@nextsparkjs/core 0.1.0-beta.184 → 0.1.0-beta.186

package/dist/templates/proxy.ts

@@ -64,9 +64,48 @@ function isPublicPath(pathname: string): boolean {
   )
 }
 
+/**
+ * Identity headers this proxy injects for downstream server code.
+ *
+ * SECURITY (#87): these headers are trusted by RSC layouts and permission
+ * checks, so an inbound value must NEVER reach the app. They are stripped from
+ * every request before any path branching and re-added only from the verified
+ * session. Gating the strip on protected prefixes is not enough: Next.js
+ * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
+ * action can be POSTed to a public path with a forged `x-user-id`.
+ */
+const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname'] as const
+
+/**
+ * Build the request headers forwarded to the app: inbound copy minus every
+ * trusted identity header, plus the real pathname.
+ */
+function sanitizeRequestHeaders(request: NextRequest): Headers {
+  const headers = new Headers(request.headers)
+  for (const name of TRUSTED_IDENTITY_HEADERS) {
+    headers.delete(name)
+  }
+  headers.set('x-pathname', request.nextUrl.pathname)
+  return headers
+}
+
+/**
+ * Continue to the app with the (sanitized) request headers.
+ * Every pass-through in this proxy MUST go through here so the strip applies
+ * to public paths, /api/v1 and unmatched routes alike.
+ */
+function passThrough(requestHeaders: Headers): NextResponse {
+  return NextResponse.next({
+    request: { headers: requestHeaders },
+  })
+}
+
 export async function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl
 
+  // 0. Strip forgeable identity headers before ANY branching (see #87)
+  const requestHeaders = sanitizeRequestHeaders(request)
+
   // 1. Check for theme middleware override
   const activeTheme = process.env.NEXT_PUBLIC_ACTIVE_THEME
   if (activeTheme && hasThemeMiddleware(activeTheme)) {
@@ -114,17 +153,17 @@ export async function proxy(request: NextRequest) {
         return NextResponse.redirect(loginUrl)
       }
     }
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 4. Allow public paths
   if (isPublicPath(pathname)) {
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 5. API v1 routes handle their own dual authentication
   if (pathname.startsWith('/api/v1')) {
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 6. Protected routes - require authentication and inject user headers
@@ -162,20 +201,17 @@ export async function proxy(request: NextRequest) {
         }
       }
 
-      // Inject user headers for downstream use
+      // Inject user headers for downstream use, ONLY from the verified session
+      // (requestHeaders already had any inbound values stripped).
       // IMPORTANT: EntityPermissionLayout depends on these headers
-      const requestHeaders = new Headers(request.headers)
       if (session.user?.id) {
         requestHeaders.set('x-user-id', session.user.id)
       }
       if (session.user?.email) {
         requestHeaders.set('x-user-email', session.user.email)
       }
-      requestHeaders.set('x-pathname', pathname)
 
-      return NextResponse.next({
-        request: { headers: requestHeaders },
-      })
+      return passThrough(requestHeaders)
     } catch (error) {
       console.error('Proxy error:', error)
       const loginUrl = new URL('/login', request.url)
@@ -184,7 +220,7 @@ export async function proxy(request: NextRequest) {
     }
   }
 
-  return NextResponse.next()
+  return passThrough(requestHeaders)
 }
 
 export const config = {

package/dist/templates/tsconfig.json

@@ -56,6 +56,10 @@
   ],
   "exclude": [
     "node_modules",
+    // PPR template variants (layout.ppr.tsx) are copied over layout.tsx when a project
+    // enables cacheComponents; in place they import registry exports that only exist
+    // in PPR mode, so they are never type-checked as-is.
+    "**/*.ppr.tsx",
     "**/*.test.ts",
     "**/*.test.tsx",
     "**/*.spec.ts",

