@nextsparkjs/core 0.1.0-beta.193 → 0.1.0-beta.195

package/dist/components/ui/relation-display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relation-display.d.ts","sourceRoot":"","sources":["../../../src/components/ui/relation-display.tsx"],"names":[],"mappings":"AAMA,UAAU,oBAAoB;IAC5B,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAGD,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAgB,EAChB,MAAM,EACP,EAAE,oBAAoB,2CAgJtB"}
+{"version":3,"file":"relation-display.d.ts","sourceRoot":"","sources":["../../../src/components/ui/relation-display.tsx"],"names":[],"mappings":"AAOA,UAAU,oBAAoB;IAC5B,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAGD,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAgB,EAChB,MAAM,EACP,EAAE,oBAAoB,2CAgJtB"}

package/dist/components/ui/relation-display.js

@@ -3,6 +3,7 @@ import { jsx } from "react/jsx-runtime";
 import * as React from "react";
 import { parseClientChildEntity as parseChildEntity, getClientEntityApiPath as getEntityApiPath } from "../../lib/entities/client-entity-meta.js";
 import { withBasePath } from "../../lib/base-path.js";
+import { TEAM_ID_HEADER } from "../../lib/api/client-headers.js";
 function RelationDisplay({
   value,
   entityType,
@@ -76,7 +77,7 @@ function RelationDisplay({
           method: "GET",
           headers: {
             "Content-Type": "application/json",
-            ...teamId && { "x-team-id": teamId }
+            ...teamId && { [TEAM_ID_HEADER]: teamId }
           },
           credentials: "include"
         });

package/dist/components/ui/user-display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-display.d.ts","sourceRoot":"","sources":["../../../src/components/ui/user-display.tsx"],"names":[],"mappings":"AASA,UAAU,gBAAgB;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAUD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAC1B,KAAK,EACL,MAAM,EAAE,UAAU,EAClB,QAAgB,EAChB,SAAiB,EACjB,SAAS,GACV,EAAE,gBAAgB,2CA0IlB"}
+{"version":3,"file":"user-display.d.ts","sourceRoot":"","sources":["../../../src/components/ui/user-display.tsx"],"names":[],"mappings":"AAUA,UAAU,gBAAgB;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAUD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAC1B,KAAK,EACL,MAAM,EAAE,UAAU,EAClB,QAAgB,EAChB,SAAiB,EACjB,SAAS,GACV,EAAE,gBAAgB,2CA0IlB"}

package/dist/components/ui/user-display.js

@@ -6,6 +6,7 @@ import { Badge } from "./badge.js";
 import { cn } from "../../lib/utils/index.js";
 import { useTeam } from "../../hooks/useTeam.js";
 import { withBasePath } from "../../lib/base-path.js";
+import { TEAM_ID_HEADER } from "../../lib/api/client-headers.js";
 function UserDisplay({
   value,
   teamId: propTeamId,
@@ -37,7 +38,7 @@ function UserDisplay({
         const response = await fetch(withBasePath(`/api/v1/teams/${effectiveTeamId}/members`), {
           headers: {
             "Content-Type": "application/json",
-            "x-team-id": effectiveTeamId
+            [TEAM_ID_HEADER]: effectiveTeamId
           },
           credentials: "include"
         });

package/dist/emails/otp-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otp-verification.d.ts","sourceRoot":"","sources":["../../src/emails/otp-verification.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKjF,wBAA8B,eAAe,CAC3C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAuEvB"}
+{"version":3,"file":"otp-verification.d.ts","sourceRoot":"","sources":["../../src/emails/otp-verification.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKjF,wBAA8B,eAAe,CAC3C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAyEvB"}

