@nextsparkjs/core 0.1.0-beta.193 → 0.1.0-beta.195

package/dist/routes/api/v1/teams/[teamId]/subscription/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { validateAndAuthenticateRequest, createApiResponse, createApiError } from "@nextsparkjs/core/lib/api/helpers";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 import { SubscriptionService, MembershipService } from "@nextsparkjs/core/lib/services";
 export const GET = withRateLimitTier(async function GET2(request, props) {
   const { auth, rateLimitResponse, errorResponse } = await validateAndAuthenticateRequest(request, { requiredScope: "billing:read" });
@@ -28,3 +29,4 @@ export const GET = withRateLimitTier(async function GET2(request, props) {
     return createApiError("Failed to fetch subscription", 500);
   }
 }, "read");
+export const OPTIONS = corsPreflight;

package/dist/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.d.ts

@@ -5,6 +5,7 @@
  * POST /api/v1/teams/[teamId]/usage/[limitSlug] - Track usage
  */
 import { NextRequest, NextResponse } from 'next/server';
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response';
 interface RouteParams {
     params: Promise<{
         teamId: string;
@@ -13,5 +14,6 @@ interface RouteParams {
 }
 export declare const GET: (request: NextRequest, props: RouteParams) => Promise<NextResponse>;
 export declare const POST: (request: NextRequest, props: RouteParams) => Promise<NextResponse>;
+export declare const OPTIONS: typeof corsPreflight;
 export {};
 //# sourceMappingURL=route.d.ts.map

package/dist/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,UAAU,WAAW;IACnB,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACvD;AAED,eAAO,MAAM,GAAG,qEAgCN,CAAA;AAEV,eAAO,MAAM,IAAI,qEA4CN,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAIvE,UAAU,WAAW;IACnB,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACvD;AAED,eAAO,MAAM,GAAG,qEAgCN,CAAA;AAEV,eAAO,MAAM,IAAI,qEA4CN,CAAA;AAEX,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { validateAndAuthenticateRequest, createApiResponse, createApiError } from "@nextsparkjs/core/lib/api/helpers";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 import { SubscriptionService, UsageService, MembershipService } from "@nextsparkjs/core/lib/services";
 import { trackUsageSchema } from "@nextsparkjs/core/lib/billing/schema";
 export const GET = withRateLimitTier(async function GET2(request, props) {
@@ -65,3 +66,4 @@ export const POST = withRateLimitTier(async function POST2(request, props) {
     return createApiError(errorMessage, 500);
   }
 }, "write");
+export const OPTIONS = corsPreflight;

package/dist/routes/api/v1/users/[id]/meta/[key]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/routes/api/v1/users/[id]/meta/[key]/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAsBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BA6DjD,CAAC;AAEZ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BA8FhD,CAAC;AAEb;;;;GAIG;AACH,eAAO,MAAM,KAAK;YArGM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BAqGpC,CAAA;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BAwDhD,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/routes/api/v1/users/[id]/meta/[key]/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAuBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BAmEjD,CAAC;AAEZ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BAoGhD,CAAC;AAEb;;;;GAIG;AACH,eAAO,MAAM,KAAK;YA3GM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2GpC,CAAA;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;2BA8DhD,CAAC"}

package/dist/routes/api/v1/users/[id]/meta/[key]/route.js

@@ -7,6 +7,7 @@ import {
   addCorsHeaders
 } from "@nextsparkjs/core/lib/api/helpers";
 import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { canAccessUser } from "@nextsparkjs/core/lib/api/auth/permissions";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 const metadataValueSchema = z.object({
@@ -33,6 +34,10 @@ export const GET = withRateLimitTier(withApiLogging(async (req, { params }) => {
       const response2 = createApiError("User ID is required", 400, null, "MISSING_USER_ID");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:read")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     if (!key || key.trim() === "") {
       const response2 = createApiError("Metadata key is required", 400, null, "MISSING_META_KEY");
       return addCorsHeaders(response2, req);
@@ -75,6 +80,10 @@ export const PUT = withRateLimitTier(withApiLogging(async (req, { params }) => {
       const response2 = createApiError("User ID is required", 400, null, "MISSING_USER_ID");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:write")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     if (!key || key.trim() === "") {
       const response2 = createApiError("Metadata key is required", 400, null, "MISSING_META_KEY");
       return addCorsHeaders(response2, req);
@@ -150,6 +159,10 @@ export const DELETE = withRateLimitTier(withApiLogging(async (req, { params }) =
       const response2 = createApiError("User ID is required", 400, null, "MISSING_USER_ID");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:write")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     if (!key || key.trim() === "") {
       const response2 = createApiError("Metadata key is required", 400, null, "MISSING_META_KEY");
       return addCorsHeaders(response2, req);