package/dist/types/theme.d.ts

@@ -17,6 +17,15 @@ export interface ThemeConfig {
     enabled?: boolean;
     /** Default theme mode - controls next-themes behavior */
     defaultMode?: 'light' | 'dark' | 'system';
+    /**
+     * Force a theme on specific routes, ignoring user and system preference.
+     * Keys are route prefixes matched at segment boundaries (the longest match
+     * wins); values are the theme to force. The root ThemeProvider passes the
+     * resolved value to next-themes' `forcedTheme`, so the route renders with
+     * that theme from the first paint and on client-side navigations.
+     * @example { '/login': 'light', '/signup': 'light', '/embed': 'dark' }
+     */
+    forcedThemeRoutes?: Record<string, 'light' | 'dark'>;
     dependencies?: string[];
     plugins?: string[];
     styles?: {

package/dist/types/theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../src/types/theme.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAE9B;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAA;IACzC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACnC,CAAA;IACD,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,GAAG,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,GAAG,CAAA;IACd,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,YAAY,EAAE,gBAAgB,EAAE,CAAA;CACjC"}
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../src/types/theme.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAE9B;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAA;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAA;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACnC,CAAA;IACD,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,GAAG,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,GAAG,CAAA;IACd,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,YAAY,EAAE,gBAAgB,EAAE,CAAA;CACjC"}

package/migrations/005_api_audit_log.sql

@@ -3,7 +3,8 @@
 
 CREATE TABLE IF NOT EXISTS "api_audit_log" (
   id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-  "apiKeyId" TEXT NOT NULL REFERENCES public."api_key"(id) ON DELETE CASCADE,
+  -- NULL for session-authenticated requests (see 025_api_audit_log_nullable_api_key.sql)
+  "apiKeyId" TEXT REFERENCES public."api_key"(id) ON DELETE CASCADE,
   "userId"   TEXT NOT NULL REFERENCES public."users"(id) ON DELETE CASCADE,
   endpoint   TEXT NOT NULL,
   method     TEXT NOT NULL,

package/migrations/025_api_audit_log_nullable_api_key.sql

@@ -0,0 +1,12 @@
+-- Migration: 025_api_audit_log_nullable_api_key.sql
+-- Description: Allow api_audit_log rows without an API key (#105)
+--
+-- The generic entity routes (/api/v1/[entity], /api/v1/[entity]/[id]) now
+-- write an audit row for every authenticated request, whether it was
+-- authenticated with an API key or with a browser session. Session requests
+-- have no key, so "apiKeyId" must accept NULL. The foreign key stays as-is:
+-- a FK only constrains non-null values.
+--
+-- Idempotent: DROP NOT NULL on an already-nullable column is a no-op.
+
+ALTER TABLE "api_audit_log" ALTER COLUMN "apiKeyId" DROP NOT NULL;

