@nextsparkjs/core 0.1.0-beta.193 → 0.1.0-beta.195

package/dist/templates/projects/blog/package.json

@@ -14,10 +14,10 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "^15.0.0 || ^16.0.0",
+    "next": "~16.3.6",
     "next-intl": "^4.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "zod": "^4.0.0"
   },
   "nextspark": {

package/dist/templates/projects/crm/package.json

@@ -13,10 +13,10 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "^15.0.0 || ^16.0.0",
+    "next": "~16.3.6",
     "next-intl": "^4.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "zod": "^4.0.0"
   },
   "nextspark": {

package/dist/templates/projects/productivity/package.json

@@ -17,9 +17,9 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "^15.0.0 || ^16.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "next": "~16.3.6",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "zod": "^4.0.0"
   },
   "nextspark": {

package/dist/templates/proxy.ts

@@ -200,8 +200,19 @@ function getSession(request: NextRequest) {
  * session. Gating the strip on protected prefixes is not enough: Next.js
  * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
  * action can be POSTed to a public path with a forged `x-user-id`.
+ *
+ * The `x-api-*` names are never set here: core takes an API key's identity from
+ * validating the key, and nothing downstream may receive them from the client.
  */
-const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname', 'x-active-team-id'] as const
+const TRUSTED_IDENTITY_HEADERS = [
+  'x-user-id',
+  'x-user-email',
+  'x-pathname',
+  'x-active-team-id',
+  'x-api-user-id',
+  'x-api-key-id',
+  'x-api-scopes',
+] as const
 
 /**
  * Build the request headers forwarded to the app: inbound copy minus every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.193",
+  "version": "0.1.0-beta.195",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -390,9 +390,9 @@
     "scripts"
   ],
   "peerDependencies": {
-    "next": "~16.3.5",
-    "react": ">=18.0.0",
-    "react-dom": ">=18.0.0"
+    "next": "~16.3.6",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0"
   },
   "devDependencies": {
     "@better-fetch/fetch": "1.3.1",
@@ -496,7 +496,10 @@
     "use-intl": "^4.9.1",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@nextsparkjs/ui": "0.1.0-beta.193"
+    "@nextsparkjs/ui": "0.1.0-beta.195"
+  },
+  "engines": {
+    "node": ">=22.14.0"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs || true",

package/scripts/build/auth-readiness.mjs

@@ -192,6 +192,10 @@ async function main() {
     console.log('   RESEND_API_KEY, RESEND_FROM_EMAIL; Google: GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET), or change auth.methods.')
     console.log('   Credentials injected only at runtime: declare them with NEXTSPARK_AUTH_RUNTIME_ONLY=email,google;')
     console.log('   they are validated again when the server starts and on every login request.')
+    if (result.diagnostics.some(({ code }) => code.endsWith('_PLACEHOLDER'))) {
+      console.log('   A placeholder value (re_..., your-google-client-id) is a value, not a missing one: NEXTSPARK_AUTH_RUNTIME_ONLY does not defer it.')
+      console.log('   Remove the placeholder lines from .env (and the build environment), or replace them with the real values.')
+    }
     process.exit(1)
   }
 

package/scripts/build/registry/__tests__/api-docs-colocated.test.mjs

@@ -15,6 +15,9 @@ import test from 'node:test'
 import { discoverApiPresets } from '../discovery/api-presets.mjs'
 import { discoverRouteFiles } from '../discovery/plugins.mjs'
 import { generateRouteHandlersRegistry } from '../generators/route-handlers.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const presets = endpoint => `export default defineApiEndpoint({\n  endpoint: '${endpoint}',\n  summary: 'S',\n  presets: [{ id: 'a', title: 'A', method: 'GET' }]\n})\n`
 

package/scripts/build/registry/__tests__/billing-registry.test.mjs

@@ -8,12 +8,15 @@
 
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, readdir, rm } from 'node:fs/promises'
+import { mkdir, mkdtemp, readdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { generateBillingRegistry } from '../generators/billing-registry.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..', '..', '..')
 
