa;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IAIR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoEnE"}

package/dist/routes/logout.js

@@ -2,6 +2,7 @@ import { getConfig } from '../config-store.js';
 import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js';
 import { resolveClientSecret } from '../utils/client-secret.js';
 import { clearAuthFlowCookies, clearIdentityCookie, clearTokenCookies, getCookie, } from '../utils/cookies.js';
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js';
 import { revokeToken } from '../utils/openauth.js';
 import { resolveWaitUntil } from '../utils/wait-until.js';
 export async function GET(context) {
@@ -9,13 +10,29 @@ export async function GET(context) {
     const refreshToken = getCookie(context.request, `${options.cookiePrefix}_rt`);
     const clientId = options.clientId || context.url.hostname;
     const waitUntil = resolveWaitUntil(context);
-    // Revoke at issuer (non-blocking)
+    // Revoke at issuer (non-blocking).
+    // Public clients (no clientSecret configured) always attempt revocation.
+    // Confidential clients only attempt revocation when the secret resolves successfully;
+    // a binding failure skips revocation rather than sending unauthenticated requests
+    // to a confidential-client issuer endpoint.
+    let secretFailureCode = null;
     if (refreshToken) {
-        const clientSecret = await resolveClientSecret(options.clientSecret);
-        const promise = clientSecret
-            ? revokeToken(refreshToken, clientId, clientSecret)
-            : revokeToken(refreshToken, clientId);
-        waitUntil(promise);
+        if (options.clientSecret === undefined) {
+            waitUntil(revokeToken(refreshToken, clientId));
+        }
+        else {
+            const secretResult = await resolveClientSecret(options.clientSecret, context.request);
+            if (secretResult.ok) {
+                const secret = secretResult.secret ?? undefined;
+                const promise = secret
+                    ? revokeToken(refreshToken, clientId, secret)
+                    : revokeToken(refreshToken, clientId);
+                waitUntil(promise);
+            }
+            else {
+                secretFailureCode = secretResult.code;
+            }
+        }
     }
     // Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
     // wired. Without analytics installed this is a no-op (analyticsAvailable
@@ -26,6 +43,18 @@ export async function GET(context) {
         });
         waitUntil(promise);
     }
+    if (secretFailureCode) {
+        // Fail closed: clear all local cookies but return a fixed 503 instead of
+        // an ordinary redirect. Revocation was already skipped above.
+        const failResponse = secretResolutionFailureResponse(context.request, {
+            surface: 'logout_revocation',
+            code: secretFailureCode,
+        });
+        clearTokenCookies(failResponse, options);
+        clearIdentityCookie(failResponse);
+        clearAuthFlowCookies(failResponse, options);
+        return failResponse;
+    }
     // Build redirect response
     const redirectUrl = new URL(options.logoutRedirect, context.url.origin).toString();
     const response = Response.redirect(redirectUrl, 302);

package/dist/routes/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACT,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAYzD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAE3C,kCAAkC;IAClC,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,YAAY;YAC3B,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC;YACnD,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACtC,SAAS,CAAC,OAAO,CAAC,CAAA;IACnB,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,kBAAkB,CAAC,OAA+C,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;YACrD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACxC,CAAC,CAAA;QACF,SAAS,CAAC,OAAO,CAAC,CAAA;IACnB,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,mBAAmB,CAAC,eAAe,CAAC,CAAA;IACpC,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,OAAO,eAAe,CAAA;AACvB,CAAC"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACT,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAYzD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAE3C,mCAAmC;IACnC,yEAAyE;IACzE,sFAAsF;IACtF,kFAAkF;IAClF,4CAA4C;IAC5C,IAAI,iBAAiB,GAA2C,IAAI,CAAA;IACpE,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC/C,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;YACrF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;gBAC/C,MAAM,OAAO,GAAG,MAAM;oBACrB,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;oBAC7C,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;gBACtC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnB,CAAC;iBAAM,CAAC;gBACP,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAA;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,kBAAkB,CAAC,OAA+C,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;YACrD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACxC,CAAC,CAAA;QACF,SAAS,CAAC,OAAO,CAAC,CAAA;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,+BAA+B,CAAC,OAAO,CAAC,OAAO,EAAE;YACrE,OAAO,EAAE,mBAAmB;YAC5B,IAAI,EAAE,iBAAiB;SACvB,CAAC,CAAA;QACF,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACxC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QACjC,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC3C,OAAO,YAAY,CAAA;IACpB,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,mBAAmB,CAAC,eAAe,CAAC,CAAA;IACpC,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/server.d.ts

