@nextsparkjs/core 0.1.0-beta.190 → 0.1.0-beta.192

package/dist/lib/api/entity/resolver.d.ts

@@ -1,14 +1,12 @@
 /**
  * Entity Resolver
  *
- * Resolves entity configurations from URLs and determines if custom
- * overrides exist in (contents) folders.
+ * Resolves entity configurations from URLs.
  */
 import type { EntityConfig } from '../../entities/types';
 export interface EntityResolution {
     entityName: string;
     entityConfig: EntityConfig | null;
-    hasCustomOverride: boolean;
     isValidEntity: boolean;
 }
 /**

package/dist/lib/api/entity/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAIxD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,iBAAiB,EAAE,OAAO,CAAA;IAC1B,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkDtF;AA2CD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ5D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAC1D,OAAO,CAkBT"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2CtF;AAoBD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ5D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAC1D,OAAO,CAkBT"}

package/dist/lib/api/entity/resolver.js

@@ -1,13 +1,10 @@
 import { entityRegistry, ensureInitialized } from "../../entities/registry.js";
-import { existsSync } from "fs";
-import { join } from "path";
 async function resolveEntityFromUrl(pathname) {
   const segments = pathname.split("/").filter(Boolean);
   if (segments.length < 3 || segments[0] !== "api" || segments[1] !== "v1") {
     return {
       entityName: "",
       entityConfig: null,
-      hasCustomOverride: false,
       isValidEntity: false
     };
   }
@@ -16,8 +13,6 @@ async function resolveEntityFromUrl(pathname) {
     return {
       entityName: entitySlug,
       entityConfig: null,
-      hasCustomOverride: true,
-      // Treat core as override
       isValidEntity: false
     };
   }
@@ -27,36 +22,16 @@ async function resolveEntityFromUrl(pathname) {
     return {
       entityName: entitySlug,
       entityConfig: null,
-      hasCustomOverride: false,
       isValidEntity: false
     };
   }
-  const hasCustomOverride = await checkCustomOverride(entitySlug);
   return {
     entityName: entityConfig.slug,
     // Use slug as entityName for new structure
     entityConfig,
-    hasCustomOverride,
     isValidEntity: true
   };
 }
-async function checkCustomOverride(entityName) {
-  try {
-    const customRoutePath = join(
-      process.cwd(),
-      "app",
-      "api",
-      "v1",
-      "(contents)",
-      entityName,
-      "route.ts"
-    );
-    return existsSync(customRoutePath);
-  } catch (error) {
-    console.warn(`Error checking custom override for ${entityName}:`, error);
-    return false;
-  }
-}
 function isCorePath(entityName) {
   const corePaths = [
     "users",

package/dist/lib/api/helpers.d.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { ApiKeyAuth } from './auth';
+import { isValidUUID } from '../utils/uuid';
 import { type AuthenticateOptions } from './auth/scope-policy';
 interface SessionAuth {
     userId: string;
@@ -110,7 +111,7 @@ export declare function withApiLogging<T extends unknown[]>(handler: (request: N
 /**
  * Valida que un UUID tenga formato válido
  */
-export declare function isValidUUID(uuid: string): boolean;
+export { isValidUUID };
 /**
  * Sanitiza parámetros de búsqueda para prevenir inyección SQL
  */
@@ -221,5 +222,4 @@ export declare function processEntityMetadata(entityType: string, entityId: stri
     success: boolean;
     errors: string[];
 }>;
-export {};
 //# sourceMappingURL=helpers.d.ts.map

package/dist/lib/api/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAWpD,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CASD;AA+BD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAWpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CASD;AA+BD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}

