@nextsparkjs/core 0.1.0-beta.19 → 0.1.0-beta.191

package/dist/lib/api/entity/public-resolver.js

@@ -1,4 +1,4 @@
-import { entityRegistry, ensureInitialized } from "../../entities/registry";
+import { entityRegistry, ensureInitialized } from "../../entities/registry.js";
 import { existsSync } from "fs";
 import { join } from "path";
 async function resolvePublicEntityFromUrl(pathname) {

package/dist/lib/api/entity/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAIxD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,iBAAiB,EAAE,OAAO,CAAA;IAC1B,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkDtF;AA2CD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ5D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAC1D,OAAO,CAyBT"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAIxD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,iBAAiB,EAAE,OAAO,CAAA;IAC1B,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkDtF;AA2CD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ5D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAC1D,OAAO,CAkBT"}

package/dist/lib/api/entity/resolver.js

@@ -1,4 +1,4 @@
-import { entityRegistry, ensureInitialized } from "../../entities/registry";
+import { entityRegistry, ensureInitialized } from "../../entities/registry.js";
 import { existsSync } from "fs";
 import { join } from "path";
 async function resolveEntityFromUrl(pathname) {
@@ -76,20 +76,16 @@ async function getGenericEntities() {
   return allEntities.filter((entity) => entity.enabled).map((entity) => entity.slug).filter((slug) => !isCorePath(slug));
 }
 function validateEntityOperation(entityConfig, operation) {
-  var _a, _b, _c, _d, _e, _f;
   if (!entityConfig.enabled) {
     return false;
   }
   switch (operation) {
     case "list":
     case "read":
-      return entityConfig.enabled;
     case "create":
-      return entityConfig.enabled && (((_b = (_a = entityConfig.permissions) == null ? void 0 : _a.actions) == null ? void 0 : _b.some((a) => a.action === "create")) ?? true);
     case "update":
-      return entityConfig.enabled && (((_d = (_c = entityConfig.permissions) == null ? void 0 : _c.actions) == null ? void 0 : _d.some((a) => a.action === "update")) ?? true);
     case "delete":
-      return entityConfig.enabled && (((_f = (_e = entityConfig.permissions) == null ? void 0 : _e.actions) == null ? void 0 : _f.some((a) => a.action === "delete")) ?? true);
+      return entityConfig.enabled;
     default:
       return false;
   }

package/dist/lib/api/entity-handler.js

@@ -1,5 +1,5 @@
-import { auth } from "../auth";
-import { entityRegistry, ensureInitialized } from "../entities/registry";
+import { getTypedSession } from "../auth.js";
+import { entityRegistry, ensureInitialized } from "../entities/registry.js";
 import {
   createApiResponse,
   createApiError,
@@ -9,11 +9,11 @@ import {
   includeEntityMetadata,
   processEntityMetadata,
   handleEntityMetadataInResponse
-} from "./helpers";
-import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../entities/entity-hooks";
+} from "./helpers.js";
+import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../entities/entity-hooks.js";
 async function checkBasicAuth(request, entityName) {
   try {
-    const session = await auth.api.getSession({ headers: request.headers });
+    const session = await getTypedSession(request.headers);
     if (!session) {
       return {
         allowed: false,

