@nextsparkjs/core 0.1.0-beta.189 → 0.1.0-beta.190

package/scripts/utils/console-guard.mjs

@@ -0,0 +1,13 @@
+/**
+ * Guards the console of the process that imports it, as `guardConsole` does.
+ * The scripts that run the registry build import it before anything else:
+ * modules print as they load - config.mjs has dotenv read the project's .env,
+ * which logs the path it read - and an import runs before the body of the
+ * module that imports it.
+ *
+ * @module core/scripts/utils/console-guard
+ */
+
+import { guardConsole } from './logging.mjs'
+
+guardConsole()

package/scripts/utils/generated-tag.mjs

@@ -0,0 +1,66 @@
+/**
+ * The generated tag `nextspark sync:app` puts on the files it writes, read here
+ * for the build steps that rewrite part of such a file. The format and what it
+ * means are the CLI's (packages/cli/src/utils/generated-tag.ts):
+ *
+ *   /* @nextspark-generated core@<version> path=<path> sha256=<hash of the rest> *\/
+ *
+ * The path runs up to the ` sha256=` that ends it, and is a JSON string when the
+ * CLI had to quote it. On the first line, or the second after a shebang. While the hash matches, the
+ * file is core's to update; a rewrite that leaves a stale hash makes sync treat
+ * the file as changed by the project and stop updating it.
+ */
+
+import { createHash } from 'node:crypto'
+
+const TAG_LINE = /^(?:\/\/|\/\*) @nextspark-generated core@\S+(?: path=.+?)? sha256=([0-9a-f]{64})(?: \*\/)?$/
+
+/**
+ * The hash a tag records: of the text below the tag, with CRLF line endings
+ * read as LF, so a checkout that converts line endings keeps its tags intact.
+ */
+export function generatedHash(text) {
+  return createHash('sha256').update(text.replace(/\r\n/g, '\n')).digest('hex')
+}
+
+/**
+ * A file split around its generated tag, or null when it has none.
+ *
+ * @param {string} text
+ * @returns {{ head: string, line: string, body: string, intact: boolean } | null}
+ *   `head` is the shebang line before the tag, if any; `line` the tag line with
+ *   its line ending; `body` the file without the tag line; `intact` whether the
+ *   body still hashes to what the tag recorded
+ */
+export function splitGeneratedTag(text) {
+  const shebangEnd = text.startsWith('#!') ? text.indexOf('\n') : -1
+  const head = text.slice(0, shebangEnd + 1)
+  const newline = text.indexOf('\n', head.length)
+  const lineEnd = newline === -1 ? text.length : newline + 1
+
+  const match = TAG_LINE.exec(text.slice(head.length, newline === -1 ? text.length : newline).replace(/\r$/, ''))
+  if (!match) return null
+
+  const body = head + text.slice(lineEnd)
+  return { head, line: text.slice(head.length, lineEnd), body, intact: generatedHash(body) === match[1] }
+}
+
+/**
+ * `text` with what is below its generated tag passed through `rewrite`. A tag
+ * that matched the file before is given the hash of the rewritten content, so
+ * the file stays core's to update; a tag that no longer matched - the project
+ * changed the file - is kept as it was. A file with no tag is rewritten whole.
+ *
+ * @param {string} text
+ * @param {(body: string) => string} rewrite - Receives and returns the file without its tag line
+ */
+export function rewriteBelowGeneratedTag(text, rewrite) {
+  const tag = splitGeneratedTag(text)
+  if (!tag) return rewrite(text)
+
+  const body = rewrite(tag.body)
+  let line = tag.intact ? tag.line.replace(/sha256=[0-9a-f]{64}/, `sha256=${generatedHash(body)}`) : tag.line
+  if (!line.endsWith('\n') && body.length > tag.head.length) line += '\n'
+
+  return tag.head + line + body.slice(tag.head.length)
+}

