@payez/next-mvp 4.4.5 → 4.4.7

package/dist/routes/auth/viability.js

@@ -20,6 +20,8 @@ const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
 const idp_client_config_1 = require("../../lib/idp-client-config");
+const safe_error_response_1 = require("../../lib/safe-error-response");
+const token_log_id_1 = require("../../lib/token-log-id");
 /**
  * Get tenant-wide 2FA requirement from cached client config (from broker handshake)
  */
@@ -165,7 +167,7 @@ async function GET(req) {
                 viable: false,
                 needsRefresh: false,
                 authenticated: false,
-                sessionToken, // Return sessionToken so middleware can detect and clear stale cookie
+                sessionTokenId: (0, token_log_id_1.tokenLogId)(sessionToken), // PAY-1481: a correlation id, never the token; middleware only needs presence to clear the stale cookie
                 reason: 'Stale session - cookie exists but session not found in Redis'
             });
         }
@@ -289,7 +291,7 @@ async function GET(req) {
                 viable: true,
                 needsRefresh: true,
                 authenticated: true,
-                sessionToken,
+                sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null,
                 // Clear names for middleware decision-making
                 tenantRequiresTwoFactor,
                 userHasCompletedTenantTwoFactorRequirements,
@@ -325,7 +327,7 @@ async function GET(req) {
         const mfaVerifiedInSession = session?.mfaVerified ?? false;
         // DEBUG: Log what we're reading from the session
         console.log('[VIABILITY] Session 2FA state:', {
-            sessionToken: sessionToken?.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             'session.mfaVerified': session?.mfaVerified,
             'session.twoFactorComplete': session?.twoFactorComplete,
             mfaVerifiedInSession,
@@ -349,7 +351,7 @@ async function GET(req) {
                 expiresIn: 0,
                 hasRefreshToken,
                 authenticated: true,
-                sessionToken,
+                sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null,
                 // Clear names
                 tenantRequiresTwoFactor,
                 userHasCompletedTenantTwoFactorRequirements,
@@ -372,7 +374,7 @@ async function GET(req) {
             expiresIn,
             hasRefreshToken,
             authenticated: true,
-            sessionToken,
+            sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null,
             // Clear names
             tenantRequiresTwoFactor,
             userHasCompletedTenantTwoFactorRequirements,
@@ -390,13 +392,15 @@ async function GET(req) {
         });
     }
     catch (error) {
-        console.error('[VIABILITY_ROUTE] Error checking session viability:', error);
+        // PAY-1438: pre-auth probe - the exception text stays in the log, keyed by correlationId.
+        const correlationId = (0, safe_error_response_1.logExceptionWithCorrelation)('[VIABILITY_ROUTE] Error checking session viability:', error);
         return server_1.NextResponse.json({
             viable: false,
             needsRefresh: false,
             authenticated: false,
             error: 'Failed to check session',
-            details: error instanceof Error ? error.message : 'Unknown error'
+            code: 'INTERNAL_ERROR',
+            correlationId
         }, { status: 500 });
     }
 }

