@growth-labs/auth 0.7.3 → 0.7.5

package/README.md

@@ -114,9 +114,10 @@ consumers can also use it from custom server routes.
 
 ## Analytics Events
 
-When `@growth-labs/analytics@0.4.0` or newer is installed, the callback
-route emits `signup_completed` or `login_completed` through
-`trackServerEvent` from `@growth-labs/analytics/utils`. The payload is:
+When `@growth-labs/analytics@0.4.0` or newer is installed, successful
+callback and JSON verify routes emit `signup_completed` or
+`login_completed` through `trackServerEvent` from
+`@growth-labs/analytics/utils`. The payload is:
 
 ```ts
 {
@@ -132,6 +133,10 @@ can preserve the site's anonymous `visitor_id`, `session_id`, attribution
 cookies, and `gl_identity_links` row. The identity platform does not need
 to see site attribution cookies.
 
+Auth failures emit the operational event `auth_failed` with
+`provider`, `reason`, and `auth_path`. Failure payloads never include raw
+email addresses, passwords, magic codes, or reset tokens.
+
 ## Using `context.locals.user`
 
 ```typescript
@@ -184,9 +189,9 @@ internal package-test helper and is not exported from
 ## OAuth Flow Summary
 
 1. User clicks a provider on the local login page → browser hits `/login?provider=...` or a local branded `/password` / `/verify-code` route when that renderer is configured
-2. The local `/login` start route stores PKCE/state/redirect/provider cookies and redirects to `{issuer}/authorize?provider=...`; configured `resource` is sent as the RFC 8707 resource indicator. Consumer-hosted `/password`, `/verify-code`, and `/forgot-password` pages seed root-scoped flow cookies locally, with the PKCE cookie visible to their package-owned POST handlers. The forgot-password route does not set a provider cookie.
-3. For consumer-hosted password or magic-code flows, package-owned POST routes call `{issuerInternal ?? issuer}/api/v1/auth/*` and redirect to `/api/auth/callback?code=...&state=...`; native forms receive `303` redirects, while `Accept: application/json` callers receive `{ ok/error, redirect }`
-4. Issuer authenticates or issues a JSON authorization code → callback exchanges code at `{issuerInternal ?? issuer}/token` via PKCE, sends `Authorization: Basic base64(client_id:client_secret)` when `clientSecret` is configured, includes `resource`, reads `properties.isNewUser` from the JWT payload with fallback to top-level `isNewUser` for legacy issuers, uses the `{cookiePrefix}_provider` auth-flow cookie set at login start for provider attribution, sets session cookies, sets `gl_id` when `GL_IDENTITY_SECRET` is configured, and redirects to the original page
+2. The local `/login` start route stores PKCE/state/redirect/provider cookies and redirects to `{issuer}/authorize?provider=...`; configured `resource` is sent as the RFC 8707 resource indicator. Consumer-hosted `/password` and `/verify-code` pages seed `{cookiePrefix}_pkce` at both `/` and `callbackPath`: the root-path copy is visible to package-owned POST handlers and JSON verify flows, while the callback-path copy preserves native form handoff through the callback route. The forgot-password route seeds local flow cookies but does not set a provider cookie.
+3. For consumer-hosted password or magic-code flows, package-owned POST routes call `{issuerInternal ?? issuer}/api/v1/auth/*`; native forms receive `303` redirects through `/api/auth/callback?code=...&state=...`, while `Accept: application/json` verify callers exchange the code in-place, set session cookies, emit the success event, and receive `{ ok, redirect }` for the final destination.
+4. Issuer authenticates or issues a JSON authorization code → callback exchanges code at `{issuerInternal ?? issuer}/token` via PKCE, sends `Authorization: Basic base64(client_id:client_secret)` when `clientSecret` is configured, includes `resource`, reads `properties.isNewUser` from the JWT payload with fallback to top-level `isNewUser` for legacy issuers, uses the `{cookiePrefix}_provider` auth-flow cookie set at login start for provider attribution, sets session cookies, sets `gl_id` when `GL_IDENTITY_SECRET` is configured, emits success/failure analytics, and redirects to the original page or returns a JSON redirect contract for `Accept: application/json`.
 
 ## Signed Identity Cookie
 
@@ -196,7 +201,7 @@ internal package-test helper and is not exported from
 - Payload: lowercase hex `sha256(sub + GL_IDENTITY_SECRET)`, where `sub` is the access-token subject. The raw subject is never written into the cookie.
 - Secret: `GL_IDENTITY_SECRET`, a per-tenant 32-byte standard-base64 value
 - Attributes: `HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=2592000`
-- Issued: callback success after token exchange
+- Issued: callback success or JSON verify success after token exchange
 - Cleared: `/logout` with `Max-Age=0`
 
 Verification helper:
@@ -214,19 +219,19 @@ if (result.valid) {
 
 ## Analytics Integration
 
-Optional analytics helpers exist for `login_completed` / `signup_completed`,
-but the package does not currently guarantee WAE writes by itself. The
-event name is derived from the access-token JWT `isNewUser` claim,
-preferring `payload.properties.isNewUser` and falling back to top-level
-`payload.isNewUser` for legacy issuers. Consumers that need dashboard
-events should use the public analytics client/server contract available
-in their app.
+Optional analytics helpers exist for `login_completed`,
+`signup_completed`, and `auth_failed`. The success event name is derived
+from the access-token JWT `isNewUser` claim, preferring
+`payload.properties.isNewUser` and falling back to top-level
+`payload.isNewUser` for legacy issuers. The package uses the public
+`@growth-labs/analytics/utils.trackServerEvent` contract when the optional
+analytics peer is installed.
 
 ## Key Patterns
 
 - Virtual module: `virtual:growth-labs/auth/config` (slash, not hyphen)
 - Cookie names: `{cookiePrefix}_at`, `{cookiePrefix}_rt`, `{cookiePrefix}_pkce`, `{cookiePrefix}_state`, `{cookiePrefix}_redirect`, `{cookiePrefix}_provider`, `gl_id`
-- PKCE flow with `code_verifier` / `code_challenge` (S256); `{cookiePrefix}_pkce` is scoped to `callbackPath` for issuer redirect flows and to `/` for consumer-hosted password/code/forgot flows that post before callback
+- PKCE flow with `code_verifier` / `code_challenge` (S256); `{cookiePrefix}_pkce` is scoped to `callbackPath` for issuer redirect flows and set at both `/` and `callbackPath` for consumer-hosted password/code flows that can either post JSON in-place or hand off to callback
 - `issuer` is browser-facing; optional `issuerInternal` is used for token exchange, silent refresh, JWT verification/JWKS lookup, and revocation. If omitted, `issuerInternal` falls back to `issuer`.
 - Confidential OAuth clients use `client_secret_basic` on token exchange and refresh when `clientSecret` is configured. Prefer a Worker secret binding name such as `AUTH_CLIENT_SECRET`; runtime code resolves that binding before calling the issuer.
 - RFC 8707 `resource` is sent on authorize, token exchange, and refresh when configured

package/dist/routes/api/code-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBnE"}
+{"version":3,"file":"code-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuBnE"}