package/scripts/utils/index.mjs

@@ -13,7 +13,15 @@ export {
   log,
   verbose,
   setVerboseMode,
-  isVerbose
+  isVerbose,
+  shownPath,
+  shownLine,
+  jsonLine,
+  guardConsole,
+  errorWithLines,
+  messageLines,
+  stackLines,
+  logFailure
 } from './logging.mjs'
 
 export {

package/scripts/utils/logging.mjs

@@ -4,6 +4,8 @@
  * @module core/scripts/utils/logging
  */
 
+import { format } from 'node:util'
+
 // Verbose mode state (set via setVerboseMode)
 let verboseMode = false
 
@@ -25,6 +27,144 @@ export function isVerbose() {
   return verboseMode
 }
 
+/**
+ * What breaks a line in a terminal or a log, or reorders how it reads: C0 and C1
+ * controls - a newline, a carriage return, ESC and the sequences it starts - DEL,
+ * the line and paragraph separators, and the bidirectional marks, embeddings,
+ * overrides and isolates.
+ */
+const BREAKS_A_LINE = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/
+
+/**
+ * Text as a line of output shows it: as it is, or, when it holds a character
+ * that breaks or reorders the line, quoted, with each such character escaped -
+ * the way `nextspark` shows one, which repeats these lines. JSON escapes the C0
+ * controls but writes the rest as they are.
+ *
+ * @param {string} path - The text to show
+ * @returns {string}
+ */
+export function shownPath(path) {
+  if (!BREAKS_A_LINE.test(path)) return path
+  return JSON.stringify(path).replace(new RegExp(BREAKS_A_LINE.source, 'g'), character =>
+    `\\u${character.charCodeAt(0).toString(16).padStart(4, '0')}`
+  )
+}
+
+/**
+ * What one call to the console prints, as a line of output shows it. The
+ * newlines and spaces it starts with and the newlines it ends with are kept, as
+ * the blank lines around it and its indent; when what is between them holds a
+ * character that breaks or reorders a line, all of it is shown the way
+ * `shownPath` shows a path, on the one line. A
+ * newline inside a call can't be told from one in a name the call prints, so
+ * what spans lines is printed one call per line, and a call starts with its own
+ * text rather than with a name.
+ *
+ * @param {string} text - What one call prints
+ * @returns {string}
+ */
+export function shownLine(text) {
+  const [, before, body, after] = /^([\n ]*)([\s\S]*?)(\n*)$/.exec(text)
+  return `${before}${shownPath(body)}${after}`
+}
+
+/**
+ * `value` as JSON that a line of output shows as it is: JSON.stringify escapes
+ * the C0 controls but leaves the C1 controls, the separators and the
+ * bidirectional marks as they are, and those are valid JSON escaped too.
+ *
+ * @param {unknown} value - What to write as JSON
+ * @returns {string}
+ */
+export function jsonLine(value) {
+  return JSON.stringify(value).replace(new RegExp(BREAKS_A_LINE.source, 'g'), character =>
+    `\\u${character.charCodeAt(0).toString(16).padStart(4, '0')}`
+  )
+}
+
+const GUARDED = Symbol.for('nextspark.shownLine')
+
+/**
+ * Make each call to `target`'s log, info, warn, error and debug print what it
+ * formats the way `shownLine` shows it. Once this runs, whatever prints through
