@payez/next-mvp 4.12.0 → 4.13.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog — @payez/next-mvp
 
+## 4.13.0 (2026-11-05; published under dist-tag `next` only, after 4.12.1; `latest` stays 4.8.9 until Jon says otherwise)
+
+A minor. Numbered 4.13.0 because everything new is additive or opt-in and no export was removed (two exports were added: `./components/mfa/TotpEnrollPanel` and `./dist/pages/enroll`), but three changes alter behaviour for every consumer and are listed first so nobody is surprised. Built from GitHub `keelsecurity/keelauth-next` main (the code is e0ccb0b9; this release commit changes only this file and the version). Base: 4.12.1 (PR 1500 only). PR numbers are the GitHub-era numbers where the PR was opened after the cutover, else the ADO number. Consumers keep their own pins: nothing here bumps or pins any consumer, and the portal stays on 4.12.1 until its owner says otherwise.
+
+**Behaviour changes for every consumer (read first)**
+
+- **CHANGE (PAY-2218 P2, PR 1752): the session cookies are expired only by a request that is provably a top-level navigation.** Decision table, `isKnownNonNavigationRequest` (new export): `Sec-Fetch-Mode` present and not `navigate`, or `Sec-Fetch-Dest` present and not `document` -> NOT cleared (the redirect is still returned); `navigate`/`document` -> cleared as before; no `Sec-Fetch-*` at all: NOT cleared when `rsc`, `next-router-prefetch`, `next-router-state-tree` or `sec-purpose`/`purpose: prefetch` is present, otherwise cleared as before (curl, old clients, server-to-server). Fixes the router-prefetch sign-out measured on real Next 15.5.9 and 16.2.12 servers with real Chromium. Consequence: a dead cookie is now cleared only by a real navigation to a protected page; an API fetch that gets 401 or a client-side link click does not wipe it, and the login page itself does not clear. One test changed on purpose: an `rsc`-only request no longer clears.
+- **CHANGE (PAY-2467, PR 1612): a session whose IdP answer said a second factor is owed stays gated whatever the tenant config says (fail closed).** The viability override used to fire only on the Better-Auth-record fallback; it now also fires on the canonical session row. An IdP-discarded refresh token is treated as a dead session, not a pending second factor. No code change needed by consumers.
+- **CHANGE (PAY-2568 / PAY-2279, PRs 1719, 1614, 1730): a failed credential sign-in shows a fixed sentence chosen by a stable code, never the server text** (detail in the entries below), including the code step.
+
+**Next-version behaviour table (PAY-2218)**
+
+| Next | Router-prefetch headers in middleware | Cookie clear after P2 | `PAYEZ_PREFETCH_GUARD_DEAD` log (PR 2) |
+|---|---|---|---|
+| 15.x (measured 15.5.9) | stripped, no opt-out | keys on Sec-Fetch; real-browser gate passes | printed once per process (proven on a real `next start`) |
+| 16.0-16.1 (measured 16.1.5 source) | stripped, no opt-out | same | printed once |
+| 16.2.x (measured 16.2.12) | kept only with `skipProxyUrlNormalize: true`; stripped without it | same (gate passes WITHOUT the flag) | silent by design (the flag cannot be read from user code) |
+| 14 | not measured | not measured | silent |
+
+Not covered: Safari/Firefox (Chromium only), non-browser clients and browsers that send no Sec-Fetch headers (they keep the old behaviour).
+
+**New, opt-in**
+
+- **PAYEZ_CLIENT_SECRET (PAY-1460 3b, PR 1745).** New optional env var, read at call time, never logged. When set it is sent as `client_secret` in the bodies of `sign-client-assertion`, `client-config` and `next-auth/secret`; unset or blank sends exactly the old bodies. Needed before the IdP enforces a client secret for the client (Core PR 1747 / keelsecurity/payez-core #3). A WRONG value is rejected 401 and 5 wrong values in 15 minutes from one source lock that client+source out: verify the secret on a non-prod rig before it goes into a task definition. An app must run this release with the secret set BEFORE its client id leaves `LegacyOpenClientIds`, or it gets the public view.
+- **PAYEZ_PROVIDER_SECRET_MISSING_REDACTED (PR 1745).** New log line, once per provider per process, naming only the provider: the IdP answered `X-PayEz-Secrets-Redacted: true` and no `<PROVIDER>_CLIENT_SECRET` is set; social sign-in for that provider will fail at the code exchange. Set the env var.
+- **PAYEZ_PREFETCH_GUARD_DEAD (PAY-2218 P1, keelauth-next PR 2).** New log line, information only (see the table).
+- **Signed-in authenticator enrolment page (PAY-2631, PR 1726)** for generated apps: new exports `./dist/pages/enroll` and `./components/mfa/TotpEnrollPanel`.
+- **Credential sign-in code step offers enrolment when the IdP says `enroll_mfa` (PAY-2630, PR 1687).** Host-gated, no default `enrollHref`.
+- **Session-reset links can fall back to a cookie-derived key when the edge cannot see the env secret (PAY-2218, PR 1639).** Explicit opt-in, default OFF (`sessionResetCookieKey`, `createSessionResetHandler({ cookieKey: true })`); the strict route logs one value-free warning for a half-set deployment.
+
+**Smaller**
+
+- **FIX (PAY-2554, PR 1606):** an OAuth callback failure (`/api/auth/error`) redirects with a fixed `OAUTH_SIGN_IN_FAILED` code and the login page shows a sentence.
+- **FIX (PAY-2568, PR 1613):** `createAuthGetHandler` logs the Better Auth error code of an `/api/auth/error` redirect.
+- **FIX (PAY-2279, PR 1614):** login page sentence for `REGISTRATION_NOT_ALLOWED`.
+
+**Not in this package**: `packages/cli` changes (PR 1686 stop-before-scaffold on `KEYS_NO_DEVELOPER_TENANT`, PR 1703 non-zero exit on a failed provision, and the CLI half of PR 1726) ship with `@payez/cli`, not `@payez/next-mvp`. Test-only: PR 1751, PR 1555.
+
