@nextsparkjs/core 0.1.0-beta.187 → 0.1.0-beta.189

package/dist/templates/contents/themes/starter/tests/cypress/e2e/uat/entities/tasks/tasks-crud.cy.ts

@@ -38,24 +38,13 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
   })
 
   afterEach(() => {
-    // Cleanup: Delete any tasks created during tests
-    if (createdTaskIds.length > 0) {
-      cy.window().then((win) => {
-        const teamId = win.localStorage.getItem('activeTeamId')
-        createdTaskIds.forEach((id) => {
-          cy.request({
-            method: 'DELETE',
-            url: `/api/v1/tasks/${id}`,
-            headers: {
-              'Content-Type': 'application/json',
-              'x-team-id': teamId || ''
-            },
-            failOnStatusCode: false
-          })
-        })
-        createdTaskIds = []
-      })
-    }
+    // Through the command rather than a request built here: it resolves the
+    // team the API requires even before a dashboard visit has put it in
+    // localStorage. Sending an empty `x-team-id` gets a 400 that nothing
+    // reports, and the tasks survive into the next test, where a count of rows
+    // then measures the leftovers instead of what that test created.
+    createdTaskIds.forEach((id) => cy.deleteTask(id))
+    createdTaskIds = []
   })
 
   // ============================================================
@@ -75,7 +64,9 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
       tasks.fillTaskForm(taskData)
       tasks.submitForm()
 
-      // Should redirect to list and show new task
+      // Saving lands on the detail page, so reaching the list is a separate
+      // visit. What this test is about is the task existing and showing there.
+      tasks.visitList()
       tasks.waitForList()
       tasks.assertTaskInList(taskData.title)
     })
@@ -93,6 +84,7 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
       tasks.fillTaskForm(taskData)
       tasks.submitForm()
 
+      tasks.visitList()
       tasks.waitForList()
       tasks.assertTaskInList(taskData.title)
     })
@@ -141,6 +133,9 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
 
     it('should navigate to task detail page', () => {
       cy.then(() => {
+        tasks.visitList()
+        tasks.waitForList()
+
         tasks.clickRow(testTaskId)
         tasks.waitForDetail()
 
@@ -195,7 +190,10 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
         tasks.fillTextField('title', newTitle)
         tasks.submitForm()
 
+        tasks.waitForDetail()
+
         // Verify update
+        tasks.visitList()
         tasks.waitForList()
         tasks.assertTaskInList(newTitle)
         tasks.assertTaskNotInList(originalTitle)
@@ -211,6 +209,9 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
         tasks.selectOption('status', 'done')
         tasks.submitForm()
 
+        tasks.waitForDetail()
+
+        tasks.visitList()
         tasks.waitForList()
         // Task should now show as done
         tasks.assertTaskInList(originalTitle)
@@ -226,6 +227,9 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
         tasks.selectOption('priority', 'urgent')
         tasks.submitForm()
 
+        tasks.waitForDetail()
+
+        tasks.visitList()
         tasks.waitForList()
         tasks.assertTaskInList(originalTitle)
       })
@@ -312,47 +316,49 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
         })
       })
 
-      // Refresh list to see new tasks
-      cy.reload()
+      // The list, not a reload: `cy.reload()` keeps the current URL, so a filter
+      // the previous test left in the query string is still applied here.
+      tasks.visitList()
       tasks.waitForList()
     })
 
     it('should filter tasks by status', () => {
-      // Filter by "todo" status
       tasks.filterByStatus('todo')
 
-      // Wait for filter to apply
-      cy.wait(500)
+      // The filter travels in the URL, and waiting on that is what settles the
+      // list: asserting row by row while the table is still refetching detaches
+      // the very rows being checked.
+      cy.url().should('include', 'status=todo')
+      cy.get(tasks.selectors.rowGeneric).should('have.length.greaterThan', 0)
 
-      // Should show only todo tasks
+      // A row shows the option's label, never the stored value.
       cy.get(tasks.selectors.rowGeneric).each(($row) => {
-        cy.wrap($row).should('contain.text', 'todo')
+        cy.wrap($row).should('contain.text', 'To Do')
       })
     })
 
     it('should filter tasks by priority', () => {
-      // Filter by "high" priority
       tasks.filterByPriority('high')
 
-      // Wait for filter to apply
-      cy.wait(500)
+      cy.url().should('include', 'priority=high')
+      cy.get(tasks.selectors.rowGeneric).should('have.length.greaterThan', 0)
 
