@nextsparkjs/core 0.1.0-beta.194 → 0.1.0-beta.196

package/dist/lib/api/helpers.js

@@ -1,13 +1,15 @@
 import { NextResponse } from "next/server";
-import { validateApiKey } from "./auth.js";
+import { getValidatedApiKey, validateApiKey } from "./auth.js";
 import { mutateWithRLS, queryWithRLS } from "../db.js";
-import { checkRateLimit, addRateLimitHeaders } from "./rate-limit.js";
+import { apiKeyRateLimitResponse } from "./rate-limit.js";
+import { getRecordedClientIp } from "./client-ip.js";
 import { getApplicationConfig } from "../config/index.js";
 import { auth } from "../auth.js";
 import { MetaService } from "../services/meta.service.js";
 import { ScopeService } from "../services/scope.service.js";
 import { getChildEntities } from "../entities/queries.js";
-import { getCorsOrigins, normalizeOrigin, isOriginAllowed } from "../utils/cors.js";
+import { getCorsOrigins } from "../utils/cors.js";
+import { corsGrant, requestPathname, setCorsHeaders, varyOnOrigin } from "./cors-response.js";
 import { isValidUUID } from "../utils/uuid.js";
 import {
   describeRoute,
@@ -34,7 +36,6 @@ async function validateAndAuthenticateRequest(request, options = {}) {
           flags: userFlags,
           isSession: true
         };
-        console.log(`[Auth] Session authentication successful for user ${session.user.id} with role ${userRole}`);
         return { auth: sessionAuth };
       }
     } catch (sessionError) {
@@ -56,7 +57,8 @@ async function validateAndAuthenticateRequest(request, options = {}) {
       )
     };
   }
-  return applyApiKeyRateLimit(apiKeyAuth);
+  const rateLimitResponse = apiKeyRateLimitResponse(request, apiKeyAuth);
+  return rateLimitResponse ? { auth: apiKeyAuth, rateLimitResponse } : { auth: apiKeyAuth };
 }
 function generateScopesForRole(role, flags = []) {
   const baseScopes = getBaseScopesFromRegistry();
@@ -101,47 +103,15 @@ async function validateAndAuthenticateApiRequest(request) {
   if (!auth2) {
     throw new Error("Invalid API key");
   }
-  return applyApiKeyRateLimit(auth2);
-}
-function applyApiKeyRateLimit(auth2) {
-  const rateLimitResult = checkRateLimit(auth2.keyId);
-  if (!rateLimitResult.allowed) {
-    const response = NextResponse.json(
-      {
-        success: false,
-        error: "Rate limit exceeded",
-        message: `Too many requests. Limit: ${rateLimitResult.limit} requests per minute`,
-        code: "RATE_LIMIT_EXCEEDED",
-        retryAfter: Math.ceil((rateLimitResult.resetTime - Date.now()) / 1e3)
-      },
-      { status: 429 }
-    );
-    addRateLimitHeaders(response, auth2.keyId, auth2.scopes);
-    return { auth: auth2, rateLimitResponse: response };
-  }
-  return { auth: auth2 };
+  const rateLimitResponse = apiKeyRateLimitResponse(request, auth2);
+  return rateLimitResponse ? { auth: auth2, rateLimitResponse } : { auth: auth2 };
 }
 function getApiAuth(request) {
-  const userId = request.headers.get("x-api-user-id");
-  const keyId = request.headers.get("x-api-key-id");
-  const scopesHeader = request.headers.get("x-api-scopes");
-  if (!userId || !keyId || !scopesHeader) {
-    throw new Error("Missing API authentication headers");
-  }
-  let scopes = [];
-  try {
-    const parsed = JSON.parse(scopesHeader);
-    if (Array.isArray(parsed)) {
-      scopes = parsed.filter((s) => typeof s === "string");
-    }
-  } catch {
-    console.warn("[API] Invalid scopes header format");
+  const auth2 = getValidatedApiKey(request);
+  if (!auth2) {
+    throw new Error("No validated API key for this request");
   }
-  return {
-    userId,
-    keyId,
-    scopes
-  };
+  return auth2;
 }
 function checkScope(auth2, requiredScope) {
   if (!scopesSatisfy(auth2.scopes, requiredScope)) {
@@ -203,7 +173,7 @@ async function logApiUsage(auth2, request, statusCode, responseTime, requestBody
   try {
     const endpoint = request.nextUrl.pathname;
     const method = request.method;
-    const ipAddress = request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || "unknown";
+    const ipAddress = getRecordedClientIp(request.headers);
     const userAgent = request.headers.get("user-agent");
     await mutateWithRLS(
       `INSERT INTO "api_audit_log" 
@@ -229,31 +199,18 @@ async function logApiUsage(auth2, request, statusCode, responseTime, requestBody
 function withApiLogging(handler) {
   return async (request, ...args) => {