package/dist/routes/api/code-request.js

@@ -11,6 +11,6 @@ export async function POST(context) {
     const email = await readFormString(form, 'email');
     const redirect = form.get('redirect')?.toString();
     const result = await authClient(context).code.request({ email });
-    return statusRedirect(context, result, options.verifyCodePath, { email, sent: '1', redirect }, options.verifyCodePath, { email, redirect });
+    return statusRedirect(context, result, options.verifyCodePath, { email, sent: '1', redirect }, options.verifyCodePath, { email, redirect }, 'email-code');
 }
 //# sourceMappingURL=code-request.js.map

package/dist/routes/api/code-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"code-request.js","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhE,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,cAAc,EACtB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC9B,OAAO,CAAC,cAAc,EACtB,EAAE,KAAK,EAAE,QAAQ,EAAE,CACnB,CAAA;AACF,CAAC"}
+{"version":3,"file":"code-request.js","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhE,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,cAAc,EACtB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC9B,OAAO,CAAC,cAAc,EACtB,EAAE,KAAK,EAAE,QAAQ,EAAE,EACnB,YAAY,CACZ,CAAA;AACF,CAAC"}

package/dist/routes/api/password-reset-confirm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-confirm.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyBnE"}
+{"version":3,"file":"password-reset-confirm.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0BnE"}

package/dist/routes/api/password-reset-confirm.js

@@ -14,6 +14,6 @@ export async function POST(context) {
         token,
         newPassword: password,
     });
-    return statusRedirect(context, result, options.loginPath, { reset: 'success' }, options.resetPasswordPath, { token });
+    return statusRedirect(context, result, options.loginPath, { reset: 'success' }, options.resetPasswordPath, { token }, 'password');
 }
 //# sourceMappingURL=password-reset-confirm.js.map

package/dist/routes/api/password-reset-confirm.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-confirm.js","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/D,KAAK;QACL,WAAW,EAAE,QAAQ;KACrB,CAAC,CAAA;IAEF,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,OAAO,CAAC,iBAAiB,EACzB,EAAE,KAAK,EAAE,CACT,CAAA;AACF,CAAC"}
+{"version":3,"file":"password-reset-confirm.js","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/D,KAAK;QACL,WAAW,EAAE,QAAQ;KACrB,CAAC,CAAA;IAEF,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,OAAO,CAAC,iBAAiB,EACzB,EAAE,KAAK,EAAE,EACT,UAAU,CACV,CAAA;AACF,CAAC"}

package/dist/routes/api/password-reset-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqBnE"}
+{"version":3,"file":"password-reset-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBnE"}

package/dist/routes/api/password-reset-request.js

@@ -10,6 +10,6 @@ export async function POST(context) {
     const form = await readForm(context);
     const email = await readFormString(form, 'email');
     const result = await authClient(context).password.reset.request({ email });
-    return statusRedirect(context, result, options.forgotPasswordPath, { sent: '1' }, options.forgotPasswordPath, { email });
+    return statusRedirect(context, result, options.forgotPasswordPath, { sent: '1' }, options.forgotPasswordPath, { email }, 'password');
 }
 //# sourceMappingURL=password-reset-request.js.map

package/dist/routes/api/password-reset-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-request.js","sourceRoot":"","sources":["../../../src/routes/api/password-reset-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1E,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,kBAAkB,EAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,OAAO,CAAC,kBAAkB,EAC1B,EAAE,KAAK,EAAE,CACT,CAAA;AACF,CAAC"}
+{"version":3,"file":"password-reset-request.js","sourceRoot":"","sources":["../../../src/routes/api/password-reset-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1E,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,kBAAkB,EAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,OAAO,CAAC,kBAAkB,EAC1B,EAAE,KAAK,EAAE,EACT,UAAU,CACV,CAAA;AACF,CAAC"}

package/dist/routes/api/shared.d.ts

@@ -1,12 +1,13 @@
 import { getConfig } from '../../config-store.js';
 import { type AuthClientCodeResult, type AuthClientOkResult, authClient } from '../../server.js';
+import { type AuthAnalyticsProvider } from '../../utils/analytics.js';
 import { type RouteContext, readForm, redirectTo } from '../flow.js';
 export declare function readFormString(form: FormData, key: string, options?: {
     trim?: boolean;
 }): Promise<string>;
 export declare function rejectCrossSitePost(context: RouteContext): Response | null;
-export declare function callbackRedirect(context: RouteContext, result: AuthClientCodeResult, errorPath: string, errorParams: Record<string, string | undefined>, provider?: 'password' | 'email-code'): Response;
-export declare function statusRedirect(context: RouteContext, result: AuthClientOkResult, successPath: string, successParams: Record<string, string | undefined>, errorPath: string, errorParams: Record<string, string | undefined>): Response;
+export declare function callbackRedirect(context: RouteContext, result: AuthClientCodeResult, errorPath: string, errorParams: Record<string, string | undefined>, provider?: 'password' | 'email-code'): Promise<Response> | Response;
+export declare function statusRedirect(context: RouteContext, result: AuthClientOkResult, successPath: string, successParams: Record<string, string | undefined>, errorPath: string, errorParams: Record<string, string | undefined>, provider?: AuthAnalyticsProvider): Response;
 export type { RouteContext };
 export { authClient, getConfig, readForm, redirectTo };
 //# sourceMappingURL=shared.d.ts.map

package/dist/routes/api/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/routes/api/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEhG,OAAO,EAAE,KAAK,YAAY,EAAE,QAAQ,EAAoB,UAAU,EAAE,MAAM,YAAY,CAAA;AAItF,wBAAsB,cAAc,CACnC,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,QAAQ,GAAG,IAAI,CAe1E;AAED,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,GAClC,QAAQ,CAgCV;AAED,wBAAgB,cAAc,CAC7B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,kBAAkB,EAC1B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAC7C,QAAQ,CAKV;AAyBD,YAAY,EAAE,YAAY,EAAE,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/routes/api/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChG,OAAO,EACN,KAAK,qBAAqB,EAI1B,MAAM,0BAA0B,CAAA;AAWjC,OAAO,EAAE,KAAK,YAAY,EAAE,QAAQ,EAAoB,UAAU,EAAE,MAAM,YAAY,CAAA;AAItF,wBAAsB,cAAc,CACnC,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,QAAQ,GAAG,IAAI,CAe1E;AAED,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,GAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAsC9B;AAED,wBAAgB,cAAc,CAC7B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,kBAAkB,EAC1B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,QAAQ,CAAC,EAAE,qBAAqB,GAC9B,QAAQ,CAMV;AAyBD,YAAY,EAAE,YAAY,EAAE,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA"}