+ * the console - the build's own lines, the paths and names in them, and the
+ * libraries it loads, dotenv among them - is escaped there, where it is printed.
+ *
+ * @param {Console} [target] - The console to guard
+ */
+export function guardConsole(target = console) {
+  for (const method of ['log', 'info', 'warn', 'error', 'debug']) {
+    const original = target[method]
+    if (typeof original !== 'function' || original[GUARDED]) continue
+    const guarded = (...args) => original.call(target, shownLine(format(...args)))
+    guarded[GUARDED] = true
+    target[method] = guarded
+  }
+}
+
+/**
+ * An error whose message is `lines`, one per line. The build prints an error's
+ * message one line per call, and takes as lines of their own only the ones an
+ * error carries this way: a newline anywhere else in a message belongs to a
+ * name in it.
+ *
+ * @param {string[]} lines - The lines of the message
+ * @returns {Error}
+ */
+export function errorWithLines(lines) {
+  return Object.assign(new Error(lines.join('\n')), { lines })
+}
+
+/**
+ * The lines of an error's message, each printed with a call of its own: the
+ * ones `errorWithLines` gave it, or else the whole message as one.
+ *
+ * @param {unknown} error - What was thrown
+ * @returns {string[]}
+ */
+export function messageLines(error) {
+  if (Array.isArray(error?.lines) && error.lines.every(line => typeof line === 'string')) return error.lines
+  return [typeof error?.message === 'string' ? error.message : String(error)]
+}
+
+/**
+ * The lines of an error's stack, each printed with a call of its own: its
+ * heading with the message as `messageLines` splits it, and then each frame -
+ * split where the next `    at ` starts, since a frame names a file whose path
+ * can hold a newline of its own.
+ *
+ * @param {unknown} error - What was thrown
+ * @returns {string[]}
+ */
+export function stackLines(error) {
+  const stack = typeof error?.stack === 'string' ? error.stack : String(error)
+  const message = typeof error?.message === 'string' ? error.message : ''
+  const at = message ? stack.indexOf(message) : -1
+  if (at === -1) return stack.split(/\n(?= {4}at )/)
+  const [first, ...rest] = messageLines(error)
+  const frames = stack.slice(at + message.length).replace(/^\n/, '')
+  return [`${stack.slice(0, at)}${first}`, ...rest, ...(frames ? frames.split(/\n(?= {4}at )/) : [])]
+}
+
+/**
+ * Log that what `label` names failed with `error`: the first line of its
+ * message after the label, each other line of it on its own, and, with
+ * `withStack`, the stack on stderr, one line per call.
+ *
+ * @param {string} label - What failed
+ * @param {unknown} error - What was thrown
+ * @param {boolean} [withStack] - Whether to print the stack too
+ */
+export function logFailure(label, error, withStack = false) {
+  const [first, ...rest] = messageLines(error)
+  log(`${label}: ${first}`, 'error')
+  for (const line of rest) console.log(line)
+  if (withStack) {
+    for (const line of stackLines(error)) console.error(line)
+  }
+}
+
 /**
  * Log a message with an emoji prefix based on type
  *