     const startTime = Date.now();
-    let auth2 = null;
-    let requestBody = null;
-    try {
-      try {
-        auth2 = getApiAuth(request);
-      } catch {
-      }
-      if (["POST", "PUT", "PATCH"].includes(request.method)) {
-        try {
-          const clonedRequest = request.clone();
-          requestBody = await clonedRequest.json();
-        } catch {
-        }
-      }
-      const response = await handler(request, ...args);
-      const responseTime = Date.now() - startTime;
+    const log = (status) => {
+      const auth2 = getValidatedApiKey(request);
       if (auth2) {
-        logApiUsage(auth2, request, response.status, responseTime, requestBody).catch(console.error);
+        logApiUsage(auth2, request, status, Date.now() - startTime).catch(console.error);
       }
+    };
+    try {
+      const response = await handler(request, ...args);
+      log(response.status);
       return response;
     } catch (error) {
-      const responseTime = Date.now() - startTime;
-      if (auth2) {
-        logApiUsage(auth2, request, 500, responseTime, requestBody).catch(console.error);
-      }
+      log(500);
       throw error;
     }
   };
@@ -282,32 +239,15 @@ function getAllowedFiltersFromRegistry() {
 async function addCorsHeaders(response, request) {
   const env = process.env.NODE_ENV || "development";
   const config = await getApplicationConfig();
-  const corsConfig = config.api.cors;
-  let allowedOrigin = "null";
+  let grant = null;
   if (request) {
     const origin = request.headers.get("origin");
-    if (origin) {
-      const normalizedOrigin = normalizeOrigin(origin);
-      if (env === "development" && corsConfig.allowAllOrigins.development) {
-        allowedOrigin = normalizedOrigin;
-      } else {
-        const allowedOrigins = getCorsOrigins(config, env);
-        const matched = isOriginAllowed(normalizedOrigin, allowedOrigins);
-        if (matched) {
-          allowedOrigin = matched;
-        }
-      }
-    }
-  } else if (env === "development" && corsConfig.allowAllOrigins.development) {
+    if (origin) grant = corsGrant(origin, config, env, requestPathname(request));
+  } else if (env === "development" && config.api.cors.allowAllOrigins.development) {
     const allowedOrigins = getCorsOrigins(config, env);
-    allowedOrigin = allowedOrigins[0] || "http://localhost:3000";
+    grant = { origin: allowedOrigins[0] || "http://localhost:3000", credentials: true };
   }
-  response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
-  response.headers.append("Vary", "Origin");
-  response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
-  response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key, x-team-id, x-builder-source");
-  response.headers.set("Access-Control-Allow-Credentials", "true");
-  response.headers.set("Access-Control-Max-Age", "86400");
+  setCorsHeaders(response.headers, grant);
   return response;
 }
 async function handleCorsPreflightRequest(request) {
@@ -321,25 +261,14 @@ async function wrapAuthHandlerWithCors(handler, request) {
     statusText: response.statusText,
     headers: new Headers(response.headers)
   });
-  const env = process.env.NODE_ENV || "development";
-  const config = await getApplicationConfig();
-  const corsConfig = config.api.cors;
   const origin = request.headers.get("origin");
   if (origin) {
-    const normalizedOrigin = normalizeOrigin(origin);
-    let allowedOrigin = "null";
-    if (env === "development" && corsConfig.allowAllOrigins.development) {
-      allowedOrigin = normalizedOrigin;
-    } else {
-      const allowedOrigins = getCorsOrigins(config, env);
-      const matched = isOriginAllowed(normalizedOrigin, allowedOrigins);
-      if (matched) {
-        allowedOrigin = matched;
-      }
+    const grant = corsGrant(origin, await getApplicationConfig(), process.env.NODE_ENV || "development", requestPathname(request));
+    if (grant) {
+      newResponse.headers.set("Access-Control-Allow-Origin", grant.origin);
+      if (grant.credentials) newResponse.headers.set("Access-Control-Allow-Credentials", "true");
     }
-    newResponse.headers.set("Access-Control-Allow-Origin", allowedOrigin);
-    newResponse.headers.set("Access-Control-Allow-Credentials", "true");
-    newResponse.headers.append("Vary", "Origin");
+    varyOnOrigin(newResponse.headers);
   }
   return newResponse;
 }