package/dist/server/auth.d.ts

@@ -24,300 +24,42 @@ export type IdpTokenResult = {
     terminal: false;
     sessionData: SessionData;
 };
-export declare function getAuthInstance(): Promise<import("better-auth/types").Auth<{
-    baseURL: string;
-    secret: string;
-    socialProviders: Record<string, import("../auth/better-auth").BetterAuthSocialProvider>;
-    trustedOrigins: string[];
-    secondaryStorage: {
-        get: (key: string) => Promise<string | null>;
-        set: (key: string, value: string, ttl?: number) => Promise<void>;
-        delete: (key: string) => Promise<void>;
-    };
-    session: {
-        cookieCache: {
-            enabled: false;
-            maxAge: number;
-            refreshCache: false;
-        };
-    };
-    advanced: {
-        cookiePrefix: string;
-        cookies: {
-            session_token: {
-                name: string;
-            };
-        };
-    };
-    plugins: [{
-        id: "next-cookies";
-        hooks: {
-            before: {
-                matcher(ctx: import("@better-auth/core").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
-            }[];
-            after: {
-                matcher(ctx: import("@better-auth/core").HookEndpointContext): true;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
-            }[];
-        };
-    }, ...(import("@better-auth/core").BetterAuthPlugin | {
-        id: "magic-link";
-        endpoints: {
-            signInMagicLink: import("better-call").StrictEndpoint<"/sign-in/magic-link", {
-                method: "POST";
-                requireHeaders: true;
-                body: import("zod").ZodObject<{
-                    email: import("zod").ZodEmail;
-                    name: import("zod").ZodOptional<import("zod").ZodString>;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                }, import("better-auth/*").$strip>;
-                metadata: {
-                    openapi: {
-                        operationId: string;
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                status: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                status: boolean;
-            }>;
-            magicLinkVerify: import("better-call").StrictEndpoint<"/magic-link/verify", {
-                method: "GET";
-                query: import("zod").ZodObject<{
-                    token: import("zod").ZodString;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth/*").$strip>;
-                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
-                requireHeaders: true;
-                metadata: {
-                    openapi: {
-                        operationId: string;
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                session: {
-                                                    $ref: string;
-                                                };
-                                                user: {
-                                                    $ref: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                token: string;
-                user: {
-                    id: string;
-                    createdAt: Date;
-                    updatedAt: Date;
-                    email: string;
-                    emailVerified: boolean;
-                    name: string;
-                    image?: string | null | undefined;
-                };
-            }>;
-        };
-        rateLimit: {
-            pathMatcher(path: string): boolean;
-            window: number;
-            max: number;
-        }[];
-        options: import("better-auth/plugins/magic-link").MagicLinkOptions;
-    } | {
-        id: "generic-oauth";
-        init: (ctx: import("@better-auth/core").AuthContext) => {
-            context: {
-                socialProviders: import("better-auth/*").OAuthProvider<Record<string, any>, Partial<import("better-auth/*").ProviderOptions<any>>>[];
-            };
-        };
-        endpoints: {
-            signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                }, import("better-auth/*").$strip>;
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-            oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
-                method: "GET";
-                query: import("zod").ZodObject<{
-                    code: import("zod").ZodOptional<import("zod").ZodString>;
-                    error: import("zod").ZodOptional<import("zod").ZodString>;
-                    error_description: import("zod").ZodOptional<import("zod").ZodString>;
-                    state: import("zod").ZodOptional<import("zod").ZodString>;
-                    iss: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth/*").$strip>;
-                metadata: {
-                    allowedMediaTypes: string[];
