@nextsparkjs/core 0.1.0-beta.193 → 0.1.0-beta.195

package/dist/lib/constants/reserved-slugs.js

@@ -1,61 +1,25 @@
 const RESERVED_SLUGS = [
-  // Core system routes
+  "_next",
+  "403",
+  "accept-invite",
   "api",
-  "auth",
-  "admin",
-  "login",
-  "register",
+  "auth-error",
   "dashboard",
-  "signin",
-  "signout",
-  "signup",
-  "verify",
-  "reset-password",
+  "devtools",
+  "docs",
   "forgot-password",
-  // Next.js internals
-  "_next",
-  "_vercel",
-  "_error",
-  "_document",
-  "_app",
-  // Common static assets
+  "login",
   "public",
-  "static",
-  "assets",
-  "images",
-  "theme",
-  "favicon.ico",
-  "robots.txt",
-  "sitemap.xml",
-  "manifest.json",
-  // Reserved for potential future use
-  "app",
-  "core",
-  "lib",
-  "components",
-  "utils",
-  "styles",
-  "fonts",
-  // Common page names that might conflict
-  "index",
-  "home",
-  "page",
-  "post",
-  "posts",
-  "blog",
-  "article",
-  "articles",
-  // API versioning
-  "v1",
-  "v2",
-  "v3"
-  // Will be extended with entity slugs from ENTITY_REGISTRY
-  // by build-registry.mjs
+  "reset-password",
+  "signup",
+  "superadmin",
+  "verify-email"
 ];
-function isReservedSlug(slug) {
-  return RESERVED_SLUGS.includes(slug.toLowerCase());
+function isReservedSlug(slug, extra = []) {
+  const lower = slug.toLowerCase();
+  return RESERVED_SLUGS.includes(lower) || extra.includes(lower);
 }
-function validatePageSlug(slug) {
+function validatePageSlug(slug, { checkReserved = true, reserved = [] } = {}) {
   if (!slug || slug.trim().length === 0) {
     return "Slug cannot be empty";
   }
@@ -75,7 +39,7 @@ function validatePageSlug(slug) {
   if (slug.length < 2) {
     return "Slug must be at least 2 characters long";
   }
-  if (isReservedSlug(slug)) {
+  if (checkReserved && isReservedSlug(slug, reserved)) {
     return `Slug "${slug}" is reserved by the system`;
   }
   return null;

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAQ3C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAe1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,kBAAkB,EAAE,OAAO,CAAA;CAAE,CAiD3F;AAQD,QAAA,MAAM,IAAI,MAMR,CAAC;AAoBH,QAAA,MAAM,WAAW,EAAE,IASX,CAAC;AAET;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAuBnD;AAgCD,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,EAAE,CAAC,CAiCd;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAC7C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU;YAsB3E,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAUjE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B;YAzB/B,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAsBjE;AAGD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,CAAC,GAAG,OAAO,EACrC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1C;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAGd;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAID,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,wBAAgB,OAAO,IAAI,IAAI,CAK9B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAuBvC;AAED;;GAEG;AACH,wBAAgB,YAAY;;;;;;EAQ3B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,GAAE,MAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqD/E;AAgBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYrF;AAMD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAchE"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAQ3C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAe1D;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,kBAAkB,EAAE,OAAO,CAAA;CAAE,CA+C3F;AAQD,QAAA,MAAM,IAAI,MAMR,CAAC;AAoBH,QAAA,MAAM,WAAW,EAAE,IASX,CAAC;AAET;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAuBnD;AAgCD,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,EAAE,CAAC,CAiCd;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAC7C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU;YAsB3E,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAUjE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B;YAzB/B,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAsBjE;AAGD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,CAAC,GAAG,OAAO,EACrC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1C;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAGd;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAID,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,wBAAgB,OAAO,IAAI,IAAI,CAK9B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAuBvC;AAED;;GAEG;AACH,wBAAgB,YAAY;;;;;;EAQ3B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,GAAE,MAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqD/E;AAgBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYrF;AAMD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAchE"}