package/dist/emails/otp-verification.js

@@ -1,9 +1,11 @@
 import { getTranslations } from "next-intl/server";
+import { escapeHtml } from "../lib/auth/security-notifications/templates/shared.js";
 import { DEFAULT_OTP_CONFIG } from "../lib/auth/otp-config.js";
 const APP_NAME_FALLBACK = process.env.NEXT_PUBLIC_APP_NAME || "Your App";
 async function otpVerification(data, locale) {
   const t = locale ? await getTranslations({ locale, namespace: "email.otpVerification" }) : await getTranslations("email.otpVerification");
   const appName = data.appName || APP_NAME_FALLBACK;
+  const htmlAppName = escapeHtml(appName);
   const year = (/* @__PURE__ */ new Date()).getFullYear();
   const expiresInMinutes = Math.floor((data.expiresIn ?? DEFAULT_OTP_CONFIG.expiresIn) / 60);
   return {
@@ -23,7 +25,7 @@ async function otpVerification(data, locale) {
                   <!-- Header -->
                   <tr>
                     <td style="padding: 40px 40px 20px 40px; text-align: center; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); border-radius: 8px 8px 0 0;">
-                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${appName}</h1>
+                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${htmlAppName}</h1>
                       <p style="color: #ffffff; font-size: 16px; margin: 10px 0 0 0; opacity: 0.95;">${t("headerSubtitle")}</p>
                     </td>
                   </tr>
@@ -52,10 +54,10 @@ async function otpVerification(data, locale) {
                   <tr>
                     <td style="padding: 30px 40px; background-color: #f8f8f8; border-radius: 0 0 8px 8px; text-align: center;">
                       <p style="color: #999999; font-size: 14px; margin: 0 0 10px 0;">
-                        ${t("copyright", { year, appName })}
+                        ${t("copyright", { year, appName: htmlAppName })}
                       </p>
                       <p style="color: #999999; font-size: 12px; margin: 0;">
-                        ${t("footerLine1", { appName })}
+                        ${t("footerLine1", { appName: htmlAppName })}
                       </p>
                     </td>
                   </tr>

package/dist/emails/reset-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/emails/reset-password.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAI/E,wBAA8B,aAAa,CACzC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA4FvB"}
+{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/emails/reset-password.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAI/E,wBAA8B,aAAa,CACzC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA8FvB"}

package/dist/emails/reset-password.js

@@ -1,8 +1,10 @@
 import { getTranslations } from "next-intl/server";
+import { escapeHtml } from "../lib/auth/security-notifications/templates/shared.js";
 const APP_NAME_FALLBACK = process.env.NEXT_PUBLIC_APP_NAME || "Your App";
 async function resetPassword(data, locale) {
   const t = locale ? await getTranslations({ locale, namespace: "email.resetPassword" }) : await getTranslations("email.resetPassword");
   const appName = data.appName || APP_NAME_FALLBACK;
+  const htmlAppName = escapeHtml(appName);
   const year = (/* @__PURE__ */ new Date()).getFullYear();
   const greeting = `${t("greetingPrefix")}${data.userName ? ` ${data.userName}` : ""},`;
   const expiresIn = data.expiresIn || t("defaultExpiresIn");
@@ -23,7 +25,7 @@ async function resetPassword(data, locale) {
                   <!-- Header -->
                   <tr>
                     <td style="padding: 40px 40px 20px 40px; text-align: center; background: linear-gradient(135deg, #f093fb 0%, #f5576c 100%); border-radius: 8px 8px 0 0;">
-                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${appName}</h1>
+                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${htmlAppName}</h1>
                       <p style="color: #ffffff; font-size: 16px; margin: 10px 0 0 0; opacity: 0.95;">${t("headerSubtitle")}</p>
                     </td>
                   </tr>
@@ -73,10 +75,10 @@ async function resetPassword(data, locale) {
                   <tr>
                     <td style="padding: 30px 40px; background-color: #f8f8f8; border-radius: 0 0 8px 8px; text-align: center;">
                       <p style="color: #999999; font-size: 14px; margin: 0 0 10px 0;">
-                        ${t("copyright", { year, appName })}
+                        ${t("copyright", { year, appName: htmlAppName })}
                       </p>
                       <p style="color: #999999; font-size: 12px; margin: 0;">
-                        ${t("footerLine1", { appName })}
+                        ${t("footerLine1", { appName: htmlAppName })}
                         <br>${t("footerLine2")}
                       </p>
                     </td>

