@payez/next-mvp 4.12.1 → 4.13.1

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog — @payez/next-mvp
 
+## Unreleased
+
+- **ADDITIVE (MINOR when released): SMS-first sign-up learns the `EMAIL_CONFIRMATION_REQUIRED` step (BAPert 88395 #2, 88454 #3; NextPert 88471).** The server (door 3b) now answers `verify-sms-code` with 200 success, `next_step = EMAIL_CONFIRMATION_REQUIRED` and NO reset token when the email is still unconfirmed. Before this, `accountApi.verifyOnboardingSmsCode` returned `{ success: true, resetToken: '' }` for that answer, which a consumer reads as "verified" and then calls set-password with an EMPTY token. Now: (a) the result type is the exported `SmsCodeVerification` and gains an OPTIONAL `nextStep` (`nextStep` ALONE is read from the nested shapes AND from a flat body; `reset_token`, `email` and `client_key` are still read from the nested shapes only, as before, so a consumer behind a proxy that forwards a flat body gets no token and the helper then says `more_steps`, the safe direction; absent / null / '' = no step; any other value, including `false`, `0` and a non-string, is kept as a non-empty UNRECOGNISED string, never dropped, so a server that means "no step" must send nothing or null); (b) new pure `interpretSmsVerification(result)` returns `verified` (only with a non-empty reset token and no step), `email_confirmation_required` (the package sentence "Your phone is verified. Confirm your email to finish signing up.", no error styling), `more_steps` ("One more step is needed to finish signing up." for ANY other step, and for success with an empty reset token) or `not_verified`; `success: false` WINS over any step (`not_verified`, so a failed answer never says "Your phone is verified"), and for every other answer it tests `nextStep` BEFORE the token; the sentences are the package's own, never the server's text. **The method itself still returns the server's `success` unchanged: a consumer MUST use `interpretSmsVerification` (or test `nextStep` first) and must not treat `success` alone as "verified", because `success: true` with an empty `resetToken` is what the server now sends for the unconfirmed-email case.** No breaking type change: a consumer that ignores `nextStep` compiles unchanged (test S6), and the email variant `verifyOnboardingCode` is untouched. **A consumer must adopt `interpretSmsVerification` (or branch on `nextStep` itself) to show the new screen; until it does, it behaves as before.** There is no SMS-first page in this package: the screen lives in the consuming sites, so the deploy of the server change (PR 85) waits on every live consumer taking this release. Tests: `test/sms-next-step.test.cjs` (32), `test/sms-next-step-mutants.test.cjs` (9 hand mutants, one per branch).
+
+## 4.13.1 (to be published under dist-tag `next` only, after 4.13.0; `latest` stays 4.8.9 until Jon says otherwise)
+
+A patch: ONE change, the PAY-2994 no-store fix for 8 GET routes (re-cut on GitHub from DevOps PR 1757, BAPert 92969; the DevOps repo is frozen).
+
+- **FIX (PAY-2994): eight GET routes now answer `Cache-Control: no-store` on every response.** The portal's BFF no-store ratchet found that these re-exported routes sent no Cache-Control, though their answers carry per-user data and some carry tokens, so a browser or an intermediate cache could keep them. New internal `lib/no-store` (`noStore(handler)`): it sets `no-store` on whatever the handler returns (errors and redirects too), REPLACES a looser existing value, rebuilds a Response whose headers are immutable (e.g. `Response.redirect`) with status, body and every `Set-Cookie` intact, passes the handler's arguments through, and hands a non-Response back untouched. Wrapped: `api-handlers/account/profile` GET, `api-handlers/anon/preferences` GET, `auth/better-auth` `createAuthGetHandler`, `routes/auth/session` GET, `routes/mfa/methods` GET, `routes/passkeys/list` GET, `routes/session/refresh-viability` GET, `routes/auth/viability` GET; and, as the same data under a second export path (NightHawk 92964 Low 1), `api-handlers/session/viability` GET and `api-handlers/session/refresh-viability` GET. No other behaviour changes. Package test `test/next-mvp-pay-2994-no-store.test.cjs` calls the REAL compiled GET of each and a mutant (wrapper removed) goes red.
+- **NOT covered (follow-up, so the next ratchet run is expected, NightHawk 92964 Low 2):** GET answers in `api-handlers/auth/status`, `api-handlers/auth/validate`, `routes/auth/session-reset`, `routes/auth/settings` and `api-handlers/oauth/resume` (a redirect that sets cookies) still send no `no-store`. They were not in the ratchet's finding.
+
+## 4.13.0 (2026-11-05; published under dist-tag `next` only, after 4.12.1; `latest` stays 4.8.9 until Jon says otherwise)
+
