keystone-design-bootstrap 1.0.103 → 1.0.104

package/dist/utils/markdown-toc.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/markdown-toc.ts"],"sourcesContent":["/**\n * Utility functions for extracting table of contents from markdown\n */\n\nexport interface TableOfContentsItem {\n  id: string;\n  title: string;\n  level: number;\n}\n\n/**\n * Generate a URL-friendly ID from a heading text\n */\nfunction slugify(text: string): string {\n  return text\n    .toLowerCase()\n    .trim()\n    .replace(/[^\\w\\s-]/g, '') // Remove special characters\n    .replace(/[\\s_-]+/g, '-') // Replace spaces and underscores with hyphens\n    .replace(/^-+|-+$/g, ''); // Remove leading/trailing hyphens\n}\n\n/**\n * Extract headings from markdown content and generate table of contents\n */\nexport function extractTableOfContents(markdown: string): TableOfContentsItem[] {\n  if (!markdown) return [];\n\n  const toc: TableOfContentsItem[] = [];\n  const lines = markdown.split('\\n');\n\n  for (const line of lines) {\n    // Match markdown headings (##, ###, etc.)\n    const headingMatch = line.match(/^(#{1,6})\\s+(.+)$/);\n    if (headingMatch) {\n      const level = headingMatch[1].length;\n      const title = headingMatch[2].trim();\n      \n      // Only include h2 and h3 headings in TOC\n      if (level >= 2 && level <= 3) {\n        const id = slugify(title);\n        toc.push({\n          id,\n          title,\n          level,\n        });\n      }\n    }\n  }\n\n  return toc;\n}\n\n\n"],"mappings":";AAaA,SAAS,QAAQ,MAAsB;AACrC,SAAO,KACJ,YAAY,EACZ,KAAK,EACL,QAAQ,aAAa,EAAE,EACvB,QAAQ,YAAY,GAAG,EACvB,QAAQ,YAAY,EAAE;AAC3B;AAKO,SAAS,uBAAuB,UAAyC;AAC9E,MAAI,CAAC,SAAU,QAAO,CAAC;AAEvB,QAAM,MAA6B,CAAC;AACpC,QAAM,QAAQ,SAAS,MAAM,IAAI;AAEjC,aAAW,QAAQ,OAAO;AAExB,UAAM,eAAe,KAAK,MAAM,mBAAmB;AACnD,QAAI,cAAc;AAChB,YAAM,QAAQ,aAAa,CAAC,EAAE;AAC9B,YAAM,QAAQ,aAAa,CAAC,EAAE,KAAK;AAGnC,UAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,cAAM,KAAK,QAAQ,KAAK;AACxB,YAAI,KAAK;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/utils/phone-helpers.d.ts

@@ -0,0 +1,24 @@
+/**
+ * List of countries with their respective country code, flag, phone code, and phone mask.
+ */
+declare const countries: ({
+    name: string;
+    code: string;
+    flag: string;
+    phoneCode: string;
+    phoneMask: string;
+} | {
+    name: string;
+    code: string;
+    flag: string;
+    phoneCode: string;
+    phoneMask?: undefined;
+})[];
+
+type Country = (typeof countries)[0];
+/** Get national-format mask from country by stripping the country code prefix (e.g. "+1 (###) ###-####" → "(###) ###-####"). */
+declare function getNationalMask(country: Country | undefined): string;
+/** Format a raw digit string into a mask pattern where '#' represents one digit. No trailing literals so backspace works naturally. */
+declare function formatDigitsToMask(digits: string, mask: string): string;
+
+export { formatDigitsToMask, getNationalMask };

package/dist/utils/phone-helpers.js

@@ -0,0 +1,26 @@
+// src/utils/phone-helpers.ts
+function getNationalMask(country) {
+  if (!(country == null ? void 0 : country.phoneMask)) return "";
+  const code = country.phoneCode.startsWith("+") ? country.phoneCode : `+${country.phoneCode}`;
+  const escaped = code.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return country.phoneMask.replace(new RegExp(`^\\s*${escaped}[\\s-]*`), "").trim();
+}
+function formatDigitsToMask(digits, mask) {
+  if (digits.length === 0) return "";
+  let i = 0;
+  let out = "";
+  for (const c of mask) {
+    if (c === "#") {
+      if (i < digits.length) out += digits[i++];
+      else break;
+    } else if (i < digits.length) {
+      out += c;
+    }
+  }
+  return out;
+}
+export {
+  formatDigitsToMask,
+  getNationalMask
+};
+//# sourceMappingURL=phone-helpers.js.map