package/dist/routes/api/shared.js

@@ -1,6 +1,11 @@
 import { getConfig } from '../../config-store.js';
+import { getRuntimeEnv } from '../../runtime.js';
 import { authClient } from '../../server.js';
-import { getCookie, setCookie } from '../../utils/cookies.js';
+import { analyticsAvailable, emitAuthFailureEvent, emitAuthSuccessEvent, } from '../../utils/analytics.js';
+import { clearAuthFlowCookies, getCookie, setCookie, setIdentityCookie, setTokenCookies, } from '../../utils/cookies.js';
+import { createIdentityCookiePayload, signIdentityCookie } from '../../utils/identity-cookie.js';
+import { exchangeCode } from '../../utils/openauth.js';
+import { resolveWaitUntil } from '../../utils/wait-until.js';
 import { readForm, redirectLocation, redirectTo } from '../flow.js';
 const CROSS_SITE_POST_MESSAGE = 'Cross-site POST form submissions are forbidden';
 export async function readFormString(form, key, options = {}) {
@@ -24,13 +29,18 @@ export function rejectCrossSitePost(context) {
 }
 export function callbackRedirect(context, result, errorPath, errorParams, provider) {
     if ('error' in result) {
+        queueAuthFailure(context, provider, result.error);
         return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error);
     }
     const options = getConfig();
     const state = getCookie(context.request, `${options.cookiePrefix}_state`);
     if (!state) {
+        queueAuthFailure(context, provider, 'missing_auth_flow');
         return routeResult(context, errorPath, { ...errorParams, error: 'missing_auth_flow' }, 'missing_auth_flow');
     }
+    if (wantsJson(context)) {
+        return completeJsonAuth(context, result.code, errorPath, errorParams, provider);
+    }
     const response = mutableHeaders(routeResult(context, options.callbackPath, {
         code: result.code,
         state,
@@ -41,8 +51,9 @@ export function callbackRedirect(context, result, errorPath, errorParams, provid
     }
     return response;
 }
-export function statusRedirect(context, result, successPath, successParams, errorPath, errorParams) {
+export function statusRedirect(context, result, successPath, successParams, errorPath, errorParams, provider) {
     if ('error' in result) {
+        queueAuthFailure(context, provider, result.error);
         return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error);
     }
     return routeResult(context, successPath, successParams);
@@ -70,6 +81,54 @@ function mutableHeaders(response) {
         headers: new Headers(response.headers),
     });
 }
+async function completeJsonAuth(context, code, errorPath, errorParams, provider) {
+    const options = getConfig();
+    const codeVerifier = getCookie(context.request, `${options.cookiePrefix}_pkce`);
+    if (!codeVerifier) {
+        queueAuthFailure(context, provider, 'missing_auth_flow');
+        return routeResult(context, errorPath, { ...errorParams, error: 'missing_auth_flow' }, 'missing_auth_flow');
+    }
+    const tokenResponse = await exchangeCode(context.url, code, codeVerifier, provider);
+    if (!tokenResponse) {
+        queueAuthFailure(context, provider, 'token_exchange_failed');
+        return routeResult(context, errorPath, { ...errorParams, error: 'auth_failed' }, 'auth_failed');
+    }
+    const redirectPath = getCookie(context.request, `${options.cookiePrefix}_redirect`) || '/';
+    const redirect = new URL(redirectPath, context.url.origin).toString();
+    const response = mutableHeaders(Response.json({ ok: true, redirect }));
+    setTokenCookies(response, options, tokenResponse.accessToken, tokenResponse.refreshToken);
+    clearAuthFlowCookies(response, options);
+    await setOptionalIdentityCookie(response, tokenResponse.claims.sub);
+    if (analyticsAvailable(context)) {
+        resolveWaitUntil(context)(emitAuthSuccessEvent(context, {
+            provider: tokenResponse.provider,
+            isNewUser: tokenResponse.isNewUser,
+            authPath: context.url.pathname,
+            identityUserId: tokenResponse.claims.sub,
+        }));
+    }
+    return response;
+}
+function queueAuthFailure(context, provider, reason) {
+    if (!analyticsAvailable(context))
+        return;
+    resolveWaitUntil(context)(emitAuthFailureEvent(context, {
+        provider,
+        reason,
+        authPath: context.url.pathname,
+    }));
+}
+async function setOptionalIdentityCookie(response, subject) {
+    const secret = getRuntimeEnv().GL_IDENTITY_SECRET;
+    if (typeof secret !== 'string' || !secret)
+        return;
+    try {
+        setIdentityCookie(response, await signIdentityCookie(await createIdentityCookiePayload(subject, secret), secret));
+    }
+    catch {
+        // Keep login working if the optional analytics identity secret is misconfigured.
+    }
+}
 function authFlowCookieAttrs() {
     return {
         path: '/',

package/dist/routes/api/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/routes/api/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAsD,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAqB,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEtF,MAAM,uBAAuB,GAAG,gDAAgD,CAAA;AAEhF,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,IAAc,EACd,GAAW,EACX,UAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC7C,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACnD,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,OAAqB,EACrB,MAA4B,EAC5B,SAAiB,EACjB,WAA+C,EAC/C,QAAoC;IAEpC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,WAAW,CACjB,OAAO,EACP,SAAS,EACT,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9C,mBAAmB,CACnB,CAAA;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAC9B,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAC1C,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK;KACL,CAAC,CACF,CAAA;IACD,SAAS,CACR,QAAQ,EACR,GAAG,OAAO,CAAC,YAAY,YAAY,EACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EACpB,mBAAmB,EAAE,CACrB,CAAA;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,OAAqB,EACrB,MAA0B,EAC1B,WAAmB,EACnB,aAAiD,EACjD,SAAiB,EACjB,WAA+C;IAE/C,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC1D,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,WAAW,CACnB,OAAqB,EACrB,QAAgB,EAChB,MAA0C,EAC1C,KAAc;IAEd,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC9F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;KACzB,CAAC,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AAEtD,SAAS,cAAc,CAAC,QAAkB;IACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB;IAC3B,OAAO;QACN,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,GAAG;KACX,CAAA;AACF,CAAC"}
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/routes/api/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAsD,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChG,OAAO,EAEN,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAqB,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEtF,MAAM,uBAAuB,GAAG,gDAAgD,CAAA;AAEhF,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,IAAc,EACd,GAAW,EACX,UAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC7C,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACnD,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,OAAqB,EACrB,MAA4B,EAC5B,SAAiB,EACjB,WAA+C,EAC/C,QAAoC;IAEpC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACjD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACxD,OAAO,WAAW,CACjB,OAAO,EACP,SAAS,EACT,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9C,mBAAmB,CACnB,CAAA;IACF,CAAC;IAED,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAC9B,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAC1C,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK;KACL,CAAC,CACF,CAAA;IACD,SAAS,CACR,QAAQ,EACR,GAAG,OAAO,CAAC,YAAY,YAAY,EACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EACpB,mBAAmB,EAAE,CACrB,CAAA;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,OAAqB,EACrB,MAA0B,EAC1B,WAAmB,EACnB,aAAiD,EACjD,SAAiB,EACjB,WAA+C,EAC/C,QAAgC;IAEhC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACjD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC1D,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,WAAW,CACnB,OAAqB,EACrB,QAAgB,EAChB,MAA0C,EAC1C,KAAc;IAEd,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC9F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;KACzB,CAAC,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AAEtD,SAAS,cAAc,CAAC,QAAkB;IACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,IAAY,EACZ,SAAiB,EACjB,WAA+C,EAC/C,QAAoC;IAEpC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAC/E,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACxD,OAAO,WAAW,CACjB,OAAO,EACP,SAAS,EACT,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9C,mBAAmB,CACnB,CAAA;IACF,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IACnF,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;QAC5D,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,aAAa,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAC1F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IACrE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IAEtE,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IACzF,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvC,MAAM,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACnE,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,OAAO,CAAC,CACxB,oBAAoB,CAAC,OAAO,EAAE;YAC7B,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;YAC9B,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;SACxC,CAAC,CACF,CAAA;IACF,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,gBAAgB,CACxB,OAAqB,EACrB,QAA2C,EAC3C,MAAc;IAEd,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAM;IACxC,gBAAgB,CAAC,OAAO,CAAC,CACxB,oBAAoB,CAAC,OAAO,EAAE;QAC7B,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CACF,CAAA;AACF,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,QAAkB,EAAE,OAAe;IAC3E,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAM;IACjD,IAAI,CAAC;QACJ,iBAAiB,CAChB,QAAQ,EACR,MAAM,kBAAkB,CAAC,MAAM,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CACpF,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,iFAAiF;IAClF,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB;IAC3B,OAAO;QACN,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,GAAG;KACX,CAAA;AACF,CAAC"}

