@nextsparkjs/core 0.1.0-beta.195 → 0.1.0-beta.196

package/dist/routes/api/v1/teams/[teamId]/members/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/v1/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAwBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YACiC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2HlE,CAAA;AAGV,eAAO,MAAM,IAAI;YACgC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BAgMjE,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/v1/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAwBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YACiC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2HlE,CAAA;AAGV,eAAO,MAAM,IAAI;YACgC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BAkMjE,CAAA"}

package/dist/routes/api/v1/teams/[teamId]/members/route.js

@@ -237,18 +237,20 @@ export const POST = withRateLimitTier(withApiLogging(
           subject: emailContent.subject,
           html: emailContent.html
         });
-        console.log("\n" + "\u{1F3AB}".repeat(30));
-        console.log("\u{1F4E8} TEAM INVITATION CREATED");
-        console.log("\u{1F3AB}".repeat(30));
-        console.log(`\u{1F4E7} To: ${validatedData.email}`);
-        console.log(`\u{1F464} Invited by: ${inviterName}`);
-        console.log(`\u{1F3E2} Team: ${team.name}`);
-        console.log(`\u{1F451} Role: ${validatedData.role}`);
-        console.log(`\u{1F517} Accept URL: ${acceptUrl}`);
-        console.log("\u{1F3AB}".repeat(30) + "\n");
+        if (process.env.NODE_ENV === "development") {
+          console.log("\n" + "\u{1F3AB}".repeat(30));
+          console.log("\u{1F4E8} TEAM INVITATION CREATED");
+          console.log("\u{1F3AB}".repeat(30));
+          console.log(`\u{1F4E7} To: ${validatedData.email}`);
+          console.log(`\u{1F464} Invited by: ${inviterName}`);
+          console.log(`\u{1F3E2} Team: ${team.name}`);
+          console.log(`\u{1F451} Role: ${validatedData.role}`);
+          console.log(`\u{1F517} Accept URL: ${acceptUrl}`);
+          console.log("\u{1F3AB}".repeat(30) + "\n");
+        }
       } catch (emailError) {
         console.error("Failed to send invitation email:", emailError);
-        console.log(`\u26A0\uFE0F Email failed but invitation created. Accept URL: ${acceptUrl}`);
+        if (process.env.NODE_ENV === "development") console.log(`\u26A0\uFE0F Email failed but invitation created. Accept URL: ${acceptUrl}`);
       }
       const response = createApiResponse(invitation, { created: true }, 201);
       return addCorsHeaders(response, req);

package/dist/routes/api/v1/teams/switch/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/teams/switch/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAuBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,IAAI,iDA6EL,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/teams/switch/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAuBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,IAAI,iDAkFL,CAAA"}

package/dist/routes/api/v1/teams/switch/route.js

@@ -38,7 +38,10 @@ export const POST = withRateLimitTier(withApiLogging(async (req) => {
       );
       return addCorsHeaders(response, req);
     }
-    const body = await req.json();
+    const body = await req.json().catch(() => void 0);
+    if (body === void 0) {
+      return addCorsHeaders(createApiError("Request body must be valid JSON", 400, null, "INVALID_JSON"), req);
+    }
     const validatedData = switchTeamSchema.parse(body);
     try {
       await TeamService.switchActive(authResult.user.id, validatedData.teamId);

package/dist/routes/dashboard/settings/password/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../../src/routes/dashboard/settings/password/page.tsx"],"names":[],"mappings":"AAwBA,iBAAS,kBAAkB,4CAmR1B;AAID,eAAe,kBAAkB,CAAA"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../../src/routes/dashboard/settings/password/page.tsx"],"names":[],"mappings":"AAwBA,iBAAS,kBAAkB,4CAsR1B;AAID,eAAe,kBAAkB,CAAA"}