package/dist/routes/api/v1/users/[id]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/users/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0BxD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BA8CpC,CAAC;AAGZ,eAAO,MAAM,KAAK;YAEM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAyHnC,CAAC;AAGb,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2DnC,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/users/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA+BxD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAoDpC,CAAC;AAGZ,eAAO,MAAM,KAAK;YAEM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAqInC,CAAC;AAGb,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAiEnC,CAAC"}

package/dist/routes/api/v1/users/[id]/route.js

@@ -11,6 +11,7 @@ import {
   processEntityMetadata
 } from "@nextsparkjs/core/lib/api/helpers";
 import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { canAccessUser, hasAdminPermission } from "@nextsparkjs/core/lib/api/auth/permissions";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 const updateUserSchema = z.object({
@@ -20,6 +21,7 @@ const updateUserSchema = z.object({
   role: z.enum(["member", "superadmin"]).optional(),
   metas: z.record(z.string(), z.any()).optional()
 });
+const resolveUserId = ({ id }, callerId) => id === "me" ? callerId : id;
 export async function OPTIONS(request) {
   return handleCorsPreflightRequest(request);
 }
@@ -32,11 +34,15 @@ export const GET = withRateLimitTier(withApiLogging(async (req, { params }) => {
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse;
     }
-    const { id } = await params;
+    const id = resolveUserId(await params, authResult.user.id);
     if (!id || id.trim() === "") {
       const response2 = createApiError("User ID or email is required", 400, null, "MISSING_IDENTIFIER");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:read")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     const user = await queryOneWithRLS(
       'SELECT id, email, name, "firstName", "lastName", image, country, timezone, language, role, "emailVerified", "createdAt", "updatedAt" FROM "users" WHERE id = $1 OR email = $1',
       [id],
@@ -65,14 +71,22 @@ export const PATCH = withRateLimitTier(withApiLogging(async (req, { params }) =>
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse;
     }
-    const { id } = await params;
+    const id = resolveUserId(await params, authResult.user.id);
     if (!id || id.trim() === "") {
       const response2 = createApiError("User ID or email is required", 400, null, "MISSING_IDENTIFIER");
       return addCorsHeaders(response2, req);
     }
+    if (!canAccessUser(authResult, id, "users:write")) {
+      const response2 = createApiError("Insufficient permissions", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     const body = await req.json();
     const { metas, ...userData } = body;
     const validatedData = updateUserSchema.parse(userData);
+    if (validatedData.role !== void 0 && !hasAdminPermission(authResult, "users:write")) {
+      const response2 = createApiError("Only a superadmin can change a role", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     const updates = [];
     const values = [];
     let paramCount = 1;
@@ -157,6 +171,10 @@ export const DELETE = withRateLimitTier(withApiLogging(async (req, { params }) =
       const response2 = createApiError("User ID or email is required", 400, null, "MISSING_IDENTIFIER");
       return addCorsHeaders(response2, req);
     }
+    if (!hasAdminPermission(authResult, "users:delete")) {
+      const response2 = createApiError("Insufficient permissions. Superadmin access required.", 403, null, "FORBIDDEN");
+      return addCorsHeaders(response2, req);
+    }
     const targetUser = await queryOneWithRLS(
       'SELECT id, email FROM "users" WHERE id = $1 OR email = $1',
       [id],

package/dist/routes/api/v1/users/docs.md

@@ -4,52 +4,67 @@ Manage user profiles and account settings.
 
 ## Overview
 
-The Users API allows you to view and update user profile information. Users can update their own profile, while admins can manage other users within their team.
+The Users API allows you to view and update user profile information. Users can read and update their own profile; a superadmin can manage any user.
 
 ## Authentication
 
 All endpoints require authentication via:
 - **Session cookie** (for browser-based requests)
-- **API Key** header (for server-to-server requests)
+- **API Key** (for server-to-server requests), sent as `x-api-key: <key>` or `Authorization: Bearer <key>`: it needs the `users:read` scope to read and `users:write` to update, and it answers as the key's owner
+
+A user can read and update only themselves; a superadmin can manage any user. Anything else answers `403`.
 