-      // Should show only high priority tasks
       cy.get(tasks.selectors.rowGeneric).each(($row) => {
-        cy.wrap($row).should('contain.text', 'high')
+        cy.wrap($row).should('contain.text', 'High')
       })
     })
 
     it('should clear filters', () => {
-      // Apply filter
       tasks.filterByStatus('todo')
-      cy.wait(500)
+      // The filter travels in the URL, and waiting on that is what settles the
+      // list — a fixed wait counts rows mid-refetch and sees a partial table.
+      cy.url().should('include', 'status=todo')
 
-      // Clear filter
       tasks.clearStatusFilter()
-      cy.wait(500)
+      cy.url().should('not.include', 'status=')
 
-      // Should show all tasks again
+      // The three the beforeEach created: the starter seeds no tasks, so any
+      // higher number would be counting on a previous run's leftovers.
       cy.get(tasks.selectors.rowGeneric).should('have.length.at.least', 3)
     })
   })
@@ -388,8 +394,9 @@ describe('Tasks CRUD', { tags: ['@uat', '@tasks', '@crud'] }, () => {
         }
       })
 
-      // Refresh list
-      cy.reload()
+      // The list, not a reload: a search or filter left in the query string by
+      // the previous test would still be applied.
+      tasks.visitList()
       tasks.waitForList()
     })
 

package/dist/templates/contents/themes/starter/tests/cypress/fixtures/entities.json

@@ -15,6 +15,22 @@
         "status",
         "priority"
       ]
+    },
+    "pages": {
+      "slug": "pages",
+      "singular": "page",
+      "plural": "Pages",
+      "tableName": "pages",
+      "fields": [
+        "title",
+        "slug",
+        "status",
+        "locale"
+      ],
+      "filters": [
+        "status"
+      ],
+      "source": "theme"
     }
   },
   "tasks": {

package/dist/templates/contents/themes/starter/tests/cypress/src/components/DevKeyringPOM.ts

@@ -118,7 +118,9 @@ export class DevKeyringPOM extends BasePOM {
     this.submitLogin()
 
     // 3. Wait for login to complete
-    cy.url().should('include', '/dashboard', { timeout: 10000 })
+    // No explicit timeout: an inline one wins over the run's configuration, so a
+    // slow dev server could not be waited out with `--config defaultCommandTimeout`.
+    cy.url().should('include', '/dashboard')
 
     return this
   }

package/dist/templates/contents/themes/starter/tests/cypress/src/core/BlockEditorBasePOM.ts

@@ -58,9 +58,9 @@ export abstract class BlockEditorBasePOM extends BasePOM {
     return {
       // Editor main
       container: cySelector('blockEditor.container'),
-      titleInput: cySelector('blockEditor.titleInput'),
-      slugInput: cySelector('blockEditor.slugInput'),
-      saveButton: cySelector('blockEditor.saveButton'),
+      titleInput: cySelector('blockEditor.header.titleInput'),
+      slugInput: cySelector('blockEditor.header.slugInput'),
+      saveButton: cySelector('blockEditor.header.saveButton'),
       statusBadge: cySelector('blockEditor.statusBadge'),
       leftSidebarToggle: cySelector('blockEditor.leftSidebarToggle'),
       viewModeToggle: cySelector('blockEditor.viewModeToggle'),

package/dist/templates/contents/themes/starter/tests/cypress/src/entities/PagesPOM.ts

