@growth-labs/auth 0.9.1 → 0.10.2

package/src/routes/api/password-reset-confirm.ts

@@ -1,5 +1,6 @@
 import {
 	authClient,
+	failClosedOnSecretResolutionFailure,
 	getConfig,
 	type RouteContext,
 	readForm,
@@ -9,6 +10,7 @@ import {
 } from './shared.js'
 
 export async function POST(context: RouteContext): Promise<Response> {
+	// Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
 	const crossSitePost = rejectCrossSitePost(context)
 	if (crossSitePost) return crossSitePost
 
@@ -17,6 +19,9 @@ export async function POST(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
+	const secretError = await failClosedOnSecretResolutionFailure(context)
+	if (secretError) return secretError
+
 	const form = await readForm(context)
 	const token = await readFormString(form, 'token')
 	const password = await readFormString(form, 'password', { trim: false })

package/src/routes/api/password-reset-request.ts

@@ -1,5 +1,6 @@
 import {
 	authClient,
+	failClosedOnSecretResolutionFailure,
 	getConfig,
 	type RouteContext,
 	readForm,
@@ -9,6 +10,7 @@ import {
 } from './shared.js'
 
 export async function POST(context: RouteContext): Promise<Response> {
+	// Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
 	const crossSitePost = rejectCrossSitePost(context)
 	if (crossSitePost) return crossSitePost
 
@@ -17,6 +19,9 @@ export async function POST(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
+	const secretError = await failClosedOnSecretResolutionFailure(context)
+	if (secretError) return secretError
+
 	const form = await readForm(context)
 	const email = await readFormString(form, 'email')
 	const result = await authClient(context).password.reset.request({ email })

package/src/routes/api/password-verify.ts

@@ -1,6 +1,7 @@
 import {
 	authClient,
 	callbackRedirect,
+	failClosedOnSecretResolutionFailure,
 	getConfig,
 	type RouteContext,
 	readForm,
@@ -9,6 +10,7 @@ import {
 } from './shared.js'
 
 export async function POST(context: RouteContext): Promise<Response> {
+	// Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
 	const crossSitePost = rejectCrossSitePost(context)
 	if (crossSitePost) return crossSitePost
 
@@ -17,6 +19,9 @@ export async function POST(context: RouteContext): Promise<Response> {
 		return new Response('Not found', { status: 404 })
 	}
 
+	const secretError = await failClosedOnSecretResolutionFailure(context)
+	if (secretError) return secretError
+
 	const form = await readForm(context)
 	const email = await readFormString(form, 'email')
 	const password = await readFormString(form, 'password', { trim: false })

package/src/routes/api/shared.ts

@@ -7,6 +7,7 @@ import {
 	emitAuthFailureEvent,
 	emitAuthSuccessEvent,
 } from '../../utils/analytics.js'
+import { resolveClientSecret } from '../../utils/client-secret.js'
 import {
 	clearAuthFlowCookies,
 	getCookie,
@@ -14,6 +15,7 @@ import {
 	setIdentityCookie,
 	setTokenCookies,
 } from '../../utils/cookies.js'
+import { secretResolutionFailureResponse } from '../../utils/fail-closed.js'
 import { canonicalIdentitySubject } from '../../utils/identity.js'
 import { createIdentityCookiePayload, signIdentityCookie } from '../../utils/identity-cookie.js'
 import { exchangeCode } from '../../utils/openauth.js'
@@ -133,6 +135,22 @@ function routeResult(
 	})
 }
 
+// Returns a 503 fail-closed response when the configured clientSecret binding
+// cannot be resolved; null when resolution succeeds or no secret is configured.
+// Call this before any authClient() call to guarantee zero issuer fetch on failure.
+export async function failClosedOnSecretResolutionFailure(
+	context: RouteContext,
+): Promise<Response | null> {
+	const options = getConfig()
+	if (options.clientSecret === undefined) return null
+	const secretResult = await resolveClientSecret(options.clientSecret, context.request)
+	if (secretResult.ok) return null
+	return secretResolutionFailureResponse(context.request, {
+		surface: 'route_preflight',
+		code: secretResult.code,
+	})
+}
+
 export type { RouteContext }
 export { authClient, getConfig, readForm, redirectTo }
 
