@nextsparkjs/core 0.1.0-beta.196 → 0.1.0-beta.197

package/dist/routes/api/v1/post-categories/[id]/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { categoryReadTeam, categoryWriter } from "@nextsparkjs/core/lib/api/post-categories";
 import { query as dbQuery } from "@nextsparkjs/core/lib/db";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
@@ -15,15 +15,33 @@ const updateCategorySchema = z.object({
   isDefault: z.boolean().optional(),
   isActive: z.boolean().optional()
 });
+async function findCategory(id, writer) {
+  const found = await dbQuery(
+    `SELECT "teamId" FROM taxonomies WHERE id = $1 AND type = 'post_category' AND ("teamId" IS NULL OR "teamId" = $2)`,
+    [id, writer.teamId]
+  );
+  if (found.rows.length === 0) {
+    return { response: NextResponse.json({ success: false, error: "Category not found" }, { status: 404 }) };
+  }
+  if (found.rows[0].teamId === null && !writer.superadmin) {
+    return { response: NextResponse.json(
+      { success: false, error: "Only a superadmin can change a category shared by every team", code: "PERMISSION_DENIED" },
+      { status: 403 }
+    ) };
+  }
+  return found.rows[0];
+}
 export const GET = withRateLimitTier(async (request, { params }) => {
   try {
     const { id } = await params;
+    const scope = await categoryReadTeam(request);
+    if ("response" in scope) return scope.response;
     const result = await dbQuery(
       `SELECT id, name, slug, description, icon, color, "parentId", "order", "isDefault", "isActive",
               "createdAt", "updatedAt"
        FROM taxonomies
-       WHERE id = $1 AND type = 'post_category' AND "deletedAt" IS NULL`,
-      [id]
+       WHERE id = $1 AND type = 'post_category' AND "deletedAt" IS NULL AND ("teamId" IS NULL OR "teamId" = $2)`,
+      [id, scope.teamId]
     );
     if (result.rows.length === 0) {
       return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });
@@ -39,24 +57,17 @@ export const GET = withRateLimitTier(async (request, { params }) => {
 }, "read");
 export const PUT = withRateLimitTier(async (request, { params }) => {
   try {
-    const authResult = await authenticateRequest(request, { requiredScope: "posts:write" });
-    if (!authResult.success || !authResult.user) {
-      return createAuthFailureResponse(authResult);
-    }
+    const writer = await categoryWriter(request, "update");
+    if ("response" in writer) return writer.response;
     const body = await request.json();
     const data = updateCategorySchema.parse(body);
     const { id } = await params;
-    const typeCheck = await dbQuery(
-      "SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category'",
-      [id]
-    );
-    if (typeCheck.rows.length === 0) {
-      return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });
-    }
+    const row = await findCategory(id, writer);
+    if ("response" in row) return row.response;
     if (data.slug) {
       const slugCheck = await dbQuery(
-        "SELECT id FROM taxonomies WHERE type = 'post_category' AND slug = $1 AND id != $2",
-        [data.slug, id]
+        `SELECT id FROM taxonomies WHERE type = 'post_category' AND slug = $1 AND id != $2 AND "teamId" IS NOT DISTINCT FROM $3`,
