@growth-labs/auth 0.7.2 → 0.7.4

package/dist/utils/analytics.js

@@ -1,6 +1,21 @@
 let trackFn = null;
 let resolved = false;
+let resolvePromise = null;
 const ANALYTICS_UTILS_MODULE = '@growth-labs/analytics/utils';
+const AUTH_PROVIDERS = new Set(['google', 'email-code', 'password']);
+const AUTH_FAILURE_REASONS = new Set([
+    'auth_failed',
+    'invalid_credentials',
+    'invalid_code',
+    'invalid_request',
+    'invalid_response',
+    'invalid_token',
+    'missing_auth_flow',
+    'oauth_denied',
+    'request_failed',
+    'send_failed',
+    'token_exchange_failed',
+]);
 async function importOptionalModule(modulePath) {
     try {
         return (await import(/* @vite-ignore */ modulePath));
@@ -12,18 +27,23 @@ async function importOptionalModule(modulePath) {
 async function resolveAnalytics() {
     if (resolved)
         return;
-    resolved = true;
-    const mod = await importOptionalModule(ANALYTICS_UTILS_MODULE);
-    let candidate;
-    try {
-        candidate = mod?.trackServerEvent;
-    }
-    catch {
-        candidate = undefined;
-    }
-    if (typeof candidate === 'function') {
-        trackFn = candidate;
+    if (!resolvePromise) {
+        resolvePromise = (async () => {
+            const mod = await importOptionalModule(ANALYTICS_UTILS_MODULE);
+            let candidate;
+            try {
+                candidate = mod?.trackServerEvent;
+            }
+            catch {
+                candidate = undefined;
+            }
+            if (typeof candidate === 'function') {
+                trackFn = candidate;
+            }
+            resolved = true;
+        })();
     }
+    await resolvePromise;
 }
 export async function emitAuthEvent(context, eventName, data) {
     await resolveAnalytics();
@@ -31,6 +51,32 @@ export async function emitAuthEvent(context, eventName, data) {
         return;
     return trackFn(context, eventName, data);
 }
+export function normalizeAuthProvider(provider) {
+    return provider && AUTH_PROVIDERS.has(provider) ? provider : 'unknown';
+}
+export function normalizeAuthFailureReason(reason) {
+    if (reason === 'access_denied')
+        return 'oauth_denied';
+    return reason && AUTH_FAILURE_REASONS.has(reason) ? reason : 'auth_failed';
+}
+export function authSuccessEventName(isNewUser) {
+    return isNewUser ? 'signup_completed' : 'login_completed';
+}
+export async function emitAuthSuccessEvent(context, input) {
+    return emitAuthEvent(context, authSuccessEventName(input.isNewUser), {
+        provider: normalizeAuthProvider(input.provider),
+        isNewUser: input.isNewUser,
+        auth_path: input.authPath,
+        identity_user_id: input.identityUserId,
+    });
+}
+export async function emitAuthFailureEvent(context, input) {
+    return emitAuthEvent(context, 'auth_failed', {
+        provider: normalizeAuthProvider(input.provider),
+        reason: normalizeAuthFailureReason(input.reason),
+        auth_path: input.authPath,
+    });
+}
 export function analyticsAvailable(context) {
     void context;
     return true;
@@ -41,5 +87,6 @@ export async function trackAuthEvent(context, eventName, data = {}) {
 export function _resetAnalytics() {
     trackFn = null;
     resolved = false;
+    resolvePromise = null;
 }
 //# sourceMappingURL=analytics.js.map

