@payez/next-mvp 4.1.20 → 4.4.0

package/src/api-handlers/mfa/methods.ts

@@ -1,46 +1,46 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-/**
- * MFA methods (GET list / DELETE one, /api/Account/mfa/methods[/{id}],
- * user JWT). Drives the method picker: an EMPTY list must route the user to
- * ENROLMENT, never to a verify screen for a factor they do not hold.
- */
-
-function upstreamError(result: { status: number; json: unknown; attemptedRefresh: boolean }) {
-  return NextResponse.json(
-    {
-      success: false,
-      message: 'Upstream error',
-      error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
-      meta: { attemptedRefresh: result.attemptedRefresh },
-    },
-    { status: result.status },
-  );
-}
-
-function passthrough(json: unknown) {
-  const bodyJson: any = json;
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if (bodyJson.success === true) return NextResponse.json(bodyJson.data ?? { success: true }, { status: 200 });
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-  return NextResponse.json(bodyJson ?? { success: true }, { status: 200 });
-}
-
-export async function GET(req: NextRequest) {
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Account/mfa/methods`, { method: 'GET' });
-  if (!result.ok) return upstreamError(result);
-  return passthrough(result.json);
-}
-
-export async function DELETE(req: NextRequest, id: string) {
-  const result = await idpFetchJSON(
-    req,
-    `${ENV_CONFIG.IDP_URL}/api/Account/mfa/methods/${encodeURIComponent(id)}`,
-    { method: 'DELETE' },
-  );
-  if (!result.ok) return upstreamError(result);
-  return passthrough(result.json);
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * MFA methods (GET list / DELETE one, /api/Account/mfa/methods[/{id}],
+ * user JWT). Drives the method picker: an EMPTY list must route the user to
+ * ENROLMENT, never to a verify screen for a factor they do not hold.
+ */
+
+function upstreamError(result: { status: number; json: unknown; attemptedRefresh: boolean }) {
+  return NextResponse.json(
+    {
+      success: false,
+      message: 'Upstream error',
+      error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+      meta: { attemptedRefresh: result.attemptedRefresh },
+    },
+    { status: result.status },
+  );
+}
+
+function passthrough(json: unknown) {
+  const bodyJson: any = json;
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if (bodyJson.success === true) return NextResponse.json(bodyJson.data ?? { success: true }, { status: 200 });
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+  return NextResponse.json(bodyJson ?? { success: true }, { status: 200 });
+}
+
+export async function GET(req: NextRequest) {
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Account/mfa/methods`, { method: 'GET' });
+  if (!result.ok) return upstreamError(result);
+  return passthrough(result.json);
+}
+
+export async function DELETE(req: NextRequest, id: string) {
+  const result = await idpFetchJSON(
+    req,
+    `${ENV_CONFIG.IDP_URL}/api/Account/mfa/methods/${encodeURIComponent(id)}`,
+    { method: 'DELETE' },
+  );
+  if (!result.ok) return upstreamError(result);
+  return passthrough(result.json);
+}

package/src/api-handlers/mfa/totp-confirm.ts

@@ -1,42 +1,42 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-/**
- * Confirm TOTP enrolment with the first authenticator code
- * (POST /api/Account/mfa/totp/confirm, user JWT). Body forwarded verbatim —
- * it carries the enrolment handle plus the code. Only after this succeeds is
- * the method ACTIVE.
- */
-export async function POST(req: NextRequest) {
-  let body = '{}';
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) body = raw;
-  } catch {}
-
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Account/mfa/totp/confirm`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body,
-  });
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
-        meta: { attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status },
-    );
-  }
-
-  const bodyJson: any = result.json;
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-  return NextResponse.json(bodyJson ?? {}, { status: 200 });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * Confirm TOTP enrolment with the first authenticator code
+ * (POST /api/Account/mfa/totp/confirm, user JWT). Body forwarded verbatim —
+ * it carries the enrolment handle plus the code. Only after this succeeds is
+ * the method ACTIVE.
+ */
+export async function POST(req: NextRequest) {
+  let body = '{}';
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {}
+
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Account/mfa/totp/confirm`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body,
+  });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status },
+    );
+  }
+
+  const bodyJson: any = result.json;
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}

