@nextsparkjs/core 0.1.0-beta.194 → 0.1.0-beta.196

package/scripts/db/run-migrations.mjs

@@ -2,6 +2,7 @@ import fs from "fs";
 import path from "path";
 import { migrationTimeLimit, migrationClient, ignoredParametersNotice, runAndRecordMigration, migrationFailure } from './migration-time-limit.mjs';
 import { getConfig } from '../build/registry/config.mjs';
+import { isSampleDataMigration, sampleDataPolicy } from './sample-data.mjs';
 
 const projectConfig = getConfig();
 const projectRoot = projectConfig.projectRoot;
@@ -21,6 +22,8 @@ let DATABASE_URL = process.env.DATABASE_URL ?? null;
 // Falls back to DATABASE_URL when unset (pre-cutover: same owner connection).
 let MIGRATE_DATABASE_URL = process.env.MIGRATE_DATABASE_URL ?? null;
 let MIGRATION_TIMEOUT_SECONDS = process.env.MIGRATION_TIMEOUT_SECONDS;
+// What the .env says about NODE_ENV and the sample-data switch (see sample-data.mjs)
+const fileEnv = {};
 
 if (readEnvFile && fs.existsSync(envPath)) {
   const envContent = fs.readFileSync(envPath, 'utf8');
@@ -40,6 +43,11 @@ if (readEnvFile && fs.existsSync(envPath)) {
       if (key?.trim() === 'MIGRATION_TIMEOUT_SECONDS' && valueParts.length > 0) {
         MIGRATION_TIMEOUT_SECONDS = value;
       }
+      // `export NODE_ENV=...` counts too; sample-data.mjs reads the value itself (case, trailing comment)
+      const name = key?.trim().replace(/^export\s+/, '');
+      if (['NODE_ENV', 'NEXTSPARK_SEED_SAMPLE_DATA'].includes(name) && valueParts.length > 0) {
+        fileEnv[name] = value;
+      }
     }
   });
 }
@@ -65,12 +73,20 @@ try {
 const ignoredParameters = ignoredParametersNotice(MIGRATION_URL, TIME_LIMIT);
 if (ignoredParameters) console.log(`⚠️  ${ignoredParameters}\n`);
 
+const SAMPLE_DATA = sampleDataPolicy({ argv: process.argv, env: process.env, fileEnv });
+
 async function runMigrations() {
   const client = migrationClient(MIGRATION_URL, TIME_LIMIT);
   
   try {
     await client.connect();
     console.log("✅ Connected to database\n");
+
+    // 029_sample_accounts_outside_development.sql reads it: a run that applies sample data keeps the sample accounts
+    await client.query("SELECT set_config('nextspark.seed_sample_data', $1, false)", [SAMPLE_DATA.apply ? 'on' : 'off']);
+    client.on('notice', notice => {
+      if (notice.message?.startsWith('Sample accounts:')) console.log(`🔐 ${notice.message}`);
+    });
     
     // Create migrations tracking table
     await client.query(`
@@ -101,9 +117,14 @@ async function runMigrations() {
         continue;
       }
       
+      const sql = fs.readFileSync(path.join(migrationsDir, file), 'utf8');
+      if (!SAMPLE_DATA.apply && isSampleDataMigration(file, sql)) {
+        console.log(`⏭️  Skipping ${file} (sample data)`);
+        continue;
+      }
+
       // Read and execute migration
       console.log(`🔄 Running ${file}...`);
-      const sql = fs.readFileSync(path.join(migrationsDir, file), 'utf8');
       
       try {
         // Runs the file and records it in one transaction (see runAndRecordMigration)
@@ -141,11 +162,6 @@ async function getActivePlugins() {
   return projectConfig.plugins;
 }
 
-// Helper: Check if a filename is a sample_data migration
-function isSampleDataMigration(filename) {
-  return filename.toLowerCase().includes('sample_data') || filename.toLowerCase().includes('sample-data');
-}
-
 // Helper: Collect all migration files from a directory (theme/plugin level)
 function collectContentMigrations(migrationsPath, sourceType, sourceName) {
   if (!fs.existsSync(migrationsPath)) return [];
@@ -160,7 +176,7 @@ function collectContentMigrations(migrationsPath, sourceType, sourceName) {
     sourceName,
     filename: file,
     fullPath: path.join(migrationsPath, file),
-    isSampleData: isSampleDataMigration(file)
+    isSampleData: isSampleDataMigration(file, fs.readFileSync(path.join(migrationsPath, file), 'utf8'))
   }));
 }
 