package/dist/utils/phone-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/phone-helpers.ts"],"sourcesContent":["import type countries from './countries';\n\ntype Country = (typeof countries)[0];\n\n/** Get national-format mask from country by stripping the country code prefix (e.g. \"+1 (###) ###-####\" → \"(###) ###-####\"). */\nexport function getNationalMask(country: Country | undefined): string {\n  if (!country?.phoneMask) return '';\n  const code = country.phoneCode.startsWith('+') ? country.phoneCode : `+${country.phoneCode}`;\n  const escaped = code.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return country.phoneMask.replace(new RegExp(`^\\\\s*${escaped}[\\\\s-]*`), '').trim();\n}\n\n/** Format a raw digit string into a mask pattern where '#' represents one digit. No trailing literals so backspace works naturally. */\nexport function formatDigitsToMask(digits: string, mask: string): string {\n  if (digits.length === 0) return '';\n  let i = 0;\n  let out = '';\n  for (const c of mask) {\n    if (c === '#') {\n      if (i < digits.length) out += digits[i++];\n      else break;\n    } else if (i < digits.length) {\n      out += c;\n    }\n  }\n  return out;\n}\n"],"mappings":";AAKO,SAAS,gBAAgB,SAAsC;AACpE,MAAI,EAAC,mCAAS,WAAW,QAAO;AAChC,QAAM,OAAO,QAAQ,UAAU,WAAW,GAAG,IAAI,QAAQ,YAAY,IAAI,QAAQ,SAAS;AAC1F,QAAM,UAAU,KAAK,QAAQ,uBAAuB,MAAM;AAC1D,SAAO,QAAQ,UAAU,QAAQ,IAAI,OAAO,QAAQ,OAAO,SAAS,GAAG,EAAE,EAAE,KAAK;AAClF;AAGO,SAAS,mBAAmB,QAAgB,MAAsB;AACvE,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI,IAAI;AACR,MAAI,MAAM;AACV,aAAW,KAAK,MAAM;AACpB,QAAI,MAAM,KAAK;AACb,UAAI,IAAI,OAAO,OAAQ,QAAO,OAAO,GAAG;AAAA,UACnC;AAAA,IACP,WAAW,IAAI,OAAO,QAAQ;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/utils/photo-helpers.d.ts

@@ -0,0 +1,38 @@
+import { P as PhotoAttachment } from '../photos-CmBdWiuZ.js';
+import { W as WebsitePhotos } from '../website-photos-Cl1YqAno.js';
+
+/**
+ * Helper functions for extracting photo URLs from photo associations
+ */
+
+/**
+ * True if the URL looks like a video by path extension. Used to avoid using video URLs in img src.
+ */
+declare function isVideoUrl(url: string | null | undefined): boolean;
+/**
+ * Get the best available photo URL from a photos array
+ * Priority: featured photo > first photo > fallback
+ */
+declare function getPhotoUrl(photos?: PhotoAttachment[]): string | null;
+/**
+ * Get avatar URL for team members or authors.
+ * Returns a URL only when there is a real photo in attachments; otherwise null.
+ * Callers should use PhotoWithFallback (gradient fallback) or Avatar with initials when null.
+ */
+/** Optional fallbackId/name reserved for future use (e.g. deterministic fallback). */
+declare function getAvatarUrl(photos?: PhotoAttachment[], _fallbackId?: number | string, _name?: string): string | null;
+/**
+ * Get featured image URL for blog posts
+ */
+declare function getFeaturedImageUrl(photos?: PhotoAttachment[]): string | null;
+/**
+ * Get logo URL from website_photos API (which aggregates from account_photos)
+ *
+ * The website_photos API endpoint returns logos from account_photos with photo_type: 'logo',
+ * with industry fallback. This is the primary and only source for logos.
+ *
+ * Returns undefined if no logo is available (for PhotoWithFallback gradient fallback)
+ */
+declare function getLogoUrl(websitePhotos?: WebsitePhotos | null): string | undefined;
+
+export { PhotoAttachment, getAvatarUrl, getFeaturedImageUrl, getLogoUrl, getPhotoUrl, isVideoUrl };

