@payez/next-mvp 4.4.8 → 4.5.0

package/dist/vibe/sessions.js

@@ -42,8 +42,14 @@ exports.revokeAllUserSessions = revokeAllUserSessions;
 exports.updateSessionActivity = updateSessionActivity;
 exports.isSessionValid = isSessionValid;
 exports.checkSessionRevocation = checkSessionRevocation;
+exports.hashSessionToken = hashSessionToken;
+exports.resolveNumericIdpUserId = resolveNumericIdpUserId;
+exports.warnNonNumericUserId = warnNonNumericUserId;
+exports.readSessionRevocationHmac = readSessionRevocationHmac;
+exports.getRevocationStatus = getRevocationStatus;
 exports.getSessionStats = getSessionStats;
 const crypto_1 = __importDefault(require("crypto"));
+const token_utils_1 = require("../auth/utils/token-utils");
 // -----------------------------------------------------------------------------
 // CONFIGURATION
 // -----------------------------------------------------------------------------
@@ -187,7 +193,9 @@ async function createLoginSession(input) {
 async function getUserSessions(idpUserId, accessToken) {
     const endpoint = `/v1/collections/${COLLECTION}/tables/${TABLE}/query`;
     const result = await vibeProxyRequest(endpoint, 'POST', accessToken, {
-        filter: [{ field: 'idp_user_id', operator: 'eq', value: idpUserId }],
+        // PAY-2037: a flat VibeFilterNode OBJECT, as idealresume sends it (vibe-sessions.ts:220). Core binds
+        // QueryRequest.Filter as an object (VibeQueryBuilder.cs IsFlatFilterFormat); an ARRAY does not bind.
+        filter: { field: 'idp_user_id', operator: 'eq', value: idpUserId },
         pageSize: 100,
     });
     return result?.data || result?.items || [];
@@ -206,11 +214,12 @@ async function getAllSessions(options = {}, accessToken) {
     const query = {
         page,
         pageSize,
-        orderBy: 'created_at',
-        orderDir: 'desc',
+        // PAY-2037: Vibe's QueryRequest.OrderBy is an OBJECT; a string is a 400 and vibeProxyRequest
+        // turned that into an empty list. There is no `orderDir` (QAPert 69149).
+        orderBy: { created_at: 'desc' },
     };
     if (options.status) {
-        query.filter = [{ field: 'status', operator: 'eq', value: options.status }];
+        query.filter = { field: 'status', operator: 'eq', value: options.status };
     }
     const endpoint = `/v1/collections/${COLLECTION}/tables/${TABLE}/query`;
     const result = await vibeProxyRequest(endpoint, 'POST', accessToken, query);
@@ -243,8 +252,9 @@ async function getSessionById(sessionId, accessToken) {
  */
 async function revokeSession(sessionId, adminEmail, accessToken, reason) {
     const now = new Date().toISOString();
+    // PAY-2037: PATCH, not PUT - a PUT replaces the row and this body carries 4 of its fields.
     const endpoint = `/v1/collections/${COLLECTION}/tables/${TABLE}/${sessionId}`;
-    const session = await vibeProxyRequest(endpoint, 'PUT', accessToken, {
+    const session = await vibeProxyRequest(endpoint, 'PATCH', accessToken, {
         status: 'revoked',
         revoked_by: adminEmail,
         revoked_at: now,
@@ -290,7 +300,7 @@ async function revokeAllUserSessions(idpUserId, adminEmail, accessToken, reason)
  */
 async function updateSessionActivity(sessionId, accessToken) {
     const endpoint = `/v1/collections/${COLLECTION}/tables/${TABLE}/${sessionId}`;
-    const result = await vibeProxyRequest(endpoint, 'PUT', accessToken, { last_activity: new Date().toISOString() });
+    const result = await vibeProxyRequest(endpoint, 'PATCH', accessToken, { last_activity: new Date().toISOString() });
     return result !== null;
 }
 // -----------------------------------------------------------------------------
@@ -325,23 +335,254 @@ async function isSessionValid(sessionId, accessToken) {
  * @param accessToken - Access token for auth
  * @param sessionTokenHash - Optional token hash to check specific session
  * @returns Revoked session info if enforcement needed, null otherwise
+ *
+ * @deprecated PAY-2037 step 1 (BAPert 69153): kept so no consumer breaks. It is a thin call into the
+ * same hash-first decision as getRevocationStatus; prefer getRevocationStatus, which distinguishes
+ * a failed read ('unknown') from 'active' instead of throwing.