package/dist/lib/db.js

@@ -14,6 +14,14 @@ function stripSSLParams(databaseUrl2) {
     return databaseUrl2.replace(/[?&]sslmode=[^&]*/g, "").replace(/[?&]uselibpqcompat=[^&]*/g, "").replace(/\?&/, "?").replace(/\?$/, "");
   }
 }
+const SSL_WARNED = /* @__PURE__ */ Symbol.for("nextspark.dbSslDisabledWarned");
+function warnSSLDisabledInProduction(url) {
+  const state = globalThis;
+  if (state[SSL_WARNED]) return;
+  if (["localhost", "127.0.0.1", "[::1]"].includes(url.hostname.toLowerCase())) return;
+  state[SSL_WARNED] = true;
+  console.warn("[DB] WARNING: SSL disabled in production environment. This is insecure!");
+}
 function parseSSLConfig(databaseUrl2) {
   var _a;
   const isProduction = process.env.NODE_ENV === "production";
@@ -26,9 +34,7 @@ function parseSSLConfig(databaseUrl2) {
     if (sslmode) {
       switch (sslmode) {
         case "disable":
-          if (isProduction) {
-            console.warn("[DB] WARNING: SSL disabled in production environment. This is insecure!");
-          }
+          if (isProduction) warnSSLDisabledInProduction(url);
           return false;
         case "require":
         case "prefer":

package/dist/lib/entities/external-api-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-api-generator.d.ts","sourceRoot":"","sources":["../../../src/lib/entities/external-api-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAqB,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAK3C,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,EAAE,CAAA;KAClB,CAAA;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB;mBAqFT,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;oBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;qBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;sBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;uBAkGnD,WAAW;EAnHnC;AAyKD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoMrD"}
+{"version":3,"file":"external-api-generator.d.ts","sourceRoot":"","sources":["../../../src/lib/entities/external-api-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAqB,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAM3C,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,EAAE,CAAA;KAClB,CAAA;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB;mBAqFT,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;oBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;qBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;sBAAnD,WAAW,YAAY;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;uBAkGnD,WAAW;EAnHnC;AAwKD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoMrD"}

package/dist/lib/entities/external-api-generator.js

@@ -3,6 +3,7 @@ import { generateEntityAPI } from "./api-generator.js";
 import { getEntityConfig } from "./registry.js";
 import { rateLimit } from "../rate-limit.js";
 import { validateAPIKey } from "../auth/api-keys.js";
+import { getClientIp } from "../api/client-ip.js";
 function generateExternalAPI(entityName, options = {}) {
   const entityConfig = getEntityConfig(entityName);
   if (!entityConfig) {
@@ -153,7 +154,9 @@ function addCORSHeaders(response, corsOptions, request) {
   response.headers.set("Access-Control-Allow-Methods", corsOptions.methods.join(", "));
   response.headers.set("Access-Control-Allow-Headers", corsOptions.headers.join(", "));
   response.headers.set("Access-Control-Max-Age", "86400");
-  response.headers.set("Access-Control-Allow-Credentials", "true");
+  if (origin && corsOptions.origins.includes(origin)) {
+    response.headers.set("Access-Control-Allow-Credentials", "true");
+  }
 }
 function createErrorResponse(status, message, details) {
   return NextResponse.json({
@@ -166,10 +169,7 @@ function createErrorResponse(status, message, details) {
   }, { status });
 }
 function getClientIdentifier(request) {
-  const apiKeyId = request.headers.get("x-api-key-id");
-  const clientId = request.headers.get("x-client-id");
-  const ip = request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || "unknown";
-  return apiKeyId || clientId || ip;
+  return getClientIp(request.headers);
 }
 function generateOpenAPISpec(entityName) {
   const entityConfig = getEntityConfig(entityName);

package/dist/lib/entities/public-slug.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Slugs of public entities (#215)
+ *
+ * A slug that ends up in a public URL is validated on write, with the one format the templates' pages and
+ * posts tables enforce (`validatePageSlug`): lowercase letters, digits and hyphens, no dot. Reserved words
+ * are refused only for an entity served at the site root (`access.basePath: '/'`), where they would shadow
+ * a route. Existing rows are not rewritten, and a slug that did not change is never judged (the callers check).
+ */
+import type { EntityConfig } from './types';
+/** What the slug rule reads of an entity: the server's config, or the client registry's lighter one. */
+export interface SlugScope {
+    access?: {
+        basePath?: string;
+        allowNestedSlugs?: boolean;
+    };
+    builder?: {
+        public?: {
+            basePath?: string;
+        };
+    };
+}
+/** Whether the entity has a `slug` field that becomes part of a public URL. */
+export declare function hasPublicSlug(entity: EntityConfig): boolean;
+/**
+ * The first segments of the base paths the other entities are served under (`/blog/x` -> `blog`): a root page with
+ * that slug would be shadowed by their routes.
+ */
+export declare function otherBasePathSegments(entity: SlugScope, entities: readonly (SlugScope & {
+    slug?: string;
+})[]): string[];
+/**
+ * The reason `slug` cannot be a public slug of `entity`, or null when it can. `taken` are the base path segments
+ * of the other entities (`otherBasePathSegments`), reserved for an entity at the site root.
+ */
+export declare function validatePublicSlug(entity: SlugScope, slug: string, taken?: readonly string[]): string | null;
+/**
+ * The validation issue (Zod's shape, so clients read it like any other field error) for the `slug` of a
+ * write body, or null: the entity has no public slug, the body does not carry one (an update that leaves it
+ * alone), or it is valid. Meant to run after the schema accepted the body, so a present slug is a string or null.
+ */
+export declare function publicSlugIssue(entity: EntityConfig, data: Record<string, unknown>, taken?: readonly string[]): {
+    code: string;
+    path: string[];
+    message: string;
+};
+//# sourceMappingURL=public-slug.d.ts.map

