@nextsparkjs/core 0.1.0-beta.194 → 0.1.0-beta.195

package/dist/routes/dashboard/(main)/layout.cc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.cc.tsx"],"names":[],"mappings":"AAgBA,MAAM,CAAC,OAAO,UAAU,mBAAmB,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CAQtF"}

package/dist/routes/dashboard/(main)/layout.cc.js

@@ -0,0 +1,10 @@
+import { Fragment, jsx } from "react/jsx-runtime";
+import { Suspense } from "react";
+import { MainDashboardShell, enforceEntityPermission } from "../../_internal/dashboard-main-shared.js";
+async function EntityPermission({ children }) {
+  await enforceEntityPermission();
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+export default function MainDashboardLayout({ children }) {
+  return /* @__PURE__ */ jsx(MainDashboardShell, { children: /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(EntityPermission, { children }) }) });
+}

package/dist/routes/dashboard/(main)/layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.tsx"],"names":[],"mappings":"AAsDA,iBAAe,0BAA0B,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B,oDAmCA;AAGD,eAAe,0BAA0B,CAAA"}
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/(main)/layout.tsx"],"names":[],"mappings":"AAcA,iBAAe,0BAA0B,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B,oDAIA;AAGD,eAAe,0BAA0B,CAAA"}

package/dist/routes/dashboard/(main)/layout.js

@@ -1,50 +1,9 @@
 import { jsx } from "react/jsx-runtime";
-import { headers } from "next/headers";
-import { redirect } from "next/navigation";
-import { DashboardShell } from "@nextsparkjs/core/components/dashboard/layouts/DashboardShell";
-import { serializeEntityConfig } from "@nextsparkjs/core/lib/entities/serialization";
-import { setEntityRegistry } from "@nextsparkjs/core/lib/entities/queries";
-import { checkPermission } from "@nextsparkjs/core/lib/permissions/check";
-import { getDashboardPermissionContext } from "@nextsparkjs/core/lib/auth/request-session";
-import { isValidPermission } from "@nextsparkjs/core/lib/permissions/init";
-import { ENTITY_REGISTRY, ENTITY_METADATA } from "@nextsparkjs/registries/entity-registry";
-setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA);
-function parseEntityFromPathname(pathname) {
-  const match = pathname.match(/^\/dashboard\/([^/]+)(?:\/(.*))?$/);
-  if (!match) return null;
-  const entity = match[1];
-  const rest = match[2] || "";
-  if (rest === "" || rest === "/") return { entity, action: "list" };
-  if (rest === "create") return { entity, action: "create" };
-  if (rest.match(/^[^/]+\/edit$/)) return { entity, action: "update" };
-  if (rest.match(/^[^/]+$/)) return { entity, action: "read" };
-  return { entity, action: "read" };
-}
-function isEntityConfig(entity) {
-  return "slug" in entity;
-}
+import { MainDashboardShell, enforceEntityPermission } from "../../_internal/dashboard-main-shared.js";
 async function DefaultMainDashboardLayout({
   children
 }) {
-  const allEntities = Object.values(ENTITY_REGISTRY).map((entry) => entry.config);
-  const entities = allEntities.filter(isEntityConfig);
-  const serializedEntities = entities.map(serializeEntityConfig);
-  const headersList = await headers();
-  const pathname = headersList.get("x-pathname") || "";
-  const { userId, teamId } = await getDashboardPermissionContext();
-  if (userId && teamId && pathname) {
-    const parsed = parseEntityFromPathname(pathname);
-    if (parsed) {
-      const { entity, action } = parsed;
-      const permission = `${entity}.${action}`;
-      if (isValidPermission(`${entity}.list`)) {
-        const hasPermission = await checkPermission(userId, teamId, permission);
-        if (!hasPermission) {
-          redirect(`/dashboard/permission-denied?entity=${entity}&action=${action}`);
-        }
-      }
-    }
-  }
-  return /* @__PURE__ */ jsx(DashboardShell, { entities: serializedEntities, children });
+  await enforceEntityPermission();
+  return /* @__PURE__ */ jsx(MainDashboardShell, { children });
 }
 export default DefaultMainDashboardLayout;

