@nextsparkjs/core 0.1.0-beta.74 → 0.1.0-beta.76

package/templates/app/api/v1/[entity]/[id]/child/[childType]/route.ts

@@ -4,16 +4,18 @@
  * POST /api/v1/[entity]/[id]/child/[childType]
  */
 
+// CRITICAL: Initialize entity registry for API routes
+// This import is processed by webpack which resolves the @nextsparkjs alias
+// The setEntityRegistry call happens at module load time
+import { setEntityRegistry, isRegistryInitialized, getChildEntities, getEntity } from '@nextsparkjs/core/lib/entities/queries'
+import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
+if (!isRegistryInitialized()) {
+  setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
+}
+
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { resolveEntityFromUrl } from '@nextsparkjs/core/lib/api/entity/resolver'
-import { getChildEntities, getEntity, setEntityRegistry } from '@nextsparkjs/core/lib/entities/queries'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
-// Import registry directly - webpack resolves @nextsparkjs/registries alias at compile time
-import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
-
-// Initialize registry at module load time (before any handler runs)
-setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
 
 
 interface RouteParams {
@@ -22,10 +24,10 @@ interface RouteParams {
   childType: string
 }
 
-export const GET = withRateLimitTier(async (
+export async function GET(
   request: NextRequest,
   { params }: { params: Promise<RouteParams> }
-) => {
+) {
   const { entity, id, childType } = await params
 
   try {
@@ -40,7 +42,7 @@ export const GET = withRateLimitTier(async (
     }
 
     // Check if child entity exists using the new registry system
-    const childEntities = getChildEntities(resolution.entityName)
+    const childEntities = getChildEntities(resolution.entityName as string)
     const childEntity = childEntities.find(child => child.name === childType)
 
     if (!childEntity) {
@@ -51,7 +53,7 @@ export const GET = withRateLimitTier(async (
     }
 
     // Get child config from registry
-    const childConfig = getEntity(childType)
+    const childConfig = getEntity(childType as string)
     if (!childConfig) {
       return NextResponse.json(
         { error: `Child entity configuration "${childType}" not found` },
@@ -85,12 +87,12 @@ export const GET = withRateLimitTier(async (
       { status: 500 }
     )
   }
-}, 'read')
+}
 
-export const POST = withRateLimitTier(async (
+export async function POST(
   request: NextRequest,
   { params }: { params: Promise<RouteParams> }
-) => {
+) {
   const { entity, id, childType } = await params
   
   try {
@@ -109,7 +111,7 @@ export const POST = withRateLimitTier(async (
     }
 
     // Check if child entity exists using the new registry system
-    const childEntities = getChildEntities(resolution.entityName)
+    const childEntities = getChildEntities(resolution.entityName as string)
     const childEntity = childEntities.find(child => child.name === childType)
     console.log(`[ChildAPI] Found child entities for ${entity}:`, childEntities.map(c => c.name))
     console.log(`[ChildAPI] Looking for childType:`, childType)
@@ -123,7 +125,7 @@ export const POST = withRateLimitTier(async (
     }
 
     // Get child config from registry
-    const childConfig = getEntity(childType)
+    const childConfig = getEntity(childType as string)
     console.log(`[ChildAPI] Child config for ${childType}:`, childConfig)
     if (!childConfig) {
       return NextResponse.json(
@@ -326,4 +328,4 @@ export const POST = withRateLimitTier(async (
       { status: 500 }
     )
   }
-}, 'write')
+}

package/templates/app/api/v1/[entity]/[id]/route.ts

@@ -13,21 +13,23 @@
  * DELETE /api/v1/orders/456       -> Delete order
  */
 
+// CRITICAL: Initialize entity registry for API routes
+// This import is processed by webpack which resolves the @nextsparkjs alias
+// The setEntityRegistry call happens at module load time
+import { setEntityRegistry, isRegistryInitialized } from '@nextsparkjs/core/lib/entities/queries'
+import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
+if (!isRegistryInitialized()) {
+  setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
+}
+
 import {
   handleGenericRead,
   handleGenericUpdate,
   handleGenericDelete,
   handleGenericOptions
 } from '@nextsparkjs/core/lib/api/entity/generic-handler'
-import { setEntityRegistry } from '@nextsparkjs/core/lib/entities/queries'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
-// Import registry directly - webpack resolves @nextsparkjs/registries alias at compile time
-import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
-
-// Initialize registry at module load time (before any handler runs)
-setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
 
