@nextsparkjs/core 0.1.0-beta.193 → 0.1.0-beta.195

package/dist/lib/api/rate-limit.js

@@ -1,11 +1,15 @@
 import { NextResponse } from "next/server";
 import { unstable_rethrow } from "next/navigation";
-import { getRateLimitForScopes } from "./keys.js";
+import { getRateLimitForScopes, presentedApiKey } from "./keys.js";
+import { validateApiKey } from "./auth.js";
 import { rateLimitCache, getCacheKey } from "./cache.js";
+import { getClientIp } from "./client-ip.js";
 import {
   checkRateLimit as checkRedisRateLimit,
   maybeRedisConfigured
 } from "../rate-limit-redis.js";
+import { checkRequestOrigin } from "./request-origin.js";
+import { withCors } from "./cors-response.js";
 function checkRateLimit(identifier, limit = 1e3, windowMs = 6e4) {
   const now = Date.now();
   const cacheKey = getCacheKey("rate_limit", identifier);
@@ -151,20 +155,11 @@ function addRateLimitHeaders(response, keyId, scopes) {
 function withRateLimit(handler) {
   return async (request, ...args) => {
     try {
-      const keyId = request.headers.get("x-api-key-id");
-      const scopesHeader = request.headers.get("x-api-scopes");
-      if (!keyId || !scopesHeader) {
+      const auth = presentedApiKey(request.headers) ? await validateApiKey(request) : null;
+      if (!auth) {
         return handler(request, ...args);
       }
-      let scopes = [];
-      try {
-        const parsed = JSON.parse(scopesHeader);
-        if (Array.isArray(parsed)) {
-          scopes = parsed.filter((s) => typeof s === "string");
-        }
-      } catch {
-        console.warn("[RateLimit] Invalid scopes header format");
-      }
+      const { keyId, scopes } = auth;
       const rateLimitResponse = applyRateLimit(request, keyId, scopes);
       if (rateLimitResponse) {
         return rateLimitResponse;
@@ -207,27 +202,6 @@ function getAllRateLimitStats() {
 function getRateLimitCacheStats() {
   return rateLimitCache.getStats();
 }
-function getClientIp(request) {
-  const cfIp = request.headers.get("cf-connecting-ip");
-  if (cfIp) return cfIp;
-  const forwardedFor = request.headers.get("x-forwarded-for");
-  if (forwardedFor) {
-    const ips = forwardedFor.split(",").map((ip) => ip.trim()).filter(Boolean);
-    if (ips.length > 0) return ips[ips.length - 1];
-  }
-  const realIp = request.headers.get("x-real-ip");
-  if (realIp) return realIp;
-  const trueClientIp = request.headers.get("true-client-ip");
-  if (trueClientIp) return trueClientIp;
-  return "unknown";
-}
-function getUserIdentifier(request) {
-  const apiKey = request.headers.get("x-api-key");
-  if (apiKey) {
-    return `apikey:${apiKey.substring(0, 16)}`;
-  }
-  return null;
-}
 let rateLimitDisabledWarningLogged = false;
 function isRateLimitingDisabled() {
   const disabled = process.env.DISABLE_RATE_LIMITING === "true";
@@ -238,13 +212,14 @@ function isRateLimitingDisabled() {
   return disabled;
 }
 function withRateLimitTier(handler, tier = "api") {
-  return async (request, ...args) => {
+  const limited = async (request, ...args) => {
+    const checked = checkRequestOrigin(request);
+    if (checked instanceof NextResponse) return checked;
+    request = checked;
     if (isRateLimitingDisabled()) {
       return handler(request, ...args);
     }
-    const userIdentifier = getUserIdentifier(request);
-    const clientIp = getClientIp(request);
-    const identifier = userIdentifier ? `${tier}:${userIdentifier}` : `${tier}:ip:${clientIp}`;
+    const identifier = `${tier}:ip:${getClientIp(request.headers)}`;
     const rateLimitResult = await checkDistributedRateLimit(identifier, tier);
     if (!rateLimitResult.allowed) {
       return createRateLimitErrorResponse(rateLimitResult);
@@ -255,6 +230,10 @@ function withRateLimitTier(handler, tier = "api") {
     response.headers.set("X-RateLimit-Reset", rateLimitResult.resetTime.toString());
     return response;
   };
+  return async (request, ...args) => {
+    const response = await limited(request, ...args);
+    return tier === "webhook" ? response : withCors(response, request);
+  };
 }
 export {
   addRateLimitHeaders,

package/dist/lib/api/request-origin.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Request origin check for cookie-authenticated writes.
+ *
+ * A POST/PUT/PATCH/DELETE that authenticates with the session cookie must come
+ * from an origin the app trusts: its own (NEXT_PUBLIC_APP_URL / BETTER_AUTH_URL)
+ * or one in the list Better Auth already trusts for sign-in (see
+ * getTrustedOrigins). withRateLimitTier runs it before every handler it wraps.
+ * Under the admin and developer areas (isAppOnlyCorsPath) only the app's own
+ * origin is trusted, plus, outside production, the request's own origin when it
+ * is a private-network address (#170); no other listed origin.
+ *
+ * What passes without a trusted origin, and why:
+ * - Reads (GET/HEAD/OPTIONS).
+ * - Requests without the session cookie: there is no session for them to use.
+ * - Requests that present an API key (`Authorization: Bearer sk_...` or
+ *   x-api-key, in the API-key format). They are let through without their
+ *   session cookie, so the handler can authenticate them only by the key: a key
+ *   that does not validate gets 401, never the cookie's session. Any other
+ *   Authorization value is not a credential here, and the check applies. Handlers
+ *   should read the session from the request they are given, not from
+ *   next/headers.
+ * - Requests with neither Origin nor Referer, unless their body is one an HTML
+ *   form can send. Browsers send Origin on every write, so these come from
+ *   native or server-side clients; requiring a non-form content type keeps
+ *   a body without origin information from ever being read as a form post.
+ */
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * Checks a write's origin. Returns a 403 response when a cookie-authenticated
+ * write does not come from a trusted origin. Otherwise returns the request the
+ * handler should get: the same request, or, for a write that would be refused
+ * but presents an API key, a copy without its session cookie.
+ */
+export declare function checkRequestOrigin(request: NextRequest): NextResponse | NextRequest;
+//# sourceMappingURL=request-origin.d.ts.map

