@payez/next-mvp 4.4.8 → 4.5.0

package/dist/hooks/useAvailableProviders.js

@@ -57,27 +57,48 @@ function useAvailableProviders() {
         let mounted = true;
         async function fetchProviders() {
             try {
-                // Fetch available providers from Better Auth
-                // Better Auth doesn't have a getProviders equivalent, so we use a static list
-                // based on configured social providers
-                const result = {
-                    google: { id: 'google', name: 'Google' },
-                };
+                // PAY-2104: THIS USED TO BE A HARDCODED GOOGLE LITERAL.
+                //
+                //   const result = { google: { id: 'google', name: 'Google' } };
+                //
+                // under a comment claiming providers were "loaded dynamically". It
+                // returned Google for EVERY client whatever the tenant had enabled -
+                // a config-shaped constant, so Apple/Facebook (PAY-2104) could never
+                // appear and a client that had DISABLED Google would still see its
+                // button. The real answer is served by /api/auth/settings (the same
+                // route routes/auth/settings.ts builds from the IDP's oauthProviders).
+                const response = await fetch('/api/auth/settings', { cache: 'no-store' });
                 if (!mounted)
                     return;
-                setRawProviders(result);
-                if (result) {
-                    // Filter to OAuth providers only (exclude credentials)
-                    // Map to our FederatedProvider type
-                    const oauthProviders = Object.keys(result)
-                        .filter(id => OAUTH_PROVIDERS.includes(id))
-                        .map(id => PROVIDER_MAP[id])
-                        .filter((p) => p !== undefined);
-                    setProviders(oauthProviders);
+                if (!response.ok) {
+                    // FAIL CLOSED. An unreadable policy is not an empty provider list
+                    // that we may then pad with a guess - it is "we do not know". See
+                    // the PAY-1243 rule: never fabricate a provider list.
+                    throw new Error(`Failed to fetch auth settings: ${response.status}`);
                 }
-                else {
-                    setProviders([]);
+                const body = await response.json().catch(() => null);
+                const settings = body?.data ?? body;
+                if (body?.success === false || !settings) {
+                    throw new Error(body?.error?.code ?? 'POLICY_UNAVAILABLE');
                 }
+                // Keep the raw provider rows (id -> the settings row) for callers that
+                // want more than the mapped union type, exactly as before.
+                const enabledIds = Array.isArray(settings.enabledProviders)
+                    ? settings.enabledProviders.filter((p) => typeof p === 'string')
+                    : [];
+                const raw = {};
+                for (const id of enabledIds)
+                    raw[id] = { id, name: id };
+                if (!mounted)
+                    return;
+                setRawProviders(raw);
+                // Filter to OAuth providers only (exclude credentials) and map to our
+                // FederatedProvider union, in the IDP's order.
+                const oauthProviders = enabledIds
+                    .filter(id => OAUTH_PROVIDERS.includes(id))
+                    .map(id => PROVIDER_MAP[id])
+                    .filter((p) => p !== undefined);
+                setProviders(oauthProviders);
                 setError(null);
             }
             catch (err) {
@@ -85,6 +106,7 @@ function useAvailableProviders() {
                     return;
                 setError(err instanceof Error ? err : new Error(String(err)));
                 setProviders([]);
+                setRawProviders(null); // never leave a stale list behind a failure
             }
             finally {
                 if (mounted) {

package/dist/lib/onboarding-proxy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * PAY-2121: shared anonymous IDP proxy for the /api/onboarding/* handlers.
+ *
+ * The onboarding flow is TOKEN-DRIVEN: the invitee has no account or session
+ * yet, and the onboard_token IS the credential. So these calls must NOT go
+ * through idpFetchJSON (which injects a Bearer from a Redis session) - there is
+ * no session. They are plain server-to-server POSTs to the IdP, exactly as the
+ * VibeID portal's hand-built /api/onboarding/* routes do (card 182611).
+ *
+ * WHY A SERVER ROUTE AT ALL, AND NOT A BROWSER CALL: the IdP URL is not exposed
+ * to the browser, and the route is the one place that owns that. The token is
+ * forwarded, never the IdP's host.
+ */
+import { NextRequest, NextResponse } from 'next/server';
+/** A typed refusal in the kit's error envelope - used for a missing field, BEFORE any IdP call. */
+export declare function onboardingBadRequest(code: string, message: string): NextResponse<{
+    success: boolean;
+    message: string;
+    error: {
+        code: string;
+    };
+}>;
+/**
+ * POST a JSON body to `{IDP_URL}{idpPath}` with no credentials, and relay the
+ * IdP's status and body verbatim (the page acts on what the IdP actually
+ * returns, not on a shape this layer guesses). Never relays the IdP error TEXT
+ * for a non-2xx is NOT done here: the onboarding endpoints answer structured
+ * envelopes the page reads; the page owns the copy.
+ */
+export declare function onboardingProxy(req: NextRequest, idpPath: string): Promise<NextResponse>;