+        [data.slug, id, row.teamId]
       );
       if (slugCheck.rows.length > 0) {
         return NextResponse.json(
@@ -67,8 +78,8 @@ export const PUT = withRateLimitTier(async (request, { params }) => {
     }
     if (data.parentId) {
       const parentCheck = await dbQuery(
-        "SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category'",
-        [data.parentId]
+        `SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category' AND ("teamId" IS NULL OR "teamId" IS NOT DISTINCT FROM $2)`,
+        [data.parentId, row.teamId]
       );
       if (parentCheck.rows.length === 0) {
         return NextResponse.json({
@@ -132,7 +143,8 @@ export const PUT = withRateLimitTier(async (request, { params }) => {
       return NextResponse.json({ success: true, data: current.rows[0] });
     }
     values.push(id);
-    const query = `UPDATE taxonomies SET ${updates.join(", ")} WHERE id = $${paramIndex} RETURNING *`;
+    values.push(row.teamId);
+    const query = `UPDATE taxonomies SET ${updates.join(", ")} WHERE id = $${paramIndex} AND "teamId" IS NOT DISTINCT FROM $${paramIndex + 1} RETURNING *`;
     const result = await dbQuery(query, values);
     if (result.rows.length === 0) {
       return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });
@@ -152,18 +164,11 @@ export const PUT = withRateLimitTier(async (request, { params }) => {
 }, "write");
 export const DELETE = withRateLimitTier(async (request, { params }) => {
   try {
-    const authResult = await authenticateRequest(request, { requiredScope: "posts:delete" });
-    if (!authResult.success || !authResult.user) {
-      return createAuthFailureResponse(authResult);
-    }
+    const writer = await categoryWriter(request, "delete");
+    if ("response" in writer) return writer.response;
     const { id } = await params;
-    const typeCheck = await dbQuery(
-      "SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category'",
-      [id]
-    );
-    if (typeCheck.rows.length === 0) {
-      return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });
-    }
+    const row = await findCategory(id, writer);
+    if ("response" in row) return row.response;
     let usageCount = 0;
     try {
       const usageCheck = await dbQuery(
@@ -177,8 +182,8 @@ export const DELETE = withRateLimitTier(async (request, { params }) => {
     }
     if (usageCount > 0) {
       await dbQuery(
-        'UPDATE taxonomies SET "deletedAt" = now() WHERE id = $1',
-        [id]
+        'UPDATE taxonomies SET "deletedAt" = now() WHERE id = $1 AND "teamId" IS NOT DISTINCT FROM $2',
+        [id, row.teamId]
       );
       return NextResponse.json({
         success: true,
@@ -186,8 +191,8 @@ export const DELETE = withRateLimitTier(async (request, { params }) => {
       });
     } else {
       const result = await dbQuery(
-        "DELETE FROM taxonomies WHERE id = $1 RETURNING id",
-        [id]
+        'DELETE FROM taxonomies WHERE id = $1 AND "teamId" IS NOT DISTINCT FROM $2 RETURNING id',
+        [id, row.teamId]
       );
       if (result.rows.length === 0) {
         return NextResponse.json({ success: false, error: "Category not found" }, { status: 404 });