@@ -193,7 +209,7 @@ function collectEntityMigrations(baseDir, sourceType, sourceName, depth = 0) {
           entityName,
           filename: file,
           fullPath: path.join(migrationsPath, file),
-          isSampleData: isSampleDataMigration(file),
+          isSampleData: isSampleDataMigration(file, fs.readFileSync(path.join(migrationsPath, file), 'utf8')),
           depth
         });
       }
@@ -415,15 +431,18 @@ async function runEntityMigrations() {
     const sortByFilename = (a, b) => a.filename.localeCompare(b.filename);
 
     const contentSchema = allContentMigrations.filter(m => !m.isSampleData).sort(sortByFilename);
-    const contentSampleData = allContentMigrations.filter(m => m.isSampleData).sort(sortByFilename);
+    const contentSampleData = allContentMigrations.filter(m => m.isSampleData && SAMPLE_DATA.apply).sort(sortByFilename);
     const entitySchema = allEntityMigrations.filter(m => !m.isSampleData).sort(sortByFilename);
-    const entitySampleData = allEntityMigrations.filter(m => m.isSampleData).sort(sortByFilename);
+    const entitySampleData = allEntityMigrations.filter(m => m.isSampleData && SAMPLE_DATA.apply).sort(sortByFilename);
 
     console.log(`📊 Migration breakdown:`);
     console.log(`   - Content schema: ${contentSchema.length}`);
     console.log(`   - Content sample_data: ${contentSampleData.length}`);
     console.log(`   - Entity schema: ${entitySchema.length}`);
     console.log(`   - Entity sample_data: ${entitySampleData.length}`);
+    for (const m of [...allContentMigrations, ...allEntityMigrations].filter(m => m.isSampleData && !SAMPLE_DATA.apply)) {
+      console.log(`⏭️  Skipping ${m.filename} (sample data, ${m.sourceName})`);
+    }
     console.log('');
 
     let totalContentMigrations = 0;
@@ -550,6 +569,7 @@ async function runEntityMigrations() {
 // Main migration runner
 async function runAllMigrations() {
   console.log("🚀 Starting migration process...\n");
+  console.log(`🌱 ${SAMPLE_DATA.notice}\n`);
   
   // First run core migrations
   console.log("📋 PHASE 1: Core migrations");