  */
-async function checkSessionRevocation(idpUserId, accessToken, sessionTokenHash) {
-    const sessions = await getUserSessions(idpUserId, accessToken);
-    // If we have a specific token hash, check that session
+async function checkSessionRevocation(idpUserId, _accessToken, sessionTokenHash) {
+    // PAY-2037 step 1: same decision as getRevocationStatus, same HMAC-only read. The bearer is
+    // accepted for signature compatibility and never sent. A FAILED read throws - it must not read
+    // as "no revoked session" (that is the PAY-1880 fail-open this replaces).
+    const { ok, sessions } = await readSessionRevocationHmac(idpUserId);
+    if (!ok) {
+        throw new Error('[vibe-sessions] session revocation read failed (fail closed)');
+    }
+    return findRevokingSession(sessions, sessionTokenHash);
+}
+// BAPert 66320: log 'not_configured' ONCE, not per request - a Vibe-less
+// deployment would otherwise emit a warn line on every viability check.
+let warnedNotConfigured = false;
+/**
+ * Hash a session token the same way record-login stores it.
+ * SHA256 hex, 64 chars. This must stay byte-identical to
+ * `hashSessionToken` in the consumers (idealresume.online/lib/session-token-hash.ts)
+ * or per-session matching silently falls back to the user-wide path.
+ */
+function hashSessionToken(token) {
+    return crypto_1.default.createHash('sha256').update(token).digest('hex');
+}
+/**
+ * BAPert 66480 condition 2 (ruling (ii), 66700; corrected per QAPert 66729):
+ * resolve the NUMERIC IdP user id the Vibe query filters on.
+ *
+ * *** DO NOT READ `sub` FOR THE USER ID. *** In the IdP's bearer token `sub` is the
+ * USERNAME, not the id: AESGCM_Encryption.cs:815 writes `{ "sub", payload.Username }`
+ * and :822 writes `{ "user_id", payload.UserId.ToString() }`. A username is commonly
+ * an email, so reading `sub` yields 0 for the common case - and for a username that
+ * happens to be all digits it yields the WRONG id, which getRevocationStatus answers
+ * 'active' for a user with no rows: a fail-OPEN.
+ *
+ * Resolution order:
+ *   1. the token's `user_id` claim, when it is all digits;
+ *   2. a digits-only session.userId / session.user.id;
+ *   3. otherwise 0 (unresolvable), which the caller reports as 'unknown' (fail closed).
+ *
+ * session.userId is not a safe source on its own either: session-store.ts:143 falls
+ * back to user.email, and better-auth.ts stringifies whichever id it finds.
+ */
+function resolveNumericIdpUserId(session, accessToken) {
+    const isDigits = (v) => /^[0-9]+$/.test(String(v ?? ''));
+    if (accessToken) {
+        // The raw payload (jwtDecode returns every claim, typed or not); user_id, never sub.
+        const payload = (0, token_utils_1.decodeIdpAccessToken)(accessToken);
+        const claim = payload?.user_id;
+        if (isDigits(claim))
+            return Number(claim);
+    }
+    const s = (session ?? {});
+    const fromSession = s.userId ?? s.user?.id;
+    return isDigits(fromSession) ? Number(fromSession) : 0;
+}
+/**
+ * BAPert 66480 condition 1: WARN once per session when the numeric IdP user id
+ * could not be resolved (userId is email-shaped, empty, or otherwise not all
+ * digits). A non-numeric id must show up as a log line, not as an unexplained
+ * sign-out. Shape only - NEVER the value.
+ *
+ * Keyed on a hash of the session token, so one WARN per session; the set is
+ * bounded so a long-lived process cannot grow it without limit.
