@payez/next-mvp 4.12.1 → 4.13.1

package/dist/lib/credential-sign-in-client.d.ts

@@ -14,6 +14,7 @@
  *     literally true (PAY-2284).
  */
 import { NO_CODE_REQUEST, type CodeRequest } from './code-step-copy';
+import { SIGN_IN_FAILURE_COPY } from './sign-in-failure';
 export declare const CREDENTIAL_LOGIN_URL = "/api/auth/admin-login";
 export declare const CREDENTIAL_EMAIL_CODE_URL = "/api/auth/admin-login/email-code";
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
@@ -23,15 +24,24 @@ export type CredentialSignInResult = {
     kind: 'two_factor';
     codeRequest: CodeRequest;
     devCode: string | null;
+    nextStep: NextStep;
 } | {
     kind: 'rate_limited';
     message: string;
+    code: ErrorCode;
 } | {
     kind: 'error';
     message: string;
+    code: ErrorCode;
     offerEmailCode: boolean;
 };
-export declare const MSG_RATE_LIMITED = "Too many attempts. Please try again later.";
+/**
+ * The stable machine code a rendered error carries (data-error-code). The three from the closed table in lib/sign-in-failure,
+ * plus 'policy_message' (an allowlisted SsoRequired / InvalidRequest refusal, whose detail the server may send) and
+ * 'sign_in_failed' (anything this client could not map: a 400/5xx, an unknown code, a thrown fetch).
+ */
+export type ErrorCode = keyof typeof SIGN_IN_FAILURE_COPY | 'policy_message' | 'sign_in_failed';
+export declare const MSG_RATE_LIMITED: string;
 export declare const MSG_CANNOT_SIGN_IN = "Could not sign in. Check your details and try again.";
 export declare const MSG_UNEXPECTED = "Something went wrong signing you in. Please try again.";
 export declare function isEmailShaped(v: string): boolean;
@@ -40,6 +50,21 @@ export declare function validateCredentials(email: string, password: string): {
     email?: string;
     password?: string;
 } | null;
+/**
+ * PAY-2630: what the IdP says is outstanding for this user ON THIS CLIENT. The door (api-handlers/auth/credential-login)
+ * already relays the IdP's next_step as `nextStep`; this form used to read ZERO of it. 'enroll_mfa' = the user has no usable
+ * second factor on this client, so a code prompt alone is a trap; 'mfa_verify' = a factor exists, the prompt is right.
+ * Anything else (absent, null, an unknown string, wrong case) is null = "not told", never a guess.
+ */
+export type NextStep = 'enroll_mfa' | 'mfa_verify' | null;
+export declare function readNextStep(body: any): NextStep;
+/**
+ * Where the browser goes after the code was accepted. A user the IdP told to enrol, who kept the offer ticked, goes to the
+ * enrolment page; everyone else goes where they were headed. The destination is never decided from anything but the IdP's
+ * answer and the user's own tick. With NO enrolHref (the host mounts no enrolment page) nobody is rerouted: there is no default, because
+ * a default that a host does not serve is a 404 after a successful sign-in (QAPert, PR 1687 read).
+ */
+export declare function postSignInDestination(destination: string, nextStep: NextStep, enrolAfter: boolean, enrolHref?: string): string;
 /** One call to the credential door. `code` is the 2FA code on the second turn; email and password are resubmitted with it. */
 export declare function credentialSignIn(args: {
     email: string;

