@nextsparkjs/core 0.1.0-beta.195 → 0.1.0-beta.197

package/dist/lib/api/rate-limit.js

@@ -43,6 +43,34 @@ function checkRateLimit(identifier, limit = 1e3, windowMs = 6e4) {
     limit
   };
 }
+const apiKeyChecks = /* @__PURE__ */ new WeakMap();
+function apiKeyRateLimitResponse(request, auth) {
+  let result = apiKeyChecks.get(request);
+  if (!result) {
+    result = checkRateLimit(auth.keyId);
+    apiKeyChecks.set(request, result);
+  }
+  if (result.allowed) return null;
+  const retryAfter = Math.ceil((result.resetTime - Date.now()) / 1e3);
+  return NextResponse.json(
+    {
+      success: false,
+      error: "Rate limit exceeded",
+      message: `Too many requests. Limit: ${result.limit} requests per minute`,
+      code: "RATE_LIMIT_EXCEEDED",
+      retryAfter
+    },
+    {
+      status: 429,
+      headers: {
+        "X-RateLimit-Limit": result.limit.toString(),
+        "X-RateLimit-Remaining": "0",
+        "X-RateLimit-Reset": result.resetTime.toString(),
+        "Retry-After": retryAfter.toString()
+      }
+    }
+  );
+}
 async function checkDistributedRateLimit(identifier, type = "api") {
   if (isRateLimitingDisabled()) {
     return { allowed: true, remaining: 999, resetTime: Date.now() + 6e4, limit: 999 };
@@ -225,9 +253,11 @@ function withRateLimitTier(handler, tier = "api") {
       return createRateLimitErrorResponse(rateLimitResult);
     }
     const response = await handler(request, ...args);
-    response.headers.set("X-RateLimit-Limit", rateLimitResult.limit.toString());
-    response.headers.set("X-RateLimit-Remaining", Math.max(0, rateLimitResult.remaining).toString());
-    response.headers.set("X-RateLimit-Reset", rateLimitResult.resetTime.toString());
+    if (response.status !== 429) {
+      response.headers.set("X-RateLimit-Limit", rateLimitResult.limit.toString());
+      response.headers.set("X-RateLimit-Remaining", Math.max(0, rateLimitResult.remaining).toString());
+      response.headers.set("X-RateLimit-Reset", rateLimitResult.resetTime.toString());
+    }
     return response;
   };
   return async (request, ...args) => {
@@ -237,6 +267,7 @@ function withRateLimitTier(handler, tier = "api") {
 }
 export {
   addRateLimitHeaders,
+  apiKeyRateLimitResponse,
   applyRateLimit,
   checkDistributedRateLimit,
   checkRateLimit,

package/dist/lib/api/request-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../../../src/lib/api/request-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA+DvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,WAAW,CAoBnF"}
+{"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../../../src/lib/api/request-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAgEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,WAAW,CAoBnF"}

package/dist/lib/api/request-origin.js

@@ -36,7 +36,7 @@ function withoutSessionCookies(request) {
 }
 function isTrustedWriteOrigin(request, origin) {
   const path = requestPathname(request);
-  if (path !== void 0 && isAppOnlyCorsPath(path)) {
+  if (path === void 0 || isAppOnlyCorsPath(path)) {
     const lan = normalizeCorsEnvironment(process.env.NODE_ENV || "development") !== "production" && isPrivateLanOrigin(origin);
     return lan || appOrigins().includes(origin);
   }

package/dist/lib/auth/auth-methods.d.ts

@@ -46,7 +46,10 @@ export declare function getPrimaryEmailMethod(methods: readonly AuthLoginMethod[
 export declare function matchAuthPreset(methods: readonly AuthLoginMethod[]): AuthPreset | null;
 /**
  * Server-side: should Better Auth's email + password endpoints be enabled?
- * Defaults to true regardless of the UI preset (see `AuthConfig.emailAndPassword`).
+ * An explicit `emailAndPassword.enabled` decides. Otherwise they are on when
+ * `methods` lists `'email-password'`, and outside production (so the dev
+ * keyring, `db:seed` users and Cypress sign in with a password); a production
+ * app on the passwordless preset serves no password endpoint.
  */
-export declare function isPasswordLoginEnabled(authConfig?: Pick<AuthConfig, 'emailAndPassword'> | null): boolean;
+export declare function isPasswordLoginEnabled(authConfig?: Pick<AuthConfig, 'methods' | 'emailAndPassword'> | null, nodeEnv?: string | undefined): boolean;
 //# sourceMappingURL=auth-methods.d.ts.map

