@payez/next-mvp 4.1.21 → 4.4.1

package/dist/lib/single-flight.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSingleFlight = createSingleFlight;
+function createSingleFlight(factory) {
+    let pending = null;
+    return {
+        get() {
+            if (pending)
+                return pending;
+            const attempt = factory();
+            // Cleanup runs on a SIDE branch so the promise handed to callers is the
+            // original one and still rejects. The identity guard means only the
+            // attempt that actually failed clears itself: without it, a slow failure
+            // could evict a newer attempt a later caller had already installed, and
+            // that caller would be de-duplicated against a promise nobody owns.
+            attempt.catch(() => {
+                if (pending === attempt)
+                    pending = null;
+            });
+            pending = attempt;
+            return pending;
+        },
+        isPending() {
+            return pending !== null;
+        },
+        reset() {
+            pending = null;
+        },
+    };
+}

package/dist/lib/token-lifecycle.js

@@ -278,6 +278,10 @@ async function ensureFreshToken(request) {
                          * `mfaVerified || ... || false`).
                          */
                         mfaVerified: idpTokens?.mfaVerified ?? false,
+                        // R807 (362550): the fail-closed default above stays exactly as documented;
+                        // this records whether it was a measurement or a default. `!== undefined`
+                        // deliberately - an explicit `false` is a signal.
+                        mfaSignalPresent: idpTokens?.mfaVerified !== undefined,
                         oauthProvider: idpTokens?.oauthProvider ?? baSession.oauthProvider ?? undefined,
                         idpClientId: idpTokens?.idpClientId ?? idpTokens?.clientId ?? baSession.idpClientId,
                         merchantId: idpTokens?.merchantId ?? baSession.merchantId,
@@ -304,6 +308,14 @@ async function ensureFreshToken(request) {
                  * UNSET is the only honest provider. Both are fail-closed.
                  */
                 mfaVerified: false,
+                /**
+                 * R807 (362550) - FIFTH construction site, not in the ruling's list of four.
+                 * This path has NO IDP TOKENS AT ALL, so there is no producer statement to
+                 * record: the `false` above is a DEFAULT, never a measurement. `false` is
+                 * therefore the honest signal value, and it is the conservative one for
+                 * viability (absent/false -> do not force a re-challenge).
+                 */
+                mfaSignalPresent: false,
                 oauthProvider: undefined,
             };
         }

package/dist/middleware/create-middleware.js

@@ -187,6 +187,18 @@ function makeAuthDecision(ctx) {
         if (sessionPointer.hasRefreshToken) {
             return { type: 'refresh_needed' };
         }
+        // 307290: this is the TERMINAL arm of the expired branch - refresh is not
+        // possible here, so the only outcomes are "redirect" or "allow". Every other
+        // terminal branch in this function (:242 no_session, :259 force_invalidated,
+        // :271 stale_session, :318 2FA-incomplete) already exempts /api/ so the route
+        // can answer with a real 401 JSON; this one did not, and redirecting an API
+        // request to an HTML login page makes the failure INVISIBLE - fetch() follows
+        // the 307, gets 200 HTML, resolves successfully and parses garbage.
+        // MUST stay BELOW the hasRefreshToken check above: placed any higher it would
+        // intercept 'refresh_needed' and disable middleware token refresh for the
+        // entire API surface.
+        if (pathname.startsWith('/api/'))
+            return { type: 'allow' }; // Let API return proper 401 JSON
         return {
             type: 'redirect',
             location: `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}&error=SessionExpired`,

package/dist/models/SessionModel.d.ts

@@ -48,6 +48,45 @@ export interface SessionData {
     bearerKeyId?: string;
     /** Whether MFA has been verified for this session */
     mfaVerified: boolean;
+    /**
+     * *** R807 (BAPert, card 362550). DID THE PRODUCER ACTUALLY SAY ANYTHING ABOUT MFA? ***
+     *
+     * `mfaVerified` above is deliberately FAIL-CLOSED: every construction site
+     * collapses an absent value to `false` (`?? false`), so by the time anyone
+     * reads it, "the producer said false" and "the producer said nothing" are
+     * indistinguishable. That collapse is CORRECT and must not be removed - a
+     * security consumer treating absence as "verified" is an AUTH BYPASS.
+     *
+     * But `routes/auth/viability.ts` asks a genuinely different question: "did the
+     * OAuth callback AFFIRMATIVELY set false, or did we simply never know?" It
+     * cannot ask that of a field whose absence has already been collapsed. This
+     * field carries that one bit, so the collapse can stay.
+     *
+     *   true      -> the producer emitted an explicit mfaVerified; `mfaVerified` is a measurement.
+     *   false     -> the producer emitted nothing; `mfaVerified`'s `false` is a DEFAULT, not a signal.
+     *   undefined -> LEGACY SESSION, minted before this field existed. Same meaning as `false`
+     *                for viability (do NOT force a re-challenge), and it is why this is
+     *                optional rather than defaulted: `?? false` here would be the very
+     *                absence-destroying move this field exists to undo.
+     *
+     * *** CONFINED, BY RULING: THIS FIELD MUST NEVER REACH AN AUTH DECISION. ***
+     * It exists to make viability LESS aggressive (suppressing a mass re-challenge of
+     * the pre-existing session population). Letting it influence an auth path would
+     * turn a permissive read into a fail-open, and R807 is void if it does. Gate on
+     * `mfaVerified` for anything that grants access; gate on this only to decide
+     * whether `mfaVerified === false` was a real statement.
+     *
+     * *** DECLARING IT HERE IS LOAD-BEARING FOR MORE THAN DOCUMENTATION. ***
+     * `SessionData` carries `[key: string]: any` (the "backward compatibility"
+     * member at the END of this interface, added for migration back-compat — it
+     * was line 147 before this block was inserted above it, which is the number
+     * quoted in R807/362550; adding these lines moved it down, so find it by name,
+     * not by number). Any field NOT declared explicitly is absorbed by that index
+     * signature and becomes `any` - so an undeclared `mfaSignalPresent` would let a
+     * typo at the consumer compile clean and read `undefined` forever, silently
+     * disabling the viability override. Measured, not assumed: see the card.
+     */
+    mfaSignalPresent?: boolean;
     /**
      * The IDP's own routing decision for a 2FA-pending login (cards 141688 /
      * 141741, IDP WO 113023). Wire name is snake — `next_step`.
@@ -111,6 +150,8 @@ export declare class SessionModel {
     decodedAccessToken?: any;
     bearerKeyId?: string;
     mfaVerified: boolean;
+    /** R807: see SessionData.mfaSignalPresent. Propagated verbatim, never defaulted. */
+    mfaSignalPresent?: boolean;
     mfaMethod?: 'email' | 'sms' | 'totp';
     mfaCompletedAt?: number;
     mfaExpiresAt?: number;