package/dist/lib/api/helpers.d.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { ApiKeyAuth } from './auth';
+import { type AuthenticateOptions } from './auth/scope-policy';
 interface SessionAuth {
     userId: string;
     scopes: string[];
@@ -10,14 +11,34 @@ type Auth = ApiKeyAuth | SessionAuth;
 /**
  * Validates authentication using session or API key
  * Prefers session auth if available, falls back to API key
- */
-export declare function validateAndAuthenticateRequest(request: NextRequest): Promise<{
-    auth: Auth;
+ *
+ * Resolves to `{ auth: null }` when the request carries neither a valid
+ * session nor a valid API key — it never throws for an unauthenticated
+ * request (#112). Routes are expected to branch on `auth` and answer 401
+ * themselves; a throw here would be swallowed by the generic try/catch most
+ * routes wrap around their body and surface as a 500 instead.
+ *
+ * API-key scope enforcement fails closed here (#93), with the same rule as
+ * `authenticateRequest`: declare `{ requiredScope }` (or, explicitly,
+ * `{ allowAnyScope: true }`). A key rejected on scope resolves to
+ * `{ auth: null, errorResponse }` where `errorResponse` is the ready-made
+ * 403 — return it. Session auth keeps its role-derived scopes and is not
+ * gated here; use `checkScope` for explicit per-branch checks.
+ */
+export declare function validateAndAuthenticateRequest(request: NextRequest, options?: AuthenticateOptions): Promise<{
+    auth: Auth | null;
     rateLimitResponse?: NextResponse;
+    /** Set (403) when a valid API key was rejected by scope enforcement. */
+    errorResponse?: NextResponse;
 }>;
 /**
  * Valida la API key y aplica rate limiting
  * Esta función debe ser llamada al inicio de cada endpoint API v1
+ *
+ * API-key-only and strict: throws when no valid key is present. Endpoints
+ * that also accept sessions (or want to treat anonymous callers as a normal
+ * 401 branch) should use `validateAndAuthenticateRequest`, which resolves to
+ * a null auth instead.
  */
 export declare function validateAndAuthenticateApiRequest(request: NextRequest): Promise<{
     auth: ApiKeyAuth;
@@ -31,8 +52,12 @@ export declare function getApiAuth(request: NextRequest): ApiKeyAuth;
 /**
  * Verifica que la autenticación tenga el scope requerido
  * Retorna un NextResponse de error si no tiene permisos, null si está autorizado
+ *
+ * Applies to both session auth (role-derived scopes) and API-key auth, with
+ * the same matching rule as `hasRequiredScope`: the wildcard `*` satisfies
+ * any scope, and an array is satisfied by any one of its entries.
  */
-export declare function checkScope(auth: Auth, requiredScope: string): NextResponse | null;
+export declare function checkScope(auth: Auth, requiredScope: string | string[]): NextResponse | null;
 /**
  * Crea una respuesta exitosa estandarizada para la API
  */
@@ -99,12 +124,34 @@ export declare function sanitizeSearchQuery(query: string): string;
 export declare function parseFilters(request: NextRequest): Record<string, string>;
 /**
  * Agrega headers de CORS para API externa
+ * Uses unified getCorsOrigins() for single source of truth
  */
 export declare function addCorsHeaders(response: NextResponse, request?: NextRequest): Promise<NextResponse>;
 /**
  * Maneja requests OPTIONS para CORS preflight
  */
 export declare function handleCorsPreflightRequest(request?: NextRequest): Promise<NextResponse>;
+/**
+ * Wraps an auth handler response with CORS headers
+ *
+ * Better Auth handles OPTIONS preflight but doesn't add CORS headers to actual responses.
+ * This utility wraps responses to add proper CORS headers for cross-origin requests.
+ *
+ * @param handler - The original handler function (GET, POST, etc.)
+ * @param request - The incoming request
+ * @returns Response with CORS headers added
+ *
+ * @example
+ * ```ts
+ * // In your auth route:
+ * import { wrapAuthHandlerWithCors } from '@nextsparkjs/core/lib/api/helpers'
+ *
+ * export async function POST(req: NextRequest) {
+ *   return wrapAuthHandlerWithCors(() => handlers.POST(req), req)
+ * }
+ * ```
+ */
+export declare function wrapAuthHandlerWithCors(handler: () => Promise<Response>, request: NextRequest): Promise<Response>;
 /**
  * Parsea los parámetros de metadata de una request
  * Soporta: metas=all, metas=key1,key2,key3, o sin parámetro

package/dist/lib/api/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAYpD,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IAClF,IAAI,EAAE,IAAI,CAAC;IACX,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CAoCD;AAgFD;;;GAGG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CA4BD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAc3D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBjF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAiCzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAWpD,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CASD;AA+BD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}

