@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/dist/lib/api/entity-handler.js

@@ -1,4 +1,4 @@
-import { auth } from "../auth.js";
+import { getTypedSession } from "../auth.js";
 import { entityRegistry, ensureInitialized } from "../entities/registry.js";
 import {
   createApiResponse,
@@ -13,7 +13,7 @@ import {
 import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../entities/entity-hooks.js";
 async function checkBasicAuth(request, entityName) {
   try {
-    const session = await auth.api.getSession({ headers: request.headers });
+    const session = await getTypedSession(request.headers);
     if (!session) {
       return {
         allowed: false,

package/dist/lib/api/helpers.d.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { ApiKeyAuth } from './auth';
+import { type AuthenticateOptions } from './auth/scope-policy';
 interface SessionAuth {
     userId: string;
     scopes: string[];
@@ -10,14 +11,34 @@ type Auth = ApiKeyAuth | SessionAuth;
 /**
  * Validates authentication using session or API key
  * Prefers session auth if available, falls back to API key
- */
-export declare function validateAndAuthenticateRequest(request: NextRequest): Promise<{
-    auth: Auth;
+ *
+ * Resolves to `{ auth: null }` when the request carries neither a valid
+ * session nor a valid API key — it never throws for an unauthenticated
+ * request (#112). Routes are expected to branch on `auth` and answer 401
+ * themselves; a throw here would be swallowed by the generic try/catch most
+ * routes wrap around their body and surface as a 500 instead.
+ *
+ * API-key scope enforcement fails closed here (#93), with the same rule as
+ * `authenticateRequest`: declare `{ requiredScope }` (or, explicitly,
+ * `{ allowAnyScope: true }`). A key rejected on scope resolves to
+ * `{ auth: null, errorResponse }` where `errorResponse` is the ready-made
+ * 403 — return it. Session auth keeps its role-derived scopes and is not
+ * gated here; use `checkScope` for explicit per-branch checks.
+ */
+export declare function validateAndAuthenticateRequest(request: NextRequest, options?: AuthenticateOptions): Promise<{
+    auth: Auth | null;
     rateLimitResponse?: NextResponse;
+    /** Set (403) when a valid API key was rejected by scope enforcement. */
+    errorResponse?: NextResponse;
 }>;
 /**
  * Valida la API key y aplica rate limiting
  * Esta función debe ser llamada al inicio de cada endpoint API v1
+ *
+ * API-key-only and strict: throws when no valid key is present. Endpoints
+ * that also accept sessions (or want to treat anonymous callers as a normal
+ * 401 branch) should use `validateAndAuthenticateRequest`, which resolves to
+ * a null auth instead.
  */
 export declare function validateAndAuthenticateApiRequest(request: NextRequest): Promise<{
     auth: ApiKeyAuth;
@@ -31,8 +52,12 @@ export declare function getApiAuth(request: NextRequest): ApiKeyAuth;
 /**
  * Verifica que la autenticación tenga el scope requerido
  * Retorna un NextResponse de error si no tiene permisos, null si está autorizado
+ *
+ * Applies to both session auth (role-derived scopes) and API-key auth, with
+ * the same matching rule as `hasRequiredScope`: the wildcard `*` satisfies
+ * any scope, and an array is satisfied by any one of its entries.
  */
-export declare function checkScope(auth: Auth, requiredScope: string): NextResponse | null;
+export declare function checkScope(auth: Auth, requiredScope: string | string[]): NextResponse | null;
 /**
  * Crea una respuesta exitosa estandarizada para la API
  */

package/dist/lib/api/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAapD,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IAClF,IAAI,EAAE,IAAI,CAAC;IACX,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CAoCD;AAgFD;;;GAGG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CA4BD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBjF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAWpD,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CASD;AA+BD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}