package/dist/lib/api/request-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../../../src/lib/api/request-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA+DvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,WAAW,CAoBnF"}

package/dist/lib/api/request-origin.js

@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from "next/server";
+import { APP_CONFIG_MERGED } from "../config/index.js";
+import { hasSessionCookie } from "../auth/session-hint.js";
+import { getTrustedOrigins, isOriginAllowed, isPrivateLanOrigin, normalizeCorsEnvironment, normalizeOrigin } from "../utils/cors.js";
+import { ApiKeyManager, presentedApiKey } from "./keys.js";
+import { appOrigins, isAppOnlyCorsPath, requestPathname } from "./cors-response.js";
+const WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const FORM_CONTENT_TYPES = /* @__PURE__ */ new Set(["text/plain", "application/x-www-form-urlencoded", "multipart/form-data"]);
+function requestOrigin(headers) {
+  const origin = headers.get("origin");
+  if (origin) return origin;
+  const referer = headers.get("referer");
+  if (!referer) return null;
+  try {
+    return new URL(referer).origin;
+  } catch {
+    return "null";
+  }
+}
+const SESSION_COOKIE_NAME = /^(?:__Secure-)?better-auth[.-]/;
+function withoutSessionCookies(request) {
+  const headers = {};
+  request.headers.forEach((value, key) => {
+    headers[key] = value;
+  });
+  const kept = (headers.cookie ?? "").split(";").map((part) => part.trim()).filter((part) => part && !SESSION_COOKIE_NAME.test(part));
+  if (kept.length) headers.cookie = kept.join("; ");
+  else delete headers.cookie;
+  return new NextRequest(request.url, {
+    method: request.method,
+    headers,
+    body: request.body,
+    signal: request.signal,
+    nextConfig: { basePath: request.nextUrl.basePath }
+  });
+}
+function isTrustedWriteOrigin(request, origin) {
+  const path = requestPathname(request);
+  if (path !== void 0 && isAppOnlyCorsPath(path)) {
+    const lan = normalizeCorsEnvironment(process.env.NODE_ENV || "development") !== "production" && isPrivateLanOrigin(origin);
+    return lan || appOrigins().includes(origin);
+  }
+  return isOriginAllowed(origin, getTrustedOrigins(APP_CONFIG_MERGED, origin)) !== null;
+}
+function refusal(error, code) {
+  return NextResponse.json({ success: false, error, code }, { status: 403 });
+}
+function checkRequestOrigin(request) {
+  if (!WRITE_METHODS.has(request.method.toUpperCase())) return request;
+  const headers = request.headers;
+  if (!hasSessionCookie(headers.get("cookie"))) return request;
+  let refused;
+  const origin = requestOrigin(headers);
+  if (origin === null) {
+    const contentType = (headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+    if (!FORM_CONTENT_TYPES.has(contentType)) return request;
+    refused = refusal("This request needs an Origin header", "ORIGIN_REQUIRED");
+  } else {
+    const normalized = normalizeOrigin(origin);
+    if (isTrustedWriteOrigin(request, normalized)) return request;
+    refused = refusal("Request origin not allowed", "ORIGIN_NOT_ALLOWED");
+  }
+  const apiKey = presentedApiKey(headers);
+  if (apiKey && ApiKeyManager.validateKeyFormat(apiKey)) return withoutSessionCookies(request);
+  return refused;
+}
+export {
+  checkRequestOrigin
+};

package/dist/lib/auth/load-login-page.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Leaves for the login page with a full page load, base path included. Sign-out and the dashboard guards use it.
+ *
+ * With Cache Components a client navigation out of the dashboard leaves it mounted, hidden, with its last render
+ * ("signed out"); shown again after the next sign-in, its effects act on that and send the user back to /login. The
+ * login page comes back as the form the last sign-in left. Loading the page drops the React tree, the session store
+ * and the query cache together, whichever way the session ended (this tab's sign-out, another tab's, an expiry).
+ */
+export declare function loadLoginPage(): void;
+//# sourceMappingURL=load-login-page.d.ts.map

package/dist/lib/auth/load-login-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-login-page.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/load-login-page.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC"}

package/dist/lib/auth/load-login-page.js

@@ -0,0 +1,7 @@
+import { withBasePath } from "../base-path.js";
+function loadLoginPage() {
+  window.location.assign(withBasePath("/login"));
+}
+export {
+  loadLoginPage
+};

