@payez/next-mvp 4.11.0 → 4.12.0

package/dist/middleware/create-middleware.js

@@ -31,6 +31,7 @@ const app_slug_1 = require("../lib/app-slug");
 const rbac_check_1 = require("./rbac-check");
 const session_cookie_clear_1 = require("../auth/session-cookie-clear");
 const session_reset_link_1 = require("../auth/session-reset-link");
+const log_safe_1 = require("../lib/log-safe");
 // =============================================================================
 // DEFAULT IMPLEMENTATIONS
 // =============================================================================
@@ -748,7 +749,7 @@ async function handleAllow(request, pathname, sessionPointer, sessionStatus, rba
             }
         }
         catch (error) {
-            console.error('[MIDDLEWARE] RBAC error:', error);
+            console.error('[MIDDLEWARE] RBAC error:', (0, log_safe_1.errForLog)(error));
             // In development, fail open
             if (process.env.NODE_ENV !== 'production') {
                 console.warn('[MIDDLEWARE] RBAC: Allowing in development despite error');

package/dist/middleware/rbac-check.d.ts

@@ -1,16 +1,3 @@
-/**
- * Page RBAC Check Module
- *
- * Checks page-level permissions via Vibe API through the IDP Proxy.
- * Uses in-memory cache to reduce API calls.
- * Fails closed (DENY) on errors or timeout.
- *
- * All requests route through the IDP Vibe Proxy ({IDP_URL}/api/vibe/proxy)
- * which injects proper HMAC credentials for the Vibe API.
- *
- * @version 2.0.0
- * @since page-rbac-2026-01
- */
 export interface RBACResult {
     allowed: boolean;
     requires_2fa?: boolean;

package/dist/middleware/rbac-check.js

@@ -1,4 +1,9 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearRBACCache = clearRBACCache;
+exports.checkPagePermission = checkPagePermission;
+exports.isRBACEnabled = isRBACEnabled;
+const log_safe_1 = require("../lib/log-safe");
 /**
  * Page RBAC Check Module
  *
@@ -12,10 +17,6 @@
  * @version 2.0.0
  * @since page-rbac-2026-01
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearRBACCache = clearRBACCache;
-exports.checkPagePermission = checkPagePermission;
-exports.isRBACEnabled = isRBACEnabled;
 // ============================================================================
 // WEB CRYPTO HELPERS (Edge Runtime compatible)
 // ============================================================================
@@ -203,7 +204,7 @@ async function checkPagePermission(path, userRoles, clientId, userClaims) {
                 redirect: '/error?code=rbac_timeout',
             };
         }
-        console.error('[RBAC] Proxy error:', error);
+        console.error('[RBAC] Proxy error:', (0, log_safe_1.errForLog)(error));
         return {
             allowed: false,
             reason: 'rbac_service_unavailable',

package/dist/routes/auth/logout.js

@@ -24,6 +24,7 @@ const idp_logout_1 = require("../../lib/idp-logout");
 const app_slug_1 = require("../../lib/app-slug");
 const site_logger_1 = require("../../lib/site-logger");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+const log_safe_1 = require("../../lib/log-safe");
 /**
  * 4.8.9: answered (status 500) when a sign-out did not finish. 4.8.10 (BAPert 76297): TWO sentences, one per cause, each true for its
  * cause, neither promising a retry (the local session is gone, so there is nothing to retry from). The browser's cookies and the local
@@ -66,7 +67,10 @@ async function POST(req) {
             }
             catch (error) {
                 idpRevokeFailed = true;
-                console.error('[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:', error);
+                // "STILL LIVE" only when the IdP showed it (a forced refresh succeeded); otherwise say what is known: it was not confirmed.
+                console.error(error?.grantLive === true
+                    ? '[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+                    : '[LOGOUT_ROUTE] IdP revoke could not be confirmed (the grant may already be dead):', (0, log_safe_1.errForLog)(error));
             }
         }
         // Delete session from EVERY store — canonical + BA secondary (181922).
@@ -78,7 +82,7 @@ async function POST(req) {
             }
             catch (error) {
                 localDeleteFailed = true;
-                console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
+                console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', (0, log_safe_1.errForLog)(error));
             }
         }
         // Log logout event (fire-and-forget)