package/dist/lib/api/helpers.js

@@ -1,13 +1,20 @@
 import { NextResponse } from "next/server";
-import { validateApiKey } from "./auth";
-import { mutateWithRLS, queryWithRLS } from "../db";
-import { checkRateLimit, addRateLimitHeaders } from "./rate-limit";
-import { getApplicationConfig } from "../config";
-import { auth } from "../auth";
-import { MetaService } from "../services/meta.service";
-import { ScopeService } from "../services/scope.service";
-import { getChildEntities } from "../entities/queries";
-async function validateAndAuthenticateRequest(request) {
+import { validateApiKey } from "./auth.js";
+import { mutateWithRLS, queryWithRLS } from "../db.js";
+import { checkRateLimit, addRateLimitHeaders } from "./rate-limit.js";
+import { getApplicationConfig } from "../config/index.js";
+import { auth } from "../auth.js";
+import { MetaService } from "../services/meta.service.js";
+import { ScopeService } from "../services/scope.service.js";
+import { getChildEntities } from "../entities/queries.js";
+import { getCorsOrigins, normalizeOrigin, isOriginAllowed } from "../utils/cors.js";
+import {
+  describeRoute,
+  normalizeRequiredScopes,
+  resolveApiKeyScopeFailure,
+  scopesSatisfy
+} from "./auth/scope-policy.js";
+async function validateAndAuthenticateRequest(request, options = {}) {
   var _a;
   const cookieHeader = request.headers.get("cookie");
   if (cookieHeader) {
@@ -34,7 +41,21 @@ async function validateAndAuthenticateRequest(request) {
     }
   }
   console.log(`[Auth] Falling back to API key authentication`);
-  return validateAndAuthenticateApiRequest(request);
+  const apiKeyAuth = await validateApiKey(request);
+  if (!apiKeyAuth) {
+    return { auth: null };
+  }
+  const scopeFailure = resolveApiKeyScopeFailure(apiKeyAuth.scopes, options, describeRoute(request));
+  if (scopeFailure) {
+    return {
+      auth: null,
+      errorResponse: NextResponse.json(
+        { success: false, error: scopeFailure.message, code: scopeFailure.code },
+        { status: scopeFailure.status }
+      )
+    };
+  }
+  return applyApiKeyRateLimit(apiKeyAuth);
 }
 function generateScopesForRole(role, flags = []) {
   const baseScopes = getBaseScopesFromRegistry();
@@ -79,6 +100,9 @@ async function validateAndAuthenticateApiRequest(request) {
   if (!auth2) {
     throw new Error("Invalid API key");
   }
+  return applyApiKeyRateLimit(auth2);
+}
+function applyApiKeyRateLimit(auth2) {
   const rateLimitResult = checkRateLimit(auth2.keyId);
   if (!rateLimitResult.allowed) {
     const response = NextResponse.json(
@@ -103,21 +127,31 @@ function getApiAuth(request) {
   if (!userId || !keyId || !scopesHeader) {
     throw new Error("Missing API authentication headers");
   }
+  let scopes = [];
+  try {
+    const parsed = JSON.parse(scopesHeader);
+    if (Array.isArray(parsed)) {
+      scopes = parsed.filter((s) => typeof s === "string");
+    }
+  } catch {
+    console.warn("[API] Invalid scopes header format");
+  }
   return {
     userId,
     keyId,
-    scopes: JSON.parse(scopesHeader)
+    scopes
   };
 }
 function checkScope(auth2, requiredScope) {
-  const hasRequiredScope = auth2.scopes.includes(requiredScope);
-  if (!hasRequiredScope) {
+  if (!scopesSatisfy(auth2.scopes, requiredScope)) {
+    const required = normalizeRequiredScopes(requiredScope);
+    const label = required.join("' or '");
     return NextResponse.json(
       {
         success: false,