+**Release checks run (NextPert, 2026-11-04)**: package builds from main e0ccb0b9 with `tsc` and no errors; full package suite 1559 tests, 1 failure (`C1`, TypeScript shape rows, fails on main and is unrelated); `exports` map has no NEW dangling target versus 4.12.1 (the dangling targets are PRE-EXISTING, in the published 4.12.1 too, not new in this release; tracked in PAY-2718); `npm pack` (not published) from a clean LF `git archive` of main e0ccb0b9 into a temp dir ran `prepack` (build + `check:publish-eol`) green and produced `payez-next-mvp-4.12.1.tgz` (965 files, 1.3 MB; the version string is still 4.12.1 because nothing was bumped); a throwaway consumer build of VibeID-Customer-Portal 2d0bcf18 (Next 16.2.12, default bundler) against that tarball passed `next build`. At the time of these checks NOT done: `npm ci` from the private feed (my token returns 401), `npm publish`, the postpublish health check, a browser/sign-in walk of the consumer. The consumer build proves the package resolves and compiles, not that sign-in works.
+
+## Earlier entries now rolled into 4.13.0 (previously "Unreleased: PAY-2568 / PAY-2279, draft PR; no release, no pin")
+
+- **CHANGE: a failed credential sign-in shows a fixed sentence chosen by a stable code, never the server text.** `lib/sign-in-failure` is one closed table: `invalid_credentials` ("Incorrect email or password.", wrong password, unknown account and any other refusal, identical), `not_a_member` (the IdP code `NotAMemberOfThisApp` at any HTTP status - the public door relays it as 400 - shown only to someone who proved the credentials), `too_many_attempts` (429, `AccountLocked`, `UserLockedOut`, one sentence for all). `/api/auth/admin-login` now answers `code` + the fixed sentence in `error`; the browser client takes the sentence from the table by code and ignores the body text (an unmapped refusal gets one generic sentence, `sign_in_failed`). Each rendered error carries `data-error-code` (form and login page). Allowlisted policy refusals (SsoRequired, InvalidRequest) still show their detail under code `policy_message`, as a plain text node, at most 200 characters (BAPert 85432); no other server text reaches the page. **What changes for a caller:** the 429 sentence and the `?error=CredentialsSignin` sentence changed; a custom UI that read `body.error` still gets a fixed sentence there. Rows: `test/signin-failure-copy.test.cjs` S1-S7 (RED on master, six mutants).
+- **FIX: the code step of a credential sign-in (wrong, unavailable, locked) shows its own sentence again (BAPert 85795).** The code-step branch of `api-handlers/auth/credential-login` sent no `code`, so after the change above every second-factor refusal fell to the generic "Could not sign in. Check your details and try again.", including the "problem on our side, not with your code" answer. The branch now sends `invalid_second_factor` ("That code is not correct. Check the code and try again."), `second_factor_unavailable` (the existing our-side sentence, with the Email-me-a-code offer kept) or `too_many_attempts`, chosen by the existing `classifyTwofaRejection` and never from IdP wording. The lockout sentence now states the window: `Too many sign-in attempts. Try again in N minutes, or reset your password.`, N = the server's `retryAfter` (seconds) rounded up to whole minutes and clamped to 1..60; with no usable number it stays the plain sentence (only a number is ever printed). The password-step 429 no longer invents a `retryAfter` of 60 when the IdP sent no Retry-After. A plain IdP 429 on the code step (a lane rate limit, not a `locked` lockout) has its own code `second_factor_rate_limited`: "Too many attempts. Try again in N minutes." (same N rule; plain fallback "Too many attempts. Wait a few minutes and try again."), so it no longer tells a user to reset their password; it makes no claim that the code is still valid (unproven here), and `twofa-rejection` no longer invents a 60 s `retryAfter`. Sentences lost by the 1719 regression in this lane: the wrong-code sentence, the our-side-fault sentence (with its Email-me-a-code offer text) and the lockout window. Test: `test/second-factor-copy.test.cjs` (T1-T15, mutants RED).
+
+## 4.12.1 (to be published under dist-tag `next` only, after 4.12.0; `latest` stays 4.8.9 until Jon says otherwise)
+
+A patch cut from the 4.12.0 tree carrying ONE change: the PAY-2425 hygiene fix below (PR 1500).
+
+- **CHANGE (PAY-2425, hygiene): the refresh no longer invents authentication claims for an OAuth (Google) session.** `lib/ensure-fresh-access-token` answered an OAuth session whose stored authentication methods were empty with `amr ['pwd','mfa']`, `two_factor_method 'oauth'` and an `acr` raised from '1' to '2' ("OAuth IS a form of multi-factor auth"), and echoed a stored `mfaVerified` as `two_factor_verified` whatever the session's methods said. OAuth is federated sign-in, not a second factor (BAPert 77404). The refresh body now carries only what the session records: empty stays empty, `acr` is the session's own level, no method is named from silence, and `two_factor_verified` is sent only when the session's recorded methods contain `mfa`, `sms`, `totp` or `email`. A session that really attests `mfa` still sends it. The IdP ignores these request fields and mints `amr`/`acr` from the stored refresh row, so this removes a false claim from the wire; it does not establish that any bypass existed or is closed. **What changes for a caller:** a Google user on a `require2FA` client is asked for a code, as before, because the IdP decides that; a Google-only client that wants no second factor sets `require2FA = false` explicitly. An earlier version of this fix on `nextpert/375639-amr-fabrication` (e6e3b6c3, e3b3bb12) was never merged; the refresh path has since moved into this helper. Rows: `test/next-mvp-pay-2425-no-fabricated-mfa.test.cjs` (R1/R2/R3, C1, N1 and four mutants).
+
 ## 4.12.0 (to be published under dist-tag `next` only, after 4.11.0; `latest` stays 4.8.9 until Jon says otherwise)
 