package/scripts/db/sample-data.mjs

@@ -0,0 +1,44 @@
+// Which migrations are sample data, and whether a db:migrate run applies them.
+//
+// Sample data is applied only when the run asks for it -- `--sample-data`
+// (what `nextspark db:seed` passes) or NEXTSPARK_SEED_SAMPLE_DATA=1, in the
+// environment or the project .env -- and never when NODE_ENV is production in
+// either: its accounts have a documented development password. A sample-data
+// file that is not applied is not recorded either, so a later run that asks
+// for it still applies it.
+
+export const SAMPLE_DATA_FLAG = '--sample-data';
+export const SAMPLE_DATA_VARIABLE = 'NEXTSPARK_SEED_SAMPLE_DATA';
+/** A line that marks a migration as sample data when its name does not say so. */
+export const SAMPLE_DATA_MARKER = '-- nextspark:sample-data';
+
+// A value as a .env or a shell may write it: any case, quotes, a trailing comment.
+const isProduction = value => /^\s*["']?production\b/i.test(String(value ?? ''));
+const isOn = value => /^\s*["']?(1|true)\b/i.test(String(value ?? ''));
+
+// Copies made before the name rule and the marker existed (the default theme's
+// 090_demo_users_teams.sql and 091_greek_teams_billing.sql, up to 0.1.0-beta.191)
+// are recognised by what they insert: a credential with a sample password. The
+// salts are those of migrations/029_*.sql, which has them but inserts nothing.
+const SAMPLE_PASSWORD_SALTS = ['22de14d5472248ed0bece911df908b2a:', '3db9e98e2b4d3caca97fdf2783791cbc:'];
+const insertsSamplePassword = sql => /insert\s+into\s+(?:"?public"?\s*\.\s*)?"?account\b/i.test(sql) && SAMPLE_PASSWORD_SALTS.some(salt => sql.includes(salt));
+
+export function isSampleDataMigration(filename, sql = '') {
+  const name = filename.toLowerCase();
+  return name.includes('sample_data') || name.includes('sample-data') || sql.split('\n').some(line => line.trim() === SAMPLE_DATA_MARKER) || insertsSamplePassword(sql);
+}
+
+/**
+ * `env` is the process environment, `fileEnv` what the project .env sets.
+ * Returns whether sample data is applied and the line the runner prints about it.
+ */
+export function sampleDataPolicy({ argv = [], env = {}, fileEnv = {} }) {
+  const requested = argv.includes(SAMPLE_DATA_FLAG) || [env[SAMPLE_DATA_VARIABLE], fileEnv[SAMPLE_DATA_VARIABLE]].some(isOn);
+  if ([env.NODE_ENV, fileEnv.NODE_ENV].some(isProduction)) {
+    return { apply: false, notice: `Sample data is not applied: NODE_ENV is production${requested ? ', which the sample-data switch does not override' : ''}.` };
+  }
+  if (requested) {
+    return { apply: true, notice: 'Sample data is applied (development). Its accounts share a documented password: use this only on a local database, and never use a database seeded this way in production (its sample accounts are kept, and later migrations do not disable them).' };
+  }
+  return { apply: false, notice: `Sample data is not applied. For a local development database, run \`pnpm db:seed\` (or pass ${SAMPLE_DATA_FLAG}, or set ${SAMPLE_DATA_VARIABLE}=1).` };
+}

package/scripts/db/ssl-config.mjs

@@ -29,6 +29,17 @@ export function stripSSLParams(databaseUrl) {
   }
 }
 
+// On globalThis, like src/lib/db.ts: one warning per process however many copies of the module are loaded
+const SSL_WARNED = Symbol.for('nextspark.dbSslDisabledWarned')
+
+/** Once per process, and not for a loopback host: mirrors `warnSSLDisabledInProduction` in src/lib/db.ts. */
+function warnSSLDisabledInProduction(url) {
+  if (globalThis[SSL_WARNED]) return
+  if (['localhost', '127.0.0.1', '[::1]'].includes(url.hostname.toLowerCase())) return
+  globalThis[SSL_WARNED] = true
+  console.warn('[DB] WARNING: SSL disabled in production environment. This is insecure!')
+}
+
 /**
  * Parse the SSL policy used by database scripts.
  *
@@ -47,7 +58,7 @@ export function parseSSLConfig(databaseUrl) {
     if (sslmode) {
       switch (sslmode) {
         case 'disable':
-          if (isProduction) console.warn('[DB] WARNING: SSL disabled in production environment. This is insecure!')
+          if (isProduction) warnSSLDisabledInProduction(url)
           return false
         case 'require':
         case 'prefer':

package/scripts/db/verify-theme-migrations.mjs

@@ -28,6 +28,9 @@
 // `pnpm db:migrate` uses. Templates are first extracted into a clean temporary
 // root-first project; apps/dev already is one. No .env is read or written.
 //
+// The run applies the theme's sample data (the database is empty and
+// throwaway), so NODE_ENV is development for it whatever the shell says.
+//
 // MIGRATE_DATABASE_URL is removed from the child's environment because
 // run-migrations.mjs connects to it in preference to DATABASE_URL, which
 // would migrate a database this script never checked.
@@ -46,6 +49,7 @@ import { GLOBAL_OBJECTS, inspectCluster } from './cluster-changes.mjs';
 import { inspectTarget, inspectMaintenanceDatabase } from './inspect-server.mjs';
 import { findTheme } from './theme-location.mjs';
 import { TIME_LIMIT_VARIABLE, migrationTimeLimit } from './migration-time-limit.mjs';
+import { SAMPLE_DATA_VARIABLE } from './sample-data.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -164,6 +168,8 @@ async function main() {
       ...inheritedEnv,
       DATABASE_URL: databaseUrl,
       [TIME_LIMIT_VARIABLE]: timeLimitSetting,
+      [SAMPLE_DATA_VARIABLE]: '1',
+      NODE_ENV: 'development',
     },
   });
   if (extracted) fs.rmSync(extracted, { recursive: true, force: true });

package/templates/ci-workflows/github/cypress-regression.yml

@@ -66,7 +66,7 @@ jobs:
       - name: Seed test data
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
-        run: pnpm db:seed || echo "No seed script found, skipping..."
+        run: pnpm db:seed
 