@@ -1,3 +1,5 @@
+import { ClientSecretResolutionError } from './utils/fail-closed.js';
+export { ClientSecretResolutionError };
 export type AuthClientCodeResult = {
     code: string;
 } | {

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjE,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE;QACT,MAAM,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACjF,KAAK,EAAE;YACN,OAAO,CAAC,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;YAC9D,OAAO,CAAC,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,WAAW,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;SACnF,CAAA;KACD,CAAA;IACD,IAAI,EAAE;QACL,OAAO,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;KAC7E,CAAA;CACD;AAgGD,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA6DjE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA,OAAO,EACN,2BAA2B,EAE3B,MAAM,wBAAwB,CAAA;AAI/B,OAAO,EAAE,2BAA2B,EAAE,CAAA;AAEtC,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjE,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE;QACT,MAAM,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACjF,KAAK,EAAE;YACN,OAAO,CAAC,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;YAC9D,OAAO,CAAC,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,WAAW,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;SACnF,CAAA;KACD,CAAA;IACD,IAAI,EAAE;QACL,OAAO,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;KAC7E,CAAA;CACD;AA2GD,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA6DjE"}

package/dist/server.js

@@ -1,8 +1,10 @@
 import { getConfig } from './config-store.js';
 import { createClientSecretBasicAuthHeader, resolveClientSecret } from './utils/client-secret.js';
 import { getCookie } from './utils/cookies.js';
+import { ClientSecretResolutionError, reportClientSecretResolutionFailure, } from './utils/fail-closed.js';
 import { resolveInternalIssuer } from './utils/issuer.js';
 import { createPKCEChallenge } from './utils/pkce.js';
+export { ClientSecretResolutionError };
 function clientId(options, context) {
     return options.clientId || context.url.hostname;
 }
@@ -26,9 +28,11 @@ async function authFlowPayload(options, context) {
 }
 async function headersFor(options, context) {
     const headers = { 'Content-Type': 'application/json' };
-    const secret = await resolveClientSecret(options.clientSecret);
-    if (secret) {
-        headers.Authorization = createClientSecretBasicAuthHeader(clientId(options, context), secret);
+    const secretResult = await resolveClientSecret(options.clientSecret, context.request);
+    if (!secretResult.ok)
+        throw new ClientSecretResolutionError(secretResult.code);
+    if (secretResult.secret) {
+        headers.Authorization = createClientSecretBasicAuthHeader(clientId(options, context), secretResult.secret);
     }
     return headers;
 }
@@ -66,7 +70,14 @@ async function postJson(options, context, pathname, body) {
         }
         return { error: 'invalid_response' };
     }
-    catch {
+    catch (err) {
+        if (err instanceof ClientSecretResolutionError) {
+            reportClientSecretResolutionFailure({
+                surface: 'server_auth_client',
+                code: err.code,
+            });
+            return { error: 'auth_service_unavailable' };
+        }
         return { error: 'request_failed' };
     }
 }

