@payez/next-mvp 4.1.11 → 4.1.13

package/dist/api-handlers/auth/refresh.js

@@ -371,7 +371,7 @@ function createRefreshHandler(config) {
                     const errorMessage = idpError.message || 'Token refresh failed';
                     // CRITICAL: 401 means token is definitively invalid - always discard
                     // This prevents redirect loops where viability check keeps returning canRefresh:true
-                    let discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
+                    const discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
                     const retryable = refreshResponse.status !== 401 && idpError.retryable === true;
                     const resolution = idpError.resolution || null;
                     // ============================================================================
@@ -408,43 +408,20 @@ function createRefreshHandler(config) {
                     console.error('[AUTH_REFRESH] Full IDP error response:', JSON.stringify(responseData, null, 2).substring(0, 1000));
                     // If IDP signals to discard token, clear it from Redis
                     if (discardToken) {
-                        // Race-safe discard (CAS): only clear if the refresh token we sent is STILL
-                        // the current one. A concurrent refresh may have already rotated it — our 401
-                        // is then stale, and wiping here would silently log out a healthy session
-                        // (the rotation-race wipe, QA 6873 site 2). Skip the wipe + drop terminal if changed.
-                        const postRefresh = await (0, session_store_1.getSession)(sessionToken);
-                        const tokenUnchanged = !!originalRefreshToken && postRefresh?.idpRefreshToken === originalRefreshToken;
-                        if (tokenUnchanged) {
-                            console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
-                                reason: 'IDP_DISCARD_TOKEN',
-                                errorCode,
-                                userId,
-                                sessionToken: sessionToken.substring(0, 8) + '...',
-                                hadRefreshToken: !!currentSession.idpRefreshToken,
-                                stack: new Error().stack
-                            });
-                            await (0, session_store_1.updateSession)(sessionToken, {
-                                idpRefreshToken: '',
-                                idpRefreshTokenExpires: undefined,
-                                refreshTokenClearedAt: Date.now(),
-                                refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
-                            });
-                        }
-                        else {
-                            // Concurrent refresh already rotated the token — our 401 is stale. Return the
-                            // freshly-rotated token directly so the loser succeeds without a retry
-                            // (race-fix follow-up #1).
-                            discardToken = false;
-                            console.warn('[AUTH_REFRESH] Discard suppressed: refresh token already rotated by a concurrent refresh — returning the fresh token (race-safe).');
-                            if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
-                                return server_1.NextResponse.json({
-                                    refreshed: true,
-                                    reason: 'completed_by_concurrent_request',
-                                    accessTokenExpires: postRefresh.idpAccessTokenExpires,
-                                    hasRefreshToken: !!postRefresh.idpRefreshToken,
-                                });
-                            }
-                        }
+                        console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
+                            reason: 'IDP_DISCARD_TOKEN',
+                            errorCode,
+                            userId,
+                            sessionToken: sessionToken.substring(0, 8) + '...',
+                            hadRefreshToken: !!currentSession.idpRefreshToken,
+                            stack: new Error().stack
+                        });
+                        await (0, session_store_1.updateSession)(sessionToken, {
+                            idpRefreshToken: '',
+                            idpRefreshTokenExpires: undefined,
+                            refreshTokenClearedAt: Date.now(),
+                            refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
+                        });
                     }
                     return server_1.NextResponse.json({
                         error: errorMessage,

package/dist/auth/better-auth.d.ts

@@ -22,9 +22,6 @@ export interface BetterAuthSocialProvider {
     accessType?: 'offline' | 'online';
     hd?: string;
 }
-/**
- * Build Better Auth social providers from IDP config.
- */
 export declare function buildBetterAuthProviders(config: IDPClientConfig): Record<string, BetterAuthSocialProvider>;
 /**
  * Optional configuration for `createBetterAuthInstance`.

