@nextsparkjs/core 0.1.0-beta.194 → 0.1.0-beta.196

package/dist/routes/api/v1/media/upload/route.js

@@ -4,6 +4,7 @@ import { createApiResponse, createApiError } from "@nextsparkjs/core/lib/api/hel
 import { API_ERROR_CODES } from "@nextsparkjs/core/lib/api/api-error";
 import { checkPermission } from "@nextsparkjs/core/lib/permissions/check";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 import { MEDIA_CONFIG } from "@nextsparkjs/core/lib/config/config-sync";
 import { MediaService } from "@nextsparkjs/core/lib/services/media.service";
 import { extractImageDimensions } from "@nextsparkjs/core/lib/media/utils";
@@ -14,6 +15,13 @@ const isVercelBlobConfigured = () => {
   const token = process.env.BLOB_READ_WRITE_TOKEN;
   return !!token && token.startsWith("vercel_blob_");
 };
+const localFallbackAllowed = () => process.env.NODE_ENV !== "production";
+const storageNotConfigured = () => createApiError(
+  'Media storage is not configured: set BLOB_READ_WRITE_TOKEN (a Vercel Blob read/write token, starts with "vercel_blob_") to upload files in production.',
+  503,
+  { missing: "BLOB_READ_WRITE_TOKEN" },
+  API_ERROR_CODES.STORAGE_NOT_CONFIGURED
+);
 async function uploadToLocalStorageBuffer(buffer, fileName) {
   const uploadDir = join(process.cwd(), "public", "uploads", "temp");
   if (!existsSync(uploadDir)) {
@@ -36,6 +44,7 @@ export const POST = withRateLimitTier(async (request) => {
     if (!await checkPermission(authResult.user.id, teamId, "media.upload")) {
       return createApiError("Permission denied", 403, void 0, API_ERROR_CODES.PERMISSION_DENIED);
     }
+    if (!isVercelBlobConfigured() && !localFallbackAllowed()) return storageNotConfigured();
     const formData = await request.formData();
     const files = Array.from(formData.getAll("files")).filter((value) => value instanceof File);
     if (files.length === 0) {
@@ -45,7 +54,6 @@ export const POST = withRateLimitTier(async (request) => {
     const uploadedMedia = [];
     const useVercelBlob = isVercelBlobConfigured();
     console.log(`\u{1F4E4} [Media Upload] Storage mode: ${useVercelBlob ? "Vercel Blob" : "Local Storage"}`);
-    console.log(`\u{1F4E4} [Media Upload] Team context: ${teamId}`);
     for (const file of files) {
       if (!file.size) {
         continue;
@@ -100,6 +108,7 @@ export const POST = withRateLimitTier(async (request) => {
             uploadedUrl = blob.url;
             console.log(`\u2705 [Media Upload] Uploaded to Vercel Blob: ${uploadedUrl}`);
           } catch (blobError) {
+            if (!localFallbackAllowed()) throw blobError;
             console.warn(`\u26A0\uFE0F [Media Upload] Vercel Blob failed, falling back to local storage:`, blobError);
             uploadedUrl = await uploadToLocalStorageBuffer(fileBuffer, fileName);
             console.log(`\u2705 [Media Upload] Uploaded to local storage (fallback): ${uploadedUrl}`);
@@ -178,7 +187,7 @@ export const GET = withRateLimitTier(async (request) => {
     const maxSizeMB = ((_a = MEDIA_CONFIG) == null ? void 0 : _a.maxSizeMB) ?? 10;
     return createApiResponse({
       message: "Media upload endpoint is active",
-      storage: useVercelBlob ? "Vercel Blob" : "Local Storage",
+      storage: useVercelBlob ? "Vercel Blob" : localFallbackAllowed() ? "Local Storage" : "Not configured (set BLOB_READ_WRITE_TOKEN)",
       uploadPath: "uploads/temp/",
       supportedTypes: ((_b = MEDIA_CONFIG) == null ? void 0 : _b.allowedMimeTypes) ?? ["image/jpeg", "image/png", "image/gif", "image/webp", "video/mp4", "video/webm"],
       maxFileSize: `${maxSizeMB}MB`,
@@ -194,3 +203,4 @@ export const GET = withRateLimitTier(async (request) => {
     );
   }
 }, "read");
+export const OPTIONS = corsPreflight;