         error: "Insufficient permissions",
-        message: `This operation requires the '${requiredScope}' scope`,
-        required_scope: requiredScope,
+        message: `This operation requires the '${label}' scope`,
+        required_scope: required.length === 1 ? required[0] : required,
         your_scopes: auth2.scopes,
         code: "INSUFFICIENT_PERMISSIONS"
       },
@@ -256,19 +290,25 @@ async function addCorsHeaders(response, request) {
   if (request) {
     const origin = request.headers.get("origin");
     if (origin) {
+      const normalizedOrigin = normalizeOrigin(origin);
       if (env === "development" && corsConfig.allowAllOrigins.development) {
-        allowedOrigin = origin;
+        allowedOrigin = normalizedOrigin;
       } else {
-        const allowedOrigins = corsConfig.allowedOrigins[env] || [];
-        if (allowedOrigins.includes(origin)) {
-          allowedOrigin = origin;
+        const allowedOrigins = getCorsOrigins(config, env);
+        const matched = isOriginAllowed(normalizedOrigin, allowedOrigins);
+        if (matched) {
+          allowedOrigin = matched;
         }
       }
     }
+  } else if (env === "development" && corsConfig.allowAllOrigins.development) {
+    const allowedOrigins = getCorsOrigins(config, env);
+    allowedOrigin = allowedOrigins[0] || "http://localhost:3000";
   }
   response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+  response.headers.append("Vary", "Origin");
   response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
-  response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key");
+  response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key, x-team-id, x-builder-source");
   response.headers.set("Access-Control-Allow-Credentials", "true");
   response.headers.set("Access-Control-Max-Age", "86400");
   return response;
@@ -277,6 +317,35 @@ async function handleCorsPreflightRequest(request) {
   const response = new NextResponse(null, { status: 200 });
   return await addCorsHeaders(response, request);
 }
+async function wrapAuthHandlerWithCors(handler, request) {
+  const response = await handler();
+  const newResponse = new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: new Headers(response.headers)
+  });
+  const env = process.env.NODE_ENV || "development";
+  const config = await getApplicationConfig();
+  const corsConfig = config.api.cors;
+  const origin = request.headers.get("origin");
+  if (origin) {
+    const normalizedOrigin = normalizeOrigin(origin);
+    let allowedOrigin = "null";
+    if (env === "development" && corsConfig.allowAllOrigins.development) {
+      allowedOrigin = normalizedOrigin;
+    } else {
+      const allowedOrigins = getCorsOrigins(config, env);
+      const matched = isOriginAllowed(normalizedOrigin, allowedOrigins);
+      if (matched) {
+        allowedOrigin = matched;
+      }
+    }
+    newResponse.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+    newResponse.headers.set("Access-Control-Allow-Credentials", "true");
+    newResponse.headers.append("Vary", "Origin");
+  }
+  return newResponse;
+}
 function parseMetaParams(request) {
   const url = new URL(request.url);
   const metasParam = url.searchParams.get("metas");
@@ -513,5 +582,6 @@ export {
   sanitizeSearchQuery,
   validateAndAuthenticateApiRequest,
   validateAndAuthenticateRequest,
-  withApiLogging
+  withApiLogging,
+  wrapAuthHandlerWithCors
 };