package/dist/routes/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAcA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAKhC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAOD,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqFrE"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAkBA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAKhC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAoCD,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0GrE"}

package/dist/routes/callback.js

@@ -1,6 +1,6 @@
 import { getConfig } from '../config-store.js';
 import { getRuntimeEnv } from '../runtime.js';
-import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js';
+import { analyticsAvailable, emitAuthFailureEvent, emitAuthSuccessEvent, } from '../utils/analytics.js';
 import { clearAuthFlowCookies, getCookie, setIdentityCookie, setTokenCookies, } from '../utils/cookies.js';
 import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js';
 import { exchangeCode } from '../utils/openauth.js';
@@ -10,33 +10,71 @@ function getIdentitySecret() {
     const secret = getRuntimeEnv().GL_IDENTITY_SECRET;
     return typeof secret === 'string' && secret.length > 0 ? secret : null;
 }
+function wantsJson(request) {
+    const accept = request.headers.get('accept') ?? '';
+    return accept
+        .split(',')
+        .some((value) => value.trim().toLowerCase().split(';')[0] === 'application/json');
+}
+function loginErrorResponse(request, origin, loginPath) {
+    const redirect = new URL(`${loginPath}?error=auth_failed`, origin).toString();
+    if (wantsJson(request)) {
+        return Response.json({ error: 'auth_failed', redirect }, { status: 400 });
+    }
+    return Response.redirect(redirect, 302);
+}
+function queueAuthFailure(context, provider, reason) {
+    if (!analyticsAvailable(context))
+        return;
+    const promise = emitAuthFailureEvent(context, {
+        provider,
+        reason,
+        authPath: context.url.pathname,
+    });
+    resolveWaitUntil(context)(promise);
+}
 export async function GET(context) {
     const options = getConfig();
     const { url, request } = context;
     const code = url.searchParams.get('code');
     const state = url.searchParams.get('state');
+    const error = url.searchParams.get('error');
     // Verify CSRF state
     const storedState = getCookie(request, `${options.cookiePrefix}_state`);
     if (!state || !storedState || !verifyState(state, storedState)) {
+        queueAuthFailure(context, getCookie(request, `${options.cookiePrefix}_provider`), 'missing_auth_flow');
         return new Response('Invalid state parameter', { status: 403 });
     }
     // Read PKCE verifier
     const codeVerifier = getCookie(request, `${options.cookiePrefix}_pkce`);
     if (!codeVerifier) {
+        queueAuthFailure(context, getCookie(request, `${options.cookiePrefix}_provider`), 'missing_auth_flow');
         return new Response('Missing PKCE verifier', { status: 400 });
     }
     const provider = getCookie(request, `${options.cookiePrefix}_provider`);
     const authPath = getCookie(request, `${options.cookiePrefix}_auth_path`) || url.pathname;
+    if (error) {
+        queueAuthFailure(context, provider, error);
+        return loginErrorResponse(request, url.origin, options.loginPath);
+    }
+    if (!code) {
+        queueAuthFailure(context, provider, 'invalid_request');
+        return loginErrorResponse(request, url.origin, options.loginPath);
+    }
     // Exchange code for tokens
     const tokenResponse = await exchangeCode(url, code, codeVerifier, provider === 'google' || provider === 'password' || provider === 'email-code'
         ? provider
         : undefined);
     if (!tokenResponse) {
-        return Response.redirect(new URL(`${options.loginPath}?error=auth_failed`, url.origin).toString(), 302);
+        queueAuthFailure(context, provider, 'token_exchange_failed');
+        return loginErrorResponse(request, url.origin, options.loginPath);
     }
     // Build redirect response
     const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/';
-    const response = Response.redirect(new URL(redirectPath, url.origin).toString(), 302);
+    const redirect = new URL(redirectPath, url.origin).toString();
+    const response = wantsJson(request)
+        ? Response.json({ ok: true, redirect })
+        : Response.redirect(redirect, 302);
     // Mutable copy for setting cookies
     const mutableResponse = new Response(response.body, {
         status: response.status,
@@ -62,12 +100,11 @@ export async function GET(context) {
     // the root cause of the missing `login_completed` / `signup_completed`
     // rows in `gl_conversion_events` after the Fronts cutover.
     if (analyticsAvailable(context)) {
-        const eventName = tokenResponse.isNewUser ? 'signup_completed' : 'login_completed';
-        const promise = emitAuthEvent(context, eventName, {
+        const promise = emitAuthSuccessEvent(context, {
             provider: tokenResponse.provider,
             isNewUser: tokenResponse.isNewUser,
-            auth_path: authPath,
-            identity_user_id: tokenResponse.claims.sub,
+            authPath,
+            identityUserId: tokenResponse.claims.sub,
         });
         resolveWaitUntil(context)(promise);
     }

package/dist/routes/callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAazD,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAA;IAExF,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CACvC,GAAG,EACH,IAAK,EACL,YAAY,EACZ,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,YAAY;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,CACZ,CAAA;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,QAAQ,CACvB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EACxE,GAAG,CACH,CAAA;IACF,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IAErF,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC9C,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;IAC1C,IAAI,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC;YACJ,iBAAiB,CAChB,eAAe,EACf,MAAM,kBAAkB,CACvB,MAAM,2BAA2B,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,EAC3E,cAAc,CACd,CACD,CAAA;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iFAAiF;QAClF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QAClF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;YACjD,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;SAC1C,CAAC,CAAA;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EACN,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAazD,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClD,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,MAAc,EAAE,SAAiB;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,oBAAoB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7E,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,gBAAgB,CACxB,OAAwB,EACxB,QAAuB,EACvB,MAAqB;IAErB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAM;IACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;QAC7C,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CAAA;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAA;IAExF,IAAI,KAAK,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;QACtD,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CACvC,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,YAAY;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,CACZ,CAAA;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;QAC5D,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAEnC,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC9C,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;IAC1C,IAAI,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC;YACJ,iBAAiB,CAChB,eAAe,EACf,MAAM,kBAAkB,CACvB,MAAM,2BAA2B,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,EAC3E,cAAc,CACd,CACD,CAAA;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iFAAiF;QAClF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;YAC7C,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,QAAQ;YACR,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;SACxC,CAAC,CAAA;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/routes/flow.d.ts

