@growth-labs/auth 0.9.1 → 0.10.2

package/dist/routes/api/shared.js

@@ -2,7 +2,9 @@ import { getConfig } from '../../config-store.js';
 import { getRuntimeEnv } from '../../runtime.js';
 import { authClient } from '../../server.js';
 import { analyticsAvailable, emitAuthFailureEvent, emitAuthSuccessEvent, } from '../../utils/analytics.js';
+import { resolveClientSecret } from '../../utils/client-secret.js';
 import { clearAuthFlowCookies, getCookie, setCookie, setIdentityCookie, setTokenCookies, } from '../../utils/cookies.js';
+import { secretResolutionFailureResponse } from '../../utils/fail-closed.js';
 import { canonicalIdentitySubject } from '../../utils/identity.js';
 import { createIdentityCookiePayload, signIdentityCookie } from '../../utils/identity-cookie.js';
 import { exchangeCode } from '../../utils/openauth.js';
@@ -74,6 +76,21 @@ function routeResult(context, pathname, params, error) {
         status: error ? 400 : 200,
     });
 }
+// Returns a 503 fail-closed response when the configured clientSecret binding
+// cannot be resolved; null when resolution succeeds or no secret is configured.
+// Call this before any authClient() call to guarantee zero issuer fetch on failure.
+export async function failClosedOnSecretResolutionFailure(context) {
+    const options = getConfig();
+    if (options.clientSecret === undefined)
+        return null;
+    const secretResult = await resolveClientSecret(options.clientSecret, context.request);
+    if (secretResult.ok)
+        return null;
+    return secretResolutionFailureResponse(context.request, {
+        surface: 'route_preflight',
+        code: secretResult.code,
+    });
+}
 export { authClient, getConfig, readForm, redirectTo };
 function mutableHeaders(response) {
     return new Response(response.body, {
@@ -89,11 +106,18 @@ async function completeJsonAuth(context, code, errorPath, errorParams, provider)
         queueAuthFailure(context, provider, 'missing_auth_flow');
         return routeResult(context, errorPath, { ...errorParams, error: 'missing_auth_flow' }, 'missing_auth_flow');
     }
-    const tokenResponse = await exchangeCode(context.url, code, codeVerifier, provider);
-    if (!tokenResponse) {
+    const exchangeResult = await exchangeCode(context.url, code, codeVerifier, provider, context.request);
+    if (exchangeResult !== null && 'secretFailed' in exchangeResult) {
+        return secretResolutionFailureResponse(context.request, {
+            surface: 'route_exchange',
+            code: exchangeResult.code,
+        });
+    }
+    if (!exchangeResult) {
         queueAuthFailure(context, provider, 'token_exchange_failed');
         return routeResult(context, errorPath, { ...errorParams, error: 'auth_failed' }, 'auth_failed');
     }
+    const tokenResponse = exchangeResult;
     const redirectPath = getCookie(context.request, `${options.cookiePrefix}_redirect`) || '/';
     const redirect = new URL(redirectPath, context.url.origin).toString();
     const response = mutableHeaders(Response.json({ ok: true, redirect }));

