@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/dist/templates/app/api/v1/users/route.ts

@@ -14,7 +14,7 @@ import {
   handleEntityMetadataInResponse,
   processEntityMetadata
 } from '@nextsparkjs/core/lib/api/helpers';
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth';
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth';
 import { hasAdminPermission } from '@nextsparkjs/core/lib/api/auth/permissions';
 import { z } from 'zod';
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
@@ -34,21 +34,19 @@ const createUserSchema = z.object({
 
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest();
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request);
 }
 
 // GET /api/v1/users - List users with dual auth
 export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:read' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
@@ -58,7 +56,7 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     // SECURITY: Only superadmins can list all users
     if (!hasAdminPermission(authResult, 'users:read')) {
       const response = createApiError('Insufficient permissions. Superadmin access required.', 403);
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const metaParams = parseMetaParams(req);
@@ -103,25 +101,23 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     const usersWithMeta = await includeEntityMetadata('user', users as { id: string }[], metaParams, authResult.user!.id);
 
     const response = createApiResponse(usersWithMeta, paginationMeta);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error fetching users:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'read');
 
 // POST /api/v1/users - Create user with dual auth
 export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:write' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
@@ -131,7 +127,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     // SECURITY: Only superadmins can create users
     if (!hasAdminPermission(authResult, 'users:write')) {
       const response = createApiError('Insufficient permissions. Superadmin access required.', 403);
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const body = await req.json();
@@ -147,7 +143,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
 
     if (existingUser.length > 0) {
       const response = createApiError('Email already exists', 409, null, 'EMAIL_EXISTS');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const newUserId = globalThis.crypto.randomUUID();
@@ -183,16 +179,16 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     const responseData = await handleEntityMetadataInResponse('user', createdUser as { id: string }, metadataWasProvided, authResult.user!.id);
     
     const response = createApiResponse(responseData, { created: true }, 201);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     if (error instanceof z.ZodError) {
       const response = createApiError('Validation error', 400, error.issues, 'VALIDATION_ERROR');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
     
     console.error('Error creating user:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'write');
 

package/dist/templates/app/dashboard/layout.tsx

@@ -3,7 +3,7 @@
 import { useAuth } from '@nextsparkjs/core/hooks/useAuth'
 import { useRouter } from 'next/navigation'
 import { useEffect, Suspense } from 'react'
-import { Loader2 } from 'lucide-react'
+import { DashboardAuthSkeleton } from '@nextsparkjs/core/components/dashboard/layouts/DashboardAuthSkeleton'
 import { DashboardProviders } from '@nextsparkjs/core/providers/DashboardProviders'
 import { DashboardTranslationPreloader } from '@nextsparkjs/core/lib/i18n/DashboardTranslationPreloader'
 import { TranslationDebugger } from '@nextsparkjs/core/utils/dev/TranslationDebugger'
@@ -35,11 +35,7 @@ function DashboardLayoutContent({ children }: { children: React.ReactNode }) {
   }, [user, isLoading, router])
 
   if (isLoading) {
-    return (
-      <div className="min-h-screen flex items-center justify-center">
-        <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
-      </div>
-    )
+    return <DashboardAuthSkeleton />
   }
 
   if (!user) {

package/dist/templates/app/layout.ppr.tsx

@@ -55,27 +55,22 @@ export const metadata: Metadata = getMetadataOrDefault(
   defaultMetadata
 )
 
