@payez/next-mvp 4.4.9 → 4.5.1

package/README.md

@@ -256,6 +256,59 @@ export default function VerifyCodePageWrapper() {
 }
 ```
 
+#### What your app must serve (PAY-2121)
+
+The IdP emails links that land on paths your app must host. Two of them are
+conventions the kit mounts for you; wire them or the link 404s at your site:
+
+**Invitation / onboarding** - `app/account-auth/onboarding/page.tsx`:
+
+```typescript
+// The IdP's welcome email links to
+//   {your site}/account-auth/onboarding?client_id=&onboard_token=
+export { default } from '@payez/next-mvp/pages/onboarding';
+```
+
+and the API it posts to (token-driven, no session) - one mount file each:
+
+```typescript
+// app/api/onboarding/verify-code/route.ts
+export { POST } from '@payez/next-mvp/routes/onboarding/verify-code';
+// app/api/onboarding/send-email-code/route.ts
+export { POST } from '@payez/next-mvp/routes/onboarding/send-email-code';
+// app/api/onboarding/verify-welcome-email/route.ts
+export { POST } from '@payez/next-mvp/routes/onboarding/verify-welcome-email';
+// app/api/onboarding/set-password/route.ts
+export { POST } from '@payez/next-mvp/routes/onboarding/set-password';
+```
+
+**Post-verify reset fragment on `/`** - mount the bridge on your home page:
+
+```typescript
+// app/page.tsx
+import { PasswordResetBridge } from '@payez/next-mvp/components/auth/PasswordResetBridge';
+
+export default function Home() {
+  return (<><PasswordResetBridge />{/* your home page */}</>);
+}
+```
+
+When the IdP's verification redirect lands on `/#password_reset_required=true&reset_token=…&email=…`
+(a fragment, for a passwordless account), the bridge performs one replace to
+`/account-auth/recovery?token=…&email=…` and clears the hash. With any other
+fragment it renders nothing. `npx @payez/create-next-app` writes all of the above.
+
+**Registration** has two doors, and the kit ships neither as a page:
+
+- **Owner-initiated invite** (shipped here): an existing owner invites a user; the invite
+  email lands on `/account-auth/onboarding` (above), which the kit now serves.
+- **Self-serve sign-up**: the kit exposes the IdP's ProgressiveAuth flow as API endpoints
+  (`/api/ProgressiveAuth/step1`..`step5`, then `/api/ProgressiveAuth/verify-email`;
+  `API_ENDPOINTS.progressiveAuth` in `config/env.ts`). The kit ships **no** registration
+  page, so a developer who wants self-serve sign-up authors a page that drives that flow,
+  respecting the tenant's `allow_public_registration` / waitlist state. The login page no
+  longer links a register page, because the kit does not ship one.
+
 ### 6. Protect Routes with Authentication
 
 **Server-side protection:**

package/dist/api-handlers/onboarding/send-email-code.d.ts

@@ -0,0 +1,11 @@
+/**
+ * POST /api/onboarding/send-email-code (PAY-2121).
+ *
+ * Body: { onboard_token } - token-driven, no session. Thin proxy to the IdP's
+ * POST /api/Onboarding/send-email-code. The IdP derives the recipient from the
+ * token's BOUND email only, never from client input, so a tampered link cannot
+ * redirect the code. Also the resend leg the verify card's cooldown fires
+ * against.
+ */
+import { NextRequest } from 'next/server';
+export declare function POST(req: NextRequest): Promise<import("next/server").NextResponse<unknown>>;

package/dist/api-handlers/onboarding/send-email-code.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const onboarding_proxy_1 = require("../../lib/onboarding-proxy");
+async function POST(req) {
+    const body = await req.json().catch(() => ({}));
+    const onboardToken = body?.onboard_token;
+    if (!onboardToken)
+        return (0, onboarding_proxy_1.onboardingBadRequest)('MISSING_TOKEN', 'onboard_token is required');
+    return (0, onboarding_proxy_1.onboardingProxy)(req, '/api/Onboarding/send-email-code');
+}

package/dist/api-handlers/onboarding/set-password.d.ts

@@ -0,0 +1,12 @@
+/**
+ * POST /api/onboarding/set-password (PAY-2121).
+ *
+ * Body: { onboard_token, email, reset_token, new_password } - the locked
+ * contract (IdP OnboardingDtos.cs SetPasswordRequest, all four snake_case).
