@payez/next-mvp 4.10.0 → 4.12.0

package/dist/lib/jwt-decode-client.js

@@ -5,6 +5,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.jwtDecode = jwtDecode;
+const log_safe_1 = require("./log-safe");
 // Decode base64url
 function base64urlDecode(base64url) {
     try {
@@ -40,7 +41,7 @@ function jwtDecode(token) {
         return parsedPayload;
     }
     catch (e) {
-        console.error('[JWT] Decode failed:', e instanceof Error ? e.message : 'Unknown error');
+        console.error('[JWT] Decode failed:', (0, log_safe_1.errForLog)(e));
         return null;
     }
 }

package/dist/lib/jwt-decode.js

@@ -4,6 +4,7 @@ exports.jwtDecode = jwtDecode;
 exports.decodeJwtHeader = decodeJwtHeader;
 exports.extractKidFromToken = extractKidFromToken;
 const jwt_decode_1 = require("jwt-decode");
+const log_safe_1 = require("./log-safe");
 /**
  * Decode JWT payload (standard claims).
  * This is a thin wrapper around jwt-decode library.
@@ -40,7 +41,7 @@ function decodeJwtHeader(token) {
         return JSON.parse(headerJson);
     }
     catch (error) {
-        console.error('[JWT_DECODE] Failed to decode JWT header:', error);
+        console.error('[JWT_DECODE] Failed to decode JWT header:', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }

package/dist/lib/log-safe.d.ts

@@ -0,0 +1,19 @@
+/**
+ * log-safe: the ONLY way a caught error or an upstream `code` goes into a server log (PII-in-logs census, BAPert 76553 group 1; ported from the
+ * portal's api-error-response.ts, BAPert 76470).
+ *
+ * Server logs persist and are read beyond the person who made the request. An error's `message`, `stack`, `cause` and `details` can carry an
+ * email, a phone number, a code, a token, a SQL fragment or a host: an IdP error's message is the upstream's own free text, and V8's JSON parse
+ * error quotes its input. So a log line gets the error's NAME and a closed STATUS / CODE, nothing else. Every field is matched against a closed
+ * shape; anything that does not match is dropped, not truncated.
+ *
+ * No imports on purpose: this is a leaf, loaded by modules that must not pull in anything else.
+ */
+/** An upstream `code` is loggable only if it is a closed token (UPPER_SNAKE). Anything else, including free text, becomes null. */
+export declare function closedCodeForLog(code: unknown): string | null;
+/**
+ * Describe a caught error for a log line: `error=<Name> [status=<n>] [code=<CLOSED_CODE>]`.
+ * It NEVER carries `message`, `stack`, `cause` or `details`. A name that is not a short identifier (a hostile or free-text `name`) becomes
+ * `NonError`; a status outside 100-599 is dropped; a code outside the closed token shape is dropped.
+ */
+export declare function errForLog(err: unknown): string;

package/dist/lib/log-safe.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * log-safe: the ONLY way a caught error or an upstream `code` goes into a server log (PII-in-logs census, BAPert 76553 group 1; ported from the
+ * portal's api-error-response.ts, BAPert 76470).
+ *
+ * Server logs persist and are read beyond the person who made the request. An error's `message`, `stack`, `cause` and `details` can carry an
+ * email, a phone number, a code, a token, a SQL fragment or a host: an IdP error's message is the upstream's own free text, and V8's JSON parse
+ * error quotes its input. So a log line gets the error's NAME and a closed STATUS / CODE, nothing else. Every field is matched against a closed
+ * shape; anything that does not match is dropped, not truncated.
+ *
+ * No imports on purpose: this is a leaf, loaded by modules that must not pull in anything else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.closedCodeForLog = closedCodeForLog;
+exports.errForLog = errForLog;
+/** An upstream `code` is loggable only if it is a closed token (UPPER_SNAKE). Anything else, including free text, becomes null. */
+function closedCodeForLog(code) {
+    return typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code) ? code : null;
+}
+/**
+ * Describe a caught error for a log line: `error=<Name> [status=<n>] [code=<CLOSED_CODE>]`.
+ * It NEVER carries `message`, `stack`, `cause` or `details`. A name that is not a short identifier (a hostile or free-text `name`) becomes
+ * `NonError`; a status outside 100-599 is dropped; a code outside the closed token shape is dropped.
+ */
+function errForLog(err) {
+    const e = (err !== null && typeof err === 'object' ? err : {});
+    const name = typeof e.name === 'string' && /^[A-Za-z0-9_]{1,48}$/.test(e.name) ? e.name : 'NonError';
+    const status = typeof e.status === 'number' && Number.isInteger(e.status) && e.status >= 100 && e.status <= 599 ? ` status=${e.status}` : '';
+    const closed = closedCodeForLog(e.code);
+    const code = closed ? ` code=${closed}` : '';
+    return `error=${name}${status}${code}`;
+}