-export const GET = withRateLimitTier(handleGenericRead, 'read')
-export const PATCH = withRateLimitTier(handleGenericUpdate, 'write')
-export const DELETE = withRateLimitTier(handleGenericDelete, 'write')
+export const GET = handleGenericRead
+export const PATCH = handleGenericUpdate
+export const DELETE = handleGenericDelete
 export const OPTIONS = handleGenericOptions

package/templates/app/api/v1/[entity]/route.ts

@@ -11,19 +11,21 @@
  * POST /api/v1/orders       -> Create order
  */
 
+// CRITICAL: Initialize entity registry for API routes
+// This import is processed by webpack which resolves the @nextsparkjs alias
+// The setEntityRegistry call happens at module load time
+import { setEntityRegistry, isRegistryInitialized } from '@nextsparkjs/core/lib/entities/queries'
+import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
+if (!isRegistryInitialized()) {
+  setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
+}
+
 import {
   handleGenericList,
   handleGenericCreate,
   handleGenericOptions
 } from '@nextsparkjs/core/lib/api/entity/generic-handler'
-import { setEntityRegistry } from '@nextsparkjs/core/lib/entities/queries'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
-// Import registry directly - webpack resolves @nextsparkjs/registries alias at compile time
-import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
-
-// Initialize registry at module load time (before any handler runs)
-setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
 
-export const GET = withRateLimitTier(handleGenericList, 'read')
-export const POST = withRateLimitTier(handleGenericCreate, 'write')
+export const GET = handleGenericList
+export const POST = handleGenericCreate
 export const OPTIONS = handleGenericOptions

package/templates/app/api/v1/api-keys/[id]/route.ts

@@ -13,15 +13,14 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { queryOneWithRLS, mutateWithRLS } from '@nextsparkjs/core/lib/db';
-import {
-  createApiResponse,
+import { 
+  createApiResponse, 
   createApiError,
   withApiLogging,
   handleCorsPreflightRequest,
   addCorsHeaders
 } from '@nextsparkjs/core/lib/api/helpers';
 import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 // Handle CORS preflight
 export async function OPTIONS() {
@@ -29,7 +28,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/api-keys/:id - Get specific API key details
-export const GET = withRateLimitTier(withApiLogging(async (
+export const GET = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -135,10 +134,10 @@ export const GET = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'strict');
+});
 
 // PATCH /api/v1/api-keys/:id - Update API key (only name and active status)
-export const PATCH = withRateLimitTier(withApiLogging(async (
+export const PATCH = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -226,10 +225,10 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'strict');
+});
 
 // DELETE /api/v1/api-keys/:id - Revoke API key
-export const DELETE = withRateLimitTier(withApiLogging(async (
+export const DELETE = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -301,4 +300,4 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'strict');
+});

package/templates/app/api/v1/api-keys/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { queryWithRLS, mutateWithRLS } from '@nextsparkjs/core/lib/db';
-import {
-  createApiResponse,
+import { 
+  createApiResponse, 
   createApiError,
   withApiLogging,
   handleCorsPreflightRequest,
@@ -10,7 +10,6 @@ import {
 import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth';
 import { ApiKeyManager, API_SCOPES, API_KEY_LIMITS } from '@nextsparkjs/core/lib/api/keys';
 import { validateScopesForUser } from '@nextsparkjs/core/lib/api/auth';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 import { z } from 'zod';
 
 const createApiKeySchema = z.object({
@@ -25,7 +24,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/api-keys - List user's API keys with dual auth
-export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const GET = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req);
@@ -131,10 +130,10 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'strict');
+});
 