+ * email + reset_token come from the verify-code response; the IdP re-checks
+ * email against the token's bound user before consuming the single-use token.
+ * On success the IdP sets the password AND completes onboarding (issues tokens).
+ * Thin proxy - status and body pass through verbatim.
+ */
+import { NextRequest } from 'next/server';
+export declare function POST(req: NextRequest): Promise<import("next/server").NextResponse<unknown>>;

package/dist/api-handlers/onboarding/set-password.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const onboarding_proxy_1 = require("../../lib/onboarding-proxy");
+async function POST(req) {
+    const body = await req.json().catch(() => ({}));
+    const b = body;
+    if (!b?.onboard_token)
+        return (0, onboarding_proxy_1.onboardingBadRequest)('MISSING_TOKEN', 'onboard_token is required');
+    if (!b?.email || !b?.reset_token)
+        return (0, onboarding_proxy_1.onboardingBadRequest)('MISSING_RESET_CONTEXT', 'email and reset_token (from verify-code) are required');
+    if (!b?.new_password)
+        return (0, onboarding_proxy_1.onboardingBadRequest)('MISSING_PASSWORD', 'new_password is required');
+    return (0, onboarding_proxy_1.onboardingProxy)(req, '/api/Onboarding/set-password');
+}

package/dist/api-handlers/onboarding/verify-code.d.ts

@@ -0,0 +1,11 @@
+/**
+ * POST /api/onboarding/verify-code (PAY-2121).
+ *
+ * Body: { onboard_token, code } - token-driven, no session. Thin proxy to the
+ * IdP's POST /api/Onboarding/verify-code, which answers
+ * { success, reset_token, email, client_key } on success (OnboardingDtos.cs
+ * VerifyCodeResponse). reset_token + email are what the set-password step needs
+ * next. The onboard_token IS the auth; there is no session to attach.
+ */
+import { NextRequest } from 'next/server';
+export declare function POST(req: NextRequest): Promise<import("next/server").NextResponse<unknown>>;

package/dist/api-handlers/onboarding/verify-code.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const onboarding_proxy_1 = require("../../lib/onboarding-proxy");
+async function POST(req) {
+    const body = await req.json().catch(() => ({}));
+    const onboardToken = body?.onboard_token;
+    const code = body?.code;
+    if (!onboardToken)
+        return (0, onboarding_proxy_1.onboardingBadRequest)('MISSING_TOKEN', 'onboard_token is required');
+    if (!code)
+        return (0, onboarding_proxy_1.onboardingBadRequest)('MISSING_CODE', 'code is required');
+    return (0, onboarding_proxy_1.onboardingProxy)(req, '/api/Onboarding/verify-code');
+}

package/dist/api-handlers/onboarding/verify-welcome-email.d.ts

@@ -0,0 +1,10 @@
+/**
+ * POST /api/onboarding/verify-welcome-email (PAY-2121).
+ *
+ * Body: { onboard_token } - token-driven, no session. Thin proxy to the IdP's
+ * POST /api/Onboarding/verify-welcome-email, which answers the masked contact
+ * info + expiry the verify card displays. The onboarding page calls this to
+ * render its "check your email / here is what we know" state.
+ */
+import { NextRequest } from 'next/server';
+export declare function POST(req: NextRequest): Promise<import("next/server").NextResponse<unknown>>;

package/dist/api-handlers/onboarding/verify-welcome-email.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const onboarding_proxy_1 = require("../../lib/onboarding-proxy");
+async function POST(req) {
+    const body = await req.json().catch(() => ({}));
+    const onboardToken = body?.onboard_token;
+    if (!onboardToken)
+        return (0, onboarding_proxy_1.onboardingBadRequest)('MISSING_TOKEN', 'onboard_token is required');
+    return (0, onboarding_proxy_1.onboardingProxy)(req, '/api/Onboarding/verify-welcome-email');
+}

package/dist/auth/auth-decision.d.ts

@@ -21,6 +21,8 @@ export interface AuthContext {
         twoFactorComplete: boolean;
     };
     circuitBreakerOpen: boolean;
+    /** PAY-2136: the request is a router prefetch. A prefetch never clears cookies (see isPrefetchRequest). */
+    isPrefetch?: boolean;
 }
 export type AuthAction = {
     type: 'allow';
@@ -34,6 +36,8 @@ export type AuthAction = {
     reason: string;
 };
 /**
- * Main decision function - pure, testable, deterministic
+ * Main decision function - pure, testable, deterministic.