package/dist/routes/dashboard/settings/password/page.js

@@ -9,7 +9,7 @@ import {
   CheckCircle,
   Loader2
 } from "lucide-react";
-import { useState, useCallback } from "react";
+import { useState, useCallback, useEffect } from "react";
 import { useForm } from "react-hook-form";
 import { useRouter } from "next/navigation";
 import { Button } from "@nextsparkjs/core/components/ui/button";
@@ -25,6 +25,7 @@ function UpdatePasswordPage() {
   const { hasPassword, isLoading: profileLoading } = useUserProfile();
   const router = useRouter();
   const t = useTranslations("settings");
+  const tCommon = useTranslations("common");
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState(null);
   const [success, setSuccess] = useState(false);
@@ -58,7 +59,7 @@ function UpdatePasswordPage() {
       if (!result.success) {
         const errorMsg = result.error || t("password.messages.updateError");
         setError(errorMsg);
-        setStatusMessage(`${t("common.status.error")}: ${errorMsg}`);
+        setStatusMessage(`${tCommon("status.error")}: ${errorMsg}`);
       } else {
         setSuccess(true);
         setStatusMessage(t("password.messages.updateSuccess"));
@@ -66,25 +67,22 @@ function UpdatePasswordPage() {
     } catch {
       const errorMsg = t("password.messages.unexpectedError");
       setError(errorMsg);
-      setStatusMessage(`${t("common.status.error")}: ${errorMsg}`);
+      setStatusMessage(`${tCommon("status.error")}: ${errorMsg}`);
     } finally {
       setLoading(false);
     }
-  }, [changePassword, t]);
-  if (!user) {
-    router.push("/login");
-    return null;
-  }
-  if (!profileLoading && !hasPassword) {
-    router.push("/dashboard/settings/profile");
-    return null;
-  }
+  }, [changePassword, t, tCommon]);
+  const mustRedirectToProfile = !!user && !profileLoading && !hasPassword;
+  useEffect(() => {
+    if (mustRedirectToProfile) router.push("/dashboard/settings/profile");
+  }, [mustRedirectToProfile, router]);
   if (profileLoading) {
     return /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-center py-12", children: [
       /* @__PURE__ */ jsx(Loader2, { className: "h-8 w-8 animate-spin text-muted-foreground" }),
       /* @__PURE__ */ jsx("span", { className: "sr-only", children: t("password.loading.verifying") })
     ] });
   }
+  if (!user || mustRedirectToProfile) return null;
   if (success) {
     return /* @__PURE__ */ jsxs(Fragment, { children: [
       /* @__PURE__ */ jsx(

package/dist/routes/devtools/config/page.js

@@ -4,7 +4,7 @@ import { ConfigViewer } from "@nextsparkjs/core/components/devtools/ConfigViewer
 import { Settings } from "lucide-react";
 import { getTranslations } from "next-intl/server";
 async function DevConfigPageContent() {
-  const t = await getTranslations("dev.config");
+  const t = await getTranslations("devtools.config");
   return /* @__PURE__ */ jsxs("div", { className: "space-y-6", "data-cy": "devtools-config-page", children: [
     /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3", children: [
       /* @__PURE__ */ jsx("div", { className: "flex items-center justify-center w-12 h-12 bg-violet-100 dark:bg-violet-950 rounded-lg", children: /* @__PURE__ */ jsx(Settings, { className: "h-6 w-6 text-violet-600 dark:text-violet-400" }) }),

package/dist/routes/devtools/page.js

@@ -5,7 +5,7 @@ import Link from "next/link";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@nextsparkjs/core/components/ui/card";
 import { getTranslations } from "next-intl/server";
 async function DevHomePageContent() {
-  const t = await getTranslations("dev");
+  const t = await getTranslations("devtools");
   const tCommon = await getTranslations("common");
   const sections = [
     {

package/dist/routes/devtools/scheduled-actions/page.js

@@ -26,7 +26,7 @@ async function fetchScheduledActions(filters, page, limit) {
   return response.json();
 }
 export default function ScheduledActionsPage() {
-  const t = useTranslations("dev.scheduledActions");
+  const t = useTranslations("devtools.scheduledActions");
   const [filters, setFilters] = useState({});
   const [page, setPage] = useState(1);
   const limit = 20;

package/dist/routes/devtools/tests/[[...path]]/page.js

@@ -5,7 +5,7 @@ import { FileText } from "lucide-react";
 import { getTranslations } from "next-intl/server";
 async function DevTestsPageContent({ params }) {
   const { path } = await params;
-  const t = await getTranslations("dev.tests");
+  const t = await getTranslations("devtools.tests");
   const initialPath = (path == null ? void 0 : path.join("/")) || null;
   return /* @__PURE__ */ jsxs(
     "div",

package/dist/templates/ci-workflows/github/cypress-regression.yml

@@ -66,7 +66,7 @@ jobs:
       - name: Seed test data
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
-        run: pnpm db:seed || echo "No seed script found, skipping..."
+        run: pnpm db:seed
 
