@growth-labs/auth 0.10.0 → 0.10.2

package/dist/utils/openauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAOtD,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY7E;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB/D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAGlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAG9D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAG5C;AAYD,wBAAsB,YAAY,CACjC,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,GAClD,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAmDrC;AAED,wBAAsB,WAAW,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf"}
+{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EACN,KAAK,+BAA+B,EAGpC,MAAM,oBAAoB,CAAA;AAM3B,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY7E;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB/D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAGlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAG9D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAG5C;AAgBD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;CAC9C;AAID,eAAO,MAAM,uBAAuB,EAAE,qBAGpC,CAAA;AAEF,wBAAsB,YAAY,CACjC,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,EACpD,OAAO,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,mBAAmB,GAAG,qBAAqB,GAAG,IAAI,CAAC,CAsD7D;AAED,wBAAsB,WAAW,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/utils/openauth.js

@@ -1,5 +1,5 @@
 import { getConfig } from '../config-store.js';
-import { createClientSecretBasicAuthHeader, resolveClientSecret } from './client-secret.js';
+import { createClientSecretBasicAuthHeader, resolveClientSecret, } from './client-secret.js';
 import { resolveInternalIssuer } from './issuer.js';
 import { generatePKCE } from './pkce.js';
 import { generateState } from './state.js';
@@ -58,17 +58,26 @@ function tokenResponseHasTokens(data) {
     return (typeof data.access_token === 'string' &&
         typeof data.refresh_token === 'string');
 }
-export async function exchangeCode(callbackUrl, code, codeVerifier, providerFromCookie) {
+// Backward-compatible exported sentinel for callers that only need a bounded
+// representative failure. Runtime exchangeCode results carry the actual code.
+export const EXCHANGE_SECRET_FAILURE = Object.freeze({
+    secretFailed: true,
+    code: 'BINDING_REJECTED',
+});
+export async function exchangeCode(callbackUrl, code, codeVerifier, providerFromCookie, request) {
     const options = getConfig();
     const issuer = resolveInternalIssuer(options);
     const clientId = options.clientId || callbackUrl.hostname;
     const redirectUri = new URL(options.callbackPath, callbackUrl.origin).toString();
-    const clientSecret = await resolveClientSecret(options.clientSecret);
+    const secretResult = await resolveClientSecret(options.clientSecret, request);
+    if (!secretResult.ok) {
+        return Object.freeze({ secretFailed: true, code: secretResult.code });
+    }
     const headers = {
         'Content-Type': 'application/x-www-form-urlencoded',
     };
-    if (clientSecret) {
-        headers.Authorization = createClientSecretBasicAuthHeader(clientId, clientSecret);
+    if (secretResult.secret) {
+        headers.Authorization = createClientSecretBasicAuthHeader(clientId, secretResult.secret);
     }
     const body = new URLSearchParams({
         grant_type: 'authorization_code',