package/dist/lib/auth/auth-methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-methods.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE9E,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAA8C,CAAA;AAEvG,uEAAuE;AACvE,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC,CAKjF,CAAA;AAED,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,EAAE,SAAS,eAAe,EAA8B,CAAA;AAEzF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,GAChF,eAAe,EAAE,CAkBnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAEzG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,eAAe,EAAE,GAClC,OAAO,CAAC,eAAe,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,IAAI,CAKjE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,UAAU,GAAG,IAAI,CAMtF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,GAAG,IAAI,GACvD,OAAO,CAET"}
+{"version":3,"file":"auth-methods.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE9E,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAA8C,CAAA;AAEvG,uEAAuE;AACvE,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC,CAKjF,CAAA;AAED,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,EAAE,SAAS,eAAe,EAA8B,CAAA;AAEzF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,GAChF,eAAe,EAAE,CAkBnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAEzG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,eAAe,EAAE,GAClC,OAAO,CAAC,eAAe,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,IAAI,CAKjE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,UAAU,GAAG,IAAI,CAMtF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,kBAAkB,CAAC,GAAG,IAAI,EACpE,OAAO,GAAE,MAAM,GAAG,SAAgC,GACjD,OAAO,CAIT"}

package/dist/lib/auth/auth-methods.js

@@ -45,9 +45,11 @@ function matchAuthPreset(methods) {
   }
   return null;
 }
-function isPasswordLoginEnabled(authConfig) {
+function isPasswordLoginEnabled(authConfig, nodeEnv = process.env.NODE_ENV) {
   var _a;
-  return ((_a = authConfig == null ? void 0 : authConfig.emailAndPassword) == null ? void 0 : _a.enabled) !== false;
+  const declared = (_a = authConfig == null ? void 0 : authConfig.emailAndPassword) == null ? void 0 : _a.enabled;
+  if (typeof declared === "boolean") return declared;
+  return ((authConfig == null ? void 0 : authConfig.methods) ?? []).includes("email-password") || nodeEnv !== "production";
 }
 export {
   AUTH_LOGIN_METHODS,

package/dist/lib/auth/authorization-session.d.ts

@@ -0,0 +1,14 @@
+import { type TypedSession } from '../auth';
+/**
+ * The request's session as the database has it now, for authorization reads: the API entry points (dual-auth,
+ * `validateAndAuthenticateRequest`), the /api/user routes, the server actions, generateEntityAPI, the /superadmin and
+ * /devtools API and page checks, and the proxy template's gate.
+ *
+ * Better Auth's cookie cache (`session.cookieCache`, on by default for 5 minutes) answers `getSession` from the
+ * signed `session_data` cookie without reading the database, so a signed-out or revoked session, or a role changed
+ * since sign-in, would keep its old answer until that cookie expires. `disableCookieCache` reads the session and its
+ * user from the database instead (one query). Reads that only display data keep the cache. A suspended account's
+ * session is no session (lib/auth/suspension.ts).
+ */
+export declare function getAuthorizationSession(headers: Headers): Promise<TypedSession | null>;
+//# sourceMappingURL=authorization-session.d.ts.map

package/dist/lib/auth/authorization-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-session.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/authorization-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,YAAY,EAAE,MAAM,SAAS,CAAA;AAGjD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAG5F"}

package/dist/lib/auth/authorization-session.js

@@ -0,0 +1,10 @@
+import { auth } from "../auth.js";
+import { isSuspendedRole } from "./suspension.js";
+async function getAuthorizationSession(headers) {
+  var _a;
+  const session = await auth.api.getSession({ headers, query: { disableCookieCache: true } });
+  return session && !isSuspendedRole((_a = session.user) == null ? void 0 : _a.role) ? session : null;
+}
+export {
+  getAuthorizationSession
+};

package/dist/lib/auth/request-session.d.ts

@@ -1,6 +1,11 @@
 import { type TypedSession } from '../auth';
 /** The request's verified session, or null; one lookup per request however many callers ask. */
 export declare const getRequestSession: () => Promise<TypedSession | null>;
+/**
+ * The same, read from the database instead of better-auth's cookie cache, once per request: the /superadmin and
+ * /devtools checks use it, so a sign-out or a role change counts at once (lib/auth/authorization-session.ts).
+ */
+export declare const getAuthorizationRequestSession: () => Promise<TypedSession | null>;
 /** The team the session chose (the activeTeamId cookie, only when this session wrote it), or null. */
 export declare function getSessionActiveTeamId(session: TypedSession): Promise<string | null>;
 /**