@@ -45,3 +48,49 @@ test("generateBillingRegistry's jiti import writes nothing under TMPDIR, even wh
     await cacheRoot.cleanup()
   }
 })
+
+// #212: a billing config that exists but cannot load must fail the build, never become an empty registry
+async function projectWith(billingSource) {
+  const dir = await directory('nextspark-billing-registry-cases-')
+  if (billingSource !== undefined) {
+    await mkdir(join(dir.root, 'config'), { recursive: true })
+    await writeFile(join(dir.root, 'config/billing.config.ts'), billingSource)
+  }
+  return { ...dir, config: { projectRoot: dir.root, projectSourceDir: dir.root, projectName: 'cases', outputDir: join(dir.root, 'out') } }
+}
+
+test('no billing config: the empty registry, the build keeps going', async () => {
+  const project = await projectWith(undefined)
+  try {
+    assert.match(await generateBillingRegistry(project.config), /No billing config found - empty registry generated/)
+  } finally { await project.cleanup() }
+})
+
+test('a valid billing config is read into the registry', async () => {
+  const project = await projectWith(`export const billingConfig = { provider: 'stripe', currency: 'usd', defaultPlan: 'free', features: { api: {} }, limits: { seats: {} }, plans: [{ slug: 'free', visibility: 'public', features: ['api'], limits: { seats: 3 } }] }\n`)
+  try {
+    const output = await generateBillingRegistry(project.config)
+    assert.match(output, /"totalPlans": 1/)
+    assert.match(output, /"seats": \{\s+"free": 3/)
+  } finally { await project.cleanup() }
+})
+
+test('a billing config that throws fails with its file name and the underlying error', async () => {
+  const project = await projectWith(`throw new Error('stripe price id is missing')\n`)
+  try {
+    await assert.rejects(generateBillingRegistry(project.config), (error) => {
+      assert.ok(error.message.includes(join(project.root, 'config/billing.config.ts')), error.message)
+      assert.ok(error.message.includes('stripe price id is missing'), error.message)
+      return true
+    })
+  } finally { await project.cleanup() }
+})
+
+test('a billing config with a syntax error or without a billingConfig export also fails', async () => {
+  for (const source of ['export const billingConfig = {', 'export const other = 1\n']) {
+    const project = await projectWith(source)
+    try {
+      await assert.rejects(generateBillingRegistry(project.config), /billing\.config\.ts/)
+    } finally { await project.cleanup() }
+  }
+})

package/scripts/build/registry/__tests__/block-registry.test.mjs

@@ -25,6 +25,9 @@ import {
 import { readSchemaExport, thumbnailImport } from '../discovery/blocks.mjs'
 import { validateGeneratedModule } from '../host/static-imports.mjs'
 import { loadTypeScriptFor } from '../shared/typescript-compiler.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 function block(slug, category) {
   const base = `@/blocks/${slug}`

package/scripts/build/registry/__tests__/build-output.test.mjs

@@ -29,7 +29,7 @@ const RAW_CONTROL = /[\u0000-\u0009\u000b-\u001f\u007f-\u009f\u061c\u200e\u200f\
 async function createProject(parent = tmpdir(), name = 'nextspark-build-output-test-') {
   const root = await mkdtemp(join(parent, name))
   await writeFile(join(root, 'nextspark.config.ts'), 'export default {}\n')
-  await writeFile(join(root, 'package.json'), '{"dependencies":{"next":"16.3.5"}}')
+  await writeFile(join(root, 'package.json'), '{"dependencies":{"next":"16.3.6"}}')
   await mkdir(join(root, 'src', 'app'), { recursive: true })
   return root
 }

package/scripts/build/registry/__tests__/icons-discovery.test.mjs

@@ -24,6 +24,9 @@ import {
   isTestFilePath,
   extractLiteralIconCallNames
 } from '../discovery/icons.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 test('discovers core entity icons through the resolution owner coreDir', async () => {
   const root = await mkdtemp(join(tmpdir(), 'nextspark-icons-core-dir-'))

package/scripts/build/registry/__tests__/project-mode-root-first.test.mjs

@@ -17,7 +17,7 @@ async function project(files = {}) {
 
 test('the nearest nextspark.config.ts owns every project source path', async () => {
   const root = await project({
-    'package.json': JSON.stringify({ dependencies: { next: '16.3.5' } }),
+    'package.json': JSON.stringify({ dependencies: { next: '16.3.6' } }),
     'nextspark.config.ts': 'export default {}\n',
   })
   const nested = join(root, 'entities', 'tasks')
@@ -40,7 +40,7 @@ test('the nearest nextspark.config.ts owns every project source path', async ()
 