package/dist/lib/entities/public-slug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-slug.d.ts","sourceRoot":"","sources":["../../../src/lib/entities/public-slug.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAG3C,wGAAwG;AACxG,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC1D,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAC7C;AAKD,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAE3D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,SAAS,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,GAAG,MAAM,EAAE,CAKvH;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,GAAG,IAAI,CAWhH;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO;;;;EAIjH"}

package/dist/lib/entities/public-slug.js

@@ -0,0 +1,39 @@
+import { validatePageSlug } from "../constants/reserved-slugs.js";
+const basePathOf = (entity) => {
+  var _a, _b, _c;
+  return ((_a = entity.access) == null ? void 0 : _a.basePath) ?? ((_c = (_b = entity.builder) == null ? void 0 : _b.public) == null ? void 0 : _c.basePath);
+};
+function hasPublicSlug(entity) {
+  var _a;
+  return entity.fields.some((field) => field.name === "slug") && (((_a = entity.access) == null ? void 0 : _a.public) === true || basePathOf(entity) !== void 0);
+}
+function otherBasePathSegments(entity, entities) {
+  return entities.filter((other) => other !== entity).map((other) => {
+    var _a;
+    return (_a = basePathOf(other)) == null ? void 0 : _a.split("/").filter(Boolean)[0];
+  }).filter((segment) => Boolean(segment));
+}
+function validatePublicSlug(entity, slug, taken = []) {
+  var _a;
+  const atRoot = basePathOf(entity) === "/";
+  const segments = slug.split("/");
+  if (segments.length > 1 && !(atRoot ? (_a = entity.access) == null ? void 0 : _a.allowNestedSlugs : basePathOf(entity))) {
+    return "Slug cannot contain slashes";
+  }
+  for (const [index, segment] of segments.entries()) {
+    const reason = validatePageSlug(segment, { checkReserved: atRoot && index === 0, reserved: taken });
+    if (reason) return reason;
+  }
+  return null;
+}
+function publicSlugIssue(entity, data, taken = []) {
+  if (!hasPublicSlug(entity) || typeof data.slug !== "string") return null;
+  const message = validatePublicSlug(entity, data.slug, taken);
+  return message ? { code: "custom", path: ["slug"], message } : null;
+}
+export {
+  hasPublicSlug,
+  otherBasePathSegments,
+  publicSlugIssue,
+  validatePublicSlug
+};