package/dist/lib/api/index.d.ts

@@ -5,10 +5,14 @@
  * including authentication, rate limiting, caching, and utilities.
  */
 export * from './auth';
+export * from './auth/dual-auth';
 export * from './keys';
 export * from './helpers';
 export * from './rate-limit';
 export * from './cache';
+export * from './distributed-cache';
+export * from './api-error';
 export type { ApiKeyAuth, ApiKeyValidationResult } from './auth';
 export type { ApiScope } from './keys';
+export { ApiError } from './api-error';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/api/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,QAAQ,CAAC;AACvB,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AAGxB,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,QAAQ,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/api/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,QAAQ,CAAC;AACvB,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAG5B,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,QAAQ,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}

package/dist/lib/api/index.js

@@ -1,5 +1,12 @@
-export * from "./auth";
-export * from "./keys";
-export * from "./helpers";
-export * from "./rate-limit";
-export * from "./cache";
+export * from "./auth.js";
+export * from "./auth/dual-auth.js";
+export * from "./keys.js";
+export * from "./helpers.js";
+export * from "./rate-limit.js";
+export * from "./cache.js";
+export * from "./distributed-cache.js";
+export * from "./api-error.js";
+import { ApiError } from "./api-error.js";
+export {
+  ApiError
+};

package/dist/lib/api/keys.d.ts

@@ -39,42 +39,73 @@ export declare class ApiKeyManager {
  * Definición de scopes disponibles para API keys
  */
 export declare const API_SCOPES: {
-    readonly 'users:read': "Leer información de usuarios";
-    readonly 'users:write': "Crear y actualizar usuarios";
-    readonly 'users:delete': "Eliminar usuarios";
-    readonly 'tasks:read': "Leer tasks";
-    readonly 'tasks:write': "Crear y actualizar tasks";
-    readonly 'tasks:delete': "Eliminar tasks";
-    readonly 'media:read': "Leer información de archivos y media";
-    readonly 'media:write': "Subir y actualizar archivos";
-    readonly 'media:delete': "Eliminar archivos";
-    readonly 'admin:api-keys': "Gestionar API keys";
-    readonly 'admin:users': "Administración completa de usuarios";
-    readonly '*': "Acceso completo (solo superadmin)";
+    readonly 'users:read': "Read user information";
+    readonly 'users:write': "Create and update users";
+    readonly 'users:delete': "Delete users";
+    readonly 'tasks:read': "Read tasks";
+    readonly 'tasks:write': "Create and update tasks";
+    readonly 'tasks:delete': "Delete tasks";
+    readonly 'media:read': "Read file and media information";
+    readonly 'media:write': "Upload and update files";
+    readonly 'media:delete': "Delete files";
+    readonly 'teams:read': "Read teams, members and invitations";
+    readonly 'teams:write': "Create and update teams, members and invitations";
+    readonly 'teams:delete': "Delete teams";
+    readonly 'billing:read': "Read subscriptions, invoices and usage";
+    readonly 'billing:write': "Manage subscriptions, checkout, plan changes and usage";
+    readonly 'admin:api-keys': "Manage API keys";
+    readonly 'admin:users': "Full user administration";
+    readonly 'admin:devtools': "Access to DevTools APIs (registries, testing, scheduled actions)";
+    readonly '*': "Full access (superadmin only)";
 };
 export type ApiScope = keyof typeof API_SCOPES;
+/**
+ * Every scope this deployment understands: the ones core enforces, plus the ones the app declared
+ * in `api.scopes`.
+ *
+ * A function and not a const because the app's config is merged at load time — and because the
+ * ONLY correct answer to "is this scope valid?" is one that includes the app's own. Validating
+ * against core's list alone let an app guard a route with a scope no key could ever carry, which
+ * does not fail loudly: it quietly makes the wildcard the only key that works.
+ *
+ * Core's entries win a name collision. An app extends the vocabulary; it does not redefine what
+ * `admin:api-keys` means.
+ */
+export declare function getApiScopes(): Record<string, string>;
+/** The scopes an app added, for a UI that wants to group them apart from core's. */
+export declare function getAppApiScopes(): Record<string, string>;
 /**
  * Categorías de scopes para organización en UI
  */
 export declare const SCOPE_CATEGORIES: {
     readonly users: {
-        readonly name: "Usuarios";
-        readonly description: "Gestión de usuarios del sistema";
+        readonly name: "Users";
+        readonly description: "System user management";
         readonly scopes: ApiScope[];
     };
     readonly tasks: {
         readonly name: "Tasks";
-        readonly description: "Gestión de tareas y TODOs";
+        readonly description: "Task and TODO management";
+        readonly scopes: ApiScope[];
+    };
+    readonly teams: {
+        readonly name: "Teams";
+        readonly description: "Teams, members and invitations";
+        readonly scopes: ApiScope[];
+    };
+    readonly billing: {
+        readonly name: "Billing";
+        readonly description: "Subscriptions, invoices, usage and plans";
         readonly scopes: ApiScope[];
     };
     readonly admin: {
-        readonly name: "Administración";
-        readonly description: "Funciones administrativas";
+        readonly name: "Administration";
+        readonly description: "Administrative functions";
         readonly scopes: ApiScope[];
     };
     readonly system: {
-        readonly name: "Sistema";
-        readonly description: "Acceso completo al sistema";
+        readonly name: "System";
+        readonly description: "Full system access";
         readonly scopes: ApiScope[];
     };
 };

package/dist/lib/api/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/keys.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,aAAa;IACxB;;;OAGG;WACU,cAAc,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBrF;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;OAEG;WACU,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE;IAUpF;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;CAchD;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;CAsBb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;yBAIgC,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKtB,QAAQ,EAAE;;;;;yBAKtC,QAAQ,EAAE;;CAErB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASd,CAAC;AAEX;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmB9F"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/keys.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,aAAa;IACxB;;;OAGG;WACU,cAAc,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBrF;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;OAEG;WACU,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE;IAUpF;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;CAchD;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;CAgCb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrD;AAED,oFAAoF;AACpF,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxD;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;yBAIgC,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKtB,QAAQ,EAAE;;;;;yBAKQ,QAAQ,EAAE;;;;;yBAKxD,QAAQ,EAAE;;CAErB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASd,CAAC;AAEX;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmB9F"}