package/migrations/026_login_events.sql

@@ -0,0 +1,91 @@
+-- Migration: 026_login_events.sql
+-- Description: login_events — per-user device/login history for built-in
+--              security email notifications (new-device login alerts).
+-- Date: 2026-09-01
+-- Issue: #75
+--
+-- Why 026 (and not 022 as the issue text proposed, nor 025):
+--   The issue was written when the migration sequence ended earlier. By the
+--   time this branch was authored the sequence already went through
+--   024_teams_soft_delete.sql (022 and 023 are taken by rls_runtime_roles and
+--   the invitations index), so this migration was originally 025. It was
+--   renumbered to 026 when merging to main, because 025 had in the meantime
+--   been taken by 025_api_audit_log_nullable_api_key.sql (issue #105).
+--
+-- What this backs:
+--   The security-notifications dispatcher records one row per successful sign-in
+--   with a device fingerprint = sha256(normalizedUA | ip/24). A sign-in whose
+--   (userId, deviceFingerprint) pair has never been seen is flagged isNew=true
+--   and triggers a "new device" email via the auth:security-notification
+--   scheduled action. Known fingerprints are still logged (isNew=false) but send
+--   no email. The table is also the substrate for a future login-history UI
+--   (out of scope here — see issue #75 "Out of scope").
+--
+-- Append-only: rows are never updated, so there is no "updatedAt"/set_updated_at
+-- trigger (unlike mutable entity tables). city/country are nullable for a future
+-- geolocation enhancement (also out of scope).
+
+-- ============================================
+-- TABLE
+-- ============================================
+DROP TABLE IF EXISTS public."login_events" CASCADE;
+
+CREATE TABLE IF NOT EXISTS public."login_events" (
+  -- Primary Key (TEXT not UUID — Better Auth convention)
+  id                  TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+
+  -- Relational Fields
+  "userId"            TEXT NOT NULL REFERENCES public."users"(id) ON DELETE CASCADE,
+
+  -- Entity-specific fields
+  "ipAddress"         TEXT,
+  "userAgent"         TEXT,
+  "deviceFingerprint" TEXT NOT NULL,
+  city                TEXT,
+  country             TEXT,
+  "isNew"             BOOLEAN NOT NULL DEFAULT false,
+
+  -- System fields (append-only: created only, never updated)
+  "createdAt"         TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE  public."login_events"                     IS 'Per-user login/device history backing built-in new-device security email notifications (issue #75).';
+COMMENT ON COLUMN public."login_events"."userId"            IS 'Owner of the login event.';
+COMMENT ON COLUMN public."login_events"."ipAddress"         IS 'Best-effort client IP captured at sign-in (may be a proxy address).';
+COMMENT ON COLUMN public."login_events"."userAgent"         IS 'Raw User-Agent header captured at sign-in.';
+COMMENT ON COLUMN public."login_events"."deviceFingerprint" IS 'sha256(normalizedUA | ip/24). Stable across patch-version UA churn and within a /24 network so routine re-logins from the same device do not re-alert.';
+COMMENT ON COLUMN public."login_events".city                IS 'Reserved for future geolocation enrichment (nullable, unused today).';
+COMMENT ON COLUMN public."login_events".country             IS 'Reserved for future geolocation enrichment (nullable, unused today).';
+COMMENT ON COLUMN public."login_events"."isNew"             IS 'True when this (userId, deviceFingerprint) pair had not been seen before this row → a new-device email was queued.';
+
+-- ============================================
+-- INDEXES
+-- ============================================
+-- Most-recent-first history lookups per user (login-history UI, TTL checks).
+CREATE INDEX IF NOT EXISTS idx_login_events_user_created
+  ON public."login_events" ("userId", "createdAt" DESC);
+
+-- "Have we seen this fingerprint for this user?" — the new-device decision.
+CREATE INDEX IF NOT EXISTS idx_login_events_user_fingerprint
+  ON public."login_events" ("userId", "deviceFingerprint");
+
+-- ============================================
+-- RLS
+-- ============================================
+-- A user may read ONLY their own login events; superadmin/developer bypass via
+-- can_bypass_rls() (defined in 001). Writes are service-only: the dispatcher
+-- inserts with no user GUC (service/bypass pool), matching how session/account
+-- rows are written in 002. Mirrors the "self read + service write" pattern.
+ALTER TABLE public."login_events" ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS "Login events self read"      ON public."login_events";
+DROP POLICY IF EXISTS "Login events service write"  ON public."login_events";
+
+CREATE POLICY "Login events self read" ON public."login_events"
+FOR SELECT TO authenticated
+USING (public.can_bypass_rls() OR "userId" = public.get_auth_user_id());
+
+CREATE POLICY "Login events service write" ON public."login_events"
+FOR ALL TO authenticated
+USING (public.can_bypass_rls())
+WITH CHECK (public.can_bypass_rls());