package/dist/lib/services/subscription.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/subscription.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAEV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EAET,sBAAsB,EACtB,eAAe,EACf,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAMzB,MAAM,WAAW,yBAAyB;IACxC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,qBAAa,mBAAmB;IAK9B;;;;;;;;OAQG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW9D;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA6B7F;;;;;OAKG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;OASG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAgC9E;;;;;;;;;;OAUG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,YAAY,CAAC;IA+ExB;;;;;;;;OAQG;WACU,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAejE;;;;;;;;;OASG;WACU,YAAY,CACvB,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC;IA0CxB;;;;;;;;OAQG;WACU,MAAM,CACjB,cAAc,EAAE,MAAM,EACtB,iBAAiB,GAAE,OAAc,GAChC,OAAO,CAAC,YAAY,CAAC;IA4DxB;;;;;;;;;;;;;OAaG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,eAAe,GAAE,eAA2B,EAC5C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC;IAoI5B;;;;;;;;OAQG;WACU,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcjE;;;;;;;;OAQG;WACU,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAclE;;;;;;;;;;OAUG;WACU,YAAY,CACvB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAoBlC;;;;;;;;OAQG;WACU,gBAAgB,CAAC,IAAI,GAAE,MAAU,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsBhF;;;;;;;;;;OAUG;WACU,UAAU,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7E,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA8BlC;;;;;;;;OAQG;WACU,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsBtF;;;;;;;;;OASG;WACU,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IA+BrF;;;;;;;;OAQG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA4BxE;;;;;;;;;OASG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/F;;;;;;;;;;;;OAYG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA2E/F;;;;;;;;;;;;;;;;;;OAkBG;WACU,gBAAgB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,CAAC;IA2ElC;;;;;;;;;OASG;WACU,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;CA+BrD"}
+{"version":3,"file":"subscription.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/subscription.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAEV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EAET,sBAAsB,EACtB,eAAe,EACf,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAMzB,MAAM,WAAW,yBAAyB;IACxC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,qBAAa,mBAAmB;IAK9B;;;;;;;;OAQG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW9D;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA6B7F;;;;;OAKG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAI9E;;;;;;;;;OASG;WACU,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAgC9E;;;;;;;;;;OAUG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,YAAY,CAAC;IA+ExB;;;;;;;;OAQG;WACU,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAejE;;;;;;;;;OASG;WACU,YAAY,CACvB,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC;IA0CxB;;;;;;;;OAQG;WACU,MAAM,CACjB,cAAc,EAAE,MAAM,EACtB,iBAAiB,GAAE,OAAc,GAChC,OAAO,CAAC,YAAY,CAAC;IA4DxB;;;;;;;;;;;;;OAaG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,eAAe,GAAE,eAA2B,EAC5C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC;IAoI5B;;;;;;;;OAQG;WACU,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcjE;;;;;;;;OAQG;WACU,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAclE;;;;;;;;;;OAUG;WACU,YAAY,CACvB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAoBlC;;;;;;;;OAQG;WACU,gBAAgB,CAAC,IAAI,GAAE,MAAU,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsBhF;;;;;;;;;;OAUG;WACU,UAAU,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7E,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA8BlC;;;;;;;;OAQG;WACU,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsBtF;;;;;;;;;OASG;WACU,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IA+BrF;;;;;;;;OAQG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA4BxE;;;;;;;;;OASG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/F;;;;;;;;;;;;OAYG;WACU,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA2E/F;;;;;;;;;;;;;;;;;;OAkBG;WACU,gBAAgB,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,CAAC;IAiFlC;;;;;;;;;OASG;WACU,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;CA+BrD"}

package/dist/lib/services/subscription.service.js

@@ -810,6 +810,9 @@ class SubscriptionService {
         console.warn("[SubscriptionService] Team permissions module not available");
       }
     }
+    if (BILLING_REGISTRY.plans.length === 0) {
+      return { allowed: true };
+    }
     const requiredFeature = BILLING_REGISTRY.actionMappings.features[action];
     if (requiredFeature) {
       const hasFeatureAccess = await this.hasFeature(teamId, requiredFeature, userId);

package/dist/lib/utils/cors.d.ts

@@ -81,6 +81,13 @@ export declare function getCorsOrigins(config: ApplicationConfig, env?: string):
  * production trust — pair with an environment check.
  */
 export declare function isPrivateLanOrigin(origin: string): boolean;
+/**
+ * The origins trusted for cookie-authenticated requests: Better Auth's
+ * trustedOrigins and the write-origin check (lib/api/request-origin) share it.
+ * getCorsOrigins() plus, outside production, the request's own origin when it is
+ * a private-network address (#170).
+ */
+export declare function getTrustedOrigins(config: ApplicationConfig, requestOrigin?: string | null, env?: string): string[];
 /**
  * Check whether a request origin is allowed, supporting wildcard-pattern entries
  * in the allow-list. A `*` in an entry matches exactly ONE host label (no dots),

package/dist/lib/utils/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAA;AAc7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAetD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAkBlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,GAAG,GAAE,MAA8C,GAClD,MAAM,EAAE,CA+CV;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAqB1D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CA6Bf"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAA;AAc7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAetD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAkBlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,GAAG,GAAE,MAA8C,GAClD,MAAM,EAAE,CA+CV;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAqB1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,GAAG,GAAE,MAA8C,GAClD,MAAM,EAAE,CAMV;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CA6Bf"}

package/dist/lib/utils/cors.js

@@ -79,6 +79,13 @@ function isPrivateLanOrigin(origin) {
   if (a === 169 && b === 254) return true;
   return false;
 }
+function getTrustedOrigins(config, requestOrigin, env = process.env.NODE_ENV || "development") {
+  const origins = getCorsOrigins(config, env);
+  if (normalizeCorsEnvironment(env) !== "production" && requestOrigin && isPrivateLanOrigin(requestOrigin)) {
+    return [...origins, requestOrigin];
+  }
+  return origins;
+}
 function isOriginAllowed(requestOrigin, allowedOrigins) {
   if (!requestOrigin) return null;
   for (const entry of allowedOrigins) {
@@ -98,6 +105,7 @@ function isOriginAllowed(requestOrigin, allowedOrigins) {
 }
 export {
   getCorsOrigins,
+  getTrustedOrigins,
   isOriginAllowed,
   isPrivateLanOrigin,
   normalizeCorsEnvironment,

