@payez/next-mvp 4.11.0 → 4.12.1

package/dist/config/logger.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.redisLogger = exports.tokenRefreshLogger = exports.tokenSyncLogger = exports.tokenLogger = exports.circuitBreakerLogger = exports.apiLogger = exports.idpLogger = exports.authLogger = exports.logger = exports.log = void 0;
 const logging_config_1 = require("./logging-config");
 const vibe_log_transport_1 = require("./vibe-log-transport");
+const log_safe_1 = require("../lib/log-safe");
 let loggingConfig = (0, logging_config_1.getLoggingConfigSync)();
 (0, logging_config_1.startConfigWatching)();
 const isEdgeRuntime = () => {
@@ -48,7 +49,7 @@ const createLogger = () => {
         return winston.createLogger({ level: loggingConfig.logLevel, levels: loggingConfig.levels, format: winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json()), transports, exitOnError: false });
     }
     catch (error) {
-        console.warn('Failed to initialize Winston logger, falling back to EdgeLogger:', error);
+        console.warn('Failed to initialize Winston logger, falling back to EdgeLogger:', (0, log_safe_1.errForLog)(error));
         return new EdgeLogger();
     }
 };

package/dist/config/logging-config.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.removeConfigWatcher = exports.addConfigWatcher = exports.stopConfigWatching = exports.startConfigWatching = exports.getLoggingConfigSync = exports.getLoggingConfig = exports.loggingConfigManager = void 0;
 const fs_1 = require("fs");
 const fs_2 = require("fs");
+const log_safe_1 = require("../lib/log-safe");
 const isEdgeRuntime = typeof globalThis.EdgeRuntime !== 'undefined' || process.env.NEXT_RUNTIME === 'edge';
 class LoggingConfigManager {
     config = null;
@@ -39,7 +40,7 @@ class LoggingConfigManager {
             return config;
         }
         catch (error) {
-            console.warn(`Failed to load logging config from ${this.configPath}:`, error);
+            console.warn(`Failed to load logging config from ${this.configPath}:`, (0, log_safe_1.errForLog)(error));
             return this.getDefaultConfig();
         }
     }
@@ -61,7 +62,7 @@ class LoggingConfigManager {
         } });
     }
     catch (error) {
-        console.warn('Failed to start watching logging config file:', error);
+        console.warn('Failed to start watching logging config file:', (0, log_safe_1.errForLog)(error));
     } }
     stopWatching() { if (this.isEdgeRuntime || this.isBrowser) {
         return;
@@ -75,7 +76,7 @@ class LoggingConfigManager {
         cb(config);
     }
     catch (error) {
-        console.error('Error in logging config watcher:', error);
+        console.error('Error in logging config watcher:', (0, log_safe_1.errForLog)(error));
     } }); }
     validateAndMergeConfig(rawConfig) {
         const defaults = this.getDefaultConfig();

package/dist/config/vibe-log-transport.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VibeLogTransport = void 0;
 exports.createVibeLogTransport = createVibeLogTransport;
 const redis_1 = require("../lib/redis");
+const log_safe_1 = require("../lib/log-safe");
 // Dynamic import — winston is a peerDependency and may not be installed.
 // We resolve the base class lazily so builds don't break without it.
 let TransportBase;
@@ -144,7 +145,7 @@ class VibeLogTransport extends TransportBase {
                 this.batch = [...entries, ...this.batch].slice(0, 100);
             }
             // Log to console as fallback
-            console.error('[VibeLogTransport] Failed to flush logs:', err);
+            console.error('[VibeLogTransport] Failed to flush logs:', (0, log_safe_1.errForLog)(err));
         }
         finally {
             this.isFlushing = false;