package/dist/routes/api/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/routes/api/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAsD,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChG,OAAO,EAEN,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAqB,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEtF,MAAM,uBAAuB,GAAG,gDAAgD,CAAA;AAEhF,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,IAAc,EACd,GAAW,EACX,UAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC7C,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACnD,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,OAAqB,EACrB,MAA4B,EAC5B,SAAiB,EACjB,WAA+C,EAC/C,QAAoC;IAEpC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACjD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACxD,OAAO,WAAW,CACjB,OAAO,EACP,SAAS,EACT,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9C,mBAAmB,CACnB,CAAA;IACF,CAAC;IAED,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAC9B,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAC1C,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK;KACL,CAAC,CACF,CAAA;IACD,SAAS,CACR,QAAQ,EACR,GAAG,OAAO,CAAC,YAAY,YAAY,EACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EACpB,mBAAmB,EAAE,CACrB,CAAA;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,OAAqB,EACrB,MAA0B,EAC1B,WAAmB,EACnB,aAAiD,EACjD,SAAiB,EACjB,WAA+C,EAC/C,QAAgC;IAEhC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACjD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC1D,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,WAAW,CACnB,OAAqB,EACrB,QAAgB,EAChB,MAA0C,EAC1C,KAAc;IAEd,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC9F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;KACzB,CAAC,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AAEtD,SAAS,cAAc,CAAC,QAAkB;IACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,IAAY,EACZ,SAAiB,EACjB,WAA+C,EAC/C,QAAoC;IAEpC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAC/E,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACxD,OAAO,WAAW,CACjB,OAAO,EACP,SAAS,EACT,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9C,mBAAmB,CACnB,CAAA;IACF,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IACnF,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;QAC5D,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,aAAa,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAC1F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IACrE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IAEtE,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IACzF,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvC,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,eAAe,GAAG,wBAAwB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,yBAAyB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;IAC1D,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,OAAO,CAAC,CACxB,oBAAoB,CAAC,OAAO,EAAE;YAC7B,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;YAC9B,cAAc,EAAE,eAAe;SAC/B,CAAC,CACF,CAAA;IACF,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,gBAAgB,CACxB,OAAqB,EACrB,QAA2C,EAC3C,MAAc;IAEd,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAM;IACxC,gBAAgB,CAAC,OAAO,CAAC,CACxB,oBAAoB,CAAC,OAAO,EAAE;QAC7B,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CACF,CAAA;AACF,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,QAAkB,EAAE,OAAe;IAC3E,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAM;IACjD,IAAI,CAAC;QACJ,iBAAiB,CAChB,QAAQ,EACR,MAAM,kBAAkB,CAAC,MAAM,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CACpF,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,iFAAiF;IAClF,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB;IAC3B,OAAO;QACN,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,GAAG;KACX,CAAA;AACF,CAAC"}
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/routes/api/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAsD,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChG,OAAO,EAEN,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAqB,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEtF,MAAM,uBAAuB,GAAG,gDAAgD,CAAA;AAEhF,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,IAAc,EACd,GAAW,EACX,UAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC7C,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACnD,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,OAAqB,EACrB,MAA4B,EAC5B,SAAiB,EACjB,WAA+C,EAC/C,QAAoC;IAEpC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACjD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACxD,OAAO,WAAW,CACjB,OAAO,EACP,SAAS,EACT,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9C,mBAAmB,CACnB,CAAA;IACF,CAAC;IAED,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAC9B,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAC1C,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK;KACL,CAAC,CACF,CAAA;IACD,SAAS,CACR,QAAQ,EACR,GAAG,OAAO,CAAC,YAAY,YAAY,EACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EACpB,mBAAmB,EAAE,CACrB,CAAA;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,OAAqB,EACrB,MAA0B,EAC1B,WAAmB,EACnB,aAAiD,EACjD,SAAiB,EACjB,WAA+C,EAC/C,QAAgC;IAEhC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACjD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC1D,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,WAAW,CACnB,OAAqB,EACrB,QAAgB,EAChB,MAA0C,EAC1C,KAAc;IAEd,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC9F,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;KACzB,CAAC,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACxD,OAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACnD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IACrF,IAAI,YAAY,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAChC,OAAO,+BAA+B,CAAC,OAAO,CAAC,OAAO,EAAE;QACvD,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,YAAY,CAAC,IAAI;KACvB,CAAC,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AAEtD,SAAS,cAAc,CAAC,QAAkB;IACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,IAAY,EACZ,SAAiB,EACjB,WAA+C,EAC/C,QAAoC;IAEpC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAC/E,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACxD,OAAO,WAAW,CACjB,OAAO,EACP,SAAS,EACT,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9C,mBAAmB,CACnB,CAAA;IACF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,YAAY,CACxC,OAAO,CAAC,GAAG,EACX,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,OAAO,CAAC,OAAO,CACf,CAAA;IACD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,IAAI,cAAc,EAAE,CAAC;QACjE,OAAO,+BAA+B,CAAC,OAAO,CAAC,OAAO,EAAE;YACvD,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,cAAc,CAAC,IAAI;SACzB,CAAC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;QAC5D,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,aAAa,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,aAAa,GAAG,cAAc,CAAA;IAEpC,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAC1F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IACrE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IAEtE,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IACzF,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvC,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,eAAe,GAAG,wBAAwB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,yBAAyB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;IAC1D,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,OAAO,CAAC,CACxB,oBAAoB,CAAC,OAAO,EAAE;YAC7B,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;YAC9B,cAAc,EAAE,eAAe;SAC/B,CAAC,CACF,CAAA;IACF,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,gBAAgB,CACxB,OAAqB,EACrB,QAA2C,EAC3C,MAAc;IAEd,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAM;IACxC,gBAAgB,CAAC,OAAO,CAAC,CACxB,oBAAoB,CAAC,OAAO,EAAE;QAC7B,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CACF,CAAA;AACF,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,QAAkB,EAAE,OAAe;IAC3E,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAM;IACjD,IAAI,CAAC;QACJ,iBAAiB,CAChB,QAAQ,EACR,MAAM,kBAAkB,CAAC,MAAM,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CACpF,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,iFAAiF;IAClF,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB;IAC3B,OAAO;QACN,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,GAAG;KACX,CAAA;AACF,CAAC"}

package/dist/routes/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAmBA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAKhC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAoCD,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsHrE"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAoBA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAKhC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAoCD,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+HrE"}

package/dist/routes/callback.js

@@ -2,6 +2,7 @@ import { getConfig } from '../config-store.js';
 import { getRuntimeEnv } from '../runtime.js';
 import { analyticsAvailable, emitAuthFailureEvent, emitAuthSuccessEvent, } from '../utils/analytics.js';
 import { clearAuthFlowCookies, getCookie, setIdentityCookie, setTokenCookies, } from '../utils/cookies.js';
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js';
 import { canonicalIdentitySubject } from '../utils/identity.js';
 import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js';
 import { exchangeCode } from '../utils/openauth.js';
@@ -63,13 +64,21 @@ export async function GET(context) {
         return loginErrorResponse(request, url.origin, options.loginPath);
     }
     // Exchange code for tokens
-    const tokenResponse = await exchangeCode(url, code, codeVerifier, provider === 'google' || provider === 'password' || provider === 'email-code'
+    const exchangeResult = await exchangeCode(url, code, codeVerifier, provider === 'google' || provider === 'password' || provider === 'email-code'
         ? provider
-        : undefined);
-    if (!tokenResponse) {
+        : undefined, request);
+    // Typed distinction: secret binding failure → fail closed; other failure → auth_failed.
+    if (exchangeResult !== null && 'secretFailed' in exchangeResult) {
+        return secretResolutionFailureResponse(request, {
+            surface: 'callback_exchange',
+            code: exchangeResult.code,
+        });
+    }
+    if (!exchangeResult) {
         queueAuthFailure(context, provider, 'token_exchange_failed');
         return loginErrorResponse(request, url.origin, options.loginPath);
     }
+    const tokenResponse = exchangeResult;
     // Build redirect response
     const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/';
     const redirect = new URL(redirectPath, url.origin).toString();