 // POST /api/v1/api-keys - Create new API key with dual auth
-export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req);
@@ -248,4 +247,4 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'strict');
+});

package/templates/app/api/v1/auth/signup-with-invite/route.ts

@@ -11,7 +11,6 @@ import {
 import type { TeamInvitation, TeamMember } from '@nextsparkjs/core/lib/teams/types'
 import { I18N_CONFIG } from '@nextsparkjs/core/lib/config'
 import { withSignupContext } from '@nextsparkjs/core/lib/auth-context'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 // Handle CORS preflight
 export async function OPTIONS() {
@@ -27,7 +26,7 @@ interface SignupWithInviteBody {
 }
 
 // POST /api/v1/auth/signup-with-invite - Create account and auto-accept invitation
-export const POST = withRateLimitTier(withApiLogging(
+export const POST = withApiLogging(
   async (req: NextRequest): Promise<NextResponse> => {
     try {
       const body: SignupWithInviteBody = await req.json()
@@ -225,4 +224,4 @@ export const POST = withRateLimitTier(withApiLogging(
       return addCorsHeaders(response)
     }
   }
-), 'auth')
+)

package/templates/app/api/v1/billing/cancel/route.ts

@@ -7,9 +7,9 @@
  * P1-4: Cancel subscription directo
  */
 
-import { NextRequest, NextResponse } from 'next/server'
+import { NextRequest } from 'next/server'
 import { z } from 'zod'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthError } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { SubscriptionService, MembershipService } from '@nextsparkjs/core/lib/services'
 import {
   cancelSubscriptionAtPeriodEnd,
@@ -17,7 +17,6 @@ import {
   reactivateSubscription
 } from '@nextsparkjs/core/lib/billing/gateways/stripe'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const cancelSchema = z.object({
   immediate: z.boolean().optional().default(false),
@@ -32,22 +31,19 @@ const cancelSchema = z.object({
  * - immediate: boolean (default: false) - If true, cancels immediately. If false, cancels at period end.
  * - reason: string (optional) - Reason for cancellation (stored in metadata)
  */
-export const POST = withRateLimitTier(async (request: NextRequest) => {
+export async function POST(request: NextRequest) {
   // 1. Dual authentication
   const authResult = await authenticateRequest(request)
 
   if (!authResult.success || !authResult.user) {
-    return NextResponse.json(
-      { success: false, error: 'Unauthorized' },
-      { status: 401 }
-    )
+    return createAuthError('Unauthorized', 401)
   }
 
   // 2. Get team context
   const teamId = request.headers.get('x-team-id') || authResult.user.defaultTeamId
 
   if (!teamId) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: 'No team context available. Please provide x-team-id header.'
@@ -61,7 +57,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   const actionResult = membership.canPerformAction('billing.cancel')
 
   if (!actionResult.allowed) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: actionResult.message,
@@ -77,7 +73,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
     body = await request.json()
   } catch {
-    return NextResponse.json(
+    return Response.json(
       { success: false, error: 'Invalid JSON body' },
       { status: 400 }
     )
@@ -91,7 +87,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   // Otherwise, it's a cancel request
   const parseResult = cancelSchema.safeParse(body)
   if (!parseResult.success) {
-    return NextResponse.json(
+    return Response.json(
       { success: false, error: 'Invalid request body', details: parseResult.error.issues },
       { status: 400 }
     )
@@ -103,7 +99,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   const subscription = await SubscriptionService.getActive(teamId)
 
   if (!subscription || !subscription.externalSubscriptionId) {
-    return NextResponse.json(
+    return Response.json(
       { success: false, error: 'No active subscription found' },
       { status: 404 }
     )
@@ -133,7 +129,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
       ]
     )
 
-    return NextResponse.json({
+    return Response.json({
       success: true,
       data: {
         canceledAt: immediate ? new Date().toISOString() : null,
@@ -146,7 +142,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
     })
   } catch (error) {
     console.error('[cancel] Error canceling subscription:', error)
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: error instanceof Error ? error.message : 'Failed to cancel subscription'
@@ -154,7 +150,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
       { status: 500 }
     )
   }
-}, 'strict');
+}
 