package/dist/routes/api/v1/post-categories/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/post-categories/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AAyBvE,eAAO,MAAM,GAAG,iDAkBN,CAAC;AAGX,eAAO,MAAM,IAAI,iDAsEN,CAAC;AAEZ,eAAO,MAAM,OAAO,sBAAgB,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/post-categories/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AA0BvE,eAAO,MAAM,GAAG,iDAuBN,CAAC;AAGX,eAAO,MAAM,IAAI,iDAqEN,CAAC;AAEZ,eAAO,MAAM,OAAO,sBAAgB,CAAA"}

package/dist/routes/api/v1/post-categories/route.js

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { authenticateRequest, createAuthFailureResponse } from "@nextsparkjs/core/lib/api/auth/dual-auth";
+import { categoryReadTeam, categoryWriter } from "@nextsparkjs/core/lib/api/post-categories";
 import { query as dbQuery } from "@nextsparkjs/core/lib/db";
 import * as z from "zod";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
@@ -17,14 +17,18 @@ const createCategorySchema = z.object({
 function generateSlug(name) {
   return name.toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
-export const GET = withRateLimitTier(async () => {
+export const GET = withRateLimitTier(async (request) => {
   try {
+    const scope = await categoryReadTeam(request);
+    if ("response" in scope) return scope.response;
     const result = await dbQuery(
       `SELECT id, name, slug, description, icon, color, "parentId", "order", "isDefault", "isActive",
               "createdAt", "updatedAt"
        FROM taxonomies
        WHERE type = 'post_category' AND "deletedAt" IS NULL AND "isActive" = true
-       ORDER BY "order" ASC, name ASC`
+         AND ("teamId" IS NULL OR "teamId" = $1)
+       ORDER BY "order" ASC, name ASC`,
+      [scope.teamId]
     );
     return NextResponse.json({
       success: true,
@@ -37,16 +41,15 @@ export const GET = withRateLimitTier(async () => {
 }, "read");
 export const POST = withRateLimitTier(async (request) => {
   try {
-    const authResult = await authenticateRequest(request, { requiredScope: "posts:write" });
-    if (!authResult.success || !authResult.user) {
-      return createAuthFailureResponse(authResult);
-    }
+    const writer = await categoryWriter(request, "create");
+    if ("response" in writer) return writer.response;
+    const teamId = writer.teamId;
     const body = await request.json();
     const data = createCategorySchema.parse(body);
     const slug = data.slug || generateSlug(data.name);
     const existing = await dbQuery(
-      "SELECT id FROM taxonomies WHERE type = 'post_category' AND slug = $1",
-      [slug]
+      `SELECT id FROM taxonomies WHERE type = 'post_category' AND slug = $1 AND "teamId" = $2`,
+      [slug, teamId]
     );
     if (existing.rows.length > 0) {
       return NextResponse.json({
@@ -57,8 +60,8 @@ export const POST = withRateLimitTier(async (request) => {
     }
     if (data.parentId) {
       const parentCheck = await dbQuery(
-        "SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category'",
-        [data.parentId]
+        `SELECT id FROM taxonomies WHERE id = $1 AND type = 'post_category' AND ("teamId" IS NULL OR "teamId" = $2)`,
+        [data.parentId, teamId]
       );
       if (parentCheck.rows.length === 0) {
         return NextResponse.json({
@@ -69,8 +72,8 @@ export const POST = withRateLimitTier(async (request) => {
     }
     const result = await dbQuery(
       `INSERT INTO taxonomies (
-        type, slug, name, description, icon, color, "parentId", "order", "isDefault", "userId"
-      ) VALUES ('post_category', $1, $2, $3, $4, $5, $6, $7, $8, $9)
+        type, slug, name, description, icon, color, "parentId", "order", "isDefault", "userId", "teamId"
+      ) VALUES ('post_category', $1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
       RETURNING *`,
       [
         slug,
@@ -81,7 +84,8 @@ export const POST = withRateLimitTier(async (request) => {
         data.parentId || null,
         data.order,
         data.isDefault,
-        authResult.user.id
+        writer.userId,
+        teamId
       ]
     );
     return NextResponse.json({ success: true, data: result.rows[0] }, { status: 201 });

package/dist/routes/api/v1/team-invitations/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/team-invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAgBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG,iDA2FL,CAAC"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/v1/team-invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAgBvD,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,kCAEjD;AAGD,eAAO,MAAM,GAAG,iDAkGL,CAAC"}

package/dist/routes/api/v1/team-invitations/route.js

@@ -25,11 +25,13 @@ export const GET = withRateLimitTier(withApiLogging(async (req) => {
     }
     const userEmail = authResult.user.email;
     const { searchParams } = new URL(req.url);
-    const queryParams = {
-      page: searchParams.get("page"),
-      limit: searchParams.get("limit"),
-      status: searchParams.get("status")
-    };
+    const queryParams = Object.fromEntries(
+      Object.entries({
+        page: searchParams.get("page"),
+        limit: searchParams.get("limit"),
+        status: searchParams.get("status")
+      }).filter(([, value]) => value !== null && value !== "")
+    );
     const validatedQuery = invitationListQuerySchema.parse(queryParams);
     const { page, limit, status } = validatedQuery;
     const offset = (page - 1) * limit;
@@ -75,6 +77,11 @@ export const GET = withRateLimitTier(withApiLogging(async (req) => {
     const response = createApiResponse(invitations, paginationMeta);
     return addCorsHeaders(response, req);
   } catch (error) {
+    if (error instanceof Error && error.name === "ZodError") {
+      const zodError = error;
+      const response2 = createApiError("Validation error", 400, zodError.issues, "VALIDATION_ERROR");
+      return addCorsHeaders(response2, req);
+    }
     console.error("Error fetching invitations:", error);
     const response = createApiError("Internal server error", 500);
     return addCorsHeaders(response, req);