package/dist/emails/team-invitation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"team-invitation.d.ts","sourceRoot":"","sources":["../../src/emails/team-invitation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAKhF,wBAA8B,cAAc,CAC1C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA0FvB"}
+{"version":3,"file":"team-invitation.d.ts","sourceRoot":"","sources":["../../src/emails/team-invitation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAKhF,wBAA8B,cAAc,CAC1C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA4FvB"}

package/dist/emails/team-invitation.js

@@ -4,6 +4,7 @@ const APP_NAME_FALLBACK = process.env.NEXT_PUBLIC_APP_NAME || "Your App";
 async function teamInvitation(data, locale) {
   const t = locale ? await getTranslations({ locale, namespace: "email.teamInvitation" }) : await getTranslations("email.teamInvitation");
   const appName = data.appName || APP_NAME_FALLBACK;
+  const htmlAppName = escapeHtml(appName);
   const year = (/* @__PURE__ */ new Date()).getFullYear();
   return {
     subject: t("subject", { teamName: data.teamName, appName }),
@@ -22,7 +23,7 @@ async function teamInvitation(data, locale) {
                   <!-- Header -->
                   <tr>
                     <td style="padding: 40px 40px 20px 40px; text-align: center; background: linear-gradient(135deg, #4F46E5 0%, #7C3AED 100%); border-radius: 8px 8px 0 0;">
-                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${appName}</h1>
+                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${htmlAppName}</h1>
                       <p style="color: #ffffff; font-size: 16px; margin: 10px 0 0 0; opacity: 0.95;">${t("headerSubtitle")}</p>
                     </td>
                   </tr>
@@ -72,7 +73,7 @@ async function teamInvitation(data, locale) {
                   <tr>
                     <td style="padding: 30px 40px; background-color: #f8f8f8; border-radius: 0 0 8px 8px; text-align: center;">
                       <p style="color: #999999; font-size: 14px; margin: 0 0 10px 0;">
-                        ${t("copyright", { year, appName })}
+                        ${t("copyright", { year, appName: htmlAppName })}
                       </p>
                       <p style="color: #999999; font-size: 12px; margin: 0;">
                         ${t("footerSentTo", { inviteeEmail: escapeHtml(data.inviteeEmail) })}<br>

package/dist/emails/verify-email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-email.d.ts","sourceRoot":"","sources":["../../src/emails/verify-email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI9E,wBAA8B,WAAW,CACvC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAiFvB"}
+{"version":3,"file":"verify-email.d.ts","sourceRoot":"","sources":["../../src/emails/verify-email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI9E,wBAA8B,WAAW,CACvC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAmFvB"}

package/dist/emails/verify-email.js

@@ -1,8 +1,10 @@
 import { getTranslations } from "next-intl/server";
+import { escapeHtml } from "../lib/auth/security-notifications/templates/shared.js";
 const APP_NAME_FALLBACK = process.env.NEXT_PUBLIC_APP_NAME || "Your App";
 async function verifyEmail(data, locale) {
   const t = locale ? await getTranslations({ locale, namespace: "email.verifyEmail" }) : await getTranslations("email.verifyEmail");
   const appName = data.appName || APP_NAME_FALLBACK;
+  const htmlAppName = escapeHtml(appName);
   const year = (/* @__PURE__ */ new Date()).getFullYear();
   const greeting = `${t("greetingPrefix")}${data.userName ? ` ${data.userName}` : ""},`;
   return {
@@ -22,7 +24,7 @@ async function verifyEmail(data, locale) {
                   <!-- Header -->
                   <tr>
                     <td style="padding: 40px 40px 20px 40px; text-align: center; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); border-radius: 8px 8px 0 0;">
-                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${appName}</h1>
+                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${htmlAppName}</h1>
                       <p style="color: #ffffff; font-size: 16px; margin: 10px 0 0 0; opacity: 0.95;">${t("headerSubtitle")}</p>
                     </td>
                   </tr>
@@ -62,10 +64,10 @@ async function verifyEmail(data, locale) {
                   <tr>
                     <td style="padding: 30px 40px; background-color: #f8f8f8; border-radius: 0 0 8px 8px; text-align: center;">
                       <p style="color: #999999; font-size: 14px; margin: 0 0 10px 0;">
-                        ${t("copyright", { year, appName })}
+                        ${t("copyright", { year, appName: htmlAppName })}
                       </p>
                       <p style="color: #999999; font-size: 12px; margin: 0;">
-                        ${t("footerLine1", { appName })}
+                        ${t("footerLine1", { appName: htmlAppName })}
                         <br>${t("footerLine2")}
                       </p>
                     </td>