 test('a next.config file cannot select a project without nextspark.config.ts', async () => {
   const root = await project({
-    'package.json': JSON.stringify({ dependencies: { next: '16.3.5' } }),
+    'package.json': JSON.stringify({ dependencies: { next: '16.3.6' } }),
     'next.config.mjs': 'export default {}\n',
   })
   try {
@@ -66,7 +66,7 @@ test('an enabled packaged plugin resolves through the project dependency tree',
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.5',
+        next: '16.3.6',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -98,7 +98,7 @@ test('an enabled packaged plugin that is not installed fails with an actionable
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.5',
+        next: '16.3.6',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -119,7 +119,7 @@ test('a packaged plugin cannot use a path segment as its logical name', async ()
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.5',
+        next: '16.3.6',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -146,7 +146,7 @@ test('a local plugin shadows an installed packaged plugin with the same NextSpar
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.5',
+        next: '16.3.6',
         '@example/plugin-search': '1.0.0',
       },
     }),

package/scripts/build/registry/__tests__/quiet-console.mjs

@@ -0,0 +1,17 @@
+import { after, before, mock } from 'node:test'
+
+/**
+ * Keeps a test file's in-process console.log/info output off the test child's stdout. The Node test runner
+ * reads that stdout for its own frames, and non-ASCII text on it (the build log's emoji) can make it fail with
+ * "Unable to deserialize cloned data" (nodejs/node#64061, fixed on 24+ only; #65934 for 22).
+ * Call once at the top of a file; a test that needs to read the output replaces console.log itself.
+ */
+export function silenceConsoleOutput() {
+  before(() => {
+    mock.method(console, 'log', () => {})
+    mock.method(console, 'info', () => {})
+  })
+  after(() => {
+    mock.restoreAll()
+  })
+}

package/scripts/build/registry/__tests__/safe-fs.test.mjs

@@ -23,6 +23,9 @@ import { fileURLToPath } from 'node:url'
 import { COPY_BLOCK_SIZE, isUnsafeWrite, projectFiles, UNSAFE_WRITE, unsafeWriteProblem } from '../../safe-fs.mjs'
 import { generateTestBlocksJson, generateTestEntitiesJson } from '../post-build/test-fixtures.mjs'
 import { directFsWrites, directFsWritesIn, generatorFiles } from './direct-fs-writes.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const CORE_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..')
 const RUNS_AS_ROOT = process.getuid?.() === 0

package/scripts/build/registry/__tests__/team-roles.test.mjs

@@ -18,6 +18,9 @@ import assert from 'node:assert/strict'
 
 import { computeTeamRoleConfig, generatePermissionsRegistry } from '../generators/permissions-registry.mjs'
 import { parseTeamRolesFromAppConfig } from '../discovery/permissions.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 // ---------------------------------------------------------------------------
 // computeTeamRoleConfig — the pure build-time computation

package/scripts/build/registry/__tests__/write-places.test.mjs

@@ -269,7 +269,7 @@ async function snapshot(root) {
 async function buildableProject() {
   const project = await directory()
   await writeIn(project.root, 'nextspark.config.ts', 'export default {}\n')
-  await writeIn(project.root, 'package.json', '{"dependencies":{"next":"16.3.5"}}')
+  await writeIn(project.root, 'package.json', '{"dependencies":{"next":"16.3.6"}}')
   await writeIn(project.root, 'templates/pricing/page.tsx', 'export default function Pricing() { return null }\n')
   return project
 }

package/scripts/build/registry/contracts/__tests__/contracts-wire.test.mjs

@@ -22,7 +22,7 @@ async function planFor(files) {
   const root = temp()
   try {
     write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-    write(root, 'package.json', JSON.stringify({ name: 'wire', dependencies: { next: '16.3.5' } }))
+    write(root, 'package.json', JSON.stringify({ name: 'wire', dependencies: { next: '16.3.6' } }))
     write(root, 'config/theme.config.ts', "export const wireThemeConfig = { name: 'wire' }\n")
     for (const [path, content] of Object.entries(files)) write(root, path, content)
     const entities = await discoverAllEntities(getConfig(root), { includeCore: false })