package/dist/lib/api/helpers.js

@@ -8,6 +8,7 @@ import { MetaService } from "../services/meta.service.js";
 import { ScopeService } from "../services/scope.service.js";
 import { getChildEntities } from "../entities/queries.js";
 import { getCorsOrigins, normalizeOrigin, isOriginAllowed } from "../utils/cors.js";
+import { isValidUUID } from "../utils/uuid.js";
 import {
   describeRoute,
   normalizeRequiredScopes,
@@ -257,10 +258,6 @@ function withApiLogging(handler) {
     }
   };
 }
-function isValidUUID(uuid) {
-  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-  return uuidRegex.test(uuid);
-}
 function sanitizeSearchQuery(query) {
   if (!query || typeof query !== "string") {
     return "";

package/dist/lib/api/keys.js

@@ -1,4 +1,4 @@
-import { API_CONFIG } from "../config/config-sync.js";
+import { API_CONFIG } from "../config/config-client.js";
 class ApiKeyManager {
   /**
    * Genera una nueva API key con formato seguro

package/dist/lib/api/permission-middleware.js

@@ -52,7 +52,7 @@ async function checkEntityPermission(userId, teamId, entitySlug, action) {
 async function checkEntityPermissionOrFail(userId, teamId, entitySlug, method, isCollection) {
   const action = getActionFromMethod(method, isCollection);
   const result = await checkEntityPermission(userId, teamId, entitySlug, action);
-  return result.allowed ? null : result.error;
+  return result.allowed === true ? null : result.error;
 }
 export {
   LIST_ACTION,

package/dist/lib/api/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAsCvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AAoGD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAEb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAkCvE"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAwCvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AAoGD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAEb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAkCvE"}

package/dist/lib/api/rate-limit.js

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { unstable_rethrow } from "next/navigation";
 import { getRateLimitForScopes } from "./keys.js";
 import { rateLimitCache, getCacheKey } from "./cache.js";
 import {
@@ -171,6 +172,7 @@ function withRateLimit(handler) {
       const response = await handler(request, ...args);
       return addRateLimitHeaders(response, keyId, scopes);
     } catch (error) {
+      unstable_rethrow(error);
       console.error("Rate limiting error:", error);
       return handler(request, ...args);
     }