package/dist/lib/auth/request-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-session.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/request-session.ts"],"names":[],"mappings":"AAWA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,SAAS,CAAA;AAI5D,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,QAAmB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAsC,CAAA;AAElH,sGAAsG;AACtG,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE1F;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAK/G"}
+{"version":3,"file":"request-session.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/request-session.ts"],"names":[],"mappings":"AAWA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,SAAS,CAAA;AAK5D,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,QAAmB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAsC,CAAA;AAElH;;;GAGG;AACH,eAAO,MAAM,8BAA8B,QAAmB,OAAO,CAAC,YAAY,GAAG,IAAI,CAA8C,CAAA;AAEvI,sGAAsG;AACtG,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE1F;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAK/G"}

package/dist/lib/auth/request-session.js

@@ -1,9 +1,11 @@
 import { cache } from "react";
 import { cookies, headers } from "next/headers";
 import { getTypedSession } from "../auth.js";
+import { getAuthorizationSession } from "./authorization-session.js";
 import { ACTIVE_TEAM_COOKIE, activeTeamIdForSession } from "../teams/active-team-cookie.js";
 import { getDashboardTeamId } from "../teams/dashboard-team.js";
 const getRequestSession = cache(async () => getTypedSession(await headers()));
+const getAuthorizationRequestSession = cache(async () => getAuthorizationSession(await headers()));
 async function getSessionActiveTeamId(session) {
   var _a, _b;
   return activeTeamIdForSession((_a = (await cookies()).get(ACTIVE_TEAM_COOKIE)) == null ? void 0 : _a.value, (_b = session.session) == null ? void 0 : _b.id);
@@ -16,6 +18,7 @@ async function getDashboardPermissionContext() {
   return { userId, teamId: await getDashboardTeamId(userId, await getSessionActiveTeamId(session)) };
 }
 export {
+  getAuthorizationRequestSession,
   getDashboardPermissionContext,
   getRequestSession,
   getSessionActiveTeamId

package/dist/lib/auth/runtime-readiness.d.ts

@@ -8,12 +8,15 @@ export interface RuntimeAuthReadinessOptions {
 }
 /**
  * Server-derived flows that do not follow the login UI intent (`auth.methods`).
- * The password backend (`auth.emailAndPassword.enabled`) stays on under the
- * passwordless preset, so invitation registration and password recovery must
- * not be inferred from `availableMethods`.
+ * The password backend (`isPasswordLoginEnabled`) can be on without
+ * `'email-password'` in `methods` (outside production, or declared), so
+ * invitation registration and password recovery are not inferred from
+ * `availableMethods`.
  */
 export interface PublicAuthCapabilities {
-    /** `/api/v1/auth/signup-with-invite` accepts a password (backend switch only). */
+    /** `/api/v1/auth/signup-with-invite` creates the invited account: always, with or without a password. */
+    invitationSignup: boolean;
+    /** `/api/v1/auth/signup-with-invite` takes a password (backend switch only); otherwise the account signs in by code. */
     invitationPasswordSignup: boolean;
     /** `/request-password-reset` can run: password backend + usable email delivery. */
     passwordRecovery: boolean;

package/dist/lib/auth/runtime-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-readiness.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/runtime-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGlE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AAEpB,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAA;IAClF,GAAG,CAAC,EAAE,kBAAkB,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,wBAAwB,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAA;IAC/B,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAaD,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAEtG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,2BAAgC,GAAG,IAAI,CAezF;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAYrG;AAiBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE1F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE3F;AAkDD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4E1B;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,CAAC,CAGnB"}
+{"version":3,"file":"runtime-readiness.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/runtime-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AAEpB,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAA;IAClF,GAAG,CAAC,EAAE,kBAAkB,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,yGAAyG;IACzG,gBAAgB,EAAE,OAAO,CAAA;IACzB,wHAAwH;IACxH,wBAAwB,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAA;IAC/B,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAaD,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAEtG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,2BAAgC,GAAG,IAAI,CAgBzF;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,2BAAgC,GAAG,mBAAmB,CAarG;AAiBD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE1F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAE3F;AAmDD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4E1B;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,QAAQ,CAAC,CAGnB"}