+ * PAY-2136: when `context.isPrefetch` is set, no redirect it returns asks for cookies to be cleared; the
+ * redirect itself is kept, and the next real navigation reaches the same decision and clears then.
  */
 export declare function makeAuthDecision(context: AuthContext): AuthAction;

package/dist/auth/auth-decision.js

@@ -10,9 +10,19 @@ exports.makeAuthDecision = makeAuthDecision;
 const safe_callback_1 = require("./safe-callback");
 const token_log_id_1 = require("../lib/token-log-id");
 /**
- * Main decision function - pure, testable, deterministic
+ * Main decision function - pure, testable, deterministic.
+ * PAY-2136: when `context.isPrefetch` is set, no redirect it returns asks for cookies to be cleared; the
+ * redirect itself is kept, and the next real navigation reaches the same decision and clears then.
  */
 function makeAuthDecision(context) {
+    const action = decide(context);
+    if (context.isPrefetch && action.type === 'redirect' && action.clearCookies) {
+        const { clearCookies: _dropped, ...rest } = action;
+        return rest;
+    }
+    return action;
+}
+function decide(context) {
     const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
     // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops.
     // 375656: `pathname` is our own request path rather than an attacker-supplied

package/dist/auth/password-reset-bridge.d.ts

@@ -0,0 +1,70 @@
+/**
+ * PAY-2121: the fragment bridge on `/`.
+ *
+ * The IdP's post-verify redirect for a passwordless account lands on
+ *   ORIGIN/#password_reset_required=true&reset_token=<token>&email=<addr>
+ * - a FRAGMENT, never a query (ProgressiveAuthController.cs:1204-1222). A fresh
+ * @payez/next-mvp app has no fragment handling at all, so the user lands on `/`
+ * and nothing happens; their reset is lost.
+ *
+ * This is the PURE half (data in, data out) so a test can execute it without a
+ * DOM. The client component (PasswordResetBridge) calls it on mount with
+ * `window.location.hash`. The kit's reset surface is the existing
+ * `/account-auth/recovery` page, which reads `?email=` and a reset token - so the
+ * bridge rewrites the fragment into that surface's OWN query shape and navigates
+ * once. It invents no new reset flow.
+ *
+ * CONTRACT:
+ *   '#password_reset_required=true&reset_token=T&email=a%40b.co' -> '/account-auth/recovery?token=T&email=a%40b.co'
+ *   any other fragment (no flag, flag != true, no token) -> null (leave `/` alone)
+ */
+/** The reset surface the bridge hands off to, by its existing path. */
+export declare const RECOVERY_PATH = "/account-auth/recovery";
+/**
+ * PAY-2121 (BAPert 70576): the recovery page's ENTRY decision, as a pure function.
+ *
+ * The bridge now sends a VERIFIED passwordless user to
+ *   /account-auth/recovery?token=<reset_token>&email=<addr>
+ * with a REAL reset token in hand. If the page then showed its request-a-code
+ * step, it would throw that token away and the flow would still dead-end - just
+ * one page later. So when a token is present the page must start at the
+ * set-password step and submit straight through resetPasswordWithToken.
+ *
+ *   token present      -> { step: 'set-password', resetToken: <token> }
+ *   no token           -> { step: 'initiate',    resetToken: null }   (today's behaviour)
+ */
+export declare function recoveryEntry(token: string | null | undefined, email: string | null | undefined): {
+    step: 'set-password' | 'initiate';
+    resetToken: string | null;
+    email: string;
+};
+/**
+ * PAY-2121 (BAPert 70582): the set-password SUBMIT precondition, as a pure
+ * function. The old guard was `if (!passwordResetToken || !recoverySession) return;`.
+ * Removing the session half (so a deep-linked reset can submit) must NOT let a
+ * submit with NO token reach the API carrying an empty token - which is exactly
+ * what a guard-less submit would do. This decides it, in one testable place:
+ *
+ *   resetSubmitTarget(resetToken, sessionEmail, queryEmail):
+ *     - no token (after trim)          -> null   (REFUSE: never call the API with an empty token)
+ *     - token, session email present   -> { token, email: sessionEmail }
+ *     - token, only a query email      -> { token, email: queryEmail }  (the deep-link case)
+ *     - token, but NO email anywhere    -> null   (REFUSE: nothing to reset)
+ *
+ * Returns the exact { token, email } the caller must pass to
+ * accountApi.resetPasswordWithToken, or null to refuse BEFORE any request.
