@payez/next-mvp 4.1.10 → 4.1.12

package/dist/api-handlers/auth/refresh.js

@@ -371,7 +371,7 @@ function createRefreshHandler(config) {
                     const errorMessage = idpError.message || 'Token refresh failed';
                     // CRITICAL: 401 means token is definitively invalid - always discard
                     // This prevents redirect loops where viability check keeps returning canRefresh:true
-                    let discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
+                    const discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
                     const retryable = refreshResponse.status !== 401 && idpError.retryable === true;
                     const resolution = idpError.resolution || null;
                     // ============================================================================
@@ -408,43 +408,20 @@ function createRefreshHandler(config) {
                     console.error('[AUTH_REFRESH] Full IDP error response:', JSON.stringify(responseData, null, 2).substring(0, 1000));
                     // If IDP signals to discard token, clear it from Redis
                     if (discardToken) {
-                        // Race-safe discard (CAS): only clear if the refresh token we sent is STILL
-                        // the current one. A concurrent refresh may have already rotated it — our 401
-                        // is then stale, and wiping here would silently log out a healthy session
-                        // (the rotation-race wipe, QA 6873 site 2). Skip the wipe + drop terminal if changed.
-                        const postRefresh = await (0, session_store_1.getSession)(sessionToken);
-                        const tokenUnchanged = !!originalRefreshToken && postRefresh?.idpRefreshToken === originalRefreshToken;
-                        if (tokenUnchanged) {
-                            console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
-                                reason: 'IDP_DISCARD_TOKEN',
-                                errorCode,
-                                userId,
-                                sessionToken: sessionToken.substring(0, 8) + '...',
-                                hadRefreshToken: !!currentSession.idpRefreshToken,
-                                stack: new Error().stack
-                            });
-                            await (0, session_store_1.updateSession)(sessionToken, {
-                                idpRefreshToken: '',
-                                idpRefreshTokenExpires: undefined,
-                                refreshTokenClearedAt: Date.now(),
-                                refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
-                            });
-                        }
-                        else {
-                            // Concurrent refresh already rotated the token — our 401 is stale. Return the
-                            // freshly-rotated token directly so the loser succeeds without a retry
-                            // (race-fix follow-up #1).
-                            discardToken = false;
-                            console.warn('[AUTH_REFRESH] Discard suppressed: refresh token already rotated by a concurrent refresh — returning the fresh token (race-safe).');
-                            if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
-                                return server_1.NextResponse.json({
-                                    refreshed: true,
-                                    reason: 'completed_by_concurrent_request',
-                                    accessTokenExpires: postRefresh.idpAccessTokenExpires,
-                                    hasRefreshToken: !!postRefresh.idpRefreshToken,
-                                });
-                            }
-                        }
+                        console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
+                            reason: 'IDP_DISCARD_TOKEN',
+                            errorCode,
+                            userId,
+                            sessionToken: sessionToken.substring(0, 8) + '...',
+                            hadRefreshToken: !!currentSession.idpRefreshToken,
+                            stack: new Error().stack
+                        });
+                        await (0, session_store_1.updateSession)(sessionToken, {
+                            idpRefreshToken: '',
+                            idpRefreshTokenExpires: undefined,
+                            refreshTokenClearedAt: Date.now(),
+                            refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
+                        });
                     }
                     return server_1.NextResponse.json({
                         error: errorMessage,

