@payez/next-mvp 4.10.0 → 4.12.0

package/dist/routes/auth/logout.js

@@ -24,6 +24,7 @@ const idp_logout_1 = require("../../lib/idp-logout");
 const app_slug_1 = require("../../lib/app-slug");
 const site_logger_1 = require("../../lib/site-logger");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+const log_safe_1 = require("../../lib/log-safe");
 /**
  * 4.8.9: answered (status 500) when a sign-out did not finish. 4.8.10 (BAPert 76297): TWO sentences, one per cause, each true for its
  * cause, neither promising a retry (the local session is gone, so there is nothing to retry from). The browser's cookies and the local
@@ -66,7 +67,10 @@ async function POST(req) {
             }
             catch (error) {
                 idpRevokeFailed = true;
-                console.error('[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:', error);
+                // "STILL LIVE" only when the IdP showed it (a forced refresh succeeded); otherwise say what is known: it was not confirmed.
+                console.error(error?.grantLive === true
+                    ? '[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+                    : '[LOGOUT_ROUTE] IdP revoke could not be confirmed (the grant may already be dead):', (0, log_safe_1.errForLog)(error));
             }
         }
         // Delete session from EVERY store — canonical + BA secondary (181922).
@@ -78,7 +82,7 @@ async function POST(req) {
             }
             catch (error) {
                 localDeleteFailed = true;
-                console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
+                console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', (0, log_safe_1.errForLog)(error));
             }
         }
         // Log logout event (fire-and-forget)

package/dist/routes/auth/refresh.d.ts

@@ -14,18 +14,4 @@
  * @since auth-ready-v2
  */
 import { NextRequest } from 'next/server';
-export declare function POST(req: NextRequest): Promise<import("next/server").NextResponse<{
-    error: string;
-    code: string;
-}> | import("next/server").NextResponse<{
-    error: any;
-    code: any;
-    discardToken: boolean;
-    retryable: boolean;
-    resolution: any;
-    status: number;
-}> | import("next/server").NextResponse<{
-    refreshed: boolean;
-    accessTokenExpires: number;
-    hasRefreshToken: boolean;
-}>>;
+export declare function POST(req: NextRequest): Promise<import("next/server").NextResponse<unknown>>;

package/dist/routes/auth/settings.js

@@ -32,6 +32,7 @@ exports.GET = GET;
 const server_1 = require("next/server");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const never_in_response_1 = require("../../lib/never-in-response");
+const log_safe_1 = require("../../lib/log-safe");
 /**
  * Fail closed and LOUD. 503 + success:false + a code, and CRUCIALLY no policy
  * fields at all - not defaults, not partials. A consumer cannot mistake an
@@ -53,7 +54,7 @@ async function GET() {
     }
     catch (error) {
         // Keep the loud line - it is what finally unmasked this in production.
-        console.error('[AUTH_SETTINGS] Failed to get settings:', error);
+        console.error('[AUTH_SETTINGS] Failed to get settings:', (0, log_safe_1.errForLog)(error));
         // The `degraded: true` shape that used to live here (240447) is gone
         // deliberately. It still answered `success: true` with a full invented
         // policy and merely LABELLED the guess - which BAPert v32 rules out:

package/dist/server/auth-guard.js

@@ -14,6 +14,7 @@ const navigation_1 = require("next/navigation");
 const headers_1 = require("next/headers");
 const decode_session_1 = require("./decode-session");
 const idp_client_config_1 = require("../lib/idp-client-config");
+const log_safe_1 = require("../lib/log-safe");
 // =============================================================================
 // CONSTANTS
 // =============================================================================
@@ -53,7 +54,7 @@ async function authGuard(options) {
     }
     catch (error) {
         // Redis unreachable or startup failure → fail closed
-        console.error('[AUTH-GUARD] Session decode failed (service error):', error instanceof Error ? error.message : String(error));
+        console.error('[AUTH-GUARD] Session decode failed (service error):', (0, log_safe_1.errForLog)(error));
         (0, navigation_1.redirect)(serviceUnavailableUrl);
     }
     // No session at all → redirect to login
@@ -83,7 +84,7 @@ async function authGuard(options) {
     }
     catch (error) {
         // If we can't check 2FA config, fail closed
-        console.error('[AUTH-GUARD] 2FA config check failed:', error instanceof Error ? error.message : String(error));
+        console.error('[AUTH-GUARD] 2FA config check failed:', (0, log_safe_1.errForLog)(error));
         (0, navigation_1.redirect)(serviceUnavailableUrl);
     }
     if (requires2FA) {
@@ -144,7 +145,7 @@ async function authGuard(options) {
                 if (error && typeof error === 'object' && 'digest' in error) {
                     throw error;
                 }
-                console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, error instanceof Error ? error.message : String(error));
+                console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, (0, log_safe_1.errForLog)(error));
                 (0, navigation_1.redirect)(serviceUnavailableUrl);
             }
         }

package/dist/server/auth.d.ts

@@ -153,7 +153,7 @@ export interface FreshIdpTokenConfig {
     idpBaseUrl: string;
     clientId: string;
     refreshEndpoint?: string;
-    /** Refresh if the access token is within this many ms of expiry. Default 60_000. */
+    /** Refresh if the access token is within this many ms of expiry. Default REFRESH_WINDOW_MS (5 min, lib/refresh-window). */
     safetyWindowMs?: number;
 }
 /**

package/dist/server/auth.js

@@ -50,6 +50,7 @@ require("server-only");
 const better_auth_1 = require("../auth/better-auth");
 const session_store_1 = require("../lib/session-store");
 const token_log_id_1 = require("../lib/token-log-id");
+const log_safe_1 = require("../lib/log-safe");
 const verified_session_token_1 = require("./verified-session-token");
 function buildSessionDataFromAuthSession(session) {
     const user = session?.user;
@@ -147,18 +148,13 @@ async function getAuthInstance() {
  * `{error:'NO_SESSION'}`, and getSession() swallowed every Redis error into a bare `catch {}`. These helpers name
  * the origin and make a swallowed read audible. Hard rules: every helper is wrapped so it can NEVER throw or change
  * a return value; nothing here ever logs a token, a cookie VALUE or a Redis value - only a tokenLogId() fingerprint,
- * cookie NAMES, booleans, and an error name/message with any long opaque run redacted.
+ * cookie NAMES, booleans, and an error NAME with its closed code/status (errForLog; never the message).
  * -------------------------------------------------------------------------------------------------------------- */
-/** An error name/message, first 80 chars, with any 24+ char opaque run (a token, a key) replaced. */
-function scrubForLog(v) {
-    const raw = v instanceof Error ? v.message : String(v ?? '');
-    return raw.replace(/[A-Za-z0-9_\-.+/=]{24,}/g, '[redacted]').slice(0, 80);
-}
-/** `catch {}` sites on the session read path: still swallowed, now audible. */
+/** `catch {}` sites on the session read path: still swallowed, now audible. The line names the error and its closed code/status only: the
+ *  message is dropped (BAPert 76553: a redacted-and-truncated message still leaked host names, ports and quoted input). */
 function logSessionReadSwallowed(path, err) {
     try {
-        const name = scrubForLog(err instanceof Error ? err.name : typeof err);
-        console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} err=${name} msg=${scrubForLog(err)}`);
+        console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} ${(0, log_safe_1.errForLog)(err)}`);
     }
     catch {
         /* a diagnostic must never change the outcome */

package/dist/server/decode-session.js

@@ -49,6 +49,7 @@ const startup_init_1 = require("../lib/startup-init");
 const session_cookie_shape_1 = require("../lib/session-cookie-shape");
 const verified_session_token_1 = require("./verified-session-token");
 const token_log_id_1 = require("../lib/token-log-id");
+const log_safe_1 = require("../lib/log-safe");
 /**
  * Try Better Auth's server-side session API.
  * Returns a DecodedSession if Better Auth has an active session, null otherwise.
@@ -215,7 +216,7 @@ async function tryBetterAuthSession(requestCookies) {
         return { sessionData, jwtPayload };
     }
     catch (error) {
-        console.warn('[DECODE-SESSION] Better Auth session check failed:', error instanceof Error ? error.message : String(error));
+        console.warn('[DECODE-SESSION] Better Auth session check failed:', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }
@@ -304,7 +305,7 @@ async function decodeSession(requestCookies) {
         };
     }
     catch (error) {
-        console.error('[DECODE-SESSION] Error:', error instanceof Error ? error.message : String(error));
+        console.error('[DECODE-SESSION] Error:', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }

package/dist/server/with-auth.js

@@ -18,6 +18,7 @@ exports.withAuth = withAuth;
 require("server-only");
 const server_1 = require("next/server");
 const decode_session_1 = require("./decode-session");
+const log_safe_1 = require("../lib/log-safe");
 // =============================================================================
 // MAIN
 // =============================================================================
@@ -52,7 +53,7 @@ function withAuth(handler, options) {
             return handler(req, auth);
         }
         catch (error) {
-            console.error('[WITH-AUTH] Error:', error instanceof Error ? error.message : String(error));
+            console.error('[WITH-AUTH] Error:', (0, log_safe_1.errForLog)(error));
             return server_1.NextResponse.json({ error: 'Internal Server Error', message: 'Auth check failed' }, { status: 500 });
         }
     };

package/dist/stores/authStore.js

@@ -56,6 +56,7 @@ const signalr_1 = require("@microsoft/signalr");
 const signalrActivityService_1 = require("../services/signalrActivityService");
 const app_slug_1 = require("../lib/app-slug");
 const token_log_id_1 = require("../lib/token-log-id");
+const refresh_window_1 = require("../lib/refresh-window");
 // ===============================
 // CACHE CONFIGURATION
 // ===============================
@@ -520,8 +521,8 @@ exports.useAuthStore = (0, zustand_1.create)()((0, middleware_1.devtools)((set,
                     const tokenExpiry = decoded.exp * 1000;
                     const now = Date.now();
                     const timeUntilExpiry = tokenExpiry - now;
-                    // Token should be fresh (not expiring in next 5 minutes)
-                    if (timeUntilExpiry < (5 * 60 * 1000)) {
+                    // Token should be fresh (not expiring within the one refresh window)
+                    if (timeUntilExpiry < refresh_window_1.REFRESH_WINDOW_MS) {
                         throw new Error(`Fresh token still expires soon: ${timeUntilExpiry}ms`);
                     }
                     logger_1.authLogger.info('[AuthStore] Session rehydration successful', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.10.0",
+  "version": "4.12.0",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/scripts/verify-release-provenance.mjs

@@ -103,6 +103,7 @@ const CLASSES = [
   { cls: 'VERIFIED', test: (p) => p.startsWith('src/') },
   { cls: 'VERIFIED', test: (p) => p.startsWith('scripts/') },
   { cls: 'VERIFIED', test: (p) => p === 'POST-INSTALL.md' },
+  { cls: 'VERIFIED', test: (p) => p === 'CHANGELOG.md' },
   // npm always ships README regardless of "files"; it is committed, so verify it.
   { cls: 'VERIFIED', test: (p) => p === 'README.md' },
   { cls: 'VERIFIED', test: (p) => p === 'LICENSE' || p === 'LICENCE' },

package/src/api-handlers/account/recovery/forward.ts

@@ -3,6 +3,7 @@ import { ENV_CONFIG } from '../../../config/env';
 import { getIDPClientConfig } from '../../../lib/idp-client-config';
 import { resolveClientKey } from '../../../lib/client-key';
 import { idpErrorEnvelope } from '../../../lib/safe-error-response';
+import { errForLog } from '../../../lib/log-safe';
 
 /**
  * Account recovery - the ONE forwarder behind /recovery/send-code and /recovery/verify-code (PAY-1588).
@@ -57,7 +58,7 @@ async function recoveryClientKey(where: string): Promise<string | null> {
     const config = await getIDPClientConfig();
     return resolveClientKey(config, where).key;
   } catch (e) {
-    console.error(`[${where}] could not resolve IDP client config for client_id:`, e);
+    console.error(`[${where}] could not resolve IDP client config for client_id:`, errForLog(e));
     return null;
   }
 }

package/src/api-handlers/account/recovery/initiate.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../../lib/idp-client-config';
 import { resolveClientKey } from '../../../lib/client-key';
 import { idpErrorEnvelope } from '../../../lib/safe-error-response';
+import { errForLog } from '../../../lib/log-safe';
 
 function getIdpUrl(): string {
   const url = process.env.IDP_URL;
@@ -34,7 +35,7 @@ async function recoveryClientKey(): Promise<string | null> {
     const config = await getIDPClientConfig();
     return resolveClientKey(config, 'account/recovery/initiate').key;
   } catch (e) {
-    console.error('[account/recovery/initiate] could not resolve IDP client config for client_id:', e);
+    console.error('[account/recovery/initiate] could not resolve IDP client config for client_id:', errForLog(e));
     return null;
   }
 }

package/src/api-handlers/account/reset-password.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { resolveClientKey } from '../../lib/client-key';
 import { idpErrorEnvelope, projectPasswordPolicyRules, projectResetTokenInvalid, projectPasswordBreached } from '../../lib/safe-error-response';
+import { errForLog } from '../../lib/log-safe';
 
 function getIdpUrl(): string {
   const url = process.env.IDP_URL;
@@ -34,7 +35,7 @@ async function recoveryClientKey(): Promise<string | null> {
     const config = await getIDPClientConfig();
     return resolveClientKey(config, 'account/reset-password').key;
   } catch (e) {
-    console.error('[account/reset-password] could not resolve IDP client config for client_id:', e);
+    console.error('[account/reset-password] could not resolve IDP client config for client_id:', errForLog(e));
     return null;
   }
 }

package/src/api-handlers/account/send-code.ts

@@ -11,6 +11,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { idpFetchJSON } from '../../lib/idp-fetch';
 import { ENV_CONFIG } from '../../config/env';
 import { twoFactorSendCodeFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -57,7 +58,7 @@ export async function POST(req: NextRequest) {
       { status: 200 }
     );
   } catch (error) {
-    console.error('[SEND_CODE] Error:', error);
+    console.error('[SEND_CODE] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/account/update-phone.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { idpFetchJSON } from '../../lib/idp-fetch';
 import { ENV_CONFIG } from '../../config/env';
+import { errForLog } from '../../lib/log-safe';
 
 /**
  * Update Phone Number API Handler
@@ -75,7 +76,7 @@ export async function POST(req: NextRequest) {
       data: responseData,
     });
   } catch (error) {
-    console.error('[UPDATE_PHONE] Error:', error);
+    console.error('[UPDATE_PHONE] Error:', errForLog(error));
     return NextResponse.json(
       { success: false, error: { code: 'INTERNAL_ERROR', message: 'Failed to update phone number' } },
       { status: 500 }

package/src/api-handlers/account/validate-password.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { errForLog } from '../../lib/log-safe';
 
 interface ValidatePasswordRequest {
   password: string;
@@ -123,7 +124,7 @@ export async function POST(req: NextRequest) {
       headers: { 'Cache-Control': 'no-store' },
     });
   } catch (error) {
-    console.error('[VALIDATE_PASSWORD] Error:', error);
+    console.error('[VALIDATE_PASSWORD] Error:', errForLog(error));
     return NextResponse.json(
       {
         is_valid: false,

package/src/api-handlers/account/verify-email.ts

@@ -14,6 +14,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -121,7 +122,7 @@ export async function POST(req: NextRequest) {
       message: unwrappedData.message || 'Email code verified successfully'
     }, { status: 200 });
   } catch (error) {
-    console.error('[VERIFY_EMAIL] Error:', error);
+    console.error('[VERIFY_EMAIL] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/account/verify-sms.ts

@@ -14,6 +14,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -121,7 +122,7 @@ export async function POST(req: NextRequest) {
       message: unwrappedData.message || 'SMS code verified successfully'
     }, { status: 200 });
   } catch (error) {
-    console.error('[VERIFY_SMS] Error:', error);
+    console.error('[VERIFY_SMS] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/anon/preferences.ts

@@ -15,6 +15,7 @@ import {
   ANON_COOKIE_NAME,
   AnonSessionPreferences,
 } from '../../lib/anon-session';
+import { errForLog } from '../../lib/log-safe';
 
 const COOKIE_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
 
@@ -52,7 +53,7 @@ export async function GET(request: NextRequest) {
 
     return response;
   } catch (error) {
-    console.error('[ANON-PREFERENCES] GET error:', error);
+    console.error('[ANON-PREFERENCES] GET error:', errForLog(error));
     return NextResponse.json(
       { success: false, error: 'Failed to get preferences' },
       { status: 500 }
@@ -114,7 +115,7 @@ export async function POST(request: NextRequest) {
 
     return response;
   } catch (error) {
-    console.error('[ANON-PREFERENCES] POST error:', error);
+    console.error('[ANON-PREFERENCES] POST error:', errForLog(error));
     return NextResponse.json(
       { success: false, error: 'Failed to update preferences' },
       { status: 500 }

package/src/api-handlers/auth/credential-login-email-code.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { resolveClientKey } from '../../lib/client-key';
 import { bearerFetch } from '../../lib/bearer-fetch';
+import { errForLog } from '../../lib/log-safe';
 
 // `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
 
@@ -43,7 +44,7 @@ export async function POST(req: NextRequest) {
     const config = await getIDPClientConfig();
     clientKey = resolveClientKey(config, 'graft/admin-login/email-code').key ?? '';
   } catch (err) {
-    console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', err instanceof Error ? err.message : String(err));
+    console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', errForLog(err));
     return NextResponse.json(
       { success: false, error: 'Sign-in is temporarily unavailable. This is a problem on our side. Please try again shortly.' },
       { status: 503 },
@@ -74,7 +75,7 @@ export async function POST(req: NextRequest) {
       /* not JSON - nothing to echo */
     }
   } catch (err) {
-    console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', err instanceof Error ? err.message : String(err));
+    console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', errForLog(err));
   }
 
   if (!sendOk) {

package/src/api-handlers/auth/credential-login.ts

@@ -47,6 +47,7 @@ import { createHash } from 'crypto';
 import { DEVICE_ID_HEADER, isValidDeviceId } from '../../lib/device-id';
 import { classifyTwofaRejection, type TwofaLaneResult } from '../../lib/twofa-rejection';
 import { bearerFetch } from '../../lib/bearer-fetch';
+import { errForLog } from '../../lib/log-safe';
 
 // `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
 
@@ -182,7 +183,7 @@ export async function POST(req: NextRequest) {
   try {
     config = await getIDPClientConfig();
   } catch (err) {
-    console.error('[ADMIN_LOGIN] IDP client config unavailable — returning 503:', err);
+    console.error('[ADMIN_LOGIN] IDP client config unavailable — returning 503:', errForLog(err));
     return NextResponse.json(
       {
         success: false,
@@ -283,7 +284,7 @@ export async function POST(req: NextRequest) {
         laneResults.push({ lane, status: idpResponse.status, body: await idpResponse.clone().text().catch(() => ''), retryAfter: idpResponse.headers.get('retry-after') });
       }
     } catch (error) {
-      console.error('[ADMIN-LOGIN] twofa verify fetch failed:', error instanceof Error ? error.message : String(error));
+      console.error('[ADMIN-LOGIN] twofa verify fetch failed:', errForLog(error));
       return NextResponse.json({ success: false, error: 'Unable to reach the authentication service' }, { status: 503 });
     }
     if (!idpResponse.ok) {
@@ -372,7 +373,7 @@ export async function POST(req: NextRequest) {
       body: JSON.stringify(idpPayload),
     });
   } catch (error) {
-    console.error('[ADMIN-LOGIN] IDP fetch failed:', error instanceof Error ? error.message : String(error));
+    console.error('[ADMIN-LOGIN] IDP fetch failed:', errForLog(error));
     return NextResponse.json({ success: false, error: 'Unable to reach the authentication service' }, { status: 503 });
   }
 
@@ -474,7 +475,7 @@ export async function POST(req: NextRequest) {
           console.warn('[ADMIN-LOGIN] mfa/methods unreadable, defaulting to email lane', mResp.status);
         }
       } catch (err) {
-        console.warn('[ADMIN-LOGIN] mfa/methods fetch failed, defaulting to email lane:', err instanceof Error ? err.message : String(err));
+        console.warn('[ADMIN-LOGIN] mfa/methods fetch failed, defaulting to email lane:', errForLog(err));
       }
     }
     // PAY-2314: advertise what this user can actually use, derived from the SAME usableFactors that chose the lane
@@ -549,7 +550,7 @@ export async function POST(req: NextRequest) {
           // not JSON - nothing to echo, and never a reason to fail the sign-in
         }
       } catch (err) {
-        console.error(`[ADMIN-LOGIN] twofa/${sendLane}/send fetch failed:`, err instanceof Error ? err.message : String(err));
+        console.error(`[ADMIN-LOGIN] twofa/${sendLane}/send fetch failed:`, errForLog(err));
       }
     }
     // 267479: `method:'email'` WAS A HARDCODED LITERAL HERE, and it was a lie for