@payez/next-mvp 4.8.2 → 4.8.3

package/dist/api-handlers/admin/audit.js

@@ -48,6 +48,7 @@ const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
 const crypto_1 = require("crypto");
+const filters_1 = require("../../vibe/filters");
 async function checkAdminRole(request) {
     const session = await (0, auth_1.getSession)(request);
     if (!session?.user) {
@@ -141,28 +142,19 @@ function createAuditHandler(config) {
             const queryBody = {
                 page,
                 pageSize,
-                orderBy: 'created_at',
-                orderDirection: 'desc',
+                // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+                orderBy: (0, filters_1.orderByMap)('created_at', 'desc'),
             };
-            const conditions = [];
-            if (action) {
-                conditions.push({ field: 'action', operator: 'eq', value: action });
-            }
-            if (userId) {
-                conditions.push({ field: 'user_id', operator: 'eq', value: userId });
-            }
-            if (startDate) {
-                conditions.push({ field: 'created_at', operator: 'gte', value: startDate });
-            }
-            if (endDate) {
-                conditions.push({ field: 'created_at', operator: 'lte', value: endDate });
-            }
-            if (conditions.length === 1) {
-                queryBody.filter = conditions[0];
-            }
-            else if (conditions.length > 1) {
-                queryBody.filter = { operator: 'and', conditions };
-            }
+            // PAY-1810: Core filter forms only (vibe/filters.ts). The old `{ operator, conditions }` had no `filters` key, so two or more filters
+            // returned zero rows.
+            const filter = (0, filters_1.allOf)([
+                action ? (0, filters_1.eq)('action', action) : null,
+                userId ? (0, filters_1.eq)('user_id', userId) : null,
+                startDate ? (0, filters_1.gte)('created_at', startDate) : null,
+                endDate ? (0, filters_1.lte)('created_at', endDate) : null,
+            ]);
+            if (filter)
+                queryBody.filter = filter;
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/audit_logs/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
                 return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });

package/dist/api-handlers/admin/sessions.js

@@ -49,6 +49,7 @@ const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
 const crypto_1 = require("crypto");
+const filters_1 = require("../../vibe/filters");
 /**
  * Check if the current user has admin role
  */
@@ -156,23 +157,17 @@ function createSessionsHandler(config) {
             const queryBody = {
                 page: 1,
                 pageSize: 100,
-                orderBy: 'created_at',
-                orderDirection: 'desc',
+                // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+                orderBy: (0, filters_1.orderByMap)('created_at', 'desc'),
             };
-            // Build filter conditions
-            const conditions = [];
-            if (status && status !== 'all') {
-                conditions.push({ field: 'status', operator: 'eq', value: status });
-            }
-            if (email) {
-                conditions.push({ field: 'email', operator: 'like', value: `%${email}%` });
-            }
-            if (conditions.length === 1) {
-                queryBody.filter = conditions[0];
-            }
-            else if (conditions.length > 1) {
-                queryBody.filter = { operator: 'and', conditions };
-            }
+            // PAY-1810: Core filter forms only (vibe/filters.ts): compound uses `filters`, and substring is `contains` (`like` is not a Core
+            // operator and a flat unknown operator is DROPPED, which returned every session).
+            const filter = (0, filters_1.allOf)([
+                status && status !== 'all' ? (0, filters_1.eq)('status', status) : null,
+                email ? (0, filters_1.contains)('email', email) : null,
+            ]);
+            if (filter)
+                queryBody.filter = filter;
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
                 return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
@@ -239,7 +234,9 @@ function createSessionsHandler(config) {
             if (action === 'revoke' && sessionId) {
                 // Revoke single session
                 const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/login_sessions/${sessionId}`, {
-                    method: 'PUT',
+                    // PAY-1810 (NightHawk 75394): PATCH, not PUT. A PUT to a Vibe document REPLACES it (Core UpdateAsync SET data = body), so this 3-field body
+                    // erased idp_user_id / session_token_hash / the rest of the row: the revoked row then vanished from the revocation check and the user list.
+                    method: 'PATCH',
                     body: {
                         status: 'revoked',
                         revoked_at: new Date().toISOString(),
@@ -252,39 +249,56 @@ function createSessionsHandler(config) {
                 return server_1.NextResponse.json({ success: true });
             }
             if (action === 'revoke_all' && userId) {
-                // Get all active sessions for user
-                const queryResult = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', {
-                    method: 'POST',
-                    body: {
-                        filter: {
-                            operator: 'and',
-                            conditions: [
-                                { field: 'idp_user_id', operator: 'eq', value: userId },
-                                { field: 'status', operator: 'eq', value: 'active' },
-                            ],
-                        },
-                    },
-                });
-                if (!queryResult.ok) {
-                    return server_1.NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
-                }
-                const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+                // PAY-1810: one /query call returns ONE page (Core's default page size is 20), so a user with more active sessions than a page would keep
+                // the rest signed in. Revoked sessions leave the `status = active` filter, so re-reading page 1 walks the whole set. It stops when a read
+                // is empty (complete), when a round revokes nothing (no progress: never loops on a failing write), or after REVOKE_ALL_MAX_ROUNDS.
+                const REVOKE_ALL_PAGE_SIZE = 50;
+                const REVOKE_ALL_MAX_ROUNDS = 20;
                 let revokedCount = 0;
-                // Revoke each session
-                for (const session of sessions) {
-                    const id = session.id || session.document_id;
-                    const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/login_sessions/${id}`, {
-                        method: 'PUT',
+                let complete = false;
+                for (let round = 0; round < REVOKE_ALL_MAX_ROUNDS; round++) {
+                    const queryResult = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', {
+                        method: 'POST',
                         body: {
-                            status: 'revoked',
-                            revoked_at: new Date().toISOString(),
-                            revoked_by: `admin:${adminCheck.userId}`,
+                            // PAY-1810: `conditions` is not a Core key (it read zero rows, so revoke_all revoked 0 and answered success); `filters` is.
+                            filter: (0, filters_1.allOf)([(0, filters_1.eq)('idp_user_id', userId), (0, filters_1.eq)('status', 'active')]),
+                            page: 1,
+                            pageSize: REVOKE_ALL_PAGE_SIZE,
                         },
                     });
-                    if (result.ok)
-                        revokedCount++;
+                    if (!queryResult.ok) {
+                        // The first read failing is a plain upstream error (as before). A later one leaves a partial result, reported as incomplete.
+                        if (round === 0) {
+                            return server_1.NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
+                        }
+                        break;
+                    }
+                    const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+                    if (sessions.length === 0) {
+                        complete = true;
+                        break;
+                    }
+                    let revokedThisRound = 0;
+                    for (const session of sessions) {
+                        const id = session.id || session.document_id;
+                        const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/login_sessions/${id}`, {
+                            method: 'PATCH', // PAY-1810: PATCH merges {status, revoked_at, revoked_by}; PUT would replace the whole row (see the single revoke above)
+                            body: {
+                                status: 'revoked',
+                                revoked_at: new Date().toISOString(),
+                                revoked_by: `admin:${adminCheck.userId}`,
+                            },
+                        });
+                        if (result.ok) {
+                            revokedCount++;
+                            revokedThisRound++;
+                        }
+                    }
+                    if (revokedThisRound === 0)
+                        break;
                 }
-                return server_1.NextResponse.json({ success: true, revokedCount });
+                // success only when the whole set was revoked: a sign-out control must not say success when every write failed (Scout 75399).
+                return server_1.NextResponse.json({ success: complete, revokedCount, complete });
             }
             return server_1.NextResponse.json({ error: 'Invalid action' }, { status: 400 });
         },

package/dist/api-handlers/admin/stats.js

@@ -142,7 +142,7 @@ function createStatsHandler(config) {
                     // 1. Users count via HMAC proxy (Vibe collection query)
                     vibeServiceRequest('/v1/collections/vibe_app/tables/users/query', {
                         method: 'POST',
-                        body: { page: 1, pageSize: 500, orderBy: 'created_at', orderDirection: 'desc' },
+                        body: { page: 1, pageSize: 500, orderBy: { created_at: 'desc' } }, // PAY-1810: orderBy is a { field: dir } map
                     }),
                     // 2. Tier distribution from analytics endpoint (uses purchases table)
                     vibeServiceRequest('/v1/analytics/tier-distribution?includeTrend=false', { method: 'GET' }),