package/dist/utils/photo-helpers.js

@@ -0,0 +1,41 @@
+// src/utils/photo-helpers.ts
+var VIDEO_EXTENSIONS = [".mp4", ".mov", ".webm", ".m4v", ".avi", ".mkv", ".flv", ".wmv"];
+function isVideoUrl(url) {
+  var _a;
+  if (!url || typeof url !== "string") return false;
+  const path = (_a = url.split("?")[0]) != null ? _a : "";
+  const ext = path.slice(path.lastIndexOf(".")).toLowerCase();
+  return VIDEO_EXTENSIONS.includes(ext);
+}
+function getPhotoUrl(photos) {
+  if (photos && photos.length > 0) {
+    const featuredPhoto = photos.find((pa) => pa.featured);
+    const photoToUse = featuredPhoto || photos[0];
+    const photo = photoToUse.photo;
+    if (photo) {
+      return photo.large_url || photo.medium_url || photo.thumbnail_url || photo.original_url || null;
+    }
+  }
+  return null;
+}
+function getAvatarUrl(photos, _fallbackId, _name) {
+  return getPhotoUrl(photos);
+}
+function getFeaturedImageUrl(photos) {
+  return getPhotoUrl(photos);
+}
+function getLogoUrl(websitePhotos) {
+  var _a;
+  if ((_a = websitePhotos == null ? void 0 : websitePhotos.logo) == null ? void 0 : _a.url) {
+    return websitePhotos.logo.url;
+  }
+  return void 0;
+}
+export {
+  getAvatarUrl,
+  getFeaturedImageUrl,
+  getLogoUrl,
+  getPhotoUrl,
+  isVideoUrl
+};
+//# sourceMappingURL=photo-helpers.js.map

package/dist/utils/photo-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/photo-helpers.ts"],"sourcesContent":["/**\n * Helper functions for extracting photo URLs from photo associations\n */\n\nimport type { PhotoAttachment } from '../types/api/photos';\nimport type { WebsitePhotos } from '../types/api/website-photos';\n\nexport type { PhotoAttachment } from '../types/api/photos';\n\n/** Video file extensions treated as video (match backend ExternalPhotoService.video_url?) */\nconst VIDEO_EXTENSIONS = ['.mp4', '.mov', '.webm', '.m4v', '.avi', '.mkv', '.flv', '.wmv'];\n\n/**\n * True if the URL looks like a video by path extension. Used to avoid using video URLs in img src.\n */\nexport function isVideoUrl(url: string | null | undefined): boolean {\n  if (!url || typeof url !== 'string') return false;\n  const path = url.split('?')[0] ?? '';\n  const ext = path.slice(path.lastIndexOf('.')).toLowerCase();\n  return VIDEO_EXTENSIONS.includes(ext);\n}\n\n/**\n * Get the best available photo URL from a photos array\n * Priority: featured photo > first photo > fallback\n */\nexport function getPhotoUrl(\n  photos?: PhotoAttachment[]\n): string | null {\n  // Priority 1: Featured photo from photos array\n  if (photos && photos.length > 0) {\n    const featuredPhoto = photos.find(pa => pa.featured);\n    const photoToUse = featuredPhoto || photos[0];\n    const photo = photoToUse.photo;\n    \n    if (photo) {\n      return photo.large_url || photo.medium_url || photo.thumbnail_url || photo.original_url || null;\n    }\n  }\n  \n  // Fallback (gradient or null)\n  return null;\n}\n\n/**\n * Get avatar URL for team members or authors.\n * Returns a URL only when there is a real photo in attachments; otherwise null.\n * Callers should use PhotoWithFallback (gradient fallback) or Avatar with initials when null.\n */\n/** Optional fallbackId/name reserved for future use (e.g. deterministic fallback). */\n/* eslint-disable @typescript-eslint/no-unused-vars -- _fallbackId, _name reserved for API */\nexport function getAvatarUrl(\n  photos?: PhotoAttachment[],\n  _fallbackId?: number | string,\n  _name?: string\n): string | null {\n  return getPhotoUrl(photos);\n}\n/* eslint-enable @typescript-eslint/no-unused-vars */\n\n/**\n * Get featured image URL for blog posts\n */\nexport function getFeaturedImageUrl(\n  photos?: PhotoAttachment[]\n): string | null {\n  return getPhotoUrl(photos);\n}\n\n/**\n * Get logo URL from website_photos API (which aggregates from account_photos)\n * \n * The website_photos API endpoint returns logos from account_photos with photo_type: 'logo',\n * with industry fallback. This is the primary and only source for logos.\n * \n * Returns undefined if no logo is available (for PhotoWithFallback gradient fallback)\n */\nexport function getLogoUrl(\n  websitePhotos?: WebsitePhotos | null\n): string | undefined {\n  if (websitePhotos?.logo?.url) {\n    return websitePhotos.logo.url;\n  }\n  \n  return undefined;\n}\n\n"],"mappings":";AAUA,IAAM,mBAAmB,CAAC,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;AAKlF,SAAS,WAAW,KAAyC;AAfpE;AAgBE,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,QAAO,SAAI,MAAM,GAAG,EAAE,CAAC,MAAhB,YAAqB;AAClC,QAAM,MAAM,KAAK,MAAM,KAAK,YAAY,GAAG,CAAC,EAAE,YAAY;AAC1D,SAAO,iBAAiB,SAAS,GAAG;AACtC;AAMO,SAAS,YACd,QACe;AAEf,MAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,UAAM,gBAAgB,OAAO,KAAK,QAAM,GAAG,QAAQ;AACnD,UAAM,aAAa,iBAAiB,OAAO,CAAC;AAC5C,UAAM,QAAQ,WAAW;AAEzB,QAAI,OAAO;AACT,aAAO,MAAM,aAAa,MAAM,cAAc,MAAM,iBAAiB,MAAM,gBAAgB;AAAA,IAC7F;AAAA,EACF;AAGA,SAAO;AACT;AASO,SAAS,aACd,QACA,aACA,OACe;AACf,SAAO,YAAY,MAAM;AAC3B;AAMO,SAAS,oBACd,QACe;AACf,SAAO,YAAY,MAAM;AAC3B;AAUO,SAAS,WACd,eACoB;AA/EtB;AAgFE,OAAI,oDAAe,SAAf,mBAAqB,KAAK;AAC5B,WAAO,cAAc,KAAK;AAAA,EAC5B;AAEA,SAAO;AACT;","names":[]}

