@nextsparkjs/core 0.1.0-beta.127 → 0.1.0-beta.128

package/dist/lib/services/membership.service.js

@@ -3,6 +3,7 @@ import { TeamMemberService } from "./team-member.service.js";
 import { SubscriptionService } from "./subscription.service.js";
 import { PermissionService } from "./permission.service.js";
 import { PlanService } from "./plan.service.js";
+import { BILLING_REGISTRY } from "@nextsparkjs/registries/billing-registry";
 class TeamMembership {
   userId;
   teamId;
@@ -141,6 +142,7 @@ class TeamMembership {
    * }
    */
   canPerformAction(action, options) {
+    var _a, _b, _c, _d, _e;
     if (!this.role) {
       return {
         allowed: false,
@@ -173,6 +175,33 @@ class TeamMembership {
         };
       }
     }
+    const requiredFeature = (_b = (_a = BILLING_REGISTRY.actionMappings) == null ? void 0 : _a.features) == null ? void 0 : _b[action];
+    if (requiredFeature && !this.hasFeature(requiredFeature)) {
+      return {
+        allowed: false,
+        reason: "feature_not_in_plan",
+        message: `Your plan does not include the required feature: ${requiredFeature}`,
+        meta: {
+          requiredFeature,
+          currentPlan: (_c = this.subscription) == null ? void 0 : _c.planSlug
+        }
+      };
+    }
+    const consumedLimit = (_e = (_d = BILLING_REGISTRY.actionMappings) == null ? void 0 : _d.limits) == null ? void 0 : _e[action];
+    if (consumedLimit) {
+      const quotaCheck = this.checkQuota(consumedLimit, (options == null ? void 0 : options.incrementQuota) ?? 1);
+      if (!quotaCheck.allowed) {
+        return {
+          allowed: false,
+          reason: "quota_exceeded",
+          message: `Quota exceeded for ${consumedLimit}`,
+          meta: {
+            limitSlug: consumedLimit,
+            remaining: quotaCheck.remaining
+          }
+        };
+      }
+    }
     return { allowed: true };
   }
 }

package/dist/lib/services/plan.service.d.ts

@@ -161,7 +161,6 @@ export declare class PlanService {
     static getPrice(slug: string, interval: 'monthly' | 'yearly'): number | null;
     /**
      * Get provider price ID for a plan.
-     * Checks generic providerPriceIds first, falls back to Stripe-specific fields.
      *
      * @param slug - Plan slug
      * @param interval - 'monthly' or 'yearly'
@@ -171,7 +170,5 @@ export declare class PlanService {
      * const priceId = PlanService.getPriceId('pro', 'monthly')
      */
     static getPriceId(slug: string, interval: 'monthly' | 'yearly'): string | null;
-    /** @deprecated Use getPriceId instead */
-    static getStripePriceId(slug: string, interval: 'monthly' | 'yearly'): string | null;
 }
 //# sourceMappingURL=plan.service.d.ts.map

package/dist/lib/services/plan.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/plan.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAM7D,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAMD,qBAAa,WAAW;IAKtB;;;;;;;;OAQG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAatD;;;;;;;;OAQG;WACU,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAa1D;;;;;;;;;;;;OAYG;WACU,IAAI,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAclE;;;;;;;;OAQG;WACU,UAAU,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAK/C;;;;;;;;OAQG;WACU,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBnD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IASrD;;;;;;;;;OASG;IACH,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAc1C;;;;;;;;;OASG;IACH,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAStD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAKxD;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAS7D;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAc3D;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE;IAI9B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;IAS5E;;;;;;;;;;OAUG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;IAoB9E,yCAAyC;IACzC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;CAGrF"}
+{"version":3,"file":"plan.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/plan.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAM7D,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAMD,qBAAa,WAAW;IAKtB;;;;;;;;OAQG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAatD;;;;;;;;OAQG;WACU,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAa1D;;;;;;;;;;;;OAYG;WACU,IAAI,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAclE;;;;;;;;OAQG;WACU,UAAU,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAK/C;;;;;;;;OAQG;WACU,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBnD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IASrD;;;;;;;;;OASG;IACH,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAc1C;;;;;;;;;OASG;IACH,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAStD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAKxD;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAS7D;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAc3D;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE;IAI9B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;IAS5E;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI;CAc/E"}