-export default function RootLayout({
+export default async function RootLayout({
   children,
 }: Readonly<{
   children: React.ReactNode
 }>) {
+  const billingHints = await getBillingResourceHints()
+
   return (
     <html lang={DEFAULT_LOCALE} suppressHydrationWarning>
       <head>
-        {(() => {
-          const hints = getBillingResourceHints()
-          return (
-            <>
-              {hints.preconnect.map((domain) => (
-                <link key={`pre-${domain}`} rel="preconnect" href={domain} />
-              ))}
-              {[...hints.preconnect, ...hints.dnsPrefetch].map((domain) => (
-                <link key={`dns-${domain}`} rel="dns-prefetch" href={domain} />
-              ))}
-            </>
-          )
-        })()}
+        {billingHints.preconnect.map((domain) => (
+          <link key={`pre-${domain}`} rel="preconnect" href={domain} />
+        ))}
+        {[...billingHints.preconnect, ...billingHints.dnsPrefetch].map((domain) => (
+          <link key={`dns-${domain}`} rel="dns-prefetch" href={domain} />
+        ))}
       </head>
       <body
         className={`${geistSans.variable} ${geistMono.variable} antialiased`}
@@ -84,7 +79,12 @@ export default function RootLayout({
           <NextThemeProvider
             attribute="class"
             defaultTheme={DEFAULT_THEME_MODE}
-            enableSystem={DEFAULT_THEME_MODE === 'system'}
+            // Always true here: this layout never passes forcedTheme, so
+            // ThemeToggle is unconditionally visible and offers "System" as one
+            // of its 3 choices — gating on DEFAULT_THEME_MODE === 'system' had
+            // the same bug as the non-PPR layout (see #175): a build-time
+            // default of 'light'/'dark' silently broke the "System" option.
+            enableSystem
             disableTransitionOnChange
           >
             <CustomThemeProvider>

package/dist/templates/app/layout.tsx

@@ -15,11 +15,15 @@ import { getBillingResourceHints } from "@nextsparkjs/core/lib/billing/gateways/
 import { ThemeProvider as NextThemeProvider } from "@nextsparkjs/core/providers/theme-provider"
 import { ThemeProvider as CustomThemeProvider } from "@nextsparkjs/core/lib/theme/ThemeProvider"
 import { Toaster } from "@nextsparkjs/core/components/ui/sonner"
+import { QueryProvider } from "@nextsparkjs/core/providers/query-provider"
+import { TeamProvider } from "@nextsparkjs/core/contexts/TeamContext"
+import { SubscriptionProvider } from "@nextsparkjs/core/contexts/SubscriptionContext"
 import { getUserLocale } from '@nextsparkjs/core/lib/locale'
 import { TranslationContextManager } from "@nextsparkjs/core/providers/TranslationContextManager"
+import { SessionCookieRefresher } from "@nextsparkjs/core/components/auth/SessionCookieRefresher"
 import { PluginService } from '@nextsparkjs/core/lib/services'
 import { getMetadataOrDefault } from '@nextsparkjs/core/lib/template-resolver'
-import { getDefaultThemeMode } from '@nextsparkjs/core/lib/theme/get-default-theme-mode'
+import { getThemeSettings } from '@nextsparkjs/core/lib/theme/get-default-theme-mode'
 
 const geistSans = Geist({
   variable: "--font-geist-sans",
@@ -55,24 +59,18 @@ export default async function RootLayout({
 
   const locale = await getUserLocale()
   const messages = await getMessages({ locale })
-  const defaultTheme = await getDefaultThemeMode()
+  const { defaultMode, allowUserToggle, forcedThemeRoutes } = await getThemeSettings()
+  const billingHints = await getBillingResourceHints()
 