@@ -2,6 +2,12 @@ import type { ResolvedAuthOptions } from '../options.js';
 export interface RouteContext {
     request: Request;
     url: URL;
+    locals?: {
+        cfContext?: {
+            waitUntil?: (promise: Promise<unknown>) => void;
+        };
+    };
+    waitUntil?: (promise: Promise<unknown>) => void;
 }
 export declare function withAuthFlowCookies(context: RouteContext, options: ResolvedAuthOptions, response: Response, redirectPath: string, provider?: string): Promise<Response>;
 export declare function redirectLocation(context: RouteContext, pathname: string, params: Record<string, string | undefined>): string;

package/dist/routes/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/routes/flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAIxD,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CAYnB;AAED,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACxC,MAAM,CAMR;AAED,wBAAgB,UAAU,CACzB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC1C,MAAM,SAAM,GACV,QAAQ,CAEV;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEvE"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/routes/flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAIxD,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,CAAC,EAAE;QACR,SAAS,CAAC,EAAE;YACX,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;SAC/C,CAAA;KACD,CAAA;IACD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CAYnB;AAED,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACxC,MAAM,CAMR;AAED,wBAAgB,UAAU,CACzB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC1C,MAAM,SAAM,GACV,QAAQ,CAEV;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEvE"}

package/dist/routes/flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/routes/flow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAOrD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,OAA4B,EAC5B,QAAkB,EAClB,YAAoB,EACpB,QAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IACF,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC/F,QAAQ,EAAE,GAAG;QACb,mBAAmB,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;KAC3C,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,OAAqB,EACrB,QAAgB,EAChB,MAA0C;IAE1C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,UAAU,CACzB,OAAqB,EACrB,QAAgB,EAChB,MAA0C,EAC1C,MAAM,GAAG,GAAG;IAEZ,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAA;AAClC,CAAC"}
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/routes/flow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAarD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,OAA4B,EAC5B,QAAkB,EAClB,YAAoB,EACpB,QAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IACF,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC/F,QAAQ,EAAE,GAAG;QACb,mBAAmB,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;KAC3C,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,OAAqB,EACrB,QAAgB,EAChB,MAA0C;IAE1C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,UAAU,CACzB,OAAqB,EACrB,QAAgB,EAChB,MAA0C,EAC1C,MAAM,GAAG,GAAG;IAEZ,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAA;AAClC,CAAC"}

package/dist/utils/analytics.d.ts

@@ -1,4 +1,21 @@
+export type AuthAnalyticsProvider = 'google' | 'email-code' | 'password' | 'unknown';
+export interface AuthSuccessEventInput {
+    provider: AuthAnalyticsProvider | string | null | undefined;
+    isNewUser: boolean;
+    authPath: string;
+    identityUserId: string;
+}
+export interface AuthFailureEventInput {
+    provider: AuthAnalyticsProvider | string | null | undefined;
+    reason: string | null | undefined;
+    authPath: string;
+}
 export declare function emitAuthEvent(context: unknown, eventName: string, data: Record<string, unknown>): Promise<void>;
+export declare function normalizeAuthProvider(provider: AuthAnalyticsProvider | string | null | undefined): AuthAnalyticsProvider;
+export declare function normalizeAuthFailureReason(reason: string | null | undefined): string;
+export declare function authSuccessEventName(isNewUser: boolean): 'signup_completed' | 'login_completed';
+export declare function emitAuthSuccessEvent(context: unknown, input: AuthSuccessEventInput): Promise<void>;
+export declare function emitAuthFailureEvent(context: unknown, input: AuthFailureEventInput): Promise<void>;
 export declare function analyticsAvailable(context: {
     locals?: Record<string, unknown>;
 }): boolean;

package/dist/utils/analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AA6BA,wBAAsB,aAAa,CAClC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,OAAO,CAGzF;AAED,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,eAAe,IAAI,IAAI,CAGtC"}
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,CAAA;AAEpF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3D,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3D,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;CAChB;AAiBD,wBAAsB,aAAa,CAClC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAgB,qBAAqB,CACpC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACzD,qBAAqB,CAEvB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGpF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,kBAAkB,GAAG,iBAAiB,CAE/F;AAED,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,OAAO,CAGzF;AAED,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,OAAO,CAAC,IAAI,CAAC,CAEf;AAKD,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/utils/analytics.js

@@ -1,35 +1,53 @@
-let trackFn = null;
-let resolved = false;
-const ANALYTICS_UTILS_MODULE = '@growth-labs/analytics/utils';
-async function importOptionalModule(modulePath) {
-    try {
-        return (await import(/* @vite-ignore */ modulePath));
-    }
-    catch {
-        return null;
-    }
-}
-async function resolveAnalytics() {
-    if (resolved)
-        return;
-    resolved = true;
-    const mod = await importOptionalModule(ANALYTICS_UTILS_MODULE);
-    let candidate;
-    try {
-        candidate = mod?.trackServerEvent;
-    }
-    catch {
-        candidate = undefined;
-    }
-    if (typeof candidate === 'function') {
-        trackFn = candidate;
-    }
-}
+import { trackServerEvent } from '@growth-labs/analytics/utils';
+const AUTH_PROVIDERS = new Set(['google', 'email-code', 'password']);
+const AUTH_FAILURE_REASONS = new Set([
+    'auth_failed',
+    'invalid_credentials',
+    'invalid_code',
+    'invalid_request',
+    'invalid_response',
+    'invalid_token',
+    'missing_auth_flow',
+    'oauth_denied',
+    'request_failed',
+    'send_failed',
+    'token_exchange_failed',
+]);
 export async function emitAuthEvent(context, eventName, data) {
-    await resolveAnalytics();
-    if (!trackFn)
-        return;
-    return trackFn(context, eventName, data);
+    // Bind via static import so wrangler/esbuild bundles the target at build
+    // time. The previous variable-path dynamic import (await import(modulePath))
+    // could not be statically analyzed; in Cloudflare Workers the bundle did
+    // not include @growth-labs/analytics/utils, the runtime resolved null, and
+    // every auth event silently no-op'd — surfaced post-2026-05-22 as
+    // `signup_completed` / `login_completed` rows never landing in
+    // gl_conversion_events on the new Fronts Worker. See peerDependency.
+    await trackServerEvent(context, eventName, data);
+}
+export function normalizeAuthProvider(provider) {
+    return provider && AUTH_PROVIDERS.has(provider) ? provider : 'unknown';
+}
+export function normalizeAuthFailureReason(reason) {
+    if (reason === 'access_denied')
+        return 'oauth_denied';
+    return reason && AUTH_FAILURE_REASONS.has(reason) ? reason : 'auth_failed';
+}
+export function authSuccessEventName(isNewUser) {
+    return isNewUser ? 'signup_completed' : 'login_completed';
+}
+export async function emitAuthSuccessEvent(context, input) {
+    return emitAuthEvent(context, authSuccessEventName(input.isNewUser), {
+        provider: normalizeAuthProvider(input.provider),
+        isNewUser: input.isNewUser,
+        auth_path: input.authPath,
+        identity_user_id: input.identityUserId,
+    });
+}
+export async function emitAuthFailureEvent(context, input) {
+    return emitAuthEvent(context, 'auth_failed', {
+        provider: normalizeAuthProvider(input.provider),
+        reason: normalizeAuthFailureReason(input.reason),
+        auth_path: input.authPath,
+    });
 }
 export function analyticsAvailable(context) {
     void context;
@@ -38,8 +56,10 @@ export function analyticsAvailable(context) {
 export async function trackAuthEvent(context, eventName, data = {}) {
     return emitAuthEvent(context, eventName, data);
 }
+// Test-only export retained for compatibility with existing tests that reset
+// internal state between runs. Now a no-op since there's no internal state
+// to reset — trackFn is the bound static import.
 export function _resetAnalytics() {
-    trackFn = null;
-    resolved = false;
+    // noop
 }
 //# sourceMappingURL=analytics.js.map