package/dist/website-photos-Cl1YqAno.d.ts

@@ -0,0 +1,21 @@
+interface WebsitePhoto {
+    id: number;
+    url: string;
+    thumbnail_url?: string;
+    medium_url?: string;
+    alt: string;
+    source: 'account' | 'industry';
+}
+interface WebsitePhotos {
+    logo?: WebsitePhoto | null;
+    favicon?: WebsitePhoto | null;
+    hero?: WebsitePhoto | null;
+    contact?: WebsitePhoto | null;
+    about?: WebsitePhoto | null;
+    careers?: WebsitePhoto | null;
+    preview_image?: WebsitePhoto | null;
+    stock_photos?: WebsitePhoto[];
+}
+type WebsitePhotosResponse = WebsitePhotos;
+
+export type { WebsitePhotos as W, WebsitePhoto as a, WebsitePhotosResponse as b };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keystone-design-bootstrap",
-  "version": "1.0.103",
+  "version": "1.0.104",
   "description": "Keystone Design Bootstrap - Sections, Elements, and Theme System for customer websites",
   "type": "module",
   "main": "./src/index.ts",

package/src/design_system/portal/LoginForm.tsx

@@ -204,30 +204,7 @@ export function LoginForm({ onSuccess, onClose }: LoginFormProps) {
         body: JSON.stringify({ phone: fullPhone, code }),
       });
       const result = await res.json().catch(() => ({}));
-      if (!res.ok) {
-        setError(result.error || 'That code is invalid or expired.');
-        captureEvent('portal_login_failed', { step: 'signin', reason: result.code || 'verification_failed' });
-        return;
-      }
-
-      // Compatibility path: verify_code may directly authenticate and set the
-      // session cookie via the route handler (no passwordless_auth needed).
-      if (result.authenticated) {
-        await setPixelUserData({ email: result.email || undefined, phone: fullPhone });
-        firePixelEvent('Lead', undefined, result?.eventId);
-        captureEvent('portal_login_step_advanced', {
-          from_step: 'signin',
-          to_step: 'authenticated',
-          reason: 'verification_direct_auth',
-        });
-        captureEvent('portal_login_completed', { flow: 'signin' });
-        setResendAvailableAt(null);
-        setSecondsUntilResend(0);
-        if (onSuccess) onSuccess(); else router.refresh();
-        return;
-      }
-
-      if (!result.verification_token) {
+      if (!res.ok || !result.verification_token) {
         setError(result.error || 'That code is invalid or expired.');
         captureEvent('portal_login_failed', { step: 'signin', reason: result.code || 'verification_failed' });
         return;

package/src/lib/consumer-session.ts

@@ -8,8 +8,10 @@ export const CONSUMER_TOKEN_COOKIE = 'ks_consumer_token';
 import type { Consumer, ConversationSummary, Message, ContactSummary } from '../types/api/consumer';
 export type { Consumer, ConversationSummary, Message, ContactSummary };
 