package/migrations/027_rls_bypass_developer_and_system_admin_team.sql

@@ -0,0 +1,197 @@
+-- Migration: 027_rls_bypass_developer_and_system_admin_team.sql
+-- Description: Resolve the System Admin Team by a metadata flag instead of a
+--              hardcoded team id, auto-enroll/unenroll developer/superadmin
+--              users via a trigger, and fix 4 RLS policies that hardcoded
+--              their own role check instead of calling can_bypass_rls().
+-- Date: 2026-09-03
+-- Issues: #108, #102
+--
+-- Why both issues in one migration: #102's fix (make a policy call
+-- can_bypass_rls()) only makes 'developer' bypass actually reachable in a
+-- real (non-seeded) deployment once #108's enrollment mechanism exists —
+-- fixing one without the other leaves the combination still broken.
+--
+-- #108 — System Admin Team enrollment:
+--   can_bypass_rls() grants 'developer' a conditional bypass: membership in
+--   the System Admin Team. Nothing ever enrolled anyone into it outside of
+--   090_sample_data.sql's explicit INSERTs, and the team id was a literal
+--   ('team-nextspark-001') duplicated in this function AND in
+--   dual-auth.ts's SYSTEM_ADMIN_TEAM_ID constant. This migration:
+--     1. Resolves the System Admin Team by `teams.metadata.systemAdmin =
+--        true` instead of a literal id — 090_sample_data.sql's team already
+--        carries this flag, so seeded deployments keep working unchanged;
+--        a real deployment flags its own team, no code change needed.
+--     2. Adds a trigger on users(role) that auto-enrolls a user into that
+--        team (as 'owner' for superadmin, 'admin' for developer) when their
+--        role becomes bypass-eligible, and removes the membership when it
+--        stops being eligible. Framework-level (a Postgres trigger fires
+--        regardless of which application code performed the UPDATE) rather
+--        than an app-level hook, because no Server Action in core actually
+--        assigns users.role today — the only code that does lives in
+--        apps/dev, reimplementable by any consumer of this framework.
+--     3. Backfills existing developer/superadmin users into the team, for
+--        deployments that already have such users predating this trigger.
+--   Deliberately NOT included here (separate, larger concern — see #108):
+--   POST /api/v1/users creating a "half" user (no account/team/subscription
+--   row). That depends on patterns from the not-yet-approved #98 MCP work.
+--
+-- #102 (+ 3 more found while auditing the same pattern) — RLS policies that
+-- hardcoded `role IN ('admin','superadmin')` or `role = 'superadmin'`
+-- instead of calling can_bypass_rls() have drifted from it in both
+-- directions. 'admin' is NOT a valid users.role value (see check_users_role
+-- in 002_auth_tables.sql: only 'member' | 'superadmin' | 'developer'), so
+-- that branch never matched any real row — removing it changes nothing for
+-- existing behavior. All four also silently excluded 'developer', who
+-- can_bypass_rls() already grants conditional bypass everywhere else.
+-- Switching to can_bypass_rls() is a pure widening for 'developer' and an
+-- exact match for 'superadmin' — no regression, only fixes a gap:
+--   - users_metas_owner_or_admin_all   (003_user_metas.sql)
+--   - "API key owner or admin can do all" (004_api_key.sql)
+--   - "API logs superadmin can select"     (005_api_audit_log.sql)
+--   - "Plans superadmin write"             (012_billing_plans.sql)
+
+-- ============================================
+-- #108.1 — can_bypass_rls(): resolve System Admin Team by metadata flag
+-- ============================================
+
+CREATE OR REPLACE FUNCTION public.can_bypass_rls()
+RETURNS BOOLEAN AS $$
+DECLARE
