@payez/next-mvp 4.1.10 → 4.1.20

package/src/routes/account/masked-info.ts

@@ -1,37 +1,37 @@
-/**
- * Ready-to-Use Masked Info Route
- *
- * Provides a pre-configured handler for fetching masked contact information
- * during 2FA flow. Can be imported directly into your app's API routes with
- * zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/account/masked-info/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/masked-info';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Re-export the POST handler from api-handlers
-// Note: IDP uses POST for masked-info endpoint
-export { POST } from '../../api-handlers/account/masked-info';
-
-/**
- * Pre-configured POST handler for masked contact information
- *
- * This endpoint is typically called during the 2FA flow to display masked
- * email/phone options to the user.
- *
- * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
- *
- * Returns:
- * - Masked email addresses
- * - Masked phone numbers
- * - Contact method preferences
+/**
+ * Ready-to-Use Masked Info Route
+ *
+ * Provides a pre-configured handler for fetching masked contact information
+ * during 2FA flow. Can be imported directly into your app's API routes with
+ * zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/masked-info/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/masked-info';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Re-export the POST handler from api-handlers
+// Note: IDP uses POST for masked-info endpoint
+export { POST } from '../../api-handlers/account/masked-info';
+
+/**
+ * Pre-configured POST handler for masked contact information
+ *
+ * This endpoint is typically called during the 2FA flow to display masked
+ * email/phone options to the user.
+ *
+ * Environment variables used:
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
+ *
+ * Returns:
+ * - Masked email addresses
+ * - Masked phone numbers
+ * - Contact method preferences
  */

package/src/routes/account/send-code.ts

@@ -1,40 +1,40 @@
-/**
- * Ready-to-Use Send Code Route
- *
- * Provides a pre-configured handler for sending 2FA verification codes
- * to the user's registered contact methods. Can be imported directly
- * into your app's API routes with zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/account/send-code/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/send-code';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Re-export the POST handler from api-handlers
-export { POST } from '../../api-handlers/account/send-code';
-
-/**
- * Pre-configured POST handler for sending verification codes
- *
- * This endpoint triggers the IDP to send a verification code to the
- * user's selected contact method (email or SMS).
- *
- * Request body:
- * - method: 'email' | 'sms' - The contact method to use
- * - contactId: string - ID of the masked contact to send to
- *
- * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
- *
- * Returns:
- * - Success status
- * - Rate limit information
- * - Cooldown timer if applicable
+/**
+ * Ready-to-Use Send Code Route
+ *
+ * Provides a pre-configured handler for sending 2FA verification codes
+ * to the user's registered contact methods. Can be imported directly
+ * into your app's API routes with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/send-code/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/send-code';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Re-export the POST handler from api-handlers
+export { POST } from '../../api-handlers/account/send-code';
+
+/**
+ * Pre-configured POST handler for sending verification codes
+ *
+ * This endpoint triggers the IDP to send a verification code to the
+ * user's selected contact method (email or SMS).
+ *
+ * Request body:
+ * - method: 'email' | 'sms' - The contact method to use
+ * - contactId: string - ID of the masked contact to send to
+ *
+ * Environment variables used:
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
+ *
+ * Returns:
+ * - Success status
+ * - Rate limit information
+ * - Cooldown timer if applicable
  */