       - name: Build application
         run: pnpm build

package/templates/ci-workflows/github/cypress-smoke.yml

@@ -59,7 +59,8 @@ jobs:
       - name: Setup database
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
-        run: pnpm db:migrate
+        # a throwaway test database: migrations plus the sample users the tests sign in as
+        run: pnpm db:seed
 
       - name: Build application
         run: pnpm build

package/templates/next.config.mjs

@@ -260,35 +260,8 @@ const nextConfig = {
         source: '/:path*',
         headers: securityHeaders
       },
-      // CORS headers for API routes
-      // NOTE: In development, CORS is handled dynamically by API routes using addCorsHeaders()
-      // to support multiple origins (web app, mobile app, etc.)
-      // In production, we set static CORS headers here
-      ...(isProduction ? [{
-        source: '/api/:path*',
-        headers: [
-          {
-            key: 'Access-Control-Allow-Origin',
-            value: process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-          },
-          {
-            key: 'Access-Control-Allow-Methods',
-            value: 'GET, POST, PUT, DELETE, OPTIONS, PATCH'
-          },
-          {
-            key: 'Access-Control-Allow-Headers',
-            value: 'Content-Type, Authorization, x-api-key, x-verify-from-ui, Cookie, Set-Cookie'
-          },
-          {
-            key: 'Access-Control-Allow-Credentials',
-            value: 'true'
-          },
-          {
-            key: 'Access-Control-Expose-Headers',
-            value: 'Set-Cookie'
-          }
-        ]
-      }] : [])
+      // No CORS headers here: core's API routes answer CORS per request (addCorsHeaders), so the
+      // origins in api.cors.allowedOrigins and CORS_ADDITIONAL_ORIGINS get their grant in production too
     ]
   },
 }

package/templates/projects/blog/api/authors/[username]/route.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface Author {
   id: string
@@ -151,3 +152,5 @@ const getHandler = async (
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/templates/projects/blog/api/authors/route.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface AuthorWithCount {
   id: string
@@ -64,3 +65,5 @@ const getHandler = async (request: NextRequest) => {
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/templates/projects/blog/api/posts/public/route.ts

@@ -11,6 +11,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { queryWithRLS } from '@nextsparkjs/core/lib/db'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { corsPreflight } from '@nextsparkjs/core/lib/api/cors-response'
 
 interface Post {
   id: string
@@ -152,3 +153,5 @@ const getHandler = async (request: NextRequest) => {
 }
 
 export const GET = withRateLimitTier(getHandler, 'read')
+
+export const OPTIONS = corsPreflight

package/templates/projects/starter/README.md

@@ -21,6 +21,8 @@ cp .env.example .env.local
 
 # Run migrations
 pnpm db:migrate
+# Local development only: also load the sample users (DevKeyring, Cypress)
+pnpm db:seed
 
 # Start development
 pnpm dev

package/templates/projects/starter/docs/public/01-overview/01-introduction.md

@@ -17,6 +17,8 @@ Welcome to the Starter theme for NextSpark. This minimal theme provides everythi
 3. Run migrations: `pnpm db:migrate`
 4. Start development: `pnpm dev`
 