+A minor. Numbered 4.13.0 because everything new is additive or opt-in and no export was removed (two exports were added: `./components/mfa/TotpEnrollPanel` and `./dist/pages/enroll`), but three changes alter behaviour for every consumer and are listed first so nobody is surprised. Built from GitHub `keelsecurity/keelauth-next` main (the code is e0ccb0b9; this release commit changes only this file and the version). Base: 4.12.1 (PR 1500 only). PR numbers are the GitHub-era numbers where the PR was opened after the cutover, else the ADO number. Consumers keep their own pins: nothing here bumps or pins any consumer, and the portal stays on 4.12.1 until its owner says otherwise.
+
+**Behaviour changes for every consumer (read first)**
+
+- **CHANGE (PAY-2218 P2, PR 1752): the session cookies are expired only by a request that is provably a top-level navigation.** Decision table, `isKnownNonNavigationRequest` (new export): `Sec-Fetch-Mode` present and not `navigate`, or `Sec-Fetch-Dest` present and not `document` -> NOT cleared (the redirect is still returned); `navigate`/`document` -> cleared as before; no `Sec-Fetch-*` at all: NOT cleared when `rsc`, `next-router-prefetch`, `next-router-state-tree` or `sec-purpose`/`purpose: prefetch` is present, otherwise cleared as before (curl, old clients, server-to-server). Fixes the router-prefetch sign-out measured on real Next 15.5.9 and 16.2.12 servers with real Chromium. Consequence: a dead cookie is now cleared only by a real navigation to a protected page; an API fetch that gets 401 or a client-side link click does not wipe it, and the login page itself does not clear. One test changed on purpose: an `rsc`-only request no longer clears.
+- **CHANGE (PAY-2467, PR 1612): a session whose IdP answer said a second factor is owed stays gated whatever the tenant config says (fail closed).** The viability override used to fire only on the Better-Auth-record fallback; it now also fires on the canonical session row. An IdP-discarded refresh token is treated as a dead session, not a pending second factor. No code change needed by consumers.
+- **CHANGE (PAY-2568 / PAY-2279, PRs 1719, 1614, 1730): a failed credential sign-in shows a fixed sentence chosen by a stable code, never the server text** (detail in the entries below), including the code step.
+
+**Next-version behaviour table (PAY-2218)**
+
+| Next | Router-prefetch headers in middleware | Cookie clear after P2 | `PAYEZ_PREFETCH_GUARD_DEAD` log (PR 2) |
+|---|---|---|---|
+| 15.x (measured 15.5.9) | stripped, no opt-out | keys on Sec-Fetch; real-browser gate passes | printed once per process (proven on a real `next start`) |
+| 16.0-16.1 (measured 16.1.5 source) | stripped, no opt-out | same | printed once |
+| 16.2.x (measured 16.2.12) | kept only with `skipProxyUrlNormalize: true`; stripped without it | same (gate passes WITHOUT the flag) | silent by design (the flag cannot be read from user code) |
+| 14 | not measured | not measured | silent |
+
+Not covered: Safari/Firefox (Chromium only), non-browser clients and browsers that send no Sec-Fetch headers (they keep the old behaviour).
+
+**New, opt-in**
+
+- **PAYEZ_CLIENT_SECRET (PAY-1460 3b, PR 1745).** New optional env var, read at call time, never logged. When set it is sent as `client_secret` in the bodies of `sign-client-assertion`, `client-config` and `next-auth/secret`; unset or blank sends exactly the old bodies. Needed before the IdP enforces a client secret for the client (Core PR 1747 / keelsecurity/payez-core #3). A WRONG value is rejected 401 and 5 wrong values in 15 minutes from one source lock that client+source out: verify the secret on a non-prod rig before it goes into a task definition. An app must run this release with the secret set BEFORE its client id leaves `LegacyOpenClientIds`, or it gets the public view.
+- **PAYEZ_PROVIDER_SECRET_MISSING_REDACTED (PR 1745).** New log line, once per provider per process, naming only the provider: the IdP answered `X-PayEz-Secrets-Redacted: true` and no `<PROVIDER>_CLIENT_SECRET` is set; social sign-in for that provider will fail at the code exchange. Set the env var.
+- **PAYEZ_PREFETCH_GUARD_DEAD (PAY-2218 P1, keelauth-next PR 2).** New log line, information only (see the table).
+- **Signed-in authenticator enrolment page (PAY-2631, PR 1726)** for generated apps: new exports `./dist/pages/enroll` and `./components/mfa/TotpEnrollPanel`.
+- **Credential sign-in code step offers enrolment when the IdP says `enroll_mfa` (PAY-2630, PR 1687).** Host-gated, no default `enrollHref`.
+- **Session-reset links can fall back to a cookie-derived key when the edge cannot see the env secret (PAY-2218, PR 1639).** Explicit opt-in, default OFF (`sessionResetCookieKey`, `createSessionResetHandler({ cookieKey: true })`); the strict route logs one value-free warning for a half-set deployment.
+
+**Smaller**
+
+- **FIX (PAY-2554, PR 1606):** an OAuth callback failure (`/api/auth/error`) redirects with a fixed `OAUTH_SIGN_IN_FAILED` code and the login page shows a sentence.