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,OAAO,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACjG,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAiCrD,SAAS,QAAQ,CAAC,OAA4B,EAAE,OAA0B;IACzE,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,OAA0B;IAC5E,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;AACpE,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,OAA4B,EAC5B,OAA0B;IAE1B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACtC,CAAC;IAED,OAAO;QACN,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QACrC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3C,cAAc,EAAE,MAAM,mBAAmB,CAAC,QAAQ,CAAC;QACnD,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAA;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,OAA4B,EAC5B,OAA0B;IAE1B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9D,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,OAA4B,EAC5B,OAA0B,EAC1B,QAAgB,EAChB,IAA6B;IAE7B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAErC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAO,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAO,CAAA;QACxC,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAO,CAAA;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAO,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAO,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAO,CAAA;IACxC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAA0B;IACpD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,OAAO;QACN,QAAQ,EAAE;YACT,KAAK,CAAC,MAAM,CAAC,KAAK;gBACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAChC,OAAO,QAAQ,CAAuB,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE;oBACvF,GAAG,IAAI;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,UAAU;iBACpB,CAAC,CAAA;YACH,CAAC;YACD,KAAK,EAAE;gBACN,OAAO,CAAC,KAAK;oBACZ,OAAO,QAAQ,CACd,OAAO,EACP,OAAO,EACP,qCAAqC,EACrC;wBACC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;wBACrC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;qBAClC,CACD,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,KAAK;oBACZ,OAAO,QAAQ,CACd,OAAO,EACP,OAAO,EACP,qCAAqC,EACrC;wBACC,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;wBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,YAAY,EAAE,KAAK,CAAC,WAAW;qBAC/B,CACD,CAAA;gBACF,CAAC;aACD;SACD;QACD,IAAI,EAAE;YACL,OAAO,CAAC,KAAK;gBACZ,OAAO,QAAQ,CAAqB,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE;oBAClF,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;iBACrC,CAAC,CAAA;YACH,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAChC,OAAO,QAAQ,CAAuB,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBACnF,GAAG,IAAI;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,MAAM;iBAChB,CAAC,CAAA;YACH,CAAC;SACD;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,OAAO,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACjG,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EACN,2BAA2B,EAC3B,mCAAmC,GACnC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,2BAA2B,EAAE,CAAA;AAiCtC,SAAS,QAAQ,CAAC,OAA4B,EAAE,OAA0B;IACzE,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,OAA0B;IAC5E,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;AACpE,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,OAA4B,EAC5B,OAA0B;IAE1B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACtC,CAAC;IAED,OAAO;QACN,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QACrC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3C,cAAc,EAAE,MAAM,mBAAmB,CAAC,QAAQ,CAAC;QACnD,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAA;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,OAA4B,EAC5B,OAA0B;IAE1B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;IAC9E,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IACrF,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,MAAM,IAAI,2BAA2B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC9E,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,aAAa,GAAG,iCAAiC,CACxD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAC1B,YAAY,CAAC,MAAM,CACnB,CAAA;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,OAA4B,EAC5B,OAA0B,EAC1B,QAAgB,EAChB,IAA6B;IAE7B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAErC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAO,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAO,CAAA;QACxC,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAO,CAAA;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAO,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAO,CAAA;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAChD,mCAAmC,CAAC;gBACnC,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAA;YACF,OAAO,EAAE,KAAK,EAAE,0BAA0B,EAAO,CAAA;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAO,CAAA;IACxC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAA0B;IACpD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,OAAO;QACN,QAAQ,EAAE;YACT,KAAK,CAAC,MAAM,CAAC,KAAK;gBACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAChC,OAAO,QAAQ,CAAuB,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE;oBACvF,GAAG,IAAI;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,UAAU;iBACpB,CAAC,CAAA;YACH,CAAC;YACD,KAAK,EAAE;gBACN,OAAO,CAAC,KAAK;oBACZ,OAAO,QAAQ,CACd,OAAO,EACP,OAAO,EACP,qCAAqC,EACrC;wBACC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;wBACrC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;qBAClC,CACD,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,KAAK;oBACZ,OAAO,QAAQ,CACd,OAAO,EACP,OAAO,EACP,qCAAqC,EACrC;wBACC,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;wBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,YAAY,EAAE,KAAK,CAAC,WAAW;qBAC/B,CACD,CAAA;gBACF,CAAC;aACD;SACD;QACD,IAAI,EAAE;YACL,OAAO,CAAC,KAAK;gBACZ,OAAO,QAAQ,CAAqB,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE;oBAClF,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;iBACrC,CAAC,CAAA;YACH,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAChC,OAAO,QAAQ,CAAuB,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBACnF,GAAG,IAAI;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,MAAM;iBAChB,CAAC,CAAA;YACH,CAAC;SACD;KACD,CAAA;AACF,CAAC"}

package/dist/utils/client-secret-literal.d.ts

@@ -0,0 +1,13 @@
+export interface ClientSecretLiteral {
+    readonly __clientSecretLiteral: true;
+    readonly value: string;
+}
+export interface SerializedClientSecretLiteral {
+    readonly __growthLabsAuthClientSecretLiteral: 1;
+    readonly value: string;
+}
+export declare function literalClientSecret(value: string): ClientSecretLiteral;
+export declare function isClientSecretLiteral(v: unknown): v is ClientSecretLiteral;
+export declare function serializeClientSecretLiteral(literal: ClientSecretLiteral): SerializedClientSecretLiteral;
+export declare function rehydrateClientSecretLiteral(value: unknown): unknown;
+//# sourceMappingURL=client-secret-literal.d.ts.map