package/dist/lib/auth/readiness.d.ts

@@ -0,0 +1,92 @@
+import type { AuthConfig, AuthLoginMethod } from '../config/types';
+/**
+ * @internal Pure readiness inputs; integration is intentionally deferred.
+ *
+ * Profiles:
+ * - `web-local-auth` and `headless` validate the same configured methods: a
+ *   headless host still serves the local auth routes, so it needs the same
+ *   providers. There is intentionally no headless-specific readiness.
+ * - `external-no-local-auth` is an assertion by the host adapter that local
+ *   auth routes are not served. The evaluator does not prove it and disables
+ *   no routes; it only reports `not-applicable`.
+ */
+export interface AuthReadinessInput {
+    profile: 'web-local-auth' | 'headless' | 'external-no-local-auth';
+    stage: 'build' | 'runtime';
+    environment: 'development' | 'production';
+    authConfig?: Pick<AuthConfig, 'methods' | 'providers' | 'emailAndPassword'> | null;
+    configuration?: {
+        email?: {
+            /**
+             * Raw EMAIL_PROVIDER. Exactly `auto`, `resend` or `console`; undefined or
+             * empty selects `auto`. Unlike EmailFactory, which sends unknown values
+             * down its auto path, any other token (including case- or
+             * whitespace-altered ones) is rejected: this check deliberately fails closed.
+             */
+            provider?: string;
+            resendApiKey?: string;
+            resendFromEmail?: string;
+            /**
+             * Boolean(FORCE_RESEND_IN_DEV), supplied by the adapter; this evaluator
+             * never reads process.env. Only affects `auto` in development.
+             */
+            forceResendInDevelopment?: boolean;
+            /** Missing values are expected to be injected after the build. */
+            runtimeOnly?: boolean;
+        };
+        google?: {
+            clientId?: string;
+            clientSecret?: string;
+            /** Missing values are expected to be injected after the build. */
+            runtimeOnly?: boolean;
+        };
+    };
+}
+export type AuthReadinessDiagnosticCode = 'AUTH_NO_AVAILABLE_METHOD' | 'AUTH_ALL_METHODS_DISABLED' | 'EMAIL_RUNTIME_VALIDATION_REQUIRED' | 'EMAIL_PROVIDER_DEVELOPMENT_ONLY' | 'EMAIL_PROVIDER_UNSUPPORTED' | 'RESEND_API_KEY_MISSING' | 'RESEND_API_KEY_PLACEHOLDER' | 'RESEND_API_KEY_MALFORMED' | 'RESEND_FROM_EMAIL_MISSING' | 'RESEND_FROM_EMAIL_PLACEHOLDER' | 'RESEND_FROM_EMAIL_MALFORMED' | 'RESEND_FROM_EMAIL_SANDBOX' | 'GOOGLE_RUNTIME_VALIDATION_REQUIRED' | 'GOOGLE_CLIENT_ID_MISSING' | 'GOOGLE_CLIENT_ID_PLACEHOLDER' | 'GOOGLE_CLIENT_ID_MALFORMED' | 'GOOGLE_CLIENT_SECRET_MISSING' | 'GOOGLE_CLIENT_SECRET_PLACEHOLDER' | 'GOOGLE_CLIENT_SECRET_MALFORMED';
+/**
+ * Severity follows the overall outcome. When the outcome is `ready` or
+ * `deferred`, per-method problems are warnings: the method stays out of
+ * `availableMethods` and must not be advertised, but another path exists.
+ * When the outcome is `invalid`, they are errors, and a final `method: 'auth'`
+ * error explains that no usable path remains. Explicitly disabled methods are
+ * intentional, so they produce no per-method diagnostic.
+ */
+export interface AuthReadinessDiagnostic {
+    method: 'auth' | 'email' | 'google' | 'email-password';
+    code: AuthReadinessDiagnosticCode;
+    severity: 'error' | 'warning';
+    message: string;
+}
+/**
+ * @internal Safe to serialize: credential values are never copied into this result.
+ *
+ * `declaredMethods` keeps the selected intent (like resolveAuthMethods), even
+ * for disabled methods. `availableMethods` is the only list a UI may advertise.
+ * The outcome is `ready` when at least one method is available. It is
+ * `deferred` only at build, when none is available but a runtimeOnly one can
+ * still be validated; runtime must then re-evaluate. Otherwise it is `invalid`.
+ */
+export interface AuthReadinessResult {
+    outcome: 'ready' | 'invalid' | 'deferred' | 'not-applicable';
+    declaredMethods: AuthLoginMethod[];
+    availableMethods: AuthLoginMethod[];
+    deferredMethods: AuthLoginMethod[];
+    diagnostics: AuthReadinessDiagnostic[];
+}
+/**
+ * Maps the provider environment contract (EMAIL_PROVIDER, RESEND_API_KEY,
+ * RESEND_FROM_EMAIL, FORCE_RESEND_IN_DEV, GOOGLE_CLIENT_ID,
+ * GOOGLE_CLIENT_SECRET) onto evaluator configuration. Shared by the runtime
+ * adapter and the production build check so both read the same variables.
+ */
+export declare function authReadinessConfigurationFromEnv(env: Record<string, string | undefined>): NonNullable<AuthReadinessInput['configuration']>;
+/**
+ * Evaluates whether at least one method declared by AuthConfig has a
+ * syntactically configured server-side provider. This performs no provider or
+ * network I/O, reads no environment and does not log. Syntax checks never prove
+ * that a domain is verified or that delivery works.
+ *
+ * @internal Integration with build/start/UI gates belongs to a later slice.
+ */
+export declare function evaluateAuthReadiness(input: AuthReadinessInput): AuthReadinessResult;
+//# sourceMappingURL=readiness.d.ts.map