package/dist/hooks/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA4C9C;;;GAGG;AACH,wBAAgB,cAAc;8CAYiC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAqBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA2E1H,MAAM;qBAlCjB,MAAM;;;gDAgBiB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;iBAwG1G,CADD;;;;;;;;;;;;;2BA5EuC,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;EAwC3D;AAED,8DAA8D;AAC9D,wBAAgB,OAAO;;;;;8CAvPwC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAqBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA2E1H,MAAM;qBAlCjB,MAAM;;;gDAgBiB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;iBAwG1G,CADD;;;;;;;;;;;;;2BA5EuC,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;UAqD5B,WAAW,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;EASjD"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAwE9C;;;GAGG;AACH,wBAAgB,cAAc;8CAYiC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAqBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAmF1H,MAAM;qBAlCjB,MAAM;;;gDAgBiB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;iBAY9F,CAAC;;;;;;;;;;;;;2BAeyB,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;EAwC3D;AAED,8DAA8D;AAC9D,wBAAgB,OAAO;;;;;8CA/PwC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAqBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAmF1H,MAAM;qBAlCjB,MAAM;;;gDAgBiB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;iBAY9F,CAAC;;;;;;;;;;;;;2BAeyB,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;UAqD5B,WAAW,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;EASjD"}

package/dist/hooks/useAuth.js

@@ -7,9 +7,11 @@ import { useOrigin } from "./useOrigin.js";
 import { useLastAuthMethod } from "./useLastAuthMethod.js";
 import { safeCallbackPath } from "../lib/auth/callback-url.js";
 import { withBasePath } from "../lib/base-path.js";
+import { loadLoginPage } from "../lib/auth/load-login-page.js";
 import { setSessionHint } from "../lib/auth/session-hint.js";
 import { setUserLocaleClient } from "../lib/locale-client.js";
 import { I18N_CONFIG } from "../lib/config/i18n-config-client.js";
+import { SIGNUP_INTENT_HEADER } from "../lib/api/client-headers.js";
 function googleCallbackURL(redirectTo) {
   const url = new URL(safeCallbackPath(redirectTo) ?? "/dashboard", "http://callback.invalid");
   url.searchParams.set("auth_method", "google");
@@ -23,6 +25,20 @@ function rememberSignedIn(user) {
     setUserLocaleClient(language);
   }
 }
+const SESSION_DROP_TIMEOUT_MS = 2e3;
+async function waitForSessionToDrop() {
+  var _a, _b, _c, _d, _e, _f;
+  let timer;
+  try {
+    const refetch = (_f = (_e = (_d = (_c = (_b = (_a = authClient.$store) == null ? void 0 : _a.atoms) == null ? void 0 : _b.session) == null ? void 0 : _c.get) == null ? void 0 : _d.call(_c)) == null ? void 0 : _e.refetch) == null ? void 0 : _f.call(_e);
+    await Promise.race([refetch, new Promise((resolve) => {
+      timer = setTimeout(resolve, SESSION_DROP_TIMEOUT_MS);
+    })]);
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function useAuthActions() {
   const router = useRouter();
   const origin = useOrigin();
@@ -57,7 +73,7 @@ function useAuthActions() {
       },
       // Optional signup intent, sent as the `x-signup-intent` header. The signup
       // route maps it to an initial team role (AUTH_CONFIG.signupIntent).
-      intent ? { headers: { "x-signup-intent": intent } } : void 0
+      intent ? { headers: { [SIGNUP_INTENT_HEADER]: intent } } : void 0
     );
     if (error) {
       throw new Error(error.message || "Failed to create account");
@@ -68,10 +84,11 @@ function useAuthActions() {
     if (typeof window !== "undefined") {
       localStorage.removeItem("activeTeamId");
     }
-    await authClient.signOut();
+    const { error } = await authClient.signOut();
+    if (error) throw new Error(error.message || "Failed to sign out");
     setSessionHint(false);
-    forgetSignedInData();
-    router.push("/login");
+    await waitForSessionToDrop();
+    loadLoginPage();
   };
   const handleSendOtp = async (email) => {
     const { data, error } = await authClient.emailOtp.sendVerificationOtp({