       - name: Build application
         run: pnpm build

package/dist/templates/ci-workflows/github/cypress-smoke.yml

@@ -59,7 +59,8 @@ jobs:
       - name: Setup database
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
-        run: pnpm db:migrate
+        # a throwaway test database: migrations plus the sample users the tests sign in as
+        run: pnpm db:seed
 
       - name: Build application
         run: pnpm build

package/dist/templates/projects/starter/README.md

@@ -21,6 +21,8 @@ cp .env.example .env.local
 
 # Run migrations
 pnpm db:migrate
+# Local development only: also load the sample users (DevKeyring, Cypress)
+pnpm db:seed
 
 # Start development
 pnpm dev

package/dist/templates/projects/starter/docs/public/01-overview/01-introduction.md

@@ -17,6 +17,8 @@ Welcome to the Starter theme for NextSpark. This minimal theme provides everythi
 3. Run migrations: `pnpm db:migrate`
 4. Start development: `pnpm dev`
 
+Sample users (DevKeyring, Cypress) are for local development only: `pnpm db:seed` loads them; `pnpm db:migrate` alone does not, and neither applies them when `NODE_ENV` is `production`.
+
 ## Project Structure
 
 ```

package/dist/templates/projects/starter/templates/dashboard/analytics/layout.tsx

@@ -0,0 +1,14 @@
+import { NextIntlClientProvider } from 'next-intl'
+import { getMessages } from 'next-intl/server'
+import { selectMessages } from '@nextsparkjs/core/lib/i18n/client-messages'
+
+// TasksChart and RecentActivity are client components that read the `analytics`
+// namespace, which the dashboard group does not carry to the browser by default.
+export default async function AnalyticsLayout({ children }: { children: React.ReactNode }) {
+  const messages = await getMessages()
+  return (
+    <NextIntlClientProvider messages={selectMessages(messages, 'dashboard', ['analytics'])}>
+      {children}
+    </NextIntlClientProvider>
+  )
+}

package/dist/templates/proxy.ts

@@ -20,8 +20,8 @@
  * themselves and use only x-pathname from here, as a routing hint; the
  * identity headers are still stripped and re-set for project code.
  */
-import { betterFetch } from '@better-fetch/fetch'
 import { NextRequest, NextResponse } from 'next/server'
+import { auth } from '@nextsparkjs/core/lib/auth'
 import {
   hasProjectMiddleware,
   executeProjectMiddleware,
@@ -181,14 +181,22 @@ function redirectAccessDenied(request: NextRequest): NextResponse {
 }
 
 /**
- * The session the request's cookies carry, asked of this app's own auth route,
- * which is served under the base path like every other route.
+ * The session the request's cookies carry, read in this process the way core's
+ * server code reads it. Asking the app's own /api/auth/get-session over HTTP
+ * built the URL from the request's origin, which behind a proxy that
+ * terminates TLS (X-Forwarded-Proto: https) is https on a port that speaks
+ * plain HTTP: the fetch failed and every signed-in user was sent to /login.
+ * Nothing here leaves the process, so no forwarded scheme or host can point
+ * the check anywhere. `disableRefresh`: this response cannot carry the renewed
+ * session cookie, so the rolling renewal is left to the auth route
+ * (lib/auth/session-refresh).
  */
-function getSession(request: NextRequest) {
-  return betterFetch<Session>('/api/auth/get-session', {
-    baseURL: `${request.nextUrl.origin}${request.nextUrl.basePath}`,
-    headers: { cookie: request.headers.get('cookie') || '' },
+async function getSession(request: NextRequest): Promise<Session | null> {
+  const session = await auth.api.getSession({
+    headers: new Headers({ cookie: request.headers.get('cookie') || '' }),
+    query: { disableRefresh: true },
   })
+  return session as Session | null
 }
 
 /**