package/dist/lib/ensure-fresh-access-token.js

@@ -25,6 +25,7 @@ const refresh_rotation_1 = require("./refresh-rotation");
 const refresh_window_1 = require("./refresh-window");
 const safe_trace_id_1 = require("./safe-trace-id");
 const refresh_in_doubt_1 = require("./refresh-in-doubt");
+const log_safe_1 = require("./log-safe");
 /**
  * The refresh envelope rule (BAPert 76455 (B)): `success` is a boolean; `success:true` needs a `data` object holding a string `access_token`;
  * `success:false` needs `error.code` as a string; `meta`, `request_id` and `time_stamp` are optional; a non-2xx can not say success:true.
@@ -256,17 +257,18 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
             }
             catch { /* fall through */ }
         }
-        const isOAuthSession = !!session.oauthProvider;
-        if (authMethods.length === 0 && isOAuthSession) {
-            authMethods = ['pwd', 'mfa'];
-        }
+        // PAY-2425 (BAPert 77400, NightHawk 77401): THE CLIENT DOES NOT INFER AUTHENTICATION STRENGTH FROM SILENCE. This block used to answer an OAuth
+        // (Google) session whose stored methods were EMPTY with amr ['pwd','mfa'], a two-factor method of 'oauth' and an acr raised from '1' to '2' ("OAuth IS
+        // a form of multi-factor auth"). That is false: OAuth is federated sign-in, one factor typed at the provider. It fired exactly when the session
+        // could tell us nothing and answered with the strongest claim available; on prod (4.10.0) a Google user on a require2FA client was then counted
+        // 2FA-complete with no code (RigPert 77398). What the session does not attest, the refresh body does not assert: empty stays empty, the level stays
+        // the session's own, and no method is named unless one is recorded. The IdP computes the real amr/acr for the minted token (and mfaVerified is
+        // re-derived from THAT token below); a session that really attests 'mfa' still sends it. History: the fix existed on nextpert/375639-amr-fabrication
+        // (e6e3b6c3, e3b3bb12) and was never merged.
         const twoFactorMethod = authMethods.find(m => ['sms', 'totp', 'email'].includes(m)) ||
             session.mfaMethod ||
-            (isOAuthSession ? 'oauth' : null);
-        let acrValue = String(session.authenticationLevel ?? '1');
-        if (isOAuthSession && session.mfaVerified && acrValue === '1') {
-            acrValue = '2';
-        }
+            null;
+        const acrValue = String(session.authenticationLevel ?? '1');
         // WO-2: send the POST-lock current refresh token, not the pre-lock snapshot.
         // `session` was read before we acquired the lock; a concurrent refresh that
         // completed while we waited rotates the token, so the pre-lock value is stale
@@ -299,7 +301,11 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
             amr: authMethods,
             acr: acrValue,
         };
-        if (session.mfaVerified)
+        // PAY-2425 (NightHawk 77414): a STORED mfaVerified flag is only echoed when the session's own recorded methods back it. Sessions created while the
+        // bug was live carry mfaVerified:true that the bug itself wrote, with no 'mfa' (or sms/totp/email) in their methods; echoing that flag would carry the
+        // poison across the upgrade. A genuine second factor leaves 'mfa' and its method in the recorded methods, so it is still sent.
+        const methodsAttestSecondFactor = authMethods.some(m => m === 'mfa' || ['sms', 'totp', 'email'].includes(m));
+        if (session.mfaVerified && methodsAttestSecondFactor)
             body.two_factor_verified = true;
         if (twoFactorMethod)
             body.two_factor_method = twoFactorMethod;
@@ -318,7 +324,7 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
                 await (0, session_store_1.updateSession)(sessionToken, (0, refresh_in_doubt_1.inDoubtPatch)(sentRefreshToken));
             }
             catch (markError) {
-                console.error('[ENSURE-FRESH] could not record the in-doubt marker', { error: markError instanceof Error ? markError.message : String(markError) });
+                console.error('[ENSURE-FRESH] could not record the in-doubt marker', { error: (0, log_safe_1.errForLog)(markError) });
             }
             return {
                 ok: false,

