@payez/next-mvp 4.8.2 → 4.8.4

package/README.md

@@ -499,6 +499,33 @@ export function Providers({ children }: { children: React.ReactNode }) {
 
 ---
 
+## Register an agent (REG-002)
+
+`@payez/next-mvp/agents` is a typed client over the tenant-admin agent door (`POST/GET api/client/agents`). The caller must be a tenant admin with completed MFA; the client (tenant) comes from the token, so there is no client id to pass.
+
+```ts
+import { createAgentRegistryClient, AgentRegistryError } from '@payez/next-mvp/agents';
+
+const agents = createAgentRegistryClient({
+  baseUrl: process.env.IDP_URL!,            // absolute origin of the identity service
+  accessToken: () => getAdminAccessToken(), // a string, or a function returning one
+});
+
+try {
+  const { item } = await agents.register({ user_name: 'build-bot', owner_user_id: 42, host_class: 'rig_pane' });
+  // item.status.code === 'PENDING': the first mint is refused AGENT_PENDING until an admin activates it.
+} catch (e) {
+  if (e instanceof AgentRegistryError) {
+    // e.code is Core's code as-is: VALIDATION_ERROR, OWNER_NOT_ELIGIBLE, OWNER_NOT_MEMBER, AGENT_NAME_TAKEN, ...
+    // e.status is the HTTP status (0 = no response). Nothing is retried; a 409 AGENT_NAME_TAKEN stays a 409.
+  }
+  throw e;
+}
+
+const { items } = await agents.list();  // every agent of your client
+const { item: one } = await agents.get(41);
+```
+
 ## API Routes
 
 Access pre-built API handlers:

package/dist/agents/index.d.ts

@@ -0,0 +1 @@
+export * from './registry';

package/dist/agents/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./registry"), exports);

package/dist/agents/registry.d.ts

@@ -0,0 +1,73 @@
+/** Core PayEzEndpoints.AgentTokens.AllowedHostClasses (PayEzEndpoints.cs:187,194,228). The server is the authority; this is for typing only. */
+export declare const AGENT_HOST_CLASSES: readonly ["rig_pane", "contractor"];
+export type AgentHostClass = (typeof AGENT_HOST_CLASSES)[number];
+export interface RegisterAgentInput {
+    /** 3-64 chars, letters/digits/'.'/'_'/'-', starting with a letter or digit; unique across the IdP. */
+    user_name: string;
+    /** A person (user id) who is an approved, active member of this client. */
+    owner_user_id: number;
+    host_class: AgentHostClass;
+}
+export interface AgentRecord {
+    id: number;
+    user_name: string;
+    owner: {
+        kind: 'person';
+        user_id: number;
+        display_name: string | null;
+        approved: boolean;
+    } | null;
+    status: {
+        code: string;
+        reason: string | null;
+    };
+    host_class: string | null;
+    agent_profile_id: number | null;
+}
+export interface MintableApp {
+    id: number;
+    name: string;
+    allowed_scopes: unknown;
+}
+export interface RegisterAgentResult {
+    item: AgentRecord | null;
+    created: boolean;
+    audited: boolean;
+}
+export interface ListAgentsResult {
+    client_id: number;
+    demo_token_ready: boolean | null;
+    items: AgentRecord[];
+    apps: MintableApp[];
+}
+export interface GetAgentResult {
+    item: AgentRecord;
+    apps: MintableApp[];
+}
+/** Codes this door is known to answer. `string` stays in the union: an unknown code is surfaced, not hidden. */
+export type AgentRegistryErrorCode = 'VALIDATION_ERROR' | 'OWNER_NOT_ELIGIBLE' | 'OWNER_NOT_MEMBER' | 'AGENT_NAME_TAKEN' | 'AUDIT_WRITE_FAILED_NOT_APPLIED' | 'MISSING_CLIENT_ID' | 'UNAUTHORIZED' | 'IDP_UNREACHABLE' | 'NETWORK_ERROR' | 'BAD_RESPONSE' | (string & {});
+export declare class AgentRegistryError extends Error {
+    readonly code: AgentRegistryErrorCode;
+    /** HTTP status; 0 when no response arrived. */
+    readonly status: number;
+    readonly requestId?: string;
+    readonly details?: unknown;
+    constructor(code: AgentRegistryErrorCode, message: string, status: number, extra?: {
+        requestId?: string;
+        details?: unknown;
+    });
+}
+export interface AgentRegistryClientOptions {
+    /** Absolute origin of the identity service (e.g. IDP_URL). */
+    baseUrl: string;
+    /** A tenant-admin access token (completed MFA), or a function that returns one. */
+    accessToken: string | (() => string | Promise<string>);
+    /** Override for tests; defaults to bearerFetch (global fetch, never follows a redirect). */
+    fetch?: (input: string, init: RequestInit) => Promise<Response>;
+}
+export interface AgentRegistryClient {
+    register(input: RegisterAgentInput): Promise<RegisterAgentResult>;
+    list(): Promise<ListAgentsResult>;
+    get(id: number): Promise<GetAgentResult>;
+}
+export declare function createAgentRegistryClient(options: AgentRegistryClientOptions): AgentRegistryClient;

