@growth-labs/auth 0.10.0 → 0.10.3

package/dist/utils/csp.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Self-contained Content-Security-Policy for auth renderer pages.
+ *
+ * WHY THIS EXISTS. The auth integration serves its UI surfaces (`/login`,
+ * `/verify-code`, `/password`, `/forgot-password`, `/reset-password`) from
+ * `injectRoute`-registered Astro endpoints that return a raw `Response` built
+ * from an HTML string. Astro's native hash-based `security.csp` only rewrites
+ * *component-rendered* pages — it scans the rendered document, hashes inline
+ * `<script>`/`<style>`, and injects a `<meta http-equiv>` CSP. An endpoint that
+ * returns its own `Response` bypasses that pass entirely, so on a site with an
+ * enforced `security.csp` the auth pages ship transport headers but NO CSP and
+ * their inline theme-bootstrap script is un-hashed (fulcrum-labs/warfronts
+ * verified live: `/login` 200, no `Content-Security-Policy` header or meta).
+ *
+ * This is the auth-side analogue of the `@growth-labs/consent@0.7.1`
+ * `context.csp.insertScriptHash` fix. Consent registers its banner hash and
+ * lets Astro render the CSP meta into the `.astro` page; auth has no Astro page
+ * to carry a meta, so it computes the sha256 hashes of its own inline scripts
+ * and styles and emits the `<meta http-equiv="Content-Security-Policy">` itself.
+ * Browsers combine a CSP meta with any CSP response header by intersection, so a
+ * site keeps owning the transport-header CSP (or none) while auth owns the meta
+ * on its own surfaces — exactly the model warfronts documents (CSP lives in the
+ * meta on SSR pages; the transport middleware never emits a CSP header).
+ */
+/** A sha256 CSP source expression, e.g. `sha256-<base64>`. */
+export type CspHash = `sha256-${string}`;
+/**
+ * Compute the CSP sha256 hash of an inline `<script>`/`<style>` body. Hashes the
+ * exact bytes the browser hashes — the raw text between the element's open and
+ * close tags, with no trimming — so the emitted `'sha256-…'` matches what the
+ * browser recomputes for the served content. Mirrors the consent package's
+ * `sha256CspHash` (SHA-256 → base64) so the two packages stay wire-compatible.
+ */
+export declare function sha256CspHash(content: string): Promise<CspHash>;
+/** Inner text of every inline `<script>` (no `src=`) and `<style>` element. */
+interface InlineSources {
+    scripts: string[];
+    styles: string[];
+}
+/**
+ * Extract the inner bodies of inline `<script>` and `<style>` elements. A
+ * `<script src=…>` reference has no hashable body (its bytes live at another
+ * URL, covered by `script-src 'self'`) and is skipped. Empty bodies are skipped
+ * — an empty inline script needs no hash. De-duplicates identical bodies so an
+ * element repeated on a page contributes a single hash.
+ */
+export declare function extractInlineSources(html: string): InlineSources;
+/** True when the document already carries a CSP `<meta http-equiv>` tag. */
+export declare function hasCspMeta(html: string): boolean;
+/**
+ * Build the CSP policy string for an auth page from its inline-source hashes.
+ *
+ * - `default-src 'self'` is the floor; anything not otherwise named falls here.
+ * - `script-src 'self' <hashes>` allows same-origin scripts plus the exact
+ *   inline scripts on the page. No `'unsafe-inline'`: every inline script is
+ *   hashed, so the policy stays strict.
+ * - `style-src 'self' <hashes>` does the same for inline `<style>` blocks.
+ * - `style-src-attr 'unsafe-inline'` permits inline `style="…"` attributes,
+ *   which are NOT hashable (Astro's own CSP takes the same allowance for
+ *   attribute styles). Element styles remain hash-pinned.
+ * - `img-src 'self' data: https:` covers the brand logo and inline data URIs.
+ * - `connect-src 'self'` bounds fetch/XHR (the code-request/verify POSTs are
+ *   same-origin). `form-action 'self'` bounds the login/verify form posts.
+ * - `object-src 'none'`, `base-uri 'self'`, `frame-ancestors 'none'` are the
+ *   standard hardening trio (no plugins, no base-tag hijack, no framing).
+ */
+export declare function buildAuthCspPolicy(sources: {
+    scriptHashes: CspHash[];
+    styleHashes: CspHash[];
+}): string;
+/**
+ * Compute the auth CSP for `html` and return the document with a
+ * `<meta http-equiv="Content-Security-Policy">` inserted at the top of `<head>`.
+ *
+ * Idempotent: if the document already carries a CSP meta (a consumer renderer
+ * that emits its own), the input is returned unchanged so we never emit two
+ * conflicting policies (browsers would intersect them and likely break the
+ * page). Every inline `<script>`/`<style>` the page ships is hash-pinned, so the
+ * emitted policy is strict — no `'unsafe-inline'` for scripts or element styles.
+ */
+export declare function injectAuthCsp(html: string): Promise<string>;
+export {};
+//# sourceMappingURL=csp.d.ts.map