package/dist/utils/openauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAU3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,OAAO;QACN,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,cAAc,MAAM,EAAE;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAA;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,qBAAqB,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAsB;IACrD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,uBAAuB,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,kBAAkB,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,iBAAiB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAC9B,IAAa;IAEb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,OAAO,CACN,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ;QACrE,OAAQ,IAAoC,CAAC,aAAa,KAAK,QAAQ,CACvE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,WAAgB,EAChB,IAAY,EACZ,YAAoB,EACpB,kBAAoD;IAEpD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAChF,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACpE,MAAM,OAAO,GAA2B;QACvC,cAAc,EAAE,mCAAmC;KACnD,CAAA;IACD,IAAI,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAE9C,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/F,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,kBAAkB,IAAI,SAAS;YACzC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,YAAoB,EACpB,QAAiB,EACjB,YAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAA;IAC/F,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,GAAG,MAAM,SAAS,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,eAAe;gBAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC"}
+{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAEN,iCAAiC,EACjC,mBAAmB,GACnB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAU3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,OAAO;QACN,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,cAAc,MAAM,EAAE;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAA;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,qBAAqB,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAsB;IACrD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,uBAAuB,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,kBAAkB,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,iBAAiB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAC9B,IAAa;IAEb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,OAAO,CACN,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ;QACrE,OAAQ,IAAoC,CAAC,aAAa,KAAK,QAAQ,CACvE,CAAA;AACF,CAAC;AAWD,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAA0B,MAAM,CAAC,MAAM,CAAC;IAC3E,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,kBAAkB;CACxB,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,WAAgB,EAChB,IAAY,EACZ,YAAoB,EACpB,kBAAoD,EACpD,OAAiB;IAEjB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAChF,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAC7E,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAa,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,OAAO,GAA2B;QACvC,cAAc,EAAE,mCAAmC;KACnD,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAE9C,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/F,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,kBAAkB,IAAI,SAAS;YACzC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,YAAoB,EACpB,QAAiB,EACjB,YAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAA;IAC/F,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,GAAG,MAAM,SAAS,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,eAAe;gBAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/auth",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -57,7 +57,7 @@
     "typescript": "^5.8.0",
     "vite": "^7.3.5",
     "vitest": "^4.1.8",
-    "@growth-labs/analytics": "0.14.6"
+    "@growth-labs/analytics": "0.14.7"
   },
   "scripts": {
     "build": "tsc",

package/src/config-store.ts

@@ -1,4 +1,5 @@
 import type { ResolvedAuthOptions } from './options.js'
+import { rehydrateClientSecretLiteral } from './utils/client-secret-literal.js'
 import { isEnvMarker, resolveEnvMarker } from './utils/env-marker.js'
 
 let _config: ResolvedAuthOptions | null = null
@@ -13,7 +14,7 @@ export function getConfig(): ResolvedAuthOptions {
 			__GL_AUTH_CONFIG__?: ResolvedAuthOptions
 		}
 	).__GL_AUTH_CONFIG__
-	const base = runtimeConfig ?? _config
+	const base = runtimeConfig ? rehydrateRuntimeConfig(runtimeConfig) : _config
 	if (!base) {
 		throw new Error(
 			'@growth-labs/auth: integration not configured. Add auth() to your astro.config.mjs integrations array.',
@@ -22,6 +23,17 @@ export function getConfig(): ResolvedAuthOptions {
 	return resolveEnvMarkers(base)
 }
 
+function rehydrateRuntimeConfig(base: ResolvedAuthOptions): ResolvedAuthOptions {
+	// The Vite global is emitted only after authOptionsSchema accepts a
+	// WeakSet-issued literal at build time. Treat the structural wire shape as
+	// transport encoding here, then re-issue the runtime object; the resolver
+	// itself never trusts the structural marker.
+	const clientSecret = rehydrateClientSecretLiteral(base.clientSecret)
+	return clientSecret === base.clientSecret
+		? base
+		: ({ ...base, clientSecret } as ResolvedAuthOptions)
+}
+
 /**
  * Resolves any `"env:VAR_NAME"` markers on auth-tuple fields against the
  * runtime env stashed by `src/runtime-bridge.ts`. The bridge is loaded

package/src/index.ts

@@ -2,6 +2,10 @@ import { _setConfig } from './config-store.js'
 import type { AuthOptions } from './options.js'
 import { authOptionsSchema } from './options.js'
 import type { AuthRenderers } from './types.js'
+import {
+	isClientSecretLiteral,
+	serializeClientSecretLiteral,
+} from './utils/client-secret-literal.js'
 
 interface AstroIntegration {
 	name: string
@@ -72,7 +76,13 @@ function isValidRendererSpec(value: unknown): value is { module: string; export:
 export default function auth(userOptions: AuthOptions): AstroIntegration {
 	const options = authOptionsSchema.parse(userOptions)
 	_setConfig(options)
-	const serializableOptions = { ...options, renderers: {} }
+	const serializableOptions = {
+		...options,
+		clientSecret: isClientSecretLiteral(options.clientSecret)
+			? serializeClientSecretLiteral(options.clientSecret)
+			: options.clientSecret,
+		renderers: {},
+	}
 
 	return {
 		name: '@growth-labs/auth',

package/src/middleware/auth.ts

@@ -3,6 +3,7 @@ import '../runtime-bridge.js'
 import type { User } from '../types.js'
 import { resolveClientSecret } from '../utils/client-secret.js'
 import { getCookie, setTokenCookies } from '../utils/cookies.js'
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
 import { resolveInternalIssuer } from '../utils/issuer.js'
 import { refreshTokens, verifyAccessToken } from '../utils/tokens.js'
 
