[botinc-agent]

Problem

Two defects surfaced in the release QA of the Next.js authentication sample, and one layout bug:

• A browser that opened /auth/reauthenticate after its session had ended was answered {"error":"signed_out"} — raw JSON after an ordinary link click.
• Signing in again in a browser whose earlier session Didit refused to end answered 500 after the code was spent, so the new session was lost.
• At 390 px, a 60-character address made the home page wider than the screen.

Solution

• packages/auth-nextjs/src/server/proxy.ts: when no session is left, reauthentication now redirects a browser to /auth/sign-in with redirect_url kept; the SDK's own fetch client still gets the 401.
• proxy.ts: ending the earlier session on sign-in is best effort, so a Didit failure no longer discards the new session cookies.
• examples/nextjs/app/globals.css: the home page's lead line wraps long values instead of overflowing.
• Tests cover the redirect, the fetch-client 401 and the 503-while-ending-the-old-session case; the README documents the redirect.

Verification

• npm run test:auth — 153 tests pass; the two new proxy tests fail on the previous source and pass with the fix.
• npm run typecheck:auth, ESLint on the touched packages — clean.
• next build of the sample, then a real next start with a local Frontend API stand-in: the 390 px page measured 601 px wide before and 390 px after, and /auth/reauthenticate returned 401 JSON before and a 307 to the hosted sign-in after. Screenshots are in the proof folder.
• The Playwright staging suite was not run: this checkout has no application key with Authentication enabled. The sign-out outage behaviour stays unchanged and is reported as a product follow-up.

Visual proof

Next.js authentication slice: before and after

• before-390-long-email.png / after-390-long-email.png — the sample's home page at 390 px with a 68-character email. Before, the page scrolled 601 px wide; after it stays at 390 px and the address wraps.
• before-reauthenticate.png / after-reauthenticate.png — a browser opening /auth/reauthenticate?... after its session ended. Before, raw {"error":"signed_out"}; after, the hosted sign-in page with redirect_url kept.

Both runs used a real next build/next start on the sample with a local stand-in for the Frontend API.