@@ -0,0 +1,137 @@
+/**
+ * PagesPOM - Page Object Model for Pages entity (List operations)
+ *
+ * Extends DashboardEntityPOM for list page operations.
+ * For editing pages with the block editor, use PageBuilderPOM from features/.
+ *
+ * @example
+ * // List operations
+ * PagesPOM.create()
+ *   .visitList()
+ *   .waitForList()
+ *   .search('About Us')
+ *   .selectFilter('status', 'published')
+ *
+ * // For editing pages, use PageBuilderPOM
+ * import { PageBuilderPOM } from '../features/PageBuilderPOM'
+ * PageBuilderPOM.create().visitEdit(pageId).setTitle('New Title').save()
+ */
+
+import { DashboardEntityPOM } from '../core/DashboardEntityPOM'
+import entitiesConfig from '../../fixtures/entities.json'
+
+export interface PageListFilters {
+  status?: 'draft' | 'published' | 'archived'
+  locale?: 'en' | 'es'
+}
+
+export class PagesPOM extends DashboardEntityPOM {
+  constructor() {
+    super(entitiesConfig.entities.pages.slug)
+  }
+
+  // ============================================
+  // FACTORY METHOD
+  // ============================================
+
+  static create(): PagesPOM {
+    return new PagesPOM()
+  }
+
+  // ============================================
+  // PAGE-SPECIFIC LIST METHODS
+  // ============================================
+
+  /**
+   * Filter pages by status
+   */
+  filterByStatus(status: 'draft' | 'published' | 'archived') {
+    return this.selectFilter('status', status)
+  }
+
+  /**
+   * Apply multiple filters at once
+   */
+  applyFilters(filters: PageListFilters) {
+    if (filters.status) {
+      this.filterByStatus(filters.status)
+    }
+    if (filters.locale) {
+      this.selectFilter('locale', filters.locale)
+    }
+    return this
+  }
+
+  // ============================================
+  // WORKFLOW METHODS
+  // ============================================
+
+  /**
+   * Navigate to create page
+   * Note: Pages use block editor, so this redirects to the editor
+   */
+  navigateToCreate() {
+    this.clickAdd()
+    return this
+  }
+
+  /**
+   * Navigate to edit page for a page
+   * Note: Pages use block editor, so this redirects to the editor
+   */
+  navigateToEdit(id: string) {
+    this.clickRowAction('edit', id)
+    return this
+  }
+
+  /**
+   * Delete page from list with API waits
+   */
+  deletePageWithApiWait(id: string) {
+    this.visitDetailWithApiWait(id)
+    this.clickDelete()
+    this.confirmDelete()
+    this.api.waitForDelete()
+    return this
+  }
+
+  /**
+   * Delete page by finding it in the list by title
+   */
+  deletePageByTitleWithApiWait(title: string) {
+    this.clickRowByText(title)
+    this.waitForDetail()
+    this.clickDelete()
+    this.confirmDelete()
+    this.api.waitForDelete()
+    return this
+  }
+
+  // ============================================
+  // ENTITY-SPECIFIC ASSERTIONS
+  // ============================================
+
+  /**
+   * Assert page appears in list
+   */
+  assertPageInList(title: string) {
+    return this.assertInList(title)
+  }
+
+  /**
+   * Assert page does not appear in list
+   */
+  assertPageNotInList(title: string) {
+    return this.assertNotInList(title)
+  }
+
+  /**
+   * Assert page has specific status badge
+   */
+  assertPageStatus(id: string, status: string) {
+    cy.get(this.selectors.row(id)).should('contain.text', status)
+    return this
+  }
+}
+
+export default PagesPOM

package/dist/templates/contents/themes/starter/tests/cypress/src/entities/index.ts

@@ -4,9 +4,11 @@
  * Page Object Models for specific entities:
  * - TasksPOM: Tasks CRUD operations
  * - PatternsPOM: Patterns CRUD operations with usage tracking (core entity)
+ * - PagesPOM: Pages CRUD operations (the block editor specs build on it)
  *
  * Add more entity POMs as you create new entities.
  */
 
 export { TasksPOM, type TaskFormData } from './TasksPOM'
 export { PatternsPOM } from './PatternsPOM'
+export { PagesPOM } from './PagesPOM'

package/dist/templates/contents/themes/starter/tests/cypress/src/index.ts

@@ -85,4 +85,5 @@ export {
   loginAsViewer,
   loginAsDefaultDeveloper,
   loginAsDefaultSuperadmin,
+  hasSeededTeamRoleUser,
 } from './session-helpers'

package/dist/templates/contents/themes/starter/tests/cypress/src/session-helpers.ts

@@ -39,19 +39,50 @@ const SUPERADMIN_PASSWORD = Cypress.env('SUPERADMIN_PASSWORD') || 'Pandora1234'
 const TEST_PASSWORD = Cypress.env('TEST_PASSWORD') || 'Test1234'
 
