@nextsparkjs/core 0.1.0-beta.193 → 0.1.0-beta.194

package/README.md

@@ -5,8 +5,6 @@ The complete SaaS framework for Next.js. Build production-ready SaaS application
 ## Installation
 
 ```bash
-npm install @nextsparkjs/core
-# or
 pnpm add @nextsparkjs/core
 ```
 
@@ -16,6 +14,8 @@ pnpm add @nextsparkjs/core
 # Create a new NextSpark project
 npx create-nextspark-app my-app
 cd my-app
+# set DATABASE_URL in .env (BETTER_AUTH_SECRET is already generated)
+pnpm db:migrate
 pnpm dev
 ```
 

package/dist/lib/api/auth/permissions.d.ts

@@ -27,4 +27,14 @@ export declare function isSuperAdmin(authResult: DualAuthResult): boolean;
  * @returns true si tiene permisos de admin
  */
 export declare function hasAdminPermission(authResult: DualAuthResult, requiredScope?: string | string[]): boolean;
+/**
+ * Whether the caller may read or edit the user `target` (an id or an email, as
+ * the /users/:id routes accept both): the user themselves, or a superadmin.
+ * An API key is its owner, so it gets the same answer, but a superadmin key
+ * must also carry `requiredScope`.
+ *
+ * Application-layer check: row-level security does not cover a deployment that
+ * has not cut over to the non-owner runtime role.
+ */
+export declare function canAccessUser(authResult: DualAuthResult, target: string, requiredScope?: string | string[]): boolean;
 //# sourceMappingURL=permissions.d.ts.map

package/dist/lib/api/auth/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAOhE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,cAAc,EAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAChC,OAAO,CAYT"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAOhE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,cAAc,EAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAChC,OAAO,CAYT;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,cAAc,EAC1B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAChC,OAAO,CAOT"}

package/dist/lib/api/auth/permissions.js

@@ -14,7 +14,14 @@ function hasAdminPermission(authResult, requiredScope) {
   }
   return true;
 }
+function canAccessUser(authResult, target, requiredScope) {
+  if (!authResult.success || !authResult.user) return false;
+  if (hasAdminPermission(authResult, requiredScope)) return true;
+  const { id, email } = authResult.user;
+  return target === id || !!email && target === email;
+}
 export {
+  canAccessUser,
   hasAdminPermission,
   isSuperAdmin
 };

package/dist/lib/api/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAwCvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AAoGD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAEb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAkCvE"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAwCvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AAsGD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAEb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAsCvE"}

package/dist/lib/api/rate-limit.js

@@ -6,6 +6,7 @@ import {
   checkRateLimit as checkRedisRateLimit,
   maybeRedisConfigured
 } from "../rate-limit-redis.js";
+import { checkRequestOrigin } from "./request-origin.js";
 function checkRateLimit(identifier, limit = 1e3, windowMs = 6e4) {
   const now = Date.now();
   const cacheKey = getCacheKey("rate_limit", identifier);
@@ -239,6 +240,8 @@ function isRateLimitingDisabled() {
 }
 function withRateLimitTier(handler, tier = "api") {
   return async (request, ...args) => {
+    const originRefused = checkRequestOrigin(request);
+    if (originRefused) return originRefused;
     if (isRateLimitingDisabled()) {
       return handler(request, ...args);
     }

package/dist/lib/api/request-origin.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Request origin check for cookie-authenticated writes.
+ *
+ * A POST/PUT/PATCH/DELETE that authenticates with the session cookie must come
+ * from an origin the app trusts: its own (NEXT_PUBLIC_APP_URL / BETTER_AUTH_URL)
+ * or one in the list Better Auth already trusts for sign-in (see
+ * getTrustedOrigins). withRateLimitTier runs it before every handler it wraps.
+ *
+ * What passes without a trusted origin, and why:
+ * - Reads (GET/HEAD/OPTIONS).
+ * - Requests without the session cookie: there is no session for them to use.
+ * - Requests with an `Authorization: Bearer` token or an x-api-key header (API
+ *   keys, the mobile client's bearer token). A browser adds those only when the page's script
+ *   sets them, and a script on another origin needs CORS approval first.
+ * - Requests with neither Origin nor Referer, unless their body is one an HTML
+ *   form can send. Browsers send Origin on every write, so these come from
+ *   native or server-side clients; requiring a non-form content type keeps
+ *   a body without origin information from ever being read as a form post.