package/dist/utils/analytics.js.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAEA,IAAI,OAAO,GAAmB,IAAI,CAAA;AAClC,IAAI,QAAQ,GAAG,KAAK,CAAA;AACpB,MAAM,sBAAsB,GAAG,8BAA8B,CAAA;AAE7D,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAA4B,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC9B,IAAI,QAAQ;QAAE,OAAM;IACpB,QAAQ,GAAG,IAAI,CAAA;IACf,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;IAC9D,IAAI,SAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,SAAS,GAAG,GAAG,EAAE,gBAAgB,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,SAAS,GAAG,SAAS,CAAA;IACtB,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,GAAG,SAAoB,CAAA;IAC/B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAgB,EAChB,SAAiB,EACjB,IAA6B;IAE7B,MAAM,gBAAgB,EAAE,CAAA;IACxB,IAAI,CAAC,OAAO;QAAE,OAAM;IACpB,OAAO,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6C;IAC/E,KAAK,OAAO,CAAA;IACZ,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgB,EAChB,SAAiB,EACjB,OAAgC,EAAE;IAElC,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,GAAG,IAAI,CAAA;IACd,QAAQ,GAAG,KAAK,CAAA;AACjB,CAAC"}
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAiBA,IAAI,OAAO,GAAmB,IAAI,CAAA;AAClC,IAAI,QAAQ,GAAG,KAAK,CAAA;AACpB,IAAI,cAAc,GAAyB,IAAI,CAAA;AAC/C,MAAM,sBAAsB,GAAG,8BAA8B,CAAA;AAC7D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAA;AACpE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,aAAa;IACb,qBAAqB;IACrB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,uBAAuB;CACvB,CAAC,CAAA;AAEF,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAA4B,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC9B,IAAI,QAAQ;QAAE,OAAM;IACpB,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;YAC9D,IAAI,SAAkB,CAAA;YACtB,IAAI,CAAC;gBACJ,SAAS,GAAG,GAAG,EAAE,gBAAgB,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACR,SAAS,GAAG,SAAS,CAAA;YACtB,CAAC;YACD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;gBACrC,OAAO,GAAG,SAAoB,CAAA;YAC/B,CAAC;YACD,QAAQ,GAAG,IAAI,CAAA;QAChB,CAAC,CAAC,EAAE,CAAA;IACL,CAAC;IACD,MAAM,cAAc,CAAA;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAgB,EAChB,SAAiB,EACjB,IAA6B;IAE7B,MAAM,gBAAgB,EAAE,CAAA;IACxB,IAAI,CAAC,OAAO;QAAE,OAAM;IACpB,OAAO,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,QAA2D;IAE3D,OAAO,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAkC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC3E,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,cAAc,CAAA;IACrD,OAAO,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAkB;IACtD,OAAO,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAgB,EAChB,KAA4B;IAE5B,OAAO,aAAa,CAAC,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QACpE,QAAQ,EAAE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,gBAAgB,EAAE,KAAK,CAAC,cAAc;KACtC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAgB,EAChB,KAA4B;IAE5B,OAAO,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;QAC5C,QAAQ,EAAE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,EAAE,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC;QAChD,SAAS,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6C;IAC/E,KAAK,OAAO,CAAA;IACZ,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgB,EAChB,SAAiB,EACjB,OAAgC,EAAE;IAElC,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,GAAG,IAAI,CAAA;IACd,QAAQ,GAAG,KAAK,CAAA;IAChB,cAAc,GAAG,IAAI,CAAA;AACtB,CAAC"}

package/dist/utils/index.d.ts

@@ -1,4 +1,4 @@
-export { emitAuthEvent, trackAuthEvent } from './analytics.js';
+export { type AuthAnalyticsProvider, type AuthFailureEventInput, type AuthSuccessEventInput, authSuccessEventName, emitAuthEvent, emitAuthFailureEvent, emitAuthSuccessEvent, normalizeAuthFailureReason, normalizeAuthProvider, trackAuthEvent, } from './analytics.js';
 export { type BridgeMigrationOptions, type BridgeMigrationStatement, buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
 export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/utils/index.js

@@ -1,4 +1,4 @@
-export { emitAuthEvent, trackAuthEvent } from './analytics.js';
+export { authSuccessEventName, emitAuthEvent, emitAuthFailureEvent, emitAuthSuccessEvent, normalizeAuthFailureReason, normalizeAuthProvider, trackAuthEvent, } from './analytics.js';
 export { buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
 export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}

package/dist/utils/wait-until.d.ts

@@ -0,0 +1,13 @@
+interface CfExecutionContext {
+    waitUntil?: (promise: Promise<unknown>) => void;
+}
+interface ContextWithWaitUntil {
+    locals?: {
+        cfContext?: CfExecutionContext;
+    };
+    waitUntil?: (promise: Promise<unknown>) => void;
+}
+export type WaitUntilFn = (promise: Promise<unknown>) => void;
+export declare function resolveWaitUntil(context: ContextWithWaitUntil): WaitUntilFn;
+export {};
+//# sourceMappingURL=wait-until.d.ts.map