package/dist/lib/auth/runtime-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-readiness.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/runtime-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAElE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AAEpB,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAA;IAClF,GAAG,CAAC,EAAE,kBAAkB,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,wBAAwB,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAA;IAC/B,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAaD,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAEtG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,2BAAgC,GAAG,IAAI,CAazF;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAYrG;AAiBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE1F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE3F;AAkDD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4E1B;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,CAAC,CAGnB"}
+{"version":3,"file":"runtime-readiness.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/runtime-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGlE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AAEpB,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAA;IAClF,GAAG,CAAC,EAAE,kBAAkB,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,wBAAwB,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAA;IAC/B,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAaD,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAEtG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,2BAAgC,GAAG,IAAI,CAezF;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAYrG;AAiBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE1F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE3F;AAkDD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4E1B;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,CAAC,CAGnB"}

package/dist/lib/auth/runtime-readiness.js

@@ -1,6 +1,7 @@
 import "server-only";
 import { AUTH_CONFIG } from "../config/index.js";
 import { isPasswordLoginEnabled } from "./auth-methods.js";
+import { warnClientIpSourceAtStartup } from "../api/client-ip.js";
 import {
   authReadinessConfigurationFromEnv,
   evaluateAuthReadiness
@@ -19,6 +20,7 @@ function getRuntimeAuthReadiness(options = {}) {
   return evaluateAuthReadiness(runtimeInput(options));
 }
 function logAuthReadinessAtStartup(options = {}) {
+  warnClientIpSourceAtStartup(options.env ?? process.env);
   try {
     const env = options.env ?? process.env;
     if (env.NODE_ENV !== "production") return;

package/dist/lib/auth/security-notifications/device-fingerprint.d.ts

@@ -40,13 +40,6 @@ export declare function ipToNetworkKey(ip: string | null | undefined): string;
  * @returns hex sha256 of `normalizedUA|ipNetworkKey`
  */
 export declare function computeDeviceFingerprint(ua: string | null, ip: string | null): string;
-/**
- * Extract the best-effort client IP from request headers.
- *
- * Strategy mirrors the rate-limiter (see lib/api/rate-limit.ts):
- *   Cloudflare > rightmost x-forwarded-for > x-real-ip > true-client-ip > 'unknown'
- * The rightmost x-forwarded-for entry is the one appended by the last (trusted)
- * proxy, so it is the hardest for a client to spoof.
- */
+/** The client address of a request (lib/api/client-ip, the same one rate limits and audit logs use); unknown on an invalid setting. */
 export declare function extractClientIp(headers: Headers): string;
 //# sourceMappingURL=device-fingerprint.d.ts.map

package/dist/lib/auth/security-notifications/device-fingerprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-fingerprint.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/security-notifications/device-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAiBpE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,EAAE,EAAE,MAAM,GAAG,IAAI,GAChB,MAAM,CAGR;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAoBxD"}
+{"version":3,"file":"device-fingerprint.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/security-notifications/device-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAiBpE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,EAAE,EAAE,MAAM,GAAG,IAAI,GAChB,MAAM,CAGR;AAED,uIAAuI;AACvI,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAExD"}

package/dist/lib/auth/security-notifications/device-fingerprint.js

@@ -1,4 +1,5 @@
 import { createHash } from "crypto";
+import { getRecordedClientIp } from "../../api/client-ip.js";
 function normalizeUserAgent(ua) {
   if (!ua) return "";
   return ua.toLowerCase().trim().replace(/\s+/g, " ").replace(/(\d+)\.(\d+)(?:\.\d+)+/g, "$1.$2");
@@ -21,18 +22,7 @@ function computeDeviceFingerprint(ua, ip) {
   return createHash("sha256").update(material).digest("hex");
 }
 function extractClientIp(headers) {
-  const cfIp = headers.get("cf-connecting-ip");
-  if (cfIp) return cfIp;
-  const forwardedFor = headers.get("x-forwarded-for");
-  if (forwardedFor) {
-    const ips = forwardedFor.split(",").map((v) => v.trim()).filter(Boolean);
-    if (ips.length > 0) return ips[ips.length - 1];
-  }
-  const realIp = headers.get("x-real-ip");
-  if (realIp) return realIp;
-  const trueClientIp = headers.get("true-client-ip");
-  if (trueClientIp) return trueClientIp;
-  return "unknown";
+  return getRecordedClientIp(headers);
 }
 export {
   computeDeviceFingerprint,

package/dist/lib/auth-email-callbacks.js

@@ -1,5 +1,5 @@
 import { sendResetPasswordEmail, sendVerifyEmail } from "./email/send.js";
-import { I18N_CONFIG } from "./config/index.js";
+import { I18N_CONFIG, APP_NAME } from "./config/index.js";
 function requireEmail(user) {
   if (!user.email) throw new Error("Cannot send an auth email without an email address");
   return user.email;
@@ -10,7 +10,7 @@ async function sendResetPasswordCallback({ user, url, token: _token }, emailServ
     const template = await sendResetPasswordEmail({
       userName: user.firstName || "",
       resetUrl: url,
-      appName: process.env.NEXT_PUBLIC_APP_NAME || "Your App",
+      appName: process.env.NEXT_PUBLIC_APP_NAME || APP_NAME,
       expiresIn: "1 hour"
     }, I18N_CONFIG.defaultLocale);
     const response = await emailService.send({
@@ -32,7 +32,7 @@ async function sendVerificationEmailCallback({ user, url, token: _token }, email
     const template = await sendVerifyEmail({
       userName: user.firstName || "",
       verificationUrl: url,
-      appName: process.env.NEXT_PUBLIC_APP_NAME || "Your App"
+      appName: process.env.NEXT_PUBLIC_APP_NAME || APP_NAME
     }, I18N_CONFIG.defaultLocale);
     const response = await emailService.send({
       to: email,

