@payez/next-mvp 4.4.9 → 4.5.1

package/dist/lib/session-store.js

@@ -37,6 +37,7 @@ exports.releaseRefreshLock = releaseRefreshLock;
 exports.checkRefreshLock = checkRefreshLock;
 exports.isRefreshInProgress = isRefreshInProgress;
 exports.cleanupRefreshLocks = cleanupRefreshLocks;
+exports.describeSessionKeyPresence = describeSessionKeyPresence;
 const redis_1 = __importDefault(require("./redis"));
 const crypto_1 = require("crypto");
 const app_slug_1 = require("./app-slug");
@@ -927,3 +928,35 @@ async function cleanupRefreshLocks() {
     console.warn('[SESSION-STORE] cleanupRefreshLocks called - scanning for expired locks');
     return 0;
 }
+async function describeSessionKeyPresence(sessionToken) {
+    const ask = async (key) => {
+        try {
+            return (await redis_1.default.exists(key)) > 0;
+        }
+        catch {
+            return 'error';
+        }
+    };
+    let prefix = '';
+    try {
+        prefix = (0, app_slug_1.getSessionPrefix)();
+    }
+    catch {
+        prefix = '';
+    }
+    if (!sessionToken)
+        return { prefix, canonical: false, ba: false, ver: false };
+    let canonicalKey = '';
+    let baKey = '';
+    let verKey = '';
+    try {
+        canonicalKey = getSessionKey(sessionToken);
+        baKey = getBetterAuthSessionKey(sessionToken, (0, app_slug_1.getAppSlug)());
+        verKey = getSessionVersionKey(sessionToken);
+    }
+    catch {
+        return { prefix, canonical: 'error', ba: 'error', ver: 'error' };
+    }
+    const [canonical, ba, ver] = await Promise.all([ask(canonicalKey), ask(baKey), ask(verKey)]);
+    return { prefix, canonical, ba, ver };
+}

package/dist/middleware/create-middleware.d.ts

@@ -124,6 +124,16 @@ export interface MvpMiddlewareOptions {
      */
     revocationFailMode?: 'closed' | 'open';
 }
+/**
+ * PAY-2136 Rule A: a speculative request (router prefetch) must NEVER mutate cookies.
+ * A prefetch of /account/security was answered 307 + Set-Cookie (session cookies expired), the browser
+ * applied it, and the user's next real request (e.g. Approve) was signed out. Detected by any of:
+ * `Next-Router-Prefetch: 1|2` (Next sets it on EVERY Link prefetch; 2 = runtime prefetch) or `Sec-Purpose`/`Purpose`
+ * containing "prefetch".
+ * NOT `RSC: 1` + `_rsc`: a real client-side navigation carries both too (Nextpert-Scout 70976), so that shape
+ * would swallow in-app navigations and stop the middleware refreshing/clearing for them.
+ */
+export declare function isPrefetchRequest(request: NextRequest): boolean;
 /** Login error code for a pre-2FA session that expired before the code was verified (PAY-884). */
 export declare const TWO_FACTOR_TIMEOUT_ERROR = "TwoFactorTimeout";
 export declare function createMvpMiddleware(options?: MvpMiddlewareOptions): (request: NextRequest) => Promise<NextResponse>;