package/dist/utils/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/utils/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,OAAO,GAAG,UAAU,MAAM,EAAE,CAAA;AAExC;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIrE;AAED,+EAA+E;AAC/E,UAAU,aAAa;IACtB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,EAAE,CAAA;CAChB;AAMD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAmBhE;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC3C,YAAY,EAAE,OAAO,EAAE,CAAA;IACvB,WAAW,EAAE,OAAO,EAAE,CAAA;CACtB,GAAG,MAAM,CAeT;AA6BD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQjE"}

package/dist/utils/csp.js

@@ -0,0 +1,149 @@
+/**
+ * Self-contained Content-Security-Policy for auth renderer pages.
+ *
+ * WHY THIS EXISTS. The auth integration serves its UI surfaces (`/login`,
+ * `/verify-code`, `/password`, `/forgot-password`, `/reset-password`) from
+ * `injectRoute`-registered Astro endpoints that return a raw `Response` built
+ * from an HTML string. Astro's native hash-based `security.csp` only rewrites
+ * *component-rendered* pages — it scans the rendered document, hashes inline
+ * `<script>`/`<style>`, and injects a `<meta http-equiv>` CSP. An endpoint that
+ * returns its own `Response` bypasses that pass entirely, so on a site with an
+ * enforced `security.csp` the auth pages ship transport headers but NO CSP and
+ * their inline theme-bootstrap script is un-hashed (fulcrum-labs/warfronts
+ * verified live: `/login` 200, no `Content-Security-Policy` header or meta).
+ *
+ * This is the auth-side analogue of the `@growth-labs/consent@0.7.1`
+ * `context.csp.insertScriptHash` fix. Consent registers its banner hash and
+ * lets Astro render the CSP meta into the `.astro` page; auth has no Astro page
+ * to carry a meta, so it computes the sha256 hashes of its own inline scripts
+ * and styles and emits the `<meta http-equiv="Content-Security-Policy">` itself.
+ * Browsers combine a CSP meta with any CSP response header by intersection, so a
+ * site keeps owning the transport-header CSP (or none) while auth owns the meta
+ * on its own surfaces — exactly the model warfronts documents (CSP lives in the
+ * meta on SSR pages; the transport middleware never emits a CSP header).
+ */
+/**
+ * Compute the CSP sha256 hash of an inline `<script>`/`<style>` body. Hashes the
+ * exact bytes the browser hashes — the raw text between the element's open and
+ * close tags, with no trimming — so the emitted `'sha256-…'` matches what the
+ * browser recomputes for the served content. Mirrors the consent package's
+ * `sha256CspHash` (SHA-256 → base64) so the two packages stay wire-compatible.
+ */
+export async function sha256CspHash(content) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(content));
+    const base64 = btoa(String.fromCharCode(...new Uint8Array(digest)));
+    return `sha256-${base64}`;
+}
+const INLINE_SCRIPT_RE = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
+const INLINE_STYLE_RE = /<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi;
+const HAS_SRC_RE = /\bsrc\s*=/i;
+/**
+ * Extract the inner bodies of inline `<script>` and `<style>` elements. A
+ * `<script src=…>` reference has no hashable body (its bytes live at another
+ * URL, covered by `script-src 'self'`) and is skipped. Empty bodies are skipped
+ * — an empty inline script needs no hash. De-duplicates identical bodies so an
+ * element repeated on a page contributes a single hash.
+ */
+export function extractInlineSources(html) {
+    const scripts = new Set();
+    const styles = new Set();
+    for (const match of html.matchAll(INLINE_SCRIPT_RE)) {
+        const attrs = match[1] ?? '';
+        const body = match[2] ?? '';
+        if (HAS_SRC_RE.test(attrs))
+            continue;
+        if (body.length === 0)
+            continue;
+        scripts.add(body);
+    }
+    for (const match of html.matchAll(INLINE_STYLE_RE)) {