+ */
+const warnedNonNumericUserIds = new Set();
+function shapeOfUserId(v) {
+    const str = String(v ?? '');
+    if (!str)
+        return 'empty:0';
+    const kind = /^[0-9]+$/.test(str) ? 'digits' : str.includes('@') ? 'email' : 'other';
+    return `${kind}:${str.length}`;
+}
+function warnNonNumericUserIdOnce(sessionToken, rawUserId) {
+    const key = sessionToken ? hashSessionToken(sessionToken).slice(0, 16) : `nosession:${shapeOfUserId(rawUserId)}`;
+    if (warnedNonNumericUserIds.has(key))
+        return;
+    if (warnedNonNumericUserIds.size > 5000)
+        warnedNonNumericUserIds.clear();
+    warnedNonNumericUserIds.add(key);
+    console.warn('[REVOCATION] non-numeric userId, failing closed', { shape: shapeOfUserId(rawUserId) });
+}
+/**
+ * Public entry point for the twins: call this when a session exists but its
+ * userId is not a usable numeric IdP id. Returns 'unknown' (fail closed) and
+ * emits the once-per-session WARN. Shape only, never the value.
+ */
+function warnNonNumericUserId(sessionToken, rawUserId) {
+    warnNonNumericUserIdOnce(sessionToken, rawUserId);
+    return 'unknown';
+}
+/**
+ * HMAC-ONLY session read for the revocation check (PAY-1882 step 4).
+ *
+ * *** DO NOT "SIMPLIFY" THIS ONTO vibeProxyRequest/getUserSessions. ***
+ * It is deliberately separate and deliberately sends NO Authorization header.
+ *
+ * WHY: the twin this must match is idealresume.online's checkSessionRevocation
+ * read. That repo's vibe-client adds `Authorization: Bearer` ONLY for member
+ * paths (`path.startsWith('/v1/my/')`) - see idealresume.online/lib/vibe-client.ts
+ * :207-210 - so its /v1/collections/.../query for this check goes out HMAC-only.
+ * The comment at vibe-client.ts:188-206 there records why: a bearer on the
+ * collections path caused USER_REQUIRED and broke signups. getUserSessions()
+ * here ALWAYS sends the bearer, so it cannot stand in for this read without
+ * changing the credential the two twins are supposed to share.
+ *
+ * BAPert 66344 (option a): match the twin, HMAC-only.
+ *
+ * Also distinguishes a FAILED read from an EMPTY one - getUserSessions()
+ * collapses a proxy outage and "user has no sessions" to `[]`, which is
+ * fail-OPEN for a revocation decision. Returns `ok:false` on an outage so the
+ * caller fails closed, and `ok:true, sessions:[]` only for a healthy empty.
+ */
+async function readSessionRevocationHmac(idpUserId) {
+    const idpUrl = getEnv('IDP_URL');
+    const clientId = getEnv('VIBE_CLIENT_ID');
+    const signingKey = getEnv('VIBE_HMAC_KEY');
+    if (!idpUrl || !clientId || !signingKey) {
+        // Caller distinguishes this from a read failure; report ok:false, not [].
+        return { ok: false, sessions: [] };
+    }
+    const endpoint = `/v1/collections/${COLLECTION}/tables/${TABLE}/query`;
+    const proxyUrl = `${idpUrl}/api/vibe/proxy`;
+    const timestamp = Math.floor(Date.now() / 1000);
+    const signature = generateHmacSignature(signingKey, timestamp, 'POST', endpoint);
+    // NOTE the absence of Authorization. This is the twin's credential.
+    const headers = {
+        'Content-Type': 'application/json',
+        'X-Vibe-Client-Id': clientId,
+        'X-Vibe-Timestamp': String(timestamp),
+        'X-Vibe-Signature': signature,
+    };
+    try {
+        const response = await fetch(proxyUrl, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                endpoint,
+                method: 'POST',
+                data: {
+                    // PAY-2037: a flat VibeFilterNode OBJECT, as idealresume sends it (vibe-sessions.ts:220). Core binds
+                    // QueryRequest.Filter as an object (VibeQueryBuilder.cs IsFlatFilterFormat); an ARRAY does not bind.
+                    filter: { field: 'idp_user_id', operator: 'eq', value: idpUserId },
+                    pageSize: 100,
+                },
+            }),
+        });
+        if (!response.ok) {
+            // PAY-1427: never the raw proxy body - an error page can echo the request.
+            console.error(`[vibe-sessions] Revocation read proxy error ${response.status}`);
+            return { ok: false, sessions: [] };
+        }
+        const data = await response.json();
+        const unwrapped = (data?.data ?? data);
+        return { ok: true, sessions: unwrapped?.data || unwrapped?.items || [] };
+    }
+    catch (error) {
+        console.error('[vibe-sessions] Revocation read failed:', error);
+        return { ok: false, sessions: [] };
+    }
+}
+/**
+ * THE one revocation decision (PAY-2037 step 1, BAPert 69150): hash-first, per session.