 A minor: PII-in-logs groups 1, 2, 3a and 3b, the GOV-023 signout BREAKING change, the logout-401 FIX (PAY-2396), and the BREAKING site-logger signatures (3b: callers of `siteEvents.loginFailed` / `siteEvents.error` must change).

package/dist/api-handlers/auth/credential-login.js

@@ -41,6 +41,7 @@ exports.POST = POST;
  * lib/session-store.js").
  */
 const server_1 = require("next/server");
+const sign_in_failure_1 = require("../../lib/sign-in-failure");
 const jose_1 = require("jose");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const client_key_1 = require("../../lib/client-key");
@@ -306,9 +307,13 @@ async function POST(req) {
             // (MfaController.VerifyTotp answers a 15-minute lockout as 400 {code:"locked"}), which status-only
             // classification told to "try again".
             const rejection = (0, twofa_rejection_1.classifyTwofaRejection)(laneResults, idpResponse.headers.get('retry-after'));
+            // PAY-2568 follow-up (BAPert 85795): the page takes its sentence from a CODE in the closed table, so this lane must send one.
+            // The branch already decided the cause (classifyTwofaRejection); the code follows its status, the IdP's wording is never used.
+            const rejectionCode = rejection.status === 429 ? (rejection.rateLimited ? 'second_factor_rate_limited' : 'too_many_attempts') : rejection.status === 502 ? 'second_factor_unavailable' : 'invalid_second_factor';
             return server_1.NextResponse.json({
                 success: false,
-                error: rejection.error,
+                code: rejectionCode,
+                error: (0, sign_in_failure_1.signInFailureMessage)(rejectionCode),
                 ...(rejection.retryAfter !== undefined ? { retryAfter: rejection.retryAfter } : {}),
                 // PAY-2284: the card shows a real "email me a code" action only when this is true.
                 ...(rejection.offerEmailCode ? { offerEmailCode: true } : {}),
@@ -365,15 +370,21 @@ async function POST(req) {
     }
     if (idpResponse.status === 429) {
         const retryAfter = idpResponse.headers.get('retry-after');
-        return server_1.NextResponse.json({ success: false, error: 'Too many attempts. Please try again later.', retryAfter: retryAfter ? parseInt(retryAfter, 10) : 60 }, { status: 429 });
+        return server_1.NextResponse.json({
+            success: false,
+            code: 'too_many_attempts',
+            error: (0, sign_in_failure_1.signInFailureMessage)('too_many_attempts'),
+            // BAPert 85807: the page prints this number as minutes, so only a real Retry-After is sent; no invented default.
+            ...(retryAfter && Number.isFinite(parseInt(retryAfter, 10)) && parseInt(retryAfter, 10) > 0 ? { retryAfter: parseInt(retryAfter, 10) } : {}),
+        }, { status: 429 });
     }
     if (!idpResponse.ok) {
         const f = logIdpAuthRefusal('non-ok', idpResponse.status, data);
-        return server_1.NextResponse.json({ success: false, error: publicRefusalMessage(f) }, { status: idpResponse.status });
+        return server_1.NextResponse.json(refusalBody(f, idpResponse.status), { status: idpResponse.status });
     }
     if (data?.success === false) {
         const f = logIdpAuthRefusal('envelope-success-false', idpResponse.status, data);
-        return server_1.NextResponse.json({ success: false, error: publicRefusalMessage(f) }, { status: 200 });
+        return server_1.NextResponse.json(refusalBody(f, idpResponse.status), { status: 200 });
     }
     // Unwrap the IDP's canonical envelope, same shape login.js normalizes.
     const result = data?.data?.result ?? data?.result ?? data;
@@ -685,6 +696,19 @@ function publicRefusalMessage(f) {
         return f.detail;
     return UNIFORM_REFUSAL;
 }
+/**
+ * The browser-facing body of a refusal (BAPert 85415): a stable machine `code` from the closed table in lib/sign-in-failure, and
+ * the fixed sentence for it. The IdP's own message text is never copied in. The one exception is the allowlisted policy refusals
+ * (SsoRequired / SsoRequiredBreakGlass / InvalidRequest): a property of the email domain or the request, not of an account, and the
+ * user cannot proceed without being told; they carry code 'policy_message' and the allowlisted detail (see SAFE_TO_SHOW).
+ */
+function refusalBody(f, status) {
+    const policy = f.code && SAFE_TO_SHOW.has(f.code) ? (0, sign_in_failure_1.capPolicyDetail)(f.detail) : null;
+    if (policy)
+        return { success: false, code: 'policy_message', error: policy };
+    const code = (0, sign_in_failure_1.classifySignInFailure)(status, f.code);
+    return { success: false, code, error: (0, sign_in_failure_1.signInFailureMessage)(code) };
+}
 function logIdpAuthRefusal(branch, httpStatus, data) {
     const f = extractIdpFailure(data);
     const d = (data ?? {});

package/dist/api-handlers/mfa/totp-confirm.js

@@ -5,6 +5,7 @@ const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+const mfa_json_guard_1 = require("../../lib/mfa-json-guard");
 /**
  * Confirm TOTP enrolment with the first authenticator code
  * (POST /api/Account/mfa/totp/confirm, user JWT). Body forwarded verbatim —
@@ -12,6 +13,9 @@ const safe_error_response_1 = require("../../lib/safe-error-response");
  * the method ACTIVE.
  */
 async function POST(req) {
+    const refused = (0, mfa_json_guard_1.refuseNonJson)(req);
+    if (refused)
+        return refused;
     let body = '{}';
     try {
         const raw = await req.text();
@@ -30,13 +34,13 @@ async function POST(req) {
             message: 'Upstream error',
             error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
-        }, { status: result.status });
+        }, { status: result.status, headers: mfa_json_guard_1.NO_STORE });
     }
     const bodyJson = result.json;
     if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
         if (bodyJson.success === true)
-            return server_1.NextResponse.json(bodyJson.data, { status: 200 });
-        return server_1.NextResponse.json(bodyJson, { status: 200 });
+            return server_1.NextResponse.json(bodyJson.data, { status: 200, headers: mfa_json_guard_1.NO_STORE });
+        return server_1.NextResponse.json(bodyJson, { status: 200, headers: mfa_json_guard_1.NO_STORE });
     }
-    return server_1.NextResponse.json(bodyJson ?? {}, { status: 200 });
+    return server_1.NextResponse.json(bodyJson ?? {}, { status: 200, headers: mfa_json_guard_1.NO_STORE });
 }