package/scripts/build/registry/contracts/__tests__/contracts.test.mjs

@@ -73,7 +73,7 @@ const NOTES_CONFIG = `export const noteEntityConfig = {
 function project(extra = {}) {
   const root = temp()
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'contracts-project', dependencies: { next: '16.3.5' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'contracts-project', dependencies: { next: '16.3.6' } }))
   write(root, 'config/theme.config.ts', "export const contractsThemeConfig = { name: 'contracts' }\n")
   write(root, 'entities/tasks/tasks.config.ts', TASKS_CONFIG)
   write(root, 'entities/tasks/tasks.fields.ts', FIELDS)

package/scripts/build/registry/contracts/render.mjs

@@ -201,7 +201,7 @@ export function renderEntity(contract, { source, shape } = {}) {
   const lines = [CONTRACTS_HEADER]
   if (source) lines.push(`// Source: ${source}`)
   for (const warning of contract.warnings) lines.push(`// Warning: ${warning}`)
-  lines.push('', "import { z } from 'zod'", "import type { EntityConfig } from '../schema/types'", "import { generateEntitySchemas } from '../schema/schema-generator'", `import { ${usedFromShape.join(', ')} } from '../schema/response-shape'`)
+  lines.push('', "import * as z from 'zod'", "import type { EntityConfig } from '../schema/types'", "import { generateEntitySchemas } from '../schema/schema-generator'", `import { ${usedFromShape.join(', ')} } from '../schema/response-shape'`)
   if (shared.length > 0) lines.push(`import { ${shared.join(', ')} } from '../fields'`)
   lines.push('', `export const ${names.apiPath} = ${quote(`/api/v1/${contract.slug}`)}`, '')
 
@@ -246,7 +246,7 @@ export function renderEntity(contract, { source, shape } = {}) {
 export function renderEnvelope() {
   return `${CONTRACTS_HEADER}
 
-import { z } from 'zod'
+import * as z from 'zod'
 
 /** \`info\` of every response: the timestamp, plus whatever the endpoint adds (pagination, \`created\`). */
 export const apiInfoSchema = z.looseObject({ timestamp: z.string() })
@@ -307,7 +307,7 @@ export const apiErrorResponseSchema = z.object({
 export function renderFields() {
   return `${CONTRACTS_HEADER}
 
-import { z } from 'zod'
+import * as z from 'zod'
 import { addressSchema, fileObjectSchema } from './schema/schema-generator'
 import { mediaRefSchema } from './schema/media-ref'
 

package/scripts/build/registry/discovery/permissions.test.mjs

@@ -6,6 +6,9 @@
 
 import { describe, it } from 'node:test'
 import assert from 'node:assert'
+import { silenceConsoleOutput } from '../__tests__/quiet-console.mjs'
+
+silenceConsoleOutput()
 
 // Import the regex pattern directly since parseEntitiesFromConfig is not exported
 // We'll test the regex patterns directly

package/scripts/build/registry/discovery/plugin-capabilities.mjs

@@ -329,11 +329,11 @@ const BUILTINS = new Set(builtinModules.filter(name => !name.startsWith('_')))
 /** Bare specifiers that only run on a server (`next/server` is Next's request/response and `after`/`connection` APIs). */
 const SERVER_ONLY_PACKAGES = new Set(['server-only', 'next/headers', 'next/server', 'pg', 'postgres', 'ioredis', 'nodemailer'])
 /**
- * The `lib/api` modules core's own 'use client' files import (the entity fetch helpers, `ApiError`, the scope catalog):
+ * The `lib/api` modules core's own 'use client' files import (the entity fetch helpers, `ApiError`, the scope catalog, the client request header names):
  * they import no server module, so they are client-safe. Everything else under `lib/api` is server-only. A guard test
  * checks that every `lib/api` module a core 'use client' file imports is in this list.
  */
-export const CLIENT_SAFE_CORE_API = ['entities', 'api-error', 'keys']
+export const CLIENT_SAFE_CORE_API = ['entities', 'api-error', 'keys', 'client-headers']
 /** Core modules known to be server-only; the ones that import a marker above are also found by following the import. */
 const SERVER_ONLY_CORE = [
   /^@nextsparkjs\/core\/lib\/db(\/|$)/,

package/scripts/build/registry/generators/billing-registry.mjs

@@ -119,10 +119,14 @@ export async function generateBillingRegistry(configOrName, _legacyContentsDir,
     // Use jiti to import .ts files at build time (Node.js can't import .ts natively)
     const jiti = createJiti(import.meta.url, { interopDefault: true, fsCache: false })
     const module = await jiti.import(absolutePath)
-    billingConfig = module.billingConfig || module.default
+    billingConfig = module.billingConfig
   } catch (error) {
-    log(`Failed to import billing config from ${absolutePath}: ${error.message}`, 'error')
-    return generateEmptyBillingRegistry(config)
+    // A config that exists but cannot load must stop the build: an empty registry has no plans,
+    // and a project without plans skips every feature and quota check.
+    throw new Error(`Failed to load billing config ${absolutePath}: ${error.message}`, { cause: error })
+  }
+  if (!billingConfig || !Array.isArray(billingConfig.plans) || !billingConfig.features || !billingConfig.limits) {
+    throw new Error(`Billing config ${absolutePath} must export \`billingConfig\` with plans, features and limits`)
   }
 
   // Pre-compute everything at build time

package/scripts/build/registry/host/README.md

@@ -28,7 +28,7 @@ const { target, content } = await emitFacade({
 Every problem is a `FacadeEmitError` carrying all diagnostics (`code`, `file`, `line`, `exportName`,
 `message`); nothing is dropped silently.
 
-## Export table (Next.js 16.3.5)
+## Export table (Next.js 16.3.6)
 
 Source of truth: `next-route-exports.json`. The tests fail when the installed Next.js version differs,
 when Next's `AppSegmentConfigSchemaKeys` or `HTTP_METHODS` change, and when this rendering is stale.
@@ -71,7 +71,7 @@ export { listSlugs as generateStaticParams }
 Metadata image kinds accept Next's one-digit variants (`icon1`, `apple-icon9`, `opengraph-image2`,
 `twitter-image3`), mapped to the base kind.
 
-The emitter resolves `next/package.json` once (project first, then core) and accepts only `~16.3.5`: the table's
+The emitter resolves `next/package.json` once (project first, then core) and accepts only `~16.3.6`: the table's
 `next` is the verified baseline, and any stable 16.3.x patch at or above it is accepted, while other minors/majors,
 lower patches and prereleases are refused (`NS_HOST_UNSUPPORTED_NEXT_VERSION`). It loads Next's segment config
 schema from that same package root.
@@ -217,7 +217,8 @@ spread and no expression. A host with another core (the conformance fixture) pas
   `_internal/default-{auth,public}-layout`).
 - **Role-gated areas** `/superadmin`, `/devtools`: every page, layout, template and default served under the area's URL (core's,
   a plugin's or the project's, in any route group) is composed with `withSuperadminAccess` / `withDevtoolsAccess`
-  (`routes/_internal/area-access`), which checks the session's role on the server before the segment renders, and its
+  (`routes/_internal/area-access`; `area-access.cc` in a Cache Components host, the same check inside the segment's own Suspense
+  boundary), which checks the session's role on the server before the segment renders, and its
   `generateMetadata` with `withSuperadminMetadata` / `withDevtoolsMetadata` (metadata resolves apart too); a Route Handler's
   methods but `OPTIONS` with `withSuperadminRouteAccess` / `withDevtoolsRouteAccess` (401 / 403 JSON; `OPTIONS` is forwarded
   unchecked, so it must not return data). An intercepting route
@@ -293,4 +294,27 @@ cookies or headers below no other boundary). The public item routes omit `revali
 mode only imports `_internal/public-item-route.cc`, whose reads of the published item and of the patterns it references are `'use cache'`
 functions (`cacheLife` of an hour for an item, tags `entity:<slug>` and `public-item:<slug>:<item slug>`).
 