package/dist/lib/geolocation.js

@@ -1,22 +1,4 @@
 "use strict";
-/**
- * =============================================================================
- * GEOLOCATION UTILITY
- * =============================================================================
- *
- * Server-side utility for resolving IP addresses to geographic locations.
- * Uses ip-api.com (free tier: 45 requests/minute).
- *
- * USAGE:
- * ------
- * import { getLocationFromIP, extractClientIP } from '@payez/next-mvp/lib/geolocation';
- *
- * const ip = extractClientIP(request.headers);
- * const location = await getLocationFromIP(ip);
- * console.log(location?.city); // 'Mountain View'
- *
- * =============================================================================
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isPrivateIP = isPrivateIP;
 exports.getPublicIP = getPublicIP;
@@ -25,6 +7,7 @@ exports.getLocationFromIP = getLocationFromIP;
 exports.formatLocation = formatLocation;
 exports.getCountryFlag = getCountryFlag;
 exports.clearGeoCache = clearGeoCache;
+const log_safe_1 = require("./log-safe");
 // -----------------------------------------------------------------------------
 // CACHE CONFIGURATION
 // -----------------------------------------------------------------------------
@@ -90,7 +73,7 @@ async function getPublicIP() {
                 // Validate it looks like an IP
                 if (ip && /^[\d.]+$/.test(ip) || /^[a-f0-9:]+$/i.test(ip)) {
                     cachedPublicIP = { ip, timestamp: Date.now() };
-                    console.log(`[geolocation] Public IP resolved: ${ip}`);
+                    console.log("[geolocation] Public IP resolved");
                     return ip;
                 }
             }
@@ -147,7 +130,7 @@ async function getLocationFromIP(ip, resolvePublicIP = true) {
         if (resolvePublicIP) {
             const publicIP = await getPublicIP();
             if (publicIP && !isPrivateIP(publicIP)) {
-                console.log(`[geolocation] Private IP ${ip} -> using public IP ${publicIP}`);
+                console.log("[geolocation] Private IP -> using the resolved public IP");
                 // Recursively call with public IP (but don't resolve again to prevent loops)
                 return getLocationFromIP(publicIP, false);
             }
@@ -176,7 +159,7 @@ async function getLocationFromIP(ip, resolvePublicIP = true) {
         }
         const data = await response.json();
         if (data.status !== 'success') {
-            console.warn(`[geolocation] Lookup failed for ${ip}: ${data.message}`);
+            console.warn("[geolocation] Lookup failed (upstream refused)");
             // Cache the failure to avoid repeated lookups
             geoCache.set(ip, { location: null, timestamp: Date.now() });
             return null;
@@ -196,7 +179,7 @@ async function getLocationFromIP(ip, resolvePublicIP = true) {
         return location;
     }
     catch (error) {
-        console.error(`[geolocation] Error looking up ${ip}:`, error);
+        console.error("[geolocation] lookup failed:", (0, log_safe_1.errForLog)(error)); // no IP on a routine line (BAPert 76553 Q1)
         return null;
     }
 }

package/dist/lib/idp-client-config.js

@@ -82,6 +82,7 @@ exports.getEnabledProviders = getEnabledProviders;
 require("server-only");
 const crypto_1 = require("crypto");
 const never_in_response_1 = require("./never-in-response");
+const log_safe_1 = require("./log-safe");
 // REDIS IS IMPORTED LAZILY, AND THAT IS LOAD-BEARING.
 // A module-scope `import redis from './redis'` drags ioredis into EVERY bundle that
 // touches this file - including instrumentation.ts. Next compiles the instrumentation
@@ -276,7 +277,7 @@ async function getConfigFromRedis() {
         return parsed.config;
     }
     catch (error) {
-        console.warn('[IDP_CONFIG] Failed to read from Redis cache:', error);
+        console.warn('[IDP_CONFIG] Failed to read from Redis cache:', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }
@@ -293,7 +294,7 @@ async function setConfigInRedis(config) {
         await (await getRedis()).set(key, JSON.stringify(data), 'EX', ttlSeconds + 10);
     }
     catch (error) {
-        console.warn('[IDP_CONFIG] Failed to write to Redis cache:', error);
+        console.warn('[IDP_CONFIG] Failed to write to Redis cache:', (0, log_safe_1.errForLog)(error));
     }
 }
 // ============================================================================
@@ -529,7 +530,7 @@ async function clearConfigRedisCache() {
         console.log('[IDP_CONFIG] Redis cache cleared:', key);
     }
     catch (error) {
-        console.warn('[IDP_CONFIG] Failed to clear Redis cache:', error);
+        console.warn('[IDP_CONFIG] Failed to clear Redis cache:', (0, log_safe_1.errForLog)(error));
     }
 }
 /**