package/dist/lib/onboarding-proxy.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.onboardingBadRequest = onboardingBadRequest;
+exports.onboardingProxy = onboardingProxy;
+/**
+ * PAY-2121: shared anonymous IDP proxy for the /api/onboarding/* handlers.
+ *
+ * The onboarding flow is TOKEN-DRIVEN: the invitee has no account or session
+ * yet, and the onboard_token IS the credential. So these calls must NOT go
+ * through idpFetchJSON (which injects a Bearer from a Redis session) - there is
+ * no session. They are plain server-to-server POSTs to the IdP, exactly as the
+ * VibeID portal's hand-built /api/onboarding/* routes do (card 182611).
+ *
+ * WHY A SERVER ROUTE AT ALL, AND NOT A BROWSER CALL: the IdP URL is not exposed
+ * to the browser, and the route is the one place that owns that. The token is
+ * forwarded, never the IdP's host.
+ */
+const server_1 = require("next/server");
+const env_1 = require("../config/env");
+const idp_url_guard_1 = require("./idp-url-guard");
+/** A typed refusal in the kit's error envelope - used for a missing field, BEFORE any IdP call. */
+function onboardingBadRequest(code, message) {
+    return server_1.NextResponse.json({ success: false, message, error: { code } }, { status: 400 });
+}
+/**
+ * POST a JSON body to `{IDP_URL}{idpPath}` with no credentials, and relay the
+ * IdP's status and body verbatim (the page acts on what the IdP actually
+ * returns, not on a shape this layer guesses). Never relays the IdP error TEXT
+ * for a non-2xx is NOT done here: the onboarding endpoints answer structured
+ * envelopes the page reads; the page owns the copy.
+ */
+async function onboardingProxy(req, idpPath) {
+    const idpBase = env_1.ENV_CONFIG.IDP_URL;
+    if (!idpBase) {
+        return server_1.NextResponse.json({ success: false, message: 'IDP_URL is not configured', error: { code: 'NO_IDP_URL' } }, { status: 500 });
+    }
+    const url = `${idpBase}${idpPath}`;
+    (0, idp_url_guard_1.assertAbsoluteIdpUrl)(url);
+    let bodyText = '{}';
+    try {
+        const raw = await req.text();
+        if (raw && raw.trim().length > 0)
+            bodyText = raw;
+    }
+    catch { /* empty body is fine */ }
+    const headers = { 'Content-Type': 'application/json', Accept: 'application/json' };
+    const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
+    if (xfwd)
+        headers['X-Forwarded-For'] = xfwd;
+    const ua = req.headers.get('user-agent');
+    if (ua)
+        headers['User-Agent'] = ua;
+    let res;
+    try {
+        res = await fetch(url, { method: 'POST', headers, body: bodyText, cache: 'no-store' });
+    }
+    catch {
+        return server_1.NextResponse.json({ success: false, message: 'The identity service is unreachable.', error: { code: 'UPSTREAM_UNREACHABLE' } }, { status: 502 });
+    }
+    const json = await res.json().catch(() => null);
+    return server_1.NextResponse.json(json ?? { success: res.ok }, { status: res.status });
+}

package/dist/lib/safe-error-response.d.ts

@@ -65,3 +65,11 @@ export declare function projectResetTokenInvalid(json: unknown): boolean;
  * (the caller must be able to tell a refused password from a dead recovery session).
  */
 export declare function projectPasswordPolicyRules(json: unknown): string[] | undefined;
+/**
+ * PAY-2103 (AUTH-009 breached-password check): the IdP refuses a password found in a breach corpus with
+ * the typed code `password_breached` in its 400 validation envelope (error.code, or error.details.code,
+ * or a value[] entry while it settles). The reset-password route is ANONYMOUS, so only a BOOLEAN crosses
+ * (`password_breached: true`), never the code text: the page maps the boolean to its own sentence. Reads
+ * only the code, never IdP text.
+ */
+export declare function projectPasswordBreached(json: unknown): boolean;