package/dist/routes/callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EACN,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAazD,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClD,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,MAAc,EAAE,SAAiB;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,oBAAoB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7E,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,gBAAgB,CACxB,OAAwB,EACxB,QAAuB,EACvB,MAAqB;IAErB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAM;IACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;QAC7C,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CAAA;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAA;IAExF,IAAI,KAAK,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;QACtD,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CACvC,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,YAAY;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,CACZ,CAAA;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;QAC5D,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAEnC,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC9C,kEAAkE;IAClE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,eAAe,GAAG,wBAAwB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;IAC1C,IAAI,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC;YACJ,iBAAiB,CAChB,eAAe,EACf,MAAM,kBAAkB,CACvB,MAAM,2BAA2B,CAAC,eAAe,EAAE,cAAc,CAAC,EAClE,cAAc,CACd,CACD,CAAA;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iFAAiF;QAClF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,2DAA2D;IAC3D,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;YAC7C,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,QAAQ;YACR,cAAc,EAAE,eAAe;SAC/B,CAAC,CAAA;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EACN,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,eAAe,GACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAazD,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,kBAAkB,CAAA;IACjD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClD,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,MAAc,EAAE,SAAiB;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,oBAAoB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7E,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,gBAAgB,CACxB,OAAwB,EACxB,QAAuB,EACvB,MAAqB;IAErB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAM;IACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;QAC7C,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CAAA;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,gBAAgB,CACf,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,EACtD,mBAAmB,CACnB,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAA;IAExF,IAAI,KAAK,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;QACtD,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IAED,2BAA2B;IAC3B,MAAM,cAAc,GAAG,MAAM,YAAY,CACxC,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,YAAY;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,EACZ,OAAO,CACP,CAAA;IACD,wFAAwF;IACxF,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,IAAI,cAAc,EAAE,CAAC;QACjE,OAAO,+BAA+B,CAAC,OAAO,EAAE;YAC/C,OAAO,EAAE,mBAAmB;YAC5B,IAAI,EAAE,cAAc,CAAC,IAAI;SACzB,CAAC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;QAC5D,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,aAAa,GAAG,cAAc,CAAA;IAEpC,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAEnC,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC9C,kEAAkE;IAClE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,eAAe,GAAG,wBAAwB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;IAC1C,IAAI,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC;YACJ,iBAAiB,CAChB,eAAe,EACf,MAAM,kBAAkB,CACvB,MAAM,2BAA2B,CAAC,eAAe,EAAE,cAAc,CAAC,EAClE,cAAc,CACd,CACD,CAAA;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iFAAiF;QAClF,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,2DAA2D;IAC3D,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE;YAC7C,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,QAAQ;YACR,cAAc,EAAE,eAAe;SAC/B,CAAC,CAAA;QACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/routes/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAYA,UAAU,aAAa;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IAIR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyCnE"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAcA,UAAU,aAAa;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IAIR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoEnE"}

package/dist/routes/logout.js

@@ -2,6 +2,7 @@ import { getConfig } from '../config-store.js';
 import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js';
 import { resolveClientSecret } from '../utils/client-secret.js';
 import { clearAuthFlowCookies, clearIdentityCookie, clearTokenCookies, getCookie, } from '../utils/cookies.js';
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js';
 import { revokeToken } from '../utils/openauth.js';
 import { resolveWaitUntil } from '../utils/wait-until.js';
 export async function GET(context) {
@@ -9,13 +10,29 @@ export async function GET(context) {
     const refreshToken = getCookie(context.request, `${options.cookiePrefix}_rt`);
     const clientId = options.clientId || context.url.hostname;
     const waitUntil = resolveWaitUntil(context);
-    // Revoke at issuer (non-blocking)
+    // Revoke at issuer (non-blocking).
+    // Public clients (no clientSecret configured) always attempt revocation.
+    // Confidential clients only attempt revocation when the secret resolves successfully;
+    // a binding failure skips revocation rather than sending unauthenticated requests
+    // to a confidential-client issuer endpoint.
+    let secretFailureCode = null;
     if (refreshToken) {
-        const clientSecret = await resolveClientSecret(options.clientSecret);
-        const promise = clientSecret
-            ? revokeToken(refreshToken, clientId, clientSecret)
-            : revokeToken(refreshToken, clientId);
-        waitUntil(promise);
+        if (options.clientSecret === undefined) {
+            waitUntil(revokeToken(refreshToken, clientId));
+        }
+        else {
+            const secretResult = await resolveClientSecret(options.clientSecret, context.request);
+            if (secretResult.ok) {
+                const secret = secretResult.secret ?? undefined;
+                const promise = secret
+                    ? revokeToken(refreshToken, clientId, secret)
+                    : revokeToken(refreshToken, clientId);
+                waitUntil(promise);
+            }
+            else {
+                secretFailureCode = secretResult.code;
+            }
+        }
     }
     // Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
     // wired. Without analytics installed this is a no-op (analyticsAvailable
@@ -26,6 +43,18 @@ export async function GET(context) {
         });
         waitUntil(promise);
     }
+    if (secretFailureCode) {
+        // Fail closed: clear all local cookies but return a fixed 503 instead of
+        // an ordinary redirect. Revocation was already skipped above.
+        const failResponse = secretResolutionFailureResponse(context.request, {
+            surface: 'logout_revocation',
+            code: secretFailureCode,
+        });
+        clearTokenCookies(failResponse, options);
+        clearIdentityCookie(failResponse);
+        clearAuthFlowCookies(failResponse, options);
+        return failResponse;
+    }
     // Build redirect response
     const redirectUrl = new URL(options.logoutRedirect, context.url.origin).toString();
     const response = Response.redirect(redirectUrl, 302);