package/dist/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAUA,OAAO,EAAgF,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAkBvH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsHD,eAAO,MAAM,IAAI,qEAkXf,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,EAAE,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAUA,OAAO,EAA0F,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAmBjI;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuHD,eAAO,MAAM,IAAI,qEAiXf,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,EAAE,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}

package/dist/lib/auth.js

@@ -8,7 +8,7 @@ import {
   sendOtpVerificationEmail
 } from "./email/send.js";
 import { sendResetPasswordCallback, sendVerificationEmailCallback } from "./auth-email-callbacks.js";
-import { I18N_CONFIG, USER_ROLES_CONFIG, TEAMS_CONFIG, AUTH_CONFIG, APP_CONFIG_MERGED } from "./config/index.js";
+import { I18N_CONFIG, USER_ROLES_CONFIG, TEAMS_CONFIG, AUTH_CONFIG, APP_CONFIG_MERGED, APP_NAME } from "./config/index.js";
 import { getUserFlags } from "./services/user-flags.service.js";
 import { TeamService } from "./services/team.service.js";
 import { TeamMemberService } from "./services/team-member.service.js";
@@ -19,8 +19,9 @@ import { resolveSessionConfig } from "./auth/session-config.js";
 import { resolveOtpConfig } from "./auth/otp-config.js";
 import { isPasswordLoginEnabled } from "./auth/auth-methods.js";
 import { isRuntimeEmailAvailable, isRuntimeGoogleAvailable } from "./auth/runtime-readiness.js";
-import { getCorsOrigins, isPrivateLanOrigin, normalizeCorsEnvironment } from "./utils/cors.js";
+import { getTrustedOrigins } from "./utils/cors.js";
 import { withBasePath } from "./base-path.js";
+import { getBetterAuthIpHeaders } from "./api/client-ip.js";
 async function hasPendingInvitationForEmail(email) {
   const row = await queryOne(
     `SELECT id FROM "team_invitations"
@@ -34,6 +35,7 @@ async function shouldSkipTeamCreationForUser(email) {
   return shouldSkipTeamCreation() || await hasPendingInvitationForEmail(email);
 }
 const isProd = process.env.NODE_ENV === "production";
+const betterAuthIpHeaders = getBetterAuthIpHeaders();
 const baseUrl = process.env.BETTER_AUTH_URL || process.env.NEXT_PUBLIC_APP_URL || "http://localhost:5173";
 const getEmailService = () => EmailFactory.create();
 const databaseUrl = process.env.DATABASE_SERVICE_URL || process.env.DATABASE_URL;
@@ -206,17 +208,7 @@ const auth = betterAuth({
   // adding a wildcard entry (e.g. "https://*.vercel.app") to
   // api.cors.additionalOrigins — better-auth's own trustedOrigins matching
   // already supports the same wildcard syntax as isOriginAllowed() above.
-  trustedOrigins: async (request) => {
-    const origins = getCorsOrigins(APP_CONFIG_MERGED);
-    if (normalizeCorsEnvironment(process.env.NODE_ENV || "development") === "production") {
-      return origins;
-    }
-    const requestOrigin = request == null ? void 0 : request.headers.get("origin");
-    if (requestOrigin && isPrivateLanOrigin(requestOrigin)) {
-      return [...origins, requestOrigin];
-    }
-    return origins;
-  },
+  trustedOrigins: async (request) => getTrustedOrigins(APP_CONFIG_MERGED, request == null ? void 0 : request.headers.get("origin")),
   // Redirect auth errors to our custom error page instead of Better Auth's default.
   // Better Auth redirects to this path as-is, outside the Next.js router.
   onAPIError: {
@@ -235,7 +227,7 @@ const auth = betterAuth({
           email,
           otp,
           type,
-          appName: process.env.NEXT_PUBLIC_APP_NAME || "Your App",
+          appName: process.env.NEXT_PUBLIC_APP_NAME || APP_NAME,
           expiresIn: otpConfig.expiresIn
         }, I18N_CONFIG.defaultLocale);
         await getEmailService().send({ to: email, ...template });
@@ -249,6 +241,12 @@ const auth = betterAuth({
     nextCookies()
     // MUST be the last plugin for Next.js cookie handling
   ],
+  // The proxy reads the session on every request; that lookup only reads the
+  // caller's own signed cookie, so it is kept out of the shared auth rate limit.
+  // The default limits (sign-in, sign-up, OTP, ...) stay.
+  rateLimit: {
+    customRules: { "/get-session": false }
+  },
   session: {
     // Configurable per theme via `auth.session` in app.config.ts (defaults:
     // 7 days / renewed daily / 5-minute cookie cache).
@@ -406,6 +404,9 @@ const auth = betterAuth({
   },
   // Removed additionalFields - will use standard name and image fields
   advanced: {
+    // Better Auth's own rate limiter reads the client address from the header NEXTSPARK_CLIENT_IP_SOURCE
+    // names (lib/api/client-ip); unset, 'xff' and 'none' keep Better Auth's default.
+    ...betterAuthIpHeaders ? { ipAddress: { ipAddressHeaders: betterAuthIpHeaders } } : {},
     // Cross-subdomain session cookies (opt-in via env).
     //
     // When an app serves tenants on subdomains (e.g. `<tenant>.example.com`)