   return (
     <html lang={locale} suppressHydrationWarning>
       <head>
-        {(() => {
-          const hints = getBillingResourceHints()
-          return (
-            <>
-              {hints.preconnect.map((domain) => (
-                <link key={`pre-${domain}`} rel="preconnect" href={domain} />
-              ))}
-              {[...hints.preconnect, ...hints.dnsPrefetch].map((domain) => (
-                <link key={`dns-${domain}`} rel="dns-prefetch" href={domain} />
-              ))}
-            </>
-          )
-        })()}
+        {billingHints.preconnect.map((domain) => (
+          <link key={`pre-${domain}`} rel="preconnect" href={domain} />
+        ))}
+        {[...billingHints.preconnect, ...billingHints.dnsPrefetch].map((domain) => (
+          <link key={`dns-${domain}`} rel="dns-prefetch" href={domain} />
+        ))}
       </head>
       <body
         className={`${geistSans.variable} ${geistMono.variable} antialiased`}
@@ -80,14 +78,42 @@ export default async function RootLayout({
         <NextIntlClientProvider locale={locale} messages={messages}>
           <NextThemeProvider
             attribute="class"
-            defaultTheme={defaultTheme}
-            enableSystem
+            defaultTheme={defaultMode}
+            // When allowUserToggle is false, force the theme and ignore localStorage/system
+            forcedTheme={!allowUserToggle ? defaultMode : undefined}
+            // Detect OS preference whenever the user can toggle at all. ThemeToggle
+            // always offers "System" as one of its 3 choices when toggling is
+            // allowed, so the provider must be able to resolve it whenever that's
+            // true — gating on `defaultMode === 'system'` looks equivalent at
+            // first render, but defaultMode is the user's last SAVED preference
+            // for a logged-in user (see getThemeSettings), not a static "is
+            // system-matching enabled" flag. That made "System" silently write a
+            // literal, unmatched `class="system"` for anyone whose saved
+            // preference (or the theme's own config default) wasn't already
+            // 'system' — see #175.
+            enableSystem={allowUserToggle}
+            // Force a theme on the routes declared in theme.config.ts (forcedThemeRoutes)
+            forcedThemeRoutes={forcedThemeRoutes}
             disableTransitionOnChange
           >
             <CustomThemeProvider>
-              <TranslationContextManager />
-              <main>{children}</main>
-              <Suspense><Toaster position="bottom-left" /></Suspense>
+              {/* Team providers live here (not only in DashboardProviders) so the activeTeamId
+                  cookie is synced from any route, matching layout.ppr.tsx — see #115.
+                  DashboardProviders skips re-mounting them when already present. */}
+              <QueryProvider>
+                <TeamProvider>
+                  <SubscriptionProvider>
+                    <TranslationContextManager />
+                    {/* Real session-cookie renewal for installed PWAs: the render-time
+                        session reads above (getUserLocale/getThemeSettings) cannot
+                        write cookies, so the rolling refresh is triggered from the
+                        client through the auth Route Handler instead. */}
+                    <SessionCookieRefresher />
+                    <main>{children}</main>
+                    <Suspense><Toaster position="bottom-left" /></Suspense>
+                  </SubscriptionProvider>
+                </TeamProvider>
+              </QueryProvider>
             </CustomThemeProvider>
           </NextThemeProvider>
         </NextIntlClientProvider>

package/dist/templates/contents/themes/starter/config/app.config.ts

@@ -115,6 +115,25 @@ export const APP_CONFIG_OVERRIDES = {
         enabled: false,
       },
     },
+    /**
+     * Login methods, in priority order. Core default = passwordless preset:
+     * a one-time code by email + Google, no password field (needs an email
+     * provider — RESEND_API_KEY — and GOOGLE_CLIENT_ID/SECRET for Google).
+     *
+     * Uncomment to switch to the classic email + password preset, or list both
+     * (the first email method is the form shown first):
+     */
+    // methods: ['email-password', 'google'],
+    // methods: ['email-otp', 'email-password', 'google'],
+
+    /**
+     * Session duration / renewal in seconds (defaults: 7 days, renewed daily).
+     * Long-lived sessions for an installed PWA, for example:
+     */
+    // session: {
+    //   expiresIn: 60 * 60 * 24 * 90, // 90 days
+    //   updateAge: 60 * 60 * 24 * 7,  // renew weekly
+    // },
     /**
      * Whether Better Auth automatically sends the verification email on signup.
      *

package/dist/templates/contents/themes/starter/config/theme.config.ts

@@ -22,6 +22,12 @@ export const starterThemeConfig: ThemeConfig = {
   // ==========================================
   plugins: [],
 