package/dist/middleware/create-middleware.js

@@ -19,6 +19,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TWO_FACTOR_TIMEOUT_ERROR = void 0;
+exports.isPrefetchRequest = isPrefetchRequest;
 exports.createMvpMiddleware = createMvpMiddleware;
 exports.decideForceInvalid = decideForceInvalid;
 const server_1 = require("next/server");
@@ -78,8 +79,32 @@ function isLoginPage(pathname) {
 function getSafeCallbackUrl(pathname, searchParams) {
     return (0, safe_callback_1.resolveCallbackDestination)(pathname, searchParams);
 }
-/** Clear all session cookies on a response */
+/**
+ * PAY-2136 Rule A: a speculative request (router prefetch) must NEVER mutate cookies.
+ * A prefetch of /account/security was answered 307 + Set-Cookie (session cookies expired), the browser
+ * applied it, and the user's next real request (e.g. Approve) was signed out. Detected by any of:
+ * `Next-Router-Prefetch: 1|2` (Next sets it on EVERY Link prefetch; 2 = runtime prefetch) or `Sec-Purpose`/`Purpose`
+ * containing "prefetch".
+ * NOT `RSC: 1` + `_rsc`: a real client-side navigation carries both too (Nextpert-Scout 70976), so that shape
+ * would swallow in-app navigations and stop the middleware refreshing/clearing for them.
+ */
+function isPrefetchRequest(request) {
+    const h = request.headers;
+    const nrp = h.get('next-router-prefetch');
+    if (nrp === '1' || nrp === '2')
+        return true;
+    if (/prefetch/i.test(h.get('sec-purpose') ?? '') || /prefetch/i.test(h.get('purpose') ?? ''))
+        return true;
+    return false;
+}
+/**
+ * Clear all session cookies on a response. The ONE site that writes the expiry Set-Cookie for the middleware,
+ * so the prefetch guard lives here: on a prefetch the redirect is still returned (routing unchanged) but
+ * carries no Set-Cookie; the next real navigation reaches the same decision and clears then.
+ */
 function clearSessionCookies(response, request) {
+    if (isPrefetchRequest(request))
+        return;
     const sessionCookie = (0, app_slug_1.getSessionCookieName)();
     const secureCookie = (0, app_slug_1.getSecureSessionCookieName)();
     // Clear main cookies
@@ -546,6 +571,10 @@ async function executeDecision(request, decision, pathname, sessionPointer, sess
         case 'service_error':
             return server_1.NextResponse.redirect(new URL('/service-unavailable', request.url));
         case 'refresh_needed':
+            // PAY-2136: a speculative request must not spend (rotate) a single-use refresh token or, on a 401/403,
+            // clear the session. Let it through; the real navigation refreshes.
+            if (isPrefetchRequest(request))
+                return server_1.NextResponse.next();
             return handleRefresh(request, safeCallback, opts);
     }
 }

package/dist/pages/login/page.js

@@ -206,7 +206,7 @@ function LoginForm({ altAuthSlot }) {
         .themed-status-submitting svg {
           color: ${buttonColor} !important;
         }
-      ` } }), (0, jsx_runtime_1.jsx)("div", { className: `min-h-screen flex items-center justify-center px-4 ${colors.background}`, children: (0, jsx_runtime_1.jsxs)("div", { className: "max-w-md w-full", children: [(0, jsx_runtime_1.jsxs)("div", { className: `rounded-2xl shadow-xl p-8 ${colors.card} ${colors.border} text-gray-800`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "text-center mb-8", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-3xl font-bold mb-2", style: { color: 'inherit' }, children: branding.tagline || 'Welcome Back' }), (0, jsx_runtime_1.jsx)("p", { className: colors.muted, children: "Sign in to your account" })] }), googleEnabled && ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => void handleGoogleSignIn(), disabled: googleLoading || isSubmitting, "data-testid": "google-sign-in", className: "w-full px-4 py-3 mb-6 rounded-lg border border-gray-300 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed hover:bg-gray-50", style: { backgroundColor: 'white', color: '#1f2937' }, children: [googleLoading ? ((0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin w-5 h-5", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] })) : ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })), googleLoading ? 'Redirecting to Google…' : 'Continue with Google'] }) })), altAuthSlot && (0, jsx_runtime_1.jsx)("div", { className: "mt-4", children: altAuthSlot }), (0, jsx_runtime_1.jsx)("div", { className: `mt-6 text-center text-sm ${colors.muted}`, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "themed-link hover:underline", children: "Start account recovery" }) })] }), (0, jsx_runtime_1.jsxs)("p", { className: `mt-4 text-center text-sm ${colors.muted}`, children: ["Don't have an account?", ' ', (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/register", className: "themed-link font-medium hover:underline", children: "Sign up" })] })] }) })] }));
+      ` } }), (0, jsx_runtime_1.jsx)("div", { className: `min-h-screen flex items-center justify-center px-4 ${colors.background}`, children: (0, jsx_runtime_1.jsx)("div", { className: "max-w-md w-full", children: (0, jsx_runtime_1.jsxs)("div", { className: `rounded-2xl shadow-xl p-8 ${colors.card} ${colors.border} text-gray-800`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "text-center mb-8", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-3xl font-bold mb-2", style: { color: 'inherit' }, children: branding.tagline || 'Welcome Back' }), (0, jsx_runtime_1.jsx)("p", { className: colors.muted, children: "Sign in to your account" })] }), googleEnabled && ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => void handleGoogleSignIn(), disabled: googleLoading || isSubmitting, "data-testid": "google-sign-in", className: "w-full px-4 py-3 mb-6 rounded-lg border border-gray-300 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed hover:bg-gray-50", style: { backgroundColor: 'white', color: '#1f2937' }, children: [googleLoading ? ((0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin w-5 h-5", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] })) : ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })), googleLoading ? 'Redirecting to Google…' : 'Continue with Google'] }) })), altAuthSlot && (0, jsx_runtime_1.jsx)("div", { className: "mt-4", children: altAuthSlot }), (0, jsx_runtime_1.jsx)("div", { className: `mt-6 text-center text-sm ${colors.muted}`, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "themed-link hover:underline", children: "Start account recovery" }) })] }) }) })] }));
 }
 function LoginPageFallback() {
     const colors = (0, useTheme_1.useColors)();