package/dist/api-handlers/mfa/totp-enroll.js

@@ -5,6 +5,7 @@ const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+const mfa_json_guard_1 = require("../../lib/mfa-json-guard");
 /**
  * Begin TOTP enrolment (POST /api/Account/mfa/totp/enroll, user JWT).
  * Returns the shared secret / otpauth URI for the QR. An enrolment left
@@ -12,6 +13,9 @@ const safe_error_response_1 = require("../../lib/safe-error-response");
  * as "Active" (MFA honesty fixes, 2026-08-01).
  */
 async function POST(req) {
+    const refused = (0, mfa_json_guard_1.refuseNonJson)(req);
+    if (refused)
+        return refused;
     let body = '{}';
     try {
         const raw = await req.text();
@@ -30,13 +34,13 @@ async function POST(req) {
             message: 'Upstream error',
             error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
-        }, { status: result.status });
+        }, { status: result.status, headers: mfa_json_guard_1.NO_STORE });
     }
     const bodyJson = result.json;
     if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
         if (bodyJson.success === true)
-            return server_1.NextResponse.json(bodyJson.data, { status: 200 });
-        return server_1.NextResponse.json(bodyJson, { status: 200 });
+            return server_1.NextResponse.json(bodyJson.data, { status: 200, headers: mfa_json_guard_1.NO_STORE });
+        return server_1.NextResponse.json(bodyJson, { status: 200, headers: mfa_json_guard_1.NO_STORE });
     }
-    return server_1.NextResponse.json(bodyJson ?? {}, { status: 200 });
+    return server_1.NextResponse.json(bodyJson ?? {}, { status: 200, headers: mfa_json_guard_1.NO_STORE });
 }

package/dist/api-handlers/session/viability.js

@@ -65,6 +65,8 @@ async function GET(req) {
         if (betterAuthSession && sessionToken) {
             // Try legacy session store first, then Better Auth format
             let sessionData = await (0, session_store_1.getSession)(sessionToken);
+            // PAY-2467: see routes/auth/viability.ts - a boolean mfaVerified on the raw canonical row is a measurement.
+            const fromCanonicalStore = !!sessionData;
             if (!sessionData) {
                 // Better Auth stores sessions with ba:{appSlug}:{token} prefix
                 sessionData = await (0, session_store_1.getBetterAuthSession)(sessionToken);
@@ -113,9 +115,11 @@ async function GET(req) {
                 // only ever SUPPRESS this override, never grant access. Anything that GRANTS must
                 // keep gating on `mfaVerified`, which stays fail-closed at all five sites. R807 is
                 // void if this signal reaches an auth decision.
-                if (sessionData.mfaSignalPresent === true &&
+                if ((sessionData.mfaSignalPresent === true || (fromCanonicalStore && typeof sessionData.mfaVerified === 'boolean')) &&
                     sessionData.mfaVerified === false &&
-                    !sessionData.idpRefreshToken) {
+                    !sessionData.idpRefreshToken &&
+                    // same exception as routes/auth/viability: an IdP-discarded refresh token is a dead session, not a pending second factor
+                    !String(sessionData?.refreshTokenClearedReason ?? '').startsWith('IDP_DISCARD_TOKEN')) {
                     requires2FA = true;
                 }
                 // CRITICAL: Check if MFA has expired (2FA TTL enforcement)

package/dist/auth/better-auth.d.ts

@@ -623,6 +623,12 @@ export declare const IDP_ERROR_CODES_TO_FORWARD: ReadonlySet<string>;
  * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
  */
 export declare function expireSetCookies(setCookies: readonly string[]): string[];
+/**
+ * PAY-2568: the Better Auth error code of an /api/auth/error redirect (`?error=<code>`), or null when absent or not a plain
+ * token. The value rides a URL, so only a short [A-Za-z0-9_.-] token is ever returned for logging. Location may be relative
+ * or absolute; the base is a placeholder used only for parsing.
+ */
+export declare function authErrorCodeFromLocation(location: string): string | null;
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *

package/dist/auth/better-auth.js

@@ -57,6 +57,7 @@ exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 exports.storeIdpTokensInSession = storeIdpTokensInSession;
 exports.storePayezIdpSession = storePayezIdpSession;
 exports.expireSetCookies = expireSetCookies;
+exports.authErrorCodeFromLocation = authErrorCodeFromLocation;
 exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
 const node_async_hooks_1 = require("node:async_hooks");
@@ -1376,6 +1377,20 @@ async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, lo
     console.warn('[BETTER_AUTH] OAuth sign-in ABORTED: the IdP exchange stored no tokens, so no session is kept (PAY-1733)', sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : '(no session)', 'code=' + errorCode);
     return new Response(null, { status: 302, headers });
 }
+/**
+ * PAY-2568: the Better Auth error code of an /api/auth/error redirect (`?error=<code>`), or null when absent or not a plain
+ * token. The value rides a URL, so only a short [A-Za-z0-9_.-] token is ever returned for logging. Location may be relative
+ * or absolute; the base is a placeholder used only for parsing.
+ */
+function authErrorCodeFromLocation(location) {
+    try {
+        const code = new URL(location, 'http://placeholder.invalid').searchParams.get('error');
+        return code && /^[A-Za-z0-9_.-]{1,64}$/.test(code) ? code : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
@@ -1411,7 +1426,16 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
             if (response.status === 302) {
                 const location = response.headers.get('location') || '';
                 if (location.includes('/api/auth/error') || location.includes('please_restart')) {
-                    console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
+                    // PAY-2568: log WHICH error. Better Auth routes every callback failure to /api/auth/error?error=<code>
+                    // (signup_disabled, state_mismatch, ...); the old fixed 'OAuth state error' sentence made distinct faults
+                    // look identical. Only the code is logged - never the Location (it can carry other params).
+                    const authErrorCode = authErrorCodeFromLocation(location);
+                    if (authErrorCode) {
+                        console.warn('[BETTER_AUTH] auth error code=' + authErrorCode + ', redirecting to login');
+                    }
+                    else {
+                        console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
+                    }
                     // *** DO NOT "TIDY" THIS BACK TO Response.redirect(). IT THROWS. (328439) ***
                     // Response.redirect() REQUIRES an absolute URL — measured, on the leg's own
                     // runtime and again on node 24:
@@ -1448,7 +1472,10 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     // Works whether loginPath is relative (package default '/account-auth/login',
                     // and the graft passes '/sign-in') or absolute — an absolute Location is also
                     // legal, so a consumer passing a full URL still behaves.
-                    return new Response(null, { status: 302, headers: { location: loginPath } });
+                    // PAY-2554: the redirect used to carry NO code, so the login page showed nothing and looked like nothing happened.
+                    // It now carries the same neutral OAUTH_SIGN_IN_FAILED the abort path uses (the login page maps it to one sentence;
+                    // no provider text, URL or internal detail goes on the URL).
+                    return new Response(null, { status: 302, headers: { location: `${loginPath}${loginPath.includes('?') ? '&' : '?'}error=${exports.OAUTH_SIGN_IN_FAILED_ERROR}` } });
                 }
             }
             // After the OAuth callback: exchange the provider identity for IDP tokens. If that does NOT store tokens - the

