fix(auth): show one terminal MFA expiry state

packages/auth/assets/client/auth.js

@@ -424,11 +424,16 @@
       form?.querySelectorAll("input, button").forEach((control) => {
         control.disabled = true;
       });
-      setMessage(
-        status,
-        "Your sign-in request has expired. Sign in again to get a fresh verification request.",
-        true,
-      );
+      // A form response's finalizer or hydration may re-enable buttons. Hide the
+      // entire stale form instead of leaving a second apparently usable action.
+      element.dataset.mfaExpired = "true";
+      if (form) form.hidden = true;
+      setMessage(status, "");
+      form?.querySelectorAll("[data-error]").forEach((error) => {
+        error.textContent = "";
+      });
+      const expiredMessage = element.querySelector("[data-auth-mfa-expired]");
+      if (expiredMessage) expiredMessage.hidden = false;
       const restart = element.querySelector("[data-auth-mfa-restart]");
       if (restart) restart.hidden = false;
     };

packages/auth/components/TwoFactorChallenge.wrn

@@ -51,6 +51,7 @@ component TwoFactorChallenge {
         <p data-error="_form" role="alert" class="m-0 hidden rounded-[var(--wrn-radius-sm)] bg-[color-mix(in_srgb,var(--wrn-color-danger)_10%,transparent)] p-3 text-sm text-[var(--wrn-color-danger)]"></p>
         <Button type="submit" label="{submitLabel}" variant="solid" color="{color}" size="{size}" fullWidth="true" />
       </form>
+      <p data-auth-mfa-expired role="alert" hidden class="wrn-auth-mfa-expired">Your sign-in request has expired. Sign in again to get a fresh verification request.</p>
       <nav class="wrn-auth-mfa-links" aria-label="Sign-in help">
         <a href='{signInHref}' data-auth-mfa-restart hidden>Back to sign in</a>
         <a href='{recoveryHref}'>Account recovery options</a>
@@ -58,6 +59,8 @@ component TwoFactorChallenge {
     </section>
   }
   style {
+    [data-auth-mfa-challenge][data-mfa-expired="true"] [data-auth-mfa-form] { display: none; }
+    .wrn-auth-mfa-expired { margin: 1.5rem 0 0; padding: 1rem; border: 1px solid var(--wrn-color-danger); border-radius: var(--wrn-radius-sm); background: color-mix(in srgb, var(--wrn-color-danger) 10%, transparent); color: var(--wrn-color-danger); font-size: 0.875rem; line-height: 1.5; }
     .wrn-auth-mfa-links { display: flex; flex-direction: column; align-items: flex-start; gap: 0.75rem; margin-top: 1.25rem; }
     .wrn-auth-mfa-links a { color: var(--wrn-color-primary); font-size: 0.875rem; }
     .wrn-auth-mfa-links a:hover { text-decoration: underline; }

packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/auth",
-  "version": "0.8.23",
+  "version": "0.8.24",
   "description": "Complete authentication, account security, MFA, passkeys, recovery, devices, risk, and audit system for WRNexusJS.",
   "type": "module",
   "sideEffects": false,

packages/auth/test/mfa-runtime.test.ts

@@ -12,16 +12,18 @@ test("expired and legacy MFA requests are rejected on mount before entering a co
       );
       window.document.body.innerHTML = `<section data-auth-mfa-challenge><form data-auth-mfa-form>
         <input name="mfaToken"><input type="radio" name="method" value="totp"><input name="code"><p data-auth-mfa-status hidden></p><button type="submit">Verify</button>
-        </form><a data-auth-mfa-restart hidden href="/login">Back to sign in</a></section>`;
+        </form><p data-auth-mfa-expired role="alert" hidden>Sign in again</p><a data-auth-mfa-restart hidden href="/login">Back to sign in</a></section>`;
       window.eval(readFileSync(new URL("../assets/client/auth.js", import.meta.url), "utf8"));
       (window as any).WRNexusAuth.mount(window.document);
       expect(window.document.querySelector("button")!.disabled).toBe(true);
       expect(window.document.querySelector<HTMLElement>("[data-auth-mfa-restart]")!.hidden).toBe(
         false,
       );
-      expect(window.document.querySelector("[data-auth-mfa-status]")!.textContent).toContain(
-        "Sign in again",
+      expect(window.document.querySelector<HTMLElement>("[data-auth-mfa-expired]")!.hidden).toBe(
+        false,
       );
+      expect(window.document.querySelector("form")!.hidden).toBe(true);
+      expect(window.document.querySelector("[data-auth-mfa-status]")!.textContent).toBe("");
       expect(window.sessionStorage.getItem("wrnexus.auth.mfa")).toBeNull();
     } finally {
       await window.happyDOM.close();
@@ -121,6 +123,12 @@ test("MFA radios preserve allowed methods and restore continuation without reviv
         detail: { code: "mfa-transaction-expired" },
       }),
     );
+    // Validation finalizers may restore button.disabled after dispatching error.
+    form.querySelector("button")!.disabled = false;
+    expect(form.hidden).toBe(true);
+    expect(
+      window.document.querySelector<HTMLElement>("[data-auth-mfa-challenge]")!.dataset.mfaExpired,
+    ).toBe("true");
     expect(window.sessionStorage.getItem("wrnexus.auth.mfa")).toBeNull();
     expect(window.document.querySelector<HTMLElement>("[data-auth-mfa-restart]")!.hidden).toBe(
       false,