+**Instant navigation (dev server).** On a Cache Components host `next dev` runs Next.js's instant-navigation check on every page it
+serves: it renders the route as a navigation into each segment and logs `Could not validate that a segment in your UI has instant
+navigation` (a segment the server render never reached), `... uncached data during prerendering or a navigation` or `... runtime data
+(`cookies()`, `headers()`, `params`, `searchParams`) accessed outside of <Suspense>`, and the dev badge shows an issue. The pages work; the check is
+about what a navigation would wait for. What it found in the starter, and the fix, are in core, so no project file changes:
+- The dashboard's client auth gate (`AuthenticatedDashboardLayout`) rendered a skeleton instead of `children` while the session loaded, so the
+  route's own segments were never rendered on the server ("dropped"). It renders the page while the session loads and keeps the signed-in side effects for
+  a known user.
+- `dashboard/(main)/layout.cc` (one more `layout.cc.tsx` variant, for a layout whose permission check reads the request) renders the shell at once and runs the permission check (session and database) in a
+  Suspense boundary around the page; the ISR layout still checks before rendering anything, so a denied request keeps its real redirect.
+- The pages that await `params` (the public item routes `public-item-route.cc`, the dashboard detail and edit routes `entity-detail-route.cc` /
+  `entity-edit-route.cc`, written for a host with `cacheComponents` on and nothing else) sit behind a boundary of their own
+  (`_internal/suspended-route`); the `/signup` variant and core's default home (`(public)/page.cc`) render the page that redirects behind one too, and the public archive and the permission-denied
+  page read `searchParams` behind one. The status a visitor gets does not change: the layouts already streamed these pages after their shell.
+- A project without `public/favicon.ico` made the browser's own `GET /favicon.ico` hit the public `[slug]` page (an HTML "not found" with a 200);
+  new projects ship a favicon, and a request for a page that does not exist is now answered inside a boundary the check accepts.
+- `/superadmin` and `/devtools` (#213): their client guards hid the page from the server render until the session loaded, and each segment awaited
+  its role check outside Suspense. In a Cache Components host the area layouts (`superadmin/layout.cc`, `devtools/layout.cc` and the composed
+  override through `withSuperadminGuard` / `withDevtoolsGuard`) pass `serverChecked` to their guard, which they render only after the role
+  check, and every segment under an area is composed from `_internal/area-access.cc`: the same check, inside the segment's own Suspense boundary,
+  the segment rendered only once it has passed. The ISR host keeps `_internal/area-access` and its guards' loading state.
+Opting a segment out is `export const instant = false` in its source (a literal, as the facade rules require); nothing sets it today.
+
 Tests: `node --test packages/core/scripts/build/registry/host/__tests__/*.test.mjs`.

package/scripts/build/registry/host/__tests__/facade-emitter.test.mjs

@@ -595,14 +595,14 @@ test('an aliased magic export is forwarded under its source local name', async (
   assert.match(content, /^export \{ listSlugs as generateStaticParams \}$/m)
 })
 
-// --- fix round 3: ~16.3.5 version range --------------------------------------
+// --- fix round 3: ~baseline version range (baseline 16.3.6 since 0.1.0-beta.194) ---
 
 test('isSupportedNextVersion accepts ~baseline: same minor, stable patch >= baseline', () => {
-  assert.equal(ROUTE_EXPORT_TABLE.next, '16.3.5')
-  for (const version of ['16.3.5', '16.3.6', '16.3.9', '16.3.10', '16.3.123', '16.3.5+build.1', '16.3.7+sha.abc-1']) assert.equal(isSupportedNextVersion(version), true, version)
+  assert.equal(ROUTE_EXPORT_TABLE.next, '16.3.6')
+  for (const version of ['16.3.6', '16.3.7', '16.3.9', '16.3.10', '16.3.123', '16.3.6+build.1', '16.3.7+sha.abc-1']) assert.equal(isSupportedNextVersion(version), true, version)
   for (const version of [
-    '16.3.4', '16.3.0', '16.4.0', '16.2.9', '17.0.0', '15.3.5', '16.3.6-canary.0', '16.3.5-rc.1', '16.3.6-canary.0+build.1',
-    '16.3.4+build.1', '16.3.5+', '16.3.5+bad..meta', '16.3', 'latest', '', undefined,
+    '16.3.5', '16.3.4', '16.3.0', '16.4.0', '16.2.9', '17.0.0', '15.3.6', '16.3.7-canary.0', '16.3.6-rc.1', '16.3.7-canary.0+build.1',
+    '16.3.5+build.1', '16.3.6+', '16.3.6+bad..meta', '16.3', 'latest', '', undefined,
   ]) {
     assert.equal(isSupportedNextVersion(version), false, String(version))
   }
@@ -625,7 +625,7 @@ test('a later 16.3 patch is accepted and its own schema internal is used', async
   }
 })
 