package/dist/lib/api/keys.js

@@ -1,3 +1,4 @@
+import { API_CONFIG } from "../config/config-sync.js";
 class ApiKeyManager {
   /**
    * Genera una nueva API key con formato seguro
@@ -44,7 +45,7 @@ class ApiKeyManager {
    * Valida que los scopes sean válidos
    */
   static validateScopes(scopes) {
-    const validScopes = Object.keys(API_SCOPES);
+    const validScopes = Object.keys(getApiScopes());
     const invalidScopes = scopes.filter((scope) => !validScopes.includes(scope));
     return {
       valid: invalidScopes.length === 0,
@@ -69,42 +70,71 @@ class ApiKeyManager {
 }
 const API_SCOPES = {
   // Usuarios
-  "users:read": "Leer informaci\xF3n de usuarios",
-  "users:write": "Crear y actualizar usuarios",
-  "users:delete": "Eliminar usuarios",
+  "users:read": "Read user information",
+  "users:write": "Create and update users",
+  "users:delete": "Delete users",
   // Tasks
-  "tasks:read": "Leer tasks",
-  "tasks:write": "Crear y actualizar tasks",
-  "tasks:delete": "Eliminar tasks",
+  "tasks:read": "Read tasks",
+  "tasks:write": "Create and update tasks",
+  "tasks:delete": "Delete tasks",
   // Media (archivos, imágenes, videos)
-  "media:read": "Leer informaci\xF3n de archivos y media",
-  "media:write": "Subir y actualizar archivos",
-  "media:delete": "Eliminar archivos",
+  "media:read": "Read file and media information",
+  "media:write": "Upload and update files",
+  "media:delete": "Delete files",
+  // Teams (equipos, miembros e invitaciones)
+  "teams:read": "Read teams, members and invitations",
+  "teams:write": "Create and update teams, members and invitations",
+  "teams:delete": "Delete teams",
+  // Billing (suscripciones, facturas, uso y planes)
+  "billing:read": "Read subscriptions, invoices and usage",
+  "billing:write": "Manage subscriptions, checkout, plan changes and usage",
   // Administración
-  "admin:api-keys": "Gestionar API keys",
-  "admin:users": "Administraci\xF3n completa de usuarios",
+  "admin:api-keys": "Manage API keys",
+  "admin:users": "Full user administration",
+  "admin:devtools": "Access to DevTools APIs (registries, testing, scheduled actions)",
   // Comodín (solo para superadmins)
-  "*": "Acceso completo (solo superadmin)"
+  "*": "Full access (superadmin only)"
 };
+function getApiScopes() {
+  var _a;
+  const appScopes = ((_a = API_CONFIG) == null ? void 0 : _a.scopes) ?? {};
+  return { ...appScopes, ...API_SCOPES };
+}
+function getAppApiScopes() {
+  var _a;
+  const appScopes = ((_a = API_CONFIG) == null ? void 0 : _a.scopes) ?? {};
+  const coreNames = Object.keys(API_SCOPES);
+  return Object.fromEntries(Object.entries(appScopes).filter(([name]) => !coreNames.includes(name)));
+}
 const SCOPE_CATEGORIES = {
   users: {
-    name: "Usuarios",
-    description: "Gesti\xF3n de usuarios del sistema",
+    name: "Users",
+    description: "System user management",
     scopes: ["users:read", "users:write", "users:delete"]
   },
   tasks: {
     name: "Tasks",
-    description: "Gesti\xF3n de tareas y TODOs",
+    description: "Task and TODO management",
     scopes: ["tasks:read", "tasks:write", "tasks:delete"]
   },
+  teams: {
+    name: "Teams",
+    description: "Teams, members and invitations",
+    scopes: ["teams:read", "teams:write", "teams:delete"]
+  },
+  billing: {
+    name: "Billing",
+    description: "Subscriptions, invoices, usage and plans",
+    scopes: ["billing:read", "billing:write"]
+  },
   admin: {
-    name: "Administraci\xF3n",
-    description: "Funciones administrativas",
-    scopes: ["admin:api-keys", "admin:users"]
+    name: "Administration",
+    description: "Administrative functions",
+    scopes: ["admin:api-keys", "admin:users", "admin:devtools"]
   },
   system: {
-    name: "Sistema",
-    description: "Acceso completo al sistema",
+    name: "System",
+    description: "Full system access",
     scopes: ["*"]
   }
 };
@@ -151,5 +181,7 @@ export {
   ApiKeyManager,
   RATE_LIMITS,
   SCOPE_CATEGORIES,
+  getApiScopes,
+  getAppApiScopes,
   getRateLimitForScopes
 };

package/dist/lib/api/meta.middleware.js

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
-import { MetaService } from "../services/meta.service";
-import { validateBasicMetas } from "../helpers/entity-meta.helpers";
+import { MetaService } from "../services/meta.service.js";
+import { validateBasicMetas } from "../helpers/entity-meta.helpers.js";
 function withUnifiedMeta(entityType) {
   return function(handler) {
     return async function(req, context) {

package/dist/lib/api/permission-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/api/permission-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAa1C;;GAEG;AACH,eAAO,MAAM,WAAW,SAAS,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAElF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAOjF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CAkCtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B"}
+{"version":3,"file":"permission-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/api/permission-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1C;;GAEG;AACH,eAAO,MAAM,WAAW,SAAS,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAElF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAOjF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CAkCtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B"}