package/dist/lib/safe-error-response.js

@@ -21,6 +21,7 @@ exports.projectPasswordPolicyDetails = projectPasswordPolicyDetails;
 exports.idpErrorEnvelope = idpErrorEnvelope;
 exports.projectResetTokenInvalid = projectResetTokenInvalid;
 exports.projectPasswordPolicyRules = projectPasswordPolicyRules;
+exports.projectPasswordBreached = projectPasswordBreached;
 const password_rules_1 = require("./password-rules");
 const str = (v) => (typeof v === 'string' ? v : undefined);
 /** Log an exception with a fresh correlationId and return the id for the response body. */
@@ -128,3 +129,29 @@ function projectPasswordPolicyRules(json) {
         return undefined;
     return (0, password_rules_1.knownPasswordRules)(details.rules);
 }
+/**
+ * PAY-2103 (AUTH-009 breached-password check): the IdP refuses a password found in a breach corpus with
+ * the typed code `password_breached` in its 400 validation envelope (error.code, or error.details.code,
+ * or a value[] entry while it settles). The reset-password route is ANONYMOUS, so only a BOOLEAN crosses
+ * (`password_breached: true`), never the code text: the page maps the boolean to its own sentence. Reads
+ * only the code, never IdP text.
+ */
+function projectPasswordBreached(json) {
+    if (!json || typeof json !== 'object')
+        return false;
+    const top = json;
+    const err = top.error && typeof top.error === 'object' ? top.error : {};
+    const direct = str(err.code) ?? str(top.code) ?? str(top.error_code);
+    if (direct?.toLowerCase() === 'password_breached')
+        return true;
+    const details = (err.details && typeof err.details === 'object' ? err.details : top.details && typeof top.details === 'object' ? top.details : null);
+    if (str(details?.code)?.toLowerCase() === 'password_breached')
+        return true;
+    // THE SHAPE THE IdP ACTUALLY SENDS (DotNetPert-Scout, PAY-2103 PR 850caa07a): error.details =
+    // { field:'new_password', code:'password_policy', rules:['password_breached'], requirements:[...] }.
+    // The breach is a member of rules[], not a code - the house envelope carries every password rule
+    // that way. Reading only a code would MISS the real refusal.
+    if (Array.isArray(details?.rules) && details.rules.some((r) => typeof r === 'string' && r.toLowerCase() === 'password_breached'))
+        return true;
+    return Array.isArray(details?.value) && details.value.some((v) => !!v && typeof v === 'object' && str(v.code)?.toLowerCase() === 'password_breached');
+}

package/dist/middleware/create-middleware.d.ts

@@ -99,7 +99,48 @@ export interface MvpMiddlewareOptions {
     bypassPaths?: string[];
     /** Paths exempt from RBAC checks (auth still enforced, just no page-permission check) */
     rbacExemptPaths?: string[];
+    /**
+     * PAY-1882 step 4 - how this app treats a producer that reports the session's
+     * revocation status as `'unknown'` (a Vibe read that FAILED: non-OK, timeout,
+     * throw - the status could not be determined).
+     *
+     *   'closed' (DEFAULT) - an unknown revocation status is NOT viable; the
+     *                        session is force-invalidated and the user re-auths.
+     *                        This is Jon's PAY-1880 ruling (option A, fail closed),
+     *                        2026-09-27, and BAPert 66316/66320 restates it for
+     *                        step 4. Consequence, accepted explicitly: a Vibe
+     *                        outage signs this app's users out. 'not_configured'
+     *                        also fails closed here - both live consumers ARE
+     *                        configured (BAPert 66356), so for them it means a
+     *                        misconfiguration, not "no revocation source".
+     *   'open'             - an unknown OR not-configured status stays viable
+     *                        (availability over fail-closed). Per-app opt-out for a
+     *                        deployment with no revocation source, or the two live
+     *                        consumers while Jon decides.
+     *
+     * Neither mode changes `'revoked'` (always force-invalid) or an ABSENT
+     * `revocationStatus` (an older producer - unchanged behaviour, so no consumer
+     * is signed out for not implementing the check).
+     */
+    revocationFailMode?: 'closed' | 'open';
 }
 /** Login error code for a pre-2FA session that expired before the code was verified (PAY-884). */
 export declare const TWO_FACTOR_TIMEOUT_ERROR = "TwoFactorTimeout";
 export declare function createMvpMiddleware(options?: MvpMiddlewareOptions): (request: NextRequest) => Promise<NextResponse>;
+/**
+ * The revocation decision, as a pure function (PAY-1882 step 4, NightHawk 66392).
+ *
+ * Separate + exported so the B1 defect is testable with a REAL mutant: the bug was
+ * that `data.forceInvalid === true` was read BEFORE revocationFailMode, so a
+ * producer that folds 'unknown' into forceInvalid made the 'open' lever dead.
+ *
+ * RULE: when the producer supplies `revocationStatus`, it is AUTHORITATIVE - the
+ * decision is made from it plus failMode, and the folded booleans are ignored for
+ * 'unknown'/'not_configured'. The booleans are read ONLY when revocationStatus is
+ * absent (idealresume.online's older boolean-only route).
+ */
+export declare function decideForceInvalid(data: {
+    revocationStatus?: unknown;
+    forceInvalid?: unknown;
+    revoked?: unknown;
+}, revocationFailMode: 'closed' | 'open'): boolean;