package/dist/auth/better-auth.js

@@ -53,6 +53,8 @@ exports.getBetterAuthHandler = getBetterAuthHandler;
 exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
+const node_async_hooks_1 = require("node:async_hooks");
+const jose_1 = require("jose"); // better-auth's own JWT dependency
 const better_auth_1 = require("better-auth");
 const next_js_1 = require("better-auth/next-js");
 const next_js_2 = require("better-auth/next-js");
@@ -60,10 +62,33 @@ const magic_link_1 = require("better-auth/plugins/magic-link");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const redis_1 = require("../lib/redis");
-const session_store_1 = require("../lib/session-store");
 /**
  * Build Better Auth social providers from IDP config.
  */
+/**
+ * REQUEST-SCOPED carrier for the provider's raw id_token. Card 138635.
+ *
+ * WHY THIS EXISTS: /api/ExternalAuth/oauth-callback mints an IDP bearer for any
+ * ASSERTED email — we send {provider, email} and nothing verifiable. The fix is
+ * for the IDP to require a provider-signed id_token and verify it itself. This
+ * is the client half: capture the token Better Auth already receives, and
+ * forward it. Additive — the IDP ignores it until its gate flips.
+ *
+ * WHY AsyncLocalStorage AND NOT REDIS (BAPert's ruling: forward, do not persist):
+ * an id_token is credential material. Writing it to the session record would put
+ * it one allow-list edit away from leaking out of /api/internal/session-data,
+ * and it would outlive the request that needed it. ALS scopes it to the single
+ * request, and it is gone when the request ends — nothing to expire, nothing to
+ * scrub, nothing to leak.
+ *
+ * SAFE BY CONSTRUCTION: getUserInfo (which fills this) and the post-callback
+ * exchange (which reads it) both run inside createAuthGetHandler's own request.
+ * VERIFIED, not assumed: better-auth.ts:452 awaits ba.GET(request) — the call
+ * that invokes getUserInfo — and the exchange follows at :465 in the SAME
+ * function. Outside that scope the store is undefined and the body simply omits
+ * id_token, which is the correct additive behaviour.
+ */
+const idTokenScope = new node_async_hooks_1.AsyncLocalStorage();
 function buildBetterAuthProviders(config) {
     const providers = {};
     for (const oauth of config.oauthProviders || []) {
@@ -93,6 +118,65 @@ function buildBetterAuthProviders(config) {
             accessType: rawAccessType === 'online' ? 'online' : rawAccessType === 'offline' ? 'offline' : undefined,
             hd: typeof rawHostedDomain === 'string' ? rawHostedDomain : undefined,
         };
+        /**
+         * CAPTURE THE RAW id_token — card 138635, client half.
+         *
+         * getUserInfo is the ONLY provider hook that receives the token set.
+         * mapProfileToUser cannot do this: it is handed the DECODED claims, and a
+         * signed JWT cannot be reconstructed from them. We need the raw token
+         * because the IDP must verify the signature ITSELF — a client-decoded
+         * claim is just another assertable field, which is the defect restated.
+         *
+         * ⚠ THIS REPLACES THE DEFAULT google getUserInfo ENTIRELY. Upstream calls
+         * `if (options.getUserInfo) return options.getUserInfo(token)` FIRST and
+         * returns our result verbatim, so everything the default did is now ours to
+         * do — including the `hd` hosted-domain restriction.
+         *
+         * `hd` IS NOT HYPOTHETICAL: it is wired from additionalParams.hd four lines
+         * above, so a client can restrict sign-in to a Google Workspace domain.
+         * Silently dropping it would let ANY Google account into a client that had
+         * restricted itself — a security regression introduced by a security fix.
+         * (Measured on 93: zero clients set it today. That is a reason to be
+         * careful, not a reason to skip it — it is configurable and unused, which
+         * is exactly the state in which a regression goes unnoticed.)
+         *
+         * SO WE DO NOT OVERRIDE AT ALL WHEN `hd` IS SET. We take the hook over
+         * ONLY where upstream's check is PROVABLY VACUOUS — its own first line is
+         * `if (!configuredHostedDomain) return true`. With no hd configured the