package/templates/app/(auth)/accept-invite/[token]/page.tsx

@@ -10,6 +10,7 @@ import { toast } from 'sonner'
 import Link from 'next/link'
 import { sel } from '@nextsparkjs/core/selectors'
 import { getTemplateOrDefaultClient } from '@nextsparkjs/registries/template-registry.client'
+import { withBasePath } from '@nextsparkjs/core/lib/base-path'
 
 type InvitationStatus = 'loading' | 'valid' | 'accepting' | 'accepted' | 'error' | 'expired' | 'not_found' | 'email_mismatch' | 'already_member' | 'requires_auth'
 
@@ -38,7 +39,7 @@ function AcceptInvitePage() {
     async function validateAndAccept() {
       try {
         // First validate the invitation
-        const response = await fetch(`/api/v1/team-invitations/${token}`)
+        const response = await fetch(withBasePath(`/api/v1/team-invitations/${token}`))
         const data = await response.json()
 
         if (!response.ok) {
@@ -80,7 +81,7 @@ function AcceptInvitePage() {
 
         setStatus('accepting')
 
-        const acceptResponse = await fetch(`/api/v1/team-invitations/${token}/accept`, {
+        const acceptResponse = await fetch(withBasePath(`/api/v1/team-invitations/${token}/accept`), {
           method: 'POST',
           credentials: 'include'
         })
@@ -125,7 +126,7 @@ function AcceptInvitePage() {
     setStatus('accepting')
 
     try {
-      const response = await fetch(`/api/v1/team-invitations/${token}/accept`, {
+      const response = await fetch(withBasePath(`/api/v1/team-invitations/${token}/accept`), {
         method: 'POST',
         credentials: 'include'
       })

package/templates/app/(auth)/verify-email/page.tsx

@@ -7,6 +7,7 @@ import { Button } from '@nextsparkjs/core/components/ui/button';
 import { Alert, AlertDescription } from '@nextsparkjs/core/components/ui/alert';
 import { getTemplateOrDefaultClient } from '@nextsparkjs/registries/template-registry.client'
 import { sel } from '@nextsparkjs/core/selectors'
+import { withBasePath } from '@nextsparkjs/core/lib/base-path'
 
 function VerifyEmailContent() {
   const searchParams = useSearchParams()!;
@@ -26,7 +27,7 @@ function VerifyEmailContent() {
 
       try {
         // Call the Better Auth verify endpoint with special header to avoid redirect loop
-        const response = await fetch(`/api/auth/verify-email?token=${token}`, {
+        const response = await fetch(withBasePath(`/api/auth/verify-email?token=${token}`), {
           method: 'GET',
           credentials: 'include',
           headers: {
@@ -43,7 +44,7 @@ function VerifyEmailContent() {
           
           // Create default metadata after successful verification
           try {
-            const response = await fetch('/api/auth/session', {
+            const response = await fetch(withBasePath('/api/auth/get-session'), {
               method: 'GET',
               credentials: 'include'
             });
@@ -52,7 +53,7 @@ function VerifyEmailContent() {
               const session = await response.json();
               if (session?.user?.id) {
                 // Create default metadata for the newly verified user
-                await fetch('/api/internal/user-metadata', {
+                await fetch(withBasePath('/api/internal/user-metadata'), {
                   method: 'POST',
                   headers: {
                     'Content-Type': 'application/json',

package/templates/app/(public)/docs/[section]/[page]/page.tsx

@@ -15,6 +15,17 @@ interface DocsPageProps {
   }>
 }
 
+// generateStaticParams below lists every public doc page, and dynamicParams =
+// false answers 404 for any other section/page pair before the page renders:
+// in `next dev`, and in a production build that prerenders this route, which
+// it does when the app's locale is fixed (see isLocaleFixed). An app that reads
+// the locale from the request renders the route on demand, where Next has no
+// prerendered list to check, and the notFound() calls below cannot set the
+// status either: they run inside the layouts' Suspense boundaries, after the
+// response head has gone out with a 200. For those requests the proxy answers
+// 404 before anything renders (isMissingDocsPage in proxy.ts).
+export const dynamicParams = false
+
 export async function generateStaticParams() {
   const params = []
 

package/templates/app/api/auth/[...all]/route.ts

@@ -10,6 +10,8 @@ import { wrapAuthHandlerWithCors, handleCorsPreflightRequest, addCorsHeaders } f
 import { checkDistributedRateLimit } from "@nextsparkjs/core/lib/api/rate-limit";
 import { withSignupContext } from "@nextsparkjs/core/lib/auth-context";
 import { dispatchSecurityNotificationsForRequest } from "@nextsparkjs/core/lib/auth/security-notifications";
+import { verifyEmailPageUrl } from "@nextsparkjs/core/lib/auth/verify-email-link";
+import { withBasePathRequest } from "@nextsparkjs/core/lib/base-path";
 
 const handlers = toNextJsHandler(auth);
 