+        const body = match[1] ?? '';
+        if (body.length === 0)
+            continue;
+        styles.add(body);
+    }
+    return { scripts: [...scripts], styles: [...styles] };
+}
+/** True when the document already carries a CSP `<meta http-equiv>` tag. */
+export function hasCspMeta(html) {
+    return /<meta\b[^>]*\bhttp-equiv\s*=\s*["']?content-security-policy["']?/i.test(html);
+}
+/**
+ * Build the CSP policy string for an auth page from its inline-source hashes.
+ *
+ * - `default-src 'self'` is the floor; anything not otherwise named falls here.
+ * - `script-src 'self' <hashes>` allows same-origin scripts plus the exact
+ *   inline scripts on the page. No `'unsafe-inline'`: every inline script is
+ *   hashed, so the policy stays strict.
+ * - `style-src 'self' <hashes>` does the same for inline `<style>` blocks.
+ * - `style-src-attr 'unsafe-inline'` permits inline `style="…"` attributes,
+ *   which are NOT hashable (Astro's own CSP takes the same allowance for
+ *   attribute styles). Element styles remain hash-pinned.
+ * - `img-src 'self' data: https:` covers the brand logo and inline data URIs.
+ * - `connect-src 'self'` bounds fetch/XHR (the code-request/verify POSTs are
+ *   same-origin). `form-action 'self'` bounds the login/verify form posts.
+ * - `object-src 'none'`, `base-uri 'self'`, `frame-ancestors 'none'` are the
+ *   standard hardening trio (no plugins, no base-tag hijack, no framing).
+ */
+export function buildAuthCspPolicy(sources) {
+    const scriptSrc = ["script-src 'self'", ...sources.scriptHashes.map((h) => `'${h}'`)].join(' ');
+    const styleSrc = ["style-src 'self'", ...sources.styleHashes.map((h) => `'${h}'`)].join(' ');
+    return [
+        "default-src 'self'",
+        scriptSrc,
+        styleSrc,
+        "style-src-attr 'unsafe-inline'",
+        "img-src 'self' data: https:",
+        "connect-src 'self'",
+        "form-action 'self'",
+        "object-src 'none'",
+        "base-uri 'self'",
+        "frame-ancestors 'none'",
+    ].join('; ');
+}
+function escapeHtmlAttribute(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+/**
+ * Insert `tag` immediately after the opening `<head>` (or, absent a head, after
+ * `<html>`, or as a prefix) so the policy is parsed before any inline content.
+ */
+function injectIntoHead(html, tag) {
+    const headOpen = /<head\b[^>]*>/i.exec(html);
+    if (headOpen) {
+        const at = headOpen.index + headOpen[0].length;
+        return `${html.slice(0, at)}${tag}${html.slice(at)}`;
+    }
+    const htmlOpen = /<html\b[^>]*>/i.exec(html);
+    if (htmlOpen) {
+        const at = htmlOpen.index + htmlOpen[0].length;
+        return `${html.slice(0, at)}${tag}${html.slice(at)}`;
+    }
+    return `${tag}${html}`;
+}
+/**
+ * Compute the auth CSP for `html` and return the document with a
+ * `<meta http-equiv="Content-Security-Policy">` inserted at the top of `<head>`.
+ *
+ * Idempotent: if the document already carries a CSP meta (a consumer renderer
+ * that emits its own), the input is returned unchanged so we never emit two
+ * conflicting policies (browsers would intersect them and likely break the
+ * page). Every inline `<script>`/`<style>` the page ships is hash-pinned, so the
+ * emitted policy is strict — no `'unsafe-inline'` for scripts or element styles.
+ */
+export async function injectAuthCsp(html) {
+    if (hasCspMeta(html))
+        return html;
+    const { scripts, styles } = extractInlineSources(html);
+    const scriptHashes = await Promise.all(scripts.map(sha256CspHash));
+    const styleHashes = await Promise.all(styles.map(sha256CspHash));
+    const policy = buildAuthCspPolicy({ scriptHashes, styleHashes });
+    const tag = `<meta http-equiv="Content-Security-Policy" content="${escapeHtmlAttribute(policy)}">`;
+    return injectIntoHead(html, tag);
+}
+//# sourceMappingURL=csp.js.map