package/dist/routes/dashboard/permission-denied/page.d.ts

@@ -4,6 +4,6 @@ interface PermissionDeniedPageProps {
         action?: string;
     }>;
 }
-declare function PermissionDeniedPage({ searchParams }: PermissionDeniedPageProps): Promise<import("react/jsx-runtime").JSX.Element>;
+declare function PermissionDeniedPage({ searchParams }: PermissionDeniedPageProps): import("react/jsx-runtime").JSX.Element;
 export default PermissionDeniedPage;
 //# sourceMappingURL=page.d.ts.map

package/dist/routes/dashboard/permission-denied/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/permission-denied/page.tsx"],"names":[],"mappings":"AAQA,UAAU,yBAAyB;IACjC,YAAY,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH;AAED,iBAAe,oBAAoB,CAAC,EAClC,YAAY,EACb,EAAE,yBAAyB,oDAW3B;AAED,eAAe,oBAAoB,CAAA"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/dashboard/permission-denied/page.tsx"],"names":[],"mappings":"AASA,UAAU,yBAAyB;IACjC,YAAY,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH;AAkBD,iBAAS,oBAAoB,CAAC,EAAE,YAAY,EAAE,EAAE,yBAAyB,2CAMxE;AAED,eAAe,oBAAoB,CAAA"}

package/dist/routes/dashboard/permission-denied/page.js

@@ -1,6 +1,7 @@
 import { jsx } from "react/jsx-runtime";
+import { Suspense } from "react";
 import { NoPermission } from "@nextsparkjs/core/components/permissions/NoPermission";
-async function PermissionDeniedPage({
+async function DeniedMessage({
   searchParams
 }) {
   const { entity, action } = await searchParams;
@@ -14,4 +15,7 @@ async function PermissionDeniedPage({
     }
   );
 }
+function PermissionDeniedPage({ searchParams }) {
+  return /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(DeniedMessage, { searchParams }) });
+}
 export default PermissionDeniedPage;

package/dist/routes/devtools/layout.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/devtools/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAEjD,wBAAkD"}
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/devtools/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAUjD,wBAA+D"}

package/dist/routes/devtools/layout.cc.js

@@ -1,4 +1,8 @@
+import { jsx } from "react/jsx-runtime";
 import { DevLayout, defaultMetadata } from "../_internal/devtools-layout.js";
 import { withDevtoolsAreaMessages } from "../_internal/devtools-layout.cc.js";
 export const metadata = defaultMetadata;
-export default withDevtoolsAreaMessages(DevLayout);
+function ServerCheckedDevLayout({ children }) {
+  return /* @__PURE__ */ jsx(DevLayout, { serverChecked: true, children });
+}
+export default withDevtoolsAreaMessages(ServerCheckedDevLayout);

package/dist/routes/manifest.json

@@ -422,6 +422,11 @@
     "target": "api/v1/users/[id]/route.ts",
     "specifier": "@nextsparkjs/core/routes/api/v1/users/[id]/route"
   },
+  {
+    "kind": "route",
+    "target": "api/v1/users/me/route.ts",
+    "specifier": "@nextsparkjs/core/routes/api/v1/users/me/route"
+  },
   {
     "kind": "route",
     "target": "api/v1/users/route.ts",
@@ -716,6 +721,11 @@
     "target": "public/page.tsx",
     "specifier": "@nextsparkjs/core/routes/public/page"
   },
+  {
+    "kind": "robots",
+    "target": "robots.ts",
+    "specifier": "@nextsparkjs/core/routes/robots"
+  },
   {
     "kind": "page",
     "target": "superadmin/docs/[section]/[page]/page.tsx",

package/dist/routes/robots.d.ts

@@ -0,0 +1,10 @@
+import type { MetadataRoute } from 'next';
+/**
+ * /robots.txt (#214): public pages are crawlable, the authenticated areas and the API are not.
+ *
+ * Answers `text/plain` 200 in Cache Components and legacy ISR alike, so a crawler never gets the public
+ * catch-all page's HTML. A project overrides it with its own `robots.ts` (templates/robots.ts), which
+ * replaces this route. Core has no sitemap, so none is declared.
+ */
+export default function robots(): MetadataRoute.Robots;
+//# sourceMappingURL=robots.d.ts.map

