@payez/next-mvp 4.4.6 → 4.4.8

package/dist/vibe/errors.d.ts

@@ -81,3 +81,20 @@ export declare class VibeConflictError extends VibeError {
 export declare class VibeServiceError extends VibeError {
     constructor(message?: string, details?: Record<string, unknown>);
 }
+/**
+ * PAY-1767 (NightHawk 64534): thrown when a NON-ATOMIC `createMany` fails part-way. It CARRIES what was
+ * already created, so the caller can reconcile instead of guessing whether k-1 rows persisted. This is the
+ * point of the class: a partial write whose extent is invisible is the hazard, not the partial write itself.
+ */
+export declare class VibeBatchCreateError extends VibeError {
+    /** How many records were created before the failure. */
+    readonly createdCount: number;
+    /** The document ids that were created before the failure. */
+    readonly createdIds: Array<number | string>;
+    constructor(message: string, details: {
+        createdCount: number;
+        createdIds: Array<number | string>;
+        failedIndex: number;
+        total: number;
+    }, cause?: unknown);
+}

package/dist/vibe/errors.js

@@ -21,7 +21,7 @@
  * =============================================================================
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VibeServiceError = exports.VibeConflictError = exports.VibeRateLimitError = exports.VibeAuthError = exports.VibeValidationError = exports.VibeNotFoundError = exports.VibeError = void 0;
+exports.VibeBatchCreateError = exports.VibeServiceError = exports.VibeConflictError = exports.VibeRateLimitError = exports.VibeAuthError = exports.VibeValidationError = exports.VibeNotFoundError = exports.VibeError = void 0;
 /**
  * Base error class for all Vibe API errors
  */
@@ -144,3 +144,23 @@ class VibeServiceError extends VibeError {
     }
 }
 exports.VibeServiceError = VibeServiceError;
+/**
+ * PAY-1767 (NightHawk 64534): thrown when a NON-ATOMIC `createMany` fails part-way. It CARRIES what was
+ * already created, so the caller can reconcile instead of guessing whether k-1 rows persisted. This is the
+ * point of the class: a partial write whose extent is invisible is the hazard, not the partial write itself.
+ */
+class VibeBatchCreateError extends VibeError {
+    /** How many records were created before the failure. */
+    createdCount;
+    /** The document ids that were created before the failure. */
+    createdIds;
+    constructor(message, details, cause) {
+        super(message, 'BATCH_PARTIAL_FAILURE', 500, details);
+        this.name = 'VibeBatchCreateError';
+        this.createdCount = details.createdCount;
+        this.createdIds = details.createdIds;
+        if (cause !== undefined)
+            this.cause = cause;
+    }
+}
+exports.VibeBatchCreateError = VibeBatchCreateError;

package/dist/vibe/generic.d.ts

@@ -52,55 +52,8 @@ export declare function vibeQueryPath(collection: string, table: string): string
  * @returns Grid API path string
  */
 export declare function vibeGridPath(collection: string, table: string): string;
-/**
- * Vibe document wrapper structure.
- * Vibe stores actual table data as JSON string in the 'data' field.
- */
-export interface VibeDocumentWrapper {
-    document_id: number;
-    client_id?: number;
-    user_id?: number;
-    collection?: string;
-    table_name?: string;
-    data: string | Record<string, unknown>;
-    collection_schema_id?: number;
-    created_at?: string;
-    created_by?: number;
-    updated_at?: string | null;
-    updated_by?: number | null;
-    deleted_at?: string | null;
-}
-/**
- * Unwrap a Vibe document response.
- * Vibe returns documents with a wrapper where actual data is a JSON string.
- *
- * @param doc - Raw Vibe document (wrapper format)
- * @returns Unwrapped document with schema fields only.
- *          Storage-layer document_id preserved as _vibe_doc_id for update/delete paths.
- *          See PayEz-Core/docs/vibe-primary-key-standard.md
- *
- * @example
- * const raw = { document_id: 123, data: '{"user_id":15,"name":"John","email":"john@example.com"}' };
- * const unwrapped = unwrapVibeDocument(raw);
- * // => { user_id: 15, name: 'John', email: 'john@example.com', _vibe_doc_id: 123 }
- */
-export declare function unwrapVibeDocument<T extends Record<string, unknown> = Record<string, unknown>>(doc: VibeDocumentWrapper | Record<string, unknown> | null | undefined): (T & {
-    _vibe_doc_id?: number;
-}) | null;
-/**
- * Extract and unwrap array of documents from Vibe response.
- *
- * @param responseData - Raw Vibe API response
- * @returns Array of unwrapped documents
- *
- * @example
- * const response = await fetch('/api/vibe/data/ideal_resume/resumes');
- * const data = await response.json();
- * const resumes = extractVibeDocuments(data);
- */
-export declare function extractVibeDocuments<T extends Record<string, unknown> = Record<string, unknown>>(responseData: unknown): Array<T & {
-    _vibe_doc_id?: number;
-}>;
+export { unwrapVibeDocument, extractVibeDocuments } from './document-unwrap';
+export type { VibeDocumentWrapper } from './document-unwrap';
 /**
  * Generic table delegate for dynamic collection/table access.
  * Provides Prisma-like methods for any table.

