@nextsparkjs/core 0.1.0-beta.75 → 0.1.0-beta.77

package/dist/templates/app/api/v1/teams/[teamId]/usage/[limitSlug]/route.ts

@@ -7,7 +7,6 @@
 
 import { NextRequest, NextResponse } from 'next/server'
 import { validateAndAuthenticateRequest, createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { SubscriptionService, UsageService, MembershipService } from '@nextsparkjs/core/lib/services'
 import { trackUsageSchema } from '@nextsparkjs/core/lib/billing/schema'
 
@@ -15,7 +14,7 @@ interface RouteParams {
   params: Promise<{ teamId: string; limitSlug: string }>
 }
 
-export const GET = withRateLimitTier(async function GET(request: NextRequest, props: RouteParams) {
+export async function GET(request: NextRequest, props: RouteParams) {
   // Authenticate request
   const { auth, rateLimitResponse } = await validateAndAuthenticateRequest(request)
   if (rateLimitResponse) return rateLimitResponse
@@ -45,9 +44,9 @@ export const GET = withRateLimitTier(async function GET(request: NextRequest, pr
     console.error('[Billing API] Error checking quota:', error)
     return createApiError('Failed to check quota', 500)
   }
-}, 'read')
+}
 
-export const POST = withRateLimitTier(async function POST(request: NextRequest, props: RouteParams) {
+export async function POST(request: NextRequest, props: RouteParams) {
   // Authenticate request
   const { auth, rateLimitResponse } = await validateAndAuthenticateRequest(request)
   if (rateLimitResponse) return rateLimitResponse
@@ -89,4 +88,4 @@ export const POST = withRateLimitTier(async function POST(request: NextRequest,
     const errorMessage = error instanceof Error ? error.message : 'Failed to track usage'
     return createApiError(errorMessage, 500)
   }
-}, 'write')
+}

package/dist/templates/app/api/v1/teams/route.ts

@@ -10,19 +10,18 @@ import {
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { isSuperAdmin } from '@nextsparkjs/core/lib/api/auth/permissions'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { createTeamSchema, teamListQuerySchema } from '@nextsparkjs/core/lib/teams/schema'
 import { TeamService } from '@nextsparkjs/core/lib/services'
 import type { Team } from '@nextsparkjs/core/lib/teams/types'
 import { APP_CONFIG_MERGED } from '@nextsparkjs/core/lib/config/config-sync'
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(req: NextRequest) {
+  return handleCorsPreflightRequest(req)
 }
 
 // GET /api/v1/teams - List user's teams
-export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const GET = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req)
@@ -62,7 +61,7 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
         'Insufficient permissions. Superadmin access required for scope=all.',
         403
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Build WHERE clause based on filters
@@ -155,16 +154,16 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     }))
 
     const response = createApiResponse(teamsWithMembers, paginationMeta)
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   } catch (error) {
     console.error('Error fetching teams:', error)
     const response = createApiError('Internal server error', 500)
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   }
-}), 'read')
+})
 
 // POST /api/v1/teams - Create new team
-export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req)
@@ -194,7 +193,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
         null,
         'TEAM_CREATION_DISABLED'
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Validate allowCreateTeams option
@@ -215,7 +214,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
           null,
           'MAX_TEAMS_REACHED'
         )
-        return addCorsHeaders(response)
+        return addCorsHeaders(response, req)
       }
     }
 
@@ -223,7 +222,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     const slugAvailable = await TeamService.isSlugAvailable(validatedData.slug)
     if (!slugAvailable) {
       const response = createApiError('Team slug already exists', 409, null, 'SLUG_EXISTS')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Use transaction to ensure atomicity
@@ -275,7 +274,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
       }
 
       const response = createApiResponse(responseData, { created: true }, 201)
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     } catch (error) {
       await tx.rollback()
       throw error
@@ -284,11 +283,11 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     if (error instanceof Error && error.name === 'ZodError') {
       const zodError = error as { issues?: unknown[] }
       const response = createApiError('Validation error', 400, zodError.issues, 'VALIDATION_ERROR')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     console.error('Error creating team:', error)
     const response = createApiError('Internal server error', 500)
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   }
-}), 'write')
+})

package/dist/templates/app/api/v1/teams/switch/route.ts

@@ -7,7 +7,6 @@ import {
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 import { TeamService } from '@nextsparkjs/core/lib/services'
 import { z } from 'zod'
 