+ * Returns the row that revokes THIS session, or null when it is not revoked.
+ *
+ * A session whose own token hash matches a row is decided by that row ALONE. A matched ACTIVE
+ * session is never logged out because another device was revoked (idealresume PAY-1882 F3).
+ * Only when no row carries the hash (a legacy row minted before hashing) does the user-wide
+ * rule apply: no active row -> the most recently revoked (none revoked: not revoked); else any revoked inside 2h.
+ */
+function findRevokingSession(sessions, sessionTokenHash) {
+    if (sessions.length === 0)
+        return null;
     if (sessionTokenHash) {
-        const matchingSession = sessions.find(s => s.session_token_hash === sessionTokenHash);
-        if (matchingSession && matchingSession.status === 'revoked') {
-            return matchingSession;
+        const matching = sessions.find(s => s.session_token_hash === sessionTokenHash);
+        if (matching)
+            return matching.status === 'revoked' ? matching : null;
+    }
+    // Hash not found (a legacy row minted before hashing) or no hash given: idealresume's user-wide
+    // rules, lib/vibe-sessions.ts:594-651 (BAPert 69189).
+    const revokedAt = (s) => (s.revoked_at ? new Date(s.revoked_at).getTime() : 0);
+    const newestFirst = (x, y) => revokedAt(y) - revokedAt(x);
+    // Check 1: no active row. The most recently revoked row (whenever it was revoked) is the verdict.
+    // All rows expired and none revoked is NOT revoked: expiry is not revocation.
+    if (!sessions.some(s => s.status === 'active')) {
+        const revoked = sessions.filter(s => s.status === 'revoked' && s.revoked_at).sort(newestFirst);
+        if (revoked.length > 0)
+            return revoked[0];
+    }
+    // Check 2: any row revoked in the last TWO hours (idealresume's window; 5-minute polling needs the time).
+    const twoHoursAgo = Date.now() - 2 * 60 * 60 * 1000;
+    return (sessions.filter(s => s.status === 'revoked' && revokedAt(s) > twoHoursAgo).sort(newestFirst)[0] ?? null);
+}
+/**
+ * Determine whether a session is revoked, with an explicit UNKNOWN state
+ * (PAY-1882 step 4 producer half).
+ *
+ * States:
+ *   'not_configured' - this deployment has no revocation source (IDP_URL /
+ *                      VIBE_CLIENT_ID / VIBE_HMAC_KEY absent). Viable; today's
+ *                      behaviour. Logged once, not per request.
+ *   'unknown'        - revocation IS configured but the read FAILED (non-OK,
+ *                      timeout, throw). Enforcing middleware fails this CLOSED
+ *                      by default (revocationFailMode 'closed'); a Vibe-less
+ *                      consumer is 'not_configured', not 'unknown', so it is not
+ *                      signed out.
+ *   'revoked'        - the session's own token hash matches a revoked row, or
+ *                      the user has no active session at all.
+ *   'active'         - read OK and the session is not revoked.
+ *
+ * @param idpUserId - The user's IDP ID
+ * @param sessionToken - The live session token; hashed to match the stored row.
+ *                       When absent, the user-wide check applies (legacy path).
+ */
+async function getRevocationStatus(idpUserId, sessionToken) {
+    const idpUrl = getEnv('IDP_URL');
+    const clientId = getEnv('VIBE_CLIENT_ID');
+    const signingKey = getEnv('VIBE_HMAC_KEY');
+    // 'not_configured' is reserved for an app with NO revocation source at all:
+    // no VIBE_CLIENT_ID. BAPert 66320 - "the app has no revocation source
+    // (VIBE_CLIENT_ID absent / revocation not enabled)". Such a consumer stays
+    // viable, or a Vibe-less app would sign everyone out on every request.