package/dist/models/SessionModel.js

@@ -40,6 +40,8 @@ class SessionModel {
     bearerKeyId;
     // MFA State
     mfaVerified;
+    /** R807: see SessionData.mfaSignalPresent. Propagated verbatim, never defaulted. */
+    mfaSignalPresent;
     mfaMethod;
     mfaCompletedAt;
     mfaExpiresAt;
@@ -69,6 +71,10 @@ class SessionModel {
         this.bearerKeyId = data.bearerKeyId;
         // MFA State
         this.mfaVerified = data.mfaVerified ?? false;
+        // *** R807: PROPAGATE, DO NOT DEFAULT. *** `?? false` here would destroy the
+        // legacy/never-knew distinction on every path through this class - invisibly,
+        // because callers construct a SessionModel without restating the field.
+        this.mfaSignalPresent = data.mfaSignalPresent;
         this.mfaMethod = data.mfaMethod;
         this.mfaCompletedAt = data.mfaCompletedAt;
         this.mfaExpiresAt = data.mfaExpiresAt;
@@ -122,6 +128,9 @@ class SessionModel {
             decodedAccessToken: this.decodedAccessToken,
             bearerKeyId: this.bearerKeyId,
             mfaVerified: this.mfaVerified,
+            // R807: must survive the Redis round-trip, or the session is re-read as
+            // `legacy` one hop later and viability silently stops firing.
+            mfaSignalPresent: this.mfaSignalPresent,
             mfaMethod: this.mfaMethod,
             mfaCompletedAt: this.mfaCompletedAt,
             mfaExpiresAt: this.mfaExpiresAt,

package/dist/pages/admin-login/page.d.ts

@@ -24,7 +24,7 @@ interface AdminLoginFormProps {
     /** Optional logo component to render */
     logo?: React.ReactNode;
 }
-declare function AdminLoginForm({ title, subtitle, callbackUrl: propCallbackUrl, logo, }: AdminLoginFormProps): import("react/jsx-runtime").JSX.Element;
+declare function AdminLoginForm({ title, subtitle, logo, }: AdminLoginFormProps): import("react/jsx-runtime").JSX.Element;
 declare function AdminLoginFallback(): import("react/jsx-runtime").JSX.Element;
 export default function AdminLoginPage(props: AdminLoginFormProps): import("react/jsx-runtime").JSX.Element;
 export { AdminLoginForm, AdminLoginFallback };

package/dist/pages/admin-login/page.js

@@ -21,53 +21,17 @@ exports.AdminLoginForm = AdminLoginForm;
 exports.AdminLoginFallback = AdminLoginFallback;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
-const better_auth_client_1 = require("../../client/better-auth-client");
-const navigation_1 = require("next/navigation");
-const react_2 = require("react");
 const useTheme_1 = require("../../theme/useTheme");
-function AdminLoginForm({ title = 'Admin Login', subtitle = 'Authorized personnel only', callbackUrl: propCallbackUrl, logo, }) {
-    const searchParams = (0, navigation_1.useSearchParams)();
-    const callbackUrl = propCallbackUrl || searchParams?.get('callbackUrl') || '/dashboard';
+function AdminLoginForm({ title = 'Admin Login', subtitle = 'Authorized personnel only', logo, }) {
     const branding = (0, useTheme_1.useBranding)();
     const colors = (0, useTheme_1.useColors)();
-    const [email, setEmail] = (0, react_1.useState)('');
-    const [password, setPassword] = (0, react_1.useState)('');
-    const [showPassword, setShowPassword] = (0, react_1.useState)(false);
-    const [isLoading, setIsLoading] = (0, react_1.useState)(false);
-    const [error, setError] = (0, react_1.useState)(null);
-    const handleSubmit = async (e) => {
-        e.preventDefault();
-        setIsLoading(true);
-        setError(null);
-        try {
-            const result = await better_auth_client_1.authClient.signIn.email({
-                email,
-                password,
-                callbackURL: callbackUrl,
-            });
-            if (result?.error) {
-                const errorMsg = typeof result.error === 'object'
-                    ? result.error.message || 'Invalid credentials'
-                    : String(result.error);
-                setError(errorMsg);
-            }
-            else if (result?.data) {
-                // Redirect to verify-code for 2FA or directly to callback
-                window.location.href = `/account-auth/verify-code?callbackUrl=${encodeURIComponent(callbackUrl)}`;
-            }
-        }
-        catch (err) {
-            setError('An unexpected error occurred');
-        }
-        finally {
-            setIsLoading(false);
-        }
-    };
-    return ((0, jsx_runtime_1.jsx)("div", { className: "min-h-screen flex items-center justify-center bg-gradient-to-br from-slate-700 via-slate-800 to-slate-900 p-4", children: (0, jsx_runtime_1.jsxs)("div", { className: "bg-white rounded-2xl shadow-2xl p-8 max-w-md w-full", children: [logo && ((0, jsx_runtime_1.jsx)("div", { className: "flex justify-center mb-6", children: logo })), (0, jsx_runtime_1.jsx)("h1", { className: "text-2xl font-bold text-center mb-2 text-slate-900", children: title }), (0, jsx_runtime_1.jsx)("p", { className: "text-center mb-8 text-slate-600", children: subtitle }), error && ((0, jsx_runtime_1.jsx)("div", { className: "mb-6 px-4 py-3 rounded-lg bg-red-500 text-white text-center text-sm", children: error })), (0, jsx_runtime_1.jsxs)("form", { onSubmit: handleSubmit, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "admin-email", className: "block text-sm font-medium mb-2 text-slate-700", children: "Email" }), (0, jsx_runtime_1.jsx)("input", { id: "admin-email", type: "email", value: email, onChange: (e) => setEmail(e.target.value), required: true, disabled: isLoading, autoComplete: "email", className: "w-full px-4 py-3 rounded-lg border border-slate-300 bg-white text-slate-900 placeholder-slate-400 focus:outline-none focus:ring-2 focus:ring-slate-500 focus:border-transparent disabled:opacity-50 disabled:cursor-not-allowed", placeholder: "admin@example.com" })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "admin-password", className: "block text-sm font-medium mb-2 text-slate-700", children: "Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { id: "admin-password", type: showPassword ? 'text' : 'password', value: password, onChange: (e) => setPassword(e.target.value), required: true, disabled: isLoading, autoComplete: "current-password", className: "w-full px-4 py-3 pr-12 rounded-lg border border-slate-300 bg-white text-slate-900 placeholder-slate-400 focus:outline-none focus:ring-2 focus:ring-slate-500 focus:border-transparent disabled:opacity-50 disabled:cursor-not-allowed", placeholder: "Enter your password" }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPassword(!showPassword), className: "absolute right-3 top-1/2 transform -translate-y-1/2 text-slate-500 hover:text-slate-700", "aria-label": showPassword ? 'Hide password' : 'Show password', children: showPassword ? ((0, jsx_runtime_1.jsx)("svg", { xmlns: "http://www.w3.org/2000/svg", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", className: "w-5 h-5", children: (0, jsx_runtime_1.jsx)("path", { strokeLinecap: "round", strokeLinejoin: "round", strokeWidth: 2, d: "M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.878 9.878L6.464 6.464m7.535 7.535l3.415 3.414M3 3l3.464 3.464M21 21l-3.415-3.414" }) })) : ((0, jsx_runtime_1.jsxs)("svg", { xmlns: "http://www.w3.org/2000/svg", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", className: "w-5 h-5", children: [(0, jsx_runtime_1.jsx)("path", { strokeLinecap: "round", strokeLinejoin: "round", strokeWidth: 2, d: "M15 12a3 3 0 11-6 0 3 3 0 016 0z" }), (0, jsx_runtime_1.jsx)("path", { strokeLinecap: "round", strokeLinejoin: "round", strokeWidth: 2, d: "M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z" })] })) })] })] }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: isLoading, className: "w-full py-3 px-4 rounded-lg font-semibold text-white transition-colors bg-slate-700 hover:bg-slate-800 disabled:bg-slate-400 disabled:cursor-not-allowed", children: isLoading ? ((0, jsx_runtime_1.jsxs)("span", { className: "flex items-center justify-center", children: [(0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin -ml-1 mr-3 h-5 w-5 text-white", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" })] }), "Signing in..."] })) : ('Sign In') })] }), (0, jsx_runtime_1.jsxs)("p", { className: "mt-6 text-center text-xs text-slate-500", children: ["This login is for authorized administrators only.", (0, jsx_runtime_1.jsx)("br", {}), "All access attempts are logged."] })] }) }));
+    void branding;
+    void colors;
+    return ((0, jsx_runtime_1.jsx)("div", { className: "min-h-screen flex items-center justify-center bg-gradient-to-br from-slate-700 via-slate-800 to-slate-900 p-4", children: (0, jsx_runtime_1.jsxs)("div", { className: "bg-white rounded-2xl shadow-2xl p-8 max-w-md w-full", children: [logo && ((0, jsx_runtime_1.jsx)("div", { className: "flex justify-center mb-6", children: logo })), (0, jsx_runtime_1.jsx)("h1", { className: "text-2xl font-bold text-center mb-2 text-slate-900", children: title }), (0, jsx_runtime_1.jsx)("p", { className: "text-center mb-8 text-slate-600", children: subtitle }), (0, jsx_runtime_1.jsxs)("p", { className: "mt-6 text-center text-xs text-slate-500", children: ["This login is for authorized administrators only.", (0, jsx_runtime_1.jsx)("br", {}), "All access attempts are logged."] })] }) }));
 }
 function AdminLoginFallback() {
     return ((0, jsx_runtime_1.jsx)("div", { className: "min-h-screen flex items-center justify-center bg-gradient-to-br from-slate-700 via-slate-800 to-slate-900", children: (0, jsx_runtime_1.jsxs)("div", { className: "text-center", children: [(0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin h-10 w-10 mx-auto text-white", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" })] }), (0, jsx_runtime_1.jsx)("p", { className: "mt-4 text-slate-400", children: "Loading..." })] }) }));
 }
 function AdminLoginPage(props) {
-    return ((0, jsx_runtime_1.jsx)(react_2.Suspense, { fallback: (0, jsx_runtime_1.jsx)(AdminLoginFallback, {}), children: (0, jsx_runtime_1.jsx)(AdminLoginForm, { ...props }) }));
+    return ((0, jsx_runtime_1.jsx)(react_1.Suspense, { fallback: (0, jsx_runtime_1.jsx)(AdminLoginFallback, {}), children: (0, jsx_runtime_1.jsx)(AdminLoginForm, { ...props }) }));
 }