package/src/routes/account/verify-email.ts

@@ -1,41 +1,41 @@
-/**
- * Ready-to-Use Verify Email Route
- *
- * Provides a pre-configured handler for verifying email-based 2FA codes.
- * Can be imported directly into your app's API routes with zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/account/verify-email/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/verify-email';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Re-export the POST handler from api-handlers
-export { POST } from '../../api-handlers/account/verify-email';
-
-/**
- * Pre-configured POST handler for verifying email 2FA codes
- *
- * This endpoint verifies the code sent to the user's email address
- * and upgrades the provisional session to a full session.
- *
- * Request body:
- * - code: string - The 6-digit verification code
- * - emailId: string - ID of the email address used
- *
- * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
- *
- * Returns:
- * - Upgraded access token with MFA claim
- * - New refresh token
- * - Session upgrade status
- * - AMR (Authentication Methods Reference) array
- * - ACR (Authentication Context Class) level
+/**
+ * Ready-to-Use Verify Email Route
+ *
+ * Provides a pre-configured handler for verifying email-based 2FA codes.
+ * Can be imported directly into your app's API routes with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/verify-email/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/verify-email';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Re-export the POST handler from api-handlers
+export { POST } from '../../api-handlers/account/verify-email';
+
+/**
+ * Pre-configured POST handler for verifying email 2FA codes
+ *
+ * This endpoint verifies the code sent to the user's email address
+ * and upgrades the provisional session to a full session.
+ *
+ * Request body:
+ * - code: string - The 6-digit verification code
+ * - emailId: string - ID of the email address used
+ *
+ * Environment variables used:
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
+ *
+ * Returns:
+ * - Upgraded access token with MFA claim
+ * - New refresh token
+ * - Session upgrade status
+ * - AMR (Authentication Methods Reference) array
+ * - ACR (Authentication Context Class) level
  */

package/src/routes/account/verify-sms.ts

@@ -1,41 +1,41 @@
-/**
- * Ready-to-Use Verify SMS Route
- *
- * Provides a pre-configured handler for verifying SMS-based 2FA codes.
- * Can be imported directly into your app's API routes with zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/account/verify-sms/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/verify-sms';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Re-export the POST handler from api-handlers
-export { POST } from '../../api-handlers/account/verify-sms';
-
-/**
- * Pre-configured POST handler for verifying SMS 2FA codes
- *
- * This endpoint verifies the code sent to the user's phone number
- * and upgrades the provisional session to a full session.
- *
- * Request body:
- * - code: string - The 6-digit verification code
- * - phoneId: string - ID of the phone number used
- *
- * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
- *
- * Returns:
- * - Upgraded access token with MFA claim
- * - New refresh token
- * - Session upgrade status
- * - AMR (Authentication Methods Reference) array
- * - ACR (Authentication Context Class) level
+/**
+ * Ready-to-Use Verify SMS Route
+ *
+ * Provides a pre-configured handler for verifying SMS-based 2FA codes.
+ * Can be imported directly into your app's API routes with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/verify-sms/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/verify-sms';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Re-export the POST handler from api-handlers
+export { POST } from '../../api-handlers/account/verify-sms';
+
+/**
+ * Pre-configured POST handler for verifying SMS 2FA codes
+ *
+ * This endpoint verifies the code sent to the user's phone number
+ * and upgrades the provisional session to a full session.
+ *
+ * Request body:
+ * - code: string - The 6-digit verification code
+ * - phoneId: string - ID of the phone number used
+ *
+ * Environment variables used:
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
+ *
+ * Returns:
+ * - Upgraded access token with MFA claim
+ * - New refresh token
+ * - Session upgrade status
+ * - AMR (Authentication Methods Reference) array
+ * - ACR (Authentication Context Class) level
  */

package/src/routes/auth/index.ts

@@ -1,23 +1,23 @@
-/**
- * @payez/next-mvp Ready-to-Use Route Exports
- *
- * Pre-configured route handlers that can be imported directly
- * into your Next.js app with zero configuration.
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-
-// Export individual route handlers
-export { POST as refreshPOST } from './refresh';
-export { GET as sessionGET, POST as sessionPOST } from './session';
-export { POST as logoutPOST } from './logout';
-export { GET as viabilityGET } from './viability';
-export { GET as nextAuthGET, POST as nextAuthPOST } from './nextauth';
-
-// Also export as namespaced objects for cleaner imports
-export * as refresh from './refresh';
-export * as session from './session';
-export * as logout from './logout';
-export * as viability from './viability';
+/**
+ * @payez/next-mvp Ready-to-Use Route Exports
+ *
+ * Pre-configured route handlers that can be imported directly
+ * into your Next.js app with zero configuration.
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+
+// Export individual route handlers
+export { POST as refreshPOST } from './refresh';
+export { GET as sessionGET, POST as sessionPOST } from './session';
+export { POST as logoutPOST } from './logout';
+export { GET as viabilityGET } from './viability';
+export { GET as nextAuthGET, POST as nextAuthPOST } from './nextauth';
+
+// Also export as namespaced objects for cleaner imports
+export * as refresh from './refresh';
+export * as session from './session';
+export * as logout from './logout';
+export * as viability from './viability';
 export * as nextauth from './nextauth';