package/dist/routes/api/v1/media-tags/route.d.ts

@@ -1,4 +1,5 @@
 import { NextRequest } from 'next/server';
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response';
 /**
  * GET /api/v1/media-tags
  *
@@ -16,4 +17,5 @@ export declare const GET: (request: NextRequest) => Promise<import("next/server"
  * Authentication: Requires valid session or API key with media:write scope
  */
 export declare const POST: (request: NextRequest) => Promise<import("next/server").NextResponse>;
+export declare const OPTIONS: typeof corsPreflight;
 //# sourceMappingURL=route.d.ts.map

package/dist/routes/api/v1/media-tags/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/media-tags/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAQzC;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,uEAwBN,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,IAAI,uEA+BN,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/media-tags/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAMzC,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAGvE;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,uEAwBN,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,IAAI,uEA+BN,CAAA;AAEX,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/media-tags/route.js

@@ -3,6 +3,7 @@ import { createApiResponse, createApiError } from "@nextsparkjs/core/lib/api/hel
 import { API_ERROR_CODES } from "@nextsparkjs/core/lib/api/api-error";
 import { checkPermission } from "@nextsparkjs/core/lib/permissions/check";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 import { MediaService } from "@nextsparkjs/core/lib/services/media.service";
 export const GET = withRateLimitTier(async (request) => {
   try {
@@ -47,3 +48,4 @@ export const POST = withRateLimitTier(async (request) => {
     return createApiError("Failed to create media tag", 500);
   }
 }, "write");
+export const OPTIONS = corsPreflight;

package/dist/routes/api/v1/post-categories/[id]/route.d.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response';
 export declare const GET: (request: NextRequest, args_0: {
     params: Promise<{
         id: string;
@@ -14,4 +15,5 @@ export declare const DELETE: (request: NextRequest, args_0: {
         id: string;
     }>;
 }) => Promise<NextResponse>;
+export declare const OPTIONS: typeof corsPreflight;
 //# sourceMappingURL=route.d.ts.map

package/dist/routes/api/v1/post-categories/[id]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/post-categories/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAmBvD,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAyBrC,CAAC;AAGX,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAwIpC,CAAC;AAGZ,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAiEpC,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/post-categories/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAevE,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAyBrC,CAAC;AAGX,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAwIpC,CAAC;AAGZ,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAiEpC,CAAC;AAEZ,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/post-categories/[id]/route.js

@@ -3,6 +3,7 @@ import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/cor
 import { query as dbQuery } from "@nextsparkjs/core/lib/db";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 const updateCategorySchema = z.object({
   name: z.string().min(1).max(255).optional(),
   slug: z.string().min(2).max(100).regex(/^[a-z0-9-]+$/, "Slug must be lowercase alphanumeric with dashes").optional(),
@@ -201,3 +202,4 @@ export const DELETE = withRateLimitTier(async (request, { params }) => {
     return NextResponse.json({ success: false, error: "Internal server error" }, { status: 500 });
   }
 }, "write");
+export const OPTIONS = corsPreflight;

package/dist/routes/api/v1/post-categories/route.d.ts

@@ -1,4 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response';
 export declare const GET: (request: NextRequest) => Promise<NextResponse>;
 export declare const POST: (request: NextRequest) => Promise<NextResponse>;
+export declare const OPTIONS: typeof corsPreflight;
 //# sourceMappingURL=route.d.ts.map

package/dist/routes/api/v1/post-categories/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/post-categories/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA6BvD,eAAO,MAAM,GAAG,iDAkBN,CAAC;AAGX,eAAO,MAAM,IAAI,iDAsEN,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/post-categories/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAyBvE,eAAO,MAAM,GAAG,iDAkBN,CAAC;AAGX,eAAO,MAAM,IAAI,iDAsEN,CAAC;AAEZ,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/post-categories/route.js