package/dist/lib/api/helpers.js

@@ -8,7 +8,13 @@ import { MetaService } from "../services/meta.service.js";
 import { ScopeService } from "../services/scope.service.js";
 import { getChildEntities } from "../entities/queries.js";
 import { getCorsOrigins, normalizeOrigin, isOriginAllowed } from "../utils/cors.js";
-async function validateAndAuthenticateRequest(request) {
+import {
+  describeRoute,
+  normalizeRequiredScopes,
+  resolveApiKeyScopeFailure,
+  scopesSatisfy
+} from "./auth/scope-policy.js";
+async function validateAndAuthenticateRequest(request, options = {}) {
   var _a;
   const cookieHeader = request.headers.get("cookie");
   if (cookieHeader) {
@@ -35,7 +41,21 @@ async function validateAndAuthenticateRequest(request) {
     }
   }
   console.log(`[Auth] Falling back to API key authentication`);
-  return validateAndAuthenticateApiRequest(request);
+  const apiKeyAuth = await validateApiKey(request);
+  if (!apiKeyAuth) {
+    return { auth: null };
+  }
+  const scopeFailure = resolveApiKeyScopeFailure(apiKeyAuth.scopes, options, describeRoute(request));
+  if (scopeFailure) {
+    return {
+      auth: null,
+      errorResponse: NextResponse.json(
+        { success: false, error: scopeFailure.message, code: scopeFailure.code },
+        { status: scopeFailure.status }
+      )
+    };
+  }
+  return applyApiKeyRateLimit(apiKeyAuth);
 }
 function generateScopesForRole(role, flags = []) {
   const baseScopes = getBaseScopesFromRegistry();
@@ -80,6 +100,9 @@ async function validateAndAuthenticateApiRequest(request) {
   if (!auth2) {
     throw new Error("Invalid API key");
   }
+  return applyApiKeyRateLimit(auth2);
+}
+function applyApiKeyRateLimit(auth2) {
   const rateLimitResult = checkRateLimit(auth2.keyId);
   if (!rateLimitResult.allowed) {
     const response = NextResponse.json(
@@ -120,14 +143,15 @@ function getApiAuth(request) {
   };
 }
 function checkScope(auth2, requiredScope) {
-  const hasRequiredScope = auth2.scopes.includes(requiredScope);
-  if (!hasRequiredScope) {
+  if (!scopesSatisfy(auth2.scopes, requiredScope)) {
+    const required = normalizeRequiredScopes(requiredScope);
+    const label = required.join("' or '");
     return NextResponse.json(
       {
         success: false,
         error: "Insufficient permissions",
-        message: `This operation requires the '${requiredScope}' scope`,
-        required_scope: requiredScope,
+        message: `This operation requires the '${label}' scope`,
+        required_scope: required.length === 1 ? required[0] : required,
         your_scopes: auth2.scopes,
         code: "INSUFFICIENT_PERMISSIONS"
       },

package/dist/lib/api/keys.d.ts

@@ -48,8 +48,14 @@ export declare const API_SCOPES: {
     readonly 'media:read': "Leer información de archivos y media";
     readonly 'media:write': "Subir y actualizar archivos";
     readonly 'media:delete': "Eliminar archivos";
+    readonly 'teams:read': "Leer equipos, miembros e invitaciones";
+    readonly 'teams:write': "Crear y actualizar equipos, miembros e invitaciones";
+    readonly 'teams:delete': "Eliminar equipos";
+    readonly 'billing:read': "Leer suscripciones, facturas y uso";
+    readonly 'billing:write': "Gestionar suscripciones, checkout, cambios de plan y uso";
     readonly 'admin:api-keys': "Gestionar API keys";
     readonly 'admin:users': "Administración completa de usuarios";
+    readonly 'admin:devtools': "Acceso a las APIs de DevTools (registries, testing, scheduled actions)";
     readonly '*': "Acceso completo (solo superadmin)";
 };
 export type ApiScope = keyof typeof API_SCOPES;
@@ -82,6 +88,16 @@ export declare const SCOPE_CATEGORIES: {
         readonly description: "Gestión de tareas y TODOs";
         readonly scopes: ApiScope[];
     };
+    readonly teams: {
+        readonly name: "Teams";
+        readonly description: "Equipos, miembros e invitaciones";
+        readonly scopes: ApiScope[];
+    };
+    readonly billing: {
+        readonly name: "Billing";
+        readonly description: "Suscripciones, facturas, uso y planes";
+        readonly scopes: ApiScope[];
+    };
     readonly admin: {
         readonly name: "Administración";
         readonly description: "Funciones administrativas";