+// AUTH_API_URL (when set) points consumer auth/session endpoints at a dedicated
+// auth service (e.g. Heimdal); everything else keeps using API_URL.
 function getApiUrl(): string {
-  return process.env.API_URL || 'http://localhost:3000/api/v1';
+  return process.env.AUTH_API_URL || process.env.API_URL || 'http://localhost:3000/api/v1';
 }
 
 async function consumerFetch<T>(path: string, token: string): Promise<T | null> {

package/src/next/routes/consumer-auth.ts

@@ -11,9 +11,9 @@
  *
  * Env (server-side only):
  * - API_URL (default: http://localhost:3000/api/v1)
+ * - AUTH_API_URL (optional) — overrides API_URL for consumer auth/session endpoints.
+ *   Set this when auth lives on a separate service (e.g. Heimdal) from the data API.
  * - API_KEY
- * - CONSUMER_AUTH_URL (optional; overrides passwordless routes base, e.g.
- *   https://www.keystone.app/api/consumer)
  */
 
 import { CONSUMER_TOKEN_COOKIE } from '../../lib/consumer-session';
@@ -25,19 +25,13 @@ type NextResponseLike = { json: (body: unknown, init?: ResponseInit) => any };
 const COOKIE_MAX_AGE = 60 * 60 * 24 * 30; // 30 days
 
 function getApiUrl(): string {
-  return process.env.API_URL || 'http://localhost:3000/api/v1';
+  return process.env.AUTH_API_URL || process.env.API_URL || 'http://localhost:3000/api/v1';
 }
 
 function getApiKey(): string {
   return process.env.API_KEY || '';
 }
 
-function getPasswordlessBaseUrl(): string {
-  const override = (process.env.CONSUMER_AUTH_URL || '').trim();
-  if (override) return override.replace(/\/+$/, '');
-  return `${getApiUrl().replace(/\/+$/, '')}/consumer/auth`;
-}
-
 function apiHeaders(request?: Request): Record<string, string> {
   const key = getApiKey();
   return {
@@ -47,69 +41,22 @@ function apiHeaders(request?: Request): Record<string, string> {
   };
 }
 
-function responseData(json: Record<string, unknown>): Record<string, unknown> {
-  return (json.data as Record<string, unknown>) || json;
-}
-
-function readStringField(obj: Record<string, unknown>, key: string): string | null {
-  const value = obj[key];
-  return typeof value === 'string' && value.length > 0 ? value : null;
-}
-
-function readNestedStringField(
-  obj: Record<string, unknown>,
-  parentKey: string,
-  key: string
-): string | null {
-  const parent = obj[parentKey];
-  if (!parent || typeof parent !== 'object') return null;
-  const value = (parent as Record<string, unknown>)[key];
-  return typeof value === 'string' && value.length > 0 ? value : null;
+function asString(value: unknown): string | undefined {
+  return typeof value === 'string' && value ? value : undefined;
 }
 