+         * default would return true unconditionally, so omitting it is equivalent
+         * by the library's own definition rather than by our judgement.
+         *
+         * A client that DOES set hd keeps the stock provider, keeps its domain
+         * restriction, and simply does not contribute an id_token yet. Losing a
+         * capability is an acceptable cost; silently losing a security control is
+         * not. (better-auth does not re-export the predicate through its public
+         * types, and reimplementing a security check is how two copies drift — so
+         * the honest move is to not need it.)
+         */
+        if (name === 'google' && !providers[name].hd) {
+            providers[name].getUserInfo = async (token) => {
+                if (!token?.idToken)
+                    return null;
+                // The only new behaviour: hand the raw token to this request's scope.
+                const scope = idTokenScope.getStore();
+                if (scope)
+                    scope.idToken = token.idToken;
+                // Mirrors the upstream default (google.mjs) verbatim, minus the hd
+                // branch that cannot fire here — so overriding the hook changes WHAT WE
+                // KEEP, never what we ACCEPT.
+                const claims = (0, jose_1.decodeJwt)(token.idToken);
+                return {
+                    user: {
+                        id: claims.sub,
+                        name: claims.name,
+                        email: claims.email,
+                        image: claims.picture,
+                        emailVerified: claims.email_verified,
+                    },
+                    data: claims,
+                };
+            };
+        }
     }
     return providers;
 }
@@ -126,24 +210,16 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
         // Redis-backed session storage via secondaryStorage
         secondaryStorage: {
             get: async (key) => {
-                try {
-                    return await (0, redis_1.getRedis)().get(`ba:${appSlug}:${key}`);
-                }
-                catch {
-                    return null;
-                }
+                return await (0, redis_1.getRedis)().get(`ba:${appSlug}:${key}`);
             },
             set: async (key, value, ttl) => {
-                try {
-                    const redis = (0, redis_1.getRedis)();
-                    if (ttl) {
-                        await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
-                    }
-                    else {
-                        await redis.setex(`ba:${appSlug}:${key}`, session_store_1.SESSION_TTL, value);
-                    }
+                const redis = (0, redis_1.getRedis)();
+                if (ttl) {
+                    await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
+                }
+                else {
+                    await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
                 }
-                catch { /* Redis unavailable — cookie cache still works */ }
             },
             delete: async (key) => {
                 try {
@@ -306,6 +382,30 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
                 name,
                 image,
                 client_id: config.clientSlug || String(config.clientId),
+                /**
+                 * Card 138635 — the RAW provider id_token, forwarded verbatim.
+                 *
+                 * Every other field in this body is an ASSERTION. The endpoint mints an
+                 * IDP bearer from them today with no cryptographic check of any kind,
+                 * which is why it is a complete authentication bypass and why it has
+                 * been publicly reachable for 488 days.
+                 *
+                 * This field is the only one the IDP can VERIFY: signature against
+                 * Google's JWKS, plus iss / exp / aud, and then read email_verified
+                 * from the verified claims. Additive — the IDP ignores it until its
+                 * gate flips, so this cannot break a login on its own.
+                 *
+                 * RAW, AND NOTHING DERIVED FROM IT (BAPert's ruling). We do NOT send a
+                 * decoded email_verified. A client-computed verification flag is a body