package/dist/utils/wait-until.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait-until.d.ts","sourceRoot":"","sources":["../../src/utils/wait-until.ts"],"names":[],"mappings":"AAuBA,UAAU,kBAAkB;IAC3B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAED,UAAU,oBAAoB;IAC7B,MAAM,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,kBAAkB,CAAA;KAC9B,CAAA;IACD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;AAI7D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,GAAG,WAAW,CAS3E"}

package/dist/utils/wait-until.js

@@ -0,0 +1,12 @@
+const NO_OP_WAIT_UNTIL = () => undefined;
+export function resolveWaitUntil(context) {
+    const cfWaitUntil = context.locals?.cfContext?.waitUntil;
+    if (typeof cfWaitUntil === 'function') {
+        return cfWaitUntil.bind(context.locals.cfContext);
+    }
+    if (typeof context.waitUntil === 'function') {
+        return context.waitUntil;
+    }
+    return NO_OP_WAIT_UNTIL;
+}
+//# sourceMappingURL=wait-until.js.map

package/dist/utils/wait-until.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait-until.js","sourceRoot":"","sources":["../../src/utils/wait-until.ts"],"names":[],"mappings":"AAoCA,MAAM,gBAAgB,GAAgB,GAAG,EAAE,CAAC,SAAS,CAAA;AAErD,MAAM,UAAU,gBAAgB,CAAC,OAA6B;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAA;IACxD,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,SAAS,CAAA;IACzB,CAAC;IACD,OAAO,gBAAgB,CAAA;AACxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/auth",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -62,7 +62,7 @@
     "typescript": "^5.8.0",
     "vite": "^7.3.2",
     "vitest": "^3.0.0",
-    "@growth-labs/analytics": "0.4.2"
+    "@growth-labs/analytics": "0.5.1"
   },
   "scripts": {
     "build": "tsc",

package/src/routes/api/code-request.ts

@@ -29,5 +29,6 @@ export async function POST(context: RouteContext): Promise<Response> {
 		{ email, sent: '1', redirect },
 		options.verifyCodePath,
 		{ email, redirect },
+		'email-code',
 	)
 }

package/src/routes/api/password-reset-confirm.ts

@@ -32,5 +32,6 @@ export async function POST(context: RouteContext): Promise<Response> {
 		{ reset: 'success' },
 		options.resetPasswordPath,
 		{ token },
+		'password',
 	)
 }

package/src/routes/api/password-reset-request.ts

@@ -28,5 +28,6 @@ export async function POST(context: RouteContext): Promise<Response> {
 		{ sent: '1' },
 		options.forgotPasswordPath,
 		{ email },
+		'password',
 	)
 }

package/src/routes/api/shared.ts

@@ -1,6 +1,22 @@
 import { getConfig } from '../../config-store.js'
+import { getRuntimeEnv } from '../../runtime.js'
 import { type AuthClientCodeResult, type AuthClientOkResult, authClient } from '../../server.js'
-import { getCookie, setCookie } from '../../utils/cookies.js'
+import {
+	type AuthAnalyticsProvider,
+	analyticsAvailable,
+	emitAuthFailureEvent,
+	emitAuthSuccessEvent,
+} from '../../utils/analytics.js'
+import {
+	clearAuthFlowCookies,
+	getCookie,
+	setCookie,
+	setIdentityCookie,
+	setTokenCookies,
+} from '../../utils/cookies.js'
+import { createIdentityCookiePayload, signIdentityCookie } from '../../utils/identity-cookie.js'
+import { exchangeCode } from '../../utils/openauth.js'
+import { resolveWaitUntil } from '../../utils/wait-until.js'
 import { type RouteContext, readForm, redirectLocation, redirectTo } from '../flow.js'
 
