@payez/next-mvp 4.4.5 → 4.4.7

package/dist/server/verified-session-token.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveVerifiedSessionCookie = resolveVerifiedSessionCookie;
+exports.resolveVerifiedSessionToken = resolveVerifiedSessionToken;
+exports.resolveVerifiedSessionTokenFromRequest = resolveVerifiedSessionTokenFromRequest;
+/**
+ * PAY-1476 / card 372275 (R941 s1b) - THE ONE SHARED VERIFIED RESOLVER for a session token taken from a cookie.
+ *
+ * THE DEFECT (4.4.5, measured at the deployed portal by QAPert-NightHawk, mail 59030):
+ *   Module A  server/decode-session.ts  the ba-hmac branch took `{token}.{anything}` and used segment 0 unread.
+ *   Module B  server/auth.ts  Path B    took the token from ANY recognised shape and never verified anything;
+ *                                       a forged JWS resolved there too.
+ * Both then treated "a Redis record exists" as the validation. So a leaked session token string was a bearer
+ * credential with no signature needed, including on the portal's admin API gate (api-admin-gate -> decodeSession).
+ *
+ * THE RULE THIS MODULE ENFORCES: a cookie yields a session token ONLY after its signature checks out against
+ * the auth secret. Every caller that turns a cookie into a token for the session store awaits this function.
+ * lib/session-cookie-shape.ts stays classification-only and secret-free (it cannot verify, by construction).
+ *
+ *   ba-hmac  `{token}.{sig}` as Better Auth mints it (better-call signCookieValue): sig =
+ *            base64(HMAC-SHA256(secret, token)), standard padding, 44 characters. Compared with
+ *            crypto.timingSafeEqual over equal-length buffers.
+ *   jws      legacy NextAuth-era cookie: jose jwtVerify with the same secret, then the sessionToken
+ *            (or redisSessionId) claim.
+ *   anything else, a missing secret, or a failed check -> null. Never throws.
+ *
+ * THE SECRET is the auth secret from getIDPClientConfig(), which resolves env-first (BETTER_AUTH_SECRET,
+ * NEXTAUTH_SECRET, then IdP config; PAY-1460). The cookie HMAC key IS the auth secret, so the resolver and the
+ * config loader cannot disagree about which secret signs sessions (BAPert 59034).
+ */
+const crypto_1 = require("crypto");
+const jose_1 = require("jose");
+const idp_client_config_1 = require("../lib/idp-client-config");
+const session_cookie_shape_1 = require("../lib/session-cookie-shape");
+/** Better Auth's signature: base64 of a 32-byte HMAC-SHA256, padded = 44 chars ending in '='. */
+const BA_SIGNATURE_LENGTH = 44;
+async function authSecret() {
+    try {
+        const config = await (0, idp_client_config_1.getIDPClientConfig)();
+        return config?.authSecret ? String(config.authSecret) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function verifyBaHmac(rawValue, secret) {
+    const dot = rawValue.lastIndexOf('.');
+    if (dot < 1)
+        return null;
+    const token = rawValue.slice(0, dot);
+    let signature = rawValue.slice(dot + 1);
+    if (signature.includes('%')) {
+        try {
+            signature = decodeURIComponent(signature);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (signature.length !== BA_SIGNATURE_LENGTH || !signature.endsWith('='))
+        return null;
+    const expected = (0, crypto_1.createHmac)('sha256', secret).update(token, 'utf8').digest('base64');
+    const a = Buffer.from(signature, 'utf8');
+    const b = Buffer.from(expected, 'utf8');
+    if (a.length !== b.length)
+        return null;
+    return (0, crypto_1.timingSafeEqual)(a, b) ? token : null;
+}
+async function verifyJws(rawValue, secret) {
+    try {
+        const { payload } = await (0, jose_1.jwtVerify)(rawValue, new TextEncoder().encode(secret));
+        const claim = payload.sessionToken ?? payload.redisSessionId;