+  current_user_id TEXT;
+  user_role TEXT;
+  admin_team_id TEXT;
+  is_system_admin_member BOOLEAN;
+BEGIN
+  current_user_id := public.get_auth_user_id();
+
+  SELECT role INTO user_role
+  FROM public."users"
+  WHERE id = current_user_id;
+
+  IF user_role = 'superadmin' THEN
+    RETURN TRUE;
+  END IF;
+
+  IF user_role = 'developer' THEN
+    -- The System Admin Team is whichever team has metadata.systemAdmin =
+    -- true, not a hardcoded id — each deployment can flag its own team.
+    SELECT id INTO admin_team_id
+    FROM public."teams"
+    WHERE (metadata->>'systemAdmin')::boolean IS TRUE
+    LIMIT 1;
+
+    IF admin_team_id IS NULL THEN
+      RETURN FALSE;
+    END IF;
+
+    SELECT EXISTS(
+      SELECT 1 FROM public."team_members"
+      WHERE "userId" = current_user_id
+        AND "teamId" = admin_team_id
+    ) INTO is_system_admin_member;
+
+    RETURN is_system_admin_member;
+  END IF;
+
+  RETURN FALSE;
+END;
+$$ LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = public;
+
+-- ============================================
+-- #108.2 — auto-enroll/unenroll on role change
+-- ============================================
+
+CREATE OR REPLACE FUNCTION public.sync_system_admin_team_membership()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  admin_team_id TEXT;
+  new_team_role TEXT;
+BEGIN
+  SELECT id INTO admin_team_id
+  FROM public."teams"
+  WHERE (metadata->>'systemAdmin')::boolean IS TRUE
+  LIMIT 1;
+
+  -- No team flagged as the System Admin Team in this deployment yet —
+  -- nothing to enroll into. Not an error: same as no bypass being possible.
+  IF admin_team_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  IF NEW.role IN ('developer', 'superadmin') THEN
+    new_team_role := CASE WHEN NEW.role = 'superadmin' THEN 'owner' ELSE 'admin' END;
+
+    INSERT INTO public."team_members" ("teamId", "userId", role)
+    VALUES (admin_team_id, NEW.id, new_team_role)
+    ON CONFLICT ("teamId", "userId") DO UPDATE SET role = EXCLUDED.role;
+
+  ELSIF TG_OP = 'UPDATE' AND OLD.role IN ('developer', 'superadmin') THEN
+    -- Role changed away from a bypass-eligible tier: revoke membership.
+    DELETE FROM public."team_members"
+    WHERE "teamId" = admin_team_id AND "userId" = NEW.id;
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_sync_system_admin_team_membership ON public."users";
+CREATE TRIGGER trg_sync_system_admin_team_membership
+AFTER INSERT OR UPDATE OF role ON public."users"
+FOR EACH ROW
+EXECUTE FUNCTION public.sync_system_admin_team_membership();
+
+-- ============================================
+-- #108.3 — backfill existing developer/superadmin users
+-- ============================================
+
+DO $$
+DECLARE
+  admin_team_id TEXT;
+BEGIN
+  SELECT id INTO admin_team_id
+  FROM public."teams"
+  WHERE (metadata->>'systemAdmin')::boolean IS TRUE
+  LIMIT 1;
+
+  IF admin_team_id IS NOT NULL THEN
+    INSERT INTO public."team_members" ("teamId", "userId", role)
+    SELECT admin_team_id, u.id, CASE WHEN u.role = 'superadmin' THEN 'owner' ELSE 'admin' END
+    FROM public."users" u
+    WHERE u.role IN ('developer', 'superadmin')
+    ON CONFLICT ("teamId", "userId") DO UPDATE SET role = EXCLUDED.role;
+  END IF;
+END $$;
+
+-- ============================================
+-- #102 + siblings — switch drifted policies to can_bypass_rls()
+-- ============================================
+
+DROP POLICY IF EXISTS "users_metas_owner_or_admin_all" ON "users_metas";
+CREATE POLICY "users_metas_owner_or_admin_all" ON "users_metas"
+  FOR ALL
+  TO authenticated
+  USING ("userId" = public.get_auth_user_id() OR public.can_bypass_rls())
+  WITH CHECK ("userId" = public.get_auth_user_id() OR public.can_bypass_rls());
+