package/dist/pages/security/EnhancedSecurityPage.d.ts

@@ -10,5 +10,39 @@
  * - Danger zone (data export, account deletion)
  *
  * @see docs/specs/MEMBER_SELF_SERVICE_SPEC.md
+ *
+ * @deprecated RETIRED (BAPert ruling, card 221074, 2026-08-18). The canonical,
+ * maintained copy is graft-local:
+ * idp_admin_ui_graft/src/app/account/security/EnhancedSecurityPage.tsx.
+ * What stage serves is what was scored against Clerk; this package copy was
+ * imported by nothing in the graft and receives NO further fixes. Do not
+ * import it into new work.
+ */
+export interface EnhancedSecurityPageProps {
+    /**
+     * 152745. Where "Enable 2FA" navigates to start enrollment. Deliberately a
+     * PROP, not a hardcoded route: this component ships in a shared package
+     * consumed by apps whose enrollment routes differ (idp_admin_ui_graft has
+     * one at /user-authentication/multi-factor; idealresume — per QAPert's
+     * 170047 gate — has NONE at all). Hardcoding either app's route into the
+     * package would be wrong for the other, and would silently reproduce the
+     * exact "advertises 2FA, nothing reachable" defect this card exists to
+     * fix. Undefined -> the button renders honestly disabled (see below),
+     * never a fake-live control pointing nowhere.
+     */
+    mfaEnrollHref?: string;
+    /**
+     * 152745. Called when "Disable 2FA" is clicked. Left to the consumer for
+     * the same reason as mfaEnrollHref: disabling 2FA is a real, consequential
+     * write (DELETE /api/Account/mfa/methods/{id} per cluster card 170059) and
+     * this package has no opinion on which method id, confirmation flow, or
+     * step-up policy a given app requires. Undefined -> honestly disabled.
+     */
+    onDisable2FA?: () => Promise<void> | void;
+}
+/**
+ * @deprecated RETIRED (BAPert ruling, card 221074, 2026-08-18). Canonical copy:
+ * idp_admin_ui_graft/src/app/account/security/EnhancedSecurityPage.tsx.
+ * This copy receives NO further fixes. Do not import.
  */
-export default function EnhancedSecurityPage(): import("react/jsx-runtime").JSX.Element;
+export default function EnhancedSecurityPage({ mfaEnrollHref, onDisable2FA }?: EnhancedSecurityPageProps): import("react/jsx-runtime").JSX.Element;

