@nextsparkjs/core 0.1.0-beta.8 → 0.1.0-beta.81

package/dist/lib/oauth/metadata.js

@@ -1,7 +1,7 @@
 import {
   OAuthError,
   OAuthErrorType
-} from "./types";
+} from "./types.js";
 const PROVIDER_ENDPOINTS = {
   facebook: {
     userInfo: "https://graph.facebook.com/v18.0/me",

package/dist/lib/oauth/token-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EACL,aAAa,EAEb,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AAuCjB;;GAEG;AACH,qBAAa,mBAAmB;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAahE;;;;;;;;OAQG;WACU,YAAY,CACvB,QAAQ,EAAE,aAAa,EACvB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAoC9B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IA2BjC;;;;;OAKG;WACU,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkHtE;;;;;OAKG;WACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA+B/D;;;;OAIG;WACU,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAqCvD;;OAEG;mBACkB,iBAAiB;IAetC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAa9B;;;;;OAKG;WACU,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmC/D;;OAEG;mBACkB,uBAAuB;CAuB7C"}
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,aAAa,EAEb,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AAuCjB;;GAEG;AACH,qBAAa,mBAAmB;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAahE;;;;;;;;OAQG;WACU,YAAY,CACvB,QAAQ,EAAE,aAAa,EACvB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAoC9B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IA2BjC;;;;;OAKG;WACU,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkHtE;;;;;OAKG;WACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA+B/D;;;;OAIG;WACU,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAqCvD;;OAEG;mBACkB,iBAAiB;IAetC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAa9B;;;;;OAKG;WACU,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmC/D;;OAEG;mBACkB,uBAAuB;CAuB7C"}

package/dist/lib/oauth/token-refresh.js

@@ -1,9 +1,10 @@
 import { Pool } from "pg";
-import { TokenEncryption } from "./encryption";
+import { parseSSLConfig } from "../db.js";
+import { TokenEncryption } from "./encryption.js";
 import {
   OAuthError,
   OAuthErrorType
-} from "./types";
+} from "./types.js";
 const TOKEN_ENDPOINTS = {
   facebook: "https://graph.facebook.com/v18.0/oauth/access_token",
   instagram: "https://graph.facebook.com/v18.0/oauth/access_token",
@@ -21,7 +22,7 @@ const databaseUrl = process.env.DATABASE_URL;
 const connectionString = databaseUrl.includes("?") ? `${databaseUrl}&pgbouncer=true` : `${databaseUrl}?pgbouncer=true`;
 const pool = new Pool({
   connectionString,
-  ssl: { rejectUnauthorized: false },
+  ssl: parseSSLConfig(databaseUrl),
   connectionTimeoutMillis: 1e4,
   idleTimeoutMillis: 3e4,
   max: 20

package/dist/lib/permissions/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/lib/permissions/check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAuBnD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,OAAO,CAAC,CA6BlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,UAAU,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,UAAU,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAET"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/lib/permissions/check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAuBnD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,UAAU,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,UAAU,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAET"}