package/dist/vibe/generic.js

@@ -24,12 +24,10 @@
  * =============================================================================
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GenericCollection = exports.GenericTableDelegate = void 0;
+exports.GenericCollection = exports.GenericTableDelegate = exports.extractVibeDocuments = exports.unwrapVibeDocument = void 0;
 exports.vibeTablePath = vibeTablePath;
 exports.vibeQueryPath = vibeQueryPath;
 exports.vibeGridPath = vibeGridPath;
-exports.unwrapVibeDocument = unwrapVibeDocument;
-exports.extractVibeDocuments = extractVibeDocuments;
 exports.vibeCollection = vibeCollection;
 exports.vibeTable = vibeTable;
 const client_1 = require("./client");
@@ -73,76 +71,17 @@ function vibeQueryPath(collection, table) {
 function vibeGridPath(collection, table) {
     return `/v1/collections/${collection}/tables/${table}/grid`;
 }
-/**
- * Unwrap a Vibe document response.
- * Vibe returns documents with a wrapper where actual data is a JSON string.
- *
- * @param doc - Raw Vibe document (wrapper format)
- * @returns Unwrapped document with schema fields only.
- *          Storage-layer document_id preserved as _vibe_doc_id for update/delete paths.
- *          See PayEz-Core/docs/vibe-primary-key-standard.md
- *
- * @example
- * const raw = { document_id: 123, data: '{"user_id":15,"name":"John","email":"john@example.com"}' };
- * const unwrapped = unwrapVibeDocument(raw);
- * // => { user_id: 15, name: 'John', email: 'john@example.com', _vibe_doc_id: 123 }
- */
-function unwrapVibeDocument(doc) {
-    if (!doc)
-        return null;
-    // Handle case where doc is already unwrapped (has schema fields directly)
-    if (!('document_id' in doc) && !('data' in doc)) {
-        return doc;
-    }
-    const wrapper = doc;
-    let parsedData = {};
-    if (typeof wrapper.data === 'string') {
-        try {
-            parsedData = JSON.parse(wrapper.data);
-        }
-        catch {
-            console.warn('[vibe-generic] Failed to parse document data JSON:', wrapper.data);
-            parsedData = {};
-        }
-    }
-    else if (typeof wrapper.data === 'object' && wrapper.data !== null) {
-        parsedData = wrapper.data;
-    }
-    // Preserve document_id as _vibe_doc_id for Vibe API update/delete paths only
-    const documentId = wrapper.document_id ?? doc.document_id;
-    if (documentId != null) {
-        parsedData._vibe_doc_id = documentId;
-    }
-    return parsedData;
-}
-/**
- * Extract and unwrap array of documents from Vibe response.
- *
- * @param responseData - Raw Vibe API response
- * @returns Array of unwrapped documents
- *
- * @example
- * const response = await fetch('/api/vibe/data/ideal_resume/resumes');
- * const data = await response.json();
- * const resumes = extractVibeDocuments(data);
- */
-function extractVibeDocuments(responseData) {
-    if (!responseData || typeof responseData !== 'object') {
-        return [];
-    }
-    const data = responseData;
-    // Try common response shapes
-    const docs = data.data ??
-        data.items ??
-        data.documents ??
-        (Array.isArray(responseData) ? responseData : null);
-    if (!Array.isArray(docs)) {
-        return [];
-    }
-    return docs
-        .map((doc) => unwrapVibeDocument(doc))
-        .filter((d) => d !== null);
-}
+// -----------------------------------------------------------------------------
+// DOCUMENT UNWRAPPING
+//
+// PAY-1767: the wrapper type and the two helpers MOVED to ./document-unwrap, so the typed client
+// (client.ts) can unwrap reads without importing this module (which imports client.ts). Re-exported
+// here so every existing `from './generic'` / package import keeps working unchanged.
+// -----------------------------------------------------------------------------
+var document_unwrap_1 = require("./document-unwrap");
+Object.defineProperty(exports, "unwrapVibeDocument", { enumerable: true, get: function () { return document_unwrap_1.unwrapVibeDocument; } });
+Object.defineProperty(exports, "extractVibeDocuments", { enumerable: true, get: function () { return document_unwrap_1.extractVibeDocuments; } });
+const document_unwrap_2 = require("./document-unwrap");
 // -----------------------------------------------------------------------------
 // GENERIC TABLE DELEGATE
 // -----------------------------------------------------------------------------
@@ -209,7 +148,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName);
         const url = `${this.client.getBaseUrl()}${path}${queryString ? `?${queryString}` : ''}`;
         const response = await this.client.request(url, 'GET');
-        const unwrapped = extractVibeDocuments(response);
+        const unwrapped = (0, document_unwrap_2.extractVibeDocuments)(response);
         return {
             data: unwrapped,
             meta: response.meta || { total: unwrapped.length, limit: options?.take || 50, offset: options?.skip || 0 },
@@ -223,7 +162,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName, options.where.id);
         const url = `${this.client.getBaseUrl()}${path}`;
         const response = await this.client.request(url, 'GET');
-        const unwrapped = unwrapVibeDocument(response.data);
+        const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeNotFoundError(`Document ${options.where.id} not found in ${this.collection}/${this.tableName}`, 'NOT_FOUND', { collection: this.collection, table: this.tableName, id: options.where.id });
         }
@@ -257,7 +196,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName);
         const url = `${this.client.getBaseUrl()}${path}`;
         const response = await this.client.request(url, 'POST', options.data);
-        const unwrapped = unwrapVibeDocument(response.data);
+        const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeServiceError('Failed to parse created document');
         }
@@ -270,7 +209,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName, options.where.id);
         const url = `${this.client.getBaseUrl()}${path}`;
         const response = await this.client.request(url, 'PUT', options.data);
-        const unwrapped = unwrapVibeDocument(response.data);
+        const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeServiceError('Failed to parse updated document');
         }
@@ -283,7 +222,7 @@ class GenericTableDelegate {
         const path = vibeTablePath(this.collection, this.tableName, options.where.id);
         const url = `${this.client.getBaseUrl()}${path}`;
         const response = await this.client.request(url, 'DELETE');
-        const unwrapped = unwrapVibeDocument(response.data);
+        const unwrapped = (0, document_unwrap_2.unwrapVibeDocument)(response.data);
         if (!unwrapped) {
             throw new errors_1.VibeServiceError('Failed to parse deleted document');
         }

package/dist/vibe/index.d.ts

@@ -16,7 +16,7 @@ export { vibe, createVibeClient, VibeClient, VibeTableDelegate } from './client'
 export type { VibeClientConfig, FindManyOptions, FindUniqueOptions, CreateOptions, UpdateOptions, DeleteOptions, CountOptions, FindManyResult, WhereClause, OrderByClause, FilterOperator, FilterValue, OrderDirection, } from './client';
 export type { VibeAuditFields, VibeMeta, VibeResponse, VibeErrorResponse, VibeTableTypes, VibeTableName, VibeTableType, IVibeUser, IVibeLoginSession, SessionStatus, IVibeProfile, IVibeSetting, IVibeFile, IVibeNotification, NotificationType, IVibeActivityLog, ActivityAction, IVibeTag, IVibeComment, IVibeSiteLog, LogLevel, } from './types';
 export { VibeUser, VibeLoginSession, VibeProfile, VibeSetting, VibeFile, VibeNotification, VibeActivityLog, VibeTag, VibeComment, VibeSiteLog, } from './types';
-export { VibeError, VibeNotFoundError, VibeValidationError, VibeAuthError, VibeRateLimitError, VibeConflictError, VibeServiceError, } from './errors';
+export { VibeError, VibeNotFoundError, VibeValidationError, VibeAuthError, VibeRateLimitError, VibeConflictError, VibeServiceError, VibeBatchCreateError, } from './errors';
 export { createLoginSession, getUserSessions, getAllSessions, getSessionById, revokeSession, revokeAllUserSessions, updateSessionActivity, isSessionValid, checkSessionRevocation, getSessionStats, } from './sessions';
 export type { CreateSessionInput, SessionQueryOptions } from './sessions';
 export { vibeCollection, vibeTable, vibeTablePath, vibeQueryPath, vibeGridPath, unwrapVibeDocument, extractVibeDocuments, GenericCollection, GenericTableDelegate, } from './generic';

package/dist/vibe/index.js

@@ -14,7 +14,7 @@
  * =============================================================================
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateBackendHmacSignature = exports.hasEnterpriseAuthHeaders = exports.validateEnterpriseAuth = exports.GenericTableDelegate = exports.GenericCollection = exports.extractVibeDocuments = exports.unwrapVibeDocument = exports.vibeGridPath = exports.vibeQueryPath = exports.vibeTablePath = exports.vibeTable = exports.vibeCollection = exports.getSessionStats = exports.checkSessionRevocation = exports.isSessionValid = exports.updateSessionActivity = exports.revokeAllUserSessions = exports.revokeSession = exports.getSessionById = exports.getAllSessions = exports.getUserSessions = exports.createLoginSession = exports.VibeServiceError = exports.VibeConflictError = exports.VibeRateLimitError = exports.VibeAuthError = exports.VibeValidationError = exports.VibeNotFoundError = exports.VibeError = exports.VibeSiteLog = exports.VibeComment = exports.VibeTag = exports.VibeActivityLog = exports.VibeNotification = exports.VibeFile = exports.VibeSetting = exports.VibeProfile = exports.VibeLoginSession = exports.VibeUser = exports.VibeTableDelegate = exports.VibeClient = exports.createVibeClient = exports.vibe = void 0;
+exports.generateBackendHmacSignature = exports.hasEnterpriseAuthHeaders = exports.validateEnterpriseAuth = exports.GenericTableDelegate = exports.GenericCollection = exports.extractVibeDocuments = exports.unwrapVibeDocument = exports.vibeGridPath = exports.vibeQueryPath = exports.vibeTablePath = exports.vibeTable = exports.vibeCollection = exports.getSessionStats = exports.checkSessionRevocation = exports.isSessionValid = exports.updateSessionActivity = exports.revokeAllUserSessions = exports.revokeSession = exports.getSessionById = exports.getAllSessions = exports.getUserSessions = exports.createLoginSession = exports.VibeBatchCreateError = exports.VibeServiceError = exports.VibeConflictError = exports.VibeRateLimitError = exports.VibeAuthError = exports.VibeValidationError = exports.VibeNotFoundError = exports.VibeError = exports.VibeSiteLog = exports.VibeComment = exports.VibeTag = exports.VibeActivityLog = exports.VibeNotification = exports.VibeFile = exports.VibeSetting = exports.VibeProfile = exports.VibeLoginSession = exports.VibeUser = exports.VibeTableDelegate = exports.VibeClient = exports.createVibeClient = exports.vibe = void 0;
 // Client exports
 var client_1 = require("./client");
 Object.defineProperty(exports, "vibe", { enumerable: true, get: function () { return client_1.vibe; } });
@@ -42,6 +42,7 @@ Object.defineProperty(exports, "VibeAuthError", { enumerable: true, get: functio
 Object.defineProperty(exports, "VibeRateLimitError", { enumerable: true, get: function () { return errors_1.VibeRateLimitError; } });
 Object.defineProperty(exports, "VibeConflictError", { enumerable: true, get: function () { return errors_1.VibeConflictError; } });
 Object.defineProperty(exports, "VibeServiceError", { enumerable: true, get: function () { return errors_1.VibeServiceError; } });
+Object.defineProperty(exports, "VibeBatchCreateError", { enumerable: true, get: function () { return errors_1.VibeBatchCreateError; } });
 // Session management exports
 var sessions_1 = require("./sessions");
 Object.defineProperty(exports, "createLoginSession", { enumerable: true, get: function () { return sessions_1.createLoginSession; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -64,6 +64,11 @@
       "require": "./dist/auth/better-auth.js",
       "default": "./dist/auth/better-auth.js"
     },
+    "./auth/safe-callback": {
+      "types": "./dist/auth/safe-callback.d.ts",
+      "require": "./dist/auth/safe-callback.js",
+      "default": "./dist/auth/safe-callback.js"
+    },
     "./components/auth/FederatedAuthSection": {
       "types": "./dist/components/auth/FederatedAuthSection.d.ts",
       "require": "./dist/components/auth/FederatedAuthSection.js",
@@ -124,6 +129,11 @@
       "require": "./dist/lib/session-store.js",
       "default": "./dist/lib/session-store.js"
     },
+    "./lib/nextauth-secret": {
+      "types": "./dist/lib/nextauth-secret.d.ts",
+      "require": "./dist/lib/nextauth-secret.js",
+      "default": "./dist/lib/nextauth-secret.js"
+    },
     "./lib/ensure-fresh-access-token": {
       "types": "./dist/lib/ensure-fresh-access-token.d.ts",
       "require": "./dist/lib/ensure-fresh-access-token.js",
@@ -179,6 +189,11 @@
       "require": "./dist/lib/idp-client-config.js",
       "default": "./dist/lib/idp-client-config.js"
     },
+    "./lib/never-in-response": {
+      "types": "./dist/lib/never-in-response.d.ts",
+      "require": "./dist/lib/never-in-response.js",
+      "default": "./dist/lib/never-in-response.js"
+    },
     "./hooks/useAuthSettings": {
       "types": "./dist/hooks/useAuthSettings.d.ts",
       "require": "./dist/hooks/useAuthSettings.js",
@@ -944,7 +959,7 @@
     "@azure/identity": "^4.0.1",
     "@azure/keyvault-secrets": "^4.7.0",
     "@upstash/redis": "^1.35.6",
-    "better-auth": "1.5.6",
+    "better-auth": "1.6.33",
     "ioredis": "^5.3.2",
     "jose": "^5.2.4",
     "jsonwebtoken": "^9.0.2",

package/src/api-handlers/account/change-password.ts

@@ -9,6 +9,28 @@ interface ChangePasswordRequest {
 }
 
 import { nanoid } from 'nanoid';
+
+/**
+ * PAY-1596: the failure code comes from the IdP's REAL envelope { success, error: { code, message, details } } - the handler
+ * used to read a top-level `error_code` the IdP never sends, so every refusal was CHANGE_PASSWORD_FAILED and "this account has
+ * no password" / "wrong current password" could not be told apart. Allowlisted: nothing but these codes ever leaves here.
+ *   - error.code NO_PASSWORD_SET / INVALID_CURRENT_PASSWORD (IdP PR 412) / VALIDATION_ERROR
+ *   - the pre-412 wrong-current shape: VALIDATION_ERROR + details.value[] { code: InvalidCurrentPassword, field_name: currentPassword }
+ *   - a legacy top-level error_code, for older IdPs
+ */
+const CHANGE_PASSWORD_CODES = new Set(['NO_PASSWORD_SET', 'INVALID_CURRENT_PASSWORD', 'VALIDATION_ERROR']);
+
+function changePasswordFailureCode(body: any): string {
+  const err = body && typeof body.error === 'object' && body.error ? body.error : null;
+  const code: string = typeof err?.code === 'string' ? err.code : typeof body?.error_code === 'string' ? body.error_code : '';
+  if (code === 'VALIDATION_ERROR' && Array.isArray(err?.details?.value)) {
+    const wrongCurrent = err.details.value.some(
+      (e: any) => e && typeof e === 'object' && (String(e.field_name ?? e.fieldName ?? '').toLowerCase() === 'currentpassword' || String(e.code ?? '').toLowerCase() === 'invalidcurrentpassword'),
+    );
+    if (wrongCurrent) return 'INVALID_CURRENT_PASSWORD';
+  }
+  return CHANGE_PASSWORD_CODES.has(code) ? code : 'CHANGE_PASSWORD_FAILED';
+}
 import { projectPasswordPolicyDetails } from '../../lib/safe-error-response';
 
 // ...
@@ -102,22 +124,25 @@ export async function POST(req: NextRequest) {
       // Extract error message from IDP response
       let errorMessage = 'Failed to change password';
 
+      const failureCode = changePasswordFailureCode(responseData);
+      // The real envelope nests details under `error`; older IdPs put them at the top level.
+      const idpDetails = (responseData.error && typeof responseData.error === 'object' ? responseData.error.details : undefined) ?? responseData.details;
       if (responseData.message) {
         errorMessage = responseData.message;
-      } else if (responseData.details?.value && Array.isArray(responseData.details.value) && responseData.details.value.length > 0) {
-        errorMessage = responseData.details.value[0].message || errorMessage;
-      } else if (responseData.details?.message) {
-        errorMessage = responseData.details.message;
+      } else if (idpDetails?.value && Array.isArray(idpDetails.value) && idpDetails.value.length > 0) {
+        errorMessage = idpDetails.value[0].message || errorMessage;
+      } else if (idpDetails?.message) {
+        errorMessage = idpDetails.message;
       }
 
       return NextResponse.json(
         {
           success: false,
           message: errorMessage,
-          error_code: responseData.error_code || 'CHANGE_PASSWORD_FAILED',
+          error_code: failureCode,
           request_id: requestId,
           // PAY-1438: only the password-policy messages the security pages display, never the raw envelope.
-          details: projectPasswordPolicyDetails(responseData.details),
+          details: projectPasswordPolicyDetails(idpDetails),
         },
         { status: idpResponse.status }
       );