@@ -3,6 +3,7 @@ import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/cor
 import { query as dbQuery } from "@nextsparkjs/core/lib/db";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 const createCategorySchema = z.object({
   name: z.string().min(1).max(255),
   slug: z.string().min(2).max(100).regex(/^[a-z0-9-]+$/, "Slug must be lowercase alphanumeric with dashes").optional(),
@@ -92,3 +93,4 @@ export const POST = withRateLimitTier(async (request) => {
     return NextResponse.json({ success: false, error: "Internal server error" }, { status: 500 });
   }
 }, "write");
+export const OPTIONS = corsPreflight;

package/dist/routes/api/v1/teams/[teamId]/members/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/v1/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAwBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YACiC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2HlE,CAAA;AAGV,eAAO,MAAM,IAAI;YACgC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BAgMjE,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/v1/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAwBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YACiC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2HlE,CAAA;AAGV,eAAO,MAAM,IAAI;YACgC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BAkMjE,CAAA"}

package/dist/routes/api/v1/teams/[teamId]/members/route.js

@@ -17,7 +17,7 @@ import { MembershipService } from "@nextsparkjs/core/lib/services";
 import { canInviteToRole } from "@nextsparkjs/core/lib/teams/permissions";
 import { EmailFactory } from "@nextsparkjs/core/lib/email/factory";
 import { sendTeamInvitationEmail } from "@nextsparkjs/core/lib/email/send";
-import { I18N_CONFIG } from "@nextsparkjs/core/lib/config";
+import { I18N_CONFIG, APP_NAME } from "@nextsparkjs/core/lib/config";
 import { withBasePath } from "@nextsparkjs/core/lib/base-path";
 export async function OPTIONS(request) {
   return handleCorsPreflightRequest(request);
@@ -230,25 +230,27 @@ export const POST = withRateLimitTier(withApiLogging(
           role: validatedData.role,
           acceptUrl,
           expiresIn: "7 days",
-          appName: process.env.NEXT_PUBLIC_APP_NAME || "Your App"
+          appName: process.env.NEXT_PUBLIC_APP_NAME || APP_NAME
         }, I18N_CONFIG.defaultLocale);
         await emailProvider.send({
           to: validatedData.email,
           subject: emailContent.subject,
           html: emailContent.html
         });
-        console.log("\n" + "\u{1F3AB}".repeat(30));
-        console.log("\u{1F4E8} TEAM INVITATION CREATED");
-        console.log("\u{1F3AB}".repeat(30));
-        console.log(`\u{1F4E7} To: ${validatedData.email}`);
-        console.log(`\u{1F464} Invited by: ${inviterName}`);
-        console.log(`\u{1F3E2} Team: ${team.name}`);
-        console.log(`\u{1F451} Role: ${validatedData.role}`);
-        console.log(`\u{1F517} Accept URL: ${acceptUrl}`);
-        console.log("\u{1F3AB}".repeat(30) + "\n");
+        if (process.env.NODE_ENV === "development") {
+          console.log("\n" + "\u{1F3AB}".repeat(30));
+          console.log("\u{1F4E8} TEAM INVITATION CREATED");
+          console.log("\u{1F3AB}".repeat(30));
+          console.log(`\u{1F4E7} To: ${validatedData.email}`);
+          console.log(`\u{1F464} Invited by: ${inviterName}`);
+          console.log(`\u{1F3E2} Team: ${team.name}`);
+          console.log(`\u{1F451} Role: ${validatedData.role}`);
+          console.log(`\u{1F517} Accept URL: ${acceptUrl}`);
+          console.log("\u{1F3AB}".repeat(30) + "\n");
+        }
       } catch (emailError) {
         console.error("Failed to send invitation email:", emailError);
-        console.log(`\u26A0\uFE0F Email failed but invitation created. Accept URL: ${acceptUrl}`);
+        if (process.env.NODE_ENV === "development") console.log(`\u26A0\uFE0F Email failed but invitation created. Accept URL: ${acceptUrl}`);
       }
       const response = createApiResponse(invitation, { created: true }, 201);
       return addCorsHeaders(response, req);

package/dist/routes/api/v1/teams/[teamId]/subscription/route.d.ts

@@ -4,11 +4,13 @@
  * GET /api/v1/teams/[teamId]/subscription - Get team's active subscription
  */
 import { NextRequest, NextResponse } from 'next/server';
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response';
 interface RouteParams {
     params: Promise<{
         teamId: string;
     }>;
 }
 export declare const GET: (request: NextRequest, props: RouteParams) => Promise<NextResponse>;
+export declare const OPTIONS: typeof corsPreflight;
 export {};
 //# sourceMappingURL=route.d.ts.map

