@payez/next-mvp 4.4.5 → 4.4.6

package/dist/api-handlers/mfa/totp-verify.d.ts

@@ -28,22 +28,4 @@
  * @package @payez/next-mvp
  */
 import { NextRequest, NextResponse } from 'next/server';
-export declare function POST(req: NextRequest): Promise<NextResponse<{
-    success: boolean;
-    error: string;
-    code: string;
-}> | NextResponse<{
-    success: boolean;
-    error: any;
-    code: any;
-    meta: {
-        attemptedRefresh: boolean;
-    };
-}> | NextResponse<{
-    message: any;
-    requiresChallenge?: boolean | undefined;
-    nextStep?: "mfa_verify" | undefined;
-    success: boolean;
-    verificationSuccessful: boolean;
-    twoFactorSessionVerified: boolean;
-}>>;
+export declare function POST(req: NextRequest): Promise<NextResponse<unknown>>;

package/dist/api-handlers/mfa/totp-verify.js

@@ -36,6 +36,7 @@ const env_1 = require("../../config/env");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
+const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
 async function POST(req) {
     try {
         const body = await req.json();
@@ -55,12 +56,9 @@ async function POST(req) {
             body: JSON.stringify({ code }),
         });
         if (!result.ok) {
-            return server_1.NextResponse.json({
-                success: false,
-                error: result.json?.message || 'Verification failed',
-                code: result.json?.code || 'IDP_ERROR',
-                meta: { attemptedRefresh: result.attemptedRefresh },
-            }, { status: result.status });
+            // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
+            // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
+            return (0, two_factor_verify_failure_1.twoFactorVerifyFailure)(result, 'totp');
         }
         // Unwrap IDP envelope { success, data }
         const unwrappedData = result.json?.data || result.json;

package/dist/api-handlers/passkeys/list.js

@@ -4,6 +4,7 @@ exports.GET = GET;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * List the signed-in user's passkeys (GET /api/Passkeys, user JWT).
  * Probe-verified live 2026-08-01 (anon -> 401 = routed).
@@ -15,7 +16,7 @@ async function GET(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/passkeys/manage.js

@@ -5,6 +5,7 @@ exports.DELETE = DELETE;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Manage ONE passkey (PATCH rename / DELETE revoke, /api/Passkeys/{id},
  * user JWT). The id arrives from the Next dynamic segment via the routes
@@ -14,7 +15,7 @@ function upstreamError(result) {
     return server_1.NextResponse.json({
         success: false,
         message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
         meta: { attemptedRefresh: result.attemptedRefresh },
     }, { status: result.status });
 }

package/dist/api-handlers/passkeys/register-options.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Begin the passkey REGISTRATION ceremony (POST /api/Passkeys/register/options,
  * user JWT — a credential change; the IDP may demand step-up, surfaced as-is).
@@ -27,7 +28,7 @@ async function POST(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/passkeys/register-verify.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Finish the passkey REGISTRATION ceremony (POST /api/Passkeys/register/verify,
  * user JWT). Body forwarded VERBATIM — it carries the enrolment handle plus the
@@ -26,7 +27,7 @@ async function POST(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/session/refresh-viability.d.ts

@@ -2,13 +2,15 @@ import { NextRequest, NextResponse } from 'next/server';
 export declare function GET(req: NextRequest): Promise<NextResponse<{
     canRefresh: boolean;
     reason: string;
-    sessionToken: null;
+    sessionTokenId: null;
 }> | NextResponse<{
     canRefresh: boolean;
     reason: string;
-    sessionToken: string;
+    sessionTokenId: string;
 }> | NextResponse<{
     canRefresh: boolean;
     reason: string;
     error: string;
+    code: string;
+    correlationId: string;
 }>>;