+                 * field with a better story: an attacker posts email_verified:true and
+                 * the defect is rebuilt one layer up. The IDP verifies for itself or
+                 * the fix is theatre.
+                 *
+                 * Absent when this runs outside the OAuth callback scope — the key is
+                 * simply omitted rather than sent null, so "we never captured one" stays
+                 * distinguishable from "the provider issued none".
+                 */
+                ...(idTokenScope.getStore()?.idToken ? { id_token: idTokenScope.getStore().idToken } : {}),
             }),
         });
         const oauthResText = await oauthRes.text();
@@ -327,20 +427,8 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             return false;
         }
         // Build IDP token data
-        // ORIGINAL INTENT: IDP withholds refresh_token until 2FA is complete, so
-        // !hasRefreshToken was a reliable "2FA required" signal.
-        //
-        // BUG [IDP-2FA-BUG]: IDP is currently returning refresh_token on the initial
-        // oauth-callback even for require_2fa tenants that haven't done 2FA yet.
-        // This made !hasRefreshToken=false → requiresTwoFactor=false → mfaVerified=true,
-        // bypassing the 2FA gate entirely.
-        //
-        // FIX: Always set mfaVerified=false on the initial OAuth exchange.
-        // The tenant's require_2fa setting is enforced by the viability endpoint
-        // (tenantRequiresTwoFactor=true), which redirects to verify-code whenever
-        // mfaVerified=false. After real 2FA, transitionTo2FASession() sets it true.
-        // Revert this comment + restore `mfaVerified: !requiresTwoFactor` once the
-        // IDP correctly withholds refresh_token until post-2FA.
+        // CRITICAL: If the IDP withholds refresh_token without setting requiresTwoFactor,
+        // treat missing refresh token as "2FA required" so middleware redirects to verify-code.
         const hasRefreshToken = !!result.refresh_token;
         const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? !hasRefreshToken;
         const idpTokenData = {
@@ -354,19 +442,19 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             name: result.user?.full_name || result.user?.name || result.name || name,
             image: image,
             roles: result.user?.roles || result.roles || [],
-            mfaVerified: false, // Always false post-OAuth — see IDP-2FA-BUG note above
+            mfaVerified: !requiresTwoFactor,
             idpClientId: result.client_id ? String(result.client_id) : undefined,
             merchantId: result.merchant_id ? String(result.merchant_id) : undefined,
         };
         // Store in BA Redis session (for decodeSession)
         baData.idpTokens = idpTokenData;
-        await (0, redis_1.getRedis)().setex(baKey, session_store_1.SESSION_TTL, JSON.stringify(baData));
+        await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
         // Write to canonical session store so refresh handler and token lifecycle can find the tokens.
         // Key format: {sessionPrefix}{token} — same key that getSession() reads from.
         try {
             const { getSessionPrefix } = await Promise.resolve().then(() => __importStar(require('../lib/app-slug')));
             const canonicalKey = `${getSessionPrefix()}${sessionToken}`;
-            await (0, redis_1.getRedis)().setex(canonicalKey, session_store_1.SESSION_TTL, JSON.stringify({
+            await (0, redis_1.getRedis)().setex(canonicalKey, 7 * 24 * 60 * 60, JSON.stringify({
                 ...idpTokenData,
                 oauthProvider: provider,
             }));
@@ -401,45 +489,52 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
  */
 function createAuthGetHandler(loginPath = '/account-auth/login') {
     return async function GET(request) {
-        const ba = await getBetterAuthHandler();
-        if (!ba) {
-            return new Response('Auth handler not configured', { status: 500 });
-        }
-        const response = await ba.GET(request);
-        // Intercept auth errors (state mismatch, expired cookies) — redirect to login cleanly
-        if (response.status === 302) {