package/dist/routes/api/v1/teams/[teamId]/subscription/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/v1/teams/[teamId]/subscription/route.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,UAAU,WAAW;IACnB,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACpC;AAED,eAAO,MAAM,GAAG,qEAmCN,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/v1/teams/[teamId]/subscription/route.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAGvE,UAAU,WAAW;IACnB,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACpC;AAED,eAAO,MAAM,GAAG,qEAmCN,CAAA;AAEV,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/teams/[teamId]/subscription/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { validateAndAuthenticateRequest, createApiResponse, createApiError } from "@nextsparkjs/core/lib/api/helpers";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 import { SubscriptionService, MembershipService } from "@nextsparkjs/core/lib/services";
 export const GET = withRateLimitTier(async function GET2(request, props) {
   const { auth, rateLimitResponse, errorResponse } = await validateAndAuthenticateRequest(request, { requiredScope: "billing:read" });
@@ -28,3 +29,4 @@ export const GET = withRateLimitTier(async function GET2(request, props) {
     return createApiError("Failed to fetch subscription", 500);
   }
 }, "read");
+export const OPTIONS = corsPreflight;

package/dist/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.d.ts

@@ -5,6 +5,7 @@
  * POST /api/v1/teams/[teamId]/usage/[limitSlug] - Track usage
  */
 import { NextRequest, NextResponse } from 'next/server';
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response';
 interface RouteParams {
     params: Promise<{
         teamId: string;
@@ -13,5 +14,6 @@ interface RouteParams {
 }
 export declare const GET: (request: NextRequest, props: RouteParams) => Promise<NextResponse>;
 export declare const POST: (request: NextRequest, props: RouteParams) => Promise<NextResponse>;
+export declare const OPTIONS: typeof corsPreflight;
 export {};
 //# sourceMappingURL=route.d.ts.map

package/dist/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,UAAU,WAAW;IACnB,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACvD;AAED,eAAO,MAAM,GAAG,qEAgCN,CAAA;AAEV,eAAO,MAAM,IAAI,qEA4CN,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAIvE,UAAU,WAAW;IACnB,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACvD;AAED,eAAO,MAAM,GAAG,qEAgCN,CAAA;AAEV,eAAO,MAAM,IAAI,qEA4CN,CAAA;AAEX,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/teams/[teamId]/usage/[limitSlug]/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { validateAndAuthenticateRequest, createApiResponse, createApiError } from "@nextsparkjs/core/lib/api/helpers";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 import { SubscriptionService, UsageService, MembershipService } from "@nextsparkjs/core/lib/services";
 import { trackUsageSchema } from "@nextsparkjs/core/lib/billing/schema";
 export const GET = withRateLimitTier(async function GET2(request, props) {
@@ -65,3 +66,4 @@ export const POST = withRateLimitTier(async function POST2(request, props) {
     return createApiError(errorMessage, 500);
   }
 }, "write");
+export const OPTIONS = corsPreflight;

package/dist/routes/api/v1/teams/switch/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/teams/switch/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAuBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,IAAI,iDA6EL,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/teams/switch/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAuBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,IAAI,iDAkFL,CAAA"}

package/dist/routes/api/v1/teams/switch/route.js

@@ -38,7 +38,10 @@ export const POST = withRateLimitTier(withApiLogging(async (req) => {
       );
       return addCorsHeaders(response, req);
     }
-    const body = await req.json();
+    const body = await req.json().catch(() => void 0);
+    if (body === void 0) {
+      return addCorsHeaders(createApiError("Request body must be valid JSON", 400, null, "INVALID_JSON"), req);
+    }
     const validatedData = switchTeamSchema.parse(body);
     try {
       await TeamService.switchActive(authResult.user.id, validatedData.teamId);

package/dist/routes/api/v1/users/[id]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/users/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA2BxD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAoDpC,CAAC;AAGZ,eAAO,MAAM,KAAK;YAEM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAqInC,CAAC;AAGb,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAiEnC,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/users/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA+BxD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAoDpC,CAAC;AAGZ,eAAO,MAAM,KAAK;YAEM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAqInC,CAAC;AAGb,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAiEnC,CAAC"}