package/dist/pages/security/EnhancedSecurityPage.js

@@ -11,6 +11,13 @@
  * - Danger zone (data export, account deletion)
  *
  * @see docs/specs/MEMBER_SELF_SERVICE_SPEC.md
+ *
+ * @deprecated RETIRED (BAPert ruling, card 221074, 2026-08-18). The canonical,
+ * maintained copy is graft-local:
+ * idp_admin_ui_graft/src/app/account/security/EnhancedSecurityPage.tsx.
+ * What stage serves is what was scored against Clerk; this package copy was
+ * imported by nothing in the graft and receives NO further fixes. Do not
+ * import it into new work.
  */
 'use client';
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
@@ -147,10 +154,32 @@ function formatRelativeTime(dateString) {
         return dateString;
     }
 }
-function EnhancedSecurityPage() {
+/**
+ * @deprecated RETIRED (BAPert ruling, card 221074, 2026-08-18). Canonical copy:
+ * idp_admin_ui_graft/src/app/account/security/EnhancedSecurityPage.tsx.
+ * This copy receives NO further fixes. Do not import.
+ */
+function EnhancedSecurityPage({ mfaEnrollHref, onDisable2FA } = {}) {
     const { data: profileData, isLoading: isProfileLoading } = (0, useProfile_1.useProfile)();
     const layout = (0, useTheme_1.useLayout)();
     const colors = (0, useTheme_1.useColors)();
+    const [disabling2FA, setDisabling2FA] = (0, react_1.useState)(false);
+    const [disable2FAError, setDisable2FAError] = (0, react_1.useState)('');
+    const handleDisable2FA = async () => {
+        if (!onDisable2FA || disabling2FA)
+            return;
+        setDisable2FAError('');
+        try {
+            setDisabling2FA(true);
+            await onDisable2FA();
+        }
+        catch (err) {
+            setDisable2FAError(err?.message || 'Failed to disable two-factor authentication');
+        }
+        finally {
+            setDisabling2FA(false);
+        }
+    };
     // Security data state (would come from API in production)
     const [securityData, setSecurityData] = (0, react_1.useState)(null);
     const [loadingSecurityData, setLoadingSecurityData] = (0, react_1.useState)(true);
@@ -244,5 +273,16 @@ function EnhancedSecurityPage() {
     }
     const twoFactorEnabled = profileData?.two_factor_enabled || securityData?.two_factor?.enabled || false;
     const twoFactorMethod = securityData?.two_factor?.method_display || (twoFactorEnabled ? 'SMS' : undefined);
-    return ((0, jsx_runtime_1.jsx)("div", { className: `min-h-screen ${bgClass}`, children: (0, jsx_runtime_1.jsxs)("div", { className: `${layout?.maxWidth || 'max-w-3xl'} mx-auto ${layout?.padding || 'p-6'} space-y-6`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("h1", { className: `text-2xl font-bold ${textPrimary}`, children: "Security" }), (0, jsx_runtime_1.jsx)("p", { className: `mt-1 ${textMuted}`, children: "Manage your account security settings" })] }), (0, jsx_runtime_1.jsxs)("div", { className: `rounded-lg border ${cardBg} ${borderColor} p-6`, children: [(0, jsx_runtime_1.jsx)("h2", { className: `text-lg font-semibold mb-4 ${textPrimary}`, children: "Security Summary" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-3 gap-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm font-medium mb-2 ${textSecondary}`, children: "2FA Status" }), (0, jsx_runtime_1.jsx)(StatusBadge, { enabled: twoFactorEnabled, isDark: isDark }), twoFactorMethod && (0, jsx_runtime_1.jsxs)("p", { className: `text-xs mt-2 ${textMuted}`, children: ["Method: ", twoFactorMethod] })] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm font-medium mb-2 ${textSecondary}`, children: "Email Status" }), (0, jsx_runtime_1.jsx)(StatusBadge, { enabled: profileData?.email_confirmed || false, label: profileData?.email_confirmed ? 'Verified' : 'Not Verified', isDark: isDark }), (0, jsx_runtime_1.jsx)("p", { className: `text-xs mt-2 ${textMuted} truncate`, children: profileData?.email })] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm font-medium mb-2 ${textSecondary}`, children: "Phone Status" }), (0, jsx_runtime_1.jsx)(StatusBadge, { enabled: profileData?.phone_confirmed || false, label: profileData?.phone_confirmed ? 'Verified' : 'Not Verified', isDark: isDark }), profileData?.phone_number && (0, jsx_runtime_1.jsx)("p", { className: `text-xs mt-2 ${textMuted}`, children: profileData.phone_number })] })] })] }), (0, jsx_runtime_1.jsx)(SecuritySection, { title: "Password", description: securityData?.password?.last_changed ? `Last changed ${formatDate(securityData.password.last_changed)}` : undefined, isDark: isDark, children: (0, jsx_runtime_1.jsxs)("form", { onSubmit: handlePasswordSubmit, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium mb-2 ${textSecondary}`, children: "Current Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showPasswords.current ? 'text' : 'password', value: formData.current_password, onChange: e => setFormData({ ...formData, current_password: e.target.value }), className: `w-full px-3 py-2 rounded-md border focus:outline-none focus:ring-2 focus:ring-blue-500 ${inputBg} ${inputBorder} ${inputText}`, placeholder: "Enter current password", disabled: submitting }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPasswords(p => ({ ...p, current: !p.current })), className: `absolute inset-y-0 right-2 flex items-center ${textMuted}`, children: showPasswords.current ? 'Hide' : 'Show' })] })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium mb-2 ${textSecondary}`, children: "New Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showPasswords.new ? 'text' : 'password', value: formData.new_password, onChange: e => setFormData({ ...formData, new_password: e.target.value }), className: `w-full px-3 py-2 rounded-md border focus:outline-none focus:ring-2 focus:ring-blue-500 ${inputBg} ${inputBorder} ${inputText}`, placeholder: "Enter new password", disabled: submitting }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPasswords(p => ({ ...p, new: !p.new })), className: `absolute inset-y-0 right-2 flex items-center ${textMuted}`, children: showPasswords.new ? 'Hide' : 'Show' })] }), formData.new_password && ((0, jsx_runtime_1.jsx)("div", { className: "mt-2", children: (0, jsx_runtime_1.jsx)(PasswordStrengthMeter, { score: newPasswordScore, failedRequirements: failedRequirements, tip: tip, isDark: isDark }) })), policy && formData.new_password && ((0, jsx_runtime_1.jsx)("div", { className: "mt-3", children: (0, jsx_runtime_1.jsx)(PolicyChecklist, { policy: policy, password: formData.new_password, isDark: isDark }) }))] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium mb-2 ${textSecondary}`, children: "Confirm New Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showPasswords.confirm ? 'text' : 'password', value: formData.confirm_password, onChange: e => setFormData({ ...formData, confirm_password: e.target.value }), className: `w-full px-3 py-2 rounded-md border focus:outline-none focus:ring-2 focus:ring-blue-500 ${inputBg} ${inputBorder} ${inputText}`, placeholder: "Confirm new password", disabled: submitting }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPasswords(p => ({ ...p, confirm: !p.confirm })), className: `absolute inset-y-0 right-2 flex items-center ${textMuted}`, children: showPasswords.confirm ? 