package/dist/middleware/create-middleware.js

@@ -20,6 +20,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TWO_FACTOR_TIMEOUT_ERROR = void 0;
 exports.createMvpMiddleware = createMvpMiddleware;
+exports.decideForceInvalid = decideForceInvalid;
 const server_1 = require("next/server");
 const route_config_1 = require("../auth/route-config");
 const safe_callback_1 = require("../auth/safe-callback");
@@ -317,6 +318,8 @@ function createMvpMiddleware(options = {}) {
     const refreshEndpoint = options.refreshEndpoint || '/api/auth/refresh';
     const bypassPaths = options.bypassPaths || [];
     const rbacExemptPaths = options.rbacExemptPaths || [];
+    // PAY-1882 step 4: default 'closed' (Jon's option A / BAPert 66316).
+    const revocationFailMode = options.revocationFailMode || 'closed';
     return async function middleware(request) {
         const { pathname, searchParams } = request.nextUrl;
         // =========================================================================
@@ -347,7 +350,7 @@ function createMvpMiddleware(options = {}) {
             // Has cookie - continue to viability check for 2FA enforcement
         }
         // --- Fetch session viability from internal API ---
-        const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log);
+        const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log, revocationFailMode);
         // --- Stale session (cookie exists but session doesn't): OBSERVE ONLY, DO NOT DECIDE ---
         //
         // *** CARD 349607. THIS BLOCK USED TO `return` HERE, AND THAT RETURN WAS A BYPASS. ***
@@ -409,8 +412,37 @@ function createMvpMiddleware(options = {}) {
         });
     };
 }
+/**
+ * The revocation decision, as a pure function (PAY-1882 step 4, NightHawk 66392).
+ *
+ * Separate + exported so the B1 defect is testable with a REAL mutant: the bug was
+ * that `data.forceInvalid === true` was read BEFORE revocationFailMode, so a
+ * producer that folds 'unknown' into forceInvalid made the 'open' lever dead.
+ *
+ * RULE: when the producer supplies `revocationStatus`, it is AUTHORITATIVE - the
+ * decision is made from it plus failMode, and the folded booleans are ignored for
+ * 'unknown'/'not_configured'. The booleans are read ONLY when revocationStatus is
+ * absent (idealresume.online's older boolean-only route).
+ */
+function decideForceInvalid(data, revocationFailMode) {
+    const status = data.revocationStatus;
+    if (typeof status === 'string') {
+        if (status === 'revoked')
+            return true;
+        if (status === 'active')
+            return false;
+        // S1 (NightHawk 66409): ANY other string - 'unknown', 'not_configured', a
+        // typo like 'Revoked', 'error', or '' - is treated as 'unknown' (fail mode
+        // applies), NEVER as 'active'. Returning false here would let the first
+        // producer that emits an unexpected state silently switch revocation OFF -
+        // the exact PAY-1880 fail-open class. Only an explicit 'active' is viable.
+        return revocationFailMode === 'closed';
+    }
+    // No revocationStatus: an older boolean producer. Absence of both stays false.
+    return data.forceInvalid === true || data.revoked === true;
+}
 /** Check session viability via internal API */
-async function checkViability(request, endpoint, log) {
+async function checkViability(request, endpoint, log, revocationFailMode) {
     const sessionStatus = {
         exists: false,
         forceInvalid: false,
@@ -443,6 +475,46 @@ async function checkViability(request, endpoint, log) {
             sessionStatus.exists = data.authenticated ?? (!!data.sessionTokenId && data.reason !== 'session_not_found');
             sessionStatus.requires2FA = data.requires2FA || false;
             sessionStatus.twoFactorComplete = data.twoFactorComplete || false;
+            // --- Session revocation (PAY-1882 Step 4) ---
+            // Two producer spellings are honoured, because both exist on the wire:
+            //   - boolean `forceInvalid` / `revoked` (idealresume.online's route today)
+            //   - the three-state `revocationStatus` the package's own viability
+            //     handlers now emit (PAY-1882 step 4).
+            //
+            // RULING (Jon, via BAPert 66316): 'revoked' ALWAYS fails closed. 'unknown'
+            // (a FAILED Vibe read) fails closed by default and is the ONLY state that
+            // the per-app `revocationFailMode` option can relax to viable.
+            //
+            // Four producer states (BAPert 66320), with the fail-closed ruling for
+            // 'not_configured' added by BAPert 66356:
+            //   'active'         - Vibe read OK, not revoked  -> viable
+            //   'revoked'        - Vibe says revoked          -> force-invalid, ALWAYS
+            //   'unknown'        - read FAILED                -> force-invalid if 'closed'
+            //   'not_configured' - no revocation source       -> force-invalid if 'closed'
+            //
+            // WHY 'not_configured' FAILS CLOSED WHEN 'closed': both live consumers of
+            // this middleware (portal.keelauth.com / keelauth-portal, idealvibe.online)
+            // DO set IDP_URL + VIBE_CLIENT_ID + VIBE_HMAC_KEY (BAPert 66356, measured in
+            // their committed manifests + the graft pipeline's own secret check), so for
+            // them 'not_configured' can only mean a MISCONFIGURATION - revocation
+            // silently switched off is exactly the PAY-1880 fail-open bug. An app with
+            // no revocation source that genuinely wants availability sets
+            // revocationFailMode 'open'.
+            //
+            // A MISSING revocationStatus (an older producer) keeps today's behaviour,
+            // i.e. NOT force-invalid: absence must never sign out a population that
+            // never opted into the check.
+            //
+            // *** revocationStatus IS AUTHORITATIVE WHEN PRESENT (NightHawk 66392). ***
+            // The package's own producers emit `forceInvalid: revocationStatus ===
+            // 'revoked' || revocationStatus === 'unknown'`. If the boolean were read
+            // FIRST, `forceInvalid: true` would short-circuit before revocationFailMode
+            // was consulted, so `'open'` could never keep an 'unknown' session viable -
+            // the opt-out lever would be DEAD. So: when a producer supplies a
+            // revocations status, decide from it + failMode and ignore the folded
+            // booleans for unknown/not_configured. The booleans are read ONLY when
+            // revocationStatus is ABSENT (idealresume.online's older boolean route).
+            sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
             sessionPointer.exists = sessionStatus.exists ?? false;
             sessionPointer.sessionTokenId = data.sessionTokenId ?? null;
             sessionPointer.expired = data.accessTokenExpired || false;

package/dist/pages/login/page.js

@@ -206,7 +206,7 @@ function LoginForm({ altAuthSlot }) {
         .themed-status-submitting svg {
           color: ${buttonColor} !important;
         }
-      ` } }), (0, jsx_runtime_1.jsx)("div", { className: `min-h-screen flex items-center justify-center px-4 ${colors.background}`, children: (0, jsx_runtime_1.jsxs)("div", { className: "max-w-md w-full", children: [(0, jsx_runtime_1.jsxs)("div", { className: `rounded-2xl shadow-xl p-8 ${colors.card} ${colors.border} text-gray-800`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "text-center mb-8", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-3xl font-bold mb-2", style: { color: 'inherit' }, children: branding.tagline || 'Welcome Back' }), (0, jsx_runtime_1.jsx)("p", { className: colors.muted, children: "Sign in to your account" })] }), googleEnabled && ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => void handleGoogleSignIn(), disabled: googleLoading || isSubmitting, "data-testid": "google-sign-in", className: "w-full px-4 py-3 mb-6 rounded-lg border border-gray-300 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed hover:bg-gray-50", style: { backgroundColor: 'white', color: '#1f2937' }, children: [googleLoading ? ((0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin w-5 h-5", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] })) : ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })), googleLoading ? 'Redirecting to Google…' : 'Continue with Google'] }) })), altAuthSlot && (0, jsx_runtime_1.jsx)("div", { className: "mt-4", children: altAuthSlot }), (0, jsx_runtime_1.jsx)("div", { className: `mt-6 text-center text-sm ${colors.muted}`, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "themed-link hover:underline", children: "Start account recovery" }) })] }), (0, jsx_runtime_1.jsxs)("p", { className: `mt-4 text-center text-sm ${colors.muted}`, children: ["Don't have an account?", ' ', (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/register", className: "themed-link font-medium hover:underline", children: "Sign up" })] })] }) })] }));
+      ` } }), (0, jsx_runtime_1.jsx)("div", { className: `min-h-screen flex items-center justify-center px-4 ${colors.background}`, children: (0, jsx_runtime_1.jsx)("div", { className: "max-w-md w-full", children: (0, jsx_runtime_1.jsxs)("div", { className: `rounded-2xl shadow-xl p-8 ${colors.card} ${colors.border} text-gray-800`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "text-center mb-8", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-3xl font-bold mb-2", style: { color: 'inherit' }, children: branding.tagline || 'Welcome Back' }), (0, jsx_runtime_1.jsx)("p", { className: colors.muted, children: "Sign in to your account" })] }), googleEnabled && ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => void handleGoogleSignIn(), disabled: googleLoading || isSubmitting, "data-testid": "google-sign-in", className: "w-full px-4 py-3 mb-6 rounded-lg border border-gray-300 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed hover:bg-gray-50", style: { backgroundColor: 'white', color: '#1f2937' }, children: [googleLoading ? ((0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin w-5 h-5", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] })) : ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })), googleLoading ? 'Redirecting to Google…' : 'Continue with Google'] }) })), altAuthSlot && (0, jsx_runtime_1.jsx)("div", { className: "mt-4", children: altAuthSlot }), (0, jsx_runtime_1.jsx)("div", { className: `mt-6 text-center text-sm ${colors.muted}`, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "themed-link hover:underline", children: "Start account recovery" }) })] }) }) })] }));
 }
 function LoginPageFallback() {
     const colors = (0, useTheme_1.useColors)();

package/dist/pages/onboarding/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * PAY-2121: the onboarding surface.
+ *
+ *   default     - the /account-auth/onboarding page (mount from the scaffold at
+ *                 app/account-auth/onboarding/page.tsx).
+ *   PasswordResetBridge - mount once on `/` to honour the IdP's post-verify
+ *                 `#password_reset_required=true` fragment.
+ */
+export { default } from './page';
+export { default as OnboardingPage } from './page';
+export { PasswordResetBridge } from '../../components/auth/PasswordResetBridge';