 const CROSS_SITE_POST_MESSAGE = 'Cross-site POST form submissions are forbidden'
@@ -37,14 +53,16 @@ export function callbackRedirect(
 	errorPath: string,
 	errorParams: Record<string, string | undefined>,
 	provider?: 'password' | 'email-code',
-): Response {
+): Promise<Response> | Response {
 	if ('error' in result) {
+		queueAuthFailure(context, provider, result.error)
 		return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error)
 	}
 
 	const options = getConfig()
 	const state = getCookie(context.request, `${options.cookiePrefix}_state`)
 	if (!state) {
+		queueAuthFailure(context, provider, 'missing_auth_flow')
 		return routeResult(
 			context,
 			errorPath,
@@ -53,6 +71,10 @@ export function callbackRedirect(
 		)
 	}
 
+	if (wantsJson(context)) {
+		return completeJsonAuth(context, result.code, errorPath, errorParams, provider)
+	}
+
 	const response = mutableHeaders(
 		routeResult(context, options.callbackPath, {
 			code: result.code,
@@ -78,8 +100,10 @@ export function statusRedirect(
 	successParams: Record<string, string | undefined>,
 	errorPath: string,
 	errorParams: Record<string, string | undefined>,
+	provider?: AuthAnalyticsProvider,
 ): Response {
 	if ('error' in result) {
+		queueAuthFailure(context, provider, result.error)
 		return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error)
 	}
 	return routeResult(context, successPath, successParams)
@@ -119,6 +143,80 @@ function mutableHeaders(response: Response): Response {
 	})
 }
 
+async function completeJsonAuth(
+	context: RouteContext,
+	code: string,
+	errorPath: string,
+	errorParams: Record<string, string | undefined>,
+	provider?: 'password' | 'email-code',
+): Promise<Response> {
+	const options = getConfig()
+	const codeVerifier = getCookie(context.request, `${options.cookiePrefix}_pkce`)
+	if (!codeVerifier) {
+		queueAuthFailure(context, provider, 'missing_auth_flow')
+		return routeResult(
+			context,
+			errorPath,
+			{ ...errorParams, error: 'missing_auth_flow' },
+			'missing_auth_flow',
+		)
+	}
+
+	const tokenResponse = await exchangeCode(context.url, code, codeVerifier, provider)
+	if (!tokenResponse) {
+		queueAuthFailure(context, provider, 'token_exchange_failed')
+		return routeResult(context, errorPath, { ...errorParams, error: 'auth_failed' }, 'auth_failed')
+	}
+
+	const redirectPath = getCookie(context.request, `${options.cookiePrefix}_redirect`) || '/'
+	const redirect = new URL(redirectPath, context.url.origin).toString()
+	const response = mutableHeaders(Response.json({ ok: true, redirect }))
+
+	setTokenCookies(response, options, tokenResponse.accessToken, tokenResponse.refreshToken)
+	clearAuthFlowCookies(response, options)
+	await setOptionalIdentityCookie(response, tokenResponse.claims.sub)
+	if (analyticsAvailable(context)) {
+		resolveWaitUntil(context)(
+			emitAuthSuccessEvent(context, {
+				provider: tokenResponse.provider,
+				isNewUser: tokenResponse.isNewUser,
+				authPath: context.url.pathname,
+				identityUserId: tokenResponse.claims.sub,
+			}),
+		)
+	}
+
+	return response
+}
+
+function queueAuthFailure(
+	context: RouteContext,
+	provider: AuthAnalyticsProvider | undefined,
+	reason: string,
+): void {
+	if (!analyticsAvailable(context)) return
+	resolveWaitUntil(context)(
+		emitAuthFailureEvent(context, {
+			provider,
+			reason,
+			authPath: context.url.pathname,
+		}),
+	)
+}
+
+async function setOptionalIdentityCookie(response: Response, subject: string): Promise<void> {
+	const secret = getRuntimeEnv().GL_IDENTITY_SECRET
+	if (typeof secret !== 'string' || !secret) return
+	try {
+		setIdentityCookie(
+			response,
+			await signIdentityCookie(await createIdentityCookiePayload(subject, secret), secret),
+		)
+	} catch {
+		// Keep login working if the optional analytics identity secret is misconfigured.
+	}
+}
+
 function authFlowCookieAttrs() {
 	return {
 		path: '/',

