@nextsparkjs/core 0.1.0-beta.194 → 0.1.0-beta.196

package/dist/routes/dashboard/settings/password/page.js

@@ -9,7 +9,7 @@ import {
   CheckCircle,
   Loader2
 } from "lucide-react";
-import { useState, useCallback } from "react";
+import { useState, useCallback, useEffect } from "react";
 import { useForm } from "react-hook-form";
 import { useRouter } from "next/navigation";
 import { Button } from "@nextsparkjs/core/components/ui/button";
@@ -25,6 +25,7 @@ function UpdatePasswordPage() {
   const { hasPassword, isLoading: profileLoading } = useUserProfile();
   const router = useRouter();
   const t = useTranslations("settings");
+  const tCommon = useTranslations("common");
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState(null);
   const [success, setSuccess] = useState(false);
@@ -58,7 +59,7 @@ function UpdatePasswordPage() {
       if (!result.success) {
         const errorMsg = result.error || t("password.messages.updateError");
         setError(errorMsg);
-        setStatusMessage(`${t("common.status.error")}: ${errorMsg}`);
+        setStatusMessage(`${tCommon("status.error")}: ${errorMsg}`);
       } else {
         setSuccess(true);
         setStatusMessage(t("password.messages.updateSuccess"));
@@ -66,25 +67,22 @@ function UpdatePasswordPage() {
     } catch {
       const errorMsg = t("password.messages.unexpectedError");
       setError(errorMsg);
-      setStatusMessage(`${t("common.status.error")}: ${errorMsg}`);
+      setStatusMessage(`${tCommon("status.error")}: ${errorMsg}`);
     } finally {
       setLoading(false);
     }
-  }, [changePassword, t]);
-  if (!user) {
-    router.push("/login");
-    return null;
-  }
-  if (!profileLoading && !hasPassword) {
-    router.push("/dashboard/settings/profile");
-    return null;
-  }
+  }, [changePassword, t, tCommon]);
+  const mustRedirectToProfile = !!user && !profileLoading && !hasPassword;
+  useEffect(() => {
+    if (mustRedirectToProfile) router.push("/dashboard/settings/profile");
+  }, [mustRedirectToProfile, router]);
   if (profileLoading) {
     return /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-center py-12", children: [
       /* @__PURE__ */ jsx(Loader2, { className: "h-8 w-8 animate-spin text-muted-foreground" }),
       /* @__PURE__ */ jsx("span", { className: "sr-only", children: t("password.loading.verifying") })
     ] });
   }
+  if (!user || mustRedirectToProfile) return null;
   if (success) {
     return /* @__PURE__ */ jsxs(Fragment, { children: [
       /* @__PURE__ */ jsx(

package/dist/routes/devtools/config/page.js

@@ -4,7 +4,7 @@ import { ConfigViewer } from "@nextsparkjs/core/components/devtools/ConfigViewer
 import { Settings } from "lucide-react";
 import { getTranslations } from "next-intl/server";
 async function DevConfigPageContent() {
-  const t = await getTranslations("dev.config");
+  const t = await getTranslations("devtools.config");
   return /* @__PURE__ */ jsxs("div", { className: "space-y-6", "data-cy": "devtools-config-page", children: [
     /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3", children: [
       /* @__PURE__ */ jsx("div", { className: "flex items-center justify-center w-12 h-12 bg-violet-100 dark:bg-violet-950 rounded-lg", children: /* @__PURE__ */ jsx(Settings, { className: "h-6 w-6 text-violet-600 dark:text-violet-400" }) }),

package/dist/routes/devtools/layout.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/devtools/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAEjD,wBAAkD"}
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/devtools/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAUjD,wBAA+D"}

package/dist/routes/devtools/layout.cc.js

@@ -1,4 +1,8 @@
+import { jsx } from "react/jsx-runtime";
 import { DevLayout, defaultMetadata } from "../_internal/devtools-layout.js";
 import { withDevtoolsAreaMessages } from "../_internal/devtools-layout.cc.js";
 export const metadata = defaultMetadata;
-export default withDevtoolsAreaMessages(DevLayout);
+function ServerCheckedDevLayout({ children }) {
+  return /* @__PURE__ */ jsx(DevLayout, { serverChecked: true, children });
+}
+export default withDevtoolsAreaMessages(ServerCheckedDevLayout);