package/dist/utils/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../src/utils/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACnE,OAAO,UAAU,MAAM,EAAE,CAAA;AAC1B,CAAC;AAQD,MAAM,gBAAgB,GAAG,4CAA4C,CAAA;AACrE,MAAM,eAAe,GAAG,wCAAwC,CAAA;AAChE,MAAM,UAAU,GAAG,YAAY,CAAA;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC/B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,IAAY;IACtC,OAAO,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAGlC;IACA,MAAM,SAAS,GAAG,CAAC,mBAAmB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,MAAM,QAAQ,GAAG,CAAC,kBAAkB,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5F,OAAO;QACN,oBAAoB;QACpB,SAAS;QACT,QAAQ;QACR,gCAAgC;QAChC,6BAA6B;QAC7B,oBAAoB;QACpB,oBAAoB;QACpB,mBAAmB;QACnB,iBAAiB;QACjB,wBAAwB;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACzC,OAAO,KAAK;SACV,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,GAAW;IAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;IACrD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;IACrD,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,CAAA;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC/C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAA;IAChE,MAAM,GAAG,GAAG,uDAAuD,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAA;IAClG,OAAO,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC"}

package/dist/utils/fail-closed.d.ts

@@ -0,0 +1,14 @@
+import type { ClientSecretResolutionErrorCode } from './client-secret.js';
+export type ClientSecretFailureSurface = 'middleware_refresh' | 'callback_exchange' | 'logout_revocation' | 'route_preflight' | 'route_exchange' | 'server_auth_client';
+export interface ClientSecretFailureSignal {
+    readonly surface: ClientSecretFailureSurface;
+    readonly code: ClientSecretResolutionErrorCode;
+}
+export declare function reportClientSecretResolutionFailure(signal: ClientSecretFailureSignal): void;
+export declare function secretResolutionFailureResponse(request?: Request, signal?: ClientSecretFailureSignal): Response;
+export declare class ClientSecretResolutionError extends Error {
+    readonly code: ClientSecretResolutionErrorCode;
+    readonly name = "ClientSecretResolutionError";
+    constructor(code: ClientSecretResolutionErrorCode);
+}
+//# sourceMappingURL=fail-closed.d.ts.map

package/dist/utils/fail-closed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail-closed.d.ts","sourceRoot":"","sources":["../../src/utils/fail-closed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAA;AAEzE,MAAM,MAAM,0BAA0B,GACnC,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,oBAAoB,CAAA;AAEvB,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;CAC9C;AAoBD,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAS3F;AAED,wBAAgB,+BAA+B,CAC9C,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,yBAAyB,GAChC,QAAQ,CAgBV;AAKD,qBAAa,2BAA4B,SAAQ,KAAK;aAEzB,IAAI,EAAE,+BAA+B;IADjE,SAAkB,IAAI,iCAAgC;gBAC1B,IAAI,EAAE,+BAA+B;CAGjE"}

package/dist/utils/fail-closed.js

@@ -0,0 +1,53 @@
+// Shared no-store headers for all secret-resolution failure responses.
+const SECURITY_HEADERS = {
+    'Cache-Control': 'private, no-store',
+    Pragma: 'no-cache',
+    Expires: '0',
+};
+function acceptsJson(request) {
+    const accept = request?.headers.get('accept') ?? '';
+    return accept
+        .split(',')
+        .some((value) => value.trim().toLowerCase().split(';')[0] === 'application/json');
+}
+// Fixed-vocabulary 503 for secret-resolution failures on all surfaces.
+// Browser callers receive bounded plain text; JSON callers receive one fixed
+// JSON error. Neither class reflects a path, provider, error code, raw error,
+// secret value, or stack. Callers must invoke this before issuer I/O.
+export function reportClientSecretResolutionFailure(signal) {
+    try {
+        console.error('[growth-labs/auth] client_secret_resolution_failed', {
+            surface: signal.surface,
+            code: signal.code,
+        });
+    }
+    catch {
+        // Observability must never replace the bounded fail-closed response.
+    }
+}
+export function secretResolutionFailureResponse(request, signal) {
+    if (signal)
+        reportClientSecretResolutionFailure(signal);
+    if (acceptsJson(request)) {
+        return Response.json({ error: 'auth_service_unavailable' }, { status: 503, headers: new Headers(SECURITY_HEADERS) });
+    }
+    return new Response('Service unavailable', {
+        status: 503,
+        headers: new Headers({
+            ...SECURITY_HEADERS,
+            'Content-Type': 'text/plain; charset=UTF-8',
+        }),
+    });
+}
+// Typed error thrown by server-helper headersFor() on secret binding failure.
+// Exported so consumers can distinguish secret-resolution failure from
+// network/credential failure in custom server-side auth flows.
+export class ClientSecretResolutionError extends Error {
+    code;
+    name = 'ClientSecretResolutionError';
+    constructor(code) {
+        super('client_secret_binding_unavailable');
+        this.code = code;
+    }
+}
+//# sourceMappingURL=fail-closed.js.map

package/dist/utils/fail-closed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail-closed.js","sourceRoot":"","sources":["../../src/utils/fail-closed.ts"],"names":[],"mappings":"AAeA,uEAAuE;AACvE,MAAM,gBAAgB,GAA2B;IAChD,eAAe,EAAE,mBAAmB;IACpC,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,GAAG;CACZ,CAAA;AAED,SAAS,WAAW,CAAC,OAA4B;IAChD,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,uEAAuE;AACvE,6EAA6E;AAC7E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,UAAU,mCAAmC,CAAC,MAAiC;IACpF,IAAI,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE;YACnE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;IACtE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,OAAiB,EACjB,MAAkC;IAElC,IAAI,MAAM;QAAE,mCAAmC,CAAC,MAAM,CAAC,CAAA;IACvD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,KAAK,EAAE,0BAA0B,EAAE,EACrC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,gBAA+B,CAAC,EAAE,CACtE,CAAA;IACF,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE;QAC1C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,IAAI,OAAO,CAAC;YACpB,GAAG,gBAAgB;YACnB,cAAc,EAAE,2BAA2B;SAC3C,CAAC;KACF,CAAC,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,+DAA+D;AAC/D,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAEzB;IADV,IAAI,GAAG,6BAA6B,CAAA;IACtD,YAA4B,IAAqC;QAChE,KAAK,CAAC,mCAAmC,CAAC,CAAA;QADf,SAAI,GAAJ,IAAI,CAAiC;IAEjE,CAAC;CACD"}

package/dist/utils/index.d.ts

@@ -1,7 +1,11 @@
 export { type AuthAnalyticsProvider, type AuthFailureEventInput, type AuthSuccessEventInput, authSuccessEventName, emitAuthEvent, emitAuthFailureEvent, emitAuthSuccessEvent, normalizeAuthFailureReason, normalizeAuthProvider, trackAuthEvent, } from './analytics.js';
+export type { ClientSecretLiteral, ClientSecretResolutionErrorCode, ClientSecretResult, } from './client-secret.js';
+export { isClientSecretLiteral, literalClientSecret } from './client-secret.js';
+export { buildAuthCspPolicy, type CspHash, extractInlineSources, hasCspMeta, injectAuthCsp, sha256CspHash, } from './csp.js';
+export { ClientSecretResolutionError } from './fail-closed.js';
 export { type BridgeMigrationOptions, type BridgeMigrationStatement, buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, canonicalIdentitySubject, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
-export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
+export { EXCHANGE_SECRET_FAILURE, type ExchangeSecretFailure, getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl, } from './openauth.js';
 export { createPKCEChallenge, generatePKCE } from './pkce.js';
 export { generateState, verifyState } from './state.js';
 export type { VerifiedClaims } from './tokens.js';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACX,mBAAmB,EACnB,+BAA+B,EAC/B,kBAAkB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EACN,kBAAkB,EAClB,KAAK,OAAO,EACZ,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,aAAa,GACb,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EACN,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/utils/index.js

@@ -1,7 +1,10 @@
 export { authSuccessEventName, emitAuthEvent, emitAuthFailureEvent, emitAuthSuccessEvent, normalizeAuthFailureReason, normalizeAuthProvider, trackAuthEvent, } from './analytics.js';
+export { isClientSecretLiteral, literalClientSecret } from './client-secret.js';
+export { buildAuthCspPolicy, extractInlineSources, hasCspMeta, injectAuthCsp, sha256CspHash, } from './csp.js';
+export { ClientSecretResolutionError } from './fail-closed.js';
 export { buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, canonicalIdentitySubject, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
-export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
+export { EXCHANGE_SECRET_FAILURE, getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl, } from './openauth.js';
 export { createPKCEChallenge, generatePKCE } from './pkce.js';
 export { generateState, verifyState } from './state.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AAMvB,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EACN,kBAAkB,EAElB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,aAAa,GACb,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EACN,uBAAuB,EAEvB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}