+- **FIX (PAY-2568, PR 1613):** `createAuthGetHandler` logs the Better Auth error code of an `/api/auth/error` redirect.
+- **FIX (PAY-2279, PR 1614):** login page sentence for `REGISTRATION_NOT_ALLOWED`.
+
+**Not in this package**: `packages/cli` changes (PR 1686 stop-before-scaffold on `KEYS_NO_DEVELOPER_TENANT`, PR 1703 non-zero exit on a failed provision, and the CLI half of PR 1726) ship with `@payez/cli`, not `@payez/next-mvp`. Test-only: PR 1751, PR 1555.
+
+**Release checks run (NextPert, 2026-11-04)**: package builds from main e0ccb0b9 with `tsc` and no errors; full package suite 1559 tests, 1 failure (`C1`, TypeScript shape rows, fails on main and is unrelated); `exports` map has no NEW dangling target versus 4.12.1 (the dangling targets are PRE-EXISTING, in the published 4.12.1 too, not new in this release; tracked in PAY-2718); `npm pack` (not published) from a clean LF `git archive` of main e0ccb0b9 into a temp dir ran `prepack` (build + `check:publish-eol`) green and produced `payez-next-mvp-4.12.1.tgz` (965 files, 1.3 MB; the version string is still 4.12.1 because nothing was bumped); a throwaway consumer build of VibeID-Customer-Portal 2d0bcf18 (Next 16.2.12, default bundler) against that tarball passed `next build`. At the time of these checks NOT done: `npm ci` from the private feed (my token returns 401), `npm publish`, the postpublish health check, a browser/sign-in walk of the consumer. The consumer build proves the package resolves and compiles, not that sign-in works.
+
+## Earlier entries now rolled into 4.13.0 (previously "Unreleased: PAY-2568 / PAY-2279, draft PR; no release, no pin")
+
+
+- **CHANGE: a failed credential sign-in shows a fixed sentence chosen by a stable code, never the server text.** `lib/sign-in-failure` is one closed table: `invalid_credentials` ("Incorrect email or password.", wrong password, unknown account and any other refusal, identical), `not_a_member` (the IdP code `NotAMemberOfThisApp` at any HTTP status - the public door relays it as 400 - shown only to someone who proved the credentials), `too_many_attempts` (429, `AccountLocked`, `UserLockedOut`, one sentence for all). `/api/auth/admin-login` now answers `code` + the fixed sentence in `error`; the browser client takes the sentence from the table by code and ignores the body text (an unmapped refusal gets one generic sentence, `sign_in_failed`). Each rendered error carries `data-error-code` (form and login page). Allowlisted policy refusals (SsoRequired, InvalidRequest) still show their detail under code `policy_message`, as a plain text node, at most 200 characters (BAPert 85432); no other server text reaches the page. **What changes for a caller:** the 429 sentence and the `?error=CredentialsSignin` sentence changed; a custom UI that read `body.error` still gets a fixed sentence there. Rows: `test/signin-failure-copy.test.cjs` S1-S7 (RED on master, six mutants).
+- **FIX: the code step of a credential sign-in (wrong, unavailable, locked) shows its own sentence again (BAPert 85795).** The code-step branch of `api-handlers/auth/credential-login` sent no `code`, so after the change above every second-factor refusal fell to the generic "Could not sign in. Check your details and try again.", including the "problem on our side, not with your code" answer. The branch now sends `invalid_second_factor` ("That code is not correct. Check the code and try again."), `second_factor_unavailable` (the existing our-side sentence, with the Email-me-a-code offer kept) or `too_many_attempts`, chosen by the existing `classifyTwofaRejection` and never from IdP wording. The lockout sentence now states the window: `Too many sign-in attempts. Try again in N minutes, or reset your password.`, N = the server's `retryAfter` (seconds) rounded up to whole minutes and clamped to 1..60; with no usable number it stays the plain sentence (only a number is ever printed). The password-step 429 no longer invents a `retryAfter` of 60 when the IdP sent no Retry-After. A plain IdP 429 on the code step (a lane rate limit, not a `locked` lockout) has its own code `second_factor_rate_limited`: "Too many attempts. Try again in N minutes." (same N rule; plain fallback "Too many attempts. Wait a few minutes and try again."), so it no longer tells a user to reset their password; it makes no claim that the code is still valid (unproven here), and `twofa-rejection` no longer invents a 60 s `retryAfter`. Sentences lost by the 1719 regression in this lane: the wrong-code sentence, the our-side-fault sentence (with its Email-me-a-code offer text) and the lockout window. Test: `test/second-factor-copy.test.cjs` (T1-T15, mutants RED).
+
 ## 4.12.1 (to be published under dist-tag `next` only, after 4.12.0; `latest` stays 4.8.9 until Jon says otherwise)
 