-function extractAuthToken(data: Record<string, unknown>): string | null {
-  const direct =
-    readStringField(data, 'token') ||
-    readStringField(data, 'auth_token') ||
-    readStringField(data, 'access_token') ||
-    readStringField(data, 'session_token') ||
-    readStringField(data, 'jwt') ||
-    readNestedStringField(data, 'consumer', 'token') ||
-    readNestedStringField(data, 'session', 'token');
-  if (direct) return direct;
-
-  // Compatibility fallback: some backends rename token fields without notice.
-  // Walk a few levels and accept any non-empty string on keys containing "token"/"jwt".
-  const queue: Array<{ value: unknown; depth: number }> = [{ value: data, depth: 0 }];
-  const visited = new Set<object>();
-  while (queue.length > 0) {
-    const next = queue.shift();
-    if (!next) break;
-    const { value, depth } = next;
-    if (!value || typeof value !== 'object') continue;
-    if (visited.has(value as object)) continue;
-    visited.add(value as object);
-
-    const entries = Object.entries(value as Record<string, unknown>);
-    for (const [key, candidate] of entries) {
-      // Never treat verification tokens as auth/session JWTs.
-      if (/verification[_-]?token/i.test(key)) {
-        if (depth < 4 && candidate && typeof candidate === 'object') {
-          queue.push({ value: candidate, depth: depth + 1 });
-        }
-        continue;
-      }
-      const isTokenLikeKey = /token|jwt/i.test(key);
-      if (isTokenLikeKey && typeof candidate === 'string' && candidate.length > 0) {
-        return candidate;
-      }
-      if (depth < 4 && candidate && typeof candidate === 'object') {
-        queue.push({ value: candidate, depth: depth + 1 });
-      }
-    }
-  }
-
-  return null;
+// Rails returns errors at the top level ({ error, code }); FastAPI backends
+// (Heimdal) nest them under `detail`, where `error` is either a string or a
+// { code, message } object for validation failures. Read all shapes, but only
+// ever surface strings.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function upstreamError(json: any): { error?: string; code?: string; retry_in_seconds?: number } {
+  const err = json.error ?? json.detail?.error;
+  return {
+    error: asString(err) || asString(err?.message),
+    code: asString(json.code) || asString(json.detail?.code) || asString(err?.code),
+    retry_in_seconds: json.retry_in_seconds ?? json.detail?.retry_in_seconds,
+  };
 }
 
 // POST /api/consumer/initiate
@@ -133,8 +80,8 @@ async function handleInitiate(request: Request, NR: NextResponseLike): Promise<R
     if (res.status === 404) return NR.json({ exists: false });
     if (!res.ok) return NR.json({ exists: null });
 
-    const json = await res.json().catch(() => ({})) as Record<string, unknown>;
-    const data = responseData(json);
+    const json = await res.json().catch(() => ({}));
+    const data = json.data as Record<string, unknown> | undefined;
     return NR.json({
       exists: true,
       firstName: data?.first_name ?? undefined,
@@ -163,14 +110,14 @@ async function handleLogin(request: Request, NR: NextResponseLike): Promise<Resp
 
   const json = await res.json().catch(() => ({}));
   if (!res.ok) {
+    const err = upstreamError(json);
     return NR.json(
-      { error: json.error || 'Login failed. Please try again.', code: json.code },
+      { error: err.error || 'Login failed. Please try again.', code: err.code },
       { status: res.status }
     );
   }
 
-  const data = responseData(json);
-  const token = extractAuthToken(data);
+  const token = json.data?.token;
   if (!token) return NR.json({ error: 'No token received.' }, { status: 500 });
 
   const response = NR.json({});
@@ -206,16 +153,18 @@ async function handleSignup(request: Request, NR: NextResponseLike): Promise<Res
     }),
   });
 
-  const json = await res.json().catch(() => ({})) as Record<string, unknown>;
+  const json = await res.json().catch(() => ({}));
   if (!res.ok) {
-    return NR.json({ error: json.error || 'Signup failed. Please try again.' }, { status: res.status });
+    return NR.json(
+      { error: upstreamError(json).error || 'Signup failed. Please try again.' },
+      { status: res.status }
+    );
   }
 
-  const data = responseData(json);
-  const token = extractAuthToken(data);
+  const token = json.data?.token;
   if (!token) return NR.json({ error: 'No token received.' }, { status: 500 });
 
-  const response = NR.json({ claimed: data?.claimed ?? false });
+  const response = NR.json({ claimed: json.data?.claimed ?? false });
   response.cookies.set(CONSUMER_TOKEN_COOKIE, token, {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',
@@ -233,27 +182,27 @@ async function handleSendCode(request: Request, NR: NextResponseLike): Promise<R
   const { phone } = body;
   if (!phone) return NR.json({ error: 'Phone is required.' }, { status: 422 });
 
-  const res = await fetch(`${getPasswordlessBaseUrl()}/send_code`, {
+  const res = await fetch(`${getApiUrl()}/consumer/auth/send_code`, {
     method: 'POST',
     headers: apiHeaders(request),
     body: JSON.stringify({ phone }),
   });
 
