Fail Vercel builds when native OAuth configuration is invalid

package.json

@@ -24,7 +24,8 @@
     "dev": "next dev -p 3002",
     "build:managed-auth-app": "bun scripts/build-managed-auth-app.mjs",
     "check:managed-auth-app": "bun scripts/build-managed-auth-app.mjs --check",
-    "build": "bun run check:managed-auth-app && next build",
+    "check:native-oauth-config": "bun scripts/check-native-oauth-config.ts",
+    "build": "bun run check:managed-auth-app && bun run check:native-oauth-config && next build",
     "start": "next start -p 3002",
     "lint": "next lint",
     "test": "bun test",

scripts/check-native-oauth-config.ts

@@ -0,0 +1,9 @@
+// Runs the server's native OAuth startup check during Vercel builds, so a
+// misconfigured environment fails its deployment and the previous one keeps
+// serving. Local builds skip it; the dev server runs the same check at startup.
+export {};
+
+if (process.env.VERCEL) {
+  const { describeNativeOAuthConfig } = await import("@/lib/native-oauth");
+  console.info(describeNativeOAuthConfig());
+}

src/instrumentation.ts

@@ -3,11 +3,6 @@
 // native OAuth settings stop a deployment instead of failing per request.
 export async function register() {
   if (process.env.NEXT_RUNTIME !== "nodejs") return;
-  const { nativeOAuthConfig } = await import("@/lib/native-oauth");
-  const config = nativeOAuthConfig();
-  console.info(
-    config
-      ? `native OAuth enabled: issuer ${config.issuer}, resource ${config.audience}`
-      : "native OAuth disabled",
-  );
+  const { describeNativeOAuthConfig } = await import("@/lib/native-oauth");
+  console.info(describeNativeOAuthConfig());
 }

src/lib/native-oauth.ts

@@ -194,6 +194,14 @@ export function nativeOAuthConfig(): NativeOAuthConfig | null {
   return resolvedConfig.value;
 }
 
+// One line for startup and build logs. Throws when the configuration is invalid.
+export function describeNativeOAuthConfig(): string {
+  const config = nativeOAuthConfig();
+  return config
+    ? `native OAuth enabled: issuer ${config.issuer}, resource ${config.audience}`
+    : "native OAuth disabled";
+}
+
 const keySets = new Map<string, JWTVerifyGetKey>();
 
 // Keys come only from the configured issuer's JWKS, never from a URL in the