package/dist/api-handlers/session/refresh-viability.js

@@ -6,6 +6,7 @@ const session_store_1 = require("../../lib/session-store");
 const refresh_token_validator_1 = require("../../lib/refresh-token-validator");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const logger_1 = require("../../config/logger");
+const token_log_id_1 = require("../../lib/token-log-id");
 async function GET(req) {
     try {
         const sessionToken = req.nextUrl.searchParams.get('token');
@@ -16,24 +17,26 @@ async function GET(req) {
             finalSessionToken = (token?.sessionToken || token?.redisSessionId);
         }
         if (!finalSessionToken) {
-            return server_1.NextResponse.json({ canRefresh: false, reason: 'not_logged_in', sessionToken: null }, { status: 200 });
+            return server_1.NextResponse.json({ canRefresh: false, reason: 'not_logged_in', sessionTokenId: null }, { status: 200 });
         }
         const refreshInProgress = await (0, session_store_1.isRefreshInProgress)(finalSessionToken);
         if (refreshInProgress) {
             // Still need to get session data for twoFactorComplete even when refresh is in progress
             const sessionData = await (0, session_store_1.getSession)(finalSessionToken);
-            logger_1.logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: finalSessionToken.substring(0, 8) + '...' });
-            return server_1.NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? false }, { status: 200 });
+            logger_1.logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: (0, token_log_id_1.tokenLogId)(finalSessionToken) });
+            return server_1.NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionTokenId: (0, token_log_id_1.tokenLogId)(finalSessionToken), twoFactorComplete: sessionData?.mfaVerified ?? false }, { status: 200 });
         }
         const sessionData = await (0, session_store_1.getSession)(finalSessionToken);
         if (!sessionData) {
-            return server_1.NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionToken: finalSessionToken }, { status: 200 });
+            return server_1.NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionTokenId: (0, token_log_id_1.tokenLogId)(finalSessionToken) }, { status: 200 });
         }
         const viabilityCheck = (0, refresh_token_validator_1.checkRefreshViability)(sessionData);
-        return server_1.NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
+        return server_1.NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionTokenId: (0, token_log_id_1.tokenLogId)(finalSessionToken), twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
     }
     catch (error) {
-        logger_1.logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { error: error instanceof Error ? error.message : String(error) });
-        return server_1.NextResponse.json({ canRefresh: false, reason: 'check_error', error: error instanceof Error ? error.message : String(error) }, { status: 500 });
+        const correlationId = globalThis.crypto.randomUUID();
+        logger_1.logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { correlationId, error: error instanceof Error ? error.message : String(error) });
+        // PAY-1438: the exception text stays in the log above; the caller gets the id.
+        return server_1.NextResponse.json({ canRefresh: false, reason: 'check_error', error: 'Failed to check refresh viability', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
     }
 }

package/dist/api-handlers/session/viability.js

@@ -11,6 +11,7 @@ const session_store_1 = require("../../lib/session-store");
 const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const idp_client_config_1 = require("../../lib/idp-client-config");
+const token_log_id_1 = require("../../lib/token-log-id");
 async function GET(req) {
     try {
         // Ensure initialization is complete (auth signing secret resolved from IDP)
@@ -109,7 +110,7 @@ async function GET(req) {
                 const sessionMfaComplete = sessionData.mfaVerified ?? false;
                 const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
                 console.log('[VIABILITY] Session 2FA check:', {
-                    sessionToken: sessionToken.substring(0, 8) + '...',
+                    sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                     mfaVerified: sessionData.mfaVerified,
                     twoFactorComplete: sessionData.twoFactorComplete,
                     sessionMfaComplete,
@@ -125,7 +126,7 @@ async function GET(req) {
                 }
                 const response = {
                     authenticated: true,
-                    sessionToken, // Include token for middleware tracking
+                    sessionTokenId: (0, token_log_id_1.tokenLogId)(sessionToken), // PAY-1481: correlation id for middleware tracking, never the token
                     // 2FA fields - critical for middleware redirect logic
                     requires2FA, // From cached client config (client-wide setting)
                     twoFactorComplete: effectiveTwoFactorComplete, // From session, BUT respects MFA TTL
@@ -159,7 +160,7 @@ async function GET(req) {
             console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
             return server_1.NextResponse.json({
                 authenticated: false,
-                sessionToken // Include token to enable stale cookie detection
+                sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null // PAY-1481: presence + correlation for stale cookie detection
             });
         }
         // If there's no token at all, it's not authenticated