package/dist/utils/openauth.d.ts

@@ -1,4 +1,5 @@
 import type { TokenExchangeResult } from '../types.js';
+import { type ClientSecretResolutionErrorCode } from './client-secret.js';
 export interface AuthFlow {
     verifier: string;
     challenge: string;
@@ -24,6 +25,11 @@ export declare function getMagicLinkUrl(_context: {
 }): string;
 export declare function getForgotPasswordUrl(): string;
 export declare function getResetPasswordUrl(): string;
-export declare function exchangeCode(callbackUrl: URL, code: string, codeVerifier: string, providerFromCookie?: TokenExchangeResult['provider']): Promise<TokenExchangeResult | null>;
+export interface ExchangeSecretFailure {
+    readonly secretFailed: true;
+    readonly code: ClientSecretResolutionErrorCode;
+}
+export declare const EXCHANGE_SECRET_FAILURE: ExchangeSecretFailure;
+export declare function exchangeCode(callbackUrl: URL, code: string, codeVerifier: string, providerFromCookie?: TokenExchangeResult['provider'], request?: Request): Promise<TokenExchangeResult | ExchangeSecretFailure | null>;
 export declare function revokeToken(refreshToken: string, clientId?: string, clientSecret?: string): Promise<void>;
 //# sourceMappingURL=openauth.d.ts.map

package/dist/utils/openauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAOtD,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY7E;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB/D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAGlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAG9D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAG5C;AAYD,wBAAsB,YAAY,CACjC,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,GAClD,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAmDrC;AAED,wBAAsB,WAAW,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf"}
+{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EACN,KAAK,+BAA+B,EAGpC,MAAM,oBAAoB,CAAA;AAM3B,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY7E;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB/D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAGlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAG9D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAG5C;AAgBD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;CAC9C;AAID,eAAO,MAAM,uBAAuB,EAAE,qBAGpC,CAAA;AAEF,wBAAsB,YAAY,CACjC,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,EACpD,OAAO,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,mBAAmB,GAAG,qBAAqB,GAAG,IAAI,CAAC,CAsD7D;AAED,wBAAsB,WAAW,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/utils/openauth.js

@@ -1,5 +1,5 @@
 import { getConfig } from '../config-store.js';
-import { createClientSecretBasicAuthHeader, resolveClientSecret } from './client-secret.js';
+import { createClientSecretBasicAuthHeader, resolveClientSecret, } from './client-secret.js';
 import { resolveInternalIssuer } from './issuer.js';
 import { generatePKCE } from './pkce.js';
 import { generateState } from './state.js';
@@ -58,17 +58,26 @@ function tokenResponseHasTokens(data) {
     return (typeof data.access_token === 'string' &&
         typeof data.refresh_token === 'string');
 }
-export async function exchangeCode(callbackUrl, code, codeVerifier, providerFromCookie) {
+// Backward-compatible exported sentinel for callers that only need a bounded
+// representative failure. Runtime exchangeCode results carry the actual code.
+export const EXCHANGE_SECRET_FAILURE = Object.freeze({
+    secretFailed: true,
+    code: 'BINDING_REJECTED',
+});
+export async function exchangeCode(callbackUrl, code, codeVerifier, providerFromCookie, request) {
     const options = getConfig();
     const issuer = resolveInternalIssuer(options);
     const clientId = options.clientId || callbackUrl.hostname;
     const redirectUri = new URL(options.callbackPath, callbackUrl.origin).toString();
-    const clientSecret = await resolveClientSecret(options.clientSecret);
+    const secretResult = await resolveClientSecret(options.clientSecret, request);
+    if (!secretResult.ok) {
+        return Object.freeze({ secretFailed: true, code: secretResult.code });
+    }
     const headers = {
         'Content-Type': 'application/x-www-form-urlencoded',
     };
-    if (clientSecret) {
-        headers.Authorization = createClientSecretBasicAuthHeader(clientId, clientSecret);
+    if (secretResult.secret) {
+        headers.Authorization = createClientSecretBasicAuthHeader(clientId, secretResult.secret);
     }
     const body = new URLSearchParams({
         grant_type: 'authorization_code',