+ */
+export declare function resetSubmitTarget(resetToken: string | null | undefined, sessionEmail: string | null | undefined, queryEmail: string | null | undefined): {
+    token: string;
+    email: string;
+} | null;
+/**
+ * The redirect the fragment asks for, or null when the fragment is not a reset
+ * request. `hash` is `window.location.hash` (leading '#' optional).
+ *
+ * Returns null - leaves `/` untouched - when:
+ *   - the fragment is empty;
+ *   - `password_reset_required` is absent or not exactly 'true';
+ *   - no `reset_token` is present (nothing to reset with; not a real link).
+ */
+export declare function passwordResetRedirect(hash: string | null | undefined): string | null;

package/dist/auth/password-reset-bridge.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * PAY-2121: the fragment bridge on `/`.
+ *
+ * The IdP's post-verify redirect for a passwordless account lands on
+ *   ORIGIN/#password_reset_required=true&reset_token=<token>&email=<addr>
+ * - a FRAGMENT, never a query (ProgressiveAuthController.cs:1204-1222). A fresh
+ * @payez/next-mvp app has no fragment handling at all, so the user lands on `/`
+ * and nothing happens; their reset is lost.
+ *
+ * This is the PURE half (data in, data out) so a test can execute it without a
+ * DOM. The client component (PasswordResetBridge) calls it on mount with
+ * `window.location.hash`. The kit's reset surface is the existing
+ * `/account-auth/recovery` page, which reads `?email=` and a reset token - so the
+ * bridge rewrites the fragment into that surface's OWN query shape and navigates
+ * once. It invents no new reset flow.
+ *
+ * CONTRACT:
+ *   '#password_reset_required=true&reset_token=T&email=a%40b.co' -> '/account-auth/recovery?token=T&email=a%40b.co'
+ *   any other fragment (no flag, flag != true, no token) -> null (leave `/` alone)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECOVERY_PATH = void 0;
+exports.recoveryEntry = recoveryEntry;
+exports.resetSubmitTarget = resetSubmitTarget;
+exports.passwordResetRedirect = passwordResetRedirect;
+/** The reset surface the bridge hands off to, by its existing path. */
+exports.RECOVERY_PATH = '/account-auth/recovery';
+/**
+ * PAY-2121 (BAPert 70576): the recovery page's ENTRY decision, as a pure function.
+ *
+ * The bridge now sends a VERIFIED passwordless user to
+ *   /account-auth/recovery?token=<reset_token>&email=<addr>
+ * with a REAL reset token in hand. If the page then showed its request-a-code
+ * step, it would throw that token away and the flow would still dead-end - just
+ * one page later. So when a token is present the page must start at the
+ * set-password step and submit straight through resetPasswordWithToken.
+ *
+ *   token present      -> { step: 'set-password', resetToken: <token> }
+ *   no token           -> { step: 'initiate',    resetToken: null }   (today's behaviour)
+ */
+function recoveryEntry(token, email) {
+    const tok = (token ?? '').trim();
+    return {
+        step: tok ? 'set-password' : 'initiate',
+        resetToken: tok || null,
+        email: (email ?? '').trim(),
+    };
+}
+/**
+ * PAY-2121 (BAPert 70582): the set-password SUBMIT precondition, as a pure
+ * function. The old guard was `if (!passwordResetToken || !recoverySession) return;`.
+ * Removing the session half (so a deep-linked reset can submit) must NOT let a
+ * submit with NO token reach the API carrying an empty token - which is exactly
+ * what a guard-less submit would do. This decides it, in one testable place:
+ *
+ *   resetSubmitTarget(resetToken, sessionEmail, queryEmail):
+ *     - no token (after trim)          -> null   (REFUSE: never call the API with an empty token)
+ *     - token, session email present   -> { token, email: sessionEmail }
+ *     - token, only a query email      -> { token, email: queryEmail }  (the deep-link case)
+ *     - token, but NO email anywhere    -> null   (REFUSE: nothing to reset)
+ *
+ * Returns the exact { token, email } the caller must pass to
+ * accountApi.resetPasswordWithToken, or null to refuse BEFORE any request.