@@ -21,6 +22,27 @@ export async function onRequest(
 	// 2. Attempt to authenticate
 	let user: User | null = null
 	let refreshed: Awaited<ReturnType<typeof refreshTokens>> = null
+	let resolvedClientSecret: string | undefined
+
+	// A request carrying a refresh token can enter the confidential-client
+	// refresh path if access-token verification fails. Resolve that request's
+	// configured secret before verification so a cold JWKS lookup can never
+	// precede discovery of a broken binding. The module-private Request-keyed
+	// resolver cache makes this the single read, and the exact bytes are reused
+	// below. A refresh token explicitly opts the request into this fail-closed
+	// confidential-session invariant even when its access token would verify;
+	// an access-token-only request never needs or reads the client secret.
+	if (refreshToken && options.clientSecret !== undefined) {
+		const secretResult = await resolveClientSecret(options.clientSecret, request)
+		if (!secretResult.ok) {
+			context.locals.user = null
+			return secretResolutionFailureResponse(request, {
+				surface: 'middleware_refresh',
+				code: secretResult.code,
+			})
+		}
+		resolvedClientSecret = secretResult.secret ?? undefined
+	}
 
 	if (accessToken) {
 		const verified = await verifyAccessToken(issuer, accessToken, { audience: options.resource })
@@ -39,8 +61,13 @@ export async function onRequest(
 
 	if (!user && refreshToken) {
 		const clientId = options.clientId || context.url.hostname
-		const clientSecret = await resolveClientSecret(options.clientSecret)
-		refreshed = await refreshTokens(issuer, refreshToken, clientId, clientSecret, options.resource)
+		refreshed = await refreshTokens(
+			issuer,
+			refreshToken,
+			clientId,
+			resolvedClientSecret,
+			options.resource,
+		)
 		if (refreshed) {
 			user = {
 				id: refreshed.claims.sub,
@@ -66,7 +93,7 @@ export async function onRequest(
 	// 5. Continue to the page
 	const response = await next()
 
-	// 6. If tokens were refreshed or response must be modified, clone and apply changes
+	// 6. If tokens were refreshed or the response must carry no-store, clone and apply.
 	if (refreshed || context.locals.synthetic === true) {
 		const modifiedResponse = new Response(response.body, {
 			status: response.status,

package/src/options.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod'
 import type { AuthRenderers } from './types.js'
+import type { ClientSecretLiteral } from './utils/client-secret-literal.js'
+import { isClientSecretLiteral } from './utils/client-secret-literal.js'
 
 // String accepted as either a literal URL or an "env:VAR_NAME" marker that
 // gets resolved against the Worker runtime env at request time. See
@@ -27,7 +29,20 @@ export const authOptionsSchema = z.object({
 
 	// ─── Client identity ───
 	clientId: stringOrEnvMarker.optional(),
-	clientSecret: z.string().optional(),
+	// clientSecret accepts either a binding name (string resolved at request time
+	// against the Worker runtime env) or an explicit literalClientSecret() value
+	// (local-dev only; embedded in the serialized config). A bare string is
+	// always treated as a binding name — fail closed when the binding is absent.
+	// An empty or whitespace-only binding name is schema-rejected; it can never
+	// resolve to a usable secret and must not silently become a public client.
+	clientSecret: z
+		.union([
+			z.string().refine((v) => v.trim().length > 0, {
+				message: 'clientSecret binding name must not be empty or whitespace-only',
+			}),
+			z.custom<ClientSecretLiteral>(isClientSecretLiteral),
+		])
+		.optional(),
 	resource: urlOrEnvMarker,
 