package/dist/utils/openauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAU3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,OAAO;QACN,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,cAAc,MAAM,EAAE;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAA;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,qBAAqB,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAsB;IACrD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,uBAAuB,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,kBAAkB,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,iBAAiB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAC9B,IAAa;IAEb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,OAAO,CACN,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ;QACrE,OAAQ,IAAoC,CAAC,aAAa,KAAK,QAAQ,CACvE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,WAAgB,EAChB,IAAY,EACZ,YAAoB,EACpB,kBAAoD;IAEpD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAChF,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACpE,MAAM,OAAO,GAA2B;QACvC,cAAc,EAAE,mCAAmC;KACnD,CAAA;IACD,IAAI,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAE9C,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/F,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,kBAAkB,IAAI,SAAS;YACzC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,YAAoB,EACpB,QAAiB,EACjB,YAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAA;IAC/F,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,GAAG,MAAM,SAAS,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,eAAe;gBAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC"}
+{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAEN,iCAAiC,EACjC,mBAAmB,GACnB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAU3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,OAAO;QACN,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,cAAc,MAAM,EAAE;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAA;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,qBAAqB,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAsB;IACrD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,uBAAuB,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,kBAAkB,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,iBAAiB,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAC9B,IAAa;IAEb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,OAAO,CACN,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ;QACrE,OAAQ,IAAoC,CAAC,aAAa,KAAK,QAAQ,CACvE,CAAA;AACF,CAAC;AAWD,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAA0B,MAAM,CAAC,MAAM,CAAC;IAC3E,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,kBAAkB;CACxB,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,WAAgB,EAChB,IAAY,EACZ,YAAoB,EACpB,kBAAoD,EACpD,OAAiB;IAEjB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAChF,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAC7E,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAa,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,OAAO,GAA2B;QACvC,cAAc,EAAE,mCAAmC;KACnD,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAE9C,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/F,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,kBAAkB,IAAI,SAAS;YACzC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,YAAoB,EACpB,QAAiB,EACjB,YAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAA;IAC/F,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,GAAG,MAAM,SAAS,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,eAAe;gBAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/auth",
-  "version": "0.10.0",
+  "version": "0.10.3",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -57,7 +57,7 @@
     "typescript": "^5.8.0",
     "vite": "^7.3.5",
     "vitest": "^4.1.8",
-    "@growth-labs/analytics": "0.14.6"
+    "@growth-labs/analytics": "0.15.0"
   },
   "scripts": {
     "build": "tsc",

package/src/config-store.ts

@@ -1,4 +1,5 @@
 import type { ResolvedAuthOptions } from './options.js'
+import { rehydrateClientSecretLiteral } from './utils/client-secret-literal.js'
 import { isEnvMarker, resolveEnvMarker } from './utils/env-marker.js'
 
 let _config: ResolvedAuthOptions | null = null
@@ -13,7 +14,7 @@ export function getConfig(): ResolvedAuthOptions {
 			__GL_AUTH_CONFIG__?: ResolvedAuthOptions
 		}
 	).__GL_AUTH_CONFIG__
-	const base = runtimeConfig ?? _config
+	const base = runtimeConfig ? rehydrateRuntimeConfig(runtimeConfig) : _config
 	if (!base) {
 		throw new Error(
 			'@growth-labs/auth: integration not configured. Add auth() to your astro.config.mjs integrations array.',
@@ -22,6 +23,17 @@ export function getConfig(): ResolvedAuthOptions {
 	return resolveEnvMarkers(base)
 }
 
+function rehydrateRuntimeConfig(base: ResolvedAuthOptions): ResolvedAuthOptions {
+	// The Vite global is emitted only after authOptionsSchema accepts a
+	// WeakSet-issued literal at build time. Treat the structural wire shape as
+	// transport encoding here, then re-issue the runtime object; the resolver
+	// itself never trusts the structural marker.
+	const clientSecret = rehydrateClientSecretLiteral(base.clientSecret)
+	return clientSecret === base.clientSecret
+		? base
+		: ({ ...base, clientSecret } as ResolvedAuthOptions)
+}
+
 /**
  * Resolves any `"env:VAR_NAME"` markers on auth-tuple fields against the
  * runtime env stashed by `src/runtime-bridge.ts`. The bridge is loaded

package/src/index.ts

@@ -2,6 +2,10 @@ import { _setConfig } from './config-store.js'
 import type { AuthOptions } from './options.js'
 import { authOptionsSchema } from './options.js'
 import type { AuthRenderers } from './types.js'
+import {
+	isClientSecretLiteral,
+	serializeClientSecretLiteral,
+} from './utils/client-secret-literal.js'
 