package/dist/lib/redis.js

@@ -7,6 +7,7 @@ exports.redis = void 0;
 exports.getRedis = getRedis;
 // E:\Repos\PayEz-Next-MVP\packages\next-mvp\src\lib\redis.ts
 const ioredis_1 = __importDefault(require("ioredis"));
+const log_safe_1 = require("./log-safe");
 let client = null;
 // ── 183496: fail FAST and NAMED, never a 20s spinner ───────────────────────
 // The DEFAULTS were the defect (Nextpert-Scout's killable-proxy measurement,
@@ -75,7 +76,7 @@ function createClient() {
     // unhandled EventEmitter error, which can take the whole PROCESS down -
     // a Redis blip becoming a dead server is worse than the spinner was.
     instance.on('error', (err) => {
-        console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${(0, log_safe_1.errForLog)(err)}`);
     });
     // 185121 line 3: the 16:05 event left no named trigger because ONLY 'error'
     // was listened for. A reconnect or a clean end is silent in the artifact,

package/dist/lib/refresh-in-doubt.d.ts

@@ -0,0 +1,31 @@
+/** How long a refresh fetch (connect, response and body) may take. 5 s lock wait + this + the persist stays well inside the 60 s lock TTL. */
+export declare const REFRESH_FETCH_TIMEOUT_MS = 10000;
+/** The typed terminal answer for an attempt that would re-send an in-doubt token. */
+export declare const REFRESH_OUTCOME_UNKNOWN_CODE = "REFRESH_OUTCOME_UNKNOWN";
+/** The typed answer for the timed-out call itself. */
+export declare const UPSTREAM_TIMEOUT_CODE = "UPSTREAM_TIMEOUT";
+/** A one-way identity for a refresh token. Not reversible and not a prefix. */
+export declare function refreshTokenIdentity(token: string): string;
+/** The row fields recorded at a timeout. */
+export declare function inDoubtPatch(sentToken: string): {
+    refreshInDoubtTokenHash: string;
+    refreshInDoubtAt: number;
+};
+/** True when the token we are about to send is the one a previous attempt left in doubt. */
+export declare function isRefreshInDoubt(session: {
+    refreshInDoubtTokenHash?: string | null;
+} | null | undefined, tokenToSend: string | null | undefined): boolean;
+/** True for the error `AbortSignal.timeout` produces (a DOMException named TimeoutError); AbortError is treated the same. */
+export declare function isTimeoutError(err: unknown): boolean;
+/**
+ * The ONLY transport error codes that PROVE the request never left this process (BAPert 76433 item 4): the connection was refused, or the
+ * name did not resolve. Anything else (ECONNRESET, UND_ERR_SOCKET, a timeout, an error with no code) may have happened AFTER the request was
+ * written, so the IdP may have consumed the token: outcome unknown. The cost is lopsided on purpose: a false in-doubt costs one re-login, a
+ * missed one costs a user-wide revocation. Do NOT add a code here without proof it can only occur before the request is sent.
+ */
+export declare const REQUEST_NEVER_LEFT_CODES: ReadonlySet<string>;
+/**
+ * True only when the error carries at least one cause code and EVERY code it carries is in the never-left allowlist. An error with no code
+ * is NOT proof, so it is in-doubt.
+ */
+export declare function requestNeverLeft(err: unknown): boolean;