package/dist/routes/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACT,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAYzD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAE3C,kCAAkC;IAClC,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,YAAY;YAC3B,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC;YACnD,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACtC,SAAS,CAAC,OAAO,CAAC,CAAA;IACnB,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,kBAAkB,CAAC,OAA+C,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;YACrD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACxC,CAAC,CAAA;QACF,SAAS,CAAC,OAAO,CAAC,CAAA;IACnB,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,mBAAmB,CAAC,eAAe,CAAC,CAAA;IACpC,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,OAAO,eAAe,CAAA;AACvB,CAAC"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACT,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAYzD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAE3C,mCAAmC;IACnC,yEAAyE;IACzE,sFAAsF;IACtF,kFAAkF;IAClF,4CAA4C;IAC5C,IAAI,iBAAiB,GAA2C,IAAI,CAAA;IACpE,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC/C,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;YACrF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;gBAC/C,MAAM,OAAO,GAAG,MAAM;oBACrB,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;oBAC7C,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;gBACtC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnB,CAAC;iBAAM,CAAC;gBACP,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAA;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,kBAAkB,CAAC,OAA+C,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;YACrD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACxC,CAAC,CAAA;QACF,SAAS,CAAC,OAAO,CAAC,CAAA;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,+BAA+B,CAAC,OAAO,CAAC,OAAO,EAAE;YACrE,OAAO,EAAE,mBAAmB;YAC5B,IAAI,EAAE,iBAAiB;SACvB,CAAC,CAAA;QACF,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACxC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QACjC,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC3C,OAAO,YAAY,CAAA;IACpB,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,mBAAmB,CAAC,eAAe,CAAC,CAAA;IACpC,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/server.d.ts

@@ -1,3 +1,5 @@
+import { ClientSecretResolutionError } from './utils/fail-closed.js';
+export { ClientSecretResolutionError };
 export type AuthClientCodeResult = {
     code: string;
 } | {

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjE,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE;QACT,MAAM,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACjF,KAAK,EAAE;YACN,OAAO,CAAC,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;YAC9D,OAAO,CAAC,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,WAAW,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;SACnF,CAAA;KACD,CAAA;IACD,IAAI,EAAE;QACL,OAAO,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;KAC7E,CAAA;CACD;AAgGD,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA6DjE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA,OAAO,EACN,2BAA2B,EAE3B,MAAM,wBAAwB,CAAA;AAI/B,OAAO,EAAE,2BAA2B,EAAE,CAAA;AAEtC,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjE,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE;QACT,MAAM,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACjF,KAAK,EAAE;YACN,OAAO,CAAC,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;YAC9D,OAAO,CAAC,KAAK,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,WAAW,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;SACnF,CAAA;KACD,CAAA;IACD,IAAI,EAAE;QACL,OAAO,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;KAC7E,CAAA;CACD;AA2GD,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA6DjE"}

package/dist/server.js

@@ -1,8 +1,10 @@
 import { getConfig } from './config-store.js';
 import { createClientSecretBasicAuthHeader, resolveClientSecret } from './utils/client-secret.js';
 import { getCookie } from './utils/cookies.js';
+import { ClientSecretResolutionError, reportClientSecretResolutionFailure, } from './utils/fail-closed.js';
 import { resolveInternalIssuer } from './utils/issuer.js';
 import { createPKCEChallenge } from './utils/pkce.js';
+export { ClientSecretResolutionError };
 function clientId(options, context) {
     return options.clientId || context.url.hostname;
 }
@@ -21,14 +23,16 @@ async function authFlowPayload(options, context) {
         code_challenge: await createPKCEChallenge(verifier),
         code_challenge_method: 'S256',
         state,
-        ...(options.resource && { resource: options.resource }),
+        resource: options.resource,
     };
 }
 async function headersFor(options, context) {
     const headers = { 'Content-Type': 'application/json' };
-    const secret = await resolveClientSecret(options.clientSecret);
-    if (secret) {
-        headers.Authorization = createClientSecretBasicAuthHeader(clientId(options, context), secret);
+    const secretResult = await resolveClientSecret(options.clientSecret, context.request);
+    if (!secretResult.ok)
+        throw new ClientSecretResolutionError(secretResult.code);
+    if (secretResult.secret) {
+        headers.Authorization = createClientSecretBasicAuthHeader(clientId(options, context), secretResult.secret);
     }
     return headers;
 }
@@ -66,7 +70,14 @@ async function postJson(options, context, pathname, body) {
         }
         return { error: 'invalid_response' };
     }
-    catch {
+    catch (err) {
+        if (err instanceof ClientSecretResolutionError) {
+            reportClientSecretResolutionFailure({
+                surface: 'server_auth_client',
+                code: err.code,
+            });
+            return { error: 'auth_service_unavailable' };
+        }
         return { error: 'request_failed' };
     }
 }