package/dist/lib/auth/readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGlE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,gBAAgB,GAAG,UAAU,GAAG,wBAAwB,CAAA;IACjE,KAAK,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1B,WAAW,EAAE,aAAa,GAAG,YAAY,CAAA;IACzC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAA;IAClF,aAAa,CAAC,EAAE;QACd,KAAK,CAAC,EAAE;YACN;;;;;eAKG;YACH,QAAQ,CAAC,EAAE,MAAM,CAAA;YACjB,YAAY,CAAC,EAAE,MAAM,CAAA;YACrB,eAAe,CAAC,EAAE,MAAM,CAAA;YACxB;;;eAGG;YACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;YAClC,kEAAkE;YAClE,WAAW,CAAC,EAAE,OAAO,CAAA;SACtB,CAAA;QACD,MAAM,CAAC,EAAE;YACP,QAAQ,CAAC,EAAE,MAAM,CAAA;YACjB,YAAY,CAAC,EAAE,MAAM,CAAA;YACrB,kEAAkE;YAClE,WAAW,CAAC,EAAE,OAAO,CAAA;SACtB,CAAA;KACF,CAAA;CACF;AAED,MAAM,MAAM,2BAA2B,GACnC,0BAA0B,GAC1B,2BAA2B,GAC3B,mCAAmC,GACnC,iCAAiC,GACjC,4BAA4B,GAC5B,wBAAwB,GACxB,4BAA4B,GAC5B,0BAA0B,GAC1B,2BAA2B,GAC3B,+BAA+B,GAC/B,6BAA6B,GAC7B,2BAA2B,GAC3B,oCAAoC,GACpC,0BAA0B,GAC1B,8BAA8B,GAC9B,4BAA4B,GAC5B,8BAA8B,GAC9B,kCAAkC,GAClC,gCAAgC,CAAA;AAEpC;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,gBAAgB,CAAA;IACtD,IAAI,EAAE,2BAA2B,CAAA;IACjC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC5D,eAAe,EAAE,eAAe,EAAE,CAAA;IAClC,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,eAAe,EAAE,eAAe,EAAE,CAAA;IAClC,WAAW,EAAE,uBAAuB,EAAE,CAAA;CACvC;AA2KD;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,WAAW,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAalD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CAwEpF"}