package/dist/pages/onboarding/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * PAY-2121: the onboarding surface.
+ *
+ *   default     - the /account-auth/onboarding page (mount from the scaffold at
+ *                 app/account-auth/onboarding/page.tsx).
+ *   PasswordResetBridge - mount once on `/` to honour the IdP's post-verify
+ *                 `#password_reset_required=true` fragment.
+ */
+export { default } from './page';
+export { default as OnboardingPage } from './page';
+export { PasswordResetBridge } from '../../components/auth/PasswordResetBridge';

package/dist/pages/onboarding/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordResetBridge = exports.OnboardingPage = exports.default = void 0;
+/**
+ * PAY-2121: the onboarding surface.
+ *
+ *   default     - the /account-auth/onboarding page (mount from the scaffold at
+ *                 app/account-auth/onboarding/page.tsx).
+ *   PasswordResetBridge - mount once on `/` to honour the IdP's post-verify
+ *                 `#password_reset_required=true` fragment.
+ */
+var page_1 = require("./page");
+Object.defineProperty(exports, "default", { enumerable: true, get: function () { return __importDefault(page_1).default; } });
+var page_2 = require("./page");
+Object.defineProperty(exports, "OnboardingPage", { enumerable: true, get: function () { return __importDefault(page_2).default; } });
+var PasswordResetBridge_1 = require("../../components/auth/PasswordResetBridge");
+Object.defineProperty(exports, "PasswordResetBridge", { enumerable: true, get: function () { return PasswordResetBridge_1.PasswordResetBridge; } });

package/dist/pages/onboarding/page.d.ts

@@ -0,0 +1 @@
+export default function OnboardingPage(): import("react/jsx-runtime").JSX.Element;