@@ -163,11 +181,24 @@ async function completeJsonAuth(
 		)
 	}
 
-	const tokenResponse = await exchangeCode(context.url, code, codeVerifier, provider)
-	if (!tokenResponse) {
+	const exchangeResult = await exchangeCode(
+		context.url,
+		code,
+		codeVerifier,
+		provider,
+		context.request,
+	)
+	if (exchangeResult !== null && 'secretFailed' in exchangeResult) {
+		return secretResolutionFailureResponse(context.request, {
+			surface: 'route_exchange',
+			code: exchangeResult.code,
+		})
+	}
+	if (!exchangeResult) {
 		queueAuthFailure(context, provider, 'token_exchange_failed')
 		return routeResult(context, errorPath, { ...errorParams, error: 'auth_failed' }, 'auth_failed')
 	}
+	const tokenResponse = exchangeResult
 
 	const redirectPath = getCookie(context.request, `${options.cookiePrefix}_redirect`) || '/'
 	const redirect = new URL(redirectPath, context.url.origin).toString()

package/src/routes/callback.ts

@@ -11,6 +11,7 @@ import {
 	setIdentityCookie,
 	setTokenCookies,
 } from '../utils/cookies.js'
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
 import { canonicalIdentitySubject } from '../utils/identity.js'
 import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js'
 import { exchangeCode } from '../utils/openauth.js'
@@ -106,18 +107,27 @@ export async function GET(context: CallbackContext): Promise<Response> {
 	}
 
 	// Exchange code for tokens
-	const tokenResponse = await exchangeCode(
+	const exchangeResult = await exchangeCode(
 		url,
 		code,
 		codeVerifier,
 		provider === 'google' || provider === 'password' || provider === 'email-code'
 			? provider
 			: undefined,
+		request,
 	)
-	if (!tokenResponse) {
+	// Typed distinction: secret binding failure → fail closed; other failure → auth_failed.
+	if (exchangeResult !== null && 'secretFailed' in exchangeResult) {
+		return secretResolutionFailureResponse(request, {
+			surface: 'callback_exchange',
+			code: exchangeResult.code,
+		})
+	}
+	if (!exchangeResult) {
 		queueAuthFailure(context, provider, 'token_exchange_failed')
 		return loginErrorResponse(request, url.origin, options.loginPath)
 	}
+	const tokenResponse = exchangeResult
 
 	// Build redirect response
 	const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/'

package/src/routes/logout.ts

@@ -1,5 +1,6 @@
 import { getConfig } from '../config-store.js'
 import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js'
+import type { ClientSecretResolutionErrorCode } from '../utils/client-secret.js'
 import { resolveClientSecret } from '../utils/client-secret.js'
 import {
 	clearAuthFlowCookies,
@@ -7,6 +8,7 @@ import {
 	clearTokenCookies,
 	getCookie,
 } from '../utils/cookies.js'
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
 import { revokeToken } from '../utils/openauth.js'
 import { resolveWaitUntil } from '../utils/wait-until.js'
 
@@ -26,13 +28,27 @@ export async function GET(context: LogoutContext): Promise<Response> {
 	const clientId = options.clientId || context.url.hostname
 	const waitUntil = resolveWaitUntil(context)
 
-	// Revoke at issuer (non-blocking)
+	// Revoke at issuer (non-blocking).
+	// Public clients (no clientSecret configured) always attempt revocation.
+	// Confidential clients only attempt revocation when the secret resolves successfully;
+	// a binding failure skips revocation rather than sending unauthenticated requests
+	// to a confidential-client issuer endpoint.
+	let secretFailureCode: ClientSecretResolutionErrorCode | null = null
 	if (refreshToken) {
-		const clientSecret = await resolveClientSecret(options.clientSecret)
-		const promise = clientSecret
-			? revokeToken(refreshToken, clientId, clientSecret)
-			: revokeToken(refreshToken, clientId)
-		waitUntil(promise)
+		if (options.clientSecret === undefined) {
+			waitUntil(revokeToken(refreshToken, clientId))
+		} else {
+			const secretResult = await resolveClientSecret(options.clientSecret, context.request)
+			if (secretResult.ok) {
+				const secret = secretResult.secret ?? undefined
+				const promise = secret
+					? revokeToken(refreshToken, clientId, secret)
+					: revokeToken(refreshToken, clientId)
+				waitUntil(promise)
+			} else {
+				secretFailureCode = secretResult.code
+			}
+		}
 	}
 