package/dist/lib/config/config-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/config-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuCH,eAAO,MAAM,iBAAiB,qBAAe,CAAA;AAC7C,eAAO,MAAM,WAAW,KAAyB,CAAA;AACjD,eAAO,MAAM,QAAQ,KAA6B,CAAA;AAClD,eAAO,MAAM,WAAW,KAAgC,CAAA;AACxD,eAAO,MAAM,WAAW,KAAyB,CAAA;AACjD,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAI5D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAqE,CAAA;AAClG,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA0B,CAAA;AACpD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA4B,CAAA;AAExD,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,OACP,CAAA;AAElD,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAO,MAAM,uBAAuB,QAAO,mBAAmB,EAClB,CAAA;AAE5C,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,KAAG,OACP,CAAA;AAElD,eAAO,MAAM,sBAAsB,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,KAAG,CAAC,GAAG,SACV,CAAA;AAGhF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"config-client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/config-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuCH,eAAO,MAAM,iBAAiB,qBAAe,CAAA;AAC7C,eAAO,MAAM,WAAW,KAAyB,CAAA;AACjD,eAAO,MAAM,QAAQ,KAAiE,CAAA;AACtF,eAAO,MAAM,WAAW,KAAgC,CAAA;AACxD,eAAO,MAAM,WAAW,KAAyB,CAAA;AACjD,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAI5D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAqE,CAAA;AAClG,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA0B,CAAA;AACpD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA4B,CAAA;AAExD,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,OACP,CAAA;AAElD,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAO,MAAM,uBAAuB,QAAO,mBAAmB,EAClB,CAAA;AAE5C,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,KAAG,OACP,CAAA;AAElD,eAAO,MAAM,sBAAsB,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,KAAG,CAAC,GAAG,SACV,CAAA;AAGhF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/lib/config/config-client.js

@@ -34,7 +34,7 @@ if ((_a = DEFAULT_APP_CONFIG.teams) == null ? void 0 : _a.roles) {
 }
 const APP_CONFIG_MERGED = mergedConfig;
 const I18N_CONFIG = APP_CONFIG_MERGED.i18n;
-const APP_NAME = APP_CONFIG_MERGED.app.name;
+const APP_NAME = process.env.NEXT_PUBLIC_APP_NAME || APP_CONFIG_MERGED.app.name;
 const APP_VERSION = APP_CONFIG_MERGED.app.version;
 const AUTH_CONFIG = APP_CONFIG_MERGED.auth;
 const API_CONFIG = APP_CONFIG_MERGED.api;

package/dist/lib/config/config-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-sync.d.ts","sourceRoot":"","sources":["../../../src/lib/config/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0LH,eAAO,MAAM,iBAAiB,KAAkB,CAAA;AAChD,eAAO,MAAM,gBAAgB,KAAwB,CAAA;AACrD,eAAO,MAAM,UAAU,6BAAkB,CAAA;AAGzC,eAAO,MAAM,iBAAiB,KAA0C,CAAA;AACxE,eAAO,MAAM,cAAc,KAAuC,CAAA;AAClE,eAAO,MAAM,eAAe,KAA6C,CAAA;AACzE,eAAO,MAAM,YAAY,KAA0C,CAAA;AACnE,eAAO,MAAM,QAAQ,KAA6B,CAAA;AAClD,eAAO,MAAM,WAAW,KAAgC,CAAA;AAGxD,eAAO,MAAM,WAAW,KAAyB,CAAA;AACjD,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAC5D,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAC5D,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,WAAW,KAAyB,CAAA;AAcjD,eAAO,MAAM,kBAAkB;;cAEqC,OAAO,SAAS,EAAE,gBAAgB;;;;;;;;;CAaxD,CAAA;AAI9C,eAAO,MAAM,aAAa,KAA0B,CAAA;AACpD,eAAO,MAAM,cAAc,KAA2B,CAAA;AACtD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,kBAAkB,KAA+B,CAAA;AAC9D,eAAO,MAAM,oBAAoB,KAAiC,CAAA;AAIlE,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,OAExD,CAAA;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAO,MAAM,uBAAuB,QAAO,mBAAmB,EAE7D,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,KAAG,OAExD,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,KAAG,CAAC,GAAG,SAGzF,CAAA;AAGD,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;AACpF,MAAM,MAAM,oBAAoB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACnF,MAAM,MAAM,QAAQ,GAAG,OAAO,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"config-sync.d.ts","sourceRoot":"","sources":["../../../src/lib/config/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0LH,eAAO,MAAM,iBAAiB,KAAkB,CAAA;AAChD,eAAO,MAAM,gBAAgB,KAAwB,CAAA;AACrD,eAAO,MAAM,UAAU,6BAAkB,CAAA;AAGzC,eAAO,MAAM,iBAAiB,KAA0C,CAAA;AACxE,eAAO,MAAM,cAAc,KAAuC,CAAA;AAClE,eAAO,MAAM,eAAe,KAA6C,CAAA;AACzE,eAAO,MAAM,YAAY,KAA0C,CAAA;AACnE,eAAO,MAAM,QAAQ,KAAiE,CAAA;AACtF,eAAO,MAAM,WAAW,KAAgC,CAAA;AAGxD,eAAO,MAAM,WAAW,KAAyB,CAAA;AACjD,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAC5D,eAAO,MAAM,UAAU,KAAwB,CAAA;AAC/C,eAAO,MAAM,iBAAiB,KAA8B,CAAA;AAC5D,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,YAAY,KAA0B,CAAA;AACnD,eAAO,MAAM,WAAW,KAAyB,CAAA;AAcjD,eAAO,MAAM,kBAAkB;;cAEqC,OAAO,SAAS,EAAE,gBAAgB;;;;;;;;;CAaxD,CAAA;AAI9C,eAAO,MAAM,aAAa,KAA0B,CAAA;AACpD,eAAO,MAAM,cAAc,KAA2B,CAAA;AACtD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,kBAAkB,KAA+B,CAAA;AAC9D,eAAO,MAAM,oBAAoB,KAAiC,CAAA;AAIlE,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,OAExD,CAAA;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAO,MAAM,uBAAuB,QAAO,mBAAmB,EAE7D,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,KAAG,OAExD,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,KAAG,CAAC,GAAG,SAGzF,CAAA;AAGD,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;AACpF,MAAM,MAAM,oBAAoB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACnF,MAAM,MAAM,QAAQ,GAAG,OAAO,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA"}

