@nextsparkjs/core 0.1.0-beta.175 → 0.1.0-beta.176

package/dist/styles/classes.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-06-28T22:03:02.165Z",
+  "generated": "2026-06-28T23:29:37.388Z",
   "totalClasses": 1081,
   "classes": [
     "!text-2xl",

package/dist/templates/app/api/v1/auth/signup-with-invite/route.ts

@@ -170,15 +170,24 @@ export const POST = withRateLimitTier(withApiLogging(
         return addCorsHeaders(response)
       }
 
+      // Steps 3-4 run via the service pool (RLS bypass). This is a trusted
+      // server flow: the invite token was validated above and the account was
+      // just created, so there is no invitee session to drive RLS — and a
+      // `SET LOCAL app.user_id` context does not reliably propagate to the
+      // membership INSERT over a pooled (PgBouncer) connection, which makes the
+      // team_members self-join policy intermittently reject it. Writing as the
+      // service role sidesteps that; every row carries explicit ids.
+
       // Step 3: Mark email as verified (skip email verification since invitation proves email ownership)
       await mutateWithRLS(
         'UPDATE "users" SET "emailVerified" = true, "updatedAt" = CURRENT_TIMESTAMP WHERE id = $1',
         [userId],
-        userId
+        undefined,
+        { service: true }
       )
 
       // Step 4: Accept the invitation (add user to team)
-      const tx = await getTransactionClient(userId)
+      const tx = await getTransactionClient(userId, { service: true })
 
       try {
         // Add user as team member

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.175",
+  "version": "0.1.0-beta.176",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -469,7 +469,7 @@
     "tailwind-merge": "^3.3.1",
     "uuid": "^13.0.0",
     "zod": "^4.1.5",
-    "@nextsparkjs/testing": "0.1.0-beta.175"
+    "@nextsparkjs/testing": "0.1.0-beta.176"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs || true",

package/templates/app/api/v1/auth/signup-with-invite/route.ts

@@ -170,15 +170,24 @@ export const POST = withRateLimitTier(withApiLogging(
         return addCorsHeaders(response)
       }
 
+      // Steps 3-4 run via the service pool (RLS bypass). This is a trusted
+      // server flow: the invite token was validated above and the account was
+      // just created, so there is no invitee session to drive RLS — and a
+      // `SET LOCAL app.user_id` context does not reliably propagate to the
+      // membership INSERT over a pooled (PgBouncer) connection, which makes the
+      // team_members self-join policy intermittently reject it. Writing as the
+      // service role sidesteps that; every row carries explicit ids.
+
       // Step 3: Mark email as verified (skip email verification since invitation proves email ownership)
       await mutateWithRLS(
         'UPDATE "users" SET "emailVerified" = true, "updatedAt" = CURRENT_TIMESTAMP WHERE id = $1',
         [userId],
-        userId
+        undefined,
+        { service: true }
       )
 
       // Step 4: Accept the invitation (add user to team)
-      const tx = await getTransactionClient(userId)
+      const tx = await getTransactionClient(userId, { service: true })
 
       try {
         // Add user as team member