+ */
+import { NextResponse } from 'next/server';
+/**
+ * Returns a 403 response when a cookie-authenticated write does not come from a
+ * trusted origin, or null when the request may proceed.
+ */
+export declare function checkRequestOrigin(request: Request): NextResponse | null;
+//# sourceMappingURL=request-origin.d.ts.map

package/dist/lib/api/request-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../../../src/lib/api/request-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA6B1C;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAsBxE"}

package/dist/lib/api/request-origin.js

@@ -0,0 +1,46 @@
+import { NextResponse } from "next/server";
+import { APP_CONFIG_MERGED } from "../config/index.js";
+import { hasSessionCookie } from "../auth/session-hint.js";
+import { getTrustedOrigins, isOriginAllowed, normalizeOrigin } from "../utils/cors.js";
+const WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const FORM_CONTENT_TYPES = /* @__PURE__ */ new Set(["text/plain", "application/x-www-form-urlencoded", "multipart/form-data"]);
+function requestOrigin(headers) {
+  const origin = headers.get("origin");
+  if (origin) return origin;
+  const referer = headers.get("referer");
+  if (!referer) return null;
+  try {
+    return new URL(referer).origin;
+  } catch {
+    return "null";
+  }
+}
+function hasHeaderCredential(headers) {
+  var _a;
+  if ((_a = headers.get("x-api-key")) == null ? void 0 : _a.trim()) return true;
+  return /^bearer\s+\S/i.test(headers.get("authorization") ?? "");
+}
+function checkRequestOrigin(request) {
+  if (!WRITE_METHODS.has(request.method.toUpperCase())) return null;
+  const headers = request.headers;
+  if (!hasSessionCookie(headers.get("cookie"))) return null;
+  if (hasHeaderCredential(headers)) return null;
+  const origin = requestOrigin(headers);
+  if (origin === null) {
+    const contentType = (headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+    if (!FORM_CONTENT_TYPES.has(contentType)) return null;
+    return NextResponse.json(
+      { success: false, error: "This request needs an Origin header", code: "ORIGIN_REQUIRED" },
+      { status: 403 }
+    );
+  }
+  const normalized = normalizeOrigin(origin);
+  if (isOriginAllowed(normalized, getTrustedOrigins(APP_CONFIG_MERGED, normalized))) return null;
+  return NextResponse.json(
+    { success: false, error: "Request origin not allowed", code: "ORIGIN_NOT_ALLOWED" },
+    { status: 403 }
+  );
+}
+export {
+  checkRequestOrigin
+};

package/dist/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAUA,OAAO,EAAgF,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAkBvH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsHD,eAAO,MAAM,IAAI,qEAkXf,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,EAAE,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAUA,OAAO,EAAgF,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAkBvH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsHD,eAAO,MAAM,IAAI,qEA8Wf,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,EAAE,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}

package/dist/lib/auth.js

@@ -19,7 +19,7 @@ import { resolveSessionConfig } from "./auth/session-config.js";
 import { resolveOtpConfig } from "./auth/otp-config.js";
 import { isPasswordLoginEnabled } from "./auth/auth-methods.js";
 import { isRuntimeEmailAvailable, isRuntimeGoogleAvailable } from "./auth/runtime-readiness.js";
-import { getCorsOrigins, isPrivateLanOrigin, normalizeCorsEnvironment } from "./utils/cors.js";
+import { getTrustedOrigins } from "./utils/cors.js";
 import { withBasePath } from "./base-path.js";
 async function hasPendingInvitationForEmail(email) {
   const row = await queryOne(
@@ -206,17 +206,7 @@ const auth = betterAuth({
   // adding a wildcard entry (e.g. "https://*.vercel.app") to
   // api.cors.additionalOrigins — better-auth's own trustedOrigins matching
   // already supports the same wildcard syntax as isOriginAllowed() above.
-  trustedOrigins: async (request) => {
-    const origins = getCorsOrigins(APP_CONFIG_MERGED);
-    if (normalizeCorsEnvironment(process.env.NODE_ENV || "development") === "production") {
-      return origins;
-    }
-    const requestOrigin = request == null ? void 0 : request.headers.get("origin");
-    if (requestOrigin && isPrivateLanOrigin(requestOrigin)) {
-      return [...origins, requestOrigin];
-    }
-    return origins;
-  },
+  trustedOrigins: async (request) => getTrustedOrigins(APP_CONFIG_MERGED, request == null ? void 0 : request.headers.get("origin")),
   // Redirect auth errors to our custom error page instead of Better Auth's default.