+DROP POLICY IF EXISTS "API key owner or admin can do all" ON "api_key";
+CREATE POLICY "API key owner or admin can do all" ON "api_key"
+  FOR ALL TO authenticated
+  USING ("userId" = public.get_auth_user_id() OR public.can_bypass_rls())
+  WITH CHECK ("userId" = public.get_auth_user_id() OR public.can_bypass_rls());
+
+DROP POLICY IF EXISTS "API logs superadmin can select" ON "api_audit_log";
+CREATE POLICY "API logs superadmin can select" ON "api_audit_log"
+  FOR SELECT TO authenticated
+  USING (public.can_bypass_rls());
+
+DROP POLICY IF EXISTS "Plans superadmin write" ON public."plans";
+CREATE POLICY "Plans superadmin write"
+ON public."plans"
+FOR ALL TO authenticated
+USING (public.can_bypass_rls())
+WITH CHECK (public.can_bypass_rls());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.184",
+  "version": "0.1.0-beta.186",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -50,10 +50,6 @@
     },
     "./globals.css": "./globals.css",
     "./theme-styles.css": "./theme-styles.css",
-    "./styles/ui.css": {
-      "style": "./dist/styles/ui.css",
-      "default": "./dist/styles/ui.css"
-    },
     "./styles/utilities.css": "./styles/utilities.css",
     "./styles/docs.css": "./styles/docs.css",
     "./lib/middleware": {
@@ -64,6 +60,10 @@
       "types": "./dist/lib/services/index.d.ts",
       "import": "./dist/lib/services/index.js"
     },
+    "./lib/mcp": {
+      "types": "./dist/lib/mcp/index.d.ts",
+      "import": "./dist/lib/mcp/index.js"
+    },
     "./lib/config": {
       "types": "./dist/lib/config/index.d.ts",
       "import": "./dist/lib/config/index.js"
@@ -108,6 +108,14 @@
       "types": "./dist/lib/scheduled-actions/index.d.ts",
       "import": "./dist/lib/scheduled-actions/index.js"
     },
+    "./lib/scheduled-actions/handlers": {
+      "types": "./dist/lib/scheduled-actions/handlers/index.d.ts",
+      "import": "./dist/lib/scheduled-actions/handlers/index.js"
+    },
+    "./lib/auth/security-notifications": {
+      "types": "./dist/lib/auth/security-notifications/index.d.ts",
+      "import": "./dist/lib/auth/security-notifications/index.js"
+    },
     "./lib/permissions": {
       "types": "./dist/lib/permissions/index.d.ts",
       "import": "./dist/lib/permissions/index.js"
@@ -401,8 +409,9 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@hookform/resolvers": "^5.2.1",
+    "@hookform/resolvers": "^5.9.1",
     "@inquirer/prompts": "^7.2.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@nextsparkjs/ui": "^0.1.0-beta.2",
     "@polar-sh/sdk": "^0.43.1",
     "@radix-ui/react-accordion": "^1.2.12",
@@ -437,7 +446,7 @@
     "@upstash/ratelimit": "^2.0.3",
     "@upstash/redis": "^1.20.6",
     "@vercel/blob": "^2.0.0",
-    "better-auth": "^1.3.5",
+    "better-auth": "~1.6.30",
     "chalk": "^5.4.1",
     "jiti": "^2.7.0",
     "kysely": "0.28.17",
@@ -463,21 +472,20 @@
     "remark-gfm": "^4.0.1",
     "remark-rehype": "^11.1.2",
     "resend": "^5.0.0",
-    "sharp": "^0.33.5",
+    "sharp": "^0.34.3 || ^0.35.3",
     "shiki": "^3.20.0",
     "sonner": "^2.0.7",
     "stripe": "^18.5.0",
     "tailwind-merge": "^3.3.1",
     "uuid": "^13.0.0",
-    "zod": "^4.1.5",
-    "@nextsparkjs/testing": "0.1.0-beta.184"
+    "zod": "^4.3.6",
+    "@nextsparkjs/testing": "0.1.0-beta.186"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs || true",
-    "build": "tsup && pnpm build:dts && pnpm build:ui-css",
+    "build": "tsup && pnpm build:dts",
     "build:js": "tsup",
     "build:dts": "tsc -p tsconfig.dts.json || echo '⚠️  DTS generation completed with some type errors (partial coverage)'",
-    "build:ui-css": "node scripts/build/build-ui-css.mjs",
     "dev": "tsup --watch",
     "test": "jest",
     "test:watch": "jest --watch",