package/dist/lib/refresh-in-doubt.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REQUEST_NEVER_LEFT_CODES = exports.UPSTREAM_TIMEOUT_CODE = exports.REFRESH_OUTCOME_UNKNOWN_CODE = exports.REFRESH_FETCH_TIMEOUT_MS = void 0;
+exports.refreshTokenIdentity = refreshTokenIdentity;
+exports.inDoubtPatch = inDoubtPatch;
+exports.isRefreshInDoubt = isRefreshInDoubt;
+exports.isTimeoutError = isTimeoutError;
+exports.requestNeverLeft = requestNeverLeft;
+/**
+ * The IdP fetch timeout and the "refresh in doubt" marker (BAPert 76397 decision 3, corrected by 76403; Core facts DotNetPert 76400).
+ *
+ * THE PROBLEM. Core consumes a refresh token with one atomic UPDATE and has NO reuse grace: re-presenting a used token revokes every newer
+ * refresh token the USER holds, on every device (RevokeDescendantTokens). So when OUR fetch to the IdP times out, we do not know whether Core
+ * consumed the token and minted a replacement whose answer we never saw. The store still holds the token we SENT (nothing was persisted).
+ * Holding the refresh lock only delays the next request by its 60 s TTL; after that the next request re-reads the same token and replays it.
+ *
+ * THE RULE. A timed-out refresh answers 504 UPSTREAM_TIMEOUT and records, on the session row, an IDENTITY (a SHA-256, never the token and
+ * never a prefix of it) of the token that was sent. Any later attempt whose token-to-send matches that identity refuses WITHOUT calling the
+ * IdP: terminal REFRESH_OUTCOME_UNKNOWN / REAUTHENTICATE. One login on one session is better than a user-wide revocation. The marker is
+ * dropped by the same write that stores a DIFFERENT refresh token (session-store `dropStaleDiscardMarker`); nothing tries to resolve the doubt
+ * without a login.
+ *
+ * Leaf module: no imports from the rest of the package, so session-store can use it without a cycle.
+ */
+const crypto_1 = require("crypto");
+/** How long a refresh fetch (connect, response and body) may take. 5 s lock wait + this + the persist stays well inside the 60 s lock TTL. */
+exports.REFRESH_FETCH_TIMEOUT_MS = 10_000;
+/** The typed terminal answer for an attempt that would re-send an in-doubt token. */
+exports.REFRESH_OUTCOME_UNKNOWN_CODE = 'REFRESH_OUTCOME_UNKNOWN';
+/** The typed answer for the timed-out call itself. */
+exports.UPSTREAM_TIMEOUT_CODE = 'UPSTREAM_TIMEOUT';
+/** A one-way identity for a refresh token. Not reversible and not a prefix. */
+function refreshTokenIdentity(token) {
+    return (0, crypto_1.createHash)('sha256').update(token, 'utf8').digest('hex');
+}
+/** The row fields recorded at a timeout. */
+function inDoubtPatch(sentToken) {
+    return { refreshInDoubtTokenHash: refreshTokenIdentity(sentToken), refreshInDoubtAt: Date.now() };
+}
+/** True when the token we are about to send is the one a previous attempt left in doubt. */
+function isRefreshInDoubt(session, tokenToSend) {
+    if (!session || typeof session.refreshInDoubtTokenHash !== 'string' || !session.refreshInDoubtTokenHash)
+        return false;
+    if (typeof tokenToSend !== 'string' || tokenToSend.length === 0)
+        return false;
+    return refreshTokenIdentity(tokenToSend) === session.refreshInDoubtTokenHash;
+}
+/** True for the error `AbortSignal.timeout` produces (a DOMException named TimeoutError); AbortError is treated the same. */
+function isTimeoutError(err) {
+    const name = err?.name;
+    return name === 'TimeoutError' || name === 'AbortError';
+}
+/**
+ * The ONLY transport error codes that PROVE the request never left this process (BAPert 76433 item 4): the connection was refused, or the
+ * name did not resolve. Anything else (ECONNRESET, UND_ERR_SOCKET, a timeout, an error with no code) may have happened AFTER the request was
+ * written, so the IdP may have consumed the token: outcome unknown. The cost is lopsided on purpose: a false in-doubt costs one re-login, a
+ * missed one costs a user-wide revocation. Do NOT add a code here without proof it can only occur before the request is sent.
+ */
+exports.REQUEST_NEVER_LEFT_CODES = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);
+/** Every `code` on the error, its `cause`, and the members of an AggregateError (undici wraps the socket error in `cause`). */
+function transportCodes(err, depth = 0, out = []) {
+    if (!err || typeof err !== 'object' || depth > 4)
+        return out;
+    const e = err;
+    if (typeof e.code === 'string' && e.code)
+        out.push(e.code);
+    if (e.cause)
+        transportCodes(e.cause, depth + 1, out);
+    if (Array.isArray(e.errors))
+        for (const inner of e.errors)
+            transportCodes(inner, depth + 1, out);
+    return out;
+}
+/**
+ * True only when the error carries at least one cause code and EVERY code it carries is in the never-left allowlist. An error with no code
+ * is NOT proof, so it is in-doubt.
+ */
+function requestNeverLeft(err) {
+    const codes = transportCodes(err);
+    return codes.length > 0 && codes.every((c) => exports.REQUEST_NEVER_LEFT_CODES.has(c));
+}

package/dist/lib/refresh-token-validator.js

@@ -7,6 +7,7 @@ exports.getRefreshTokenTimeRemaining = getRefreshTokenTimeRemaining;
 exports.checkRefreshViability = checkRefreshViability;
 const jwt_decode_1 = require("./jwt-decode");
 const logger_1 = require("../config/logger");
+const refresh_window_1 = require("./refresh-window");
 function isRefreshTokenValid(token) {
     if (!token)
         return false;
@@ -81,7 +82,7 @@ function checkRefreshViability(sessionData) {
         if (expiresAtMs < 1000000000000)
             expiresAtMs = expiresAtMs * 1000;
         accessTokenTimeRemaining = Math.floor((expiresAtMs - now) / 1000);
-        const bufferSec = 5 * 60; // 5 minutes pre-expiry buffer
+        const bufferSec = refresh_window_1.REFRESH_WINDOW_MS / 1000; // the one refresh window (lib/refresh-window), in seconds
         accessTokenExpired = accessTokenTimeRemaining <= bufferSec;
         logger_1.tokenRefreshLogger.debug('[REFRESH_VIABILITY] Access token expiration check', { now, expiresAtMs, accessTokenTimeRemaining, bufferSec, accessTokenExpired });
     }

package/dist/lib/refresh-window.d.ts

@@ -0,0 +1,16 @@
+/**
+ * THE freshness window for an IdP access token (BAPert 76397 decision 1; Core facts DotNetPert 76400).
+ *
+ * An access token with this much life left or less is treated as stale and refreshed; with more, it is served as it is. One value for
+ * every path that decides: the mounted refresh route (`api-handlers/auth/refresh`), `ensureFreshAccessToken`, and `lib/idp-fetch`'s own
+ * pre-check. They used to disagree (5 min, 60 s, 5 min), so the same session was "stale" to one path and "fresh" to another, which is how
+ * two callers each rotated a token the other had just rotated.
+ *
+ * WHY 5 MINUTES: Core mints access tokens with a fixed 15-minute lifetime (a code constant, not configuration: Core
+ * `TokenConstants.ACCESS_TOKEN_LIFETIME_MINUTES = 15`, read-only in `TokenSettings`). The ruling is 5 minutes when the lifetime is at least 15
+ * minutes, and lifetime / 3 otherwise. If Core ever shortens the lifetime, this value MUST be revisited: a window at or above the lifetime
+ * makes every request refresh.
+ *
+ * A caller that needs another value passes it explicitly (`ensureFreshAccessToken`'s `safetyWindowMs` option still exists and still wins).
+ */
+export declare const REFRESH_WINDOW_MS: number;

package/dist/lib/refresh-window.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFRESH_WINDOW_MS = void 0;
+/**
+ * THE freshness window for an IdP access token (BAPert 76397 decision 1; Core facts DotNetPert 76400).
+ *
+ * An access token with this much life left or less is treated as stale and refreshed; with more, it is served as it is. One value for
+ * every path that decides: the mounted refresh route (`api-handlers/auth/refresh`), `ensureFreshAccessToken`, and `lib/idp-fetch`'s own
+ * pre-check. They used to disagree (5 min, 60 s, 5 min), so the same session was "stale" to one path and "fresh" to another, which is how
+ * two callers each rotated a token the other had just rotated.
+ *
+ * WHY 5 MINUTES: Core mints access tokens with a fixed 15-minute lifetime (a code constant, not configuration: Core
+ * `TokenConstants.ACCESS_TOKEN_LIFETIME_MINUTES = 15`, read-only in `TokenSettings`). The ruling is 5 minutes when the lifetime is at least 15
+ * minutes, and lifetime / 3 otherwise. If Core ever shortens the lifetime, this value MUST be revisited: a window at or above the lifetime
+ * makes every request refresh.
+ *
+ * A caller that needs another value passes it explicitly (`ensureFreshAccessToken`'s `safetyWindowMs` option still exists and still wins).
+ */
+exports.REFRESH_WINDOW_MS = 5 * 60 * 1000;

package/dist/lib/safe-error-response.d.ts

@@ -19,7 +19,11 @@ export interface IdpErrorProjection {
     resolution?: string;
     request_id?: string;
 }
-/** Log an exception with a fresh correlationId and return the id for the response body. */
+/**
+ * Log an exception with a fresh correlationId and return the id for the response body.
+ * The log line carries the error's NAME and closed code/status only (errForLog), never its message, stack or cause: those can hold an
+ * email, a phone number, a token or a quoted request body (PII-in-logs, BAPert 76553 group 1). The correlationId still ties the response to the line.
+ */
 export declare function logExceptionWithCorrelation(tag: string, err: unknown): string;
 /** Whitelisted projection of an IDP error envelope: code / message / resolution / request_id only. */
 export declare function projectIdpError(json: unknown): IdpErrorProjection;

package/dist/lib/safe-error-response.js

@@ -23,11 +23,16 @@ exports.projectResetTokenInvalid = projectResetTokenInvalid;
 exports.projectPasswordPolicyRules = projectPasswordPolicyRules;
 exports.projectPasswordBreached = projectPasswordBreached;
 const password_rules_1 = require("./password-rules");
+const log_safe_1 = require("./log-safe");
 const str = (v) => (typeof v === 'string' ? v : undefined);
-/** Log an exception with a fresh correlationId and return the id for the response body. */
+/**
+ * Log an exception with a fresh correlationId and return the id for the response body.
+ * The log line carries the error's NAME and closed code/status only (errForLog), never its message, stack or cause: those can hold an
+ * email, a phone number, a token or a quoted request body (PII-in-logs, BAPert 76553 group 1). The correlationId still ties the response to the line.
+ */
 function logExceptionWithCorrelation(tag, err) {
     const correlationId = globalThis.crypto.randomUUID();
-    console.error(tag, { correlationId, error: err });
+    console.error(tag, { correlationId, error: (0, log_safe_1.errForLog)(err) });
     return correlationId;
 }
 /** Whitelisted projection of an IDP error envelope: code / message / resolution / request_id only. */

package/dist/lib/safe-trace-id.d.ts

@@ -0,0 +1,11 @@
+/**
+ * A caller-supplied trace id (the `x-request-id` header) is attacker-chosen text, and it goes to the log sink (PAY-2376; BAPert 76321 item 4,
+ * NightHawk 76316). Two problems if it is logged as it arrives: a value with a newline forges a log line, and an unbounded value is a log
+ * flood. This is the one place that makes it safe to log: control characters are removed, the length is capped, and anything that is not a
+ * non-empty string becomes `undefined` (so the log carries no trace id rather than a forged one).
+ *
+ * It is for LOG CORRELATION ONLY. It is never a lock identity and never a security decision (the lock id is minted server-side).
+ */
+/** Longest trace id that is logged. 64 covers a UUID (36) and common trace formats; longer input is cut, not rejected. */
+export declare const MAX_TRACE_ID_LENGTH = 64;
+export declare function sanitizeTraceId(value: unknown): string | undefined;

package/dist/lib/safe-trace-id.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * A caller-supplied trace id (the `x-request-id` header) is attacker-chosen text, and it goes to the log sink (PAY-2376; BAPert 76321 item 4,
+ * NightHawk 76316). Two problems if it is logged as it arrives: a value with a newline forges a log line, and an unbounded value is a log
+ * flood. This is the one place that makes it safe to log: control characters are removed, the length is capped, and anything that is not a
+ * non-empty string becomes `undefined` (so the log carries no trace id rather than a forged one).
+ *
+ * It is for LOG CORRELATION ONLY. It is never a lock identity and never a security decision (the lock id is minted server-side).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_TRACE_ID_LENGTH = void 0;
+exports.sanitizeTraceId = sanitizeTraceId;
+/** Longest trace id that is logged. 64 covers a UUID (36) and common trace formats; longer input is cut, not rejected. */
+exports.MAX_TRACE_ID_LENGTH = 64;
+// C0 controls (incl. CR, LF, TAB, ESC), DEL, C1 controls (incl. NEL U+0085), and the Unicode line/paragraph separators U+2028 / U+2029.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
+function sanitizeTraceId(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const cleaned = value.replace(CONTROL_CHARS, '').slice(0, exports.MAX_TRACE_ID_LENGTH);
+    return cleaned.length > 0 ? cleaned : undefined;
+}

package/dist/lib/session-store.js

@@ -43,6 +43,8 @@ const crypto_1 = require("crypto");
 const app_slug_1 = require("./app-slug");
 const token_utils_1 = require("../auth/utils/token-utils");
 const token_log_id_1 = require("./token-log-id");
+const refresh_in_doubt_1 = require("./refresh-in-doubt");
+const log_safe_1 = require("./log-safe");
 // Use app-slug prefixes for multi-app isolation
 const getSessionKey = (token) => `${(0, app_slug_1.getSessionPrefix)()}${token}`;
 const getRefreshLockKey = (token) => `${(0, app_slug_1.getRefreshLockPrefix)()}${token}`;
@@ -78,7 +80,7 @@ async function createSession(data) {
             .exec();
     }
     catch (error) {
-        console.error('[SESSION-STORE] Failed to create session:', error);
+        console.error('[SESSION-STORE] Failed to create session:', (0, log_safe_1.errForLog)(error));
         throw error;
     }
     return sessionToken;
@@ -280,12 +282,21 @@ async function deleteSessionEverywhere(sessionToken, appSlug) {
  * today; this is the defence BAPert ruled to keep anyway.
  */
 function dropStaleDiscardMarker(session) {
-    const s = session;
+    let s = session;
     if (typeof s.idpRefreshToken === 'string' && s.idpRefreshToken.length > 0 && (s.refreshTokenClearedReason !== undefined || s.refreshTokenClearedAt !== undefined)) {
         const { refreshTokenClearedReason: _reason, refreshTokenClearedAt: _at, ...rest } = s;
-        return rest;
-    }
-    return session;
+        s = rest;
+    }
+    // BAPert 76403: the refresh-IN-DOUBT marker (lib/refresh-in-doubt) is cleared by the same write that stores a NEW refresh token, i.e. one
+    // whose identity differs from the one left in doubt. A write that stores the SAME token (any caller spreading the whole row back) does
+    // NOT clear it: that token is still the in-doubt one.
+    if (typeof s.refreshInDoubtTokenHash === 'string' &&
+        typeof s.idpRefreshToken === 'string' && s.idpRefreshToken.length > 0 &&
+        (0, refresh_in_doubt_1.refreshTokenIdentity)(s.idpRefreshToken) !== s.refreshInDoubtTokenHash) {
+        const { refreshInDoubtTokenHash: _hash, refreshInDoubtAt: _doubtAt, ...rest } = s;
+        s = rest;
+    }
+    return s;
 }
 async function setSession(sessionToken, data) {
     data = dropStaleDiscardMarker(data);

package/dist/lib/site-logger.d.ts

@@ -54,7 +54,6 @@ export declare const siteEvents: {
     }) => void;
     loginFailed: (opts: {
         reason: string;
-        email?: string;
         url?: string;
         user_agent?: string;
         ip_address?: string;
@@ -106,9 +105,7 @@ export declare const siteEvents: {
         ip_address?: string;
     }) => void;
     error: (opts: {
-        message: string;
-        error?: string;
-        stack?: string;
+        code: string;
         user_id?: string | number;
         url?: string;
         user_agent?: string;
@@ -139,7 +136,6 @@ declare const _default: {
         }) => void;
         loginFailed: (opts: {
             reason: string;
-            email?: string;
             url?: string;
             user_agent?: string;
             ip_address?: string;
@@ -191,9 +187,7 @@ declare const _default: {
             ip_address?: string;
         }) => void;
         error: (opts: {
-            message: string;
-            error?: string;
-            stack?: string;
+            code: string;
             user_id?: string | number;
             url?: string;
             user_agent?: string;