package/dist/lib/permissions/check.js

@@ -1,5 +1,5 @@
-import { permissionRegistry, ensureEntityPermissionsLoaded } from "./init";
-import { queryOneWithRLS } from "../db";
+import { permissionRegistry, ensureEntityPermissionsLoaded } from "./init.js";
+import { queryOneWithRLS } from "../db.js";
 async function getTeamMemberRole(userId, teamId) {
   const result = await queryOneWithRLS(
     `SELECT role
@@ -15,22 +15,15 @@ async function checkPermission(userId, teamId, permission) {
   ensureEntityPermissionsLoaded();
   const teamRole = await getTeamMemberRole(userId, teamId);
   if (!teamRole) {
-    console.log(`[checkPermission] User ${userId} is not a member of team ${teamId}`);
+    if (process.env.NODE_ENV === "development") {
+      console.log(`[checkPermission] User ${userId} is not a member of team ${teamId}`);
+    }
     return false;
   }
   const hasPermission = permissionRegistry.hasPermission(teamRole, permission);
-  const permConfig = permissionRegistry.getPermissionConfig(permission);
-  const rolePerms = permissionRegistry.getRolePermissions(teamRole);
-  console.log(`[checkPermission] ============================================`);
-  console.log(`[checkPermission] User role: ${teamRole}, Permission: ${permission}`);
-  console.log(`[checkPermission] Has permission: ${hasPermission}`);
-  console.log(`[checkPermission] Registry initialized: ${permissionRegistry.isInitialized()}`);
-  console.log(`[checkPermission] Permission config exists: ${!!permConfig}`);
-  console.log(`[checkPermission] Role ${teamRole} has ${rolePerms.length} permissions`);
-  if (permConfig) {
-    console.log(`[checkPermission] Permission roles: ${JSON.stringify(permConfig.roles)}`);
+  if (process.env.NODE_ENV === "development") {
+    console.log(`[checkPermission] Role: ${teamRole}, Perm: ${permission}, Has: ${hasPermission}`);
   }
-  console.log(`[checkPermission] ============================================`);
   return hasPermission;
 }
 async function checkPermissions(userId, teamId, permissions) {

package/dist/lib/permissions/hooks.js

@@ -1,7 +1,7 @@
 "use client";
 import { useMemo } from "react";
-import { useTeamContext } from "../../contexts/TeamContext";
-import { permissionRegistry } from "./init";
+import { useTeamContext } from "../../contexts/TeamContext.js";
+import { permissionRegistry } from "./init.js";
 function usePermission(permission) {
   const { currentTeam, userTeams } = useTeamContext();
   return useMemo(() => {

package/dist/lib/permissions/init.js

@@ -8,7 +8,7 @@ import {
   isValidPermission,
   getPermissionConfig,
   permissionRegistry
-} from "../services/permission.service";
+} from "../services/permission.service.js";
 import {
   ALL_PERMISSIONS,
   PERMISSIONS_BY_CATEGORY,

package/dist/lib/permissions/merge.d.ts

@@ -2,6 +2,10 @@ import type { CorePermissionsConfig, ThemePermissionsConfig, PermissionConfig, P
 /**
  * Merge configuration from core with theme and entities
  *
+ * @deprecated This function is no longer used. Permissions are now pre-computed
+ * at build time and stored in the permissions-registry. Use PermissionService
+ * for runtime permission checks instead.
+ *
  * Order of precedence:
  * 1. Core config (base)
  * 2. Theme overrides (override specific properties)
@@ -16,6 +20,10 @@ export declare function mergePermissionsConfig(coreConfig: CorePermissionsConfig
 /**
  * Extract permissions from EntityConfig
  *
+ * @deprecated This function is no longer used. Entity permissions are now defined
+ * centrally in permissions.config.ts and processed at build time by the registry
+ * generator script. Do not use this function for new code.
+ *
  * Converts entity permissions configuration into PermissionConfig objects
  * that can be merged into the global permissions registry.
  *

package/dist/lib/permissions/merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/lib/permissions/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,SAAS,CAAA;AAEhB;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,WAAW,EAAE,sBAAsB,GAAG,IAAI,EAC1C,iBAAiB,EAAE,gBAAgB,EAAE,GACpC;IACD,WAAW,EAAE,kBAAkB,EAAE,CAAA;IACjC,UAAU,EAAE,mBAAmB,EAAE,CAAA;IACjC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;CAC7B,CA0EA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,uBAAuB,GACnC,gBAAgB,EAAE,CA8BpB"}
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/lib/permissions/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,SAAS,CAAA;AAEhB;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,WAAW,EAAE,sBAAsB,GAAG,IAAI,EAC1C,iBAAiB,EAAE,gBAAgB,EAAE,GACpC;IACD,WAAW,EAAE,kBAAkB,EAAE,CAAA;IACjC,UAAU,EAAE,mBAAmB,EAAE,CAAA;IACjC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;CAC7B,CA0EA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,uBAAuB,GACnC,gBAAgB,EAAE,CA8BpB"}