package/dist/lib/auth/runtime-readiness.js

@@ -2,6 +2,7 @@ import "server-only";
 import { AUTH_CONFIG } from "../config/index.js";
 import { isPasswordLoginEnabled } from "./auth-methods.js";
 import { warnClientIpSourceAtStartup } from "../api/client-ip.js";
+import { warnSampleAccountsAtStartup } from "./sample-accounts.js";
 import {
   authReadinessConfigurationFromEnv,
   evaluateAuthReadiness
@@ -21,6 +22,7 @@ function getRuntimeAuthReadiness(options = {}) {
 }
 function logAuthReadinessAtStartup(options = {}) {
   warnClientIpSourceAtStartup(options.env ?? process.env);
+  void warnSampleAccountsAtStartup(options.env ?? process.env);
   try {
     const env = options.env ?? process.env;
     if (env.NODE_ENV !== "production") return;
@@ -37,11 +39,12 @@ function logAuthReadinessAtStartup(options = {}) {
 function getPublicAuthReadiness(options = {}) {
   const result = getRuntimeAuthReadiness(options);
   const authConfig = options.authConfig === void 0 ? AUTH_CONFIG : options.authConfig;
-  const passwordBackend = isPasswordLoginEnabled(authConfig);
+  const passwordBackend = isPasswordLoginEnabled(authConfig, (options.env ?? process.env).NODE_ENV);
   return {
     status: result.outcome === "ready" ? "ready" : "unavailable",
     availableMethods: result.availableMethods,
     capabilities: {
+      invitationSignup: true,
       invitationPasswordSignup: passwordBackend,
       passwordRecovery: passwordBackend && isRuntimeEmailAvailable(options)
     }
@@ -68,7 +71,7 @@ function authRoutePath(pathname) {
   const marker = "/api/auth";
   const index = pathname.lastIndexOf(marker);
   if (index === -1) return null;
-  const suffix = pathname.slice(index + marker.length);
+  const suffix = pathname.slice(index + marker.length).replace(/\/+$/, "");
   return suffix || "/";
 }
 function jsonResponse(body, status = 200) {
@@ -103,7 +106,7 @@ async function requestedSocialProvider(request) {
   }
 }
 async function getAuthReadinessResponse(request, options = {}) {
-  var _a, _b, _c;
+  var _a, _b;
   const pathname = new URL(request.url).pathname;
   const route = authRoutePath(pathname);
   if (!route) return null;
@@ -138,10 +141,10 @@ async function getAuthReadinessResponse(request, options = {}) {
       return unavailableResponse(method, diagnostics, pathname);
     }
   }
-  if (isPasswordOperation && ((_a = authConfig == null ? void 0 : authConfig.emailAndPassword) == null ? void 0 : _a.enabled) === false) {
+  if (isPasswordOperation && !isPasswordLoginEnabled(authConfig, (options.env ?? process.env).NODE_ENV)) {
     return unavailableResponse("email-password", [{
       code: "EMAIL_PASSWORD_POLICY_DISABLED",
-      message: "Password authentication is disabled by auth.emailAndPassword.enabled."
+      message: "Password authentication is off: auth.methods has no email-password and auth.emailAndPassword.enabled is not true."
     }], pathname);
   }
   if (isPasswordEmailDeliveryOperation || isGeneralEmailDeliveryOperation) {
@@ -158,7 +161,7 @@ async function getAuthReadinessResponse(request, options = {}) {
     method = "google";
     const readiness = evaluateProvider("google", options);
     diagnostics = readiness.diagnostics;
-    if (((_c = (_b = authConfig == null ? void 0 : authConfig.providers) == null ? void 0 : _b.google) == null ? void 0 : _c.enabled) === false) {
+    if (((_b = (_a = authConfig == null ? void 0 : authConfig.providers) == null ? void 0 : _a.google) == null ? void 0 : _b.enabled) === false) {
       return unavailableResponse(method, [{
         code: "GOOGLE_POLICY_DISABLED",
         message: "Google authentication is disabled by auth.providers.google.enabled."

package/dist/lib/auth/sample-accounts.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The password hashes the sample data ships with (core's 090_sample_data.sql and
+ * the project templates' sample data). A "credential" account that still holds
+ * one of them can be signed in to with a documented password.
+ * Keep in sync with migrations/029_sample_accounts_outside_development.sql.
+ */
+export declare const SAMPLE_PASSWORD_HASHES: readonly ["22de14d5472248ed0bece911df908b2a:d29576424798ba6845d348a3767c0b0f38a00f2aca461b3b1d34b99a93cab06c86774c6edb183e6d6ec47457649b032a49a7b60a48f6f4f7fbbc4ea40258f19f", "3db9e98e2b4d3caca97fdf2783791cbc:34b293de615caf277a237773208858e960ea8aa10f1f5c5c309b632f192cac34d52ceafbd338385616f4929e4b1b6c055b67429c6722ffdb80b01d9bf4764866"];
+type QueryRows = (text: string, params?: unknown[]) => Promise<Array<{
+    count: number;
+}>>;
+/**
+ * In production, logs one warning when accounts with a sample password exist.
+ * Never throws. When the query fails it logs one line with the error code or class name only
+ * (never the error object, which can carry the connection string).
+ */
+export declare function warnSampleAccountsAtStartup(env?: Record<string, string | undefined>, queryRows?: QueryRows): Promise<void>;
+export {};
+//# sourceMappingURL=sample-accounts.d.ts.map

package/dist/lib/auth/sample-accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sample-accounts.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/sample-accounts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,qVAGzB,CAAA;AAEV,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAA;AAExF;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/lib/auth/sample-accounts.js

