@payez/next-mvp 4.4.5 → 4.4.7

package/dist/api-handlers/mfa/totp-verify.d.ts

@@ -28,22 +28,4 @@
  * @package @payez/next-mvp
  */
 import { NextRequest, NextResponse } from 'next/server';
-export declare function POST(req: NextRequest): Promise<NextResponse<{
-    success: boolean;
-    error: string;
-    code: string;
-}> | NextResponse<{
-    success: boolean;
-    error: any;
-    code: any;
-    meta: {
-        attemptedRefresh: boolean;
-    };
-}> | NextResponse<{
-    message: any;
-    requiresChallenge?: boolean | undefined;
-    nextStep?: "mfa_verify" | undefined;
-    success: boolean;
-    verificationSuccessful: boolean;
-    twoFactorSessionVerified: boolean;
-}>>;
+export declare function POST(req: NextRequest): Promise<NextResponse<unknown>>;

package/dist/api-handlers/mfa/totp-verify.js

@@ -36,6 +36,7 @@ const env_1 = require("../../config/env");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
+const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
 async function POST(req) {
     try {
         const body = await req.json();
@@ -55,12 +56,9 @@ async function POST(req) {
             body: JSON.stringify({ code }),
         });
         if (!result.ok) {
-            return server_1.NextResponse.json({
-                success: false,
-                error: result.json?.message || 'Verification failed',
-                code: result.json?.code || 'IDP_ERROR',
-                meta: { attemptedRefresh: result.attemptedRefresh },
-            }, { status: result.status });
+            // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
+            // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
+            return (0, two_factor_verify_failure_1.twoFactorVerifyFailure)(result, 'totp');
         }
         // Unwrap IDP envelope { success, data }
         const unwrappedData = result.json?.data || result.json;

package/dist/api-handlers/passkeys/list.js

@@ -4,6 +4,7 @@ exports.GET = GET;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * List the signed-in user's passkeys (GET /api/Passkeys, user JWT).
  * Probe-verified live 2026-08-01 (anon -> 401 = routed).
@@ -15,7 +16,7 @@ async function GET(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/passkeys/manage.js

@@ -5,6 +5,7 @@ exports.DELETE = DELETE;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Manage ONE passkey (PATCH rename / DELETE revoke, /api/Passkeys/{id},
  * user JWT). The id arrives from the Next dynamic segment via the routes
@@ -14,7 +15,7 @@ function upstreamError(result) {
     return server_1.NextResponse.json({
         success: false,
         message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
         meta: { attemptedRefresh: result.attemptedRefresh },
     }, { status: result.status });
 }

package/dist/api-handlers/passkeys/register-options.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Begin the passkey REGISTRATION ceremony (POST /api/Passkeys/register/options,
  * user JWT — a credential change; the IDP may demand step-up, surfaced as-is).
@@ -27,7 +28,7 @@ async function POST(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/passkeys/register-verify.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Finish the passkey REGISTRATION ceremony (POST /api/Passkeys/register/verify,
  * user JWT). Body forwarded VERBATIM — it carries the enrolment handle plus the
@@ -26,7 +27,7 @@ async function POST(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/session/refresh-viability.d.ts

@@ -2,13 +2,15 @@ import { NextRequest, NextResponse } from 'next/server';
 export declare function GET(req: NextRequest): Promise<NextResponse<{
     canRefresh: boolean;
     reason: string;
-    sessionToken: null;
+    sessionTokenId: null;
 }> | NextResponse<{
     canRefresh: boolean;
     reason: string;
-    sessionToken: string;
+    sessionTokenId: string;
 }> | NextResponse<{
     canRefresh: boolean;
     reason: string;
     error: string;
+    code: string;
+    correlationId: string;
 }>>;

package/dist/api-handlers/session/refresh-viability.js

@@ -6,6 +6,7 @@ const session_store_1 = require("../../lib/session-store");
 const refresh_token_validator_1 = require("../../lib/refresh-token-validator");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const logger_1 = require("../../config/logger");
+const token_log_id_1 = require("../../lib/token-log-id");
 async function GET(req) {
     try {
         const sessionToken = req.nextUrl.searchParams.get('token');
@@ -16,24 +17,26 @@ async function GET(req) {
             finalSessionToken = (token?.sessionToken || token?.redisSessionId);
         }
         if (!finalSessionToken) {
-            return server_1.NextResponse.json({ canRefresh: false, reason: 'not_logged_in', sessionToken: null }, { status: 200 });
+            return server_1.NextResponse.json({ canRefresh: false, reason: 'not_logged_in', sessionTokenId: null }, { status: 200 });
         }
         const refreshInProgress = await (0, session_store_1.isRefreshInProgress)(finalSessionToken);
         if (refreshInProgress) {
             // Still need to get session data for twoFactorComplete even when refresh is in progress
             const sessionData = await (0, session_store_1.getSession)(finalSessionToken);
-            logger_1.logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: finalSessionToken.substring(0, 8) + '...' });
-            return server_1.NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? false }, { status: 200 });
+            logger_1.logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: (0, token_log_id_1.tokenLogId)(finalSessionToken) });
+            return server_1.NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionTokenId: (0, token_log_id_1.tokenLogId)(finalSessionToken), twoFactorComplete: sessionData?.mfaVerified ?? false }, { status: 200 });
         }
         const sessionData = await (0, session_store_1.getSession)(finalSessionToken);
         if (!sessionData) {
-            return server_1.NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionToken: finalSessionToken }, { status: 200 });
+            return server_1.NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionTokenId: (0, token_log_id_1.tokenLogId)(finalSessionToken) }, { status: 200 });
         }
         const viabilityCheck = (0, refresh_token_validator_1.checkRefreshViability)(sessionData);
-        return server_1.NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
+        return server_1.NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionTokenId: (0, token_log_id_1.tokenLogId)(finalSessionToken), twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
     }
     catch (error) {
-        logger_1.logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { error: error instanceof Error ? error.message : String(error) });
-        return server_1.NextResponse.json({ canRefresh: false, reason: 'check_error', error: error instanceof Error ? error.message : String(error) }, { status: 500 });
+        const correlationId = globalThis.crypto.randomUUID();
+        logger_1.logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { correlationId, error: error instanceof Error ? error.message : String(error) });
+        // PAY-1438: the exception text stays in the log above; the caller gets the id.
+        return server_1.NextResponse.json({ canRefresh: false, reason: 'check_error', error: 'Failed to check refresh viability', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
     }
 }

package/dist/api-handlers/session/viability.js

@@ -11,6 +11,7 @@ const session_store_1 = require("../../lib/session-store");
 const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const idp_client_config_1 = require("../../lib/idp-client-config");
+const token_log_id_1 = require("../../lib/token-log-id");
 async function GET(req) {
     try {
         // Ensure initialization is complete (auth signing secret resolved from IDP)
@@ -109,7 +110,7 @@ async function GET(req) {
                 const sessionMfaComplete = sessionData.mfaVerified ?? false;
                 const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
                 console.log('[VIABILITY] Session 2FA check:', {
-                    sessionToken: sessionToken.substring(0, 8) + '...',
+                    sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                     mfaVerified: sessionData.mfaVerified,
                     twoFactorComplete: sessionData.twoFactorComplete,
                     sessionMfaComplete,
@@ -125,7 +126,7 @@ async function GET(req) {
                 }
                 const response = {
                     authenticated: true,
-                    sessionToken, // Include token for middleware tracking
+                    sessionTokenId: (0, token_log_id_1.tokenLogId)(sessionToken), // PAY-1481: correlation id for middleware tracking, never the token
                     // 2FA fields - critical for middleware redirect logic
                     requires2FA, // From cached client config (client-wide setting)
                     twoFactorComplete: effectiveTwoFactorComplete, // From session, BUT respects MFA TTL
@@ -159,7 +160,7 @@ async function GET(req) {
             console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
             return server_1.NextResponse.json({
                 authenticated: false,
-                sessionToken // Include token to enable stale cookie detection
+                sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null // PAY-1481: presence + correlation for stale cookie detection
             });
         }
         // If there's no token at all, it's not authenticated

package/dist/api-handlers/test/force-expire.js

@@ -4,6 +4,8 @@ exports.POST = void 0;
 const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
+const safe_error_response_1 = require("../../lib/safe-error-response");
+const token_log_id_1 = require("../../lib/token-log-id");
 /**
  * ⚠️ DESTRUCTIVE TEST-ONLY HANDLER — DO NOT MOUNT IN PRODUCTION. ⚠️
  *
@@ -134,7 +136,7 @@ const POST = async (req) => {
         const prev = session.idpAccessTokenExpires || null;
         await (0, session_store_1.updateSession)(sessionToken, { idpAccessTokenExpires: forced });
         console.log('[TEST_EXPIRE] Forced access token expiry for session', {
-            sessionToken: sessionToken.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             previous: prev ? new Date(prev).toISOString() : null,
             newExpiry: new Date(forced).toISOString()
         });
@@ -147,8 +149,8 @@ const POST = async (req) => {
         });
     }
     catch (e) {
-        console.error('[TEST_EXPIRE] Error:', e);
-        return server_1.NextResponse.json({ success: false, error: e instanceof Error ? e.message : String(e) }, { status: 500 });
+        const correlationId = (0, safe_error_response_1.logExceptionWithCorrelation)('[TEST_EXPIRE] Error:', e);
+        return server_1.NextResponse.json({ success: false, error: 'Failed to force expiry', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
     }
 };
 exports.POST = POST;

package/dist/auth/auth-decision.js

@@ -8,6 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeAuthDecision = makeAuthDecision;
 const safe_callback_1 = require("./safe-callback");
+const token_log_id_1 = require("../lib/token-log-id");
 /**
  * Main decision function - pure, testable, deterministic
  */
@@ -99,7 +100,7 @@ function makeAuthDecision(context) {
             pathname,
             isLoginPage,
             sessionExists: sessionStatus.exists,
-            sessionToken: sessionPointer.sessionToken?.substring(0, 8) + '...'
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionPointer.sessionToken)
         });
         // Already on the 2FA page
         if (pathname === '/account-auth/verify-code') {

package/dist/auth/better-auth.d.ts

@@ -182,6 +182,9 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
             refreshCache: false;
         };
     };
+    account: {
+        storeStateStrategy: "cookie";
+    };
     advanced: {
         cookiePrefix: string;
         cookies: {
@@ -192,22 +195,25 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
     };
     plugins: [{
         id: "next-cookies";
+        version: string;
         hooks: {
             before: {
                 matcher(ctx: import("better-auth").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
             after: {
                 matcher(ctx: import("better-auth").HookEndpointContext): true;
-                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
         };
-    }, ...(import("better-auth").BetterAuthPlugin | {
+    }, ...({
         id: "magic-link";
+        version: string;
         endpoints: {
             signInMagicLink: import("better-auth").StrictEndpoint<"/sign-in/magic-link", {
                 method: "POST";
                 requireHeaders: true;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
                 body: import("better-auth").ZodObject<{
                     email: import("better-auth").ZodEmail;
                     name: import("better-auth").ZodOptional<import("better-auth").ZodString>;
@@ -215,7 +221,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     metadata: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     openapi: {
                         operationId: string;
@@ -249,8 +255,8 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
-                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>)[];
+                }, import("zod/v4/core").$strip>;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
                 requireHeaders: true;
                 metadata: {
                     openapi: {
@@ -289,6 +295,16 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     name: string;
                     image?: string | null | undefined;
                 };
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
             }>;
         };
         rateLimit: {
@@ -297,8 +313,9 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
             max: number;
         }[];
         options: MagicLinkOptions;
-    } | {
+    } | import("better-auth").BetterAuthPlugin | {
         id: "generic-oauth";
+        version: string;
         init: (ctx: import("better-auth").AuthContext) => {
             context: {
                 socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
@@ -316,7 +333,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     scopes: import("better-auth").ZodOptional<import("better-auth").ZodArray<import("better-auth").ZodString>>;
                     requestSignUp: import("better-auth").ZodOptional<import("better-auth").ZodBoolean>;
                     additionalData: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     openapi: {
                         description: string;
@@ -354,7 +371,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     error_description: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     state: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     iss: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     allowedMediaTypes: string[];
                     openapi: {
@@ -379,7 +396,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     };
                     scope: "server";
                 };
-            }, void>;
+            }, never>;
             oAuth2LinkAccount: import("better-auth").StrictEndpoint<"/oauth2/link", {
                 method: "POST";
                 body: import("better-auth").ZodObject<{
@@ -387,8 +404,8 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     callbackURL: import("better-auth").ZodString;
                     scopes: import("better-auth").ZodOptional<import("better-auth").ZodArray<import("better-auth").ZodString>>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
-                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                }, import("zod/v4/core").$strip>;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
                     session: {
                         session: Record<string, any> & {
                             id: string;
@@ -410,7 +427,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                             image?: string | null | undefined;
                         };
                     };
-                }>)[];
+                }>>[];
                 metadata: {
                     openapi: {
                         description: string;
@@ -476,6 +493,20 @@ export declare function __getBetterAuthInstance(): unknown;
  * cannot be applied retroactively.
  */
 export declare function configureBetterAuth(opts: CreateBetterAuthInstanceOptions): void;
+/**
+ * PAY-642 (card 338215): the init attempt no longer LATCHES A FAILURE.
+ *
+ * This used to be `state.initPromise ??= getIDPClientConfig(true).then(...)` with no .catch and no reset. One
+ * auth request against a cold process while the IdP was unreachable stored a rejected promise, and every later
+ * caller replayed it until the process restarted, even after the IdP recovered. This funnel backs every
+ * /api/auth/* route, the login GET handler and withAuth. server/auth.ts getAuthInstance() already used
+ * createSingleFlight for this exact bug; this sibling funnel was missed.
+ *
+ * Now the attempt runs through the same helper: concurrent callers share one attempt, a failure still rejects
+ * for every caller of THAT attempt (loud), the next call starts a fresh attempt, and a success is cached in
+ * state.cachedInstance as before. The flight lives on the globalThis state for the same reason the instance
+ * does (duplicated route chunks must share one init).
+ */
 export declare function getBetterAuthInstance(): Promise<any>;
 /**
  * Get flag-gated auth handler for Next.js route.
@@ -551,12 +582,25 @@ export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider
  *                      state what actually authenticated ('passkey', 'google').
  */
 export declare function storeIdpTokensInSession(sessionToken: string, idpTokenData: Record<string, unknown>, authProvider: string): Promise<boolean>;
+/**
+ * The `?error=` code the login page receives when an OAuth sign-in is ABORTED because the IdP exchange did not
+ * store tokens (PAY-1733). Hosts map it to ONE neutral line; the card's words are "That sign-in didn't work.
+ * Try again or use another method." The cause stays in the server log, never on the page.
+ */
+export declare const OAUTH_SIGN_IN_FAILED_ERROR = "OAUTH_SIGN_IN_FAILED";
+/**
+ * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
+ * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only
+ * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
+ */
+export declare function expireSetCookies(setCookies: readonly string[]): string[];
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
  * Wraps better-auth's GET handler with:
  * - OAuth state error recovery (redirects to login instead of error page)
- * - IDP token exchange after successful OAuth callback
+ * - IDP token exchange after successful OAuth callback - and, when it stores no tokens, the sign-in is ABORTED
+ *   (session destroyed, cookies expired, login page with OAUTH_SIGN_IN_FAILED; PAY-1733)
  *
  * Usage in host app:
  * ```ts