package/dist/lib/auth/readiness.js

@@ -0,0 +1,192 @@
+import { DEFAULT_AUTH_METHODS, isAuthLoginMethod } from "./auth-methods.js";
+const EMAIL_PROVIDER_TOKENS = ["auto", "resend", "console"];
+const RESEND_API_KEY_PATTERN = /^re_[A-Za-z0-9_-]{16,}$/;
+const GOOGLE_CLIENT_ID_PATTERN = /^[0-9]+-[A-Za-z0-9_-]+\.apps\.googleusercontent\.com$/;
+const EMAIL_PATTERN = /^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/;
+const DOCUMENTED_PLACEHOLDER_SENDER_PATTERN = /@yourdomain\.com$/i;
+const RESEND_SANDBOX_SENDER_PATTERN = /@resend\.dev$/i;
+function isPlaceholder(value) {
+  return value.includes("...") || /(?:^|[_<\s.-])(?:your|replace|change|changeme|todo|placeholder|x{3,})(?:[_>\s.-]|$)/i.test(value) || DOCUMENTED_PLACEHOLDER_SENDER_PATTERN.test(value) || /^<[^>]+>$/.test(value);
+}
+function credentialState(value, pattern, minimumLength = 1) {
+  const normalized = (value == null ? void 0 : value.trim()) ?? "";
+  if (!normalized) return "missing";
+  if (isPlaceholder(normalized)) return "placeholder";
+  if (normalized.length < minimumLength || !pattern.test(normalized)) return "malformed";
+  return "valid";
+}
+function credentialDiagnostic(method, field, state) {
+  return {
+    method,
+    code: `${field}_${state.toUpperCase()}`,
+    severity: "error",
+    message: `${field} is ${state}; provide a syntactically valid value.`
+  };
+}
+function canDeferAtBuild(input, runtimeOnly, states) {
+  return input.stage === "build" && Boolean(runtimeOnly) && states.includes("missing") && states.every((state) => state === "missing" || state === "valid");
+}
+function resolveDeclaredMethods(authConfig) {
+  if (!Array.isArray(authConfig == null ? void 0 : authConfig.methods)) return [...DEFAULT_AUTH_METHODS];
+  const methods = authConfig.methods.filter(isAuthLoginMethod);
+  const uniqueMethods = [...new Set(methods)];
+  return uniqueMethods.length > 0 ? uniqueMethods : [...DEFAULT_AUTH_METHODS];
+}
+function selectEmailProvider(input, provider) {
+  var _a, _b, _c;
+  const email = (_a = input.configuration) == null ? void 0 : _a.email;
+  if (provider !== "auto") return provider;
+  if (input.environment === "development") {
+    return (email == null ? void 0 : email.forceResendInDevelopment) && email.resendApiKey ? "resend" : "console";
+  }
+  const hasResendConfiguration = Boolean(((_b = email == null ? void 0 : email.resendApiKey) == null ? void 0 : _b.trim()) || ((_c = email == null ? void 0 : email.resendFromEmail) == null ? void 0 : _c.trim()));
+  return hasResendConfiguration || input.stage === "build" && (email == null ? void 0 : email.runtimeOnly) ? "resend" : "console";
+}
+function evaluateEmailConfiguration(input, diagnostics) {
+  var _a, _b;
+  const email = (_a = input.configuration) == null ? void 0 : _a.email;
+  const provider = (email == null ? void 0 : email.provider) || "auto";
+  if (!EMAIL_PROVIDER_TOKENS.includes(provider)) {
+    diagnostics.push({
+      method: "email",
+      code: "EMAIL_PROVIDER_UNSUPPORTED",
+      severity: "error",
+      message: "EMAIL_PROVIDER must be exactly auto, resend or console (case- and whitespace-sensitive)."
+    });
+    return "invalid";
+  }
+  if (selectEmailProvider(input, provider) === "console") {
+    if (input.environment === "development") return "available";
+    diagnostics.push({
+      method: "email",
+      code: "EMAIL_PROVIDER_DEVELOPMENT_ONLY",
+      severity: "error",
+      message: "Console-delivered email is development-only; configure Resend for production local authentication."
+    });
+    return "invalid";
+  }
+  const apiKeyState = credentialState(email == null ? void 0 : email.resendApiKey, RESEND_API_KEY_PATTERN);
+  let fromEmailState = credentialState(email == null ? void 0 : email.resendFromEmail, EMAIL_PATTERN);
+  if (fromEmailState === "valid" && input.environment === "production" && RESEND_SANDBOX_SENDER_PATTERN.test(((_b = email == null ? void 0 : email.resendFromEmail) == null ? void 0 : _b.trim()) ?? "")) {
+    fromEmailState = "sandbox";
+  }
+  if (canDeferAtBuild(input, email == null ? void 0 : email.runtimeOnly, [apiKeyState, fromEmailState])) {
+    diagnostics.push({
+      method: "email",
+      code: "EMAIL_RUNTIME_VALIDATION_REQUIRED",
+      severity: "warning",
+      message: "Email configuration is runtime-only and must be validated before serving local authentication."
+    });
+    return "deferred";
+  }
+  if (apiKeyState !== "valid") diagnostics.push(credentialDiagnostic("email", "RESEND_API_KEY", apiKeyState));
+  if (fromEmailState === "sandbox") {
+    diagnostics.push({
+      method: "email",
+      code: "RESEND_FROM_EMAIL_SANDBOX",
+      severity: "error",
