@nextsparkjs/core 0.1.0-beta.195 → 0.1.0-beta.197

package/dist/templates/proxy.ts

@@ -20,8 +20,8 @@
  * themselves and use only x-pathname from here, as a routing hint; the
  * identity headers are still stripped and re-set for project code.
  */
-import { betterFetch } from '@better-fetch/fetch'
 import { NextRequest, NextResponse } from 'next/server'
+import { auth } from '@nextsparkjs/core/lib/auth'
 import {
   hasProjectMiddleware,
   executeProjectMiddleware,
@@ -181,14 +181,25 @@ function redirectAccessDenied(request: NextRequest): NextResponse {
 }
 
 /**
- * The session the request's cookies carry, asked of this app's own auth route,
- * which is served under the base path like every other route.
+ * The session the request's cookies carry, read in this process the way core's
+ * server code reads it. Asking the app's own /api/auth/get-session over HTTP
+ * built the URL from the request's origin, which behind a proxy that
+ * terminates TLS (X-Forwarded-Proto: https) is https on a port that speaks
+ * plain HTTP: the fetch failed and every signed-in user was sent to /login.
+ * Nothing here leaves the process, so no forwarded scheme or host can point
+ * the check anywhere. `disableRefresh`: this response cannot carry the renewed
+ * session cookie, so the rolling renewal is left to the auth route
+ * (lib/auth/session-refresh). `disableCookieCache`: the session comes from the
+ * database, not the signed session_data cookie, so a sign-out, a revoked
+ * session or a role change counts at once (lib/auth/authorization-session).
+ * A suspended account's session is no session (lib/auth/suspension).
  */
-function getSession(request: NextRequest) {
-  return betterFetch<Session>('/api/auth/get-session', {
-    baseURL: `${request.nextUrl.origin}${request.nextUrl.basePath}`,
-    headers: { cookie: request.headers.get('cookie') || '' },
+async function getSession(request: NextRequest): Promise<Session | null> {
+  const session = await auth.api.getSession({
+    headers: new Headers({ cookie: request.headers.get('cookie') || '' }),
+    query: { disableRefresh: true, disableCookieCache: true },
   })
+  return session && (session.user as { role?: unknown }).role !== 'suspended' ? (session as Session) : null
 }
 
 /**
@@ -490,7 +501,6 @@ export async function proxy(request: NextRequest) {
   const verifiedSession = async (): Promise<Session | null> => {
     if (!sessionPromise) {
       sessionPromise = getSession(request)
-        .then(({ data }) => data)
         .catch(error => {
           sessionError = error
           return null

package/dist/templates/public/uploads/README.md

@@ -1,97 +1,8 @@
-# Media Upload System
+# Media uploads
 
-## Overview
-This application uses **Vercel Blob Storage** for all media uploads. Files are stored in the cloud, not on the local filesystem.
+`POST /api/v1/media/upload` stores files in **Vercel Blob** when `BLOB_READ_WRITE_TOKEN` is set. The media library lists the Blob URLs.
 
-> **Note:** This directory (`public/uploads/`) is legacy from a previous filesystem-based implementation and is no longer used.
+- **Development without a token:** files are written to `public/uploads/temp/` (git-ignored) so the library works offline.
+- **Production without a token:** the upload answers `503` with code `STORAGE_NOT_CONFIGURED`. Nothing is written to disk: a file under `public/` is not served until the next restart and does not survive a redeploy.
 