+ */
+function resetSubmitTarget(resetToken, sessionEmail, queryEmail) {
+    const tok = (resetToken ?? '').trim();
+    if (!tok)
+        return null;
+    const email = ((sessionEmail ?? '').trim() || (queryEmail ?? '').trim());
+    if (!email)
+        return null;
+    return { token: tok, email };
+}
+/**
+ * The redirect the fragment asks for, or null when the fragment is not a reset
+ * request. `hash` is `window.location.hash` (leading '#' optional).
+ *
+ * Returns null - leaves `/` untouched - when:
+ *   - the fragment is empty;
+ *   - `password_reset_required` is absent or not exactly 'true';
+ *   - no `reset_token` is present (nothing to reset with; not a real link).
+ */
+function passwordResetRedirect(hash) {
+    const raw = (hash ?? '').replace(/^#/, '');
+    if (!raw)
+        return null;
+    const params = new URLSearchParams(raw);
+    if (params.get('password_reset_required') !== 'true')
+        return null;
+    const token = params.get('reset_token') ?? '';
+    if (!token)
+        return null;
+    const email = params.get('email') ?? '';
+    const qs = new URLSearchParams({ token });
+    if (email)
+        qs.set('email', email);
+    return `${exports.RECOVERY_PATH}?${qs.toString()}`;
+}

package/dist/auth/route-config.js

@@ -46,6 +46,23 @@ const defaultUnauthenticatedRoutes = [
         allowDuringCircuitBreakerOpen: true,
         requiresRateLimit: false
     },
+    // PAY-2121: the IdP emails an invite link to /account-auth/onboarding and a
+    // post-verify reset FRAGMENT on '/'. Both must be reachable unauthenticated -
+    // the invitee has no session (the onboard_token IS the credential), and the
+    // fragment lands on the already-public root. Listed explicitly, not left to
+    // the /account-auth/* wildcard, so the two conventional paths are visible here.
+    {
+        pattern: '/account-auth/onboarding',
+        description: 'IdP invite/onboarding landing page (token-driven, no session)',
+        allowDuringCircuitBreakerOpen: true,
+        requiresRateLimit: false
+    },
+    {
+        pattern: '/api/onboarding/*',
+        description: 'Onboarding API (token-driven, no session)',
+        allowDuringCircuitBreakerOpen: true,
+        requiresRateLimit: true
+    },
     {
         pattern: '/api/auth/*',
         description: 'Authentication API endpoints',

package/dist/components/auth/PasswordResetBridge.d.ts

@@ -0,0 +1,17 @@
+/**
+ * PAY-2121: mount this once on your app's `/` page. When the IdP's post-verify
+ * redirect lands on `/#password_reset_required=true&reset_token=<t>&email=<e>`
+ * (a FRAGMENT), this performs ONE replace to the kit's reset surface and clears
+ * the hash. With any other fragment it renders nothing and leaves `/` alone.
+ *
+ * It renders nothing and reads no user data - it only inspects the fragment.
+ *
+ * @example
+ * // app/page.tsx
+ * import { PasswordResetBridge } from '@payez/next-mvp/components/auth/PasswordResetBridge';
+ * export default function Home() {
+ *   return (&lt;&gt;&lt;PasswordResetBridge /&gt;&lt;/&gt;);
+ * }
+ */
+export declare function PasswordResetBridge(): null;
+export default PasswordResetBridge;

package/dist/components/auth/PasswordResetBridge.js

@@ -0,0 +1,32 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordResetBridge = PasswordResetBridge;
+const react_1 = require("react");
+const password_reset_bridge_1 = require("../../auth/password-reset-bridge");
+/**
+ * PAY-2121: mount this once on your app's `/` page. When the IdP's post-verify
+ * redirect lands on `/#password_reset_required=true&reset_token=<t>&email=<e>`
+ * (a FRAGMENT), this performs ONE replace to the kit's reset surface and clears
+ * the hash. With any other fragment it renders nothing and leaves `/` alone.
+ *
+ * It renders nothing and reads no user data - it only inspects the fragment.