package/dist/routes/superadmin/users/page.js

@@ -39,8 +39,8 @@ import { sel } from "@nextsparkjs/core/lib/selectors";
 import { withBasePath } from "@nextsparkjs/core/lib/base-path";
 const roleOptions = [
   { value: "member", label: "Member" },
-  { value: "colaborator", label: "Colaborator" },
-  { value: "admin", label: "Admin" }
+  { value: "developer", label: "Developer" },
+  { value: "suspended", label: "Suspended" }
 ];
 const statusOptions = [
   { value: "verified", label: "Verified" },

package/dist/templates/next.config.mjs

@@ -109,42 +109,21 @@ const nextConfig = {
     formats: ['image/avif', 'image/webp'],
     deviceSizes: [640, 750, 828, 1080, 1200, 1920],
     imageSizes: [16, 32, 48, 64, 96, 128, 256, 384],
+    // Hosts the server may fetch and resize through /_next/image.
+    // Keep this list to the exact hosts you use.
     remotePatterns: [
+      // Google profile pictures shown for accounts that sign in with Google.
       {
         protocol: 'https',
         hostname: 'lh3.googleusercontent.com',
         pathname: '/**',
       },
-      {
-        protocol: 'https',
-        hostname: '*.public.blob.vercel-storage.com',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'images.unsplash.com',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'upload.wikimedia.org',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'i.pravatar.cc',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: '*.supabase.co',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: '*.cloudinary.com',
-        pathname: '/**',
-      },
+      // Examples: add the exact host of your own store, e.g. your Vercel Blob store
+      // (`<store-id>.public.blob.vercel-storage.com`) once uploads use it.
+      // { protocol: 'https', hostname: '<store-id>.public.blob.vercel-storage.com', pathname: '/**' },
+      // { protocol: 'https', hostname: '<project-ref>.supabase.co', pathname: '/**' },
+      // { protocol: 'https', hostname: 'res.cloudinary.com', pathname: '/<cloud-name>/**' },
+      // { protocol: 'https', hostname: 'images.unsplash.com', pathname: '/**' },
     ],
   },
   // Next.js sets TURBOPACK before it loads this file whenever Turbopack builds
@@ -158,7 +137,8 @@ const nextConfig = {
   async headers() {
     const isProduction = process.env.NODE_ENV === 'production';
 
-    // Allowed image domains (must match remotePatterns above)
+    // Image hosts the browser may load directly (CSP img-src). The server only fetches the hosts in
+    // images.remotePatterns above; add a host there too when next/image should serve it.
     // NOTE: Wildcard patterns (*.public.blob.vercel-storage.com, *.supabase.co, *.cloudinary.com)
     // allow images from any account on these services for development flexibility.
     // For production with stricter security, consider restricting to specific account subdomains.

package/dist/templates/projects/blog/package.json

@@ -14,7 +14,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "next-intl": "^4.0.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",

package/dist/templates/projects/crm/package.json

@@ -13,7 +13,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "next-intl": "^4.0.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",

package/dist/templates/projects/productivity/package.json

@@ -17,7 +17,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "zod": "^4.0.0"

package/dist/templates/projects/starter/config/app.config.ts

@@ -126,6 +126,14 @@ export const APP_CONFIG_OVERRIDES = {
     // methods: ['email-password', 'google'],
     // methods: ['email-otp', 'email-password', 'google'],
 