package/dist/lib/plugins/env-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-loader.d.ts","sourceRoot":"","sources":["../../../src/lib/plugins/env-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;GAEG;AACH,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AA2IzD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAEhE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}
+{"version":3,"file":"env-loader.d.ts","sourceRoot":"","sources":["../../../src/lib/plugins/env-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;GAEG;AACH,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAuJzD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAEhE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/lib/plugins/env-loader.js

@@ -38,7 +38,11 @@ class PluginEnvLoader {
         if (existsSync(envPath)) {
           const result = config({ path: envPath, override: false });
           if (result.error) {
-            console.error(`[Plugin Env Loader] Error loading ${entry}/.env:`, result.error);
+            if (process.env.NODE_ENV === "development") {
+              console.error(`[Plugin Env Loader] Error loading ${entry}/.env:`, result.error);
+            } else {
+              console.error(`[Plugin Env Loader] Error loading ${entry}/.env`);
+            }
             pluginEnv = { ...process.env };
           } else if (result.parsed) {
             pluginEnv = { ...process.env, ...result.parsed };
@@ -58,7 +62,11 @@ class PluginEnvLoader {
       }
       this.loaded = true;
     } catch (error) {
-      console.error("[Plugin Env Loader] Failed to load plugin environments:", error);
+      if (process.env.NODE_ENV === "development") {
+        console.error("[Plugin Env Loader] Failed to load plugin environments:", error);
+      } else {
+        console.error("[Plugin Env Loader] Failed to load plugin environments");
+      }
       this.loaded = true;
     }
   }
@@ -74,7 +82,7 @@ class PluginEnvLoader {
       if (process.env.NODE_ENV === "development") {
         console.warn(`[Plugin Env Loader] No .env found for plugin: ${pluginName}`);
       }
-      return {};
+      return { ...process.env };
     }
     return pluginEnv;
   }

package/dist/lib/plugins/plugin-loader.js

@@ -1,4 +1,4 @@
-import { PluginService } from "../services";
+import { PluginService } from "../services/index.js";
 const pluginCache = /* @__PURE__ */ new Map();
 function discoverPlugins() {
   try {

package/dist/lib/rate-limit-redis.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Distributed Rate Limiting System with Redis (Upstash)
+ *
+ * This module provides distributed rate limiting using Upstash Redis,
+ * which works correctly in multi-instance deployments.
+ *
+ * Falls back gracefully when Redis is not configured or dependencies aren't available.
+ */
+export declare const authRateLimiter: any;
+export declare const apiRateLimiter: any;
+export declare const strictRateLimiter: any;
+export interface RateLimitCheckResult {
+    success: boolean;
+    remaining: number;
+    reset: number;
+    limit?: number;
+    retryAfter?: number;
+}
+/**
+ * Rate limit tiers available for API endpoints
+ */
+export type RateLimitTier = 'auth' | 'api' | 'strict' | 'read' | 'write';
+/**
+ * Check rate limit for a given identifier
+ *
+ * @param identifier - Unique identifier (e.g., IP address, user ID, or combination)
+ * @param type - Rate limit tier: 'auth' (5/15min), 'api' (100/1min), 'strict' (10/1hr), 'read' (200/1min), 'write' (50/1min)
+ * @returns Promise with success status, remaining requests, and reset timestamp
+ */
+export declare function checkRateLimit(identifier: string, type?: RateLimitTier): Promise<RateLimitCheckResult>;
+/**
+ * Check if Redis is configured and available
+ */
+export declare function isRedisConfigured(): Promise<boolean>;
+/**
+ * Synchronous check if Redis might be configured (based on env vars)
+ * Use this for quick checks, but isRedisConfigured() is more accurate
+ */
+export declare function maybeRedisConfigured(): boolean;
+/**
+ * Get rate limit headers for HTTP response
+ */
+export declare function getRateLimitHeaders(result: RateLimitCheckResult): Record<string, string>;
+/**
+ * Create rate limit error response
+ * Use this to return a consistent 429 response when rate limited
+ */
+export declare function createRateLimitResponse(result: RateLimitCheckResult): Response;
+//# sourceMappingURL=rate-limit-redis.d.ts.map