@@ -0,0 +1,25 @@
+const SAMPLE_PASSWORD_HASHES = [
+  "22de14d5472248ed0bece911df908b2a:d29576424798ba6845d348a3767c0b0f38a00f2aca461b3b1d34b99a93cab06c86774c6edb183e6d6ec47457649b032a49a7b60a48f6f4f7fbbc4ea40258f19f",
+  "3db9e98e2b4d3caca97fdf2783791cbc:34b293de615caf277a237773208858e960ea8aa10f1f5c5c309b632f192cac34d52ceafbd338385616f4929e4b1b6c055b67429c6722ffdb80b01d9bf4764866"
+];
+async function warnSampleAccountsAtStartup(env = process.env, queryRows) {
+  if (env.NODE_ENV !== "production") return;
+  try {
+    const run = queryRows ?? (await import("../db.js")).queryRows;
+    const [row] = await run(
+      `SELECT count(*)::int AS count FROM "account" WHERE "providerId" = 'credential' AND "password" = ANY($1)`,
+      [SAMPLE_PASSWORD_HASHES]
+    );
+    if (row && row.count > 0) {
+      console.warn(`[auth-readiness] ${row.count} account(s) still have a sample-data password; pnpm db:migrate disables them once; if it already ran, see the CHANGELOG upgrade notes`);
+    }
+  } catch (error) {
+    const safe = (value) => typeof value === "string" && /^[A-Za-z0-9_]{1,40}$/.test(value) ? value : void 0;
+    const reason = safe(error == null ? void 0 : error.code) ?? safe(error == null ? void 0 : error.name) ?? "unknown error";
+    console.warn(`[auth-readiness] could not check for sample-data passwords at startup (query failed: ${reason}); check DATABASE_URL, then run the read-only query in the 0.1.0-beta.196 CHANGELOG upgrade notes`);
+  }
+}
+export {
+  SAMPLE_PASSWORD_HASHES,
+  warnSampleAccountsAtStartup
+};

package/dist/lib/auth/suspension.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A suspended account: `users.role = 'suspended'` (allowed by `check_users_role` since migration 031). It gets no new
+ * session (the session create hook in lib/auth.ts), and its existing session and its API keys are refused where core
+ * authenticates: dual-auth, `validateAndAuthenticateRequest`, getAuthorizationSession, validateApiKey and the proxy
+ * template.
+ */
+export declare const SUSPENDED_ROLE = "suspended";
+export declare function isSuspendedRole(role: unknown): boolean;
+/**
+ * Suspends `userId` in one statement: sets the role, deletes the user's sessions and deactivates their active API keys
+ * (`status = 'inactive'`, so the audit log keeps the rows; unsuspending does not bring them back). A superadmin is never
+ * suspended. Returns null when no user was suspended (unknown id, or a superadmin).
+ */
+export declare function suspendUser(userId: string, actorId: string): Promise<{
+    sessions: number;
+    apiKeys: number;
+} | null>;
+/** Gives a suspended user back the `member` role. Their deactivated API keys stay deactivated. Null if not suspended. */
+export declare function unsuspendUser(userId: string, actorId: string): Promise<{
+    id: string;
+} | null>;
+//# sourceMappingURL=suspension.d.ts.map

package/dist/lib/auth/suspension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suspension.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/suspension.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,cAAc,cAAc,CAAA;AAEzC,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAuBxH;AAED,yHAAyH;AACzH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAOnG"}