+    /**
+     * Password endpoints (sign-in/email, sign-up/email, reset). Left undeclared
+     * they follow `methods` in production (off under the passwordless preset) and
+     * stay on in development (dev keyring, `pnpm db:seed` users, Cypress).
+     * Uncomment to keep password logins in production (API clients, test users):
+     */
+    // emailAndPassword: { enabled: true },
+
     /**
      * Session duration / renewal in seconds (defaults: 7 days, renewed daily).
      * Long-lived sessions for an installed PWA, for example:

package/dist/templates/proxy.ts

@@ -189,14 +189,17 @@ function redirectAccessDenied(request: NextRequest): NextResponse {
  * Nothing here leaves the process, so no forwarded scheme or host can point
  * the check anywhere. `disableRefresh`: this response cannot carry the renewed
  * session cookie, so the rolling renewal is left to the auth route
- * (lib/auth/session-refresh).
+ * (lib/auth/session-refresh). `disableCookieCache`: the session comes from the
+ * database, not the signed session_data cookie, so a sign-out, a revoked
+ * session or a role change counts at once (lib/auth/authorization-session).
+ * A suspended account's session is no session (lib/auth/suspension).
  */
 async function getSession(request: NextRequest): Promise<Session | null> {
   const session = await auth.api.getSession({
     headers: new Headers({ cookie: request.headers.get('cookie') || '' }),
-    query: { disableRefresh: true },
+    query: { disableRefresh: true, disableCookieCache: true },
   })
-  return session as Session | null
+  return session && (session.user as { role?: unknown }).role !== 'suspended' ? (session as Session) : null
 }
 
 /**

package/migrations/030_taxonomies_team_writes.sql

@@ -0,0 +1,29 @@
+-- Migration: 030_taxonomies_team_writes.sql
+-- Description: Taxonomy rows are written by members of their team; rows without a team only by a superadmin.
+--
+-- 021 let any authenticated user write a taxonomy row with "teamId" IS NULL. Post categories are now created in
+-- the caller's team (lib/api/post-categories.ts), and the rows without a team that earlier releases created stay
+-- readable by everyone but are changed only by a superadmin. This policy says the same on the RLS-enforced
+-- connection: reads are as before, writes need the row's team (or is_superadmin()).
+-- is_superadmin() also accepts a developer enrolled in the System Admin Team; the API (lib/api/post-categories.ts) is
+-- stricter and lets only users.role = 'superadmin' change a row without a team.
+-- Idempotent; the anon read policy from 006 is unchanged.
+
+DROP POLICY IF EXISTS "taxonomies auth can do all" ON public.taxonomies;
+DROP POLICY IF EXISTS "taxonomies auth can select" ON public.taxonomies;
+DROP POLICY IF EXISTS "taxonomies team can write" ON public.taxonomies;
+
+CREATE POLICY "taxonomies auth can select"
+ON public.taxonomies
+FOR SELECT TO authenticated
+USING (
+  "teamId" IS NULL
+  OR "teamId" = ANY(public.get_user_team_ids())
+  OR public.is_superadmin()
+);
+
+CREATE POLICY "taxonomies team can write"
+ON public.taxonomies
+FOR ALL TO authenticated
+USING ("teamId" = ANY(public.get_user_team_ids()) OR public.is_superadmin())
+WITH CHECK ("teamId" = ANY(public.get_user_team_ids()) OR public.is_superadmin());