 ## Endpoints
 
 ### Get Current User
 `GET /api/v1/users/me`
 
-Returns the currently authenticated user's profile.
+Returns the signed-in user, with a session cookie or an API key. It is `GET /api/v1/users/:id` for the caller's own id, so it takes the same `metas` query parameters and answers with the same fields.
+
+```bash
+curl -H "Cookie: <session cookie>" https://yourdomain.com/api/v1/users/me
+curl -H "Authorization: Bearer <api key>" https://yourdomain.com/api/v1/users/me
+curl -H "x-api-key: <api key>" https://yourdomain.com/api/v1/users/me
+```
 
 **Example Response:**
 ```json
 {
-  "id": "user_123",
-  "name": "John Doe",
-  "email": "john@example.com",
-  "image": "/uploads/avatar.png",
-  "createdAt": "2024-01-15T10:30:00Z",
-  "teams": [
-    {
-      "id": "team_456",
-      "name": "Acme Corp",
-      "role": "admin"
-    }
-  ]
+  "success": true,
+  "data": {
+    "id": "user_123",
+    "email": "john@example.com",
+    "name": "John Doe",
+    "firstName": "John",
+    "lastName": "Doe",
+    "image": "/uploads/avatar.png",
+    "country": null,
+    "timezone": null,
+    "language": "en",
+    "role": "member",
+    "emailVerified": true,
+    "createdAt": "2024-01-15T10:30:00Z",
+    "updatedAt": "2024-01-15T10:30:00Z"
+  }
 }
 ```
 
 ### Update Current User
 `PATCH /api/v1/users/me`
 
-Update the current user's profile.
+Update the signed-in user. It is `PATCH /api/v1/users/:id` for the caller's own id, with the same rules: only `firstName`, `lastName`, `language` and `metas` are accepted, and `role` is a superadmin's to change (anyone else gets `403`).
 
 **Request Body:**
 ```json
 {
-  "name": "John Smith",
-  "image": "/uploads/new-avatar.png"
+  "firstName": "John",
+  "lastName": "Smith",
+  "metas": { "preferences": { "theme": "dark" } }
 }
 ```
 
+To store per-user settings (the mobile client's preferences), use the user's metadata: `GET`/`PUT /api/v1/users/:id/meta/:key`.
+
 ### List Team Members
 `GET /api/v1/users`
 
@@ -63,7 +78,7 @@ Returns all users in the current team.
 ### Get User by ID
 `GET /api/v1/users/[id]`
 
-Returns a specific user's profile (within the same team).
+Returns a specific user's profile. Only that user or a superadmin can read it; `403` otherwise.
 
 **Path Parameters:**
 - `id` (string, required): User ID

package/dist/routes/api/v1/users/me/route.d.ts

@@ -0,0 +1,6 @@
+import type { NextRequest } from 'next/server';
+import { OPTIONS } from '@nextsparkjs/core/routes/api/v1/users/[id]/route';
+export { OPTIONS };
+export declare const GET: (req: NextRequest) => Promise<import("next/server").NextResponse<unknown>>;
+export declare const PATCH: (req: NextRequest) => Promise<import("next/server").NextResponse<unknown>>;
+//# sourceMappingURL=route.d.ts.map

package/dist/routes/api/v1/users/me/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/users/me/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAsC,MAAM,kDAAkD,CAAA;AAO9G,OAAO,EAAE,OAAO,EAAE,CAAA;AAClB,eAAO,MAAM,GAAG,GAAI,KAAK,WAAW,yDAAqB,CAAA;AACzD,eAAO,MAAM,KAAK,GAAI,KAAK,WAAW,yDAAuB,CAAA"}

package/dist/routes/api/v1/users/me/route.js

@@ -0,0 +1,5 @@
+import { OPTIONS, GET as getUser, PATCH as patchUser } from "@nextsparkjs/core/routes/api/v1/users/[id]/route";
+const me = { params: Promise.resolve({ id: "me" }) };
+export { OPTIONS };
+export const GET = (req) => getUser(req, me);
+export const PATCH = (req) => patchUser(req, me);

package/dist/routes/api/v1/users/presets.ts

@@ -34,13 +34,13 @@ export default defineApiEndpoint({
     {
       id: 'update-profile',
       title: 'Update My Profile',
-      description: 'Update current user name',
+      description: 'Update the current user first name',
       method: 'PATCH',
       pathParams: {
         id: 'me'
       },
       payload: {
-        name: 'Updated Name'
+        firstName: 'Updated'
       },
       tags: ['write', 'profile']
     },