package/src/routes/callback.ts

@@ -1,6 +1,10 @@
 import { getConfig } from '../config-store.js'
 import { getRuntimeEnv } from '../runtime.js'
-import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js'
+import {
+	analyticsAvailable,
+	emitAuthFailureEvent,
+	emitAuthSuccessEvent,
+} from '../utils/analytics.js'
 import {
 	clearAuthFlowCookies,
 	getCookie,
@@ -10,11 +14,16 @@ import {
 import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js'
 import { exchangeCode } from '../utils/openauth.js'
 import { verifyState } from '../utils/state.js'
+import { resolveWaitUntil } from '../utils/wait-until.js'
 
 interface CallbackContext {
 	request: Request
 	url: URL
 	locals?: Record<string, unknown>
+	// Some callers may surface `waitUntil` at the top level (synthetic
+	// contexts in tests; future runtimes). The production wiring on Astro v6
+	// + @astrojs/cloudflare@13 instead exposes it at
+	// `locals.cfContext.waitUntil`, which `resolveWaitUntil` handles below.
 	waitUntil?: (promise: Promise<unknown>) => void
 }
 
@@ -23,47 +32,98 @@ function getIdentitySecret(): string | null {
 	return typeof secret === 'string' && secret.length > 0 ? secret : null
 }
 
+function wantsJson(request: Request): boolean {
+	const accept = request.headers.get('accept') ?? ''
+	return accept
+		.split(',')
+		.some((value) => value.trim().toLowerCase().split(';')[0] === 'application/json')
+}
+
+function loginErrorResponse(request: Request, origin: string, loginPath: string): Response {
+	const redirect = new URL(`${loginPath}?error=auth_failed`, origin).toString()
+	if (wantsJson(request)) {
+		return Response.json({ error: 'auth_failed', redirect }, { status: 400 })
+	}
+	return Response.redirect(redirect, 302)
+}
+
+function queueAuthFailure(
+	context: CallbackContext,
+	provider: string | null,
+	reason: string | null,
+): void {
+	if (!analyticsAvailable(context)) return
+	const promise = emitAuthFailureEvent(context, {
+		provider,
+		reason,
+		authPath: context.url.pathname,
+	})
+	resolveWaitUntil(context)(promise)
+}
+
 export async function GET(context: CallbackContext): Promise<Response> {
 	const options = getConfig()
 	const { url, request } = context
 
 	const code = url.searchParams.get('code')
 	const state = url.searchParams.get('state')
+	const error = url.searchParams.get('error')
 
 	// Verify CSRF state
 	const storedState = getCookie(request, `${options.cookiePrefix}_state`)
 	if (!state || !storedState || !verifyState(state, storedState)) {
+		queueAuthFailure(
+			context,
+			getCookie(request, `${options.cookiePrefix}_provider`),
+			'missing_auth_flow',
+		)
 		return new Response('Invalid state parameter', { status: 403 })
 	}
 
 	// Read PKCE verifier
 	const codeVerifier = getCookie(request, `${options.cookiePrefix}_pkce`)
 	if (!codeVerifier) {
+		queueAuthFailure(
+			context,
+			getCookie(request, `${options.cookiePrefix}_provider`),
+			'missing_auth_flow',
+		)
 		return new Response('Missing PKCE verifier', { status: 400 })
 	}
 
 	const provider = getCookie(request, `${options.cookiePrefix}_provider`)
 	const authPath = getCookie(request, `${options.cookiePrefix}_auth_path`) || url.pathname
 
+	if (error) {
+		queueAuthFailure(context, provider, error)
+		return loginErrorResponse(request, url.origin, options.loginPath)
+	}
+
+	if (!code) {
+		queueAuthFailure(context, provider, 'invalid_request')
+		return loginErrorResponse(request, url.origin, options.loginPath)
+	}
+
 	// Exchange code for tokens
 	const tokenResponse = await exchangeCode(
 		url,
-		code!,
+		code,
 		codeVerifier,
 		provider === 'google' || provider === 'password' || provider === 'email-code'
 			? provider
 			: undefined,
 	)
 	if (!tokenResponse) {
-		return Response.redirect(
-			new URL(`${options.loginPath}?error=auth_failed`, url.origin).toString(),
-			302,
-		)
+		queueAuthFailure(context, provider, 'token_exchange_failed')
+		return loginErrorResponse(request, url.origin, options.loginPath)
 	}
 