+ *
+ * @example
+ * // app/page.tsx
+ * import { PasswordResetBridge } from '@payez/next-mvp/components/auth/PasswordResetBridge';
+ * export default function Home() {
+ *   return (&lt;&gt;&lt;PasswordResetBridge /&gt;&lt;/&gt;);
+ * }
+ */
+function PasswordResetBridge() {
+    (0, react_1.useEffect)(() => {
+        if (typeof window === 'undefined')
+            return;
+        const target = (0, password_reset_bridge_1.passwordResetRedirect)(window.location.hash);
+        if (target)
+            window.location.replace(target);
+    }, []);
+    return null;
+}
+exports.default = PasswordResetBridge;

package/dist/edge/middleware.d.ts

@@ -7,7 +7,7 @@
 export { makeAuthDecision } from '../auth/auth-decision';
 export { isUnauthenticatedRoute, configurePublicRoutes, getRouteConfig, configure2FABypassRoutes, should2FABypass, get2FABypassConfig } from '../auth/route-config';
 export type { UnauthenticatedRouteConfig, ProtectedRouteConfig } from '../auth/route-config';
-export { createMvpMiddleware } from '../middleware/create-middleware';
+export { createMvpMiddleware, isPrefetchRequest } from '../middleware/create-middleware';
 export type { MvpMiddlewareOptions, CircuitBreakerProvider, MiddlewareLogger, AuthContext, AuthAction, SessionPointer, SessionStatus } from '../middleware/create-middleware';
 export { TwoFactorPresets, AMRValues, ACRLevels, validateAMR, validateACR, checkTwoFactorRequirements } from '../middleware/twofa-presets';
 export type { TwoFactorRequirements, RouteConfig } from '../middleware/twofa-presets';

package/dist/edge/middleware.js

@@ -6,7 +6,7 @@
  * Client-side utilities that depend on browser APIs or server-only code are excluded.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getInternalApiUrl = exports.checkTwoFactorRequirements = exports.validateACR = exports.validateAMR = exports.ACRLevels = exports.AMRValues = exports.TwoFactorPresets = exports.createMvpMiddleware = exports.get2FABypassConfig = exports.should2FABypass = exports.configure2FABypassRoutes = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = void 0;
+exports.getInternalApiUrl = exports.checkTwoFactorRequirements = exports.validateACR = exports.validateAMR = exports.ACRLevels = exports.AMRValues = exports.TwoFactorPresets = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.get2FABypassConfig = exports.should2FABypass = exports.configure2FABypassRoutes = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = void 0;
 // Authentication middleware and configuration (Edge Runtime compatible)
 var auth_decision_1 = require("../auth/auth-decision");
 Object.defineProperty(exports, "makeAuthDecision", { enumerable: true, get: function () { return auth_decision_1.makeAuthDecision; } });
@@ -19,6 +19,7 @@ Object.defineProperty(exports, "should2FABypass", { enumerable: true, get: funct
 Object.defineProperty(exports, "get2FABypassConfig", { enumerable: true, get: function () { return route_config_1.get2FABypassConfig; } });
 var create_middleware_1 = require("../middleware/create-middleware");
 Object.defineProperty(exports, "createMvpMiddleware", { enumerable: true, get: function () { return create_middleware_1.createMvpMiddleware; } });
+Object.defineProperty(exports, "isPrefetchRequest", { enumerable: true, get: function () { return create_middleware_1.isPrefetchRequest; } });
 // Two-Factor Authentication Presets (Edge Runtime compatible)
 var twofa_presets_1 = require("../middleware/twofa-presets");
 Object.defineProperty(exports, "TwoFactorPresets", { enumerable: true, get: function () { return twofa_presets_1.TwoFactorPresets; } });

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export type { AuthConfig } from './types/auth';
 export { makeAuthDecision } from './auth/auth-decision';
 export { isUnauthenticatedRoute, configurePublicRoutes, getRouteConfig } from './auth/route-config';
 export { safeCallbackPath, isSafeCallbackPath, resolveCallbackDestination, DEFAULT_CALLBACK } from './auth/safe-callback';
-export { createMvpMiddleware } from './middleware/create-middleware';
+export { createMvpMiddleware, isPrefetchRequest } from './middleware/create-middleware';
 export { UserAvatarMenu, MobileNavDrawer } from './components/account';
 export type { UserAvatarMenuProps, MobileNavDrawerProps, NavItem, NavSection } from './components/account';