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,OAAO,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACjG,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAiCrD,SAAS,QAAQ,CAAC,OAA4B,EAAE,OAA0B;IACzE,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,OAA0B;IAC5E,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;AACpE,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,OAA4B,EAC5B,OAA0B;IAE1B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACtC,CAAC;IAED,OAAO;QACN,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QACrC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3C,cAAc,EAAE,MAAM,mBAAmB,CAAC,QAAQ,CAAC;QACnD,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KACvD,CAAA;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,OAA4B,EAC5B,OAA0B;IAE1B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9D,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,OAA4B,EAC5B,OAA0B,EAC1B,QAAgB,EAChB,IAA6B;IAE7B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAErC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAO,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAO,CAAA;QACxC,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAO,CAAA;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAO,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAO,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAO,CAAA;IACxC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAA0B;IACpD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,OAAO;QACN,QAAQ,EAAE;YACT,KAAK,CAAC,MAAM,CAAC,KAAK;gBACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAChC,OAAO,QAAQ,CAAuB,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE;oBACvF,GAAG,IAAI;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,UAAU;iBACpB,CAAC,CAAA;YACH,CAAC;YACD,KAAK,EAAE;gBACN,OAAO,CAAC,KAAK;oBACZ,OAAO,QAAQ,CACd,OAAO,EACP,OAAO,EACP,qCAAqC,EACrC;wBACC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;wBACrC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;qBAClC,CACD,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,KAAK;oBACZ,OAAO,QAAQ,CACd,OAAO,EACP,OAAO,EACP,qCAAqC,EACrC;wBACC,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;wBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,YAAY,EAAE,KAAK,CAAC,WAAW;qBAC/B,CACD,CAAA;gBACF,CAAC;aACD;SACD;QACD,IAAI,EAAE;YACL,OAAO,CAAC,KAAK;gBACZ,OAAO,QAAQ,CAAqB,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE;oBAClF,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;iBACrC,CAAC,CAAA;YACH,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAChC,OAAO,QAAQ,CAAuB,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBACnF,GAAG,IAAI;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,MAAM;iBAChB,CAAC,CAAA;YACH,CAAC;SACD;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,OAAO,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACjG,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EACN,2BAA2B,EAC3B,mCAAmC,GACnC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,2BAA2B,EAAE,CAAA;AAiCtC,SAAS,QAAQ,CAAC,OAA4B,EAAE,OAA0B;IACzE,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,OAA0B;IAC5E,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;AACpE,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,OAA4B,EAC5B,OAA0B;IAE1B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACtC,CAAC;IAED,OAAO;QACN,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QACrC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3C,cAAc,EAAE,MAAM,mBAAmB,CAAC,QAAQ,CAAC;QACnD,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAA;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,OAA4B,EAC5B,OAA0B;IAE1B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;IAC9E,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IACrF,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,MAAM,IAAI,2BAA2B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC9E,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,aAAa,GAAG,iCAAiC,CACxD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAC1B,YAAY,CAAC,MAAM,CACnB,CAAA;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,OAA4B,EAC5B,OAA0B,EAC1B,QAAgB,EAChB,IAA6B;IAE7B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAErC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAO,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAO,CAAA;QACxC,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAO,CAAA;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAO,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAO,CAAA;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAChD,mCAAmC,CAAC;gBACnC,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAA;YACF,OAAO,EAAE,KAAK,EAAE,0BAA0B,EAAO,CAAA;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAO,CAAA;IACxC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAA0B;IACpD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,OAAO;QACN,QAAQ,EAAE;YACT,KAAK,CAAC,MAAM,CAAC,KAAK;gBACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAChC,OAAO,QAAQ,CAAuB,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE;oBACvF,GAAG,IAAI;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,UAAU;iBACpB,CAAC,CAAA;YACH,CAAC;YACD,KAAK,EAAE;gBACN,OAAO,CAAC,KAAK;oBACZ,OAAO,QAAQ,CACd,OAAO,EACP,OAAO,EACP,qCAAqC,EACrC;wBACC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;wBACrC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;qBAClC,CACD,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,KAAK;oBACZ,OAAO,QAAQ,CACd,OAAO,EACP,OAAO,EACP,qCAAqC,EACrC;wBACC,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;wBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,YAAY,EAAE,KAAK,CAAC,WAAW;qBAC/B,CACD,CAAA;gBACF,CAAC;aACD;SACD;QACD,IAAI,EAAE;YACL,OAAO,CAAC,KAAK;gBACZ,OAAO,QAAQ,CAAqB,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE;oBAClF,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;iBACrC,CAAC,CAAA;YACH,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBACjB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAA;gBAChC,OAAO,QAAQ,CAAuB,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBACnF,GAAG,IAAI;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,MAAM;iBAChB,CAAC,CAAA;YACH,CAAC;SACD;KACD,CAAA;AACF,CAAC"}