   // Better Auth redirects to this path as-is, outside the Next.js router.
   onAPIError: {
@@ -249,6 +239,12 @@ const auth = betterAuth({
     nextCookies()
     // MUST be the last plugin for Next.js cookie handling
   ],
+  // The proxy reads the session on every request; that lookup only reads the
+  // caller's own signed cookie, so it is kept out of the shared auth rate limit.
+  // The default limits (sign-in, sign-up, OTP, ...) stay.
+  rateLimit: {
+    customRules: { "/get-session": false }
+  },
   session: {
     // Configurable per theme via `auth.session` in app.config.ts (defaults:
     // 7 days / renewed daily / 5-minute cookie cache).

package/dist/lib/entities/external-api-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-api-generator.d.ts","sourceRoot":"","sources":["../../../src/lib/entities/external-api-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAqB,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAK3C,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,EAAE,CAAA;KAClB,CAAA;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB;mBAqFT,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;oBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;qBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;sBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;uBAkGnD,WAAW;EAnHnC;AAyKD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoMrD"}
+{"version":3,"file":"external-api-generator.d.ts","sourceRoot":"","sources":["../../../src/lib/entities/external-api-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAqB,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAK3C,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,EAAE,CAAA;KAClB,CAAA;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB;mBAqFT,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;oBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;qBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;sBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;uBAkGnD,WAAW;EAnHnC;AA4KD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoMrD"}

package/dist/lib/entities/external-api-generator.js

@@ -153,7 +153,9 @@ function addCORSHeaders(response, corsOptions, request) {
   response.headers.set("Access-Control-Allow-Methods", corsOptions.methods.join(", "));
   response.headers.set("Access-Control-Allow-Headers", corsOptions.headers.join(", "));
   response.headers.set("Access-Control-Max-Age", "86400");
-  response.headers.set("Access-Control-Allow-Credentials", "true");
+  if (origin && corsOptions.origins.includes(origin)) {
+    response.headers.set("Access-Control-Allow-Credentials", "true");
+  }
 }
 function createErrorResponse(status, message, details) {
   return NextResponse.json({

package/dist/lib/services/subscription.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/subscription.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAEV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EAET,sBAAsB,EACtB,eAAe,EACf,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAMzB,MAAM,WAAW,yBAAyB;IACxC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,qBAAa,mBAAmB;IAK9B;;;;;;;;OAQG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW9D;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA6B7F;;;;;OAKG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;OASG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAgC9E;;;;;;;;;;OAUG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,YAAY,CAAC;IA+ExB;;;;;;;;OAQG;WACU,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAejE;;;;;;;;;OASG;WACU,YAAY,CACvB,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC;IA0CxB;;;;;;;;OAQG;WACU,MAAM,CACjB,cAAc,EAAE,MAAM,EACtB,iBAAiB,GAAE,OAAc,GAChC,OAAO,CAAC,YAAY,CAAC;IA4DxB;;;;;;;;;;;;;OAaG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,eAAe,GAAE,eAA2B,EAC5C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC;IAoI5B;;;;;;;;OAQG;WACU,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcjE;;;;;;;;OAQG;WACU,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAclE;;;;;;;;;;OAUG;WACU,YAAY,CACvB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAoBlC;;;;;;;;OAQG;WACU,gBAAgB,CAAC,IAAI,GAAE,MAAU,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsBhF;;;;;;;;;;OAUG;WACU,UAAU,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7E,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA8BlC;;;;;;;;OAQG;WACU,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsBtF;;;;;;;;;OASG;WACU,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IA+BrF;;;;;;;;OAQG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA4BxE;;;;;;;;;OASG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/F;;;;;;;;;;;;OAYG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA2E/F;;;;;;;;;;;;;;;;;;OAkBG;WACU,gBAAgB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,CAAC;IA2ElC;;;;;;;;;OASG;WACU,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;CA+BrD"}