package/dist/auth/session-reset-link.d.ts

@@ -15,6 +15,26 @@ export interface ResetParams {
 }
 /** The secret the app already signs its session cookie with. Undefined means "cannot sign": callers fall back. */
 export declare function resetSecret(): string | undefined;
+/**
+ * The domain-separation label for the cookie-derived FALLBACK key (PAY-2218, BAPert 83028). It is the only place the session cookie is used as
+ * key material, and it is never the raw SHA-256 of the cookie (that is the binding, a different value for a different purpose).
+ */
+export declare const RESET_COOKIE_KEY_CONTEXT = "payez:session-reset:v1:cookie-derived";
+/**
+ * The secret the reset link is signed and verified with.
+ *
+ *  1. The env secret (BETTER_AUTH_SECRET / NEXTAUTH_SECRET) when the edge can see it. ALWAYS FIRST: where it is present nothing changes.
+ *  2. Otherwise a key derived from the session cookie the link is bound to: HMAC(key = cookie value, message = RESET_COOKIE_KEY_CONTEXT).
+ *     Why that is safe: the cookie is HttpOnly and is the user's credential, so a third-party page that links a victim to the route cannot
+ *     produce a valid signature (the logout-CSRF protection the signature exists for), and anyone who holds the cookie can already act as
+ *     the user, logging out included. The edge holds only a one-way value computed per request from a cookie it already received.
+ *     RESIDUAL RISK, ACCEPTED (BAPert 83028): an attacker who controls a sibling subdomain can plant a cookie value they know under the
+ *     session cookie name and sign a link that clears THAT value. The effect is a forced logout, and an attacker in that position can already
+ *     set or shadow cookies and log the victim out, so the scheme adds no capability.
+ *  3. Neither: undefined ("cannot sign"; callers fall back to the direct clear).
+ * Never log the cookie value or the returned key.
+ */
+export declare function resetSigningSecret(envSecret: string | undefined, sessionCookieValue: string | undefined): Promise<string | undefined>;
 /** The session cookie a reset is bound to: the __Secure- one when present, else the plain one. */
 export declare function boundSessionCookie(get: (name: string) => string | undefined, plainName: string, secureName: string): string | undefined;
 /** Normalise to exactly what the route will honour, so what is signed is what is verified. */
@@ -32,6 +52,18 @@ export declare function loginLocation(p: ResetParams): string;
  * `nowMs` is injectable for tests.
  */
 export declare function signedResetHref(route: string, p: ResetParams, secret: string, sessionCookieValue: string | undefined, nowMs?: number): Promise<string>;
+/**
+ * VERIFY side, ONLY for an app that opted in (sessionResetCookieKey + createSessionResetHandler({ cookieKey: true }); BAPert 83102). PAY-2218, BAPert 83074 option a: the signer and the verifier can see different things. The edge middleware may be BLIND to the env
+ * secret (it signs cookie-derived) while the Node route handler is SIGHTED (the IdP-supplied secret is in its process.env). So the route accepts a link
+ * signed with EITHER sound key: the env secret first (when it has one), then the key derived from THIS request's session cookie. Both are sound: the
+ * cookie-derived link is still bound to the request's own session cookie, carries its expiry inside the MAC, and is compared in constant time. A link
+ * signed with neither key, or with a key derived from a different cookie, is refused.
+ */
+export declare function readResetRequestAnyKey(search: URLSearchParams, envSecret: string | undefined, sessionCookieValue: string | undefined, nowMs?: number): Promise<{
+    params: ResetParams;
+    signed: boolean;
+    via: 'env' | 'cookie' | null;
+}>;
 /**
  * Read a reset request's query. `signed` is true only for a valid, unexpired signature over the normalised params AND
  * this request's own session cookie (`sessionCookieValue`). With no session cookie there is nothing to clear: false.