package/dist/lib/config/config-sync.js

@@ -109,7 +109,7 @@ const SUPPORTED_LOCALES = APP_CONFIG_MERGED.i18n.supportedLocales;
 const DEFAULT_LOCALE = APP_CONFIG_MERGED.i18n.defaultLocale;
 const AVAILABLE_ROLES = APP_CONFIG_MERGED.userRoles.availableRoles;
 const DEFAULT_ROLE = APP_CONFIG_MERGED.userRoles.defaultRole;
-const APP_NAME = APP_CONFIG_MERGED.app.name;
+const APP_NAME = process.env.NEXT_PUBLIC_APP_NAME || APP_CONFIG_MERGED.app.name;
 const APP_VERSION = APP_CONFIG_MERGED.app.version;
 const I18N_CONFIG = APP_CONFIG_MERGED.i18n;
 const APP_CONFIG = APP_CONFIG_MERGED.app;

package/dist/lib/config/public-config-client.d.ts

@@ -6,6 +6,7 @@
  * component on a public or auth route imports this module instead, so those pages ship neither (#207).
  */
 export declare const APP_NAME: any;
+export declare const APP_DESCRIPTION: any;
 export declare const DOCS_CONFIG: any;
 export declare const PUBLIC_AUTH_CONFIG: {
     registration: {

package/dist/lib/config/public-config-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-config-client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/public-config-client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,eAAO,MAAM,QAAQ,KAAqB,CAAA;AAC1C,eAAO,MAAM,WAAW,KAAiB,CAAA;AAGzC,eAAO,MAAM,kBAAkB;;;;;;;;;;;CAS9B,CAAA"}
+{"version":3,"file":"public-config-client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/public-config-client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,eAAO,MAAM,QAAQ,KAAyD,CAAA;AAC9E,eAAO,MAAM,eAAe,KAA4B,CAAA;AACxD,eAAO,MAAM,WAAW,KAAiB,CAAA;AAGzC,eAAO,MAAM,kBAAkB;;;;;;;;;;;CAS9B,CAAA"}

package/dist/lib/config/public-config-client.js

@@ -5,7 +5,8 @@ import { mergeConfigs } from "../utils/config-merge.js";
 import { resolveAuthMethods } from "../auth/auth-methods.js";
 import { resolveOtpConfig } from "../auth/otp-config.js";
 const appConfig = mergeConfigs(DEFAULT_APP_CONFIG, APP_CONFIG_OVERRIDES);
-const APP_NAME = appConfig.app.name;
+const APP_NAME = process.env.NEXT_PUBLIC_APP_NAME || appConfig.app.name;
+const APP_DESCRIPTION = appConfig.app.description;
 const DOCS_CONFIG = appConfig.docs;
 const methods = resolveAuthMethods(appConfig.auth);
 const PUBLIC_AUTH_CONFIG = {
@@ -19,6 +20,7 @@ const PUBLIC_AUTH_CONFIG = {
   otp: resolveOtpConfig(appConfig.auth)
 };
 export {
+  APP_DESCRIPTION,
   APP_NAME,
   DOCS_CONFIG,
   PUBLIC_AUTH_CONFIG

package/dist/lib/config/types.d.ts

@@ -626,6 +626,8 @@ export interface AppConfig {
     app: {
         name: string;
         version: string;
+        /** One line shown under the name on the sign-in pages; the wizard writes the project's. */
+        description?: string;
     };
     i18n: {
         supportedLocales: string[];