@@ -28,16 +30,9 @@ export async function GET(req: NextRequest, context: { params: Promise<{ all: st
   const isFromUI = req.headers.get('x-verify-from-ui') === 'true';
 
   if (pathname === '/api/auth/verify-email' && !isFromUI) {
-    const token = req.nextUrl.searchParams.get('token');
-    const callbackURL = req.nextUrl.searchParams.get('callbackURL');
-
-    if (token) {
-      // This is from an email link, redirect to the UI verification page
-      const redirectUrl = new URL('/verify-email', req.url);
-      redirectUrl.searchParams.set('token', token);
-      if (callbackURL) {
-        redirectUrl.searchParams.set('callbackURL', callbackURL);
-      }
+    // This is from an email link, redirect to the UI verification page
+    const redirectUrl = verifyEmailPageUrl(req.url);
+    if (redirectUrl) {
       return NextResponse.redirect(redirectUrl);
     }
   }
@@ -56,11 +51,14 @@ export async function GET(req: NextRequest, context: { params: Promise<{ all: st
     ? (req.cookies.get('signup-intent')?.value || undefined)
     : undefined;
 
+  // Better Auth matches its routes with the base path in the URL
+  const authReq = withBasePathRequest(req);
+
   // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
   return wrapAuthHandlerWithCors(
     signupIntent
-      ? () => withSignupContext({ signupIntent }, () => handlers.GET(req))
-      : () => handlers.GET(req),
+      ? () => withSignupContext({ signupIntent }, () => handlers.GET(authReq))
+      : () => handlers.GET(authReq),
     req
   );
 }
@@ -188,11 +186,14 @@ export async function POST(req: NextRequest) {
   // handlers.POST(req) reads req's body exactly once.
   const securityReq = req.clone() as NextRequest;
 
+  // Better Auth matches its routes with the base path in the URL
+  const authReq = withBasePathRequest(req);
+
   // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
   const response = await wrapAuthHandlerWithCors(
     signupIntent
-      ? () => withSignupContext({ signupIntent }, () => handlers.POST(req))
-      : () => handlers.POST(req),
+      ? () => withSignupContext({ signupIntent }, () => handlers.POST(authReq))
+      : () => handlers.POST(authReq),
     req
   );
 

package/templates/app/api/internal/user-metadata/route.ts

@@ -28,16 +28,14 @@ export const POST = withRateLimitTier(async (req: NextRequest) => {
       return NextResponse.json({ error: 'Metadata is required' }, { status: 400 })
     }
 
-    // Crear cada grupo de metadata por separado
-    for (const [metaKey, metaValue] of Object.entries(metadata)) {
-      if (metaValue && typeof metaValue === 'object') {
-        await MetaService.setEntityMeta('user', userId, metaKey, metaValue, userId)
-      }
-    }
+    // Defaults only fill in what is missing. The caller picks them from a read
+    // of the user's meta that may be stale by now, so a preference saved in
+    // between (a theme change, a collapsed sidebar) is kept.
+    await MetaService.mergeEntityMetaGroups('user', userId, metadata, userId, { defaults: true })
 
-    return NextResponse.json({ 
+    return NextResponse.json({
       success: true,
-      message: 'Default metadata created successfully' 
+      message: 'Default metadata created successfully'
     })
   } catch (error) {
     // Log error for debugging but don't expose details to client

package/templates/app/api/user/plan-flags/route.ts

@@ -8,7 +8,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { getTypedSession } from '@nextsparkjs/core/lib/auth'
 import { getUserPlanAndFlags, updateUserPlan, updateUserFlags } from '@nextsparkjs/core/lib/user-data'
-import { z } from 'zod'
+import * as z from 'zod'
 import type { UserRole } from '@nextsparkjs/core/types/user.types'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 

package/templates/app/api/user/profile/route.ts

@@ -3,7 +3,7 @@ import { auth } from '@nextsparkjs/core/lib/auth'
 import { headers } from 'next/headers'
 import { queryOneWithRLS, mutateWithRLS, queryOne } from '@nextsparkjs/core/lib/db'
 import { profileSchema } from '@nextsparkjs/core/lib/validation'
-import { MetaService } from '@nextsparkjs/core/lib/services/meta.service'
+import { MetaService, MetaValueTooLargeError } from '@nextsparkjs/core/lib/services/meta.service'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 export const GET = withRateLimitTier(async (request: NextRequest) => {
@@ -68,15 +68,12 @@ export const PATCH = withRateLimitTier(async (request: NextRequest) => {
     const body = await request.json()
     const { meta, ...profileData } = body
     