package/dist/routes/dashboard/(main)/layout.cc.d.ts

@@ -0,0 +1,4 @@
+export default function MainDashboardLayout({ children }: {
+    children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=layout.cc.d.ts.map

package/dist/routes/dashboard/(main)/layout.cc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.cc.tsx"],"names":[],"mappings":"AAgBA,MAAM,CAAC,OAAO,UAAU,mBAAmB,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CAQtF"}

package/dist/routes/dashboard/(main)/layout.cc.js

@@ -0,0 +1,10 @@
+import { Fragment, jsx } from "react/jsx-runtime";
+import { Suspense } from "react";
+import { MainDashboardShell, enforceEntityPermission } from "../../_internal/dashboard-main-shared.js";
+async function EntityPermission({ children }) {
+  await enforceEntityPermission();
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+export default function MainDashboardLayout({ children }) {
+  return /* @__PURE__ */ jsx(MainDashboardShell, { children: /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(EntityPermission, { children }) }) });
+}

package/dist/routes/dashboard/(main)/layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.tsx"],"names":[],"mappings":"AAsDA,iBAAe,0BAA0B,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B,oDAmCA;AAGD,eAAe,0BAA0B,CAAA"}
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.tsx"],"names":[],"mappings":"AAcA,iBAAe,0BAA0B,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B,oDAIA;AAGD,eAAe,0BAA0B,CAAA"}

package/dist/routes/dashboard/(main)/layout.js

@@ -1,50 +1,9 @@
 import { jsx } from "react/jsx-runtime";
-import { headers } from "next/headers";
-import { redirect } from "next/navigation";
-import { DashboardShell } from "@nextsparkjs/core/components/dashboard/layouts/DashboardShell";
-import { serializeEntityConfig } from "@nextsparkjs/core/lib/entities/serialization";
-import { setEntityRegistry } from "@nextsparkjs/core/lib/entities/queries";
-import { checkPermission } from "@nextsparkjs/core/lib/permissions/check";
-import { getDashboardPermissionContext } from "@nextsparkjs/core/lib/auth/request-session";
-import { isValidPermission } from "@nextsparkjs/core/lib/permissions/init";
-import { ENTITY_REGISTRY, ENTITY_METADATA } from "@nextsparkjs/registries/entity-registry";
-setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA);
-function parseEntityFromPathname(pathname) {
-  const match = pathname.match(/^\/dashboard\/([^/]+)(?:\/(.*))?$/);
-  if (!match) return null;
-  const entity = match[1];
-  const rest = match[2] || "";
-  if (rest === "" || rest === "/") return { entity, action: "list" };
-  if (rest === "create") return { entity, action: "create" };
-  if (rest.match(/^[^/]+\/edit$/)) return { entity, action: "update" };
-  if (rest.match(/^[^/]+$/)) return { entity, action: "read" };
-  return { entity, action: "read" };
-}
-function isEntityConfig(entity) {
-  return "slug" in entity;
-}
+import { MainDashboardShell, enforceEntityPermission } from "../../_internal/dashboard-main-shared.js";
 async function DefaultMainDashboardLayout({
   children
 }) {
-  const allEntities = Object.values(ENTITY_REGISTRY).map((entry) => entry.config);
-  const entities = allEntities.filter(isEntityConfig);
-  const serializedEntities = entities.map(serializeEntityConfig);
-  const headersList = await headers();
-  const pathname = headersList.get("x-pathname") || "";
-  const { userId, teamId } = await getDashboardPermissionContext();
-  if (userId && teamId && pathname) {
-    const parsed = parseEntityFromPathname(pathname);
-    if (parsed) {
-      const { entity, action } = parsed;
-      const permission = `${entity}.${action}`;
-      if (isValidPermission(`${entity}.list`)) {
-        const hasPermission = await checkPermission(userId, teamId, permission);
-        if (!hasPermission) {
-          redirect(`/dashboard/permission-denied?entity=${entity}&action=${action}`);
-        }
-      }
-    }
-  }
-  return /* @__PURE__ */ jsx(DashboardShell, { entities: serializedEntities, children });
+  await enforceEntityPermission();
+  return /* @__PURE__ */ jsx(MainDashboardShell, { children });
 }
 export default DefaultMainDashboardLayout;