package/dist/lib/api/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/keys.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,aAAa;IACxB;;;OAGG;WACU,cAAc,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBrF;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;OAEG;WACU,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE;IAUpF;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;CAchD;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;CAsBb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrD;AAED,oFAAoF;AACpF,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxD;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;yBAIgC,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKtB,QAAQ,EAAE;;;;;yBAKtC,QAAQ,EAAE;;CAErB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASd,CAAC;AAEX;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmB9F"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/keys.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,aAAa;IACxB;;;OAGG;WACU,cAAc,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBrF;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;OAEG;WACU,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE;IAUpF;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;CAchD;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;CAgCb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrD;AAED,oFAAoF;AACpF,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxD;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;yBAIgC,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKtB,QAAQ,EAAE;;;;;yBAKQ,QAAQ,EAAE;;;;;yBAKxD,QAAQ,EAAE;;CAErB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASd,CAAC;AAEX;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmB9F"}

package/dist/lib/api/keys.js

@@ -81,9 +81,17 @@ const API_SCOPES = {
   "media:read": "Leer informaci\xF3n de archivos y media",
   "media:write": "Subir y actualizar archivos",
   "media:delete": "Eliminar archivos",
+  // Teams (equipos, miembros e invitaciones)
+  "teams:read": "Leer equipos, miembros e invitaciones",
+  "teams:write": "Crear y actualizar equipos, miembros e invitaciones",
+  "teams:delete": "Eliminar equipos",
+  // Billing (suscripciones, facturas, uso y planes)
+  "billing:read": "Leer suscripciones, facturas y uso",
+  "billing:write": "Gestionar suscripciones, checkout, cambios de plan y uso",
   // Administración
   "admin:api-keys": "Gestionar API keys",
   "admin:users": "Administraci\xF3n completa de usuarios",
+  "admin:devtools": "Acceso a las APIs de DevTools (registries, testing, scheduled actions)",
   // Comodín (solo para superadmins)
   "*": "Acceso completo (solo superadmin)"
 };
@@ -109,10 +117,20 @@ const SCOPE_CATEGORIES = {
     description: "Gesti\xF3n de tareas y TODOs",
     scopes: ["tasks:read", "tasks:write", "tasks:delete"]
   },
+  teams: {
+    name: "Teams",
+    description: "Equipos, miembros e invitaciones",
+    scopes: ["teams:read", "teams:write", "teams:delete"]
+  },
+  billing: {
+    name: "Billing",
+    description: "Suscripciones, facturas, uso y planes",
+    scopes: ["billing:read", "billing:write"]
+  },
   admin: {
     name: "Administraci\xF3n",
     description: "Funciones administrativas",
-    scopes: ["admin:api-keys", "admin:users"]
+    scopes: ["admin:api-keys", "admin:users", "admin:devtools"]
   },
   system: {
     name: "Sistema",

package/dist/lib/api/routes/patterns-usages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns-usages.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/routes/patterns-usages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAavD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B;;gBAQQ,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;;;EAkFzE"}
+{"version":3,"file":"patterns-usages.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/routes/patterns-usages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAavD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B;;gBAQQ,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;;;EA0EzE"}

package/dist/lib/api/routes/patterns-usages.js

@@ -1,4 +1,3 @@
-import { NextResponse } from "next/server";
 import {
   createApiResponse,
   createApiError,
@@ -7,7 +6,7 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders
 } from "../helpers.js";
-import { authenticateRequest, hasRequiredScope } from "../auth/dual-auth.js";
+import { authenticateRequest, createAuthFailureResponse } from "../auth/dual-auth.js";
 import { PatternUsageService } from "../../services/index.js";
 import { queryOneWithRLS } from "../../db.js";
 function createPatternUsagesHandlers() {
@@ -17,20 +16,13 @@ function createPatternUsagesHandlers() {
   const GET = withApiLogging(
     async (req, { params }) => {
       try {
-        const authResult = await authenticateRequest(req);
+        const authResult = await authenticateRequest(req, { requiredScope: "patterns:read" });
         if (!authResult.success) {
-          return NextResponse.json(
-            { success: false, error: "Authentication required", code: "AUTHENTICATION_FAILED" },
-            { status: 401 }
-          );
+          return createAuthFailureResponse(authResult);
         }
         if (authResult.rateLimitResponse) {
           return authResult.rateLimitResponse;
         }
-        if (!hasRequiredScope(authResult, "patterns:read")) {
-          const response2 = createApiError("Insufficient permissions", 403);
-          return addCorsHeaders(response2);
-        }
         const { id: patternId } = await params;
         const userId = authResult.user.id;
         if (!patternId || patternId.trim() === "") {