package/dist/lib/site-logger.js

@@ -16,6 +16,7 @@ exports.configureSiteLogger = configureSiteLogger;
 exports.logSiteEvent = logSiteEvent;
 exports.getClientIp = getClientIp;
 const redis_1 = require("./redis");
+const log_safe_1 = require("./log-safe");
 // Redis key for site logs (separate from data_logs)
 const REDIS_SITE_LOG_KEY = 'vibe:site-logs:pending';
 const REDIS_LOG_TTL = 7 * 24 * 60 * 60; // 1 week
@@ -53,12 +54,12 @@ async function logSiteEvent(entry) {
             console.log('[site-logger] Redis push success, queue length:', result);
             redis.expire(REDIS_SITE_LOG_KEY, REDIS_LOG_TTL).catch(() => { });
         }).catch(err => {
-            console.error('[site-logger] Redis push failed:', err.message);
+            console.error('[site-logger] Redis push failed:', (0, log_safe_1.errForLog)(err));
         });
     }
     catch (error) {
         // Fail silently - logging should never break the app
-        console.error('[site-logger] Failed to log event:', error);
+        console.error('[site-logger] Failed to log event:', (0, log_safe_1.errForLog)(error));
     }
 }
 /**
@@ -94,12 +95,14 @@ exports.siteEvents = {
             ip_address: opts.ip_address,
         });
     },
+    // BREAKING (PII-in-logs group 3b, BAPert 76553 Q2): no `email` parameter. A failed login is told apart by a CLOSED reason code (UPPER_SNAKE),
+    // never by the address that was tried; anything that is not a closed code is stored as UNSPECIFIED. A caller that still passes `email` fails to compile.
     loginFailed: (opts) => {
         logSiteEvent({
             level: 'warn',
             category: 'auth',
             message: 'Login failed',
-            context: { reason: opts.reason, email: opts.email },
+            context: { reason: (0, log_safe_1.closedCodeForLog)(opts.reason) ?? 'UNSPECIFIED' },
             url: opts.url || '/auth/login',
             user_agent: opts.user_agent,
             ip_address: opts.ip_address,
@@ -181,12 +184,15 @@ exports.siteEvents = {
             ip_address: opts.ip_address,
         });
     },
+    // BREAKING (PII-in-logs group 3b, BAPert 76553 Q2): takes a CLOSED code, not caller text, an error string or a stack. The stored message is the fixed
+    // sentence 'Application error'; the code (UPPER_SNAKE, else UNSPECIFIED) goes in context. A caller that still passes `message`, `error` or `stack`
+    // fails to compile.
     error: (opts) => {
         logSiteEvent({
             level: 'error',
             category: 'error',
-            message: opts.message,
-            context: { error: opts.error, stack: opts.stack },
+            message: 'Application error',
+            context: { code: (0, log_safe_1.closedCodeForLog)(opts.code) ?? 'UNSPECIFIED' },
             user_id: opts.user_id,
             url: opts.url,
             user_agent: opts.user_agent,

package/dist/lib/standardized-client-api.js

@@ -48,6 +48,7 @@ exports.extractApiItems = extractApiItems;
 // NO MORE GUESSING data.data.data.data - EVER AGAIN!
 // ========================================================================================
 const better_auth_client_1 = require("../client/better-auth-client");
+const log_safe_1 = require("./log-safe");
 /** Unwrap Better Auth getSession() to a flat session-like object for backward compat */
 async function getSession() {
     const { data } = await better_auth_client_1.authClient.getSession();
@@ -172,7 +173,7 @@ function scheduleLoginRedirect(isImmediate = false) {
             window.location.href = `/account-auth/login?returnUrl=${returnUrl}`;
         }
         catch (error) {
-            console.error('❌ Error during login redirect:', error);
+            console.error('❌ Error during login redirect:', (0, log_safe_1.errForLog)(error));
             // Final fallback
             try {
                 window.location.href = '/account-auth/login';
@@ -640,7 +641,7 @@ class StandardizedClientApiService {
                 throw error;
             }
             // Wrap unknown errors as network errors
-            console.error('❌ API request failed:', error);
+            console.error('❌ API request failed:', (0, log_safe_1.errForLog)(error));
             throw new ApiNetworkError(error instanceof Error ? error.message : 'Network error', 0, endpoint);
         }
     }

package/dist/lib/token-lifecycle.js

@@ -28,8 +28,10 @@ const auth_1 = require("../server/auth");
 const redis_1 = require("./redis");
 const app_slug_1 = require("./app-slug");
 const token_log_id_1 = require("./token-log-id");
-// 5 minute threshold for "needs refresh" - matches refresh handler pattern
-const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
+const refresh_window_1 = require("./refresh-window");
+const log_safe_1 = require("./log-safe");
+// "needs refresh" threshold: THE one freshness window (lib/refresh-window), the same value the refresh route, ensureFreshAccessToken and idp-fetch use.
+const REFRESH_THRESHOLD_MS = refresh_window_1.REFRESH_WINDOW_MS;
 // Concurrent refresh handling configuration
 const CONCURRENT_REFRESH_POLL_INTERVAL_MS = 200; // How often to poll session during concurrent refresh
 const CONCURRENT_REFRESH_MAX_WAIT_MS = 8000; // Max time to wait for concurrent refresh to complete
@@ -357,7 +359,7 @@ async function ensureFreshToken(request) {
             }
             catch (e) {
                 // If we can't decode, proceed with normal logic
-                console.warn('[TOKEN_LIFECYCLE] Could not validate JWT exp claim:', e);
+                console.warn('[TOKEN_LIFECYCLE] Could not validate JWT exp claim:', (0, log_safe_1.errForLog)(e));
             }
         }
         console.log('[TOKEN_LIFECYCLE] ensureFreshToken check:', {
@@ -428,7 +430,7 @@ async function ensureFreshToken(request) {
         };
     }
     catch (error) {
-        console.error('[TOKEN_LIFECYCLE] Error:', error);
+        console.error('[TOKEN_LIFECYCLE] Error:', (0, log_safe_1.errForLog)(error));
         return {
             success: false,
             error: 'NO_SESSION',