package/dist/lib/auth/suspension.js

@@ -0,0 +1,43 @@
+import { queryWithRLS } from "../db.js";
+import { invalidateApiKeyCache } from "../api/auth.js";
+const SUSPENDED_ROLE = "suspended";
+function isSuspendedRole(role) {
+  return role === SUSPENDED_ROLE;
+}
+async function suspendUser(userId, actorId) {
+  const [result] = await queryWithRLS(
+    `WITH suspended AS (
+       UPDATE "users" SET role = '${SUSPENDED_ROLE}', "updatedAt" = NOW()
+       WHERE id = $1 AND role <> 'superadmin'
+       RETURNING id
+     ), sessions AS (
+       DELETE FROM "session" WHERE "userId" IN (SELECT id FROM suspended) RETURNING id
+     ), keys AS (
+       UPDATE "api_key" SET status = 'inactive'
+       WHERE "userId" IN (SELECT id FROM suspended) AND status = 'active'
+       RETURNING "keyHash"
+     )
+     SELECT (SELECT COUNT(*) FROM suspended)::int AS suspended,
+            (SELECT COUNT(*) FROM sessions)::int AS sessions,
+            COALESCE((SELECT json_agg("keyHash") FROM keys), '[]'::json) AS "keyHashes"`,
+    [userId],
+    actorId
+  );
+  if (!(result == null ? void 0 : result.suspended)) return null;
+  for (const keyHash of result.keyHashes) invalidateApiKeyCache(keyHash);
+  return { sessions: result.sessions, apiKeys: result.keyHashes.length };
+}
+async function unsuspendUser(userId, actorId) {
+  const [row] = await queryWithRLS(
+    `UPDATE "users" SET role = 'member', "updatedAt" = NOW() WHERE id = $1 AND role = '${SUSPENDED_ROLE}' RETURNING id`,
+    [userId],
+    actorId
+  );
+  return row ?? null;
+}
+export {
+  SUSPENDED_ROLE,
+  isSuspendedRole,
+  suspendUser,
+  unsuspendUser
+};

package/dist/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAUA,OAAO,EAA0F,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAmBjI;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuHD,eAAO,MAAM,IAAI,qEAiXf,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,EAAE,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAWA,OAAO,EAA0F,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAmBjI;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyHD,eAAO,MAAM,IAAI,qEAsXf,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,EAAE,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}

package/dist/lib/auth.js

@@ -1,5 +1,5 @@
-import { betterAuth } from "better-auth";
-import { Pool } from "pg";
+import { betterAuth, APIError } from "better-auth";
+import { createPool } from "./db-pool.js";
 import { nextCookies } from "better-auth/next-js";
 import { emailOTP } from "better-auth/plugins";
 import { parseSSLConfig, stripSSLParams, queryOne } from "./db.js";
@@ -42,13 +42,13 @@ const databaseUrl = process.env.DATABASE_SERVICE_URL || process.env.DATABASE_URL
 const cleanUrl = stripSSLParams(databaseUrl);
 const isPoolerUrl = /:6543(\/|$|\?)/.test(databaseUrl) || /pooler/i.test(databaseUrl);
 const connectionString = isPoolerUrl ? cleanUrl.includes("?") ? `${cleanUrl}&pgbouncer=true` : `${cleanUrl}?pgbouncer=true` : cleanUrl;
-const pool = new Pool({
+const AUTH_POOLS = /* @__PURE__ */ Symbol.for("nextspark.auth.pools");
+const authPools = globalThis[AUTH_POOLS] ??= /* @__PURE__ */ new Map();
+const pool = authPools.get(databaseUrl) ?? createPool("auth", {
   connectionString,
-  ssl: parseSSLConfig(databaseUrl),
-  connectionTimeoutMillis: 1e4,
-  idleTimeoutMillis: 3e4,
-  max: 20
+  ssl: parseSSLConfig(databaseUrl)
 });
+authPools.set(databaseUrl, pool);
 const sessionConfig = resolveSessionConfig(AUTH_CONFIG);
 const otpConfig = resolveOtpConfig(AUTH_CONFIG);
 function resolveNonOwnerSignupRole() {
@@ -137,10 +137,9 @@ const auth = betterAuth({
     }
   },
   emailAndPassword: {
-    // Enabled by default even under the passwordless preset (AUTH_CONFIG.methods
-    // only shapes the login UI) so password accounts, seeded test users and
-    // API logins keep working. A theme hard-disables it with
-    // `auth.emailAndPassword.enabled: false`.
+    // On when AUTH_CONFIG.methods lists 'email-password', and outside production
+    // (seeded test users, the dev keyring). A production passwordless app opts
+    // in with `auth.emailAndPassword.enabled: true` (API logins, test users).
     enabled: isPasswordLoginEnabled(AUTH_CONFIG),
     requireEmailVerification: true,
     minPasswordLength: 8,
@@ -277,7 +276,7 @@ const auth = betterAuth({
           if (registrationMode === "domain-restricted" || registrationMode === "domain-open") {
             const allowedDomains = ((_d = (_c = AUTH_CONFIG) == null ? void 0 : _c.registration) == null ? void 0 : _d.allowedDomains) ?? [];
             if (allowedDomains.length > 0 && !isDomainAllowed(user.email, allowedDomains)) {
-              console.log(`[Auth] Blocked registration for ${user.email}: domain not in allowedDomains (allowed: ${allowedDomains.join(", ")})`);
+              console.log(`[Auth] Blocked registration for a user at ${user.email.split("@").pop()}: domain not in allowedDomains (allowed: ${allowedDomains.join(", ")})`);
               throw new Error(`DOMAIN_NOT_ALLOWED: Email domain not authorized. Please use an email from: ${allowedDomains.join(", ")}`);
             }
           }
@@ -333,18 +332,22 @@ const auth = betterAuth({
         // Enforce domain restrictions on EVERY login (not just signup)
         // @ts-expect-error — pre-existing type error, tracked in https://github.com/NextSpark-js/nextspark/issues/131
         before: async (session) => {
-          var _a, _b, _c, _d, _e;
-          const registrationMode = ((_b = (_a = AUTH_CONFIG) == null ? void 0 : _a.registration) == null ? void 0 : _b.mode) ?? "open";
+          var _a, _b, _c, _d, _e, _f;
+          const owner = await pool.query("SELECT role FROM users WHERE id = $1 LIMIT 1", [session.userId]);
+          if (((_a = owner.rows[0]) == null ? void 0 : _a.role) === "suspended") {
+            throw new APIError("FORBIDDEN", { message: "This account is suspended", code: "ACCOUNT_SUSPENDED" });
+          }
+          const registrationMode = ((_c = (_b = AUTH_CONFIG) == null ? void 0 : _b.registration) == null ? void 0 : _c.mode) ?? "open";
           if (registrationMode === "domain-restricted" || registrationMode === "domain-open") {
-            const allowedDomains = ((_d = (_c = AUTH_CONFIG) == null ? void 0 : _c.registration) == null ? void 0 : _d.allowedDomains) ?? [];
+            const allowedDomains = ((_e = (_d = AUTH_CONFIG) == null ? void 0 : _d.registration) == null ? void 0 : _e.allowedDomains) ?? [];
             if (allowedDomains.length > 0) {
               const result = await pool.query(
                 "SELECT email FROM users WHERE id = $1 LIMIT 1",
                 [session.userId]
               );
-              const email = (_e = result.rows[0]) == null ? void 0 : _e.email;
+              const email = (_f = result.rows[0]) == null ? void 0 : _f.email;
               if (email && !isDomainAllowed(email, allowedDomains)) {
-                console.log(`[Auth] Blocked sign-in for ${email}: domain not in allowedDomains`);
+                console.log(`[Auth] Blocked sign-in for a user at ${email.split("@").pop()}: domain not in allowedDomains`);
                 return false;
               }
             }

package/dist/lib/cache/public-entity-cache.d.ts

@@ -0,0 +1,21 @@
+import type { EntityConfig } from '../entities/types';
+/**
+ * The public pages of an entity are cached (`'use cache'` tagged `entity:<slug>` in public-item-route.cc; ISR
+ * `revalidate` in the other host), so a write has to expire them. Every writer of an entity ends here: the
+ * generic REST handler, the entity handler, GenericEntityService and the server actions reach it through the
+ * `afterEntity*` hooks (entity-hooks.ts), and the one write that skips hooks (`deleteMany`) calls it itself.
+ *
+ * - Cache Components: `entity:<slug>` is on every cached read of the entity's items (found or not found), so
+ *   one tag covers the old and the new slug of a rename, an unpublished item and a deleted one. It also
+ *   drops the sibling items' entries; they are read again by their next visit.
+ * - ISR: Next tags a page by its route file path, route group included, so the path is `/(public)<basePath>` with
+ *   'layout' (item pages and archive of a base path) or the root item route with 'page'. `(public)` is the group the
+ *   host generator puts those routes in (scripts/build/registry/host/entity-routes.mjs); a test keeps them equal.
+ * - Patterns are tagged `patterns` and are expired by their own writes.
+ *
+ * Outside a request (a script, a test) Next refuses the call; there is no cache to expire there.
+ */
+/** Route group of the generated public routes. Keep equal to the one in scripts/build/registry/host/entity-routes.mjs. */
+export declare const PUBLIC_ROUTE_GROUP = "(public)";
+export declare function expirePublicEntity(config: Pick<EntityConfig, 'slug' | 'access' | 'builder'> | undefined): void;
+//# sourceMappingURL=public-entity-cache.d.ts.map