package/dist/pages/onboarding/page.js

@@ -0,0 +1,118 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = OnboardingPage;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const navigation_1 = require("next/navigation");
+const H = { primary: 'var(--text-primary)', secondary: 'var(--text-secondary)', muted: 'var(--text-muted)' };
+function OnboardingContent() {
+    const params = (0, navigation_1.useSearchParams)();
+    const onboardToken = params?.get('onboard_token') ?? '';
+    const [step, setStep] = (0, react_1.useState)('code');
+    const [maskedEmail, setMaskedEmail] = (0, react_1.useState)(null);
+    const [digits, setDigits] = (0, react_1.useState)('');
+    const [password, setPassword] = (0, react_1.useState)('');
+    const [confirm, setConfirm] = (0, react_1.useState)('');
+    const [resetToken, setResetToken] = (0, react_1.useState)('');
+    const [email, setEmail] = (0, react_1.useState)('');
+    const [busy, setBusy] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    // Step 1: tell the invitee which address the code went to (masked). Best
+    // effort - a failure here does not block entering a code they were emailed.
+    (0, react_1.useEffect)(() => {
+        if (!onboardToken)
+            return;
+        let alive = true;
+        (async () => {
+            try {
+                const res = await fetch('/api/onboarding/verify-welcome-email', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ onboard_token: onboardToken }),
+                });
+                const body = await res.json().catch(() => null);
+                const data = body?.data?.data || body?.data || {};
+                const masked = data?.masked_user_info?.masked_email || data?.masked_email;
+                if (alive && typeof masked === 'string' && masked)
+                    setMaskedEmail(masked);
+            }
+            catch { /* non-fatal */ }
+        })();
+        return () => { alive = false; };
+    }, [onboardToken]);
+    if (!onboardToken) {
+        return ((0, jsx_runtime_1.jsxs)(Shell, { children: [(0, jsx_runtime_1.jsx)("h1", { style: titleStyle, children: "This invitation link is missing its token." }), (0, jsx_runtime_1.jsx)("p", { style: { color: H.secondary, fontSize: 14, marginTop: 8 }, children: "The link may have been truncated or copied incompletely. Ask for a new invitation, or sign in if you already have an account." }), (0, jsx_runtime_1.jsx)("p", { style: { marginTop: 16 }, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/login", style: linkStyle, children: "Go to sign in" }) })] }));
+    }
+    async function submitCode(e) {
+        e.preventDefault();
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await fetch('/api/onboarding/verify-code', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ onboard_token: onboardToken, code: digits }),
+            });
+            const body = await res.json().catch(() => null);
+            const data = body?.data?.data || body?.data || body;
+            if (!res.ok || !data?.reset_token || !data?.email)
+                throw new Error();
+            setResetToken(data.reset_token);
+            setEmail(data.email);
+            setStep('password');
+        }
+        catch {
+            setError('That code was not accepted. Check it and try again.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    async function submitPassword(e) {
+        e.preventDefault();
+        if (password !== confirm) {
+            setError('The two passwords do not match.');
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await fetch('/api/onboarding/set-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ onboard_token: onboardToken, email, reset_token: resetToken, new_password: password }),
+            });
+            const body = await res.json().catch(() => null);
+            if (!res.ok || (body && body.success === false))
+                throw new Error(body?.message || '');
+            setStep('done');
+        }
+        catch (err) {
+            setError(err instanceof Error && err.message ? err.message : 'We could not set that password. Try again.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    return ((0, jsx_runtime_1.jsxs)(Shell, { children: [step === 'code' && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h1", { style: titleStyle, children: "Finish setting up your account" }), (0, jsx_runtime_1.jsx)("p", { style: { color: H.secondary, fontSize: 14, marginTop: 8 }, children: maskedEmail
+                            ? `We emailed a 6-digit code to ${maskedEmail}. Enter it below.`
+                            : 'Enter the 6-digit code from your invitation email.' }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: submitCode, noValidate: true, style: { marginTop: 16 }, children: [(0, jsx_runtime_1.jsx)("input", { value: digits, onChange: (e) => setDigits(e.target.value.replace(/\D/g, '').slice(0, 6)), inputMode: "numeric", autoComplete: "one-time-code", "aria-label": "6-digit code", placeholder: "000000", style: { ...inputStyle, letterSpacing: 6, textAlign: 'center', fontFamily: 'monospace', fontSize: 20 } }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy || digits.length < 6, style: ctaStyle(busy || digits.length < 6), children: busy ? 'Verifying…' : 'Verify' })] })] })), step === 'password' && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h1", { style: titleStyle, children: "Choose a password" }), (0, jsx_runtime_1.jsx)("p", { style: { color: H.secondary, fontSize: 14, marginTop: 8 }, children: "Set the password you will sign in with." }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: submitPassword, noValidate: true, style: { marginTop: 16 }, children: [(0, jsx_runtime_1.jsx)("input", { type: "password", value: password, onChange: (e) => setPassword(e.target.value), "aria-label": "New password", placeholder: "New password", style: inputStyle }), (0, jsx_runtime_1.jsx)("input", { type: "password", value: confirm, onChange: (e) => setConfirm(e.target.value), "aria-label": "Confirm password", placeholder: "Confirm password", style: { ...inputStyle, marginTop: 10 } }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy || !password || !confirm, style: ctaStyle(busy || !password || !confirm), children: busy ? 'Saving…' : 'Set password' })] })] })), step === 'done' && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h1", { style: titleStyle, children: "You're all set." }), (0, jsx_runtime_1.jsx)("p", { style: { color: H.secondary, fontSize: 14, marginTop: 8 }, children: "Your account is ready. You can sign in now." }), (0, jsx_runtime_1.jsx)("p", { style: { marginTop: 16 }, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/login", style: linkStyle, children: "Go to sign in" }) })] })), error && (0, jsx_runtime_1.jsx)("p", { style: { color: '#b00020', fontSize: 13, marginTop: 12 }, children: error })] }));
+}
+const titleStyle = { color: H.primary, fontSize: 20, fontWeight: 600, margin: 0 };
+const linkStyle = { color: H.primary, fontWeight: 600, textDecoration: 'underline' };
+const inputStyle = {
+    width: '100%', padding: '10px 12px', border: '1px solid var(--border-default, #d1d5db)',
+    borderRadius: 10, color: H.primary, fontSize: 15, background: 'var(--bg-card, #fff)',
+};
+const ctaStyle = (disabled) => ({
+    marginTop: 14, width: '100%', padding: '10px 12px', borderRadius: 10, border: 'none',
+    background: H.primary, color: '#fff', fontWeight: 600, fontSize: 15, cursor: disabled ? 'default' : 'pointer',
+    opacity: disabled ? 0.5 : 1,
+});
+function Shell({ children }) {
+    return ((0, jsx_runtime_1.jsx)("div", { style: { minHeight: '100vh', display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16, background: 'var(--bg-default, #f9fafb)' }, children: (0, jsx_runtime_1.jsx)("div", { style: { width: '100%', maxWidth: 420, background: 'var(--bg-card, #fff)', border: '1px solid var(--border-default, #e5e7eb)', borderRadius: 16, padding: 28 }, children: children }) }));
+}
+function OnboardingPage() {
+    return ((0, jsx_runtime_1.jsx)(react_1.Suspense, { fallback: (0, jsx_runtime_1.jsx)("div", { style: { minHeight: '100vh' } }), children: (0, jsx_runtime_1.jsx)(OnboardingContent, {}) }));
+}