package/dist/utils/analytics.js.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAEA,IAAI,OAAO,GAAmB,IAAI,CAAA;AAClC,IAAI,QAAQ,GAAG,KAAK,CAAA;AACpB,MAAM,sBAAsB,GAAG,8BAA8B,CAAA;AAE7D,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAA4B,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC9B,IAAI,QAAQ;QAAE,OAAM;IACpB,QAAQ,GAAG,IAAI,CAAA;IACf,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;IAC9D,IAAI,SAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,SAAS,GAAG,GAAG,EAAE,gBAAgB,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,SAAS,GAAG,SAAS,CAAA;IACtB,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,GAAG,SAAoB,CAAA;IAC/B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAgB,EAChB,SAAiB,EACjB,IAA6B;IAE7B,MAAM,gBAAgB,EAAE,CAAA;IACxB,IAAI,CAAC,OAAO;QAAE,OAAM;IACpB,OAAO,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6C;IAC/E,KAAK,OAAO,CAAA;IACZ,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgB,EAChB,SAAiB,EACjB,OAAgC,EAAE;IAElC,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,GAAG,IAAI,CAAA;IACd,QAAQ,GAAG,KAAK,CAAA;AACjB,CAAC"}
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAiB/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAA;AACpE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,aAAa;IACb,qBAAqB;IACrB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,uBAAuB;CACvB,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAgB,EAChB,SAAiB,EACjB,IAA6B;IAE7B,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,+DAA+D;IAC/D,qEAAqE;IACrE,MAAM,gBAAgB,CAAC,OAAiD,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AAC3F,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,QAA2D;IAE3D,OAAO,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAkC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC3E,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,cAAc,CAAA;IACrD,OAAO,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAkB;IACtD,OAAO,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAgB,EAChB,KAA4B;IAE5B,OAAO,aAAa,CAAC,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QACpE,QAAQ,EAAE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,gBAAgB,EAAE,KAAK,CAAC,cAAc;KACtC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAgB,EAChB,KAA4B;IAE5B,OAAO,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;QAC5C,QAAQ,EAAE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,EAAE,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC;QAChD,SAAS,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6C;IAC/E,KAAK,OAAO,CAAA;IACZ,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgB,EAChB,SAAiB,EACjB,OAAgC,EAAE;IAElC,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,iDAAiD;AACjD,MAAM,UAAU,eAAe;IAC9B,OAAO;AACR,CAAC"}

package/dist/utils/index.d.ts

@@ -1,4 +1,4 @@
-export { emitAuthEvent, trackAuthEvent } from './analytics.js';
+export { type AuthAnalyticsProvider, type AuthFailureEventInput, type AuthSuccessEventInput, authSuccessEventName, emitAuthEvent, emitAuthFailureEvent, emitAuthSuccessEvent, normalizeAuthFailureReason, normalizeAuthProvider, trackAuthEvent, } from './analytics.js';
 export { type BridgeMigrationOptions, type BridgeMigrationStatement, buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
 export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/utils/index.js

@@ -1,4 +1,4 @@
-export { emitAuthEvent, trackAuthEvent } from './analytics.js';
+export { authSuccessEventName, emitAuthEvent, emitAuthFailureEvent, emitAuthSuccessEvent, normalizeAuthFailureReason, normalizeAuthProvider, trackAuthEvent, } from './analytics.js';
 export { buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
 export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/auth",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -46,12 +46,7 @@
   },
   "peerDependencies": {
     "astro": "^6.1.10",
-    "@growth-labs/analytics": ">=0.4.0"
-  },
-  "peerDependenciesMeta": {
-    "@growth-labs/analytics": {
-      "optional": true
-    }
+    "@growth-labs/analytics": ">=0.5.1"
   },
   "dependencies": {
     "zod": "^3.23.0",
@@ -62,7 +57,7 @@
     "typescript": "^5.8.0",
     "vite": "^7.3.2",
     "vitest": "^3.0.0",
-    "@growth-labs/analytics": "0.5.0"
+    "@growth-labs/analytics": "0.5.1"
   },
   "scripts": {
     "build": "tsc",

package/src/routes/api/code-request.ts

@@ -29,5 +29,6 @@ export async function POST(context: RouteContext): Promise<Response> {
 		{ email, sent: '1', redirect },
 		options.verifyCodePath,
 		{ email, redirect },
+		'email-code',
 	)
 }

package/src/routes/api/password-reset-confirm.ts

@@ -32,5 +32,6 @@ export async function POST(context: RouteContext): Promise<Response> {
 		{ reset: 'success' },
 		options.resetPasswordPath,
 		{ token },
+		'password',
 	)
 }

package/src/routes/api/password-reset-request.ts

@@ -28,5 +28,6 @@ export async function POST(context: RouteContext): Promise<Response> {
 		{ sent: '1' },
 		options.forgotPasswordPath,
 		{ email },
+		'password',
 	)
 }

package/src/routes/api/shared.ts

@@ -1,6 +1,22 @@
 import { getConfig } from '../../config-store.js'
+import { getRuntimeEnv } from '../../runtime.js'
 import { type AuthClientCodeResult, type AuthClientOkResult, authClient } from '../../server.js'
-import { getCookie, setCookie } from '../../utils/cookies.js'
+import {
+	type AuthAnalyticsProvider,
+	analyticsAvailable,
+	emitAuthFailureEvent,
+	emitAuthSuccessEvent,
+} from '../../utils/analytics.js'
+import {
+	clearAuthFlowCookies,
+	getCookie,
+	setCookie,
+	setIdentityCookie,
+	setTokenCookies,
+} from '../../utils/cookies.js'
+import { createIdentityCookiePayload, signIdentityCookie } from '../../utils/identity-cookie.js'
+import { exchangeCode } from '../../utils/openauth.js'
+import { resolveWaitUntil } from '../../utils/wait-until.js'
 import { type RouteContext, readForm, redirectLocation, redirectTo } from '../flow.js'
 
 const CROSS_SITE_POST_MESSAGE = 'Cross-site POST form submissions are forbidden'
@@ -37,14 +53,16 @@ export function callbackRedirect(
 	errorPath: string,
 	errorParams: Record<string, string | undefined>,
 	provider?: 'password' | 'email-code',
-): Response {
+): Promise<Response> | Response {
 	if ('error' in result) {
+		queueAuthFailure(context, provider, result.error)
 		return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error)
 	}
 
 	const options = getConfig()
 	const state = getCookie(context.request, `${options.cookiePrefix}_state`)
 	if (!state) {
+		queueAuthFailure(context, provider, 'missing_auth_flow')
 		return routeResult(
 			context,
 			errorPath,
@@ -53,6 +71,10 @@ export function callbackRedirect(
 		)
 	}
 