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                    scope: "server";
-                };
-            }, void>;
-            oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodString;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth/*").$strip>;
-                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-                    session: {
-                        session: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            userId: string;
-                            expiresAt: Date;
-                            token: string;
-                            ipAddress?: string | null | undefined;
-                            userAgent?: string | null | undefined;
-                        };
-                        user: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            email: string;
-                            emailVerified: boolean;
-                            name: string;
-                            image?: string | null | undefined;
-                        };
-                    };
-                }>)[];
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            "200": {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                    format: string;
-                                                    description: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                    description: string;
-                                                    enum: boolean[];
-                                                };
-                                            };
-                                            required: string[];
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-        };
-        options: import("better-auth/plugins/generic-oauth").GenericOAuthOptions;
-        $ERROR_CODES: {
-            INVALID_OAUTH_CONFIGURATION: import("better-auth/*").RawError<"INVALID_OAUTH_CONFIGURATION">;
-            TOKEN_URL_NOT_FOUND: import("better-auth/*").RawError<"TOKEN_URL_NOT_FOUND">;
-            PROVIDER_CONFIG_NOT_FOUND: import("better-auth/*").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-            PROVIDER_ID_REQUIRED: import("better-auth/*").RawError<"PROVIDER_ID_REQUIRED">;
-            INVALID_OAUTH_CONFIG: import("better-auth/*").RawError<"INVALID_OAUTH_CONFIG">;
-            SESSION_REQUIRED: import("better-auth/*").RawError<"SESSION_REQUIRED">;
-            ISSUER_MISMATCH: import("better-auth/*").RawError<"ISSUER_MISMATCH">;
-            ISSUER_MISSING: import("better-auth/*").RawError<"ISSUER_MISSING">;
-        };
-    })[]];
-}>>;
+/**
+ * Get the initialized Better Auth instance (singleton).
+ *
+ * 244549: the single-flight memoisation lives in lib/single-flight.ts rather
+ * than inline here, and that placement is deliberate rather than tidiness.
+ * The bug being fixed -- a REJECTED init promise cached for the life of the
+ * process, so recovery was restart-only -- went unnoticed precisely because
+ * this module cannot be loaded in a unit test: importing it pulls in
+ * better-auth and the whole IDP config stack. Extracted into a zero-import
+ * module, the retry semantics are covered by
+ * test/single-flight-retry.test.cjs, which imports dist/ and therefore
+ * exercises the artefact that actually ships.
+ *
+ * PAY-1623 (package half, BAPert 62449): THIS FUNNEL NO LONGER BUILDS ITS OWN
+ * INSTANCE. It used to call `createBetterAuthInstance(config)` with no opts, so
+ * it carried NONE of the app-supplied plugins registered by the host app at
+ * startup (`configureBetterAuth()` -> `state.configuredOpts`). `samlAcs()` and
+ * `passkeySignIn()` arrive only that way, so `getAuthInstance()` returned an
+ * instance on which `auth.api.samlAcs` was `undefined` — the exact package twin
+ * of the portal ACS crash `t.api.samlAcs is not a function` (Jon's walk,
+ * 2026-09-21; Portal PR 517 fixed the portal by importing the CONFIGURED
+ * instance, `getBetterAuthInstance`, which is why this file must now resolve the
+ * same one). It also silently created a SECOND, divergent instance beside the
+ * one every /api/auth/* route uses — two instances, two secrets, one process.
+ *
+ * It now DELEGATES to that configured funnel, which is the single source of
+ * truth for the process's Better Auth instance:
+ *   - it carries `state.configuredOpts` (better-auth.ts:930), so the app
+ *     plugins are present;
+ *   - its init is already single-flighted with the retry semantics described in
+ *     lib/single-flight.ts (see getBetterAuthInstance, card 244549/338215), so
+ *     this function keeps the same no-latch recovery contract;
+ *   - there is now ONE instance, so the double-init / divergent-secret hazard
+ *     this path used to create is gone by construction.
+ */
+export declare function getAuthInstance(): Promise<any>;
 /**
  * Get the current session from a request.
  *