 	// Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
@@ -45,6 +61,19 @@ export async function GET(context: LogoutContext): Promise<Response> {
 		waitUntil(promise)
 	}
 
+	if (secretFailureCode) {
+		// Fail closed: clear all local cookies but return a fixed 503 instead of
+		// an ordinary redirect. Revocation was already skipped above.
+		const failResponse = secretResolutionFailureResponse(context.request, {
+			surface: 'logout_revocation',
+			code: secretFailureCode,
+		})
+		clearTokenCookies(failResponse, options)
+		clearIdentityCookie(failResponse)
+		clearAuthFlowCookies(failResponse, options)
+		return failResponse
+	}
+
 	// Build redirect response
 	const redirectUrl = new URL(options.logoutRedirect, context.url.origin).toString()
 	const response = Response.redirect(redirectUrl, 302)

package/src/server.ts

@@ -2,9 +2,15 @@ import { getConfig } from './config-store.js'
 import type { ResolvedAuthOptions } from './options.js'
 import { createClientSecretBasicAuthHeader, resolveClientSecret } from './utils/client-secret.js'
 import { getCookie } from './utils/cookies.js'
+import {
+	ClientSecretResolutionError,
+	reportClientSecretResolutionFailure,
+} from './utils/fail-closed.js'
 import { resolveInternalIssuer } from './utils/issuer.js'
 import { createPKCEChallenge } from './utils/pkce.js'
 
+export { ClientSecretResolutionError }
+
 export type AuthClientCodeResult = { code: string } | { error: string }
 export type AuthClientOkResult = { ok: true } | { error: string }
 
@@ -33,7 +39,7 @@ interface AuthFlowPayload {
 	code_challenge: string
 	code_challenge_method: 'S256'
 	state: string
-	resource?: string
+	resource: string
 }
 
 function clientId(options: ResolvedAuthOptions, context: AuthClientContext): string {
@@ -60,7 +66,7 @@ async function authFlowPayload(
 		code_challenge: await createPKCEChallenge(verifier),
 		code_challenge_method: 'S256',
 		state,
-		...(options.resource && { resource: options.resource }),
+		resource: options.resource,
 	}
 }
 
@@ -69,9 +75,13 @@ async function headersFor(
 	context: AuthClientContext,
 ): Promise<Record<string, string>> {
 	const headers: Record<string, string> = { 'Content-Type': 'application/json' }
-	const secret = await resolveClientSecret(options.clientSecret)
-	if (secret) {
-		headers.Authorization = createClientSecretBasicAuthHeader(clientId(options, context), secret)
+	const secretResult = await resolveClientSecret(options.clientSecret, context.request)
+	if (!secretResult.ok) throw new ClientSecretResolutionError(secretResult.code)
+	if (secretResult.secret) {
+		headers.Authorization = createClientSecretBasicAuthHeader(
+			clientId(options, context),
+			secretResult.secret,
+		)
 	}
 	return headers
 }
@@ -116,7 +126,14 @@ async function postJson<T extends AuthClientCodeResult | AuthClientOkResult>(
 			return { ok: true } as T
 		}
 		return { error: 'invalid_response' } as T
-	} catch {
+	} catch (err) {
+		if (err instanceof ClientSecretResolutionError) {
+			reportClientSecretResolutionFailure({
+				surface: 'server_auth_client',
+				code: err.code,
+			})
+			return { error: 'auth_service_unavailable' } as T
+		}
 		return { error: 'request_failed' } as T
 	}
 }