+	if (wantsJson(context)) {
+		return completeJsonAuth(context, result.code, errorPath, errorParams, provider)
+	}
+
 	const response = mutableHeaders(
 		routeResult(context, options.callbackPath, {
 			code: result.code,
@@ -78,8 +100,10 @@ export function statusRedirect(
 	successParams: Record<string, string | undefined>,
 	errorPath: string,
 	errorParams: Record<string, string | undefined>,
+	provider?: AuthAnalyticsProvider,
 ): Response {
 	if ('error' in result) {
+		queueAuthFailure(context, provider, result.error)
 		return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error)
 	}
 	return routeResult(context, successPath, successParams)
@@ -119,6 +143,80 @@ function mutableHeaders(response: Response): Response {
 	})
 }
 
+async function completeJsonAuth(
+	context: RouteContext,
+	code: string,
+	errorPath: string,
+	errorParams: Record<string, string | undefined>,
+	provider?: 'password' | 'email-code',
+): Promise<Response> {
+	const options = getConfig()
+	const codeVerifier = getCookie(context.request, `${options.cookiePrefix}_pkce`)
+	if (!codeVerifier) {
+		queueAuthFailure(context, provider, 'missing_auth_flow')
+		return routeResult(
+			context,
+			errorPath,
+			{ ...errorParams, error: 'missing_auth_flow' },
+			'missing_auth_flow',
+		)
+	}
+
+	const tokenResponse = await exchangeCode(context.url, code, codeVerifier, provider)
+	if (!tokenResponse) {
+		queueAuthFailure(context, provider, 'token_exchange_failed')
+		return routeResult(context, errorPath, { ...errorParams, error: 'auth_failed' }, 'auth_failed')
+	}
+
+	const redirectPath = getCookie(context.request, `${options.cookiePrefix}_redirect`) || '/'
+	const redirect = new URL(redirectPath, context.url.origin).toString()
+	const response = mutableHeaders(Response.json({ ok: true, redirect }))
+
+	setTokenCookies(response, options, tokenResponse.accessToken, tokenResponse.refreshToken)
+	clearAuthFlowCookies(response, options)
+	await setOptionalIdentityCookie(response, tokenResponse.claims.sub)
+	if (analyticsAvailable(context)) {
+		resolveWaitUntil(context)(
+			emitAuthSuccessEvent(context, {
+				provider: tokenResponse.provider,
+				isNewUser: tokenResponse.isNewUser,
+				authPath: context.url.pathname,
+				identityUserId: tokenResponse.claims.sub,
+			}),
+		)
+	}
+
+	return response
+}
+
+function queueAuthFailure(
+	context: RouteContext,
+	provider: AuthAnalyticsProvider | undefined,
+	reason: string,
+): void {
+	if (!analyticsAvailable(context)) return
+	resolveWaitUntil(context)(
+		emitAuthFailureEvent(context, {
+			provider,
+			reason,
+			authPath: context.url.pathname,
+		}),
+	)
+}
+
+async function setOptionalIdentityCookie(response: Response, subject: string): Promise<void> {
+	const secret = getRuntimeEnv().GL_IDENTITY_SECRET
+	if (typeof secret !== 'string' || !secret) return
+	try {
+		setIdentityCookie(
+			response,
+			await signIdentityCookie(await createIdentityCookiePayload(subject, secret), secret),
+		)
+	} catch {
+		// Keep login working if the optional analytics identity secret is misconfigured.
+	}
+}
+
 function authFlowCookieAttrs() {
 	return {
 		path: '/',

package/src/routes/callback.ts

@@ -1,6 +1,10 @@
 import { getConfig } from '../config-store.js'
 import { getRuntimeEnv } from '../runtime.js'
-import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js'
+import {
+	analyticsAvailable,
+	emitAuthFailureEvent,
+	emitAuthSuccessEvent,
+} from '../utils/analytics.js'
 import {
 	clearAuthFlowCookies,
 	getCookie,
@@ -28,47 +32,98 @@ function getIdentitySecret(): string | null {
 	return typeof secret === 'string' && secret.length > 0 ? secret : null
 }
 
+function wantsJson(request: Request): boolean {
+	const accept = request.headers.get('accept') ?? ''
+	return accept
+		.split(',')
+		.some((value) => value.trim().toLowerCase().split(';')[0] === 'application/json')
+}
+
+function loginErrorResponse(request: Request, origin: string, loginPath: string): Response {
+	const redirect = new URL(`${loginPath}?error=auth_failed`, origin).toString()
+	if (wantsJson(request)) {
+		return Response.json({ error: 'auth_failed', redirect }, { status: 400 })
+	}
+	return Response.redirect(redirect, 302)
+}
+
+function queueAuthFailure(
+	context: CallbackContext,
+	provider: string | null,
+	reason: string | null,
+): void {
+	if (!analyticsAvailable(context)) return
+	const promise = emitAuthFailureEvent(context, {
+		provider,
+		reason,
+		authPath: context.url.pathname,
+	})
+	resolveWaitUntil(context)(promise)
+}
+
 export async function GET(context: CallbackContext): Promise<Response> {
 	const options = getConfig()
 	const { url, request } = context
 
 	const code = url.searchParams.get('code')
 	const state = url.searchParams.get('state')
+	const error = url.searchParams.get('error')
 
 	// Verify CSRF state
 	const storedState = getCookie(request, `${options.cookiePrefix}_state`)
 	if (!state || !storedState || !verifyState(state, storedState)) {
+		queueAuthFailure(
+			context,
+			getCookie(request, `${options.cookiePrefix}_provider`),
+			'missing_auth_flow',
+		)
 		return new Response('Invalid state parameter', { status: 403 })
 	}
 
 	// Read PKCE verifier
 	const codeVerifier = getCookie(request, `${options.cookiePrefix}_pkce`)
 	if (!codeVerifier) {
+		queueAuthFailure(
+			context,
+			getCookie(request, `${options.cookiePrefix}_provider`),
+			'missing_auth_flow',
+		)
 		return new Response('Missing PKCE verifier', { status: 400 })
 	}
 
 	const provider = getCookie(request, `${options.cookiePrefix}_provider`)
 	const authPath = getCookie(request, `${options.cookiePrefix}_auth_path`) || url.pathname
 
+	if (error) {
+		queueAuthFailure(context, provider, error)
+		return loginErrorResponse(request, url.origin, options.loginPath)
+	}
+
+	if (!code) {
+		queueAuthFailure(context, provider, 'invalid_request')
+		return loginErrorResponse(request, url.origin, options.loginPath)
+	}
+
 	// Exchange code for tokens
 	const tokenResponse = await exchangeCode(
 		url,
-		code!,
+		code,
 		codeVerifier,
 		provider === 'google' || provider === 'password' || provider === 'email-code'
 			? provider
 			: undefined,
 	)
 	if (!tokenResponse) {
-		return Response.redirect(
-			new URL(`${options.loginPath}?error=auth_failed`, url.origin).toString(),
-			302,
-		)
+		queueAuthFailure(context, provider, 'token_exchange_failed')
+		return loginErrorResponse(request, url.origin, options.loginPath)
 	}
 