package/dist/utils/client-secret-literal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-secret-literal.d.ts","sourceRoot":"","sources":["../../src/utils/client-secret-literal.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,mCAAmC,EAAE,CAAC,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAID,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAItE;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAMD,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,mBAAmB,GAC1B,6BAA6B,CAQ/B;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAsBpE"}

package/dist/utils/client-secret-literal.js

@@ -0,0 +1,50 @@
+const issuedClientSecretLiterals = new WeakSet();
+export function literalClientSecret(value) {
+    const literal = Object.freeze({ __clientSecretLiteral: true, value });
+    issuedClientSecretLiterals.add(literal);
+    return literal;
+}
+export function isClientSecretLiteral(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        issuedClientSecretLiterals.has(v) &&
+        v.__clientSecretLiteral === true &&
+        typeof v.value === 'string');
+}
+// Only the integration calls this after authOptionsSchema has accepted a
+// WeakSet-issued literal. The distinct wire marker is never accepted directly
+// by resolveClientSecret; config-store must rehydrate it into a newly issued
+// literal after Vite's JSON serialization boundary.
+export function serializeClientSecretLiteral(literal) {
+    if (!isClientSecretLiteral(literal)) {
+        throw new TypeError('client secret literal was not issued by literalClientSecret()');
+    }
+    return Object.freeze({
+        __growthLabsAuthClientSecretLiteral: 1,
+        value: literal.value,
+    });
+}
+export function rehydrateClientSecretLiteral(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return value;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return value;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const keys = Object.keys(descriptors);
+    const marker = descriptors.__growthLabsAuthClientSecretLiteral;
+    const literalValue = descriptors.value;
+    if (keys.length !== 2 ||
+        !keys.includes('__growthLabsAuthClientSecretLiteral') ||
+        !keys.includes('value') ||
+        !marker ||
+        !('value' in marker) ||
+        marker.value !== 1 ||
+        !literalValue ||
+        !('value' in literalValue) ||
+        typeof literalValue.value !== 'string') {
+        return value;
+    }
+    return literalClientSecret(literalValue.value);
+}
+//# sourceMappingURL=client-secret-literal.js.map

package/dist/utils/client-secret-literal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-secret-literal.js","sourceRoot":"","sources":["../../src/utils/client-secret-literal.ts"],"names":[],"mappings":"AAcA,MAAM,0BAA0B,GAAG,IAAI,OAAO,EAAuB,CAAA;AAErE,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,IAAa,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9E,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACvC,OAAO,OAAO,CAAA;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC/C,OAAO,CACN,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,0BAA0B,CAAC,GAAG,CAAC,CAAwB,CAAC;QACvD,CAA6B,CAAC,qBAAqB,KAAK,IAAI;QAC7D,OAAQ,CAA6B,CAAC,KAAK,KAAK,QAAQ,CACxD,CAAA;AACF,CAAC;AAED,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,UAAU,4BAA4B,CAC3C,OAA4B;IAE5B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,mCAAmC,EAAE,CAAU;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,mCAAmC,CAAA;IAC9D,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAA;IACtC,IACC,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QACrD,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,CAAC,MAAM;QACP,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC;QACpB,MAAM,CAAC,KAAK,KAAK,CAAC;QAClB,CAAC,YAAY;QACb,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC;QAC1B,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ,EACrC,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,OAAO,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC"}

package/dist/utils/client-secret.d.ts

@@ -1,3 +1,14 @@
-export declare function resolveClientSecret(clientSecret?: string): Promise<string | undefined>;
+import { type ClientSecretLiteral, isClientSecretLiteral, literalClientSecret } from './client-secret-literal.js';
+export type { ClientSecretLiteral };
+export { isClientSecretLiteral, literalClientSecret };
+export type ClientSecretResolutionErrorCode = 'BINDING_REJECTED' | 'BINDING_MALFORMED' | 'BINDING_EMPTY' | 'BINDING_MISSING';
+export type ClientSecretResult = {
+    ok: true;
+    secret: string | null;
+} | {
+    ok: false;
+    code: ClientSecretResolutionErrorCode;
+};
+export declare function resolveClientSecret(clientSecret: string | ClientSecretLiteral | undefined, request?: Request): Promise<ClientSecretResult>;
 export declare function createClientSecretBasicAuthHeader(clientId: string, clientSecret: string): string;
 //# sourceMappingURL=client-secret.d.ts.map