 interface AstroIntegration {
 	name: string
@@ -72,7 +76,13 @@ function isValidRendererSpec(value: unknown): value is { module: string; export:
 export default function auth(userOptions: AuthOptions): AstroIntegration {
 	const options = authOptionsSchema.parse(userOptions)
 	_setConfig(options)
-	const serializableOptions = { ...options, renderers: {} }
+	const serializableOptions = {
+		...options,
+		clientSecret: isClientSecretLiteral(options.clientSecret)
+			? serializeClientSecretLiteral(options.clientSecret)
+			: options.clientSecret,
+		renderers: {},
+	}
 
 	return {
 		name: '@growth-labs/auth',

package/src/middleware/auth.ts

@@ -3,6 +3,7 @@ import '../runtime-bridge.js'
 import type { User } from '../types.js'
 import { resolveClientSecret } from '../utils/client-secret.js'
 import { getCookie, setTokenCookies } from '../utils/cookies.js'
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
 import { resolveInternalIssuer } from '../utils/issuer.js'
 import { refreshTokens, verifyAccessToken } from '../utils/tokens.js'
 
@@ -21,6 +22,27 @@ export async function onRequest(
 	// 2. Attempt to authenticate
 	let user: User | null = null
 	let refreshed: Awaited<ReturnType<typeof refreshTokens>> = null
+	let resolvedClientSecret: string | undefined
+
+	// A request carrying a refresh token can enter the confidential-client
+	// refresh path if access-token verification fails. Resolve that request's
+	// configured secret before verification so a cold JWKS lookup can never
+	// precede discovery of a broken binding. The module-private Request-keyed
+	// resolver cache makes this the single read, and the exact bytes are reused
+	// below. A refresh token explicitly opts the request into this fail-closed
+	// confidential-session invariant even when its access token would verify;
+	// an access-token-only request never needs or reads the client secret.
+	if (refreshToken && options.clientSecret !== undefined) {
+		const secretResult = await resolveClientSecret(options.clientSecret, request)
+		if (!secretResult.ok) {
+			context.locals.user = null
+			return secretResolutionFailureResponse(request, {
+				surface: 'middleware_refresh',
+				code: secretResult.code,
+			})
+		}
+		resolvedClientSecret = secretResult.secret ?? undefined
+	}
 
 	if (accessToken) {
 		const verified = await verifyAccessToken(issuer, accessToken, { audience: options.resource })
@@ -39,8 +61,13 @@ export async function onRequest(
 
 	if (!user && refreshToken) {
 		const clientId = options.clientId || context.url.hostname
-		const clientSecret = await resolveClientSecret(options.clientSecret)
-		refreshed = await refreshTokens(issuer, refreshToken, clientId, clientSecret, options.resource)
+		refreshed = await refreshTokens(
+			issuer,
+			refreshToken,
+			clientId,
+			resolvedClientSecret,
+			options.resource,
+		)
 		if (refreshed) {
 			user = {
 				id: refreshed.claims.sub,
@@ -66,7 +93,7 @@ export async function onRequest(
 	// 5. Continue to the page
 	const response = await next()
 
-	// 6. If tokens were refreshed or response must be modified, clone and apply changes
+	// 6. If tokens were refreshed or the response must carry no-store, clone and apply.
 	if (refreshed || context.locals.synthetic === true) {
 		const modifiedResponse = new Response(response.body, {
 			status: response.status,

package/src/options.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod'
 import type { AuthRenderers } from './types.js'
+import type { ClientSecretLiteral } from './utils/client-secret-literal.js'
+import { isClientSecretLiteral } from './utils/client-secret-literal.js'
 
 // String accepted as either a literal URL or an "env:VAR_NAME" marker that
 // gets resolved against the Worker runtime env at request time. See
@@ -27,7 +29,20 @@ export const authOptionsSchema = z.object({
 
 	// ─── Client identity ───
 	clientId: stringOrEnvMarker.optional(),
-	clientSecret: z.string().optional(),
+	// clientSecret accepts either a binding name (string resolved at request time
+	// against the Worker runtime env) or an explicit literalClientSecret() value
+	// (local-dev only; embedded in the serialized config). A bare string is
+	// always treated as a binding name — fail closed when the binding is absent.
+	// An empty or whitespace-only binding name is schema-rejected; it can never
+	// resolve to a usable secret and must not silently become a public client.
+	clientSecret: z
+		.union([
+			z.string().refine((v) => v.trim().length > 0, {
+				message: 'clientSecret binding name must not be empty or whitespace-only',
+			}),
+			z.custom<ClientSecretLiteral>(isClientSecretLiteral),
+		])
+		.optional(),
 	resource: urlOrEnvMarker,
 
 	// ─── Cookie configuration ───