package/dist/routes/auth/settings.js

@@ -32,6 +32,7 @@ exports.GET = GET;
 const server_1 = require("next/server");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const never_in_response_1 = require("../../lib/never-in-response");
+const log_safe_1 = require("../../lib/log-safe");
 /**
  * Fail closed and LOUD. 503 + success:false + a code, and CRUCIALLY no policy
  * fields at all - not defaults, not partials. A consumer cannot mistake an
@@ -53,7 +54,7 @@ async function GET() {
     }
     catch (error) {
         // Keep the loud line - it is what finally unmasked this in production.
-        console.error('[AUTH_SETTINGS] Failed to get settings:', error);
+        console.error('[AUTH_SETTINGS] Failed to get settings:', (0, log_safe_1.errForLog)(error));
         // The `degraded: true` shape that used to live here (240447) is gone
         // deliberately. It still answered `success: true` with a full invented
         // policy and merely LABELLED the guess - which BAPert v32 rules out:

package/dist/server/auth-guard.js

@@ -14,6 +14,7 @@ const navigation_1 = require("next/navigation");
 const headers_1 = require("next/headers");
 const decode_session_1 = require("./decode-session");
 const idp_client_config_1 = require("../lib/idp-client-config");
+const log_safe_1 = require("../lib/log-safe");
 // =============================================================================
 // CONSTANTS
 // =============================================================================
@@ -53,7 +54,7 @@ async function authGuard(options) {
     }
     catch (error) {
         // Redis unreachable or startup failure → fail closed
-        console.error('[AUTH-GUARD] Session decode failed (service error):', error instanceof Error ? error.message : String(error));
+        console.error('[AUTH-GUARD] Session decode failed (service error):', (0, log_safe_1.errForLog)(error));
         (0, navigation_1.redirect)(serviceUnavailableUrl);
     }
     // No session at all → redirect to login
@@ -83,7 +84,7 @@ async function authGuard(options) {
     }
     catch (error) {
         // If we can't check 2FA config, fail closed
-        console.error('[AUTH-GUARD] 2FA config check failed:', error instanceof Error ? error.message : String(error));
+        console.error('[AUTH-GUARD] 2FA config check failed:', (0, log_safe_1.errForLog)(error));
         (0, navigation_1.redirect)(serviceUnavailableUrl);
     }
     if (requires2FA) {
@@ -144,7 +145,7 @@ async function authGuard(options) {
                 if (error && typeof error === 'object' && 'digest' in error) {
                     throw error;
                 }
-                console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, error instanceof Error ? error.message : String(error));
+                console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, (0, log_safe_1.errForLog)(error));
                 (0, navigation_1.redirect)(serviceUnavailableUrl);
             }
         }