 	// ─── Cookie configuration ───

package/src/routes/api/code-request.ts

@@ -1,5 +1,6 @@
 import {
 	authClient,
+	failClosedOnSecretResolutionFailure,
 	getConfig,
 	type RouteContext,
 	readForm,
@@ -9,6 +10,7 @@ import {
 } from './shared.js'
 
 export async function POST(context: RouteContext): Promise<Response> {
+	// Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
 	const crossSitePost = rejectCrossSitePost(context)
 	if (crossSitePost) return crossSitePost
 
@@ -17,6 +19,9 @@ export async function POST(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
+	const secretError = await failClosedOnSecretResolutionFailure(context)
+	if (secretError) return secretError
+
 	const form = await readForm(context)
 	const email = await readFormString(form, 'email')
 	const redirect = form.get('redirect')?.toString()

package/src/routes/api/code-verify.ts

@@ -1,6 +1,7 @@
 import {
 	authClient,
 	callbackRedirect,
+	failClosedOnSecretResolutionFailure,
 	getConfig,
 	type RouteContext,
 	readForm,
@@ -9,6 +10,7 @@ import {
 } from './shared.js'
 
 export async function POST(context: RouteContext): Promise<Response> {
+	// Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
 	const crossSitePost = rejectCrossSitePost(context)
 	if (crossSitePost) return crossSitePost
 
@@ -17,6 +19,9 @@ export async function POST(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
+	const secretError = await failClosedOnSecretResolutionFailure(context)
+	if (secretError) return secretError
+
 	const form = await readForm(context)
 	const email = await readFormString(form, 'email')
 	const code = await readFormString(form, 'code')

package/src/routes/api/password-reset-confirm.ts

@@ -1,5 +1,6 @@
 import {
 	authClient,
+	failClosedOnSecretResolutionFailure,
 	getConfig,
 	type RouteContext,
 	readForm,
@@ -9,6 +10,7 @@ import {
 } from './shared.js'
 
 export async function POST(context: RouteContext): Promise<Response> {
+	// Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
 	const crossSitePost = rejectCrossSitePost(context)
 	if (crossSitePost) return crossSitePost
 
@@ -17,6 +19,9 @@ export async function POST(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
+	const secretError = await failClosedOnSecretResolutionFailure(context)
+	if (secretError) return secretError
+
 	const form = await readForm(context)
 	const token = await readFormString(form, 'token')
 	const password = await readFormString(form, 'password', { trim: false })

package/src/routes/api/password-reset-request.ts

@@ -1,5 +1,6 @@
 import {
 	authClient,
+	failClosedOnSecretResolutionFailure,
 	getConfig,
 	type RouteContext,
 	readForm,
@@ -9,6 +10,7 @@ import {
 } from './shared.js'
 
 export async function POST(context: RouteContext): Promise<Response> {
+	// Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
 	const crossSitePost = rejectCrossSitePost(context)
 	if (crossSitePost) return crossSitePost
 
@@ -17,6 +19,9 @@ export async function POST(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
+	const secretError = await failClosedOnSecretResolutionFailure(context)
+	if (secretError) return secretError
+
 	const form = await readForm(context)
 	const email = await readFormString(form, 'email')
 	const result = await authClient(context).password.reset.request({ email })

package/src/routes/api/password-verify.ts

@@ -1,6 +1,7 @@
 import {
 	authClient,
 	callbackRedirect,
+	failClosedOnSecretResolutionFailure,
 	getConfig,
 	type RouteContext,
 	readForm,
@@ -9,6 +10,7 @@ import {
 } from './shared.js'
 
 export async function POST(context: RouteContext): Promise<Response> {
+	// Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
 	const crossSitePost = rejectCrossSitePost(context)
 	if (crossSitePost) return crossSitePost
 