'Hide' : 'Show' })] }), formData.confirm_password && !passwordsMatch && (0, jsx_runtime_1.jsx)("p", { className: "mt-1 text-xs text-red-400", children: "Passwords do not match" }), formData.confirm_password && passwordsMatch && (0, jsx_runtime_1.jsx)("p", { className: "mt-1 text-xs text-green-400", children: "Passwords match" })] }), error && (0, jsx_runtime_1.jsx)("div", { className: "bg-red-900/30 border border-red-600 rounded-lg p-3", children: (0, jsx_runtime_1.jsx)("p", { className: "text-red-400 text-sm", children: error }) }), success && (0, jsx_runtime_1.jsx)("div", { className: "bg-green-900/30 border border-green-600 rounded-lg p-3", children: (0, jsx_runtime_1.jsx)("p", { className: "text-green-400 text-sm", children: success }) }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: !canSubmit, className: "px-4 py-2 bg-blue-600 text-white rounded-md hover:bg-blue-700 disabled:opacity-50 disabled:cursor-not-allowed", children: submitting ? 'Changing...' : 'Change Password' })] }) }), (0, jsx_runtime_1.jsx)(SecuritySection, { title: "Two-Factor Authentication", description: "Add an extra layer of security to your account", isDark: isDark, children: (0, jsx_runtime_1.jsxs)("div", { className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: "Status" }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: twoFactorEnabled ? `Enabled via ${twoFactorMethod || 'SMS'}` : 'Not enabled' })] }), (0, jsx_runtime_1.jsx)(StatusBadge, { enabled: twoFactorEnabled, isDark: isDark })] }), twoFactorEnabled ? ((0, jsx_runtime_1.jsxs)("div", { className: "flex gap-2", children: [(0, jsx_runtime_1.jsx)("button", { className: `px-3 py-1.5 text-sm rounded border ${isDark ? 'border-slate-600 hover:bg-slate-700' : 'border-gray-300 hover:bg-gray-50'} ${textSecondary}`, children: "Change Method" }), (0, jsx_runtime_1.jsx)("button", { className: "px-3 py-1.5 text-sm rounded border border-red-500 text-red-500 hover:bg-red-500/10", children: "Disable 2FA" })] })) : ((0, jsx_runtime_1.jsx)("button", { className: "px-4 py-2 bg-blue-600 text-white rounded-md hover:bg-blue-700", children: "Enable 2FA" })), securityData?.two_factor?.backup_codes_remaining !== undefined && ((0, jsx_runtime_1.jsxs)("div", { className: `mt-4 p-3 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textSecondary}`, children: "Backup Codes" }), (0, jsx_runtime_1.jsxs)("p", { className: textMuted, children: ["You have ", securityData.two_factor.backup_codes_remaining, " of 10 backup codes remaining"] }), (0, jsx_runtime_1.jsx)("button", { className: `mt-2 text-sm ${isDark ? 'text-blue-400' : 'text-blue-600'}`, children: "View Codes" })] }))] }) }), (0, jsx_runtime_1.jsxs)(SecuritySection, { title: "Connected Accounts", description: "OAuth providers linked to your account", isDark: isDark, children: [securityData?.connected_accounts && securityData.connected_accounts.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { className: "space-y-3", children: securityData.connected_accounts.map((account, idx) => ((0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between p-3 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: account.provider }), account.email && (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: account.email }), account.connected_at && (0, jsx_runtime_1.jsxs)("p", { className: `text-xs ${textMuted}`, children: ["Connected ", formatDate(account.connected_at)] })] }), account.can_disconnect && ((0, jsx_runtime_1.jsx)("button", { className: "text-sm text-red-500 hover:text-red-400", children: "Disconnect" }))] }, idx))) })) : ((0, jsx_runtime_1.jsx)("p", { className: textMuted, children: "No connected accounts" })), (0, jsx_runtime_1.jsx)("button", { className: `mt-4 text-sm ${isDark ? 'text-blue-400' : 'text-blue-600'}`, children: "Connect Another Account" })] }), (0, jsx_runtime_1.jsxs)(SecuritySection, { title: "Active Sessions", description: "Devices currently logged into your account", isDark: isDark, children: [securityData?.active_sessions && securityData.active_sessions.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { className: "space-y-3", children: securityData.active_sessions.map((session, idx) => ((0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between p-3 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: session.device_name || 'Unknown Device' }), session.is_current && (0, jsx_runtime_1.jsx)("span", { className: "px-2 py-0.5 rounded text-xs bg-blue-500 text-white", children: "This Device" })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: session.location || session.ip_address }), (0, jsx_runtime_1.jsx)("p", { className: `text-xs ${textMuted}`, children: session.is_current ? 'Active now' : `Last active ${formatRelativeTime(session.last_active_at)}` })] }), !session.is_current && ((0, jsx_runtime_1.jsx)("button", { className: "text-sm text-red-500 hover:text-red-400", children: "Revoke" }))] }, idx))) })) : ((0, jsx_runtime_1.jsx)("p", { className: textMuted, children: "Session information not available" })), (0, jsx_runtime_1.jsx)("button", { className: "mt-4 text-sm text-red-500 hover:text-red-400", children: "Sign Out All Other Devices" })] }), (0, jsx_runtime_1.jsxs)(SecuritySection, { title: "Recent Activity", description: "Security events on your account", isDark: isDark, children: [securityData?.recent_activity && securityData.recent_activity.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { className: "space-y-2", children: securityData.recent_activity.slice(0, 5).map((activity, idx) => ((0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between py-2 border-b last:border-b-0 ${borderColor}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)("span", { className: activity.success ? 'text-green-400' : 'text-red-400', children: activity.success ? 'v' : 'x' }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textPrimary}`, children: activity.description }), activity.device && (0, jsx_runtime_1.jsx)("p", { className: `text-xs ${textMuted}`, children: activity.device })] })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-xs ${textMuted}`, children: formatRelativeTime(activity.timestamp) })] }, idx))) })) : ((0, jsx_runtime_1.jsx)("p", { className: textMuted, children: "No recent activity" })), (0, jsx_runtime_1.jsx)("button", { className: `mt-4 text-sm ${isDark ? 'text-blue-400' : 'text-blue-600'}`, children: "View Full History" })] }), (0, jsx_runtime_1.jsx)(SecuritySection, { title: "Danger Zone", description: "Irreversible actions", isDark: isDark, children: (0, jsx_runtime_1.jsxs)("div", { className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between p-4 rounded-lg border border-yellow-500/50`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: "Download My Data" }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: "Get a copy of all your personal data" })] }), (0, jsx_runtime_1.jsx)("button", { className: "px-4 py-2 text-sm rounded border border-yellow-500 text-yellow-500 hover:bg-yellow-500/10", children: "Request Export" })] }), (0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between p-4 rounded-lg border border-red-500/50`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: "Delete Account" }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: "Permanently delete your account and all data" })] }), (0, jsx_runtime_1.jsx)("button", { className: "px-4 py-2 text-sm rounded border border-red-500 text-red-500 hover:bg-red-500/10", children: "Delete Account" })] })] }) }), (0, jsx_runtime_1.jsx)("div", { className: "text-center", children: (0, jsx_runtime_1.jsx)("a", { href: "/account/profile", className: `text-sm hover:underline ${textMuted}`, children: "Back to Profile" }) })] }) }));