@@ -490,7 +498,6 @@ export async function proxy(request: NextRequest) {
   const verifiedSession = async (): Promise<Session | null> => {
     if (!sessionPromise) {
       sessionPromise = getSession(request)
-        .then(({ data }) => data)
         .catch(error => {
           sessionError = error
           return null

package/dist/templates/public/uploads/README.md

@@ -1,97 +1,8 @@
-# Media Upload System
+# Media uploads
 
-## Overview
-This application uses **Vercel Blob Storage** for all media uploads. Files are stored in the cloud, not on the local filesystem.
+`POST /api/v1/media/upload` stores files in **Vercel Blob** when `BLOB_READ_WRITE_TOKEN` is set. The media library lists the Blob URLs.
 
-> **Note:** This directory (`public/uploads/`) is legacy from a previous filesystem-based implementation and is no longer used.
+- **Development without a token:** files are written to `public/uploads/temp/` (git-ignored) so the library works offline.
+- **Production without a token:** the upload answers `503` with code `STORAGE_NOT_CONFIGURED`. Nothing is written to disk: a file under `public/` is not served until the next restart and does not survive a redeploy.
 
-## Upload Endpoint
-**POST** `/api/v1/media/upload`
-
-### Authentication
-Requires valid user session (Better Auth)
-
-### Request
-- **Content-Type**: `multipart/form-data`
-- **Field name**: `files` (accepts multiple files)
-
-### Supported File Types
-- Images: JPEG, PNG, GIF, WebP
-- Videos: MP4, MPEG, QuickTime, WebM
-
-### File Size Limit
-- Maximum: 10MB per file
-
-### Response
-```json
-{
-  "message": "Files uploaded successfully",
-  "urls": [
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_abc123.jpg",
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_def456.png"
-  ],
-  "count": 2
-}
-```
-
-## File Naming Convention
-Files are automatically renamed using the pattern:
-```
-{timestamp}_{randomString}.{extension}
-```
-
-Example: `1704067200000_k9x2m4p.jpg`
-
-## Storage Location
-- **Storage Provider**: Vercel Blob (cloud object storage)
-- **Blob Path**: `uploads/temp/{filename}` (organizational prefix, not a filesystem path)
-- **Public URL**: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/{filename}`
-
-### How It Works
-
-**Local Development:**
-- Files are uploaded directly to Vercel Blob using `BLOB_READ_WRITE_TOKEN` from `.env`
-- No files are saved to your local filesystem
-- URLs point to Vercel's CDN
-
-**Production/Staging:**
-- Same behavior - files go directly to Vercel Blob
-- Uses environment-specific Blob token
-- No filesystem writes (Vercel serverless is read-only)
-
-## Usage in AI Content Generation
-The generate-content endpoint (`/api/content-buddy/generate-content`) automatically processes images for AI analysis.
-
-**Supported URL formats:**
-- Vercel Blob URLs: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/image.jpg`
-- External URLs: `https://example.com/image.jpg` (also supported)
-
-## Configuration
-Requires `BLOB_READ_WRITE_TOKEN` environment variable:
-
-```env
-BLOB_READ_WRITE_TOKEN="vercel_blob_rw_..."
-```
-
-## Cleanup
-Files are managed through Vercel Blob's retention policies.
-
-**Manual cleanup** (if needed):
-```typescript
-import { del } from '@vercel/blob'
-
-// Delete specific file
-await del(fileUrl)
-
-// Or list and delete old files
-import { list } from '@vercel/blob'
-const { blobs } = await list({ prefix: 'uploads/temp/' })
-// Filter and delete as needed
-```
-
-## Security Notes
-- All uploads require authentication
-- File type validation prevents malicious uploads
-- File size limits prevent DoS attacks
-- Random filenames prevent enumeration attacks
-- Files stored in secure Vercel Blob infrastructure
+Self-hosting needs a storage provider: set `BLOB_READ_WRITE_TOKEN` (a Vercel Blob token, starts with `vercel_blob_`). See the media library docs.