package/dist/api-handlers/admin/users.js

@@ -48,6 +48,7 @@ const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
 const crypto_1 = require("crypto");
+const filters_1 = require("../../vibe/filters");
 async function checkAdminRole(request) {
     const session = await (0, auth_1.getSession)(request);
     if (!session?.user) {
@@ -139,28 +140,17 @@ function createUsersHandler(config) {
             const queryBody = {
                 page,
                 pageSize,
-                orderBy: 'created_at',
-                orderDirection: 'desc',
+                // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+                orderBy: (0, filters_1.orderByMap)('created_at', 'desc'),
             };
-            const conditions = [];
-            if (search) {
-                conditions.push({
-                    operator: 'or',
-                    conditions: [
-                        { field: 'email', operator: 'like', value: `%${search}%` },
-                        { field: 'display_name', operator: 'like', value: `%${search}%` },
-                    ],
-                });
-            }
-            if (tier) {
-                conditions.push({ field: 'tier', operator: 'eq', value: tier });
-            }
-            if (conditions.length === 1) {
-                queryBody.filter = conditions[0];
-            }
-            else if (conditions.length > 1) {
-                queryBody.filter = { operator: 'and', conditions };
-            }
+            // PAY-1810: Core filter forms only (vibe/filters.ts). The old `{ operator, conditions }` had no `filters` key, so a search returned zero rows,
+            // and `like` is not a Core operator; substring is `contains` (case-insensitive).
+            const filter = (0, filters_1.allOf)([
+                search ? (0, filters_1.anyOf)([(0, filters_1.contains)('email', search), (0, filters_1.contains)('display_name', search)]) : null,
+                tier ? (0, filters_1.eq)('tier', tier) : null,
+            ]);
+            if (filter)
+                queryBody.filter = filter;
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/users/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
                 return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
@@ -211,14 +201,16 @@ function createUsersHandler(config) {
                 return server_1.NextResponse.json({ stats });
             }
             if (action === 'update_tier' && userId && tier) {
-                const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PUT', body: { tier } });
+                const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PATCH', body: { tier } } // PAY-2041: merge one field; PUT replaced the whole user row
+                );
                 if (!result.ok) {
                     return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }
                 return server_1.NextResponse.json({ success: true });
             }
             if (action === 'update_credits' && userId && credits !== undefined) {
-                const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PUT', body: { credits } });
+                const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PATCH', body: { credits } } // PAY-2041: merge one field; PUT replaced the whole user row
+                );
                 if (!result.ok) {
                     return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }

package/dist/api-handlers/admin/vibe-data.d.ts

@@ -48,6 +48,11 @@ export declare function createGetRecordHandler(config: AdminVibeHandlerConfig):
 /**
  * PUT /api/admin/vibe/data/[collection]/[table]/[id]
  * Update record (admin access)
+ *
+ * PAY-2041: this is deliberately a REPLACE. An editor save sends the whole record, and Core PUT sets the
+ * document data to the body, so a field the admin removed stays removed. Do not switch it to PATCH: a merge
+ * could never delete a key. Callers that hold only some fields (VibeTable.update, generic update, the
+ * users tier/credits writes) use PATCH instead. Ruled by BAPert 75440 (NightHawk 75437, Scout 75439 agree).
  */
 export declare function createUpdateRecordHandler(config: AdminVibeHandlerConfig): (request: NextRequest, { params }: {
     params: Promise<{

package/dist/api-handlers/admin/vibe-data.js

@@ -218,6 +218,11 @@ function createGetRecordHandler(config) {
 /**
  * PUT /api/admin/vibe/data/[collection]/[table]/[id]
  * Update record (admin access)
+ *
+ * PAY-2041: this is deliberately a REPLACE. An editor save sends the whole record, and Core PUT sets the
+ * document data to the body, so a field the admin removed stays removed. Do not switch it to PATCH: a merge
+ * could never delete a key. Callers that hold only some fields (VibeTable.update, generic update, the
+ * users tier/credits writes) use PATCH instead. Ruled by BAPert 75440 (NightHawk 75437, Scout 75439 agree).
  */
 function createUpdateRecordHandler(config) {
     return async function PUT(request, { params }) {

package/dist/vibe/client.d.ts

@@ -345,7 +345,7 @@ export declare class VibeClient {
      * - 401/403 errors: No retry (auth errors)
      * - Network errors: Retry with backoff
      */
-    request<T>(urlOrPath: string, method: 'GET' | 'POST' | 'PUT' | 'DELETE', body?: unknown, authToken?: string): Promise<VibeResponse<T>>;
+    request<T>(urlOrPath: string, method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', body?: unknown, authToken?: string): Promise<VibeResponse<T>>;
     /**
      * Parse error response body, handling non-JSON responses gracefully.
      */

package/dist/vibe/client.js

@@ -331,7 +331,8 @@ class VibeTableDelegate {
      */
     async update(options) {
         const endpoint = this.tableEndpoint(options.where.id);
-        const response = await this.client.request(endpoint, 'PUT', options.data);
+        // PAY-2041: PATCH, not PUT. Core PUT REPLACES the document (UpdateAsync SET data = body), and `data` here is Partial, so PUT erased every field not named. PATCH merges (DocumentsController.Patch).
+        const response = await this.client.request(endpoint, 'PATCH', options.data);
         return this.requireRow(response.data, 'update');
     }
     /**