package/dist/auth/better-auth.js

@@ -60,7 +60,6 @@ const magic_link_1 = require("better-auth/plugins/magic-link");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const redis_1 = require("../lib/redis");
-const session_store_1 = require("../lib/session-store");
 /**
  * Build Better Auth social providers from IDP config.
  */
@@ -126,24 +125,16 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
         // Redis-backed session storage via secondaryStorage
         secondaryStorage: {
             get: async (key) => {
-                try {
-                    return await (0, redis_1.getRedis)().get(`ba:${appSlug}:${key}`);
-                }
-                catch {
-                    return null;
-                }
+                return await (0, redis_1.getRedis)().get(`ba:${appSlug}:${key}`);
             },
             set: async (key, value, ttl) => {
-                try {
-                    const redis = (0, redis_1.getRedis)();
-                    if (ttl) {
-                        await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
-                    }
-                    else {
-                        await redis.setex(`ba:${appSlug}:${key}`, session_store_1.SESSION_TTL, value);
-                    }
+                const redis = (0, redis_1.getRedis)();
+                if (ttl) {
+                    await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
+                }
+                else {
+                    await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
                 }
-                catch { /* Redis unavailable — cookie cache still works */ }
             },
             delete: async (key) => {
                 try {
@@ -348,13 +339,13 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         };
         // Store in BA Redis session (for decodeSession)
         baData.idpTokens = idpTokenData;
-        await (0, redis_1.getRedis)().setex(baKey, session_store_1.SESSION_TTL, JSON.stringify(baData));
+        await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
         // Write to canonical session store so refresh handler and token lifecycle can find the tokens.
         // Key format: {sessionPrefix}{token} — same key that getSession() reads from.
         try {
             const { getSessionPrefix } = await Promise.resolve().then(() => __importStar(require('../lib/app-slug')));
             const canonicalKey = `${getSessionPrefix()}${sessionToken}`;
-            await (0, redis_1.getRedis)().setex(canonicalKey, session_store_1.SESSION_TTL, JSON.stringify({
+            await (0, redis_1.getRedis)().setex(canonicalKey, 7 * 24 * 60 * 60, JSON.stringify({
                 ...idpTokenData,
                 oauthProvider: provider,
             }));

package/dist/client/better-auth-client.d.ts

@@ -814,7 +814,13 @@ export declare const authClient: {
         isPending: boolean;
         isRefetching: boolean;
         error: import("@better-fetch/fetch").BetterFetchError | null;
-        refetch: (queryParams?: {
+        refetch: (queryParams
+        /**
+         * NextAuth-compatible signOut wrapper.
+         *
+         * Maps NextAuth signOut({ redirect, callbackUrl }) to Better Auth.
+         */
+        ?: {
             query?: import("better-auth/types").SessionQueryParams;
         } | undefined) => Promise<void>;
     };
@@ -988,7 +994,13 @@ export declare const useSession: () => {
     isPending: boolean;
     isRefetching: boolean;
     error: import("@better-fetch/fetch").BetterFetchError | null;
-    refetch: (queryParams?: {
+    refetch: (queryParams
+    /**
+     * NextAuth-compatible signOut wrapper.
+     *
+     * Maps NextAuth signOut({ redirect, callbackUrl }) to Better Auth.
+     */
+    ?: {
         query?: import("better-auth/types").SessionQueryParams;
     } | undefined) => Promise<void>;
 }, signIn: {

package/dist/lib/ensure-fresh-access-token.js

@@ -200,38 +200,15 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
         if (!idpResponse.ok) {
             const idpError = responseData?.error || {};
             const code = idpError.code || 'UNKNOWN_ERROR';
-            let discardToken = idpResponse.status === 401 || idpError.discard_token === true;
+            const discardToken = idpResponse.status === 401 || idpError.discard_token === true;
             const retryable = idpResponse.status !== 401 && idpError.retryable === true;
             if (discardToken) {
-                // Race-safe discard (CAS): only clear if the refresh token we used is STILL
-                // current. A concurrent refresh may have already rotated it — our 401 is then
-                // stale/expected, and wiping here would silently log out a healthy session
-                // (the rotation-race wipe, QA 6873 site 1/2). Compare-and-skip if it changed;
-                // a concurrent rotation is NOT a terminal condition.
-                const postRefresh = await (0, session_store_1.getSession)(sessionToken);
-                const tokenUnchanged = !!session.idpRefreshToken && postRefresh?.idpRefreshToken === session.idpRefreshToken;
-                if (tokenUnchanged) {
-                    await (0, session_store_1.updateSession)(sessionToken, {
-                        idpRefreshToken: '',
-                        idpRefreshTokenExpires: undefined,
-                        refreshTokenClearedAt: Date.now(),
-                        refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
-                    });
-                }
-                else {
-                    // Concurrent refresh already rotated the token — our 401 is stale. Return the
-                    // freshly-rotated token directly so the loser succeeds without a retry round-trip
-                    // (race-fix follow-up #1).
-                    discardToken = false;
-                    if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
-                        return {
-                            ok: true,
-                            accessToken: postRefresh.idpAccessToken,
-                            accessTokenExpires: postRefresh.idpAccessTokenExpires,
-                            refreshed: true,
-                        };
-                    }
-                }
+                await (0, session_store_1.updateSession)(sessionToken, {
+                    idpRefreshToken: '',
+                    idpRefreshTokenExpires: undefined,
+                    refreshTokenClearedAt: Date.now(),
+                    refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
+                });
             }
             return {
                 ok: false,