-for (const version of ['16.3.4', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
+for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
   test(`${DIAGNOSTICS.UNSUPPORTED_NEXT_VERSION}: next@${version} is refused`, async () => {
     const dir = await fakeNextProject(version, "exports.AppSegmentConfigSchemaKeys = []\nexports.parseAppSegmentConfig = () => ({})\n")
     try {
@@ -634,7 +634,7 @@ for (const version of ['16.3.4', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
         error => {
           assert.deepEqual(error.diagnostics.map(d => d.code), [DIAGNOSTICS.UNSUPPORTED_NEXT_VERSION])
           assert.match(error.message, new RegExp(`next@${version.replace(/\./g, '\\.')}`))
-          assert.match(error.message, /next@~16\.3\.5/)
+          assert.match(error.message, /next@~16\.3\.6/)
           return true
         }
       )
@@ -646,9 +646,9 @@ for (const version of ['16.3.4', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
 
 // --- fix round 4: build metadata ----------------------------------------------
 
-test('a Next.js version with build metadata (16.3.5+build.1) is accepted end to end', async () => {
+test('a Next.js version with build metadata (16.3.6+build.1) is accepted end to end', async () => {
   const marker = "exports.AppSegmentConfigSchemaKeys = []\nexports.parseAppSegmentConfig = () => ({})\n"
-  const dir = await fakeNextProject('16.3.5+build.1', marker)
+  const dir = await fakeNextProject('16.3.6+build.1', marker)
   try {
     assert.equal(loadNextSegmentConfig(dir).error, undefined)
     const { content } = await emitFacade({ kind: 'page', target: 'a/page.tsx', specifier: '@/a', file: FILE, source: PAGE_WITH_CONFIG, projectRoot: dir })

package/scripts/build/registry/host/__tests__/host-area-access.test.mjs

@@ -276,3 +276,35 @@ test('a metadata file under an area cannot be guarded: a warning notice names it
     w.cleanup()
   }
 })
+
+/**
+ * #213: with core's own manifest, a Cache Components host composes every page and layout under the areas with
+ * area-access.cc (the check inside the segment's own Suspense boundary), a legacy ISR host with area-access as before.
+ * The facades stay inside the facade grammar either way.
+ */
+test("core's manifest: area segments import their check from area-access.cc in a Cache Components host only", async () => {
+  const facades = async cacheComponents => {
+    const { routes } = await loadCoreRouteManifest({ coreRoot: CORE_ROOT, cacheComponents })
+    const planned = planHost({ coreRoutes: routes })
+    const result = await render(planned.routes)
+    assert.deepEqual(result.diagnostics, [])
+    return result
+  }
+  const INTERNAL = '@nextsparkjs/core/routes/_internal/'
+  for (const [cacheComponents, module] of [[true, 'area-access.cc'], [false, 'area-access']]) {
+    const result = await facades(cacheComponents)
+    for (const [target, wrapper] of [
+      ['superadmin/users/page.tsx', 'withSuperadminAccess'],
+      ['superadmin/docs/[section]/[page]/page.tsx', 'withSuperadminAccess'],
+      ['devtools/page.tsx', 'withDevtoolsAccess'],
+      ['devtools/api/layout.tsx', 'withDevtoolsAccess'],
+    ]) {
+      const content = contentOf(result, target)
+      assert.ok(content, target)
+      assert.ok(content.includes(`import { ${wrapper} } from "${INTERNAL}${module}"`), `${target} (cacheComponents ${cacheComponents}) imports ${wrapper} from ${module}:\n${content}`)
+      assert.deepEqual(validateGeneratedModule({ ts, source: content, file: `src/app/${target}`, grammar: 'composed-facade' }), [], target)
+    }
+    // A doc page's generateMetadata keeps area-access's check (re-exported by area-access.cc)
+    assert.match(contentOf(result, 'superadmin/docs/[section]/[page]/page.tsx'), new RegExp(`withSuperadminMetadata.*from "${INTERNAL}${module.replace('.', '\\.')}"`, 's'))
+  }
+})

package/scripts/build/registry/host/__tests__/host-entities.test.mjs

@@ -15,7 +15,7 @@ import { dirname, join } from 'node:path'
 import { ENTITY_DIAGNOSTICS, ENTITY_MODULES, entityConfigFile, planEntityRoutes, readAllEntityFacts, readEntityFacts, routableEntities } from '../entity-routes.mjs'
 import { PLAN_DIAGNOSTICS, PLAN_NOTICES, planHost, urlConflicts } from '../plan.mjs'
 import { renderHost } from '../render.mjs'
-import { validateGeneratedModule } from '../static-imports.mjs'
+import { CORE_COMPOSITION_WRAPPERS, validateGeneratedModule } from '../static-imports.mjs'
 import { loadTypeScriptFor } from '../../shared/typescript-compiler.mjs'
 