package/dist/routes/devtools/page.js

@@ -5,7 +5,7 @@ import Link from "next/link";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@nextsparkjs/core/components/ui/card";
 import { getTranslations } from "next-intl/server";
 async function DevHomePageContent() {
-  const t = await getTranslations("dev");
+  const t = await getTranslations("devtools");
   const tCommon = await getTranslations("common");
   const sections = [
     {

package/dist/routes/devtools/scheduled-actions/page.js

@@ -26,7 +26,7 @@ async function fetchScheduledActions(filters, page, limit) {
   return response.json();
 }
 export default function ScheduledActionsPage() {
-  const t = useTranslations("dev.scheduledActions");
+  const t = useTranslations("devtools.scheduledActions");
   const [filters, setFilters] = useState({});
   const [page, setPage] = useState(1);
   const limit = 20;

package/dist/routes/devtools/tests/[[...path]]/page.js

@@ -5,7 +5,7 @@ import { FileText } from "lucide-react";
 import { getTranslations } from "next-intl/server";
 async function DevTestsPageContent({ params }) {
   const { path } = await params;
-  const t = await getTranslations("dev.tests");
+  const t = await getTranslations("devtools.tests");
   const initialPath = (path == null ? void 0 : path.join("/")) || null;
   return /* @__PURE__ */ jsxs(
     "div",

package/dist/routes/manifest.json

@@ -422,6 +422,11 @@
     "target": "api/v1/users/[id]/route.ts",
     "specifier": "@nextsparkjs/core/routes/api/v1/users/[id]/route"
   },
+  {
+    "kind": "route",
+    "target": "api/v1/users/me/route.ts",
+    "specifier": "@nextsparkjs/core/routes/api/v1/users/me/route"
+  },
   {
     "kind": "route",
     "target": "api/v1/users/route.ts",
@@ -716,6 +721,11 @@
     "target": "public/page.tsx",
     "specifier": "@nextsparkjs/core/routes/public/page"
   },
+  {
+    "kind": "robots",
+    "target": "robots.ts",
+    "specifier": "@nextsparkjs/core/routes/robots"
+  },
   {
     "kind": "page",
     "target": "superadmin/docs/[section]/[page]/page.tsx",

package/dist/routes/robots.d.ts

@@ -0,0 +1,10 @@
+import type { MetadataRoute } from 'next';
+/**
+ * /robots.txt (#214): public pages are crawlable, the authenticated areas and the API are not.
+ *
+ * Answers `text/plain` 200 in Cache Components and legacy ISR alike, so a crawler never gets the public
+ * catch-all page's HTML. A project overrides it with its own `robots.ts` (templates/robots.ts), which
+ * replaces this route. Core has no sitemap, so none is declared.
+ */
+export default function robots(): MetadataRoute.Robots;
+//# sourceMappingURL=robots.d.ts.map

package/dist/routes/robots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"robots.d.ts","sourceRoot":"","sources":["../../src/routes/robots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAGzC;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,UAAU,MAAM,IAAI,aAAa,CAAC,MAAM,CAQrD"}

package/dist/routes/robots.js

@@ -0,0 +1,10 @@
+import { withBasePath } from "@nextsparkjs/core/lib/base-path";
+export default function robots() {
+  return {
+    rules: {
+      userAgent: "*",
+      allow: withBasePath("/"),
+      disallow: ["/dashboard", "/superadmin", "/devtools", "/api"].map(withBasePath)
+    }
+  };
+}

package/dist/routes/superadmin/layout.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/superadmin/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAEjD,wBAA2D"}
+{"version":3,"file":"layout.cc.d.ts","sourceRoot":"","sources":["../../../src/routes/superadmin/layout.cc.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAIpC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;;;;AAUjD,wBAAwE"}

package/dist/routes/superadmin/layout.cc.js

@@ -1,4 +1,8 @@
+import { jsx } from "react/jsx-runtime";
 import { SuperadminLayout, defaultMetadata } from "../_internal/superadmin-layout.js";
 import { withSuperadminAreaMessages } from "../_internal/superadmin-layout.cc.js";
 export const metadata = defaultMetadata;
-export default withSuperadminAreaMessages(SuperadminLayout);
+function ServerCheckedSuperadminLayout({ children }) {
+  return /* @__PURE__ */ jsx(SuperadminLayout, { serverChecked: true, children });
+}
+export default withSuperadminAreaMessages(ServerCheckedSuperadminLayout);