+{"version":3,"file":"subscription.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/subscription.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAEV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EAET,sBAAsB,EACtB,eAAe,EACf,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAMzB,MAAM,WAAW,yBAAyB;IACxC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,qBAAa,mBAAmB;IAK9B;;;;;;;;OAQG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW9D;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA6B7F;;;;;OAKG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;OASG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAgC9E;;;;;;;;;;OAUG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,YAAY,CAAC;IA+ExB;;;;;;;;OAQG;WACU,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAejE;;;;;;;;;OASG;WACU,YAAY,CACvB,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC;IA0CxB;;;;;;;;OAQG;WACU,MAAM,CACjB,cAAc,EAAE,MAAM,EACtB,iBAAiB,GAAE,OAAc,GAChC,OAAO,CAAC,YAAY,CAAC;IA4DxB;;;;;;;;;;;;;OAaG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,eAAe,GAAE,eAA2B,EAC5C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC;IAoI5B;;;;;;;;OAQG;WACU,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcjE;;;;;;;;OAQG;WACU,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAclE;;;;;;;;;;OAUG;WACU,YAAY,CACvB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAoBlC;;;;;;;;OAQG;WACU,gBAAgB,CAAC,IAAI,GAAE,MAAU,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsBhF;;;;;;;;;;OAUG;WACU,UAAU,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7E,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA8BlC;;;;;;;;OAQG;WACU,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsBtF;;;;;;;;;OASG;WACU,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IA+BrF;;;;;;;;OAQG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA4BxE;;;;;;;;;OASG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/F;;;;;;;;;;;;OAYG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA2E/F;;;;;;;;;;;;;;;;;;OAkBG;WACU,gBAAgB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,CAAC;IAiFlC;;;;;;;;;OASG;WACU,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;CA+BrD"}

package/dist/lib/services/subscription.service.js

@@ -810,6 +810,9 @@ class SubscriptionService {
         console.warn("[SubscriptionService] Team permissions module not available");
       }
     }
+    if (BILLING_REGISTRY.plans.length === 0) {
+      return { allowed: true };
+    }
     const requiredFeature = BILLING_REGISTRY.actionMappings.features[action];
     if (requiredFeature) {
       const hasFeatureAccess = await this.hasFeature(teamId, requiredFeature, userId);

package/dist/lib/utils/cors.d.ts

@@ -81,6 +81,13 @@ export declare function getCorsOrigins(config: ApplicationConfig, env?: string):
  * production trust — pair with an environment check.
  */
 export declare function isPrivateLanOrigin(origin: string): boolean;
+/**
+ * The origins trusted for cookie-authenticated requests: Better Auth's
+ * trustedOrigins and the write-origin check (lib/api/request-origin) share it.
+ * getCorsOrigins() plus, outside production, the request's own origin when it is
+ * a private-network address (#170).
+ */
+export declare function getTrustedOrigins(config: ApplicationConfig, requestOrigin?: string | null, env?: string): string[];
 /**
  * Check whether a request origin is allowed, supporting wildcard-pattern entries
  * in the allow-list. A `*` in an entry matches exactly ONE host label (no dots),

package/dist/lib/utils/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAA;AAc7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAetD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAkBlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,GAAG,GAAE,MAA8C,GAClD,MAAM,EAAE,CA+CV;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAqB1D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CA6Bf"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAA;AAc7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAetD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAkBlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,GAAG,GAAE,MAA8C,GAClD,MAAM,EAAE,CA+CV;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAqB1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,GAAG,GAAE,MAA8C,GAClD,MAAM,EAAE,CAMV;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CA6Bf"}

package/dist/lib/utils/cors.js

@@ -79,6 +79,13 @@ function isPrivateLanOrigin(origin) {
   if (a === 169 && b === 254) return true;
   return false;
 }
+function getTrustedOrigins(config, requestOrigin, env = process.env.NODE_ENV || "development") {
+  const origins = getCorsOrigins(config, env);
+  if (normalizeCorsEnvironment(env) !== "production" && requestOrigin && isPrivateLanOrigin(requestOrigin)) {
+    return [...origins, requestOrigin];
+  }
+  return origins;
+}
