@nextsparkjs/core 0.1.0-beta.195 → 0.1.0-beta.197

package/dist/routes/api/v1/post-categories/[id]/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { categoryReadTeam, categoryWriter } from "@nextsparkjs/core/lib/api/post-categories";
 import { query as dbQuery } from "@nextsparkjs/core/lib/db";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
@@ -15,15 +15,33 @@ const updateCategorySchema = z.object({
   isDefault: z.boolean().optional(),
   isActive: z.boolean().optional()
 });
+async function findCategory(id, writer) {
+  const found = await dbQuery(
+    `SELECT "teamId" FROM taxonomies WHERE id = $1 AND type = 'post_category' AND ("teamId" IS NULL OR "teamId" = $2)`,
+    [id, writer.teamId]
+  );
+  if (found.rows.length === 0) {
+    return { response: NextResponse.json({ success: false, error: "Category not found" }, { status: 404 }) };
+  }
+  if (found.rows[0].teamId === null && !writer.superadmin) {
+    return { response: NextResponse.json(
+      { success: false, error: "Only a superadmin can change a category shared by every team", code: "PERMISSION_DENIED" },
+      { status: 403 }
+    ) };
+  }
+  return found.rows[0];
+}
 export const GET = withRateLimitTier(async (request, { params }) => {
   try {
     const { id } = await params;
+    const scope = await categoryReadTeam(request);
+    if ("response" in scope) return scope.response;
     const result = await dbQuery(
       `SELECT id, name, slug, description, icon, color, "parentId", "order", "isDefault", "isActive",
               "createdAt", "updatedAt"
        FROM taxonomies
-       WHERE id = $1 AND type = 'post_category' AND "deletedAt" IS NULL`,
-      [id]
+       WHERE id = $1 AND type = 'post_category' AND "deletedAt" IS NULL AND ("teamId" IS NULL OR "teamId" = $2)`,
+      [id, scope.teamId]
     );
     if (result.rows.length === 0) {
       return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });
@@ -39,24 +57,17 @@ export const GET = withRateLimitTier(async (request, { params }) => {
 }, "read");
 export const PUT = withRateLimitTier(async (request, { params }) => {
   try {
-    const authResult = await authenticateRequest(request, { requiredScope: "posts:write" });
-    if (!authResult.success || !authResult.user) {
-      return createAuthFailureResponse(authResult);
-    }
+    const writer = await categoryWriter(request, "update");
+    if ("response" in writer) return writer.response;
     const body = await request.json();
     const data = updateCategorySchema.parse(body);
     const { id } = await params;
-    const typeCheck = await dbQuery(
-      "SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category'",
-      [id]
-    );
-    if (typeCheck.rows.length === 0) {
-      return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });
-    }
+    const row = await findCategory(id, writer);
+    if ("response" in row) return row.response;
     if (data.slug) {
       const slugCheck = await dbQuery(
-        "SELECT id FROM taxonomies WHERE type = 'post_category' AND slug = $1 AND id != $2",
-        [data.slug, id]
+        `SELECT id FROM taxonomies WHERE type = 'post_category' AND slug = $1 AND id != $2 AND "teamId" IS NOT DISTINCT FROM $3`,
+        [data.slug, id, row.teamId]
       );
       if (slugCheck.rows.length > 0) {
         return NextResponse.json(
@@ -67,8 +78,8 @@ export const PUT = withRateLimitTier(async (request, { params }) => {
     }
     if (data.parentId) {
       const parentCheck = await dbQuery(
-        "SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category'",
-        [data.parentId]
+        `SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category' AND ("teamId" IS NULL OR "teamId" IS NOT DISTINCT FROM $2)`,
+        [data.parentId, row.teamId]
       );
       if (parentCheck.rows.length === 0) {
         return NextResponse.json({
@@ -132,7 +143,8 @@ export const PUT = withRateLimitTier(async (request, { params }) => {
       return NextResponse.json({ success: true, data: current.rows[0] });
     }
     values.push(id);
-    const query = `UPDATE taxonomies SET ${updates.join(", ")} WHERE id = $${paramIndex} RETURNING *`;
+    values.push(row.teamId);
+    const query = `UPDATE taxonomies SET ${updates.join(", ")} WHERE id = $${paramIndex} AND "teamId" IS NOT DISTINCT FROM $${paramIndex + 1} RETURNING *`;
     const result = await dbQuery(query, values);
     if (result.rows.length === 0) {
       return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });
@@ -152,18 +164,11 @@ export const PUT = withRateLimitTier(async (request, { params }) => {
 }, "write");
 export const DELETE = withRateLimitTier(async (request, { params }) => {
   try {
-    const authResult = await authenticateRequest(request, { requiredScope: "posts:delete" });
-    if (!authResult.success || !authResult.user) {
-      return createAuthFailureResponse(authResult);
-    }
+    const writer = await categoryWriter(request, "delete");
+    if ("response" in writer) return writer.response;
     const { id } = await params;
-    const typeCheck = await dbQuery(
-      "SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category'",
-      [id]
-    );
-    if (typeCheck.rows.length === 0) {
-      return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });
-    }
+    const row = await findCategory(id, writer);
+    if ("response" in row) return row.response;
     let usageCount = 0;
     try {
       const usageCheck = await dbQuery(
@@ -177,8 +182,8 @@ export const DELETE = withRateLimitTier(async (request, { params }) => {
     }
     if (usageCount > 0) {
       await dbQuery(
-        'UPDATE taxonomies SET "deletedAt" = now() WHERE id = $1',
-        [id]
+        'UPDATE taxonomies SET "deletedAt" = now() WHERE id = $1 AND "teamId" IS NOT DISTINCT FROM $2',
+        [id, row.teamId]
       );
       return NextResponse.json({
         success: true,
@@ -186,8 +191,8 @@ export const DELETE = withRateLimitTier(async (request, { params }) => {
       });
     } else {
       const result = await dbQuery(
-        "DELETE FROM taxonomies WHERE id = $1 RETURNING id",
-        [id]
+        'DELETE FROM taxonomies WHERE id = $1 AND "teamId" IS NOT DISTINCT FROM $2 RETURNING id',
+        [id, row.teamId]
       );
       if (result.rows.length === 0) {
         return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });

package/dist/routes/api/v1/post-categories/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/post-categories/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAyBvE,eAAO,MAAM,GAAG,iDAkBN,CAAC;AAGX,eAAO,MAAM,IAAI,iDAsEN,CAAC;AAEZ,eAAO,MAAM,OAAO,sBAAgB,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/post-categories/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AA0BvE,eAAO,MAAM,GAAG,iDAuBN,CAAC;AAGX,eAAO,MAAM,IAAI,iDAqEN,CAAC;AAEZ,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/post-categories/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { categoryReadTeam, categoryWriter } from "@nextsparkjs/core/lib/api/post-categories";
 import { query as dbQuery } from "@nextsparkjs/core/lib/db";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
@@ -17,14 +17,18 @@ const createCategorySchema = z.object({
 function generateSlug(name) {
   return name.toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
-export const GET = withRateLimitTier(async () => {
+export const GET = withRateLimitTier(async (request) => {
   try {
+    const scope = await categoryReadTeam(request);
+    if ("response" in scope) return scope.response;
     const result = await dbQuery(
       `SELECT id, name, slug, description, icon, color, "parentId", "order", "isDefault", "isActive",
               "createdAt", "updatedAt"
        FROM taxonomies
        WHERE type = 'post_category' AND "deletedAt" IS NULL AND "isActive" = true
-       ORDER BY "order" ASC, name ASC`
+         AND ("teamId" IS NULL OR "teamId" = $1)
+       ORDER BY "order" ASC, name ASC`,
+      [scope.teamId]
     );
     return NextResponse.json({
       success: true,
@@ -37,16 +41,15 @@ export const GET = withRateLimitTier(async () => {
 }, "read");
 export const POST = withRateLimitTier(async (request) => {
   try {
-    const authResult = await authenticateRequest(request, { requiredScope: "posts:write" });
-    if (!authResult.success || !authResult.user) {
-      return createAuthFailureResponse(authResult);
-    }
+    const writer = await categoryWriter(request, "create");
+    if ("response" in writer) return writer.response;
+    const teamId = writer.teamId;
     const body = await request.json();
     const data = createCategorySchema.parse(body);
     const slug = data.slug || generateSlug(data.name);
     const existing = await dbQuery(
-      "SELECT id FROM taxonomies WHERE type = 'post_category' AND slug = $1",
-      [slug]
+      `SELECT id FROM taxonomies WHERE type = 'post_category' AND slug = $1 AND "teamId" = $2`,
+      [slug, teamId]
     );
     if (existing.rows.length > 0) {
       return NextResponse.json({
@@ -57,8 +60,8 @@ export const POST = withRateLimitTier(async (request) => {
     }
     if (data.parentId) {
       const parentCheck = await dbQuery(
-        "SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category'",
-        [data.parentId]
+        `SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category' AND ("teamId" IS NULL OR "teamId" = $2)`,
+        [data.parentId, teamId]
       );
       if (parentCheck.rows.length === 0) {
         return NextResponse.json({
@@ -69,8 +72,8 @@ export const POST = withRateLimitTier(async (request) => {
     }
     const result = await dbQuery(
       `INSERT INTO taxonomies (
-        type, slug, name, description, icon, color, "parentId", "order", "isDefault", "userId"
-      ) VALUES ('post_category', $1, $2, $3, $4, $5, $6, $7, $8, $9)
+        type, slug, name, description, icon, color, "parentId", "order", "isDefault", "userId", "teamId"
+      ) VALUES ('post_category', $1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
       RETURNING *`,
       [
         slug,
@@ -81,7 +84,8 @@ export const POST = withRateLimitTier(async (request) => {
         data.parentId || null,
         data.order,
         data.isDefault,
-        authResult.user.id
+        writer.userId,
+        teamId
       ]
     );
     return NextResponse.json({ success: true, data: result.rows[0] }, { status: 201 });