package/dist/lib/rate-limit-redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-redis.d.ts","sourceRoot":"","sources":["../../src/lib/rate-limit-redis.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgIH,eAAO,MAAM,eAAe,KAAO,CAAA;AACnC,eAAO,MAAM,cAAc,KAAO,CAAA;AAClC,eAAO,MAAM,iBAAiB,KAAO,CAAA;AAErC,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAA;AAExE;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,aAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CA6C/B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG1D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,QAAQ,CAe9E"}

package/dist/lib/rate-limit-redis.js

@@ -0,0 +1,157 @@
+let Redis = null;
+let Ratelimit = null;
+let modulesLoaded = false;
+let loadError = null;
+let redis = null;
+let authRateLimiterInstance = null;
+let apiRateLimiterInstance = null;
+let strictRateLimiterInstance = null;
+let readRateLimiterInstance = null;
+let writeRateLimiterInstance = null;
+async function loadUpstashModules() {
+  if (modulesLoaded) return !loadError;
+  try {
+    const [ratelimitModule, redisModule] = await Promise.all([
+      import("@upstash/ratelimit"),
+      import("@upstash/redis")
+    ]);
+    Ratelimit = ratelimitModule.Ratelimit;
+    Redis = redisModule.Redis;
+    if (process.env.UPSTASH_REDIS_REST_URL && process.env.UPSTASH_REDIS_REST_TOKEN) {
+      redis = new Redis({
+        url: process.env.UPSTASH_REDIS_REST_URL,
+        token: process.env.UPSTASH_REDIS_REST_TOKEN
+      });
+      authRateLimiterInstance = new Ratelimit({
+        redis,
+        limiter: Ratelimit.slidingWindow(5, "15 m"),
+        analytics: true,
+        prefix: "ratelimit:auth",
+        ephemeralCache: /* @__PURE__ */ new Map()
+      });
+      apiRateLimiterInstance = new Ratelimit({
+        redis,
+        limiter: Ratelimit.slidingWindow(100, "1 m"),
+        analytics: true,
+        prefix: "ratelimit:api",
+        ephemeralCache: /* @__PURE__ */ new Map()
+      });
+      strictRateLimiterInstance = new Ratelimit({
+        redis,
+        limiter: Ratelimit.slidingWindow(10, "1 h"),
+        analytics: true,
+        prefix: "ratelimit:strict",
+        ephemeralCache: /* @__PURE__ */ new Map()
+      });
+      readRateLimiterInstance = new Ratelimit({
+        redis,
+        limiter: Ratelimit.slidingWindow(200, "1 m"),
+        analytics: true,
+        prefix: "ratelimit:read",
+        ephemeralCache: /* @__PURE__ */ new Map()
+      });
+      writeRateLimiterInstance = new Ratelimit({
+        redis,
+        limiter: Ratelimit.slidingWindow(50, "1 m"),
+        analytics: true,
+        prefix: "ratelimit:write",
+        ephemeralCache: /* @__PURE__ */ new Map()
+      });
+    }
+    modulesLoaded = true;
+    return true;
+  } catch (error) {
+    loadError = error;
+    modulesLoaded = true;
+    if (process.env.NODE_ENV === "development") {
+      console.warn("[RateLimit] Upstash modules not available, using fallback:", error.message);
+    }
+    return false;
+  }
+}
+const authRateLimiter = null;
+const apiRateLimiter = null;
+const strictRateLimiter = null;
+async function checkRateLimit(identifier, type = "api") {
+  await loadUpstashModules();
+  const limiterMap = {
+    auth: authRateLimiterInstance,
+    api: apiRateLimiterInstance,
+    strict: strictRateLimiterInstance,
+    read: readRateLimiterInstance,
+    write: writeRateLimiterInstance
+  };
+  const limiter = limiterMap[type];
+  if (!limiter) {
+    console.warn("[RateLimit] FALLBACK MODE: Rate limiting disabled - Redis unavailable. Identifier:", identifier, "Tier:", type);
+    return {
+      success: true,
+      remaining: 100,
+      reset: Date.now() + 6e4
+    };
+  }
+  try {
+    const result = await limiter.limit(identifier);
+    const retryAfter = result.success ? void 0 : Math.ceil((result.reset - Date.now()) / 1e3);
+    return {
+      success: result.success,
+      remaining: result.remaining,
+      reset: result.reset,
+      limit: result.limit,
+      retryAfter
+    };
+  } catch (error) {
+    console.error("[RateLimit] Redis error:", error);
+    return {
+      success: true,
+      remaining: 100,
+      reset: Date.now() + 6e4
+    };
+  }
+}
+async function isRedisConfigured() {
+  await loadUpstashModules();
+  return redis !== null;
+}
+function maybeRedisConfigured() {
+  return !!(process.env.UPSTASH_REDIS_REST_URL && process.env.UPSTASH_REDIS_REST_TOKEN);
+}
+function getRateLimitHeaders(result) {
+  const headers = {
+    "X-RateLimit-Remaining": String(result.remaining),
+    "X-RateLimit-Reset": String(result.reset)
+  };
+  if (result.limit) {
+    headers["X-RateLimit-Limit"] = String(result.limit);
+  }
+  if (result.retryAfter !== void 0 && result.retryAfter > 0) {
+    headers["Retry-After"] = String(result.retryAfter);
+  }
+  return headers;
+}
+function createRateLimitResponse(result) {
+  return new Response(
+    JSON.stringify({
+      error: "Too Many Requests",
+      message: "Rate limit exceeded. Please try again later.",
+      retryAfter: result.retryAfter
+    }),
+    {
+      status: 429,
+      headers: {
+        "Content-Type": "application/json",
+        ...getRateLimitHeaders(result)
+      }
+    }
+  );
+}
+export {
+  apiRateLimiter,
+  authRateLimiter,
+  checkRateLimit,
+  createRateLimitResponse,
+  getRateLimitHeaders,
+  isRedisConfigured,
+  maybeRedisConfigured,
+  strictRateLimiter
+};