 /**
- * Default Theme Test Users
- * Teams: Everpoint Labs, Ironvale Global, Riverstone Ventures
+ * Team-role test users.
  *
- * Note: These are fallback demo users. For selector tests, use CORE_USER (developer).
+ * The starter seeds exactly two users (core migration 090): superadmin and
+ * developer. The names below come from the default theme's richer sample data,
+ * and every one of them has to be pointed at a real user through the matching
+ * env var before the specs that use it can run.
+ *
+ * OWNER is the exception, and it matters: it is what the CRUD specs log in as,
+ * so its fallback is the user the starter actually creates — superadmin owns
+ * the initial team. Leaving it on a name with no row made the whole UAT suite
+ * fail in session setup, before a single assertion.
  */
 export const DEFAULT_THEME_USERS = {
-  OWNER: Cypress.env('OWNER_EMAIL') || 'carlos.mendoza@nextspark.dev',
+  OWNER: Cypress.env('OWNER_EMAIL') || 'superadmin@nextspark.dev',
   ADMIN: Cypress.env('ADMIN_EMAIL') || 'james.wilson@nextspark.dev',
   MEMBER: Cypress.env('MEMBER_EMAIL') || 'emily.johnson@nextspark.dev',
   EDITOR: Cypress.env('EDITOR_EMAIL') || 'diego.ramirez@nextspark.dev',
   VIEWER: Cypress.env('VIEWER_EMAIL') || 'sarah.davis@nextspark.dev',
 } as const
 
+/**
+ * The password that goes with OWNER.
+ *
+ * OWNER falls back to the seeded superadmin, and that user's password is the
+ * superadmin one, not the demo-user one. A theme that points OWNER at a user of
+ * its own sets OWNER_EMAIL, and then the demo password is the right default.
+ */
+const OWNER_PASSWORD =
+  Cypress.env('OWNER_PASSWORD') ||
+  (Cypress.env('OWNER_EMAIL') ? TEST_PASSWORD : SUPERADMIN_PASSWORD)
+
+/**
+ * Whether a non-owner team role points at a user that exists.
+ *
+ * Only OWNER has a seeded fallback. The other four keep the default theme's
+ * names, which resolve to nothing here until the theme seeds them and sets the
+ * matching env var. A spec that needs one guards on this instead of failing in
+ * session setup, where the error is a ten-second timeout on the Dev Keyring
+ * rather than "this user does not exist".
+ */
+export function hasSeededTeamRoleUser(role: 'ADMIN' | 'MEMBER' | 'EDITOR' | 'VIEWER'): boolean {
+  return Boolean(Cypress.env(`${role}_EMAIL`))
+}
+
 /**
  * Core System Users (from core/migrations/090_sample_data.sql)
  * These users have special global roles, not team-based roles
@@ -164,7 +195,7 @@ function apiLogin(email: string, password: string = TEST_PASSWORD): Cypress.Chai
  */
 export function loginAsDefaultOwner() {
   cy.session('default-owner-session', () => {
-    apiLogin(DEFAULT_THEME_USERS.OWNER).then((apiLoginSucceeded) => {
+    apiLogin(DEFAULT_THEME_USERS.OWNER, OWNER_PASSWORD).then((apiLoginSucceeded) => {
       // If API login succeeded, we need to visit a page before setting localStorage
       if (apiLoginSucceeded) {
         cy.visit('/dashboard', { timeout: 60000 })
@@ -389,22 +420,22 @@ export function getThemeUsers() {
  */
 export const BILLING_TEAMS = {
   FREE: {
-    teamId: 'team-personal-carlos-001',
+    teamId: Cypress.env('BILLING_FREE_TEAM_ID') || 'team-personal-carlos-001',
     name: 'Carlos Personal',
     planSlug: 'free',
-    owner: 'carlos.mendoza@nextspark.dev'
+    owner: Cypress.env('BILLING_FREE_OWNER') || 'carlos.mendoza@nextspark.dev'
   },
   PRO: {
-    teamId: 'team-everpoint-001',
+    teamId: Cypress.env('BILLING_PRO_TEAM_ID') || 'team-everpoint-001',
     name: 'Everpoint Labs',
     planSlug: 'pro',
-    owner: 'carlos.mendoza@nextspark.dev'
+    owner: Cypress.env('BILLING_PRO_OWNER') || 'carlos.mendoza@nextspark.dev'
   },
   ENTERPRISE: {
-    teamId: 'team-ironvale-002',
+    teamId: Cypress.env('BILLING_ENTERPRISE_TEAM_ID') || 'team-ironvale-002',
     name: 'Ironvale Global',
     planSlug: 'enterprise',
-    owner: 'ana.garcia@nextspark.dev'
+    owner: Cypress.env('BILLING_ENTERPRISE_OWNER') || 'ana.garcia@nextspark.dev'
   }
 } as const
 

package/dist/templates/contents/themes/starter/tests/cypress/support/commands.ts

@@ -140,18 +140,37 @@ Cypress.Commands.add('logout', () => {
 })
 