@@ -17,6 +19,9 @@ export async function POST(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
+	const secretError = await failClosedOnSecretResolutionFailure(context)
+	if (secretError) return secretError
+
 	const form = await readForm(context)
 	const email = await readFormString(form, 'email')
 	const password = await readFormString(form, 'password', { trim: false })

package/src/routes/api/shared.ts

@@ -7,6 +7,7 @@ import {
 	emitAuthFailureEvent,
 	emitAuthSuccessEvent,
 } from '../../utils/analytics.js'
+import { resolveClientSecret } from '../../utils/client-secret.js'
 import {
 	clearAuthFlowCookies,
 	getCookie,
@@ -14,6 +15,7 @@ import {
 	setIdentityCookie,
 	setTokenCookies,
 } from '../../utils/cookies.js'
+import { secretResolutionFailureResponse } from '../../utils/fail-closed.js'
 import { canonicalIdentitySubject } from '../../utils/identity.js'
 import { createIdentityCookiePayload, signIdentityCookie } from '../../utils/identity-cookie.js'
 import { exchangeCode } from '../../utils/openauth.js'
@@ -133,6 +135,22 @@ function routeResult(
 	})
 }
 
+// Returns a 503 fail-closed response when the configured clientSecret binding
+// cannot be resolved; null when resolution succeeds or no secret is configured.
+// Call this before any authClient() call to guarantee zero issuer fetch on failure.
+export async function failClosedOnSecretResolutionFailure(
+	context: RouteContext,
+): Promise<Response | null> {
+	const options = getConfig()
+	if (options.clientSecret === undefined) return null
+	const secretResult = await resolveClientSecret(options.clientSecret, context.request)
+	if (secretResult.ok) return null
+	return secretResolutionFailureResponse(context.request, {
+		surface: 'route_preflight',
+		code: secretResult.code,
+	})
+}
+
 export type { RouteContext }
 export { authClient, getConfig, readForm, redirectTo }
 
@@ -163,11 +181,24 @@ async function completeJsonAuth(
 		)
 	}
 
-	const tokenResponse = await exchangeCode(context.url, code, codeVerifier, provider)
-	if (!tokenResponse) {
+	const exchangeResult = await exchangeCode(
+		context.url,
+		code,
+		codeVerifier,
+		provider,
+		context.request,
+	)
+	if (exchangeResult !== null && 'secretFailed' in exchangeResult) {
+		return secretResolutionFailureResponse(context.request, {
+			surface: 'route_exchange',
+			code: exchangeResult.code,
+		})
+	}
+	if (!exchangeResult) {
 		queueAuthFailure(context, provider, 'token_exchange_failed')
 		return routeResult(context, errorPath, { ...errorParams, error: 'auth_failed' }, 'auth_failed')
 	}
+	const tokenResponse = exchangeResult
 
 	const redirectPath = getCookie(context.request, `${options.cookiePrefix}_redirect`) || '/'
 	const redirect = new URL(redirectPath, context.url.origin).toString()

package/src/routes/callback.ts

@@ -11,6 +11,7 @@ import {
 	setIdentityCookie,
 	setTokenCookies,
 } from '../utils/cookies.js'
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
 import { canonicalIdentitySubject } from '../utils/identity.js'
 import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js'
 import { exchangeCode } from '../utils/openauth.js'
@@ -106,18 +107,27 @@ export async function GET(context: CallbackContext): Promise<Response> {
 	}
 
 	// Exchange code for tokens
-	const tokenResponse = await exchangeCode(
+	const exchangeResult = await exchangeCode(
 		url,
 		code,
 		codeVerifier,
 		provider === 'google' || provider === 'password' || provider === 'email-code'
 			? provider
 			: undefined,
+		request,
 	)
-	if (!tokenResponse) {
+	// Typed distinction: secret binding failure → fail closed; other failure → auth_failed.
+	if (exchangeResult !== null && 'secretFailed' in exchangeResult) {
+		return secretResolutionFailureResponse(request, {
+			surface: 'callback_exchange',
+			code: exchangeResult.code,
+		})
+	}
+	if (!exchangeResult) {
 		queueAuthFailure(context, provider, 'token_exchange_failed')
 		return loginErrorResponse(request, url.origin, options.loginPath)
 	}
+	const tokenResponse = exchangeResult
 