-            const location = response.headers.get('location') || '';
-            if (location.includes('/api/auth/error') || location.includes('please_restart')) {
-                console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
-                return Response.redirect(new URL(loginPath, request.url), 302);
+        // Card 138635: establish the request-scoped carrier for the provider's raw
+        // id_token. It must wrap BOTH ba.GET (which invokes getUserInfo, the only
+        // hook that sees the token) and the exchange below (which forwards it).
+        // Wrapping the whole handler is what makes "never persisted" achievable —
+        // the token exists only for the life of this request.
+        return idTokenScope.run({}, async () => {
+            const ba = await getBetterAuthHandler();
+            if (!ba) {
+                return new Response('Auth handler not configured', { status: 500 });
             }
-        }
-        // After successful OAuth callback: exchange Google identity for IDP tokens
-        const url = new URL(request.url);
-        if (url.pathname.includes('/callback/') && response.status === 302) {
-            try {
-                const auth = await getBetterAuthInstance();
-                if (auth?.api?.getSession) {
-                    const setCookies = response.headers.getSetCookie?.() || [];
-                    const cookieHeader = setCookies
-                        .map((c) => c.split(';')[0])
-                        .join('; ');
-                    const headers = new Headers();
-                    headers.set('cookie', cookieHeader);
-                    const session = await auth.api.getSession({ headers });
-                    if (session?.session?.token) {
-                        console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| email:', session.user?.email);
-                        await exchangeOAuthForIdpTokens(session.session.token);
-                    }
-                    else {
-                        console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
-                    }
+            const response = await ba.GET(request);
+            // Intercept auth errors (state mismatch, expired cookies) — redirect to login cleanly
+            if (response.status === 302) {
+                const location = response.headers.get('location') || '';
+                if (location.includes('/api/auth/error') || location.includes('please_restart')) {
+                    console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
+                    return Response.redirect(new URL(loginPath, request.url), 302);
                 }
             }
-            catch (err) {
-                console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+            // After successful OAuth callback: exchange Google identity for IDP tokens
+            const url = new URL(request.url);
+            if (url.pathname.includes('/callback/') && response.status === 302) {
+                try {
+                    const auth = await getBetterAuthInstance();
+                    if (auth?.api?.getSession) {
+                        const setCookies = response.headers.getSetCookie?.() || [];
+                        const cookieHeader = setCookies
+                            .map((c) => c.split(';')[0])
+                            .join('; ');
+                        const headers = new Headers();
+                        headers.set('cookie', cookieHeader);
+                        const session = await auth.api.getSession({ headers });
+                        if (session?.session?.token) {
+                            console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| email:', session.user?.email);
+                            await exchangeOAuthForIdpTokens(session.session.token);
+                        }
+                        else {
+                            console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
+                        }
+                    }
+                }
+                catch (err) {
+                    console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+                }
             }
-        }
-        return response;
+            return response;
+        });
     };
 }