 	// Build redirect response
 	const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/'
-	const response = Response.redirect(new URL(redirectPath, url.origin).toString(), 302)
+	const redirect = new URL(redirectPath, url.origin).toString()
+	const response = wantsJson(request)
+		? Response.json({ ok: true, redirect })
+		: Response.redirect(redirect, 302)
 
 	// Mutable copy for setting cookies
 	const mutableResponse = new Response(response.body, {
@@ -102,12 +157,11 @@ export async function GET(context: CallbackContext): Promise<Response> {
 	// the root cause of the missing `login_completed` / `signup_completed`
 	// rows in `gl_conversion_events` after the Fronts cutover.
 	if (analyticsAvailable(context)) {
-		const eventName = tokenResponse.isNewUser ? 'signup_completed' : 'login_completed'
-		const promise = emitAuthEvent(context, eventName, {
+		const promise = emitAuthSuccessEvent(context, {
 			provider: tokenResponse.provider,
 			isNewUser: tokenResponse.isNewUser,
-			auth_path: authPath,
-			identity_user_id: tokenResponse.claims.sub,
+			authPath,
+			identityUserId: tokenResponse.claims.sub,
 		})
 		resolveWaitUntil(context)(promise)
 	}

package/src/routes/flow.ts

@@ -5,6 +5,12 @@ import { createAuthFlow } from '../utils/openauth.js'
 export interface RouteContext {
 	request: Request
 	url: URL
+	locals?: {
+		cfContext?: {
+			waitUntil?: (promise: Promise<unknown>) => void
+		}
+	}
+	waitUntil?: (promise: Promise<unknown>) => void
 }
 
 export async function withAuthFlowCookies(

package/src/utils/analytics.ts

@@ -1,40 +1,86 @@
-type TrackFn = (context: unknown, event: string, props?: Record<string, unknown>) => Promise<void>
-
-let trackFn: TrackFn | null = null
-let resolved = false
-const ANALYTICS_UTILS_MODULE = '@growth-labs/analytics/utils'
-
-async function importOptionalModule(modulePath: string): Promise<Record<string, unknown> | null> {
-	try {
-		return (await import(/* @vite-ignore */ modulePath)) as Record<string, unknown>
-	} catch {
-		return null
-	}
-}
-
-async function resolveAnalytics(): Promise<void> {
-	if (resolved) return
-	resolved = true
-	const mod = await importOptionalModule(ANALYTICS_UTILS_MODULE)
-	let candidate: unknown
-	try {
-		candidate = mod?.trackServerEvent
-	} catch {
-		candidate = undefined
-	}
-	if (typeof candidate === 'function') {
-		trackFn = candidate as TrackFn
-	}
+import { trackServerEvent } from '@growth-labs/analytics/utils'
+
+export type AuthAnalyticsProvider = 'google' | 'email-code' | 'password' | 'unknown'
+
+export interface AuthSuccessEventInput {
+	provider: AuthAnalyticsProvider | string | null | undefined
+	isNewUser: boolean
+	authPath: string
+	identityUserId: string
 }
 
+export interface AuthFailureEventInput {
+	provider: AuthAnalyticsProvider | string | null | undefined
+	reason: string | null | undefined
+	authPath: string
+}
+
+const AUTH_PROVIDERS = new Set(['google', 'email-code', 'password'])
+const AUTH_FAILURE_REASONS = new Set([
+	'auth_failed',
+	'invalid_credentials',
+	'invalid_code',
+	'invalid_request',
+	'invalid_response',
+	'invalid_token',
+	'missing_auth_flow',
+	'oauth_denied',
+	'request_failed',
+	'send_failed',
+	'token_exchange_failed',
+])
+
 export async function emitAuthEvent(
 	context: unknown,
 	eventName: string,
 	data: Record<string, unknown>,
 ): Promise<void> {
-	await resolveAnalytics()
-	if (!trackFn) return
-	return trackFn(context, eventName, data)
+	// Bind via static import so wrangler/esbuild bundles the target at build
+	// time. The previous variable-path dynamic import (await import(modulePath))
+	// could not be statically analyzed; in Cloudflare Workers the bundle did
+	// not include @growth-labs/analytics/utils, the runtime resolved null, and
+	// every auth event silently no-op'd — surfaced post-2026-05-22 as
+	// `signup_completed` / `login_completed` rows never landing in
+	// gl_conversion_events on the new Fronts Worker. See peerDependency.
+	await trackServerEvent(context as Parameters<typeof trackServerEvent>[0], eventName, data)
+}
+
+export function normalizeAuthProvider(
+	provider: AuthAnalyticsProvider | string | null | undefined,
+): AuthAnalyticsProvider {
+	return provider && AUTH_PROVIDERS.has(provider) ? (provider as AuthAnalyticsProvider) : 'unknown'
+}
+
+export function normalizeAuthFailureReason(reason: string | null | undefined): string {
+	if (reason === 'access_denied') return 'oauth_denied'
+	return reason && AUTH_FAILURE_REASONS.has(reason) ? reason : 'auth_failed'
+}
+
+export function authSuccessEventName(isNewUser: boolean): 'signup_completed' | 'login_completed' {
+	return isNewUser ? 'signup_completed' : 'login_completed'
+}
+
+export async function emitAuthSuccessEvent(
+	context: unknown,
+	input: AuthSuccessEventInput,
+): Promise<void> {
+	return emitAuthEvent(context, authSuccessEventName(input.isNewUser), {
+		provider: normalizeAuthProvider(input.provider),
+		isNewUser: input.isNewUser,
+		auth_path: input.authPath,
+		identity_user_id: input.identityUserId,
+	})
+}
+
+export async function emitAuthFailureEvent(
+	context: unknown,
+	input: AuthFailureEventInput,
+): Promise<void> {
+	return emitAuthEvent(context, 'auth_failed', {
+		provider: normalizeAuthProvider(input.provider),
+		reason: normalizeAuthFailureReason(input.reason),
+		auth_path: input.authPath,
+	})
 }
 
 export function analyticsAvailable(context: { locals?: Record<string, unknown> }): boolean {
@@ -50,7 +96,9 @@ export async function trackAuthEvent(
 	return emitAuthEvent(context, eventName, data)
 }
 
+// Test-only export retained for compatibility with existing tests that reset
+// internal state between runs. Now a no-op since there's no internal state
+// to reset — trackFn is the bound static import.
 export function _resetAnalytics(): void {
-	trackFn = null
-	resolved = false
+	// noop
 }

package/src/utils/index.ts

@@ -1,4 +1,15 @@
-export { emitAuthEvent, trackAuthEvent } from './analytics.js'
+export {
+	type AuthAnalyticsProvider,
+	type AuthFailureEventInput,
+	type AuthSuccessEventInput,
+	authSuccessEventName,
+	emitAuthEvent,
+	emitAuthFailureEvent,
+	emitAuthSuccessEvent,
+	normalizeAuthFailureReason,
+	normalizeAuthProvider,
+	trackAuthEvent,
+} from './analytics.js'
 export {
 	type BridgeMigrationOptions,
 	type BridgeMigrationStatement,