package/dist/lib/services/plan.service.js

@@ -243,7 +243,6 @@ class PlanService {
   }
   /**
    * Get provider price ID for a plan.
-   * Checks generic providerPriceIds first, falls back to Stripe-specific fields.
    *
    * @param slug - Plan slug
    * @param interval - 'monthly' or 'yearly'
@@ -257,15 +256,10 @@ class PlanService {
     if (!config) {
       return null;
     }
-    if (config.providerPriceIds) {
-      const id = interval === "yearly" ? config.providerPriceIds.yearly : config.providerPriceIds.monthly;
-      if (id) return id;
+    if (!config.providerPriceIds) {
+      return null;
     }
-    return interval === "yearly" ? config.stripePriceIdYearly || null : config.stripePriceIdMonthly || null;
-  }
-  /** @deprecated Use getPriceId instead */
-  static getStripePriceId(slug, interval) {
-    return this.getPriceId(slug, interval);
+    return interval === "yearly" ? config.providerPriceIds.yearly || null : config.providerPriceIds.monthly || null;
   }
 }
 export {

package/dist/lib/services/subscription.service.d.ts

@@ -6,11 +6,11 @@
  *
  * @module SubscriptionService
  */
-import type { Subscription, SubscriptionWithPlan, SubscriptionStatus, QuotaInfo, CanPerformActionResult, BillingInterval } from '../billing/types';
+import type { Subscription, SubscriptionWithPlan, SubscriptionStatus, QuotaInfo, CanPerformActionResult, BillingInterval, PaymentProvider } from '../billing/types';
 export interface CreateSubscriptionOptions {
     billingInterval?: BillingInterval;
     trialDays?: number;
-    paymentProvider?: 'stripe' | 'paddle' | 'lemonsqueezy';
+    paymentProvider?: PaymentProvider;
     externalSubscriptionId?: string;
     externalCustomerId?: string;
 }
@@ -41,7 +41,7 @@ export declare class SubscriptionService {
      * const sub = await SubscriptionService.getActive('team-uuid-123')
      * console.log(sub?.plan.name) // 'Pro Plan'
      */
-    static getActive(teamId: string): Promise<SubscriptionWithPlan | null>;
+    static getActive(teamId: string, userId?: string): Promise<SubscriptionWithPlan | null>;
     /**
      * Get subscription by team ID (alias for getActive)
      *
@@ -117,7 +117,7 @@ export declare class SubscriptionService {
      *   console.log('Warnings:', result.downgradeWarnings)
      * }
      */
-    static changePlan(teamId: string, targetPlanSlug: string, billingInterval?: BillingInterval): Promise<ChangePlanResult>;
+    static changePlan(teamId: string, targetPlanSlug: string, billingInterval?: BillingInterval, userId?: string): Promise<ChangePlanResult>;
     /**
      * Pause subscription
      *
@@ -180,7 +180,7 @@ export declare class SubscriptionService {
         offset?: number;
     }): Promise<SubscriptionWithPlan[]>;
     /**
-     * Get subscription by external (Stripe) subscription ID
+     * Get subscription by external subscription ID (from payment provider)
      *
      * @param externalId - External subscription ID from payment provider
      * @returns Subscription with plan or null

package/dist/lib/services/subscription.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/subscription.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAEV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EAET,sBAAsB,EACtB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAMzB,MAAM,WAAW,yBAAyB;IACxC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,cAAc,CAAA;IACtD,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,qBAAa,mBAAmB;IAK9B;;;;;;;;OAQG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW9D;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA4B5E;;;;;OAKG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;OASG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAgC9E;;;;;;;;;;OAUG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,YAAY,CAAC;IA+ExB;;;;;;;;OAQG;WACU,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAejE;;;;;;;;;OASG;WACU,YAAY,CACvB,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC;IA0CxB;;;;;;;;OAQG;WACU,MAAM,CACjB,cAAc,EAAE,MAAM,EACtB,iBAAiB,GAAE,OAAc,GAChC,OAAO,CAAC,YAAY,CAAC;IA4DxB;;;;;;;;;;;;;OAaG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,eAAe,GAAE,eAA2B,GAC3C,OAAO,CAAC,gBAAgB,CAAC;IAmH5B;;;;;;;;OAQG;WACU,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcjE;;;;;;;;OAQG;WACU,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAclE;;;;;;;;;;OAUG;WACU,YAAY,CACvB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAoBlC;;;;;;;;OAQG;WACU,gBAAgB,CAAC,IAAI,GAAE,MAAU,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsBhF;;;;;;;;;;OAUG;WACU,UAAU,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7E,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA8BlC;;;;;;;;OAQG;WACU,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsBtF;;;;;;;;;OASG;WACU,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IA+BrF;;;;;;;;OAQG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA4BxE;;;;;;;;;OASG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB9E;;;;;;;;;;;;OAYG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA2E9E;;;;;;;;;;;;;;;;;;OAkBG;WACU,gBAAgB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,CAAC;IA2ElC;;;;;;;;;OASG;WACU,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;CA+BrD"}
+{"version":3,"file":"subscription.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/subscription.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAEV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EAET,sBAAsB,EACtB,eAAe,EACf,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAMzB,MAAM,WAAW,yBAAyB;IACxC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,qBAAa,mBAAmB;IAK9B;;;;;;;;OAQG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW9D;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA6B7F;;;;;OAKG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;OASG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAgC9E;;;;;;;;;;OAUG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,YAAY,CAAC;IA+ExB;;;;;;;;OAQG;WACU,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAejE;;;;;;;;;OASG;WACU,YAAY,CACvB,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC;IA0CxB;;;;;;;;OAQG;WACU,MAAM,CACjB,cAAc,EAAE,MAAM,EACtB,iBAAiB,GAAE,OAAc,GAChC,OAAO,CAAC,YAAY,CAAC;IA4DxB;;;;;;;;;;;;;OAaG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,eAAe,GAAE,eAA2B,EAC5C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC;IAmI5B;;;;;;;;OAQG;WACU,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcjE;;;;;;;;OAQG;WACU,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAclE;;;;;;;;;;OAUG;WACU,YAAY,CACvB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAoBlC;;;;;;;;OAQG;WACU,gBAAgB,CAAC,IAAI,GAAE,MAAU,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsBhF;;;;;;;;;;OAUG;WACU,UAAU,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7E,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA8BlC;;;;;;;;OAQG;WACU,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsBtF;;;;;;;;;OASG;WACU,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IA+BrF;;;;;;;;OAQG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA4BxE;;;;;;;;;OASG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB9E;;;;;;;;;;;;OAYG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA2E9E;;;;;;;;;;;;;;;;;;OAkBG;WACU,gBAAgB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,CAAC;IA2ElC;;;;;;;;;OASG;WACU,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;CA+BrD"}

package/dist/lib/services/subscription.service.js

@@ -1,4 +1,4 @@
-import { queryOneWithRLS, queryWithRLS, mutateWithRLS } from "../db.js";
+import { queryOneWithRLS, queryWithRLS, mutateWithRLS, getTransactionClient } from "../db.js";
 import { doAction } from "../plugins/hook-system.js";
 import { BILLING_REGISTRY } from "@nextsparkjs/registries/billing-registry";
 import { PlanService } from "./plan.service.js";
@@ -41,7 +41,7 @@ class SubscriptionService {
    * const sub = await SubscriptionService.getActive('team-uuid-123')
    * console.log(sub?.plan.name) // 'Pro Plan'
    */
-  static async getActive(teamId) {
+  static async getActive(teamId, userId) {
     if (!teamId || teamId.trim() === "") {
       throw new Error("Team ID is required");
     }
@@ -57,7 +57,8 @@ class SubscriptionService {
       ORDER BY s."createdAt" DESC
       LIMIT 1
       `,
-      [teamId]
+      [teamId],
+      userId
     );
     if (!result) return null;
     return {
@@ -325,14 +326,14 @@ class SubscriptionService {
    *   console.log('Warnings:', result.downgradeWarnings)
    * }
    */
-  static async changePlan(teamId, targetPlanSlug, billingInterval = "monthly") {
+  static async changePlan(teamId, targetPlanSlug, billingInterval = "monthly", userId) {
     if (!teamId || teamId.trim() === "") {
       return { success: false, error: "Team ID is required" };
     }
     if (!targetPlanSlug || targetPlanSlug.trim() === "") {
       return { success: false, error: "Target plan slug is required" };
     }
-    const currentSub = await this.getActive(teamId);
+    const currentSub = await this.getActive(teamId, userId);
     if (!(currentSub == null ? void 0 : currentSub.externalSubscriptionId)) {
       return { success: false, error: "No active subscription found" };
     }
@@ -354,46 +355,58 @@ class SubscriptionService {
     try {
       await getBillingGateway().updateSubscriptionPlan({
         subscriptionId: currentSub.externalSubscriptionId,
-        newPriceId,
-        prorationBehavior: "create_prorations"
+        newPriceId
       });
       const targetPlan = await PlanService.getBySlug(targetPlanSlug);
       if (!targetPlan) {
         return { success: false, error: "Plan not found in database" };
       }
-      await queryWithRLS(
-        `
-        UPDATE "subscriptions"
-        SET
-          "planId" = $1,
-          "billingInterval" = $2,
-          metadata = jsonb_set(
-            COALESCE(metadata, '{}'::jsonb),
-            '{previousPlanSlug}',
-            $3::jsonb
-          ),
-          "updatedAt" = NOW()
-        WHERE "teamId" = $4 AND status IN ('active', 'trialing')
-        `,
-        [targetPlan.id, billingInterval, JSON.stringify(currentSub.plan.slug), teamId]
-      );
-      await queryWithRLS(
-        `
-        INSERT INTO "billing_events" (id, "subscriptionId", type, status, metadata, "createdAt")
-        VALUES ($1, $2, 'lifecycle', 'succeeded', $3, NOW())
-        `,
-        [
-          crypto.randomUUID(),
-          currentSub.id,
-          JSON.stringify({
-            action: "plan_change",
-            fromPlan: currentSub.plan.slug,
-            toPlan: targetPlanSlug,
-            billingInterval
-          })
-        ]
-      );
-      const updatedSub = await this.getActive(teamId);
+      const tx = await getTransactionClient();
+      try {
+        await tx.query(
+          `
+          UPDATE "subscriptions"
+          SET
+            "planId" = $1,
+            "billingInterval" = $2,
+            metadata = jsonb_set(
+              COALESCE(metadata, '{}'::jsonb),
+              '{previousPlanSlug}',
+              $3::jsonb
+            ),
+            "updatedAt" = NOW()
+          WHERE "teamId" = $4 AND status IN ('active', 'trialing')
+          `,
+          [targetPlan.id, billingInterval, JSON.stringify(currentSub.plan.slug), teamId]
+        );
+        await tx.query(
+          `
+          INSERT INTO "billing_events" (id, "subscriptionId", type, status, amount, currency, metadata, "createdAt")
+          VALUES ($1, $2, 'lifecycle', 'succeeded', $3, $4, $5, NOW())
+          `,
+          [
+            crypto.randomUUID(),
+            currentSub.id,
+            0,
+            "usd",
+            JSON.stringify({
+              action: "plan_change",
+              fromPlan: currentSub.plan.slug,
+              toPlan: targetPlanSlug,
+              billingInterval
+            })
+          ]
+        );
+        await tx.commit();
+      } catch (dbError) {
+        await tx.rollback();
+        console.error("[SubscriptionService.changePlan] DB transaction failed after provider update:", dbError);
+        return {
+          success: false,
+          error: "Plan changed in payment provider but local DB update failed. Please contact support."
+        };
+      }
+      const updatedSub = await this.getActive(teamId, userId);
       await doAction("subscription.updated", {
         id: currentSub.id,
         data: updatedSub,
@@ -544,7 +557,7 @@ class SubscriptionService {
     return results.map((r) => ({ ...r, plan: r.plan }));
   }
   /**
-   * Get subscription by external (Stripe) subscription ID
+   * Get subscription by external subscription ID (from payment provider)
    *
    * @param externalId - External subscription ID from payment provider
    * @returns Subscription with plan or null

package/dist/migrations/001_better_auth_and_functions.sql

@@ -41,17 +41,11 @@ BEGIN
 END;
 $$;
 
--- Alias sin schema si lo usás en policies legadas
-CREATE OR REPLACE FUNCTION get_auth_user_id()
-RETURNS TEXT
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $$
-BEGIN
-  RETURN public.get_auth_user_id();
-END;
-$$;
+-- NOTE: Previously there was an alias function `get_auth_user_id()` (without schema)
+-- that called `public.get_auth_user_id()`. This was removed because PostgreSQL's
+-- `CREATE OR REPLACE` with `SET search_path = public` would overwrite the real
+-- function with the alias, causing infinite recursion. All RLS policies should
+-- use `public.get_auth_user_id()` with the explicit schema qualifier.
 
 -- Utilidad: updatedAt (si no existe ya en otra migration)
 CREATE OR REPLACE FUNCTION public.set_updated_at()

package/dist/migrations/008_team_members_table.sql

@@ -43,6 +43,24 @@ CREATE TRIGGER team_members_set_updated_at
 BEFORE UPDATE ON public."team_members"
 FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
 
+-- ============================================
+-- HELPER FUNCTION (bypasses RLS via SECURITY DEFINER)
+-- ============================================
+
+-- Returns team IDs for a given user, bypassing RLS to prevent self-referencing
+-- recursion. Without this, team_members RLS policies query team_members itself,
+-- causing infinite recursion when any other table (subscriptions, billing_events,
+-- usage) references team_members in its own RLS policy chain.
+CREATE OR REPLACE FUNCTION public.get_user_team_ids(p_user_id TEXT)
+RETURNS SETOF TEXT
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT "teamId" FROM public."team_members" WHERE "userId" = p_user_id;
+$$;
+
 -- ============================================
 -- TEAM MEMBERS ROW LEVEL SECURITY (RLS)
 -- ============================================
@@ -50,23 +68,21 @@ FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
 ALTER TABLE public."team_members" ENABLE ROW LEVEL SECURITY;
 
 -- Team members: visible to members of the same team
+-- Uses get_user_team_ids() (SECURITY DEFINER) to avoid self-referencing recursion
 CREATE POLICY "team_members_select_policy" ON public."team_members"
   FOR SELECT TO authenticated
   USING (
-    "teamId" IN (
-      SELECT "teamId" FROM public."team_members"
-      WHERE "userId" = public.get_auth_user_id()
-    )
+    "teamId" IN (SELECT public.get_user_team_ids(public.get_auth_user_id()))
   );
 
 -- Team members: owners and admins can add members
 CREATE POLICY "team_members_insert_policy" ON public."team_members"
   FOR INSERT TO authenticated
   WITH CHECK (
-    "teamId" IN (
-      SELECT "teamId" FROM public."team_members"
-      WHERE "userId" = public.get_auth_user_id()
-      AND role IN ('owner', 'admin')
+    "teamId" IN (SELECT public.get_user_team_ids(public.get_auth_user_id()))
+    AND EXISTS (
+      SELECT 1 FROM public.get_user_team_ids(public.get_auth_user_id()) AS t
+      WHERE t = "team_members"."teamId"
     )
   );
 
@@ -74,29 +90,17 @@ CREATE POLICY "team_members_insert_policy" ON public."team_members"
 CREATE POLICY "team_members_update_policy" ON public."team_members"
   FOR UPDATE TO authenticated
   USING (
-    "teamId" IN (
-      SELECT "teamId" FROM public."team_members"
-      WHERE "userId" = public.get_auth_user_id()
-      AND role IN ('owner', 'admin')
-    )
+    "teamId" IN (SELECT public.get_user_team_ids(public.get_auth_user_id()))
   )
   WITH CHECK (
-    "teamId" IN (
-      SELECT "teamId" FROM public."team_members"
-      WHERE "userId" = public.get_auth_user_id()
-      AND role IN ('owner', 'admin')
-    )
+    "teamId" IN (SELECT public.get_user_team_ids(public.get_auth_user_id()))
   );
 
 -- Team members: owners and admins can remove members (except themselves)
 CREATE POLICY "team_members_delete_policy" ON public."team_members"
   FOR DELETE TO authenticated
   USING (
-    "teamId" IN (
-      SELECT "teamId" FROM public."team_members"
-      WHERE "userId" = public.get_auth_user_id()
-      AND role IN ('owner', 'admin')
-    )
+    "teamId" IN (SELECT public.get_user_team_ids(public.get_auth_user_id()))
     -- Cannot remove yourself
     AND "userId" != public.get_auth_user_id()
   );

package/dist/styles/classes.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-03-20T15:42:25.079Z",
+  "generated": "2026-03-21T22:28:39.842Z",
   "totalClasses": 1074,
   "classes": [
     "!text-2xl",

package/dist/templates/app/api/auth/[...all]/route.ts

@@ -7,6 +7,7 @@ import { isPublicSignupRestricted } from "@nextsparkjs/core/lib/teams/helpers";
 // Currently domain validation happens in auth.ts databaseHooks
 import { TeamService } from "@nextsparkjs/core/lib/services";
 import { wrapAuthHandlerWithCors, handleCorsPreflightRequest, addCorsHeaders } from "@nextsparkjs/core/lib/api/helpers";
+import { checkDistributedRateLimit } from "@nextsparkjs/core/lib/api/rate-limit";
 
 const handlers = toNextJsHandler(auth);
 
@@ -45,6 +46,40 @@ export async function GET(req: NextRequest, context: { params: Promise<{ all: st
 
 // Intercept signup requests to validate registration mode
 export async function POST(req: NextRequest) {
+  // Rate limiting: 5 requests per 15 minutes per IP (tier: auth).
+  // Protects login/signup against brute-force and credential stuffing attacks.
+  // IP extraction strategy:
+  // - Cloudflare: cf-connecting-ip (set by Cloudflare, not spoofable behind CF)
+  // - Vercel/trusted proxies: rightmost non-private IP in x-forwarded-for
+  // - Fallback: x-real-ip or 'unknown'
+  const clientIp = (() => {
+    // Cloudflare sets this header and it cannot be spoofed when behind CF
+    const cfIp = req.headers.get('cf-connecting-ip')
+    if (cfIp) return cfIp
+
+    // x-forwarded-for: use rightmost entry (last proxy-appended value is most trustworthy)
+    const forwardedFor = req.headers.get('x-forwarded-for')
+    if (forwardedFor) {
+      const ips = forwardedFor.split(',').map(ip => ip.trim()).filter(Boolean)
+      if (ips.length > 0) return ips[ips.length - 1]
+    }
+
+    return req.headers.get('x-real-ip') || 'unknown'
+  })()
+  const rateLimitResult = await checkDistributedRateLimit(`auth:ip:${clientIp}`, 'auth')
+  if (!rateLimitResult.allowed) {
+    return new NextResponse(JSON.stringify({ error: 'Too many requests' }), {
+      status: 429,
+      headers: {
+        'Content-Type': 'application/json',
+        'Retry-After': '900',
+        'X-RateLimit-Limit': rateLimitResult.limit.toString(),
+        'X-RateLimit-Remaining': '0',
+        'X-RateLimit-Reset': rateLimitResult.resetTime.toString(),
+      },
+    })
+  }
+
   const pathname = req.nextUrl.pathname;
 
   // Determine request type

package/dist/templates/app/api/health/route.ts

@@ -1,31 +1,51 @@
 import { queryWithRLS } from "@nextsparkjs/core/lib/db";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
-import { NextResponse } from "next/server";
+import { isRedisConfigured } from "@nextsparkjs/core/lib/rate-limit-redis";
+import { authenticateRequest } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { NextRequest, NextResponse } from "next/server";
+
+export const GET = withRateLimitTier(async (request: NextRequest) => {
+  let dbStatus: 'connected' | 'disconnected' = 'disconnected';
+  let dbError: string | undefined;
 
-export const GET = withRateLimitTier(async () => {
   try {
-    // Test database connection
     await queryWithRLS('SELECT 1');
-    
-    return NextResponse.json({
-      status: 'healthy',
-      timestamp: new Date().toISOString(),
-      services: {
-        database: 'connected',
-        api: 'operational'
-      }
-    });
+    dbStatus = 'connected';
   } catch (error) {
-    console.error('Health check failed:', error);
-    return NextResponse.json({
-      status: 'unhealthy',
-      timestamp: new Date().toISOString(),
-      error: 'Database connection failed',
-      services: {
-        database: 'disconnected',
-        api: 'operational'
-      }
-    }, { status: 503 });
+    dbError = error instanceof Error ? error.message : 'Unknown error';
+    console.error('[health] Database connection failed:', error);
   }
-}, 'read');
 
+  const healthy = dbStatus === 'connected';
+
+  // Public response: only healthy/unhealthy status
+  const publicResponse = {
+    status: healthy ? 'healthy' : 'unhealthy',
+    timestamp: new Date().toISOString(),
+  };
+
+  // Check if caller is authenticated for detailed info
+  const authResult = await authenticateRequest(request);
+  const isAuthenticated = authResult.success && authResult.user;
+
+  if (!isAuthenticated) {
+    return NextResponse.json(publicResponse, { status: healthy ? 200 : 503 });
+  }
+
+  // Authenticated callers get detailed service status
+  const redisConfigured = await isRedisConfigured();
+
+  if (!redisConfigured) {
+    console.error('[health] CRITICAL: Redis not configured — rate limiting is DISABLED. Set UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN in environment variables.');
+  }
+
+  return NextResponse.json({
+    ...publicResponse,
+    services: {
+      database: dbStatus,
+      rateLimit: redisConfigured ? 'redis' : 'disabled',
+      api: 'operational',
+    },
+    ...(dbError ? { error: dbError } : {}),
+  }, { status: healthy ? 200 : 503 });
+}, 'read');

package/dist/templates/app/api/internal/user-metadata/route.ts

@@ -1,10 +1,16 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { MetaService } from '@nextsparkjs/core/lib/services/meta.service'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 
 // Endpoint interno para crear metadata default después del signup
 export const POST = withRateLimitTier(async (req: NextRequest) => {
   try {
+    const authResult = await authenticateRequest(req)
+    if (!authResult.success || !authResult.user) {
+      return NextResponse.json({ error: 'Authentication required' }, { status: 401 })
+    }
+
     const body = await req.json()
     const { userId, metadata } = body
 
@@ -12,6 +18,10 @@ export const POST = withRateLimitTier(async (req: NextRequest) => {
       return NextResponse.json({ error: 'User ID is required' }, { status: 400 })
     }
 
+    if (userId !== authResult.user.id) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+    }
+
     if (!metadata || typeof metadata !== 'object') {
       return NextResponse.json({ error: 'Metadata is required' }, { status: 400 })
     }

package/dist/templates/app/api/superadmin/subscriptions/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getTypedSession } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
+import { getBillingGateway } from '@nextsparkjs/core/lib/billing/gateways/factory';
 
 interface SubscriptionResult {
   id: string;
@@ -23,6 +24,7 @@ interface SubscriptionResult {
   canceledAt: string | null;
   cancelAtPeriodEnd: boolean;
   externalSubscriptionId: string | null;
+  paymentProvider: string | null;
   createdAt: string;
 }
 
@@ -181,6 +183,7 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
         s."canceledAt",
         s."cancelAtPeriodEnd",
         s."externalSubscriptionId",
+        s."paymentProvider",
         s."createdAt"
       FROM "subscriptions" s
       LEFT JOIN "teams" t ON s."teamId" = t.id
@@ -253,6 +256,8 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
       canceledAt: sub.canceledAt,
       cancelAtPeriodEnd: sub.cancelAtPeriodEnd,
       externalSubscriptionId: sub.externalSubscriptionId,
+      paymentProvider: sub.paymentProvider,
+      providerDashboardUrl: getBillingGateway().getSubscriptionDashboardUrl(sub.externalSubscriptionId),
       createdAt: sub.createdAt
     }));
 

package/dist/templates/app/api/superadmin/teams/[teamId]/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getTypedSession } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
+import { getBillingGateway } from '@nextsparkjs/core/lib/billing/gateways/factory';
 
 interface TeamResult {
   id: string;
@@ -37,6 +38,7 @@ interface SubscriptionResult {
   cancelAtPeriodEnd: boolean;
   externalSubscriptionId: string | null;
   externalCustomerId: string | null;
+  paymentProvider: string | null;
   createdAt: string;
 }
 
@@ -144,6 +146,7 @@ export const GET = withRateLimitTier(async (
         s."cancelAtPeriodEnd",
         s."externalSubscriptionId",
         s."externalCustomerId",
+        s."paymentProvider",
         s."createdAt"
       FROM "subscriptions" s
       LEFT JOIN "plans" p ON s."planId" = p.id
@@ -242,6 +245,9 @@ export const GET = withRateLimitTier(async (
         cancelAtPeriodEnd: subscription.cancelAtPeriodEnd,
         externalSubscriptionId: subscription.externalSubscriptionId,
         externalCustomerId: subscription.externalCustomerId,
+        paymentProvider: subscription.paymentProvider,
+        providerName: getBillingGateway().getProviderName(),
+        providerDashboardUrl: getBillingGateway().getSubscriptionDashboardUrl(subscription.externalSubscriptionId),
         createdAt: subscription.createdAt
       } : null,
       billingHistory: billingEventsResult.map((event) => ({