 A patch cut from the 4.12.0 tree carrying ONE change: the PAY-2425 hygiene fix below (PR 1500).

package/dist/api-handlers/account/profile.d.ts

@@ -1,41 +1,4 @@
 import { NextRequest, NextResponse } from 'next/server';
-/**
- * Account Profile API Handler
- *
- * GET /api/account/profile  - Get user profile
- * PUT /api/account/profile  - Update user profile
- *
- * WHY THIS WAS REWRITTEN (2026-08-02, QAPert defect #7)
- * Reported as "/api/account/profile 401s on the same cookie masked-info
- * accepts (200)". Two endpoints disagreeing about one cookie meant two auth
- * implementations, and they were:
- *
- *   masked-info.ts  idpFetchJSON(req, ...)           resolves the caller's token
- *                                                    from the server-side session
- *   profile.ts      req.headers.get('authorization') required an INBOUND bearer
- *
- * A browser sends a session COOKIE and no Authorization header, so the old
- * profile.ts 401'd EVERY browser request by construction. Nothing was revoked
- * and no token was stale — the handler demanded a credential the app does not
- * use.
- *
- * THE OLD AUTH CHECK WAS A VENEER. It tested that the header was PRESENT, never
- * that it was valid, then forwarded it upstream unexamined. Any string at all
- * got past it and the IDP did the real work. It looked like enforcement and
- * enforced nothing.
- *
- * WHAT THE WORKAROUND COST US: consumers could not call this with a cookie, so
- * the graft's useProfile hook fetched the raw IDP access token from
- * /api/session/idp-token INTO BROWSER JAVASCRIPT and re-sent it as a bearer.
- * That defeats the reason idpFetchJSON exists — it keeps the token server-side
- * precisely so client-side script can never hold it. The bearer-only handler
- * did not merely fail; it pushed its callers into exposing the token.
- *
- * Switching to idpFetchJSON makes the cookie work, so the hook's token round
- * trip can be deleted and /api/session/idp-token drops to a single deliberate
- * caller: the jwt-inspect debug page.
- *
- * @package @payez/next-mvp
- */
-export declare function GET(req: NextRequest): Promise<NextResponse<any>>;
+/** PAY-2994: the profile is one person's data; never cached (noStore). */
+export declare const GET: (req: NextRequest) => Promise<Response>;
 export declare function PUT(req: NextRequest): Promise<NextResponse<any>>;

package/dist/api-handlers/account/profile.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET = GET;
+exports.GET = void 0;
 exports.PUT = PUT;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const no_store_1 = require("../../lib/no-store");
 /**
  * Account Profile API Handler
  *
@@ -43,7 +44,7 @@ const env_1 = require("../../config/env");
  *
  * @package @payez/next-mvp
  */
-async function GET(req) {
+async function getProfile(req) {
     const result = await (0, idp_fetch_1.idpFetchJSON)(req, `${env_1.ENV_CONFIG.IDP_URL}/api/Account/profile`, {
         method: 'GET',
         headers: { 'Content-Type': 'application/json' },
@@ -61,6 +62,8 @@ async function GET(req) {
     }
     return server_1.NextResponse.json(result.json, { status: 200 });
 }
+/** PAY-2994: the profile is one person's data; never cached (noStore). */
+exports.GET = (0, no_store_1.noStore)(getProfile);
 async function PUT(req) {
     let body = '{}';
     try {

package/dist/api-handlers/anon/preferences.d.ts

@@ -8,23 +8,10 @@
  */
 import { NextRequest, NextResponse } from 'next/server';
 import { AnonSessionPreferences } from '../../lib/anon-session';
-/**
- * GET handler - retrieves anonymous session preferences
- */
-export declare function GET(request: NextRequest): Promise<NextResponse<{
-    success: boolean;
-    data: {
-        id: string;
-        preferences: AnonSessionPreferences;
-        metrics: import("../../lib/anon-session").AnonSessionMetrics;
-    };
-}> | NextResponse<{
-    success: boolean;
-    error: string;
-}>>;
 /**
  * POST handler - updates anonymous session preferences
  */
+export declare const GET: (request: NextRequest) => Promise<Response>;
 export declare function POST(request: NextRequest): Promise<NextResponse<{
     success: boolean;
     error: string;

package/dist/api-handlers/anon/preferences.js

@@ -8,17 +8,16 @@
  * Sets a cookie to track anonymous visitors and stores preferences in Redis.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET = GET;
+exports.GET = void 0;
 exports.POST = POST;
 const server_1 = require("next/server");
 const headers_1 = require("next/headers");
 const anon_session_1 = require("../../lib/anon-session");
 const log_safe_1 = require("../../lib/log-safe");
+const no_store_1 = require("../../lib/no-store");
 const COOKIE_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
-/**
- * GET handler - retrieves anonymous session preferences
- */
-async function GET(request) {
+/** Retrieves anonymous session preferences. Exported as GET below, wrapped in noStore (PAY-2994). */
+async function getPreferences(request) {
     try {
         const cookieStore = await (0, headers_1.cookies)();
         let anonId = cookieStore.get(anon_session_1.ANON_COOKIE_NAME)?.value;
@@ -53,6 +52,7 @@ async function GET(request) {
 /**
  * POST handler - updates anonymous session preferences
  */
+exports.GET = (0, no_store_1.noStore)(getPreferences);
 async function POST(request) {
     try {
         const cookieStore = await (0, headers_1.cookies)();