-## Upload Endpoint
-**POST** `/api/v1/media/upload`
-
-### Authentication
-Requires valid user session (Better Auth)
-
-### Request
-- **Content-Type**: `multipart/form-data`
-- **Field name**: `files` (accepts multiple files)
-
-### Supported File Types
-- Images: JPEG, PNG, GIF, WebP
-- Videos: MP4, MPEG, QuickTime, WebM
-
-### File Size Limit
-- Maximum: 10MB per file
-
-### Response
-```json
-{
-  "message": "Files uploaded successfully",
-  "urls": [
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_abc123.jpg",
-    "https://xxxxx.public.blob.vercel-storage.com/uploads/temp/1234567890_def456.png"
-  ],
-  "count": 2
-}
-```
-
-## File Naming Convention
-Files are automatically renamed using the pattern:
-```
-{timestamp}_{randomString}.{extension}
-```
-
-Example: `1704067200000_k9x2m4p.jpg`
-
-## Storage Location
-- **Storage Provider**: Vercel Blob (cloud object storage)
-- **Blob Path**: `uploads/temp/{filename}` (organizational prefix, not a filesystem path)
-- **Public URL**: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/{filename}`
-
-### How It Works
-
-**Local Development:**
-- Files are uploaded directly to Vercel Blob using `BLOB_READ_WRITE_TOKEN` from `.env`
-- No files are saved to your local filesystem
-- URLs point to Vercel's CDN
-
-**Production/Staging:**
-- Same behavior - files go directly to Vercel Blob
-- Uses environment-specific Blob token
-- No filesystem writes (Vercel serverless is read-only)
-
-## Usage in AI Content Generation
-The generate-content endpoint (`/api/content-buddy/generate-content`) automatically processes images for AI analysis.
-
-**Supported URL formats:**
-- Vercel Blob URLs: `https://xxxxx.public.blob.vercel-storage.com/uploads/temp/image.jpg`
-- External URLs: `https://example.com/image.jpg` (also supported)
-
-## Configuration
-Requires `BLOB_READ_WRITE_TOKEN` environment variable:
-
-```env
-BLOB_READ_WRITE_TOKEN="vercel_blob_rw_..."
-```
-
-## Cleanup
-Files are managed through Vercel Blob's retention policies.
-
-**Manual cleanup** (if needed):
-```typescript
-import { del } from '@vercel/blob'
-
-// Delete specific file
-await del(fileUrl)
-
-// Or list and delete old files
-import { list } from '@vercel/blob'
-const { blobs } = await list({ prefix: 'uploads/temp/' })
-// Filter and delete as needed
-```
-
-## Security Notes
-- All uploads require authentication
-- File type validation prevents malicious uploads
-- File size limits prevent DoS attacks
-- Random filenames prevent enumeration attacks
-- Files stored in secure Vercel Blob infrastructure
+Self-hosting needs a storage provider: set `BLOB_READ_WRITE_TOKEN` (a Vercel Blob token, starts with `vercel_blob_`). See the media library docs.

package/migrations/029_sample_accounts_outside_development.sql

@@ -0,0 +1,55 @@
+-- Migration: 029_sample_accounts_outside_development.sql
+-- Description: sample accounts keep no usable credentials outside development
+--
+-- Sample data (090_sample_data.sql and the projects' *sample_data* files) is
+-- only applied by an explicit development opt-in (`nextspark db:seed`,
+-- `--sample-data` or NEXTSPARK_SEED_SAMPLE_DATA=1). Databases migrated before
+-- that may still hold the sample accounts. This migration finds them by the
+-- sample password, never by name, so a renamed account is found and an account
+-- whose password was changed is left alone; for each one it:
+--   - removes the sample password (its "credential" account row),
+--   - removes its sessions,
+--   - deactivates its API keys (status 'inactive'; deleting them would delete
+--     their api_audit_log rows),
+--   - sets its global role to 'member' (027's trigger then removes it from the
+--     System Admin Team, as for any user who loses that role).
+-- It also removes the sample sessions and deactivates the sample API key by
+-- their fixed values, whoever owns them now. Nothing else is changed.
+--
+-- It runs once, everywhere, except in a development run that opted into sample
+-- data (the runner sets nextspark.seed_sample_data to 'on' then), where those
+-- accounts are wanted. To keep using one of them deliberately, give it a new
+-- password before upgrading; to restore one afterwards, set its role back and
+-- reset its password.
+
+DO $$
+DECLARE
+  sample_passwords CONSTANT TEXT[] := ARRAY[
+    '22de14d5472248ed0bece911df908b2a:d29576424798ba6845d348a3767c0b0f38a00f2aca461b3b1d34b99a93cab06c86774c6edb183e6d6ec47457649b032a49a7b60a48f6f4f7fbbc4ea40258f19f',
+    '3db9e98e2b4d3caca97fdf2783791cbc:34b293de615caf277a237773208858e960ea8aa10f1f5c5c309b632f192cac34d52ceafbd338385616f4929e4b1b6c055b67429c6722ffdb80b01d9bf4764866'
+  ];
+  sample_session_tokens CONSTANT TEXT[] := ARRAY['tmt_superadmin_session_token_001', 'tmt_developer_session_token_001'];
+  sample_key_hashes CONSTANT TEXT[] := ARRAY[
+    '205f13ae4d2e18df417e61123bb84030c124fcb5013699046379ae1b5ec04324',
+    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+  ];
+  sample_users TEXT[];
+BEGIN
+  IF current_setting('nextspark.seed_sample_data', true) = 'on' THEN
+    RAISE NOTICE 'Sample accounts: kept (development run with sample data).';
+    RETURN;
+  END IF;
+
+  SELECT COALESCE(array_agg(DISTINCT "userId"), '{}') INTO sample_users
+  FROM "account"
+  WHERE "providerId" = 'credential' AND "password" = ANY (sample_passwords);
+
+  DELETE FROM "account" WHERE "providerId" = 'credential' AND "password" = ANY (sample_passwords);
+  DELETE FROM "session" WHERE "userId" = ANY (sample_users) OR token = ANY (sample_session_tokens);
+  UPDATE "api_key" SET status = 'inactive', "updatedAt" = now()
+  WHERE status IS DISTINCT FROM 'inactive' AND ("userId" = ANY (sample_users) OR "keyHash" = ANY (sample_key_hashes));
+  UPDATE "users" SET role = 'member', "updatedAt" = now()
+  WHERE id = ANY (sample_users) AND role <> 'member';
+
+  RAISE NOTICE 'Sample accounts: % disabled (no password, sessions or active API keys; role member).', cardinality(sample_users);
+END $$;

package/migrations/030_taxonomies_team_writes.sql

@@ -0,0 +1,29 @@
+-- Migration: 030_taxonomies_team_writes.sql
+-- Description: Taxonomy rows are written by members of their team; rows without a team only by a superadmin.
+--
+-- 021 let any authenticated user write a taxonomy row with "teamId" IS NULL. Post categories are now created in
+-- the caller's team (lib/api/post-categories.ts), and the rows without a team that earlier releases created stay
+-- readable by everyone but are changed only by a superadmin. This policy says the same on the RLS-enforced
+-- connection: reads are as before, writes need the row's team (or is_superadmin()).
+-- is_superadmin() also accepts a developer enrolled in the System Admin Team; the API (lib/api/post-categories.ts) is
+-- stricter and lets only users.role = 'superadmin' change a row without a team.
+-- Idempotent; the anon read policy from 006 is unchanged.
+
+DROP POLICY IF EXISTS "taxonomies auth can do all" ON public.taxonomies;
+DROP POLICY IF EXISTS "taxonomies auth can select" ON public.taxonomies;
+DROP POLICY IF EXISTS "taxonomies team can write" ON public.taxonomies;
+
+CREATE POLICY "taxonomies auth can select"
+ON public.taxonomies
+FOR SELECT TO authenticated
+USING (
+  "teamId" IS NULL
+  OR "teamId" = ANY(public.get_user_team_ids())
+  OR public.is_superadmin()
+);
+
+CREATE POLICY "taxonomies team can write"
+ON public.taxonomies
+FOR ALL TO authenticated
+USING ("teamId" = ANY(public.get_user_team_ids()) OR public.is_superadmin())
+WITH CHECK ("teamId" = ANY(public.get_user_team_ids()) OR public.is_superadmin());

package/migrations/031_users_role_suspended.sql

@@ -0,0 +1,41 @@
+-- Migration: 031_users_role_suspended.sql
+-- Description: users.role accepts 'suspended' (lib/auth/suspension.ts).
+--
+-- The superadmin "suspend" action sets users.role = 'suspended', which check_users_role (002: member, superadmin,
+-- developer) refused. This adds 'suspended' to the roles the constraint already accepts and keeps every other one,
+-- including roles a project added to it. Idempotent: a constraint that already accepts 'suspended' is left alone. A
+-- constraint that is not a plain list of roles is left alone too, with a notice (add 'suspended' to it yourself).
+
+DO $$
+DECLARE
+  def   TEXT;
+  roles TEXT[];
+BEGIN
+  SELECT pg_get_constraintdef(c.oid) INTO def
+  FROM pg_constraint c
+  WHERE c.conrelid = 'public.users'::regclass AND c.conname = 'check_users_role';
+
+  IF def IS NULL THEN
+    ALTER TABLE public."users" ADD CONSTRAINT check_users_role
+      CHECK ("role" IN ('member', 'superadmin', 'developer', 'suspended'));
+    RETURN;
+  END IF;
+
+  IF def ~ '\msuspended\M' THEN
+    RETURN;
+  END IF;
+
+  -- "role" IN (...) is stored as: CHECK ((role = ANY (ARRAY['member'::text, ...])))
+  IF def !~ '^CHECK \(\(+"?role"?\)?(::text)? = ANY \(\(?ARRAY\[' THEN
+    RAISE NOTICE 'check_users_role is not a plain list of roles (%); add ''suspended'' to it to use the suspend action', def;
+    RETURN;
+  END IF;
+
+  SELECT array_agg(m[1]) INTO roles FROM regexp_matches(def, '''([^'']+)''', 'g') AS m;
+
+  ALTER TABLE public."users" DROP CONSTRAINT check_users_role;
+  EXECUTE format(
+    'ALTER TABLE public."users" ADD CONSTRAINT check_users_role CHECK ("role" IN (%s))',
+    (SELECT string_agg(quote_literal(r), ', ') FROM unnest(array_append(roles, 'suspended')) AS r)
+  );
+END $$;

package/migrations/090_sample_data.sql

@@ -7,6 +7,16 @@
 -- Theme-specific demo data (TMT.dev users, companies, invoices) is in:
 -- migrations/090_demo_users_teams.sql
 
+-- Only a development run that asked for sample data applies this file (see
+-- scripts/db/sample-data.mjs); anything else that runs it, such as a tool that
+-- applies every core .sql file in order, fails here instead of creating these accounts.
+DO $$
+BEGIN
+  IF current_setting('nextspark.seed_sample_data', true) IS DISTINCT FROM 'on' THEN
+    RAISE EXCEPTION 'Sample data is applied only by `pnpm db:seed` (or NEXTSPARK_SEED_SAMPLE_DATA=1) outside production. If you ran that, the session setting it relies on was lost: a transaction-mode pooler (PgBouncer, Supavisor on port 6543) drops it, so point MIGRATE_DATABASE_URL at a direct connection.';
+  END IF;
+END $$;
+
 -- ============================================
 -- STEP 1: CREATE CORE TEST USERS
 -- ============================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.195",
+  "version": "0.1.0-beta.197",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -390,7 +390,7 @@
     "scripts"
   ],
   "peerDependencies": {
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "react": "^19.2.0",
     "react-dom": "^19.2.0"
   },
@@ -496,7 +496,7 @@
     "use-intl": "^4.9.1",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@nextsparkjs/ui": "0.1.0-beta.195"
+    "@nextsparkjs/ui": "0.1.0-beta.197"
   },
   "engines": {
     "node": ">=22.14.0"

package/scripts/build/registry/__tests__/build-output.test.mjs

@@ -29,7 +29,7 @@ const RAW_CONTROL = /[\u0000-\u0009\u000b-\u001f\u007f-\u009f\u061c\u200e\u200f\
 async function createProject(parent = tmpdir(), name = 'nextspark-build-output-test-') {
   const root = await mkdtemp(join(parent, name))
   await writeFile(join(root, 'nextspark.config.ts'), 'export default {}\n')
-  await writeFile(join(root, 'package.json'), '{"dependencies":{"next":"16.3.6"}}')
+  await writeFile(join(root, 'package.json'), '{"dependencies":{"next":"16.3.8"}}')
   await mkdir(join(root, 'src', 'app'), { recursive: true })
   return root
 }

package/scripts/build/registry/__tests__/project-mode-root-first.test.mjs

@@ -17,7 +17,7 @@ async function project(files = {}) {
 
 test('the nearest nextspark.config.ts owns every project source path', async () => {
   const root = await project({
-    'package.json': JSON.stringify({ dependencies: { next: '16.3.6' } }),
+    'package.json': JSON.stringify({ dependencies: { next: '16.3.8' } }),
     'nextspark.config.ts': 'export default {}\n',
   })
   const nested = join(root, 'entities', 'tasks')
@@ -40,7 +40,7 @@ test('the nearest nextspark.config.ts owns every project source path', async ()
 
 test('a next.config file cannot select a project without nextspark.config.ts', async () => {
   const root = await project({
-    'package.json': JSON.stringify({ dependencies: { next: '16.3.6' } }),
+    'package.json': JSON.stringify({ dependencies: { next: '16.3.8' } }),
     'next.config.mjs': 'export default {}\n',
   })
   try {
@@ -66,7 +66,7 @@ test('an enabled packaged plugin resolves through the project dependency tree',
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.6',
+        next: '16.3.8',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -98,7 +98,7 @@ test('an enabled packaged plugin that is not installed fails with an actionable
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.6',
+        next: '16.3.8',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -119,7 +119,7 @@ test('a packaged plugin cannot use a path segment as its logical name', async ()
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.6',
+        next: '16.3.8',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -146,7 +146,7 @@ test('a local plugin shadows an installed packaged plugin with the same NextSpar
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.6',
+        next: '16.3.8',
         '@example/plugin-search': '1.0.0',
       },
     }),

package/scripts/build/registry/__tests__/write-places.test.mjs

@@ -269,7 +269,7 @@ async function snapshot(root) {
 async function buildableProject() {
   const project = await directory()
   await writeIn(project.root, 'nextspark.config.ts', 'export default {}\n')
-  await writeIn(project.root, 'package.json', '{"dependencies":{"next":"16.3.6"}}')
+  await writeIn(project.root, 'package.json', '{"dependencies":{"next":"16.3.8"}}')
   await writeIn(project.root, 'templates/pricing/page.tsx', 'export default function Pricing() { return null }\n')
   return project
 }

package/scripts/build/registry/contracts/__tests__/contracts-wire.test.mjs

@@ -22,7 +22,7 @@ async function planFor(files) {
   const root = temp()
   try {
     write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-    write(root, 'package.json', JSON.stringify({ name: 'wire', dependencies: { next: '16.3.6' } }))
+    write(root, 'package.json', JSON.stringify({ name: 'wire', dependencies: { next: '16.3.8' } }))
     write(root, 'config/theme.config.ts', "export const wireThemeConfig = { name: 'wire' }\n")
     for (const [path, content] of Object.entries(files)) write(root, path, content)
     const entities = await discoverAllEntities(getConfig(root), { includeCore: false })

package/scripts/build/registry/contracts/__tests__/contracts.test.mjs

@@ -73,7 +73,7 @@ const NOTES_CONFIG = `export const noteEntityConfig = {
 function project(extra = {}) {
   const root = temp()
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'contracts-project', dependencies: { next: '16.3.6' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'contracts-project', dependencies: { next: '16.3.8' } }))
   write(root, 'config/theme.config.ts', "export const contractsThemeConfig = { name: 'contracts' }\n")
   write(root, 'entities/tasks/tasks.config.ts', TASKS_CONFIG)
   write(root, 'entities/tasks/tasks.fields.ts', FIELDS)

package/scripts/build/registry/host/README.md

@@ -28,7 +28,7 @@ const { target, content } = await emitFacade({
 Every problem is a `FacadeEmitError` carrying all diagnostics (`code`, `file`, `line`, `exportName`,
 `message`); nothing is dropped silently.
 
-## Export table (Next.js 16.3.6)
+## Export table (Next.js 16.3.8)
 
 Source of truth: `next-route-exports.json`. The tests fail when the installed Next.js version differs,
 when Next's `AppSegmentConfigSchemaKeys` or `HTTP_METHODS` change, and when this rendering is stale.
@@ -71,7 +71,7 @@ export { listSlugs as generateStaticParams }
 Metadata image kinds accept Next's one-digit variants (`icon1`, `apple-icon9`, `opengraph-image2`,
 `twitter-image3`), mapped to the base kind.
 
-The emitter resolves `next/package.json` once (project first, then core) and accepts only `~16.3.6`: the table's
+The emitter resolves `next/package.json` once (project first, then core) and accepts only `~16.3.8`: the table's
 `next` is the verified baseline, and any stable 16.3.x patch at or above it is accepted, while other minors/majors,
 lower patches and prereleases are refused (`NS_HOST_UNSUPPORTED_NEXT_VERSION`). It loads Next's segment config
 schema from that same package root.

package/scripts/build/registry/host/__tests__/facade-emitter.test.mjs

@@ -124,11 +124,12 @@ test("page and layout exports include Next.js's TS-plugin ALLOWED_EXPORTS (excep
   }
 })
 
-test('metadata route loader still filters dynamicParams/generateSitemaps out of its re-exports', async () => {
-  // The table forbids dynamicParams and generateStaticParams on metadata routes because the
-  // loader either drops them or declares its own; detect a Next.js change to that code.
+test('metadata route loader still filters generateSitemaps out of its re-exports', async () => {
+  // The table forbids dynamicParams and generateStaticParams on metadata routes: the loader
+  // declares its own generateStaticParams, and up to 16.3.7 it dropped dynamicParams (16.3.8
+  // re-exports it; the table keeps refusing it). Detect a Next.js change to that code.
   const loader = await readFile(requireFromCore.resolve('next/dist/build/webpack/loaders/next-metadata-route-loader'), 'utf8')
-  assert.match(loader, /name !== 'default' && name !== 'generateSitemaps' && name !== 'dynamicParams'/)
+  assert.match(loader, /exportNames\.filter\(\(name\)=>name !== 'default' && name !== 'generateSitemaps'\);/)
   assert.match(loader, /export async function generateStaticParams/)
 })
 
@@ -595,14 +596,14 @@ test('an aliased magic export is forwarded under its source local name', async (
   assert.match(content, /^export \{ listSlugs as generateStaticParams \}$/m)
 })
 
-// --- fix round 3: ~baseline version range (baseline 16.3.6 since 0.1.0-beta.194) ---
+// --- fix round 3: ~baseline version range (baseline 16.3.8 since 0.1.0-beta.197) ---
 
 test('isSupportedNextVersion accepts ~baseline: same minor, stable patch >= baseline', () => {
-  assert.equal(ROUTE_EXPORT_TABLE.next, '16.3.6')
-  for (const version of ['16.3.6', '16.3.7', '16.3.9', '16.3.10', '16.3.123', '16.3.6+build.1', '16.3.7+sha.abc-1']) assert.equal(isSupportedNextVersion(version), true, version)
+  assert.equal(ROUTE_EXPORT_TABLE.next, '16.3.8')
+  for (const version of ['16.3.8', '16.3.9', '16.3.10', '16.3.123', '16.3.8+build.1', '16.3.9+sha.abc-1']) assert.equal(isSupportedNextVersion(version), true, version)
   for (const version of [
-    '16.3.5', '16.3.4', '16.3.0', '16.4.0', '16.2.9', '17.0.0', '15.3.6', '16.3.7-canary.0', '16.3.6-rc.1', '16.3.7-canary.0+build.1',
-    '16.3.5+build.1', '16.3.6+', '16.3.6+bad..meta', '16.3', 'latest', '', undefined,
+    '16.3.7', '16.3.6', '16.3.5', '16.3.4', '16.3.0', '16.4.0', '16.2.9', '17.0.0', '15.3.6', '16.3.7-canary.0', '16.3.8-rc.1', '16.3.7-canary.0+build.1',
+    '16.3.5+build.1', '16.3.8+', '16.3.8+bad..meta', '16.3', 'latest', '', undefined,
   ]) {
     assert.equal(isSupportedNextVersion(version), false, String(version))
   }
@@ -625,7 +626,7 @@ test('a later 16.3 patch is accepted and its own schema internal is used', async
   }
 })
 
-for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
+for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.8-canary.0']) {
   test(`${DIAGNOSTICS.UNSUPPORTED_NEXT_VERSION}: next@${version} is refused`, async () => {
     const dir = await fakeNextProject(version, "exports.AppSegmentConfigSchemaKeys = []\nexports.parseAppSegmentConfig = () => ({})\n")
     try {
@@ -634,7 +635,7 @@ for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
         error => {
           assert.deepEqual(error.diagnostics.map(d => d.code), [DIAGNOSTICS.UNSUPPORTED_NEXT_VERSION])
           assert.match(error.message, new RegExp(`next@${version.replace(/\./g, '\\.')}`))
-          assert.match(error.message, /next@~16\.3\.6/)
+          assert.match(error.message, /next@~16\.3\.8/)
           return true
         }
       )
@@ -646,9 +647,9 @@ for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
 
 // --- fix round 4: build metadata ----------------------------------------------
 
-test('a Next.js version with build metadata (16.3.6+build.1) is accepted end to end', async () => {
+test('a Next.js version with build metadata (16.3.8+build.1) is accepted end to end', async () => {
   const marker = "exports.AppSegmentConfigSchemaKeys = []\nexports.parseAppSegmentConfig = () => ({})\n"
-  const dir = await fakeNextProject('16.3.6+build.1', marker)
+  const dir = await fakeNextProject('16.3.8+build.1', marker)
   try {
     assert.equal(loadNextSegmentConfig(dir).error, undefined)
     const { content } = await emitFacade({ kind: 'page', target: 'a/page.tsx', specifier: '@/a', file: FILE, source: PAGE_WITH_CONFIG, projectRoot: dir })

package/scripts/build/registry/host/__tests__/host-mode.test.mjs

@@ -17,7 +17,7 @@ const PREPARE_CLI = join(CORE_ROOT, 'scripts/build/registry/host/prepare-cli.mjs
 function project({ legacyApp = false } = {}) {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-mode-'))
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'host-mode', dependencies: { next: '16.3.6' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'host-mode', dependencies: { next: '16.3.8' } }))
   write(root, 'templates/pricing/page.tsx', PAGE('Pricing'))
   if (legacyApp) write(root, 'src/app/layout.tsx', 'export default function Layout({ children }) { return children }\n')
   return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) }

package/scripts/build/registry/host/__tests__/host-project-composition.test.mjs

@@ -36,7 +36,7 @@ const LAYOUT = 'export default function Layout({ children }: { children: React.R
 function project(extra = {}) {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-composition-'))
   write(root, 'nextspark.config.ts', "export default { plugins: [], billing: { webhookExtensions: { stripe: './lib/billing/stripe-webhook-extensions' } } }\n")
-  write(root, 'package.json', JSON.stringify({ name: 'composition', dependencies: { next: '16.3.6' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'composition', dependencies: { next: '16.3.8' } }))
   write(root, 'config/theme.config.ts', "export const compositionThemeConfig = { name: 'composition' }\n")
   write(root, 'styles/globals.css', '@import "tailwindcss";\n')
   write(root, 'lib/billing/stripe-webhook-extensions.ts', 'export const stripeWebhookExtensions = {}\n')

package/scripts/build/registry/host/__tests__/host-project.test.mjs

@@ -16,7 +16,7 @@ const PREPARE_CLI = join(CORE_ROOT, 'scripts/build/registry/host/prepare-cli.mjs
 function project() {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-project-'))
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'host-project', dependencies: { next: '16.3.6' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'host-project', dependencies: { next: '16.3.8' } }))
   write(root, 'templates/pricing/page.tsx', PAGE('Pricing'))
   write(root, 'api/ping/route.ts', ROUTE)
   return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) }
@@ -41,7 +41,7 @@ test('a real project: the registry build is staged and published with the host,
 
     const record = readGeneration(root)
     assert.equal(Object.keys(record.files).length, first.files.length)
-    assert.ok(record.versions.core && record.versions.next === '16.3.6')
+    assert.ok(record.versions.core && record.versions.next === '16.3.8')
     assert.ok(record.inputs.files['nextspark.config.ts'] && record.inputs.files['templates/pricing/page.tsx'])
     assert.deepEqual(await checkHost(config), { ok: true, problems: [] })