+Sample users (DevKeyring, Cypress) are for local development only: `pnpm db:seed` loads them; `pnpm db:migrate` alone does not, and neither applies them when `NODE_ENV` is `production`.
+
 ## Project Structure
 
 ```

package/templates/projects/starter/templates/dashboard/analytics/layout.tsx

@@ -0,0 +1,14 @@
+import { NextIntlClientProvider } from 'next-intl'
+import { getMessages } from 'next-intl/server'
+import { selectMessages } from '@nextsparkjs/core/lib/i18n/client-messages'
+
+// TasksChart and RecentActivity are client components that read the `analytics`
+// namespace, which the dashboard group does not carry to the browser by default.
+export default async function AnalyticsLayout({ children }: { children: React.ReactNode }) {
+  const messages = await getMessages()
+  return (
+    <NextIntlClientProvider messages={selectMessages(messages, 'dashboard', ['analytics'])}>
+      {children}
+    </NextIntlClientProvider>
+  )
+}

package/templates/proxy.ts

@@ -20,8 +20,8 @@
  * themselves and use only x-pathname from here, as a routing hint; the
  * identity headers are still stripped and re-set for project code.
  */
-import { betterFetch } from '@better-fetch/fetch'
 import { NextRequest, NextResponse } from 'next/server'
+import { auth } from '@nextsparkjs/core/lib/auth'
 import {
   hasProjectMiddleware,
   executeProjectMiddleware,
@@ -181,14 +181,22 @@ function redirectAccessDenied(request: NextRequest): NextResponse {
 }
 
 /**
- * The session the request's cookies carry, asked of this app's own auth route,
- * which is served under the base path like every other route.
+ * The session the request's cookies carry, read in this process the way core's
+ * server code reads it. Asking the app's own /api/auth/get-session over HTTP
+ * built the URL from the request's origin, which behind a proxy that
+ * terminates TLS (X-Forwarded-Proto: https) is https on a port that speaks
+ * plain HTTP: the fetch failed and every signed-in user was sent to /login.
+ * Nothing here leaves the process, so no forwarded scheme or host can point
+ * the check anywhere. `disableRefresh`: this response cannot carry the renewed
+ * session cookie, so the rolling renewal is left to the auth route
+ * (lib/auth/session-refresh).
  */
-function getSession(request: NextRequest) {
-  return betterFetch<Session>('/api/auth/get-session', {
-    baseURL: `${request.nextUrl.origin}${request.nextUrl.basePath}`,
-    headers: { cookie: request.headers.get('cookie') || '' },
+async function getSession(request: NextRequest): Promise<Session | null> {
+  const session = await auth.api.getSession({
+    headers: new Headers({ cookie: request.headers.get('cookie') || '' }),
+    query: { disableRefresh: true },
   })
+  return session as Session | null
 }
 
 /**
@@ -200,8 +208,19 @@ function getSession(request: NextRequest) {
  * session. Gating the strip on protected prefixes is not enough: Next.js
  * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
  * action can be POSTed to a public path with a forged `x-user-id`.
+ *
+ * The `x-api-*` names are never set here: core takes an API key's identity from
+ * validating the key, and nothing downstream may receive them from the client.
  */
-const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname', 'x-active-team-id'] as const
+const TRUSTED_IDENTITY_HEADERS = [
+  'x-user-id',
+  'x-user-email',
+  'x-pathname',
+  'x-active-team-id',
+  'x-api-user-id',
+  'x-api-key-id',
+  'x-api-scopes',
+] as const
 
 /**
  * Build the request headers forwarded to the app: inbound copy minus every
@@ -479,7 +498,6 @@ export async function proxy(request: NextRequest) {
   const verifiedSession = async (): Promise<Session | null> => {
     if (!sessionPromise) {
       sessionPromise = getSession(request)
-        .then(({ data }) => data)
         .catch(error => {
           sessionError = error
           return null

package/templates/public/uploads/README.md

@@ -1,97 +1,8 @@
-# Media Upload System
+# Media uploads
 
-## Overview
-This application uses **Vercel Blob Storage** for all media uploads. Files are stored in the cloud, not on the local filesystem.