package/dist/pages/onboarding/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordResetBridge = exports.OnboardingPage = exports.default = void 0;
+/**
+ * PAY-2121: the onboarding surface.
+ *
+ *   default     - the /account-auth/onboarding page (mount from the scaffold at
+ *                 app/account-auth/onboarding/page.tsx).
+ *   PasswordResetBridge - mount once on `/` to honour the IdP's post-verify
+ *                 `#password_reset_required=true` fragment.
+ */
+var page_1 = require("./page");
+Object.defineProperty(exports, "default", { enumerable: true, get: function () { return __importDefault(page_1).default; } });
+var page_2 = require("./page");
+Object.defineProperty(exports, "OnboardingPage", { enumerable: true, get: function () { return __importDefault(page_2).default; } });
+var PasswordResetBridge_1 = require("../../components/auth/PasswordResetBridge");
+Object.defineProperty(exports, "PasswordResetBridge", { enumerable: true, get: function () { return PasswordResetBridge_1.PasswordResetBridge; } });

package/dist/pages/onboarding/page.d.ts

@@ -0,0 +1 @@
+export default function OnboardingPage(): import("react/jsx-runtime").JSX.Element;

package/dist/pages/onboarding/page.js

@@ -0,0 +1,118 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = OnboardingPage;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const navigation_1 = require("next/navigation");
+const H = { primary: 'var(--text-primary)', secondary: 'var(--text-secondary)', muted: 'var(--text-muted)' };
+function OnboardingContent() {
+    const params = (0, navigation_1.useSearchParams)();
+    const onboardToken = params?.get('onboard_token') ?? '';
+    const [step, setStep] = (0, react_1.useState)('code');
+    const [maskedEmail, setMaskedEmail] = (0, react_1.useState)(null);
+    const [digits, setDigits] = (0, react_1.useState)('');
+    const [password, setPassword] = (0, react_1.useState)('');
+    const [confirm, setConfirm] = (0, react_1.useState)('');
+    const [resetToken, setResetToken] = (0, react_1.useState)('');
+    const [email, setEmail] = (0, react_1.useState)('');
+    const [busy, setBusy] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    // Step 1: tell the invitee which address the code went to (masked). Best
+    // effort - a failure here does not block entering a code they were emailed.
+    (0, react_1.useEffect)(() => {
+        if (!onboardToken)
+            return;
+        let alive = true;
+        (async () => {
+            try {
+                const res = await fetch('/api/onboarding/verify-welcome-email', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ onboard_token: onboardToken }),
+                });
+                const body = await res.json().catch(() => null);
+                const data = body?.data?.data || body?.data || {};
+                const masked = data?.masked_user_info?.masked_email || data?.masked_email;
+                if (alive && typeof masked === 'string' && masked)
+                    setMaskedEmail(masked);
+            }
+            catch { /* non-fatal */ }
+        })();
+        return () => { alive = false; };
+    }, [onboardToken]);
+    if (!onboardToken) {
+        return ((0, jsx_runtime_1.jsxs)(Shell, { children: [(0, jsx_runtime_1.jsx)("h1", { style: titleStyle, children: "This invitation link is missing its token." }), (0, jsx_runtime_1.jsx)("p", { style: { color: H.secondary, fontSize: 14, marginTop: 8 }, children: "The link may have been truncated or copied incompletely. Ask for a new invitation, or sign in if you already have an account." }), (0, jsx_runtime_1.jsx)("p", { style: { marginTop: 16 }, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/login", style: linkStyle, children: "Go to sign in" }) })] }));
+    }
+    async function submitCode(e) {
+        e.preventDefault();
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await fetch('/api/onboarding/verify-code', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ onboard_token: onboardToken, code: digits }),
+            });
+            const body = await res.json().catch(() => null);
+            const data = body?.data?.data || body?.data || body;
+            if (!res.ok || !data?.reset_token || !data?.email)
+                throw new Error();
+            setResetToken(data.reset_token);
+            setEmail(data.email);
+            setStep('password');
+        }
+        catch {
+            setError('That code was not accepted. Check it and try again.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    async function submitPassword(e) {
+        e.preventDefault();
+        if (password !== confirm) {
+            setError('The two passwords do not match.');