package/dist/server/auth.js

@@ -50,6 +50,7 @@ require("server-only");
 const better_auth_1 = require("../auth/better-auth");
 const session_store_1 = require("../lib/session-store");
 const token_log_id_1 = require("../lib/token-log-id");
+const log_safe_1 = require("../lib/log-safe");
 const verified_session_token_1 = require("./verified-session-token");
 function buildSessionDataFromAuthSession(session) {
     const user = session?.user;
@@ -147,18 +148,13 @@ async function getAuthInstance() {
  * `{error:'NO_SESSION'}`, and getSession() swallowed every Redis error into a bare `catch {}`. These helpers name
  * the origin and make a swallowed read audible. Hard rules: every helper is wrapped so it can NEVER throw or change
  * a return value; nothing here ever logs a token, a cookie VALUE or a Redis value - only a tokenLogId() fingerprint,
- * cookie NAMES, booleans, and an error name/message with any long opaque run redacted.
+ * cookie NAMES, booleans, and an error NAME with its closed code/status (errForLog; never the message).
  * -------------------------------------------------------------------------------------------------------------- */
-/** An error name/message, first 80 chars, with any 24+ char opaque run (a token, a key) replaced. */
-function scrubForLog(v) {
-    const raw = v instanceof Error ? v.message : String(v ?? '');
-    return raw.replace(/[A-Za-z0-9_\-.+/=]{24,}/g, '[redacted]').slice(0, 80);
-}
-/** `catch {}` sites on the session read path: still swallowed, now audible. */
+/** `catch {}` sites on the session read path: still swallowed, now audible. The line names the error and its closed code/status only: the
+ *  message is dropped (BAPert 76553: a redacted-and-truncated message still leaked host names, ports and quoted input). */
 function logSessionReadSwallowed(path, err) {
     try {
-        const name = scrubForLog(err instanceof Error ? err.name : typeof err);
-        console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} err=${name} msg=${scrubForLog(err)}`);
+        console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} ${(0, log_safe_1.errForLog)(err)}`);
     }
     catch {
         /* a diagnostic must never change the outcome */

package/dist/server/decode-session.js

@@ -49,6 +49,7 @@ const startup_init_1 = require("../lib/startup-init");
 const session_cookie_shape_1 = require("../lib/session-cookie-shape");
 const verified_session_token_1 = require("./verified-session-token");
 const token_log_id_1 = require("../lib/token-log-id");
+const log_safe_1 = require("../lib/log-safe");
 /**
  * Try Better Auth's server-side session API.
  * Returns a DecodedSession if Better Auth has an active session, null otherwise.
@@ -215,7 +216,7 @@ async function tryBetterAuthSession(requestCookies) {
         return { sessionData, jwtPayload };
     }
     catch (error) {
-        console.warn('[DECODE-SESSION] Better Auth session check failed:', error instanceof Error ? error.message : String(error));
+        console.warn('[DECODE-SESSION] Better Auth session check failed:', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }
@@ -304,7 +305,7 @@ async function decodeSession(requestCookies) {
         };
     }
     catch (error) {
-        console.error('[DECODE-SESSION] Error:', error instanceof Error ? error.message : String(error));
+        console.error('[DECODE-SESSION] Error:', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }

package/dist/server/with-auth.js

@@ -18,6 +18,7 @@ exports.withAuth = withAuth;
 require("server-only");
 const server_1 = require("next/server");
 const decode_session_1 = require("./decode-session");
+const log_safe_1 = require("../lib/log-safe");
 // =============================================================================
 // MAIN
 // =============================================================================
@@ -52,7 +53,7 @@ function withAuth(handler, options) {
             return handler(req, auth);
         }
         catch (error) {
-            console.error('[WITH-AUTH] Error:', error instanceof Error ? error.message : String(error));
+            console.error('[WITH-AUTH] Error:', (0, log_safe_1.errForLog)(error));
             return server_1.NextResponse.json({ error: 'Internal Server Error', message: 'Auth check failed' }, { status: 500 });
         }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.11.0",
+  "version": "4.12.0",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/api-handlers/account/recovery/forward.ts

@@ -3,6 +3,7 @@ import { ENV_CONFIG } from '../../../config/env';
 import { getIDPClientConfig } from '../../../lib/idp-client-config';
 import { resolveClientKey } from '../../../lib/client-key';
 import { idpErrorEnvelope } from '../../../lib/safe-error-response';
+import { errForLog } from '../../../lib/log-safe';
 