package/dist/client/better-auth-client.d.ts

@@ -814,7 +814,13 @@ export declare const authClient: {
         isPending: boolean;
         isRefetching: boolean;
         error: import("@better-fetch/fetch").BetterFetchError | null;
-        refetch: (queryParams?: {
+        refetch: (queryParams
+        /**
+         * NextAuth-compatible signOut wrapper.
+         *
+         * Maps NextAuth signOut({ redirect, callbackUrl }) to Better Auth.
+         */
+        ?: {
             query?: import("better-auth/types").SessionQueryParams;
         } | undefined) => Promise<void>;
     };
@@ -988,7 +994,13 @@ export declare const useSession: () => {
     isPending: boolean;
     isRefetching: boolean;
     error: import("@better-fetch/fetch").BetterFetchError | null;
-    refetch: (queryParams?: {
+    refetch: (queryParams
+    /**
+     * NextAuth-compatible signOut wrapper.
+     *
+     * Maps NextAuth signOut({ redirect, callbackUrl }) to Better Auth.
+     */
+    ?: {
         query?: import("better-auth/types").SessionQueryParams;
     } | undefined) => Promise<void>;
 }, signIn: {

package/dist/lib/ensure-fresh-access-token.js

@@ -158,16 +158,8 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
         if (isOAuthSession && session.mfaVerified && acrValue === '1') {
             acrValue = '2';
         }
-        // WO-2: send the POST-lock current refresh token, not the pre-lock snapshot.
-        // `session` was read before we acquired the lock; a concurrent refresh that
-        // completed while we waited rotates the token, so the pre-lock value is stale
-        // and would draw an avoidable 401 (the CAS now catches the resulting wipe, but
-        // the round-trip is wasted). `latest` is the authoritative post-lock session.
-        // Auth-context (amr/acr/2FA) intentionally still derives from `session` — it is
-        // the identity context of THIS request, unchanged by a token rotation.
-        const sentRefreshToken = latest?.idpRefreshToken ?? session.idpRefreshToken;
         const body = {
-            refresh_token: sentRefreshToken,
+            refresh_token: session.idpRefreshToken,
             amr: authMethods,
             acr: acrValue,
         };
@@ -208,41 +200,15 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
         if (!idpResponse.ok) {
             const idpError = responseData?.error || {};
             const code = idpError.code || 'UNKNOWN_ERROR';
-            let discardToken = idpResponse.status === 401 || idpError.discard_token === true;
+            const discardToken = idpResponse.status === 401 || idpError.discard_token === true;
             const retryable = idpResponse.status !== 401 && idpError.retryable === true;
             if (discardToken) {
-                // Race-safe discard (CAS): only clear if the refresh token we used is STILL
-                // current. A concurrent refresh may have already rotated it — our 401 is then
-                // stale/expected, and wiping here would silently log out a healthy session
-                // (the rotation-race wipe, QA 6873 site 1/2). Compare-and-skip if it changed;
-                // a concurrent rotation is NOT a terminal condition.
-                const postRefresh = await (0, session_store_1.getSession)(sessionToken);
-                // CAS compares against the token we ACTUALLY SENT (WO-2: sentRefreshToken,
-                // the post-lock value), not the pre-lock snapshot — otherwise a token rotated
-                // between pre-lock read and our send would be misjudged.
-                const tokenUnchanged = !!sentRefreshToken && postRefresh?.idpRefreshToken === sentRefreshToken;
-                if (tokenUnchanged) {
-                    await (0, session_store_1.updateSession)(sessionToken, {
-                        idpRefreshToken: '',
-                        idpRefreshTokenExpires: undefined,
-                        refreshTokenClearedAt: Date.now(),
-                        refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
-                    });
-                }
-                else {
-                    // Concurrent refresh already rotated the token — our 401 is stale. Return the
-                    // freshly-rotated token directly so the loser succeeds without a retry round-trip
-                    // (race-fix follow-up #1).
-                    discardToken = false;
-                    if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
-                        return {
-                            ok: true,
-                            accessToken: postRefresh.idpAccessToken,
-                            accessTokenExpires: postRefresh.idpAccessTokenExpires,
-                            refreshed: true,
-                        };
-                    }
-                }
+                await (0, session_store_1.updateSession)(sessionToken, {
+                    idpRefreshToken: '',
+                    idpRefreshTokenExpires: undefined,
+                    refreshTokenClearedAt: Date.now(),
+                    refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
+                });
             }
             return {
                 ok: false,

package/dist/lib/session-store.d.ts

@@ -9,7 +9,6 @@
  */
 import { SessionData } from '../models/SessionModel';
 export type { SessionData } from '../models/SessionModel';
-export declare const SESSION_TTL: number;
 export interface RefreshLockInfo {
     sessionToken: string;
     acquiredAt: number;