package/dist/routes/(auth)/signup/page.cc.d.ts

@@ -1,9 +1,4 @@
-/**
- * Signup page for a host with `cacheComponents` on (variant of ./page).
- *
- * Same page and metadata; `dynamic = 'force-dynamic'` is left out because Next.js fails a build that
- * has it under Cache Components. The page reads the database and calls redirect(); under Cache Components
- * the group or root layout puts it behind Suspense, so the redirect streams per request, after the static shell.
- */
-export { default, metadata } from './page';
+import { metadata } from './page';
+export { metadata };
+export default function SignupPageCc(): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=page.cc.d.ts.map

package/dist/routes/(auth)/signup/page.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.cc.d.ts","sourceRoot":"","sources":["../../../../src/routes/(auth)/signup/page.cc.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA"}
+{"version":3,"file":"page.cc.d.ts","sourceRoot":"","sources":["../../../../src/routes/(auth)/signup/page.cc.tsx"],"names":[],"mappings":"AAUA,OAAmB,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,CAAA;AAEnB,MAAM,CAAC,OAAO,UAAU,YAAY,4CAMnC"}

package/dist/routes/(auth)/signup/page.cc.js

@@ -1 +1,7 @@
-export { default, metadata } from "./page.js";
+import { jsx } from "react/jsx-runtime";
+import { Suspense } from "react";
+import SignupPage, { metadata } from "./page.js";
+export { metadata };
+export default function SignupPageCc() {
+  return /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(SignupPage, {}) });
+}

package/dist/routes/(auth)/verify-email/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/(auth)/verify-email/page.tsx"],"names":[],"mappings":"AA+KA,iBAAS,eAAe,4CAUvB;AAGD,eAAe,eAAe,CAAA"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/(auth)/verify-email/page.tsx"],"names":[],"mappings":"AAgLA,iBAAS,eAAe,4CAUvB;AAGD,eAAe,eAAe,CAAA"}

package/dist/routes/(auth)/verify-email/page.js

@@ -7,6 +7,7 @@ import { Button } from "@nextsparkjs/core/components/ui/button";
 import { Alert, AlertDescription } from "@nextsparkjs/core/components/ui/alert";
 import { sel } from "@nextsparkjs/core/selectors/auth";
 import { withBasePath } from "@nextsparkjs/core/lib/base-path";
+import { VERIFY_FROM_UI_HEADER } from "@nextsparkjs/core/lib/api/client-headers";
 function VerifyEmailContent() {
   const searchParams = useSearchParams();
   const router = useRouter();
@@ -26,7 +27,7 @@ function VerifyEmailContent() {
           method: "GET",
           credentials: "include",
           headers: {
-            "x-verify-from-ui": "true"
+            [VERIFY_FROM_UI_HEADER]: "true"
           }
         });
         if (!response.ok) {

package/dist/routes/(public)/page.cc.d.ts

@@ -0,0 +1,3 @@
+declare const _default: (props: object) => import("react/jsx-runtime").JSX.Element;
+export default _default;
+//# sourceMappingURL=page.cc.d.ts.map

package/dist/routes/(public)/page.cc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/(public)/page.cc.tsx"],"names":[],"mappings":";AASA,wBAAgD"}

package/dist/routes/(public)/page.cc.js

@@ -0,0 +1,3 @@
+import { behindSuspense } from "../_internal/suspended-route.js";
+import DefaultPublicHome from "./page.js";
+export default behindSuspense(DefaultPublicHome);