 function isOriginAllowed(requestOrigin, allowedOrigins) {
   if (!requestOrigin) return null;
   for (const entry of allowedOrigins) {
@@ -98,6 +105,7 @@ function isOriginAllowed(requestOrigin, allowedOrigins) {
 }
 export {
   getCorsOrigins,
+  getTrustedOrigins,
   isOriginAllowed,
   isPrivateLanOrigin,
   normalizeCorsEnvironment,

package/dist/routes/api/v1/users/[id]/meta/[key]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/routes/api/v1/users/[id]/meta/[key]/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAsBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BA6DjD,CAAC;AAEZ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BA8FhD,CAAC;AAEb;;;;GAIG;AACH,eAAO,MAAM,KAAK;YArGM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BAqGpC,CAAA;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BAwDhD,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/routes/api/v1/users/[id]/meta/[key]/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAuBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BAmEjD,CAAC;AAEZ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BAoGhD,CAAC;AAEb;;;;GAIG;AACH,eAAO,MAAM,KAAK;YA3GM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2GpC,CAAA;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BA8DhD,CAAC"}

package/dist/routes/api/v1/users/[id]/meta/[key]/route.js

@@ -7,6 +7,7 @@ import {
   addCorsHeaders
 } from "@nextsparkjs/core/lib/api/helpers";
 import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { canAccessUser } from "@nextsparkjs/core/lib/api/auth/permissions";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 const metadataValueSchema = z.object({
@@ -33,6 +34,10 @@ export const GET = withRateLimitTier(withApiLogging(async (req, { params }) => {
       const response2 = createApiError("User ID is required", 400, null, "MISSING_USER_ID");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:read")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     if (!key || key.trim() === "") {
       const response2 = createApiError("Metadata key is required", 400, null, "MISSING_META_KEY");
       return addCorsHeaders(response2, req);
@@ -75,6 +80,10 @@ export const PUT = withRateLimitTier(withApiLogging(async (req, { params }) => {
       const response2 = createApiError("User ID is required", 400, null, "MISSING_USER_ID");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:write")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     if (!key || key.trim() === "") {
       const response2 = createApiError("Metadata key is required", 400, null, "MISSING_META_KEY");
       return addCorsHeaders(response2, req);
@@ -150,6 +159,10 @@ export const DELETE = withRateLimitTier(withApiLogging(async (req, { params }) =
       const response2 = createApiError("User ID is required", 400, null, "MISSING_USER_ID");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:write")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     if (!key || key.trim() === "") {
       const response2 = createApiError("Metadata key is required", 400, null, "MISSING_META_KEY");
       return addCorsHeaders(response2, req);

package/dist/routes/api/v1/users/[id]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/users/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0BxD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BA8CpC,CAAC;AAGZ,eAAO,MAAM,KAAK;YAEM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAyHnC,CAAC;AAGb,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2DnC,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/users/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA2BxD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAoDpC,CAAC;AAGZ,eAAO,MAAM,KAAK;YAEM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAqInC,CAAC;AAGb,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAiEnC,CAAC"}

package/dist/routes/api/v1/users/[id]/route.js

@@ -11,6 +11,7 @@ import {
   processEntityMetadata
 } from "@nextsparkjs/core/lib/api/helpers";
 import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { canAccessUser, hasAdminPermission } from "@nextsparkjs/core/lib/api/auth/permissions";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 const updateUserSchema = z.object({
@@ -37,6 +38,10 @@ export const GET = withRateLimitTier(withApiLogging(async (req, { params }) => {
       const response2 = createApiError("User ID or email is required", 400, null, "MISSING_IDENTIFIER");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:read")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     const user = await queryOneWithRLS(
       'SELECT id, email, name, "firstName", "lastName", image, country, timezone, language, role, "emailVerified", "createdAt", "updatedAt" FROM "users" WHERE id = $1 OR email = $1',
       [id],
@@ -70,9 +75,17 @@ export const PATCH = withRateLimitTier(withApiLogging(async (req, { params }) =>