package/dist/api-handlers/test/force-expire.js

@@ -4,6 +4,8 @@ exports.POST = void 0;
 const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
+const safe_error_response_1 = require("../../lib/safe-error-response");
+const token_log_id_1 = require("../../lib/token-log-id");
 /**
  * ⚠️ DESTRUCTIVE TEST-ONLY HANDLER — DO NOT MOUNT IN PRODUCTION. ⚠️
  *
@@ -134,7 +136,7 @@ const POST = async (req) => {
         const prev = session.idpAccessTokenExpires || null;
         await (0, session_store_1.updateSession)(sessionToken, { idpAccessTokenExpires: forced });
         console.log('[TEST_EXPIRE] Forced access token expiry for session', {
-            sessionToken: sessionToken.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             previous: prev ? new Date(prev).toISOString() : null,
             newExpiry: new Date(forced).toISOString()
         });
@@ -147,8 +149,8 @@ const POST = async (req) => {
         });
     }
     catch (e) {
-        console.error('[TEST_EXPIRE] Error:', e);
-        return server_1.NextResponse.json({ success: false, error: e instanceof Error ? e.message : String(e) }, { status: 500 });
+        const correlationId = (0, safe_error_response_1.logExceptionWithCorrelation)('[TEST_EXPIRE] Error:', e);
+        return server_1.NextResponse.json({ success: false, error: 'Failed to force expiry', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
     }
 };
 exports.POST = POST;

package/dist/auth/auth-decision.js

@@ -8,6 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeAuthDecision = makeAuthDecision;
 const safe_callback_1 = require("./safe-callback");
+const token_log_id_1 = require("../lib/token-log-id");
 /**
  * Main decision function - pure, testable, deterministic
  */
@@ -99,7 +100,7 @@ function makeAuthDecision(context) {
             pathname,
             isLoginPage,
             sessionExists: sessionStatus.exists,
-            sessionToken: sessionPointer.sessionToken?.substring(0, 8) + '...'
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionPointer.sessionToken)
         });
         // Already on the 2FA page
         if (pathname === '/account-auth/verify-code') {

package/dist/auth/better-auth.d.ts

@@ -476,6 +476,20 @@ export declare function __getBetterAuthInstance(): unknown;
  * cannot be applied retroactively.
  */
 export declare function configureBetterAuth(opts: CreateBetterAuthInstanceOptions): void;
+/**
+ * PAY-642 (card 338215): the init attempt no longer LATCHES A FAILURE.
+ *
+ * This used to be `state.initPromise ??= getIDPClientConfig(true).then(...)` with no .catch and no reset. One
+ * auth request against a cold process while the IdP was unreachable stored a rejected promise, and every later
+ * caller replayed it until the process restarted, even after the IdP recovered. This funnel backs every
+ * /api/auth/* route, the login GET handler and withAuth. server/auth.ts getAuthInstance() already used
+ * createSingleFlight for this exact bug; this sibling funnel was missed.
+ *
+ * Now the attempt runs through the same helper: concurrent callers share one attempt, a failure still rejects
+ * for every caller of THAT attempt (loud), the next call starts a fresh attempt, and a success is cached in
+ * state.cachedInstance as before. The flight lives on the globalThis state for the same reason the instance
+ * does (duplicated route chunks must share one init).
+ */
 export declare function getBetterAuthInstance(): Promise<any>;
 /**
  * Get flag-gated auth handler for Next.js route.