+    if (!clientId) {
+        if (!warnedNotConfigured) {
+            warnedNotConfigured = true;
+            console.warn('[vibe-sessions] Revocation check not configured (VIBE_CLIENT_ID absent) - reporting not_configured (logged once)');
         }
+        return 'not_configured';
+    }
+    // A client id IS present, so this app is a Vibe consumer that intends the
+    // revocation check - but the read is MISCONFIGURED (IDP_URL or VIBE_HMAC_KEY
+    // missing). BAPert 66344 condition 2: FAIL CLOSED. Do NOT fall back to bearer,
+    // do NOT report "no sessions". 'unknown' is the fail-closed state.
+    if (!idpUrl || !signingKey) {
+        console.warn('[vibe-sessions] Revocation check MISCONFIGURED (VIBE_CLIENT_ID set but IDP_URL/VIBE_HMAC_KEY missing) - reporting unknown (fail closed)');
+        return 'unknown';
+    }
+    const { ok, sessions } = await readSessionRevocationHmac(idpUserId);
+    if (!ok) {
+        console.warn('[vibe-sessions] Revocation read failed - reporting unknown');
+        return 'unknown';
     }
-    // Otherwise, check if there are any recently revoked sessions
-    // (revoked within the last hour - gives time for enforcement)
-    const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000);
-    const recentlyRevoked = sessions.find(s => s.status === 'revoked' &&
-        s.revoked_at &&
-        new Date(s.revoked_at) > oneHourAgo);
-    return recentlyRevoked || null;
+    return findRevokingSession(sessions, sessionToken ? hashSessionToken(sessionToken) : undefined)
+        ? 'revoked'
+        : 'active';
 }
 // -----------------------------------------------------------------------------
 // STATISTICS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.4.8",
+  "version": "4.5.0",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -17,12 +17,13 @@
     "pretest:ci": "npm run build",
     "test:ci": "node --test --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=junit.xml \"test/*.test.cjs\"",
     "prepack": "npm run build",
-    "prepublishOnly": "npm run build",
+    "prepublishOnly": "npm run check:publish-eol && npm run build",
     "postpublish": "node scripts/check-publish-health.mjs",
     "postversion": "node scripts/check-publish-health.mjs || echo \"[postversion] see above: local/registry are out of sync after this version bump (171900)\"",
     "dev": "next dev",
     "dev:local": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-local.ps1",
     "dev:broker": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-broker.ps1",
+    "check:publish-eol": "node scripts/check-publish-eol.mjs",
     "check:publish-health": "node scripts/check-publish-health.mjs",
     "check:provenance": "node scripts/verify-release-provenance.mjs",
     "census:reach": "node scripts/module-reach.mjs",
@@ -574,6 +575,61 @@
       "require": "./dist/pages/verify-code/page.js",
       "default": "./dist/pages/verify-code/page.js"
     },
+    "./dist/pages/onboarding": {
+      "types": "./dist/pages/onboarding/index.d.ts",
+      "require": "./dist/pages/onboarding/index.js",
+      "default": "./dist/pages/onboarding/index.js"
+    },
+    "./pages/onboarding": {
+      "types": "./dist/pages/onboarding/index.d.ts",
+      "require": "./dist/pages/onboarding/index.js",
+      "default": "./dist/pages/onboarding/index.js"
+    },
+    "./components/auth/PasswordResetBridge": {
+      "types": "./dist/components/auth/PasswordResetBridge.d.ts",
+      "require": "./dist/components/auth/PasswordResetBridge.js",
+      "default": "./dist/components/auth/PasswordResetBridge.js"
+    },
+    "./api-handlers/onboarding/verify-code": {
+      "types": "./dist/api-handlers/onboarding/verify-code.d.ts",
+      "require": "./dist/api-handlers/onboarding/verify-code.js",
+      "default": "./dist/api-handlers/onboarding/verify-code.js"
+    },
+    "./api-handlers/onboarding/send-email-code": {
+      "types": "./dist/api-handlers/onboarding/send-email-code.d.ts",
+      "require": "./dist/api-handlers/onboarding/send-email-code.js",
+      "default": "./dist/api-handlers/onboarding/send-email-code.js"
+    },
+    "./api-handlers/onboarding/verify-welcome-email": {
+      "types": "./dist/api-handlers/onboarding/verify-welcome-email.d.ts",
+      "require": "./dist/api-handlers/onboarding/verify-welcome-email.js",
+      "default": "./dist/api-handlers/onboarding/verify-welcome-email.js"
+    },