package/dist/lib/api/keys.d.ts

@@ -35,6 +35,12 @@ export declare class ApiKeyManager {
      */
     static suggestKeyName(scopes: string[]): string;
 }
+/**
+ * The API key a request presents: the token of `Authorization: Bearer <token>`,
+ * else the `x-api-key` header. validateApiKey checks this value, and the
+ * cookie-write origin check (lib/api/request-origin) reads it too.
+ */
+export declare function presentedApiKey(headers: Headers): string | null;
 /**
  * Definición de scopes disponibles para API keys
  */

package/dist/lib/api/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/keys.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,aAAa;IACxB;;;OAGG;WACU,cAAc,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBrF;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;OAEG;WACU,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE;IAUpF;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;CAchD;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;CAgCb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrD;AAED,oFAAoF;AACpF,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxD;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;yBAIgC,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKtB,QAAQ,EAAE;;;;;yBAKQ,QAAQ,EAAE;;;;;yBAKxD,QAAQ,EAAE;;CAErB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASd,CAAC;AAEX;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmB9F"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/lib/api/keys.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,aAAa;IACxB;;;OAGG;WACU,cAAc,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBrF;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;OAEG;WACU,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE;IAUpF;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;CAchD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI/D;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;CAgCb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,UAAU,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrD;AAED,oFAAoF;AACpF,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxD;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;yBAIgC,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKV,QAAQ,EAAE;;;;;yBAKtB,QAAQ,EAAE;;;;;yBAKQ,QAAQ,EAAE;;;;;yBAKxD,QAAQ,EAAE;;CAErB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASd,CAAC;AAEX;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmB9F"}

package/dist/lib/api/keys.js

@@ -68,6 +68,11 @@ class ApiKeyManager {
     return `${categoryNames} Access Key`;
   }
 }
+function presentedApiKey(headers) {
+  const authorization = headers.get("authorization");
+  if (authorization == null ? void 0 : authorization.startsWith("Bearer ")) return authorization.substring(7);
+  return headers.get("x-api-key") || null;
+}
 const API_SCOPES = {
   // Usuarios
   "users:read": "Read user information",
@@ -183,5 +188,6 @@ export {
   SCOPE_CATEGORIES,
   getApiScopes,
   getAppApiScopes,
-  getRateLimitForScopes
+  getRateLimitForScopes,
+  presentedApiKey
 };

package/dist/lib/api/permission-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/api/permission-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1C;;GAEG;AACH,eAAO,MAAM,WAAW,SAAS,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAElF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAOjF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CAkCtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B"}
+{"version":3,"file":"permission-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/api/permission-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1C;;GAEG;AACH,eAAO,MAAM,WAAW,SAAS,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAElF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAOjF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CA8BtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B"}

package/dist/lib/api/permission-middleware.js

@@ -21,9 +21,7 @@ function getActionFromMethod(method, isCollection) {
 }
 async function checkEntityPermission(userId, teamId, entitySlug, action) {
   const permission = getEntityPermission(entitySlug, action);
-  console.log(`[PermMiddleware] Checking permission: ${permission} for user ${userId} in team ${teamId}`);
   const hasPermission = await checkPermission(userId, teamId, permission);
-  console.log(`[PermMiddleware] Result: ${hasPermission}`);
   if (!hasPermission) {
     return {
       allowed: false,