 /**
  * Account recovery - the ONE forwarder behind /recovery/send-code and /recovery/verify-code (PAY-1588).
@@ -57,7 +58,7 @@ async function recoveryClientKey(where: string): Promise<string | null> {
     const config = await getIDPClientConfig();
     return resolveClientKey(config, where).key;
   } catch (e) {
-    console.error(`[${where}] could not resolve IDP client config for client_id:`, e);
+    console.error(`[${where}] could not resolve IDP client config for client_id:`, errForLog(e));
     return null;
   }
 }

package/src/api-handlers/account/recovery/initiate.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../../lib/idp-client-config';
 import { resolveClientKey } from '../../../lib/client-key';
 import { idpErrorEnvelope } from '../../../lib/safe-error-response';
+import { errForLog } from '../../../lib/log-safe';
 
 function getIdpUrl(): string {
   const url = process.env.IDP_URL;
@@ -34,7 +35,7 @@ async function recoveryClientKey(): Promise<string | null> {
     const config = await getIDPClientConfig();
     return resolveClientKey(config, 'account/recovery/initiate').key;
   } catch (e) {
-    console.error('[account/recovery/initiate] could not resolve IDP client config for client_id:', e);
+    console.error('[account/recovery/initiate] could not resolve IDP client config for client_id:', errForLog(e));
     return null;
   }
 }

package/src/api-handlers/account/reset-password.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { resolveClientKey } from '../../lib/client-key';
 import { idpErrorEnvelope, projectPasswordPolicyRules, projectResetTokenInvalid, projectPasswordBreached } from '../../lib/safe-error-response';
+import { errForLog } from '../../lib/log-safe';
 
 function getIdpUrl(): string {
   const url = process.env.IDP_URL;
@@ -34,7 +35,7 @@ async function recoveryClientKey(): Promise<string | null> {
     const config = await getIDPClientConfig();
     return resolveClientKey(config, 'account/reset-password').key;
   } catch (e) {
-    console.error('[account/reset-password] could not resolve IDP client config for client_id:', e);
+    console.error('[account/reset-password] could not resolve IDP client config for client_id:', errForLog(e));
     return null;
   }
 }

package/src/api-handlers/account/send-code.ts

@@ -11,6 +11,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { idpFetchJSON } from '../../lib/idp-fetch';
 import { ENV_CONFIG } from '../../config/env';
 import { twoFactorSendCodeFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -57,7 +58,7 @@ export async function POST(req: NextRequest) {
       { status: 200 }
     );
   } catch (error) {
-    console.error('[SEND_CODE] Error:', error);
+    console.error('[SEND_CODE] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/account/update-phone.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { idpFetchJSON } from '../../lib/idp-fetch';
 import { ENV_CONFIG } from '../../config/env';
+import { errForLog } from '../../lib/log-safe';
 
 /**
  * Update Phone Number API Handler
@@ -75,7 +76,7 @@ export async function POST(req: NextRequest) {
       data: responseData,
     });
   } catch (error) {
-    console.error('[UPDATE_PHONE] Error:', error);
+    console.error('[UPDATE_PHONE] Error:', errForLog(error));
     return NextResponse.json(
       { success: false, error: { code: 'INTERNAL_ERROR', message: 'Failed to update phone number' } },
       { status: 500 }

package/src/api-handlers/account/validate-password.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { errForLog } from '../../lib/log-safe';
 
 interface ValidatePasswordRequest {
   password: string;
@@ -123,7 +124,7 @@ export async function POST(req: NextRequest) {
       headers: { 'Cache-Control': 'no-store' },
     });
   } catch (error) {
-    console.error('[VALIDATE_PASSWORD] Error:', error);
+    console.error('[VALIDATE_PASSWORD] Error:', errForLog(error));
     return NextResponse.json(
       {
         is_valid: false,

package/src/api-handlers/account/verify-email.ts

@@ -14,6 +14,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -121,7 +122,7 @@ export async function POST(req: NextRequest) {
       message: unwrappedData.message || 'Email code verified successfully'
     }, { status: 200 });
   } catch (error) {
-    console.error('[VERIFY_EMAIL] Error:', error);
+    console.error('[VERIFY_EMAIL] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/account/verify-sms.ts

@@ -14,6 +14,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -121,7 +122,7 @@ export async function POST(req: NextRequest) {
       message: unwrappedData.message || 'SMS code verified successfully'
     }, { status: 200 });
   } catch (error) {
-    console.error('[VERIFY_SMS] Error:', error);
+    console.error('[VERIFY_SMS] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/anon/preferences.ts

