Pair 4.1.3

Protected browser pages now redirect to login when the web session has expired, even if the navigation also carries AJAX or JSON headers. Background fetch/XHR requests continue to receive HTTP 401 with the existing AUTH_SESSION_EXPIRED payload, so applications can show a session-expired notice without replacing the page with login HTML.

This release also includes the previously committed Supabase key fix: anonymous, user-token and Realtime flows require SUPABASE_ANON_KEY and no longer fall back to the server-only service-role key.

Upgrade and compatibility

• Update with composer update viames/pair within your existing Pair 4 constraint, or require viames/pair:^4.1.3.
• No database migration or new session setting is required.
• API modules and native bearer-token authentication retain their response contracts.
• Supabase applications using public/user flows must configure SUPABASE_ANON_KEY; an absent key now raises a configuration error.

Validation

• Framework PHPUnit suite: 533 tests, 2246 assertions, 2 skipped.
• Real local browser checks with a genuinely expired database-backed PHP session: document navigation shows login HTML; AJAX returns 401, shows one notice and navigates only after user confirmation.

Rollback

Restore the previous application composer.lock and run composer install to return to the previously deployed dependency set. Pair 4.1.2 lacks the Supabase key fix: assess that security risk before reverting. No schema rollback is needed.