package/dist/lib/auth/auth-methods.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Login Methods & Presets
+ *
+ * Pure helpers around `AuthConfig.methods` — the list of login methods an app
+ * offers (`'email-otp'`, `'google'`, `'email-password'`), in priority order.
+ * Safe to import from server and client code: no side effects, types only.
+ *
+ * Portfolio policy (#126): the DEFAULT is the passwordless preset — a one-time
+ * code by email + Google OAuth, no password field. Themes opt into the classic
+ * preset (or any combination) from their app.config.ts.
+ */
+import type { AuthConfig, AuthLoginMethod, AuthPreset } from '../config/types';
+/** Every method the core knows how to render/serve. */
+export declare const AUTH_LOGIN_METHODS: readonly AuthLoginMethod[];
+/** Named bundles of login methods. Arrays are in UI priority order. */
+export declare const AUTH_PRESETS: Readonly<Record<AuthPreset, readonly AuthLoginMethod[]>>;
+/** The preset applied when a theme does not set `auth.methods`. */
+export declare const DEFAULT_AUTH_METHODS: readonly AuthLoginMethod[];
+export declare function isAuthLoginMethod(value: unknown): value is AuthLoginMethod;
+/**
+ * Resolve the login methods an app offers.
+ *
+ * - Unknown values are dropped (with a warning), duplicates removed, order kept.
+ * - No `methods` configured, or nothing valid left → the default (passwordless)
+ *   preset.
+ */
+export declare function resolveAuthMethods(authConfig?: Pick<AuthConfig, 'methods'> | {
+    methods?: readonly string[];
+} | null): AuthLoginMethod[];
+export declare function isAuthMethodEnabled(methods: readonly AuthLoginMethod[], method: AuthLoginMethod): boolean;
+/**
+ * True when the login has NO password path: a one-time code is offered and
+ * `'email-password'` is not. Google may or may not be present.
+ */
+export declare function isPasswordlessPreset(methods: readonly AuthLoginMethod[]): boolean;
+/**
+ * The email-based method the login form should open with: the first of
+ * `'email-otp'` / `'email-password'` in the configured order, or null when the
+ * app is Google-only.
+ */
+export declare function getPrimaryEmailMethod(methods: readonly AuthLoginMethod[]): Extract<AuthLoginMethod, 'email-otp' | 'email-password'> | null;
+/**
+ * Which named preset the resolved methods correspond to (order-insensitive),
+ * or null for a custom combination.
+ */
+export declare function matchAuthPreset(methods: readonly AuthLoginMethod[]): AuthPreset | null;
+/**
+ * Server-side: should Better Auth's email + password endpoints be enabled?
+ * Defaults to true regardless of the UI preset (see `AuthConfig.emailAndPassword`).
+ */
+export declare function isPasswordLoginEnabled(authConfig?: Pick<AuthConfig, 'emailAndPassword'> | null): boolean;
+//# sourceMappingURL=auth-methods.d.ts.map

package/dist/lib/auth/auth-methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-methods.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE9E,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAA8C,CAAA;AAEvG,uEAAuE;AACvE,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC,CAKjF,CAAA;AAED,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,EAAE,SAAS,eAAe,EAA8B,CAAA;AAEzF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,GAChF,eAAe,EAAE,CAkBnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAEzG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,eAAe,EAAE,GAClC,OAAO,CAAC,eAAe,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,IAAI,CAKjE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,UAAU,GAAG,IAAI,CAMtF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,GAAG,IAAI,GACvD,OAAO,CAET"}