-    // Handle metadata-only updates (formato anidado)
+    // Handle metadata-only updates (nested format)
     if (meta && Object.keys(profileData).length === 0) {
-      // Procesar cada grupo de metadata por separado
-      for (const [metaKey, metaValue] of Object.entries(meta)) {
-        if (metaValue && typeof metaValue === 'object') {
-          await MetaService.setEntityMeta('user', session.user.id, metaKey, metaValue, session.user.id)
-        }
-      }
-      
+      // Each group (uiPreferences, ...) is merged into the stored one: the
+      // theme toggle sends only `theme`, the sidebar only `sidebarCollapsed`.
+      await MetaService.mergeEntityMetaGroups('user', session.user.id, meta, session.user.id)
+
       return NextResponse.json({ 
         message: 'Settings updated successfully',
         success: true
@@ -113,21 +110,19 @@ export const PATCH = withRateLimitTier(async (request: NextRequest) => {
       }
     }
 
-    // Handle metadata updates if provided (formato anidado)
+    // Handle metadata updates if provided (nested format), merged like above
     if (meta) {
-      // Procesar cada grupo de metadata por separado
-      for (const [metaKey, metaValue] of Object.entries(meta)) {
-        if (metaValue && typeof metaValue === 'object') {
-          await MetaService.setEntityMeta('user', session.user.id, metaKey, metaValue, session.user.id)
-        }
-      }
+      await MetaService.mergeEntityMetaGroups('user', session.user.id, meta, session.user.id)
     }
-    
+
     return NextResponse.json({
       message: 'Profile updated successfully',
       success: true
     })
   } catch (error) {
+    if (error instanceof MetaValueTooLargeError) {
+      return NextResponse.json({ error: error.message }, { status: 413 })
+    }
     console.error('Error updating user profile:', error)
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }

package/templates/app/api/v1/api-keys/route.ts

@@ -11,7 +11,7 @@ import { authenticateRequest, createAuthFailureResponse, resolveTeamContext } fr
 import { ApiKeyManager, API_SCOPES, API_KEY_LIMITS } from '@nextsparkjs/core/lib/api/keys';
 import { validateScopesForUser } from '@nextsparkjs/core/lib/api/auth';
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
-import { z } from 'zod';
+import * as z from 'zod';
 
 const createApiKeySchema = z.object({
   name: z.string().min(1, 'Name is required').max(API_KEY_LIMITS.maxKeyNameLength, 'Name too long'),

package/templates/app/api/v1/auth/signup-with-invite/route.ts

@@ -12,6 +12,7 @@ import type { TeamInvitation, TeamMember } from '@nextsparkjs/core/lib/teams/typ
 import { I18N_CONFIG } from '@nextsparkjs/core/lib/config'
 import { withSignupContext } from '@nextsparkjs/core/lib/auth-context'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { withBasePath } from '@nextsparkjs/core/lib/base-path'
 
 // Handle CORS preflight
 export async function OPTIONS(request: NextRequest) {
@@ -111,7 +112,7 @@ export const POST = withRateLimitTier(withApiLogging(
       // Step 2: Create user using Better Auth's internal API
       // Wrap in signup context to skip automatic team creation
       // (user will be added to the invited team instead)
-      const signUpRequest = new Request(`${process.env.NEXT_PUBLIC_APP_URL}/api/auth/sign-up/email`, {
+      const signUpRequest = new Request(`${process.env.NEXT_PUBLIC_APP_URL}${withBasePath('/api/auth/sign-up/email')}`, {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',