package/dist/middleware/create-middleware.js

@@ -31,6 +31,7 @@ const app_slug_1 = require("../lib/app-slug");
 const rbac_check_1 = require("./rbac-check");
 const session_cookie_clear_1 = require("../auth/session-cookie-clear");
 const session_reset_link_1 = require("../auth/session-reset-link");
+const log_safe_1 = require("../lib/log-safe");
 // =============================================================================
 // DEFAULT IMPLEMENTATIONS
 // =============================================================================
@@ -748,7 +749,7 @@ async function handleAllow(request, pathname, sessionPointer, sessionStatus, rba
             }
         }
         catch (error) {
-            console.error('[MIDDLEWARE] RBAC error:', error);
+            console.error('[MIDDLEWARE] RBAC error:', (0, log_safe_1.errForLog)(error));
             // In development, fail open
             if (process.env.NODE_ENV !== 'production') {
                 console.warn('[MIDDLEWARE] RBAC: Allowing in development despite error');

package/dist/middleware/rbac-check.d.ts

@@ -1,16 +1,3 @@
-/**
- * Page RBAC Check Module
- *
- * Checks page-level permissions via Vibe API through the IDP Proxy.
- * Uses in-memory cache to reduce API calls.
- * Fails closed (DENY) on errors or timeout.
- *
- * All requests route through the IDP Vibe Proxy ({IDP_URL}/api/vibe/proxy)
- * which injects proper HMAC credentials for the Vibe API.
- *
- * @version 2.0.0
- * @since page-rbac-2026-01
- */
 export interface RBACResult {
     allowed: boolean;
     requires_2fa?: boolean;

package/dist/middleware/rbac-check.js

@@ -1,4 +1,9 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearRBACCache = clearRBACCache;
+exports.checkPagePermission = checkPagePermission;
+exports.isRBACEnabled = isRBACEnabled;
+const log_safe_1 = require("../lib/log-safe");
 /**
  * Page RBAC Check Module
  *
@@ -12,10 +17,6 @@
  * @version 2.0.0
  * @since page-rbac-2026-01
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearRBACCache = clearRBACCache;
-exports.checkPagePermission = checkPagePermission;
-exports.isRBACEnabled = isRBACEnabled;
 // ============================================================================
 // WEB CRYPTO HELPERS (Edge Runtime compatible)
 // ============================================================================
@@ -203,7 +204,7 @@ async function checkPagePermission(path, userRoles, clientId, userClaims) {
                 redirect: '/error?code=rbac_timeout',
             };
         }
-        console.error('[RBAC] Proxy error:', error);
+        console.error('[RBAC] Proxy error:', (0, log_safe_1.errForLog)(error));
         return {
             allowed: false,
             reason: 'rbac_service_unavailable',

package/dist/models/SessionModel.d.ts

@@ -38,6 +38,13 @@ export interface SessionData {
     idpAccessTokenExpires: number;
     /** When the IDP refresh token expires (Unix timestamp ms) */
     idpRefreshTokenExpires?: number;
+    /**
+     * BAPert 76403 (lib/refresh-in-doubt): set when a refresh fetch TIMED OUT. A SHA-256 identity of the refresh token that was sent (never the
+     * token), and when. A later attempt whose token-to-send matches refuses without calling the IdP. Cleared by the write that stores a different
+     * refresh token.
+     */
+    refreshInDoubtTokenHash?: string;
+    refreshInDoubtAt?: number;
     /** Decoded IDP access token claims (for quick access without re-decoding) */
     decodedAccessToken?: any;
     /**