package/dist/lib/api/rate-limit.d.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { type ApiKeyAuth } from './auth';
 import { type RateLimitTier } from '../rate-limit-redis';
 export interface RateLimitResult {
     allowed: boolean;
@@ -10,6 +11,13 @@ export interface RateLimitResult {
  * Verifica el rate limit para un identificador específico
  */
 export declare function checkRateLimit(identifier: string, limit?: number, windowMs?: number): RateLimitResult;
+/**
+ * The per-key limit (checkRateLimit, by the key's id) for a request authenticated with `auth`: a 429 ready to
+ * return when the key is over it, null otherwise. Counted once per request, however many times the request is
+ * authenticated (authenticateRequest, validateAndAuthenticate*Request). The per-address limit of the route
+ * wrapper (withRateLimitTier) still applies on top. It is a safety cap, so DISABLE_RATE_LIMITING does not turn it off.
+ */
+export declare function apiKeyRateLimitResponse(request: Request, auth: ApiKeyAuth): NextResponse | null;
 /**
  * Rate limit types for distributed rate limiting
  * Re-export from rate-limit-redis for convenience
@@ -47,6 +55,10 @@ export declare function applyRateLimit(request: NextRequest, keyId: string, scop
 export declare function addRateLimitHeaders(response: NextResponse, keyId: string, scopes: string[]): NextResponse;
 /**
  * Middleware helper para aplicar rate limiting automáticamente
+ *
+ * Limits per API key, with the limits of the key's scopes, when the request presents a key that validates.
+ * The key id and scopes come from that validation, never from request headers; any other request runs the
+ * handler without this limit.
  */
 export declare function withRateLimit<T extends unknown[]>(handler: (request: NextRequest, ...args: T) => Promise<NextResponse>): (request: NextRequest, ...args: T) => Promise<NextResponse>;
 /**

package/dist/lib/api/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAwCvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AAsGD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAEb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAsCvE"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/api/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGzD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAa,EACpB,QAAQ,GAAE,MAAc,GACvB,eAAe,CAyCjB;AAKD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,IAAI,CA0B/F;AAED;;;GAGG;AACH,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAwB5G;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,GAAG,IAAI,CAkCrB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,YAAY,CASd;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA2BvE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CASD;AAED;;GAEG;AACH,wBAAgB,sBAAsB;;;;;EAErC;AA4DD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EACpE,IAAI,GAAE,aAAqB,IAqCb,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAIvE"}