package/src/api-handlers/mfa/totp-enroll.ts

@@ -1,42 +1,42 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-/**
- * Begin TOTP enrolment (POST /api/Account/mfa/totp/enroll, user JWT).
- * Returns the shared secret / otpauth URI for the QR. An enrolment left
- * UNCONFIRMED is pending — it can only be RESTARTED, and must never render
- * as "Active" (MFA honesty fixes, 2026-08-01).
- */
-export async function POST(req: NextRequest) {
-  let body = '{}';
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) body = raw;
-  } catch {}
-
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Account/mfa/totp/enroll`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body,
-  });
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
-        meta: { attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status },
-    );
-  }
-
-  const bodyJson: any = result.json;
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-  return NextResponse.json(bodyJson ?? {}, { status: 200 });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * Begin TOTP enrolment (POST /api/Account/mfa/totp/enroll, user JWT).
+ * Returns the shared secret / otpauth URI for the QR. An enrolment left
+ * UNCONFIRMED is pending — it can only be RESTARTED, and must never render
+ * as "Active" (MFA honesty fixes, 2026-08-01).
+ */
+export async function POST(req: NextRequest) {
+  let body = '{}';
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {}
+
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Account/mfa/totp/enroll`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body,
+  });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status },
+    );
+  }
+
+  const bodyJson: any = result.json;
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}

package/src/api-handlers/passkeys/list.ts

@@ -1,31 +1,31 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-/**
- * List the signed-in user's passkeys (GET /api/Passkeys, user JWT).
- * Probe-verified live 2026-08-01 (anon -> 401 = routed).
- * No session -> upstream 401, passed through, never invented locally.
- */
-export async function GET(req: NextRequest) {
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys`, { method: 'GET' });
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
-        meta: { attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status },
-    );
-  }
-
-  const bodyJson: any = result.json;
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-  return NextResponse.json(bodyJson ?? {}, { status: 200 });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * List the signed-in user's passkeys (GET /api/Passkeys, user JWT).
+ * Probe-verified live 2026-08-01 (anon -> 401 = routed).
+ * No session -> upstream 401, passed through, never invented locally.
+ */
+export async function GET(req: NextRequest) {
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys`, { method: 'GET' });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status },
+    );
+  }
+
+  const bodyJson: any = result.json;
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}

package/src/api-handlers/passkeys/manage.ts

@@ -1,54 +1,54 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-/**
- * Manage ONE passkey (PATCH rename / DELETE revoke, /api/Passkeys/{id},
- * user JWT). The id arrives from the Next dynamic segment via the routes
- * wrapper — it is never read from the body.
- */
-
-function upstreamError(result: { status: number; json: unknown; attemptedRefresh: boolean }) {
-  return NextResponse.json(
-    {
-      success: false,
-      message: 'Upstream error',
-      error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
-      meta: { attemptedRefresh: result.attemptedRefresh },
-    },
-    { status: result.status },
-  );
-}
-
-function passthrough(json: unknown) {
-  const bodyJson: any = json;
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if (bodyJson.success === true) return NextResponse.json(bodyJson.data ?? { success: true }, { status: 200 });
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-  return NextResponse.json(bodyJson ?? { success: true }, { status: 200 });
-}
-
-export async function PATCH(req: NextRequest, id: string) {
-  let body = '{}';
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) body = raw;
-  } catch {}
-
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys/${encodeURIComponent(id)}`, {
-    method: 'PATCH',
-    headers: { 'Content-Type': 'application/json' },
-    body,
-  });
-  if (!result.ok) return upstreamError(result);
-  return passthrough(result.json);
-}
-
-export async function DELETE(req: NextRequest, id: string) {
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys/${encodeURIComponent(id)}`, {
-    method: 'DELETE',
-  });
-  if (!result.ok) return upstreamError(result);
-  return passthrough(result.json);
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * Manage ONE passkey (PATCH rename / DELETE revoke, /api/Passkeys/{id},
+ * user JWT). The id arrives from the Next dynamic segment via the routes
+ * wrapper — it is never read from the body.
+ */
+
+function upstreamError(result: { status: number; json: unknown; attemptedRefresh: boolean }) {
+  return NextResponse.json(
+    {
+      success: false,
+      message: 'Upstream error',
+      error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+      meta: { attemptedRefresh: result.attemptedRefresh },
+    },
+    { status: result.status },
+  );
+}
+
+function passthrough(json: unknown) {
+  const bodyJson: any = json;
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if (bodyJson.success === true) return NextResponse.json(bodyJson.data ?? { success: true }, { status: 200 });
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+  return NextResponse.json(bodyJson ?? { success: true }, { status: 200 });
+}
+
+export async function PATCH(req: NextRequest, id: string) {
+  let body = '{}';
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {}
+
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys/${encodeURIComponent(id)}`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json' },
+    body,
+  });
+  if (!result.ok) return upstreamError(result);
+  return passthrough(result.json);
+}
+
+export async function DELETE(req: NextRequest, id: string) {
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys/${encodeURIComponent(id)}`, {
+    method: 'DELETE',
+  });
+  if (!result.ok) return upstreamError(result);
+  return passthrough(result.json);
+}