package/dist/hooks/usePatternUsages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usePatternUsages.d.ts","sourceRoot":"","sources":["../../src/hooks/usePatternUsages.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4EtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,iEA8BxD"}
+{"version":3,"file":"usePatternUsages.d.ts","sourceRoot":"","sources":["../../src/hooks/usePatternUsages.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4EtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,iEA8BxD"}

package/dist/hooks/usePatternUsages.js

@@ -3,6 +3,7 @@ import { useQuery } from "@tanstack/react-query";
 import { useAuth } from "./useAuth.js";
 import { useTeam } from "./useTeam.js";
 import { withBasePath } from "../lib/base-path.js";
+import { TEAM_ID_HEADER } from "../lib/api/client-headers.js";
 function usePatternUsages(patternId, options = {}) {
   var _a, _b, _c, _d, _e;
   const {
@@ -37,7 +38,7 @@ function usePatternUsages(patternId, options = {}) {
         "Content-Type": "application/json"
       };
       if (teamId) {
-        headers["x-team-id"] = teamId;
+        headers[TEAM_ID_HEADER] = teamId;
       }
       const response = await fetch(withBasePath(url), { headers });
       if (!response.ok) {
@@ -81,7 +82,7 @@ function usePatternUsageCount(patternId, options = {}) {
         "Content-Type": "application/json"
       };
       if (teamId) {
-        headers["x-team-id"] = teamId;
+        headers[TEAM_ID_HEADER] = teamId;
       }
       const response = await fetch(withBasePath(`/api/v1/patterns/${patternId}/usages?limit=1`), { headers });
       if (!response.ok) {

package/dist/lib/api/auth/permissions.d.ts

@@ -27,4 +27,14 @@ export declare function isSuperAdmin(authResult: DualAuthResult): boolean;
  * @returns true si tiene permisos de admin
  */
 export declare function hasAdminPermission(authResult: DualAuthResult, requiredScope?: string | string[]): boolean;
+/**
+ * Whether the caller may read or edit the user `target` (an id or an email, as
+ * the /users/:id routes accept both): the user themselves, or a superadmin.
+ * An API key is its owner, so it gets the same answer, but a superadmin key
+ * must also carry `requiredScope`.
+ *
+ * Application-layer check: row-level security does not cover a deployment that
+ * has not cut over to the non-owner runtime role.
+ */
+export declare function canAccessUser(authResult: DualAuthResult, target: string, requiredScope?: string | string[]): boolean;
 //# sourceMappingURL=permissions.d.ts.map

package/dist/lib/api/auth/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAOhE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,cAAc,EAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAChC,OAAO,CAYT"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAOhE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,cAAc,EAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAChC,OAAO,CAYT;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,cAAc,EAC1B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAChC,OAAO,CAOT"}

package/dist/lib/api/auth/permissions.js

@@ -14,7 +14,14 @@ function hasAdminPermission(authResult, requiredScope) {
   }
   return true;
 }
+function canAccessUser(authResult, target, requiredScope) {
+  if (!authResult.success || !authResult.user) return false;
+  if (hasAdminPermission(authResult, requiredScope)) return true;
+  const { id, email } = authResult.user;
+  return target === id || !!email && target === email;
+}
 export {
+  canAccessUser,
   hasAdminPermission,
   isSuperAdmin
 };

package/dist/lib/api/auth.d.ts

@@ -21,6 +21,8 @@ export interface ApiKeyValidationResult {
     auth?: ApiKeyAuth;
     error?: string;
 }
+/** The API key validateApiKey accepted for this request, or null when none was validated. */
+export declare function getValidatedApiKey(request: Request): ApiKeyAuth | null;
 /**
  * Valida una API Key desde el header Authorization o x-api-key
  */

package/dist/lib/api/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoHrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAEtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA0GrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}