package/src/utils/client-secret-literal.ts

@@ -0,0 +1,71 @@
+// Explicit local-dev literal type and predicate. Intentionally no runtime
+// imports — this file is reachable from options.ts (the package main entry
+// static-import chain) so it must not pull in cloudflare:workers.
+// Resolution logic that requires the runtime lives in client-secret.ts.
+export interface ClientSecretLiteral {
+	readonly __clientSecretLiteral: true
+	readonly value: string
+}
+
+export interface SerializedClientSecretLiteral {
+	readonly __growthLabsAuthClientSecretLiteral: 1
+	readonly value: string
+}
+
+const issuedClientSecretLiterals = new WeakSet<ClientSecretLiteral>()
+
+export function literalClientSecret(value: string): ClientSecretLiteral {
+	const literal = Object.freeze({ __clientSecretLiteral: true as const, value })
+	issuedClientSecretLiterals.add(literal)
+	return literal
+}
+
+export function isClientSecretLiteral(v: unknown): v is ClientSecretLiteral {
+	return (
+		typeof v === 'object' &&
+		v !== null &&
+		issuedClientSecretLiterals.has(v as ClientSecretLiteral) &&
+		(v as Record<string, unknown>).__clientSecretLiteral === true &&
+		typeof (v as Record<string, unknown>).value === 'string'
+	)
+}
+
+// Only the integration calls this after authOptionsSchema has accepted a
+// WeakSet-issued literal. The distinct wire marker is never accepted directly
+// by resolveClientSecret; config-store must rehydrate it into a newly issued
+// literal after Vite's JSON serialization boundary.
+export function serializeClientSecretLiteral(
+	literal: ClientSecretLiteral,
+): SerializedClientSecretLiteral {
+	if (!isClientSecretLiteral(literal)) {
+		throw new TypeError('client secret literal was not issued by literalClientSecret()')
+	}
+	return Object.freeze({
+		__growthLabsAuthClientSecretLiteral: 1 as const,
+		value: literal.value,
+	})
+}
+
+export function rehydrateClientSecretLiteral(value: unknown): unknown {
+	if (typeof value !== 'object' || value === null || Array.isArray(value)) return value
+	const prototype = Object.getPrototypeOf(value)
+	if (prototype !== Object.prototype && prototype !== null) return value
+	const descriptors = Object.getOwnPropertyDescriptors(value)
+	const keys = Object.keys(descriptors)
+	const marker = descriptors.__growthLabsAuthClientSecretLiteral
+	const literalValue = descriptors.value
+	if (
+		keys.length !== 2 ||
+		!keys.includes('__growthLabsAuthClientSecretLiteral') ||
+		!keys.includes('value') ||
+		!marker ||
+		!('value' in marker) ||
+		marker.value !== 1 ||
+		!literalValue ||
+		!('value' in literalValue) ||
+		typeof literalValue.value !== 'string'
+	) {
+		return value
+	}
+	return literalClientSecret(literalValue.value)
+}

package/src/utils/client-secret.ts

@@ -1,22 +1,144 @@
 import { getRuntimeEnv } from '../runtime.js'
+import {
+	type ClientSecretLiteral,
+	isClientSecretLiteral,
+	literalClientSecret,
+} from './client-secret-literal.js'
 
-interface SecretsStoreBinding {
-	get(): Promise<string>
+export type { ClientSecretLiteral }
+export { isClientSecretLiteral, literalClientSecret }
+
+export type ClientSecretResolutionErrorCode =
+	| 'BINDING_REJECTED'
+	| 'BINDING_MALFORMED'
+	| 'BINDING_EMPTY'
+	| 'BINDING_MISSING'
+
+export type ClientSecretResult =
+	| { ok: true; secret: string | null }
+	| { ok: false; code: ClientSecretResolutionErrorCode }
+
+type PerRequestCache = Map<string, Promise<ClientSecretResult>>
+
+const CLIENT_SECRET_READ_TIMEOUT_MS = 5_000
+const CLIENT_SECRET_READ_TIMEOUT = Symbol('client-secret-read-timeout')
+
+// Module-private request-lifetime cache. The WeakMap is keyed strictly by
+// Request; entries are naturally collectible with the Request and are never
+// attached to consumer-visible Request properties or symbols.
+const requestCache = new WeakMap<Request, PerRequestCache>()
+
+function getPerRequestCache(request: Request): PerRequestCache {
+	let cache = requestCache.get(request)
+	if (!cache) {
+		cache = new Map<string, Promise<ClientSecretResult>>()
+		requestCache.set(request, cache)
+	}
+	return cache
 }
 
-export async function resolveClientSecret(clientSecret?: string): Promise<string | undefined> {
-	if (!clientSecret) return undefined
+async function doResolve(clientSecretName: string): Promise<ClientSecretResult> {
+	const runtimeEnv = getRuntimeEnv()
+	let hasOwnBinding: boolean
+	try {
+		hasOwnBinding = Object.hasOwn(runtimeEnv, clientSecretName)
+	} catch {
+		return { ok: false, code: 'BINDING_MALFORMED' }
+	}
+	if (!hasOwnBinding) return { ok: false, code: 'BINDING_MISSING' }
+
+	let runtimeValue: unknown
+	try {
+		runtimeValue = runtimeEnv[clientSecretName]
+	} catch {
+		return { ok: false, code: 'BINDING_MALFORMED' }
+	}
 