 	// Build redirect response
 	const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/'
-	const response = Response.redirect(new URL(redirectPath, url.origin).toString(), 302)
+	const redirect = new URL(redirectPath, url.origin).toString()
+	const response = wantsJson(request)
+		? Response.json({ ok: true, redirect })
+		: Response.redirect(redirect, 302)
 
 	// Mutable copy for setting cookies
 	const mutableResponse = new Response(response.body, {
@@ -89,16 +149,21 @@ export async function GET(context: CallbackContext): Promise<Response> {
 		}
 	}
 
-	// Emit analytics event (non-blocking)
+	// Emit analytics event (non-blocking). Register the promise via the
+	// Cloudflare execution context's `waitUntil` so the dynamic import of
+	// `@growth-labs/analytics/utils` and the downstream WAE + D1 writes
+	// survive past the 302 response. Without this, the Cloudflare runtime
+	// terminates the orphaned promise before the conversion event lands —
+	// the root cause of the missing `login_completed` / `signup_completed`
+	// rows in `gl_conversion_events` after the Fronts cutover.
 	if (analyticsAvailable(context)) {
-		const eventName = tokenResponse.isNewUser ? 'signup_completed' : 'login_completed'
-		const promise = emitAuthEvent(context, eventName, {
+		const promise = emitAuthSuccessEvent(context, {
 			provider: tokenResponse.provider,
 			isNewUser: tokenResponse.isNewUser,
-			auth_path: authPath,
-			identity_user_id: tokenResponse.claims.sub,
+			authPath,
+			identityUserId: tokenResponse.claims.sub,
 		})
-		context.waitUntil?.(promise)
+		resolveWaitUntil(context)(promise)
 	}
 
 	return mutableResponse

package/src/routes/flow.ts

@@ -5,6 +5,12 @@ import { createAuthFlow } from '../utils/openauth.js'
 export interface RouteContext {
 	request: Request
 	url: URL
+	locals?: {
+		cfContext?: {
+			waitUntil?: (promise: Promise<unknown>) => void
+		}
+	}
+	waitUntil?: (promise: Promise<unknown>) => void
 }
 
 export async function withAuthFlowCookies(

package/src/routes/logout.ts

@@ -8,10 +8,14 @@ import {
 	getCookie,
 } from '../utils/cookies.js'
 import { revokeToken } from '../utils/openauth.js'
+import { resolveWaitUntil } from '../utils/wait-until.js'
 
 interface LogoutContext {
 	request: Request
 	url: URL
+	// See callback.ts: Astro v6 + @astrojs/cloudflare@13 places the Worker
+	// execution context's `waitUntil` at `locals.cfContext.waitUntil`, not
+	// at the top level. `resolveWaitUntil` handles both shapes.
 	waitUntil?: (promise: Promise<unknown>) => void
 	locals?: Record<string, unknown>
 }
@@ -20,6 +24,7 @@ export async function GET(context: LogoutContext): Promise<Response> {
 	const options = getConfig()
 	const refreshToken = getCookie(context.request, `${options.cookiePrefix}_rt`)
 	const clientId = options.clientId || context.url.hostname
+	const waitUntil = resolveWaitUntil(context)
 
 	// Revoke at issuer (non-blocking)
 	if (refreshToken) {
@@ -27,7 +32,7 @@ export async function GET(context: LogoutContext): Promise<Response> {
 		const promise = clientSecret
 			? revokeToken(refreshToken, clientId, clientSecret)
 			: revokeToken(refreshToken, clientId)
-		context.waitUntil?.(promise)
+		waitUntil(promise)
 	}
 
 	// Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
@@ -37,7 +42,7 @@ export async function GET(context: LogoutContext): Promise<Response> {
 		const promise = emitAuthEvent(context, 'auth_logout', {
 			revoked: refreshToken ? 'true' : 'false',
 		})
-		context.waitUntil?.(promise)
+		waitUntil(promise)
 	}
 
 	// Build redirect response