package/dist/lib/session-store.d.ts

@@ -9,7 +9,6 @@
  */
 import { SessionData } from '../models/SessionModel';
 export type { SessionData } from '../models/SessionModel';
-export declare const SESSION_TTL: number;
 export interface RefreshLockInfo {
     sessionToken: string;
     acquiredAt: number;

package/dist/lib/session-store.js

@@ -12,7 +12,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SESSION_TTL = void 0;
 exports.generateSessionToken = generateSessionToken;
 exports.createSession = createSession;
 exports.getSession = getSession;
@@ -47,10 +46,7 @@ const getSessionVersionKey = (token) => `${(0, app_slug_1.getSessionPrefix)()}ve
 // Better Auth uses a different key format: ba:{appSlug}:{token}
 const getBetterAuthSessionKey = (token, appSlug) => `ba:${appSlug || 'app'}:${token}`;
 const REFRESH_LOCK_TTL = 60; // 60 seconds
-// 3 days in seconds (matches refresh token lifetime). EXPORTED as the single source
-// of session TTL — better-auth.ts derives its BA-session Redis TTL from this so the
-// two can never drift apart again (the 7d-vs-3d drift = the zombie-session window, QA 6952).
-exports.SESSION_TTL = 3 * 24 * 60 * 60;
+const SESSION_TTL = 3 * 24 * 60 * 60; // 3 days in seconds (matches refresh token lifetime)
 /**
  * Generates a new session token.
  * @returns A new session token string.
@@ -70,8 +66,8 @@ async function createSession(data) {
     const versionKey = getSessionVersionKey(sessionToken);
     try {
         await redis_1.default.multi()
-            .setex(key, exports.SESSION_TTL, JSON.stringify(data))
-            .setex(versionKey, exports.SESSION_TTL, '1')
+            .setex(key, SESSION_TTL, JSON.stringify(data))
+            .setex(versionKey, SESSION_TTL, '1')
             .exec();
     }
     catch (error) {
@@ -152,7 +148,7 @@ async function getBetterAuthSession(sessionToken, appSlug) {
  */
 async function touchSession(token) {
     const key = getSessionKey(token);
-    await redis_1.default.expire(key, exports.SESSION_TTL);
+    await redis_1.default.expire(key, SESSION_TTL);
 }
 /**
  * Retrieves a session along with a version identifier for optimistic locking.
@@ -218,9 +214,9 @@ async function setSession(sessionToken, data) {
     const key = getSessionKey(sessionToken);
     const versionKey = getSessionVersionKey(sessionToken);
     await redis_1.default.multi()
-        .setex(key, exports.SESSION_TTL, JSON.stringify(data))
+        .setex(key, SESSION_TTL, JSON.stringify(data))
         .incr(versionKey)
-        .expire(versionKey, exports.SESSION_TTL)
+        .expire(versionKey, SESSION_TTL)
         .exec();
 }
 /**
@@ -258,9 +254,9 @@ async function updateSession(sessionToken, updates) {
     const updatedSession = { ...currentSession, ...updates };
     // Write the entire updated session back to Redis with version increment
     await redis_1.default.multi()
-        .setex(key, exports.SESSION_TTL, JSON.stringify(updatedSession))
+        .setex(key, SESSION_TTL, JSON.stringify(updatedSession))
         .incr(versionKey)
-        .expire(versionKey, exports.SESSION_TTL)
+        .expire(versionKey, SESSION_TTL)
         .exec();
     return updatedSession;
 }
@@ -489,27 +485,27 @@ async function releaseRefreshLock(sessionToken, requestId, lockVersion) {
     const lockKey = getRefreshLockKey(sessionToken);
     try {
         // Lua script for atomic lock validation and release
-        const luaScript = `
-      local lockKey = KEYS[1]
-      local expectedRequestId = ARGV[1]
-      local expectedVersion = ARGV[2]
-
-      local lockData = redis.call('GET', lockKey)
-      if not lockData then
-        return 0  -- Lock doesn't exist
-      end
-
-      local lockInfo = cjson.decode(lockData)
-      if lockInfo.acquiredBy == expectedRequestId then
-        if not expectedVersion or expectedVersion == '' or tostring(lockInfo.lockVersion) == expectedVersion then
-          redis.call('DEL', lockKey)
-          return 1  -- Successfully released
-        else
-          return -2  -- Version mismatch
-        end
-      else
-        return -1  -- Wrong owner
-      end
+        const luaScript = `
+      local lockKey = KEYS[1]
+      local expectedRequestId = ARGV[1]
+      local expectedVersion = ARGV[2]
+
+      local lockData = redis.call('GET', lockKey)
+      if not lockData then
+        return 0  -- Lock doesn't exist
+      end
+
+      local lockInfo = cjson.decode(lockData)
+      if lockInfo.acquiredBy == expectedRequestId then
+        if not expectedVersion or expectedVersion == '' or tostring(lockInfo.lockVersion) == expectedVersion then
+          redis.call('DEL', lockKey)
+          return 1  -- Successfully released
+        else
+          return -2  -- Version mismatch
+        end
+      else
+        return -1  -- Wrong owner
+      end
     `;
         const result = await redis_1.default.eval(luaScript, 1, lockKey, requestId, lockVersion ? lockVersion.toString() : '');
         if (result === 1) {