       const response2 = createApiError("User ID or email is required", 400, null, "MISSING_IDENTIFIER");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:write")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     const body = await req.json();
     const { metas, ...userData } = body;
     const validatedData = updateUserSchema.parse(userData);
+    if (validatedData.role !== void 0 && !hasAdminPermission(authResult, "users:write")) {
+      const response2 = createApiError("Only a superadmin can change a role", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     const updates = [];
     const values = [];
     let paramCount = 1;
@@ -157,6 +170,10 @@ export const DELETE = withRateLimitTier(withApiLogging(async (req, { params }) =
       const response2 = createApiError("User ID or email is required", 400, null, "MISSING_IDENTIFIER");
       return addCorsHeaders(response2, req);
     }
+    if (!hasAdminPermission(authResult, "users:delete")) {
+      const response2 = createApiError("Insufficient permissions. Superadmin access required.", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     const targetUser = await queryOneWithRLS(
       'SELECT id, email FROM "users" WHERE id = $1 OR email = $1',
       [id],

package/dist/templates/projects/blog/package.json

@@ -14,10 +14,10 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "^15.0.0 || ^16.0.0",
+    "next": "~16.3.6",
     "next-intl": "^4.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "zod": "^4.0.0"
   },
   "nextspark": {

package/dist/templates/projects/crm/package.json

@@ -13,10 +13,10 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "^15.0.0 || ^16.0.0",
+    "next": "~16.3.6",
     "next-intl": "^4.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "zod": "^4.0.0"
   },
   "nextspark": {

package/dist/templates/projects/productivity/package.json

@@ -17,9 +17,9 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "^15.0.0 || ^16.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "next": "~16.3.6",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "zod": "^4.0.0"
   },
   "nextspark": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.193",
+  "version": "0.1.0-beta.194",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -390,9 +390,9 @@
     "scripts"
   ],
   "peerDependencies": {
-    "next": "~16.3.5",
-    "react": ">=18.0.0",
-    "react-dom": ">=18.0.0"
+    "next": "~16.3.6",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0"
   },
   "devDependencies": {
     "@better-fetch/fetch": "1.3.1",
@@ -496,7 +496,10 @@
     "use-intl": "^4.9.1",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@nextsparkjs/ui": "0.1.0-beta.193"
+    "@nextsparkjs/ui": "0.1.0-beta.194"
+  },
+  "engines": {
+    "node": ">=22.14.0"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs || true",

package/scripts/build/auth-readiness.mjs

@@ -192,6 +192,10 @@ async function main() {
     console.log('   RESEND_API_KEY, RESEND_FROM_EMAIL; Google: GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET), or change auth.methods.')
     console.log('   Credentials injected only at runtime: declare them with NEXTSPARK_AUTH_RUNTIME_ONLY=email,google;')
     console.log('   they are validated again when the server starts and on every login request.')
+    if (result.diagnostics.some(({ code }) => code.endsWith('_PLACEHOLDER'))) {
+      console.log('   A placeholder value (re_..., your-google-client-id) is a value, not a missing one: NEXTSPARK_AUTH_RUNTIME_ONLY does not defer it.')
+      console.log('   Remove the placeholder lines from .env (and the build environment), or replace them with the real values.')
+    }
     process.exit(1)
   }
 

package/scripts/build/registry/__tests__/build-output.test.mjs

@@ -29,7 +29,7 @@ const RAW_CONTROL = /[\u0000-\u0009\u000b-\u001f\u007f-\u009f\u061c\u200e\u200f\
 async function createProject(parent = tmpdir(), name = 'nextspark-build-output-test-') {
   const root = await mkdtemp(join(parent, name))
   await writeFile(join(root, 'nextspark.config.ts'), 'export default {}\n')
-  await writeFile(join(root, 'package.json'), '{"dependencies":{"next":"16.3.5"}}')
+  await writeFile(join(root, 'package.json'), '{"dependencies":{"next":"16.3.6"}}')
   await mkdir(join(root, 'src', 'app'), { recursive: true })
   return root
 }

package/scripts/build/registry/__tests__/project-mode-root-first.test.mjs

@@ -17,7 +17,7 @@ async function project(files = {}) {
 
 test('the nearest nextspark.config.ts owns every project source path', async () => {
   const root = await project({
-    'package.json': JSON.stringify({ dependencies: { next: '16.3.5' } }),
+    'package.json': JSON.stringify({ dependencies: { next: '16.3.6' } }),
     'nextspark.config.ts': 'export default {}\n',
   })
   const nested = join(root, 'entities', 'tasks')
@@ -40,7 +40,7 @@ test('the nearest nextspark.config.ts owns every project source path', async ()
 