package/dist/auth/better-auth.js

@@ -68,7 +68,9 @@ const generic_oauth_1 = require("better-auth/plugins/generic-oauth");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const redis_1 = require("../lib/redis");
+const single_flight_1 = require("../lib/single-flight");
 const session_store_1 = require("../lib/session-store");
+const token_log_id_1 = require("../lib/token-log-id");
 /**
  * 185121: short sha256 fingerprint for secrets/tokens in log lines — enough
  * to tell "same" from "divergent", never enough to reconstruct. 12 hex chars
@@ -463,6 +465,7 @@ function buildBetterAuthProviders(config) {
  * Call after getIDPClientConfig() resolves.
  */
 function createBetterAuthInstance(idpConfig, opts = {}) {
+    (0, app_slug_1.assertAppSlugMatchesIdp)(idpConfig.clientSlug);
     const appSlug = idpConfig.clientSlug || (0, app_slug_1.getAppSlug)();
     // 185121 line 1: name the secret this instance PINNED, as a hash, never the
     // secret. 183047's surviving fork is HMAC-fail vs record-miss; an HMAC-fail
@@ -799,18 +802,33 @@ function configureBetterAuth(opts) {
     }
     state.configuredOpts = opts;
 }
+/**
+ * PAY-642 (card 338215): the init attempt no longer LATCHES A FAILURE.
+ *
+ * This used to be `state.initPromise ??= getIDPClientConfig(true).then(...)` with no .catch and no reset. One
+ * auth request against a cold process while the IdP was unreachable stored a rejected promise, and every later
+ * caller replayed it until the process restarted, even after the IdP recovered. This funnel backs every
+ * /api/auth/* route, the login GET handler and withAuth. server/auth.ts getAuthInstance() already used
+ * createSingleFlight for this exact bug; this sibling funnel was missed.
+ *
+ * Now the attempt runs through the same helper: concurrent callers share one attempt, a failure still rejects
+ * for every caller of THAT attempt (loud), the next call starts a fresh attempt, and a success is cached in
+ * state.cachedInstance as before. The flight lives on the globalThis state for the same reason the instance
+ * does (duplicated route chunks must share one init).
+ */
 async function getBetterAuthInstance() {
     if (state.cachedInstance)
         return state.cachedInstance;
-    if (!state.initPromise) {
-        state.initPromise = (0, idp_client_config_1.getIDPClientConfig)(true).then(config => {
-            const instance = createBetterAuthInstance(config, state.configuredOpts);
-            state.cachedInstance = instance;
-            console.log('[BETTER_AUTH] Instance created for', config.clientSlug || config.clientId);
-            return instance;
-        });
-    }
-    return state.initPromise;
+    state.initFlight ??= (0, single_flight_1.createSingleFlight)(() => (0, idp_client_config_1.getIDPClientConfig)(true).then(config => {
+        const instance = createBetterAuthInstance(config, state.configuredOpts);
+        state.cachedInstance = instance;
+        console.log('[BETTER_AUTH] Instance created for', config.clientSlug || config.clientId);
+        return instance;
+    }));
+    const attempt = state.initFlight.get();
+    // Kept for callers that inspect it; it always points at the CURRENT attempt, never a settled failure.
+    state.initPromise = attempt;
+    return attempt;
 }
 /**
  * Get flag-gated auth handler for Next.js route.
@@ -851,7 +869,7 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         // Read the BA session from Redis
         const baRaw = await (0, redis_1.getRedis)().get(baKey).catch(() => null);
         if (!baRaw) {
-            console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: session not found in Redis for token', sessionToken.substring(0, 10));
+            console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: session not found in Redis for token', (0, token_log_id_1.tokenLogId)(sessionToken));
             return false;
         }
         const baData = JSON.parse(baRaw);
@@ -922,7 +940,9 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             }),
         });
         const oauthResText = await oauthRes.text();
-        console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
+        // PAY-1427 (QAPert, PR 154 thread 326): this printed the first 500 chars of the oauth-callback TOKEN
+        // envelope on EVERY successful OAuth login (it runs before the !ok check). Status + length only.
+        console.log('[BETTER_AUTH] IDP oauth-callback response:', { status: oauthRes.status, bodyLength: oauthResText.length });
         if (!oauthRes.ok) {
             console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
             /**
@@ -1154,7 +1174,7 @@ async function storeIdpTokensInSession(sessionToken, idpTokenData, authProvider)
             // conjured here would carry no Better Auth cookie, so it would be
             // unreachable by the browser and invisible to every other consumer —
             // failing as "silently signed out" rather than as an error.
-            console.warn('[BETTER_AUTH] storeIdpTokensInSession: no BA session for token', sessionToken.substring(0, 10));
+            console.warn('[BETTER_AUTH] storeIdpTokensInSession: no BA session for token', (0, token_log_id_1.tokenLogId)(sessionToken));
             return false;
         }
         const baData = JSON.parse(baRaw);
@@ -1256,26 +1276,7 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     return new Response(null, { status: 302, headers: { location: loginPath } });
                 }
             }
-            // After successful OAuth callback: exchange the PROVIDER identity for IDP tokens.
-            //
-            // ⚠ WAS "exchange Google identity" — and it meant it literally. This call
-            // site passed no provider, so it took exchangeOAuthForIdpTokens's
-            // `provider: string = 'google'` default and asserted "google" to
-            // /api/ExternalAuth/oauth-callback for EVERY provider. That was harmless
-            // while Google was the only one wired, and became wrong the moment a second
-            // provider shipped: a GitHub sign-in forwarded a GitHub access_token
-            // labelled `provider: 'google'`, so the IDP tried to verify it as a Google
-            // identity and fail-closed with 401 UNVERIFIED_ASSERTION in
-            // `response_time_ms: 0` — it never had to call anyone to know it was wrong.
-            //
-            // The diagnostics made this maximally confusing: `access_token_forwarded:
-            // true` is correct and the token really did arrive. The FIELD was fine; the
-            // LABEL on it was a lie. Nothing on the client half is broken.
-            //
-            // The provider was never unavailable — it is the path segment this very
-            // `if` matches on (/api/auth/callback/github). Derive it instead of
-            // defaulting, because a default here cannot be right for more than one
-            // provider at a time.
+            // After successful OAuth callback: exchange Google identity for IDP tokens
             const url = new URL(request.url);
             if (url.pathname.includes('/callback/') && response.status === 302) {
                 try {
@@ -1289,23 +1290,8 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                         headers.set('cookie', cookieHeader);
                         const session = await auth.api.getSession({ headers });
                         if (session?.session?.token) {
-                            // /api/auth/callback/<provider>[?query] -> "<provider>"
-                            const callbackProvider = url.pathname
-                                .split('/callback/')[1]
-                                ?.split('/')[0]
-                                ?.split('?')[0]
-                                ?.trim()
-                                .toLowerCase() || '';
-                            if (!callbackProvider) {
-                                // Do NOT quietly fall back to 'google'. That silent default is the
-                                // exact defect this block fixes, and re-introducing it here would
-                                // reproduce it for whatever unparseable shape got us here.
-                                console.error('[BETTER_AUTH] OAuth callback matched /callback/ but no provider could be derived from', url.pathname, '— refusing to assert a guessed provider to the IDP. No exchange performed.');
-                            }
-                            else {
-                                console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| provider:', callbackProvider, '| email:', session.user?.email);
-                                await exchangeOAuthForIdpTokens(session.session.token, callbackProvider);
-                            }
+                            console.log('[BETTER_AUTH] Got session token from callback:', (0, token_log_id_1.tokenLogId)(session.session.token), '| email:', session.user?.email);
+                            await exchangeOAuthForIdpTokens(session.session.token);
                         }
                         else {
                             console.warn('[BETTER_AUTH] Could not get session after OAuth callback');

package/dist/auth/utils/idp-client.js

@@ -183,7 +183,8 @@ async function idpRefreshToken(refreshToken, mfaContext) {
         });
         if (!response.ok) {
             const errorText = await response.text().catch(() => 'Unknown error');
-            console.error('[IDP_CLIENT] Token refresh failed:', response.status, errorText);
+            // PAY-1427: never the raw upstream body (the refresh.ts:528 twin PR 139 fixed). Status + length only.
+            console.error('[IDP_CLIENT] Token refresh failed:', { status: response.status, bodyLength: errorText.length });
             return {
                 success: false,
                 error: {

package/dist/components/admin/DataBrowserTab.js

@@ -174,7 +174,10 @@ function DataBrowserTab({ isDark = true, apiBasePath = '/api/admin/vibe', focusC
             });
             if (!response.ok) {
                 const errData = await response.json().catch(() => ({}));
-                throw new Error(errData.error?.message || 'Delete failed');
+                // PAY-1425: the handler returns a fixed message plus a correlationId (never upstream
+                // text). Surface the id so an admin can quote it to an operator.
+                const ref = errData.error?.correlationId ? ` (ref ${errData.error.correlationId})` : '';
+                throw new Error(`${errData.error?.message || 'Delete failed'}${ref}`);
             }
             setSuccess(`Record ${id} deleted`);
             setTimeout(() => setSuccess(null), 3000);

package/dist/components/admin/SessionsTab.js

@@ -7,6 +7,12 @@ const react_1 = require("react");
 // -----------------------------------------------------------------------------
 // COMPONENT
 // -----------------------------------------------------------------------------
+// PAY-1429: admin handlers return a fixed message plus a correlationId (never upstream or
+// exception text). Surface the id so an admin can quote it to an operator.
+function errorWithRef(data, fallback) {
+    const msg = typeof data?.error === 'string' ? data.error : fallback;
+    return data?.correlationId ? `${msg} (ref ${data.correlationId})` : msg;
+}
 function SessionsTab({ isDark = true, apiBasePath = '/api/admin/sessions' }) {
     const [sessions, setSessions] = (0, react_1.useState)([]);
     const [isLoading, setIsLoading] = (0, react_1.useState)(false);
@@ -41,7 +47,7 @@ function SessionsTab({ isDark = true, apiBasePath = '/api/admin/sessions' }) {
                 setLastRefresh(new Date());
             }
             else {
-                setError(data.error || 'Failed to fetch sessions');
+                setError(errorWithRef(data, 'Failed to fetch sessions'));
             }
         }
         catch (err) {
@@ -91,7 +97,7 @@ function SessionsTab({ isDark = true, apiBasePath = '/api/admin/sessions' }) {
                 await fetchStats();
             }
             else {
-                alert(data.error || 'Failed to revoke session');
+                alert(errorWithRef(data, 'Failed to revoke session'));
             }
         }
         catch (err) {
@@ -120,7 +126,7 @@ function SessionsTab({ isDark = true, apiBasePath = '/api/admin/sessions' }) {
                 await fetchStats();
             }
             else {
-                alert(data.error || 'Failed to revoke sessions');
+                alert(errorWithRef(data, 'Failed to revoke sessions'));
             }
         }
         catch (err) {

package/dist/components/recovery/RequestedStep.d.ts

@@ -0,0 +1,11 @@
+interface Props {
+    onGoToLogin: () => void;
+}
+/**
+ * PAY-1588 (rigpert 60711): what a caller sees when the recovery request produced NO recovery session - an unknown
+ * address, a locked account, a throttled caller. ONE sentence, identical for all of them, so the screen cannot be used
+ * to tell which. It must not claim a reset happened (that is CompleteStep, reached only after a successful reset) and it
+ * must not name a cause.
+ */
+export declare function RequestedStep({ onGoToLogin }: Props): import("react/jsx-runtime").JSX.Element;
+export {};

package/dist/components/recovery/RequestedStep.js

@@ -0,0 +1,14 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestedStep = RequestedStep;
+const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * PAY-1588 (rigpert 60711): what a caller sees when the recovery request produced NO recovery session - an unknown
+ * address, a locked account, a throttled caller. ONE sentence, identical for all of them, so the screen cannot be used
+ * to tell which. It must not claim a reset happened (that is CompleteStep, reached only after a successful reset) and it
+ * must not name a cause.
+ */
+function RequestedStep({ onGoToLogin }) {
+    return ((0, jsx_runtime_1.jsxs)("div", { className: "bg-white border border-gray-300 rounded p-8 text-center", children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-2xl font-semibold text-gray-900 mb-2", children: "Check your email" }), (0, jsx_runtime_1.jsx)("p", { className: "text-gray-600 mb-6", children: "If an account exists for that email, we've sent instructions to reset your password." }), (0, jsx_runtime_1.jsx)("button", { onClick: onGoToLogin, className: "w-full py-2 px-4 border border-gray-300 rounded text-gray-900 font-medium hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-gray-400", children: "Back to sign in" })] }));
+}

package/dist/components/recovery/SetPasswordStep.js

@@ -4,17 +4,26 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SetPasswordStep = SetPasswordStep;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
+const usePasswordValidation_1 = require("../../hooks/usePasswordValidation");
+const password_rules_1 = require("../../lib/password-rules");
 function SetPasswordStep({ onSubmit, loading }) {
     const [password, setPassword] = (0, react_1.useState)('');
     const [confirmPassword, setConfirmPassword] = (0, react_1.useState)('');
     const [showPassword, setShowPassword] = (0, react_1.useState)(false);
     const [showConfirmPassword, setShowConfirmPassword] = (0, react_1.useState)(false);
     const passwordsMatch = password === confirmPassword && password !== '';
+    // PAY-1591: ADVISORY only. It shows the rules and what is missing; it never disables submit, because the validator
+    // may be down and the IdP is the authority (a dead validator must not trap a user who already spent their code).
+    const { setPassword: validateAsYouType, policy, failedRequirements } = (0, usePasswordValidation_1.usePasswordValidation)();
+    // The policy only comes back with a validation, so ask once on mount with a one-character probe (it never leaves the
+    // policy question; the answer is what the rules line is built from). Until it lands the line says the rules are coming.
+    (0, react_1.useEffect)(() => { validateAsYouType('a'); }, [validateAsYouType]);
+    const missing = failedRequirements.filter((r) => !/^(Unable to validate|Password validation)/i.test(r));
     const handleSubmit = (e) => {
         e.preventDefault();
         if (passwordsMatch) {
             onSubmit(password, confirmPassword);
         }
     };
-    return ((0, jsx_runtime_1.jsxs)("div", { className: "bg-white border border-gray-300 rounded p-8", children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-xl font-semibold text-gray-900 mb-2", children: "Set New Password" }), (0, jsx_runtime_1.jsx)("p", { className: "text-sm text-gray-600 mb-6", children: "Choose a strong password for your account." }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: handleSubmit, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "password", className: "block text-sm font-medium text-gray-900 mb-1", children: "New Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showPassword ? 'text' : 'password', id: "password", value: password, onChange: (e) => setPassword(e.target.value), required: true, disabled: loading, className: "w-full px-3 py-2 border border-gray-300 rounded focus:ring-2 focus:ring-gray-900 focus:outline-none disabled:opacity-50 disabled:bg-gray-50 pr-10" }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPassword(!showPassword), className: "absolute right-2 top-1/2 -translate-y-1/2 text-gray-600 hover:text-gray-900", children: showPassword ? '👁️' : '👁️‍🗨️' })] })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "confirmPassword", className: "block text-sm font-medium text-gray-900 mb-1", children: "Confirm New Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showConfirmPassword ? 'text' : 'password', id: "confirmPassword", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, disabled: loading, className: "w-full px-3 py-2 border border-gray-300 rounded focus:ring-2 focus:ring-gray-900 focus:outline-none disabled:opacity-50 disabled:bg-gray-50 pr-10" }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowConfirmPassword(!showConfirmPassword), className: "absolute right-2 top-1/2 -translate-y-1/2 text-gray-600 hover:text-gray-900", children: showConfirmPassword ? '👁️' : '👁️‍🗨️' })] })] }), !passwordsMatch && confirmPassword && ((0, jsx_runtime_1.jsx)("div", { className: "bg-red-50 border border-red-200 rounded p-3", children: (0, jsx_runtime_1.jsx)("p", { className: "text-red-700 text-sm", children: "Passwords do not match" }) })), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: !passwordsMatch || loading, className: "w-full py-2 px-4 border border-gray-300 rounded text-gray-900 font-medium hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-gray-900 disabled:opacity-50 disabled:cursor-not-allowed", children: loading ? 'Resetting Password...' : 'Reset Password' })] })] }));
+    return ((0, jsx_runtime_1.jsxs)("div", { className: "bg-white border border-gray-300 rounded p-8", children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-xl font-semibold text-gray-900 mb-2", children: "Set New Password" }), (0, jsx_runtime_1.jsx)("p", { className: "text-sm text-gray-600 mb-2", children: "Choose a strong password for your account." }), (0, jsx_runtime_1.jsx)("p", { "data-testid": "password-rules", className: "text-sm text-gray-700 mb-6", children: (0, password_rules_1.passwordRulesText)(policy) }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: handleSubmit, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "password", className: "block text-sm font-medium text-gray-900 mb-1", children: "New Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showPassword ? 'text' : 'password', id: "password", value: password, onChange: (e) => { setPassword(e.target.value); validateAsYouType(e.target.value); }, required: true, disabled: loading, className: "w-full px-3 py-2 border border-gray-300 rounded focus:ring-2 focus:ring-gray-900 focus:outline-none disabled:opacity-50 disabled:bg-gray-50 pr-10" }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowPassword(!showPassword), className: "absolute right-2 top-1/2 -translate-y-1/2 text-gray-600 hover:text-gray-900", children: showPassword ? '👁️' : '👁️‍🗨️' })] })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "confirmPassword", className: "block text-sm font-medium text-gray-900 mb-1", children: "Confirm New Password" }), (0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsx)("input", { type: showConfirmPassword ? 'text' : 'password', id: "confirmPassword", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, disabled: loading, className: "w-full px-3 py-2 border border-gray-300 rounded focus:ring-2 focus:ring-gray-900 focus:outline-none disabled:opacity-50 disabled:bg-gray-50 pr-10" }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => setShowConfirmPassword(!showConfirmPassword), className: "absolute right-2 top-1/2 -translate-y-1/2 text-gray-600 hover:text-gray-900", children: showConfirmPassword ? '👁️' : '👁️‍🗨️' })] })] }), password && missing.length > 0 && ((0, jsx_runtime_1.jsx)("ul", { "data-testid": "password-missing", className: "text-sm text-gray-700 list-disc pl-5", children: missing.map((r) => ((0, jsx_runtime_1.jsx)("li", { children: r }, r))) })), !passwordsMatch && confirmPassword && ((0, jsx_runtime_1.jsx)("div", { className: "bg-red-50 border border-red-200 rounded p-3", children: (0, jsx_runtime_1.jsx)("p", { className: "text-red-700 text-sm", children: "Passwords do not match" }) })), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: !passwordsMatch || loading, className: "w-full py-2 px-4 border border-gray-300 rounded text-gray-900 font-medium hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-gray-900 disabled:opacity-50 disabled:cursor-not-allowed", children: loading ? 'Resetting Password...' : 'Reset Password' })] })] }));
 }

package/dist/lib/app-slug.d.ts

@@ -14,6 +14,27 @@
  * Caches the result for performance.
  */
 export declare function getAppSlug(): string;
+/**
+ * The session cookie name has TWO producers: better-auth mints `${idpConfig.clientSlug || getAppSlug()}.session-token`, while
+ * the gate and every reader use getSessionCookieName() = getAppSlug() = APP_SLUG || CLIENT_ID. When the IdP's slug is known and
+ * differs, the gate looks for a cookie that was never set and every better-auth (Google) session bounces to
+ * /sign-in?error=SessionInvalid straight after a successful 2FA (rigpert 60743, live on :4797 with CLIENT_ID=idp-admin-ui-graft
+ * against clientSlug idp_admin_ui_graft). FAIL CLOSED: refuse rather than run with two names. No IdP slug -> nothing to compare.
+ */
+export declare function slugMismatchReason(idpClientSlug: string | null | undefined): string | null;
+/**
+ * rigpert 60813: when the IdP returns NO client slug for this app (an unknown client: the config fetch failed or came back
+ * without one), startup must fail LOUD. Silently defaulting would run with a cookie name nobody verified against the IdP. The
+ * startup path swallows a failed config fetch when BETTER_AUTH_SECRET is supplied by env, so without this an unregistered
+ * CLIENT_ID (e.g. payez_idp_customer_web, absent on dev-93) would boot 'fine'.
+ */
+export declare function assertIdpSlugKnown(idpClientSlug: string | null | undefined): void;
+/**
+ * The health-endpoint view: a mismatch is always reportable; an UNKNOWN slug is reported only once startup has actually been
+ * attempted (before that nothing is known yet and health must not go red on a pod that has not started initialising).
+ */
+export declare function slugStateReason(idpClientSlug: string | null | undefined, startupAttempted: boolean): string | null;
+export declare function assertAppSlugMatchesIdp(idpClientSlug: string | null | undefined): void;
 /**
  * Clears the cached slug (useful for testing).
  */