package/dist/lib/api/auth.js

@@ -1,22 +1,19 @@
 import { queryOne } from "../db.js";
-import { ApiKeyManager } from "./keys.js";
+import { ApiKeyManager, presentedApiKey } from "./keys.js";
 import { apiKeyCache, getCacheKey } from "./cache.js";
 import { TeamMemberService } from "../services/team-member.service.js";
 import { ScopeService } from "../services/scope.service.js";
 function hasScope(auth, requiredScope) {
   return auth.scopes.includes(requiredScope);
 }
+const validatedKeys = /* @__PURE__ */ new WeakMap();
+function getValidatedApiKey(request) {
+  return validatedKeys.get(request) ?? null;
+}
 async function validateApiKey(request) {
   const startTime = Date.now();
   try {
-    const authHeader = request.headers.get("Authorization");
-    const xApiKeyHeader = request.headers.get("x-api-key");
-    let apiKey = null;
-    if (authHeader == null ? void 0 : authHeader.startsWith("Bearer ")) {
-      apiKey = authHeader.substring(7);
-    } else if (xApiKeyHeader) {
-      apiKey = xApiKeyHeader;
-    }
+    const apiKey = presentedApiKey(request.headers);
     if (!apiKey) {
       await constantTimeDelay(startTime);
       return null;
@@ -72,11 +69,13 @@ async function validateApiKey(request) {
     updateLastUsed(keyData.id).catch((error) => {
       console.error("Error updating API key last used:", error);
     });
-    return {
+    const validated = {
       userId: keyData.userId,
       keyId: keyData.id,
       scopes: keyData.scopes || []
     };
+    validatedKeys.set(request, validated);
+    return validated;
   } catch (error) {
     console.error("Error validating API key:", error);
     await constantTimeDelay(startTime);
@@ -245,6 +244,7 @@ async function validateScopesForUser(userId, teamId, requestedScopes) {
 export {
   canCreateApiKeys,
   getApiKeyUser,
+  getValidatedApiKey,
   hasAllScopes,
   hasAnyScope,
   hasScope,

package/dist/lib/api/client-headers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The custom request headers core's own clients send to /api. The clients set them by these names and
+ * CORS_ALLOW_HEADERS (cors-response.ts) is built from this list, so a listed origin's preflight allows
+ * every header core's clients send. Client-safe: no imports.
+ */
+export declare const TEAM_ID_HEADER = "x-team-id";
+export declare const BUILDER_SOURCE_HEADER = "x-builder-source";
+export declare const SIGNUP_INTENT_HEADER = "x-signup-intent";
+export declare const VERIFY_FROM_UI_HEADER = "x-verify-from-ui";
+export declare const CLIENT_REQUEST_HEADERS: readonly ["x-team-id", "x-builder-source", "x-signup-intent", "x-verify-from-ui"];
+//# sourceMappingURL=client-headers.d.ts.map

package/dist/lib/api/client-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-headers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/client-headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,cAAc,cAAc,CAAA;AACzC,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AACvD,eAAO,MAAM,oBAAoB,oBAAoB,CAAA;AACrD,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AAEvD,eAAO,MAAM,sBAAsB,mFAAgG,CAAA"}

package/dist/lib/api/client-headers.js

@@ -0,0 +1,12 @@
+const TEAM_ID_HEADER = "x-team-id";
+const BUILDER_SOURCE_HEADER = "x-builder-source";
+const SIGNUP_INTENT_HEADER = "x-signup-intent";
+const VERIFY_FROM_UI_HEADER = "x-verify-from-ui";
+const CLIENT_REQUEST_HEADERS = [TEAM_ID_HEADER, BUILDER_SOURCE_HEADER, SIGNUP_INTENT_HEADER, VERIFY_FROM_UI_HEADER];
+export {
+  BUILDER_SOURCE_HEADER,
+  CLIENT_REQUEST_HEADERS,
+  SIGNUP_INTENT_HEADER,
+  TEAM_ID_HEADER,
+  VERIFY_FROM_UI_HEADER
+};