+    return ((0, jsx_runtime_1.jsx)("div", { className: `min-h-screen ${bgClass}`, children: (0, jsx_runtime_1.jsxs)("div", { className: `${layout?.maxWidth || 'max-w-3xl'} mx-auto ${layout?.padding || 'p-6'} space-y-6`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("h1", { className: `text-2xl font-bold ${textPrimary}`, children: "Security" }), (0, jsx_runtime_1.jsx)("p", { className: `mt-1 ${textMuted}`, children: "Manage your account security settings" })] }), (0, jsx_runtime_1.jsxs)("div", { className: `rounded-lg border ${cardBg} ${borderColor} p-6`, children: [(0, jsx_runtime_1.jsx)("h2", { className: `text-lg font-semibold mb-4 ${textPrimary}`, children: "Security Summary" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-3 gap-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm font-medium mb-2 ${textSecondary}`, children: "2FA Status" }), (0, jsx_runtime_1.jsx)(StatusBadge, { enabled: twoFactorEnabled, isDark: isDark }), twoFactorMethod && (0, jsx_runtime_1.jsxs)("p", { className: `text-xs mt-2 ${textMuted}`, children: ["Method: ", twoFactorMethod] })] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm font-medium mb-2 ${textSecondary}`, children: "Email Status" }), (0, jsx_runtime_1.jsx)(StatusBadge, { enabled: profileData?.email_confirmed || false, label: profileData?.email_confirmed ? 'Verified' : 'Not Verified', isDark: isDark }), (0, jsx_runtime_1.jsx)("p", { className: `text-xs mt-2 ${textMuted} truncate`, children: profileData?.email })] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm font-medium mb-2 ${textSecondary}`, children: "Phone Status" }), (0, jsx_runtime_1.jsx)(StatusBadge, { enabled: profileData?.phone_confirmed || false, label: profileData?.phone_confirmed ? 'Verified' : 'Not Verified', isDark: isDark }), profileData?.phone_number && (0, jsx_runtime_1.jsx)("p", { className: `text-xs mt-2 ${textMuted}`, children: profileData.phone_number })] })] })] }), (0, jsx_runtime_1.jsx)(SecuritySection, { title: "Password", description: securityData?.password?.last_changed ? `Last changed ${formatDate(securityData.password.last_changed)}` : undefined, isDark: isDark, children: (0, jsx_runtime_1.jsxs)("form", { onSubmit: handlePasswordSubmit, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium mb-2 ${textSecondary}`, children: "Current Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showPasswords.current ? 'text' : 'password', value: formData.current_password, onChange: e => setFormData({ ...formData, current_password: e.target.value }), className: `w-full px-3 py-2 rounded-md border focus:outline-none focus:ring-2 focus:ring-blue-500 ${inputBg} ${inputBorder} ${inputText}`, placeholder: "Enter current password", disabled: submitting }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPasswords(p => ({ ...p, current: !p.current })), className: `absolute inset-y-0 right-2 flex items-center ${textMuted}`, children: showPasswords.current ? 'Hide' : 'Show' })] })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium mb-2 ${textSecondary}`, children: "New Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showPasswords.new ? 'text' : 'password', value: formData.new_password, onChange: e => setFormData({ ...formData, new_password: e.target.value }), className: `w-full px-3 py-2 rounded-md border focus:outline-none focus:ring-2 focus:ring-blue-500 ${inputBg} ${inputBorder} ${inputText}`, placeholder: "Enter new password", disabled: submitting }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPasswords(p => ({ ...p, new: !p.new })), className: `absolute inset-y-0 right-2 flex items-center ${textMuted}`, children: showPasswords.new ? 'Hide' : 'Show' })] }), formData.new_password && ((0, jsx_runtime_1.jsx)("div", { className: "mt-2", children: (0, jsx_runtime_1.jsx)(PasswordStrengthMeter, { score: newPasswordScore, failedRequirements: failedRequirements, tip: tip, isDark: isDark }) })), policy && formData.new_password && ((0, jsx_runtime_1.jsx)("div", { className: "mt-3", children: (0, jsx_runtime_1.jsx)(PolicyChecklist, { policy: policy, password: formData.new_password, isDark: isDark }) }))] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium mb-2 ${textSecondary}`, children: "Confirm New Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showPasswords.confirm ? 'text' : 'password', value: formData.confirm_password, onChange: e => setFormData({ ...formData, confirm_password: e.target.value }), className: `w-full px-3 py-2 rounded-md border focus:outline-none focus:ring-2 focus:ring-blue-500 ${inputBg} ${inputBorder} ${inputText}`, placeholder: "Confirm new password", disabled: submitting }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPasswords(p => ({ ...p, confirm: !p.confirm })), className: `absolute inset-y-0 right-2 flex items-center ${textMuted}`, children: showPasswords.confirm ? 'Hide' : 'Show' })] }), formData.confirm_password && !passwordsMatch && (0, jsx_runtime_1.jsx)("p", { className: "mt-1 text-xs text-red-400", children: "Passwords do not match" }), formData.confirm_password && passwordsMatch && (0, jsx_runtime_1.jsx)("p", { className: "mt-1 text-xs text-green-400", children: "Passwords match" })] }), error && (0, jsx_runtime_1.jsx)("div", { className: "bg-red-900/30 border border-red-600 rounded-lg p-3", children: (0, jsx_runtime_1.jsx)("p", { className: "text-red-400 text-sm", children: error }) }), success && (0, jsx_runtime_1.jsx)("div", { className: "bg-green-900/30 border border-green-600 rounded-lg p-3", children: (0, jsx_runtime_1.jsx)("p", { className: "text-green-400 text-sm", children: success }) }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: !canSubmit, className: "px-4 py-2 bg-blue-600 text-white rounded-md hover:bg-blue-700 disabled:opacity-50 disabled:cursor-not-allowed", children: submitting ? 'Changing...' : 'Change Password' })] }) }), (0, jsx_runtime_1.jsx)(SecuritySection, { title: "Two-Factor Authentication", description: "Add an extra layer of security to your account", isDark: isDark, children: (0, jsx_runtime_1.jsxs)("div", { className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: "Status" }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: twoFactorEnabled ? `Enabled via ${twoFactorMethod || 'SMS'}` : 'Not enabled' })] }), (0, jsx_runtime_1.jsx)(StatusBadge, { enabled: twoFactorEnabled, isDark: isDark })] }), twoFactorEnabled ? ((0, jsx_runtime_1.jsxs)("div", { className: "flex flex-col gap-2", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex gap-2", children: [(0, jsx_runtime_1.jsx)("button", { className: `px-3 py-1.5 text-sm rounded border ${isDark ? 'border-slate-600 hover:bg-slate-700' : 'border-gray-300 hover:bg-gray-50'} ${textSecondary}`, children: "Change Method" }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: handleDisable2FA, disabled: !onDisable2FA || disabling2FA, title: !onDisable2FA ? 'Disabling two-factor authentication is not available here' : undefined, className: "px-3 py-1.5 text-sm rounded border border-red-500 text-red-500 hover:bg-red-500/10 disabled:opacity-40 disabled:cursor-not-allowed disabled:hover:bg-transparent", children: disabling2FA ? 'Disabling...' : 'Disable 2FA' })] }), disable2FAError && (0, jsx_runtime_1.jsx)("p", { className: "text-xs text-red-400", children: disable2FAError })] })) : mfaEnrollHref ? (