package/scripts/build/registry/__tests__/mcp-registry.test.mjs

@@ -0,0 +1,64 @@
+/**
+ * Tests for the mcp-registry generator.
+ *
+ * Run: node --test packages/core/scripts/build/registry/__tests__/mcp-registry.test.mjs
+ */
+
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { generateMcpRegistry } from '../generators/mcp-registry.mjs'
+
+const CONFIG = { outputDir: '/project/.nextspark/registries', isNpmMode: false }
+
+test('emits an empty MCP_OVERRIDES map when no overrides were discovered', () => {
+  const out = generateMcpRegistry([], CONFIG)
+  assert.match(out, /export const MCP_OVERRIDES: Record<string, McpEntityOverride> = \{\s*\}/)
+  assert.doesNotMatch(out, /^import .+McpOverride/m)
+})
+
+test('emits one literal import + map entry per discovered override', () => {
+  const out = generateMcpRegistry(
+    [{ slug: 'customers', importPath: '@/contents/themes/default/entities/customers/mcp', themeName: 'default' }],
+    CONFIG
+  )
+  assert.match(out, /import CustomersMcpOverride from '@\/contents\/themes\/default\/entities\/customers\/mcp'/)
+  assert.match(out, /'customers': CustomersMcpOverride,/)
+})
+
+test('imports the McpEntityOverride type from @/core/lib/mcp in monorepo mode', () => {
+  const out = generateMcpRegistry([], CONFIG)
+  assert.match(out, /import type \{ McpEntityOverride \} from '@\/core\/lib\/mcp'/)
+})
+
+test('converts @/core/lib/mcp to @nextsparkjs/core/lib/mcp in npm mode', () => {
+  const out = generateMcpRegistry([], { ...CONFIG, isNpmMode: true })
+  assert.match(out, /import type \{ McpEntityOverride \} from '@nextsparkjs\/core\/lib\/mcp'/)
+})
+
+test('PascalCases hyphenated/underscored/nested slugs into a valid identifier', () => {
+  const out = generateMcpRegistry(
+    [
+      { slug: 'meal-plans', importPath: '@/contents/themes/default/entities/meal-plans/mcp' },
+      { slug: 'pantry_items', importPath: '@/contents/themes/default/entities/pantry_items/mcp' },
+    ],
+    CONFIG
+  )
+  assert.match(out, /import MealPlansMcpOverride from/)
+  assert.match(out, /import PantryItemsMcpOverride from/)
+  assert.match(out, /'meal-plans': MealPlansMcpOverride,/)
+  assert.match(out, /'pantry_items': PantryItemsMcpOverride,/)
+})
+
+test('handles multiple overrides, one import + entry each, in discovery order', () => {
+  const out = generateMcpRegistry(
+    [
+      { slug: 'customers', importPath: '@/contents/themes/default/entities/customers/mcp' },
+      { slug: 'tasks', importPath: '@/contents/themes/default/entities/tasks/mcp' },
+    ],
+    CONFIG
+  )
+  const importLines = out.match(/^import \w+McpOverride from .+$/gm) ?? []
+  assert.equal(importLines.length, 2)
+  assert.match(out, /'customers': CustomersMcpOverride,[\s\S]*'tasks': TasksMcpOverride,/)
+})