+  // ==========================================
+  // THEME MODE (Optional)
+  // ==========================================
+  // defaultMode: 'system',                    // 'light' | 'dark' | 'system'
+  // forcedThemeRoutes: { '/login': 'light' }, // force a theme on route prefixes (longest wins)
+
   // ==========================================
   // STYLES CONFIGURATION
   // ==========================================

package/dist/templates/contents/themes/starter/styles/globals.css

@@ -200,8 +200,12 @@
 /* =============================================
    BASE STYLES
    ============================================= */
-* {
-  border-color: var(--border);
+/* Must live in @layer base: un-layered rules beat every Tailwind v4 utility
+   (border-primary, border-destructive, ...) regardless of specificity. */
+@layer base {
+  * {
+    border-color: var(--border);
+  }
 }
 
 body {

package/dist/templates/proxy.ts

@@ -64,9 +64,48 @@ function isPublicPath(pathname: string): boolean {
   )
 }
 
+/**
+ * Identity headers this proxy injects for downstream server code.
+ *
+ * SECURITY (#87): these headers are trusted by RSC layouts and permission
+ * checks, so an inbound value must NEVER reach the app. They are stripped from
+ * every request before any path branching and re-added only from the verified
+ * session. Gating the strip on protected prefixes is not enough: Next.js
+ * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
+ * action can be POSTed to a public path with a forged `x-user-id`.
+ */
+const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname'] as const
+
+/**
+ * Build the request headers forwarded to the app: inbound copy minus every
+ * trusted identity header, plus the real pathname.
+ */
+function sanitizeRequestHeaders(request: NextRequest): Headers {
+  const headers = new Headers(request.headers)
+  for (const name of TRUSTED_IDENTITY_HEADERS) {
+    headers.delete(name)
+  }
+  headers.set('x-pathname', request.nextUrl.pathname)
+  return headers
+}
+
+/**
+ * Continue to the app with the (sanitized) request headers.
+ * Every pass-through in this proxy MUST go through here so the strip applies
+ * to public paths, /api/v1 and unmatched routes alike.
+ */
+function passThrough(requestHeaders: Headers): NextResponse {
+  return NextResponse.next({
+    request: { headers: requestHeaders },
+  })
+}
+
 export async function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl
 
+  // 0. Strip forgeable identity headers before ANY branching (see #87)
+  const requestHeaders = sanitizeRequestHeaders(request)
+
   // 1. Check for theme middleware override
   const activeTheme = process.env.NEXT_PUBLIC_ACTIVE_THEME
   if (activeTheme && hasThemeMiddleware(activeTheme)) {
@@ -114,17 +153,17 @@ export async function proxy(request: NextRequest) {
         return NextResponse.redirect(loginUrl)
       }
     }
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 4. Allow public paths
   if (isPublicPath(pathname)) {
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 5. API v1 routes handle their own dual authentication
   if (pathname.startsWith('/api/v1')) {
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 6. Protected routes - require authentication and inject user headers
@@ -162,20 +201,17 @@ export async function proxy(request: NextRequest) {
         }
       }
 
-      // Inject user headers for downstream use
+      // Inject user headers for downstream use, ONLY from the verified session
+      // (requestHeaders already had any inbound values stripped).
       // IMPORTANT: EntityPermissionLayout depends on these headers
-      const requestHeaders = new Headers(request.headers)
       if (session.user?.id) {
         requestHeaders.set('x-user-id', session.user.id)
       }
       if (session.user?.email) {
         requestHeaders.set('x-user-email', session.user.email)
       }
-      requestHeaders.set('x-pathname', pathname)
 
-      return NextResponse.next({
-        request: { headers: requestHeaders },
-      })
+      return passThrough(requestHeaders)
     } catch (error) {
       console.error('Proxy error:', error)
       const loginUrl = new URL('/login', request.url)
@@ -184,7 +220,7 @@ export async function proxy(request: NextRequest) {
     }
   }
 