package/dist/routes/dashboard/permission-denied/page.d.ts

@@ -4,6 +4,6 @@ interface PermissionDeniedPageProps {
         action?: string;
     }>;
 }
-declare function PermissionDeniedPage({ searchParams }: PermissionDeniedPageProps): Promise<import("react/jsx-runtime").JSX.Element>;
+declare function PermissionDeniedPage({ searchParams }: PermissionDeniedPageProps): import("react/jsx-runtime").JSX.Element;
 export default PermissionDeniedPage;
 //# sourceMappingURL=page.d.ts.map

package/dist/routes/dashboard/permission-denied/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/permission-denied/page.tsx"],"names":[],"mappings":"AAQA,UAAU,yBAAyB;IACjC,YAAY,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH;AAED,iBAAe,oBAAoB,CAAC,EAClC,YAAY,EACb,EAAE,yBAAyB,oDAW3B;AAED,eAAe,oBAAoB,CAAA"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/permission-denied/page.tsx"],"names":[],"mappings":"AASA,UAAU,yBAAyB;IACjC,YAAY,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH;AAkBD,iBAAS,oBAAoB,CAAC,EAAE,YAAY,EAAE,EAAE,yBAAyB,2CAMxE;AAED,eAAe,oBAAoB,CAAA"}

package/dist/routes/dashboard/permission-denied/page.js

@@ -1,6 +1,7 @@
 import { jsx } from "react/jsx-runtime";
+import { Suspense } from "react";
 import { NoPermission } from "@nextsparkjs/core/components/permissions/NoPermission";
-async function PermissionDeniedPage({
+async function DeniedMessage({
   searchParams
 }) {
   const { entity, action } = await searchParams;
@@ -14,4 +15,7 @@ async function PermissionDeniedPage({
     }
   );
 }
+function PermissionDeniedPage({ searchParams }) {
+  return /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(DeniedMessage, { searchParams }) });
+}
 export default PermissionDeniedPage;

package/dist/routes/devtools/layout.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/devtools/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAEjD,wBAAkD"}
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/devtools/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAUjD,wBAA+D"}

package/dist/routes/devtools/layout.cc.js

@@ -1,4 +1,8 @@
+import { jsx } from "react/jsx-runtime";
 import { DevLayout, defaultMetadata } from "../_internal/devtools-layout.js";
 import { withDevtoolsAreaMessages } from "../_internal/devtools-layout.cc.js";
 export const metadata = defaultMetadata;
-export default withDevtoolsAreaMessages(DevLayout);
+function ServerCheckedDevLayout({ children }) {
+  return /* @__PURE__ */ jsx(DevLayout, { serverChecked: true, children });
+}
+export default withDevtoolsAreaMessages(ServerCheckedDevLayout);

package/dist/routes/manifest.json

@@ -422,6 +422,11 @@
     "target": "api/v1/users/[id]/route.ts",
     "specifier": "@nextsparkjs/core/routes/api/v1/users/[id]/route"
   },
+  {
+    "kind": "route",
+    "target": "api/v1/users/me/route.ts",
+    "specifier": "@nextsparkjs/core/routes/api/v1/users/me/route"
+  },
   {
     "kind": "route",
     "target": "api/v1/users/route.ts",
@@ -716,6 +721,11 @@
     "target": "public/page.tsx",
     "specifier": "@nextsparkjs/core/routes/public/page"
   },
+  {
+    "kind": "robots",
+    "target": "robots.ts",
+    "specifier": "@nextsparkjs/core/routes/robots"
+  },
   {
     "kind": "page",
     "target": "superadmin/docs/[section]/[page]/page.tsx",

package/dist/routes/robots.d.ts

@@ -0,0 +1,10 @@
+import type { MetadataRoute } from 'next';
+/**
+ * /robots.txt (#214): public pages are crawlable, the authenticated areas and the API are not.
+ *
+ * Answers `text/plain` 200 in Cache Components and legacy ISR alike, so a crawler never gets the public
+ * catch-all page's HTML. A project overrides it with its own `robots.ts` (templates/robots.ts), which
+ * replaces this route. Core has no sitemap, so none is declared.
+ */
+export default function robots(): MetadataRoute.Robots;
+//# sourceMappingURL=robots.d.ts.map

package/dist/routes/robots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"robots.d.ts","sourceRoot":"","sources":["../../src/routes/robots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAGzC;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,UAAU,MAAM,IAAI,aAAa,CAAC,MAAM,CAQrD"}