package/dist/lib/idp-fetch.d.ts

@@ -35,5 +35,16 @@ export interface IdpFetchOptions {
      * `skipped: true` without a request; null on the retry leaves the first answer standing. Absent: `init` is used as before.
      */
     initFor?: (sessionToken: string) => Promise<RequestInit | null>;
+    /**
+     * 4.12: the refresh that follows a 401/403 is done by THIS function instead of the HTTP self-call to /api/auth/refresh. Sign-out supplies one that
+     * calls `ensureFreshAccessToken` in-process with a window that cannot be "fresh": a logout 401 with a locally-fresh token usually means Core
+     * invalidated the token (password change), and only the IdP's answer to a real refresh (401 + the discard marker = the grant is dead; success =
+     * the grant is live) can say which. No header on the public refresh route, so nothing a browser sends can force a refresh (BAPert 77022).
+     * Returns the status the refresh route would have answered. Absent: `internalRefresh` as before.
+     */
+    refreshOnAuthFailure?: (sessionToken: string) => Promise<{
+        ok: boolean;
+        status: number;
+    }>;
 }
 export declare function idpFetchJSON<T = any>(req: NextRequest, targetUrl: string, init?: RequestInit, opts?: IdpFetchOptions): Promise<IdpFetchResult<T>>;

package/dist/lib/idp-fetch.js

@@ -180,7 +180,9 @@ async function idpFetchJSON(req, targetUrl, init = {}, opts = {}) {
         attemptedRefresh = true;
         try {
             // Use centralized internal API helper for server-to-server calls
-            const rf = await (0, internal_api_1.internalRefresh)(req.headers.get('cookie') || '', sessionToken);
+            const rf = opts.refreshOnAuthFailure
+                ? await opts.refreshOnAuthFailure(sessionToken)
+                : await (0, internal_api_1.internalRefresh)(req.headers.get('cookie') || '', sessionToken);
             refreshStatus = rf.status;
             if (rf.ok) {
                 const fresh = await (0, session_store_1.getSession)(sessionToken);

package/dist/lib/idp-logout.d.ts

@@ -21,4 +21,14 @@ import type { NextRequest } from 'next/server';
  * refresh token, and a body built earlier would name the old one (NightHawk 76288).
  */
 export type IdpLogoutOutcome = 'revoked' | 'nothing-to-revoke' | 'grant-already-dead';
+/**
+ * The revoke could not be confirmed. `grantLive` is true ONLY when the IdP itself showed the grant is alive: the forced refresh SUCCEEDED (it issued
+ * new tokens) and the logout still did not end it. Every other unknown (a transport error, a 5xx, a refresh that threw or answered something
+ * else) leaves it false: the grant may be live or dead, and the log must not claim either (BAPert 77013). The closed `code` is what errForLog prints.
+ */
+export declare class IdpLogoutUnconfirmedError extends Error {
+    readonly grantLive: boolean;
+    readonly code = "IDP_LOGOUT_UNCONFIRMED";
+    constructor(status: number, grantLive: boolean);
+}
 export declare function revokeSessionAtIdp(req: NextRequest): Promise<IdpLogoutOutcome>;