package/dist/lib/api/rate-limit.js

@@ -1,12 +1,15 @@
 import { NextResponse } from "next/server";
 import { unstable_rethrow } from "next/navigation";
-import { getRateLimitForScopes } from "./keys.js";
+import { getRateLimitForScopes, presentedApiKey } from "./keys.js";
+import { validateApiKey } from "./auth.js";
 import { rateLimitCache, getCacheKey } from "./cache.js";
+import { getClientIp } from "./client-ip.js";
 import {
   checkRateLimit as checkRedisRateLimit,
   maybeRedisConfigured
 } from "../rate-limit-redis.js";
 import { checkRequestOrigin } from "./request-origin.js";
+import { withCors } from "./cors-response.js";
 function checkRateLimit(identifier, limit = 1e3, windowMs = 6e4) {
   const now = Date.now();
   const cacheKey = getCacheKey("rate_limit", identifier);
@@ -40,6 +43,34 @@ function checkRateLimit(identifier, limit = 1e3, windowMs = 6e4) {
     limit
   };
 }
+const apiKeyChecks = /* @__PURE__ */ new WeakMap();
+function apiKeyRateLimitResponse(request, auth) {
+  let result = apiKeyChecks.get(request);
+  if (!result) {
+    result = checkRateLimit(auth.keyId);
+    apiKeyChecks.set(request, result);
+  }
+  if (result.allowed) return null;
+  const retryAfter = Math.ceil((result.resetTime - Date.now()) / 1e3);
+  return NextResponse.json(
+    {
+      success: false,
+      error: "Rate limit exceeded",
+      message: `Too many requests. Limit: ${result.limit} requests per minute`,
+      code: "RATE_LIMIT_EXCEEDED",
+      retryAfter
+    },
+    {
+      status: 429,
+      headers: {
+        "X-RateLimit-Limit": result.limit.toString(),
+        "X-RateLimit-Remaining": "0",
+        "X-RateLimit-Reset": result.resetTime.toString(),
+        "Retry-After": retryAfter.toString()
+      }
+    }
+  );
+}
 async function checkDistributedRateLimit(identifier, type = "api") {
   if (isRateLimitingDisabled()) {
     return { allowed: true, remaining: 999, resetTime: Date.now() + 6e4, limit: 999 };
@@ -152,20 +183,11 @@ function addRateLimitHeaders(response, keyId, scopes) {
 function withRateLimit(handler) {
   return async (request, ...args) => {
     try {
-      const keyId = request.headers.get("x-api-key-id");
-      const scopesHeader = request.headers.get("x-api-scopes");
-      if (!keyId || !scopesHeader) {
+      const auth = presentedApiKey(request.headers) ? await validateApiKey(request) : null;
+      if (!auth) {
         return handler(request, ...args);
       }
-      let scopes = [];
-      try {
-        const parsed = JSON.parse(scopesHeader);
-        if (Array.isArray(parsed)) {
-          scopes = parsed.filter((s) => typeof s === "string");
-        }
-      } catch {
-        console.warn("[RateLimit] Invalid scopes header format");
-      }
+      const { keyId, scopes } = auth;
       const rateLimitResponse = applyRateLimit(request, keyId, scopes);
       if (rateLimitResponse) {
         return rateLimitResponse;
@@ -208,27 +230,6 @@ function getAllRateLimitStats() {
 function getRateLimitCacheStats() {
   return rateLimitCache.getStats();
 }
-function getClientIp(request) {
-  const cfIp = request.headers.get("cf-connecting-ip");
-  if (cfIp) return cfIp;
-  const forwardedFor = request.headers.get("x-forwarded-for");
-  if (forwardedFor) {
-    const ips = forwardedFor.split(",").map((ip) => ip.trim()).filter(Boolean);
-    if (ips.length > 0) return ips[ips.length - 1];
-  }
-  const realIp = request.headers.get("x-real-ip");
-  if (realIp) return realIp;
-  const trueClientIp = request.headers.get("true-client-ip");
-  if (trueClientIp) return trueClientIp;
-  return "unknown";
-}
-function getUserIdentifier(request) {
-  const apiKey = request.headers.get("x-api-key");
-  if (apiKey) {
-    return `apikey:${apiKey.substring(0, 16)}`;
-  }
-  return null;
-}
 let rateLimitDisabledWarningLogged = false;
 function isRateLimitingDisabled() {
   const disabled = process.env.DISABLE_RATE_LIMITING === "true";
@@ -239,28 +240,34 @@ function isRateLimitingDisabled() {
   return disabled;
 }
 function withRateLimitTier(handler, tier = "api") {
-  return async (request, ...args) => {
-    const originRefused = checkRequestOrigin(request);
-    if (originRefused) return originRefused;
+  const limited = async (request, ...args) => {
+    const checked = checkRequestOrigin(request);
+    if (checked instanceof NextResponse) return checked;
+    request = checked;
     if (isRateLimitingDisabled()) {
       return handler(request, ...args);
     }
-    const userIdentifier = getUserIdentifier(request);
-    const clientIp = getClientIp(request);
-    const identifier = userIdentifier ? `${tier}:${userIdentifier}` : `${tier}:ip:${clientIp}`;
+    const identifier = `${tier}:ip:${getClientIp(request.headers)}`;
     const rateLimitResult = await checkDistributedRateLimit(identifier, tier);
     if (!rateLimitResult.allowed) {
       return createRateLimitErrorResponse(rateLimitResult);
     }
     const response = await handler(request, ...args);
-    response.headers.set("X-RateLimit-Limit", rateLimitResult.limit.toString());
-    response.headers.set("X-RateLimit-Remaining", Math.max(0, rateLimitResult.remaining).toString());
-    response.headers.set("X-RateLimit-Reset", rateLimitResult.resetTime.toString());
+    if (response.status !== 429) {
+      response.headers.set("X-RateLimit-Limit", rateLimitResult.limit.toString());
+      response.headers.set("X-RateLimit-Remaining", Math.max(0, rateLimitResult.remaining).toString());
+      response.headers.set("X-RateLimit-Reset", rateLimitResult.resetTime.toString());
+    }
     return response;
   };
+  return async (request, ...args) => {
+    const response = await limited(request, ...args);
+    return tier === "webhook" ? response : withCors(response, request);
+  };
 }
 export {
   addRateLimitHeaders,
+  apiKeyRateLimitResponse,
   applyRateLimit,
   checkDistributedRateLimit,
   checkRateLimit,

