@nextsparkjs/core 0.1.0-beta.195 → 0.1.0-beta.197

package/dist/routes/api/devtools/tests/[...path]/route.js

@@ -1,4 +1,4 @@
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { NextResponse } from "next/server";
 import { readFile, stat } from "fs/promises";
 import { join } from "path";
@@ -7,7 +7,7 @@ import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 export const GET = withRateLimitTier(async (request, { params }) => {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user) || session.user.role !== "developer") {
       return NextResponse.json(
         {

package/dist/routes/api/devtools/tests/route.js

@@ -1,4 +1,4 @@
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { NextResponse } from "next/server";
 import { readdir, stat } from "fs/promises";
 import { join } from "path";
@@ -35,7 +35,7 @@ async function buildFileTree(dirPath, basePath) {
 }
 export const GET = withRateLimitTier(async (request) => {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user) || session.user.role !== "developer") {
       return NextResponse.json(
         {

package/dist/routes/api/mcp/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/mcp/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAOvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAoIvE,eAAO,MAAM,IAAI,iDAA0C,CAAA;AAE3D,wBAAsB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,CAKjD;AAED,wBAAsB,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,CAKpD;AAED,eAAO,MAAM,OAAO,sBAAgB,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/mcp/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAOvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AA2IvE,eAAO,MAAM,IAAI,iDAA0C,CAAA;AAE3D,wBAAsB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,CAKjD;AAED,wBAAsB,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,CAKpD;AAED,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/mcp/route.js

@@ -7,7 +7,7 @@ import { validateApiKey } from "@nextsparkjs/core/lib/api/auth";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 import { setEntityRegistry } from "@nextsparkjs/core/lib/entities/queries";
-import { createMcpEngine } from "@nextsparkjs/core/lib/mcp";
+import { createMcpEngine, RATE_LIMIT_MESSAGE } from "@nextsparkjs/core/lib/mcp";
 import { ENTITY_REGISTRY, ENTITY_METADATA } from "@nextsparkjs/registries/entity-registry";
 import { MCP_OVERRIDES } from "@nextsparkjs/registries/mcp-registry";
 import { API_PRESETS_REGISTRY } from "@nextsparkjs/registries/api-presets-registry";
@@ -56,6 +56,12 @@ async function handleMcpPost(request) {
     return jsonRpcError(403, -32e3, "Origin not allowed");
   }
   const authResult = await authenticateRequest(request, { allowAnyScope: true });
+  if (authResult.rateLimitResponse) {
+    const limited = jsonRpcError(429, -32e3, RATE_LIMIT_MESSAGE);
+    const retryAfter = authResult.rateLimitResponse.headers.get("Retry-After");
+    if (retryAfter) limited.headers.set("Retry-After", retryAfter);
+    return limited;
+  }
   if (!authResult.success || authResult.type !== "api-key" || !authResult.user) {
     return jsonRpcError(401, -32001, API_KEY_HELP);
   }

package/dist/routes/api/superadmin/subscriptions/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { queryWithRLS } from "@nextsparkjs/core/lib/db";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
@@ -7,7 +7,7 @@ import { getBillingGateway } from "@nextsparkjs/core/lib/billing/gateways/factor
 export const GET = withRateLimitTier(async (request) => {
   var _a;
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json(
         { error: "Unauthorized - No session found" },

package/dist/routes/api/superadmin/teams/[teamId]/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { queryWithRLS } from "@nextsparkjs/core/lib/db";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
@@ -8,7 +8,7 @@ export const GET = withRateLimitTier(async (request, { params }) => {
   var _a;
   try {
     const { teamId } = await params;
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json(
         { error: "Unauthorized - No session found" },

package/dist/routes/api/superadmin/teams/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { queryWithRLS } from "@nextsparkjs/core/lib/db";
 import { SYSTEM_ADMIN_TEAM_ID } from "@nextsparkjs/core/lib/api/auth/dual-auth";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
@@ -7,7 +7,7 @@ import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 export const GET = withRateLimitTier(async (request) => {
   var _a, _b, _c, _d;
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json(
         { error: "Unauthorized - No session found" },

package/dist/routes/api/superadmin/users/[userId]/route.d.ts

@@ -24,10 +24,12 @@ export declare const GET: (request: NextRequest, args_0: RouteParams) => Promise
  * Only accessible by superadmin or developer users.
  *
  * Actions:
- * - change-role: Change user's role (requires 'role' field)
- * - suspend: Suspend the user (sets role to 'suspended')
- * - unsuspend: Restore user's role to 'member'
+ * - change-role: Change user's role (requires 'role' field: member, or developer when a superadmin asks)
+ * - suspend: Suspend the user (role 'suspended'), sign out all their sessions and deactivate their API keys
+ * - unsuspend: Give a suspended user back the 'member' role (their API keys stay deactivated)
  * - verify-email: Manually verify user's email
+ *
+ * Nobody can act on their own account or on a superadmin, so the last superadmin is never suspended.
  */
 export declare const PATCH: (request: NextRequest, args_0: RouteParams) => Promise<NextResponse>;
 /**

package/dist/routes/api/superadmin/users/[userId]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/superadmin/users/[userId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AA+BxE,UAAU,WAAW;IACnB,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,GAAG,sEA6KJ,CAAC;AAOb;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,sEA+JN,CAAC;AAEb;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,sEAgIP,CAAC;AAEb,eAAO,MAAM,OAAO,sBAAgB,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/superadmin/users/[userId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKxD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AA+BxE,UAAU,WAAW;IACnB,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,GAAG,sEA6KJ,CAAC;AAOb;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,KAAK,sEAuLN,CAAC;AAEb;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,sEAgIP,CAAC;AAEb,eAAO,MAAM,OAAO,sBAAgB,CAAC"}

package/dist/routes/api/superadmin/users/[userId]/route.js

@@ -1,11 +1,12 @@
 import { NextResponse } from "next/server";
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
+import { suspendUser, unsuspendUser } from "@nextsparkjs/core/lib/auth/suspension";
 import { queryWithRLS } from "@nextsparkjs/core/lib/db";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 export const GET = withRateLimitTier(async (request, { params }) => {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json(
         { error: "Unauthorized - No session found" },
@@ -137,7 +138,7 @@ export const GET = withRateLimitTier(async (request, { params }) => {
 }, "strict");
 export const PATCH = withRateLimitTier(async (request, { params }) => {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json(
         { error: "Unauthorized - No session found" },
@@ -192,12 +193,24 @@ export const PATCH = withRateLimitTier(async (request, { params }) => {
     let updateParams = [];
     switch (action) {
       case "change-role":
-        if (!role || !["member", "colaborator", "admin"].includes(role)) {
+        if (!role || !["member", "developer"].includes(role)) {
           return NextResponse.json(
-            { error: "Invalid role. Must be one of: member, colaborator, admin" },
+            { error: "Invalid role. Must be one of: member, developer" },
             { status: 400 }
           );
         }
+        if (targetUser.role === "suspended") {
+          return NextResponse.json(
+            { error: "User is suspended. Use the unsuspend action to restore access, then change the role" },
+            { status: 400 }
+          );
+        }
+        if (role === "developer" && session.user.role !== "superadmin") {
+          return NextResponse.json(
+            { error: "Forbidden - Only a superadmin can grant the developer role" },
+            { status: 403 }
+          );
+        }
         updateQuery = `
           UPDATE "users"
           SET role = $1, "updatedAt" = NOW()
@@ -206,24 +219,34 @@ export const PATCH = withRateLimitTier(async (request, { params }) => {
         `;
         updateParams = [role, userId];
         break;
-      case "suspend":
-        updateQuery = `
-          UPDATE "users"
-          SET role = 'suspended', "updatedAt" = NOW()
-          WHERE id = $1
-          RETURNING id, role
-        `;
-        updateParams = [userId];
-        break;
+      case "suspend": {
+        const suspended = await suspendUser(userId, session.user.id);
+        if (!suspended) {
+          return NextResponse.json({ error: "Failed to update user" }, { status: 500 });
+        }
+        return NextResponse.json({
+          success: true,
+          action,
+          userId,
+          message: `User ${action} successful`,
+          revoked: suspended,
+          metadata: { performedBy: session.user.id, performedAt: (/* @__PURE__ */ new Date()).toISOString(), source: "superadmin-api" }
+        });
+      }
       case "unsuspend":
-        updateQuery = `
-          UPDATE "users"
-          SET role = 'member', "updatedAt" = NOW()
-          WHERE id = $1
-          RETURNING id, role
-        `;
-        updateParams = [userId];
-        break;
+        if (targetUser.role !== "suspended") {
+          return NextResponse.json({ error: "User is not suspended" }, { status: 400 });
+        }
+        if (!await unsuspendUser(userId, session.user.id)) {
+          return NextResponse.json({ error: "Failed to update user" }, { status: 500 });
+        }
+        return NextResponse.json({
+          success: true,
+          action,
+          userId,
+          message: `User ${action} successful`,
+          metadata: { performedBy: session.user.id, performedAt: (/* @__PURE__ */ new Date()).toISOString(), source: "superadmin-api" }
+        });
       case "verify-email":
         updateQuery = `
           UPDATE "users"
@@ -265,7 +288,7 @@ export const PATCH = withRateLimitTier(async (request, { params }) => {
 }, "strict");
 export const DELETE = withRateLimitTier(async (request, { params }) => {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json(
         { error: "Unauthorized - No session found" },

