@nextsparkjs/core 0.1.0-beta.194 → 0.1.0-beta.196

package/scripts/build/registry/__tests__/billing-registry.test.mjs

@@ -8,12 +8,15 @@
 
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, readdir, rm } from 'node:fs/promises'
+import { mkdir, mkdtemp, readdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { generateBillingRegistry } from '../generators/billing-registry.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..', '..', '..')
 
@@ -45,3 +48,49 @@ test("generateBillingRegistry's jiti import writes nothing under TMPDIR, even wh
     await cacheRoot.cleanup()
   }
 })
+
+// #212: a billing config that exists but cannot load must fail the build, never become an empty registry
+async function projectWith(billingSource) {
+  const dir = await directory('nextspark-billing-registry-cases-')
+  if (billingSource !== undefined) {
+    await mkdir(join(dir.root, 'config'), { recursive: true })
+    await writeFile(join(dir.root, 'config/billing.config.ts'), billingSource)
+  }
+  return { ...dir, config: { projectRoot: dir.root, projectSourceDir: dir.root, projectName: 'cases', outputDir: join(dir.root, 'out') } }
+}
+
+test('no billing config: the empty registry, the build keeps going', async () => {
+  const project = await projectWith(undefined)
+  try {
+    assert.match(await generateBillingRegistry(project.config), /No billing config found - empty registry generated/)
+  } finally { await project.cleanup() }
+})
+
+test('a valid billing config is read into the registry', async () => {
+  const project = await projectWith(`export const billingConfig = { provider: 'stripe', currency: 'usd', defaultPlan: 'free', features: { api: {} }, limits: { seats: {} }, plans: [{ slug: 'free', visibility: 'public', features: ['api'], limits: { seats: 3 } }] }\n`)
+  try {
+    const output = await generateBillingRegistry(project.config)
+    assert.match(output, /"totalPlans": 1/)
+    assert.match(output, /"seats": \{\s+"free": 3/)
+  } finally { await project.cleanup() }
+})
+
+test('a billing config that throws fails with its file name and the underlying error', async () => {
+  const project = await projectWith(`throw new Error('stripe price id is missing')\n`)
+  try {
+    await assert.rejects(generateBillingRegistry(project.config), (error) => {
+      assert.ok(error.message.includes(join(project.root, 'config/billing.config.ts')), error.message)
+      assert.ok(error.message.includes('stripe price id is missing'), error.message)
+      return true
+    })
+  } finally { await project.cleanup() }
+})
+
+test('a billing config with a syntax error or without a billingConfig export also fails', async () => {
+  for (const source of ['export const billingConfig = {', 'export const other = 1\n']) {
+    const project = await projectWith(source)
+    try {
+      await assert.rejects(generateBillingRegistry(project.config), /billing\.config\.ts/)
+    } finally { await project.cleanup() }
+  }
+})

package/scripts/build/registry/__tests__/block-registry.test.mjs

@@ -25,6 +25,9 @@ import {
 import { readSchemaExport, thumbnailImport } from '../discovery/blocks.mjs'
 import { validateGeneratedModule } from '../host/static-imports.mjs'
 import { loadTypeScriptFor } from '../shared/typescript-compiler.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 function block(slug, category) {
   const base = `@/blocks/${slug}`

package/scripts/build/registry/__tests__/icons-discovery.test.mjs

@@ -24,6 +24,9 @@ import {
   isTestFilePath,
   extractLiteralIconCallNames
 } from '../discovery/icons.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 test('discovers core entity icons through the resolution owner coreDir', async () => {
   const root = await mkdtemp(join(tmpdir(), 'nextspark-icons-core-dir-'))

package/scripts/build/registry/__tests__/quiet-console.mjs

@@ -0,0 +1,17 @@
+import { after, before, mock } from 'node:test'
+
+/**
+ * Keeps a test file's in-process console.log/info output off the test child's stdout. The Node test runner
+ * reads that stdout for its own frames, and non-ASCII text on it (the build log's emoji) can make it fail with
+ * "Unable to deserialize cloned data" (nodejs/node#64061, fixed on 24+ only; #65934 for 22).
+ * Call once at the top of a file; a test that needs to read the output replaces console.log itself.
+ */
+export function silenceConsoleOutput() {
+  before(() => {
+    mock.method(console, 'log', () => {})
+    mock.method(console, 'info', () => {})
+  })
+  after(() => {
+    mock.restoreAll()
+  })
+}

package/scripts/build/registry/__tests__/safe-fs.test.mjs

@@ -23,6 +23,9 @@ import { fileURLToPath } from 'node:url'
 import { COPY_BLOCK_SIZE, isUnsafeWrite, projectFiles, UNSAFE_WRITE, unsafeWriteProblem } from '../../safe-fs.mjs'
 import { generateTestBlocksJson, generateTestEntitiesJson } from '../post-build/test-fixtures.mjs'
 import { directFsWrites, directFsWritesIn, generatorFiles } from './direct-fs-writes.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 const CORE_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..')
 const RUNS_AS_ROOT = process.getuid?.() === 0

package/scripts/build/registry/__tests__/team-roles.test.mjs

@@ -18,6 +18,9 @@ import assert from 'node:assert/strict'
 
 import { computeTeamRoleConfig, generatePermissionsRegistry } from '../generators/permissions-registry.mjs'
 import { parseTeamRolesFromAppConfig } from '../discovery/permissions.mjs'
+import { silenceConsoleOutput } from './quiet-console.mjs'
+
+silenceConsoleOutput()
 