-	const runtimeValue = getRuntimeEnv()[clientSecret]
 	if (typeof runtimeValue === 'string') {
-		return runtimeValue.length > 0 ? runtimeValue : undefined
+		// Use trim() only to detect all-whitespace emptiness; return original bytes.
+		return runtimeValue.trim().length > 0
+			? { ok: true, secret: runtimeValue }
+			: { ok: false, code: 'BINDING_EMPTY' }
 	}
-	if (isSecretsStoreBinding(runtimeValue)) {
-		const resolved = await runtimeValue.get()
-		return resolved.length > 0 ? resolved : undefined
+
+	if (typeof runtimeValue === 'object' && runtimeValue !== null) {
+		let get: unknown
+		try {
+			get = Reflect.get(runtimeValue, 'get')
+		} catch {
+			return { ok: false, code: 'BINDING_MALFORMED' }
+		}
+		if (typeof get !== 'function') return { ok: false, code: 'BINDING_MALFORMED' }
+
+		let resolved: unknown
+		let timeoutId: ReturnType<typeof setTimeout> | undefined
+		try {
+			const timeout = new Promise<typeof CLIENT_SECRET_READ_TIMEOUT>((resolve) => {
+				timeoutId = setTimeout(
+					() => resolve(CLIENT_SECRET_READ_TIMEOUT),
+					CLIENT_SECRET_READ_TIMEOUT_MS,
+				)
+			})
+			const read = Promise.resolve(Reflect.apply(get, runtimeValue, []))
+			resolved = await Promise.race([read, timeout])
+		} catch {
+			return { ok: false, code: 'BINDING_REJECTED' }
+		} finally {
+			if (timeoutId !== undefined) clearTimeout(timeoutId)
+		}
+		if (resolved === CLIENT_SECRET_READ_TIMEOUT) {
+			return { ok: false, code: 'BINDING_REJECTED' }
+		}
+		if (typeof resolved !== 'string') return { ok: false, code: 'BINDING_MALFORMED' }
+		return resolved.trim().length > 0
+			? { ok: true, secret: resolved }
+			: { ok: false, code: 'BINDING_EMPTY' }
 	}
 
-	return clientSecret
+	// Own binding key exists but is neither a string nor a Secrets Store binding.
+	return { ok: false, code: 'BINDING_MALFORMED' }
+}
+
+export async function resolveClientSecret(
+	clientSecret: string | ClientSecretLiteral | undefined,
+	request?: Request,
+): Promise<ClientSecretResult> {
+	// undefined means no clientSecret is configured — public client
+	if (clientSecret === undefined) return { ok: true, secret: null }
+
+	// Explicit literal: use value directly, no binding lookup, no I/O, no caching.
+	if (isClientSecretLiteral(clientSecret)) {
+		const { value } = clientSecret
+		return value.trim().length > 0
+			? { ok: true, secret: value }
+			: { ok: false, code: 'BINDING_EMPTY' }
+	}
+
+	// Runtime config is a serialization boundary. Any object that was not
+	// explicitly rehydrated into a module-issued literal is malformed config,
+	// never a value on which string methods may be invoked.
+	if (typeof clientSecret !== 'string') {
+		return { ok: false, code: 'BINDING_MALFORMED' }
+	}
+
+	// Empty/whitespace-only binding name is invalid configuration, not a public client.
+	if (clientSecret.trim().length === 0) {
+		return { ok: false, code: 'BINDING_EMPTY' }
+	}
+
+	// Non-empty string: treat as a binding name, cache per (Request, name).
+	if (request) {
+		const cache = getPerRequestCache(request)
+		let pending = cache.get(clientSecret)
+		if (!pending) {
+			pending = doResolve(clientSecret)
+			cache.set(clientSecret, pending)
+		}
+		return pending
+	}
+
+	// No Request context: resolve without caching (test or internal call).
+	return doResolve(clientSecret)
 }
 