package/src/api-handlers/passkeys/register-options.ts

@@ -1,42 +1,42 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-/**
- * Begin the passkey REGISTRATION ceremony (POST /api/Passkeys/register/options,
- * user JWT — a credential change; the IDP may demand step-up, surfaced as-is).
- * Returns the WebAuthn PublicKeyCredentialCreationOptions (ride the envelope
- * `data`, per the archived hand-roll contract).
- */
-export async function POST(req: NextRequest) {
-  let body = '{}';
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) body = raw;
-  } catch {}
-
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys/register/options`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body,
-  });
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
-        meta: { attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status },
-    );
-  }
-
-  const bodyJson: any = result.json;
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-  return NextResponse.json(bodyJson ?? {}, { status: 200 });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * Begin the passkey REGISTRATION ceremony (POST /api/Passkeys/register/options,
+ * user JWT — a credential change; the IDP may demand step-up, surfaced as-is).
+ * Returns the WebAuthn PublicKeyCredentialCreationOptions (ride the envelope
+ * `data`, per the archived hand-roll contract).
+ */
+export async function POST(req: NextRequest) {
+  let body = '{}';
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {}
+
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys/register/options`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body,
+  });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status },
+    );
+  }
+
+  const bodyJson: any = result.json;
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}

package/src/api-handlers/passkeys/register-verify.ts

@@ -1,41 +1,41 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-/**
- * Finish the passkey REGISTRATION ceremony (POST /api/Passkeys/register/verify,
- * user JWT). Body forwarded VERBATIM — it carries the enrolment handle plus the
- * authenticator attestation produced by navigator.credentials.create().
- */
-export async function POST(req: NextRequest) {
-  let body = '{}';
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) body = raw;
-  } catch {}
-
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys/register/verify`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body,
-  });
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
-        meta: { attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status },
-    );
-  }
-
-  const bodyJson: any = result.json;
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-  return NextResponse.json(bodyJson ?? {}, { status: 200 });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * Finish the passkey REGISTRATION ceremony (POST /api/Passkeys/register/verify,
+ * user JWT). Body forwarded VERBATIM — it carries the enrolment handle plus the
+ * authenticator attestation produced by navigator.credentials.create().
+ */
+export async function POST(req: NextRequest) {
+  let body = '{}';
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {}
+
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys/register/verify`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body,
+  });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status },
+    );
+  }
+
+  const bodyJson: any = result.json;
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}

package/src/api-handlers/session/viability.ts

@@ -81,7 +81,35 @@ export async function GET(req: NextRequest) {
         // CRITICAL: OAuth sessions without refresh token always need 2FA completion
         // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
         // when no refresh_token is present. This must override the client config.
-        if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
+        //
+        // *** R807 (BAPert, card 362550) — SECOND OF THE TWO SITES THE SIGNAL IS FOR. ***
+        // The `=== false` below reads as strict but had stopped behaving strictly: every
+        // construction site collapses an ABSENT mfaVerified to `false` (`?? false`), so by
+        // the time it is read here "the callback said false" and "we never knew" are the
+        // same value. This override therefore fired on EVERY session, not on OAuth sessions
+        // that genuinely lack a refresh token.
+        //
+        // The comment at line ~122 of this file already warned that fixing only ONE of the
+        // two viability implementations leaves an app mounting the other one blind. That
+        // applies here verbatim: routes/auth/viability.ts carries the same guard, and both
+        // are publicly exported entry points, so both must gate on the signal or the defect
+        // survives one export over.
+        //
+        // mfaSignalPresent === true -> the producer really emitted a value, so the `false`
+        //                              is a MEASUREMENT. Override.
+        // absent / false            -> LEGACY session (minted before the signal existed) or
+        //                              a path with no IDP tokens. NOT a signal. Do not
+        //                              force a re-challenge.
+        //
+        // *** CONFINED, BY RULING. *** This signal is permissive by construction — it can
+        // only ever SUPPRESS this override, never grant access. Anything that GRANTS must
+        // keep gating on `mfaVerified`, which stays fail-closed at all five sites. R807 is
+        // void if this signal reaches an auth decision.
+        if (
+          sessionData.mfaSignalPresent === true &&
+          sessionData.mfaVerified === false &&
+          !sessionData.idpRefreshToken
+        ) {
           requires2FA = true;
         }