package/dist/lib/credential-sign-in-client.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NO_CODE_REQUEST = exports.MSG_EMAIL_CODE_FAILED = exports.MSG_UNEXPECTED = exports.MSG_CANNOT_SIGN_IN = exports.MSG_RATE_LIMITED = exports.CREDENTIAL_EMAIL_CODE_URL = exports.CREDENTIAL_LOGIN_URL = void 0;
 exports.isEmailShaped = isEmailShaped;
 exports.validateCredentials = validateCredentials;
+exports.readNextStep = readNextStep;
+exports.postSignInDestination = postSignInDestination;
 exports.credentialSignIn = credentialSignIn;
 exports.requestEmailCode = requestEmailCode;
 /**
@@ -22,9 +24,10 @@ exports.requestEmailCode = requestEmailCode;
  */
 const code_step_copy_1 = require("./code-step-copy");
 Object.defineProperty(exports, "NO_CODE_REQUEST", { enumerable: true, get: function () { return code_step_copy_1.NO_CODE_REQUEST; } });
+const sign_in_failure_1 = require("./sign-in-failure");
 exports.CREDENTIAL_LOGIN_URL = '/api/auth/admin-login';
 exports.CREDENTIAL_EMAIL_CODE_URL = '/api/auth/admin-login/email-code';
-exports.MSG_RATE_LIMITED = 'Too many attempts. Please try again later.';
+exports.MSG_RATE_LIMITED = sign_in_failure_1.SIGN_IN_FAILURE_COPY.too_many_attempts;
 exports.MSG_CANNOT_SIGN_IN = 'Could not sign in. Check your details and try again.';
 exports.MSG_UNEXPECTED = 'Something went wrong signing you in. Please try again.';
 const EMAIL_SHAPE = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
@@ -43,6 +46,19 @@ function validateCredentials(email, password) {
         errors.password = 'Enter your password.';
     return errors.email || errors.password ? errors : null;
 }
+function readNextStep(body) {
+    const v = body?.nextStep;
+    return v === 'enroll_mfa' || v === 'mfa_verify' ? v : null;
+}
+/**
+ * Where the browser goes after the code was accepted. A user the IdP told to enrol, who kept the offer ticked, goes to the
+ * enrolment page; everyone else goes where they were headed. The destination is never decided from anything but the IdP's
+ * answer and the user's own tick. With NO enrolHref (the host mounts no enrolment page) nobody is rerouted: there is no default, because
+ * a default that a host does not serve is a 404 after a successful sign-in (QAPert, PR 1687 read).
+ */
+function postSignInDestination(destination, nextStep, enrolAfter, enrolHref) {
+    return enrolHref && nextStep === 'enroll_mfa' && enrolAfter ? enrolHref : destination;
+}
 /** The dev echo: the door passes the IdP's DevVerificationCode through as `devVerificationCode`. Nothing else is ever a dev code. */
 function readDevCode(body) {
     return typeof body?.devVerificationCode === 'string' && body.devVerificationCode ? body.devVerificationCode : null;
@@ -59,17 +75,27 @@ async function credentialSignIn(args, fetchImpl = (input, init) => fetch(input,
             body: JSON.stringify({ email: args.email, password: args.password, code: args.code }),
         });
         const body = await res.json().catch(() => null);
-        if (res.status === 429)
-            return { kind: 'rate_limited', message: asString(body?.error) ?? exports.MSG_RATE_LIMITED };
+        // The sentence comes from the closed table, never from the body (BAPert 85415 rule 4).
+        if (res.status === 429) {
+            const code = body?.code === 'second_factor_rate_limited' ? 'second_factor_rate_limited' : 'too_many_attempts';
+            return { kind: 'rate_limited', message: (0, sign_in_failure_1.tooManyAttemptsMessage)(body?.retryAfter, code), code };
+        }
         if (body?.requiresTwoFactor)
-            return { kind: 'two_factor', codeRequest: (0, code_step_copy_1.readCodeRequest)(body), devCode: readDevCode(body) };
+            return { kind: 'two_factor', codeRequest: (0, code_step_copy_1.readCodeRequest)(body), devCode: readDevCode(body), nextStep: readNextStep(body) };
         if (!res.ok || body?.success !== true) {
-            return { kind: 'error', message: asString(body?.error) ?? exports.MSG_CANNOT_SIGN_IN, offerEmailCode: body?.offerEmailCode === true };
+            const offerEmailCode = body?.offerEmailCode === true;
+            if ((0, sign_in_failure_1.isSignInFailureCode)(body?.code))
+                return { kind: 'error', message: (0, sign_in_failure_1.signInFailureMessage)(body.code), code: body.code, offerEmailCode };
+            // The one passthrough: an allowlisted policy refusal (SsoRequired / InvalidRequest), flagged by the server with this exact code.
+            const policy = body?.code === 'policy_message' ? (0, sign_in_failure_1.capPolicyDetail)(body?.error) : null;
+            if (policy)
+                return { kind: 'error', message: policy, code: 'policy_message', offerEmailCode };
+            return { kind: 'error', message: exports.MSG_CANNOT_SIGN_IN, code: 'sign_in_failed', offerEmailCode };
         }
         return { kind: 'success' };
     }
     catch {
-        return { kind: 'error', message: exports.MSG_UNEXPECTED, offerEmailCode: false };
+        return { kind: 'error', message: exports.MSG_UNEXPECTED, code: 'sign_in_failed', offerEmailCode: false };
     }
 }
 exports.MSG_EMAIL_CODE_FAILED = 'We could not ask for an email code just now. Try again shortly.';