package/dist/routes/api/v1/team-invitations/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/team-invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAgBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG,iDA2FL,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/team-invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAgBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG,iDAkGL,CAAC"}

package/dist/routes/api/v1/team-invitations/route.js

@@ -25,11 +25,13 @@ export const GET = withRateLimitTier(withApiLogging(async (req) => {
     }
     const userEmail = authResult.user.email;
     const { searchParams } = new URL(req.url);
-    const queryParams = {
-      page: searchParams.get("page"),
-      limit: searchParams.get("limit"),
-      status: searchParams.get("status")
-    };
+    const queryParams = Object.fromEntries(
+      Object.entries({
+        page: searchParams.get("page"),
+        limit: searchParams.get("limit"),
+        status: searchParams.get("status")
+      }).filter(([, value]) => value !== null && value !== "")
+    );
     const validatedQuery = invitationListQuerySchema.parse(queryParams);
     const { page, limit, status } = validatedQuery;
     const offset = (page - 1) * limit;
@@ -75,6 +77,11 @@ export const GET = withRateLimitTier(withApiLogging(async (req) => {
     const response = createApiResponse(invitations, paginationMeta);
     return addCorsHeaders(response, req);
   } catch (error) {
+    if (error instanceof Error && error.name === "ZodError") {
+      const zodError = error;
+      const response2 = createApiError("Validation error", 400, zodError.issues, "VALIDATION_ERROR");
+      return addCorsHeaders(response2, req);
+    }
     console.error("Error fetching invitations:", error);
     const response = createApiError("Internal server error", 500);
     return addCorsHeaders(response, req);

package/dist/routes/api/v1/teams/[teamId]/members/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/v1/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAwBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YACiC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2HlE,CAAA;AAGV,eAAO,MAAM,IAAI;YACgC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BAgMjE,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/v1/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAwBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG;YACiC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BA2HlE,CAAA;AAGV,eAAO,MAAM,IAAI;YACgC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;2BAkMjE,CAAA"}