+      message: "RESEND_FROM_EMAIL uses the resend.dev testing sender, which only delivers to the Resend account owner; use a sender on a domain verified in Resend."
+    });
+  } else if (fromEmailState !== "valid") {
+    diagnostics.push(credentialDiagnostic("email", "RESEND_FROM_EMAIL", fromEmailState));
+  }
+  return apiKeyState === "valid" && fromEmailState === "valid" ? "available" : "invalid";
+}
+function evaluateGoogleConfiguration(input, diagnostics) {
+  var _a;
+  const google = (_a = input.configuration) == null ? void 0 : _a.google;
+  const clientIdState = credentialState(google == null ? void 0 : google.clientId, GOOGLE_CLIENT_ID_PATTERN);
+  const clientSecretState = credentialState(google == null ? void 0 : google.clientSecret, /^\S+$/, 8);
+  if (canDeferAtBuild(input, google == null ? void 0 : google.runtimeOnly, [clientIdState, clientSecretState])) {
+    diagnostics.push({
+      method: "google",
+      code: "GOOGLE_RUNTIME_VALIDATION_REQUIRED",
+      severity: "warning",
+      message: "Google credentials are runtime-only and must be validated before serving local authentication."
+    });
+    return "deferred";
+  }
+  if (clientIdState !== "valid") {
+    diagnostics.push(credentialDiagnostic("google", "GOOGLE_CLIENT_ID", clientIdState));
+  }
+  if (clientSecretState !== "valid") {
+    diagnostics.push(credentialDiagnostic("google", "GOOGLE_CLIENT_SECRET", clientSecretState));
+  }
+  return clientIdState === "valid" && clientSecretState === "valid" ? "available" : "invalid";
+}
+function authReadinessConfigurationFromEnv(env) {
+  return {
+    email: {
+      provider: env.EMAIL_PROVIDER,
+      resendApiKey: env.RESEND_API_KEY,
+      resendFromEmail: env.RESEND_FROM_EMAIL,
+      forceResendInDevelopment: Boolean(env.FORCE_RESEND_IN_DEV)
+    },
+    google: {
+      clientId: env.GOOGLE_CLIENT_ID,
+      clientSecret: env.GOOGLE_CLIENT_SECRET
+    }
+  };
+}
+function evaluateAuthReadiness(input) {
+  var _a, _b, _c, _d, _e;
+  if (input.profile === "external-no-local-auth") {
+    return {
+      outcome: "not-applicable",
+      declaredMethods: [],
+      availableMethods: [],
+      deferredMethods: [],
+      diagnostics: []
+    };
+  }
+  const declaredMethods = resolveDeclaredMethods(input.authConfig);
+  const available = /* @__PURE__ */ new Set();
+  const deferred = /* @__PURE__ */ new Set();
+  const diagnostics = [];
+  const passwordEnabled = ((_b = (_a = input.authConfig) == null ? void 0 : _a.emailAndPassword) == null ? void 0 : _b.enabled) !== false;
+  const googleEnabled = ((_e = (_d = (_c = input.authConfig) == null ? void 0 : _c.providers) == null ? void 0 : _d.google) == null ? void 0 : _e.enabled) !== false;
+  const providerBackedEmailMethods = declaredMethods.filter(
+    (method) => method === "email-otp" || method === "email-password" && passwordEnabled
+  );
+  if (providerBackedEmailMethods.length > 0) {
+    const emailStatus = evaluateEmailConfiguration(input, diagnostics);
+    if (emailStatus === "available") providerBackedEmailMethods.forEach((method) => available.add(method));
+    if (emailStatus === "deferred") providerBackedEmailMethods.forEach((method) => deferred.add(method));
+  }
+  if (declaredMethods.includes("google") && googleEnabled) {
+    const googleStatus = evaluateGoogleConfiguration(input, diagnostics);
+    if (googleStatus === "available") available.add("google");
+    if (googleStatus === "deferred") deferred.add("google");
+  }
+  const availableMethods = declaredMethods.filter((method) => available.has(method));
+  const deferredMethods = declaredMethods.filter((method) => deferred.has(method));
+  const outcome = availableMethods.length > 0 ? "ready" : deferredMethods.length > 0 ? "deferred" : "invalid";
+  if (outcome !== "invalid") {
+    return {
+      outcome,
+      declaredMethods,
+      availableMethods,
+      deferredMethods,
+      diagnostics: diagnostics.map((diagnostic) => ({ ...diagnostic, severity: "warning" }))
+    };
+  }
+  const allDisabled = declaredMethods.every(
+    (method) => method === "google" && !googleEnabled || method === "email-password" && !passwordEnabled
+  );
+  diagnostics.push(allDisabled ? {
+    method: "auth",
+    code: "AUTH_ALL_METHODS_DISABLED",
+    severity: "error",
+    message: "Every method in auth.methods is disabled server-side; enable one or select another login method."
+  } : {
+    method: "auth",
+    code: "AUTH_NO_AVAILABLE_METHOD",
+    severity: "error",
+    message: "No selected login method has a usable configuration; fix at least one method reported above."
+  });
+  return { outcome, declaredMethods, availableMethods, deferredMethods, diagnostics };
+}
+export {
+  authReadinessConfigurationFromEnv,
+  evaluateAuthReadiness
+};