package/dist/routes/_internal/area-access.cc.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The per-segment role check of /superadmin and /devtools for a host with `cacheComponents` on (the `access` of the
+ * area layouts' variants in ../variants.json). Same rules and same check as `area-access`; only where it runs moves.
+ *
+ * `withSuperadminAccess(Page)` in `area-access` awaits the session before it returns the page, so the segment has no
+ * Suspense boundary between it and request-time work: a navigation into it would wait, and the dev server reports it
+ * ("Could not validate that a segment in your UI has instant navigation ... dropped segment"). Here the segment is a
+ * Suspense boundary (fallback: nothing) around the check, and the page or layout renders inside it only once the
+ * check has passed: no session -> /login, a session without the role -> /dashboard?error=access_denied, and the
+ * segment's content is never rendered for either. What the prerendered shell holds of the segment is the empty
+ * fallback.
+ *
+ * `generateMetadata` and Route Handlers keep the checks of `area-access` (nothing to prerender there).
+ */
+import { type ComponentType } from 'react';
+export { withSuperadminMetadata, withDevtoolsMetadata, withSuperadminRouteAccess, withDevtoolsRouteAccess } from './area-access';
+/** A page or layout under /superadmin, rendered only for superadmin and developer sessions, inside its own boundary. */
+export declare function withSuperadminAccess<P extends object>(Segment: ComponentType<P>): (props: P) => import("react/jsx-runtime").JSX.Element;
+/** A page or layout under /devtools, rendered only for developer sessions, inside its own boundary. */
+export declare function withDevtoolsAccess<P extends object>(Segment: ComponentType<P>): (props: P) => import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=area-access.cc.d.ts.map

package/dist/routes/_internal/area-access.cc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"area-access.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/area-access.cc.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,OAAO,CAAA;AAGpD,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAgBhI,wHAAwH;AACxH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,yDAE/E;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,yDAE7E"}

package/dist/routes/_internal/area-access.cc.js

@@ -0,0 +1,19 @@
+import { jsx } from "react/jsx-runtime";
+import { Suspense } from "react";
+import { requireAreaAccess } from "./area-access.js";
+export { withSuperadminMetadata, withDevtoolsMetadata, withSuperadminRouteAccess, withDevtoolsRouteAccess } from "./area-access.js";
+function withAreaAccess(area, Segment) {
+  async function AreaSegmentGate(props) {
+    await requireAreaAccess(area);
+    return /* @__PURE__ */ jsx(Segment, { ...props });
+  }
+  return function AreaSegment(props) {
+    return /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(AreaSegmentGate, { ...props }) });
+  };
+}
+export function withSuperadminAccess(Segment) {
+  return withAreaAccess("superadmin", Segment);
+}
+export function withDevtoolsAccess(Segment) {
+  return withAreaAccess("devtools", Segment);
+}

package/dist/routes/_internal/auth-layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-layout.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/auth-layout.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAKpC,eAAO,MAAM,eAAe,EAAE,QAU7B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;AAEjD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,CAAC,IAC1C,cAAc;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,sDAQzF"}
+{"version":3,"file":"auth-layout.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/auth-layout.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAMpC,eAAO,MAAM,eAAe,EAAE,QAU7B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;AAEjD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,CAAC,IAC1C,cAAc;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,sDAQzF"}

package/dist/routes/_internal/auth-layout.js

@@ -2,10 +2,11 @@ import { jsx } from "react/jsx-runtime";
 import { NextIntlClientProvider } from "next-intl";
 import { getMessages } from "next-intl/server";
 import { selectMessages } from "@nextsparkjs/core/lib/i18n/client-messages";
+import { APP_NAME } from "@nextsparkjs/core/lib/config/public-config-client";
 export const defaultMetadata = {
   title: {
-    default: "Authentication | Boilerplate",
-    template: "%s | Boilerplate"
+    default: `Authentication | ${APP_NAME}`,
+    template: `%s | ${APP_NAME}`
   },
   description: "Sign in or create an account to access our platform",
   robots: {

package/dist/routes/_internal/dashboard-main-shared.d.ts

@@ -0,0 +1,7 @@
+/** The dashboard shell with the navigation of every entity the project registers. */
+export declare function MainDashboardShell({ children }: {
+    children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+/** Sends a request for an entity route the signed-in user may not use to the permission-denied page. */
+export declare function enforceEntityPermission(): Promise<void>;
+//# sourceMappingURL=dashboard-main-shared.d.ts.map

package/dist/routes/_internal/dashboard-main-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-main-shared.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/dashboard-main-shared.tsx"],"names":[],"mappings":"AA8CA,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CAO7E;AAED,wGAAwG;AACxG,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAuB7D"}