package/dist/lib/api/client-ip.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The client address of a request: the one place that decides it, for rate limits, audit logs,
+ * security notifications and every other reader in core.
+ *
+ * Which header can be trusted depends on what sits in front of the app, so the deployment names it:
+ *
+ *   NEXTSPARK_CLIENT_IP_SOURCE=vercel         x-vercel-forwarded-for, then x-real-ip (set by Vercel)
+ *   NEXTSPARK_CLIENT_IP_SOURCE=cloudflare     cf-connecting-ip (set by Cloudflare)
+ *   NEXTSPARK_CLIENT_IP_SOURCE=header:<name>  one header that your proxy sets, e.g. header:x-real-ip
+ *   NEXTSPARK_CLIENT_IP_SOURCE=xff            X-Forwarded-For, counting NEXTSPARK_TRUSTED_PROXY_HOPS
+ *                                             (default 1) trusted proxies from the right
+ *   NEXTSPARK_CLIENT_IP_SOURCE=none           no client address: every request shares one bucket
+ *
+ * Unset keeps the order core always used (cf-connecting-ip, rightmost X-Forwarded-For, x-real-ip,
+ * true-client-ip), and production logs one warning saying what to set. Next.js gives route handlers
+ * no socket address, so 'none' cannot fall back to one.
+ * What to set per deployment: the upgrade note in CHANGELOG.md, and https://nextspark.dev/docs.
+ */
+export declare const UNKNOWN_CLIENT_IP = "unknown";
+export type ClientIpSource = {
+    kind: 'default';
+} | {
+    kind: 'vercel';
+} | {
+    kind: 'cloudflare';
+} | {
+    kind: 'header';
+    header: string;
+} | {
+    kind: 'xff';
+    hops: number;
+} | {
+    kind: 'none';
+};
+type Env = Record<string, string | undefined>;
+/** Reads the setting. Throws on a value it does not understand: a typo must not silently trust a header. */
+export declare function getClientIpSource(env?: Env): ClientIpSource;
+/** The client address of a request, from the source the deployment configured (getClientIpSource). */
+export declare function getClientIp(headers: Headers, env?: Env): string;
+/**
+ * getClientIp for readers that only record the address (audit rows, the new-device fingerprint): an invalid
+ * setting records UNKNOWN_CLIENT_IP instead of throwing, so the row is still written. Rate limits use getClientIp,
+ * which throws.
+ */
+export declare function getRecordedClientIp(headers: Headers, env?: Env): string;
+/**
+ * The headers Better Auth's own rate limiter should read (advanced.ipAddress.ipAddressHeaders), or undefined
+ * to keep its default. Better Auth trusts only a single-valued header, so 'xff' keeps its default; 'none' names no
+ * header, so Better Auth counts every request to a path in one shared bucket.
+ */
+export declare function getBetterAuthIpHeaders(env?: Env): string[] | undefined;
+/**
+ * Logs once per process when the client address source is invalid (in every environment) or, in production
+ * only, not set. Called at server start (logAuthReadinessAtStartup) and again on first use, for projects whose
+ * instrumentation does not run it; the flag lives on globalThis so both bundles share it.
+ */
+export declare function warnClientIpSourceAtStartup(env?: Env): void;
+export {};
+//# sourceMappingURL=client-ip.d.ts.map

package/dist/lib/api/client-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.d.ts","sourceRoot":"","sources":["../../../src/lib/api/client-ip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,iBAAiB,YAAY,CAAA;AAE1C,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpB,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAI7C,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,GAAiB,GAAG,cAAc,CAiBxE;AAWD,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,GAAiB,GAAG,MAAM,CA2B5E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,GAAiB,GAAG,MAAM,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,EAAE,GAAG,SAAS,CAWnF;AAID;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,GAAiB,GAAG,IAAI,CAkBxE"}