package/dist/utils/client-secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-secret.d.ts","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AAMA,wBAAsB,mBAAmB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAa5F;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhG"}
+{"version":3,"file":"client-secret.d.ts","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,MAAM,4BAA4B,CAAA;AAEnC,YAAY,EAAE,mBAAmB,EAAE,CAAA;AACnC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAA;AAErD,MAAM,MAAM,+BAA+B,GACxC,kBAAkB,GAClB,mBAAmB,GACnB,eAAe,GACf,iBAAiB,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,+BAA+B,CAAA;CAAE,CAAA;AAmFvD,wBAAsB,mBAAmB,CACxC,YAAY,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,EACtD,OAAO,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhG"}

package/dist/utils/client-secret.js

@@ -1,16 +1,115 @@
 import { getRuntimeEnv } from '../runtime.js';
-export async function resolveClientSecret(clientSecret) {
-    if (!clientSecret)
-        return undefined;
-    const runtimeValue = getRuntimeEnv()[clientSecret];
+import { isClientSecretLiteral, literalClientSecret, } from './client-secret-literal.js';
+export { isClientSecretLiteral, literalClientSecret };
+const CLIENT_SECRET_READ_TIMEOUT_MS = 5_000;
+const CLIENT_SECRET_READ_TIMEOUT = Symbol('client-secret-read-timeout');
+// Module-private request-lifetime cache. The WeakMap is keyed strictly by
+// Request; entries are naturally collectible with the Request and are never
+// attached to consumer-visible Request properties or symbols.
+const requestCache = new WeakMap();
+function getPerRequestCache(request) {
+    let cache = requestCache.get(request);
+    if (!cache) {
+        cache = new Map();
+        requestCache.set(request, cache);
+    }
+    return cache;
+}
+async function doResolve(clientSecretName) {
+    const runtimeEnv = getRuntimeEnv();
+    let hasOwnBinding;
+    try {
+        hasOwnBinding = Object.hasOwn(runtimeEnv, clientSecretName);
+    }
+    catch {
+        return { ok: false, code: 'BINDING_MALFORMED' };
+    }
+    if (!hasOwnBinding)
+        return { ok: false, code: 'BINDING_MISSING' };
+    let runtimeValue;
+    try {
+        runtimeValue = runtimeEnv[clientSecretName];
+    }
+    catch {
+        return { ok: false, code: 'BINDING_MALFORMED' };
+    }
     if (typeof runtimeValue === 'string') {
-        return runtimeValue.length > 0 ? runtimeValue : undefined;
+        // Use trim() only to detect all-whitespace emptiness; return original bytes.
+        return runtimeValue.trim().length > 0
+            ? { ok: true, secret: runtimeValue }
+            : { ok: false, code: 'BINDING_EMPTY' };
     }
-    if (isSecretsStoreBinding(runtimeValue)) {
-        const resolved = await runtimeValue.get();
-        return resolved.length > 0 ? resolved : undefined;
+    if (typeof runtimeValue === 'object' && runtimeValue !== null) {
+        let get;
+        try {
+            get = Reflect.get(runtimeValue, 'get');
+        }
+        catch {
+            return { ok: false, code: 'BINDING_MALFORMED' };
+        }
+        if (typeof get !== 'function')
+            return { ok: false, code: 'BINDING_MALFORMED' };
+        let resolved;
+        let timeoutId;
+        try {
+            const timeout = new Promise((resolve) => {
+                timeoutId = setTimeout(() => resolve(CLIENT_SECRET_READ_TIMEOUT), CLIENT_SECRET_READ_TIMEOUT_MS);
+            });
+            const read = Promise.resolve(Reflect.apply(get, runtimeValue, []));
+            resolved = await Promise.race([read, timeout]);
+        }
+        catch {
+            return { ok: false, code: 'BINDING_REJECTED' };
+        }
+        finally {
+            if (timeoutId !== undefined)
+                clearTimeout(timeoutId);
+        }
+        if (resolved === CLIENT_SECRET_READ_TIMEOUT) {
+            return { ok: false, code: 'BINDING_REJECTED' };
+        }
+        if (typeof resolved !== 'string')
+            return { ok: false, code: 'BINDING_MALFORMED' };
+        return resolved.trim().length > 0
+            ? { ok: true, secret: resolved }
+            : { ok: false, code: 'BINDING_EMPTY' };
     }
-    return clientSecret;
+    // Own binding key exists but is neither a string nor a Secrets Store binding.
+    return { ok: false, code: 'BINDING_MALFORMED' };
+}
+export async function resolveClientSecret(clientSecret, request) {
+    // undefined means no clientSecret is configured — public client
+    if (clientSecret === undefined)
+        return { ok: true, secret: null };
+    // Explicit literal: use value directly, no binding lookup, no I/O, no caching.
+    if (isClientSecretLiteral(clientSecret)) {
+        const { value } = clientSecret;
+        return value.trim().length > 0
+            ? { ok: true, secret: value }
+            : { ok: false, code: 'BINDING_EMPTY' };
+    }
+    // Runtime config is a serialization boundary. Any object that was not
+    // explicitly rehydrated into a module-issued literal is malformed config,
+    // never a value on which string methods may be invoked.
+    if (typeof clientSecret !== 'string') {
+        return { ok: false, code: 'BINDING_MALFORMED' };
+    }
+    // Empty/whitespace-only binding name is invalid configuration, not a public client.
+    if (clientSecret.trim().length === 0) {
+        return { ok: false, code: 'BINDING_EMPTY' };
+    }
+    // Non-empty string: treat as a binding name, cache per (Request, name).
+    if (request) {
+        const cache = getPerRequestCache(request);
+        let pending = cache.get(clientSecret);
+        if (!pending) {
+            pending = doResolve(clientSecret);
+            cache.set(clientSecret, pending);
+        }
+        return pending;
+    }
+    // No Request context: resolve without caching (test or internal call).
+    return doResolve(clientSecret);
 }
 export function createClientSecretBasicAuthHeader(clientId, clientSecret) {
     return `Basic ${btoa(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`;
@@ -19,9 +118,4 @@ function formEncode(value) {
     const params = new URLSearchParams({ value });
     return params.toString().slice('value='.length);
 }
-function isSecretsStoreBinding(value) {
-    return (typeof value === 'object' &&
-        value !== null &&
-        typeof value.get === 'function');
-}
 //# sourceMappingURL=client-secret.js.map