 // ---------------------------------------------------------------------------
 // computeTeamRoleConfig — the pure build-time computation

package/scripts/build/registry/discovery/permissions.test.mjs

@@ -6,6 +6,9 @@
 
 import { describe, it } from 'node:test'
 import assert from 'node:assert'
+import { silenceConsoleOutput } from '../__tests__/quiet-console.mjs'
+
+silenceConsoleOutput()
 
 // Import the regex pattern directly since parseEntitiesFromConfig is not exported
 // We'll test the regex patterns directly

package/scripts/build/registry/discovery/plugin-capabilities.mjs

@@ -329,11 +329,11 @@ const BUILTINS = new Set(builtinModules.filter(name => !name.startsWith('_')))
 /** Bare specifiers that only run on a server (`next/server` is Next's request/response and `after`/`connection` APIs). */
 const SERVER_ONLY_PACKAGES = new Set(['server-only', 'next/headers', 'next/server', 'pg', 'postgres', 'ioredis', 'nodemailer'])
 /**
- * The `lib/api` modules core's own 'use client' files import (the entity fetch helpers, `ApiError`, the scope catalog):
+ * The `lib/api` modules core's own 'use client' files import (the entity fetch helpers, `ApiError`, the scope catalog, the client request header names):
  * they import no server module, so they are client-safe. Everything else under `lib/api` is server-only. A guard test
  * checks that every `lib/api` module a core 'use client' file imports is in this list.
  */
-export const CLIENT_SAFE_CORE_API = ['entities', 'api-error', 'keys']
+export const CLIENT_SAFE_CORE_API = ['entities', 'api-error', 'keys', 'client-headers']
 /** Core modules known to be server-only; the ones that import a marker above are also found by following the import. */
 const SERVER_ONLY_CORE = [
   /^@nextsparkjs\/core\/lib\/db(\/|$)/,

package/scripts/build/registry/generators/billing-registry.mjs

@@ -119,10 +119,14 @@ export async function generateBillingRegistry(configOrName, _legacyContentsDir,
     // Use jiti to import .ts files at build time (Node.js can't import .ts natively)
     const jiti = createJiti(import.meta.url, { interopDefault: true, fsCache: false })
     const module = await jiti.import(absolutePath)
-    billingConfig = module.billingConfig || module.default
+    billingConfig = module.billingConfig
   } catch (error) {
-    log(`Failed to import billing config from ${absolutePath}: ${error.message}`, 'error')
-    return generateEmptyBillingRegistry(config)
+    // A config that exists but cannot load must stop the build: an empty registry has no plans,
+    // and a project without plans skips every feature and quota check.
+    throw new Error(`Failed to load billing config ${absolutePath}: ${error.message}`, { cause: error })
+  }
+  if (!billingConfig || !Array.isArray(billingConfig.plans) || !billingConfig.features || !billingConfig.limits) {
+    throw new Error(`Billing config ${absolutePath} must export \`billingConfig\` with plans, features and limits`)
   }
 
   // Pre-compute everything at build time

package/scripts/build/registry/host/README.md

@@ -217,7 +217,8 @@ spread and no expression. A host with another core (the conformance fixture) pas
   `_internal/default-{auth,public}-layout`).
 - **Role-gated areas** `/superadmin`, `/devtools`: every page, layout, template and default served under the area's URL (core's,
   a plugin's or the project's, in any route group) is composed with `withSuperadminAccess` / `withDevtoolsAccess`
-  (`routes/_internal/area-access`), which checks the session's role on the server before the segment renders, and its
+  (`routes/_internal/area-access`; `area-access.cc` in a Cache Components host, the same check inside the segment's own Suspense
+  boundary), which checks the session's role on the server before the segment renders, and its
   `generateMetadata` with `withSuperadminMetadata` / `withDevtoolsMetadata` (metadata resolves apart too); a Route Handler's
   methods but `OPTIONS` with `withSuperadminRouteAccess` / `withDevtoolsRouteAccess` (401 / 403 JSON; `OPTIONS` is forwarded
   unchecked, so it must not return data). An intercepting route
@@ -293,4 +294,27 @@ cookies or headers below no other boundary). The public item routes omit `revali
 mode only imports `_internal/public-item-route.cc`, whose reads of the published item and of the patterns it references are `'use cache'`
 functions (`cacheLife` of an hour for an item, tags `entity:<slug>` and `public-item:<slug>:<item slug>`).
 