 export function createClientSecretBasicAuthHeader(clientId: string, clientSecret: string): string {
@@ -27,11 +149,3 @@ function formEncode(value: string): string {
 	const params = new URLSearchParams({ value })
 	return params.toString().slice('value='.length)
 }
-
-function isSecretsStoreBinding(value: unknown): value is SecretsStoreBinding {
-	return (
-		typeof value === 'object' &&
-		value !== null &&
-		typeof (value as { get?: unknown }).get === 'function'
-	)
-}

package/src/utils/fail-closed.ts

@@ -0,0 +1,74 @@
+import type { ClientSecretResolutionErrorCode } from './client-secret.js'
+
+export type ClientSecretFailureSurface =
+	| 'middleware_refresh'
+	| 'callback_exchange'
+	| 'logout_revocation'
+	| 'route_preflight'
+	| 'route_exchange'
+	| 'server_auth_client'
+
+export interface ClientSecretFailureSignal {
+	readonly surface: ClientSecretFailureSurface
+	readonly code: ClientSecretResolutionErrorCode
+}
+
+// Shared no-store headers for all secret-resolution failure responses.
+const SECURITY_HEADERS: Record<string, string> = {
+	'Cache-Control': 'private, no-store',
+	Pragma: 'no-cache',
+	Expires: '0',
+}
+
+function acceptsJson(request: Request | undefined): boolean {
+	const accept = request?.headers.get('accept') ?? ''
+	return accept
+		.split(',')
+		.some((value) => value.trim().toLowerCase().split(';')[0] === 'application/json')
+}
+
+// Fixed-vocabulary 503 for secret-resolution failures on all surfaces.
+// Browser callers receive bounded plain text; JSON callers receive one fixed
+// JSON error. Neither class reflects a path, provider, error code, raw error,
+// secret value, or stack. Callers must invoke this before issuer I/O.
+export function reportClientSecretResolutionFailure(signal: ClientSecretFailureSignal): void {
+	try {
+		console.error('[growth-labs/auth] client_secret_resolution_failed', {
+			surface: signal.surface,
+			code: signal.code,
+		})
+	} catch {
+		// Observability must never replace the bounded fail-closed response.
+	}
+}
+
+export function secretResolutionFailureResponse(
+	request?: Request,
+	signal?: ClientSecretFailureSignal,
+): Response {
+	if (signal) reportClientSecretResolutionFailure(signal)
+	if (acceptsJson(request)) {
+		return Response.json(
+			{ error: 'auth_service_unavailable' },
+			{ status: 503, headers: new Headers(SECURITY_HEADERS as HeadersInit) },
+		)
+	}
+
+	return new Response('Service unavailable', {
+		status: 503,
+		headers: new Headers({
+			...SECURITY_HEADERS,
+			'Content-Type': 'text/plain; charset=UTF-8',
+		}),
+	})
+}
+
+// Typed error thrown by server-helper headersFor() on secret binding failure.
+// Exported so consumers can distinguish secret-resolution failure from
+// network/credential failure in custom server-side auth flows.
+export class ClientSecretResolutionError extends Error {
+	override readonly name = 'ClientSecretResolutionError'
+	constructor(public readonly code: ClientSecretResolutionErrorCode) {
+		super('client_secret_binding_unavailable')
+	}
+}

package/src/utils/index.ts

@@ -10,6 +10,13 @@ export {
 	normalizeAuthProvider,
 	trackAuthEvent,
 } from './analytics.js'
+export type {
+	ClientSecretLiteral,
+	ClientSecretResolutionErrorCode,
+	ClientSecretResult,
+} from './client-secret.js'
+export { isClientSecretLiteral, literalClientSecret } from './client-secret.js'
+export { ClientSecretResolutionError } from './fail-closed.js'
 export {
 	type BridgeMigrationOptions,
 	type BridgeMigrationStatement,
@@ -25,7 +32,13 @@ export {
 	rewriteLegacyIdentitySubjects,
 } from './identity.js'
 export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js'
-export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js'
+export {
+	EXCHANGE_SECRET_FAILURE,
+	type ExchangeSecretFailure,
+	getAuthorizationUrl,
+	getMagicLinkUrl,
+	getPasswordLoginUrl,
+} from './openauth.js'
 export { createPKCEChallenge, generatePKCE } from './pkce.js'
 export { generateState, verifyState } from './state.js'
 export type { VerifiedClaims } from './tokens.js'