+                            // 152745: real navigation to the consumer's own enrollment
+                            // route (a plain <a>, matching "Back to Profile" below — this
+                            // package has no opinion on which router the host app uses).
+                            (0, jsx_runtime_1.jsx)("a", { href: mfaEnrollHref, className: "inline-block px-4 py-2 bg-blue-600 text-white rounded-md hover:bg-blue-700", children: "Enable 2FA" })) : (
+                            // 152745: no enrollment destination configured. This is the
+                            // case QAPert's 170047 gate found live on idealresume.online —
+                            // rendering an active-looking button here would be the exact
+                            // "advertises 2FA, nothing reachable" defect this card exists
+                            // to close, just moved from "no onClick" to "onClick navigates
+                            // to a 404". Honestly disabled instead.
+                            (0, jsx_runtime_1.jsx)("button", { type: "button", disabled: true, title: "Two-factor authentication enrollment is not available here", className: "px-4 py-2 bg-blue-600 text-white rounded-md opacity-40 cursor-not-allowed", children: "Enable 2FA" })), securityData?.two_factor?.backup_codes_remaining !== undefined && ((0, jsx_runtime_1.jsxs)("div", { className: `mt-4 p-3 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textSecondary}`, children: "Backup Codes" }), (0, jsx_runtime_1.jsxs)("p", { className: textMuted, children: ["You have ", securityData.two_factor.backup_codes_remaining, " of 10 backup codes remaining"] }), (0, jsx_runtime_1.jsx)("button", { className: `mt-2 text-sm ${isDark ? 'text-blue-400' : 'text-blue-600'}`, children: "View Codes" })] }))] }) }), (0, jsx_runtime_1.jsxs)(SecuritySection, { title: "Connected Accounts", description: "OAuth providers linked to your account", isDark: isDark, children: [securityData?.connected_accounts && securityData.connected_accounts.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { className: "space-y-3", children: securityData.connected_accounts.map((account, idx) => ((0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between p-3 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: account.provider }), account.email && (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: account.email }), account.connected_at && (0, jsx_runtime_1.jsxs)("p", { className: `text-xs ${textMuted}`, children: ["Connected ", formatDate(account.connected_at)] })] }), account.can_disconnect && ((0, jsx_runtime_1.jsx)("button", { className: "text-sm text-red-500 hover:text-red-400", children: "Disconnect" }))] }, idx))) })) : ((0, jsx_runtime_1.jsx)("p", { className: textMuted, children: "No connected accounts" })), (0, jsx_runtime_1.jsx)("button", { className: `mt-4 text-sm ${isDark ? 'text-blue-400' : 'text-blue-600'}`, children: "Connect Another Account" })] }), (0, jsx_runtime_1.jsxs)(SecuritySection, { title: "Active Sessions", description: "Devices currently logged into your account", isDark: isDark, children: [securityData?.active_sessions && securityData.active_sessions.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { className: "space-y-3", children: securityData.active_sessions.map((session, idx) => ((0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between p-3 rounded-lg ${elevatedBg}`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: session.device_name || 'Unknown Device' }), session.is_current && (0, jsx_runtime_1.jsx)("span", { className: "px-2 py-0.5 rounded text-xs bg-blue-500 text-white", children: "This Device" })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: session.location || session.ip_address }), (0, jsx_runtime_1.jsx)("p", { className: `text-xs ${textMuted}`, children: session.is_current ? 'Active now' : `Last active ${formatRelativeTime(session.last_active_at)}` })] }), !session.is_current && ((0, jsx_runtime_1.jsx)("button", { className: "text-sm text-red-500 hover:text-red-400", children: "Revoke" }))] }, idx))) })) : ((0, jsx_runtime_1.jsx)("p", { className: textMuted, children: "Session information not available" })), (0, jsx_runtime_1.jsx)("button", { className: "mt-4 text-sm text-red-500 hover:text-red-400", children: "Sign Out All Other Devices" })] }), (0, jsx_runtime_1.jsxs)(SecuritySection, { title: "Recent Activity", description: "Security events on your account", isDark: isDark, children: [securityData?.recent_activity && securityData.recent_activity.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { className: "space-y-2", children: securityData.recent_activity.slice(0, 5).map((activity, idx) => ((0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between py-2 border-b last:border-b-0 ${borderColor}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)("span", { className: activity.success ? 'text-green-400' : 'text-red-400', children: activity.success ? 'v' : 'x' }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textPrimary}`, children: activity.description }), activity.device && (0, jsx_runtime_1.jsx)("p", { className: `text-xs ${textMuted}`, children: activity.device })] })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-xs ${textMuted}`, children: formatRelativeTime(activity.timestamp) })] }, idx))) })) : ((0, jsx_runtime_1.jsx)("p", { className: textMuted, children: "No recent activity" })), (0, jsx_runtime_1.jsx)("button", { className: `mt-4 text-sm ${isDark ? 'text-blue-400' : 'text-blue-600'}`, children: "View Full History" })] }), (0, jsx_runtime_1.jsx)(SecuritySection, { title: "Danger Zone", description: "Irreversible actions", isDark: isDark, children: (0, jsx_runtime_1.jsxs)("div", { className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between p-4 rounded-lg border border-yellow-500/50`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: "Download My Data" }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: "Get a copy of all your personal data" })] }), (0, jsx_runtime_1.jsx)("button", { className: "px-4 py-2 text-sm rounded border border-yellow-500 text-yellow-500 hover:bg-yellow-500/10", children: "Request Export" })] }), (0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between p-4 rounded-lg border border-red-500/50`, children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${textPrimary}`, children: "Delete Account" }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${textMuted}`, children: "Permanently delete your account and all data" })] }), (0, jsx_runtime_1.jsx)("button", { className: "px-4 py-2 text-sm rounded border border-red-500 text-red-500 hover:bg-red-500/10", children: "Delete Account" })] })] }) }), (0, jsx_runtime_1.jsx)("div", { className: "text-center", children: (0, jsx_runtime_1.jsx)("a", { href: "/account/profile", className: `text-sm hover:underline ${textMuted}`, children: "Back to Profile" }) })] }) }));
 }