package/dist/utils/client-secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-secret.js","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAM7C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,YAAqB;IAC9D,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAA;IAEnC,MAAM,YAAY,GAAG,aAAa,EAAE,CAAC,YAAY,CAAC,CAAA;IAClD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,CAAC;IACD,IAAI,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAA;QACzC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAClD,CAAC;IAED,OAAO,YAAY,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,QAAgB,EAAE,YAAoB;IACvF,OAAO,SAAS,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC5C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA2B,CAAC,GAAG,KAAK,UAAU,CACtD,CAAA;AACF,CAAC"}
+{"version":3,"file":"client-secret.js","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAEN,qBAAqB,EACrB,mBAAmB,GACnB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAA;AAcrD,MAAM,6BAA6B,GAAG,KAAK,CAAA;AAC3C,MAAM,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAA;AAEvE,0EAA0E;AAC1E,4EAA4E;AAC5E,8DAA8D;AAC9D,MAAM,YAAY,GAAG,IAAI,OAAO,EAA4B,CAAA;AAE5D,SAAS,kBAAkB,CAAC,OAAgB;IAC3C,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAA;QACtD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,gBAAwB;IAChD,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,aAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAA;IAEjE,IAAI,YAAqB,CAAA;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;IAChD,CAAC;IAED,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,6EAA6E;QAC7E,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE;YACpC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACxC,CAAC;IAED,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC/D,IAAI,GAAY,CAAA;QAChB,IAAI,CAAC;YACJ,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QAChD,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QAE9E,IAAI,QAAiB,CAAA;QACrB,IAAI,SAAoD,CAAA;QACxD,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,IAAI,OAAO,CAAoC,CAAC,OAAO,EAAE,EAAE;gBAC1E,SAAS,GAAG,UAAU,CACrB,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,EACzC,6BAA6B,CAC7B,CAAA;YACF,CAAC,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;YAClE,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;QAC/C,CAAC;gBAAS,CAAC;YACV,IAAI,SAAS,KAAK,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,QAAQ,KAAK,0BAA0B,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QACjF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;YAChC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACxC,CAAC;IAED,8EAA8E;IAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,YAAsD,EACtD,OAAiB;IAEjB,gEAAgE;IAChE,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAEjE,+EAA+E;IAC/E,IAAI,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAA;QAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;YAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACxC,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,wDAAwD;IACxD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;IAChD,CAAC;IAED,oFAAoF;IACpF,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IAC5C,CAAC;IAED,wEAAwE;IACxE,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;YACjC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,OAAO,CAAA;IACf,CAAC;IAED,uEAAuE;IACvE,OAAO,SAAS,CAAC,YAAY,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,QAAgB,EAAE,YAAoB;IACvF,OAAO,SAAS,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAChD,CAAC"}