package/dist/pages/recovery/page.js

@@ -6,6 +6,7 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const navigation_1 = require("next/navigation");
 const api_1 = require("../../utils/api");
+const password_reset_bridge_1 = require("../../auth/password-reset-bridge");
 const InitiateRecoveryStep_1 = require("../../components/recovery/InitiateRecoveryStep");
 const SelectMethodStep_1 = require("../../components/recovery/SelectMethodStep");
 const VerifyCodeStep_1 = require("../../components/recovery/VerifyCodeStep");
@@ -16,14 +17,18 @@ const useTheme_1 = require("../../theme/useTheme");
 function RecoveryContent() {
     const router = (0, navigation_1.useRouter)();
     const searchParams = (0, navigation_1.useSearchParams)();
-    const prefilledEmail = searchParams?.get('email') || '';
+    // PAY-2121 (BAPert 70576): a VERIFIED passwordless user arrives here with a real
+    // reset token (?token=) from the IdP's post-verify fragment, via the bridge. In
+    // that case skip the request-a-code step and go straight to set-password - the
+    // token is the credential; asking for a code would throw it away.
+    const entry = (0, password_reset_bridge_1.recoveryEntry)(searchParams?.get('token'), searchParams?.get('email'));
     const colors = (0, useTheme_1.useColors)();
-    const [currentStep, setCurrentStep] = (0, react_1.useState)('initiate');
-    const [email, setEmail] = (0, react_1.useState)(prefilledEmail);
+    const [currentStep, setCurrentStep] = (0, react_1.useState)(entry.step);
+    const [email, setEmail] = (0, react_1.useState)(entry.email);
     const [recoverySession, setRecoverySession] = (0, react_1.useState)(null);
     const [selectedMethod, setSelectedMethod] = (0, react_1.useState)(null);
     const [verificationCode, setVerificationCode] = (0, react_1.useState)('');
-    const [passwordResetToken, setPasswordResetToken] = (0, react_1.useState)(null);
+    const [passwordResetToken, setPasswordResetToken] = (0, react_1.useState)(entry.resetToken ? { token: entry.resetToken, expiresAt: '' } : null);
     const [error, setError] = (0, react_1.useState)(null);
     // PAY-1591: true when the reset failed because the recovery itself is dead; the error box then offers a way back.
     const [recoveryExpired, setRecoveryExpired] = (0, react_1.useState)(false);
@@ -108,13 +113,19 @@ function RecoveryContent() {
         }
     };
     const handleResetPassword = async (password, confirmPassword) => {
-        if (!passwordResetToken || !recoverySession)
+        // PAY-2121 (BAPert 70582): the ONE place that decides whether a submit may proceed.
+        // No token (or no email anywhere) -> refuse BEFORE any request; a guard-less submit
+        // would otherwise call the API with an empty token.
+        const target = (0, password_reset_bridge_1.resetSubmitTarget)(passwordResetToken?.token, recoverySession?.email, email);
+        if (!target) {
+            setError(passwordResetToken ? 'We could not tell which account to reset. Start recovery again.' : 'This reset link is missing its token. Start recovery again.');
             return;
+        }
         setLoading(true);
         setError(null);
         setRecoveryExpired(false);
         try {
-            const response = await api_1.accountApi.resetPasswordWithToken(recoverySession.email, passwordResetToken.token, password, confirmPassword);
+            const response = await api_1.accountApi.resetPasswordWithToken(target.email, target.token, password, confirmPassword);
             if (response.success) {
                 setResetSucceeded(true);
                 setCurrentStep('complete');
@@ -136,8 +147,10 @@ function RecoveryContent() {
             setCurrentStep('initiate');
         else if (currentStep === 'verify-code')
             setCurrentStep('select-method');
+        // PAY-2121: a deep-linked set-password has no verify-code to go back to; return to
+        // the request-code step so a bad token still leaves a way forward.
         else if (currentStep === 'set-password')
-            setCurrentStep('verify-code');
+            setCurrentStep(recoverySession ? 'verify-code' : 'initiate');
     };
     return ((0, jsx_runtime_1.jsx)("div", { className: "w-full flex items-center justify-center p-6", style: { background: 'var(--bg-default)' }, children: (0, jsx_runtime_1.jsxs)("div", { className: "max-w-md w-full", children: [error && ((0, jsx_runtime_1.jsxs)("div", { className: "mb-4 bg-red-50 border border-red-200 rounded-2xl p-3", children: [(0, jsx_runtime_1.jsx)("p", { className: "text-red-700 text-sm", children: error }), recoveryExpired && ((0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "text-sm font-medium underline", children: "Start password recovery again" }))] })), loading && ((0, jsx_runtime_1.jsx)("div", { className: "mb-4 rounded-2xl p-3", style: { background: 'var(--bg-card)', borderColor: 'var(--border-default)' }, children: (0, jsx_runtime_1.jsx)("p", { className: "text-sm", style: { color: 'var(--text-secondary)' }, children: "Processing..." }) })), currentStep === 'initiate' && ((0, jsx_runtime_1.jsx)(InitiateRecoveryStep_1.InitiateRecoveryStep, { email: email, setEmail: setEmail, onSubmit: handleInitiateRecovery, loading: loading })), currentStep === 'select-method' && recoverySession && ((0, jsx_runtime_1.jsx)(SelectMethodStep_1.SelectMethodStep, { session: recoverySession, onSelectMethod: handleSendCode, loading: loading })), currentStep === 'verify-code' && ((0, jsx_runtime_1.jsx)(VerifyCodeStep_1.VerifyCodeStep, { code: verificationCode, setCode: setVerificationCode, onSubmit: handleVerifyCode, onResend: () => selectedMethod && handleSendCode(selectedMethod), loading: loading, maskedDestination: selectedMethod === 'sms'
                         ? recoverySession?.maskedPhone