+        return typeof claim === 'string' && claim ? { token: claim, shape: 'jws', payload } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The verified session cookie (token, shape, JWS payload), or null unless its signature verifies. */
+async function resolveVerifiedSessionCookie(rawValue) {
+    if (!rawValue)
+        return null;
+    const shaped = (0, session_cookie_shape_1.extractSessionTokenFromCookieValue)(rawValue);
+    if (!shaped)
+        return null;
+    const secret = await authSecret();
+    if (!secret)
+        return null;
+    if (shaped.shape === 'ba-hmac') {
+        const token = verifyBaHmac(rawValue, secret);
+        return token ? { token, shape: 'ba-hmac' } : null;
+    }
+    return verifyJws(rawValue, secret);
+}
+/** The session token carried by a raw session-cookie value, or null unless its signature verifies. */
+async function resolveVerifiedSessionToken(rawValue) {
+    const verified = await resolveVerifiedSessionCookie(rawValue);
+    return verified ? verified.token : null;
+}
+/** Same, reading the session cookie (every name it is minted under, chunks joined) from a Request. */
+async function resolveVerifiedSessionTokenFromRequest(request) {
+    return resolveVerifiedSessionToken((0, session_cookie_shape_1.extractSessionCookieValue)(request));
+}

package/dist/stores/authStore.js

@@ -55,6 +55,7 @@ const logger_1 = require("../config/logger");
 const signalr_1 = require("@microsoft/signalr");
 const signalrActivityService_1 = require("../services/signalrActivityService");
 const app_slug_1 = require("../lib/app-slug");
+const token_log_id_1 = require("../lib/token-log-id");
 // ===============================
 // CACHE CONFIGURATION
 // ===============================
@@ -303,17 +304,26 @@ exports.useAuthStore = (0, zustand_1.create)()((0, middleware_1.devtools)((set,
     },
     forceLogoutAndRedirect: async (reason) => {
         const state = get();
+        // Same truncation convention as the server-side session logs (session-store.ts,
+        // refresh.ts): a session token is a bearer credential, and this line goes to the
+        // browser console (and whatever aggregates authLogger client-side) - full value
+        // was leftover debug logging (DotNetPert-Scout, mail 58678).
+        // PAY-1505: the ternary that used to stand here fell back to the RAW token on its false arm.
+        // Safe only by the unenforced property that the arm is reached when the token is falsy -
+        // exactly the shape the source guard exists to refuse. tokenLogId already answers 'none'
+        // for an absent token, so the fallback is not needed.
+        const sessionTokenPrefix = (0, token_log_id_1.tokenLogId)(state.session?.sessionToken);
         // AGGRESSIVE LOGGING TO TRACK EXECUTION
         console.error('🚨 FORCE LOGOUT INITIATED 🚨', {
             reason,
             userId: state.user?.id,
-            sessionToken: state.session?.sessionToken,
+            sessionToken: sessionTokenPrefix,
             timestamp: new Date().toISOString()
         });
         logger_1.authLogger.error('[AuthStore] Force logout initiated', {
             reason,
             userId: state.user?.id,
-            sessionToken: state.session?.sessionToken
+            sessionToken: sessionTokenPrefix
         });
         try {
             // TODO: Step 1: Mark session as force-invalidated in Redis (temp disabled for client build)
@@ -1503,7 +1513,8 @@ exports.useAuthStore = (0, zustand_1.create)()((0, middleware_1.devtools)((set,
         const state = get();
         // If this event is about the current user, update their state
         if (data.userId === state.user?.id && state.session) {
-            logger_1.authLogger.info('[AuthStore] Updating current user state from SignalR:', data);
+            // PAY-1427: the event is user state; log its shape, not its contents.
+            logger_1.authLogger.info('[AuthStore] Updating current user state from SignalR:', { keys: Object.keys(data || {}) });
             // ... user state update logic would go here
         }
     },

package/dist/types/recovery.d.ts

@@ -1,4 +1,4 @@
-export type RecoveryStep = 'initiate' | 'select-method' | 'verify-code' | 'set-password' | 'complete';
+export type RecoveryStep = 'initiate' | 'select-method' | 'verify-code' | 'set-password' | 'requested' | 'complete';
 export interface RecoverySession {
     recoveryToken: string;
     email: string;

package/dist/utils/api.d.ts

@@ -25,6 +25,24 @@ export interface ApiResponse<T> {
     message?: string;
 }
 export declare function apiFetch<T>(url: string, options?: ApiOptions): Promise<ApiResponse<T>>;
+/**
+ * PAY-1591: what the user reads when the LAST recovery step fails. Four outcomes, told apart only by codes the IdP really sends
+ * (see resetFailureText): a password-policy refusal names the failed rules; an explicit expired/used token says so and links back
+ * to recovery; any other 400/422 gets a neutral 'check the requirements and try again' (the user's recovery session is kept); and
+ * a server or transport failure gets a retry sentence. None of them is the old fixed "Failed to reset password".
+ */
+export declare const RECOVERY_EXPIRED_TEXT = "This reset link has expired or was already used. Start password recovery again.";
+export declare const RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+/**
+ * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
+ *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences
+ *   tokenInvalid  an EXPLICIT expired/used signal (token_expired / token_used / Identity InvalidToken, projected as
+ *                 reset_token_invalid) -> 'link expired, start again'
+ *   anything else -> NEUTRAL, which must NOT tell the user their link is dead: the served IdP sends a weak-password refusal with
+ *                 no code, and 'expired' there loops them after they spent their emailed code. The recovery session is kept, so
+ *                 they can retry.
+ */
+export declare function resetFailureText(status: number, rules?: string[], policy?: boolean, tokenInvalid?: boolean): string;
 export declare class AccountApi {
     /**
      * Get masked user info (email, phone, authenticator status)

package/dist/utils/api.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accountApi = exports.AccountApi = exports.ApiError = void 0;
+exports.accountApi = exports.AccountApi = exports.RESET_NEUTRAL_TEXT = exports.RECOVERY_EXPIRED_TEXT = exports.ApiError = void 0;
 exports.apiFetch = apiFetch;
+exports.resetFailureText = resetFailureText;
 const standardized_client_api_1 = require("../lib/standardized-client-api");
+const password_rules_1 = require("../lib/password-rules");
 class ApiError extends Error {
     type;
     title;
@@ -74,6 +76,34 @@ async function apiFetch(url, options = {}) {
 }
 // DELETED: apiFetchAuth - Use clientApi from @/lib/client-api instead for proper token refresh handling
 // Account API for masked info and 2FA
+/**
+ * PAY-1591: what the user reads when the LAST recovery step fails. Four outcomes, told apart only by codes the IdP really sends
+ * (see resetFailureText): a password-policy refusal names the failed rules; an explicit expired/used token says so and links back
+ * to recovery; any other 400/422 gets a neutral 'check the requirements and try again' (the user's recovery session is kept); and
+ * a server or transport failure gets a retry sentence. None of them is the old fixed "Failed to reset password".
+ */
+exports.RECOVERY_EXPIRED_TEXT = 'This reset link has expired or was already used. Start password recovery again.';
+exports.RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+/**
+ * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
+ *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences
+ *   tokenInvalid  an EXPLICIT expired/used signal (token_expired / token_used / Identity InvalidToken, projected as
+ *                 reset_token_invalid) -> 'link expired, start again'
+ *   anything else -> NEUTRAL, which must NOT tell the user their link is dead: the served IdP sends a weak-password refusal with
+ *                 no code, and 'expired' there loops them after they spent their emailed code. The recovery session is kept, so
+ *                 they can retry.
+ */
+function resetFailureText(status, rules = [], policy = false, tokenInvalid = false) {
+    if (status === 400 || status === 422) {
+        if (tokenInvalid && !policy)
+            return exports.RECOVERY_EXPIRED_TEXT;
+        if (!policy)
+            return exports.RESET_NEUTRAL_TEXT;
+        const base = "That password wasn't accepted.";
+        return rules.length ? `${base} ${(0, password_rules_1.passwordRuleSentences)(rules)}` : `${base} Try a different one; the rules are shown above.`;
+    }
+    return "We couldn't reset your password just now. Please try again.";
+}
 class AccountApi {
     /**
      * Get masked user info (email, phone, authenticator status)
@@ -87,16 +117,15 @@ class AccountApi {
         // Authenticated request - proxy through Next API to IDP
         // Empty body: user info comes from JWT token
         const result = await standardized_client_api_1.standardizedApi.post('/api/account/masked-info', {}, accessToken);
+        // PAY-1427: masked email/phone are still user data - log the response shape, never its values.
         console.log('[DEBUG] getMaskedInfo result:', {
             success: (0, standardized_client_api_1.isApiSuccess)(result),
             hasData: (0, standardized_client_api_1.isApiSuccess)(result) && !!result.data,
-            rawData: (0, standardized_client_api_1.isApiSuccess)(result) ? result.data : null,
             dataFields: (0, standardized_client_api_1.isApiSuccess)(result) && result.data ? Object.keys(result.data) : []
         });
-        console.log('[DEBUG] getMaskedInfo raw data structure:', JSON.stringify((0, standardized_client_api_1.isApiSuccess)(result) ? result.data : result, null, 2));
         if (!(0, standardized_client_api_1.isApiSuccess)(result)) {
             const errorMessage = (0, standardized_client_api_1.isApiError)(result) ? result.message : 'Failed to get masked info';
-            console.error('[DEBUG] getMaskedInfo failed:', result);
+            console.error('[DEBUG] getMaskedInfo failed:', { keys: result && typeof result === 'object' ? Object.keys(result) : typeof result });
             throw new ApiError(errorMessage, result);
         }
         // Use only snake_case fields from backend response
@@ -116,6 +145,9 @@ class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ email }),
         });
+        // PAY-1588: a throttled caller (429) must look exactly like an unknown one - no session, no distinguishing error.
+        if (res.status === 429)
+            return { success: false, data: {} };
         if (!res.ok)
             throw new Error('Failed to initiate recovery');
         return res.json();
@@ -154,13 +186,23 @@ class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
                 email,
-                password_reset_token: resetToken,
+                token: resetToken,
                 new_password: newPassword,
                 confirm_password: confirmPassword,
             }),
         });
-        if (!res.ok)
-            throw new Error('Failed to reset password');
+        if (!res.ok) {
+            const body = await res.json().catch(() => null);
+            const policy = !!body?.password_policy;
+            const rules = (0, password_rules_1.knownPasswordRules)(body?.password_policy?.rules);
+            const tokenInvalid = body?.reset_token_invalid === true;
+            const err = new Error(resetFailureText(res.status, rules, policy, tokenInvalid));
+            if (rules.length)
+                err.rules = rules;
+            if ((res.status === 400 || res.status === 422) && tokenInvalid && !policy)
+                err.code = 'RECOVERY_EXPIRED';
+            throw err;
+        }
         return res.json();
     }
     async resetPassword(data) {
@@ -171,8 +213,8 @@ class AccountApi {
             body: JSON.stringify({
                 email: data.email,
                 token: data.token,
-                password: data.password,
-                password_confirmation: data.password_confirmation
+                new_password: data.password,
+                confirm_password: data.password_confirmation
             })
         });
         const result = await res.json().catch(() => ({}));

package/dist/vibe/client.d.ts

@@ -49,7 +49,13 @@ export interface VibeRetryConfig {
     retryOnRateLimit?: boolean;
 }
 export interface VibeClientConfig {
-    /** Base URL for the Vibe API (defaults to VIBE_API_URL env var) */
+    /**
+     * Base URL for the Vibe API (defaults to VIBE_API_URL env var).
+     *
+     * PAY-1767: proxy mode does NOT need this. Every request is sent to the IDP proxy as an endpoint
+     * PATH (`/v1/collections/...`), which is what the proxy validates and signs - it never builds a
+     * Vibe URL from this value. It is retained only for compatibility with consumers that still read it.
+     */
     baseUrl?: string;
     /** Vibe Client ID (defaults to VIBE_CLIENT_ID env var) */
     clientId?: string;
@@ -64,6 +70,15 @@ export interface VibeClientConfig {
      * When set, requests are routed through the IDP proxy instead of directly to Vibe.
      */
     appSigningKey?: string;
+    /**
+     * PAY-1767: which COLLECTION the table delegates address (defaults to VIBE_COLLECTION, then 'vibe_app').
+     *
+     * The Vibe API route is `/v1/collections/{collection}/tables/{table}`. This client used to hardcode
+     * `/api/v1/vibe_app/{table}` - a collection baked into the path with no route behind it. Pin the
+     * collection explicitly at the call site when your tables do not live in `vibe_app` (the UMI
+     * VIBE_COLLECTION-double-duty lesson, POST-INSTALL.md item 16).
+     */
+    collection?: string;
     /** Custom fetch function (for testing or custom auth) */
     fetch?: typeof fetch;
     /** Retry configuration for transient errors */
@@ -92,7 +107,13 @@ export interface FindManyOptions<T> {
     take?: number;
     skip?: number;
 }
-/** Options for findUnique */
+/**
+ * Options for findUnique.
+ *
+ * PAY-1767 (NightHawk 64534 MUST 2): `where.id` is the DOCUMENT id - the storage-layer primary key the
+ * route constrains (`{id:int}`), NOT a row's own `id` column. The unwrapped row exposes it as
+ * `_vibe_doc_id`; use THAT value for a subsequent update/delete.
+ */
 export interface FindUniqueOptions {
     where: {
         id: number;
@@ -102,14 +123,16 @@ export interface FindUniqueOptions {
 export interface CreateOptions<T> {
     data: Omit<T, 'id' | 'created_at' | 'updated_at'>;
 }
-/** Options for update */
+/**
+ * Options for update. `where.id` is the DOCUMENT id (see FindUniqueOptions), not a row's own id column.
+ */
 export interface UpdateOptions<T> {
     where: {
         id: number;
     };
     data: Partial<Omit<T, 'id' | 'created_at' | 'updated_at'>>;
 }
-/** Options for delete */
+/** Options for delete. `where.id` is the DOCUMENT id (see FindUniqueOptions). */
 export interface DeleteOptions {
     where: {
         id: number;
@@ -122,8 +145,36 @@ export interface CountOptions<T> {
 /** Result of findMany with metadata */
 export interface FindManyResult<T> {
     data: T[];
+    /**
+     * PAY-1767 (NightHawk 64552 item B): true when `data` is a PAGE of a larger population. Read from Core's
+     * `pagination.totalCount`; a caller must not treat `data.length` as the table's size.
+     */
+    hasMore?: boolean;
     meta: VibeMeta;
 }
+/**
+ * PAY-1767: the most records `createMany` will create in one call. It is per-record and NOT atomic, so a
+ * ceiling bounds the blast radius of a partial failure. 50 is the house's only batch ceiling (Vibe's own
+ * DecryptController BATCH_TOO_LARGE = 50).
+ */
+export declare const MAX_BATCH_CREATE_ROWS = 50;
+/**
+ * PAY-1767: the default page size findMany asks the query route for. Core clamps pageSize/limit to 100
+ * (DocumentsController.Query), so this is the most one call returns.
+ */
+export declare const MAX_FIND_MANY_PAGE_SIZE = 100;
+/**
+ * PAY-1767: map a Prisma-style `where` to Core's VibeFilterNode OBJECT.
+ *
+ *   { status: 'active' }            -> { 'status': { eq: 'active' } }
+ *   { score: { gt: 5 } }            -> { 'score': { gt: 5 } }
+ *   { status: 'a', tier: { in: [] } } -> { AND: [ {status:{eq:'a'}}, {tier:{in:[]}} ] }
+ *
+ * A field name is used as-is: a top-level document column (document_id, created_at...) or a JSONB path
+ * (Core treats an unknown name as data->>'name'; a nested path like 'data.x' is honoured explicitly).
+ * An unknown OPERATOR throws - dropping an operator would widen the result silently.
+ */
+export declare function buildVibeFilter(where: Record<string, unknown>, table: string): Record<string, unknown>;
 /**
  * Delegate class for table operations.
  * Provides Prisma-style methods for a specific table.
@@ -133,9 +184,33 @@ export declare class VibeTableDelegate<T extends VibeTableName> {
     private client;
     constructor(tableName: T, client: VibeClient);
     /**
-     * Find multiple records with optional filtering and pagination.
+     * PAY-1767: the Vibe API route for this table's document collection.
+     * `/v1/collections/{collection}/tables/{table}` (Core DocumentsController.cs:15) - the same shape
+     * generic.ts and sessions.ts already use. The OLD `/api/v1/vibe_app/{table}` had no route behind it.
+     */
+    private tableEndpoint;
+    /**
+     * Find multiple records, WITH filtering, sorting and paging honoured.
+     *
+     * PAY-1767 (NightHawk 64534 MUST 1, QAPert 64530, BAPert 64535). The GET list route
+     * (`GET /v1/collections/{c}/tables/{t}`, Core DocumentsController.List :44-48) binds ONLY `page` and
+     * `pageSize` - it reads no filter, sort or offset, so sending where/orderBy/take/skip there DROPPED them
+     * silently. Through the proxy that is worse than loud: a proxied MVP service account is ADMIN mode
+     * (HasValidContext), so the ownership filter is bypassed and an unfiltered page is 20 ARBITRARY rows of
+     * the tenant - caller code doing `rows[0]` gets the WRONG record with no error.
+     *
+     * So this now goes to `POST .../tables/{t}/query`, which binds QueryRequest (Filter / OrderBy / Page /
+     * PageSize / Limit). The FILTER is a VibeFilterNode OBJECT - `{ "<field>": { "<op>": value } }` - NOT the
+     * filter ARRAY that sessions.ts sends: QueryRequest.Filter is typed VibeFilterNode, which has no array
+     * form (measured at Core origin/master; CliInitProjectService.cs:197 builds the same object shape). An
+     * unmappable option THROWS rather than being dropped.
      */
     findMany(options?: FindManyOptions<VibeTableType<T>>): Promise<FindManyResult<VibeTableType<T>>>;
+    /**
+     * PAY-1767: map the Prisma-style findMany options onto Core's QueryRequest body. THROWS on anything the
+     * query endpoint cannot express, so nothing is silently dropped.
+     */
+    private buildQueryBody;
     /**
      * Find a single record by ID.
      * Throws VibeNotFoundError if not found.
@@ -147,8 +222,12 @@ export declare class VibeTableDelegate<T extends VibeTableName> {
      */
     findUniqueOrNull(options: FindUniqueOptions): Promise<VibeTableType<T> | null>;
     /**
-     * Find the first record matching the filter.
+     * Find the first record.
      * Returns null if none found.
+     *
+     * PAY-1767: takes the first row of the (caller-owned, created_at-ordered) list. Any where/orderBy in
+     * `options` is passed through to findMany, which REFUSES them on this route rather than dropping them,
+     * so this cannot pretend to filter.
      */
     findFirst(options?: FindManyOptions<VibeTableType<T>>): Promise<VibeTableType<T> | null>;
     /**
@@ -163,19 +242,45 @@ export declare class VibeTableDelegate<T extends VibeTableName> {
     /**
      * Delete a record by ID (soft delete).
      * Throws VibeNotFoundError if not found.
+     *
+     * PAY-1767 (NightHawk 64578 item 2): Core answers DELETE with **204 No Content** (DocumentsController
+     * Delete returns NoContent()), so a SUCCESSFUL delete carries NO document - and there is none to unwrap.
+     * This must therefore NOT go through requireRow (that is the create/update rule: "a success WITH no
+     * document throws"). A 2xx with no body is the success here; the request layer already resolves it to an
+     * empty success. Returns null when the server sent no document.
      */
-    delete(options: DeleteOptions): Promise<VibeTableType<T>>;
+    delete(options: DeleteOptions): Promise<VibeTableType<T> | null>;
+    /** Unwrap a single-document response, or THROW - never return an empty object typed as a row. */
+    private requireRow;
     /**
      * Count records matching the filter.
+     *
+     * PAY-1767 (NightHawk 64534): goes to POST /query with limit:0, which is Core's COUNT-ONLY mode
+     * (DocumentsController.Query returns an empty Data array plus Pagination.TotalCount). So this is the
+     * true population of the filter, not the first page's size.
      */
     count(options?: CountOptions<VibeTableType<T>>): Promise<number>;
     /**
-     * Create multiple records in a batch.
+     * Create multiple records.
+     *
+     * PAY-1767: the old path `/api/v1/vibe_app/batch` has no route (there is no documents batch endpoint in
+     * Core's Vibe Public API), so this CANNOT be atomic here. Until a Core batch route exists, this creates
+     * each record against the REAL table endpoint in turn.
+     *
+     * BOUNDED ON PURPOSE (BAPert 64527). Non-atomic is tolerable only while the blast radius is small, so a
+     * request above MAX_BATCH_CREATE_ROWS is REFUSED before anything is sent. 50 matches the house's only
+     * batch ceiling (Vibe's DecryptController BATCH_TOO_LARGE).
+     *
+     * PARTIAL FAILURE IS REPORTED, NOT SWALLOWED (NightHawk 64534 condition (a)). A failure at item k throws
+     * a VibeBatchCreateError that CARRIES the count and the document ids already created - a cap cannot fix
+     * partial failure, only reporting it can. The created rows are unwrapped (MUST 2) so their own fields are
+     * present, not the wrapper's.
      */
     createMany(options: {
         data: CreateOptions<VibeTableType<T>>['data'][];
     }): Promise<{
         count: number;
+        ids: Array<number | string>;
     }>;
 }
 /**
@@ -205,9 +310,19 @@ export declare class VibeClient {
      * Message format: {timestamp}|{method}|{endpoint}
      */
     private generateProxySignature;
+    /**
+     * PAY-1767: the Vibe API endpoint PATH for a table in this client's collection.
+     * `/v1/collections/{collection}/tables/{table}[/{id}]` - what the IDP proxy validates, signs and forwards.
+     * Returned as a PATH, not a URL: proxy mode needs no VIBE_API_URL (the proxy owns the base).
+     */
+    tableEndpoint(table: string, id?: number | string): string;
     /**
      * Make a request through the IDP Vibe proxy.
      * The proxy handles credential injection securely.
+     *
+     * PAY-1767: `endpoint` is the RAW path (+query) to forward. It is what gets signed and sent, so this
+     * takes a path directly rather than parsing one out of a URL - proxy mode is complete without a Vibe
+     * base URL, which is exactly what an endpoint-path call needs.
      */
     private requestViaProxy;
     /**
@@ -220,27 +335,28 @@ export declare class VibeClient {
      * Routing:
      * - All requests route through the IDP proxy (requires VIBE_HMAC_KEY + IDP_URL)
      *
+     * PAY-1767: `urlOrPath` is EITHER a full URL or a bare Vibe path ('/v1/collections/...'). Proxy mode
+     * signs and forwards the PATH either way, so a caller with only a path (the table delegates) needs no
+     * Vibe base URL - VIBE_API_URL is not required to make a proxied call.
+     *
      * Retry behavior:
      * - 5xx errors: Retry up to maxRetries times with exponential backoff
      * - 429 errors: Retry once after Retry-After delay (if retryOnRateLimit enabled)
      * - 401/403 errors: No retry (auth errors)
      * - Network errors: Retry with backoff
      */
-    request<T>(url: string, method: 'GET' | 'POST' | 'PUT' | 'DELETE', body?: unknown, authToken?: string): Promise<VibeResponse<T>>;
+    request<T>(urlOrPath: string, method: 'GET' | 'POST' | 'PUT' | 'DELETE', body?: unknown, authToken?: string): Promise<VibeResponse<T>>;
     /**
      * Parse error response body, handling non-JSON responses gracefully.
      */
     private parseErrorResponse;
     /**
      * Fetch the schema for type generation.
+     *
+     * PAY-1767: the old path `/api/v1/vibe_app/schema` has no route. The real per-collection schema route is
+     * `/v1/mvp/schemas/{collection}` (Core MvpSchemaController.cs:65). Returns the collection schema DTO.
      */
-    getSchema(): Promise<Record<string, {
-        columns: Array<{
-            name: string;
-            type: string;
-            nullable: boolean;
-        }>;
-    }>>;
+    getSchema(): Promise<Record<string, unknown>>;
 }
 /**
  * Default Vibe client instance.