package/dist/lib/idp-logout.js

@@ -1,12 +1,64 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdpLogoutUnconfirmedError = void 0;
 exports.revokeSessionAtIdp = revokeSessionAtIdp;
 const idp_fetch_1 = require("./idp-fetch");
 const session_store_1 = require("./session-store");
 const env_1 = require("../config/env");
+/**
+ * The revoke could not be confirmed. `grantLive` is true ONLY when the IdP itself showed the grant is alive: the forced refresh SUCCEEDED (it issued
+ * new tokens) and the logout still did not end it. Every other unknown (a transport error, a 5xx, a refresh that threw or answered something
+ * else) leaves it false: the grant may be live or dead, and the log must not claim either (BAPert 77013). The closed `code` is what errForLog prints.
+ */
+class IdpLogoutUnconfirmedError extends Error {
+    grantLive;
+    code = 'IDP_LOGOUT_UNCONFIRMED';
+    constructor(status, grantLive) {
+        super(`IdP logout answered ${status}`);
+        this.grantLive = grantLive;
+        this.name = 'IdpLogoutUnconfirmedError';
+    }
+}
+exports.IdpLogoutUnconfirmedError = IdpLogoutUnconfirmedError;
 async function revokeSessionAtIdp(req) {
     let resolvedSession;
     const result = await (0, idp_fetch_1.idpFetchJSON)(req, `${env_1.ENV_CONFIG.IDP_URL}/api/Account/logout`, {}, {
+        // A logout 401 with a locally-fresh token must reach a REAL refresh, so the IdP's answer can prove the grant dead (BAPert 77013). Done
+        // in-process, not through the public refresh route, so no request header can force it (NightHawk 77021, BAPert 77022).
+        refreshOnAuthFailure: forceRefreshAtIdp,
         initFor: async (token) => {
             resolvedSession = token;
             let session = await (0, session_store_1.getSession)(token);
@@ -28,7 +80,27 @@ async function revokeSessionAtIdp(req) {
         return 'revoked';
     if (result.attemptedRefresh && result.refreshStatus === 401 && resolvedSession && (await grantWasDiscarded(resolvedSession)))
         return 'grant-already-dead';
-    throw new Error(`IdP logout answered ${result.status}`);
+    const refreshSucceeded = result.attemptedRefresh && typeof result.refreshStatus === 'number' && result.refreshStatus >= 200 && result.refreshStatus < 300;
+    throw new IdpLogoutUnconfirmedError(result.status, refreshSucceeded);
+}
+/**
+ * Refresh the session NOW, ignoring "the stored access token looks fresh", by calling `ensureFreshAccessToken` in this process (the one
+ * implementation that talks to the IdP, holds the lock and writes the discard marker). Config is read the way `oauth/resume` reads it
+ * (IDP_URL, CLIENT_ID, the default refresh endpoint). It answers with the status the refresh route would have: 200 on success, 401 for
+ * NO_SESSION / NO_REFRESH_TOKEN, 409 for a lost lock, otherwise E's own status (a discarded IdP 401 is 401 with the marker written).
+ * Missing config or a throw is an UNKNOWN outcome: the caller treats a thrown refresh as `refreshStatus: null`.
+ */
+async function forceRefreshAtIdp(sessionToken) {
+    const idpBaseUrl = process.env.IDP_URL;
+    const clientId = process.env.CLIENT_ID;
+    if (!idpBaseUrl || !clientId)
+        throw new Error('IDP_URL and CLIENT_ID are required to prove a grant dead');
+    const { ensureFreshAccessToken } = await Promise.resolve().then(() => __importStar(require('./ensure-fresh-access-token')));
+    const r = await ensureFreshAccessToken(sessionToken, { idpBaseUrl, clientId }, { requireRefreshToken: true, safetyWindowMs: Number.MAX_SAFE_INTEGER });
+    if (r.ok)
+        return { ok: true, status: 200 };
+    const status = r.code === 'NO_SESSION' || r.code === 'NO_REFRESH_TOKEN' ? 401 : r.code === 'CONFLICT' ? 409 : r.status;
+    return { ok: false, status };
 }
 /**
  * A refresh 401 is not by itself "the grant is gone" (NightHawk 76295, BAPert 76297): refresh.ts also answers 401 for 'no session', for

package/dist/lib/jwt-decode-client.js

@@ -5,6 +5,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.jwtDecode = jwtDecode;
+const log_safe_1 = require("./log-safe");
 // Decode base64url
 function base64urlDecode(base64url) {
     try {
@@ -40,7 +41,7 @@ function jwtDecode(token) {
         return parsedPayload;
     }
     catch (e) {
-        console.error('[JWT] Decode failed:', e instanceof Error ? e.message : 'Unknown error');
+        console.error('[JWT] Decode failed:', (0, log_safe_1.errForLog)(e));
         return null;
     }
 }