package/dist/api-handlers/auth/credential-login.js

@@ -41,6 +41,7 @@ exports.POST = POST;
  * lib/session-store.js").
  */
 const server_1 = require("next/server");
+const sign_in_failure_1 = require("../../lib/sign-in-failure");
 const jose_1 = require("jose");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const client_key_1 = require("../../lib/client-key");
@@ -306,9 +307,13 @@ async function POST(req) {
             // (MfaController.VerifyTotp answers a 15-minute lockout as 400 {code:"locked"}), which status-only
             // classification told to "try again".
             const rejection = (0, twofa_rejection_1.classifyTwofaRejection)(laneResults, idpResponse.headers.get('retry-after'));
+            // PAY-2568 follow-up (BAPert 85795): the page takes its sentence from a CODE in the closed table, so this lane must send one.
+            // The branch already decided the cause (classifyTwofaRejection); the code follows its status, the IdP's wording is never used.
+            const rejectionCode = rejection.status === 429 ? (rejection.rateLimited ? 'second_factor_rate_limited' : 'too_many_attempts') : rejection.status === 502 ? 'second_factor_unavailable' : 'invalid_second_factor';
             return server_1.NextResponse.json({
                 success: false,
-                error: rejection.error,
+                code: rejectionCode,
+                error: (0, sign_in_failure_1.signInFailureMessage)(rejectionCode),
                 ...(rejection.retryAfter !== undefined ? { retryAfter: rejection.retryAfter } : {}),
                 // PAY-2284: the card shows a real "email me a code" action only when this is true.
                 ...(rejection.offerEmailCode ? { offerEmailCode: true } : {}),
@@ -365,15 +370,21 @@ async function POST(req) {
     }
     if (idpResponse.status === 429) {
         const retryAfter = idpResponse.headers.get('retry-after');
-        return server_1.NextResponse.json({ success: false, error: 'Too many attempts. Please try again later.', retryAfter: retryAfter ? parseInt(retryAfter, 10) : 60 }, { status: 429 });
+        return server_1.NextResponse.json({
+            success: false,
+            code: 'too_many_attempts',
+            error: (0, sign_in_failure_1.signInFailureMessage)('too_many_attempts'),
+            // BAPert 85807: the page prints this number as minutes, so only a real Retry-After is sent; no invented default.
+            ...(retryAfter && Number.isFinite(parseInt(retryAfter, 10)) && parseInt(retryAfter, 10) > 0 ? { retryAfter: parseInt(retryAfter, 10) } : {}),
+        }, { status: 429 });
     }
     if (!idpResponse.ok) {
         const f = logIdpAuthRefusal('non-ok', idpResponse.status, data);
-        return server_1.NextResponse.json({ success: false, error: publicRefusalMessage(f) }, { status: idpResponse.status });
+        return server_1.NextResponse.json(refusalBody(f, idpResponse.status), { status: idpResponse.status });
     }
     if (data?.success === false) {
         const f = logIdpAuthRefusal('envelope-success-false', idpResponse.status, data);
-        return server_1.NextResponse.json({ success: false, error: publicRefusalMessage(f) }, { status: 200 });
+        return server_1.NextResponse.json(refusalBody(f, idpResponse.status), { status: 200 });
     }
     // Unwrap the IDP's canonical envelope, same shape login.js normalizes.
     const result = data?.data?.result ?? data?.result ?? data;
@@ -685,6 +696,19 @@ function publicRefusalMessage(f) {
         return f.detail;
     return UNIFORM_REFUSAL;
 }
+/**
+ * The browser-facing body of a refusal (BAPert 85415): a stable machine `code` from the closed table in lib/sign-in-failure, and
+ * the fixed sentence for it. The IdP's own message text is never copied in. The one exception is the allowlisted policy refusals
+ * (SsoRequired / SsoRequiredBreakGlass / InvalidRequest): a property of the email domain or the request, not of an account, and the
+ * user cannot proceed without being told; they carry code 'policy_message' and the allowlisted detail (see SAFE_TO_SHOW).
+ */
+function refusalBody(f, status) {
+    const policy = f.code && SAFE_TO_SHOW.has(f.code) ? (0, sign_in_failure_1.capPolicyDetail)(f.detail) : null;
+    if (policy)
+        return { success: false, code: 'policy_message', error: policy };
+    const code = (0, sign_in_failure_1.classifySignInFailure)(status, f.code);
+    return { success: false, code, error: (0, sign_in_failure_1.signInFailureMessage)(code) };
+}
 function logIdpAuthRefusal(branch, httpStatus, data) {
     const f = extractIdpFailure(data);
     const d = (data ?? {});

package/dist/api-handlers/health.d.ts

@@ -0,0 +1,5 @@
+export interface HealthRedis {
+    ping(): Promise<unknown>;
+}
+export type RedisState = 'up' | 'down' | 'unknown';
+export declare function createHealthHandler(getRedis: () => HealthRedis): () => Promise<Response>;