package/dist/lib/api/client-ip.js

@@ -0,0 +1,91 @@
+const UNKNOWN_CLIENT_IP = "unknown";
+const HEADER_NAME = /^[a-z0-9!#$%&'*+.^_`|~-]+$/;
+function getClientIpSource(env = process.env) {
+  var _a, _b;
+  const raw = (_a = env.NEXTSPARK_CLIENT_IP_SOURCE) == null ? void 0 : _a.trim().toLowerCase();
+  if (!raw) return { kind: "default" };
+  if (raw === "vercel" || raw === "cloudflare" || raw === "none") return { kind: raw };
+  if (raw === "xff") {
+    const hopsRaw = ((_b = env.NEXTSPARK_TRUSTED_PROXY_HOPS) == null ? void 0 : _b.trim()) || "1";
+    const hops = Number(hopsRaw);
+    if (!/^\d+$/.test(hopsRaw) || hops < 1) {
+      throw new Error("[client-ip] NEXTSPARK_TRUSTED_PROXY_HOPS must be a whole number of 1 or more");
+    }
+    return { kind: "xff", hops };
+  }
+  if (raw.startsWith("header:")) {
+    const header = raw.slice("header:".length).trim();
+    if (HEADER_NAME.test(header)) return { kind: "header", header };
+  }
+  throw new Error("[client-ip] NEXTSPARK_CLIENT_IP_SOURCE must be vercel, cloudflare, xff, none or header:<name>");
+}
+function entries(value) {
+  return value ? value.split(",").map((ip) => ip.trim()).filter(Boolean) : [];
+}
+function lastEntry(value) {
+  return entries(value).at(-1) ?? null;
+}
+function getClientIp(headers, env = process.env) {
+  warnClientIpSourceAtStartup(env);
+  const source = getClientIpSource(env);
+  switch (source.kind) {
+    case "vercel":
+      return lastEntry(headers.get("x-vercel-forwarded-for")) ?? lastEntry(headers.get("x-real-ip")) ?? UNKNOWN_CLIENT_IP;
+    case "cloudflare":
+      return lastEntry(headers.get("cf-connecting-ip")) ?? UNKNOWN_CLIENT_IP;
+    case "header":
+      return lastEntry(headers.get(source.header)) ?? UNKNOWN_CLIENT_IP;
+    case "xff": {
+      const ips = entries(headers.get("x-forwarded-for"));
+      return ips.length >= source.hops ? ips[ips.length - source.hops] : UNKNOWN_CLIENT_IP;
+    }
+    case "none":
+      return UNKNOWN_CLIENT_IP;
+    default:
+      return headers.get("cf-connecting-ip") || lastEntry(headers.get("x-forwarded-for")) || headers.get("x-real-ip") || headers.get("true-client-ip") || UNKNOWN_CLIENT_IP;
+  }
+}
+function getRecordedClientIp(headers, env = process.env) {
+  try {
+    return getClientIp(headers, env);
+  } catch {
+    return UNKNOWN_CLIENT_IP;
+  }
+}
+function getBetterAuthIpHeaders(env = process.env) {
+  try {
+    const source = getClientIpSource(env);
+    if (source.kind === "vercel") return ["x-vercel-forwarded-for", "x-real-ip"];
+    if (source.kind === "cloudflare") return ["cf-connecting-ip"];
+    if (source.kind === "header") return [source.header];
+    if (source.kind === "none") return [];
+  } catch {
+  }
+  return void 0;
+}
+const WARNED = /* @__PURE__ */ Symbol.for("nextspark.clientIpSourceWarned");
+function warnClientIpSourceAtStartup(env = process.env) {
+  const state = globalThis;
+  if (state[WARNED]) return;
+  let source;
+  try {
+    source = getClientIpSource(env);
+  } catch (error) {
+    state[WARNED] = true;
+    console.error(error.message);
+    return;
+  }
+  if (source.kind !== "default" || env.NODE_ENV !== "production") return;
+  state[WARNED] = true;
+  console.warn(
+    "[client-ip] NEXTSPARK_CLIENT_IP_SOURCE is not set, so rate limits and audit logs read the client address from request headers in a fixed order. Set it for your deployment: vercel, cloudflare, xff (with NEXTSPARK_TRUSTED_PROXY_HOPS) or header:<name>; none if nothing in front sets a client address."
+  );
+}
+export {
+  UNKNOWN_CLIENT_IP,
+  getBetterAuthIpHeaders,
+  getClientIp,
+  getClientIpSource,
+  getRecordedClientIp,
+  warnClientIpSourceAtStartup
+};