package/dist/routes/api/v1/users/[id]/route.js

@@ -21,6 +21,7 @@ const updateUserSchema = z.object({
   role: z.enum(["member", "superadmin"]).optional(),
   metas: z.record(z.string(), z.any()).optional()
 });
+const resolveUserId = ({ id }, callerId) => id === "me" ? callerId : id;
 export async function OPTIONS(request) {
   return handleCorsPreflightRequest(request);
 }
@@ -33,7 +34,7 @@ export const GET = withRateLimitTier(withApiLogging(async (req, { params }) => {
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse;
     }
-    const { id } = await params;
+    const id = resolveUserId(await params, authResult.user.id);
     if (!id || id.trim() === "") {
       const response2 = createApiError("User ID or email is required", 400, null, "MISSING_IDENTIFIER");
       return addCorsHeaders(response2, req);
@@ -70,7 +71,7 @@ export const PATCH = withRateLimitTier(withApiLogging(async (req, { params }) =>
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse;
     }
-    const { id } = await params;
+    const id = resolveUserId(await params, authResult.user.id);
     if (!id || id.trim() === "") {
       const response2 = createApiError("User ID or email is required", 400, null, "MISSING_IDENTIFIER");
       return addCorsHeaders(response2, req);

package/dist/routes/api/v1/users/docs.md

@@ -4,52 +4,67 @@ Manage user profiles and account settings.
 
 ## Overview
 
-The Users API allows you to view and update user profile information. Users can update their own profile, while admins can manage other users within their team.
+The Users API allows you to view and update user profile information. Users can read and update their own profile; a superadmin can manage any user.
 
 ## Authentication
 
 All endpoints require authentication via:
 - **Session cookie** (for browser-based requests)
-- **API Key** header (for server-to-server requests)
+- **API Key** (for server-to-server requests), sent as `x-api-key: <key>` or `Authorization: Bearer <key>`: it needs the `users:read` scope to read and `users:write` to update, and it answers as the key's owner
+
+A user can read and update only themselves; a superadmin can manage any user. Anything else answers `403`.
 
 ## Endpoints
 
 ### Get Current User
 `GET /api/v1/users/me`
 
-Returns the currently authenticated user's profile.
+Returns the signed-in user, with a session cookie or an API key. It is `GET /api/v1/users/:id` for the caller's own id, so it takes the same `metas` query parameters and answers with the same fields.
+
+```bash
+curl -H "Cookie: <session cookie>" https://yourdomain.com/api/v1/users/me
+curl -H "Authorization: Bearer <api key>" https://yourdomain.com/api/v1/users/me
+curl -H "x-api-key: <api key>" https://yourdomain.com/api/v1/users/me
+```
 
 **Example Response:**
 ```json
 {
-  "id": "user_123",
-  "name": "John Doe",
-  "email": "john@example.com",
-  "image": "/uploads/avatar.png",
-  "createdAt": "2024-01-15T10:30:00Z",
-  "teams": [
-    {
-      "id": "team_456",
-      "name": "Acme Corp",
-      "role": "admin"
-    }
-  ]
+  "success": true,
+  "data": {
+    "id": "user_123",
+    "email": "john@example.com",
+    "name": "John Doe",
+    "firstName": "John",
+    "lastName": "Doe",
+    "image": "/uploads/avatar.png",
+    "country": null,
+    "timezone": null,
+    "language": "en",
+    "role": "member",
+    "emailVerified": true,
+    "createdAt": "2024-01-15T10:30:00Z",
+    "updatedAt": "2024-01-15T10:30:00Z"
+  }
 }
 ```
 
 ### Update Current User
 `PATCH /api/v1/users/me`
 
-Update the current user's profile.
+Update the signed-in user. It is `PATCH /api/v1/users/:id` for the caller's own id, with the same rules: only `firstName`, `lastName`, `language` and `metas` are accepted, and `role` is a superadmin's to change (anyone else gets `403`).
 
 **Request Body:**
 ```json
 {
-  "name": "John Smith",
-  "image": "/uploads/new-avatar.png"
+  "firstName": "John",
+  "lastName": "Smith",
+  "metas": { "preferences": { "theme": "dark" } }
 }
 ```
 
+To store per-user settings (the mobile client's preferences), use the user's metadata: `GET`/`PUT /api/v1/users/:id/meta/:key`.
+
 ### List Team Members
 `GET /api/v1/users`
 
@@ -63,7 +78,7 @@ Returns all users in the current team.
 ### Get User by ID
 `GET /api/v1/users/[id]`
 
-Returns a specific user's profile (within the same team).
+Returns a specific user's profile. Only that user or a superadmin can read it; `403` otherwise.
 