package/dist/api-handlers/health.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHealthHandler = createHealthHandler;
+/**
+ * /api/health handler (PAY-2804, AUTH-045; BAPert ruling 88065).
+ *
+ * Sessions are Redis-only. The body reports state ONLY: `redis: 'up' | 'down' | 'unknown'` and
+ * `status: 'ok' | 'degraded'`. No REDIS_URL, host, port, error text or stack, to any caller (anonymous route).
+ *
+ * The HTTP status is 200 even when Redis is down: this route is the ALB target-group check, and a 503
+ * there would make the ALB pull every task for an outage that replacing tasks cannot fix.
+ * HEALTH_REDIS_FAILS_STATUS=1 turns Redis-down into 503 as a READINESS setting for a deployer's OWN probe;
+ * it is default off and must never be set on a load-balancer health check.
+ */
+const server_1 = require("next/server");
+const PING_BUDGET_MS = 2000;
+async function probe(redis) {
+    let timer;
+    try {
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error('ping timeout')), PING_BUDGET_MS);
+        });
+        await Promise.race([redis.ping(), timeout]);
+        return 'up';
+    }
+    catch {
+        return 'down';
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function createHealthHandler(getRedis) {
+    return async function GET() {
+        let redis;
+        let client;
+        try {
+            client = getRedis();
+        }
+        catch {
+            client = undefined;
+        }
+        redis = client ? await probe(client) : 'unknown';
+        const failsStatus = process.env.HEALTH_REDIS_FAILS_STATUS === '1';
+        return server_1.NextResponse.json({ status: redis === 'up' ? 'ok' : 'degraded', redis }, { status: redis !== 'up' && failsStatus ? 503 : 200, headers: { 'Cache-Control': 'no-store' } });
+    };
+}

package/dist/api-handlers/mfa/totp-confirm.js

@@ -5,6 +5,7 @@ const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+const mfa_json_guard_1 = require("../../lib/mfa-json-guard");
 /**
  * Confirm TOTP enrolment with the first authenticator code
  * (POST /api/Account/mfa/totp/confirm, user JWT). Body forwarded verbatim —
@@ -12,6 +13,9 @@ const safe_error_response_1 = require("../../lib/safe-error-response");
  * the method ACTIVE.
  */
 async function POST(req) {
+    const refused = (0, mfa_json_guard_1.refuseNonJson)(req);
+    if (refused)
+        return refused;
     let body = '{}';
     try {
         const raw = await req.text();
@@ -30,13 +34,13 @@ async function POST(req) {
             message: 'Upstream error',
             error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
-        }, { status: result.status });
+        }, { status: result.status, headers: mfa_json_guard_1.NO_STORE });
     }
     const bodyJson = result.json;
     if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
         if (bodyJson.success === true)
-            return server_1.NextResponse.json(bodyJson.data, { status: 200 });
-        return server_1.NextResponse.json(bodyJson, { status: 200 });
+            return server_1.NextResponse.json(bodyJson.data, { status: 200, headers: mfa_json_guard_1.NO_STORE });
+        return server_1.NextResponse.json(bodyJson, { status: 200, headers: mfa_json_guard_1.NO_STORE });
     }
-    return server_1.NextResponse.json(bodyJson ?? {}, { status: 200 });
+    return server_1.NextResponse.json(bodyJson ?? {}, { status: 200, headers: mfa_json_guard_1.NO_STORE });
 }

package/dist/api-handlers/mfa/totp-enroll.js

@@ -5,6 +5,7 @@ const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+const mfa_json_guard_1 = require("../../lib/mfa-json-guard");
 /**
  * Begin TOTP enrolment (POST /api/Account/mfa/totp/enroll, user JWT).
  * Returns the shared secret / otpauth URI for the QR. An enrolment left
@@ -12,6 +13,9 @@ const safe_error_response_1 = require("../../lib/safe-error-response");
  * as "Active" (MFA honesty fixes, 2026-08-01).
  */
 async function POST(req) {
+    const refused = (0, mfa_json_guard_1.refuseNonJson)(req);
+    if (refused)
+        return refused;
     let body = '{}';
     try {
         const raw = await req.text();
@@ -30,13 +34,13 @@ async function POST(req) {
             message: 'Upstream error',
             error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
-        }, { status: result.status });
+        }, { status: result.status, headers: mfa_json_guard_1.NO_STORE });
     }
     const bodyJson = result.json;
     if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
         if (bodyJson.success === true)
-            return server_1.NextResponse.json(bodyJson.data, { status: 200 });
-        return server_1.NextResponse.json(bodyJson, { status: 200 });
+            return server_1.NextResponse.json(bodyJson.data, { status: 200, headers: mfa_json_guard_1.NO_STORE });
+        return server_1.NextResponse.json(bodyJson, { status: 200, headers: mfa_json_guard_1.NO_STORE });
     }
-    return server_1.NextResponse.json(bodyJson ?? {}, { status: 200 });
+    return server_1.NextResponse.json(bodyJson ?? {}, { status: 200, headers: mfa_json_guard_1.NO_STORE });
 }

package/dist/api-handlers/session/refresh-viability.d.ts

@@ -1,15 +1,3 @@
-import { NextRequest, NextResponse } from 'next/server';
-export declare function GET(req: NextRequest): Promise<NextResponse<{
-    canRefresh: boolean;
-    reason: string;
-    error: string;
-    code: string;
-}> | NextResponse<{
-    canRefresh: boolean;
-    reason: string;
-    sessionTokenId: string;
-}> | NextResponse<{
-    canRefresh: boolean;
-    reason: string;
-    sessionTokenId: null;
-}>>;
+import { NextRequest } from 'next/server';
+/** PAY-2994 (NightHawk 92964 Low 1): the api-handlers/session/* path is also in the exports map; wrap here too so a consumer importing it is covered. */
+export declare const GET: (req: NextRequest) => Promise<Response>;