package/dist/server/auth.js

@@ -47,11 +47,8 @@ exports.getFreshIdpToken = getFreshIdpToken;
 exports.requireSession = requireSession;
 require("server-only");
 const better_auth_1 = require("../auth/better-auth");
-const idp_client_config_1 = require("../lib/idp-client-config");
 const session_store_1 = require("../lib/session-store");
-const session_cookie_shape_1 = require("../lib/session-cookie-shape");
-const single_flight_1 = require("../lib/single-flight");
-let authInstance = null;
+const verified_session_token_1 = require("./verified-session-token");
 function buildSessionDataFromAuthSession(session) {
     const user = session?.user;
     if (!user?.id && !user?.email) {
@@ -116,30 +113,30 @@ function attachSessionData(session, sessionData, sessionToken) {
  * test/single-flight-retry.test.cjs, which imports dist/ and therefore
  * exercises the artefact that actually ships.
  *
- * Semantics, all asserted by that suite: concurrent callers share ONE
- * underlying init; a rejection reaches every caller awaiting that attempt
- * (failures stay loud -- getIDPClientConfig is fail-loud by design and callers
- * depend on it); the NEXT call after a failure starts a fresh attempt; and a
- * slow failure never evicts a newer in-flight attempt.
+ * PAY-1623 (package half, BAPert 62449): THIS FUNNEL NO LONGER BUILDS ITS OWN
+ * INSTANCE. It used to call `createBetterAuthInstance(config)` with no opts, so
+ * it carried NONE of the app-supplied plugins registered by the host app at
+ * startup (`configureBetterAuth()` -> `state.configuredOpts`). `samlAcs()` and
+ * `passkeySignIn()` arrive only that way, so `getAuthInstance()` returned an
+ * instance on which `auth.api.samlAcs` was `undefined` — the exact package twin
+ * of the portal ACS crash `t.api.samlAcs is not a function` (Jon's walk,
+ * 2026-09-21; Portal PR 517 fixed the portal by importing the CONFIGURED
+ * instance, `getBetterAuthInstance`, which is why this file must now resolve the
+ * same one). It also silently created a SECOND, divergent instance beside the
+ * one every /api/auth/* route uses — two instances, two secrets, one process.
+ *
+ * It now DELEGATES to that configured funnel, which is the single source of
+ * truth for the process's Better Auth instance:
+ *   - it carries `state.configuredOpts` (better-auth.ts:930), so the app
+ *     plugins are present;
+ *   - its init is already single-flighted with the retry semantics described in
+ *     lib/single-flight.ts (see getBetterAuthInstance, card 244549/338215), so
+ *     this function keeps the same no-latch recovery contract;
+ *   - there is now ONE instance, so the double-init / divergent-secret hazard
+ *     this path used to create is gone by construction.
  */
-const authInit = (0, single_flight_1.createSingleFlight)(async () => {
-    const config = await (0, idp_client_config_1.getIDPClientConfig)(true);
-    authInstance = (0, better_auth_1.createBetterAuthInstance)(config);
-    // 185121 line 1, path 2: this module-scope instance had NO creation log
-    // line — first-called during a config transition window it pinned a
-    // divergent secret INVISIBLY. Name the path and the secret fingerprint
-    // (the createBetterAuthInstance line already logged the same hash;
-    // this line is what attributes it to THIS init path).
-    // Guard matches createBetterAuthInstance's: getIDPClientConfig currently
-    // throws FATAL on a missing authSecret (QAPert 27328 verified), but that
-    // guarantee is one refactor away — log ABSENT rather than ever throw here.
-    console.log(`[AUTH] getAuthInstance: created BA instance via server/auth.ts — authSecret ${config.authSecret ? `sha256:${(0, better_auth_1.secretFingerprint)(config.authSecret)}` : 'ABSENT'}`);
-    return authInstance;
-});
 async function getAuthInstance() {
-    if (authInstance)
-        return authInstance;
-    return authInit.get();
+    return (0, better_auth_1.getBetterAuthInstance)();
 }
 /**
  * Get the current session from a request.
@@ -184,14 +181,18 @@ async function getSession(request) {
             sessionData = buildSessionDataFromAuthSession(betterAuthSession);
         return attachSessionData(betterAuthSession, sessionData, sessionToken);
     }
-    // Path B — Better Auth said null/incomplete. Fall back to manual cookie
+    // Path B — Better Auth said null/incomplete. Fall back to a VERIFIED cookie
     // decode + Redis-canonical liveness check. This catches cases where the
     // canonical app session at `{slug}:{token}` is still alive but Better
     // Auth's `ba:{slug}:{token}` secondary record was evicted or the
-    // in-memory cookie cache returned stale-null. No JWT signature check —
-    // Redis lookup is the validation: an attacker forging a session-token
-    // claim hits NO_SESSION because Redis has no matching entry.
-    const sessionToken = (0, session_cookie_shape_1.extractSessionTokenFromCookie)(request);
+    // in-memory cookie cache returned stale-null.
+    //
+    // PAY-1476: this path used to take the token with NO signature check, on the
+    // theory that "Redis lookup is the validation". It is not: a leaked token has
+    // a live record, so the token string alone authenticated, with any garbage in
+    // the signature position, and a forged JWS too. The token now comes only from
+    // the shared verified resolver (HMAC or JWS signature checked first).
+    const sessionToken = await (0, verified_session_token_1.resolveVerifiedSessionTokenFromRequest)(request);
     if (!sessionToken)
         return null;
     let sessionData = null;