 /**
  * Handle reactivation of a subscription that was scheduled to cancel
@@ -163,14 +159,14 @@ async function handleReactivation(teamId: string) {
   const subscription = await SubscriptionService.getActive(teamId)
 
   if (!subscription || !subscription.externalSubscriptionId) {
-    return NextResponse.json(
+    return Response.json(
       { success: false, error: 'No active subscription found' },
       { status: 404 }
     )
   }
 
   if (!subscription.cancelAtPeriodEnd) {
-    return NextResponse.json(
+    return Response.json(
       { success: false, error: 'Subscription is not scheduled for cancellation' },
       { status: 400 }
     )
@@ -190,7 +186,7 @@ async function handleReactivation(teamId: string) {
       [subscription.id]
     )
 
-    return NextResponse.json({
+    return Response.json({
       success: true,
       data: {
         reactivated: true,
@@ -199,7 +195,7 @@ async function handleReactivation(teamId: string) {
     })
   } catch (error) {
     console.error('[cancel] Error reactivating subscription:', error)
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: error instanceof Error ? error.message : 'Failed to reactivate subscription'

package/templates/app/api/v1/billing/change-plan/route.ts

@@ -7,11 +7,10 @@
  * P1-3: Plan Change con Proration
  */
 
-import { NextRequest, NextResponse } from 'next/server'
+import { NextRequest } from 'next/server'
 import { z } from 'zod'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthError } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { SubscriptionService, MembershipService } from '@nextsparkjs/core/lib/services'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const changePlanSchema = z.object({
   planSlug: z.string().min(1, 'Plan slug is required'),
@@ -26,22 +25,19 @@ const changePlanSchema = z.object({
  * - planSlug: string - Target plan slug
  * - billingInterval: 'monthly' | 'yearly' (default: monthly)
  */
-export const POST = withRateLimitTier(async (request: NextRequest) => {
+export async function POST(request: NextRequest) {
   // 1. Dual authentication
   const authResult = await authenticateRequest(request)
 
   if (!authResult.success || !authResult.user) {
-    return NextResponse.json(
-      { success: false, error: 'Unauthorized' },
-      { status: 401 }
-    )
+    return createAuthError('Unauthorized', 401)
   }
 
   // 2. Get team context
   const teamId = request.headers.get('x-team-id') || authResult.user.defaultTeamId
 
   if (!teamId) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: 'No team context available. Please provide x-team-id header.',
@@ -55,7 +51,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   const actionResult = membership.canPerformAction('billing.change-plan')
 
   if (!actionResult.allowed) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: actionResult.message,
@@ -71,12 +67,12 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
     body = await request.json()
   } catch {
-    return NextResponse.json({ success: false, error: 'Invalid JSON body' }, { status: 400 })
+    return Response.json({ success: false, error: 'Invalid JSON body' }, { status: 400 })
   }
 
   const parseResult = changePlanSchema.safeParse(body)
   if (!parseResult.success) {
-    return NextResponse.json(
+    return Response.json(
       { success: false, error: 'Invalid request body', details: parseResult.error.issues },
       { status: 400 }
     )
@@ -88,14 +84,14 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   const result = await SubscriptionService.changePlan(teamId, planSlug, billingInterval)
 
   if (!result.success) {
-    return NextResponse.json({ success: false, error: result.error }, { status: 400 })
+    return Response.json({ success: false, error: result.error }, { status: 400 })
   }
 
-  return NextResponse.json({
+  return Response.json({
     success: true,
     data: {
       subscription: result.subscription,
       warnings: result.downgradeWarnings,
     },
   })
-}, 'strict');
+}

package/templates/app/api/v1/billing/check-action/route.ts

@@ -9,26 +9,22 @@
  * FIX1: This endpoint was missing, causing useMembership.canDo() to fail
  */
 
-import { NextRequest, NextResponse } from 'next/server'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { NextRequest } from 'next/server'
+import { authenticateRequest, createAuthError } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { MembershipService } from '@nextsparkjs/core/lib/services'
 import { z } from 'zod'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const checkActionSchema = z.object({
   action: z.string().min(1, 'Action is required'),
   teamId: z.string().uuid().optional()
 })
 
-export const POST = withRateLimitTier(async (request: NextRequest) => {
+export async function POST(request: NextRequest) {
   // 1. Dual authentication (API Key OR Session)
   const authResult = await authenticateRequest(request)
 
   if (!authResult.success || !authResult.user) {
-    return NextResponse.json(
-      { success: false, error: 'Unauthorized' },
-      { status: 401 }
-    )
+    return createAuthError('Unauthorized', 401)
   }
 
   // 2. Parse and validate request body
@@ -36,7 +32,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
     body = await request.json()
   } catch {
-    return NextResponse.json(
+    return Response.json(
       { success: false, error: 'Invalid JSON body' },
       { status: 400 }
     )
@@ -44,7 +40,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
 
   const parseResult = checkActionSchema.safeParse(body)
   if (!parseResult.success) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: 'Validation failed',
@@ -63,7 +59,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
     authResult.user.defaultTeamId
 
   if (!teamId) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: 'No team context available. Please provide teamId in body or x-team-id header.'
@@ -78,8 +74,8 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   const membership = await MembershipService.get(authResult.user.id, teamId)
   const result = membership.canPerformAction(action)
 
-  return NextResponse.json({
+  return Response.json({
     success: true,
     data: result
   })
-}, 'read');
+}

package/templates/app/api/v1/billing/checkout/route.ts

@@ -9,27 +9,23 @@
  * P2: Stripe Integration
  */
 
-import { NextRequest, NextResponse } from 'next/server'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { NextRequest } from 'next/server'
+import { authenticateRequest, createAuthError } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { createCheckoutSession } from '@nextsparkjs/core/lib/billing/gateways/stripe'
 import { SubscriptionService, MembershipService } from '@nextsparkjs/core/lib/services'
 import { z } from 'zod'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const checkoutSchema = z.object({
   planSlug: z.string().min(1, 'Plan slug is required'),
   billingPeriod: z.enum(['monthly', 'yearly']).default('monthly')
 })
 
-export const POST = withRateLimitTier(async (request: NextRequest) => {
+export async function POST(request: NextRequest) {
   // 1. Dual authentication
   const authResult = await authenticateRequest(request)
 
   if (!authResult.success || !authResult.user) {
-    return NextResponse.json(
-      { success: false, error: 'Unauthorized' },
-      { status: 401 }
-    )
+    return createAuthError('Unauthorized', 401)
   }
 
   // 2. Parse and validate request body
@@ -37,7 +33,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
     body = await request.json()
   } catch {
-    return NextResponse.json(
+    return Response.json(
       { success: false, error: 'Invalid JSON body' },
       { status: 400 }
     )
@@ -45,7 +41,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
 
   const parseResult = checkoutSchema.safeParse(body)
   if (!parseResult.success) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: 'Validation failed',
@@ -63,7 +59,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
     authResult.user.defaultTeamId
 
   if (!teamId) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: 'No team context available. Please provide x-team-id header.'
@@ -77,7 +73,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
   const actionResult = membership.canPerformAction('billing.checkout')
 
   if (!actionResult.allowed) {
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: actionResult.message,
@@ -108,7 +104,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
       customerId: subscription?.externalCustomerId || undefined
     })
 
-    return NextResponse.json({
+    return Response.json({
       success: true,
       data: {
         url: session.url,
@@ -117,7 +113,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
     })
   } catch (error) {
     console.error('[checkout] Error creating checkout session:', error)
-    return NextResponse.json(
+    return Response.json(
       {
         success: false,
         error: error instanceof Error ? error.message : 'Failed to create checkout session'
@@ -125,4 +121,4 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
       { status: 500 }
     )
   }
-}, 'write');
+}