 	// Build redirect response
 	const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/'

package/src/routes/logout.ts

@@ -1,5 +1,6 @@
 import { getConfig } from '../config-store.js'
 import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js'
+import type { ClientSecretResolutionErrorCode } from '../utils/client-secret.js'
 import { resolveClientSecret } from '../utils/client-secret.js'
 import {
 	clearAuthFlowCookies,
@@ -7,6 +8,7 @@ import {
 	clearTokenCookies,
 	getCookie,
 } from '../utils/cookies.js'
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
 import { revokeToken } from '../utils/openauth.js'
 import { resolveWaitUntil } from '../utils/wait-until.js'
 
@@ -26,13 +28,27 @@ export async function GET(context: LogoutContext): Promise<Response> {
 	const clientId = options.clientId || context.url.hostname
 	const waitUntil = resolveWaitUntil(context)
 
-	// Revoke at issuer (non-blocking)
+	// Revoke at issuer (non-blocking).
+	// Public clients (no clientSecret configured) always attempt revocation.
+	// Confidential clients only attempt revocation when the secret resolves successfully;
+	// a binding failure skips revocation rather than sending unauthenticated requests
+	// to a confidential-client issuer endpoint.
+	let secretFailureCode: ClientSecretResolutionErrorCode | null = null
 	if (refreshToken) {
-		const clientSecret = await resolveClientSecret(options.clientSecret)
-		const promise = clientSecret
-			? revokeToken(refreshToken, clientId, clientSecret)
-			: revokeToken(refreshToken, clientId)
-		waitUntil(promise)
+		if (options.clientSecret === undefined) {
+			waitUntil(revokeToken(refreshToken, clientId))
+		} else {
+			const secretResult = await resolveClientSecret(options.clientSecret, context.request)
+			if (secretResult.ok) {
+				const secret = secretResult.secret ?? undefined
+				const promise = secret
+					? revokeToken(refreshToken, clientId, secret)
+					: revokeToken(refreshToken, clientId)
+				waitUntil(promise)
+			} else {
+				secretFailureCode = secretResult.code
+			}
+		}
 	}
 
 	// Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
@@ -45,6 +61,19 @@ export async function GET(context: LogoutContext): Promise<Response> {
 		waitUntil(promise)
 	}
 
+	if (secretFailureCode) {
+		// Fail closed: clear all local cookies but return a fixed 503 instead of
+		// an ordinary redirect. Revocation was already skipped above.
+		const failResponse = secretResolutionFailureResponse(context.request, {
+			surface: 'logout_revocation',
+			code: secretFailureCode,
+		})
+		clearTokenCookies(failResponse, options)
+		clearIdentityCookie(failResponse)
+		clearAuthFlowCookies(failResponse, options)
+		return failResponse
+	}
+
 	// Build redirect response
 	const redirectUrl = new URL(options.logoutRedirect, context.url.origin).toString()
 	const response = Response.redirect(redirectUrl, 302)

package/src/server.ts

@@ -2,9 +2,15 @@ import { getConfig } from './config-store.js'
 import type { ResolvedAuthOptions } from './options.js'
 import { createClientSecretBasicAuthHeader, resolveClientSecret } from './utils/client-secret.js'
 import { getCookie } from './utils/cookies.js'
+import {
+	ClientSecretResolutionError,
+	reportClientSecretResolutionFailure,
+} from './utils/fail-closed.js'
 import { resolveInternalIssuer } from './utils/issuer.js'
 import { createPKCEChallenge } from './utils/pkce.js'
 
+export { ClientSecretResolutionError }
+
 export type AuthClientCodeResult = { code: string } | { error: string }
 export type AuthClientOkResult = { ok: true } | { error: string }
 