package/dist/routes/onboarding/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Ready-to-use onboarding route handlers (PAY-2121).
+ *
+ * Import directly into your app's API routes with zero configuration:
+ *
+ * @example
+ * ```typescript
+ * // app/api/onboarding/verify-code/route.ts
+ * export { POST } from '@payez/next-mvp/routes/onboarding/verify-code';
+ * ```
+ */
+export { POST as verifyCodePOST } from '../../api-handlers/onboarding/verify-code';
+export { POST as sendEmailCodePOST } from '../../api-handlers/onboarding/send-email-code';
+export { POST as verifyWelcomeEmailPOST } from '../../api-handlers/onboarding/verify-welcome-email';
+export { POST as setPasswordPOST } from '../../api-handlers/onboarding/set-password';

package/dist/routes/onboarding/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setPasswordPOST = exports.verifyWelcomeEmailPOST = exports.sendEmailCodePOST = exports.verifyCodePOST = void 0;
+/**
+ * Ready-to-use onboarding route handlers (PAY-2121).
+ *
+ * Import directly into your app's API routes with zero configuration:
+ *
+ * @example
+ * ```typescript
+ * // app/api/onboarding/verify-code/route.ts
+ * export { POST } from '@payez/next-mvp/routes/onboarding/verify-code';
+ * ```
+ */
+var verify_code_1 = require("../../api-handlers/onboarding/verify-code");
+Object.defineProperty(exports, "verifyCodePOST", { enumerable: true, get: function () { return verify_code_1.POST; } });
+var send_email_code_1 = require("../../api-handlers/onboarding/send-email-code");
+Object.defineProperty(exports, "sendEmailCodePOST", { enumerable: true, get: function () { return send_email_code_1.POST; } });
+var verify_welcome_email_1 = require("../../api-handlers/onboarding/verify-welcome-email");
+Object.defineProperty(exports, "verifyWelcomeEmailPOST", { enumerable: true, get: function () { return verify_welcome_email_1.POST; } });
+var set_password_1 = require("../../api-handlers/onboarding/set-password");
+Object.defineProperty(exports, "setPasswordPOST", { enumerable: true, get: function () { return set_password_1.POST; } });

package/dist/routes/onboarding/send-email-code.d.ts

@@ -0,0 +1,2 @@
+/** POST /api/onboarding/send-email-code -> IdP (PAY-2121). */
+export { POST } from '../../api-handlers/onboarding/send-email-code';

package/dist/routes/onboarding/send-email-code.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/** POST /api/onboarding/send-email-code -> IdP (PAY-2121). */
+var send_email_code_1 = require("../../api-handlers/onboarding/send-email-code");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return send_email_code_1.POST; } });

package/dist/routes/onboarding/set-password.d.ts

@@ -0,0 +1,2 @@
+/** POST /api/onboarding/set-password -> IdP (PAY-2121). */
+export { POST } from '../../api-handlers/onboarding/set-password';

package/dist/routes/onboarding/set-password.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/** POST /api/onboarding/set-password -> IdP (PAY-2121). */
+var set_password_1 = require("../../api-handlers/onboarding/set-password");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return set_password_1.POST; } });

package/dist/routes/onboarding/verify-code.d.ts

@@ -0,0 +1,2 @@
+/** POST /api/onboarding/verify-code -> IdP (PAY-2121). */
+export { POST } from '../../api-handlers/onboarding/verify-code';

package/dist/routes/onboarding/verify-code.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/** POST /api/onboarding/verify-code -> IdP (PAY-2121). */
+var verify_code_1 = require("../../api-handlers/onboarding/verify-code");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return verify_code_1.POST; } });

package/dist/routes/onboarding/verify-welcome-email.d.ts

@@ -0,0 +1,2 @@
+/** POST /api/onboarding/verify-welcome-email -> IdP (PAY-2121). */
+export { POST } from '../../api-handlers/onboarding/verify-welcome-email';

package/dist/routes/onboarding/verify-welcome-email.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/** POST /api/onboarding/verify-welcome-email -> IdP (PAY-2121). */
+var verify_welcome_email_1 = require("../../api-handlers/onboarding/verify-welcome-email");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return verify_welcome_email_1.POST; } });

package/dist/server/auth.js

@@ -48,6 +48,7 @@ exports.requireSession = requireSession;
 require("server-only");
 const better_auth_1 = require("../auth/better-auth");
 const session_store_1 = require("../lib/session-store");
+const token_log_id_1 = require("../lib/token-log-id");
 const verified_session_token_1 = require("./verified-session-token");
 function buildSessionDataFromAuthSession(session) {
     const user = session?.user;
@@ -138,6 +139,79 @@ function attachSessionData(session, sessionData, sessionToken) {
 async function getAuthInstance() {
     return (0, better_auth_1.getBetterAuthInstance)();
 }
+/* ----------------------------------------------------------------------------------------------------------------
+ * PAY-2136 DIAGNOSTICS (BAPert 70873, Nextpert-Scout 70872/70875) - LOG ONLY, NO BEHAVIOUR CHANGE.
+ *
+ * A getFreshIdpToken NO_SESSION used to carry no origin: three different returns produced the same
+ * `{error:'NO_SESSION'}`, and getSession() swallowed every Redis error into a bare `catch {}`. These helpers name
+ * the origin and make a swallowed read audible. Hard rules: every helper is wrapped so it can NEVER throw or change
+ * a return value; nothing here ever logs a token, a cookie VALUE or a Redis value - only a tokenLogId() fingerprint,
+ * cookie NAMES, booleans, and an error name/message with any long opaque run redacted.
+ * -------------------------------------------------------------------------------------------------------------- */
+/** An error name/message, first 80 chars, with any 24+ char opaque run (a token, a key) replaced. */
+function scrubForLog(v) {
+    const raw = v instanceof Error ? v.message : String(v ?? '');
+    return raw.replace(/[A-Za-z0-9_\-.+/=]{24,}/g, '[redacted]').slice(0, 80);
+}
+/** `catch {}` sites on the session read path: still swallowed, now audible. */
+function logSessionReadSwallowed(path, err) {
+    try {
+        const name = scrubForLog(err instanceof Error ? err.name : typeof err);
+        console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} err=${name} msg=${scrubForLog(err)}`);
+    }
+    catch {
+        /* a diagnostic must never change the outcome */
+    }
+}
+/** Origin a: getSession(request) produced no token. Cookie NAMES only, never a value. */
+function logNoSessionOriginA(request) {
+    try {
+        const header = request?.headers?.get('cookie') ?? '';
+        // Only segments of the form name=value contribute a NAME. A segment with no '=' is not a cookie pair, and
+        // logging it whole could emit a bare token (Nextpert-Scout 70901 finding 1).
+        const cookieNames = header
+            .split(';')
+            // Structural, alphabet-independent (Nextpert-Scout 70945): base64 padding can only sit at the END of a bare
+            // value, so a bare padded token splits as name=<token>, value='' or '='. A real pair has a non-empty value that
+            // is not only '=' characters. (The old includes('=') let 74% of base64url tokens through as a "name".)
+            .filter((c) => {
+            const i = c.indexOf('=');
+            if (i < 0)
+                return false;
+            const v = c.slice(i + 1);
+            return v !== '' && !/^=+$/.test(v);
+        })
+            .map((c) => c.split('=')[0].trim())
+            .filter((n) => n !== '')
+            // A bare token that merely ENDS in base64 padding ('=') still passes the filter above and its "name" would be
+            // the token itself (Nextpert-Scout 70913). Real cookie names carry a separator ('.', '-', '_'); a long name with
+            // none is opaque, so it is logged as a placeholder, never as itself.
+            .map((n) => (n.length >= 24 && !/[._-]/.test(n) ? '[opaque-name]' : n))
+            .slice(0, 20);
+        console.warn('[server-auth] NO_SESSION origin=a', { hasCookieHeader: header !== '', cookieNames });
+    }
+    catch {
+        /* a diagnostic must never change the outcome */
+    }
+}
+/** Origins b and c: a token WAS resolved. Log which of its three keys exist (presence only), fire-and-forget. */
+function logNoSessionWithKeys(origin, sessionToken) {
+    try {
+        void (0, session_store_1.describeSessionKeyPresence)(sessionToken).then((keys) => {
+            try {
+                console.warn(`[server-auth] NO_SESSION origin=${origin}`, { token: (0, token_log_id_1.tokenLogId)(sessionToken), ...keys });
+            }
+            catch {
+                /* never throws */
+            }
+        }, () => {
+            /* never throws */
+        });
+    }
+    catch {
+        /* a diagnostic must never change the outcome */
+    }
+}
 /**
  * Get the current session from a request.
  *
@@ -167,7 +241,9 @@ async function getSession(request) {
     try {
         betterAuthSession = await auth.api.getSession({ headers: request.headers });
     }
-    catch { /* fall through to canonical Redis path */ }
+    catch (err) {
+        logSessionReadSwallowed('primary', err); // fall through to canonical Redis path
+    }
     if (betterAuthSession?.session?.token && betterAuthSession?.user) {
         const sessionToken = betterAuthSession.session.token;
         let sessionData = null;
@@ -176,7 +252,9 @@ async function getSession(request) {
             if (!sessionData)
                 sessionData = await (0, session_store_1.getBetterAuthSession)(sessionToken);
         }
-        catch { /* Redis unavailable */ }
+        catch (err) {
+            logSessionReadSwallowed('A', err); // Redis unavailable
+        }
         if (!sessionData)
             sessionData = buildSessionDataFromAuthSession(betterAuthSession);
         return attachSessionData(betterAuthSession, sessionData, sessionToken);
@@ -201,7 +279,9 @@ async function getSession(request) {
         if (!sessionData)
             sessionData = await (0, session_store_1.getBetterAuthSession)(sessionToken);
     }
-    catch { /* Redis unavailable */ }
+    catch (err) {
+        logSessionReadSwallowed('B', err); // Redis unavailable
+    }
     if (!sessionData)
         return null;
     // Synthesize a minimal session shape compatible with downstream callers.
@@ -282,6 +362,7 @@ async function getFreshIdpToken(request, config) {
     const session = await getSession(request);
     const sessionToken = session?.session?.token;
     if (!sessionToken) {
+        logNoSessionOriginA(request);
         return { success: false, error: 'NO_SESSION', status: 401, terminal: true };
     }
     const { ensureFreshAccessToken } = await Promise.resolve().then(() => __importStar(require('../lib/ensure-fresh-access-token')));
@@ -294,6 +375,8 @@ async function getFreshIdpToken(request, config) {
         requestId: request?.headers?.get('x-request-id') ?? undefined,
     });
     if (!result.ok) {
+        if (result.code === 'NO_SESSION')
+            logNoSessionWithKeys('b', sessionToken);
         return {
             success: false,
             error: result.code,
@@ -306,6 +389,7 @@ async function getFreshIdpToken(request, config) {
     }
     const sessionData = await (0, session_store_1.getSession)(sessionToken);
     if (!sessionData) {
+        logNoSessionWithKeys('c', sessionToken);
         return { success: false, error: 'NO_SESSION', status: 401, terminal: true };
     }
     return {