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await fetch('/api/onboarding/set-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ onboard_token: onboardToken, email, reset_token: resetToken, new_password: password }),
+            });
+            const body = await res.json().catch(() => null);
+            if (!res.ok || (body && body.success === false))
+                throw new Error(body?.message || '');
+            setStep('done');
+        }
+        catch (err) {
+            setError(err instanceof Error && err.message ? err.message : 'We could not set that password. Try again.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    return ((0, jsx_runtime_1.jsxs)(Shell, { children: [step === 'code' && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h1", { style: titleStyle, children: "Finish setting up your account" }), (0, jsx_runtime_1.jsx)("p", { style: { color: H.secondary, fontSize: 14, marginTop: 8 }, children: maskedEmail
+                            ? `We emailed a 6-digit code to ${maskedEmail}. Enter it below.`
+                            : 'Enter the 6-digit code from your invitation email.' }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: submitCode, noValidate: true, style: { marginTop: 16 }, children: [(0, jsx_runtime_1.jsx)("input", { value: digits, onChange: (e) => setDigits(e.target.value.replace(/\D/g, '').slice(0, 6)), inputMode: "numeric", autoComplete: "one-time-code", "aria-label": "6-digit code", placeholder: "000000", style: { ...inputStyle, letterSpacing: 6, textAlign: 'center', fontFamily: 'monospace', fontSize: 20 } }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy || digits.length < 6, style: ctaStyle(busy || digits.length < 6), children: busy ? 'Verifying…' : 'Verify' })] })] })), step === 'password' && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h1", { style: titleStyle, children: "Choose a password" }), (0, jsx_runtime_1.jsx)("p", { style: { color: H.secondary, fontSize: 14, marginTop: 8 }, children: "Set the password you will sign in with." }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: submitPassword, noValidate: true, style: { marginTop: 16 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "password", value: password, onChange: (e) => setPassword(e.target.value), "aria-label": "New password", placeholder: "New password", style: inputStyle }), (0, jsx_runtime_1.jsx)("input", { type: "password", value: confirm, onChange: (e) => setConfirm(e.target.value), "aria-label": "Confirm password", placeholder: "Confirm password", style: { ...inputStyle, marginTop: 10 } }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy || !password || !confirm, style: ctaStyle(busy || !password || !confirm), children: busy ? 'Saving…' : 'Set password' })] })] })), step === 'done' && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h1", { style: titleStyle, children: "You're all set." }), (0, jsx_runtime_1.jsx)("p", { style: { color: H.secondary, fontSize: 14, marginTop: 8 }, children: "Your account is ready. You can sign in now." }), (0, jsx_runtime_1.jsx)("p", { style: { marginTop: 16 }, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/login", style: linkStyle, children: "Go to sign in" }) })] })), error && (0, jsx_runtime_1.jsx)("p", { style: { color: '#b00020', fontSize: 13, marginTop: 12 }, children: error })] }));
+}
+const titleStyle = { color: H.primary, fontSize: 20, fontWeight: 600, margin: 0 };
+const linkStyle = { color: H.primary, fontWeight: 600, textDecoration: 'underline' };
+const inputStyle = {
+    width: '100%', padding: '10px 12px', border: '1px solid var(--border-default, #d1d5db)',
+    borderRadius: 10, color: H.primary, fontSize: 15, background: 'var(--bg-card, #fff)',
+};
+const ctaStyle = (disabled) => ({
+    marginTop: 14, width: '100%', padding: '10px 12px', borderRadius: 10, border: 'none',
+    background: H.primary, color: '#fff', fontWeight: 600, fontSize: 15, cursor: disabled ? 'default' : 'pointer',
+    opacity: disabled ? 0.5 : 1,
+});
+function Shell({ children }) {
+    return ((0, jsx_runtime_1.jsx)("div", { style: { minHeight: '100vh', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16, background: 'var(--bg-default, #f9fafb)' }, children: (0, jsx_runtime_1.jsx)("div", { style: { width: '100%', maxWidth: 420, background: 'var(--bg-card, #fff)', border: '1px solid var(--border-default, #e5e7eb)', borderRadius: 16, padding: 28 }, children: children }) }));
+}
+function OnboardingPage() {
+    return ((0, jsx_runtime_1.jsx)(react_1.Suspense, { fallback: (0, jsx_runtime_1.jsx)("div", { style: { minHeight: '100vh' } }), children: (0, jsx_runtime_1.jsx)(OnboardingContent, {}) }));
+}