-  return NextResponse.next()
+  return passThrough(requestHeaders)
 }
 
 export const config = {

package/dist/templates/tsconfig.json

@@ -56,6 +56,10 @@
   ],
   "exclude": [
     "node_modules",
+    // PPR template variants (layout.ppr.tsx) are copied over layout.tsx when a project
+    // enables cacheComponents; in place they import registry exports that only exist
+    // in PPR mode, so they are never type-checked as-is.
+    "**/*.ppr.tsx",
     "**/*.test.ts",
     "**/*.test.tsx",
     "**/*.spec.ts",

package/dist/types/theme.d.ts

@@ -17,6 +17,15 @@ export interface ThemeConfig {
     enabled?: boolean;
     /** Default theme mode - controls next-themes behavior */
     defaultMode?: 'light' | 'dark' | 'system';
+    /**
+     * Force a theme on specific routes, ignoring user and system preference.
+     * Keys are route prefixes matched at segment boundaries (the longest match
+     * wins); values are the theme to force. The root ThemeProvider passes the
+     * resolved value to next-themes' `forcedTheme`, so the route renders with
+     * that theme from the first paint and on client-side navigations.
+     * @example { '/login': 'light', '/signup': 'light', '/embed': 'dark' }
+     */
+    forcedThemeRoutes?: Record<string, 'light' | 'dark'>;
     dependencies?: string[];
     plugins?: string[];
     styles?: {

package/dist/types/theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../src/types/theme.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAE9B;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAA;IACzC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACnC,CAAA;IACD,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,GAAG,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,GAAG,CAAA;IACd,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,YAAY,EAAE,gBAAgB,EAAE,CAAA;CACjC"}
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../src/types/theme.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAE9B;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAA;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAA;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACnC,CAAA;IACD,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,GAAG,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,GAAG,CAAA;IACd,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,YAAY,EAAE,gBAAgB,EAAE,CAAA;CACjC"}

package/migrations/005_api_audit_log.sql

@@ -3,7 +3,8 @@
 
 CREATE TABLE IF NOT EXISTS "api_audit_log" (
   id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-  "apiKeyId" TEXT NOT NULL REFERENCES public."api_key"(id) ON DELETE CASCADE,
+  -- NULL for session-authenticated requests (see 025_api_audit_log_nullable_api_key.sql)
+  "apiKeyId" TEXT REFERENCES public."api_key"(id) ON DELETE CASCADE,
   "userId"   TEXT NOT NULL REFERENCES public."users"(id) ON DELETE CASCADE,
   endpoint   TEXT NOT NULL,
   method     TEXT NOT NULL,

package/migrations/025_api_audit_log_nullable_api_key.sql

@@ -0,0 +1,12 @@
+-- Migration: 025_api_audit_log_nullable_api_key.sql
+-- Description: Allow api_audit_log rows without an API key (#105)
+--
+-- The generic entity routes (/api/v1/[entity], /api/v1/[entity]/[id]) now
+-- write an audit row for every authenticated request, whether it was
+-- authenticated with an API key or with a browser session. Session requests
+-- have no key, so "apiKeyId" must accept NULL. The foreign key stays as-is:
+-- a FK only constrains non-null values.
+--
+-- Idempotent: DROP NOT NULL on an already-nullable column is a no-op.
+
+ALTER TABLE "api_audit_log" ALTER COLUMN "apiKeyId" DROP NOT NULL;

package/migrations/026_login_events.sql

@@ -0,0 +1,91 @@
+-- Migration: 026_login_events.sql
+-- Description: login_events — per-user device/login history for built-in
+--              security email notifications (new-device login alerts).
+-- Date: 2026-09-01
+-- Issue: #75
+--
+-- Why 026 (and not 022 as the issue text proposed, nor 025):
+--   The issue was written when the migration sequence ended earlier. By the
+--   time this branch was authored the sequence already went through
+--   024_teams_soft_delete.sql (022 and 023 are taken by rls_runtime_roles and
+--   the invitations index), so this migration was originally 025. It was
+--   renumbered to 026 when merging to main, because 025 had in the meantime
+--   been taken by 025_api_audit_log_nullable_api_key.sql (issue #105).
+--
+-- What this backs:
+--   The security-notifications dispatcher records one row per successful sign-in
+--   with a device fingerprint = sha256(normalizedUA | ip/24). A sign-in whose
+--   (userId, deviceFingerprint) pair has never been seen is flagged isNew=true
+--   and triggers a "new device" email via the auth:security-notification
+--   scheduled action. Known fingerprints are still logged (isNew=false) but send
+--   no email. The table is also the substrate for a future login-history UI
+--   (out of scope here — see issue #75 "Out of scope").
+--
+-- Append-only: rows are never updated, so there is no "updatedAt"/set_updated_at
+-- trigger (unlike mutable entity tables). city/country are nullable for a future
+-- geolocation enhancement (also out of scope).
+
+-- ============================================
+-- TABLE
+-- ============================================
+DROP TABLE IF EXISTS public."login_events" CASCADE;
+
+CREATE TABLE IF NOT EXISTS public."login_events" (
+  -- Primary Key (TEXT not UUID — Better Auth convention)
+  id                  TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+
+  -- Relational Fields
+  "userId"            TEXT NOT NULL REFERENCES public."users"(id) ON DELETE CASCADE,
+
+  -- Entity-specific fields
+  "ipAddress"         TEXT,
+  "userAgent"         TEXT,
+  "deviceFingerprint" TEXT NOT NULL,
+  city                TEXT,
+  country             TEXT,
+  "isNew"             BOOLEAN NOT NULL DEFAULT false,
+
+  -- System fields (append-only: created only, never updated)
+  "createdAt"         TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE  public."login_events"                     IS 'Per-user login/device history backing built-in new-device security email notifications (issue #75).';
+COMMENT ON COLUMN public."login_events"."userId"            IS 'Owner of the login event.';
+COMMENT ON COLUMN public."login_events"."ipAddress"         IS 'Best-effort client IP captured at sign-in (may be a proxy address).';
+COMMENT ON COLUMN public."login_events"."userAgent"         IS 'Raw User-Agent header captured at sign-in.';
+COMMENT ON COLUMN public."login_events"."deviceFingerprint" IS 'sha256(normalizedUA | ip/24). Stable across patch-version UA churn and within a /24 network so routine re-logins from the same device do not re-alert.';
+COMMENT ON COLUMN public."login_events".city                IS 'Reserved for future geolocation enrichment (nullable, unused today).';
+COMMENT ON COLUMN public."login_events".country             IS 'Reserved for future geolocation enrichment (nullable, unused today).';
+COMMENT ON COLUMN public."login_events"."isNew"             IS 'True when this (userId, deviceFingerprint) pair had not been seen before this row → a new-device email was queued.';
+
+-- ============================================
+-- INDEXES
+-- ============================================
+-- Most-recent-first history lookups per user (login-history UI, TTL checks).
+CREATE INDEX IF NOT EXISTS idx_login_events_user_created
+  ON public."login_events" ("userId", "createdAt" DESC);
+
+-- "Have we seen this fingerprint for this user?" — the new-device decision.
+CREATE INDEX IF NOT EXISTS idx_login_events_user_fingerprint
+  ON public."login_events" ("userId", "deviceFingerprint");
+
+-- ============================================
+-- RLS
+-- ============================================
+-- A user may read ONLY their own login events; superadmin/developer bypass via
+-- can_bypass_rls() (defined in 001). Writes are service-only: the dispatcher
+-- inserts with no user GUC (service/bypass pool), matching how session/account
+-- rows are written in 002. Mirrors the "self read + service write" pattern.
+ALTER TABLE public."login_events" ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS "Login events self read"      ON public."login_events";
+DROP POLICY IF EXISTS "Login events service write"  ON public."login_events";
+
+CREATE POLICY "Login events self read" ON public."login_events"
+FOR SELECT TO authenticated
+USING (public.can_bypass_rls() OR "userId" = public.get_auth_user_id());
+
+CREATE POLICY "Login events service write" ON public."login_events"
+FOR ALL TO authenticated
+USING (public.can_bypass_rls())
+WITH CHECK (public.can_bypass_rls());