package/dist/api-handlers/session/refresh-viability.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET = GET;
+exports.GET = void 0;
 const server_1 = require("next/server");
 const session_store_1 = require("../../lib/session-store");
 const refresh_token_validator_1 = require("../../lib/refresh-token-validator");
@@ -8,8 +8,9 @@ const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const logger_1 = require("../../config/logger");
 const token_log_id_1 = require("../../lib/token-log-id");
 const log_safe_1 = require("../../lib/log-safe");
+const no_store_1 = require("../../lib/no-store");
 const auth_1 = require("../../server/auth");
-async function GET(req) {
+async function getRefreshViability(req) {
     try {
         const sessionToken = req.nextUrl.searchParams.get('token');
         let finalSessionToken = sessionToken;
@@ -59,3 +60,5 @@ async function GET(req) {
         return server_1.NextResponse.json({ canRefresh: false, reason: 'check_error', error: 'Failed to check refresh viability', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
     }
 }
+/** PAY-2994 (NightHawk 92964 Low 1): the api-handlers/session/* path is also in the exports map; wrap here too so a consumer importing it is covered. */
+exports.GET = (0, no_store_1.noStore)(getRefreshViability);

package/dist/api-handlers/session/viability.d.ts

@@ -3,11 +3,6 @@
  *
  * This API route is called by the middleware to securely check if a session is valid.
  */
-import { NextRequest, NextResponse } from 'next/server';
-export declare function GET(req: NextRequest): Promise<NextResponse<{
-    error: string;
-    message: string;
-    code: string;
-}> | NextResponse<{
-    authenticated: boolean;
-}>>;
+import { NextRequest } from 'next/server';
+/** PAY-2994 (NightHawk 92964 Low 1): the api-handlers/session/* path is also in the exports map; wrap here too so a consumer importing it is covered. */
+export declare const GET: (req: NextRequest) => Promise<Response>;

package/dist/api-handlers/session/viability.js

@@ -5,7 +5,7 @@
  * This API route is called by the middleware to securely check if a session is valid.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET = GET;
+exports.GET = void 0;
 const revocation_fields_1 = require("../../auth/revocation-fields");
 const server_1 = require("next/server");
 const session_store_1 = require("../../lib/session-store");
@@ -15,7 +15,8 @@ const idp_client_config_1 = require("../../lib/idp-client-config");
 const token_log_id_1 = require("../../lib/token-log-id");
 const sessions_1 = require("../../vibe/sessions");
 const log_safe_1 = require("../../lib/log-safe");
-async function GET(req) {
+const no_store_1 = require("../../lib/no-store");
+async function getViability(req) {
     try {
         // Ensure initialization is complete (auth signing secret resolved from IDP)
         if (!process.env.BETTER_AUTH_SECRET && !process.env.NEXTAUTH_SECRET) {
@@ -65,6 +66,8 @@ async function GET(req) {
         if (betterAuthSession && sessionToken) {
             // Try legacy session store first, then Better Auth format
             let sessionData = await (0, session_store_1.getSession)(sessionToken);
+            // PAY-2467: see routes/auth/viability.ts - a boolean mfaVerified on the raw canonical row is a measurement.
+            const fromCanonicalStore = !!sessionData;
             if (!sessionData) {
                 // Better Auth stores sessions with ba:{appSlug}:{token} prefix
                 sessionData = await (0, session_store_1.getBetterAuthSession)(sessionToken);
@@ -113,9 +116,11 @@ async function GET(req) {
                 // only ever SUPPRESS this override, never grant access. Anything that GRANTS must
                 // keep gating on `mfaVerified`, which stays fail-closed at all five sites. R807 is
                 // void if this signal reaches an auth decision.
-                if (sessionData.mfaSignalPresent === true &&
+                if ((sessionData.mfaSignalPresent === true || (fromCanonicalStore && typeof sessionData.mfaVerified === 'boolean')) &&
                     sessionData.mfaVerified === false &&
-                    !sessionData.idpRefreshToken) {
+                    !sessionData.idpRefreshToken &&
+                    // same exception as routes/auth/viability: an IdP-discarded refresh token is a dead session, not a pending second factor
+                    !String(sessionData?.refreshTokenClearedReason ?? '').startsWith('IDP_DISCARD_TOKEN')) {
                     requires2FA = true;
                 }
                 // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
@@ -218,3 +223,5 @@ async function GET(req) {
         return server_1.NextResponse.json({ authenticated: false }, { status: 500 });
     }
 }
+/** PAY-2994 (NightHawk 92964 Low 1): the api-handlers/session/* path is also in the exports map; wrap here too so a consumer importing it is covered. */
+exports.GET = (0, no_store_1.noStore)(getViability);