 export { ErrorMetricsCard, HealthMetricsCard, AuditLogViewer, AdminAnalyticsLayout, useErrorMetrics, useHealthMetrics, useAuditLog, useAdminAnalytics, getErrorMetrics, getHealthMetrics, writeAuditLog, queryAuditLog, } from './logging';

package/dist/index.js

@@ -8,7 +8,7 @@
 // - Better Auth: import { createBetterAuthInstance } from '@payez/next-mvp/auth/better-auth'
 // - Server auth: import { getSession } from '@payez/next-mvp/server/auth'
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.queryAuditLog = exports.writeAuditLog = exports.getHealthMetrics = exports.getErrorMetrics = exports.useAdminAnalytics = exports.useAuditLog = exports.useHealthMetrics = exports.useErrorMetrics = exports.AdminAnalyticsLayout = exports.AuditLogViewer = exports.HealthMetricsCard = exports.ErrorMetricsCard = exports.MobileNavDrawer = exports.UserAvatarMenu = exports.createMvpMiddleware = exports.DEFAULT_CALLBACK = exports.resolveCallbackDestination = exports.isSafeCallbackPath = exports.safeCallbackPath = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = exports.useTraditionalAuthEnabled = exports.useFederatedAuthEnabled = exports.useFederatedProviders = exports.useAuthMode = exports.useAuthConfig = exports.AuthProvider = exports.useAnonSession = exports.fetchWithAuth = void 0;
+exports.queryAuditLog = exports.writeAuditLog = exports.getHealthMetrics = exports.getErrorMetrics = exports.useAdminAnalytics = exports.useAuditLog = exports.useHealthMetrics = exports.useErrorMetrics = exports.AdminAnalyticsLayout = exports.AuditLogViewer = exports.HealthMetricsCard = exports.ErrorMetricsCard = exports.MobileNavDrawer = exports.UserAvatarMenu = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.DEFAULT_CALLBACK = exports.resolveCallbackDestination = exports.isSafeCallbackPath = exports.safeCallbackPath = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = exports.useTraditionalAuthEnabled = exports.useFederatedAuthEnabled = exports.useFederatedProviders = exports.useAuthMode = exports.useAuthConfig = exports.AuthProvider = exports.useAnonSession = exports.fetchWithAuth = void 0;
 // Client-safe exports only
 // Client-side utilities
 var fetch_with_auth_1 = require("./client/fetch-with-auth");
@@ -40,6 +40,7 @@ Object.defineProperty(exports, "resolveCallbackDestination", { enumerable: true,
 Object.defineProperty(exports, "DEFAULT_CALLBACK", { enumerable: true, get: function () { return safe_callback_1.DEFAULT_CALLBACK; } });
 var create_middleware_1 = require("./middleware/create-middleware");
 Object.defineProperty(exports, "createMvpMiddleware", { enumerable: true, get: function () { return create_middleware_1.createMvpMiddleware; } });
+Object.defineProperty(exports, "isPrefetchRequest", { enumerable: true, get: function () { return create_middleware_1.isPrefetchRequest; } });
 // Account Components
 var account_1 = require("./components/account");
 Object.defineProperty(exports, "UserAvatarMenu", { enumerable: true, get: function () { return account_1.UserAvatarMenu; } });

package/dist/lib/onboarding-proxy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * PAY-2121: shared anonymous IDP proxy for the /api/onboarding/* handlers.
+ *
+ * The onboarding flow is TOKEN-DRIVEN: the invitee has no account or session
+ * yet, and the onboard_token IS the credential. So these calls must NOT go
+ * through idpFetchJSON (which injects a Bearer from a Redis session) - there is
+ * no session. They are plain server-to-server POSTs to the IdP, exactly as the
+ * VibeID portal's hand-built /api/onboarding/* routes do (card 182611).
+ *
+ * WHY A SERVER ROUTE AT ALL, AND NOT A BROWSER CALL: the IdP URL is not exposed
+ * to the browser, and the route is the one place that owns that. The token is
+ * forwarded, never the IdP's host.
+ */
+import { NextRequest, NextResponse } from 'next/server';
+/** A typed refusal in the kit's error envelope - used for a missing field, BEFORE any IdP call. */
+export declare function onboardingBadRequest(code: string, message: string): NextResponse<{
+    success: boolean;
+    message: string;
+    error: {
+        code: string;
+    };
+}>;
+/**
+ * POST a JSON body to `{IDP_URL}{idpPath}` with no credentials, and relay the
+ * IdP's status and body verbatim (the page acts on what the IdP actually
+ * returns, not on a shape this layer guesses). Never relays the IdP error TEXT
+ * for a non-2xx is NOT done here: the onboarding endpoints answer structured
+ * envelopes the page reads; the page owns the copy.