package/dist/lib/jwt-decode.js

@@ -4,6 +4,7 @@ exports.jwtDecode = jwtDecode;
 exports.decodeJwtHeader = decodeJwtHeader;
 exports.extractKidFromToken = extractKidFromToken;
 const jwt_decode_1 = require("jwt-decode");
+const log_safe_1 = require("./log-safe");
 /**
  * Decode JWT payload (standard claims).
  * This is a thin wrapper around jwt-decode library.
@@ -40,7 +41,7 @@ function decodeJwtHeader(token) {
         return JSON.parse(headerJson);
     }
     catch (error) {
-        console.error('[JWT_DECODE] Failed to decode JWT header:', error);
+        console.error('[JWT_DECODE] Failed to decode JWT header:', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }

package/dist/lib/log-safe.d.ts

@@ -0,0 +1,19 @@
+/**
+ * log-safe: the ONLY way a caught error or an upstream `code` goes into a server log (PII-in-logs census, BAPert 76553 group 1; ported from the
+ * portal's api-error-response.ts, BAPert 76470).
+ *
+ * Server logs persist and are read beyond the person who made the request. An error's `message`, `stack`, `cause` and `details` can carry an
+ * email, a phone number, a code, a token, a SQL fragment or a host: an IdP error's message is the upstream's own free text, and V8's JSON parse
+ * error quotes its input. So a log line gets the error's NAME and a closed STATUS / CODE, nothing else. Every field is matched against a closed
+ * shape; anything that does not match is dropped, not truncated.
+ *
+ * No imports on purpose: this is a leaf, loaded by modules that must not pull in anything else.
+ */
+/** An upstream `code` is loggable only if it is a closed token (UPPER_SNAKE). Anything else, including free text, becomes null. */
+export declare function closedCodeForLog(code: unknown): string | null;
+/**
+ * Describe a caught error for a log line: `error=<Name> [status=<n>] [code=<CLOSED_CODE>]`.
+ * It NEVER carries `message`, `stack`, `cause` or `details`. A name that is not a short identifier (a hostile or free-text `name`) becomes
+ * `NonError`; a status outside 100-599 is dropped; a code outside the closed token shape is dropped.
+ */
+export declare function errForLog(err: unknown): string;

package/dist/lib/log-safe.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * log-safe: the ONLY way a caught error or an upstream `code` goes into a server log (PII-in-logs census, BAPert 76553 group 1; ported from the
+ * portal's api-error-response.ts, BAPert 76470).
+ *
+ * Server logs persist and are read beyond the person who made the request. An error's `message`, `stack`, `cause` and `details` can carry an
+ * email, a phone number, a code, a token, a SQL fragment or a host: an IdP error's message is the upstream's own free text, and V8's JSON parse
+ * error quotes its input. So a log line gets the error's NAME and a closed STATUS / CODE, nothing else. Every field is matched against a closed
+ * shape; anything that does not match is dropped, not truncated.
+ *
+ * No imports on purpose: this is a leaf, loaded by modules that must not pull in anything else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.closedCodeForLog = closedCodeForLog;
+exports.errForLog = errForLog;
+/** An upstream `code` is loggable only if it is a closed token (UPPER_SNAKE). Anything else, including free text, becomes null. */
+function closedCodeForLog(code) {
+    return typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code) ? code : null;
+}
+/**
+ * Describe a caught error for a log line: `error=<Name> [status=<n>] [code=<CLOSED_CODE>]`.
+ * It NEVER carries `message`, `stack`, `cause` or `details`. A name that is not a short identifier (a hostile or free-text `name`) becomes
+ * `NonError`; a status outside 100-599 is dropped; a code outside the closed token shape is dropped.
+ */
+function errForLog(err) {
+    const e = (err !== null && typeof err === 'object' ? err : {});
+    const name = typeof e.name === 'string' && /^[A-Za-z0-9_]{1,48}$/.test(e.name) ? e.name : 'NonError';
+    const status = typeof e.status === 'number' && Number.isInteger(e.status) && e.status >= 100 && e.status <= 599 ? ` status=${e.status}` : '';
+    const closed = closedCodeForLog(e.code);
+    const code = closed ? ` code=${closed}` : '';
+    return `error=${name}${status}${code}`;
+}