-  const json = await res.json().catch(() => ({})) as Record<string, unknown>;
-  const data = responseData(json);
+  const json = await res.json().catch(() => ({}));
   if (!res.ok) {
+    const err = upstreamError(json);
     return NR.json(
       {
-        error: (json as Record<string, unknown>).error || 'Failed to send verification code. Please try again.',
-        code: (json as Record<string, unknown>).code,
-        retry_in_seconds: (json as Record<string, unknown>).retry_in_seconds,
+        error: err.error || 'Failed to send verification code. Please try again.',
+        code: err.code,
+        retry_in_seconds: err.retry_in_seconds,
       },
       { status: res.status }
     );
   }
 
   return NR.json({
-    resend_available_at: data?.resend_available_at ?? null,
+    resend_available_at: json.data?.resend_available_at ?? null,
   });
 }
 
@@ -264,49 +213,26 @@ async function handleVerifyCode(request: Request, NR: NextResponseLike): Promise
   const { phone, code } = body;
   if (!phone || !code) return NR.json({ error: 'Phone and code are required.' }, { status: 422 });
 
-  const res = await fetch(`${getPasswordlessBaseUrl()}/verify_code`, {
+  const res = await fetch(`${getApiUrl()}/consumer/auth/verify_code`, {
     method: 'POST',
     headers: apiHeaders(request),
     body: JSON.stringify({ phone, code }),
   });
 
-  const json = await res.json().catch(() => ({})) as Record<string, unknown>;
-  const data = responseData(json);
+  const json = await res.json().catch(() => ({}));
   if (!res.ok) {
+    const err = upstreamError(json);
     return NR.json(
-      {
-        error: (json as Record<string, unknown>).error || 'Verification failed. Please try again.',
-        code: (json as Record<string, unknown>).code,
-      },
+      { error: err.error || 'Verification failed. Please try again.', code: err.code },
       { status: res.status }
     );
   }
 
-  // Some surfaces return a direct session token on verify.
-  const directToken = extractAuthToken(data);
-  if (directToken) {
-    const response = NR.json({
-      authenticated: true,
-      first_name: data?.first_name ?? '',
-      last_name: data?.last_name ?? '',
-      email: data?.email ?? '',
-      eventId: data?.event_id ?? undefined,
-    });
-    response.cookies.set(CONSUMER_TOKEN_COOKIE, directToken, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === 'production',
-      sameSite: 'lax',
-      path: '/',
-      maxAge: COOKIE_MAX_AGE,
-    });
-    return response;
-  }
-
   return NR.json({
-    verification_token: data?.verification_token,
-    first_name: data?.first_name ?? '',
-    last_name: data?.last_name ?? '',
-    email: data?.email ?? '',
+    verification_token: json.data?.verification_token,
+    first_name: json.data?.first_name ?? '',
+    last_name: json.data?.last_name ?? '',
+    email: json.data?.email ?? '',
   });
 }
 
@@ -322,7 +248,7 @@ async function handlePasswordlessAuth(request: Request, NR: NextResponseLike): P
     return NR.json({ error: 'First name, last name, and email are required.' }, { status: 422 });
   }
 
-  const res = await fetch(`${getPasswordlessBaseUrl()}/passwordless_auth`, {
+  const res = await fetch(`${getApiUrl()}/consumer/auth/passwordless_auth`, {
     method: 'POST',
     headers: apiHeaders(request),
     body: JSON.stringify({
@@ -334,21 +260,20 @@ async function handlePasswordlessAuth(request: Request, NR: NextResponseLike): P
     }),
   });
 
-  const json = await res.json().catch(() => ({})) as Record<string, unknown>;
-  const data = responseData(json);
+  const json = await res.json().catch(() => ({}));
   if (!res.ok) {
     return NR.json(
-      { error: (json as Record<string, unknown>).error || 'Authentication failed. Please try again.' },
+      { error: upstreamError(json).error || 'Authentication failed. Please try again.' },
       { status: res.status }
     );
   }
 
-  const token = extractAuthToken(data);
+  const token = json.data?.token;
   if (!token) return NR.json({ error: 'No token received.' }, { status: 500 });
 
   // Surface the server-side Lead event_id so the browser can fire a single deduped
   // Lead (fbq track with { eventID }) that Meta matches against the CAPI Lead event.
-  const response = NR.json({ eventId: data?.event_id ?? undefined });
+  const response = NR.json({ eventId: json.data?.event_id ?? undefined });
   response.cookies.set(CONSUMER_TOKEN_COOKIE, token, {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',