package/dist/routes/robots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"robots.d.ts","sourceRoot":"","sources":["../../src/routes/robots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAGzC;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,UAAU,MAAM,IAAI,aAAa,CAAC,MAAM,CAQrD"}

package/dist/routes/robots.js

@@ -0,0 +1,10 @@
+import { withBasePath } from "@nextsparkjs/core/lib/base-path";
+export default function robots() {
+  return {
+    rules: {
+      userAgent: "*",
+      allow: withBasePath("/"),
+      disallow: ["/dashboard", "/superadmin", "/devtools", "/api"].map(withBasePath)
+    }
+  };
+}

package/dist/routes/superadmin/layout.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/superadmin/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAEjD,wBAA2D"}
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/superadmin/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAUjD,wBAAwE"}

package/dist/routes/superadmin/layout.cc.js

@@ -1,4 +1,8 @@
+import { jsx } from "react/jsx-runtime";
 import { SuperadminLayout, defaultMetadata } from "../_internal/superadmin-layout.js";
 import { withSuperadminAreaMessages } from "../_internal/superadmin-layout.cc.js";
 export const metadata = defaultMetadata;
-export default withSuperadminAreaMessages(SuperadminLayout);
+function ServerCheckedSuperadminLayout({ children }) {
+  return /* @__PURE__ */ jsx(SuperadminLayout, { serverChecked: true, children });
+}
+export default withSuperadminAreaMessages(ServerCheckedSuperadminLayout);

package/dist/routes/variants.json

@@ -39,7 +39,7 @@
         "wrapper": "withSuperadminAccess",
         "metadata": "withSuperadminMetadata",
         "handler": "withSuperadminRouteAccess",
-        "specifier": "@nextsparkjs/core/routes/_internal/area-access"
+        "specifier": "@nextsparkjs/core/routes/_internal/area-access.cc"
       }
     },
     {
@@ -54,7 +54,7 @@
         "wrapper": "withDevtoolsAccess",
         "metadata": "withDevtoolsMetadata",
         "handler": "withDevtoolsRouteAccess",
-        "specifier": "@nextsparkjs/core/routes/_internal/area-access"
+        "specifier": "@nextsparkjs/core/routes/_internal/area-access.cc"
       }
     },
     {
@@ -62,6 +62,16 @@
       "target": "dashboard/layout.tsx",
       "specifier": "@nextsparkjs/core/routes/dashboard/layout.cc"
     },
+    {
+      "kind": "layout",
+      "target": "dashboard/(main)/layout.tsx",
+      "specifier": "@nextsparkjs/core/routes/dashboard/(main)/layout.cc"
+    },
+    {
+      "kind": "page",
+      "target": "(public)/page.tsx",
+      "specifier": "@nextsparkjs/core/routes/(public)/page.cc"
+    },
     {
       "kind": "page",
       "target": "(auth)/login/page.tsx",

package/dist/templates/next.config.mjs

@@ -260,35 +260,8 @@ const nextConfig = {
         source: '/:path*',
         headers: securityHeaders
       },
-      // CORS headers for API routes
-      // NOTE: In development, CORS is handled dynamically by API routes using addCorsHeaders()
-      // to support multiple origins (web app, mobile app, etc.)
-      // In production, we set static CORS headers here
-      ...(isProduction ? [{
-        source: '/api/:path*',
-        headers: [
-          {
-            key: 'Access-Control-Allow-Origin',
-            value: process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-          },
-          {
-            key: 'Access-Control-Allow-Methods',
-            value: 'GET, POST, PUT, DELETE, OPTIONS, PATCH'
-          },
-          {
-            key: 'Access-Control-Allow-Headers',
-            value: 'Content-Type, Authorization, x-api-key, x-verify-from-ui, Cookie, Set-Cookie'
-          },
-          {
-            key: 'Access-Control-Allow-Credentials',
-            value: 'true'
-          },
-          {
-            key: 'Access-Control-Expose-Headers',
-            value: 'Set-Cookie'
-          }
-        ]
-      }] : [])
+      // No CORS headers here: core's API routes answer CORS per request (addCorsHeaders), so the
+      // origins in api.cors.allowedOrigins and CORS_ADDITIONAL_ORIGINS get their grant in production too
     ]
   },
 }

package/dist/templates/projects/blog/api/authors/[username]/route.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface Author {
   id: string
@@ -151,3 +152,5 @@ const getHandler = async (
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/dist/templates/projects/blog/api/authors/route.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface AuthorWithCount {
   id: string
@@ -64,3 +65,5 @@ const getHandler = async (request: NextRequest) => {
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/dist/templates/projects/blog/api/posts/public/route.ts

@@ -11,6 +11,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface Post {
   id: string
@@ -152,3 +153,5 @@ const getHandler = async (request: NextRequest) => {
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/dist/templates/proxy.ts

@@ -200,8 +200,19 @@ function getSession(request: NextRequest) {
  * session. Gating the strip on protected prefixes is not enough: Next.js
  * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
  * action can be POSTed to a public path with a forged `x-user-id`.
+ *
+ * The `x-api-*` names are never set here: core takes an API key's identity from
+ * validating the key, and nothing downstream may receive them from the client.
  */
-const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname', 'x-active-team-id'] as const
+const TRUSTED_IDENTITY_HEADERS = [
+  'x-user-id',
+  'x-user-email',
+  'x-pathname',
+  'x-active-team-id',
+  'x-api-user-id',
+  'x-api-key-id',
+  'x-api-scopes',
+] as const
 
 /**
  * Build the request headers forwarded to the app: inbound copy minus every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.194",
+  "version": "0.1.0-beta.195",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -496,7 +496,7 @@
     "use-intl": "^4.9.1",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@nextsparkjs/ui": "0.1.0-beta.194"
+    "@nextsparkjs/ui": "0.1.0-beta.195"
   },
   "engines": {
     "node": ">=22.14.0"

package/scripts/build/registry/__tests__/api-docs-colocated.test.mjs

@@ -15,6 +15,9 @@ import test from 'node:test'
 import { discoverApiPresets } from '../discovery/api-presets.mjs'
 import { discoverRouteFiles } from '../discovery/plugins.mjs'
 import { generateRouteHandlersRegistry } from '../generators/route-handlers.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const presets = endpoint => `export default defineApiEndpoint({\n  endpoint: '${endpoint}',\n  summary: 'S',\n  presets: [{ id: 'a', title: 'A', method: 'GET' }]\n})\n`
 

package/scripts/build/registry/__tests__/billing-registry.test.mjs

@@ -8,12 +8,15 @@
 
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, readdir, rm } from 'node:fs/promises'
+import { mkdir, mkdtemp, readdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { generateBillingRegistry } from '../generators/billing-registry.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..', '..', '..')
 
@@ -45,3 +48,49 @@ test("generateBillingRegistry's jiti import writes nothing under TMPDIR, even wh
     await cacheRoot.cleanup()
   }
 })
+
+// #212: a billing config that exists but cannot load must fail the build, never become an empty registry
+async function projectWith(billingSource) {
+  const dir = await directory('nextspark-billing-registry-cases-')
+  if (billingSource !== undefined) {
+    await mkdir(join(dir.root, 'config'), { recursive: true })
+    await writeFile(join(dir.root, 'config/billing.config.ts'), billingSource)
+  }
+  return { ...dir, config: { projectRoot: dir.root, projectSourceDir: dir.root, projectName: 'cases', outputDir: join(dir.root, 'out') } }
+}
+
+test('no billing config: the empty registry, the build keeps going', async () => {
+  const project = await projectWith(undefined)
+  try {
+    assert.match(await generateBillingRegistry(project.config), /No billing config found - empty registry generated/)
+  } finally { await project.cleanup() }
+})
+
+test('a valid billing config is read into the registry', async () => {
+  const project = await projectWith(`export const billingConfig = { provider: 'stripe', currency: 'usd', defaultPlan: 'free', features: { api: {} }, limits: { seats: {} }, plans: [{ slug: 'free', visibility: 'public', features: ['api'], limits: { seats: 3 } }] }\n`)
+  try {
+    const output = await generateBillingRegistry(project.config)
+    assert.match(output, /"totalPlans": 1/)
+    assert.match(output, /"seats": \{\s+"free": 3/)
+  } finally { await project.cleanup() }
+})
+
+test('a billing config that throws fails with its file name and the underlying error', async () => {
+  const project = await projectWith(`throw new Error('stripe price id is missing')\n`)
+  try {
+    await assert.rejects(generateBillingRegistry(project.config), (error) => {
+      assert.ok(error.message.includes(join(project.root, 'config/billing.config.ts')), error.message)
+      assert.ok(error.message.includes('stripe price id is missing'), error.message)
+      return true
+    })
+  } finally { await project.cleanup() }
+})
+
+test('a billing config with a syntax error or without a billingConfig export also fails', async () => {
+  for (const source of ['export const billingConfig = {', 'export const other = 1\n']) {
+    const project = await projectWith(source)
+    try {
+      await assert.rejects(generateBillingRegistry(project.config), /billing\.config\.ts/)
+    } finally { await project.cleanup() }
+  }
+})

package/scripts/build/registry/__tests__/block-registry.test.mjs

@@ -25,6 +25,9 @@ import {
 import { readSchemaExport, thumbnailImport } from '../discovery/blocks.mjs'
 import { validateGeneratedModule } from '../host/static-imports.mjs'
 import { loadTypeScriptFor } from '../shared/typescript-compiler.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 function block(slug, category) {
   const base = `@/blocks/${slug}`

package/scripts/build/registry/__tests__/icons-discovery.test.mjs

@@ -24,6 +24,9 @@ import {
   isTestFilePath,
   extractLiteralIconCallNames
 } from '../discovery/icons.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 test('discovers core entity icons through the resolution owner coreDir', async () => {
   const root = await mkdtemp(join(tmpdir(), 'nextspark-icons-core-dir-'))

package/scripts/build/registry/__tests__/quiet-console.mjs

@@ -0,0 +1,17 @@
+import { after, before, mock } from 'node:test'
+
+/**
+ * Keeps a test file's in-process console.log/info output off the test child's stdout. The Node test runner
+ * reads that stdout for its own frames, and non-ASCII text on it (the build log's emoji) can make it fail with
+ * "Unable to deserialize cloned data" (nodejs/node#64061, fixed on 24+ only; #65934 for 22).
+ * Call once at the top of a file; a test that needs to read the output replaces console.log itself.
+ */
+export function silenceConsoleOutput() {
+  before(() => {
+    mock.method(console, 'log', () => {})
+    mock.method(console, 'info', () => {})
+  })
+  after(() => {
+    mock.restoreAll()
+  })
+}

package/scripts/build/registry/__tests__/safe-fs.test.mjs

@@ -23,6 +23,9 @@ import { fileURLToPath } from 'node:url'
 import { COPY_BLOCK_SIZE, isUnsafeWrite, projectFiles, UNSAFE_WRITE, unsafeWriteProblem } from '../../safe-fs.mjs'
 import { generateTestBlocksJson, generateTestEntitiesJson } from '../post-build/test-fixtures.mjs'
 import { directFsWrites, directFsWritesIn, generatorFiles } from './direct-fs-writes.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const CORE_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..')
 const RUNS_AS_ROOT = process.getuid?.() === 0

package/scripts/build/registry/__tests__/team-roles.test.mjs

@@ -18,6 +18,9 @@ import assert from 'node:assert/strict'
 
 import { computeTeamRoleConfig, generatePermissionsRegistry } from '../generators/permissions-registry.mjs'
 import { parseTeamRolesFromAppConfig } from '../discovery/permissions.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 // ---------------------------------------------------------------------------
 // computeTeamRoleConfig — the pure build-time computation

package/scripts/build/registry/discovery/permissions.test.mjs

@@ -6,6 +6,9 @@
 
 import { describe, it } from 'node:test'
 import assert from 'node:assert'
+import { silenceConsoleOutput } from '../__tests__/quiet-console.mjs'
+
+silenceConsoleOutput()
 
 // Import the regex pattern directly since parseEntitiesFromConfig is not exported
 // We'll test the regex patterns directly

package/scripts/build/registry/discovery/plugin-capabilities.mjs

@@ -329,11 +329,11 @@ const BUILTINS = new Set(builtinModules.filter(name => !name.startsWith('_')))
 /** Bare specifiers that only run on a server (`next/server` is Next's request/response and `after`/`connection` APIs). */
 const SERVER_ONLY_PACKAGES = new Set(['server-only', 'next/headers', 'next/server', 'pg', 'postgres', 'ioredis', 'nodemailer'])
 /**
- * The `lib/api` modules core's own 'use client' files import (the entity fetch helpers, `ApiError`, the scope catalog):
+ * The `lib/api` modules core's own 'use client' files import (the entity fetch helpers, `ApiError`, the scope catalog, the client request header names):
  * they import no server module, so they are client-safe. Everything else under `lib/api` is server-only. A guard test
  * checks that every `lib/api` module a core 'use client' file imports is in this list.
  */
-export const CLIENT_SAFE_CORE_API = ['entities', 'api-error', 'keys']
+export const CLIENT_SAFE_CORE_API = ['entities', 'api-error', 'keys', 'client-headers']
 /** Core modules known to be server-only; the ones that import a marker above are also found by following the import. */
 const SERVER_ONLY_CORE = [
   /^@nextsparkjs\/core\/lib\/db(\/|$)/,

package/scripts/build/registry/generators/billing-registry.mjs

@@ -119,10 +119,14 @@ export async function generateBillingRegistry(configOrName, _legacyContentsDir,
     // Use jiti to import .ts files at build time (Node.js can't import .ts natively)
     const jiti = createJiti(import.meta.url, { interopDefault: true, fsCache: false })
     const module = await jiti.import(absolutePath)
-    billingConfig = module.billingConfig || module.default
+    billingConfig = module.billingConfig
   } catch (error) {
-    log(`Failed to import billing config from ${absolutePath}: ${error.message}`, 'error')
-    return generateEmptyBillingRegistry(config)
+    // A config that exists but cannot load must stop the build: an empty registry has no plans,
+    // and a project without plans skips every feature and quota check.
+    throw new Error(`Failed to load billing config ${absolutePath}: ${error.message}`, { cause: error })
+  }
+  if (!billingConfig || !Array.isArray(billingConfig.plans) || !billingConfig.features || !billingConfig.limits) {
+    throw new Error(`Billing config ${absolutePath} must export \`billingConfig\` with plans, features and limits`)
   }
 
   // Pre-compute everything at build time

package/scripts/build/registry/host/README.md

@@ -217,7 +217,8 @@ spread and no expression. A host with another core (the conformance fixture) pas
   `_internal/default-{auth,public}-layout`).
 - **Role-gated areas** `/superadmin`, `/devtools`: every page, layout, template and default served under the area's URL (core's,
   a plugin's or the project's, in any route group) is composed with `withSuperadminAccess` / `withDevtoolsAccess`
-  (`routes/_internal/area-access`), which checks the session's role on the server before the segment renders, and its
+  (`routes/_internal/area-access`; `area-access.cc` in a Cache Components host, the same check inside the segment's own Suspense
+  boundary), which checks the session's role on the server before the segment renders, and its
   `generateMetadata` with `withSuperadminMetadata` / `withDevtoolsMetadata` (metadata resolves apart too); a Route Handler's
   methods but `OPTIONS` with `withSuperadminRouteAccess` / `withDevtoolsRouteAccess` (401 / 403 JSON; `OPTIONS` is forwarded
   unchecked, so it must not return data). An intercepting route
@@ -293,4 +294,27 @@ cookies or headers below no other boundary). The public item routes omit `revali
 mode only imports `_internal/public-item-route.cc`, whose reads of the published item and of the patterns it references are `'use cache'`
 functions (`cacheLife` of an hour for an item, tags `entity:<slug>` and `public-item:<slug>:<item slug>`).
 