package/dist/lib/redis.js

@@ -7,6 +7,7 @@ exports.redis = void 0;
 exports.getRedis = getRedis;
 // E:\Repos\PayEz-Next-MVP\packages\next-mvp\src\lib\redis.ts
 const ioredis_1 = __importDefault(require("ioredis"));
+const log_safe_1 = require("./log-safe");
 let client = null;
 // ── 183496: fail FAST and NAMED, never a 20s spinner ───────────────────────
 // The DEFAULTS were the defect (Nextpert-Scout's killable-proxy measurement,
@@ -75,7 +76,7 @@ function createClient() {
     // unhandled EventEmitter error, which can take the whole PROCESS down -
     // a Redis blip becoming a dead server is worse than the spinner was.
     instance.on('error', (err) => {
-        console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${(0, log_safe_1.errForLog)(err)}`);
     });
     // 185121 line 3: the 16:05 event left no named trigger because ONLY 'error'
     // was listened for. A reconnect or a clean end is silent in the artifact,

package/dist/lib/safe-error-response.d.ts

@@ -19,7 +19,11 @@ export interface IdpErrorProjection {
     resolution?: string;
     request_id?: string;
 }
-/** Log an exception with a fresh correlationId and return the id for the response body. */
+/**
+ * Log an exception with a fresh correlationId and return the id for the response body.
+ * The log line carries the error's NAME and closed code/status only (errForLog), never its message, stack or cause: those can hold an
+ * email, a phone number, a token or a quoted request body (PII-in-logs, BAPert 76553 group 1). The correlationId still ties the response to the line.
+ */
 export declare function logExceptionWithCorrelation(tag: string, err: unknown): string;
 /** Whitelisted projection of an IDP error envelope: code / message / resolution / request_id only. */
 export declare function projectIdpError(json: unknown): IdpErrorProjection;

package/dist/lib/safe-error-response.js

@@ -23,11 +23,16 @@ exports.projectResetTokenInvalid = projectResetTokenInvalid;
 exports.projectPasswordPolicyRules = projectPasswordPolicyRules;
 exports.projectPasswordBreached = projectPasswordBreached;
 const password_rules_1 = require("./password-rules");
+const log_safe_1 = require("./log-safe");
 const str = (v) => (typeof v === 'string' ? v : undefined);
-/** Log an exception with a fresh correlationId and return the id for the response body. */
+/**
+ * Log an exception with a fresh correlationId and return the id for the response body.
+ * The log line carries the error's NAME and closed code/status only (errForLog), never its message, stack or cause: those can hold an
+ * email, a phone number, a token or a quoted request body (PII-in-logs, BAPert 76553 group 1). The correlationId still ties the response to the line.
+ */
 function logExceptionWithCorrelation(tag, err) {
     const correlationId = globalThis.crypto.randomUUID();
-    console.error(tag, { correlationId, error: err });
+    console.error(tag, { correlationId, error: (0, log_safe_1.errForLog)(err) });
     return correlationId;
 }
 /** Whitelisted projection of an IDP error envelope: code / message / resolution / request_id only. */

package/dist/lib/session-store.js

@@ -44,6 +44,7 @@ const app_slug_1 = require("./app-slug");
 const token_utils_1 = require("../auth/utils/token-utils");
 const token_log_id_1 = require("./token-log-id");
 const refresh_in_doubt_1 = require("./refresh-in-doubt");
+const log_safe_1 = require("./log-safe");
 // Use app-slug prefixes for multi-app isolation
 const getSessionKey = (token) => `${(0, app_slug_1.getSessionPrefix)()}${token}`;
 const getRefreshLockKey = (token) => `${(0, app_slug_1.getRefreshLockPrefix)()}${token}`;
@@ -79,7 +80,7 @@ async function createSession(data) {
             .exec();
     }
     catch (error) {
-        console.error('[SESSION-STORE] Failed to create session:', error);
+        console.error('[SESSION-STORE] Failed to create session:', (0, log_safe_1.errForLog)(error));
         throw error;
     }
     return sessionToken;