package/migrations/029_sample_accounts_outside_development.sql

@@ -0,0 +1,55 @@
+-- Migration: 029_sample_accounts_outside_development.sql
+-- Description: sample accounts keep no usable credentials outside development
+--
+-- Sample data (090_sample_data.sql and the projects' *sample_data* files) is
+-- only applied by an explicit development opt-in (`nextspark db:seed`,
+-- `--sample-data` or NEXTSPARK_SEED_SAMPLE_DATA=1). Databases migrated before
+-- that may still hold the sample accounts. This migration finds them by the
+-- sample password, never by name, so a renamed account is found and an account
+-- whose password was changed is left alone; for each one it:
+--   - removes the sample password (its "credential" account row),
+--   - removes its sessions,
+--   - deactivates its API keys (status 'inactive'; deleting them would delete
+--     their api_audit_log rows),
+--   - sets its global role to 'member' (027's trigger then removes it from the
+--     System Admin Team, as for any user who loses that role).
+-- It also removes the sample sessions and deactivates the sample API key by
+-- their fixed values, whoever owns them now. Nothing else is changed.
+--
+-- It runs once, everywhere, except in a development run that opted into sample
+-- data (the runner sets nextspark.seed_sample_data to 'on' then), where those
+-- accounts are wanted. To keep using one of them deliberately, give it a new
+-- password before upgrading; to restore one afterwards, set its role back and
+-- reset its password.
+
+DO $$
+DECLARE
+  sample_passwords CONSTANT TEXT[] := ARRAY[
+    '22de14d5472248ed0bece911df908b2a:d29576424798ba6845d348a3767c0b0f38a00f2aca461b3b1d34b99a93cab06c86774c6edb183e6d6ec47457649b032a49a7b60a48f6f4f7fbbc4ea40258f19f',
+    '3db9e98e2b4d3caca97fdf2783791cbc:34b293de615caf277a237773208858e960ea8aa10f1f5c5c309b632f192cac34d52ceafbd338385616f4929e4b1b6c055b67429c6722ffdb80b01d9bf4764866'
+  ];
+  sample_session_tokens CONSTANT TEXT[] := ARRAY['tmt_superadmin_session_token_001', 'tmt_developer_session_token_001'];
+  sample_key_hashes CONSTANT TEXT[] := ARRAY[
+    '205f13ae4d2e18df417e61123bb84030c124fcb5013699046379ae1b5ec04324',
+    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+  ];
+  sample_users TEXT[];
+BEGIN
+  IF current_setting('nextspark.seed_sample_data', true) = 'on' THEN
+    RAISE NOTICE 'Sample accounts: kept (development run with sample data).';
+    RETURN;
+  END IF;
+
+  SELECT COALESCE(array_agg(DISTINCT "userId"), '{}') INTO sample_users
+  FROM "account"
+  WHERE "providerId" = 'credential' AND "password" = ANY (sample_passwords);
+
+  DELETE FROM "account" WHERE "providerId" = 'credential' AND "password" = ANY (sample_passwords);
+  DELETE FROM "session" WHERE "userId" = ANY (sample_users) OR token = ANY (sample_session_tokens);
+  UPDATE "api_key" SET status = 'inactive', "updatedAt" = now()
+  WHERE status IS DISTINCT FROM 'inactive' AND ("userId" = ANY (sample_users) OR "keyHash" = ANY (sample_key_hashes));
+  UPDATE "users" SET role = 'member', "updatedAt" = now()
+  WHERE id = ANY (sample_users) AND role <> 'member';
+
+  RAISE NOTICE 'Sample accounts: % disabled (no password, sessions or active API keys; role member).', cardinality(sample_users);
+END $$;

package/migrations/090_sample_data.sql

@@ -7,6 +7,16 @@
 -- Theme-specific demo data (TMT.dev users, companies, invoices) is in:
 -- migrations/090_demo_users_teams.sql
 
+-- Only a development run that asked for sample data applies this file (see
+-- scripts/db/sample-data.mjs); anything else that runs it, such as a tool that
+-- applies every core .sql file in order, fails here instead of creating these accounts.
+DO $$
+BEGIN