 test('a next.config file cannot select a project without nextspark.config.ts', async () => {
   const root = await project({
-    'package.json': JSON.stringify({ dependencies: { next: '16.3.5' } }),
+    'package.json': JSON.stringify({ dependencies: { next: '16.3.6' } }),
     'next.config.mjs': 'export default {}\n',
   })
   try {
@@ -66,7 +66,7 @@ test('an enabled packaged plugin resolves through the project dependency tree',
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.5',
+        next: '16.3.6',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -98,7 +98,7 @@ test('an enabled packaged plugin that is not installed fails with an actionable
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.5',
+        next: '16.3.6',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -119,7 +119,7 @@ test('a packaged plugin cannot use a path segment as its logical name', async ()
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.5',
+        next: '16.3.6',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -146,7 +146,7 @@ test('a local plugin shadows an installed packaged plugin with the same NextSpar
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.5',
+        next: '16.3.6',
         '@example/plugin-search': '1.0.0',
       },
     }),

package/scripts/build/registry/__tests__/write-places.test.mjs

@@ -269,7 +269,7 @@ async function snapshot(root) {
 async function buildableProject() {
   const project = await directory()
   await writeIn(project.root, 'nextspark.config.ts', 'export default {}\n')
-  await writeIn(project.root, 'package.json', '{"dependencies":{"next":"16.3.5"}}')
+  await writeIn(project.root, 'package.json', '{"dependencies":{"next":"16.3.6"}}')
   await writeIn(project.root, 'templates/pricing/page.tsx', 'export default function Pricing() { return null }\n')
   return project
 }

package/scripts/build/registry/contracts/__tests__/contracts-wire.test.mjs

@@ -22,7 +22,7 @@ async function planFor(files) {
   const root = temp()
   try {
     write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-    write(root, 'package.json', JSON.stringify({ name: 'wire', dependencies: { next: '16.3.5' } }))
+    write(root, 'package.json', JSON.stringify({ name: 'wire', dependencies: { next: '16.3.6' } }))
     write(root, 'config/theme.config.ts', "export const wireThemeConfig = { name: 'wire' }\n")
     for (const [path, content] of Object.entries(files)) write(root, path, content)
     const entities = await discoverAllEntities(getConfig(root), { includeCore: false })

package/scripts/build/registry/contracts/__tests__/contracts.test.mjs

@@ -73,7 +73,7 @@ const NOTES_CONFIG = `export const noteEntityConfig = {
 function project(extra = {}) {
   const root = temp()
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'contracts-project', dependencies: { next: '16.3.5' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'contracts-project', dependencies: { next: '16.3.6' } }))
   write(root, 'config/theme.config.ts', "export const contractsThemeConfig = { name: 'contracts' }\n")
   write(root, 'entities/tasks/tasks.config.ts', TASKS_CONFIG)
   write(root, 'entities/tasks/tasks.fields.ts', FIELDS)

package/scripts/build/registry/contracts/render.mjs

@@ -201,7 +201,7 @@ export function renderEntity(contract, { source, shape } = {}) {
   const lines = [CONTRACTS_HEADER]
   if (source) lines.push(`// Source: ${source}`)
   for (const warning of contract.warnings) lines.push(`// Warning: ${warning}`)
-  lines.push('', "import { z } from 'zod'", "import type { EntityConfig } from '../schema/types'", "import { generateEntitySchemas } from '../schema/schema-generator'", `import { ${usedFromShape.join(', ')} } from '../schema/response-shape'`)
+  lines.push('', "import * as z from 'zod'", "import type { EntityConfig } from '../schema/types'", "import { generateEntitySchemas } from '../schema/schema-generator'", `import { ${usedFromShape.join(', ')} } from '../schema/response-shape'`)
   if (shared.length > 0) lines.push(`import { ${shared.join(', ')} } from '../fields'`)
   lines.push('', `export const ${names.apiPath} = ${quote(`/api/v1/${contract.slug}`)}`, '')
 
@@ -246,7 +246,7 @@ export function renderEntity(contract, { source, shape } = {}) {
 export function renderEnvelope() {
   return `${CONTRACTS_HEADER}
 
-import { z } from 'zod'
+import * as z from 'zod'
 
 /** \`info\` of every response: the timestamp, plus whatever the endpoint adds (pagination, \`created\`). */
 export const apiInfoSchema = z.looseObject({ timestamp: z.string() })
@@ -307,7 +307,7 @@ export const apiErrorResponseSchema = z.object({
 export function renderFields() {
   return `${CONTRACTS_HEADER}
 
-import { z } from 'zod'
+import * as z from 'zod'
 import { addressSchema, fileObjectSchema } from './schema/schema-generator'
 import { mediaRefSchema } from './schema/media-ref'