@@ -15,6 +15,7 @@ import {
   ANON_COOKIE_NAME,
   AnonSessionPreferences,
 } from '../../lib/anon-session';
+import { errForLog } from '../../lib/log-safe';
 
 const COOKIE_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
 
@@ -52,7 +53,7 @@ export async function GET(request: NextRequest) {
 
     return response;
   } catch (error) {
-    console.error('[ANON-PREFERENCES] GET error:', error);
+    console.error('[ANON-PREFERENCES] GET error:', errForLog(error));
     return NextResponse.json(
       { success: false, error: 'Failed to get preferences' },
       { status: 500 }
@@ -114,7 +115,7 @@ export async function POST(request: NextRequest) {
 
     return response;
   } catch (error) {
-    console.error('[ANON-PREFERENCES] POST error:', error);
+    console.error('[ANON-PREFERENCES] POST error:', errForLog(error));
     return NextResponse.json(
       { success: false, error: 'Failed to update preferences' },
       { status: 500 }

package/src/api-handlers/auth/credential-login-email-code.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { resolveClientKey } from '../../lib/client-key';
 import { bearerFetch } from '../../lib/bearer-fetch';
+import { errForLog } from '../../lib/log-safe';
 
 // `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
 
@@ -43,7 +44,7 @@ export async function POST(req: NextRequest) {
     const config = await getIDPClientConfig();
     clientKey = resolveClientKey(config, 'graft/admin-login/email-code').key ?? '';
   } catch (err) {
-    console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', err instanceof Error ? err.message : String(err));
+    console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', errForLog(err));
     return NextResponse.json(
       { success: false, error: 'Sign-in is temporarily unavailable. This is a problem on our side. Please try again shortly.' },
       { status: 503 },
@@ -74,7 +75,7 @@ export async function POST(req: NextRequest) {
       /* not JSON - nothing to echo */
     }
   } catch (err) {
-    console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', err instanceof Error ? err.message : String(err));
+    console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', errForLog(err));
   }
 
   if (!sendOk) {

package/src/api-handlers/auth/credential-login.ts

@@ -47,6 +47,7 @@ import { createHash } from 'crypto';
 import { DEVICE_ID_HEADER, isValidDeviceId } from '../../lib/device-id';
 import { classifyTwofaRejection, type TwofaLaneResult } from '../../lib/twofa-rejection';
 import { bearerFetch } from '../../lib/bearer-fetch';
+import { errForLog } from '../../lib/log-safe';
 
 // `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
 
@@ -182,7 +183,7 @@ export async function POST(req: NextRequest) {
   try {
     config = await getIDPClientConfig();
   } catch (err) {
-    console.error('[ADMIN_LOGIN] IDP client config unavailable — returning 503:', err);
+    console.error('[ADMIN_LOGIN] IDP client config unavailable — returning 503:', errForLog(err));
     return NextResponse.json(
       {
         success: false,
@@ -283,7 +284,7 @@ export async function POST(req: NextRequest) {
         laneResults.push({ lane, status: idpResponse.status, body: await idpResponse.clone().text().catch(() => ''), retryAfter: idpResponse.headers.get('retry-after') });
       }
     } catch (error) {
-      console.error('[ADMIN-LOGIN] twofa verify fetch failed:', error instanceof Error ? error.message : String(error));
+      console.error('[ADMIN-LOGIN] twofa verify fetch failed:', errForLog(error));
       return NextResponse.json({ success: false, error: 'Unable to reach the authentication service' }, { status: 503 });
     }
     if (!idpResponse.ok) {
@@ -372,7 +373,7 @@ export async function POST(req: NextRequest) {
       body: JSON.stringify(idpPayload),
     });
   } catch (error) {
-    console.error('[ADMIN-LOGIN] IDP fetch failed:', error instanceof Error ? error.message : String(error));
+    console.error('[ADMIN-LOGIN] IDP fetch failed:', errForLog(error));
     return NextResponse.json({ success: false, error: 'Unable to reach the authentication service' }, { status: 503 });
   }
 