 /**
- * Create a task via API
+ * The headers an entity API call needs, `x-team-id` included.
+ *
+ * The app writes `activeTeamId` into localStorage while the dashboard loads, so
+ * a command that runs before any dashboard visit — a `beforeEach` seeding data,
+ * typically — finds nothing there. Without the header the API answers 400
+ * TEAM_CONTEXT_REQUIRED, and since these requests do not fail on status the
+ * seed silently does nothing: the failure only surfaces later, as an assertion
+ * about data that was never created. Asking the API for the team is what makes
+ * the command work from any starting point.
  */
-Cypress.Commands.add('createTask', (data) => {
+function apiHeaders(): Cypress.Chainable<Record<string, string>> {
+  const base: Record<string, string> = { 'Content-Type': 'application/json' }
+
   return cy.window().then((win) => {
-    const teamId = win.localStorage.getItem('activeTeamId')
-    const headers: Record<string, string> = {
-      'Content-Type': 'application/json',
-    }
-    if (teamId) {
-      headers['x-team-id'] = teamId
-    }
+    const stored = win.localStorage.getItem('activeTeamId')
+    if (stored) return cy.wrap({ ...base, 'x-team-id': stored })
+
+    return cy
+      .request({ method: 'GET', url: '/api/v1/teams', failOnStatusCode: false })
+      .then((response) => {
+        const teamId = response.body?.data?.[0]?.id
+        return cy.wrap(teamId ? { ...base, 'x-team-id': teamId } : base)
+      })
+  })
+}
 
+/**
+ * Create a task via API
+ */
+Cypress.Commands.add('createTask', (data) => {
+  return apiHeaders().then((headers) => {
     return cy.request({
       method: 'POST',
       url: '/api/v1/tasks',
@@ -171,15 +190,7 @@ Cypress.Commands.add('createTask', (data) => {
  * Delete a task via API
  */
 Cypress.Commands.add('deleteTask', (id: string) => {
-  return cy.window().then((win) => {
-    const teamId = win.localStorage.getItem('activeTeamId')
-    const headers: Record<string, string> = {
-      'Content-Type': 'application/json',
-    }
-    if (teamId) {
-      headers['x-team-id'] = teamId
-    }
-
+  return apiHeaders().then((headers) => {
     return cy.request({
       method: 'DELETE',
       url: `/api/v1/tasks/${id}`,

package/dist/templates/features/blog/blocks/post-content/component.tsx

@@ -1,6 +1,7 @@
 import React from 'react'
 import { cn } from '@nextsparkjs/core/lib/utils'
 import { buildSectionClasses } from '@nextsparkjs/core/types/blocks'
+import { sanitizeBlockHtml } from '@nextsparkjs/core/lib/blocks/sanitize-html'
 import { sel } from '../../lib/selectors'
 import type { PostContentBlockProps } from './schema'
 
@@ -171,7 +172,7 @@ export function PostContentBlock({
             // Em/italic
             'prose-em:italic'
           )}
-          dangerouslySetInnerHTML={{ __html: content }}
+          dangerouslySetInnerHTML={{ __html: sanitizeBlockHtml(content) }}
         />
 
         {/* Optional Divider after content */}
@@ -195,3 +196,6 @@ export function PostContentBlock({
     </section>
   )
 }
+
+// The generated block registry imports this as the module's default.
+export default PostContentBlock

package/dist/templates/features/blog/blocks/post-content/schema.ts

@@ -41,6 +41,6 @@ export const postContentSpecificSchema = z.object({
  * Complete Post Content Block Schema
  * Note: postContentSpecificSchema.content overrides baseBlockSchema.content
  */
-export const schema = baseBlockSchema.merge(postContentSpecificSchema)
+export const schema = baseBlockSchema.extend(postContentSpecificSchema.shape)
 
 export type PostContentBlockProps = z.infer<typeof schema>

package/dist/templates/features/pages/blocks/hero/component.tsx

@@ -113,3 +113,6 @@ export function HeroBlock({
     </section>
   )
 }
+
+// The generated block registry imports this as the module's default.
+export default HeroBlock

package/dist/templates/features/pages/blocks/hero/schema.ts

@@ -27,7 +27,7 @@ export const heroSpecificSchema = z.object({
  * Complete Hero Block Schema
  * Combines base fields + hero-specific fields
  */
-export const schema = baseBlockSchema.merge(heroSpecificSchema)
+export const schema = baseBlockSchema.extend(heroSpecificSchema.shape)
 
 export type HeroBlockProps = z.infer<typeof schema>