package/dist/lib/role-helpers.js

@@ -1,5 +1,5 @@
 import { useTranslations } from "next-intl";
-import { roleHelpers } from "../types/user.types";
+import { roleHelpers } from "../types/user.types.js";
 function useRoleTranslations() {
   const t = useTranslations();
   return (role) => {

package/dist/lib/scheduled-actions/cleanup.js

@@ -1,5 +1,5 @@
-import { mutateWithRLS } from "../db";
-import { APP_CONFIG_MERGED } from "../config";
+import { mutateWithRLS } from "../db.js";
+import { APP_CONFIG_MERGED } from "../config/index.js";
 const DEFAULT_RETENTION_DAYS = 7;
 async function cleanupOldActions(retentionDays) {
   var _a;

package/dist/lib/scheduled-actions/handlers/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Scheduled Actions - Core Handlers
+ *
+ * This module exports all core scheduled action handlers.
+ * Themes can import and register these handlers during initialization.
+ *
+ * @module core/lib/scheduled-actions/handlers
+ */
+export { registerPatternCacheInvalidationHandler } from './invalidate-pattern-cache';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/scheduled-actions/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/scheduled-actions/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,uCAAuC,EAAE,MAAM,4BAA4B,CAAA"}

package/dist/lib/scheduled-actions/handlers/index.js

@@ -0,0 +1,4 @@
+import { registerPatternCacheInvalidationHandler } from "./invalidate-pattern-cache.js";
+export {
+  registerPatternCacheInvalidationHandler
+};

package/dist/lib/scheduled-actions/handlers/invalidate-pattern-cache.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Scheduled Action Handler: Invalidate Pattern Cache
+ *
+ * Asynchronously invalidates ISR cache for all pages using a pattern.
+ * This is triggered when a pattern's blocks are updated, ensuring
+ * dependent pages are refreshed without blocking the update request.
+ *
+ * @module core/lib/scheduled-actions/handlers/invalidate-pattern-cache
+ */
+/**
+ * Register the pattern cache invalidation handler
+ *
+ * Call this function during app initialization to register the handler.
+ * The handler processes invalidations in batches for better performance.
+ */
+export declare function registerPatternCacheInvalidationHandler(): void;
+//# sourceMappingURL=invalidate-pattern-cache.d.ts.map

package/dist/lib/scheduled-actions/handlers/invalidate-pattern-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalidate-pattern-cache.d.ts","sourceRoot":"","sources":["../../../../src/lib/scheduled-actions/handlers/invalidate-pattern-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAsDH;;;;;GAKG;AACH,wBAAgB,uCAAuC,IAAI,IAAI,CA6E9D"}

package/dist/lib/scheduled-actions/handlers/invalidate-pattern-cache.js

@@ -0,0 +1,84 @@
+import { revalidatePath } from "next/cache";
+import { registerScheduledAction } from "../registry.js";
+import { PatternUsageService } from "../../services/pattern-usage.service.js";
+import { entityRegistry } from "../../entities/registry.js";