package/dist/lib/startup-init.js

@@ -213,25 +213,25 @@ async function performInitialization() {
         const connectionLine = isConnectionError
             ? '║   🔌 CONNECTION REFUSED - IDP appears to be down             ║\n║                                                              ║\n'
             : '';
-        console.error(`
-╔══════════════════════════════════════════════════════════════╗
-║   ❌ FATAL: BETTER_AUTH_SECRET NOT AVAILABLE                  ║
-║                                                              ║
-║   The app cannot start without a valid auth signing secret.  ║
-║   This should be fetched from IDP at startup.                ║
-║                                                              ║
-${connectionLine}║   Possible causes:                                           ║
-║   • IDP is not running or unreachable                        ║
-║   • CLIENT_ID is not registered in IDP                       ║
-║   • IDP_URL is incorrect                                     ║
-║   • Network connectivity issue                               ║
-║                                                              ║
-║   Current config:                                            ║
-║   • IDP_URL: ${idpUrl}║
-║   • CLIENT_ID: ${clientId}║
-╚══════════════════════════════════════════════════════════════╝
-
-[STARTUP] Error: ${errorMsg}
+        console.error(`
+╔══════════════════════════════════════════════════════════════╗
+║   ❌ FATAL: BETTER_AUTH_SECRET NOT AVAILABLE                  ║
+║                                                              ║
+║   The app cannot start without a valid auth signing secret.  ║
+║   This should be fetched from IDP at startup.                ║
+║                                                              ║
+${connectionLine}║   Possible causes:                                           ║
+║   • IDP is not running or unreachable                        ║
+║   • CLIENT_ID is not registered in IDP                       ║
+║   • IDP_URL is incorrect                                     ║
+║   • Network connectivity issue                               ║
+║                                                              ║
+║   Current config:                                            ║
+║   • IDP_URL: ${idpUrl}║
+║   • CLIENT_ID: ${clientId}║
+╚══════════════════════════════════════════════════════════════╝
+
+[STARTUP] Error: ${errorMsg}
 `);
         // Re-throw so callers know initialization failed
         throw lastInitError;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.1.10",
+  "version": "4.1.12",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,11 +10,12 @@
     "src"
   ],
   "scripts": {
-    "build": "npx tsc --project tsconfig.json",
+    "build": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true});fs.rmSync('tsconfig.tsbuildinfo',{force:true})\" && npx tsc --project tsconfig.json",
     "prepublishOnly": "npm run build",
     "dev": "next dev",
     "dev:local": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-local.ps1",
-    "dev:broker": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-broker.ps1"
+    "dev:broker": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-broker.ps1",
+    "prepack": "npm run build"
   },
   "exports": {
     ".": {