package/dist/auth/session-reset-link.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RESET_ERRORS = exports.RESET_REASONS = exports.RESET_KEY_PURPOSE = exports.RESET_LINK_TTL_SECONDS = exports.DEFAULT_SESSION_RESET_ROUTE = exports.LOGIN_PAGE = void 0;
+exports.RESET_COOKIE_KEY_CONTEXT = exports.RESET_ERRORS = exports.RESET_REASONS = exports.RESET_KEY_PURPOSE = exports.RESET_LINK_TTL_SECONDS = exports.DEFAULT_SESSION_RESET_ROUTE = exports.LOGIN_PAGE = void 0;
 exports.resetSecret = resetSecret;
+exports.resetSigningSecret = resetSigningSecret;
 exports.boundSessionCookie = boundSessionCookie;
 exports.normaliseResetParams = normaliseResetParams;
 exports.resetPayload = resetPayload;
 exports.loginLocation = loginLocation;
 exports.signedResetHref = signedResetHref;
+exports.readResetRequestAnyKey = readResetRequestAnyKey;
 exports.readResetRequest = readResetRequest;
 /**
  * PAY-2218 PR 2: the hand-off between the middleware and the session-reset route.
@@ -85,6 +87,32 @@ function sameString(a, b) {
 function resetSecret() {
     return process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET || undefined;
 }
+/**
+ * The domain-separation label for the cookie-derived FALLBACK key (PAY-2218, BAPert 83028). It is the only place the session cookie is used as
+ * key material, and it is never the raw SHA-256 of the cookie (that is the binding, a different value for a different purpose).
+ */
+exports.RESET_COOKIE_KEY_CONTEXT = 'payez:session-reset:v1:cookie-derived';
+/**
+ * The secret the reset link is signed and verified with.
+ *
+ *  1. The env secret (BETTER_AUTH_SECRET / NEXTAUTH_SECRET) when the edge can see it. ALWAYS FIRST: where it is present nothing changes.
+ *  2. Otherwise a key derived from the session cookie the link is bound to: HMAC(key = cookie value, message = RESET_COOKIE_KEY_CONTEXT).
+ *     Why that is safe: the cookie is HttpOnly and is the user's credential, so a third-party page that links a victim to the route cannot
+ *     produce a valid signature (the logout-CSRF protection the signature exists for), and anyone who holds the cookie can already act as
+ *     the user, logging out included. The edge holds only a one-way value computed per request from a cookie it already received.
+ *     RESIDUAL RISK, ACCEPTED (BAPert 83028): an attacker who controls a sibling subdomain can plant a cookie value they know under the
+ *     session cookie name and sign a link that clears THAT value. The effect is a forced logout, and an attacker in that position can already
+ *     set or shadow cookies and log the victim out, so the scheme adds no capability.
+ *  3. Neither: undefined ("cannot sign"; callers fall back to the direct clear).
+ * Never log the cookie value or the returned key.
+ */
+async function resetSigningSecret(envSecret, sessionCookieValue) {
+    if (envSecret)
+        return envSecret;
+    if (!sessionCookieValue)
+        return undefined;
+    return b64url(await hmacBytes(encoder.encode(sessionCookieValue), exports.RESET_COOKIE_KEY_CONTEXT));
+}
 /** The session cookie a reset is bound to: the __Secure- one when present, else the plain one. */
 function boundSessionCookie(get, plainName, secureName) {
     return get(secureName) || get(plainName) || undefined;
@@ -126,6 +154,22 @@ async function signedResetHref(route, p, secret, sessionCookieValue, nowMs = Dat
     q.set('sig', await sign(secret, resetPayload(p, exp, await sessionBinding(sessionCookieValue))));
     return `${route}?${q.toString()}`;
 }
+/**
+ * VERIFY side, ONLY for an app that opted in (sessionResetCookieKey + createSessionResetHandler({ cookieKey: true }); BAPert 83102). PAY-2218, BAPert 83074 option a: the signer and the verifier can see different things. The edge middleware may be BLIND to the env
+ * secret (it signs cookie-derived) while the Node route handler is SIGHTED (the IdP-supplied secret is in its process.env). So the route accepts a link
+ * signed with EITHER sound key: the env secret first (when it has one), then the key derived from THIS request's session cookie. Both are sound: the
+ * cookie-derived link is still bound to the request's own session cookie, carries its expiry inside the MAC, and is compared in constant time. A link
+ * signed with neither key, or with a key derived from a different cookie, is refused.
+ */
+async function readResetRequestAnyKey(search, envSecret, sessionCookieValue, nowMs = Date.now()) {
+    if (envSecret) {
+        const viaEnv = await readResetRequest(search, envSecret, sessionCookieValue, nowMs);
+        if (viaEnv.signed)
+            return { ...viaEnv, via: 'env' };
+    }
+    const viaCookie = await readResetRequest(search, await resetSigningSecret(undefined, sessionCookieValue), sessionCookieValue, nowMs);
+    return { ...viaCookie, via: viaCookie.signed ? 'cookie' : null };
+}
 /**
  * Read a reset request's query. `signed` is true only for a valid, unexpired signature over the normalised params AND
  * this request's own session cookie (`sessionCookieValue`). With no session cookie there is nothing to clear: false.

package/dist/components/auth/CredentialSignInForm.d.ts

@@ -27,7 +27,13 @@ interface Props {
     /** Test seam: navigation after success. */
     onSignedIn?: (destination: string) => void;
     showForgotPassword?: boolean;
+    /**
+     * PAY-2630: the enrolment page a user the IdP told to enrol is taken to after signing in. NO DEFAULT: the offer renders only when
+     * the host passes this, because the host is the one that serves the page (the CLI scaffold writes no /account/security, so a
+     * default would 404 a generated app's user right after a good sign-in).
+     */
+    enrollHref?: string;
 }
 export declare function resolveDestination(explicit?: string): string;
-export declare function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword }: Props): import("react/jsx-runtime").JSX.Element;
+export declare function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword, enrollHref }: Props): import("react/jsx-runtime").JSX.Element;
 export default CredentialSignInForm;