+    "./api-handlers/onboarding/set-password": {
+      "types": "./dist/api-handlers/onboarding/set-password.d.ts",
+      "require": "./dist/api-handlers/onboarding/set-password.js",
+      "default": "./dist/api-handlers/onboarding/set-password.js"
+    },
+    "./routes/onboarding/verify-code": {
+      "types": "./dist/routes/onboarding/verify-code.d.ts",
+      "require": "./dist/routes/onboarding/verify-code.js",
+      "default": "./dist/routes/onboarding/verify-code.js"
+    },
+    "./routes/onboarding/send-email-code": {
+      "types": "./dist/routes/onboarding/send-email-code.d.ts",
+      "require": "./dist/routes/onboarding/send-email-code.js",
+      "default": "./dist/routes/onboarding/send-email-code.js"
+    },
+    "./routes/onboarding/verify-welcome-email": {
+      "types": "./dist/routes/onboarding/verify-welcome-email.d.ts",
+      "require": "./dist/routes/onboarding/verify-welcome-email.js",
+      "default": "./dist/routes/onboarding/verify-welcome-email.js"
+    },
+    "./routes/onboarding/set-password": {
+      "types": "./dist/routes/onboarding/set-password.d.ts",
+      "require": "./dist/routes/onboarding/set-password.js",
+      "default": "./dist/routes/onboarding/set-password.js"
+    },
     "./pages/admin-login": {
       "types": "./dist/pages/admin-login/page.d.ts",
       "require": "./dist/pages/admin-login/page.js",

package/scripts/check-publish-eol.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+/**
+ * PAY-1998 — SHIPPED-SCRIPT LINE-ENDING GUARD (source-of-truth check, no network).
+ *
+ * WHY THIS EXISTS. @payez/next-mvp ships shell/node scripts inside the npm tarball
+ * and those run on LINUX build agents. A Windows checkout that stores CRLF packs
+ * CRLF, and bash on the agent fails with `$'\r': command not found` / `syntax error:
+ * unexpected end of file`. That is not hypothetical: it broke idealvibe's pipeline
+ * (08-09) and re-broke on 4.1.21 (published from a branch that did not carry the
+ * `*.sh text eol=lf` rule — 73 CRs in the tarball), and it is the same class that
+ * had idealresume prod live-broken.
+ *
+ * `.gitattributes` is the FIX-AT-SOURCE, and it IS on master now. The remaining gap
+ * is that NOTHING CHECKS IT AT RELEASE TIME: a version can still be cut from a branch
+ * that dropped the rule, or a new shipped script in an uncovered extension can slip
+ * through. This script is that release-time gate — it FAILS THE RELEASE, in the
+ * package's own publish path, so the defect is caught HERE instead of downstream in
+ * every consumer's CI.
+ *
+ * WHAT IT CHECKS:
+ *   1. `*.sh`, `*.mjs`, `*.cjs` that the package SHIPS (package.json "files") must
+ *      contain NO CR bytes. These run on Linux (bash / node with a shebang).
+ *   2. The `*.sh text eol=lf` rule is still present in the repo's `.gitattributes` —
+ *      so a future edit that quietly drops the rule fails the same check, not just a
+ *      future CRLF checkout.
+ *   3. `*.ps1` is EXEMPT: PowerShell helpers are Windows-only and are deliberately
+ *      kept CRLF (mirroring the .gitattributes rule).
+ *
+ * DESIGN (deliberate — do not soften):
+ *   - EXITS NON-ZERO on any CR in an LF-required shipped script. A check that warns
+ *     is a check that gets ignored; that is exactly how the 08-10 regression shipped.
+ *   - NO NETWORK. Unlike check-publish-health.mjs (which reads the registry), this is
+ *     a pure local scan, so it is safe to run in prepack/prepublishOnly.
+ *   - Exit 2 = INCONCLUSIVE (could not enumerate/read), never a pass. A clean run that
+ *     scanned zero files is reported and treated as inconclusive, not green — a guard
+ *     that silently passes when it found nothing is the failure mode this file exists
+ *     to prevent.
+ *
+ * Usage:  node scripts/check-publish-eol.mjs
+ * Exit:   0 = every shipped LF-required script is CR-free, and the .gitattributes rule is present
+ *         1 = at least one shipped script has CR, or the .gitattributes rule is missing
+ *         2 = could not determine (nothing scanned / unreadable) — inconclusive, NOT a pass
+ */
+
+import { readFileSync, existsSync, statSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join, extname } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgDir = join(here, '..');            // packages/next-mvp
+const repoRoot = join(pkgDir, '..', '..');  // repo root
+
+// Extensions that MUST be LF (they execute on Linux build agents).