package/dist/lib/session-store.js

@@ -12,7 +12,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SESSION_TTL = void 0;
 exports.generateSessionToken = generateSessionToken;
 exports.createSession = createSession;
 exports.getSession = getSession;
@@ -47,10 +46,7 @@ const getSessionVersionKey = (token) => `${(0, app_slug_1.getSessionPrefix)()}ve
 // Better Auth uses a different key format: ba:{appSlug}:{token}
 const getBetterAuthSessionKey = (token, appSlug) => `ba:${appSlug || 'app'}:${token}`;
 const REFRESH_LOCK_TTL = 60; // 60 seconds
-// 3 days in seconds (matches refresh token lifetime). EXPORTED as the single source
-// of session TTL — better-auth.ts derives its BA-session Redis TTL from this so the
-// two can never drift apart again (the 7d-vs-3d drift = the zombie-session window, QA 6952).
-exports.SESSION_TTL = 3 * 24 * 60 * 60;
+const SESSION_TTL = 3 * 24 * 60 * 60; // 3 days in seconds (matches refresh token lifetime)
 /**
  * Generates a new session token.
  * @returns A new session token string.
@@ -70,8 +66,8 @@ async function createSession(data) {
     const versionKey = getSessionVersionKey(sessionToken);
     try {
         await redis_1.default.multi()
-            .setex(key, exports.SESSION_TTL, JSON.stringify(data))
-            .setex(versionKey, exports.SESSION_TTL, '1')
+            .setex(key, SESSION_TTL, JSON.stringify(data))
+            .setex(versionKey, SESSION_TTL, '1')
             .exec();
     }
     catch (error) {
@@ -152,7 +148,7 @@ async function getBetterAuthSession(sessionToken, appSlug) {
  */
 async function touchSession(token) {
     const key = getSessionKey(token);
-    await redis_1.default.expire(key, exports.SESSION_TTL);
+    await redis_1.default.expire(key, SESSION_TTL);
 }
 /**
  * Retrieves a session along with a version identifier for optimistic locking.
@@ -218,9 +214,9 @@ async function setSession(sessionToken, data) {
     const key = getSessionKey(sessionToken);
     const versionKey = getSessionVersionKey(sessionToken);
     await redis_1.default.multi()
-        .setex(key, exports.SESSION_TTL, JSON.stringify(data))
+        .setex(key, SESSION_TTL, JSON.stringify(data))
         .incr(versionKey)
-        .expire(versionKey, exports.SESSION_TTL)
+        .expire(versionKey, SESSION_TTL)
         .exec();
 }
 /**
@@ -258,9 +254,9 @@ async function updateSession(sessionToken, updates) {
     const updatedSession = { ...currentSession, ...updates };
     // Write the entire updated session back to Redis with version increment
     await redis_1.default.multi()
-        .setex(key, exports.SESSION_TTL, JSON.stringify(updatedSession))
+        .setex(key, SESSION_TTL, JSON.stringify(updatedSession))
         .incr(versionKey)
-        .expire(versionKey, exports.SESSION_TTL)
+        .expire(versionKey, SESSION_TTL)
         .exec();
     return updatedSession;
 }
@@ -489,27 +485,27 @@ async function releaseRefreshLock(sessionToken, requestId, lockVersion) {
     const lockKey = getRefreshLockKey(sessionToken);
     try {
         // Lua script for atomic lock validation and release
-        const luaScript = `
-      local lockKey = KEYS[1]
-      local expectedRequestId = ARGV[1]
-      local expectedVersion = ARGV[2]
-
-      local lockData = redis.call('GET', lockKey)
-      if not lockData then
-        return 0  -- Lock doesn't exist
-      end
-
-      local lockInfo = cjson.decode(lockData)
-      if lockInfo.acquiredBy == expectedRequestId then
-        if not expectedVersion or expectedVersion == '' or tostring(lockInfo.lockVersion) == expectedVersion then
-          redis.call('DEL', lockKey)
-          return 1  -- Successfully released
-        else
-          return -2  -- Version mismatch
-        end
-      else
-        return -1  -- Wrong owner
-      end
+        const luaScript = `
+      local lockKey = KEYS[1]
+      local expectedRequestId = ARGV[1]
+      local expectedVersion = ARGV[2]
+
+      local lockData = redis.call('GET', lockKey)
+      if not lockData then
+        return 0  -- Lock doesn't exist
+      end
+
+      local lockInfo = cjson.decode(lockData)
+      if lockInfo.acquiredBy == expectedRequestId then
+        if not expectedVersion or expectedVersion == '' or tostring(lockInfo.lockVersion) == expectedVersion then
+          redis.call('DEL', lockKey)
+          return 1  -- Successfully released
+        else
+          return -2  -- Version mismatch
+        end
+      else
+        return -1  -- Wrong owner
+      end
     `;
         const result = await redis_1.default.eval(luaScript, 1, lockKey, requestId, lockVersion ? lockVersion.toString() : '');
         if (result === 1) {