+`POST /api/v1/media/upload` stores files in **Vercel Blob** when `BLOB_READ_WRITE_TOKEN` is set. The media library lists the Blob URLs.
 
-> **Note:** This directory (`public/uploads/`) is legacy from a previous filesystem-based implementation and is no longer used.
+- **Development without a token:** files are written to `public/uploads/temp/` (git-ignored) so the library works offline.
+- **Production without a token:** the upload answers `503` with code `STORAGE_NOT_CONFIGURED`. Nothing is written to disk: a file under `public/` is not served until the next restart and does not survive a redeploy.
 
-## Upload Endpoint
-**POST** `/api/v1/media/upload`
-
-### Authentication
-Requires valid user session (Better Auth)
-
-### Request
-- **Content-Type**: `multipart/form-data`
-- **Field name**: `files` (accepts multiple files)
-
-### Supported File Types
-- Images: JPEG, PNG, GIF, WebP
-- Videos: MP4, MPEG, QuickTime, WebM
-
-### File Size Limit
-- Maximum: 10MB per file
-
-### Response
-```json
-{
-  "message": "Files uploaded successfully",
-  "urls": [
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_abc123.jpg",
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_def456.png"
-  ],
-  "count": 2
-}
-```
-
-## File Naming Convention
-Files are automatically renamed using the pattern:
-```
-{timestamp}_{randomString}.{extension}
-```
-
-Example: `1704067200000_k9x2m4p.jpg`
-
-## Storage Location
-- **Storage Provider**: Vercel Blob (cloud object storage)
-- **Blob Path**: `uploads/temp/{filename}` (organizational prefix, not a filesystem path)
-- **Public URL**: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/{filename}`
-
-### How It Works
-
-**Local Development:**
-- Files are uploaded directly to Vercel Blob using `BLOB_READ_WRITE_TOKEN` from `.env`
-- No files are saved to your local filesystem
-- URLs point to Vercel's CDN
-
-**Production/Staging:**
-- Same behavior - files go directly to Vercel Blob
-- Uses environment-specific Blob token
-- No filesystem writes (Vercel serverless is read-only)
-
-## Usage in AI Content Generation
-The generate-content endpoint (`/api/content-buddy/generate-content`) automatically processes images for AI analysis.
-
-**Supported URL formats:**
-- Vercel Blob URLs: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/image.jpg`
-- External URLs: `https://example.com/image.jpg` (also supported)
-
-## Configuration
-Requires `BLOB_READ_WRITE_TOKEN` environment variable:
-
-```env
-BLOB_READ_WRITE_TOKEN="vercel_blob_rw_..."
-```
-
-## Cleanup
-Files are managed through Vercel Blob's retention policies.
-
-**Manual cleanup** (if needed):
-```typescript
-import { del } from '@vercel/blob'
-
-// Delete specific file
-await del(fileUrl)
-
-// Or list and delete old files
-import { list } from '@vercel/blob'
-const { blobs } = await list({ prefix: 'uploads/temp/' })
-// Filter and delete as needed
-```
-
-## Security Notes
-- All uploads require authentication
-- File type validation prevents malicious uploads
-- File size limits prevent DoS attacks
-- Random filenames prevent enumeration attacks
-- Files stored in secure Vercel Blob infrastructure
+Self-hosting needs a storage provider: set `BLOB_READ_WRITE_TOKEN` (a Vercel Blob token, starts with `vercel_blob_`). See the media library docs.

package/tests/jest/__mocks__/@nextsparkjs/registries/api-presets-registry.ts

@@ -0,0 +1,2 @@
+/** Jest mock: no API presets. */
+export const API_PRESETS_REGISTRY = { endpoints: {} }

package/tests/jest/__mocks__/@nextsparkjs/registries/mcp-registry.ts

@@ -0,0 +1,2 @@
+/** Jest mock: no MCP overrides. */
+export const MCP_OVERRIDES = {}

package/dist/templates/public/uploads/.gitignore

@@ -1,6 +0,0 @@
-# Ignore all uploaded files
-temp/*
-!temp/.gitkeep
-
-# Keep the directory structure
-!.gitignore

package/dist/templates/public/uploads/temp/.gitkeep

@@ -1 +0,0 @@
-# Keep this directory in git but ignore uploaded files

package/templates/public/uploads/.gitignore

@@ -1,6 +0,0 @@
-# Ignore all uploaded files
-temp/*
-!temp/.gitkeep
-
-# Keep the directory structure
-!.gitignore

package/templates/public/uploads/temp/.gitkeep

@@ -1 +0,0 @@
-# Keep this directory in git but ignore uploaded files