package/dist/utils/client-secret-literal.d.ts

@@ -0,0 +1,13 @@
+export interface ClientSecretLiteral {
+    readonly __clientSecretLiteral: true;
+    readonly value: string;
+}
+export interface SerializedClientSecretLiteral {
+    readonly __growthLabsAuthClientSecretLiteral: 1;
+    readonly value: string;
+}
+export declare function literalClientSecret(value: string): ClientSecretLiteral;
+export declare function isClientSecretLiteral(v: unknown): v is ClientSecretLiteral;
+export declare function serializeClientSecretLiteral(literal: ClientSecretLiteral): SerializedClientSecretLiteral;
+export declare function rehydrateClientSecretLiteral(value: unknown): unknown;
+//# sourceMappingURL=client-secret-literal.d.ts.map

package/dist/utils/client-secret-literal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-secret-literal.d.ts","sourceRoot":"","sources":["../../src/utils/client-secret-literal.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,mCAAmC,EAAE,CAAC,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAID,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAItE;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAMD,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,mBAAmB,GAC1B,6BAA6B,CAQ/B;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAsBpE"}

package/dist/utils/client-secret-literal.js

@@ -0,0 +1,50 @@
+const issuedClientSecretLiterals = new WeakSet();
+export function literalClientSecret(value) {
+    const literal = Object.freeze({ __clientSecretLiteral: true, value });
+    issuedClientSecretLiterals.add(literal);
+    return literal;
+}
+export function isClientSecretLiteral(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        issuedClientSecretLiterals.has(v) &&
+        v.__clientSecretLiteral === true &&
+        typeof v.value === 'string');
+}
+// Only the integration calls this after authOptionsSchema has accepted a
+// WeakSet-issued literal. The distinct wire marker is never accepted directly
+// by resolveClientSecret; config-store must rehydrate it into a newly issued
+// literal after Vite's JSON serialization boundary.
+export function serializeClientSecretLiteral(literal) {
+    if (!isClientSecretLiteral(literal)) {
+        throw new TypeError('client secret literal was not issued by literalClientSecret()');
+    }
+    return Object.freeze({
+        __growthLabsAuthClientSecretLiteral: 1,
+        value: literal.value,
+    });
+}
+export function rehydrateClientSecretLiteral(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return value;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return value;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const keys = Object.keys(descriptors);
+    const marker = descriptors.__growthLabsAuthClientSecretLiteral;
+    const literalValue = descriptors.value;
+    if (keys.length !== 2 ||
+        !keys.includes('__growthLabsAuthClientSecretLiteral') ||
+        !keys.includes('value') ||
+        !marker ||
+        !('value' in marker) ||
+        marker.value !== 1 ||
+        !literalValue ||
+        !('value' in literalValue) ||
+        typeof literalValue.value !== 'string') {
+        return value;
+    }
+    return literalClientSecret(literalValue.value);
+}
+//# sourceMappingURL=client-secret-literal.js.map

package/dist/utils/client-secret-literal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-secret-literal.js","sourceRoot":"","sources":["../../src/utils/client-secret-literal.ts"],"names":[],"mappings":"AAcA,MAAM,0BAA0B,GAAG,IAAI,OAAO,EAAuB,CAAA;AAErE,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,IAAa,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9E,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACvC,OAAO,OAAO,CAAA;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC/C,OAAO,CACN,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,0BAA0B,CAAC,GAAG,CAAC,CAAwB,CAAC;QACvD,CAA6B,CAAC,qBAAqB,KAAK,IAAI;QAC7D,OAAQ,CAA6B,CAAC,KAAK,KAAK,QAAQ,CACxD,CAAA;AACF,CAAC;AAED,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,UAAU,4BAA4B,CAC3C,OAA4B;IAE5B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,mCAAmC,EAAE,CAAU;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,mCAAmC,CAAA;IAC9D,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAA;IACtC,IACC,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QACrD,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,CAAC,MAAM;QACP,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC;QACpB,MAAM,CAAC,KAAK,KAAK,CAAC;QAClB,CAAC,YAAY;QACb,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC;QAC1B,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ,EACrC,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,OAAO,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC"}

package/dist/utils/client-secret.d.ts

@@ -1,3 +1,14 @@
-export declare function resolveClientSecret(clientSecret?: string): Promise<string | undefined>;
+import { type ClientSecretLiteral, isClientSecretLiteral, literalClientSecret } from './client-secret-literal.js';
+export type { ClientSecretLiteral };
+export { isClientSecretLiteral, literalClientSecret };
+export type ClientSecretResolutionErrorCode = 'BINDING_REJECTED' | 'BINDING_MALFORMED' | 'BINDING_EMPTY' | 'BINDING_MISSING';
+export type ClientSecretResult = {
+    ok: true;
+    secret: string | null;
+} | {
+    ok: false;
+    code: ClientSecretResolutionErrorCode;
+};
+export declare function resolveClientSecret(clientSecret: string | ClientSecretLiteral | undefined, request?: Request): Promise<ClientSecretResult>;
 export declare function createClientSecretBasicAuthHeader(clientId: string, clientSecret: string): string;
 //# sourceMappingURL=client-secret.d.ts.map