+ */
+export declare function onboardingProxy(req: NextRequest, idpPath: string): Promise<NextResponse>;

package/dist/lib/onboarding-proxy.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.onboardingBadRequest = onboardingBadRequest;
+exports.onboardingProxy = onboardingProxy;
+/**
+ * PAY-2121: shared anonymous IDP proxy for the /api/onboarding/* handlers.
+ *
+ * The onboarding flow is TOKEN-DRIVEN: the invitee has no account or session
+ * yet, and the onboard_token IS the credential. So these calls must NOT go
+ * through idpFetchJSON (which injects a Bearer from a Redis session) - there is
+ * no session. They are plain server-to-server POSTs to the IdP, exactly as the
+ * VibeID portal's hand-built /api/onboarding/* routes do (card 182611).
+ *
+ * WHY A SERVER ROUTE AT ALL, AND NOT A BROWSER CALL: the IdP URL is not exposed
+ * to the browser, and the route is the one place that owns that. The token is
+ * forwarded, never the IdP's host.
+ */
+const server_1 = require("next/server");
+const env_1 = require("../config/env");
+const idp_url_guard_1 = require("./idp-url-guard");
+/** A typed refusal in the kit's error envelope - used for a missing field, BEFORE any IdP call. */
+function onboardingBadRequest(code, message) {
+    return server_1.NextResponse.json({ success: false, message, error: { code } }, { status: 400 });
+}
+/**
+ * POST a JSON body to `{IDP_URL}{idpPath}` with no credentials, and relay the
+ * IdP's status and body verbatim (the page acts on what the IdP actually
+ * returns, not on a shape this layer guesses). Never relays the IdP error TEXT
+ * for a non-2xx is NOT done here: the onboarding endpoints answer structured
+ * envelopes the page reads; the page owns the copy.
+ */
+async function onboardingProxy(req, idpPath) {
+    const idpBase = env_1.ENV_CONFIG.IDP_URL;
+    if (!idpBase) {
+        return server_1.NextResponse.json({ success: false, message: 'IDP_URL is not configured', error: { code: 'NO_IDP_URL' } }, { status: 500 });
+    }
+    const url = `${idpBase}${idpPath}`;
+    (0, idp_url_guard_1.assertAbsoluteIdpUrl)(url);
+    let bodyText = '{}';
+    try {
+        const raw = await req.text();
+        if (raw && raw.trim().length > 0)
+            bodyText = raw;
+    }
+    catch { /* empty body is fine */ }
+    const headers = { 'Content-Type': 'application/json', Accept: 'application/json' };
+    const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
+    if (xfwd)
+        headers['X-Forwarded-For'] = xfwd;
+    const ua = req.headers.get('user-agent');
+    if (ua)
+        headers['User-Agent'] = ua;
+    let res;
+    try {
+        res = await fetch(url, { method: 'POST', headers, body: bodyText, cache: 'no-store' });
+    }
+    catch {
+        return server_1.NextResponse.json({ success: false, message: 'The identity service is unreachable.', error: { code: 'UPSTREAM_UNREACHABLE' } }, { status: 502 });
+    }
+    const json = await res.json().catch(() => null);
+    return server_1.NextResponse.json(json ?? { success: res.ok }, { status: res.status });
+}

package/dist/lib/session-store.d.ts

@@ -218,3 +218,20 @@ export declare function isRefreshInProgress(sessionToken: string): Promise<boole
  * Force cleanup of expired or orphaned refresh locks
  */
 export declare function cleanupRefreshLocks(): Promise<number>;
+/**
+ * PAY-2136 DIAGNOSTIC (BAPert 70873): which of the session keys EXIST for a token, right now.
+ *
+ * Names/presence only - this returns booleans and the key PREFIX (an app slug, not a secret), never a value and
+ * never any part of the token. It exists so a NO_SESSION can be read for what it was: canonical row gone with the
+ * ba: record alive (the :330 asymmetry), both gone (expired/deleted), or the store could not be asked ('error').
+ *
+ * EXISTS, not GET: it cannot parse, cannot throw on a malformed blob, and cannot return a credential. Each key is
+ * asked separately so one timeout does not hide the other two. Never throws.
+ */
+export type KeyPresence = boolean | 'error';
+export declare function describeSessionKeyPresence(sessionToken: string): Promise<{
+    prefix: string;
+    canonical: KeyPresence;
+    ba: KeyPresence;
+    ver: KeyPresence;
+}>;