package/dist/lib/api/request-origin.d.ts

@@ -5,22 +5,31 @@
  * from an origin the app trusts: its own (NEXT_PUBLIC_APP_URL / BETTER_AUTH_URL)
  * or one in the list Better Auth already trusts for sign-in (see
  * getTrustedOrigins). withRateLimitTier runs it before every handler it wraps.
+ * Under the admin and developer areas (isAppOnlyCorsPath) only the app's own
+ * origin is trusted, plus, outside production, the request's own origin when it
+ * is a private-network address (#170); no other listed origin.
  *
  * What passes without a trusted origin, and why:
  * - Reads (GET/HEAD/OPTIONS).
  * - Requests without the session cookie: there is no session for them to use.
- * - Requests with an `Authorization: Bearer` token or an x-api-key header (API
- *   keys, the mobile client's bearer token). A browser adds those only when the page's script
- *   sets them, and a script on another origin needs CORS approval first.
+ * - Requests that present an API key (`Authorization: Bearer sk_...` or
+ *   x-api-key, in the API-key format). They are let through without their
+ *   session cookie, so the handler can authenticate them only by the key: a key
+ *   that does not validate gets 401, never the cookie's session. Any other
+ *   Authorization value is not a credential here, and the check applies. Handlers
+ *   should read the session from the request they are given, not from
+ *   next/headers.
  * - Requests with neither Origin nor Referer, unless their body is one an HTML
  *   form can send. Browsers send Origin on every write, so these come from
  *   native or server-side clients; requiring a non-form content type keeps
  *   a body without origin information from ever being read as a form post.
  */
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 /**
- * Returns a 403 response when a cookie-authenticated write does not come from a
- * trusted origin, or null when the request may proceed.
+ * Checks a write's origin. Returns a 403 response when a cookie-authenticated
+ * write does not come from a trusted origin. Otherwise returns the request the
+ * handler should get: the same request, or, for a write that would be refused
+ * but presents an API key, a copy without its session cookie.
  */
-export declare function checkRequestOrigin(request: Request): NextResponse | null;
+export declare function checkRequestOrigin(request: NextRequest): NextResponse | NextRequest;
 //# sourceMappingURL=request-origin.d.ts.map

package/dist/lib/api/request-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../../../src/lib/api/request-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA6B1C;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAsBxE"}
+{"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../../../src/lib/api/request-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAgEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,WAAW,CAoBnF"}

package/dist/lib/api/request-origin.js

@@ -1,7 +1,9 @@
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
 import { APP_CONFIG_MERGED } from "../config/index.js";
 import { hasSessionCookie } from "../auth/session-hint.js";
-import { getTrustedOrigins, isOriginAllowed, normalizeOrigin } from "../utils/cors.js";
+import { getTrustedOrigins, isOriginAllowed, isPrivateLanOrigin, normalizeCorsEnvironment, normalizeOrigin } from "../utils/cors.js";
+import { ApiKeyManager, presentedApiKey } from "./keys.js";
+import { appOrigins, isAppOnlyCorsPath, requestPathname } from "./cors-response.js";
 const WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 const FORM_CONTENT_TYPES = /* @__PURE__ */ new Set(["text/plain", "application/x-www-form-urlencoded", "multipart/form-data"]);
 function requestOrigin(headers) {
@@ -15,31 +17,52 @@ function requestOrigin(headers) {
     return "null";
   }
 }
-function hasHeaderCredential(headers) {
-  var _a;
-  if ((_a = headers.get("x-api-key")) == null ? void 0 : _a.trim()) return true;
-  return /^bearer\s+\S/i.test(headers.get("authorization") ?? "");
+const SESSION_COOKIE_NAME = /^(?:__Secure-)?better-auth[.-]/;
+function withoutSessionCookies(request) {
+  const headers = {};
+  request.headers.forEach((value, key) => {
+    headers[key] = value;
+  });
+  const kept = (headers.cookie ?? "").split(";").map((part) => part.trim()).filter((part) => part && !SESSION_COOKIE_NAME.test(part));
+  if (kept.length) headers.cookie = kept.join("; ");
+  else delete headers.cookie;
+  return new NextRequest(request.url, {
+    method: request.method,
+    headers,
+    body: request.body,
+    signal: request.signal,
+    nextConfig: { basePath: request.nextUrl.basePath }
+  });
+}
+function isTrustedWriteOrigin(request, origin) {
+  const path = requestPathname(request);
+  if (path === void 0 || isAppOnlyCorsPath(path)) {
+    const lan = normalizeCorsEnvironment(process.env.NODE_ENV || "development") !== "production" && isPrivateLanOrigin(origin);
+    return lan || appOrigins().includes(origin);
+  }
+  return isOriginAllowed(origin, getTrustedOrigins(APP_CONFIG_MERGED, origin)) !== null;
+}
+function refusal(error, code) {
+  return NextResponse.json({ success: false, error, code }, { status: 403 });
 }
 function checkRequestOrigin(request) {
-  if (!WRITE_METHODS.has(request.method.toUpperCase())) return null;
+  if (!WRITE_METHODS.has(request.method.toUpperCase())) return request;
   const headers = request.headers;
-  if (!hasSessionCookie(headers.get("cookie"))) return null;
-  if (hasHeaderCredential(headers)) return null;
+  if (!hasSessionCookie(headers.get("cookie"))) return request;
+  let refused;
   const origin = requestOrigin(headers);
   if (origin === null) {
     const contentType = (headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
-    if (!FORM_CONTENT_TYPES.has(contentType)) return null;
-    return NextResponse.json(
-      { success: false, error: "This request needs an Origin header", code: "ORIGIN_REQUIRED" },
-      { status: 403 }
-    );
+    if (!FORM_CONTENT_TYPES.has(contentType)) return request;
+    refused = refusal("This request needs an Origin header", "ORIGIN_REQUIRED");
+  } else {
+    const normalized = normalizeOrigin(origin);
+    if (isTrustedWriteOrigin(request, normalized)) return request;
+    refused = refusal("Request origin not allowed", "ORIGIN_NOT_ALLOWED");
   }
-  const normalized = normalizeOrigin(origin);
-  if (isOriginAllowed(normalized, getTrustedOrigins(APP_CONFIG_MERGED, normalized))) return null;
-  return NextResponse.json(
-    { success: false, error: "Request origin not allowed", code: "ORIGIN_NOT_ALLOWED" },
-    { status: 403 }
-  );
+  const apiKey = presentedApiKey(headers);
+  if (apiKey && ApiKeyManager.validateKeyFormat(apiKey)) return withoutSessionCookies(request);
+  return refused;
 }
 export {
   checkRequestOrigin