+**Instant navigation (dev server).** On a Cache Components host `next dev` runs Next.js's instant-navigation check on every page it
+serves: it renders the route as a navigation into each segment and logs `Could not validate that a segment in your UI has instant
+navigation` (a segment the server render never reached), `... uncached data during prerendering or a navigation` or `... runtime data
+(`cookies()`, `headers()`, `params`, `searchParams`) accessed outside of <Suspense>`, and the dev badge shows an issue. The pages work; the check is
+about what a navigation would wait for. What it found in the starter, and the fix, are in core, so no project file changes:
+- The dashboard's client auth gate (`AuthenticatedDashboardLayout`) rendered a skeleton instead of `children` while the session loaded, so the
+  route's own segments were never rendered on the server ("dropped"). It renders the page while the session loads and keeps the signed-in side effects for
+  a known user.
+- `dashboard/(main)/layout.cc` (one more `layout.cc.tsx` variant, for a layout whose permission check reads the request) renders the shell at once and runs the permission check (session and database) in a
+  Suspense boundary around the page; the ISR layout still checks before rendering anything, so a denied request keeps its real redirect.
+- The pages that await `params` (the public item routes `public-item-route.cc`, the dashboard detail and edit routes `entity-detail-route.cc` /
+  `entity-edit-route.cc`, written for a host with `cacheComponents` on and nothing else) sit behind a boundary of their own
+  (`_internal/suspended-route`); the `/signup` variant and core's default home (`(public)/page.cc`) render the page that redirects behind one too, and the public archive and the permission-denied
+  page read `searchParams` behind one. The status a visitor gets does not change: the layouts already streamed these pages after their shell.
+- A project without `public/favicon.ico` made the browser's own `GET /favicon.ico` hit the public `[slug]` page (an HTML "not found" with a 200);
+  new projects ship a favicon, and a request for a page that does not exist is now answered inside a boundary the check accepts.
+- `/superadmin` and `/devtools` (#213): their client guards hid the page from the server render until the session loaded, and each segment awaited
+  its role check outside Suspense. In a Cache Components host the area layouts (`superadmin/layout.cc`, `devtools/layout.cc` and the composed
+  override through `withSuperadminGuard` / `withDevtoolsGuard`) pass `serverChecked` to their guard, which they render only after the role
+  check, and every segment under an area is composed from `_internal/area-access.cc`: the same check, inside the segment's own Suspense boundary,
+  the segment rendered only once it has passed. The ISR host keeps `_internal/area-access` and its guards' loading state.
+Opting a segment out is `export const instant = false` in its source (a literal, as the facade rules require); nothing sets it today.
+
 Tests: `node --test packages/core/scripts/build/registry/host/__tests__/*.test.mjs`.

package/scripts/build/registry/host/__tests__/host-area-access.test.mjs

@@ -276,3 +276,35 @@ test('a metadata file under an area cannot be guarded: a warning notice names it
     w.cleanup()
   }
 })
+
+/**
+ * #213: with core's own manifest, a Cache Components host composes every page and layout under the areas with
+ * area-access.cc (the check inside the segment's own Suspense boundary), a legacy ISR host with area-access as before.
+ * The facades stay inside the facade grammar either way.
+ */
+test("core's manifest: area segments import their check from area-access.cc in a Cache Components host only", async () => {
+  const facades = async cacheComponents => {
+    const { routes } = await loadCoreRouteManifest({ coreRoot: CORE_ROOT, cacheComponents })
+    const planned = planHost({ coreRoutes: routes })
+    const result = await render(planned.routes)
+    assert.deepEqual(result.diagnostics, [])
+    return result
+  }
+  const INTERNAL = '@nextsparkjs/core/routes/_internal/'
+  for (const [cacheComponents, module] of [[true, 'area-access.cc'], [false, 'area-access']]) {
+    const result = await facades(cacheComponents)
+    for (const [target, wrapper] of [
+      ['superadmin/users/page.tsx', 'withSuperadminAccess'],
+      ['superadmin/docs/[section]/[page]/page.tsx', 'withSuperadminAccess'],
+      ['devtools/page.tsx', 'withDevtoolsAccess'],
+      ['devtools/api/layout.tsx', 'withDevtoolsAccess'],
+    ]) {
+      const content = contentOf(result, target)
+      assert.ok(content, target)
+      assert.ok(content.includes(`import { ${wrapper} } from "${INTERNAL}${module}"`), `${target} (cacheComponents ${cacheComponents}) imports ${wrapper} from ${module}:\n${content}`)
+      assert.deepEqual(validateGeneratedModule({ ts, source: content, file: `src/app/${target}`, grammar: 'composed-facade' }), [], target)
+    }
+    // A doc page's generateMetadata keeps area-access's check (re-exported by area-access.cc)
+    assert.match(contentOf(result, 'superadmin/docs/[section]/[page]/page.tsx'), new RegExp(`withSuperadminMetadata.*from "${INTERNAL}${module.replace('.', '\\.')}"`, 's'))
+  }
+})