package/dist/lib/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/config/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,eAAe,GACf,cAAc,CAAA;AAElB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,+BAA+B;IAC/B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,qCAAqC;IACrC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB;IACjB,IAAI,EAAE,SAAS,CAAA;IACf,yBAAyB;IACzB,OAAO,CAAC,EAAE,kBAAkB,CAAA;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAA;IAEV,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;IAEhB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,kCAAkC;IAClC,IAAI,EAAE,QAAQ,CAAA;IAEd,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAEhB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,aAAa,GAAG,WAAW,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAA;IAEV,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;IAEhB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAA;IAEZ,kCAAkC;IAClC,IAAI,EAAE,QAAQ,CAAA;IAEd,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAEhB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,KAAK,EAAE,aAAa,EAAE,CAAA;IAEtB,8CAA8C;IAC9C,cAAc,EAAE,iBAAiB,EAAE,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE;QACR,WAAW,EAAE,OAAO,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,aAAa,EAAE,OAAO,CAAA;QACtB,IAAI,EAAE,OAAO,CAAA;QACb,KAAK,EAAE,OAAO,CAAA;QACd,KAAK,EAAE,OAAO,CAAA;QACd,QAAQ,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QACL,OAAO,EAAE,kBAAkB,CAAA;QAC3B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,QAAQ,EAAE,kBAAkB,CAAA;KAC7B,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB,iDAAiD;IACjD,IAAI,CAAC,EAAE,OAAO,CAAA;IAEd;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,iDAAiD;IACjD,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAA;IAErC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IAEV,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;IAEb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAA;IAEZ,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAA;IAEhB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAEhB,mDAAmD;IACnD,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAEhC,wCAAwC;IACxC,eAAe,EAAE,MAAM,CAAA;IAEvB,+BAA+B;IAC/B,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAErC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEjC,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IAEd,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;IAEhD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAA;IAEhB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAA;IAErB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IAEjB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAA;IAEtB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QACd,qFAAqF;QACrF,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,0GAA0G;IAC1G,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,0GAA0G;IAC1G,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oFAAoF;IACpF,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,mBAAmB,GAAG,aAAa,GAAG,iBAAiB,CAAA;AAE/F;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,wBAAwB;IACxB,IAAI,EAAE,gBAAgB,CAAA;IAEtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE;QACP;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAEhB,2CAA2C;IAC3C,MAAM,EAAE;QACN,+DAA+D;QAC/D,cAAc,EAAE,OAAO,CAAA;QACvB,0CAA0C;QAC1C,eAAe,EAAE,OAAO,CAAA;QACxB,wEAAwE;QACxE,YAAY,EAAE,OAAO,CAAA;KACtB,CAAA;IAED;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,oBAAoB;QACpB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,0CAA0C;QAC1C,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,gBAAgB,CAAA;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,SAAS,CAAA;AAEnD,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,YAAY,EAAE,sBAAsB,CAAA;IAEpC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;IAE3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE;QACjB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;IAED;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAE3B;;;OAGG;IACH,GAAG,CAAC,EAAE,aAAa,CAAA;IAEnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,mBAAmB,CAAA;IAE/B,qFAAqF;IACrF,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IAEnD;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IAEvC,sFAAsF;IACtF,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE;QACZ,IAAI,EAAE,gBAAgB,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,MAAM,EAAE;YACN,8EAA8E;YAC9E,OAAO,EAAE,OAAO,CAAA;SACjB,CAAA;KACF,CAAA;IACD,4EAA4E;IAC5E,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE;QACJ,+CAA+C;QAC/C,SAAS,EAAE,MAAM,CAAA;QACjB,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IAED,IAAI,EAAE;QACJ,gBAAgB,EAAE,MAAM,EAAE,CAAA;QAC1B,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;WAKG;QACH,eAAe,CAAC,EAAE,OAAO,CAAA;QACzB,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAA;YACZ,MAAM,EAAE,MAAM,CAAA;YACd;;;;eAIG;YACH,QAAQ,EAAE,OAAO,CAAA;YACjB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;YACxB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;YACnC,IAAI,EAAE,MAAM,CAAA;SACb,CAAA;QACD,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,WAAW,EAAE;YACX,yBAAyB,EAAE,MAAM,EAAE,CAAA;SACpC,CAAA;KACF,CAAA;IAED,MAAM,EAAE,YAAY,CAAA;IAEpB,QAAQ,EAAE,cAAc,CAAA;IAExB,SAAS,EAAE,eAAe,CAAA;IAE1B,yCAAyC;IACzC,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAE7B,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IAEzC,kCAAkC;IAClC,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,oDAAoD;IACpD,IAAI,CAAC,EAAE,UAAU,CAAA;IAGjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,SAAS;IACxB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAM9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/config/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,eAAe,GACf,cAAc,CAAA;AAElB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,+BAA+B;IAC/B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,qCAAqC;IACrC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB;IACjB,IAAI,EAAE,SAAS,CAAA;IACf,yBAAyB;IACzB,OAAO,CAAC,EAAE,kBAAkB,CAAA;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAA;IAEV,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;IAEhB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,kCAAkC;IAClC,IAAI,EAAE,QAAQ,CAAA;IAEd,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAEhB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,aAAa,GAAG,WAAW,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAA;IAEV,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;IAEhB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAA;IAEZ,kCAAkC;IAClC,IAAI,EAAE,QAAQ,CAAA;IAEd,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAEhB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,KAAK,EAAE,aAAa,EAAE,CAAA;IAEtB,8CAA8C;IAC9C,cAAc,EAAE,iBAAiB,EAAE,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE;QACR,WAAW,EAAE,OAAO,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,aAAa,EAAE,OAAO,CAAA;QACtB,IAAI,EAAE,OAAO,CAAA;QACb,KAAK,EAAE,OAAO,CAAA;QACd,KAAK,EAAE,OAAO,CAAA;QACd,QAAQ,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QACL,OAAO,EAAE,kBAAkB,CAAA;QAC3B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,QAAQ,EAAE,kBAAkB,CAAA;KAC7B,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB,iDAAiD;IACjD,IAAI,CAAC,EAAE,OAAO,CAAA;IAEd;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,iDAAiD;IACjD,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAA;IAErC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IAEV,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;IAEb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAA;IAEZ,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAA;IAEhB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAEhB,mDAAmD;IACnD,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAEhC,wCAAwC;IACxC,eAAe,EAAE,MAAM,CAAA;IAEvB,+BAA+B;IAC/B,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAErC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEjC,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IAEd,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;IAEhD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAA;IAEhB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAA;IAErB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IAEjB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAA;IAEtB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QACd,qFAAqF;QACrF,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,0GAA0G;IAC1G,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,0GAA0G;IAC1G,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oFAAoF;IACpF,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,mBAAmB,GAAG,aAAa,GAAG,iBAAiB,CAAA;AAE/F;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,wBAAwB;IACxB,IAAI,EAAE,gBAAgB,CAAA;IAEtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE;QACP;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAEhB,2CAA2C;IAC3C,MAAM,EAAE;QACN,+DAA+D;QAC/D,cAAc,EAAE,OAAO,CAAA;QACvB,0CAA0C;QAC1C,eAAe,EAAE,OAAO,CAAA;QACxB,wEAAwE;QACxE,YAAY,EAAE,OAAO,CAAA;KACtB,CAAA;IAED;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,oBAAoB;QACpB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,0CAA0C;QAC1C,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,gBAAgB,CAAA;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,SAAS,CAAA;AAEnD,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,YAAY,EAAE,sBAAsB,CAAA;IAEpC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;IAE3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE;QACjB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;IAED;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAE3B;;;OAGG;IACH,GAAG,CAAC,EAAE,aAAa,CAAA;IAEnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,mBAAmB,CAAA;IAE/B,qFAAqF;IACrF,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IAEnD;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IAEvC,sFAAsF;IACtF,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE;QACZ,IAAI,EAAE,gBAAgB,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,MAAM,EAAE;YACN,8EAA8E;YAC9E,OAAO,EAAE,OAAO,CAAA;SACjB,CAAA;KACF,CAAA;IACD,4EAA4E;IAC5E,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE;QACJ,+CAA+C;QAC/C,SAAS,EAAE,MAAM,CAAA;QACjB,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,2FAA2F;QAC3F,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IAED,IAAI,EAAE;QACJ,gBAAgB,EAAE,MAAM,EAAE,CAAA;QAC1B,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;WAKG;QACH,eAAe,CAAC,EAAE,OAAO,CAAA;QACzB,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAA;YACZ,MAAM,EAAE,MAAM,CAAA;YACd;;;;eAIG;YACH,QAAQ,EAAE,OAAO,CAAA;YACjB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;YACxB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;YACnC,IAAI,EAAE,MAAM,CAAA;SACb,CAAA;QACD,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,WAAW,EAAE;YACX,yBAAyB,EAAE,MAAM,EAAE,CAAA;SACpC,CAAA;KACF,CAAA;IAED,MAAM,EAAE,YAAY,CAAA;IAEpB,QAAQ,EAAE,cAAc,CAAA;IAExB,SAAS,EAAE,eAAe,CAAA;IAE1B,yCAAyC;IACzC,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAE7B,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IAEzC,kCAAkC;IAClC,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,oDAAoD;IACpD,IAAI,CAAC,EAAE,UAAU,CAAA;IAGjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,SAAS;IACxB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAM9B"}