package/dist/auth/better-auth-exposure.d.ts

@@ -0,0 +1,11 @@
+export declare const MAGIC_LINK_ADVISORY = "GHSA-965c-763c-88jm";
+export declare const MAGIC_LINK_FIX_VERSION = "1.7.7";
+/** The installed better-auth version, read from its own package.json (the package does not export './package.json'), or null when it cannot be found. */
+export declare function installedBetterAuthVersion(): string | null;
+/** True when `version` is strictly below `floor` (numeric major.minor.patch; a pre-release suffix is ignored). An unparseable version is NOT proven fixed, so it counts as below. */
+export declare function versionBelow(version: string | null, floor: string): boolean;
+/**
+ * Warn when the magic-link plugin is enabled on a better-auth below the fix. Returns whether it warned (so a test can assert it). `warn` and `version` are
+ * injectable for the same reason.
+ */
+export declare function warnIfMagicLinkBelowFix(magicLinkEnabled: boolean, warn?: (msg: string) => void, version?: string | null): boolean;

package/dist/auth/better-auth-exposure.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAGIC_LINK_FIX_VERSION = exports.MAGIC_LINK_ADVISORY = void 0;
+exports.installedBetterAuthVersion = installedBetterAuthVersion;
+exports.versionBelow = versionBelow;
+exports.warnIfMagicLinkBelowFix = warnIfMagicLinkBelowFix;
+/**
+ * PAY-2592 slice 1: the exposure guard for better-auth GHSA-965c-763c-88jm (critical, CVSS 9.1; affected >=1.4.0-beta.18 <1.7.7).
+ *
+ * "OAuth state can be used as a Magic Link to sign in as another user." It needs ALL of: the Magic Link plugin enabled, an OAuth provider, and OAuth state
+ * stored with `account.storeStateStrategy: "database"` (better-auth's default when a database OR secondaryStorage exists). This package has secondaryStorage,
+ * so what keeps it unexposed is, today:
+ *   1. `account.storeStateStrategy: 'cookie'` is pinned in better-auth.ts (the advisory: cookie-backed state blocks the path), and
+ *   2. the magic-link plugin registers ONLY when a consumer passes `opts.magicLink`.
+ * Nothing in this package fixes the flaw; the fix is better-auth >= 1.7.7 (PAY-2592, spike pending). Until then a consumer that turns the plugin on is told, loudly,
+ * once per process.
+ *
+ * test/next-mvp-pay-2592-exposure-pins.test.cjs holds both conditions and this warning.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.MAGIC_LINK_ADVISORY = 'GHSA-965c-763c-88jm';
+exports.MAGIC_LINK_FIX_VERSION = '1.7.7';
+/** The installed better-auth version, read from its own package.json (the package does not export './package.json'), or null when it cannot be found. */
+function installedBetterAuthVersion() {
+    try {
+        let dir = (0, node_path_1.dirname)(require.resolve('better-auth'));
+        for (let i = 0; i < 8; i++) {
+            try {
+                const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, 'package.json'), 'utf8'));
+                if (pkg.name === 'better-auth' && typeof pkg.version === 'string')
+                    return pkg.version;
+            }
+            catch {
+                /* no package.json at this level */
+            }
+            const up = (0, node_path_1.dirname)(dir);
+            if (up === dir)
+                break;
+            dir = up;
+        }
+    }
+    catch {
+        /* unresolvable */
+    }
+    return null;
+}
+/** True when `version` is strictly below `floor` (numeric major.minor.patch; a pre-release suffix is ignored). An unparseable version is NOT proven fixed, so it counts as below. */
+function versionBelow(version, floor) {
+    const parse = (v) => /^(\d+)\.(\d+)\.(\d+)/.exec(v)?.slice(1, 4).map(Number) ?? null;
+    const a = version ? parse(version) : null;
+    const b = parse(floor);
+    if (!a || !b)
+        return true;
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    }
+    return false;
+}
+/**
+ * Warn when the magic-link plugin is enabled on a better-auth below the fix. Returns whether it warned (so a test can assert it). `warn` and `version` are
+ * injectable for the same reason.
+ */
+function warnIfMagicLinkBelowFix(magicLinkEnabled, warn = (m) => console.warn(m), version = installedBetterAuthVersion()) {
+    if (!magicLinkEnabled)
+        return false;
+    if (!versionBelow(version, exports.MAGIC_LINK_FIX_VERSION))
+        return false;
+    warn(`[BETTER_AUTH] WARNING ${exports.MAGIC_LINK_ADVISORY} (critical): the magic-link plugin is enabled on better-auth ${version ?? '(version unknown)'}, below the fix ${exports.MAGIC_LINK_FIX_VERSION}. ` +
+        `This package keeps account.storeStateStrategy='cookie', which blocks the attack; do NOT change that while magic link is on, and upgrade better-auth (PAY-2592).`);
+    return true;
+}

package/dist/auth/better-auth.d.ts

@@ -623,6 +623,12 @@ export declare const IDP_ERROR_CODES_TO_FORWARD: ReadonlySet<string>;
  * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
  */
 export declare function expireSetCookies(setCookies: readonly string[]): string[];
+/**
+ * PAY-2568: the Better Auth error code of an /api/auth/error redirect (`?error=<code>`), or null when absent or not a plain
+ * token. The value rides a URL, so only a short [A-Za-z0-9_.-] token is ever returned for logging. Location may be relative
+ * or absolute; the base is a placeholder used only for parsing.
+ */
+export declare function authErrorCodeFromLocation(location: string): string | null;
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *