@payez/next-mvp 4.8.0 → 4.8.2

package/dist/pages/settings/EnhancedSettingsPage.js

@@ -47,13 +47,13 @@ const DATE_FORMATS = [
 ];
 // Toggle component
 function Toggle({ enabled, onChange, disabled = false, isDark = true, }) {
-    return ((0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => !disabled && onChange(!enabled), disabled: disabled, className: `
-        relative inline-flex h-6 w-11 items-center rounded-full transition-colors
-        ${disabled ? 'opacity-50 cursor-not-allowed' : 'cursor-pointer'}
-        ${enabled ? 'bg-blue-600' : isDark ? 'bg-slate-600' : 'bg-gray-300'}
-      `, children: (0, jsx_runtime_1.jsx)("span", { className: `
-          inline-block h-4 w-4 transform rounded-full bg-white transition-transform
-          ${enabled ? 'translate-x-6' : 'translate-x-1'}
+    return ((0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => !disabled && onChange(!enabled), disabled: disabled, className: `
+        relative inline-flex h-6 w-11 items-center rounded-full transition-colors
+        ${disabled ? 'opacity-50 cursor-not-allowed' : 'cursor-pointer'}
+        ${enabled ? 'bg-blue-600' : isDark ? 'bg-slate-600' : 'bg-gray-300'}
+      `, children: (0, jsx_runtime_1.jsx)("span", { className: `
+          inline-block h-4 w-4 transform rounded-full bg-white transition-transform
+          ${enabled ? 'translate-x-6' : 'translate-x-1'}
         ` }) }));
 }
 // Section wrapper component
@@ -73,9 +73,9 @@ function Select({ value, onChange, options, isDark, }) {
     const bgColor = isDark ? 'bg-slate-700' : 'bg-white';
     const borderColor = isDark ? 'border-slate-600' : 'border-gray-300';
     const textColor = isDark ? 'text-white' : 'text-gray-900';
-    return ((0, jsx_runtime_1.jsx)("select", { value: value, onChange: (e) => onChange(e.target.value), className: `
-        px-3 py-2 rounded-md border ${borderColor} ${bgColor} ${textColor}
-        focus:outline-none focus:ring-2 focus:ring-blue-500 min-w-[200px]
+    return ((0, jsx_runtime_1.jsx)("select", { value: value, onChange: (e) => onChange(e.target.value), className: `
+        px-3 py-2 rounded-md border ${borderColor} ${bgColor} ${textColor}
+        focus:outline-none focus:ring-2 focus:ring-blue-500 min-w-[200px]
       `, children: options.map((opt) => ((0, jsx_runtime_1.jsx)("option", { value: opt.value, children: opt.label }, opt.value))) }));
 }
 function EnhancedSettingsPage({ initialPreferences, preferencesEndpoint = '/api/v1/user/preferences', languagesEndpoint = '/api/v1/lookup/languages', timezonesEndpoint = '/api/v1/lookup/timezones', onSave, onThemeChange, }) {
@@ -206,17 +206,17 @@ function EnhancedSettingsPage({ initialPreferences, preferencesEndpoint = '/api/
     const smsEnabled = preferences.notifications?.sms_enabled ?? false;
     const profileVisibility = preferences.privacy?.profile_visibility || 'team';
     const showActivityStatus = preferences.privacy?.show_activity_status ?? true;
-    return ((0, jsx_runtime_1.jsx)("div", { className: `min-h-screen ${bgColor}`, children: (0, jsx_runtime_1.jsxs)("div", { className: `max-w-2xl mx-auto ${layout?.padding || 'p-6'}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between mb-6", children: [(0, jsx_runtime_1.jsx)("h1", { className: `text-3xl font-bold ${textPrimary}`, children: "Settings" }), (0, jsx_runtime_1.jsx)("button", { onClick: handleSave, disabled: saving, className: `
-              px-4 py-2 rounded-md font-medium transition-colors
-              ${saving ? 'opacity-50 cursor-not-allowed' : ''}
-              bg-blue-600 text-white hover:bg-blue-700
-            `, children: saving ? 'Saving...' : 'Save Changes' })] }), error && ((0, jsx_runtime_1.jsx)("div", { className: "mb-4 p-3 rounded-md bg-red-500/10 border border-red-500/50 text-red-500", children: error })), successMessage && ((0, jsx_runtime_1.jsx)("div", { className: "mb-4 p-3 rounded-md bg-green-500/10 border border-green-500/50 text-green-500", children: successMessage })), (0, jsx_runtime_1.jsxs)("div", { className: `${cardBg} rounded-lg shadow-lg border ${borderColor} p-6`, children: [(0, jsx_runtime_1.jsxs)(SettingsSection, { title: "Appearance", isDark: isDark, children: [(0, jsx_runtime_1.jsxs)("div", { className: "mb-4", children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium ${textMuted} mb-2`, children: "Theme" }), (0, jsx_runtime_1.jsx)("div", { className: "flex gap-2", children: ['light', 'dark', 'system'].map((theme) => ((0, jsx_runtime_1.jsx)("button", { onClick: () => handleThemeChange(theme), className: `
-                      px-4 py-2 rounded-md capitalize transition-colors
+    return ((0, jsx_runtime_1.jsx)("div", { className: `min-h-screen ${bgColor}`, children: (0, jsx_runtime_1.jsxs)("div", { className: `max-w-2xl mx-auto ${layout?.padding || 'p-6'}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between mb-6", children: [(0, jsx_runtime_1.jsx)("h1", { className: `text-3xl font-bold ${textPrimary}`, children: "Settings" }), (0, jsx_runtime_1.jsx)("button", { onClick: handleSave, disabled: saving, className: `
+              px-4 py-2 rounded-md font-medium transition-colors
+              ${saving ? 'opacity-50 cursor-not-allowed' : ''}
+              bg-blue-600 text-white hover:bg-blue-700
+            `, children: saving ? 'Saving...' : 'Save Changes' })] }), error && ((0, jsx_runtime_1.jsx)("div", { className: "mb-4 p-3 rounded-md bg-red-500/10 border border-red-500/50 text-red-500", children: error })), successMessage && ((0, jsx_runtime_1.jsx)("div", { className: "mb-4 p-3 rounded-md bg-green-500/10 border border-green-500/50 text-green-500", children: successMessage })), (0, jsx_runtime_1.jsxs)("div", { className: `${cardBg} rounded-lg shadow-lg border ${borderColor} p-6`, children: [(0, jsx_runtime_1.jsxs)(SettingsSection, { title: "Appearance", isDark: isDark, children: [(0, jsx_runtime_1.jsxs)("div", { className: "mb-4", children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium ${textMuted} mb-2`, children: "Theme" }), (0, jsx_runtime_1.jsx)("div", { className: "flex gap-2", children: ['light', 'dark', 'system'].map((theme) => ((0, jsx_runtime_1.jsx)("button", { onClick: () => handleThemeChange(theme), className: `
+                      px-4 py-2 rounded-md capitalize transition-colors
                       ${currentTheme === theme
                                                     ? 'bg-blue-600 text-white'
                                                     : isDark
                                                         ? 'bg-slate-700 text-gray-300 hover:bg-slate-600'
-                                                        : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}
+                                                        : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}
                     `, children: theme }, theme))) })] }), (0, jsx_runtime_1.jsx)(SettingRow, { label: "Compact Mode", description: "Reduce spacing and padding for denser layouts", isDark: isDark, children: (0, jsx_runtime_1.jsx)(Toggle, { enabled: compactMode, onChange: (value) => updatePreference('appearance', 'compact_mode', value), isDark: isDark }) })] }), (0, jsx_runtime_1.jsx)(SettingsSection, { title: "Localization", isDark: isDark, children: (0, jsx_runtime_1.jsxs)("div", { className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium ${textMuted} mb-2`, children: "Language" }), (0, jsx_runtime_1.jsx)(Select, { value: currentLanguage, onChange: (value) => updatePreference('localization', 'language', value), options: languages.map((l) => ({ value: l.code, label: l.name })), isDark: isDark })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium ${textMuted} mb-2`, children: "Timezone" }), (0, jsx_runtime_1.jsx)(Select, { value: currentTimezone, onChange: (value) => updatePreference('localization', 'timezone', value), options: timezones.map((tz) => ({ value: tz.id, label: `${tz.display} (${tz.offset})` })), isDark: isDark }), preferences.localization?.timezone_display && ((0, jsx_runtime_1.jsxs)("p", { className: `mt-1 text-sm ${textMuted}`, children: ["Currently: ", preferences.localization.timezone_display] }))] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium ${textMuted} mb-2`, children: "Date Format" }), (0, jsx_runtime_1.jsx)(Select, { value: currentDateFormat, onChange: (value) => updatePreference('localization', 'date_format', value), options: DATE_FORMATS.map((df) => ({ value: df.value, label: df.label })), isDark: isDark }), (0, jsx_runtime_1.jsxs)("p", { className: `mt-1 text-sm ${textMuted}`, children: ["Example: ", DATE_FORMATS.find((df) => df.value === currentDateFormat)?.example] })] })] }) }), (0, jsx_runtime_1.jsxs)(SettingsSection, { title: "Notifications", isDark: isDark, children: [(0, jsx_runtime_1.jsx)(SettingRow, { label: "Email Notifications", description: "Receive updates and alerts via email", isDark: isDark, children: (0, jsx_runtime_1.jsx)(Toggle, { enabled: emailEnabled, onChange: (value) => updatePreference('notifications', 'email_enabled', value), isDark: isDark }) }), emailEnabled && ((0, jsx_runtime_1.jsxs)("div", { className: `ml-6 border-l-2 ${borderColor} pl-4 space-y-2`, children: [(0, jsx_runtime_1.jsx)(SettingRow, { label: "Security alerts", description: "Login from new device, etc.", isDark: isDark, children: (0, jsx_runtime_1.jsx)(Toggle, { enabled: preferences.notifications?.email_security_alerts ?? true, onChange: (value) => updatePreference('notifications', 'email_security_alerts', value), isDark: isDark }) }), (0, jsx_runtime_1.jsx)(SettingRow, { label: "Account updates", description: "Password expiry, etc.", isDark: isDark, children: (0, jsx_runtime_1.jsx)(Toggle, { enabled: preferences.notifications?.email_account_updates ?? true, onChange: (value) => updatePreference('notifications', 'email_account_updates', value), isDark: isDark }) }), (0, jsx_runtime_1.jsx)(SettingRow, { label: "Product news and tips", isDark: isDark, children: (0, jsx_runtime_1.jsx)(Toggle, { enabled: preferences.notifications?.email_product_news ?? false, onChange: (value) => updatePreference('notifications', 'email_product_news', value), isDark: isDark }) }), (0, jsx_runtime_1.jsx)(SettingRow, { label: "Marketing and promotions", isDark: isDark, children: (0, jsx_runtime_1.jsx)(Toggle, { enabled: preferences.notifications?.email_marketing ?? false, onChange: (value) => updatePreference('notifications', 'email_marketing', value), isDark: isDark }) })] })), (0, jsx_runtime_1.jsx)(SettingRow, { label: "SMS Notifications", description: "Receive urgent alerts via text message", isDark: isDark, children: (0, jsx_runtime_1.jsx)(Toggle, { enabled: smsEnabled, onChange: (value) => updatePreference('notifications', 'sms_enabled', value), isDark: isDark }) }), smsEnabled && ((0, jsx_runtime_1.jsx)("div", { className: `ml-6 border-l-2 ${borderColor} pl-4`, children: (0, jsx_runtime_1.jsx)(SettingRow, { label: "Security alerts only", isDark: isDark, children: (0, jsx_runtime_1.jsx)(Toggle, { enabled: preferences.notifications?.sms_security_alerts ?? true, onChange: (value) => updatePreference('notifications', 'sms_security_alerts', value), isDark: isDark }) }) }))] }), (0, jsx_runtime_1.jsxs)(SettingsSection, { title: "Privacy", isDark: isDark, children: [(0, jsx_runtime_1.jsxs)("div", { className: "mb-4", children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm font-medium ${textMuted} mb-2`, children: "Profile Visibility" }), (0, jsx_runtime_1.jsx)("div", { className: "space-y-2", children: [
                                                 { value: 'private', label: 'Private', description: 'Only you can see your profile' },
                                                 { value: 'team', label: 'Team', description: 'Team members can see your profile' },

package/dist/vibe/sessions.js

@@ -145,6 +145,26 @@ async function createLoginSession(input) {
     }
     const now = new Date();
     const expiresAt = new Date(now.getTime() + SESSION_EXPIRY_DAYS * 24 * 60 * 60 * 1000);
+    // PAY-2362 (write side): ONE row per session hash. A second record-login for the same session (another tab, a cleared
+    // sessionStorage, every open session when an app first runs a version that changes its login-recording key) used to INSERT a second
+    // row with the SAME hash, and a revoke PATCHes ONE row by id. If a row for this hash already exists, PATCH last_activity on it (that
+    // one field only: it never touches status, so it cannot un-revoke) and return it. A failed lookup must never block a login: fall
+    // through to the insert, as before. The read side (findRevokingSession: revoked if ANY row for the hash is) covers duplicates that
+    // already exist.
+    if (input.sessionTokenHash) {
+        try {
+            const existingRows = (await getUserSessions(input.idpUserId, input.accessToken))
+                .filter(s => s.session_token_hash === input.sessionTokenHash);
+            if (existingRows.length > 0) {
+                const existing = existingRows.find(s => s.status === 'revoked') ?? existingRows[0];
+                await updateSessionActivity(existing.id, input.accessToken);
+                return existing;
+            }
+        }
+        catch {
+            /* lookup failed: insert as before */
+        }
+    }
     const sessionData = {
         idp_user_id: input.idpUserId,
         email: input.email,
@@ -561,9 +581,14 @@ function findRevokingSessionWithRule(sessions, sessionTokenHash) {
     if (sessions.length === 0)
         return { row: null, rule: 'none' };
     if (sessionTokenHash) {
-        const matching = sessions.find(s => s.session_token_hash === sessionTokenHash);
-        if (matching)
-            return matching.status === 'revoked' ? { row: matching, rule: 'own_row_revoked' } : { row: null, rule: 'none' };
+        // PAY-2362: EVERY row carrying this hash, not the first. A second record-login for the same session (another tab, a cleared
+        // sessionStorage, every open session at a package roll) writes a second row with the SAME hash, and a revoke PATCHes ONE row by id.
+        // `find` took the first row, so an active duplicate listed before the revoked one hid the revoke. Revoked if ANY of them is.
+        const matching = sessions.filter(s => s.session_token_hash === sessionTokenHash);
+        if (matching.length > 0) {
+            const revoked = matching.find(s => s.status === 'revoked');
+            return revoked ? { row: revoked, rule: 'own_row_revoked' } : { row: null, rule: 'none' };
+        }
     }
     // Hash not found (a legacy row minted before hashing) or no hash given: idealresume's user-wide
     // rules, lib/vibe-sessions.ts:594-651 (BAPert 69189).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.8.0",
+  "version": "4.8.2",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -16,7 +16,7 @@
     "test": "node --test \"test/*.test.cjs\"",
     "pretest:ci": "npm run build",
     "test:ci": "node --test --test-reporter=spec --test-reporter-destination=stdout --test-reporter=junit --test-reporter-destination=junit.xml \"test/*.test.cjs\"",
-    "prepack": "npm run build",
+    "prepack": "npm run build && npm run check:publish-eol",
     "prepublishOnly": "npm run check:publish-eol && npm run build",
     "postpublish": "node scripts/check-publish-health.mjs",
     "postversion": "node scripts/check-publish-health.mjs || echo \"[postversion] see above: local/registry are out of sync after this version bump (171900)\"",

package/scripts/check-publish-eol.mjs

@@ -18,11 +18,14 @@
  * every consumer's CI.
  *
  * WHAT IT CHECKS:
- *   1. `*.sh`, `*.mjs`, `*.cjs` that the package SHIPS (package.json "files") must
- *      contain NO CR bytes. These run on Linux (bash / node with a shebang).
- *   2. The `*.sh text eol=lf` rule is still present in the repo's `.gitattributes` —
- *      so a future edit that quietly drops the rule fails the same check, not just a
- *      future CRLF checkout.
+ *   1. EVERY text file the package SHIPS (package.json "files") must contain NO CR bytes,
+ *      except the Windows-only `*.ps1` helpers. (Until 2026-10-14 only `*.sh`, `*.mjs`, `*.cjs`
+ *      were scanned, so 4.8.1 shipped CRLF in every src/*.ts and in README.md: the tarball is
+ *      packed from the working tree and a Windows checkout with core.autocrlf=true writes CRLF
+ *      there while the index stays LF; BAPert 74792.) A file with a NUL byte is binary and skipped.
+ *   2. The `*.sh text eol=lf` rule AND the catch-all `* text=auto eol=lf` rule are still present in
+ *      the repo's `.gitattributes` — so a future edit that quietly drops a rule fails the same
+ *      check, not just a future CRLF checkout.
  *   3. `*.ps1` is EXEMPT: PowerShell helpers are Windows-only and are deliberately
  *      kept CRLF (mirroring the .gitattributes rule).
  *
@@ -50,8 +53,7 @@ const here = dirname(fileURLToPath(import.meta.url));
 const pkgDir = join(here, '..');            // packages/next-mvp
 const repoRoot = join(pkgDir, '..', '..');  // repo root
 
-// Extensions that MUST be LF (they execute on Linux build agents).
-const LF_EXTS = new Set(['.sh', '.mjs', '.cjs']);
+// Every shipped text file must be LF. Binary files (a NUL byte in them) are skipped; see isBinary().
 // Extensions explicitly allowed to stay CRLF (Windows-only helpers).
 const CRLF_EXTS = new Set(['.ps1']);
 
@@ -65,6 +67,10 @@ function walk(dir, out = []) {
   return out;
 }
 
+function isBinary(buf) {
+  return buf.includes(0x00);
+}
+
 function crCount(buf) {
   let n = 0;
   for (const b of buf) if (b === 0x0d) n++;
@@ -94,19 +100,23 @@ for (const entry of shipped) {
   for (const f of files) {
     const ext = extname(f).toLowerCase();
     if (CRLF_EXTS.has(ext)) { exempt++; continue; }
-    if (!LF_EXTS.has(ext)) continue;
-    scanned++;
-    const crs = crCount(readFileSync(f));
+    const buf = readFileSync(f);
+    if (isBinary(buf)) continue;
+    // package.json always ships, so it cannot be what makes a scan count as non-empty (P9).
+    if (f !== join(pkgDir, 'package.json')) scanned++;
+    const crs = crCount(buf);
     if (crs > 0) offenders.push({ file: f, crs });
   }
 }
 
 // 2. The .gitattributes rule must still be present at the source.
 let gaRulePresent = false;
+let gaAllRulePresent = false;
 let gaPath = join(repoRoot, '.gitattributes');
 try {
   const ga = readFileSync(gaPath, 'utf8');
   gaRulePresent = /^\s*\*\.sh\s+text\s+eol=lf\s*$/m.test(ga);
+  gaAllRulePresent = /^\*\s+text=auto\s+eol=lf\s*$/m.test(ga);
 } catch {
   gaRulePresent = false;
 }
@@ -114,9 +124,11 @@ try {
 const rel = (p) => p.replace(repoRoot + '\\', '').replace(repoRoot + '/', '');
 
 if (offenders.length > 0) {
-  console.error('[publish-eol] FAIL: shipped script(s) contain CR (CRLF) and would break Linux agents.');
-  for (const o of offenders) console.error(`[publish-eol]   ${rel(o.file)}  CR=${o.crs}`);
-  console.error('[publish-eol] Fix: ensure the *.sh/*.mjs/*.cjs rule is in .gitattributes and renormalise (git add --renormalize .).');
+  console.error('[publish-eol] FAIL: shipped text file(s) contain CR (CRLF). Scripts break Linux agents; the rest make the tarball differ from the LF source (4.8.1).');
+  const SHOW = 25;
+  for (const o of offenders.slice(0, SHOW)) console.error(`[publish-eol]   ${rel(o.file)}  CR=${o.crs}`);
+  if (offenders.length > SHOW) console.error(`[publish-eol]   ... and ${offenders.length - SHOW} more (${offenders.length} files in all)`);
+  console.error('[publish-eol] Fix: ensure the "* text=auto eol=lf" rule is in .gitattributes, then re-checkout the working tree as LF (git rm --cached -r . && git reset --hard, or pack from a fresh LF clone).');
   process.exit(1);
 }
 
@@ -126,10 +138,16 @@ if (!gaRulePresent) {
   process.exit(1);
 }
 
+if (!gaAllRulePresent) {
+  console.error(`[publish-eol] FAIL: the catch-all "* text=auto eol=lf" rule is MISSING from ${rel(gaPath)}.`);
+  console.error('[publish-eol] Without it a Windows checkout (core.autocrlf=true) packs CRLF into src/*.ts, README.md and any extension no per-extension rule names (the 4.8.1 tarball).');
+  process.exit(1);
+}
+
 if (scanned === 0) {
-  console.error('[publish-eol] INCONCLUSIVE: scanned 0 LF-required shipped scripts - the scan is broken, not the package. NOT a pass.');
+  console.error('[publish-eol] INCONCLUSIVE: scanned 0 shipped text files - the scan is broken, not the package. NOT a pass.');
   process.exit(2);
 }
 
-console.log(`[publish-eol] OK: ${scanned} shipped script(s) CR-free; ${exempt} Windows-only (*.ps1) exempt; .gitattributes rule present.`);
+console.log(`[publish-eol] OK: ${scanned} shipped text file(s) CR-free; ${exempt} Windows-only (*.ps1) exempt; .gitattributes rule present.`);
 process.exit(0);