package/dist/lib/constants/reserved-slugs.d.ts

@@ -1,22 +1,31 @@
 /**
  * Reserved Slugs for Pages System
  *
- * This file contains all slugs that cannot be used for dynamic pages
- * to prevent conflicts with system routes, API endpoints, and existing entities.
- *
- * Auto-updated by build-registry.mjs to include entity slugs from ENTITY_REGISTRY
+ * The slugs a page at the site root cannot take because a route of the host already answers that URL: Next serves
+ * a static segment before the generated `(public)/[slug]` page. They are the first segments of core's route
+ * manifest (`src/routes/manifest.json`; a test fails when the two drift) plus `_next`. The base paths of the
+ * other registered entities are added where the check runs (`validatePublicSlug`); the routes a project adds
+ * under `templates/` are the project's to avoid.
  */
-export declare const RESERVED_SLUGS: readonly ["api", "auth", "admin", "login", "register", "dashboard", "signin", "signout", "signup", "verify", "reset-password", "forgot-password", "_next", "_vercel", "_error", "_document", "_app", "public", "static", "assets", "images", "theme", "favicon.ico", "robots.txt", "sitemap.xml", "manifest.json", "app", "core", "lib", "components", "utils", "styles", "fonts", "index", "home", "page", "post", "posts", "blog", "article", "articles", "v1", "v2", "v3"];
+export declare const RESERVED_SLUGS: readonly ["_next", "403", "accept-invite", "api", "auth-error", "dashboard", "devtools", "docs", "forgot-password", "login", "public", "reset-password", "signup", "superadmin", "verify-email"];
 export type ReservedSlug = (typeof RESERVED_SLUGS)[number];
 /**
- * Check if a slug is reserved
+ * Check if a slug is reserved: one of core's routes, or one of `extra` (other entities' base path segments)
  */
-export declare function isReservedSlug(slug: string): boolean;
+export declare function isReservedSlug(slug: string, extra?: readonly string[]): boolean;
 /**
  * Validate a slug for pages system
  * Returns error message if invalid, null if valid
+ *
+ * The format is the one the templates' `valid_slug` / `valid_post_slug` constraints enforce
+ * (`^[a-z0-9\-]+$`, no dot: a dotted last segment is read as a file request by the public item routes),
+ * plus the stricter rules below, which only apply to new writes. `checkReserved: false` skips the reserved
+ * list, `reserved` adds words to it, for an entity whose URLs are not at the site root (`/blog/v1` cannot shadow a root route).
  */
-export declare function validatePageSlug(slug: string): string | null;
+export declare function validatePageSlug(slug: string, { checkReserved, reserved }?: {
+    checkReserved?: boolean;
+    reserved?: readonly string[];
+}): string | null;
 /**
  * Generate a slug from a string (typically a title)
  */

package/dist/lib/constants/reserved-slugs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reserved-slugs.d.ts","sourceRoot":"","sources":["../../../src/lib/constants/reserved-slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,cAAc,+cA2DjB,CAAA;AAEV,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqC5D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAsB3F"}
+{"version":3,"file":"reserved-slugs.d.ts","sourceRoot":"","sources":["../../../src/lib/constants/reserved-slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,cAAc,kMAgBjB,CAAA;AAEV,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAGnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,EAAE,aAAoB,EAAE,QAAa,EAAE,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACtG,MAAM,GAAG,IAAI,CAqCf;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAsB3F"}