package/dist/lib/auth/auth-methods.js

@@ -0,0 +1,63 @@
+const AUTH_LOGIN_METHODS = ["email-otp", "google", "email-password"];
+const AUTH_PRESETS = {
+  /** One-time code by email + Google. No password anywhere. DEFAULT. */
+  passwordless: ["email-otp", "google"],
+  /** Email + password (with signup / reset flows) + Google. */
+  classic: ["email-password", "google"]
+};
+const DEFAULT_AUTH_METHODS = AUTH_PRESETS.passwordless;
+function isAuthLoginMethod(value) {
+  return typeof value === "string" && AUTH_LOGIN_METHODS.includes(value);
+}
+function resolveAuthMethods(authConfig) {
+  const configured = authConfig == null ? void 0 : authConfig.methods;
+  if (!Array.isArray(configured)) return [...DEFAULT_AUTH_METHODS];
+  const valid = [];
+  for (const method of configured) {
+    if (!isAuthLoginMethod(method)) {
+      console.warn(`[Auth] Ignoring unknown auth.methods entry: ${String(method)}`);
+      continue;
+    }
+    if (!valid.includes(method)) valid.push(method);
+  }
+  if (valid.length === 0) {
+    console.warn("[Auth] auth.methods resolved to an empty list; falling back to the passwordless preset");
+    return [...DEFAULT_AUTH_METHODS];
+  }
+  return valid;
+}
+function isAuthMethodEnabled(methods, method) {
+  return methods.includes(method);
+}
+function isPasswordlessPreset(methods) {
+  return methods.includes("email-otp") && !methods.includes("email-password");
+}
+function getPrimaryEmailMethod(methods) {
+  for (const method of methods) {
+    if (method === "email-otp" || method === "email-password") return method;
+  }
+  return null;
+}
+function matchAuthPreset(methods) {
+  const sorted = [...methods].sort().join(",");
+  for (const [preset, presetMethods] of Object.entries(AUTH_PRESETS)) {
+    if ([...presetMethods].sort().join(",") === sorted) return preset;
+  }
+  return null;
+}
+function isPasswordLoginEnabled(authConfig) {
+  var _a;
+  return ((_a = authConfig == null ? void 0 : authConfig.emailAndPassword) == null ? void 0 : _a.enabled) !== false;
+}
+export {
+  AUTH_LOGIN_METHODS,
+  AUTH_PRESETS,
+  DEFAULT_AUTH_METHODS,
+  getPrimaryEmailMethod,
+  isAuthLoginMethod,
+  isAuthMethodEnabled,
+  isPasswordLoginEnabled,
+  isPasswordlessPreset,
+  matchAuthPreset,
+  resolveAuthMethods
+};

package/dist/lib/auth/registration-guard-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration-guard-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/registration-guard-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAO,gBA2C1C,CAAC"}
+{"version":3,"file":"registration-guard-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/registration-guard-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAO,gBA6C1C,CAAC"}

package/dist/lib/auth/registration-helpers.d.ts

@@ -29,9 +29,18 @@ export declare function isDomainAllowed(email: string, allowedDomains: string[])
  *
  * Google is disabled when:
  * - providers.google.enabled is explicitly false
+ * - 'google' is not one of the configured login `methods`
  * - GOOGLE_CLIENT_ID env var is not set (runtime check, not done here)
  */
 export declare function isGoogleAuthEnabled(authConfig: AuthConfig): boolean;
+/**
+ * Check if the email+password SIGNUP flow (the /signup page and its form) is
+ * available: the registration mode must allow self-signup AND
+ * 'email-password' must be one of the configured login methods. Under the
+ * passwordless preset the first OTP sign-in creates the account, so there is
+ * no separate signup page.
+ */
+export declare function isPasswordSignupAvailable(authConfig: AuthConfig): boolean;
 /**
  * Check if the signup page should be accessible.
  *

package/dist/lib/auth/registration-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration-helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/registration-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAErF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAShF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAEnE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEnE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,OAAO,GACf,OAAO,CAGT;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEnE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAW5E"}
+{"version":3,"file":"registration-helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/registration-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAGrF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAShF;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAKnE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAKzE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEnE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,OAAO,GACf,OAAO,CAGT;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEnE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAY5E"}