package/dist/lib/cache/public-entity-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-entity-cache.d.ts","sourceRoot":"","sources":["../../../src/lib/cache/public-entity-cache.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIrD;;;;;;;;;;;;;;;GAeG;AACH,0HAA0H;AAC1H,eAAO,MAAM,kBAAkB,aAAa,CAAA;AAE5C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,CAe9G"}

package/dist/lib/cache/public-entity-cache.js

@@ -0,0 +1,25 @@
+import { revalidatePath } from "next/cache";
+import { unstable_rethrow } from "next/navigation";
+import { getEntityBasePath } from "../entities/schema-generator.js";
+import { revalidateTag } from "./revalidate-tag.js";
+const PUBLIC_ROUTE_GROUP = "(public)";
+function expirePublicEntity(config) {
+  var _a;
+  if (!config) return;
+  try {
+    if (config.slug === "patterns") revalidateTag("patterns");
+    const basePath = getEntityBasePath(config);
+    if (!basePath) return;
+    revalidateTag(`entity:${config.slug}`);
+    const group = `/${PUBLIC_ROUTE_GROUP}`;
+    if (basePath === "/") revalidatePath(`${group}${((_a = config.access) == null ? void 0 : _a.allowNestedSlugs) ? "/[...slug]" : "/[slug]"}`, "page");
+    else revalidatePath(`${group}${basePath}`, "layout");
+  } catch (error) {
+    unstable_rethrow(error);
+    console.warn(`[public-entity-cache] could not expire the public pages of ${config.slug}: ${error instanceof Error ? error.message : error}`);
+  }
+}
+export {
+  PUBLIC_ROUTE_GROUP,
+  expirePublicEntity
+};

package/dist/lib/config/app.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.config.d.ts","sourceRoot":"","sources":["../../../src/lib/config/app.config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,SAAS,CAAA;AAOzD,eAAO,MAAM,kBAAkB,EAAE,SA8gBhC,CAAA"}
+{"version":3,"file":"app.config.d.ts","sourceRoot":"","sources":["../../../src/lib/config/app.config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,SAAS,CAAA;AAOzD,eAAO,MAAM,kBAAkB,EAAE,SA6gBhC,CAAA"}

package/dist/lib/config/app.config.js

@@ -337,14 +337,13 @@ const DEFAULT_APP_CONFIG = {
      */
     methods: ["email-otp", "google"],
     /**
-     * Better Auth's email + password endpoints stay enabled by default (even
-     * under the passwordless preset) so password accounts, seeded test users
-     * and API-based logins keep working. Set `enabled: false` in a theme to
-     * hard-disable password auth server-side.
+     * Better Auth's email + password endpoints. Left undeclared, they follow
+     * `methods`: on when it lists 'email-password', and always outside
+     * production (seeded test users, the dev keyring). Set `enabled: true` to
+     * keep password logins (API clients, test users) in a passwordless
+     * production app, or `false` to turn them off everywhere.
      */
-    emailAndPassword: {
-      enabled: true
-    },
+    emailAndPassword: {},
     /**
      * Whether Better Auth automatically sends the verification email on signup.
      *

package/dist/lib/config/types.d.ts

@@ -532,18 +532,20 @@ export interface AuthConfig {
      * auth: { methods: ['email-otp', 'email-password', 'google'] } // both, OTP first
      * ```
      *
-     * This only shapes the UI and the signup page. Better Auth's password
-     * endpoints stay enabled unless `emailAndPassword.enabled` is set to false.
+     * This shapes the UI and the signup page, and decides whether Better Auth's
+     * password endpoints run in production (see `emailAndPassword`).
      */
     methods?: AuthLoginMethod[];
     /**
      * Server-side switch for Better Auth's email + password endpoints
      * (`sign-in/email`, `sign-up/email`, forget/reset/change-password).
      *
-     * Default: `true` — even under the passwordless preset — so existing
-     * password accounts, seeded test users and API-based logins keep working
-     * when a theme only changes the login UI. Set `{ enabled: false }` to
-     * hard-disable password auth for a strictly passwordless app.
+     * Default (undeclared): on when `methods` lists `'email-password'`, and
+     * outside production (`NODE_ENV !== 'production'`) so the dev keyring,
+     * `db:seed` users and Cypress can sign in with a password. A production app
+     * on the passwordless preset serves no password endpoint. Set
+     * `{ enabled: true }` to keep password logins (API clients, test users) in
+     * production, or `{ enabled: false }` to turn them off everywhere.
      */
     emailAndPassword?: {
         enabled?: boolean;