package/dist/utils/fail-closed.d.ts

@@ -0,0 +1,14 @@
+import type { ClientSecretResolutionErrorCode } from './client-secret.js';
+export type ClientSecretFailureSurface = 'middleware_refresh' | 'callback_exchange' | 'logout_revocation' | 'route_preflight' | 'route_exchange' | 'server_auth_client';
+export interface ClientSecretFailureSignal {
+    readonly surface: ClientSecretFailureSurface;
+    readonly code: ClientSecretResolutionErrorCode;
+}
+export declare function reportClientSecretResolutionFailure(signal: ClientSecretFailureSignal): void;
+export declare function secretResolutionFailureResponse(request?: Request, signal?: ClientSecretFailureSignal): Response;
+export declare class ClientSecretResolutionError extends Error {
+    readonly code: ClientSecretResolutionErrorCode;
+    readonly name = "ClientSecretResolutionError";
+    constructor(code: ClientSecretResolutionErrorCode);
+}
+//# sourceMappingURL=fail-closed.d.ts.map

package/dist/utils/fail-closed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail-closed.d.ts","sourceRoot":"","sources":["../../src/utils/fail-closed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAA;AAEzE,MAAM,MAAM,0BAA0B,GACnC,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,oBAAoB,CAAA;AAEvB,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;CAC9C;AAoBD,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAS3F;AAED,wBAAgB,+BAA+B,CAC9C,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,yBAAyB,GAChC,QAAQ,CAgBV;AAKD,qBAAa,2BAA4B,SAAQ,KAAK;aAEzB,IAAI,EAAE,+BAA+B;IADjE,SAAkB,IAAI,iCAAgC;gBAC1B,IAAI,EAAE,+BAA+B;CAGjE"}

package/dist/utils/fail-closed.js

@@ -0,0 +1,53 @@
+// Shared no-store headers for all secret-resolution failure responses.
+const SECURITY_HEADERS = {
+    'Cache-Control': 'private, no-store',
+    Pragma: 'no-cache',
+    Expires: '0',
+};
+function acceptsJson(request) {
+    const accept = request?.headers.get('accept') ?? '';
+    return accept
+        .split(',')
+        .some((value) => value.trim().toLowerCase().split(';')[0] === 'application/json');
+}
+// Fixed-vocabulary 503 for secret-resolution failures on all surfaces.
+// Browser callers receive bounded plain text; JSON callers receive one fixed
+// JSON error. Neither class reflects a path, provider, error code, raw error,
+// secret value, or stack. Callers must invoke this before issuer I/O.
+export function reportClientSecretResolutionFailure(signal) {
+    try {
+        console.error('[growth-labs/auth] client_secret_resolution_failed', {
+            surface: signal.surface,
+            code: signal.code,
+        });
+    }
+    catch {
+        // Observability must never replace the bounded fail-closed response.
+    }
+}
+export function secretResolutionFailureResponse(request, signal) {
+    if (signal)
+        reportClientSecretResolutionFailure(signal);
+    if (acceptsJson(request)) {
+        return Response.json({ error: 'auth_service_unavailable' }, { status: 503, headers: new Headers(SECURITY_HEADERS) });
+    }
+    return new Response('Service unavailable', {
+        status: 503,
+        headers: new Headers({
+            ...SECURITY_HEADERS,
+            'Content-Type': 'text/plain; charset=UTF-8',
+        }),
+    });
+}
+// Typed error thrown by server-helper headersFor() on secret binding failure.
+// Exported so consumers can distinguish secret-resolution failure from
+// network/credential failure in custom server-side auth flows.
+export class ClientSecretResolutionError extends Error {
+    code;
+    name = 'ClientSecretResolutionError';
+    constructor(code) {
+        super('client_secret_binding_unavailable');
+        this.code = code;
+    }
+}
+//# sourceMappingURL=fail-closed.js.map

package/dist/utils/fail-closed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail-closed.js","sourceRoot":"","sources":["../../src/utils/fail-closed.ts"],"names":[],"mappings":"AAeA,uEAAuE;AACvE,MAAM,gBAAgB,GAA2B;IAChD,eAAe,EAAE,mBAAmB;IACpC,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,GAAG;CACZ,CAAA;AAED,SAAS,WAAW,CAAC,OAA4B;IAChD,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,uEAAuE;AACvE,6EAA6E;AAC7E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,UAAU,mCAAmC,CAAC,MAAiC;IACpF,IAAI,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE;YACnE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;IACtE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,OAAiB,EACjB,MAAkC;IAElC,IAAI,MAAM;QAAE,mCAAmC,CAAC,MAAM,CAAC,CAAA;IACvD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,KAAK,EAAE,0BAA0B,EAAE,EACrC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,gBAA+B,CAAC,EAAE,CACtE,CAAA;IACF,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE;QAC1C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,IAAI,OAAO,CAAC;YACpB,GAAG,gBAAgB;YACnB,cAAc,EAAE,2BAA2B;SAC3C,CAAC;KACF,CAAC,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,+DAA+D;AAC/D,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAEzB;IADV,IAAI,GAAG,6BAA6B,CAAA;IACtD,YAA4B,IAAqC;QAChE,KAAK,CAAC,mCAAmC,CAAC,CAAA;QADf,SAAI,GAAJ,IAAI,CAAiC;IAEjE,CAAC;CACD"}

package/dist/utils/index.d.ts

@@ -1,7 +1,10 @@
 export { type AuthAnalyticsProvider, type AuthFailureEventInput, type AuthSuccessEventInput, authSuccessEventName, emitAuthEvent, emitAuthFailureEvent, emitAuthSuccessEvent, normalizeAuthFailureReason, normalizeAuthProvider, trackAuthEvent, } from './analytics.js';
+export type { ClientSecretLiteral, ClientSecretResolutionErrorCode, ClientSecretResult, } from './client-secret.js';
+export { isClientSecretLiteral, literalClientSecret } from './client-secret.js';
+export { ClientSecretResolutionError } from './fail-closed.js';
 export { type BridgeMigrationOptions, type BridgeMigrationStatement, buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, canonicalIdentitySubject, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
-export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
+export { EXCHANGE_SECRET_FAILURE, type ExchangeSecretFailure, getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl, } from './openauth.js';
 export { createPKCEChallenge, generatePKCE } from './pkce.js';
 export { generateState, verifyState } from './state.js';
 export type { VerifiedClaims } from './tokens.js';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACX,mBAAmB,EACnB,+BAA+B,EAC/B,kBAAkB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EACN,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/utils/index.js

@@ -1,7 +1,9 @@
 export { authSuccessEventName, emitAuthEvent, emitAuthFailureEvent, emitAuthSuccessEvent, normalizeAuthFailureReason, normalizeAuthProvider, trackAuthEvent, } from './analytics.js';
+export { isClientSecretLiteral, literalClientSecret } from './client-secret.js';
+export { ClientSecretResolutionError } from './fail-closed.js';
 export { buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, canonicalIdentitySubject, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
-export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
+export { EXCHANGE_SECRET_FAILURE, getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl, } from './openauth.js';
 export { createPKCEChallenge, generatePKCE } from './pkce.js';
 export { generateState, verifyState } from './state.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AAMvB,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EACN,uBAAuB,EAEvB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}

package/dist/utils/openauth.d.ts

@@ -1,4 +1,5 @@
 import type { TokenExchangeResult } from '../types.js';
+import { type ClientSecretResolutionErrorCode } from './client-secret.js';
 export interface AuthFlow {
     verifier: string;
     challenge: string;
@@ -24,6 +25,11 @@ export declare function getMagicLinkUrl(_context: {
 }): string;
 export declare function getForgotPasswordUrl(): string;
 export declare function getResetPasswordUrl(): string;
-export declare function exchangeCode(callbackUrl: URL, code: string, codeVerifier: string, providerFromCookie?: TokenExchangeResult['provider']): Promise<TokenExchangeResult | null>;
+export interface ExchangeSecretFailure {
+    readonly secretFailed: true;
+    readonly code: ClientSecretResolutionErrorCode;
+}
+export declare const EXCHANGE_SECRET_FAILURE: ExchangeSecretFailure;
+export declare function exchangeCode(callbackUrl: URL, code: string, codeVerifier: string, providerFromCookie?: TokenExchangeResult['provider'], request?: Request): Promise<TokenExchangeResult | ExchangeSecretFailure | null>;
 export declare function revokeToken(refreshToken: string, clientId?: string, clientSecret?: string): Promise<void>;
 //# sourceMappingURL=openauth.d.ts.map