package/dist/lib/auth/registration-helpers.js

@@ -1,3 +1,4 @@
+import { resolveAuthMethods } from "./auth-methods.js";
 function isRegistrationOpen(mode) {
   return mode === "open" || mode === "domain-open";
 }
@@ -12,7 +13,10 @@ function isDomainAllowed(email, allowedDomains) {
 }
 function isGoogleAuthEnabled(authConfig) {
   var _a, _b;
-  return ((_b = (_a = authConfig.providers) == null ? void 0 : _a.google) == null ? void 0 : _b.enabled) !== false;
+  return ((_b = (_a = authConfig.providers) == null ? void 0 : _a.google) == null ? void 0 : _b.enabled) !== false && resolveAuthMethods(authConfig).includes("google");
+}
+function isPasswordSignupAvailable(authConfig) {
+  return isEmailSignupEnabled(authConfig.registration.mode) && resolveAuthMethods(authConfig).includes("email-password");
 }
 function isSignupPageVisible(mode) {
   return mode === "open" || mode === "domain-open";
@@ -36,7 +40,8 @@ function getPublicAuthConfig(authConfig) {
       google: {
         enabled: isGoogleAuthEnabled(authConfig)
       }
-    }
+    },
+    methods: resolveAuthMethods(authConfig)
   };
 }
 export {
@@ -45,6 +50,7 @@ export {
   isEmailLoginVisible,
   isEmailSignupEnabled,
   isGoogleAuthEnabled,
+  isPasswordSignupAvailable,
   isRegistrationOpen,
   isSignupPageVisible,
   shouldBlockSignup

package/dist/lib/auth/security-notifications/device-fingerprint.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Device fingerprinting for new-device login detection.
+ *
+ * The fingerprint is deliberately COARSE:
+ *   fingerprint = sha256( normalizedUA + "|" + ip/24 )
+ *
+ * - UA is normalized so browser auto-updates (patch/build version churn) do NOT
+ *   look like a brand-new device every week. We keep major.minor of each version
+ *   token and drop the rest (`Chrome/120.0.6099.109` → `Chrome/120.0`).
+ * - IP is truncated to its /24 network so a phone hopping between addresses in
+ *   the same carrier/NAT block is still "the same place".
+ *
+ * This is an anti-annoyance heuristic for security emails, NOT an
+ * authentication signal — a coarse fingerprint means fewer false "new device"
+ * alerts, at the cost of not distinguishing devices that share a /24 and a
+ * near-identical UA. That trade-off is intentional.
+ */
+/**
+ * Normalize a User-Agent string:
+ *   - lower-cased and whitespace-collapsed
+ *   - every version token with 3+ dotted numeric components is reduced to its
+ *     first two (major.minor), stripping patch/build churn
+ *
+ * A missing UA normalizes to the empty string (all UA-less clients from the
+ * same /24 then share a fingerprint, which is the desired conservative bucket).
+ */
+export declare function normalizeUserAgent(ua: string | null | undefined): string;
+/**
+ * Reduce an IP address to its /24 network key.
+ *   - IPv4 `a.b.c.d`     → `a.b.c.0/24`
+ *   - IPv6 `x:y:z:...`   → first three hextets + `::/48` (coarse, best-effort)
+ *   - anything else      → returned unchanged (e.g. the literal 'unknown')
+ */
+export declare function ipToNetworkKey(ip: string | null | undefined): string;
+/**
+ * Compute the stable device fingerprint for a login.
+ *
+ * @param ua - raw User-Agent header (or null)
+ * @param ip - client IP (or null); truncated to /24 before hashing
+ * @returns hex sha256 of `normalizedUA|ipNetworkKey`
+ */
+export declare function computeDeviceFingerprint(ua: string | null, ip: string | null): string;
+/**
+ * Extract the best-effort client IP from request headers.
+ *
+ * Strategy mirrors the rate-limiter (see lib/api/rate-limit.ts):
+ *   Cloudflare > rightmost x-forwarded-for > x-real-ip > true-client-ip > 'unknown'
+ * The rightmost x-forwarded-for entry is the one appended by the last (trusted)
+ * proxy, so it is the hardest for a client to spoof.
+ */
+export declare function extractClientIp(headers: Headers): string;
+//# sourceMappingURL=device-fingerprint.d.ts.map

package/dist/lib/auth/security-notifications/device-fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/security-notifications/device-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAiBpE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,EAAE,EAAE,MAAM,GAAG,IAAI,GAChB,MAAM,CAGR;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAoBxD"}