+const LF_EXTS = new Set(['.sh', '.mjs', '.cjs']);
+// Extensions explicitly allowed to stay CRLF (Windows-only helpers).
+const CRLF_EXTS = new Set(['.ps1']);
+
+function walk(dir, out = []) {
+  for (const name of readdirSync(dir)) {
+    const full = join(dir, name);
+    const st = statSync(full);
+    if (st.isDirectory()) walk(full, out);
+    else out.push(full);
+  }
+  return out;
+}
+
+function crCount(buf) {
+  let n = 0;
+  for (const b of buf) if (b === 0x0d) n++;
+  return n;
+}
+
+let pkg;
+try {
+  pkg = JSON.parse(readFileSync(join(pkgDir, 'package.json'), 'utf8'));
+} catch (err) {
+  console.error(`[publish-eol] INCONCLUSIVE: cannot read package.json: ${err.message}`);
+  process.exit(2);
+}
+
+// The files the package ships. package.json itself always ships; "files" lists the rest.
+const shipped = ['package.json', ...(pkg.files ?? [])];
+
+const offenders = [];
+let scanned = 0;
+let exempt = 0;
+
+for (const entry of shipped) {
+  const abs = join(pkgDir, entry);
+  if (!existsSync(abs)) continue; // a "files" glob that matches nothing here is fine
+  const st = statSync(abs);
+  const files = st.isDirectory() ? walk(abs) : [abs];
+  for (const f of files) {
+    const ext = extname(f).toLowerCase();
+    if (CRLF_EXTS.has(ext)) { exempt++; continue; }
+    if (!LF_EXTS.has(ext)) continue;
+    scanned++;
+    const crs = crCount(readFileSync(f));
+    if (crs > 0) offenders.push({ file: f, crs });
+  }
+}
+
+// 2. The .gitattributes rule must still be present at the source.
+let gaRulePresent = false;
+let gaPath = join(repoRoot, '.gitattributes');
+try {
+  const ga = readFileSync(gaPath, 'utf8');
+  gaRulePresent = /^\s*\*\.sh\s+text\s+eol=lf\s*$/m.test(ga);
+} catch {
+  gaRulePresent = false;
+}
+
+const rel = (p) => p.replace(repoRoot + '\\', '').replace(repoRoot + '/', '');
+
+if (offenders.length > 0) {
+  console.error('[publish-eol] FAIL: shipped script(s) contain CR (CRLF) and would break Linux agents.');
+  for (const o of offenders) console.error(`[publish-eol]   ${rel(o.file)}  CR=${o.crs}`);
+  console.error('[publish-eol] Fix: ensure the *.sh/*.mjs/*.cjs rule is in .gitattributes and renormalise (git add --renormalize .).');
+  process.exit(1);
+}
+
+if (!gaRulePresent) {
+  console.error(`[publish-eol] FAIL: the "*.sh text eol=lf" rule is MISSING from ${rel(gaPath)}.`);
+  console.error('[publish-eol] Without it, a Windows checkout packs CRLF and breaks every consumer pipeline (the 4.1.21 regression).');
+  process.exit(1);
+}
+
+if (scanned === 0) {
+  console.error('[publish-eol] INCONCLUSIVE: scanned 0 LF-required shipped scripts - the scan is broken, not the package. NOT a pass.');
+  process.exit(2);
+}
+
+console.log(`[publish-eol] OK: ${scanned} shipped script(s) CR-free; ${exempt} Windows-only (*.ps1) exempt; .gitattributes rule present.`);
+process.exit(0);

package/src/api-handlers/account/reset-password.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { resolveClientKey } from '../../lib/client-key';
-import { idpErrorEnvelope, projectPasswordPolicyRules, projectResetTokenInvalid } from '../../lib/safe-error-response';
+import { idpErrorEnvelope, projectPasswordPolicyRules, projectResetTokenInvalid, projectPasswordBreached } from '../../lib/safe-error-response';
 
 function getIdpUrl(): string {
   const url = process.env.IDP_URL;
@@ -73,8 +73,10 @@ export async function POST(req: NextRequest) {
     if (!upstream.ok) {
       // PAY-1591: a password-policy refusal also carries the KNOWN rule codes so the page can say which rules failed.
       const rules = projectPasswordPolicyRules(data);
+      // PAY-2103: a breached-password refusal is a distinct 400; project a BOOLEAN so the anonymous
+      // route carries no code text and the page picks its own sentence.
       return NextResponse.json(
-        { ...idpErrorEnvelope(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...(projectResetTokenInvalid(data) ? { reset_token_invalid: true } : {}) },
+        { ...idpErrorEnvelope(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...(projectResetTokenInvalid(data) ? { reset_token_invalid: true } : {}), ...(projectPasswordBreached(data) ? { password_breached: true } : {}) },
         { status: upstream.status },
       );
     }

package/src/api-handlers/onboarding/send-email-code.ts

@@ -0,0 +1,18 @@
+/**
+ * POST /api/onboarding/send-email-code (PAY-2121).
+ *
+ * Body: { onboard_token } - token-driven, no session. Thin proxy to the IdP's
+ * POST /api/Onboarding/send-email-code. The IdP derives the recipient from the
+ * token's BOUND email only, never from client input, so a tampered link cannot
+ * redirect the code. Also the resend leg the verify card's cooldown fires
+ * against.
+ */
+import { NextRequest } from 'next/server';
+import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({} as Record<string, unknown>));
+  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
+  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
+  return onboardingProxy(req, '/api/Onboarding/send-email-code');
+}

package/src/api-handlers/onboarding/set-password.ts

@@ -0,0 +1,21 @@
+/**
+ * POST /api/onboarding/set-password (PAY-2121).
+ *
+ * Body: { onboard_token, email, reset_token, new_password } - the locked
+ * contract (IdP OnboardingDtos.cs SetPasswordRequest, all four snake_case).
+ * email + reset_token come from the verify-code response; the IdP re-checks
+ * email against the token's bound user before consuming the single-use token.
+ * On success the IdP sets the password AND completes onboarding (issues tokens).
+ * Thin proxy - status and body pass through verbatim.
+ */
+import { NextRequest } from 'next/server';
+import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({} as Record<string, unknown>));
+  const b = body as Record<string, unknown>;
+  if (!b?.onboard_token) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
+  if (!b?.email || !b?.reset_token) return onboardingBadRequest('MISSING_RESET_CONTEXT', 'email and reset_token (from verify-code) are required');
+  if (!b?.new_password) return onboardingBadRequest('MISSING_PASSWORD', 'new_password is required');
+  return onboardingProxy(req, '/api/Onboarding/set-password');
+}

package/src/api-handlers/onboarding/verify-code.ts

@@ -0,0 +1,20 @@
+/**
+ * POST /api/onboarding/verify-code (PAY-2121).
+ *
+ * Body: { onboard_token, code } - token-driven, no session. Thin proxy to the
+ * IdP's POST /api/Onboarding/verify-code, which answers
+ * { success, reset_token, email, client_key } on success (OnboardingDtos.cs
+ * VerifyCodeResponse). reset_token + email are what the set-password step needs
+ * next. The onboard_token IS the auth; there is no session to attach.
+ */
+import { NextRequest } from 'next/server';
+import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({} as Record<string, unknown>));
+  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
+  const code = (body as Record<string, unknown>)?.code;
+  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
+  if (!code) return onboardingBadRequest('MISSING_CODE', 'code is required');
+  return onboardingProxy(req, '/api/Onboarding/verify-code');
+}

package/src/api-handlers/onboarding/verify-welcome-email.ts

@@ -0,0 +1,17 @@
+/**
+ * POST /api/onboarding/verify-welcome-email (PAY-2121).
+ *
+ * Body: { onboard_token } - token-driven, no session. Thin proxy to the IdP's
+ * POST /api/Onboarding/verify-welcome-email, which answers the masked contact
+ * info + expiry the verify card displays. The onboarding page calls this to
+ * render its "check your email / here is what we know" state.
+ */
+import { NextRequest } from 'next/server';
+import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({} as Record<string, unknown>));
+  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
+  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
+  return onboardingProxy(req, '/api/Onboarding/verify-welcome-email');
+}