package/dist/routes/robots.js

@@ -0,0 +1,10 @@
+import { withBasePath } from "@nextsparkjs/core/lib/base-path";
+export default function robots() {
+  return {
+    rules: {
+      userAgent: "*",
+      allow: withBasePath("/"),
+      disallow: ["/dashboard", "/superadmin", "/devtools", "/api"].map(withBasePath)
+    }
+  };
+}

package/dist/routes/superadmin/layout.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/superadmin/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAEjD,wBAA2D"}
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/superadmin/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAUjD,wBAAwE"}

package/dist/routes/superadmin/layout.cc.js

@@ -1,4 +1,8 @@
+import { jsx } from "react/jsx-runtime";
 import { SuperadminLayout, defaultMetadata } from "../_internal/superadmin-layout.js";
 import { withSuperadminAreaMessages } from "../_internal/superadmin-layout.cc.js";
 export const metadata = defaultMetadata;
-export default withSuperadminAreaMessages(SuperadminLayout);
+function ServerCheckedSuperadminLayout({ children }) {
+  return /* @__PURE__ */ jsx(SuperadminLayout, { serverChecked: true, children });
+}
+export default withSuperadminAreaMessages(ServerCheckedSuperadminLayout);

package/dist/routes/variants.json

@@ -39,7 +39,7 @@
         "wrapper": "withSuperadminAccess",
         "metadata": "withSuperadminMetadata",
         "handler": "withSuperadminRouteAccess",
-        "specifier": "@nextsparkjs/core/routes/_internal/area-access"
+        "specifier": "@nextsparkjs/core/routes/_internal/area-access.cc"
       }
     },
     {
@@ -54,7 +54,7 @@
         "wrapper": "withDevtoolsAccess",
         "metadata": "withDevtoolsMetadata",
         "handler": "withDevtoolsRouteAccess",
-        "specifier": "@nextsparkjs/core/routes/_internal/area-access"
+        "specifier": "@nextsparkjs/core/routes/_internal/area-access.cc"
       }
     },
     {
@@ -62,6 +62,16 @@
       "target": "dashboard/layout.tsx",
       "specifier": "@nextsparkjs/core/routes/dashboard/layout.cc"
     },
+    {
+      "kind": "layout",
+      "target": "dashboard/(main)/layout.tsx",
+      "specifier": "@nextsparkjs/core/routes/dashboard/(main)/layout.cc"
+    },
+    {
+      "kind": "page",
+      "target": "(public)/page.tsx",
+      "specifier": "@nextsparkjs/core/routes/(public)/page.cc"
+    },
     {
       "kind": "page",
       "target": "(auth)/login/page.tsx",

package/dist/templates/next.config.mjs

@@ -260,35 +260,8 @@ const nextConfig = {
         source: '/:path*',
         headers: securityHeaders
       },
-      // CORS headers for API routes
-      // NOTE: In development, CORS is handled dynamically by API routes using addCorsHeaders()
-      // to support multiple origins (web app, mobile app, etc.)
-      // In production, we set static CORS headers here
-      ...(isProduction ? [{
-        source: '/api/:path*',
-        headers: [
-          {
-            key: 'Access-Control-Allow-Origin',
-            value: process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-          },
-          {
-            key: 'Access-Control-Allow-Methods',
-            value: 'GET, POST, PUT, DELETE, OPTIONS, PATCH'
-          },
-          {
-            key: 'Access-Control-Allow-Headers',
-            value: 'Content-Type, Authorization, x-api-key, x-verify-from-ui, Cookie, Set-Cookie'
-          },
-          {
-            key: 'Access-Control-Allow-Credentials',
-            value: 'true'
-          },
-          {
-            key: 'Access-Control-Expose-Headers',
-            value: 'Set-Cookie'
-          }
-        ]
-      }] : [])
+      // No CORS headers here: core's API routes answer CORS per request (addCorsHeaders), so the
+      // origins in api.cors.allowedOrigins and CORS_ADDITIONAL_ORIGINS get their grant in production too
     ]
   },
 }

package/dist/templates/projects/blog/api/authors/[username]/route.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface Author {
   id: string
@@ -151,3 +152,5 @@ const getHandler = async (
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/dist/templates/projects/blog/api/authors/route.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface AuthorWithCount {
   id: string
@@ -64,3 +65,5 @@ const getHandler = async (request: NextRequest) => {
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/dist/templates/projects/blog/api/posts/public/route.ts

@@ -11,6 +11,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface Post {
   id: string
@@ -152,3 +153,5 @@ const getHandler = async (request: NextRequest) => {
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight