@payez/next-mvp 4.4.6 → 4.4.7

package/dist/vibe/errors.d.ts

@@ -81,3 +81,20 @@ export declare class VibeConflictError extends VibeError {
 export declare class VibeServiceError extends VibeError {
     constructor(message?: string, details?: Record<string, unknown>);
 }
+/**
+ * PAY-1767 (NightHawk 64534): thrown when a NON-ATOMIC `createMany` fails part-way. It CARRIES what was
+ * already created, so the caller can reconcile instead of guessing whether k-1 rows persisted. This is the
+ * point of the class: a partial write whose extent is invisible is the hazard, not the partial write itself.
+ */
+export declare class VibeBatchCreateError extends VibeError {
+    /** How many records were created before the failure. */
+    readonly createdCount: number;
+    /** The document ids that were created before the failure. */
+    readonly createdIds: Array<number | string>;
+    constructor(message: string, details: {
+        createdCount: number;
+        createdIds: Array<number | string>;
+        failedIndex: number;
+        total: number;
+    }, cause?: unknown);
+}

package/dist/vibe/errors.js

@@ -21,7 +21,7 @@
  * =============================================================================
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VibeServiceError = exports.VibeConflictError = exports.VibeRateLimitError = exports.VibeAuthError = exports.VibeValidationError = exports.VibeNotFoundError = exports.VibeError = void 0;
+exports.VibeBatchCreateError = exports.VibeServiceError = exports.VibeConflictError = exports.VibeRateLimitError = exports.VibeAuthError = exports.VibeValidationError = exports.VibeNotFoundError = exports.VibeError = void 0;
 /**
  * Base error class for all Vibe API errors
  */
@@ -144,3 +144,23 @@ class VibeServiceError extends VibeError {
     }
 }
 exports.VibeServiceError = VibeServiceError;
+/**
+ * PAY-1767 (NightHawk 64534): thrown when a NON-ATOMIC `createMany` fails part-way. It CARRIES what was
+ * already created, so the caller can reconcile instead of guessing whether k-1 rows persisted. This is the
+ * point of the class: a partial write whose extent is invisible is the hazard, not the partial write itself.
+ */
+class VibeBatchCreateError extends VibeError {
+    /** How many records were created before the failure. */
+    createdCount;
+    /** The document ids that were created before the failure. */
+    createdIds;
+    constructor(message, details, cause) {
+        super(message, 'BATCH_PARTIAL_FAILURE', 500, details);
+        this.name = 'VibeBatchCreateError';
+        this.createdCount = details.createdCount;
+        this.createdIds = details.createdIds;
+        if (cause !== undefined)
+            this.cause = cause;
+    }
+}
+exports.VibeBatchCreateError = VibeBatchCreateError;

package/dist/vibe/generic.d.ts

@@ -52,55 +52,8 @@ export declare function vibeQueryPath(collection: string, table: string): string
  * @returns Grid API path string
  */
 export declare function vibeGridPath(collection: string, table: string): string;
-/**
- * Vibe document wrapper structure.
- * Vibe stores actual table data as JSON string in the 'data' field.
- */
-export interface VibeDocumentWrapper {
-    document_id: number;
-    client_id?: number;
-    user_id?: number;
-    collection?: string;
-    table_name?: string;
-    data: string | Record<string, unknown>;
-    collection_schema_id?: number;
-    created_at?: string;
-    created_by?: number;
-    updated_at?: string | null;
-    updated_by?: number | null;
-    deleted_at?: string | null;
-}
-/**
- * Unwrap a Vibe document response.
- * Vibe returns documents with a wrapper where actual data is a JSON string.
- *
- * @param doc - Raw Vibe document (wrapper format)
- * @returns Unwrapped document with schema fields only.
- *          Storage-layer document_id preserved as _vibe_doc_id for update/delete paths.
- *          See PayEz-Core/docs/vibe-primary-key-standard.md
- *
- * @example
- * const raw = { document_id: 123, data: '{"user_id":15,"name":"John","email":"john@example.com"}' };
- * const unwrapped = unwrapVibeDocument(raw);
- * // => { user_id: 15, name: 'John', email: 'john@example.com', _vibe_doc_id: 123 }
- */
-export declare function unwrapVibeDocument<T extends Record<string, unknown> = Record<string, unknown>>(doc: VibeDocumentWrapper | Record<string, unknown> | null | undefined): (T & {
-    _vibe_doc_id?: number;
-}) | null;
-/**
- * Extract and unwrap array of documents from Vibe response.
- *
- * @param responseData - Raw Vibe API response
- * @returns Array of unwrapped documents
- *
- * @example
- * const response = await fetch('/api/vibe/data/ideal_resume/resumes');
- * const data = await response.json();
- * const resumes = extractVibeDocuments(data);
- */
-export declare function extractVibeDocuments<T extends Record<string, unknown> = Record<string, unknown>>(responseData: unknown): Array<T & {
-    _vibe_doc_id?: number;
-}>;
+export { unwrapVibeDocument, extractVibeDocuments } from './document-unwrap';
+export type { VibeDocumentWrapper } from './document-unwrap';
 /**
  * Generic table delegate for dynamic collection/table access.
  * Provides Prisma-like methods for any table.

package/dist/vibe/generic.js

@@ -24,12 +24,10 @@
  * =============================================================================
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GenericCollection = exports.GenericTableDelegate = void 0;
+exports.GenericCollection = exports.GenericTableDelegate = exports.extractVibeDocuments = exports.unwrapVibeDocument = void 0;
 exports.vibeTablePath = vibeTablePath;
 exports.vibeQueryPath = vibeQueryPath;
 exports.vibeGridPath = vibeGridPath;
-exports.unwrapVibeDocument = unwrapVibeDocument;
-exports.extractVibeDocuments = extractVibeDocuments;
 exports.vibeCollection = vibeCollection;
 exports.vibeTable = vibeTable;
 const client_1 = require("./client");
@@ -73,76 +71,17 @@ function vibeQueryPath(collection, table) {
 function vibeGridPath(collection, table) {
     return `/v1/collections/${collection}/tables/${table}/grid`;
 }
-/**
- * Unwrap a Vibe document response.
- * Vibe returns documents with a wrapper where actual data is a JSON string.
- *
- * @param doc - Raw Vibe document (wrapper format)
- * @returns Unwrapped document with schema fields only.
- *          Storage-layer document_id preserved as _vibe_doc_id for update/delete paths.
- *          See PayEz-Core/docs/vibe-primary-key-standard.md
- *
- * @example
- * const raw = { document_id: 123, data: '{"user_id":15,"name":"John","email":"john@example.com"}' };
- * const unwrapped = unwrapVibeDocument(raw);
- * // => { user_id: 15, name: 'John', email: 'john@example.com', _vibe_doc_id: 123 }
- */
-function unwrapVibeDocument(doc) {
-    if (!doc)
-        return null;
-    // Handle case where doc is already unwrapped (has schema fields directly)
-    if (!('document_id' in doc) && !('data' in doc)) {
-        return doc;
-    }
-    const wrapper = doc;
-    let parsedData = {};
-    if (typeof wrapper.data === 'string') {
-        try {
-            parsedData = JSON.parse(wrapper.data);
-        }
-        catch {
-            console.warn('[vibe-generic] Failed to parse document data JSON:', wrapper.data);
-            parsedData = {};
-        }
-    }
-    else if (typeof wrapper.data === 'object' && wrapper.data !== null) {
-        parsedData = wrapper.data;
-    }
-    // Preserve document_id as _vibe_doc_id for Vibe API update/delete paths only
-    const documentId = wrapper.document_id ?? doc.document_id;
-    if (documentId != null) {
-        parsedData._vibe_doc_id = documentId;
-    }
-    return parsedData;
-}
-/**
- * Extract and unwrap array of documents from Vibe response.
- *
- * @param responseData - Raw Vibe API response
- * @returns Array of unwrapped documents
- *
- * @example
- * const response = await fetch('/api/vibe/data/ideal_resume/resumes');
- * const data = await response.json();
- * const resumes = extractVibeDocuments(data);
- */
-function extractVibeDocuments(responseData) {
-    if (!responseData || typeof responseData !== 'object') {
-        return [];
-    }
-    const data = responseData;
-    // Try common response shapes
-    const docs = data.data ??
-        data.items ??
-        data.documents ??
-        (Array.isArray(responseData) ? responseData : null);
-    if (!Array.isArray(docs)) {
-        return [];
-    }
-    return docs
-        .map((doc) => unwrapVibeDocument(doc))
-        .filter((d) => d !== null);
-}
+// -----------------------------------------------------------------------------
+// DOCUMENT UNWRAPPING
+//
+// PAY-1767: the wrapper type and the two helpers MOVED to ./document-unwrap, so the typed client
+// (client.ts) can unwrap reads without importing this module (which imports client.ts). Re-exported
+// here so every existing `from './generic'` / package import keeps working unchanged.
+// -----------------------------------------------------------------------------
+var document_unwrap_1 = require("./document-unwrap");
+Object.defineProperty(exports, "unwrapVibeDocument", { enumerable: true, get: function () { return document_unwrap_1.unwrapVibeDocument; } });
+Object.defineProperty(exports, "extractVibeDocuments", { enumerable: true, get: function () { return document_unwrap_1.extractVibeDocuments; } });
+const document_unwrap_2 = require("./document-unwrap");
 // -----------------------------------------------------------------------------
 // GENERIC TABLE DELEGATE
 // -----------------------------------------------------------------------------
@@ -209,7 +148,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName);
         const url = `${this.client.getBaseUrl()}${path}${queryString ? `?${queryString}` : ''}`;
         const response = await this.client.request(url, 'GET');
-        const unwrapped = extractVibeDocuments(response);
+        const unwrapped = (0, document_unwrap_2.extractVibeDocuments)(response);
         return {
             data: unwrapped,
             meta: response.meta || { total: unwrapped.length, limit: options?.take || 50, offset: options?.skip || 0 },
@@ -223,7 +162,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName, options.where.id);
         const url = `${this.client.getBaseUrl()}${path}`;
         const response = await this.client.request(url, 'GET');
-        const unwrapped = unwrapVibeDocument(response.data);
+        const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeNotFoundError(`Document ${options.where.id} not found in ${this.collection}/${this.tableName}`, 'NOT_FOUND', { collection: this.collection, table: this.tableName, id: options.where.id });
         }
@@ -257,7 +196,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName);
         const url = `${this.client.getBaseUrl()}${path}`;
         const response = await this.client.request(url, 'POST', options.data);
-        const unwrapped = unwrapVibeDocument(response.data);
+        const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeServiceError('Failed to parse created document');
         }
@@ -270,7 +209,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName, options.where.id);
         const url = `${this.client.getBaseUrl()}${path}`;
         const response = await this.client.request(url, 'PUT', options.data);
-        const unwrapped = unwrapVibeDocument(response.data);
+        const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeServiceError('Failed to parse updated document');
         }
@@ -283,7 +222,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName, options.where.id);
         const url = `${this.client.getBaseUrl()}${path}`;
         const response = await this.client.request(url, 'DELETE');
-        const unwrapped = unwrapVibeDocument(response.data);
+        const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeServiceError('Failed to parse deleted document');
         }

package/dist/vibe/index.d.ts

@@ -16,7 +16,7 @@ export { vibe, createVibeClient, VibeClient, VibeTableDelegate } from './client'
 export type { VibeClientConfig, FindManyOptions, FindUniqueOptions, CreateOptions, UpdateOptions, DeleteOptions, CountOptions, FindManyResult, WhereClause, OrderByClause, FilterOperator, FilterValue, OrderDirection, } from './client';
 export type { VibeAuditFields, VibeMeta, VibeResponse, VibeErrorResponse, VibeTableTypes, VibeTableName, VibeTableType, IVibeUser, IVibeLoginSession, SessionStatus, IVibeProfile, IVibeSetting, IVibeFile, IVibeNotification, NotificationType, IVibeActivityLog, ActivityAction, IVibeTag, IVibeComment, IVibeSiteLog, LogLevel, } from './types';
 export { VibeUser, VibeLoginSession, VibeProfile, VibeSetting, VibeFile, VibeNotification, VibeActivityLog, VibeTag, VibeComment, VibeSiteLog, } from './types';
-export { VibeError, VibeNotFoundError, VibeValidationError, VibeAuthError, VibeRateLimitError, VibeConflictError, VibeServiceError, } from './errors';
+export { VibeError, VibeNotFoundError, VibeValidationError, VibeAuthError, VibeRateLimitError, VibeConflictError, VibeServiceError, VibeBatchCreateError, } from './errors';
 export { createLoginSession, getUserSessions, getAllSessions, getSessionById, revokeSession, revokeAllUserSessions, updateSessionActivity, isSessionValid, checkSessionRevocation, getSessionStats, } from './sessions';
 export type { CreateSessionInput, SessionQueryOptions } from './sessions';
 export { vibeCollection, vibeTable, vibeTablePath, vibeQueryPath, vibeGridPath, unwrapVibeDocument, extractVibeDocuments, GenericCollection, GenericTableDelegate, } from './generic';

package/dist/vibe/index.js

@@ -14,7 +14,7 @@
  * =============================================================================
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateBackendHmacSignature = exports.hasEnterpriseAuthHeaders = exports.validateEnterpriseAuth = exports.GenericTableDelegate = exports.GenericCollection = exports.extractVibeDocuments = exports.unwrapVibeDocument = exports.vibeGridPath = exports.vibeQueryPath = exports.vibeTablePath = exports.vibeTable = exports.vibeCollection = exports.getSessionStats = exports.checkSessionRevocation = exports.isSessionValid = exports.updateSessionActivity = exports.revokeAllUserSessions = exports.revokeSession = exports.getSessionById = exports.getAllSessions = exports.getUserSessions = exports.createLoginSession = exports.VibeServiceError = exports.VibeConflictError = exports.VibeRateLimitError = exports.VibeAuthError = exports.VibeValidationError = exports.VibeNotFoundError = exports.VibeError = exports.VibeSiteLog = exports.VibeComment = exports.VibeTag = exports.VibeActivityLog = exports.VibeNotification = exports.VibeFile = exports.VibeSetting = exports.VibeProfile = exports.VibeLoginSession = exports.VibeUser = exports.VibeTableDelegate = exports.VibeClient = exports.createVibeClient = exports.vibe = void 0;
+exports.generateBackendHmacSignature = exports.hasEnterpriseAuthHeaders = exports.validateEnterpriseAuth = exports.GenericTableDelegate = exports.GenericCollection = exports.extractVibeDocuments = exports.unwrapVibeDocument = exports.vibeGridPath = exports.vibeQueryPath = exports.vibeTablePath = exports.vibeTable = exports.vibeCollection = exports.getSessionStats = exports.checkSessionRevocation = exports.isSessionValid = exports.updateSessionActivity = exports.revokeAllUserSessions = exports.revokeSession = exports.getSessionById = exports.getAllSessions = exports.getUserSessions = exports.createLoginSession = exports.VibeBatchCreateError = exports.VibeServiceError = exports.VibeConflictError = exports.VibeRateLimitError = exports.VibeAuthError = exports.VibeValidationError = exports.VibeNotFoundError = exports.VibeError = exports.VibeSiteLog = exports.VibeComment = exports.VibeTag = exports.VibeActivityLog = exports.VibeNotification = exports.VibeFile = exports.VibeSetting = exports.VibeProfile = exports.VibeLoginSession = exports.VibeUser = exports.VibeTableDelegate = exports.VibeClient = exports.createVibeClient = exports.vibe = void 0;
 // Client exports
 var client_1 = require("./client");
 Object.defineProperty(exports, "vibe", { enumerable: true, get: function () { return client_1.vibe; } });
@@ -42,6 +42,7 @@ Object.defineProperty(exports, "VibeAuthError", { enumerable: true, get: functio
 Object.defineProperty(exports, "VibeRateLimitError", { enumerable: true, get: function () { return errors_1.VibeRateLimitError; } });
 Object.defineProperty(exports, "VibeConflictError", { enumerable: true, get: function () { return errors_1.VibeConflictError; } });
 Object.defineProperty(exports, "VibeServiceError", { enumerable: true, get: function () { return errors_1.VibeServiceError; } });
+Object.defineProperty(exports, "VibeBatchCreateError", { enumerable: true, get: function () { return errors_1.VibeBatchCreateError; } });
 // Session management exports
 var sessions_1 = require("./sessions");
 Object.defineProperty(exports, "createLoginSession", { enumerable: true, get: function () { return sessions_1.createLoginSession; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.4.6",
+  "version": "4.4.7",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -64,6 +64,11 @@
       "require": "./dist/auth/better-auth.js",
       "default": "./dist/auth/better-auth.js"
     },
+    "./auth/safe-callback": {
+      "types": "./dist/auth/safe-callback.d.ts",
+      "require": "./dist/auth/safe-callback.js",
+      "default": "./dist/auth/safe-callback.js"
+    },
     "./components/auth/FederatedAuthSection": {
       "types": "./dist/components/auth/FederatedAuthSection.d.ts",
       "require": "./dist/components/auth/FederatedAuthSection.js",
@@ -179,6 +184,11 @@
       "require": "./dist/lib/idp-client-config.js",
       "default": "./dist/lib/idp-client-config.js"
     },
+    "./lib/never-in-response": {
+      "types": "./dist/lib/never-in-response.d.ts",
+      "require": "./dist/lib/never-in-response.js",
+      "default": "./dist/lib/never-in-response.js"
+    },
     "./hooks/useAuthSettings": {
       "types": "./dist/hooks/useAuthSettings.d.ts",
       "require": "./dist/hooks/useAuthSettings.js",
@@ -944,7 +954,7 @@
     "@azure/identity": "^4.0.1",
     "@azure/keyvault-secrets": "^4.7.0",
     "@upstash/redis": "^1.35.6",
-    "better-auth": "1.5.6",
+    "better-auth": "1.6.33",
     "ioredis": "^5.3.2",
     "jose": "^5.2.4",
     "jsonwebtoken": "^9.0.2",

package/src/api-handlers/account/change-password.ts

@@ -9,6 +9,28 @@ interface ChangePasswordRequest {
 }
 
 import { nanoid } from 'nanoid';
+
+/**
+ * PAY-1596: the failure code comes from the IdP's REAL envelope { success, error: { code, message, details } } - the handler
+ * used to read a top-level `error_code` the IdP never sends, so every refusal was CHANGE_PASSWORD_FAILED and "this account has
+ * no password" / "wrong current password" could not be told apart. Allowlisted: nothing but these codes ever leaves here.
+ *   - error.code NO_PASSWORD_SET / INVALID_CURRENT_PASSWORD (IdP PR 412) / VALIDATION_ERROR
+ *   - the pre-412 wrong-current shape: VALIDATION_ERROR + details.value[] { code: InvalidCurrentPassword, field_name: currentPassword }
+ *   - a legacy top-level error_code, for older IdPs
+ */
+const CHANGE_PASSWORD_CODES = new Set(['NO_PASSWORD_SET', 'INVALID_CURRENT_PASSWORD', 'VALIDATION_ERROR']);
+
+function changePasswordFailureCode(body: any): string {
+  const err = body && typeof body.error === 'object' && body.error ? body.error : null;
+  const code: string = typeof err?.code === 'string' ? err.code : typeof body?.error_code === 'string' ? body.error_code : '';
+  if (code === 'VALIDATION_ERROR' && Array.isArray(err?.details?.value)) {
+    const wrongCurrent = err.details.value.some(
+      (e: any) => e && typeof e === 'object' && (String(e.field_name ?? e.fieldName ?? '').toLowerCase() === 'currentpassword' || String(e.code ?? '').toLowerCase() === 'invalidcurrentpassword'),
+    );
+    if (wrongCurrent) return 'INVALID_CURRENT_PASSWORD';
+  }
+  return CHANGE_PASSWORD_CODES.has(code) ? code : 'CHANGE_PASSWORD_FAILED';
+}
 import { projectPasswordPolicyDetails } from '../../lib/safe-error-response';
 
 // ...
@@ -102,22 +124,25 @@ export async function POST(req: NextRequest) {
       // Extract error message from IDP response
       let errorMessage = 'Failed to change password';
 
+      const failureCode = changePasswordFailureCode(responseData);
+      // The real envelope nests details under `error`; older IdPs put them at the top level.
+      const idpDetails = (responseData.error && typeof responseData.error === 'object' ? responseData.error.details : undefined) ?? responseData.details;
       if (responseData.message) {
         errorMessage = responseData.message;
-      } else if (responseData.details?.value && Array.isArray(responseData.details.value) && responseData.details.value.length > 0) {
-        errorMessage = responseData.details.value[0].message || errorMessage;
-      } else if (responseData.details?.message) {
-        errorMessage = responseData.details.message;
+      } else if (idpDetails?.value && Array.isArray(idpDetails.value) && idpDetails.value.length > 0) {
+        errorMessage = idpDetails.value[0].message || errorMessage;
+      } else if (idpDetails?.message) {
+        errorMessage = idpDetails.message;
       }
 
       return NextResponse.json(
         {
           success: false,
           message: errorMessage,
-          error_code: responseData.error_code || 'CHANGE_PASSWORD_FAILED',
+          error_code: failureCode,
           request_id: requestId,
           // PAY-1438: only the password-policy messages the security pages display, never the raw envelope.
-          details: projectPasswordPolicyDetails(responseData.details),
+          details: projectPasswordPolicyDetails(idpDetails),
         },
         { status: idpResponse.status }
       );

package/src/auth/better-auth.ts

@@ -820,6 +820,19 @@ export function createBetterAuthInstance(
       },
     },
 
+    // PAY-1781 B: KEEP OAUTH STATE IN THE ENCRYPTED COOKIE, as it was on better-auth 1.5.6.
+    // 1.5.6 resolved the default as `options.database ? 'database' : 'cookie'` - we have no
+    // database, so: cookie. 1.6.13+ resolves it as `(database || secondaryStorage) ? 'database'
+    // : 'cookie'`, and we DO have secondaryStorage, so the upgrade alone would silently move every
+    // OAuth state record into Redis through the adapter above (its enrichment read-modify-write
+    // and key handling were built for session records, not state). Pinned so the upgrade changes
+    // the version, not the design. The cookie branch is where GHSA-wxw3-q3m9-c3jr lived; 1.6.2+
+    // compares the returned `state` with the nonce sealed in the cookie, and our provider is also
+    // pkce:true, which the advisory required to be false. Test: oauth-state-strategy-cookie.
+    account: {
+      storeStateStrategy: 'cookie',
+    },
+
     // Cookie prefix must match slim-middleware expectations ({slug}.session-token)
     advanced: {
       cookiePrefix: appSlug,
@@ -1331,12 +1344,79 @@ export async function storeIdpTokensInSession(
   }
 }
 
+/**
+ * The `?error=` code the login page receives when an OAuth sign-in is ABORTED because the IdP exchange did not
+ * store tokens (PAY-1733). Hosts map it to ONE neutral line; the card's words are "That sign-in didn't work.
+ * Try again or use another method." The cause stays in the server log, never on the page.
+ */
+export const OAUTH_SIGN_IN_FAILED_ERROR = 'OAUTH_SIGN_IN_FAILED';
+
+/**
+ * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
+ * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only
+ * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
+ */
+export function expireSetCookies(setCookies: readonly string[]): string[] {
+  const out: string[] = [];
+  for (const sc of setCookies) {
+    const [pair, ...attrs] = sc.split(';').map((s) => s.trim());
+    const eq = pair.indexOf('=');
+    const name = eq > 0 ? pair.slice(0, eq) : '';
+    if (!name) continue;
+    const kept = attrs.filter((a) => /^(path|domain|secure|samesite|httponly)\b/i.test(a));
+    out.push([`${name}=`, ...kept, 'Max-Age=0'].join('; '));
+  }
+  return out;
+}
+
+/**
+ * PAY-1733 (Jon, live on :4797): ABORT an OAuth sign-in whose IdP exchange did not store tokens.
+ *
+ * Before this, a failed exchange was a console.error and the user kept the Better Auth session the callback had
+ * just created: signed in, holding NO IdP tokens. The host then routed that session to 2FA, which painted the
+ * user's email and failed every call - a red "sign in again" screen about an account the app could no longer
+ * authenticate. The IdP's 401 was CORRECT (it fail-closes unverified assertions); keeping the session was the bug.
+ *
+ * So: no session without IdP tokens. The Better Auth session is destroyed (its own signOut, best effort, then the
+ * `ba:<slug>:<token>` record directly - that record is what makes it resolvable), every cookie the callback set is
+ * expired, and the user goes to the login page with OAUTH_SIGN_IN_FAILED. Relative Location, as for the state-error
+ * branch above (328439: an absolute URL built from request.url is a dead tab in a container).
+ */
+async function abortOAuthSignIn(
+  callbackResponse: Response,
+  sessionToken: string | null,
+  cookieHeader: string,
+  loginPath: string,
+): Promise<Response> {
+  const headers = new Headers();
+  if (sessionToken) {
+    try {
+      const auth = await getBetterAuthInstance();
+      const out = await auth?.api?.signOut?.({ headers: new Headers({ cookie: cookieHeader }), asResponse: true });
+      for (const sc of (out as Response | undefined)?.headers?.getSetCookie?.() ?? []) headers.append('set-cookie', sc);
+    } catch (err) {
+      console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', err instanceof Error ? err.message : String(err));
+    }
+    try {
+      const config = await getIDPClientConfig();
+      await getRedis().del(`ba:${config.clientSlug || getAppSlug()}:${sessionToken}`);
+    } catch (err) {
+      console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', tokenLogId(sessionToken), err instanceof Error ? err.message : String(err));
+    }
+  }
+  for (const sc of expireSetCookies(callbackResponse.headers.getSetCookie?.() ?? [])) headers.append('set-cookie', sc);
+  headers.set('location', `${loginPath}${loginPath.includes('?') ? '&' : '?'}error=${OAUTH_SIGN_IN_FAILED_ERROR}`);
+  console.warn('[BETTER_AUTH] OAuth sign-in ABORTED: the IdP exchange stored no tokens, so no session is kept (PAY-1733)', sessionToken ? tokenLogId(sessionToken) : '(no session)');
+  return new Response(null, { status: 302, headers });
+}
+
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
  * Wraps better-auth's GET handler with:
  * - OAuth state error recovery (redirects to login instead of error page)
- * - IDP token exchange after successful OAuth callback
+ * - IDP token exchange after successful OAuth callback - and, when it stores no tokens, the sign-in is ABORTED
+ *   (session destroyed, cookies expired, login page with OAUTH_SIGN_IN_FAILED; PAY-1733)
  *
  * Usage in host app:
  * ```ts
@@ -1408,24 +1488,28 @@ export function createAuthGetHandler(loginPath: string = '/account-auth/login')
       }
     }
 
-    // After successful OAuth callback: exchange Google identity for IDP tokens
+    // After the OAuth callback: exchange the provider identity for IDP tokens. If that does NOT store tokens - the
+    // IdP refused (401), no session was found, or anything threw - the sign-in is ABORTED (PAY-1733). A session is
+    // kept only when it holds IdP tokens.
     const url = new URL(request.url);
     if (url.pathname.includes('/callback/') && response.status === 302) {
+      const setCookies = response.headers.getSetCookie?.() || [];
+      const cookieHeader = setCookies
+        .map((c: string) => c.split(';')[0])
+        .join('; ');
+      let sessionToken: string | null = null;
+      let exchanged = false;
       try {
         const auth = await getBetterAuthInstance();
         if (auth?.api?.getSession) {
-          const setCookies = response.headers.getSetCookie?.() || [];
-          const cookieHeader = setCookies
-            .map((c: string) => c.split(';')[0])
-            .join('; ');
-
           const headers = new Headers();
           headers.set('cookie', cookieHeader);
 
           const session = await auth.api.getSession({ headers });
           if (session?.session?.token) {
+            sessionToken = session.session.token;
             console.log('[BETTER_AUTH] Got session token from callback:', tokenLogId(session.session.token), '| email:', session.user?.email);
-            await exchangeOAuthForIdpTokens(session.session.token);
+            exchanged = await exchangeOAuthForIdpTokens(session.session.token);
           } else {
             console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
           }
@@ -1433,6 +1517,7 @@ export function createAuthGetHandler(loginPath: string = '/account-auth/login')
       } catch (err: any) {
         console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
       }
+      if (!exchanged) return abortOAuthSignIn(response, sessionToken, cookieHeader, loginPath);
     }
 
     return response;

package/src/config/env.ts

@@ -29,8 +29,6 @@ export const API_ENDPOINTS = {
     profile: '/api/account/profile',
     updateProfile: '/api/account/profile',
     maskedInfo: '/api/account/masked-info',
-    sendResetCode: '/api/account/send-reset-code',
-    verifyResetCode: '/api/account/verify-reset-code',
     resetPassword: '/api/account/reset-password',
     changePassword: '/api/account/change-password',
     validatePassword: '/api/account/validate-password'

package/src/index.ts

@@ -23,6 +23,10 @@ export type { AuthConfig } from './types/auth';
 // Route configuration (client-safe)
 export { makeAuthDecision } from './auth/auth-decision';
 export { isUnauthenticatedRoute, configurePublicRoutes, getRouteConfig } from './auth/route-config';
+
+// The ONE callback-target guard (N7 / PAY-1989): apps import this instead of
+// copying it. Exposed from the main index AND as the subpath ./auth/safe-callback.
+export { safeCallbackPath, isSafeCallbackPath, resolveCallbackDestination, DEFAULT_CALLBACK } from './auth/safe-callback';
 export { createMvpMiddleware } from './middleware/create-middleware';
 
 // Account Components

package/src/lib/idp-client-config.ts

@@ -42,6 +42,7 @@
 
 import 'server-only';
 import { createHash, randomUUID } from 'crypto';
+import { markNeverInResponse } from './never-in-response';
 // REDIS IS IMPORTED LAZILY, AND THAT IS LOAD-BEARING.
 // A module-scope `import redis from './redis'` drags ioredis into EVERY bundle that
 // touches this file - including instrumentation.ts. Next compiles the instrumentation
@@ -211,6 +212,10 @@ function resolveAuthSecret(fromConfig: string | undefined): { value: string; sou
 function applyEnvSecrets(config: IDPClientConfig): IDPClientConfig {
     const auth = resolveAuthSecret(config.authSecret);
     logSecretSource('authSecret', auth.source);
+    // PAY-1529: every secret this module resolves is registered as never-in-response HERE, the one place
+    // both fetch paths and the Redis read pass through, so the runtime backstop knows the value whichever
+    // handler later tries to serialize it.
+    markNeverInResponse(auth.value);
     return {
         ...config,
         authSecret: auth.value,
@@ -219,7 +224,9 @@ function applyEnvSecrets(config: IDPClientConfig): IDPClientConfig {
             const fromEnv = process.env[envVar];
             const source: SecretSource = fromEnv ? `env:${envVar}` : p.clientSecret ? 'idp-config' : 'none';
             logSecretSource(`${p.provider} clientSecret`, source);
-            return { ...p, clientSecret: fromEnv || p.clientSecret };
+            const clientSecret = fromEnv || p.clientSecret;
+            markNeverInResponse(clientSecret);
+            return { ...p, clientSecret };
         }),
     };
 }