 **Path Parameters:**
 - `id` (string, required): User ID

package/dist/routes/api/v1/users/me/route.d.ts

@@ -0,0 +1,6 @@
+import type { NextRequest } from 'next/server';
+import { OPTIONS } from '@nextsparkjs/core/routes/api/v1/users/[id]/route';
+export { OPTIONS };
+export declare const GET: (req: NextRequest) => Promise<import("next/server").NextResponse<unknown>>;
+export declare const PATCH: (req: NextRequest) => Promise<import("next/server").NextResponse<unknown>>;
+//# sourceMappingURL=route.d.ts.map

package/dist/routes/api/v1/users/me/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/users/me/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAsC,MAAM,kDAAkD,CAAA;AAO9G,OAAO,EAAE,OAAO,EAAE,CAAA;AAClB,eAAO,MAAM,GAAG,GAAI,KAAK,WAAW,yDAAqB,CAAA;AACzD,eAAO,MAAM,KAAK,GAAI,KAAK,WAAW,yDAAuB,CAAA"}

package/dist/routes/api/v1/users/me/route.js

@@ -0,0 +1,5 @@
+import { OPTIONS, GET as getUser, PATCH as patchUser } from "@nextsparkjs/core/routes/api/v1/users/[id]/route";
+const me = { params: Promise.resolve({ id: "me" }) };
+export { OPTIONS };
+export const GET = (req) => getUser(req, me);
+export const PATCH = (req) => patchUser(req, me);

package/dist/routes/api/v1/users/presets.ts

@@ -34,13 +34,13 @@ export default defineApiEndpoint({
     {
       id: 'update-profile',
       title: 'Update My Profile',
-      description: 'Update current user name',
+      description: 'Update the current user first name',
       method: 'PATCH',
       pathParams: {
         id: 'me'
       },
       payload: {
-        name: 'Updated Name'
+        firstName: 'Updated'
       },
       tags: ['write', 'profile']
     },

package/dist/routes/dashboard/(main)/layout.cc.d.ts

@@ -0,0 +1,4 @@
+export default function MainDashboardLayout({ children }: {
+    children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=layout.cc.d.ts.map

package/dist/routes/dashboard/(main)/layout.cc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.cc.tsx"],"names":[],"mappings":"AAgBA,MAAM,CAAC,OAAO,UAAU,mBAAmB,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CAQtF"}

package/dist/routes/dashboard/(main)/layout.cc.js

@@ -0,0 +1,10 @@
+import { Fragment, jsx } from "react/jsx-runtime";
+import { Suspense } from "react";
+import { MainDashboardShell, enforceEntityPermission } from "../../_internal/dashboard-main-shared.js";
+async function EntityPermission({ children }) {
+  await enforceEntityPermission();
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+export default function MainDashboardLayout({ children }) {
+  return /* @__PURE__ */ jsx(MainDashboardShell, { children: /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(EntityPermission, { children }) }) });
+}

package/dist/routes/dashboard/(main)/layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.tsx"],"names":[],"mappings":"AAsDA,iBAAe,0BAA0B,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B,oDAmCA;AAGD,eAAe,0BAA0B,CAAA"}
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.tsx"],"names":[],"mappings":"AAcA,iBAAe,0BAA0B,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B,oDAIA;AAGD,eAAe,0BAA0B,CAAA"}