package/scripts/check-internal-url-usage.sh

@@ -1,73 +1,73 @@
-#!/bin/bash
-#
-# CI Check: Detect incorrect internal API URL patterns
-#
-# This script fails if code is using req.url or req.nextUrl.origin to construct
-# URLs for internal API calls. These patterns cause 403 errors in Kubernetes
-# because they use the external HTTPS URL instead of INTERNAL_API_URL.
-#
-# CORRECT:   Use internalFetch() or internalRefresh() from @payez/next-mvp/lib/internal-api
-# INCORRECT: new URL('/api/...', req.url) or fetch(`${req.nextUrl.origin}/api/...`)
-#
-# NOTE: new URL(req.url) alone is FINE - it just parses the incoming request URL.
-#       The problem is when you construct a NEW path using req.url as the base.
-#
-
-set -e
-
-SEARCH_PATH="${1:-.}"
-ERRORS_FOUND=0
-
-echo "Checking for incorrect internal URL patterns in: $SEARCH_PATH"
-echo "========================================================================"
-
-# Pattern 1: new URL('/api/...', req.url) - constructing internal API URL from request
-# This catches: new URL('/api/...', req.url) and new URL("/api/...", req.url)
-# But NOT: new URL(req.url) which is just parsing the request
-echo ""
-echo "Checking for: new URL('/api/...', req.url) pattern"
-if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\(['\"][^'\"]*['\"],\s*req\.url" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'new URL(path, req.url)' pattern. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 2: new URL('/api/...', req.nextUrl) or new URL(..., req.nextUrl.origin)
-echo ""
-echo "Checking for: new URL(..., req.nextUrl) pattern"
-if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\([^)]+,\s*req\.nextUrl" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'new URL(..., req.nextUrl)' pattern. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 3: fetch with req.nextUrl.origin and /api/
-echo ""
-echo "Checking for: fetch with req.nextUrl.origin and /api/"
-if grep -rn --include="*.ts" --include="*.tsx" "req\.nextUrl\.origin.*\/api\/" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'req.nextUrl.origin' used with internal API route. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 4: Direct fetch to /api/auth/refresh without using internalRefresh (warning only)
-echo ""
-echo "Checking for: Direct fetch to /api/auth/refresh (should use internalRefresh)"
-if grep -rn --include="*.ts" --include="*.tsx" "fetch.*\/api\/auth\/refresh" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts" | grep -v "internal-api\.ts"; then
-    echo "WARNING: Found direct fetch to /api/auth/refresh. Consider using internalRefresh() helper."
-    # Not failing on this one as it might be intentional in some cases (client-side refresh)
-fi
-
-echo ""
-echo "========================================================================"
-
-if [ $ERRORS_FOUND -eq 1 ]; then
-    echo "FAILED: Dangerous internal URL patterns detected!"
-    echo ""
-    echo "Fix: Import and use helpers from @payez/next-mvp/lib/internal-api:"
-    echo "  import { internalFetch, internalRefresh } from '@payez/next-mvp/lib/internal-api';"
-    echo ""
-    echo "Why: Server-to-server calls must use INTERNAL_API_URL (http://service.namespace.svc.cluster.local)"
-    echo "     not the external URL from the request (https://api.example.com) which fails in Kubernetes."
-    exit 1
-else
-    echo "PASSED: No dangerous internal URL patterns found."
-    exit 0
-fi
+#!/bin/bash
+#
+# CI Check: Detect incorrect internal API URL patterns
+#
+# This script fails if code is using req.url or req.nextUrl.origin to construct
+# URLs for internal API calls. These patterns cause 403 errors in Kubernetes
+# because they use the external HTTPS URL instead of INTERNAL_API_URL.
+#
+# CORRECT:   Use internalFetch() or internalRefresh() from @payez/next-mvp/lib/internal-api
+# INCORRECT: new URL('/api/...', req.url) or fetch(`${req.nextUrl.origin}/api/...`)
+#
+# NOTE: new URL(req.url) alone is FINE - it just parses the incoming request URL.
+#       The problem is when you construct a NEW path using req.url as the base.
+#
+
+set -e
+
+SEARCH_PATH="${1:-.}"
+ERRORS_FOUND=0
+
+echo "Checking for incorrect internal URL patterns in: $SEARCH_PATH"
+echo "========================================================================"
+
+# Pattern 1: new URL('/api/...', req.url) - constructing internal API URL from request
+# This catches: new URL('/api/...', req.url) and new URL("/api/...", req.url)
+# But NOT: new URL(req.url) which is just parsing the request
+echo ""
+echo "Checking for: new URL('/api/...', req.url) pattern"
+if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\(['\"][^'\"]*['\"],\s*req\.url" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'new URL(path, req.url)' pattern. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 2: new URL('/api/...', req.nextUrl) or new URL(..., req.nextUrl.origin)
+echo ""
+echo "Checking for: new URL(..., req.nextUrl) pattern"
+if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\([^)]+,\s*req\.nextUrl" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'new URL(..., req.nextUrl)' pattern. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 3: fetch with req.nextUrl.origin and /api/
+echo ""
+echo "Checking for: fetch with req.nextUrl.origin and /api/"
+if grep -rn --include="*.ts" --include="*.tsx" "req\.nextUrl\.origin.*\/api\/" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'req.nextUrl.origin' used with internal API route. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 4: Direct fetch to /api/auth/refresh without using internalRefresh (warning only)
+echo ""
+echo "Checking for: Direct fetch to /api/auth/refresh (should use internalRefresh)"
+if grep -rn --include="*.ts" --include="*.tsx" "fetch.*\/api\/auth\/refresh" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts" | grep -v "internal-api\.ts"; then
+    echo "WARNING: Found direct fetch to /api/auth/refresh. Consider using internalRefresh() helper."
+    # Not failing on this one as it might be intentional in some cases (client-side refresh)
+fi
+
+echo ""
+echo "========================================================================"
+
+if [ $ERRORS_FOUND -eq 1 ]; then
+    echo "FAILED: Dangerous internal URL patterns detected!"
+    echo ""
+    echo "Fix: Import and use helpers from @payez/next-mvp/lib/internal-api:"
+    echo "  import { internalFetch, internalRefresh } from '@payez/next-mvp/lib/internal-api';"
+    echo ""
+    echo "Why: Server-to-server calls must use INTERNAL_API_URL (http://service.namespace.svc.cluster.local)"
+    echo "     not the external URL from the request (https://api.example.com) which fails in Kubernetes."
+    exit 1
+else
+    echo "PASSED: No dangerous internal URL patterns found."
+    exit 0
+fi

package/src/api/index.ts

@@ -1,18 +1,18 @@
-/**
- * @payez/next-mvp API Module Exports
- *
- * Provides enhanced API route handlers with automatic token management
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-
-export {
-  createAuthHandler,
-  type AuthContext,
-  type AuthHandlerOptions,
-  type HandlerFunction
-} from './auth-handler';
-
-// Default export for convenience
+/**
+ * @payez/next-mvp API Module Exports
+ *
+ * Provides enhanced API route handlers with automatic token management
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+
+export {
+  createAuthHandler,
+  type AuthContext,
+  type AuthHandlerOptions,
+  type HandlerFunction
+} from './auth-handler';
+
+// Default export for convenience
 export { default } from './auth-handler';