package/dist/lib/idp-client-config.js

@@ -82,6 +82,7 @@ exports.getEnabledProviders = getEnabledProviders;
 require("server-only");
 const crypto_1 = require("crypto");
 const never_in_response_1 = require("./never-in-response");
+const payez_client_secret_1 = require("./payez-client-secret");
 const log_safe_1 = require("./log-safe");
 // REDIS IS IMPORTED LAZILY, AND THAT IS LOAD-BEARING.
 // A module-scope `import redis from './redis'` drags ioredis into EVERY bundle that
@@ -691,6 +692,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
             subject: clientIdStr,
             audience: 'urn:payez:externalauth:clientconfig',
             expires_in: 60,
+            ...(0, payez_client_secret_1.clientSecretBody)(),
         };
         const signingResp = await fetch(signingUrl, {
             method: 'POST',
@@ -731,7 +733,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
                 'X-Client-Id': clientIdStr,
                 'X-Correlation-Id': (0, crypto_1.randomUUID)().replace(/-/g, ''),
             },
-            body: JSON.stringify({ client_assertion }),
+            body: JSON.stringify({ client_assertion, ...(0, payez_client_secret_1.clientSecretBody)() }),
             cache: 'no-store'
         });
         if (!configResp.ok) {
@@ -839,6 +841,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
             // silently substitutes a public constant for an empty secret.
             throw new Error('[IDP_CONFIG] FATAL: authSecret is empty after parsing and neither BETTER_AUTH_SECRET nor NEXTAUTH_SECRET is set');
         }
+        (0, payez_client_secret_1.warnIfProviderSecretRedacted)(configResp.headers?.get?.('X-PayEz-Secrets-Redacted'), config.oauthProviders ?? [], providerSecretEnvVar);
         // Success - reset failure tracking
         consecutiveFailures = 0;
         return config;

package/dist/lib/login-error-message.d.ts

@@ -8,6 +8,7 @@
  * text on the login page (content spoofing / phishing). Known codes get their sentence; anything else gets one generic
  * sentence; nothing from the URL is ever shown verbatim.
  */
+import { type SignInFailureCode } from './sign-in-failure';
 export declare const GENERIC_LOGIN_ERROR = "We could not sign you in. Please try again.";
 /**
  * The sentence for `?error=<code>`, or null when nothing should be shown.
@@ -16,3 +17,5 @@ export declare const GENERIC_LOGIN_ERROR = "We could not sign you in. Please try
 export declare function friendlyLoginError(code: string | null | undefined): string | null;
 /** `?oauth_error=<provider>`: only a plain provider-like slug is echoed (capitalised); anything else is the generic sentence. */
 export declare function oauthFailureMessage(provider: string | null | undefined): string | null;
+/** The machine code (data-error-code) for a `?error=` code, or null when it has none in the closed table. Nothing from the URL is echoed. */
+export declare function loginErrorCode(code: string | null | undefined): SignInFailureCode | null;