package/dist/pages/security/index.d.ts

@@ -5,4 +5,5 @@
  * - EnhancedSecurityPage: Full-featured security with password, 2FA, sessions, activity, danger zone
  */
 export { default as SecurityPage } from './page';
+/** @deprecated use the graft-local canonical copy (card 221074) */
 export { default as EnhancedSecurityPage } from './EnhancedSecurityPage';

package/dist/pages/security/index.js

@@ -12,5 +12,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EnhancedSecurityPage = exports.SecurityPage = void 0;
 var page_1 = require("./page");
 Object.defineProperty(exports, "SecurityPage", { enumerable: true, get: function () { return __importDefault(page_1).default; } });
+// RETIRED (BAPert ruling, card 221074, 2026-08-18): canonical copy is
+// graft-local at idp_admin_ui_graft/src/app/account/security/EnhancedSecurityPage.tsx.
+/** @deprecated use the graft-local canonical copy (card 221074) */
 var EnhancedSecurityPage_1 = require("./EnhancedSecurityPage");
 Object.defineProperty(exports, "EnhancedSecurityPage", { enumerable: true, get: function () { return __importDefault(EnhancedSecurityPage_1).default; } });

package/dist/pages/test-env/EmergencyLogoutPage.d.ts

@@ -1,12 +1,24 @@
 /**
- * Emergency Logout Page
+ * ⚠️ DESTRUCTIVE DEBUG PAGE — NOT INTENDED FOR PRODUCTION. ⚠️
  *
- * Nuclear option for clearing auth state when things go wrong.
- * Clears cookies, localStorage, and forces NextAuth signout.
+ * Emergency Logout Page. Nuclear option for clearing auth state when things go
+ * wrong: clears cookies, clears localStorage, and forces a signout.
  *
- * Usage in consuming app:
+ * ────────────────────────── SCOPE, STATED HONESTLY (QAPert 35000 sweep) ──────────────────────────
+ * This is the MILDEST of the four test-env pages and this warning is
+ * deliberately weaker than its siblings'. The damage is SELF-INFLICTED and
+ * recoverable: a visitor can only destroy their OWN client-side auth state,
+ * and the remedy is to sign in again. It exposes no credential and mutates no
+ * other user's state. Do not read the banner above as equivalent to the JWT
+ * inspector's — inflating a mild finding is how real ones get discounted.
+ *
+ * It is flagged only because it ships with no env gate of its own, and because
+ * clearing localStorage wholesale can discard unrelated application state that
+ * a consuming app kept there. Mounting it is the gate.
+ *
+ * ────────────────────────── IF YOU MOUNT IT, MOUNT IT LIKE THIS ──────────────────────────
  * ```typescript
- * // app/test-env/emergency-logout/page.tsx
+ * // app/test-env/emergency-logout/page.tsx   — TEST/DEV ENVIRONMENTS ONLY
  * export { EmergencyLogoutPage as default } from '@payez/next-mvp/pages/test-env';
  * ```
  */

package/dist/pages/test-env/EmergencyLogoutPage.js

@@ -6,14 +6,26 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const better_auth_client_1 = require("../../client/better-auth-client");
 const react_1 = require("react");
 /**
- * Emergency Logout Page
+ * ⚠️ DESTRUCTIVE DEBUG PAGE — NOT INTENDED FOR PRODUCTION. ⚠️
  *
- * Nuclear option for clearing auth state when things go wrong.
- * Clears cookies, localStorage, and forces NextAuth signout.
+ * Emergency Logout Page. Nuclear option for clearing auth state when things go
+ * wrong: clears cookies, clears localStorage, and forces a signout.
  *
- * Usage in consuming app:
+ * ────────────────────────── SCOPE, STATED HONESTLY (QAPert 35000 sweep) ──────────────────────────
+ * This is the MILDEST of the four test-env pages and this warning is
+ * deliberately weaker than its siblings'. The damage is SELF-INFLICTED and
+ * recoverable: a visitor can only destroy their OWN client-side auth state,
+ * and the remedy is to sign in again. It exposes no credential and mutates no
+ * other user's state. Do not read the banner above as equivalent to the JWT
+ * inspector's — inflating a mild finding is how real ones get discounted.
+ *
+ * It is flagged only because it ships with no env gate of its own, and because
+ * clearing localStorage wholesale can discard unrelated application state that
+ * a consuming app kept there. Mounting it is the gate.
+ *
+ * ────────────────────────── IF YOU MOUNT IT, MOUNT IT LIKE THIS ──────────────────────────
  * ```typescript
- * // app/test-env/emergency-logout/page.tsx
+ * // app/test-env/emergency-logout/page.tsx   — TEST/DEV ENVIRONMENTS ONLY
  * export { EmergencyLogoutPage as default } from '@payez/next-mvp/pages/test-env';
  * ```
  */

package/dist/pages/test-env/JwtInspectPage.d.ts

@@ -1,14 +1,39 @@
 /**
- * Session Inspector Page
+ * ⚠️ DEBUG PAGE THAT DISPLAYS AND COPIES LIVE CREDENTIALS — DO NOT MOUNT
+ * IN PRODUCTION. ⚠️
  *
- * Debug page for inspecting session data from Redis.
- * Shows user info, roles, 2FA status, and tokens.
+ * Session Inspector Page. Debug page for inspecting session data from Redis:
+ * shows user info, roles, 2FA status, and TOKENS. It offers
+ * COPY-TO-CLIPBOARD buttons for the live SESSION TOKEN and ACCESS TOKEN, and
+ * reads them from the consuming app's `/api/internal/session-data` route.
  *
- * Usage in consuming app:
+ * ────────────────────────── WHY THIS WARNING EXISTS (QAPert 35000 / 248991) ──────────────────────────
+ * THIS PAGE HAS NO ENV GATE OF ITS OWN. Unlike the force-expire handler
+ * (default-denied behind ENABLE_TEST_ROUTES) or the idp-token route (behind
+ * ENABLE_TOKEN_INSPECTOR), a mounted page is reachable exactly as far as the
+ * consuming app's own middleware allows. MOUNTING IT IS THE GATE. There is no
+ * second line of defence behind it.
+ *
+ * AND THE CREDENTIAL IT HANDS OVER IS THE PRECONDITION FOR A REAL ATTACK ON
+ * THIS SAME PACKAGE. The 246007 finding reduces to "a caller who KNOWS A
+ * SESSION TOKEN can act on a session it does not own". The purpose of this
+ * page is to put a live session token on the clipboard of whoever loads it. A
+ * screen-share, a shoulder-surfed screenshot or a support call is enough.
+ * Treat the rendered value as a live credential, because that is what it is.
+ *
+ * NOTE FOR MAINTAINERS: this warning must stay on THIS docstring, the one
+ * attached to the exported declaration. An identical block placed higher in
+ * the file does NOT reach the emitted .d.ts — measured, after I made exactly
+ * that mistake — so it would warn no consumer at all.
+ *
+ * ────────────────────────── IF YOU MOUNT IT, MOUNT IT LIKE THIS ──────────────────────────
  * ```typescript
- * // app/test-env/jwt-inspect/page.tsx
+ * // app/test-env/jwt-inspect/page.tsx   — TEST/DEV ENVIRONMENTS ONLY
  * export { JwtInspectPage as default } from '@payez/next-mvp/pages/test-env';
  * ```
+ * Gate the whole /test-env segment in your middleware, per environment. If you
+ * are not actively debugging token contents, DO NOT MOUNT THIS AT ALL — the
+ * safest configuration is the absence of the route.
  */
 export declare function JwtInspectPage(): import("react/jsx-runtime").JSX.Element;
 export default JwtInspectPage;