+  IF current_setting('nextspark.seed_sample_data', true) IS DISTINCT FROM 'on' THEN
+    RAISE EXCEPTION 'Sample data is applied only by `pnpm db:seed` (or NEXTSPARK_SEED_SAMPLE_DATA=1) outside production. If you ran that, the session setting it relies on was lost: a transaction-mode pooler (PgBouncer, Supavisor on port 6543) drops it, so point MIGRATE_DATABASE_URL at a direct connection.';
+  END IF;
+END $$;
+
 -- ============================================
 -- STEP 1: CREATE CORE TEST USERS
 -- ============================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.195",
+  "version": "0.1.0-beta.196",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -496,7 +496,7 @@
     "use-intl": "^4.9.1",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@nextsparkjs/ui": "0.1.0-beta.195"
+    "@nextsparkjs/ui": "0.1.0-beta.196"
   },
   "engines": {
     "node": ">=22.14.0"

package/scripts/build/registry/host/__tests__/host-proxy-areas.test.mjs

@@ -12,7 +12,7 @@ import { mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
-import { PROXY_AREA_WARNING, missingProxyAreas, proxyAreaNotice, proxyAreaNotices } from '../proxy-areas.mjs'
+import { PROXY_AREA_WARNING, PROXY_SESSION_WARNING, missingProxyAreas, withoutComments, proxyAreaNotice, proxyAreaNotices, proxySessionNotice } from '../proxy-areas.mjs'
 import { predictHost } from '../prepare.mjs'
 import { PAGE, tempHost, write } from './host-helpers.mjs'
 
@@ -30,6 +30,20 @@ test('an area counts only when the proxy names its path; a look-alike prefix or
   assert.deepEqual(missingProxyAreas("const docs = '/superadmin-guide'; const tips = \"/devtools-tips\"").map(area => area.path), ['/superadmin', '/devtools'])
 })
 
+test("a proxy that re-exports core's template has the check; a re-export of anything else does not", () => {
+  assert.deepEqual(missingProxyAreas("export { proxy } from '../../../packages/core/templates/proxy'\nexport const config = { matcher: [] }"), [])
+  assert.deepEqual(missingProxyAreas("export { proxy } from '@nextsparkjs/core/templates/proxy'"), [])
+  assert.deepEqual(missingProxyAreas("export { proxy } from './my-proxy'").map(area => area.path), ['/superadmin', '/devtools'])
+  assert.deepEqual(missingProxyAreas("export { other } from '@nextsparkjs/core/templates/proxy'").map(area => area.path), ['/superadmin', '/devtools'])
+  const both = ['/superadmin', '/devtools']
+  assert.deepEqual(missingProxyAreas("export { proxy as coreProxy } from '@nextsparkjs/core/templates/proxy'\nexport function proxy() {}").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("export { other as proxy } from '@nextsparkjs/core/templates/proxy'").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("export { proxy } from './vendor/core/templates/proxy'").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("// export { proxy } from '@nextsparkjs/core/templates/proxy'\nexport function proxy() {}").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("/*\nexport { proxy } from '@nextsparkjs/core/templates/proxy'\n*/\nexport function proxy() {}").map(a => a.path), both)
+  assert.deepEqual(missingProxyAreas("export { config, proxy } from '@nextsparkjs/core/templates/proxy.ts'"), [])
+})
+
 test('the warning names the file, each missing area, its roles and where the check comes from', () => {
   const notice = proxyAreaNotice('src/proxy.ts', "const PROTECTED = ['/superadmin']")
   assert.equal(notice.code, PROXY_AREA_WARNING)
@@ -53,6 +67,63 @@ test('the proxy Next loads is the one checked; a project without one is not warn
   }
 })
 
+// S80 (D1): the session check that fetched /api/auth/get-session from the request's origin, as every proxy.ts copied
+// before 0.1.0-beta.196 does. Upgrading core never touches that copy, so prepare says what to change.
+const HTTP_SESSION_CHECK = `function getSession(request: NextRequest) {