package/migrations/031_users_role_suspended.sql

@@ -0,0 +1,41 @@
+-- Migration: 031_users_role_suspended.sql
+-- Description: users.role accepts 'suspended' (lib/auth/suspension.ts).
+--
+-- The superadmin "suspend" action sets users.role = 'suspended', which check_users_role (002: member, superadmin,
+-- developer) refused. This adds 'suspended' to the roles the constraint already accepts and keeps every other one,
+-- including roles a project added to it. Idempotent: a constraint that already accepts 'suspended' is left alone. A
+-- constraint that is not a plain list of roles is left alone too, with a notice (add 'suspended' to it yourself).
+
+DO $$
+DECLARE
+  def   TEXT;
+  roles TEXT[];
+BEGIN
+  SELECT pg_get_constraintdef(c.oid) INTO def
+  FROM pg_constraint c
+  WHERE c.conrelid = 'public.users'::regclass AND c.conname = 'check_users_role';
+
+  IF def IS NULL THEN
+    ALTER TABLE public."users" ADD CONSTRAINT check_users_role
+      CHECK ("role" IN ('member', 'superadmin', 'developer', 'suspended'));
+    RETURN;
+  END IF;
+
+  IF def ~ '\msuspended\M' THEN
+    RETURN;
+  END IF;
+
+  -- "role" IN (...) is stored as: CHECK ((role = ANY (ARRAY['member'::text, ...])))
+  IF def !~ '^CHECK \(\(+"?role"?\)?(::text)? = ANY \(\(?ARRAY\[' THEN
+    RAISE NOTICE 'check_users_role is not a plain list of roles (%); add ''suspended'' to it to use the suspend action', def;
+    RETURN;
+  END IF;
+
+  SELECT array_agg(m[1]) INTO roles FROM regexp_matches(def, '''([^'']+)''', 'g') AS m;
+
+  ALTER TABLE public."users" DROP CONSTRAINT check_users_role;
+  EXECUTE format(
+    'ALTER TABLE public."users" ADD CONSTRAINT check_users_role CHECK ("role" IN (%s))',
+    (SELECT string_agg(quote_literal(r), ', ') FROM unnest(array_append(roles, 'suspended')) AS r)
+  );
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.196",
+  "version": "0.1.0-beta.197",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -390,7 +390,7 @@
     "scripts"
   ],
   "peerDependencies": {
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "react": "^19.2.0",
     "react-dom": "^19.2.0"
   },
@@ -496,7 +496,7 @@
     "use-intl": "^4.9.1",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@nextsparkjs/ui": "0.1.0-beta.196"
+    "@nextsparkjs/ui": "0.1.0-beta.197"
   },
   "engines": {
     "node": ">=22.14.0"

package/scripts/build/registry/__tests__/build-output.test.mjs

@@ -29,7 +29,7 @@ const RAW_CONTROL = /[\u0000-\u0009\u000b-\u001f\u007f-\u009f\u061c\u200e\u200f\
 async function createProject(parent = tmpdir(), name = 'nextspark-build-output-test-') {
   const root = await mkdtemp(join(parent, name))
   await writeFile(join(root, 'nextspark.config.ts'), 'export default {}\n')
-  await writeFile(join(root, 'package.json'), '{"dependencies":{"next":"16.3.6"}}')
+  await writeFile(join(root, 'package.json'), '{"dependencies":{"next":"16.3.8"}}')
   await mkdir(join(root, 'src', 'app'), { recursive: true })
   return root
 }

package/scripts/build/registry/__tests__/project-mode-root-first.test.mjs

@@ -17,7 +17,7 @@ async function project(files = {}) {
 
 test('the nearest nextspark.config.ts owns every project source path', async () => {
   const root = await project({
-    'package.json': JSON.stringify({ dependencies: { next: '16.3.6' } }),
+    'package.json': JSON.stringify({ dependencies: { next: '16.3.8' } }),
     'nextspark.config.ts': 'export default {}\n',
   })
   const nested = join(root, 'entities', 'tasks')
@@ -40,7 +40,7 @@ test('the nearest nextspark.config.ts owns every project source path', async ()
 
 test('a next.config file cannot select a project without nextspark.config.ts', async () => {
   const root = await project({
-    'package.json': JSON.stringify({ dependencies: { next: '16.3.6' } }),
+    'package.json': JSON.stringify({ dependencies: { next: '16.3.8' } }),
     'next.config.mjs': 'export default {}\n',
   })
   try {
@@ -66,7 +66,7 @@ test('an enabled packaged plugin resolves through the project dependency tree',
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.6',
+        next: '16.3.8',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -98,7 +98,7 @@ test('an enabled packaged plugin that is not installed fails with an actionable
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.6',
+        next: '16.3.8',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -119,7 +119,7 @@ test('a packaged plugin cannot use a path segment as its logical name', async ()
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.6',
+        next: '16.3.8',
         '@example/plugin-search': '1.0.0',
       },
     }),
@@ -146,7 +146,7 @@ test('a local plugin shadows an installed packaged plugin with the same NextSpar
   const root = await project({
     'package.json': JSON.stringify({
       dependencies: {
-        next: '16.3.6',
+        next: '16.3.8',
         '@example/plugin-search': '1.0.0',
       },
     }),

package/scripts/build/registry/__tests__/write-places.test.mjs

@@ -269,7 +269,7 @@ async function snapshot(root) {
 async function buildableProject() {
   const project = await directory()
   await writeIn(project.root, 'nextspark.config.ts', 'export default {}\n')
-  await writeIn(project.root, 'package.json', '{"dependencies":{"next":"16.3.6"}}')
+  await writeIn(project.root, 'package.json', '{"dependencies":{"next":"16.3.8"}}')
   await writeIn(project.root, 'templates/pricing/page.tsx', 'export default function Pricing() { return null }\n')
   return project
 }

package/scripts/build/registry/contracts/__tests__/contracts-wire.test.mjs

@@ -22,7 +22,7 @@ async function planFor(files) {
   const root = temp()
   try {
     write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-    write(root, 'package.json', JSON.stringify({ name: 'wire', dependencies: { next: '16.3.6' } }))
+    write(root, 'package.json', JSON.stringify({ name: 'wire', dependencies: { next: '16.3.8' } }))
     write(root, 'config/theme.config.ts', "export const wireThemeConfig = { name: 'wire' }\n")
     for (const [path, content] of Object.entries(files)) write(root, path, content)
     const entities = await discoverAllEntities(getConfig(root), { includeCore: false })

package/scripts/build/registry/contracts/__tests__/contracts.test.mjs

@@ -73,7 +73,7 @@ const NOTES_CONFIG = `export const noteEntityConfig = {
 function project(extra = {}) {
   const root = temp()
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'contracts-project', dependencies: { next: '16.3.6' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'contracts-project', dependencies: { next: '16.3.8' } }))
   write(root, 'config/theme.config.ts', "export const contractsThemeConfig = { name: 'contracts' }\n")
   write(root, 'entities/tasks/tasks.config.ts', TASKS_CONFIG)
   write(root, 'entities/tasks/tasks.fields.ts', FIELDS)

package/scripts/build/registry/host/README.md

@@ -28,7 +28,7 @@ const { target, content } = await emitFacade({
 Every problem is a `FacadeEmitError` carrying all diagnostics (`code`, `file`, `line`, `exportName`,
 `message`); nothing is dropped silently.
 
-## Export table (Next.js 16.3.6)
+## Export table (Next.js 16.3.8)
 
 Source of truth: `next-route-exports.json`. The tests fail when the installed Next.js version differs,
 when Next's `AppSegmentConfigSchemaKeys` or `HTTP_METHODS` change, and when this rendering is stale.
@@ -71,7 +71,7 @@ export { listSlugs as generateStaticParams }
 Metadata image kinds accept Next's one-digit variants (`icon1`, `apple-icon9`, `opengraph-image2`,
 `twitter-image3`), mapped to the base kind.
 
-The emitter resolves `next/package.json` once (project first, then core) and accepts only `~16.3.6`: the table's
+The emitter resolves `next/package.json` once (project first, then core) and accepts only `~16.3.8`: the table's
 `next` is the verified baseline, and any stable 16.3.x patch at or above it is accepted, while other minors/majors,
 lower patches and prereleases are refused (`NS_HOST_UNSUPPORTED_NEXT_VERSION`). It loads Next's segment config
 schema from that same package root.