package/dist/lib/login-error-message.js

@@ -13,12 +13,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GENERIC_LOGIN_ERROR = void 0;
 exports.friendlyLoginError = friendlyLoginError;
 exports.oauthFailureMessage = oauthFailureMessage;
+exports.loginErrorCode = loginErrorCode;
+const sign_in_failure_1 = require("./sign-in-failure");
 exports.GENERIC_LOGIN_ERROR = 'We could not sign you in. Please try again.';
 const KNOWN = {
     TwoFactorTimeout: 'Your verification step timed out before the code was confirmed. Please sign in again.',
     AUTHORIZE_RESUME_REFUSED: 'That sign-in request could not be continued. Please sign in again.',
+    // PAY-2279 / PAY-2005(b): the one IdP refusal code the abort path forwards (IDP_ERROR_CODES_TO_FORWARD). Wording is the card's proposal.
+    // (OAUTH_SIGN_IN_FAILED has no sentence in THIS change: PR 1606 (PAY-2554) owns that code's redirect and its sentence; once both land the map carries both.)
+    REGISTRATION_NOT_ALLOWED: 'Registration is not open for this site. Ask your administrator for an invitation.',
     ServiceUnavailable: 'Authentication service is temporarily unavailable. Please try again in a few minutes.',
-    CredentialsSignin: 'Invalid email or password. Please try again.',
+    CredentialsSignin: sign_in_failure_1.SIGN_IN_FAILURE_COPY.invalid_credentials,
+    // PAY-2554: the neutral code the OAuth callback failure / state-error / aborted-exchange redirects carry (better-auth.ts OAUTH_SIGN_IN_FAILED_ERROR).
+    OAUTH_SIGN_IN_FAILED: "Sign-in didn't complete. Please try again, or use email.",
 };
 /**
  * The sentence for `?error=<code>`, or null when nothing should be shown.
@@ -45,3 +52,7 @@ function oauthFailureMessage(provider) {
         return exports.GENERIC_LOGIN_ERROR;
     return `${provider.charAt(0).toUpperCase()}${provider.slice(1)} sign-in did not complete. Please try again.`;
 }
+/** The machine code (data-error-code) for a `?error=` code, or null when it has none in the closed table. Nothing from the URL is echoed. */
+function loginErrorCode(code) {
+    return code === 'CredentialsSignin' ? 'invalid_credentials' : null;
+}

package/dist/lib/mfa-json-guard.d.ts

@@ -0,0 +1,12 @@
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * PAY-2631: the TOTP enrol/confirm handlers forward the browser body verbatim, so a cross-site form post
+ * (Content-Type text/plain, application/x-www-form-urlencoded) could reach them. A browser cannot send
+ * application/json cross-site without a CORS preflight, so requiring it closes that path.
+ * The responses carry the shared secret and the otpauth URI, so they are never cached.
+ */
+export declare const NO_STORE: {
+    readonly 'Cache-Control': "no-store";
+};
+/** A 415 response when the request is not application/json, otherwise null. */
+export declare function refuseNonJson(req: NextRequest): NextResponse | null;

package/dist/lib/mfa-json-guard.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_STORE = void 0;
+exports.refuseNonJson = refuseNonJson;
+const server_1 = require("next/server");
+/**
+ * PAY-2631: the TOTP enrol/confirm handlers forward the browser body verbatim, so a cross-site form post
+ * (Content-Type text/plain, application/x-www-form-urlencoded) could reach them. A browser cannot send
+ * application/json cross-site without a CORS preflight, so requiring it closes that path.
+ * The responses carry the shared secret and the otpauth URI, so they are never cached.
+ */
+exports.NO_STORE = { 'Cache-Control': 'no-store' };
+/** A 415 response when the request is not application/json, otherwise null. */
+function refuseNonJson(req) {
+    const ct = (req.headers.get('content-type') || '').toLowerCase();
+    if (ct.split(';')[0].trim() === 'application/json')
+        return null;
+    return server_1.NextResponse.json({ success: false, message: 'Content-Type must be application/json', error: { code: 'UNSUPPORTED_MEDIA_TYPE' } }, { status: 415, headers: exports.NO_STORE });
+}

package/dist/lib/nextauth-secret.js

@@ -45,6 +45,7 @@ exports.resolveNextAuthSecret = resolveNextAuthSecret;
 require("server-only");
 const node_crypto_1 = require("node:crypto");
 const secret_validation_1 = require("./secret-validation");
+const payez_client_secret_1 = require("./payez-client-secret");
 let cachedSecret = null;
 let lastFetchedAt = 0;
 const CACHE_TTL_MS = 5 * 60 * 1000;
@@ -88,6 +89,7 @@ async function resolveNextAuthSecret() {
             subject: clientIdStr,
             audience: 'urn:payez:externalauth:nextauthsecret',
             expires_in: 60,
+            ...(0, payez_client_secret_1.clientSecretBody)(),
         }),
         cache: 'no-store',
     });
@@ -115,7 +117,7 @@ async function resolveNextAuthSecret() {
             'X-Client-Id': clientIdStr,
             'X-Correlation-Id': (0, node_crypto_1.randomUUID)().replace(/-/g, ''),
         },
-        body: JSON.stringify({ client_assertion: clientAssertion }),
+        body: JSON.stringify({ client_assertion: clientAssertion, ...(0, payez_client_secret_1.clientSecretBody)() }),
         cache: 'no-store',
     });
     if (!proxyResp.ok) {

package/dist/lib/no-store.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Cache-Control: no-store for GET routes whose answer carries a person's, a tenant's or a session's data (PAY-2994).
+ *
+ * WHY: the portal's BFF no-store ratchet (testing/qa/bff-no-store-ratchet.js) found 8 GET routes re-exported from this package that sent no
+ * Cache-Control. Their answers carry per-user data and some carry tokens, so a browser or an intermediate cache must never keep them.
+ *
+ * `noStore(handler)` wraps a route handler and sets `Cache-Control: no-store` on EVERY response it returns (errors and redirects too: nothing
+ * a session route says is worth caching). It REPLACES an existing Cache-Control, never merges, so a looser value cannot survive. A Response
+ * whose headers are immutable (a fetch() result, Response.redirect()) is rebuilt with the same status, body and headers (Set-Cookie kept).
+ */
+export declare const NO_STORE_VALUE = "no-store";
+export declare function withNoStoreHeader(res: Response): Response;
+export declare function noStore<A extends unknown[], R extends Response>(handler: (...args: A) => R | Promise<R>): (...args: A) => Promise<Response>;

package/dist/lib/no-store.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_STORE_VALUE = void 0;
+exports.withNoStoreHeader = withNoStoreHeader;
+exports.noStore = noStore;
+/**
+ * Cache-Control: no-store for GET routes whose answer carries a person's, a tenant's or a session's data (PAY-2994).
+ *
+ * WHY: the portal's BFF no-store ratchet (testing/qa/bff-no-store-ratchet.js) found 8 GET routes re-exported from this package that sent no
+ * Cache-Control. Their answers carry per-user data and some carry tokens, so a browser or an intermediate cache must never keep them.
+ *
+ * `noStore(handler)` wraps a route handler and sets `Cache-Control: no-store` on EVERY response it returns (errors and redirects too: nothing
+ * a session route says is worth caching). It REPLACES an existing Cache-Control, never merges, so a looser value cannot survive. A Response
+ * whose headers are immutable (a fetch() result, Response.redirect()) is rebuilt with the same status, body and headers (Set-Cookie kept).
+ */
+exports.NO_STORE_VALUE = 'no-store';
+function withNoStoreHeader(res) {
+    // Not a Response (no headers object): hand it back untouched. A Next route always returns a Response, so this only keeps a hand-made
+    // test double from being turned into an empty Response.
+    if (!res || typeof res !== 'object' || !res.headers)
+        return res;
+    try {
+        res.headers.set('Cache-Control', exports.NO_STORE_VALUE);
+        return res;
+    }
+    catch {
+        // Immutable headers (TypeError). Rebuild: same status, statusText, body and every header; Headers copies Set-Cookie entries intact.
+        const headers = new Headers(res.headers);
+        headers.set('Cache-Control', exports.NO_STORE_VALUE);
+        return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+    }
+}
+function noStore(handler) {
+    return async (...args) => withNoStoreHeader(await handler(...args));
+}

package/dist/lib/payez-client-secret.d.ts

@@ -0,0 +1,14 @@
+export declare const CLIENT_SECRET_ENV = "PAYEZ_CLIENT_SECRET";
+/** `{ client_secret }` when the env var is set to a non-blank value, else `{}`. Spread it into a JSON body. */
+export declare function clientSecretBody(): {
+    client_secret?: string;
+};
+/**
+ * The IdP marks a view whose secrets it withheld with the response header X-PayEz-Secrets-Redacted: true. An app with no
+ * <PROVIDER>_CLIENT_SECRET in env then boots and the provider fails at the code exchange. Say so, once per provider per
+ * process, naming the provider only.
+ */
+export declare function warnIfProviderSecretRedacted(redactedHeader: string | null | undefined, providers: ReadonlyArray<{
+    provider: string;
+    enabled?: boolean;
+}>, envVarFor: (provider: string) => string): void;

package/dist/lib/payez-client-secret.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_SECRET_ENV = void 0;
+exports.clientSecretBody = clientSecretBody;
+exports.warnIfProviderSecretRedacted = warnIfProviderSecretRedacted;
+/**
+ * PAY-1460 (BAPert 86061): the app's own client secret, so the IdP can tell this app from a caller that merely knows its
+ * client id. One env var per app, PAYEZ_CLIENT_SECRET, read at CALL time (not a module-load snapshot: the deployment may
+ * inject it late). Unset or blank: NOTHING is added to any request body, so an app that has no secret yet sends exactly
+ * what it sent before. The value is never logged and never leaves in a response (markNeverInResponse).
+ */
+const never_in_response_1 = require("./never-in-response");
+exports.CLIENT_SECRET_ENV = 'PAYEZ_CLIENT_SECRET';
+/** `{ client_secret }` when the env var is set to a non-blank value, else `{}`. Spread it into a JSON body. */
+function clientSecretBody() {
+    const v = process.env[exports.CLIENT_SECRET_ENV];
+    if (typeof v !== 'string' || v.trim() === '')
+        return {};
+    (0, never_in_response_1.markNeverInResponse)(v);
+    return { client_secret: v };
+}
+const warnedProviders = new Set();
+/**
+ * The IdP marks a view whose secrets it withheld with the response header X-PayEz-Secrets-Redacted: true. An app with no
+ * <PROVIDER>_CLIENT_SECRET in env then boots and the provider fails at the code exchange. Say so, once per provider per
+ * process, naming the provider only.
+ */
+function warnIfProviderSecretRedacted(redactedHeader, providers, envVarFor) {
+    if (String(redactedHeader ?? '').trim().toLowerCase() !== 'true')
+        return;
+    for (const p of providers) {
+        if (!p.enabled || !p.provider)
+            continue;
+        if (process.env[envVarFor(p.provider)])
+            continue;
+        if (warnedProviders.has(p.provider))
+            continue;
+        warnedProviders.add(p.provider);
+        console.warn(`[IDP_CONFIG] PAYEZ_PROVIDER_SECRET_MISSING_REDACTED provider=${p.provider}`);
+    }
+}

package/dist/lib/qrcode.d.ts

@@ -0,0 +1,22 @@
+/**
+ * qrcode.ts — minimal QR Code generator (byte mode, ECC level M), a
+ * TypeScript port of Nayuki's qrcodegen (MIT) trimmed to what TOTP
+ * otpauth:// URIs need. Renders to an SVG path string (no library, no
+ * canvas) — D3 MFA page generates the QR client-side per contract
+ * (fe-be-contract §D3.1: "no BE QR image needed").
+ *
+ * Cross-checked bit-exact against python `qrcode` (see D3 day-end report).
+ * PAY-2631: copied verbatim from VibeID-Customer-Portal src/lib/qrcode.ts so the generated app draws the QR itself:
+ * the TOTP secret is never sent to a third-party QR service.
+ */
+export interface QrMatrix {
+    size: number;
+    modules: boolean[][];
+}
+export declare function debugFinalBytes(text: string): {
+    version: number;
+    bytes: number[];
+};
+export declare function encodeQr(text: string, maskOverride?: number): QrMatrix;
+/** Render to an SVG path (dark modules as 1x1 squares). */
+export declare function qrToSvgPath(qr: QrMatrix): string;