package/dist/lib/auth/security-notifications/device-fingerprint.js

@@ -0,0 +1,42 @@
+import { createHash } from "crypto";
+function normalizeUserAgent(ua) {
+  if (!ua) return "";
+  return ua.toLowerCase().trim().replace(/\s+/g, " ").replace(/(\d+)\.(\d+)(?:\.\d+)+/g, "$1.$2");
+}
+function ipToNetworkKey(ip) {
+  if (!ip) return "";
+  const trimmed = ip.trim();
+  const v4 = trimmed.match(/(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    return `${v4[1]}.${v4[2]}.${v4[3]}.0/24`;
+  }
+  if (trimmed.includes(":")) {
+    const hextets = trimmed.split(":").filter(Boolean).slice(0, 3);
+    if (hextets.length > 0) return `${hextets.join(":")}::/48`;
+  }
+  return trimmed;
+}
+function computeDeviceFingerprint(ua, ip) {
+  const material = `${normalizeUserAgent(ua)}|${ipToNetworkKey(ip)}`;
+  return createHash("sha256").update(material).digest("hex");
+}
+function extractClientIp(headers) {
+  const cfIp = headers.get("cf-connecting-ip");
+  if (cfIp) return cfIp;
+  const forwardedFor = headers.get("x-forwarded-for");
+  if (forwardedFor) {
+    const ips = forwardedFor.split(",").map((v) => v.trim()).filter(Boolean);
+    if (ips.length > 0) return ips[ips.length - 1];
+  }
+  const realIp = headers.get("x-real-ip");
+  if (realIp) return realIp;
+  const trueClientIp = headers.get("true-client-ip");
+  if (trueClientIp) return trueClientIp;
+  return "unknown";
+}
+export {
+  computeDeviceFingerprint,
+  extractClientIp,
+  ipToNetworkKey,
+  normalizeUserAgent
+};

package/dist/lib/auth/security-notifications/dispatcher.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Security-notifications dispatcher.
+ *
+ * Called from the Better Auth route handler AFTER the auth response has been
+ * produced. It inspects the request path + the outgoing response, and — when a
+ * security-relevant event succeeded — records login history and queues the
+ * appropriate email via the `auth:security-notification` scheduled action.
+ *
+ * ────────────────────────────────────────────────────────────────────────────
+ * ⚠️  CRITICAL FOOTGUN — read the user from the RESPONSE BODY, not the session.
+ * ────────────────────────────────────────────────────────────────────────────
+ * For a sign-in, the session does NOT exist on the INCOMING request: the session
+ * cookie is only now being written, sitting in the OUTGOING `Set-Cookie` header.
+ * Calling `auth.api.getSession({ headers: req.headers })` here would read the
+ * incoming cookies, find none, and silently return null — so new-device emails
+ * would NEVER fire. We therefore read the just-authenticated user from
+ * `response.clone().json()` (Better Auth's sign-in/change-password responses
+ * carry `{ user, token, ... }`).
+ *
+ * The ONE exception is `change-email`: that request is made by an ALREADY
+ * authenticated user (its incoming cookie is valid) and its response body is
+ * only `{ status: true }` — no user. There we DO read the session, to recover
+ * the *old* address the notification must go to. That asymmetry is deliberate;
+ * do not "simplify" it into a single getSession call.
+ *
+ * Everything here is best-effort: any failure is swallowed so a security email
+ * problem can NEVER turn a successful auth response into a 500.
+ */
+import type { NextRequest, NextResponse } from 'next/server';
+/**
+ * Entry point. Inspect (req, response) and fire the matching security email.
+ *
+ * @param req      the auth request (a clone is fine; headers + body are read here)
+ * @param response the outgoing auth response (cloned before reading its body)
+ */
+export declare function dispatchSecurityNotificationsForRequest(req: NextRequest, response: NextResponse | Response): Promise<void>;
+//# sourceMappingURL=dispatcher.d.ts.map

package/dist/lib/auth/security-notifications/dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/security-notifications/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAwM5D;;;;;GAKG;AACH,wBAAsB,uCAAuC,CAC3D,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,YAAY,GAAG,QAAQ,GAChC,OAAO,CAAC,IAAI,CAAC,CAsCf"}