+import { getEntityBasePath } from "../../entities/schema-generator.js";
+function getEntityPublicUrl(entityType, entitySlug) {
+  var _a;
+  if (!entitySlug) return null;
+  try {
+    const entityConfig = entityRegistry.get(entityType);
+    if (!entityConfig) return null;
+    if (((_a = entityConfig.access) == null ? void 0 : _a.public) === false) return null;
+    const basePath = getEntityBasePath(entityConfig);
+    if (basePath === "/") {
+      return `/${entitySlug}`;
+    } else if (basePath) {
+      return `${basePath}/${entitySlug}`;
+    }
+    return `/${entityType}/${entitySlug}`;
+  } catch {
+    return null;
+  }
+}
+function registerPatternCacheInvalidationHandler() {
+  registerScheduledAction(
+    "pattern:invalidate-cache",
+    async (payload, action) => {
+      const { patternId, userId } = payload;
+      console.info(
+        `[ScheduledAction:pattern:invalidate-cache] Starting for pattern ${patternId} (action: ${action.id})`
+      );
+      const MAX_USAGES = 1e3;
+      const { usages, total } = await PatternUsageService.getUsagesWithEntityInfo(
+        patternId,
+        userId,
+        { limit: MAX_USAGES }
+      );
+      if (total === 0) {
+        console.info(
+          `[ScheduledAction:pattern:invalidate-cache] Pattern ${patternId} has no usages, nothing to invalidate`
+        );
+        return;
+      }
+      if (total > MAX_USAGES) {
+        console.warn(
+          `[ScheduledAction:pattern:invalidate-cache] Pattern ${patternId} has ${total} usages, only invalidating first ${MAX_USAGES}. Remaining pages will refresh via ISR.`
+        );
+      }
+      const invalidatedPaths = [];
+      const BATCH_SIZE = 10;
+      for (let i = 0; i < usages.length; i += BATCH_SIZE) {
+        const batch = usages.slice(i, i + BATCH_SIZE);
+        await Promise.all(
+          batch.map(async (usage) => {
+            const publicUrl = getEntityPublicUrl(usage.entityType, usage.entitySlug);
+            if (publicUrl) {
+              try {
+                revalidatePath(publicUrl);
+                invalidatedPaths.push(publicUrl);
+              } catch (error) {
+                console.warn(
+                  `[ScheduledAction:pattern:invalidate-cache] Failed to revalidate ${publicUrl}:`,
+                  error
+                );
+              }
+            }
+          })
+        );
+      }
+      console.info(
+        `[ScheduledAction:pattern:invalidate-cache] Pattern ${patternId}: Invalidated ${invalidatedPaths.length}/${total} pages. Sample paths: ${invalidatedPaths.slice(0, 5).join(", ")}${invalidatedPaths.length > 5 ? "..." : ""}`
+      );
+    },
+    {
+      description: "Invalidate ISR cache for pages using a pattern",
+      timeout: 3e4
+      // 30 seconds timeout for large invalidations
+    }
+  );
+  console.log("[ScheduledActions] Registered handler: pattern:invalidate-cache");
+}
+export {
+  registerPatternCacheInvalidationHandler
+};