package/dist/pages/recovery/page.js

@@ -6,6 +6,7 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const navigation_1 = require("next/navigation");
 const api_1 = require("../../utils/api");
+const password_reset_bridge_1 = require("../../auth/password-reset-bridge");
 const InitiateRecoveryStep_1 = require("../../components/recovery/InitiateRecoveryStep");
 const SelectMethodStep_1 = require("../../components/recovery/SelectMethodStep");
 const VerifyCodeStep_1 = require("../../components/recovery/VerifyCodeStep");
@@ -16,14 +17,18 @@ const useTheme_1 = require("../../theme/useTheme");
 function RecoveryContent() {
     const router = (0, navigation_1.useRouter)();
     const searchParams = (0, navigation_1.useSearchParams)();
-    const prefilledEmail = searchParams?.get('email') || '';
+    // PAY-2121 (BAPert 70576): a VERIFIED passwordless user arrives here with a real
+    // reset token (?token=) from the IdP's post-verify fragment, via the bridge. In
+    // that case skip the request-a-code step and go straight to set-password - the
+    // token is the credential; asking for a code would throw it away.
+    const entry = (0, password_reset_bridge_1.recoveryEntry)(searchParams?.get('token'), searchParams?.get('email'));
     const colors = (0, useTheme_1.useColors)();
-    const [currentStep, setCurrentStep] = (0, react_1.useState)('initiate');
-    const [email, setEmail] = (0, react_1.useState)(prefilledEmail);
+    const [currentStep, setCurrentStep] = (0, react_1.useState)(entry.step);
+    const [email, setEmail] = (0, react_1.useState)(entry.email);
     const [recoverySession, setRecoverySession] = (0, react_1.useState)(null);
     const [selectedMethod, setSelectedMethod] = (0, react_1.useState)(null);
     const [verificationCode, setVerificationCode] = (0, react_1.useState)('');
-    const [passwordResetToken, setPasswordResetToken] = (0, react_1.useState)(null);
+    const [passwordResetToken, setPasswordResetToken] = (0, react_1.useState)(entry.resetToken ? { token: entry.resetToken, expiresAt: '' } : null);
     const [error, setError] = (0, react_1.useState)(null);
     // PAY-1591: true when the reset failed because the recovery itself is dead; the error box then offers a way back.
     const [recoveryExpired, setRecoveryExpired] = (0, react_1.useState)(false);
@@ -108,13 +113,19 @@ function RecoveryContent() {
         }
     };
     const handleResetPassword = async (password, confirmPassword) => {
-        if (!passwordResetToken || !recoverySession)
+        // PAY-2121 (BAPert 70582): the ONE place that decides whether a submit may proceed.
+        // No token (or no email anywhere) -> refuse BEFORE any request; a guard-less submit
+        // would otherwise call the API with an empty token.
+        const target = (0, password_reset_bridge_1.resetSubmitTarget)(passwordResetToken?.token, recoverySession?.email, email);
+        if (!target) {
+            setError(passwordResetToken ? 'We could not tell which account to reset. Start recovery again.' : 'This reset link is missing its token. Start recovery again.');
             return;
+        }
         setLoading(true);
         setError(null);
         setRecoveryExpired(false);
         try {
-            const response = await api_1.accountApi.resetPasswordWithToken(recoverySession.email, passwordResetToken.token, password, confirmPassword);
+            const response = await api_1.accountApi.resetPasswordWithToken(target.email, target.token, password, confirmPassword);
             if (response.success) {
                 setResetSucceeded(true);
                 setCurrentStep('complete');
@@ -136,8 +147,10 @@ function RecoveryContent() {
             setCurrentStep('initiate');
         else if (currentStep === 'verify-code')
             setCurrentStep('select-method');
+        // PAY-2121: a deep-linked set-password has no verify-code to go back to; return to
+        // the request-code step so a bad token still leaves a way forward.
         else if (currentStep === 'set-password')
-            setCurrentStep('verify-code');
+            setCurrentStep(recoverySession ? 'verify-code' : 'initiate');
     };
     return ((0, jsx_runtime_1.jsx)("div", { className: "w-full flex items-center justify-center p-6", style: { background: 'var(--bg-default)' }, children: (0, jsx_runtime_1.jsxs)("div", { className: "max-w-md w-full", children: [error && ((0, jsx_runtime_1.jsxs)("div", { className: "mb-4 bg-red-50 border border-red-200 rounded-2xl p-3", children: [(0, jsx_runtime_1.jsx)("p", { className: "text-red-700 text-sm", children: error }), recoveryExpired && ((0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "text-sm font-medium underline", children: "Start password recovery again" }))] })), loading && ((0, jsx_runtime_1.jsx)("div", { className: "mb-4 rounded-2xl p-3", style: { background: 'var(--bg-card)', borderColor: 'var(--border-default)' }, children: (0, jsx_runtime_1.jsx)("p", { className: "text-sm", style: { color: 'var(--text-secondary)' }, children: "Processing..." }) })), currentStep === 'initiate' && ((0, jsx_runtime_1.jsx)(InitiateRecoveryStep_1.InitiateRecoveryStep, { email: email, setEmail: setEmail, onSubmit: handleInitiateRecovery, loading: loading })), currentStep === 'select-method' && recoverySession && ((0, jsx_runtime_1.jsx)(SelectMethodStep_1.SelectMethodStep, { session: recoverySession, onSelectMethod: handleSendCode, loading: loading })), currentStep === 'verify-code' && ((0, jsx_runtime_1.jsx)(VerifyCodeStep_1.VerifyCodeStep, { code: verificationCode, setCode: setVerificationCode, onSubmit: handleVerifyCode, onResend: () => selectedMethod && handleSendCode(selectedMethod), loading: loading, maskedDestination: selectedMethod === 'sms'
                         ? recoverySession?.maskedPhone