package/dist/agents/registry.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentRegistryError = exports.AGENT_HOST_CLASSES = void 0;
+exports.createAgentRegistryClient = createAgentRegistryClient;
+/**
+ * REG-002 (Keel Registry): the SDK half of "Registration API and SDK".
+ *
+ * A typed client over the tenant-admin agent door in PayEz-Core:
+ *   PayEz.Apis/PayEz.External.Id.Api/Controllers/ClientAgentsController.cs @ 22d44a34c
+ *     POST api/client/agents       Register  (:332-367)  body { user_name, owner_user_id, host_class } -> 201 { item, created, audited }
+ *     GET  api/client/agents       List      (:92-107)   -> { client_id, demo_token_ready, items, apps }
+ *     GET  api/client/agents/{id}  Get       (:126-133)  -> { item, apps } | 404
+ *   Gate: payez_admin / idp_admin_ui_graft_admin with completed MFA (:39-40). The client comes from the TOKEN, never from the
+ *   body, so this client has no client-id argument and cannot register into another client.
+ *
+ * Contract this client keeps:
+ *   - a refusal is thrown as an AgentRegistryError carrying the server's `code` AS-IS (VALIDATION_ERROR, OWNER_NOT_ELIGIBLE,
+ *     OWNER_NOT_MEMBER, AGENT_NAME_TAKEN, AUDIT_WRITE_FAILED_NOT_APPLIED, MISSING_CLIENT_ID, UNAUTHORIZED, ...). It is never
+ *     re-worded, mapped, or swallowed.
+ *   - NO RETRY, of any status. A 409 AGENT_NAME_TAKEN means the name exists; sending it again can only repeat the answer, and a
+ *     register that timed out may have been applied, so the caller (who can read the list) decides, not this client.
+ *   - no validation of the body before sending: the server's validation is the authority and its code is what the caller gets.
+ *   - the bearer never follows a redirect (bearerFetch) and is never put in an error, a message or a log line.
+ *
+ * A newly registered agent is PENDING until an admin activates it (PAY-2069); its first mint is refused AGENT_PENDING.
+ */
+const bearer_fetch_1 = require("../lib/bearer-fetch");
+const idp_url_guard_1 = require("../lib/idp-url-guard");
+/** Core PayEzEndpoints.AgentTokens.AllowedHostClasses (PayEzEndpoints.cs:187,194,228). The server is the authority; this is for typing only. */
+exports.AGENT_HOST_CLASSES = ['rig_pane', 'contractor'];
+class AgentRegistryError extends Error {
+    code;
+    /** HTTP status; 0 when no response arrived. */
+    status;
+    requestId;
+    details;
+    constructor(code, message, status, extra) {
+        super(message);
+        this.name = 'AgentRegistryError';
+        this.code = code;
+        this.status = status;
+        this.requestId = extra?.requestId;
+        this.details = extra?.details;
+    }
+}
+exports.AgentRegistryError = AgentRegistryError;
+function createAgentRegistryClient(options) {
+    (0, idp_url_guard_1.assertAbsoluteIdpUrl)(options.baseUrl);
+    const base = options.baseUrl.replace(/\/+$/, '');
+    const send = options.fetch ?? ((input, init) => (0, bearer_fetch_1.bearerFetch)(input, init));
+    async function call(path, init) {
+        const token = typeof options.accessToken === 'function' ? await options.accessToken() : options.accessToken;
+        let res;
+        try {
+            res = await send(`${base}${path}`, {
+                method: init.method,
+                headers: {
+                    Accept: 'application/json',
+                    ...(init.body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+                    Authorization: `Bearer ${token}`,
+                },
+                ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+                cache: 'no-store',
+            });
+        }
+        catch {
+            // Fixed text: a transport error's own message can carry the URL or headers.
+            // A POST that failed in transit may still have been applied (the server can answer after the client gave up), so for register the text says the
+            // outcome is unknown and to read the list; it is never retried here. A GET changes nothing, so it keeps the plain text.
+            throw new AgentRegistryError('NETWORK_ERROR', init.method === 'POST'
+                ? 'The identity service could not be reached; the outcome is unknown, so read the list before registering again'
+                : 'The identity service could not be reached', 0);
+        }
+        let json = null;
+        try {
+            json = await res.json();
+        }
+        catch {
+            json = null;
+        }
+        if (!res.ok) {
+            const e = json?.error;
+            throw new AgentRegistryError(typeof e?.code === 'string' ? e.code : `HTTP_${res.status}`, typeof e?.message === 'string' ? e.message : `The identity service answered ${res.status}`, res.status, { requestId: json?.request_id ?? e?.support?.request_id, details: e?.details });
+        }
+        const data = json?.data;
+        if (json?.success === false || data == null || typeof data !== 'object') {
+            throw new AgentRegistryError('BAD_RESPONSE', 'The identity service answered without the expected data', res.status);
+        }
+        return data;
+    }
+    return {
+        register: (input) => call('/api/client/agents', {
+            method: 'POST',
+            // Exactly the three fields the door binds; nothing else is forwarded.
+            body: { user_name: input.user_name, owner_user_id: input.owner_user_id, host_class: input.host_class },
+        }),
+        list: () => call('/api/client/agents', { method: 'GET' }),
+        get: (id) => call(`/api/client/agents/${encodeURIComponent(String(id))}`, { method: 'GET' }),
+    };
+}

package/dist/api-handlers/admin/audit.js

@@ -48,6 +48,7 @@ const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
 const crypto_1 = require("crypto");
+const filters_1 = require("../../vibe/filters");
 async function checkAdminRole(request) {
     const session = await (0, auth_1.getSession)(request);
     if (!session?.user) {
@@ -141,28 +142,19 @@ function createAuditHandler(config) {
             const queryBody = {
                 page,
                 pageSize,
-                orderBy: 'created_at',
-                orderDirection: 'desc',
+                // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+                orderBy: (0, filters_1.orderByMap)('created_at', 'desc'),
             };
-            const conditions = [];
-            if (action) {
-                conditions.push({ field: 'action', operator: 'eq', value: action });
-            }
-            if (userId) {
-                conditions.push({ field: 'user_id', operator: 'eq', value: userId });
-            }
-            if (startDate) {
-                conditions.push({ field: 'created_at', operator: 'gte', value: startDate });
-            }
-            if (endDate) {
-                conditions.push({ field: 'created_at', operator: 'lte', value: endDate });
-            }
-            if (conditions.length === 1) {
-                queryBody.filter = conditions[0];
-            }
-            else if (conditions.length > 1) {
-                queryBody.filter = { operator: 'and', conditions };
-            }
+            // PAY-1810: Core filter forms only (vibe/filters.ts). The old `{ operator, conditions }` had no `filters` key, so two or more filters
+            // returned zero rows.
+            const filter = (0, filters_1.allOf)([
+                action ? (0, filters_1.eq)('action', action) : null,
+                userId ? (0, filters_1.eq)('user_id', userId) : null,
+                startDate ? (0, filters_1.gte)('created_at', startDate) : null,
+                endDate ? (0, filters_1.lte)('created_at', endDate) : null,
+            ]);
+            if (filter)
+                queryBody.filter = filter;
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/audit_logs/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
                 return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });

package/dist/api-handlers/admin/sessions.js

@@ -49,6 +49,7 @@ const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
 const crypto_1 = require("crypto");
+const filters_1 = require("../../vibe/filters");
 /**
  * Check if the current user has admin role
  */
@@ -156,23 +157,17 @@ function createSessionsHandler(config) {
             const queryBody = {
                 page: 1,
                 pageSize: 100,
-                orderBy: 'created_at',
-                orderDirection: 'desc',
+                // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+                orderBy: (0, filters_1.orderByMap)('created_at', 'desc'),
             };
-            // Build filter conditions
-            const conditions = [];
-            if (status && status !== 'all') {
-                conditions.push({ field: 'status', operator: 'eq', value: status });
-            }
-            if (email) {
-                conditions.push({ field: 'email', operator: 'like', value: `%${email}%` });
-            }
-            if (conditions.length === 1) {
-                queryBody.filter = conditions[0];
-            }
-            else if (conditions.length > 1) {
-                queryBody.filter = { operator: 'and', conditions };
-            }
+            // PAY-1810: Core filter forms only (vibe/filters.ts): compound uses `filters`, and substring is `contains` (`like` is not a Core
+            // operator and a flat unknown operator is DROPPED, which returned every session).
+            const filter = (0, filters_1.allOf)([
+                status && status !== 'all' ? (0, filters_1.eq)('status', status) : null,
+                email ? (0, filters_1.contains)('email', email) : null,
+            ]);
+            if (filter)
+                queryBody.filter = filter;
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
                 return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
@@ -239,7 +234,9 @@ function createSessionsHandler(config) {
             if (action === 'revoke' && sessionId) {
                 // Revoke single session
                 const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/login_sessions/${sessionId}`, {
-                    method: 'PUT',
+                    // PAY-1810 (NightHawk 75394): PATCH, not PUT. A PUT to a Vibe document REPLACES it (Core UpdateAsync SET data = body), so this 3-field body
+                    // erased idp_user_id / session_token_hash / the rest of the row: the revoked row then vanished from the revocation check and the user list.
+                    method: 'PATCH',
                     body: {
                         status: 'revoked',
                         revoked_at: new Date().toISOString(),
@@ -252,39 +249,56 @@ function createSessionsHandler(config) {
                 return server_1.NextResponse.json({ success: true });
             }
             if (action === 'revoke_all' && userId) {
-                // Get all active sessions for user
-                const queryResult = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', {
-                    method: 'POST',
-                    body: {
-                        filter: {
-                            operator: 'and',
-                            conditions: [
-                                { field: 'idp_user_id', operator: 'eq', value: userId },
-                                { field: 'status', operator: 'eq', value: 'active' },
-                            ],
-                        },
-                    },
-                });
-                if (!queryResult.ok) {
-                    return server_1.NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
-                }
-                const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+                // PAY-1810: one /query call returns ONE page (Core's default page size is 20), so a user with more active sessions than a page would keep
+                // the rest signed in. Revoked sessions leave the `status = active` filter, so re-reading page 1 walks the whole set. It stops when a read
+                // is empty (complete), when a round revokes nothing (no progress: never loops on a failing write), or after REVOKE_ALL_MAX_ROUNDS.
+                const REVOKE_ALL_PAGE_SIZE = 50;
+                const REVOKE_ALL_MAX_ROUNDS = 20;
                 let revokedCount = 0;
-                // Revoke each session
-                for (const session of sessions) {
-                    const id = session.id || session.document_id;
-                    const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/login_sessions/${id}`, {
-                        method: 'PUT',
+                let complete = false;
+                for (let round = 0; round < REVOKE_ALL_MAX_ROUNDS; round++) {
+                    const queryResult = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', {
+                        method: 'POST',
                         body: {
-                            status: 'revoked',
-                            revoked_at: new Date().toISOString(),
-                            revoked_by: `admin:${adminCheck.userId}`,
+                            // PAY-1810: `conditions` is not a Core key (it read zero rows, so revoke_all revoked 0 and answered success); `filters` is.
+                            filter: (0, filters_1.allOf)([(0, filters_1.eq)('idp_user_id', userId), (0, filters_1.eq)('status', 'active')]),
+                            page: 1,
+                            pageSize: REVOKE_ALL_PAGE_SIZE,
                         },
                     });
-                    if (result.ok)
-                        revokedCount++;
+                    if (!queryResult.ok) {
+                        // The first read failing is a plain upstream error (as before). A later one leaves a partial result, reported as incomplete.
+                        if (round === 0) {
+                            return server_1.NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
+                        }
+                        break;
+                    }
+                    const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+                    if (sessions.length === 0) {
+                        complete = true;
+                        break;
+                    }
+                    let revokedThisRound = 0;
+                    for (const session of sessions) {
+                        const id = session.id || session.document_id;
+                        const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/login_sessions/${id}`, {
+                            method: 'PATCH', // PAY-1810: PATCH merges {status, revoked_at, revoked_by}; PUT would replace the whole row (see the single revoke above)
+                            body: {
+                                status: 'revoked',
+                                revoked_at: new Date().toISOString(),
+                                revoked_by: `admin:${adminCheck.userId}`,
+                            },
+                        });
+                        if (result.ok) {
+                            revokedCount++;
+                            revokedThisRound++;
+                        }
+                    }
+                    if (revokedThisRound === 0)
+                        break;
                 }
-                return server_1.NextResponse.json({ success: true, revokedCount });
+                // success only when the whole set was revoked: a sign-out control must not say success when every write failed (Scout 75399).
+                return server_1.NextResponse.json({ success: complete, revokedCount, complete });
             }
             return server_1.NextResponse.json({ error: 'Invalid action' }, { status: 400 });
         },

package/dist/api-handlers/admin/stats.js

@@ -142,7 +142,7 @@ function createStatsHandler(config) {
                     // 1. Users count via HMAC proxy (Vibe collection query)
                     vibeServiceRequest('/v1/collections/vibe_app/tables/users/query', {
                         method: 'POST',
-                        body: { page: 1, pageSize: 500, orderBy: 'created_at', orderDirection: 'desc' },
+                        body: { page: 1, pageSize: 500, orderBy: { created_at: 'desc' } }, // PAY-1810: orderBy is a { field: dir } map
                     }),
                     // 2. Tier distribution from analytics endpoint (uses purchases table)
                     vibeServiceRequest('/v1/analytics/tier-distribution?includeTrend=false', { method: 'GET' }),

package/dist/api-handlers/admin/users.js

@@ -48,6 +48,7 @@ const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
 const crypto_1 = require("crypto");
+const filters_1 = require("../../vibe/filters");
 async function checkAdminRole(request) {
     const session = await (0, auth_1.getSession)(request);
     if (!session?.user) {
@@ -139,28 +140,17 @@ function createUsersHandler(config) {
             const queryBody = {
                 page,
                 pageSize,
-                orderBy: 'created_at',
-                orderDirection: 'desc',
+                // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+                orderBy: (0, filters_1.orderByMap)('created_at', 'desc'),
             };
-            const conditions = [];
-            if (search) {
-                conditions.push({
-                    operator: 'or',
-                    conditions: [
-                        { field: 'email', operator: 'like', value: `%${search}%` },
-                        { field: 'display_name', operator: 'like', value: `%${search}%` },
-                    ],
-                });
-            }
-            if (tier) {
-                conditions.push({ field: 'tier', operator: 'eq', value: tier });
-            }
-            if (conditions.length === 1) {
-                queryBody.filter = conditions[0];
-            }
-            else if (conditions.length > 1) {
-                queryBody.filter = { operator: 'and', conditions };
-            }
+            // PAY-1810: Core filter forms only (vibe/filters.ts). The old `{ operator, conditions }` had no `filters` key, so a search returned zero rows,
+            // and `like` is not a Core operator; substring is `contains` (case-insensitive).
+            const filter = (0, filters_1.allOf)([
+                search ? (0, filters_1.anyOf)([(0, filters_1.contains)('email', search), (0, filters_1.contains)('display_name', search)]) : null,
+                tier ? (0, filters_1.eq)('tier', tier) : null,
+            ]);
+            if (filter)
+                queryBody.filter = filter;
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/users/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
                 return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
@@ -211,14 +201,16 @@ function createUsersHandler(config) {
                 return server_1.NextResponse.json({ stats });
             }
             if (action === 'update_tier' && userId && tier) {
-                const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PUT', body: { tier } });
+                const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PATCH', body: { tier } } // PAY-2041: merge one field; PUT replaced the whole user row
+                );
                 if (!result.ok) {
                     return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }
                 return server_1.NextResponse.json({ success: true });
             }
             if (action === 'update_credits' && userId && credits !== undefined) {
-                const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PUT', body: { credits } });
+                const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PATCH', body: { credits } } // PAY-2041: merge one field; PUT replaced the whole user row
+                );
                 if (!result.ok) {
                     return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }

package/dist/api-handlers/admin/vibe-data.d.ts

@@ -48,6 +48,11 @@ export declare function createGetRecordHandler(config: AdminVibeHandlerConfig):
 /**
  * PUT /api/admin/vibe/data/[collection]/[table]/[id]
  * Update record (admin access)
+ *
+ * PAY-2041: this is deliberately a REPLACE. An editor save sends the whole record, and Core PUT sets the
+ * document data to the body, so a field the admin removed stays removed. Do not switch it to PATCH: a merge
+ * could never delete a key. Callers that hold only some fields (VibeTable.update, generic update, the
+ * users tier/credits writes) use PATCH instead. Ruled by BAPert 75440 (NightHawk 75437, Scout 75439 agree).
  */
 export declare function createUpdateRecordHandler(config: AdminVibeHandlerConfig): (request: NextRequest, { params }: {
     params: Promise<{

package/dist/api-handlers/admin/vibe-data.js

@@ -218,6 +218,11 @@ function createGetRecordHandler(config) {
 /**
  * PUT /api/admin/vibe/data/[collection]/[table]/[id]
  * Update record (admin access)
+ *
+ * PAY-2041: this is deliberately a REPLACE. An editor save sends the whole record, and Core PUT sets the
+ * document data to the body, so a field the admin removed stays removed. Do not switch it to PATCH: a merge
+ * could never delete a key. Callers that hold only some fields (VibeTable.update, generic update, the
+ * users tier/credits writes) use PATCH instead. Ruled by BAPert 75440 (NightHawk 75437, Scout 75439 agree).
  */
 function createUpdateRecordHandler(config) {
     return async function PUT(request, { params }) {

package/dist/vibe/client.d.ts

@@ -345,7 +345,7 @@ export declare class VibeClient {
      * - 401/403 errors: No retry (auth errors)
      * - Network errors: Retry with backoff
      */
-    request<T>(urlOrPath: string, method: 'GET' | 'POST' | 'PUT' | 'DELETE', body?: unknown, authToken?: string): Promise<VibeResponse<T>>;
+    request<T>(urlOrPath: string, method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', body?: unknown, authToken?: string): Promise<VibeResponse<T>>;
     /**
      * Parse error response body, handling non-JSON responses gracefully.
      */

package/dist/vibe/client.js

@@ -331,7 +331,8 @@ class VibeTableDelegate {
      */
     async update(options) {
         const endpoint = this.tableEndpoint(options.where.id);
-        const response = await this.client.request(endpoint, 'PUT', options.data);
+        // PAY-2041: PATCH, not PUT. Core PUT REPLACES the document (UpdateAsync SET data = body), and `data` here is Partial, so PUT erased every field not named. PATCH merges (DocumentsController.Patch).
+        const response = await this.client.request(endpoint, 'PATCH', options.data);
         return this.requireRow(response.data, 'update');
     }
     /**

package/dist/vibe/filters.d.ts

@@ -0,0 +1,36 @@
+/**
+ * PAY-1810: the ONE place the package builds Vibe /query filters and orderBy, in the shapes Core's VibeQueryBuilder accepts.
+ *
+ * Core accepts exactly three filter forms (PayEz.Vibe.Public.Api VibeQueryModels / VibeQueryBuilder):
+ *   standard  { field: { op: value } } with AND / OR arrays
+ *   flat      { field, operator, value }
+ *   compound  { operator: 'and' | 'or', filters: [ ...nodes ] }        <- the key is `filters`, NOT `conditions`
+ * What goes wrong with the shapes this module replaces:
+ *   - { operator, conditions }  has no `filters` key, so Core reads `operator` / `conditions` as COLUMN names and returns ZERO rows
+ *     (a broken search; for revoke-all, "revoked 0 sessions" reported as success).
+ *   - operator 'like' is not a Core operator; in a flat filter it is DROPPED and the query returns ALL rows. Core's substring operator is
+ *     `contains` (ILIKE, case-insensitive); `ilike` is case-insensitive EQUALS.
+ *   - orderBy must be a { field: 'asc' | 'desc' } map (Core's model is Dictionary<string,string>); a bare string is rejected or ignored, never honoured.
+ */
+export type VibeOperator = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'startsWith' | 'endsWith' | 'ilike' | 'in' | 'notIn';
+export interface VibeFlatFilter {
+    field: string;
+    operator: VibeOperator;
+    value: unknown;
+}
+export interface VibeCompoundFilter {
+    operator: 'and' | 'or';
+    filters: VibeFilter[];
+}
+export type VibeFilter = VibeFlatFilter | VibeCompoundFilter;
+export declare const eq: (field: string, value: unknown) => VibeFlatFilter;
+export declare const gte: (field: string, value: unknown) => VibeFlatFilter;
+export declare const lte: (field: string, value: unknown) => VibeFlatFilter;
+/** Case-insensitive substring (Core `contains` = ILIKE). The value is the bare text: no % wildcards. */
+export declare const contains: (field: string, value: string) => VibeFlatFilter;
+/** AND of the given nodes: none -> undefined (no filter), one -> that node, several -> a compound with `filters`. */
+export declare function allOf(nodes: Array<VibeFilter | undefined | null>): VibeFilter | undefined;
+/** OR of the given nodes: none -> undefined, one -> that node, several -> a compound with `filters`. */
+export declare function anyOf(nodes: Array<VibeFilter | undefined | null>): VibeFilter | undefined;
+/** orderBy as Core binds it. */
+export declare function orderByMap(field: string, direction?: 'asc' | 'desc'): Record<string, 'asc' | 'desc'>;

package/dist/vibe/filters.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * PAY-1810: the ONE place the package builds Vibe /query filters and orderBy, in the shapes Core's VibeQueryBuilder accepts.
+ *
+ * Core accepts exactly three filter forms (PayEz.Vibe.Public.Api VibeQueryModels / VibeQueryBuilder):
+ *   standard  { field: { op: value } } with AND / OR arrays
+ *   flat      { field, operator, value }
+ *   compound  { operator: 'and' | 'or', filters: [ ...nodes ] }        <- the key is `filters`, NOT `conditions`
+ * What goes wrong with the shapes this module replaces:
+ *   - { operator, conditions }  has no `filters` key, so Core reads `operator` / `conditions` as COLUMN names and returns ZERO rows
+ *     (a broken search; for revoke-all, "revoked 0 sessions" reported as success).
+ *   - operator 'like' is not a Core operator; in a flat filter it is DROPPED and the query returns ALL rows. Core's substring operator is
+ *     `contains` (ILIKE, case-insensitive); `ilike` is case-insensitive EQUALS.
+ *   - orderBy must be a { field: 'asc' | 'desc' } map (Core's model is Dictionary<string,string>); a bare string is rejected or ignored, never honoured.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contains = exports.lte = exports.gte = exports.eq = void 0;
+exports.allOf = allOf;
+exports.anyOf = anyOf;
+exports.orderByMap = orderByMap;
+const eq = (field, value) => ({ field, operator: 'eq', value });
+exports.eq = eq;
+const gte = (field, value) => ({ field, operator: 'gte', value });
+exports.gte = gte;
+const lte = (field, value) => ({ field, operator: 'lte', value });
+exports.lte = lte;
+/** Case-insensitive substring (Core `contains` = ILIKE). The value is the bare text: no % wildcards. */
+const contains = (field, value) => ({ field, operator: 'contains', value });
+exports.contains = contains;
+/** AND of the given nodes: none -> undefined (no filter), one -> that node, several -> a compound with `filters`. */
+function allOf(nodes) {
+    const f = nodes.filter((n) => !!n);
+    if (f.length === 0)
+        return undefined;
+    return f.length === 1 ? f[0] : { operator: 'and', filters: f };
+}
+/** OR of the given nodes: none -> undefined, one -> that node, several -> a compound with `filters`. */
+function anyOf(nodes) {
+    const f = nodes.filter((n) => !!n);
+    if (f.length === 0)
+        return undefined;
+    return f.length === 1 ? f[0] : { operator: 'or', filters: f };
+}
+/** orderBy as Core binds it. */
+function orderByMap(field, direction = 'desc') {
+    return { [field]: direction };
+}

package/dist/vibe/generic.js

@@ -208,7 +208,8 @@ class GenericTableDelegate {
     async update(options) {
         const path = vibeTablePath(this.collection, this.tableName, options.where.id);
         const url = `${this.client.getBaseUrl()}${path}`;
-        const response = await this.client.request(url, 'PUT', options.data);
+        // PAY-2041: PATCH merges; PUT would replace the whole document with this Partial.
+        const response = await this.client.request(url, 'PATCH', options.data);
         const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeServiceError('Failed to parse updated document');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.8.2",
+  "version": "4.8.4",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -810,6 +810,11 @@
       "require": "./dist/hooks/useViabilitySession.js",
       "default": "./dist/hooks/useViabilitySession.js"
     },
+    "./agents": {
+      "types": "./dist/agents/index.d.ts",
+      "require": "./dist/agents/index.js",
+      "default": "./dist/agents/index.js"
+    },
     "./vibe": {
       "types": "./dist/vibe/index.d.ts",
       "require": "./dist/vibe/index.js",

package/src/agents/index.ts

@@ -0,0 +1 @@
+export * from './registry';

package/src/agents/registry.ts

@@ -0,0 +1,179 @@
+/**
+ * REG-002 (Keel Registry): the SDK half of "Registration API and SDK".
+ *
+ * A typed client over the tenant-admin agent door in PayEz-Core:
+ *   PayEz.Apis/PayEz.External.Id.Api/Controllers/ClientAgentsController.cs @ 22d44a34c
+ *     POST api/client/agents       Register  (:332-367)  body { user_name, owner_user_id, host_class } -> 201 { item, created, audited }
+ *     GET  api/client/agents       List      (:92-107)   -> { client_id, demo_token_ready, items, apps }
+ *     GET  api/client/agents/{id}  Get       (:126-133)  -> { item, apps } | 404
+ *   Gate: payez_admin / idp_admin_ui_graft_admin with completed MFA (:39-40). The client comes from the TOKEN, never from the
+ *   body, so this client has no client-id argument and cannot register into another client.
+ *
+ * Contract this client keeps:
+ *   - a refusal is thrown as an AgentRegistryError carrying the server's `code` AS-IS (VALIDATION_ERROR, OWNER_NOT_ELIGIBLE,
+ *     OWNER_NOT_MEMBER, AGENT_NAME_TAKEN, AUDIT_WRITE_FAILED_NOT_APPLIED, MISSING_CLIENT_ID, UNAUTHORIZED, ...). It is never
+ *     re-worded, mapped, or swallowed.
+ *   - NO RETRY, of any status. A 409 AGENT_NAME_TAKEN means the name exists; sending it again can only repeat the answer, and a
+ *     register that timed out may have been applied, so the caller (who can read the list) decides, not this client.
+ *   - no validation of the body before sending: the server's validation is the authority and its code is what the caller gets.
+ *   - the bearer never follows a redirect (bearerFetch) and is never put in an error, a message or a log line.
+ *
+ * A newly registered agent is PENDING until an admin activates it (PAY-2069); its first mint is refused AGENT_PENDING.
+ */
+import { bearerFetch } from '../lib/bearer-fetch';
+import { assertAbsoluteIdpUrl } from '../lib/idp-url-guard';
+
+/** Core PayEzEndpoints.AgentTokens.AllowedHostClasses (PayEzEndpoints.cs:187,194,228). The server is the authority; this is for typing only. */
+export const AGENT_HOST_CLASSES = ['rig_pane', 'contractor'] as const;
+export type AgentHostClass = (typeof AGENT_HOST_CLASSES)[number];
+
+export interface RegisterAgentInput {
+  /** 3-64 chars, letters/digits/'.'/'_'/'-', starting with a letter or digit; unique across the IdP. */
+  user_name: string;
+  /** A person (user id) who is an approved, active member of this client. */
+  owner_user_id: number;
+  host_class: AgentHostClass;
+}
+
+export interface AgentRecord {
+  id: number;
+  user_name: string;
+  owner: { kind: 'person'; user_id: number; display_name: string | null; approved: boolean } | null;
+  status: { code: string; reason: string | null };
+  host_class: string | null;
+  agent_profile_id: number | null;
+}
+
+export interface MintableApp {
+  id: number;
+  name: string;
+  allowed_scopes: unknown;
+}
+
+export interface RegisterAgentResult {
+  item: AgentRecord | null;
+  created: boolean;
+  audited: boolean;
+}
+
+export interface ListAgentsResult {
+  client_id: number;
+  demo_token_ready: boolean | null;
+  items: AgentRecord[];
+  apps: MintableApp[];
+}
+
+export interface GetAgentResult {
+  item: AgentRecord;
+  apps: MintableApp[];
+}
+
+/** Codes this door is known to answer. `string` stays in the union: an unknown code is surfaced, not hidden. */
+export type AgentRegistryErrorCode =
+  | 'VALIDATION_ERROR'
+  | 'OWNER_NOT_ELIGIBLE'
+  | 'OWNER_NOT_MEMBER'
+  | 'AGENT_NAME_TAKEN'
+  | 'AUDIT_WRITE_FAILED_NOT_APPLIED'
+  | 'MISSING_CLIENT_ID'
+  | 'UNAUTHORIZED'
+  | 'IDP_UNREACHABLE'
+  | 'NETWORK_ERROR'
+  | 'BAD_RESPONSE'
+  | (string & {});
+
+export class AgentRegistryError extends Error {
+  readonly code: AgentRegistryErrorCode;
+  /** HTTP status; 0 when no response arrived. */
+  readonly status: number;
+  readonly requestId?: string;
+  readonly details?: unknown;
+
+  constructor(code: AgentRegistryErrorCode, message: string, status: number, extra?: { requestId?: string; details?: unknown }) {
+    super(message);
+    this.name = 'AgentRegistryError';
+    this.code = code;
+    this.status = status;
+    this.requestId = extra?.requestId;
+    this.details = extra?.details;
+  }
+}
+
+export interface AgentRegistryClientOptions {
+  /** Absolute origin of the identity service (e.g. IDP_URL). */
+  baseUrl: string;
+  /** A tenant-admin access token (completed MFA), or a function that returns one. */
+  accessToken: string | (() => string | Promise<string>);
+  /** Override for tests; defaults to bearerFetch (global fetch, never follows a redirect). */
+  fetch?: (input: string, init: RequestInit) => Promise<Response>;
+}
+
+export interface AgentRegistryClient {
+  register(input: RegisterAgentInput): Promise<RegisterAgentResult>;
+  list(): Promise<ListAgentsResult>;
+  get(id: number): Promise<GetAgentResult>;
+}
+
+export function createAgentRegistryClient(options: AgentRegistryClientOptions): AgentRegistryClient {
+  assertAbsoluteIdpUrl(options.baseUrl);
+  const base = options.baseUrl.replace(/\/+$/, '');
+  const send = options.fetch ?? ((input: string, init: RequestInit) => bearerFetch(input, init));
+
+  async function call<T>(path: string, init: { method: 'GET' | 'POST'; body?: unknown }): Promise<T> {
+    const token = typeof options.accessToken === 'function' ? await options.accessToken() : options.accessToken;
+    let res: Response;
+    try {
+      res = await send(`${base}${path}`, {
+        method: init.method,
+        headers: {
+          Accept: 'application/json',
+          ...(init.body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+          Authorization: `Bearer ${token}`,
+        },
+        ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+        cache: 'no-store',
+      });
+    } catch {
+      // Fixed text: a transport error's own message can carry the URL or headers.
+      // A POST that failed in transit may still have been applied (the server can answer after the client gave up), so for register the text says the
+      // outcome is unknown and to read the list; it is never retried here. A GET changes nothing, so it keeps the plain text.
+      throw new AgentRegistryError(
+        'NETWORK_ERROR',
+        init.method === 'POST'
+          ? 'The identity service could not be reached; the outcome is unknown, so read the list before registering again'
+          : 'The identity service could not be reached',
+        0,
+      );
+    }
+
+    let json: any = null;
+    try { json = await res.json(); } catch { json = null; }
+
+    if (!res.ok) {
+      const e = json?.error;
+      throw new AgentRegistryError(
+        typeof e?.code === 'string' ? e.code : `HTTP_${res.status}`,
+        typeof e?.message === 'string' ? e.message : `The identity service answered ${res.status}`,
+        res.status,
+        { requestId: json?.request_id ?? e?.support?.request_id, details: e?.details },
+      );
+    }
+
+    const data = json?.data;
+    if (json?.success === false || data == null || typeof data !== 'object') {
+      throw new AgentRegistryError('BAD_RESPONSE', 'The identity service answered without the expected data', res.status);
+    }
+    return data as T;
+  }
+
+  return {
+    register: (input) =>
+      call<RegisterAgentResult>('/api/client/agents', {
+        method: 'POST',
+        // Exactly the three fields the door binds; nothing else is forwarded.
+        body: { user_name: input.user_name, owner_user_id: input.owner_user_id, host_class: input.host_class },
+      }),
+    list: () => call<ListAgentsResult>('/api/client/agents', { method: 'GET' }),
+    get: (id) => call<GetAgentResult>(`/api/client/agents/${encodeURIComponent(String(id))}`, { method: 'GET' }),
+  };
+}

package/src/api-handlers/admin/audit.ts

@@ -13,6 +13,7 @@ import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
 import { randomUUID } from 'crypto';
+import { allOf, eq, gte, lte, orderByMap } from '../../vibe/filters';
 
 interface VibeRequestOptions {
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -131,29 +132,19 @@ export function createAuditHandler(config: AdminAuditHandlerConfig) {
       const queryBody: any = {
         page,
         pageSize,
-        orderBy: 'created_at',
-        orderDirection: 'desc',
+        // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+        orderBy: orderByMap('created_at', 'desc'),
       };
 
-      const conditions: any[] = [];
-      if (action) {
-        conditions.push({ field: 'action', operator: 'eq', value: action });
-      }
-      if (userId) {
-        conditions.push({ field: 'user_id', operator: 'eq', value: userId });
-      }
-      if (startDate) {
-        conditions.push({ field: 'created_at', operator: 'gte', value: startDate });
-      }
-      if (endDate) {
-        conditions.push({ field: 'created_at', operator: 'lte', value: endDate });
-      }
-
-      if (conditions.length === 1) {
-        queryBody.filter = conditions[0];
-      } else if (conditions.length > 1) {
-        queryBody.filter = { operator: 'and', conditions };
-      }
+      // PAY-1810: Core filter forms only (vibe/filters.ts). The old `{ operator, conditions }` had no `filters` key, so two or more filters
+      // returned zero rows.
+      const filter = allOf([
+        action ? eq('action', action) : null,
+        userId ? eq('user_id', userId) : null,
+        startDate ? gte('created_at', startDate) : null,
+        endDate ? lte('created_at', endDate) : null,
+      ]);
+      if (filter) queryBody.filter = filter;
 
       const result = await vibeServiceRequest<any>(
         '/v1/collections/vibe_app/tables/audit_logs/query',

package/src/api-handlers/admin/sessions.ts

@@ -14,9 +14,10 @@ import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
 import { randomUUID } from 'crypto';
+import { allOf, contains, eq, orderByMap } from '../../vibe/filters';
 
 interface VibeRequestOptions {
-  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
   body?: unknown;
 }
 
@@ -154,24 +155,17 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
       const queryBody: any = {
         page: 1,
         pageSize: 100,
-        orderBy: 'created_at',
-        orderDirection: 'desc',
+        // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+        orderBy: orderByMap('created_at', 'desc'),
       };
 
-      // Build filter conditions
-      const conditions: any[] = [];
-      if (status && status !== 'all') {
-        conditions.push({ field: 'status', operator: 'eq', value: status });
-      }
-      if (email) {
-        conditions.push({ field: 'email', operator: 'like', value: `%${email}%` });
-      }
-
-      if (conditions.length === 1) {
-        queryBody.filter = conditions[0];
-      } else if (conditions.length > 1) {
-        queryBody.filter = { operator: 'and', conditions };
-      }
+      // PAY-1810: Core filter forms only (vibe/filters.ts): compound uses `filters`, and substring is `contains` (`like` is not a Core
+      // operator and a flat unknown operator is DROPPED, which returned every session).
+      const filter = allOf([
+        status && status !== 'all' ? eq('status', status) : null,
+        email ? contains('email', email) : null,
+      ]);
+      if (filter) queryBody.filter = filter;
 
       const result = await vibeServiceRequest<any>(
         '/v1/collections/vibe_app/tables/login_sessions/query',
@@ -260,7 +254,9 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
         const result = await vibeServiceRequest<any>(
           `/v1/collections/vibe_app/tables/login_sessions/${sessionId}`,
           {
-            method: 'PUT',
+            // PAY-1810 (NightHawk 75394): PATCH, not PUT. A PUT to a Vibe document REPLACES it (Core UpdateAsync SET data = body), so this 3-field body
+            // erased idp_user_id / session_token_hash / the rest of the row: the revoked row then vanished from the revocation check and the user list.
+            method: 'PATCH',
             body: {
               status: 'revoked',
               revoked_at: new Date().toISOString(),
@@ -277,48 +273,66 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
       }
 
       if (action === 'revoke_all' && userId) {
-        // Get all active sessions for user
-        const queryResult = await vibeServiceRequest<any>(
-          '/v1/collections/vibe_app/tables/login_sessions/query',
-          {
-            method: 'POST',
-            body: {
-              filter: {
-                operator: 'and',
-                conditions: [
-                  { field: 'idp_user_id', operator: 'eq', value: userId },
-                  { field: 'status', operator: 'eq', value: 'active' },
-                ],
-              },
-            },
-          }
-        );
-
-        if (!queryResult.ok) {
-          return NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
-        }
-
-        const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+        // PAY-1810: one /query call returns ONE page (Core's default page size is 20), so a user with more active sessions than a page would keep
+        // the rest signed in. Revoked sessions leave the `status = active` filter, so re-reading page 1 walks the whole set. It stops when a read
+        // is empty (complete), when a round revokes nothing (no progress: never loops on a failing write), or after REVOKE_ALL_MAX_ROUNDS.
+        const REVOKE_ALL_PAGE_SIZE = 50;
+        const REVOKE_ALL_MAX_ROUNDS = 20;
         let revokedCount = 0;
+        let complete = false;
 
-        // Revoke each session
-        for (const session of sessions) {
-          const id = session.id || session.document_id;
-          const result = await vibeServiceRequest<any>(
-            `/v1/collections/vibe_app/tables/login_sessions/${id}`,
+        for (let round = 0; round < REVOKE_ALL_MAX_ROUNDS; round++) {
+          const queryResult = await vibeServiceRequest<any>(
+            '/v1/collections/vibe_app/tables/login_sessions/query',
             {
-              method: 'PUT',
+              method: 'POST',
               body: {
-                status: 'revoked',
-                revoked_at: new Date().toISOString(),
-                revoked_by: `admin:${adminCheck.userId}`,
+                // PAY-1810: `conditions` is not a Core key (it read zero rows, so revoke_all revoked 0 and answered success); `filters` is.
+                filter: allOf([eq('idp_user_id', userId), eq('status', 'active')]),
+                page: 1,
+                pageSize: REVOKE_ALL_PAGE_SIZE,
               },
             }
           );
-          if (result.ok) revokedCount++;
+
+          if (!queryResult.ok) {
+            // The first read failing is a plain upstream error (as before). A later one leaves a partial result, reported as incomplete.
+            if (round === 0) {
+              return NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
+            }
+            break;
+          }
+
+          const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+          if (sessions.length === 0) {
+            complete = true;
+            break;
+          }
+
+          let revokedThisRound = 0;
+          for (const session of sessions) {
+            const id = session.id || session.document_id;
+            const result = await vibeServiceRequest<any>(
+              `/v1/collections/vibe_app/tables/login_sessions/${id}`,
+              {
+                method: 'PATCH', // PAY-1810: PATCH merges {status, revoked_at, revoked_by}; PUT would replace the whole row (see the single revoke above)
+                body: {
+                  status: 'revoked',
+                  revoked_at: new Date().toISOString(),
+                  revoked_by: `admin:${adminCheck.userId}`,
+                },
+              }
+            );
+            if (result.ok) {
+              revokedCount++;
+              revokedThisRound++;
+            }
+          }
+          if (revokedThisRound === 0) break;
         }
 
-        return NextResponse.json({ success: true, revokedCount });
+        // success only when the whole set was revoked: a sign-out control must not say success when every write failed (Scout 75399).
+        return NextResponse.json({ success: complete, revokedCount, complete });
       }
 
       return NextResponse.json({ error: 'Invalid action' }, { status: 400 });

package/src/api-handlers/admin/stats.ts

@@ -133,7 +133,7 @@ export function createStatsHandler(config: AdminStatsHandlerConfig) {
           // 1. Users count via HMAC proxy (Vibe collection query)
           vibeServiceRequest<any>('/v1/collections/vibe_app/tables/users/query', {
             method: 'POST',
-            body: { page: 1, pageSize: 500, orderBy: 'created_at', orderDirection: 'desc' },
+            body: { page: 1, pageSize: 500, orderBy: { created_at: 'desc' } }, // PAY-1810: orderBy is a { field: dir } map
           }),
 
           // 2. Tier distribution from analytics endpoint (uses purchases table)

package/src/api-handlers/admin/users.ts

@@ -13,9 +13,10 @@ import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
 import { randomUUID } from 'crypto';
+import { allOf, anyOf, contains, eq, orderByMap } from '../../vibe/filters';
 
 interface VibeRequestOptions {
-  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
   body?: unknown;
 }
 
@@ -129,29 +130,17 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
       const queryBody: any = {
         page,
         pageSize,
-        orderBy: 'created_at',
-        orderDirection: 'desc',
+        // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+        orderBy: orderByMap('created_at', 'desc'),
       };
 
-      const conditions: any[] = [];
-      if (search) {
-        conditions.push({
-          operator: 'or',
-          conditions: [
-            { field: 'email', operator: 'like', value: `%${search}%` },
-            { field: 'display_name', operator: 'like', value: `%${search}%` },
-          ],
-        });
-      }
-      if (tier) {
-        conditions.push({ field: 'tier', operator: 'eq', value: tier });
-      }
-
-      if (conditions.length === 1) {
-        queryBody.filter = conditions[0];
-      } else if (conditions.length > 1) {
-        queryBody.filter = { operator: 'and', conditions };
-      }
+      // PAY-1810: Core filter forms only (vibe/filters.ts). The old `{ operator, conditions }` had no `filters` key, so a search returned zero rows,
+      // and `like` is not a Core operator; substring is `contains` (case-insensitive).
+      const filter = allOf([
+        search ? anyOf([contains('email', search), contains('display_name', search)]) : null,
+        tier ? eq('tier', tier) : null,
+      ]);
+      if (filter) queryBody.filter = filter;
 
       const result = await vibeServiceRequest<any>(
         '/v1/collections/vibe_app/tables/users/query',
@@ -222,7 +211,7 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
       if (action === 'update_tier' && userId && tier) {
         const result = await vibeServiceRequest<any>(
           `/v1/collections/vibe_app/tables/users/${userId}`,
-          { method: 'PUT', body: { tier } }
+          { method: 'PATCH', body: { tier } } // PAY-2041: merge one field; PUT replaced the whole user row
         );
 
         if (!result.ok) {
@@ -235,7 +224,7 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
       if (action === 'update_credits' && userId && credits !== undefined) {
         const result = await vibeServiceRequest<any>(
           `/v1/collections/vibe_app/tables/users/${userId}`,
-          { method: 'PUT', body: { credits } }
+          { method: 'PATCH', body: { credits } } // PAY-2041: merge one field; PUT replaced the whole user row
         );
 
         if (!result.ok) {

package/src/api-handlers/admin/vibe-data.ts

@@ -248,6 +248,11 @@ export function createGetRecordHandler(config: AdminVibeHandlerConfig) {
 /**
  * PUT /api/admin/vibe/data/[collection]/[table]/[id]
  * Update record (admin access)
+ *
+ * PAY-2041: this is deliberately a REPLACE. An editor save sends the whole record, and Core PUT sets the
+ * document data to the body, so a field the admin removed stays removed. Do not switch it to PATCH: a merge
+ * could never delete a key. Callers that hold only some fields (VibeTable.update, generic update, the
+ * users tier/credits writes) use PATCH instead. Ruled by BAPert 75440 (NightHawk 75437, Scout 75439 agree).
  */
 export function createUpdateRecordHandler(config: AdminVibeHandlerConfig) {
   return async function PUT(

package/src/vibe/client.ts

@@ -491,7 +491,8 @@ export class VibeTableDelegate<T extends VibeTableName> {
    */
   async update(options: UpdateOptions<VibeTableType<T>>): Promise<VibeTableType<T>> {
     const endpoint = this.tableEndpoint(options.where.id);
-    const response = await this.client.request<VibeDocumentWrapper>(endpoint, 'PUT', options.data);
+    // PAY-2041: PATCH, not PUT. Core PUT REPLACES the document (UpdateAsync SET data = body), and `data` here is Partial, so PUT erased every field not named. PATCH merges (DocumentsController.Patch).
+    const response = await this.client.request<VibeDocumentWrapper>(endpoint, 'PATCH', options.data);
     return this.requireRow(response.data, 'update');
   }
 
@@ -693,7 +694,7 @@ export class VibeClient {
    */
   private async requestViaProxy<T>(
     endpoint: string,
-    method: 'GET' | 'POST' | 'PUT' | 'DELETE',
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
     body?: unknown,
     authToken?: string
   ): Promise<VibeResponse<T>> {
@@ -788,7 +789,7 @@ export class VibeClient {
    */
   async request<T>(
     urlOrPath: string,
-    method: 'GET' | 'POST' | 'PUT' | 'DELETE',
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
     body?: unknown,
     authToken?: string
   ): Promise<VibeResponse<T>> {

package/src/vibe/filters.ts

@@ -0,0 +1,52 @@
+/**
+ * PAY-1810: the ONE place the package builds Vibe /query filters and orderBy, in the shapes Core's VibeQueryBuilder accepts.
+ *
+ * Core accepts exactly three filter forms (PayEz.Vibe.Public.Api VibeQueryModels / VibeQueryBuilder):
+ *   standard  { field: { op: value } } with AND / OR arrays
+ *   flat      { field, operator, value }
+ *   compound  { operator: 'and' | 'or', filters: [ ...nodes ] }        <- the key is `filters`, NOT `conditions`
+ * What goes wrong with the shapes this module replaces:
+ *   - { operator, conditions }  has no `filters` key, so Core reads `operator` / `conditions` as COLUMN names and returns ZERO rows
+ *     (a broken search; for revoke-all, "revoked 0 sessions" reported as success).
+ *   - operator 'like' is not a Core operator; in a flat filter it is DROPPED and the query returns ALL rows. Core's substring operator is
+ *     `contains` (ILIKE, case-insensitive); `ilike` is case-insensitive EQUALS.
+ *   - orderBy must be a { field: 'asc' | 'desc' } map (Core's model is Dictionary<string,string>); a bare string is rejected or ignored, never honoured.
+ */
+
+export type VibeOperator = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'startsWith' | 'endsWith' | 'ilike' | 'in' | 'notIn';
+
+export interface VibeFlatFilter {
+  field: string;
+  operator: VibeOperator;
+  value: unknown;
+}
+export interface VibeCompoundFilter {
+  operator: 'and' | 'or';
+  filters: VibeFilter[];
+}
+export type VibeFilter = VibeFlatFilter | VibeCompoundFilter;
+
+export const eq = (field: string, value: unknown): VibeFlatFilter => ({ field, operator: 'eq', value });
+export const gte = (field: string, value: unknown): VibeFlatFilter => ({ field, operator: 'gte', value });
+export const lte = (field: string, value: unknown): VibeFlatFilter => ({ field, operator: 'lte', value });
+/** Case-insensitive substring (Core `contains` = ILIKE). The value is the bare text: no % wildcards. */
+export const contains = (field: string, value: string): VibeFlatFilter => ({ field, operator: 'contains', value });
+
+/** AND of the given nodes: none -> undefined (no filter), one -> that node, several -> a compound with `filters`. */
+export function allOf(nodes: Array<VibeFilter | undefined | null>): VibeFilter | undefined {
+  const f = nodes.filter((n): n is VibeFilter => !!n);
+  if (f.length === 0) return undefined;
+  return f.length === 1 ? f[0] : { operator: 'and', filters: f };
+}
+
+/** OR of the given nodes: none -> undefined, one -> that node, several -> a compound with `filters`. */
+export function anyOf(nodes: Array<VibeFilter | undefined | null>): VibeFilter | undefined {
+  const f = nodes.filter((n): n is VibeFilter => !!n);
+  if (f.length === 0) return undefined;
+  return f.length === 1 ? f[0] : { operator: 'or', filters: f };
+}
+
+/** orderBy as Core binds it. */
+export function orderByMap(field: string, direction: 'asc' | 'desc' = 'desc'): Record<string, 'asc' | 'desc'> {
+  return { [field]: direction };
+}

package/src/vibe/generic.ts

@@ -224,7 +224,8 @@ export class GenericTableDelegate<T extends Record<string, unknown> = Record<str
   async update(options: { where: { id: number }; data: Partial<T> }): Promise<T & { _vibe_doc_id?: number }> {
     const path = vibeTablePath(this.collection, this.tableName, options.where.id);
     const url = `${this.client.getBaseUrl()}${path}`;
-    const response = await this.client.request<VibeDocumentWrapper>(url, 'PUT', options.data);
+    // PAY-2041: PATCH merges; PUT would replace the whole document with this Partial.
+    const response = await this.client.request<VibeDocumentWrapper>(url, 'PATCH', options.data);
     const unwrapped = unwrapVibeDocument<T>(response.data);
     if (!unwrapped) {
       throw new VibeServiceError('Failed to parse updated document');