package/dist/vibe/filters.d.ts

@@ -0,0 +1,36 @@
+/**
+ * PAY-1810: the ONE place the package builds Vibe /query filters and orderBy, in the shapes Core's VibeQueryBuilder accepts.
+ *
+ * Core accepts exactly three filter forms (PayEz.Vibe.Public.Api VibeQueryModels / VibeQueryBuilder):
+ *   standard  { field: { op: value } } with AND / OR arrays
+ *   flat      { field, operator, value }
+ *   compound  { operator: 'and' | 'or', filters: [ ...nodes ] }        <- the key is `filters`, NOT `conditions`
+ * What goes wrong with the shapes this module replaces:
+ *   - { operator, conditions }  has no `filters` key, so Core reads `operator` / `conditions` as COLUMN names and returns ZERO rows
+ *     (a broken search; for revoke-all, "revoked 0 sessions" reported as success).
+ *   - operator 'like' is not a Core operator; in a flat filter it is DROPPED and the query returns ALL rows. Core's substring operator is
+ *     `contains` (ILIKE, case-insensitive); `ilike` is case-insensitive EQUALS.
+ *   - orderBy must be a { field: 'asc' | 'desc' } map (Core's model is Dictionary<string,string>); a bare string is rejected or ignored, never honoured.
+ */
+export type VibeOperator = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'startsWith' | 'endsWith' | 'ilike' | 'in' | 'notIn';
+export interface VibeFlatFilter {
+    field: string;
+    operator: VibeOperator;
+    value: unknown;
+}
+export interface VibeCompoundFilter {
+    operator: 'and' | 'or';
+    filters: VibeFilter[];
+}
+export type VibeFilter = VibeFlatFilter | VibeCompoundFilter;
+export declare const eq: (field: string, value: unknown) => VibeFlatFilter;
+export declare const gte: (field: string, value: unknown) => VibeFlatFilter;
+export declare const lte: (field: string, value: unknown) => VibeFlatFilter;
+/** Case-insensitive substring (Core `contains` = ILIKE). The value is the bare text: no % wildcards. */
+export declare const contains: (field: string, value: string) => VibeFlatFilter;
+/** AND of the given nodes: none -> undefined (no filter), one -> that node, several -> a compound with `filters`. */
+export declare function allOf(nodes: Array<VibeFilter | undefined | null>): VibeFilter | undefined;
+/** OR of the given nodes: none -> undefined, one -> that node, several -> a compound with `filters`. */
+export declare function anyOf(nodes: Array<VibeFilter | undefined | null>): VibeFilter | undefined;
+/** orderBy as Core binds it. */
+export declare function orderByMap(field: string, direction?: 'asc' | 'desc'): Record<string, 'asc' | 'desc'>;

package/dist/vibe/filters.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * PAY-1810: the ONE place the package builds Vibe /query filters and orderBy, in the shapes Core's VibeQueryBuilder accepts.
+ *
+ * Core accepts exactly three filter forms (PayEz.Vibe.Public.Api VibeQueryModels / VibeQueryBuilder):
+ *   standard  { field: { op: value } } with AND / OR arrays
+ *   flat      { field, operator, value }
+ *   compound  { operator: 'and' | 'or', filters: [ ...nodes ] }        <- the key is `filters`, NOT `conditions`
+ * What goes wrong with the shapes this module replaces:
+ *   - { operator, conditions }  has no `filters` key, so Core reads `operator` / `conditions` as COLUMN names and returns ZERO rows
+ *     (a broken search; for revoke-all, "revoked 0 sessions" reported as success).
+ *   - operator 'like' is not a Core operator; in a flat filter it is DROPPED and the query returns ALL rows. Core's substring operator is
+ *     `contains` (ILIKE, case-insensitive); `ilike` is case-insensitive EQUALS.
+ *   - orderBy must be a { field: 'asc' | 'desc' } map (Core's model is Dictionary<string,string>); a bare string is rejected or ignored, never honoured.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contains = exports.lte = exports.gte = exports.eq = void 0;
+exports.allOf = allOf;
+exports.anyOf = anyOf;
+exports.orderByMap = orderByMap;
+const eq = (field, value) => ({ field, operator: 'eq', value });
+exports.eq = eq;
+const gte = (field, value) => ({ field, operator: 'gte', value });
+exports.gte = gte;
+const lte = (field, value) => ({ field, operator: 'lte', value });
+exports.lte = lte;
+/** Case-insensitive substring (Core `contains` = ILIKE). The value is the bare text: no % wildcards. */
+const contains = (field, value) => ({ field, operator: 'contains', value });
+exports.contains = contains;
+/** AND of the given nodes: none -> undefined (no filter), one -> that node, several -> a compound with `filters`. */
+function allOf(nodes) {
+    const f = nodes.filter((n) => !!n);
+    if (f.length === 0)
+        return undefined;
+    return f.length === 1 ? f[0] : { operator: 'and', filters: f };
+}
+/** OR of the given nodes: none -> undefined, one -> that node, several -> a compound with `filters`. */
+function anyOf(nodes) {
+    const f = nodes.filter((n) => !!n);
+    if (f.length === 0)
+        return undefined;
+    return f.length === 1 ? f[0] : { operator: 'or', filters: f };
+}
+/** orderBy as Core binds it. */
+function orderByMap(field, direction = 'desc') {
+    return { [field]: direction };
+}

package/dist/vibe/generic.js

@@ -208,7 +208,8 @@ class GenericTableDelegate {
     async update(options) {
         const path = vibeTablePath(this.collection, this.tableName, options.where.id);
         const url = `${this.client.getBaseUrl()}${path}`;
-        const response = await this.client.request(url, 'PUT', options.data);
+        // PAY-2041: PATCH merges; PUT would replace the whole document with this Partial.
+        const response = await this.client.request(url, 'PATCH', options.data);
         const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeServiceError('Failed to parse updated document');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.8.2",
+  "version": "4.8.3",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/api-handlers/admin/audit.ts

@@ -13,6 +13,7 @@ import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
 import { randomUUID } from 'crypto';
+import { allOf, eq, gte, lte, orderByMap } from '../../vibe/filters';
 
 interface VibeRequestOptions {
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -131,29 +132,19 @@ export function createAuditHandler(config: AdminAuditHandlerConfig) {
       const queryBody: any = {
         page,
         pageSize,
-        orderBy: 'created_at',
-        orderDirection: 'desc',
+        // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+        orderBy: orderByMap('created_at', 'desc'),
       };
 
-      const conditions: any[] = [];
-      if (action) {
-        conditions.push({ field: 'action', operator: 'eq', value: action });
-      }
-      if (userId) {
-        conditions.push({ field: 'user_id', operator: 'eq', value: userId });
-      }
-      if (startDate) {
-        conditions.push({ field: 'created_at', operator: 'gte', value: startDate });
-      }
-      if (endDate) {
-        conditions.push({ field: 'created_at', operator: 'lte', value: endDate });
-      }
-
-      if (conditions.length === 1) {
-        queryBody.filter = conditions[0];
-      } else if (conditions.length > 1) {
-        queryBody.filter = { operator: 'and', conditions };
-      }
+      // PAY-1810: Core filter forms only (vibe/filters.ts). The old `{ operator, conditions }` had no `filters` key, so two or more filters
+      // returned zero rows.
+      const filter = allOf([
+        action ? eq('action', action) : null,
+        userId ? eq('user_id', userId) : null,
+        startDate ? gte('created_at', startDate) : null,
+        endDate ? lte('created_at', endDate) : null,
+      ]);
+      if (filter) queryBody.filter = filter;
 
       const result = await vibeServiceRequest<any>(
         '/v1/collections/vibe_app/tables/audit_logs/query',

package/src/api-handlers/admin/sessions.ts

@@ -14,9 +14,10 @@ import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
 import { randomUUID } from 'crypto';
+import { allOf, contains, eq, orderByMap } from '../../vibe/filters';
 
 interface VibeRequestOptions {
-  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
   body?: unknown;
 }
 
@@ -154,24 +155,17 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
       const queryBody: any = {
         page: 1,
         pageSize: 100,
-        orderBy: 'created_at',
-        orderDirection: 'desc',
+        // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+        orderBy: orderByMap('created_at', 'desc'),
       };
 
-      // Build filter conditions
-      const conditions: any[] = [];
-      if (status && status !== 'all') {
-        conditions.push({ field: 'status', operator: 'eq', value: status });
-      }
-      if (email) {
-        conditions.push({ field: 'email', operator: 'like', value: `%${email}%` });
-      }
-
-      if (conditions.length === 1) {
-        queryBody.filter = conditions[0];
-      } else if (conditions.length > 1) {
-        queryBody.filter = { operator: 'and', conditions };
-      }
+      // PAY-1810: Core filter forms only (vibe/filters.ts): compound uses `filters`, and substring is `contains` (`like` is not a Core
+      // operator and a flat unknown operator is DROPPED, which returned every session).
+      const filter = allOf([
+        status && status !== 'all' ? eq('status', status) : null,
+        email ? contains('email', email) : null,
+      ]);
+      if (filter) queryBody.filter = filter;
 
       const result = await vibeServiceRequest<any>(
         '/v1/collections/vibe_app/tables/login_sessions/query',
@@ -260,7 +254,9 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
         const result = await vibeServiceRequest<any>(
           `/v1/collections/vibe_app/tables/login_sessions/${sessionId}`,
           {
-            method: 'PUT',
+            // PAY-1810 (NightHawk 75394): PATCH, not PUT. A PUT to a Vibe document REPLACES it (Core UpdateAsync SET data = body), so this 3-field body
+            // erased idp_user_id / session_token_hash / the rest of the row: the revoked row then vanished from the revocation check and the user list.
+            method: 'PATCH',
             body: {
               status: 'revoked',
               revoked_at: new Date().toISOString(),
@@ -277,48 +273,66 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
       }
 
       if (action === 'revoke_all' && userId) {
-        // Get all active sessions for user
-        const queryResult = await vibeServiceRequest<any>(
-          '/v1/collections/vibe_app/tables/login_sessions/query',
-          {
-            method: 'POST',
-            body: {
-              filter: {
-                operator: 'and',
-                conditions: [
-                  { field: 'idp_user_id', operator: 'eq', value: userId },
-                  { field: 'status', operator: 'eq', value: 'active' },
-                ],
-              },
-            },
-          }
-        );
-
-        if (!queryResult.ok) {
-          return NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
-        }
-
-        const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+        // PAY-1810: one /query call returns ONE page (Core's default page size is 20), so a user with more active sessions than a page would keep
+        // the rest signed in. Revoked sessions leave the `status = active` filter, so re-reading page 1 walks the whole set. It stops when a read
+        // is empty (complete), when a round revokes nothing (no progress: never loops on a failing write), or after REVOKE_ALL_MAX_ROUNDS.
+        const REVOKE_ALL_PAGE_SIZE = 50;
+        const REVOKE_ALL_MAX_ROUNDS = 20;
         let revokedCount = 0;
+        let complete = false;
 
-        // Revoke each session
-        for (const session of sessions) {
-          const id = session.id || session.document_id;
-          const result = await vibeServiceRequest<any>(
-            `/v1/collections/vibe_app/tables/login_sessions/${id}`,
+        for (let round = 0; round < REVOKE_ALL_MAX_ROUNDS; round++) {
+          const queryResult = await vibeServiceRequest<any>(
+            '/v1/collections/vibe_app/tables/login_sessions/query',
             {
-              method: 'PUT',
+              method: 'POST',
               body: {
-                status: 'revoked',
-                revoked_at: new Date().toISOString(),
-                revoked_by: `admin:${adminCheck.userId}`,
+                // PAY-1810: `conditions` is not a Core key (it read zero rows, so revoke_all revoked 0 and answered success); `filters` is.
+                filter: allOf([eq('idp_user_id', userId), eq('status', 'active')]),
+                page: 1,
+                pageSize: REVOKE_ALL_PAGE_SIZE,
               },
             }
           );
-          if (result.ok) revokedCount++;
+
+          if (!queryResult.ok) {
+            // The first read failing is a plain upstream error (as before). A later one leaves a partial result, reported as incomplete.
+            if (round === 0) {
+              return NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
+            }
+            break;
+          }
+
+          const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+          if (sessions.length === 0) {
+            complete = true;
+            break;
+          }
+
+          let revokedThisRound = 0;
+          for (const session of sessions) {
+            const id = session.id || session.document_id;
+            const result = await vibeServiceRequest<any>(
+              `/v1/collections/vibe_app/tables/login_sessions/${id}`,
+              {
+                method: 'PATCH', // PAY-1810: PATCH merges {status, revoked_at, revoked_by}; PUT would replace the whole row (see the single revoke above)
+                body: {
+                  status: 'revoked',
+                  revoked_at: new Date().toISOString(),
+                  revoked_by: `admin:${adminCheck.userId}`,
+                },
+              }
+            );
+            if (result.ok) {
+              revokedCount++;
+              revokedThisRound++;
+            }
+          }
+          if (revokedThisRound === 0) break;
         }
 
-        return NextResponse.json({ success: true, revokedCount });
+        // success only when the whole set was revoked: a sign-out control must not say success when every write failed (Scout 75399).
+        return NextResponse.json({ success: complete, revokedCount, complete });
       }
 
       return NextResponse.json({ error: 'Invalid action' }, { status: 400 });

package/src/api-handlers/admin/stats.ts

@@ -133,7 +133,7 @@ export function createStatsHandler(config: AdminStatsHandlerConfig) {
           // 1. Users count via HMAC proxy (Vibe collection query)
           vibeServiceRequest<any>('/v1/collections/vibe_app/tables/users/query', {
             method: 'POST',
-            body: { page: 1, pageSize: 500, orderBy: 'created_at', orderDirection: 'desc' },
+            body: { page: 1, pageSize: 500, orderBy: { created_at: 'desc' } }, // PAY-1810: orderBy is a { field: dir } map
           }),
 
           // 2. Tier distribution from analytics endpoint (uses purchases table)

package/src/api-handlers/admin/users.ts

@@ -13,9 +13,10 @@ import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
 import { randomUUID } from 'crypto';
+import { allOf, anyOf, contains, eq, orderByMap } from '../../vibe/filters';
 
 interface VibeRequestOptions {
-  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
   body?: unknown;
 }
 
@@ -129,29 +130,17 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
       const queryBody: any = {
         page,
         pageSize,
-        orderBy: 'created_at',
-        orderDirection: 'desc',
+        // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+        orderBy: orderByMap('created_at', 'desc'),
       };
 
-      const conditions: any[] = [];
-      if (search) {
-        conditions.push({
-          operator: 'or',
-          conditions: [
-            { field: 'email', operator: 'like', value: `%${search}%` },
-            { field: 'display_name', operator: 'like', value: `%${search}%` },
-          ],
-        });
-      }
-      if (tier) {
-        conditions.push({ field: 'tier', operator: 'eq', value: tier });
-      }
-
-      if (conditions.length === 1) {
-        queryBody.filter = conditions[0];
-      } else if (conditions.length > 1) {
-        queryBody.filter = { operator: 'and', conditions };
-      }
+      // PAY-1810: Core filter forms only (vibe/filters.ts). The old `{ operator, conditions }` had no `filters` key, so a search returned zero rows,
+      // and `like` is not a Core operator; substring is `contains` (case-insensitive).
+      const filter = allOf([
+        search ? anyOf([contains('email', search), contains('display_name', search)]) : null,
+        tier ? eq('tier', tier) : null,
+      ]);
+      if (filter) queryBody.filter = filter;
 
       const result = await vibeServiceRequest<any>(
         '/v1/collections/vibe_app/tables/users/query',
@@ -222,7 +211,7 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
       if (action === 'update_tier' && userId && tier) {
         const result = await vibeServiceRequest<any>(
           `/v1/collections/vibe_app/tables/users/${userId}`,
-          { method: 'PUT', body: { tier } }
+          { method: 'PATCH', body: { tier } } // PAY-2041: merge one field; PUT replaced the whole user row
         );
 
         if (!result.ok) {
@@ -235,7 +224,7 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
       if (action === 'update_credits' && userId && credits !== undefined) {
         const result = await vibeServiceRequest<any>(
           `/v1/collections/vibe_app/tables/users/${userId}`,
-          { method: 'PUT', body: { credits } }
+          { method: 'PATCH', body: { credits } } // PAY-2041: merge one field; PUT replaced the whole user row
         );
 
         if (!result.ok) {

package/src/api-handlers/admin/vibe-data.ts

@@ -248,6 +248,11 @@ export function createGetRecordHandler(config: AdminVibeHandlerConfig) {
 /**
  * PUT /api/admin/vibe/data/[collection]/[table]/[id]
  * Update record (admin access)
+ *
+ * PAY-2041: this is deliberately a REPLACE. An editor save sends the whole record, and Core PUT sets the
+ * document data to the body, so a field the admin removed stays removed. Do not switch it to PATCH: a merge
+ * could never delete a key. Callers that hold only some fields (VibeTable.update, generic update, the
+ * users tier/credits writes) use PATCH instead. Ruled by BAPert 75440 (NightHawk 75437, Scout 75439 agree).
  */
 export function createUpdateRecordHandler(config: AdminVibeHandlerConfig) {
   return async function PUT(

package/src/vibe/client.ts

@@ -491,7 +491,8 @@ export class VibeTableDelegate<T extends VibeTableName> {
    */
   async update(options: UpdateOptions<VibeTableType<T>>): Promise<VibeTableType<T>> {
     const endpoint = this.tableEndpoint(options.where.id);
-    const response = await this.client.request<VibeDocumentWrapper>(endpoint, 'PUT', options.data);
+    // PAY-2041: PATCH, not PUT. Core PUT REPLACES the document (UpdateAsync SET data = body), and `data` here is Partial, so PUT erased every field not named. PATCH merges (DocumentsController.Patch).
+    const response = await this.client.request<VibeDocumentWrapper>(endpoint, 'PATCH', options.data);
     return this.requireRow(response.data, 'update');
   }
 
@@ -693,7 +694,7 @@ export class VibeClient {
    */
   private async requestViaProxy<T>(
     endpoint: string,
-    method: 'GET' | 'POST' | 'PUT' | 'DELETE',
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
     body?: unknown,
     authToken?: string
   ): Promise<VibeResponse<T>> {
@@ -788,7 +789,7 @@ export class VibeClient {
    */
   async request<T>(
     urlOrPath: string,
-    method: 'GET' | 'POST' | 'PUT' | 'DELETE',
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
     body?: unknown,
     authToken?: string
   ): Promise<VibeResponse<T>> {

package/src/vibe/filters.ts

@@ -0,0 +1,52 @@
+/**
+ * PAY-1810: the ONE place the package builds Vibe /query filters and orderBy, in the shapes Core's VibeQueryBuilder accepts.
+ *
+ * Core accepts exactly three filter forms (PayEz.Vibe.Public.Api VibeQueryModels / VibeQueryBuilder):
+ *   standard  { field: { op: value } } with AND / OR arrays
+ *   flat      { field, operator, value }
+ *   compound  { operator: 'and' | 'or', filters: [ ...nodes ] }        <- the key is `filters`, NOT `conditions`
+ * What goes wrong with the shapes this module replaces:
+ *   - { operator, conditions }  has no `filters` key, so Core reads `operator` / `conditions` as COLUMN names and returns ZERO rows
+ *     (a broken search; for revoke-all, "revoked 0 sessions" reported as success).
+ *   - operator 'like' is not a Core operator; in a flat filter it is DROPPED and the query returns ALL rows. Core's substring operator is
+ *     `contains` (ILIKE, case-insensitive); `ilike` is case-insensitive EQUALS.
+ *   - orderBy must be a { field: 'asc' | 'desc' } map (Core's model is Dictionary<string,string>); a bare string is rejected or ignored, never honoured.
+ */
+
+export type VibeOperator = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'startsWith' | 'endsWith' | 'ilike' | 'in' | 'notIn';
+
+export interface VibeFlatFilter {
+  field: string;
+  operator: VibeOperator;
+  value: unknown;
+}
+export interface VibeCompoundFilter {
+  operator: 'and' | 'or';
+  filters: VibeFilter[];
+}
+export type VibeFilter = VibeFlatFilter | VibeCompoundFilter;
+
+export const eq = (field: string, value: unknown): VibeFlatFilter => ({ field, operator: 'eq', value });
+export const gte = (field: string, value: unknown): VibeFlatFilter => ({ field, operator: 'gte', value });
+export const lte = (field: string, value: unknown): VibeFlatFilter => ({ field, operator: 'lte', value });
+/** Case-insensitive substring (Core `contains` = ILIKE). The value is the bare text: no % wildcards. */
+export const contains = (field: string, value: string): VibeFlatFilter => ({ field, operator: 'contains', value });
+
+/** AND of the given nodes: none -> undefined (no filter), one -> that node, several -> a compound with `filters`. */
+export function allOf(nodes: Array<VibeFilter | undefined | null>): VibeFilter | undefined {
+  const f = nodes.filter((n): n is VibeFilter => !!n);
+  if (f.length === 0) return undefined;
+  return f.length === 1 ? f[0] : { operator: 'and', filters: f };
+}
+
+/** OR of the given nodes: none -> undefined, one -> that node, several -> a compound with `filters`. */
+export function anyOf(nodes: Array<VibeFilter | undefined | null>): VibeFilter | undefined {
+  const f = nodes.filter((n): n is VibeFilter => !!n);
+  if (f.length === 0) return undefined;
+  return f.length === 1 ? f[0] : { operator: 'or', filters: f };
+}
+
+/** orderBy as Core binds it. */
+export function orderByMap(field: string, direction: 'asc' | 'desc' = 'desc'): Record<string, 'asc' | 'desc'> {
+  return { [field]: direction };
+}

package/src/vibe/generic.ts

@@ -224,7 +224,8 @@ export class GenericTableDelegate<T extends Record<string, unknown> = Record<str
   async update(options: { where: { id: number }; data: Partial<T> }): Promise<T & { _vibe_doc_id?: number }> {
     const path = vibeTablePath(this.collection, this.tableName, options.where.id);
     const url = `${this.client.getBaseUrl()}${path}`;
-    const response = await this.client.request<VibeDocumentWrapper>(url, 'PUT', options.data);
+    // PAY-2041: PATCH merges; PUT would replace the whole document with this Partial.
+    const response = await this.client.request<VibeDocumentWrapper>(url, 'PATCH', options.data);
     const unwrapped = unwrapVibeDocument<T>(response.data);
     if (!unwrapped) {
       throw new VibeServiceError('Failed to parse updated document');