package/dist/routes/dashboard/(main)/layout.js

@@ -1,50 +1,9 @@
 import { jsx } from "react/jsx-runtime";
-import { headers } from "next/headers";
-import { redirect } from "next/navigation";
-import { DashboardShell } from "@nextsparkjs/core/components/dashboard/layouts/DashboardShell";
-import { serializeEntityConfig } from "@nextsparkjs/core/lib/entities/serialization";
-import { setEntityRegistry } from "@nextsparkjs/core/lib/entities/queries";
-import { checkPermission } from "@nextsparkjs/core/lib/permissions/check";
-import { getDashboardPermissionContext } from "@nextsparkjs/core/lib/auth/request-session";
-import { isValidPermission } from "@nextsparkjs/core/lib/permissions/init";
-import { ENTITY_REGISTRY, ENTITY_METADATA } from "@nextsparkjs/registries/entity-registry";
-setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA);
-function parseEntityFromPathname(pathname) {
-  const match = pathname.match(/^\/dashboard\/([^/]+)(?:\/(.*))?$/);
-  if (!match) return null;
-  const entity = match[1];
-  const rest = match[2] || "";
-  if (rest === "" || rest === "/") return { entity, action: "list" };
-  if (rest === "create") return { entity, action: "create" };
-  if (rest.match(/^[^/]+\/edit$/)) return { entity, action: "update" };
-  if (rest.match(/^[^/]+$/)) return { entity, action: "read" };
-  return { entity, action: "read" };
-}
-function isEntityConfig(entity) {
-  return "slug" in entity;
-}
+import { MainDashboardShell, enforceEntityPermission } from "../../_internal/dashboard-main-shared.js";
 async function DefaultMainDashboardLayout({
   children
 }) {
-  const allEntities = Object.values(ENTITY_REGISTRY).map((entry) => entry.config);
-  const entities = allEntities.filter(isEntityConfig);
-  const serializedEntities = entities.map(serializeEntityConfig);
-  const headersList = await headers();
-  const pathname = headersList.get("x-pathname") || "";
-  const { userId, teamId } = await getDashboardPermissionContext();
-  if (userId && teamId && pathname) {
-    const parsed = parseEntityFromPathname(pathname);
-    if (parsed) {
-      const { entity, action } = parsed;
-      const permission = `${entity}.${action}`;
-      if (isValidPermission(`${entity}.list`)) {
-        const hasPermission = await checkPermission(userId, teamId, permission);
-        if (!hasPermission) {
-          redirect(`/dashboard/permission-denied?entity=${entity}&action=${action}`);
-        }
-      }
-    }
-  }
-  return /* @__PURE__ */ jsx(DashboardShell, { entities: serializedEntities, children });
+  await enforceEntityPermission();
+  return /* @__PURE__ */ jsx(MainDashboardShell, { children });
 }
 export default DefaultMainDashboardLayout;

package/dist/routes/dashboard/permission-denied/page.d.ts

@@ -4,6 +4,6 @@ interface PermissionDeniedPageProps {
         action?: string;
     }>;
 }
-declare function PermissionDeniedPage({ searchParams }: PermissionDeniedPageProps): Promise<import("react/jsx-runtime").JSX.Element>;
+declare function PermissionDeniedPage({ searchParams }: PermissionDeniedPageProps): import("react/jsx-runtime").JSX.Element;
 export default PermissionDeniedPage;
 //# sourceMappingURL=page.d.ts.map

package/dist/routes/dashboard/permission-denied/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/permission-denied/page.tsx"],"names":[],"mappings":"AAQA,UAAU,yBAAyB;IACjC,YAAY,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH;AAED,iBAAe,oBAAoB,CAAC,EAClC,YAAY,EACb,EAAE,yBAAyB,oDAW3B;AAED,eAAe,oBAAoB,CAAA"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/permission-denied/page.tsx"],"names":[],"mappings":"AASA,UAAU,yBAAyB;IACjC,YAAY,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH;AAkBD,iBAAS,oBAAoB,CAAC,EAAE,YAAY,EAAE,EAAE,yBAAyB,2CAMxE;AAED,eAAe,oBAAoB,CAAA"}

package/dist/routes/dashboard/permission-denied/page.js

@@ -1,6 +1,7 @@
 import { jsx } from "react/jsx-runtime";
+import { Suspense } from "react";
 import { NoPermission } from "@nextsparkjs/core/components/permissions/NoPermission";
-async function PermissionDeniedPage({
+async function DeniedMessage({
   searchParams
 }) {
   const { entity, action } = await searchParams;
@@ -14,4 +15,7 @@ async function PermissionDeniedPage({
     }
   );
 }
+function PermissionDeniedPage({ searchParams }) {
+  return /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(DeniedMessage, { searchParams }) });
+}
 export default PermissionDeniedPage;

package/dist/routes/dashboard/settings/password/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../../src/routes/dashboard/settings/password/page.tsx"],"names":[],"mappings":"AAwBA,iBAAS,kBAAkB,4CAmR1B;AAID,eAAe,kBAAkB,CAAA"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../../src/routes/dashboard/settings/password/page.tsx"],"names":[],"mappings":"AAwBA,iBAAS,kBAAkB,4CAsR1B;AAID,eAAe,kBAAkB,CAAA"}