package/dist/lib/scheduled-actions/index.d.js

@@ -1,8 +1,8 @@
-import { registerScheduledAction, getActionHandler, getAllRegisteredActions, isActionRegistered, clearActionRegistry } from "./registry";
-import { scheduleAction, scheduleRecurringAction, cancelScheduledAction } from "./scheduler";
-import { processPendingActions } from "./processor";
-import { cleanupOldActions } from "./cleanup";
-import { initializeScheduledActions, initializeRecurringActions } from "./initializer";
+import { registerScheduledAction, getActionHandler, getAllRegisteredActions, isActionRegistered, clearActionRegistry } from "./registry.js";
+import { scheduleAction, scheduleRecurringAction, cancelScheduledAction } from "./scheduler.js";
+import { processPendingActions } from "./processor.js";
+import { cleanupOldActions } from "./cleanup.js";
+import { initializeScheduledActions, initializeRecurringActions } from "./initializer.js";
 export {
   cancelScheduledAction,
   cleanupOldActions,

package/dist/lib/scheduled-actions/index.js

@@ -4,22 +4,22 @@ import {
   getAllRegisteredActions,
   isActionRegistered,
   clearActionRegistry
-} from "./registry";
+} from "./registry.js";
 import {
   scheduleAction,
   scheduleRecurringAction,
   cancelScheduledAction
-} from "./scheduler";
+} from "./scheduler.js";
 import {
   processPendingActions
-} from "./processor";
+} from "./processor.js";
 import {
   cleanupOldActions
-} from "./cleanup";
+} from "./cleanup.js";
 import {
   initializeScheduledActions,
   initializeRecurringActions
-} from "./initializer";
+} from "./initializer.js";
 export {
   cancelScheduledAction,
   cleanupOldActions,

package/dist/lib/scheduled-actions/processor.js

@@ -1,7 +1,7 @@
-import { queryWithRLS, mutateWithRLS } from "../db";
-import { APP_CONFIG_MERGED } from "../config";
-import { getActionHandler } from "./registry";
-import { scheduleAction } from "./scheduler";
+import { queryWithRLS, mutateWithRLS } from "../db.js";
+import { APP_CONFIG_MERGED } from "../config/index.js";
+import { getActionHandler } from "./registry.js";
+import { scheduleAction } from "./scheduler.js";
 const DEFAULT_BATCH_SIZE = 10;
 const DEFAULT_TIMEOUT = 3e4;
 async function processPendingActions(batchSize) {

package/dist/lib/scheduled-actions/scheduler.js

@@ -1,5 +1,5 @@
-import { mutateWithRLS, queryWithRLS } from "../db";
-import { APP_CONFIG_MERGED } from "../config/config-sync";
+import { mutateWithRLS, queryWithRLS } from "../db.js";
+import { APP_CONFIG_MERGED } from "../config/config-sync.js";
 async function scheduleAction(actionType, payload, options) {
   var _a;
   const dedupeConfig = (_a = APP_CONFIG_MERGED.scheduledActions) == null ? void 0 : _a.deduplication;