package/dist/components/auth/CredentialSignInForm.js

@@ -10,6 +10,7 @@ const safe_callback_1 = require("../../auth/safe-callback");
 const authorize_resume_1 = require("../../lib/authorize-resume");
 const code_step_copy_1 = require("../../lib/code-step-copy");
 const DevCodeNotice_1 = require("./DevCodeNotice");
+const EnrollAuthenticatorOffer_1 = require("./EnrollAuthenticatorOffer");
 const credential_sign_in_client_1 = require("../../lib/credential-sign-in-client");
 const inputStyle = {
     borderColor: 'var(--border-default, #e5e7eb)',
@@ -30,26 +31,31 @@ function resolveDestination(explicit) {
     }
     return (0, safe_callback_1.safeCallbackPath)((0, authorize_resume_1.authorizeResumeHref)(returnUrl), (0, safe_callback_1.safeCallbackPath)(raw, '/dashboard'));
 }
-function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword = false }) {
+function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword = false, enrollHref }) {
     const [step, setStep] = (0, react_1.useState)('credentials');
     const [email, setEmail] = (0, react_1.useState)('');
     const [password, setPassword] = (0, react_1.useState)('');
     const [code, setCode] = (0, react_1.useState)('');
     const [busy, setBusy] = (0, react_1.useState)(false);
     const [error, setError] = (0, react_1.useState)(null);
+    const [errorCode, setErrorCode] = (0, react_1.useState)(null);
     const [fieldError, setFieldError] = (0, react_1.useState)(null);
     const [codeRequest, setCodeRequest] = (0, react_1.useState)(code_step_copy_1.NO_CODE_REQUEST);
     const [offerEmailCode, setOfferEmailCode] = (0, react_1.useState)(false);
     const [devCode, setDevCode] = (0, react_1.useState)(null);
     const [emailCodeMsg, setEmailCodeMsg] = (0, react_1.useState)(null);
+    // PAY-2630: what the IdP said is outstanding on this client, and whether the user kept the 'take me to enrol' offer ticked.
+    const [nextStep, setNextStep] = (0, react_1.useState)(null);
+    const [enrolAfter, setEnrolAfter] = (0, react_1.useState)(true);
     async function submit(withCode) {
         setBusy(true);
         setError(null);
+        setErrorCode(null);
         setOfferEmailCode(false);
         try {
             const r = await (0, credential_sign_in_client_1.credentialSignIn)({ email, password, code: withCode }, fetchImpl);
             if (r.kind === 'success') {
-                const destination = resolveDestination(callbackUrl);
+                const destination = (0, credential_sign_in_client_1.postSignInDestination)(resolveDestination(callbackUrl), nextStep, enrolAfter, enrollHref);
                 if (onSignedIn)
                     onSignedIn(destination);
                 else
@@ -59,10 +65,12 @@ function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPa
             if (r.kind === 'two_factor') {
                 setCodeRequest(r.codeRequest);
                 setDevCode(r.devCode);
+                setNextStep(r.nextStep);
                 setStep('code');
                 return;
             }
             setError(r.message);
+            setErrorCode(r.code);
             if (r.kind === 'error')
                 setOfferEmailCode(r.offerEmailCode);
         }
@@ -94,6 +102,7 @@ function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPa
         setStep('credentials');
         setCodeRequest(code_step_copy_1.NO_CODE_REQUEST);
         setDevCode(null);
+        setNextStep(null);
         setCode('');
         setFieldError(null);
         setError(null);
@@ -121,12 +130,12 @@ function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPa
         }
     }
     const problem = fieldError ?? error;
-    const problemLine = problem && ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "credential-sign-in-error", className: "text-sm mt-3", style: { color: 'var(--color-error, #ef4444)' }, children: problem }));
+    const problemLine = problem && ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "credential-sign-in-error", "data-error-code": fieldError ? 'invalid_input' : (errorCode ?? undefined), className: "text-sm mt-3", style: { color: 'var(--color-error, #ef4444)' }, children: problem }));
     if (step === 'code') {
         return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "credential-sign-in-code-step", className: "text-left", children: [(0, jsx_runtime_1.jsx)("p", { className: "text-sm mb-4", style: { color: 'var(--text-primary, #111827)' }, children: (0, code_step_copy_1.codeStepInstruction)(email, codeRequest) }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: onCodeSubmit, noValidate: true, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "credential-code", className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary, #111827)' }, children: "Authentication code" }), (0, jsx_runtime_1.jsx)("input", { id: "credential-code", name: "code", type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, placeholder: "000000", value: code, disabled: busy, onChange: (e) => {
                                         setCode(e.target.value);
                                         setFieldError(null);
-                                    }, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: inputStyle }), (0, jsx_runtime_1.jsx)(DevCodeNotice_1.DevCodeNotice, { code: devCode })] }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy, className: "w-full py-3 px-4 rounded-lg font-semibold focus:outline-none focus:ring-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors", style: { background: 'var(--btn-primary-bg, #11B588)', color: 'var(--btn-primary-text, white)' }, children: busy ? 'Verifying…' : 'Verify' })] }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: onBack, disabled: busy, className: "text-sm underline mt-4", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-muted, #6b7280)' }, children: "Back" }), problemLine, (offerEmailCode || emailCodeMsg) && ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "email-code-offer", className: "mt-4", children: [offerEmailCode && ((0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => void askForEmailCode(), disabled: busy, className: "text-sm font-semibold underline", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-primary, #111827)' }, children: "Email me a code instead" })), emailCodeMsg && ((0, jsx_runtime_1.jsx)("p", { role: "status", "data-testid": "email-code-offer-msg", className: "text-sm mt-2", style: { color: 'var(--text-primary, #111827)' }, children: emailCodeMsg }))] }))] }));
+                                    }, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: inputStyle }), (0, jsx_runtime_1.jsx)(DevCodeNotice_1.DevCodeNotice, { code: devCode })] }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy, className: "w-full py-3 px-4 rounded-lg font-semibold focus:outline-none focus:ring-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors", style: { background: 'var(--btn-primary-bg, #11B588)', color: 'var(--btn-primary-text, white)' }, children: busy ? 'Verifying…' : 'Verify' })] }), (0, jsx_runtime_1.jsx)(EnrollAuthenticatorOffer_1.EnrollAuthenticatorOffer, { nextStep: enrollHref ? nextStep : null, checked: enrolAfter, onChange: setEnrolAfter, disabled: busy }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: onBack, disabled: busy, className: "text-sm underline mt-4", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-muted, #6b7280)' }, children: "Back" }), problemLine, (offerEmailCode || emailCodeMsg) && ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "email-code-offer", className: "mt-4", children: [offerEmailCode && ((0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => void askForEmailCode(), disabled: busy, className: "text-sm font-semibold underline", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-primary, #111827)' }, children: "Email me a code instead" })), emailCodeMsg && ((0, jsx_runtime_1.jsx)("p", { role: "status", "data-testid": "email-code-offer-msg", className: "text-sm mt-2", style: { color: 'var(--text-primary, #111827)' }, children: emailCodeMsg }))] }))] }));
     }
     return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "credential-sign-in", className: "text-left", children: [(0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: (v) => {
                     setEmail(v);