package/src/routes/auth/passkey-signin.ts

@@ -0,0 +1,13 @@
+/**
+ * Ready-to-Use Passkey Sign-In Route (ANONYMOUS ceremony)
+ *
+ * @example
+ * ```typescript
+ * // app/api/passkey/sign-in/options/route.ts
+ * export { POST } from '@payez/next-mvp/routes/auth/passkey-signin';
+ * // (optionsPOST is exported as POST; mount verify at its own path:)
+ * // app/api/passkey/sign-in/verify/route.ts
+ * export { verifyPOST as POST } from '@payez/next-mvp/routes/auth/passkey-signin';
+ * ```
+ */
+export { optionsPOST, verifyPOST } from '../../api-handlers/auth/passkey-signin';

package/src/routes/auth/refresh.ts

@@ -1,49 +1,49 @@
-/**
- * Ready-to-Use Refresh Token Route
- *
- * Provides a pre-configured refresh handler that can be imported directly
- * into your app's API routes with zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/auth/refresh/route.ts
- * export { POST } from '@payez/next-mvp/routes/auth/refresh';
- * ```
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-
-import { createRefreshHandler } from '../../api-handlers/auth/refresh';
-
-// Configuration is read at runtime from environment.
-function getConfig() {
-  const idpBaseUrl = process.env.IDP_URL;
-  if (!idpBaseUrl) {
-    throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  }
-  return {
-    idpBaseUrl,
-    clientId: process.env.CLIENT_ID || process.env.NEXT_PUBLIC_IDP_CLIENT_ID || '',
-    refreshEndpoint: process.env.REFRESH_ENDPOINT || '/api/ExternalAuth/refresh',
-  };
-}
-
-/**
- * Pre-configured POST handler for token refresh
- *
- * Environment variables used:
- * - IDP_URL (REQUIRED)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - REFRESH_ENDPOINT (default: /api/ExternalAuth/refresh)
- */
-let _handler: ReturnType<typeof createRefreshHandler> | null = null;
-
-import { NextRequest } from 'next/server';
-
-export async function POST(req: NextRequest) {
-  if (!_handler) {
-    _handler = createRefreshHandler(getConfig());
-  }
-  return _handler(req);
+/**
+ * Ready-to-Use Refresh Token Route
+ *
+ * Provides a pre-configured refresh handler that can be imported directly
+ * into your app's API routes with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/auth/refresh/route.ts
+ * export { POST } from '@payez/next-mvp/routes/auth/refresh';
+ * ```
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+
+import { createRefreshHandler } from '../../api-handlers/auth/refresh';
+
+// Configuration is read at runtime from environment.
+function getConfig() {
+  const idpBaseUrl = process.env.IDP_URL;
+  if (!idpBaseUrl) {
+    throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  }
+  return {
+    idpBaseUrl,
+    clientId: process.env.CLIENT_ID || process.env.NEXT_PUBLIC_IDP_CLIENT_ID || '',
+    refreshEndpoint: process.env.REFRESH_ENDPOINT || '/api/ExternalAuth/refresh',
+  };
+}
+
+/**
+ * Pre-configured POST handler for token refresh
+ *
+ * Environment variables used:
+ * - IDP_URL (REQUIRED)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - REFRESH_ENDPOINT (default: /api/ExternalAuth/refresh)
+ */
+let _handler: ReturnType<typeof createRefreshHandler> | null = null;
+
+import { NextRequest } from 'next/server';
+
+export async function POST(req: NextRequest) {
+  if (!_handler) {
+    _handler = createRefreshHandler(getConfig());
+  }
+  return _handler(req);
 }