package/dist/routes/api/superadmin/users/route.js

@@ -1,12 +1,12 @@
 import { NextResponse } from "next/server";
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { queryWithRLS } from "@nextsparkjs/core/lib/db";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 export const GET = withRateLimitTier(async (request) => {
   var _a, _b, _c;
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json(
         { error: "Unauthorized - No session found" },

package/dist/routes/api/user/delete-account/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/delete-account/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAGxE,eAAO,MAAM,MAAM,iDAoDP,CAAC;AAEb,eAAO,MAAM,OAAO,sBAAgB,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/delete-account/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAGxE,eAAO,MAAM,MAAM,iDAkDP,CAAC;AAEb,eAAO,MAAM,OAAO,sBAAgB,CAAC"}

package/dist/routes/api/user/delete-account/route.js

@@ -1,13 +1,12 @@
 import { NextResponse } from "next/server";
 import { auth } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 import { corsPreflight } from "@nextsparkjs/core/lib/api/cors-response";
 import { UserService } from "@nextsparkjs/core/lib/services";
 export const DELETE = withRateLimitTier(async (req) => {
   try {
-    const session = await auth.api.getSession({
-      headers: req.headers
-    });
+    const session = await getAuthorizationSession(req.headers);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }

package/dist/routes/api/user/plan-flags/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/plan-flags/route.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAavE;;;GAGG;AACH,eAAO,MAAM,GAAG,iDAwDN,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,KAAK,iDAgFP,CAAC;AAEZ;;;GAGG;AACH,eAAO,MAAM,IAAI,iDA4FL,CAAC;AAEb,eAAO,MAAM,OAAO,sBAAgB,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/plan-flags/route.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAavE;;;GAGG;AACH,eAAO,MAAM,GAAG,iDAyDN,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,KAAK,iDAgFP,CAAC;AAEZ;;;GAGG;AACH,eAAO,MAAM,IAAI,iDA4FL,CAAC;AAEb,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/user/plan-flags/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { getUserPlanAndFlags, updateUserPlan, updateUserFlags } from "@nextsparkjs/core/lib/user-data";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
@@ -14,7 +14,7 @@ const planFlagsUpdateSchema = z.object({
 });
 export const GET = withRateLimitTier(async (request) => {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!session) {
       return NextResponse.json(
         { error: "Authentication required" },
@@ -23,7 +23,7 @@ export const GET = withRateLimitTier(async (request) => {
     }
     const { searchParams } = new URL(request.url);
     const validation = planFlagsQuerySchema.safeParse({
-      userId: searchParams.get("userId")
+      userId: searchParams.get("userId") ?? void 0
     });
     if (!validation.success) {
       return NextResponse.json(
@@ -60,7 +60,7 @@ export const GET = withRateLimitTier(async (request) => {
 }, "read");
 export const PATCH = withRateLimitTier(async (request) => {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!session) {
       return NextResponse.json(
         { error: "Authentication required" },
@@ -125,7 +125,7 @@ export const PATCH = withRateLimitTier(async (request) => {
 }, "write");
 export const POST = withRateLimitTier(async (request) => {
   try {
-    const session = await getTypedSession(request.headers);
+    const session = await getAuthorizationSession(request.headers);
     if (!session) {
       return NextResponse.json(
         { error: "Authentication required" },

package/dist/routes/api/user/profile/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { auth } from "@nextsparkjs/core/lib/auth";
+import { getAuthorizationSession } from "@nextsparkjs/core/lib/auth/authorization-session";
 import { queryOneWithRLS, mutateWithRLS, queryOne } from "@nextsparkjs/core/lib/db";
 import { profileSchema } from "@nextsparkjs/core/lib/validation";
 import { MetaService, MetaValueTooLargeError } from "@nextsparkjs/core/lib/services/meta.service";
@@ -10,7 +10,7 @@ export const GET = withRateLimitTier(async (request) => {
   const includeMeta = url.searchParams.get("includeMeta") === "true";
   try {
     const sessionHeaders = request.headers;
-    const session = await auth.api.getSession({ headers: sessionHeaders });
+    const session = await getAuthorizationSession(sessionHeaders);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
@@ -44,7 +44,7 @@ export const GET = withRateLimitTier(async (request) => {
 export const PATCH = withRateLimitTier(async (request) => {
   try {
     const sessionHeaders = request.headers;
-    const session = await auth.api.getSession({ headers: sessionHeaders });
+    const session = await getAuthorizationSession(sessionHeaders);
     if (!(session == null ? void 0 : session.user)) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }

package/dist/routes/api/v1/auth/signup-with-invite/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/auth/signup-with-invite/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAkBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAWD,eAAO,MAAM,IAAI,iDA8NP,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/auth/signup-with-invite/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAkBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAYD,eAAO,MAAM,IAAI,iDAsQP,CAAA"}

package/dist/routes/api/v1/auth/signup-with-invite/route.js

@@ -19,20 +19,12 @@ export const POST = withRateLimitTier(withApiLogging(
   async (req) => {
     var _a, _b;
     try {
-      if (!isPasswordLoginEnabled(AUTH_CONFIG)) {
-        const response = createApiError(
-          "Password authentication is unavailable",
-          503,
-          null,
-          "AUTH_METHOD_UNAVAILABLE"
-        );
-        return addCorsHeaders(response, req);
-      }
+      const passwordLogin = isPasswordLoginEnabled(AUTH_CONFIG);
       const body = await req.json();
       const { email, password, firstName, lastName, inviteToken } = body;
-      if (!email || !password || !inviteToken) {
+      if (!email || passwordLogin && !password || !inviteToken) {
         const response = createApiError(
-          "Email, password, and invitation token are required",
+          passwordLogin ? "Email, password, and invitation token are required" : "Email and invitation token are required",
           400,
           null,
           "MISSING_FIELDS"
@@ -44,7 +36,7 @@ export const POST = withRateLimitTier(withApiLogging(
         const response = createApiError("Invalid email format", 400, null, "INVALID_EMAIL");
         return addCorsHeaders(response, req);
       }
-      if (password.length < 8) {
+      if (passwordLogin && password.length < 8) {
         const response = createApiError(
           "Password must be at least 8 characters",
           400,
@@ -86,45 +78,89 @@ export const POST = withRateLimitTier(withApiLogging(
         const response = createApiError("Invitation has expired", 410, null, "INVITATION_EXPIRED");
         return addCorsHeaders(response, req);
       }
-      const signUpRequest = new Request(`${process.env.NEXT_PUBLIC_APP_URL}${withBasePath("/api/auth/sign-up/email")}`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          email,
-          password,
-          name: firstName && lastName ? `${firstName} ${lastName}` : firstName || "",
-          firstName,
-          lastName,
-          language: I18N_CONFIG.defaultLocale
-        })
-      });
-      const signUpResponse = await withSignupContext(
-        { skipTeamCreation: true, invitedTeamId: invitation.teamId },
-        () => auth.handler(signUpRequest)
-      );
-      if (!signUpResponse.ok) {
-        const errorData = await signUpResponse.json();
-        if (((_a = errorData.message) == null ? void 0 : _a.includes("already exists")) || errorData.code === "USER_ALREADY_EXISTS") {
-          const response2 = createApiError(
+      let userId;
+      const signupContext = { skipTeamCreation: true, invitedTeamId: invitation.teamId };
+      const name = firstName && lastName ? `${firstName} ${lastName}` : firstName || "";
+      if (passwordLogin) {
+        const signUpRequest = new Request(`${process.env.NEXT_PUBLIC_APP_URL}${withBasePath("/api/auth/sign-up/email")}`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            email,
+            password,
+            name,
+            firstName,
+            lastName,
+            language: I18N_CONFIG.defaultLocale
+          })
+        });
+        const signUpResponse = await withSignupContext(signupContext, () => auth.handler(signUpRequest));
+        if (!signUpResponse.ok) {
+          const errorData = await signUpResponse.json();
+          if (((_a = errorData.message) == null ? void 0 : _a.includes("already exists")) || errorData.code === "USER_ALREADY_EXISTS") {
+            const response2 = createApiError(
+              "An account with this email already exists. Please sign in instead.",
+              409,
+              null,
+              "USER_ALREADY_EXISTS"
+            );
+            return addCorsHeaders(response2, req);
+          }
+          const response = createApiError(
+            errorData.message || "Failed to create account",
+            signUpResponse.status,
+            null,
+            "SIGNUP_FAILED"
+          );
+          return addCorsHeaders(response, req);
+        }
+        const signUpData = await signUpResponse.json();
+        userId = (_b = signUpData.user) == null ? void 0 : _b.id;
+      } else {
+        const { internalAdapter } = await auth.$context;
+        if (await internalAdapter.findUserByEmail(email.toLowerCase())) {
+          const response = createApiError(
             "An account with this email already exists. Please sign in instead.",
             409,
             null,
             "USER_ALREADY_EXISTS"
           );
-          return addCorsHeaders(response2, req);
+          return addCorsHeaders(response, req);
         }
-        const response = createApiError(
-          errorData.message || "Failed to create account",
-          signUpResponse.status,
-          null,
-          "SIGNUP_FAILED"
-        );
-        return addCorsHeaders(response, req);
+        let user;
+        try {
+          user = await withSignupContext(signupContext, () => internalAdapter.createUser({
+            email: email.toLowerCase(),
+            emailVerified: true,
+            name,
+            firstName,
+            lastName,
+            language: I18N_CONFIG.defaultLocale
+          }));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "";
+          const refused = /^(DOMAIN_NOT_ALLOWED|SIGNUP_RESTRICTED): (.*)$/s.exec(message);
+          if (refused) {
+            return addCorsHeaders(createApiError(refused[2], 403, null, refused[1]), req);
+          }
+          if (error.code === "23505" || /duplicate key/i.test(message)) {
+            const response = createApiError(
+              "An account with this email already exists. Please sign in instead.",
+              409,
+              null,
+              "USER_ALREADY_EXISTS"
+            );
+            return addCorsHeaders(response, req);
+          }
+          throw error;
+        }
+        if (!user) {
+          return addCorsHeaders(createApiError("Account creation was refused", 403, null, "SIGNUP_FAILED"), req);
+        }
+        userId = user.id;
       }
-      const signUpData = await signUpResponse.json();
-      const userId = (_b = signUpData.user) == null ? void 0 : _b.id;
       if (!userId) {
         const response = createApiError(
           "Failed to create account - no user ID returned",

package/dist/routes/api/v1/media/upload/route.d.ts

@@ -7,7 +7,8 @@ import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response';
  * Enhanced version that creates database records for uploaded files.
  *
  * Features:
- * - Uploads files to Vercel Blob (production) or local storage (development)
+ * - Uploads files to Vercel Blob; development without a token falls back to local storage,
+ *   production without one answers 503 STORAGE_NOT_CONFIGURED
  * - Creates media records in database for tracking
  * - Extracts image dimensions automatically
  * - Returns both legacy URLs array and new media records array

package/dist/routes/api/v1/media/upload/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/media/upload/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAOzC,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAkCvE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,IAAI,uEA0KN,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,GAAG,uEA0CN,CAAC;AAEX,eAAO,MAAM,OAAO,sBAAgB,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/media/upload/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAOzC,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AA8CvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,IAAI,uEA6KN,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,GAAG,uEA0CN,CAAC;AAEX,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/media/upload/route.js

@@ -15,6 +15,13 @@ const isVercelBlobConfigured = () => {
   const token = process.env.BLOB_READ_WRITE_TOKEN;
   return !!token && token.startsWith("vercel_blob_");
 };
+const localFallbackAllowed = () => process.env.NODE_ENV !== "production";
+const storageNotConfigured = () => createApiError(
+  'Media storage is not configured: set BLOB_READ_WRITE_TOKEN (a Vercel Blob read/write token, starts with "vercel_blob_") to upload files in production.',
+  503,
+  { missing: "BLOB_READ_WRITE_TOKEN" },
+  API_ERROR_CODES.STORAGE_NOT_CONFIGURED
+);
 async function uploadToLocalStorageBuffer(buffer, fileName) {
   const uploadDir = join(process.cwd(), "public", "uploads", "temp");
   if (!existsSync(uploadDir)) {
@@ -37,6 +44,7 @@ export const POST = withRateLimitTier(async (request) => {
     if (!await checkPermission(authResult.user.id, teamId, "media.upload")) {
       return createApiError("Permission denied", 403, void 0, API_ERROR_CODES.PERMISSION_DENIED);
     }
+    if (!isVercelBlobConfigured() && !localFallbackAllowed()) return storageNotConfigured();
     const formData = await request.formData();
     const files = Array.from(formData.getAll("files")).filter((value) => value instanceof File);
     if (files.length === 0) {
@@ -46,7 +54,6 @@ export const POST = withRateLimitTier(async (request) => {
     const uploadedMedia = [];
     const useVercelBlob = isVercelBlobConfigured();
     console.log(`\u{1F4E4} [Media Upload] Storage mode: ${useVercelBlob ? "Vercel Blob" : "Local Storage"}`);
-    console.log(`\u{1F4E4} [Media Upload] Team context: ${teamId}`);
     for (const file of files) {
       if (!file.size) {
         continue;
@@ -101,6 +108,7 @@ export const POST = withRateLimitTier(async (request) => {
             uploadedUrl = blob.url;
             console.log(`\u2705 [Media Upload] Uploaded to Vercel Blob: ${uploadedUrl}`);
           } catch (blobError) {
+            if (!localFallbackAllowed()) throw blobError;
             console.warn(`\u26A0\uFE0F [Media Upload] Vercel Blob failed, falling back to local storage:`, blobError);
             uploadedUrl = await uploadToLocalStorageBuffer(fileBuffer, fileName);
             console.log(`\u2705 [Media Upload] Uploaded to local storage (fallback): ${uploadedUrl}`);
@@ -179,7 +187,7 @@ export const GET = withRateLimitTier(async (request) => {
     const maxSizeMB = ((_a = MEDIA_CONFIG) == null ? void 0 : _a.maxSizeMB) ?? 10;
     return createApiResponse({
       message: "Media upload endpoint is active",
-      storage: useVercelBlob ? "Vercel Blob" : "Local Storage",
+      storage: useVercelBlob ? "Vercel Blob" : localFallbackAllowed() ? "Local Storage" : "Not configured (set BLOB_READ_WRITE_TOKEN)",
       uploadPath: "uploads/temp/",
       supportedTypes: ((_b = MEDIA_CONFIG) == null ? void 0 : _b.allowedMimeTypes) ?? ["image/jpeg", "image/png", "image/gif", "image/webp", "video/mp4", "video/webm"],
       maxFileSize: `${maxSizeMB}MB`,

package/dist/routes/api/v1/post-categories/[id]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/post-categories/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAevE,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAyBrC,CAAC;AAGX,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAwIpC,CAAC;AAGZ,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAiEpC,CAAC;AAEZ,eAAO,MAAM,OAAO,sBAAgB,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/post-categories/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAiCvE,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2BrC,CAAC;AAIX,eAAO,MAAM,GAAG;YAEQ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BA+HpC,CAAC;AAIZ,eAAO,MAAM,MAAM;YAEK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;2BAuDpC,CAAC;AAEZ,eAAO,MAAM,OAAO,sBAAgB,CAAA"}