package/dist/lib/auth/registration-guard-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration-guard-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/registration-guard-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAO,gBA6C1C,CAAC"}
+{"version":3,"file":"registration-guard-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/registration-guard-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAO,gBA2C1C,CAAC"}

package/dist/lib/auth/registration-guard-plugin.js

@@ -16,8 +16,8 @@ const registrationGuardPlugin = () => {
             const registrationMode = ((_b = (_a = AUTH_CONFIG) == null ? void 0 : _a.registration) == null ? void 0 : _b.mode) ?? "open";
             if (registrationMode === "invitation-only") {
               const request = ctx.request;
-              const url = new URL(request.url);
-              const hasInviteToken = request.headers.get("x-invite-token") || url.searchParams.get("inviteToken");
+              const url = request ? new URL(request.url) : null;
+              const hasInviteToken = (request == null ? void 0 : request.headers.get("x-invite-token")) || (url == null ? void 0 : url.searchParams.get("inviteToken"));
               if (!hasInviteToken) {
                 const teamExists = await TeamService.hasGlobal();
                 if (teamExists) {

package/dist/lib/auth/request-session.d.ts

@@ -0,0 +1,15 @@
+import { type TypedSession } from '../auth';
+/** The request's verified session, or null; one lookup per request however many callers ask. */
+export declare const getRequestSession: () => Promise<TypedSession | null>;
+/** The team the session chose (the activeTeamId cookie, only when this session wrote it), or null. */
+export declare function getSessionActiveTeamId(session: TypedSession): Promise<string | null>;
+/**
+ * The user and team a dashboard request's permissions are checked for: the verified session's user, and the team
+ * its session chose while the user still belongs to it, else their default team (getDashboardTeamId). No session,
+ * no user; a user in no team, no team.
+ */
+export declare function getDashboardPermissionContext(): Promise<{
+    userId: string | null;
+    teamId: string | null;
+}>;
+//# sourceMappingURL=request-session.d.ts.map

package/dist/lib/auth/request-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-session.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/request-session.ts"],"names":[],"mappings":"AAWA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,SAAS,CAAA;AAI5D,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,QAAmB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAsC,CAAA;AAElH,sGAAsG;AACtG,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE1F;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAK/G"}

package/dist/lib/auth/request-session.js

@@ -0,0 +1,22 @@
+import { cache } from "react";
+import { cookies, headers } from "next/headers";
+import { getTypedSession } from "../auth.js";
+import { ACTIVE_TEAM_COOKIE, activeTeamIdForSession } from "../teams/active-team-cookie.js";
+import { getDashboardTeamId } from "../teams/dashboard-team.js";
+const getRequestSession = cache(async () => getTypedSession(await headers()));
+async function getSessionActiveTeamId(session) {
+  var _a, _b;
+  return activeTeamIdForSession((_a = (await cookies()).get(ACTIVE_TEAM_COOKIE)) == null ? void 0 : _a.value, (_b = session.session) == null ? void 0 : _b.id);
+}
+async function getDashboardPermissionContext() {
+  var _a;
+  const session = await getRequestSession();
+  const userId = ((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id) ?? null;
+  if (!session || !userId) return { userId: null, teamId: null };
+  return { userId, teamId: await getDashboardTeamId(userId, await getSessionActiveTeamId(session)) };
+}
+export {
+  getDashboardPermissionContext,
+  getRequestSession,
+  getSessionActiveTeamId
+};