package/dist/lib/auth/load-login-page.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Leaves for the login page with a full page load, base path included. Sign-out and the dashboard guards use it.
+ *
+ * With Cache Components a client navigation out of the dashboard leaves it mounted, hidden, with its last render
+ * ("signed out"); shown again after the next sign-in, its effects act on that and send the user back to /login. The
+ * login page comes back as the form the last sign-in left. Loading the page drops the React tree, the session store
+ * and the query cache together, whichever way the session ended (this tab's sign-out, another tab's, an expiry).
+ */
+export declare function loadLoginPage(): void;
+//# sourceMappingURL=load-login-page.d.ts.map

package/dist/lib/auth/load-login-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-login-page.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/load-login-page.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC"}

package/dist/lib/auth/load-login-page.js

@@ -0,0 +1,7 @@
+import { withBasePath } from "../base-path.js";
+function loadLoginPage() {
+  window.location.assign(withBasePath("/login"));
+}
+export {
+  loadLoginPage
+};

package/dist/lib/auth/runtime-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-readiness.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/runtime-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAElE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AAEpB,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAA;IAClF,GAAG,CAAC,EAAE,kBAAkB,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,wBAAwB,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAA;IAC/B,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAaD,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAEtG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,2BAAgC,GAAG,IAAI,CAazF;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAYrG;AAiBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE1F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE3F;AAkDD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4E1B;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,CAAC,CAGnB"}
+{"version":3,"file":"runtime-readiness.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/runtime-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AAEpB,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAA;IAClF,GAAG,CAAC,EAAE,kBAAkB,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,wBAAwB,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAA;IAC/B,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAaD,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAEtG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,2BAAgC,GAAG,IAAI,CAgBzF;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAYrG;AAiBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE1F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE3F;AAkDD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4E1B;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,CAAC,CAGnB"}

package/dist/lib/auth/runtime-readiness.js

@@ -1,6 +1,8 @@
 import "server-only";
 import { AUTH_CONFIG } from "../config/index.js";
 import { isPasswordLoginEnabled } from "./auth-methods.js";
+import { warnClientIpSourceAtStartup } from "../api/client-ip.js";
+import { warnSampleAccountsAtStartup } from "./sample-accounts.js";
 import {
   authReadinessConfigurationFromEnv,
   evaluateAuthReadiness
@@ -19,6 +21,8 @@ function getRuntimeAuthReadiness(options = {}) {
   return evaluateAuthReadiness(runtimeInput(options));
 }
 function logAuthReadinessAtStartup(options = {}) {
+  warnClientIpSourceAtStartup(options.env ?? process.env);
+  void warnSampleAccountsAtStartup(options.env ?? process.env);
   try {
     const env = options.env ?? process.env;
     if (env.NODE_ENV !== "production") return;