@@ -474,7 +475,7 @@ export async function POST(req: NextRequest) {
           console.warn('[ADMIN-LOGIN] mfa/methods unreadable, defaulting to email lane', mResp.status);
         }
       } catch (err) {
-        console.warn('[ADMIN-LOGIN] mfa/methods fetch failed, defaulting to email lane:', err instanceof Error ? err.message : String(err));
+        console.warn('[ADMIN-LOGIN] mfa/methods fetch failed, defaulting to email lane:', errForLog(err));
       }
     }
     // PAY-2314: advertise what this user can actually use, derived from the SAME usableFactors that chose the lane
@@ -549,7 +550,7 @@ export async function POST(req: NextRequest) {
           // not JSON - nothing to echo, and never a reason to fail the sign-in
         }
       } catch (err) {
-        console.error(`[ADMIN-LOGIN] twofa/${sendLane}/send fetch failed:`, err instanceof Error ? err.message : String(err));
+        console.error(`[ADMIN-LOGIN] twofa/${sendLane}/send fetch failed:`, errForLog(err));
       }
     }
     // 267479: `method:'email'` WAS A HARDCODED LITERAL HERE, and it was a lie for

package/src/api-handlers/auth/refresh.ts

@@ -26,6 +26,7 @@ import { getSession as getBetterAuthSession } from '../../server/auth';
 import { ensureFreshAccessToken, type EnsureFreshResult } from '../../lib/ensure-fresh-access-token';
 import { UPSTREAM_TIMEOUT_CODE } from '../../lib/refresh-in-doubt';
 import { sanitizeTraceId } from '../../lib/safe-trace-id';
+import { errForLog } from '../../lib/log-safe';
 
 interface RefreshConfig {
   idpBaseUrl: string;
@@ -145,7 +146,7 @@ export function createRefreshHandler(config: RefreshConfig) {
         hasRefreshToken: result.hasRefreshToken,
       });
     } catch (err: any) {
-      console.error('[AUTH_REFRESH] Unexpected error', { error: err?.message || String(err) });
+      console.error('[AUTH_REFRESH] Unexpected error', { error: errForLog(err) });
       return NextResponse.json({
         error: 'Unexpected error during refresh',
         code: 'INTERNAL_SERVER_ERROR'

package/src/api-handlers/auth/signout.ts

@@ -11,7 +11,15 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { cookies } from 'next/headers';
-import { deleteSessionEverywhere } from '../../lib/session-store';
+import { deleteSessionEverywhere, getSession as getStoredSession, getBetterAuthSession as getStoredBetterAuthSession } from '../../lib/session-store';
+import { revokeSessionAtIdp } from '../../lib/idp-logout';
+import { errForLog } from '../../lib/log-safe';
+import {
+  SESSION_NOT_ENDED_CODE,
+  SESSION_NOT_ENDED_IDP_MESSAGE,
+  SESSION_NOT_ENDED_LOCAL_MESSAGE,
+  type SessionNotEndedCause,
+} from '../../routes/auth/logout';
 import { getSession } from '../../server/auth';
 import {
   getSessionCookieName,
@@ -147,23 +155,55 @@ export function createSignoutHandler() {
       }
     }
 