+  return betterFetch<Session>('/api/auth/get-session', {
+    baseURL: \`\${request.nextUrl.origin}\${request.nextUrl.basePath}\`,
+    headers: { cookie: request.headers.get('cookie') || '' },
+  })
+}
+const PROTECTED = ['/superadmin', '/devtools']
+`
+
+test('a proxy that asks its own /api/auth/get-session over HTTP is warned about, with the in-process call to use', () => {
+  const notice = proxySessionNotice('src/proxy.ts', HTTP_SESSION_CHECK)
+  assert.equal(notice.code, PROXY_SESSION_WARNING)
+  assert.match(notice.message, /^src\/proxy\.ts checks the session by fetching \/api\/auth\/get-session/)
+  assert.match(notice.message, /X-Forwarded-Proto: https/)
+  assert.match(notice.message, /auth\.api\.getSession\(\{ headers: new Headers\(\{ cookie: request\.headers\.get\('cookie'\) \|\| '' \}\), query: \{ disableRefresh: true \} \}\)/)
+  assert.equal(proxySessionNotice('src/proxy.ts', readFileSync(join(CORE_ROOT, 'templates/proxy.ts'), 'utf8')), null)
+  assert.equal(proxySessionNotice('src/proxy.ts', "// was: betterFetch('/api/auth/get-session')\nexport function proxy() {}"), null)
+  assert.equal(proxySessionNotice('src/proxy.ts', "export { proxy } from '@nextsparkjs/core/templates/proxy'"), null)
+})
+
+// The S80 review's measured edges: an end-of-line comment, and a '/*' / '*/' pair inside two string literals.
+const COMMENT_EDGES = [
+  ['an end-of-line comment after code', "const x = 1 // was '/api/auth/get-session'\nexport function proxy() {}", false],
+  ['an end-of-line comment after code, no space', "const x = 1// was '/api/auth/get-session'", false],
+  ["a '/*' and a '*/' in two strings around the call", "const a = '/api/*'\nbetterFetch('/api/auth/get-session')\nconst b = 'x*/'", true],
+  ["a '//' inside a string before the call", "const u = 'https://example.com'; betterFetch('/api/auth/get-session')", true],
+  ['a block comment', "/* betterFetch('/api/auth/get-session') */ export function proxy() {}", false],
+  ['a quote escaped inside a string', "const q = 'it\\'s'; betterFetch('/api/auth/get-session')", true],
+]
+
+test('comments are stripped wherever they start, and never inside a string literal', () => {
+  for (const [label, source, warns] of COMMENT_EDGES) {
+    assert.equal(proxySessionNotice('src/proxy.ts', source) !== null, warns, label)
+  }
+  assert.equal(withoutComments("a // b\nc"), 'a \nc')
+  assert.equal(withoutComments("'//' /* x */ \"/*\""), "'//'   \"/*\"")
+  // The repository template, old and new, reads the same with comments gone: every regex literal in it survives.
+  const template = readFileSync(join(CORE_ROOT, 'templates/proxy.ts'), 'utf8')
+  assert.match(withoutComments(template), /\.replace\(\/\\\\\/g, '\/'\)\.replace\(\/\\\/\\\/\+\/g, '\/'\)/)
+})
+
+test("the proxy Next loads gets the session warning next to the areas one; core's template gets neither", () => {
+  const root = mkdtempSync(join(tmpdir(), 'nextspark-proxy-session-'))
+  try {
+    write(root, 'src/proxy.ts', HTTP_SESSION_CHECK)
+    assert.deepEqual(proxyAreaNotices(root).map(notice => notice.code), [PROXY_SESSION_WARNING])
+    write(root, 'src/proxy.ts', `${HTTP_SESSION_CHECK.replace("['/superadmin', '/devtools']", '[]')}`)
+    assert.deepEqual(proxyAreaNotices(root).map(notice => notice.code), [PROXY_AREA_WARNING, PROXY_SESSION_WARNING])
+    write(root, 'src/proxy.ts', readFileSync(join(CORE_ROOT, 'templates/proxy.ts'), 'utf8'))
+    assert.deepEqual(proxyAreaNotices(root), [])
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
 test("prepare's prediction carries the warning among its notices", async () => {
   const host = tempHost({ 'templates/about/page.tsx': PAGE('About') })
   const project = mkdtempSync(join(tmpdir(), 'nextspark-proxy-areas-project-'))