+**Instant navigation (dev server).** On a Cache Components host `next dev` runs Next.js's instant-navigation check on every page it
+serves: it renders the route as a navigation into each segment and logs `Could not validate that a segment in your UI has instant
+navigation` (a segment the server render never reached), `... uncached data during prerendering or a navigation` or `... runtime data
+(`cookies()`, `headers()`, `params`, `searchParams`) accessed outside of <Suspense>`, and the dev badge shows an issue. The pages work; the check is
+about what a navigation would wait for. What it found in the starter, and the fix, are in core, so no project file changes:
+- The dashboard's client auth gate (`AuthenticatedDashboardLayout`) rendered a skeleton instead of `children` while the session loaded, so the
+  route's own segments were never rendered on the server ("dropped"). It renders the page while the session loads and keeps the signed-in side effects for
+  a known user.
+- `dashboard/(main)/layout.cc` (one more `layout.cc.tsx` variant, for a layout whose permission check reads the request) renders the shell at once and runs the permission check (session and database) in a
+  Suspense boundary around the page; the ISR layout still checks before rendering anything, so a denied request keeps its real redirect.
+- The pages that await `params` (the public item routes `public-item-route.cc`, the dashboard detail and edit routes `entity-detail-route.cc` /
+  `entity-edit-route.cc`, written for a host with `cacheComponents` on and nothing else) sit behind a boundary of their own
+  (`_internal/suspended-route`); the `/signup` variant and core's default home (`(public)/page.cc`) render the page that redirects behind one too, and the public archive and the permission-denied
+  page read `searchParams` behind one. The status a visitor gets does not change: the layouts already streamed these pages after their shell.
+- A project without `public/favicon.ico` made the browser's own `GET /favicon.ico` hit the public `[slug]` page (an HTML "not found" with a 200);
+  new projects ship a favicon, and a request for a page that does not exist is now answered inside a boundary the check accepts.
+- `/superadmin` and `/devtools` (#213): their client guards hid the page from the server render until the session loaded, and each segment awaited
+  its role check outside Suspense. In a Cache Components host the area layouts (`superadmin/layout.cc`, `devtools/layout.cc` and the composed
+  override through `withSuperadminGuard` / `withDevtoolsGuard`) pass `serverChecked` to their guard, which they render only after the role
+  check, and every segment under an area is composed from `_internal/area-access.cc`: the same check, inside the segment's own Suspense boundary,
+  the segment rendered only once it has passed. The ISR host keeps `_internal/area-access` and its guards' loading state.
+Opting a segment out is `export const instant = false` in its source (a literal, as the facade rules require); nothing sets it today.
+
 Tests: `node --test packages/core/scripts/build/registry/host/__tests__/*.test.mjs`.

package/scripts/build/registry/host/__tests__/host-area-access.test.mjs

@@ -276,3 +276,35 @@ test('a metadata file under an area cannot be guarded: a warning notice names it
     w.cleanup()
   }
 })
+
+/**
+ * #213: with core's own manifest, a Cache Components host composes every page and layout under the areas with
+ * area-access.cc (the check inside the segment's own Suspense boundary), a legacy ISR host with area-access as before.
+ * The facades stay inside the facade grammar either way.
+ */
+test("core's manifest: area segments import their check from area-access.cc in a Cache Components host only", async () => {
+  const facades = async cacheComponents => {
+    const { routes } = await loadCoreRouteManifest({ coreRoot: CORE_ROOT, cacheComponents })
+    const planned = planHost({ coreRoutes: routes })
+    const result = await render(planned.routes)
+    assert.deepEqual(result.diagnostics, [])
+    return result
+  }
+  const INTERNAL = '@nextsparkjs/core/routes/_internal/'
+  for (const [cacheComponents, module] of [[true, 'area-access.cc'], [false, 'area-access']]) {
+    const result = await facades(cacheComponents)
+    for (const [target, wrapper] of [
+      ['superadmin/users/page.tsx', 'withSuperadminAccess'],
+      ['superadmin/docs/[section]/[page]/page.tsx', 'withSuperadminAccess'],
+      ['devtools/page.tsx', 'withDevtoolsAccess'],
+      ['devtools/api/layout.tsx', 'withDevtoolsAccess'],
+    ]) {
+      const content = contentOf(result, target)
+      assert.ok(content, target)
+      assert.ok(content.includes(`import { ${wrapper} } from "${INTERNAL}${module}"`), `${target} (cacheComponents ${cacheComponents}) imports ${wrapper} from ${module}:\n${content}`)
+      assert.deepEqual(validateGeneratedModule({ ts, source: content, file: `src/app/${target}`, grammar: 'composed-facade' }), [], target)
+    }
+    // A doc page's generateMetadata keeps area-access's check (re-exported by area-access.cc)
+    assert.match(contentOf(result, 'superadmin/docs/[section]/[page]/page.tsx'), new RegExp(`withSuperadminMetadata.*from "${INTERNAL}${module.replace('.', '\\.')}"`, 's'))
+  }
+})

package/scripts/build/registry/host/__tests__/host-entities.test.mjs

@@ -15,7 +15,7 @@ import { dirname, join } from 'node:path'
 import { ENTITY_DIAGNOSTICS, ENTITY_MODULES, entityConfigFile, planEntityRoutes, readAllEntityFacts, readEntityFacts, routableEntities } from '../entity-routes.mjs'
 import { PLAN_DIAGNOSTICS, PLAN_NOTICES, planHost, urlConflicts } from '../plan.mjs'
 import { renderHost } from '../render.mjs'
-import { validateGeneratedModule } from '../static-imports.mjs'
+import { CORE_COMPOSITION_WRAPPERS, validateGeneratedModule } from '../static-imports.mjs'
 import { loadTypeScriptFor } from '../../shared/typescript-compiler.mjs'
 
 const CORE_ROOT = join(import.meta.dirname, '../../../../..')
@@ -29,6 +29,8 @@ const CORE_MODULES = {
   [ENTITY_MODULES.detail]: ['core/entity-detail-route.tsx', factories('createEntityDetailRoute')],
   [ENTITY_MODULES.create]: ['core/entity-create-route.tsx', factories('createEntityCreateRoute')],
   [ENTITY_MODULES.edit]: ['core/entity-edit-route.tsx', factories('createEntityEditRoute')],
+  [ENTITY_MODULES.detailCc]: ['core/entity-detail-route.cc.tsx', factories('createEntityDetailRoute')],
+  [ENTITY_MODULES.editCc]: ['core/entity-edit-route.cc.tsx', factories('createEntityEditRoute')],
   [ENTITY_MODULES.publicItem]: ['core/public-item-route.tsx', factories('createPublicItemRoute', 'createPublicItemMetadata')],
   [ENTITY_MODULES.publicItemCc]: ['core/public-item-route.cc.tsx', factories('createPublicItemRoute', 'createPublicItemMetadata')],
   [ENTITY_MODULES.publicArchive]: ['core/public-archive-route.tsx', factories('createPublicArchiveRoute', 'createPublicArchiveMetadata')],
@@ -690,6 +692,35 @@ test('a host that builds in Cache Components mode only imports the cached item s
   }
 })
 
+test('a Cache Components host writes the detail and edit pages of an entity from the modules that put them behind Suspense (they await `params`)', async () => {
+  const w = world()
+  try {
+    const args = [w, [entity('tasks', 'taskEntityConfig')], { tasks: await factsOf("slug: 'tasks', enabled: true, ui: { dashboard: { showInMenu: true } }") }]
+    const moduleOf = async (target, factory, options) => at(await render((await plan(...args, options)).routes), target).match(new RegExp(`import \\{ ${factory} \\} from "([^"]+)"`))[1]
+    assert.equal(ENTITY_MODULES.detailCc, `${ENTITY_MODULES.detail}.cc`)
+    assert.equal(ENTITY_MODULES.editCc, `${ENTITY_MODULES.edit}.cc`)
+    const detail = options => moduleOf('dashboard/(main)/tasks/[id]/page.tsx', 'createEntityDetailRoute', options)
+    const edit = options => moduleOf('dashboard/(main)/tasks/[id]/edit/page.tsx', 'createEntityEditRoute', options)
+    assert.equal(await detail({ cacheComponents: true }), ENTITY_MODULES.detailCc)
+    assert.equal(await edit({ cacheComponents: true }), ENTITY_MODULES.editCc)
+    // An ISR host keeps the routes that redirect and answer notFound() before anything is sent; so does one that builds both, or does not know
+    for (const options of [{ cacheComponents: false }, {}, { cacheComponents: true, modes: ['isr', 'cc'] }]) {
+      assert.equal(await detail(options), ENTITY_MODULES.detail)
+      assert.equal(await edit(options), ENTITY_MODULES.edit)
+    }
+  } finally {
+    w.cleanup()
+  }
+})
+
+test('every factory module the entity routes import is a known composition module, with the factories it exports (a real host fails facade validation otherwise)', () => {
+  const FACTORY_MODULES = ['layout', 'list', 'detail', 'create', 'edit', 'detailCc', 'editCc', 'publicItem', 'publicItemCc', 'publicArchive']
+  for (const name of FACTORY_MODULES) {
+    const wrappers = CORE_COMPOSITION_WRAPPERS[ENTITY_MODULES[name]]
+    assert.ok(Array.isArray(wrappers) && wrappers.length > 0, `${name}: ${ENTITY_MODULES[name]} is missing from CORE_COMPOSITION_WRAPPERS`)
+  }
+})
+
 // ---------------------------------------------------------------------------
 // "The template replaces": project templates at an entity's dashboard URL in another route group
 // ---------------------------------------------------------------------------

package/scripts/build/registry/host/__tests__/host-plan.test.mjs

@@ -53,6 +53,16 @@ test('core < plugin < project: a higher layer replaces a lower one at the same r
   }
 })
 
+test('a project robots.ts replaces the robots route core ships (#214)', () => {
+  const { root, cleanup } = project({ 'templates/robots.ts': 'export default function robots() { return { rules: { userAgent: "*", disallow: "/" } } }\n' })
+  try {
+    const routes = resolveHostPlan({ coreRoutes: [core('robots.ts', 'robots')], plugins: [], project: { root } })
+    assert.deepEqual(summary(routes), ['robots.ts <- project:@/templates/robots (overrides core route @nextsparkjs/core/routes/robots)'])
+  } finally {
+    cleanup()
+  }
+})
+
 test('the extension does not decide the slot: templates/about/page.ts replaces core about/page.tsx', () => {
   const { root, cleanup } = project({ 'templates/about/page.ts': PAGE })
   try {
@@ -330,8 +340,8 @@ test('core\'s routes carry their protection level, so a composed layout can be t
   assert.equal(withCc.routes.find(route => route.target === 'layout.tsx').compose.specifier, '@nextsparkjs/core/routes/_internal/root-layout.ppr')
   assert.equal(withCc.routes.find(route => route.target === '(auth)/login/page.tsx').specifier, '@nextsparkjs/core/routes/(auth)/login/page.cc')
   assert.deepEqual(withCc.variantsApplied.sort(), [
-    '(auth)/layout.tsx', '(auth)/login/page.tsx', '(auth)/signup/page.tsx', '(public)/docs/[section]/[page]/page.tsx', '(public)/layout.tsx',
-    'dashboard/layout.tsx', 'devtools/layout.tsx', 'layout.tsx', 'superadmin/docs/[section]/[page]/page.tsx', 'superadmin/layout.tsx',
+    '(auth)/layout.tsx', '(auth)/login/page.tsx', '(auth)/signup/page.tsx', '(public)/docs/[section]/[page]/page.tsx', '(public)/layout.tsx', '(public)/page.tsx',
+    'dashboard/(main)/layout.tsx', 'dashboard/layout.tsx', 'devtools/layout.tsx', 'layout.tsx', 'superadmin/docs/[section]/[page]/page.tsx', 'superadmin/layout.tsx',
   ])
   // The layouts that load messages keep their wrapper (from the Cache Components module) and their protection level
   const ccLevel = target => withCc.routes.find(route => route.target === target)

package/scripts/build/registry/host/__tests__/host-proxy-areas.test.mjs

@@ -12,7 +12,7 @@ import { mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
-import { PROXY_AREA_WARNING, missingProxyAreas, proxyAreaNotice, proxyAreaNotices } from '../proxy-areas.mjs'
+import { PROXY_AREA_WARNING, PROXY_SESSION_WARNING, missingProxyAreas, withoutComments, proxyAreaNotice, proxyAreaNotices, proxySessionNotice } from '../proxy-areas.mjs'
 import { predictHost } from '../prepare.mjs'
 import { PAGE, tempHost, write } from './host-helpers.mjs'
 
@@ -30,6 +30,20 @@ test('an area counts only when the proxy names its path; a look-alike prefix or
   assert.deepEqual(missingProxyAreas("const docs = '/superadmin-guide'; const tips = \"/devtools-tips\"").map(area => area.path), ['/superadmin', '/devtools'])
 })
 
+test("a proxy that re-exports core's template has the check; a re-export of anything else does not", () => {
+  assert.deepEqual(missingProxyAreas("export { proxy } from '../../../packages/core/templates/proxy'\nexport const config = { matcher: [] }"), [])
+  assert.deepEqual(missingProxyAreas("export { proxy } from '@nextsparkjs/core/templates/proxy'"), [])
+  assert.deepEqual(missingProxyAreas("export { proxy } from './my-proxy'").map(area => area.path), ['/superadmin', '/devtools'])
+  assert.deepEqual(missingProxyAreas("export { other } from '@nextsparkjs/core/templates/proxy'").map(area => area.path), ['/superadmin', '/devtools'])
+  const both = ['/superadmin', '/devtools']
+  assert.deepEqual(missingProxyAreas("export { proxy as coreProxy } from '@nextsparkjs/core/templates/proxy'\nexport function proxy() {}").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("export { other as proxy } from '@nextsparkjs/core/templates/proxy'").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("export { proxy } from './vendor/core/templates/proxy'").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("// export { proxy } from '@nextsparkjs/core/templates/proxy'\nexport function proxy() {}").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("/*\nexport { proxy } from '@nextsparkjs/core/templates/proxy'\n*/\nexport function proxy() {}").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("export { config, proxy } from '@nextsparkjs/core/templates/proxy.ts'"), [])
+})
+
 test('the warning names the file, each missing area, its roles and where the check comes from', () => {
   const notice = proxyAreaNotice('src/proxy.ts', "const PROTECTED = ['/superadmin']")
   assert.equal(notice.code, PROXY_AREA_WARNING)
@@ -53,6 +67,63 @@ test('the proxy Next loads is the one checked; a project without one is not warn
   }
 })
 
+// S80 (D1): the session check that fetched /api/auth/get-session from the request's origin, as every proxy.ts copied
+// before 0.1.0-beta.196 does. Upgrading core never touches that copy, so prepare says what to change.
+const HTTP_SESSION_CHECK = `function getSession(request: NextRequest) {
+  return betterFetch<Session>('/api/auth/get-session', {
+    baseURL: \`\${request.nextUrl.origin}\${request.nextUrl.basePath}\`,
+    headers: { cookie: request.headers.get('cookie') || '' },
+  })
+}
+const PROTECTED = ['/superadmin', '/devtools']
+`
+
+test('a proxy that asks its own /api/auth/get-session over HTTP is warned about, with the in-process call to use', () => {
+  const notice = proxySessionNotice('src/proxy.ts', HTTP_SESSION_CHECK)
+  assert.equal(notice.code, PROXY_SESSION_WARNING)
+  assert.match(notice.message, /^src\/proxy\.ts checks the session by fetching \/api\/auth\/get-session/)
+  assert.match(notice.message, /X-Forwarded-Proto: https/)
+  assert.match(notice.message, /auth\.api\.getSession\(\{ headers: new Headers\(\{ cookie: request\.headers\.get\('cookie'\) \|\| '' \}\), query: \{ disableRefresh: true \} \}\)/)
+  assert.equal(proxySessionNotice('src/proxy.ts', readFileSync(join(CORE_ROOT, 'templates/proxy.ts'), 'utf8')), null)
+  assert.equal(proxySessionNotice('src/proxy.ts', "// was: betterFetch('/api/auth/get-session')\nexport function proxy() {}"), null)
+  assert.equal(proxySessionNotice('src/proxy.ts', "export { proxy } from '@nextsparkjs/core/templates/proxy'"), null)
+})
+
+// The S80 review's measured edges: an end-of-line comment, and a '/*' / '*/' pair inside two string literals.
+const COMMENT_EDGES = [
+  ['an end-of-line comment after code', "const x = 1 // was '/api/auth/get-session'\nexport function proxy() {}", false],
+  ['an end-of-line comment after code, no space', "const x = 1// was '/api/auth/get-session'", false],
+  ["a '/*' and a '*/' in two strings around the call", "const a = '/api/*'\nbetterFetch('/api/auth/get-session')\nconst b = 'x*/'", true],
+  ["a '//' inside a string before the call", "const u = 'https://example.com'; betterFetch('/api/auth/get-session')", true],
+  ['a block comment', "/* betterFetch('/api/auth/get-session') */ export function proxy() {}", false],
+  ['a quote escaped inside a string', "const q = 'it\\'s'; betterFetch('/api/auth/get-session')", true],
+]
+
+test('comments are stripped wherever they start, and never inside a string literal', () => {
+  for (const [label, source, warns] of COMMENT_EDGES) {
+    assert.equal(proxySessionNotice('src/proxy.ts', source) !== null, warns, label)
+  }
+  assert.equal(withoutComments("a // b\nc"), 'a \nc')
+  assert.equal(withoutComments("'//' /* x */ \"/*\""), "'//'   \"/*\"")
+  // The repository template, old and new, reads the same with comments gone: every regex literal in it survives.
+  const template = readFileSync(join(CORE_ROOT, 'templates/proxy.ts'), 'utf8')
+  assert.match(withoutComments(template), /\.replace\(\/\\\\\/g, '\/'\)\.replace\(\/\\\/\\\/\+\/g, '\/'\)/)
+})
+
+test("the proxy Next loads gets the session warning next to the areas one; core's template gets neither", () => {
+  const root = mkdtempSync(join(tmpdir(), 'nextspark-proxy-session-'))
+  try {
+    write(root, 'src/proxy.ts', HTTP_SESSION_CHECK)
+    assert.deepEqual(proxyAreaNotices(root).map(notice => notice.code), [PROXY_SESSION_WARNING])
+    write(root, 'src/proxy.ts', `${HTTP_SESSION_CHECK.replace("['/superadmin', '/devtools']", '[]')}`)
+    assert.deepEqual(proxyAreaNotices(root).map(notice => notice.code), [PROXY_AREA_WARNING, PROXY_SESSION_WARNING])
+    write(root, 'src/proxy.ts', readFileSync(join(CORE_ROOT, 'templates/proxy.ts'), 'utf8'))
+    assert.deepEqual(proxyAreaNotices(root), [])
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
 test("prepare's prediction carries the warning among its notices", async () => {
   const host = tempHost({ 'templates/about/page.tsx': PAGE('About') })
   const project = mkdtempSync(join(tmpdir(), 'nextspark-proxy-areas-project-'))

package/scripts/build/registry/host/entity-routes.mjs

@@ -54,6 +54,9 @@ export const ENTITY_MODULES = Object.freeze({
   detail: `${CORE_ROUTES_SPECIFIER}_internal/entity-detail-route`,
   create: `${CORE_ROUTES_SPECIFIER}_internal/entity-create-route`,
   edit: `${CORE_ROUTES_SPECIFIER}_internal/entity-edit-route`,
+  // The detail and edit pages of a host with `cacheComponents` on: the same routes behind a Suspense boundary (they await `params`).
+  detailCc: `${CORE_ROUTES_SPECIFIER}_internal/entity-detail-route.cc`,
+  editCc: `${CORE_ROUTES_SPECIFIER}_internal/entity-edit-route.cc`,
   publicItem: `${CORE_ROUTES_SPECIFIER}_internal/public-item-route`,
   // The item pages of a host with `cacheComponents` on: same factories, `'use cache'` reads instead of `revalidate`.
   publicItemCc: `${CORE_ROUTES_SPECIFIER}_internal/public-item-route.cc`,
@@ -207,7 +210,10 @@ export function planEntityRoutes({ entities, facts, coreRoutes, resolveFile, cac
   const revalidates = cacheComponents !== true && !modes.includes('cc')
   // A host that builds in Cache Components mode only gets the cached item source; one that builds both (the
   // conformance fixture) or does not know keeps the module that works in either.
-  const publicItemModule = cacheComponents === true && modes.length === 0 && modules.publicItemCc ? modules.publicItemCc : modules.publicItem
+  const ccOnly = cacheComponents === true && modes.length === 0
+  const publicItemModule = ccOnly && modules.publicItemCc ? modules.publicItemCc : modules.publicItem
+  const detailModule = ccOnly && modules.detailCc ? modules.detailCc : modules.detail
+  const editModule = ccOnly && modules.editCc ? modules.editCc : modules.edit
 
   const coreFacade = (kind, target, specifier) => ({
     kind,
@@ -275,8 +281,8 @@ export function planEntityRoutes({ entities, facts, coreRoutes, resolveFile, cac
         coreFacade('loading', `${base}/loading.tsx`, modules.loading),
         composed('page', `${base}/page.tsx`, 'createEntityListRoute', modules.list, [config, arg.template()], { acceptsTemplate: true, reexport: [{ names: ['metadata'], specifier: modules.listMetadata }] }),
         composed('page', `${base}/create/page.tsx`, 'createEntityCreateRoute', modules.create, [config, arg.template()], { acceptsTemplate: true }),
-        composed('page', `${base}/[id]/page.tsx`, 'createEntityDetailRoute', modules.detail, [config, arg.literal(children), arg.template()], { acceptsTemplate: true, reexport: [{ names: ['metadata'], specifier: modules.detailMetadata }] }),
-        composed('page', `${base}/[id]/edit/page.tsx`, 'createEntityEditRoute', modules.edit, [config, arg.template()], { acceptsTemplate: true })
+        composed('page', `${base}/[id]/page.tsx`, 'createEntityDetailRoute', detailModule, [config, arg.literal(children), arg.template()], { acceptsTemplate: true, reexport: [{ names: ['metadata'], specifier: modules.detailMetadata }] }),
+        composed('page', `${base}/[id]/edit/page.tsx`, 'createEntityEditRoute', editModule, [config, arg.template()], { acceptsTemplate: true })
       )
     }
 

package/scripts/build/registry/host/proxy-areas.mjs

@@ -7,6 +7,10 @@
  * before the template gained the check, or written by hand, may not have it: `nextspark prepare` (and `migrate`, in
  * the CLI) warn, naming each area the proxy never mentions.
  *
+ * Same for the session check (S80): a proxy copied before 0.1.0-beta.196 fetches its own /api/auth/get-session from
+ * the request's origin, which behind a proxy that terminates TLS is https on a plain-HTTP port, so every signed-in
+ * user is sent to /login. That copy is never updated by an upgrade, so prepare and migrate say what to change.
+ *
  * @module core/scripts/build/registry/host/proxy-areas
  */
 
@@ -24,8 +28,45 @@ export const PROTECTED_AREAS = Object.freeze([
 /** Where Next loads a project's proxy from, next to the generated src/app. */
 export const PROXY_FILES = Object.freeze(['src/proxy.ts', 'src/proxy.js', 'src/middleware.ts', 'src/middleware.js'])
 
+/**
+ * A proxy that re-exports core's template under its own name (apps/dev does) has the check without naming the areas
+ * itself. Exact name (`proxy as x` is not the proxy Next loads), a concrete specifier (the package, or the repository's
+ * packages/core), and only code: a commented-out line does not count.
+ */
+const REEXPORTS_CORE_PROXY =
+  /^\s*export\s*\{\s*(?:[\w$]+\s*,\s*)*proxy\s*(?:,[^}]*)?\}\s*from\s*['"](?:@nextsparkjs\/core|(?:\.\.\/)+packages\/core)\/templates\/proxy(?:\.ts)?['"]/m
+/**
+ * The source without its comments (`//` to the end of the line, wherever it starts, and block comments). String
+ * literals are kept whole, so a `/*` or `//` inside one is text. Not parsed: regular-expression literals (a quote in
+ * one can hide the code after it) and template-literal `${}` nesting; nor does the session detector follow a URL
+ * assembled from parts. No template that copied the HTTP session check needs either.
+ */
+export function withoutComments(source) {
+  let out = ''
+  let quote = null
+  for (let i = 0; i < source.length; i++) {
+    const c = source[i]
+    if (quote) {
+      out += c
+      if (c === '\\') out += source[++i] ?? ''
+      else if (c === quote) quote = null
+    } else if (c === '/' && source[i + 1] === '/') {
+      while (i + 1 < source.length && source[i + 1] !== '\n') i++
+    } else if (c === '/' && source[i + 1] === '*') {
+      const end = source.indexOf('*/', i + 2)
+      i = end < 0 ? source.length : end + 1
+      out += ' '
+    } else {
+      if (c === "'" || c === '"' || c === '`') quote = c
+      out += c
+    }
+  }
+  return out
+}
+
 /** The protected areas a proxy's source never names as a path (`'/superadmin'`, `"/devtools"`, `` `/devtools` ``). */
 export function missingProxyAreas(source) {
+  if (REEXPORTS_CORE_PROXY.test(withoutComments(source))) return []
   return PROTECTED_AREAS.filter(area => !new RegExp(`['"\`]${area.path}(?![\\w-])`).test(source))
 }
 
@@ -46,11 +87,33 @@ export function proxyAreaNotice(file, source) {
   }
 }
 
+export const PROXY_SESSION_WARNING = 'NS_PROXY_SESSION_OVER_HTTP'
+
+/** What to write instead of the HTTP session check; migrate in the CLI says the same. */
+export const PROXY_SESSION_FIX =
+  "import { auth } from '@nextsparkjs/core/lib/auth' and replace the betterFetch('/api/auth/get-session', ...) call with " +
+  "auth.api.getSession({ headers: new Headers({ cookie: request.headers.get('cookie') || '' }), query: { disableRefresh: true } }), " +
+  'which returns the session itself (or null), not { data }'
+
+/** The warning for a proxy whose code (not a comment) asks /api/auth/get-session over HTTP, or null. */
+export function proxySessionNotice(file, source) {
+  if (!withoutComments(source).includes('/api/auth/get-session')) return null
+  return {
+    code: PROXY_SESSION_WARNING,
+    target: file,
+    message:
+      `${file} checks the session by fetching /api/auth/get-session from the request's own origin. Behind a proxy that ` +
+      `terminates TLS (X-Forwarded-Proto: https) that origin is https on a port that speaks plain HTTP: the fetch fails ` +
+      `and every signed-in user is sent to /login. Read the session in process, as ` +
+      `node_modules/@nextsparkjs/core/templates/proxy.ts does: ${PROXY_SESSION_FIX}`,
+  }
+}
+
 /** The warnings for the proxy Next would load in `projectRoot` (the first of PROXY_FILES that exists). */
 export function proxyAreaNotices(projectRoot) {
   if (!projectRoot) return []
   const file = PROXY_FILES.find(candidate => existsSync(join(projectRoot, candidate)))
   if (!file) return []
-  const notice = proxyAreaNotice(file, readFileSync(join(projectRoot, file), 'utf8'))
-  return notice ? [notice] : []
+  const source = readFileSync(join(projectRoot, file), 'utf8')
+  return [proxyAreaNotice(file, source), proxySessionNotice(file, source)].filter(Boolean)
 }

package/scripts/build/registry/host/static-imports.mjs

@@ -80,11 +80,15 @@ export const CORE_COMPOSITION_WRAPPERS = Object.freeze({
   [`${INTERNAL}devtools-layout.cc`]: ['withDevtoolsGuard'],
   // Every page and layout under /superadmin and /devtools (the manifest's `access`).
   [`${INTERNAL}area-access`]: ['withSuperadminAccess', 'withDevtoolsAccess', 'withSuperadminMetadata', 'withDevtoolsMetadata', 'withSuperadminRouteAccess', 'withDevtoolsRouteAccess'],
+  // The same, for a Cache Components host (each segment checks inside its own Suspense boundary).
+  [`${INTERNAL}area-access.cc`]: ['withSuperadminAccess', 'withDevtoolsAccess', 'withSuperadminMetadata', 'withDevtoolsMetadata', 'withSuperadminRouteAccess', 'withDevtoolsRouteAccess'],
   [`${INTERNAL}entity-layout-route`]: ['createEntityLayoutRoute'],
   [`${INTERNAL}entity-list-route`]: ['createEntityListRoute'],
   [`${INTERNAL}entity-detail-route`]: ['createEntityDetailRoute'],
   [`${INTERNAL}entity-create-route`]: ['createEntityCreateRoute'],
   [`${INTERNAL}entity-edit-route`]: ['createEntityEditRoute'],
+  [`${INTERNAL}entity-detail-route.cc`]: ['createEntityDetailRoute'],
+  [`${INTERNAL}entity-edit-route.cc`]: ['createEntityEditRoute'],
   [`${INTERNAL}public-item-route`]: ['createPublicItemRoute', 'createPublicItemMetadata'],
   [`${INTERNAL}public-item-route.cc`]: ['createPublicItemRoute', 'createPublicItemMetadata'],
   [`${INTERNAL}public-archive-route`]: ['createPublicArchiveRoute', 'createPublicArchiveMetadata'],

package/scripts/build/routes-manifest.mjs

@@ -66,6 +66,8 @@ export const VARIANT_FILES = Object.freeze({
     'superadmin/layout.cc.tsx': 'superadmin/layout.tsx',
     'devtools/layout.cc.tsx': 'devtools/layout.tsx',
     'dashboard/layout.cc.tsx': 'dashboard/layout.tsx',
+    'dashboard/(main)/layout.cc.tsx': 'dashboard/(main)/layout.tsx',
+    '(public)/page.cc.tsx': '(public)/page.tsx',
     '(auth)/login/page.cc.tsx': '(auth)/login/page.tsx',
     '(auth)/signup/page.cc.tsx': '(auth)/signup/page.tsx',
     '(public)/docs/[section]/[page]/page.cc.tsx': '(public)/docs/[section]/[page]/page.tsx',
@@ -105,6 +107,15 @@ export const VARIANT_COMPOSE = Object.freeze({
   'devtools/layout.cc.tsx': { wrapper: 'withDevtoolsGuard', specifier: `${ROUTES_SUBPATH}/_internal/devtools-layout.cc` },
 })
 
+/**
+ * The per-segment access check of a variant, when it differs from its base route's: in Cache Components mode every
+ * page and layout under an area checks the role inside its own Suspense boundary (area-access.cc).
+ */
+export const VARIANT_ACCESS = Object.freeze({
+  'superadmin/layout.cc.tsx': { ...ACCESS_ROUTES['superadmin/layout.tsx'], specifier: `${ROUTES_SUBPATH}/_internal/area-access.cc` },
+  'devtools/layout.cc.tsx': { ...ACCESS_ROUTES['devtools/layout.tsx'], specifier: `${ROUTES_SUBPATH}/_internal/area-access.cc` },
+})
+
 /**
  * Files that live next to a route without being one: the API explorer's presets, read as text by the
  * registry build (registry/discovery/api-presets.mjs), and its docs.md.
@@ -168,7 +179,8 @@ export function buildRoutesManifest(routesDir = ROUTES_DIR) {
       const replaced = manifest.find(entry => entry.target === target)
       if (!replaced) throw new Error(`Variant ${file} (${mode}) replaces ${target}, which is not a core route`)
       const compose = VARIANT_COMPOSE[file] ?? replaced.compose
-      return { kind: replaced.kind, target, specifier: specifierForRouteFile(file), ...(compose ? { compose } : {}), ...(replaced.access ? { access: replaced.access } : {}) }
+      const access = VARIANT_ACCESS[file] ?? replaced.access
+      return { kind: replaced.kind, target, specifier: specifierForRouteFile(file), ...(compose ? { compose } : {}), ...(access ? { access } : {}) }
     })
   }
   return { manifest, variants }