-    // Delete the session from EVERY store (181922): canonical + BA secondary.
-    // Canonical-only deletion let the ba: record resurrect the session.
+    // GOV-023 (BAPert 76687): ending the session ends the IdP GRANT first, the same IdP-first path as routes/auth/logout. Before this, this
+    // handler only deleted the local record, so a consumer who mounted it left the IdP refresh token live until it expired.
+    // A failed or unresolved revoke is the same typed failure as a failed local delete (SESSION_NOT_ENDED + cause); the local delete still
+    // runs and the cookies are cleared either way.
+    let idpRevokeFailed = false;
+    let localDeleteFailed = false;
     if (redisSessionToken) {
+      // Does the stored session hold an IdP refresh token? (revokeSessionAtIdp reads the canonical row, then the Better Auth record.)
+      let heldRefreshToken = false;
+      try {
+        const stored = (await getStoredSession(redisSessionToken)) ?? (await getStoredBetterAuthSession(redisSessionToken));
+        heldRefreshToken = !!stored?.idpRefreshToken;
+      } catch {
+        // unknown: treated as "none held", so an unreadable store does not turn a clean sign-out into a failure on its own
+      }
+      try {
+        const outcome = await revokeSessionAtIdp(req);
+        // 'nothing-to-revoke' while a refresh token IS held means the helper could not resolve this session from the request (this
+        // handler also finds the session by decoding the cookie when Better Auth cannot): the grant is NOT ended, so say so.
+        if (outcome === 'nothing-to-revoke' && heldRefreshToken) {
+          idpRevokeFailed = true;
+          console.error('[SIGNOUT] IdP revoke could not resolve the session - the IdP refresh token is STILL LIVE');
+        }
+      } catch (revokeError) {
+        idpRevokeFailed = true;
+        console.error(
+          (revokeError as { grantLive?: boolean } | null)?.grantLive === true
+            ? '[SIGNOUT] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+            : '[SIGNOUT] IdP revoke could not be confirmed (the grant may already be dead):',
+          errForLog(revokeError),
+        );
+      }
+
+      // Delete the session from EVERY store (181922): canonical + BA secondary.
+      // Canonical-only deletion let the ba: record resurrect the session.
       try {
         await deleteSessionEverywhere(redisSessionToken);
         console.info('[SIGNOUT] Redis session cleanup successful', {
           sessionToken: tokenLogId(redisSessionToken)
         });
       } catch (sessionError) {
-        // Log error but don't fail the signout process
-        console.error('[SIGNOUT] Redis session cleanup failed', { error: sessionError });
+        localDeleteFailed = true;
+        console.error('[SIGNOUT] Redis session cleanup failed - the server session is STILL LIVE:', errForLog(sessionError));
       }
     } else {
       console.warn('[SIGNOUT] No Redis session token (UUID) extracted from cookie; skipping Redis deletion');
     }
 
-    // Build response
+    // Build response. A sign-out that did not end the session must not say it did (same typed answer as routes/auth/logout).
     const responseData: SignoutResponse = {
       success: true,
       message: sessionToken ? 'Session deleted successfully' : 'No active session found',
@@ -171,7 +211,14 @@ export function createSignoutHandler() {
       chunkCookiesDeleted: chunkCookies.length
     };
 
-    const response = NextResponse.json(responseData);
+    const response = (localDeleteFailed || idpRevokeFailed)
+      ? NextResponse.json(
+          localDeleteFailed
+            ? { success: false, code: SESSION_NOT_ENDED_CODE, cause: 'local_delete_failed' as SessionNotEndedCause, message: SESSION_NOT_ENDED_LOCAL_MESSAGE }
+            : { success: false, code: SESSION_NOT_ENDED_CODE, cause: 'idp_unconfirmed' as SessionNotEndedCause, message: SESSION_NOT_ENDED_IDP_MESSAGE },
+          { status: 500 },
+        )
+      : NextResponse.json(responseData);
 
     // Always clear cookies, regardless of success/failure (using app-slug prefixed names)
     try {

package/src/api-handlers/mfa/backup-code-verify.ts

@@ -60,6 +60,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -157,7 +158,7 @@ export async function POST(req: NextRequest) {
       { status: 200 }
     );
   } catch (error) {
-    console.error('[VERIFY_BACKUP_CODE] Error:', error);
+    console.error('[VERIFY_BACKUP_CODE] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/mfa/totp-verify.ts

@@ -35,6 +35,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -159,7 +160,7 @@ export async function POST(req: NextRequest) {
       { status: 200 }
     );
   } catch (error) {
-    console.error('[VERIFY_TOTP] Error:', error);
+    console.error('[VERIFY_TOTP] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,