 const CORE_ROOT = join(import.meta.dirname, '../../../../..')
@@ -29,6 +29,8 @@ const CORE_MODULES = {
   [ENTITY_MODULES.detail]: ['core/entity-detail-route.tsx', factories('createEntityDetailRoute')],
   [ENTITY_MODULES.create]: ['core/entity-create-route.tsx', factories('createEntityCreateRoute')],
   [ENTITY_MODULES.edit]: ['core/entity-edit-route.tsx', factories('createEntityEditRoute')],
+  [ENTITY_MODULES.detailCc]: ['core/entity-detail-route.cc.tsx', factories('createEntityDetailRoute')],
+  [ENTITY_MODULES.editCc]: ['core/entity-edit-route.cc.tsx', factories('createEntityEditRoute')],
   [ENTITY_MODULES.publicItem]: ['core/public-item-route.tsx', factories('createPublicItemRoute', 'createPublicItemMetadata')],
   [ENTITY_MODULES.publicItemCc]: ['core/public-item-route.cc.tsx', factories('createPublicItemRoute', 'createPublicItemMetadata')],
   [ENTITY_MODULES.publicArchive]: ['core/public-archive-route.tsx', factories('createPublicArchiveRoute', 'createPublicArchiveMetadata')],
@@ -690,6 +692,35 @@ test('a host that builds in Cache Components mode only imports the cached item s
   }
 })
 
+test('a Cache Components host writes the detail and edit pages of an entity from the modules that put them behind Suspense (they await `params`)', async () => {
+  const w = world()
+  try {
+    const args = [w, [entity('tasks', 'taskEntityConfig')], { tasks: await factsOf("slug: 'tasks', enabled: true, ui: { dashboard: { showInMenu: true } }") }]
+    const moduleOf = async (target, factory, options) => at(await render((await plan(...args, options)).routes), target).match(new RegExp(`import \\{ ${factory} \\} from "([^"]+)"`))[1]
+    assert.equal(ENTITY_MODULES.detailCc, `${ENTITY_MODULES.detail}.cc`)
+    assert.equal(ENTITY_MODULES.editCc, `${ENTITY_MODULES.edit}.cc`)
+    const detail = options => moduleOf('dashboard/(main)/tasks/[id]/page.tsx', 'createEntityDetailRoute', options)
+    const edit = options => moduleOf('dashboard/(main)/tasks/[id]/edit/page.tsx', 'createEntityEditRoute', options)
+    assert.equal(await detail({ cacheComponents: true }), ENTITY_MODULES.detailCc)
+    assert.equal(await edit({ cacheComponents: true }), ENTITY_MODULES.editCc)
+    // An ISR host keeps the routes that redirect and answer notFound() before anything is sent; so does one that builds both, or does not know
+    for (const options of [{ cacheComponents: false }, {}, { cacheComponents: true, modes: ['isr', 'cc'] }]) {
+      assert.equal(await detail(options), ENTITY_MODULES.detail)
+      assert.equal(await edit(options), ENTITY_MODULES.edit)
+    }
+  } finally {
+    w.cleanup()
+  }
+})
+
+test('every factory module the entity routes import is a known composition module, with the factories it exports (a real host fails facade validation otherwise)', () => {
+  const FACTORY_MODULES = ['layout', 'list', 'detail', 'create', 'edit', 'detailCc', 'editCc', 'publicItem', 'publicItemCc', 'publicArchive']
+  for (const name of FACTORY_MODULES) {
+    const wrappers = CORE_COMPOSITION_WRAPPERS[ENTITY_MODULES[name]]
+    assert.ok(Array.isArray(wrappers) && wrappers.length > 0, `${name}: ${ENTITY_MODULES[name]} is missing from CORE_COMPOSITION_WRAPPERS`)
+  }
+})
+
 // ---------------------------------------------------------------------------
 // "The template replaces": project templates at an entity's dashboard URL in another route group
 // ---------------------------------------------------------------------------