package/templates/app/api/v1/billing/cancel/route.ts

@@ -8,7 +8,7 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
+import * as z from 'zod'
 import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { SubscriptionService, MembershipService } from '@nextsparkjs/core/lib/services'
 import { getBillingGateway } from '@nextsparkjs/core/lib/billing/gateways/factory'

package/templates/app/api/v1/billing/change-plan/route.ts

@@ -8,7 +8,7 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
+import * as z from 'zod'
 import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { SubscriptionService, MembershipService } from '@nextsparkjs/core/lib/services'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'

package/templates/app/api/v1/billing/check-action/route.ts

@@ -12,7 +12,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { SubscriptionService } from '@nextsparkjs/core/lib/services'
-import { z } from 'zod'
+import * as z from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const checkActionSchema = z.object({

package/templates/app/api/v1/billing/checkout/route.ts

@@ -11,7 +11,7 @@ import { NextRequest, NextResponse } from 'next/server'
 import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { getBillingGateway } from '@nextsparkjs/core/lib/billing/gateways/factory'
 import { SubscriptionService, MembershipService } from '@nextsparkjs/core/lib/services'
-import { z } from 'zod'
+import * as z from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const checkoutSchema = z.object({

package/templates/app/api/v1/blocks/validate/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { BLOCK_REGISTRY } from '@nextsparkjs/registries/block-registry'
-import { z } from 'zod'
+import * as z from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const requestSchema = z.object({

package/templates/app/api/v1/media/[id]/tags/route.ts

@@ -5,7 +5,7 @@ import { API_ERROR_CODES } from '@nextsparkjs/core/lib/api/api-error'
 import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { MediaService } from '@nextsparkjs/core/lib/services/media.service'
-import { z } from 'zod'
+import * as z from 'zod'
 
 const addTagSchema = z.object({
   tagId: z.string().min(1),

package/templates/app/api/v1/post-categories/[id]/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { query as dbQuery } from '@nextsparkjs/core/lib/db'
-import { z } from 'zod'
+import * as z from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const updateCategorySchema = z.object({

package/templates/app/api/v1/post-categories/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { query as dbQuery } from '@nextsparkjs/core/lib/db'
-import { z } from 'zod'
+import * as z from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 const createCategorySchema = z.object({

package/templates/app/api/v1/teams/[teamId]/members/route.ts

@@ -19,6 +19,7 @@ import type { TeamMember, TeamInvitation, TeamRole, Team } from '@nextsparkjs/co
 import { EmailFactory } from '@nextsparkjs/core/lib/email/factory'
 import { sendTeamInvitationEmail } from '@nextsparkjs/core/lib/email/send'
 import { I18N_CONFIG } from '@nextsparkjs/core/lib/config'
+import { withBasePath } from '@nextsparkjs/core/lib/base-path'
 
 // Handle CORS preflight
 export async function OPTIONS(request: NextRequest) {
@@ -294,7 +295,7 @@ export const POST = withRateLimitTier(withApiLogging(
 
       // Build accept URL
       const baseUrl = (process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:5173').replace(/\/$/, '')
-      const acceptUrl = `${baseUrl}/accept-invite/${token}`
+      const acceptUrl = `${baseUrl}${withBasePath(`/accept-invite/${token}`)}`
 
       // Send invitation email
       try {

package/templates/app/api/v1/teams/[teamId]/subscription/route.ts

@@ -41,11 +41,9 @@ export const GET = withRateLimitTier(async function GET(request: NextRequest, pr
 
     const subscription = await SubscriptionService.getActive(teamId)
 
-    if (!subscription) {
-      return createApiError('No active subscription found for this team', 404)
-    }
-
-    return createApiResponse({ subscription })
+    // A team can legitimately have no subscription yet. Keep that normal state
+    // in the successful response so dashboard loads do not log a 404.
+    return createApiResponse({ subscription: subscription ?? null })
   } catch (error) {
     console.error('[Billing API] Error fetching subscription:', error)
     return createApiError('Failed to fetch subscription', 500)