package/dist/routes/api/v1/teams/[teamId]/members/route.js

@@ -237,18 +237,20 @@ export const POST = withRateLimitTier(withApiLogging(
           subject: emailContent.subject,
           html: emailContent.html
         });
-        console.log("\n" + "\u{1F3AB}".repeat(30));
-        console.log("\u{1F4E8} TEAM INVITATION CREATED");
-        console.log("\u{1F3AB}".repeat(30));
-        console.log(`\u{1F4E7} To: ${validatedData.email}`);
-        console.log(`\u{1F464} Invited by: ${inviterName}`);
-        console.log(`\u{1F3E2} Team: ${team.name}`);
-        console.log(`\u{1F451} Role: ${validatedData.role}`);
-        console.log(`\u{1F517} Accept URL: ${acceptUrl}`);
-        console.log("\u{1F3AB}".repeat(30) + "\n");
+        if (process.env.NODE_ENV === "development") {
+          console.log("\n" + "\u{1F3AB}".repeat(30));
+          console.log("\u{1F4E8} TEAM INVITATION CREATED");
+          console.log("\u{1F3AB}".repeat(30));
+          console.log(`\u{1F4E7} To: ${validatedData.email}`);
+          console.log(`\u{1F464} Invited by: ${inviterName}`);
+          console.log(`\u{1F3E2} Team: ${team.name}`);
+          console.log(`\u{1F451} Role: ${validatedData.role}`);
+          console.log(`\u{1F517} Accept URL: ${acceptUrl}`);
+          console.log("\u{1F3AB}".repeat(30) + "\n");
+        }
       } catch (emailError) {
         console.error("Failed to send invitation email:", emailError);
-        console.log(`\u26A0\uFE0F Email failed but invitation created. Accept URL: ${acceptUrl}`);
+        if (process.env.NODE_ENV === "development") console.log(`\u26A0\uFE0F Email failed but invitation created. Accept URL: ${acceptUrl}`);
       }
       const response = createApiResponse(invitation, { created: true }, 201);
       return addCorsHeaders(response, req);

package/dist/routes/api/v1/teams/switch/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/teams/switch/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAuBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,IAAI,iDA6EL,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/v1/teams/switch/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAuBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,IAAI,iDAkFL,CAAA"}

package/dist/routes/api/v1/teams/switch/route.js

@@ -38,7 +38,10 @@ export const POST = withRateLimitTier(withApiLogging(async (req) => {
       );
       return addCorsHeaders(response, req);
     }
-    const body = await req.json();
+    const body = await req.json().catch(() => void 0);
+    if (body === void 0) {
+      return addCorsHeaders(createApiError("Request body must be valid JSON", 400, null, "INVALID_JSON"), req);
+    }
     const validatedData = switchTeamSchema.parse(body);
     try {
       await TeamService.switchActive(authResult.user.id, validatedData.teamId);

package/dist/routes/dashboard/settings/password/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../../src/routes/dashboard/settings/password/page.tsx"],"names":[],"mappings":"AAwBA,iBAAS,kBAAkB,4CAmR1B;AAID,eAAe,kBAAkB,CAAA"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../../src/routes/dashboard/settings/password/page.tsx"],"names":[],"mappings":"AAwBA,iBAAS,kBAAkB,4CAsR1B;AAID,eAAe,kBAAkB,CAAA"}

package/dist/routes/dashboard/settings/password/page.js

@@ -9,7 +9,7 @@ import {
   CheckCircle,
   Loader2
 } from "lucide-react";
-import { useState, useCallback } from "react";
+import { useState, useCallback, useEffect } from "react";
 import { useForm } from "react-hook-form";
 import { useRouter } from "next/navigation";
 import { Button } from "@nextsparkjs/core/components/ui/button";
@@ -25,6 +25,7 @@ function UpdatePasswordPage() {
   const { hasPassword, isLoading: profileLoading } = useUserProfile();
   const router = useRouter();
   const t = useTranslations("settings");
+  const tCommon = useTranslations("common");
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState(null);
   const [success, setSuccess] = useState(false);
@@ -58,7 +59,7 @@ function UpdatePasswordPage() {
       if (!result.success) {
         const errorMsg = result.error || t("password.messages.updateError");
         setError(errorMsg);
-        setStatusMessage(`${t("common.status.error")}: ${errorMsg}`);
+        setStatusMessage(`${tCommon("status.error")}: ${errorMsg}`);
       } else {
         setSuccess(true);
         setStatusMessage(t("password.messages.updateSuccess"));
@@ -66,25 +67,22 @@ function UpdatePasswordPage() {
     } catch {
       const errorMsg = t("password.messages.unexpectedError");
       setError(errorMsg);
-      setStatusMessage(`${t("common.status.error")}: ${errorMsg}`);
+      setStatusMessage(`${tCommon("status.error")}: ${errorMsg}`);
     } finally {
       setLoading(false);
     }
-  }, [changePassword, t]);
-  if (!user) {
-    router.push("/login");
-    return null;
-  }
-  if (!profileLoading && !hasPassword) {
-    router.push("/dashboard/settings/profile");
-    return null;
-  }
+  }, [changePassword, t, tCommon]);
+  const mustRedirectToProfile = !!user && !profileLoading && !hasPassword;
+  useEffect(() => {
+    if (mustRedirectToProfile) router.push("/dashboard/settings/profile");
+  }, [mustRedirectToProfile, router]);
   if (profileLoading) {
     return /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-center py-12", children: [
       /* @__PURE__ */ jsx(Loader2, { className: "h-8 w-8 animate-spin text-muted-foreground" }),
       /* @__PURE__ */ jsx("span", { className: "sr-only", children: t("password.loading.verifying") })
     ] });
   }
+  if (!user || mustRedirectToProfile) return null;
   if (success) {
     return /* @__PURE__ */ jsxs(Fragment, { children: [
       /* @__PURE__ */ jsx(

package/dist/routes/devtools/config/page.js

@@ -4,7 +4,7 @@ import { ConfigViewer } from "@nextsparkjs/core/components/devtools/ConfigViewer
 import { Settings } from "lucide-react";
 import { getTranslations } from "next-intl/server";
 async function DevConfigPageContent() {
-  const t = await getTranslations("dev.config");
+  const t = await getTranslations("devtools.config");
   return /* @__PURE__ */ jsxs("div", { className: "space-y-6", "data-cy": "devtools-config-page", children: [
     /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3", children: [
       /* @__PURE__ */ jsx("div", { className: "flex items-center justify-center w-12 h-12 bg-violet-100 dark:bg-violet-950 rounded-lg", children: /* @__PURE__ */ jsx(Settings, { className: "h-6 w-6 text-violet-600 dark:text-violet-400" }) }),

package/dist/routes/devtools/page.js

@@ -5,7 +5,7 @@ import Link from "next/link";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@nextsparkjs/core/components/ui/card";
 import { getTranslations } from "next-intl/server";
 async function DevHomePageContent() {
-  const t = await getTranslations("dev");
+  const t = await getTranslations("devtools");
   const tCommon = await getTranslations("common");
   const sections = [
     {

package/dist/routes/devtools/scheduled-actions/page.js

@@ -26,7 +26,7 @@ async function fetchScheduledActions(filters, page, limit) {
   return response.json();
 }
 export default function ScheduledActionsPage() {
-  const t = useTranslations("dev.scheduledActions");
+  const t = useTranslations("devtools.scheduledActions");
   const [filters, setFilters] = useState({});
   const [page, setPage] = useState(1);
   const limit = 20;

package/dist/routes/devtools/tests/[[...path]]/page.js

@@ -5,7 +5,7 @@ import { FileText } from "lucide-react";
 import { getTranslations } from "next-intl/server";
 async function DevTestsPageContent({ params }) {
   const { path } = await params;
-  const t = await getTranslations("dev.tests");
+  const t = await getTranslations("devtools.tests");
   const initialPath = (path == null ? void 0 : path.join("/")) || null;
   return /* @__PURE__ */ jsxs(
     "div",

package/dist/routes/superadmin/users/page.js

@@ -39,8 +39,8 @@ import { sel } from "@nextsparkjs/core/lib/selectors";
 import { withBasePath } from "@nextsparkjs/core/lib/base-path";
 const roleOptions = [
   { value: "member", label: "Member" },
-  { value: "colaborator", label: "Colaborator" },
-  { value: "admin", label: "Admin" }
+  { value: "developer", label: "Developer" },
+  { value: "suspended", label: "Suspended" }
 ];
 const statusOptions = [
   { value: "verified", label: "Verified" },

package/dist/templates/ci-workflows/github/cypress-regression.yml

@@ -66,7 +66,7 @@ jobs:
       - name: Seed test data
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
-        run: pnpm db:seed || echo "No seed script found, skipping..."
+        run: pnpm db:seed
 
       - name: Build application
         run: pnpm build

package/dist/templates/ci-workflows/github/cypress-smoke.yml

@@ -59,7 +59,8 @@ jobs:
       - name: Setup database
         env:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
-        run: pnpm db:migrate
+        # a throwaway test database: migrations plus the sample users the tests sign in as
+        run: pnpm db:seed
 
       - name: Build application
         run: pnpm build

package/dist/templates/next.config.mjs

@@ -109,42 +109,21 @@ const nextConfig = {
     formats: ['image/avif', 'image/webp'],
     deviceSizes: [640, 750, 828, 1080, 1200, 1920],
     imageSizes: [16, 32, 48, 64, 96, 128, 256, 384],
+    // Hosts the server may fetch and resize through /_next/image.
+    // Keep this list to the exact hosts you use.
     remotePatterns: [
+      // Google profile pictures shown for accounts that sign in with Google.
       {
         protocol: 'https',
         hostname: 'lh3.googleusercontent.com',
         pathname: '/**',
       },
-      {
-        protocol: 'https',
-        hostname: '*.public.blob.vercel-storage.com',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'images.unsplash.com',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'upload.wikimedia.org',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'i.pravatar.cc',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: '*.supabase.co',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: '*.cloudinary.com',
-        pathname: '/**',
-      },
+      // Examples: add the exact host of your own store, e.g. your Vercel Blob store
+      // (`<store-id>.public.blob.vercel-storage.com`) once uploads use it.
+      // { protocol: 'https', hostname: '<store-id>.public.blob.vercel-storage.com', pathname: '/**' },
+      // { protocol: 'https', hostname: '<project-ref>.supabase.co', pathname: '/**' },
+      // { protocol: 'https', hostname: 'res.cloudinary.com', pathname: '/<cloud-name>/**' },
+      // { protocol: 'https', hostname: 'images.unsplash.com', pathname: '/**' },
     ],
   },
   // Next.js sets TURBOPACK before it loads this file whenever Turbopack builds
@@ -158,7 +137,8 @@ const nextConfig = {
   async headers() {
     const isProduction = process.env.NODE_ENV === 'production';
 
-    // Allowed image domains (must match remotePatterns above)
+    // Image hosts the browser may load directly (CSP img-src). The server only fetches the hosts in
+    // images.remotePatterns above; add a host there too when next/image should serve it.
     // NOTE: Wildcard patterns (*.public.blob.vercel-storage.com, *.supabase.co, *.cloudinary.com)
     // allow images from any account on these services for development flexibility.
     // For production with stricter security, consider restricting to specific account subdomains.

package/dist/templates/projects/blog/package.json

@@ -14,7 +14,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "next-intl": "^4.0.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",

package/dist/templates/projects/crm/package.json

@@ -13,7 +13,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "next-intl": "^4.0.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",

package/dist/templates/projects/productivity/package.json

@@ -17,7 +17,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "zod": "^4.0.0"

package/dist/templates/projects/starter/README.md

@@ -21,6 +21,8 @@ cp .env.example .env.local
 
 # Run migrations
 pnpm db:migrate
+# Local development only: also load the sample users (DevKeyring, Cypress)
+pnpm db:seed
 
 # Start development
 pnpm dev

package/dist/templates/projects/starter/config/app.config.ts

@@ -126,6 +126,14 @@ export const APP_CONFIG_OVERRIDES = {
     // methods: ['email-password', 'google'],
     // methods: ['email-otp', 'email-password', 'google'],
 
+    /**
+     * Password endpoints (sign-in/email, sign-up/email, reset). Left undeclared
+     * they follow `methods` in production (off under the passwordless preset) and
+     * stay on in development (dev keyring, `pnpm db:seed` users, Cypress).
+     * Uncomment to keep password logins in production (API clients, test users):
+     */
+    // emailAndPassword: { enabled: true },
+
     /**
      * Session duration / renewal in seconds (defaults: 7 days, renewed daily).
      * Long-lived sessions for an installed PWA, for example:

package/dist/templates/projects/starter/docs/public/01-overview/01-introduction.md

@@ -17,6 +17,8 @@ Welcome to the Starter theme for NextSpark. This minimal theme provides everythi
 3. Run migrations: `pnpm db:migrate`
 4. Start development: `pnpm dev`
 
+Sample users (DevKeyring, Cypress) are for local development only: `pnpm db:seed` loads them; `pnpm db:migrate` alone does not, and neither applies them when `NODE_ENV` is `production`.
+
 ## Project Structure
 
 ```

package/dist/templates/projects/starter/templates/dashboard/analytics/layout.tsx

@@ -0,0 +1,14 @@
+import { NextIntlClientProvider } from 'next-intl'
+import { getMessages } from 'next-intl/server'
+import { selectMessages } from '@nextsparkjs/core/lib/i18n/client-messages'
+
+// TasksChart and RecentActivity are client components that read the `analytics`
+// namespace, which the dashboard group does not carry to the browser by default.
+export default async function AnalyticsLayout({ children }: { children: React.ReactNode }) {
+  const messages = await getMessages()
+  return (
+    <NextIntlClientProvider messages={selectMessages(messages, 'dashboard', ['analytics'])}>
+      {children}
+    </NextIntlClientProvider>
+  )
+}