package/dist/utils/client-secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-secret.d.ts","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AAMA,wBAAsB,mBAAmB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAa5F;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhG"}
+{"version":3,"file":"client-secret.d.ts","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,MAAM,4BAA4B,CAAA;AAEnC,YAAY,EAAE,mBAAmB,EAAE,CAAA;AACnC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAA;AAErD,MAAM,MAAM,+BAA+B,GACxC,kBAAkB,GAClB,mBAAmB,GACnB,eAAe,GACf,iBAAiB,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,+BAA+B,CAAA;CAAE,CAAA;AAmFvD,wBAAsB,mBAAmB,CACxC,YAAY,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,EACtD,OAAO,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhG"}

package/dist/utils/client-secret.js

@@ -1,16 +1,115 @@
 import { getRuntimeEnv } from '../runtime.js';
-export async function resolveClientSecret(clientSecret) {
-    if (!clientSecret)
-        return undefined;
-    const runtimeValue = getRuntimeEnv()[clientSecret];
+import { isClientSecretLiteral, literalClientSecret, } from './client-secret-literal.js';
+export { isClientSecretLiteral, literalClientSecret };
+const CLIENT_SECRET_READ_TIMEOUT_MS = 5_000;
+const CLIENT_SECRET_READ_TIMEOUT = Symbol('client-secret-read-timeout');
+// Module-private request-lifetime cache. The WeakMap is keyed strictly by
+// Request; entries are naturally collectible with the Request and are never
+// attached to consumer-visible Request properties or symbols.
+const requestCache = new WeakMap();
+function getPerRequestCache(request) {
+    let cache = requestCache.get(request);
+    if (!cache) {
+        cache = new Map();
+        requestCache.set(request, cache);
+    }
+    return cache;
+}
+async function doResolve(clientSecretName) {
+    const runtimeEnv = getRuntimeEnv();
+    let hasOwnBinding;
+    try {
+        hasOwnBinding = Object.hasOwn(runtimeEnv, clientSecretName);
+    }
+    catch {
+        return { ok: false, code: 'BINDING_MALFORMED' };
+    }
+    if (!hasOwnBinding)
+        return { ok: false, code: 'BINDING_MISSING' };
+    let runtimeValue;
+    try {
+        runtimeValue = runtimeEnv[clientSecretName];
+    }
+    catch {
+        return { ok: false, code: 'BINDING_MALFORMED' };
+    }
     if (typeof runtimeValue === 'string') {
-        return runtimeValue.length > 0 ? runtimeValue : undefined;
+        // Use trim() only to detect all-whitespace emptiness; return original bytes.
+        return runtimeValue.trim().length > 0
+            ? { ok: true, secret: runtimeValue }
+            : { ok: false, code: 'BINDING_EMPTY' };
     }
-    if (isSecretsStoreBinding(runtimeValue)) {
-        const resolved = await runtimeValue.get();
-        return resolved.length > 0 ? resolved : undefined;
+    if (typeof runtimeValue === 'object' && runtimeValue !== null) {
+        let get;
+        try {
+            get = Reflect.get(runtimeValue, 'get');
+        }
+        catch {
+            return { ok: false, code: 'BINDING_MALFORMED' };
+        }
+        if (typeof get !== 'function')
+            return { ok: false, code: 'BINDING_MALFORMED' };
+        let resolved;
+        let timeoutId;
+        try {
+            const timeout = new Promise((resolve) => {
+                timeoutId = setTimeout(() => resolve(CLIENT_SECRET_READ_TIMEOUT), CLIENT_SECRET_READ_TIMEOUT_MS);
+            });
+            const read = Promise.resolve(Reflect.apply(get, runtimeValue, []));
+            resolved = await Promise.race([read, timeout]);
+        }
+        catch {
+            return { ok: false, code: 'BINDING_REJECTED' };
+        }
+        finally {
+            if (timeoutId !== undefined)
+                clearTimeout(timeoutId);
+        }
+        if (resolved === CLIENT_SECRET_READ_TIMEOUT) {
+            return { ok: false, code: 'BINDING_REJECTED' };
+        }
+        if (typeof resolved !== 'string')
+            return { ok: false, code: 'BINDING_MALFORMED' };
+        return resolved.trim().length > 0
+            ? { ok: true, secret: resolved }
+            : { ok: false, code: 'BINDING_EMPTY' };
     }
-    return clientSecret;
+    // Own binding key exists but is neither a string nor a Secrets Store binding.
+    return { ok: false, code: 'BINDING_MALFORMED' };
+}
+export async function resolveClientSecret(clientSecret, request) {
+    // undefined means no clientSecret is configured — public client
+    if (clientSecret === undefined)
+        return { ok: true, secret: null };
+    // Explicit literal: use value directly, no binding lookup, no I/O, no caching.
+    if (isClientSecretLiteral(clientSecret)) {
+        const { value } = clientSecret;
+        return value.trim().length > 0
+            ? { ok: true, secret: value }
+            : { ok: false, code: 'BINDING_EMPTY' };
+    }
+    // Runtime config is a serialization boundary. Any object that was not
+    // explicitly rehydrated into a module-issued literal is malformed config,
+    // never a value on which string methods may be invoked.
+    if (typeof clientSecret !== 'string') {
+        return { ok: false, code: 'BINDING_MALFORMED' };
+    }
+    // Empty/whitespace-only binding name is invalid configuration, not a public client.
+    if (clientSecret.trim().length === 0) {
+        return { ok: false, code: 'BINDING_EMPTY' };
+    }
+    // Non-empty string: treat as a binding name, cache per (Request, name).
+    if (request) {
+        const cache = getPerRequestCache(request);
+        let pending = cache.get(clientSecret);
+        if (!pending) {
+            pending = doResolve(clientSecret);
+            cache.set(clientSecret, pending);
+        }
+        return pending;
+    }
+    // No Request context: resolve without caching (test or internal call).
+    return doResolve(clientSecret);
 }
 export function createClientSecretBasicAuthHeader(clientId, clientSecret) {
     return `Basic ${btoa(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`;
@@ -19,9 +118,4 @@ function formEncode(value) {
     const params = new URLSearchParams({ value });
     return params.toString().slice('value='.length);
 }
-function isSecretsStoreBinding(value) {
-    return (typeof value === 'object' &&
-        value !== null &&
-        typeof value.get === 'function');
-}
 //# sourceMappingURL=client-secret.js.map