package/dist/lib/site-logger.d.ts

@@ -54,7 +54,6 @@ export declare const siteEvents: {
     }) => void;
     loginFailed: (opts: {
         reason: string;
-        email?: string;
         url?: string;
         user_agent?: string;
         ip_address?: string;
@@ -106,9 +105,7 @@ export declare const siteEvents: {
         ip_address?: string;
     }) => void;
     error: (opts: {
-        message: string;
-        error?: string;
-        stack?: string;
+        code: string;
         user_id?: string | number;
         url?: string;
         user_agent?: string;
@@ -139,7 +136,6 @@ declare const _default: {
         }) => void;
         loginFailed: (opts: {
             reason: string;
-            email?: string;
             url?: string;
             user_agent?: string;
             ip_address?: string;
@@ -191,9 +187,7 @@ declare const _default: {
             ip_address?: string;
         }) => void;
         error: (opts: {
-            message: string;
-            error?: string;
-            stack?: string;
+            code: string;
             user_id?: string | number;
             url?: string;
             user_agent?: string;

package/dist/lib/site-logger.js

@@ -16,6 +16,7 @@ exports.configureSiteLogger = configureSiteLogger;
 exports.logSiteEvent = logSiteEvent;
 exports.getClientIp = getClientIp;
 const redis_1 = require("./redis");
+const log_safe_1 = require("./log-safe");
 // Redis key for site logs (separate from data_logs)
 const REDIS_SITE_LOG_KEY = 'vibe:site-logs:pending';
 const REDIS_LOG_TTL = 7 * 24 * 60 * 60; // 1 week
@@ -53,12 +54,12 @@ async function logSiteEvent(entry) {
             console.log('[site-logger] Redis push success, queue length:', result);
             redis.expire(REDIS_SITE_LOG_KEY, REDIS_LOG_TTL).catch(() => { });
         }).catch(err => {
-            console.error('[site-logger] Redis push failed:', err.message);
+            console.error('[site-logger] Redis push failed:', (0, log_safe_1.errForLog)(err));
         });
     }
     catch (error) {
         // Fail silently - logging should never break the app
-        console.error('[site-logger] Failed to log event:', error);
+        console.error('[site-logger] Failed to log event:', (0, log_safe_1.errForLog)(error));
     }
 }
 /**
@@ -94,12 +95,14 @@ exports.siteEvents = {
             ip_address: opts.ip_address,
         });
     },
+    // BREAKING (PII-in-logs group 3b, BAPert 76553 Q2): no `email` parameter. A failed login is told apart by a CLOSED reason code (UPPER_SNAKE),
+    // never by the address that was tried; anything that is not a closed code is stored as UNSPECIFIED. A caller that still passes `email` fails to compile.
     loginFailed: (opts) => {
         logSiteEvent({
             level: 'warn',
             category: 'auth',
             message: 'Login failed',
-            context: { reason: opts.reason, email: opts.email },
+            context: { reason: (0, log_safe_1.closedCodeForLog)(opts.reason) ?? 'UNSPECIFIED' },
             url: opts.url || '/auth/login',
             user_agent: opts.user_agent,
             ip_address: opts.ip_address,
@@ -181,12 +184,15 @@ exports.siteEvents = {
             ip_address: opts.ip_address,
         });
     },
+    // BREAKING (PII-in-logs group 3b, BAPert 76553 Q2): takes a CLOSED code, not caller text, an error string or a stack. The stored message is the fixed
+    // sentence 'Application error'; the code (UPPER_SNAKE, else UNSPECIFIED) goes in context. A caller that still passes `message`, `error` or `stack`
+    // fails to compile.
     error: (opts) => {
         logSiteEvent({
             level: 'error',
             category: 'error',
-            message: opts.message,
-            context: { error: opts.error, stack: opts.stack },
+            message: 'Application error',
+            context: { code: (0, log_safe_1.closedCodeForLog)(opts.code) ?? 'UNSPECIFIED' },
             user_id: opts.user_id,
             url: opts.url,
             user_agent: opts.user_agent,