@@ -69,9 +75,13 @@ async function headersFor(
 	context: AuthClientContext,
 ): Promise<Record<string, string>> {
 	const headers: Record<string, string> = { 'Content-Type': 'application/json' }
-	const secret = await resolveClientSecret(options.clientSecret)
-	if (secret) {
-		headers.Authorization = createClientSecretBasicAuthHeader(clientId(options, context), secret)
+	const secretResult = await resolveClientSecret(options.clientSecret, context.request)
+	if (!secretResult.ok) throw new ClientSecretResolutionError(secretResult.code)
+	if (secretResult.secret) {
+		headers.Authorization = createClientSecretBasicAuthHeader(
+			clientId(options, context),
+			secretResult.secret,
+		)
 	}
 	return headers
 }
@@ -116,7 +126,14 @@ async function postJson<T extends AuthClientCodeResult | AuthClientOkResult>(
 			return { ok: true } as T
 		}
 		return { error: 'invalid_response' } as T
-	} catch {
+	} catch (err) {
+		if (err instanceof ClientSecretResolutionError) {
+			reportClientSecretResolutionFailure({
+				surface: 'server_auth_client',
+				code: err.code,
+			})
+			return { error: 'auth_service_unavailable' } as T
+		}
 		return { error: 'request_failed' } as T
 	}
 }

package/src/utils/client-secret-literal.ts

@@ -0,0 +1,71 @@
+// Explicit local-dev literal type and predicate. Intentionally no runtime
+// imports — this file is reachable from options.ts (the package main entry
+// static-import chain) so it must not pull in cloudflare:workers.
+// Resolution logic that requires the runtime lives in client-secret.ts.
+export interface ClientSecretLiteral {
+	readonly __clientSecretLiteral: true
+	readonly value: string
+}
+
+export interface SerializedClientSecretLiteral {
+	readonly __growthLabsAuthClientSecretLiteral: 1
+	readonly value: string
+}
+
+const issuedClientSecretLiterals = new WeakSet<ClientSecretLiteral>()
+
+export function literalClientSecret(value: string): ClientSecretLiteral {
+	const literal = Object.freeze({ __clientSecretLiteral: true as const, value })
+	issuedClientSecretLiterals.add(literal)
+	return literal
+}
+
+export function isClientSecretLiteral(v: unknown): v is ClientSecretLiteral {
+	return (
+		typeof v === 'object' &&
+		v !== null &&
+		issuedClientSecretLiterals.has(v as ClientSecretLiteral) &&
+		(v as Record<string, unknown>).__clientSecretLiteral === true &&
+		typeof (v as Record<string, unknown>).value === 'string'
+	)
+}
+
+// Only the integration calls this after authOptionsSchema has accepted a
+// WeakSet-issued literal. The distinct wire marker is never accepted directly
+// by resolveClientSecret; config-store must rehydrate it into a newly issued
+// literal after Vite's JSON serialization boundary.
+export function serializeClientSecretLiteral(
+	literal: ClientSecretLiteral,
+): SerializedClientSecretLiteral {
+	if (!isClientSecretLiteral(literal)) {
+		throw new TypeError('client secret literal was not issued by literalClientSecret()')
+	}
+	return Object.freeze({
+		__growthLabsAuthClientSecretLiteral: 1 as const,
+		value: literal.value,
+	})
+}
+
+export function rehydrateClientSecretLiteral(value: unknown): unknown {
+	if (typeof value !== 'object' || value === null || Array.isArray(value)) return value
+	const prototype = Object.getPrototypeOf(value)
+	if (prototype !== Object.prototype && prototype !== null) return value
+	const descriptors = Object.getOwnPropertyDescriptors(value)
+	const keys = Object.keys(descriptors)
+	const marker = descriptors.__growthLabsAuthClientSecretLiteral
+	const literalValue = descriptors.value
+	if (
+		keys.length !== 2 ||
+		!keys.includes('__growthLabsAuthClientSecretLiteral') ||
+		!keys.includes('value') ||
+		!marker ||
+		!('value' in marker) ||
+		marker.value !== 1 ||
+		!literalValue ||
+		!('value' in literalValue) ||
+		typeof literalValue.value !== 'string'
+	) {
+		return value
+	}
+	return literalClientSecret(literalValue.value)
+}