package/dist/utils/client-secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-secret.js","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAM7C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,YAAqB;IAC9D,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAA;IAEnC,MAAM,YAAY,GAAG,aAAa,EAAE,CAAC,YAAY,CAAC,CAAA;IAClD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,CAAC;IACD,IAAI,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAA;QACzC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAClD,CAAC;IAED,OAAO,YAAY,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,QAAgB,EAAE,YAAoB;IACvF,OAAO,SAAS,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC5C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA2B,CAAC,GAAG,KAAK,UAAU,CACtD,CAAA;AACF,CAAC"}
+{"version":3,"file":"client-secret.js","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAEN,qBAAqB,EACrB,mBAAmB,GACnB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAA;AAcrD,MAAM,6BAA6B,GAAG,KAAK,CAAA;AAC3C,MAAM,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAA;AAEvE,0EAA0E;AAC1E,4EAA4E;AAC5E,8DAA8D;AAC9D,MAAM,YAAY,GAAG,IAAI,OAAO,EAA4B,CAAA;AAE5D,SAAS,kBAAkB,CAAC,OAAgB;IAC3C,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAA;QACtD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,gBAAwB;IAChD,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,aAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAA;IAEjE,IAAI,YAAqB,CAAA;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;IAChD,CAAC;IAED,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,6EAA6E;QAC7E,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE;YACpC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACxC,CAAC;IAED,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC/D,IAAI,GAAY,CAAA;QAChB,IAAI,CAAC;YACJ,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QAChD,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QAE9E,IAAI,QAAiB,CAAA;QACrB,IAAI,SAAoD,CAAA;QACxD,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,IAAI,OAAO,CAAoC,CAAC,OAAO,EAAE,EAAE;gBAC1E,SAAS,GAAG,UAAU,CACrB,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,EACzC,6BAA6B,CAC7B,CAAA;YACF,CAAC,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;YAClE,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;QAC/C,CAAC;gBAAS,CAAC;YACV,IAAI,SAAS,KAAK,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,QAAQ,KAAK,0BAA0B,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QACjF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;YAChC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACxC,CAAC;IAED,8EAA8E;IAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,YAAsD,EACtD,OAAiB;IAEjB,gEAAgE;IAChE,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAEjE,+EAA+E;IAC/E,IAAI,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAA;QAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;YAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACxC,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,wDAAwD;IACxD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;IAChD,CAAC;IAED,oFAAoF;IACpF,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IAC5C,CAAC;IAED,wEAAwE;IACxE,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;YACjC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,OAAO,CAAA;IACf,CAAC;IAED,uEAAuE;IACvE,OAAO,SAAS,CAAC,YAAY,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,QAAgB,EAAE,YAAoB;IACvF,OAAO,SAAS,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAChD,CAAC"}

package/dist/utils/fail-closed.d.ts

@@ -0,0 +1,14 @@
+import type { ClientSecretResolutionErrorCode } from './client-secret.js';
+export type ClientSecretFailureSurface = 'middleware_refresh' | 'callback_exchange' | 'logout_revocation' | 'route_preflight' | 'route_exchange' | 'server_auth_client';
+export interface ClientSecretFailureSignal {
+    readonly surface: ClientSecretFailureSurface;
+    readonly code: ClientSecretResolutionErrorCode;
+}
+export declare function reportClientSecretResolutionFailure(signal: ClientSecretFailureSignal): void;
+export declare function secretResolutionFailureResponse(request?: Request, signal?: ClientSecretFailureSignal): Response;
+export declare class ClientSecretResolutionError extends Error {
+    readonly code: ClientSecretResolutionErrorCode;
+    readonly name = "ClientSecretResolutionError";
+    constructor(code: ClientSecretResolutionErrorCode);
+}
+//# sourceMappingURL=fail-closed.d.ts.map

package/dist/utils/fail-closed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail-closed.d.ts","sourceRoot":"","sources":["../../src/utils/fail-closed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAA;AAEzE,MAAM,MAAM,0BAA0B,GACnC,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,oBAAoB,CAAA;AAEvB,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;CAC9C;AAoBD,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAS3F;AAED,wBAAgB,+BAA+B,CAC9C,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,yBAAyB,GAChC,QAAQ,CAgBV;AAKD,qBAAa,2BAA4B,SAAQ,KAAK;aAEzB,IAAI,EAAE,+BAA+B;IADjE,SAAkB,IAAI,iCAAgC;gBAC1B,IAAI,EAAE,+BAA+B;CAGjE"}