package/dist/server/decode-session.js

@@ -42,12 +42,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.decodeSession = decodeSession;
 require("server-only");
 const headers_1 = require("next/headers");
-const jose_1 = require("jose");
 const session_store_1 = require("../lib/session-store");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const startup_init_1 = require("../lib/startup-init");
 const session_cookie_shape_1 = require("../lib/session-cookie-shape");
+const verified_session_token_1 = require("./verified-session-token");
+const token_log_id_1 = require("../lib/token-log-id");
 /**
  * Try Better Auth's server-side session API.
  * Returns a DecodedSession if Better Auth has an active session, null otherwise.
@@ -161,7 +162,7 @@ async function tryBetterAuthSession(requestCookies) {
         // session. Read the commit message before treating a sign-out here as a
         // bug introduced by this fix.
         if (!idpTokens?.roles?.length) {
-            console.warn('[DECODE-SESSION] Leg 1 declining: idpTokens unusable (no roles) for session', result.session.token.substring(0, 10), '— falling through to the sess: leg');
+            console.warn('[DECODE-SESSION] Leg 1 declining: idpTokens unusable (no roles) for session', (0, token_log_id_1.tokenLogId)(result.session.token), '— falling through to the sess: leg');
             return null;
         }
         // Map Better Auth session + IDP tokens to SessionData
@@ -261,31 +262,19 @@ async function decodeSession(requestCookies) {
         // death, because the ONLY fallback was structurally blind to the only
         // shape it would ever be handed.
         //
-        // Check the shape FIRST. A BA-hmac cookie skips jose entirely and goes
-        // straight to the Redis-canonical liveness check below — same posture
-        // as the JWS path always had (no signature re-check here either; Redis
-        // presence is the authority). A JWS-shaped cookie (legacy NextAuth-era,
-        // if any still linger) keeps the original jwtVerify path unchanged.
+        // PAY-1476: the shape still decides HOW to verify, but BOTH shapes are now
+        // verified, by the shared resolver. This branch used to take a BA-hmac
+        // cookie's token with no signature check ("Redis presence is the
+        // authority"), so `{leaked token}.{anything}` authenticated here - including
+        // behind the portal's admin API gate. The resolver checks the HMAC with
+        // timingSafeEqual (ba-hmac) or runs jwtVerify (jws) against the same
+        // env-first auth secret, and returns null on any failure.
         const shaped = (0, session_cookie_shape_1.extractSessionTokenFromCookieValue)(cookieValue);
-        let sessionToken;
-        let payload;
-        if (shaped?.shape === 'ba-hmac') {
-            sessionToken = shaped.token;
-        }
-        else {
-            const secretKey = new TextEncoder().encode(secret);
-            try {
-                const result = await (0, jose_1.jwtVerify)(cookieValue, secretKey);
-                payload = result.payload;
-            }
-            catch (jwtError) {
-                console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
-                return null;
-            }
-            sessionToken = payload.sessionToken || payload.redisSessionId;
-        }
+        const verified = await (0, verified_session_token_1.resolveVerifiedSessionCookie)(cookieValue);
+        const sessionToken = verified?.token;
+        const payload = verified?.payload;
         if (!sessionToken) {
-            console.warn('[DECODE-SESSION] No sessionToken resolved from cookie (shape:', shaped?.shape ?? 'unrecognized', ')');
+            console.warn('[DECODE-SESSION] Session cookie did not verify (shape:', shaped?.shape ?? 'unrecognized', ')');
             return null;
         }
         const sessionData = await (0, session_store_1.getSession)(sessionToken);
@@ -297,7 +286,7 @@ async function decodeSession(requestCookies) {
             // either and the caller is about to be signed out. Different meanings,
             // different remediations — do not ship a second silent path while
             // fixing a silent path.
-            console.warn('[DECODE-SESSION] No sess: record for token', sessionToken.substring(0, 10), '— no fallback available, session will be signed out');
+            console.warn('[DECODE-SESSION] No sess: record for token', (0, token_log_id_1.tokenLogId)(sessionToken), '— no fallback available, session will be signed out');
             return null;
         }
         // Backwards compat: session.user.email works alongside session.email

package/dist/server/verified-session-token.d.ts

@@ -0,0 +1,13 @@
+import { type JWTPayload } from 'jose';
+export interface VerifiedSessionCookie {
+    token: string;
+    shape: 'ba-hmac' | 'jws';
+    /** The verified JWS payload (jws shape only). */
+    payload?: JWTPayload;
+}
+/** The verified session cookie (token, shape, JWS payload), or null unless its signature verifies. */
+export declare function resolveVerifiedSessionCookie(rawValue: string | null | undefined): Promise<VerifiedSessionCookie | null>;
+/** The session token carried by a raw session-cookie value, or null unless its signature verifies. */
+export declare function resolveVerifiedSessionToken(rawValue: string | null | undefined): Promise<string | null>;
+/** Same, reading the session cookie (every name it is minted under, chunks joined) from a Request. */
+export declare function resolveVerifiedSessionTokenFromRequest(request: Request): Promise<string | null>;