package/dist/routes/_internal/dashboard-main-shared.js

@@ -0,0 +1,49 @@
+import { jsx } from "react/jsx-runtime";
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { DashboardShell } from "@nextsparkjs/core/components/dashboard/layouts/DashboardShell";
+import { serializeEntityConfig } from "@nextsparkjs/core/lib/entities/serialization";
+import { setEntityRegistry } from "@nextsparkjs/core/lib/entities/queries";
+import { checkPermission } from "@nextsparkjs/core/lib/permissions/check";
+import { getDashboardPermissionContext } from "@nextsparkjs/core/lib/auth/request-session";
+import { isValidPermission } from "@nextsparkjs/core/lib/permissions/init";
+import { ENTITY_REGISTRY, ENTITY_METADATA } from "@nextsparkjs/registries/entity-registry";
+setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA);
+function parseEntityFromPathname(pathname) {
+  const match = pathname.match(/^\/dashboard\/([^/]+)(?:\/(.*))?$/);
+  if (!match) return null;
+  const entity = match[1];
+  const rest = match[2] || "";
+  if (rest === "" || rest === "/") return { entity, action: "list" };
+  if (rest === "create") return { entity, action: "create" };
+  if (rest.match(/^[^/]+\/edit$/)) return { entity, action: "update" };
+  if (rest.match(/^[^/]+$/)) return { entity, action: "read" };
+  return { entity, action: "read" };
+}
+function isEntityConfig(entity) {
+  return "slug" in entity;
+}
+export function MainDashboardShell({ children }) {
+  const allEntities = Object.values(ENTITY_REGISTRY).map((entry) => entry.config);
+  const entities = allEntities.filter(isEntityConfig);
+  const serializedEntities = entities.map(serializeEntityConfig);
+  return /* @__PURE__ */ jsx(DashboardShell, { entities: serializedEntities, children });
+}
+export async function enforceEntityPermission() {
+  const headersList = await headers();
+  const pathname = headersList.get("x-pathname") || "";
+  const { userId, teamId } = await getDashboardPermissionContext();
+  if (userId && teamId && pathname) {
+    const parsed = parseEntityFromPathname(pathname);
+    if (parsed) {
+      const { entity, action } = parsed;
+      const permission = `${entity}.${action}`;
+      if (isValidPermission(`${entity}.list`)) {
+        const hasPermission = await checkPermission(userId, teamId, permission);
+        if (!hasPermission) {
+          redirect(`/dashboard/permission-denied?entity=${entity}&action=${action}`);
+        }
+      }
+    }
+  }
+}

package/dist/routes/_internal/default-auth-layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-auth-layout.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/default-auth-layout.tsx"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CA6B5E"}
+{"version":3,"file":"default-auth-layout.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/default-auth-layout.tsx"],"names":[],"mappings":"AAIA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CA+B5E"}

package/dist/routes/_internal/default-auth-layout.js

@@ -1,12 +1,13 @@
 import { jsx, jsxs } from "react/jsx-runtime";
 import { Suspense } from "react";
 import { AuthWrapper } from "@nextsparkjs/core/components/auth/layouts/AuthWrapper";
+import { APP_DESCRIPTION, APP_NAME } from "@nextsparkjs/core/lib/config/public-config-client";
 export function DefaultAuthLayout({ children }) {
   return /* @__PURE__ */ jsx("div", { className: "min-h-screen bg-gradient-to-b from-background to-muted/20 flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs("div", { className: "w-full max-w-md", children: [
     /* @__PURE__ */ jsxs("div", { className: "bg-card rounded-lg shadow-lg border border-border p-8", children: [
       /* @__PURE__ */ jsxs("div", { className: "text-center mb-8", children: [
-        /* @__PURE__ */ jsx("h1", { className: "text-3xl font-bold text-foreground mb-2", children: "Boilerplate" }),
-        /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: "Modern Full-Stack Application" })
+        /* @__PURE__ */ jsx("h1", { className: "text-3xl font-bold text-foreground mb-2", children: APP_NAME }),
+        APP_DESCRIPTION && /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: APP_DESCRIPTION })
       ] }),
       /* @__PURE__ */ jsx(AuthWrapper, { children: /* @__PURE__ */ jsx(Suspense, { fallback: null, children }) })
     ] }),

package/dist/routes/_internal/devtools-layout.cc.d.ts

@@ -10,8 +10,9 @@ export declare const withDevtoolsAreaMessages: (Layout: ComponentType<DevLayoutP
 /**
  * What a project's devtools layout is composed with in Cache Components mode (the manifest's `compose` of that
  * variant): the mode's messages and the server-side role check, then core's client guard around the project's layout,
- * as `withDevtoolsGuard` does in the ISR module. A module of its own so only the devtools route group imports the guard,
- * the role check and their client components.
+ * as `withDevtoolsGuard` does in the ISR module. The guard is told the server checked the role (`serverChecked`), so it
+ * renders the area while the client session loads. A module of its own so only the devtools route group imports the
+ * guard, the role check and their client components.
  */
 export declare const withDevtoolsGuard: (ProjectLayout: ComponentType<DevLayoutProps>) => ({ children }: {
     children: import("react").ReactNode;

package/dist/routes/_internal/devtools-layout.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devtools-layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/devtools-layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAE1C,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAG5E;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,aAAa,CAAC,cAAc,CAAC;;6CAA2D,CAAA;AAEzI;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,eAAe,aAAa,CAAC,cAAc,CAAC;;6CAAiE,CAAA"}
+{"version":3,"file":"devtools-layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/devtools-layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAE1C,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAG5E;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,aAAa,CAAC,cAAc,CAAC;;6CAA2D,CAAA;AAEzI;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,eAAe,aAAa,CAAC,cAAc,CAAC;;6CAAuE,CAAA"}

package/dist/routes/_internal/devtools-layout.cc.js

@@ -2,4 +2,4 @@ import { withDevtoolsMessages } from "./group-layouts.cc.js";
 import { guardDevtoolsLayout } from "./devtools-layout.js";
 import { withAreaGate } from "./area-access.js";
 export const withDevtoolsAreaMessages = (Layout) => withDevtoolsMessages(withAreaGate("devtools", Layout));
-export const withDevtoolsGuard = (ProjectLayout) => withDevtoolsAreaMessages(guardDevtoolsLayout(ProjectLayout));
+export const withDevtoolsGuard = (ProjectLayout) => withDevtoolsAreaMessages(guardDevtoolsLayout(ProjectLayout, true));

package/dist/routes/_internal/devtools-layout.d.ts

@@ -4,6 +4,10 @@ export declare const defaultMetadata: Metadata;
 export interface DevLayoutProps {
     children: React.ReactNode;
 }
+/** `serverChecked`: see DeveloperGuard (only the Cache Components module passes it, after its role check). */
+type GuardedProps = DevLayoutProps & {
+    serverChecked?: boolean;
+};
 /**
  * Developer Area Layout
  *
@@ -12,7 +16,7 @@ export interface DevLayoutProps {
  * Includes responsive design for mobile and desktop.
  * Uses purple/violet color scheme to differentiate from Admin Panel (red).
  */
-export declare function DevLayout({ children }: DevLayoutProps): import("react/jsx-runtime").JSX.Element;
+export declare function DevLayout({ children, serverChecked }: GuardedProps): import("react/jsx-runtime").JSX.Element;
 /**
  * Wraps a layout for this route group in the group's client messages, after the server-side role check
  * (area-access): it runs before anything is rendered or sent, so a page load without the role gets a 307. The
@@ -27,10 +31,11 @@ export declare function withDevtoolsMessages(ResolvedDevLayout: ComponentType<De
  * /devtools checks again, see area-access). Shared by the message wrappers of both rendering modes
  * (`withDevtoolsGuard` here, and in `group-layouts.cc`).
  */
-export declare function guardDevtoolsLayout(ProjectLayout: ComponentType<DevLayoutProps>): ({ children }: DevLayoutProps) => import("react/jsx-runtime").JSX.Element;
+export declare function guardDevtoolsLayout(ProjectLayout: ComponentType<DevLayoutProps>, serverChecked?: boolean): ({ children }: DevLayoutProps) => import("react/jsx-runtime").JSX.Element;
 /**
  * The composition of a project's devtools layout with core (the generated host): messages, then
  * `guardDevtoolsLayout` around the project's layout.
  */
 export declare function withDevtoolsGuard(ProjectLayout: ComponentType<DevLayoutProps>): ({ children }: DevLayoutProps) => Promise<import("react/jsx-runtime").JSX.Element>;
+export {};
 //# sourceMappingURL=devtools-layout.d.ts.map

package/dist/routes/_internal/devtools-layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devtools-layout.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/devtools-layout.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAK1C,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAOhC,eAAO,MAAM,eAAe,EAAE,QAI7B,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,cAAc,2CAgCrD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,iBAAiB,EAAE,aAAa,CAAC,cAAc,CAAC,IACvC,cAAc,cAAc,sDASzE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,IAC7C,cAAc,cAAc,6CAS9D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,kBAlClB,cAAc,sDAoCzE"}
+{"version":3,"file":"devtools-layout.d.ts","sourceRoot":"","sources":["../../../src/routes/_internal/devtools-layout.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAK1C,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAOhC,eAAO,MAAM,eAAe,EAAE,QAI7B,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,8GAA8G;AAC9G,KAAK,YAAY,GAAG,cAAc,GAAG;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEhE;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,YAAY,2CAgClE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,iBAAiB,EAAE,aAAa,CAAC,cAAc,CAAC,IACvC,cAAc,cAAc,sDASzE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,aAAa,UAAQ,IACpE,cAAc,cAAc,6CAS9D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,kBAlClB,cAAc,sDAoCzE"}