package/dist/routes/variants.json

@@ -39,7 +39,7 @@
         "wrapper": "withSuperadminAccess",
         "metadata": "withSuperadminMetadata",
         "handler": "withSuperadminRouteAccess",
-        "specifier": "@nextsparkjs/core/routes/_internal/area-access"
+        "specifier": "@nextsparkjs/core/routes/_internal/area-access.cc"
       }
     },
     {
@@ -54,7 +54,7 @@
         "wrapper": "withDevtoolsAccess",
         "metadata": "withDevtoolsMetadata",
         "handler": "withDevtoolsRouteAccess",
-        "specifier": "@nextsparkjs/core/routes/_internal/area-access"
+        "specifier": "@nextsparkjs/core/routes/_internal/area-access.cc"
       }
     },
     {
@@ -62,6 +62,16 @@
       "target": "dashboard/layout.tsx",
       "specifier": "@nextsparkjs/core/routes/dashboard/layout.cc"
     },
+    {
+      "kind": "layout",
+      "target": "dashboard/(main)/layout.tsx",
+      "specifier": "@nextsparkjs/core/routes/dashboard/(main)/layout.cc"
+    },
+    {
+      "kind": "page",
+      "target": "(public)/page.tsx",
+      "specifier": "@nextsparkjs/core/routes/(public)/page.cc"
+    },
     {
       "kind": "page",
       "target": "(auth)/login/page.tsx",

package/dist/templates/ci-workflows/github/cypress-regression.yml

@@ -66,7 +66,7 @@ jobs:
       - name: Seed test data
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
-        run: pnpm db:seed || echo "No seed script found, skipping..."
+        run: pnpm db:seed
 
       - name: Build application
         run: pnpm build

package/dist/templates/ci-workflows/github/cypress-smoke.yml

@@ -59,7 +59,8 @@ jobs:
       - name: Setup database
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
-        run: pnpm db:migrate
+        # a throwaway test database: migrations plus the sample users the tests sign in as
+        run: pnpm db:seed
 
       - name: Build application
         run: pnpm build

package/dist/templates/next.config.mjs

@@ -260,35 +260,8 @@ const nextConfig = {
         source: '/:path*',
         headers: securityHeaders
       },
-      // CORS headers for API routes
-      // NOTE: In development, CORS is handled dynamically by API routes using addCorsHeaders()
-      // to support multiple origins (web app, mobile app, etc.)
-      // In production, we set static CORS headers here
-      ...(isProduction ? [{
-        source: '/api/:path*',
-        headers: [
-          {
-            key: 'Access-Control-Allow-Origin',
-            value: process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-          },
-          {
-            key: 'Access-Control-Allow-Methods',
-            value: 'GET, POST, PUT, DELETE, OPTIONS, PATCH'
-          },
-          {
-            key: 'Access-Control-Allow-Headers',
-            value: 'Content-Type, Authorization, x-api-key, x-verify-from-ui, Cookie, Set-Cookie'
-          },
-          {
-            key: 'Access-Control-Allow-Credentials',
-            value: 'true'
-          },
-          {
-            key: 'Access-Control-Expose-Headers',
-            value: 'Set-Cookie'
-          }
-        ]
-      }] : [])
+      // No CORS headers here: core's API routes answer CORS per request (addCorsHeaders), so the
+      // origins in api.cors.allowedOrigins and CORS_ADDITIONAL_ORIGINS get their grant in production too
     ]
   },
 }

package/dist/templates/projects/blog/api/authors/[username]/route.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface Author {
   id: string
@@ -151,3 +152,5 @@ const getHandler = async (
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/dist/templates/projects/blog/api/authors/route.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface AuthorWithCount {
   id: string
@@ -64,3 +65,5 @@ const getHandler = async (request: NextRequest) => {
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/dist/templates/projects/blog/api/posts/public/route.ts

@@ -11,6 +11,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface Post {
   id: string
@@ -152,3 +153,5 @@ const getHandler = async (request: NextRequest) => {
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/dist/templates/projects/starter/README.md

@@ -21,6 +21,8 @@ cp .env.example .env.local
 
 # Run migrations
 pnpm db:migrate
+# Local development only: also load the sample users (DevKeyring, Cypress)
+pnpm db:seed
 
 # Start development
 pnpm dev

package/dist/templates/projects/starter/docs/public/01-overview/01-introduction.md

@@ -17,6 +17,8 @@ Welcome to the Starter theme for NextSpark. This minimal theme provides everythi
 3. Run migrations: `pnpm db:migrate`
 4. Start development: `pnpm dev`
 
+Sample users (DevKeyring, Cypress) are for local development only: `pnpm db:seed` loads them; `pnpm db:migrate` alone does not, and neither applies them when `NODE_ENV` is `production`.
+
 ## Project Structure
 
 ```

package/dist/templates/projects/starter/templates/dashboard/analytics/layout.tsx

@@ -0,0 +1,14 @@
+import { NextIntlClientProvider } from 'next-intl'
+import { getMessages } from 'next-intl/server'
+import { selectMessages } from '@nextsparkjs/core/lib/i18n/client-messages'
+
+// TasksChart and RecentActivity are client components that read the `analytics`
+// namespace, which the dashboard group does not carry to the browser by default.
+export default async function AnalyticsLayout({ children }: { children: React.ReactNode }) {
+  const messages = await getMessages()
+  return (
+    <NextIntlClientProvider messages={selectMessages(messages, 'dashboard', ['analytics'])}>
+      {children}
+    </NextIntlClientProvider>
+  )
+}

package/dist/templates/proxy.ts

@@ -20,8 +20,8 @@
  * themselves and use only x-pathname from here, as a routing hint; the
  * identity headers are still stripped and re-set for project code.
  */
-import { betterFetch } from '@better-fetch/fetch'
 import { NextRequest, NextResponse } from 'next/server'
+import { auth } from '@nextsparkjs/core/lib/auth'
 import {
   hasProjectMiddleware,
   executeProjectMiddleware,
@@ -181,14 +181,22 @@ function redirectAccessDenied(request: NextRequest): NextResponse {
 }
 
 /**
- * The session the request's cookies carry, asked of this app's own auth route,
- * which is served under the base path like every other route.
+ * The session the request's cookies carry, read in this process the way core's
+ * server code reads it. Asking the app's own /api/auth/get-session over HTTP
+ * built the URL from the request's origin, which behind a proxy that
+ * terminates TLS (X-Forwarded-Proto: https) is https on a port that speaks
+ * plain HTTP: the fetch failed and every signed-in user was sent to /login.
+ * Nothing here leaves the process, so no forwarded scheme or host can point
+ * the check anywhere. `disableRefresh`: this response cannot carry the renewed
+ * session cookie, so the rolling renewal is left to the auth route
+ * (lib/auth/session-refresh).
  */
-function getSession(request: NextRequest) {
-  return betterFetch<Session>('/api/auth/get-session', {
-    baseURL: `${request.nextUrl.origin}${request.nextUrl.basePath}`,
-    headers: { cookie: request.headers.get('cookie') || '' },
+async function getSession(request: NextRequest): Promise<Session | null> {
+  const session = await auth.api.getSession({
+    headers: new Headers({ cookie: request.headers.get('cookie') || '' }),
+    query: { disableRefresh: true },
   })
+  return session as Session | null
 }
 
 /**
@@ -200,8 +208,19 @@ function getSession(request: NextRequest) {
  * session. Gating the strip on protected prefixes is not enough: Next.js
  * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
  * action can be POSTed to a public path with a forged `x-user-id`.
+ *
+ * The `x-api-*` names are never set here: core takes an API key's identity from
+ * validating the key, and nothing downstream may receive them from the client.
  */
-const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname', 'x-active-team-id'] as const
+const TRUSTED_IDENTITY_HEADERS = [
+  'x-user-id',
+  'x-user-email',
+  'x-pathname',
+  'x-active-team-id',
+  'x-api-user-id',
+  'x-api-key-id',
+  'x-api-scopes',
+] as const
 
 /**
  * Build the request headers forwarded to the app: inbound copy minus every
@@ -479,7 +498,6 @@ export async function proxy(request: NextRequest) {
   const verifiedSession = async (): Promise<Session | null> => {
     if (!sessionPromise) {
       sessionPromise = getSession(request)
-        .then(({ data }) => data)
         .catch(error => {
           sessionError = error
           return null

package/dist/templates/public/uploads/README.md

@@ -1,97 +1,8 @@
-# Media Upload System
+# Media uploads
 
-## Overview
-This application uses **Vercel Blob Storage** for all media uploads. Files are stored in the cloud, not on the local filesystem.
+`POST /api/v1/media/upload` stores files in **Vercel Blob** when `BLOB_READ_WRITE_TOKEN` is set. The media library lists the Blob URLs.
 
-> **Note:** This directory (`public/uploads/`) is legacy from a previous filesystem-based implementation and is no longer used.
+- **Development without a token:** files are written to `public/uploads/temp/` (git-ignored) so the library works offline.
+- **Production without a token:** the upload answers `503` with code `STORAGE_NOT_CONFIGURED`. Nothing is written to disk: a file under `public/` is not served until the next restart and does not survive a redeploy.
 
-## Upload Endpoint
-**POST** `/api/v1/media/upload`
-
-### Authentication
-Requires valid user session (Better Auth)
-
-### Request
-- **Content-Type**: `multipart/form-data`
-- **Field name**: `files` (accepts multiple files)
-
-### Supported File Types
-- Images: JPEG, PNG, GIF, WebP
-- Videos: MP4, MPEG, QuickTime, WebM
-
-### File Size Limit
-- Maximum: 10MB per file
-
-### Response
-```json
-{
-  "message": "Files uploaded successfully",
-  "urls": [
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_abc123.jpg",
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_def456.png"
-  ],
-  "count": 2
-}
-```
-
-## File Naming Convention
-Files are automatically renamed using the pattern:
-```
-{timestamp}_{randomString}.{extension}
-```
-
-Example: `1704067200000_k9x2m4p.jpg`
-
-## Storage Location
-- **Storage Provider**: Vercel Blob (cloud object storage)
-- **Blob Path**: `uploads/temp/{filename}` (organizational prefix, not a filesystem path)
-- **Public URL**: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/{filename}`
-
-### How It Works
-
-**Local Development:**
-- Files are uploaded directly to Vercel Blob using `BLOB_READ_WRITE_TOKEN` from `.env`
-- No files are saved to your local filesystem
-- URLs point to Vercel's CDN
-
-**Production/Staging:**
-- Same behavior - files go directly to Vercel Blob
-- Uses environment-specific Blob token
-- No filesystem writes (Vercel serverless is read-only)
-
-## Usage in AI Content Generation
-The generate-content endpoint (`/api/content-buddy/generate-content`) automatically processes images for AI analysis.
-
-**Supported URL formats:**
-- Vercel Blob URLs: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/image.jpg`
-- External URLs: `https://example.com/image.jpg` (also supported)
-
-## Configuration
-Requires `BLOB_READ_WRITE_TOKEN` environment variable:
-
-```env
-BLOB_READ_WRITE_TOKEN="vercel_blob_rw_..."
-```
-
-## Cleanup
-Files are managed through Vercel Blob's retention policies.
-
-**Manual cleanup** (if needed):
-```typescript
-import { del } from '@vercel/blob'
-
-// Delete specific file
-await del(fileUrl)
-
-// Or list and delete old files
-import { list } from '@vercel/blob'
-const { blobs } = await list({ prefix: 'uploads/temp/' })
-// Filter and delete as needed
-```
-
-## Security Notes
-- All uploads require authentication
-- File type validation prevents malicious uploads
-- File size limits prevent DoS attacks
-- Random filenames prevent enumeration attacks
-- Files stored in secure Vercel Blob infrastructure
+Self-hosting needs a storage provider: set `BLOB_READ_WRITE_TOKEN` (a Vercel Blob token, starts with `vercel_blob_`). See the media library docs.

package/migrations/029_sample_accounts_outside_development.sql

@@ -0,0 +1,55 @@
+-- Migration: 029_sample_accounts_outside_development.sql
+-- Description: sample accounts keep no usable credentials outside development
+--
+-- Sample data (090_sample_data.sql and the projects' *sample_data* files) is
+-- only applied by an explicit development opt-in (`nextspark db:seed`,
+-- `--sample-data` or NEXTSPARK_SEED_SAMPLE_DATA=1). Databases migrated before
+-- that may still hold the sample accounts. This migration finds them by the
+-- sample password, never by name, so a renamed account is found and an account
+-- whose password was changed is left alone; for each one it:
+--   - removes the sample password (its "credential" account row),
+--   - removes its sessions,
+--   - deactivates its API keys (status 'inactive'; deleting them would delete
+--     their api_audit_log rows),
+--   - sets its global role to 'member' (027's trigger then removes it from the
+--     System Admin Team, as for any user who loses that role).
+-- It also removes the sample sessions and deactivates the sample API key by
+-- their fixed values, whoever owns them now. Nothing else is changed.
+--
+-- It runs once, everywhere, except in a development run that opted into sample
+-- data (the runner sets nextspark.seed_sample_data to 'on' then), where those
+-- accounts are wanted. To keep using one of them deliberately, give it a new
+-- password before upgrading; to restore one afterwards, set its role back and
+-- reset its password.
+
+DO $$
+DECLARE
+  sample_passwords CONSTANT TEXT[] := ARRAY[
+    '22de14d5472248ed0bece911df908b2a:d29576424798ba6845d348a3767c0b0f38a00f2aca461b3b1d34b99a93cab06c86774c6edb183e6d6ec47457649b032a49a7b60a48f6f4f7fbbc4ea40258f19f',
+    '3db9e98e2b4d3caca97fdf2783791cbc:34b293de615caf277a237773208858e960ea8aa10f1f5c5c309b632f192cac34d52ceafbd338385616f4929e4b1b6c055b67429c6722ffdb80b01d9bf4764866'
+  ];
+  sample_session_tokens CONSTANT TEXT[] := ARRAY['tmt_superadmin_session_token_001', 'tmt_developer_session_token_001'];
+  sample_key_hashes CONSTANT TEXT[] := ARRAY[
+    '205f13ae4d2e18df417e61123bb84030c124fcb5013699046379ae1b5ec04324',
+    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+  ];
+  sample_users TEXT[];
+BEGIN
+  IF current_setting('nextspark.seed_sample_data', true) = 'on' THEN
+    RAISE NOTICE 'Sample accounts: kept (development run with sample data).';
+    RETURN;
+  END IF;
+
+  SELECT COALESCE(array_agg(DISTINCT "userId"), '{}') INTO sample_users
+  FROM "account"
+  WHERE "providerId" = 'credential' AND "password" = ANY (sample_passwords);
+
+  DELETE FROM "account" WHERE "providerId" = 'credential' AND "password" = ANY (sample_passwords);
+  DELETE FROM "session" WHERE "userId" = ANY (sample_users) OR token = ANY (sample_session_tokens);
+  UPDATE "api_key" SET status = 'inactive', "updatedAt" = now()
+  WHERE status IS DISTINCT FROM 'inactive' AND ("userId" = ANY (sample_users) OR "keyHash" = ANY (sample_key_hashes));
+  UPDATE "users" SET role = 'member', "updatedAt" = now()
+  WHERE id = ANY (sample_users) AND role <> 'member';
+
+  RAISE NOTICE 'Sample accounts: % disabled (no password, sessions or active API keys; role member).', cardinality(sample_users);
+END $$;

package/migrations/090_sample_data.sql

@@ -7,6 +7,16 @@
 -- Theme-specific demo data (TMT.dev users, companies, invoices) is in:
 -- migrations/090_demo_users_teams.sql
 
+-- Only a development run that asked for sample data applies this file (see
+-- scripts/db/sample-data.mjs); anything else that runs it, such as a tool that
+-- applies every core .sql file in order, fails here instead of creating these accounts.
+DO $$
+BEGIN
+  IF current_setting('nextspark.seed_sample_data', true) IS DISTINCT FROM 'on' THEN
+    RAISE EXCEPTION 'Sample data is applied only by `pnpm db:seed` (or NEXTSPARK_SEED_SAMPLE_DATA=1) outside production. If you ran that, the session setting it relies on was lost: a transaction-mode pooler (PgBouncer, Supavisor on port 6543) drops it, so point MIGRATE_DATABASE_URL at a direct connection.';
+  END IF;
+END $$;
+
 -- ============================================
 -- STEP 1: CREATE CORE TEST USERS
 -- ============================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.194",
+  "version": "0.1.0-beta.196",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -496,7 +496,7 @@
     "use-intl": "^4.9.1",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@nextsparkjs/ui": "0.1.0-beta.194"
+    "@nextsparkjs/ui": "0.1.0-beta.196"
   },
   "engines": {
     "node": ">=22.14.0"

package/scripts/build/registry/__tests__/api-docs-colocated.test.mjs

@@ -15,6 +15,9 @@ import test from 'node:test'
 import { discoverApiPresets } from '../discovery/api-presets.mjs'
 import { discoverRouteFiles } from '../discovery/plugins.mjs'
 import { generateRouteHandlersRegistry } from '../generators/route-handlers.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const presets = endpoint => `export default defineApiEndpoint({\n  endpoint: '${endpoint}',\n  summary: 'S',\n  presets: [{ id: 'a', title: 'A', method: 'GET' }]\n})\n`