package/dist/components/auth/EnrollAuthenticatorOffer.d.ts

@@ -0,0 +1,21 @@
+import type { NextStep } from '../../lib/credential-sign-in-client';
+/**
+ * PAY-2630: the code step's offer to set up an authenticator.
+ *
+ * WHY. The IdP answers the first sign-in turn with next_step 'enroll_mfa' when the user has NO usable second factor on this
+ * client (factors are per client). The step used to ignore that and show only "enter the code we emailed you", so a user of a
+ * generated app could never enrol a factor on that client. Measured on the PAY-2305 walk (client 90662, user with a TOTP on
+ * client 12 only): requiresTwoFactor true, sentVia 'email', nextStep 'enroll_mfa', and a page with Verify / Back and nothing else.
+ *
+ * WHAT IT IS, AND IS NOT. It renders ONLY for 'enroll_mfa'. It names the lane the user is on (the emailed code) and offers to take
+ * them to the enrolment page right after they sign in with it. It does NOT enrol in place: the enrolment endpoints need a signed-in
+ * session and this step has none yet (the provisional bearer is parked server-side). For 'mfa_verify', null or anything else it
+ * renders nothing: a user who HAS a factor must not be told to set one up.
+ */
+export declare function EnrollAuthenticatorOffer({ nextStep, checked, onChange, disabled, }: {
+    nextStep: NextStep;
+    checked: boolean;
+    onChange: (next: boolean) => void;
+    disabled?: boolean;
+}): import("react/jsx-runtime").JSX.Element | null;
+export default EnrollAuthenticatorOffer;

package/dist/components/auth/EnrollAuthenticatorOffer.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnrollAuthenticatorOffer = EnrollAuthenticatorOffer;
+const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * PAY-2630: the code step's offer to set up an authenticator.
+ *
+ * WHY. The IdP answers the first sign-in turn with next_step 'enroll_mfa' when the user has NO usable second factor on this
+ * client (factors are per client). The step used to ignore that and show only "enter the code we emailed you", so a user of a
+ * generated app could never enrol a factor on that client. Measured on the PAY-2305 walk (client 90662, user with a TOTP on
+ * client 12 only): requiresTwoFactor true, sentVia 'email', nextStep 'enroll_mfa', and a page with Verify / Back and nothing else.
+ *
+ * WHAT IT IS, AND IS NOT. It renders ONLY for 'enroll_mfa'. It names the lane the user is on (the emailed code) and offers to take
+ * them to the enrolment page right after they sign in with it. It does NOT enrol in place: the enrolment endpoints need a signed-in
+ * session and this step has none yet (the provisional bearer is parked server-side). For 'mfa_verify', null or anything else it
+ * renders nothing: a user who HAS a factor must not be told to set one up.
+ */
+function EnrollAuthenticatorOffer({ nextStep, checked, onChange, disabled, }) {
+    if (nextStep !== 'enroll_mfa')
+        return null;
+    return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "enroll-authenticator-offer", className: "mt-4 text-sm", style: { color: 'var(--text-primary, #111827)' }, children: [(0, jsx_runtime_1.jsx)("p", { "data-testid": "enroll-authenticator-lane", children: "You have no authenticator set up for this app yet, so this time you sign in with the emailed code." }), (0, jsx_runtime_1.jsxs)("label", { className: "flex items-center gap-2 mt-2", children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", "data-testid": "enroll-authenticator-checkbox", checked: checked, disabled: disabled, onChange: (e) => onChange(e.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: "Take me to set up an authenticator right after I sign in" })] })] }));
+}
+exports.default = EnrollAuthenticatorOffer;

package/dist/components/mfa/QrCode.d.ts

@@ -0,0 +1,6 @@
+/** PAY-2631: client-side QR from an otpauth:// URI. Inline SVG, quiet zone of 4 modules; no network, no library. */
+export declare function QrCode({ value, size }: {
+    value: string;
+    size?: number;
+}): import("react/jsx-runtime").JSX.Element;
+export default QrCode;

package/dist/components/mfa/QrCode.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QrCode = QrCode;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const qrcode_1 = require("../../lib/qrcode");
+/** PAY-2631: client-side QR from an otpauth:// URI. Inline SVG, quiet zone of 4 modules; no network, no library. */
+function QrCode({ value, size = 168 }) {
+    const qr = (0, react_1.useMemo)(() => (0, qrcode_1.encodeQr)(value), [value]);
+    const path = (0, react_1.useMemo)(() => (0, qrcode_1.qrToSvgPath)(qr), [qr]);
+    const modules = qr.size;
+    return ((0, jsx_runtime_1.jsxs)("svg", { width: size, height: size, viewBox: `-4 -4 ${modules + 8} ${modules + 8}`, role: "img", "aria-label": "QR code for authenticator setup", "data-testid": "totp-qr", children: [(0, jsx_runtime_1.jsx)("rect", { x: -4, y: -4, width: modules + 8, height: modules + 8, fill: "#ffffff" }), (0, jsx_runtime_1.jsx)("path", { d: path, fill: "#212126" })] }));
+}
+exports.default = QrCode;

package/dist/components/mfa/TotpEnrollPanel.d.ts

@@ -0,0 +1,6 @@
+export declare const STEP_UP_SENTENCE = "This session was signed in with an emailed or texted code only. Sign in with your current authenticator, then try again.";
+export declare function TotpEnrollPanel({ fetchImpl, onConfirmed }?: {
+    fetchImpl?: typeof fetch;
+    onConfirmed?: () => void;
+}): import("react/jsx-runtime").JSX.Element;
+export default TotpEnrollPanel;