package/dist/lib/auth/runtime-readiness.d.ts

@@ -0,0 +1,49 @@
+import 'server-only';
+import type { AuthConfig, AuthLoginMethod } from '../config/types';
+import { type AuthReadinessResult } from './readiness';
+type RuntimeEnvironment = Record<string, string | undefined>;
+export interface RuntimeAuthReadinessOptions {
+    authConfig?: Pick<AuthConfig, 'methods' | 'providers' | 'emailAndPassword'> | null;
+    env?: RuntimeEnvironment;
+}
+/**
+ * Server-derived flows that do not follow the login UI intent (`auth.methods`).
+ * The password backend (`auth.emailAndPassword.enabled`) stays on under the
+ * passwordless preset, so invitation registration and password recovery must
+ * not be inferred from `availableMethods`.
+ */
+export interface PublicAuthCapabilities {
+    /** `/api/v1/auth/signup-with-invite` accepts a password (backend switch only). */
+    invitationPasswordSignup: boolean;
+    /** `/request-password-reset` can run: password backend + usable email delivery. */
+    passwordRecovery: boolean;
+}
+export interface PublicAuthReadiness {
+    status: 'ready' | 'unavailable';
+    availableMethods: AuthLoginMethod[];
+    capabilities: PublicAuthCapabilities;
+}
+/** Server-owned runtime adapter for the pure readiness evaluator. */
+export declare function getRuntimeAuthReadiness(options?: RuntimeAuthReadinessOptions): AuthReadinessResult;
+/**
+ * Startup re-validation for production servers. The build check may have
+ * deferred runtime-only providers, and the runtime environment can differ from
+ * the build's, so this logs one error with safe diagnostics (codes and
+ * messages, never values) when no login method can work. It never throws or
+ * stops the server: the per-request gates already fail closed.
+ */
+export declare function logAuthReadinessAtStartup(options?: RuntimeAuthReadinessOptions): void;
+/** The only readiness representation safe to return to an unauthenticated browser. */
+export declare function getPublicAuthReadiness(options?: RuntimeAuthReadinessOptions): PublicAuthReadiness;
+export declare function isRuntimeEmailAvailable(options?: RuntimeAuthReadinessOptions): boolean;
+export declare function isRuntimeGoogleAvailable(options?: RuntimeAuthReadinessOptions): boolean;
+/**
+ * Runtime gate around a Better Auth route handler. It deliberately leaves
+ * session inspection and sign-out untouched, while blocking provider-backed
+ * operations before Better Auth can invoke an unusable provider.
+ */
+export declare function getAuthReadinessResponse(request: Request, options?: RuntimeAuthReadinessOptions): Promise<Response | null>;
+/** Execute a Better Auth handler only after its operation passes the runtime gate. */
+export declare function withAuthRequestReadiness(request: Request, handler: () => Promise<Response>, options?: RuntimeAuthReadinessOptions): Promise<Response>;
+export {};
+//# sourceMappingURL=runtime-readiness.d.ts.map

package/dist/lib/auth/runtime-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-readiness.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/runtime-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAElE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AAEpB,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAA;IAClF,GAAG,CAAC,EAAE,kBAAkB,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,wBAAwB,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAA;IAC/B,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAaD,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAEtG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,2BAAgC,GAAG,IAAI,CAazF;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAYrG;AAiBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE1F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE3F;AAkDD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4E1B;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,CAAC,CAGnB"}