@@ -21,7 +20,7 @@ export async function OPTIONS() {
 }
 
 // POST /api/v1/teams/switch - Switch active team context
-export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req)
@@ -86,4 +85,4 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     const response = createApiError('Internal server error', 500)
     return addCorsHeaders(response)
   }
-}), 'write')
+})

package/dist/templates/app/api/v1/theme/[...path]/route.ts

@@ -11,47 +11,46 @@ import {
   type ThemeRouteFile,
   type ThemeRegistryEntry
 } from '@nextsparkjs/registries/theme-registry'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
-export const GET = withRateLimitTier(async (
+export async function GET(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'GET')
-}, 'read');
+}
 
-export const POST = withRateLimitTier(async (
+export async function POST(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'POST')
-}, 'write');
+}
 
-export const PUT = withRateLimitTier(async (
+export async function PUT(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'PUT')
-}, 'write');
+}
 
-export const DELETE = withRateLimitTier(async (
+export async function DELETE(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'DELETE')
-}, 'write');
+}
 
-export const PATCH = withRateLimitTier(async (
+export async function PATCH(
   request: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   const { path } = await params
   return handleThemeRequest(request, path, 'PATCH')
-}, 'write');
+}
 
 /**
  * Handle theme API requests with nested paths

package/dist/templates/app/api/v1/theme/route.ts

@@ -8,11 +8,10 @@
 import { NextResponse } from 'next/server'
 import { PluginService, type PluginRegistryEntry } from '@nextsparkjs/core/lib/services'
 import { PLUGIN_REGISTRY } from '@nextsparkjs/registries/plugin-registry'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
-export const GET = withRateLimitTier(async () => {
+export async function GET() {
   return listPluginsWithAPI()
-}, 'read');
+}
 
 /**
  * List all plugins with their API status

package/dist/templates/app/api/v1/users/[id]/meta/[key]/route.ts

@@ -30,7 +30,6 @@ import {
 } from '@nextsparkjs/core/lib/api/helpers'
 import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { z } from 'zod'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 // Validation schema for metadata value
 const metadataValueSchema = z.object({
@@ -57,7 +56,7 @@ export async function OPTIONS() {
  * GET /api/v1/users/user-123/meta/theme
  * Response: { success: true, data: { key: "theme", value: "dark" } }
  */
-export const GET = withRateLimitTier(withApiLogging(async (
+export const GET = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
@@ -141,7 +140,7 @@ export const GET = withRateLimitTier(withApiLogging(async (
     )
     return addCorsHeaders(response)
   }
-}), 'read');
+})
 
 /**
  * PUT /api/v1/users/:id/meta/:key
@@ -160,7 +159,7 @@ export const GET = withRateLimitTier(withApiLogging(async (
  * Body: { value: "dark", isPublic: false }
  * Response: { success: true, data: { key: "theme", value: "dark", updated: true } }
  */
-export const PUT = withRateLimitTier(withApiLogging(async (
+export const PUT = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
@@ -271,7 +270,7 @@ export const PUT = withRateLimitTier(withApiLogging(async (
     )
     return addCorsHeaders(response)
   }
-}), 'write');
+})
 
 /**
  * PATCH /api/v1/users/:id/meta/:key
@@ -288,7 +287,7 @@ export const PATCH = PUT
  * DELETE /api/v1/users/user-123/meta/theme
  * Response: { success: true, data: { key: "theme", deleted: true } }
  */
-export const DELETE = withRateLimitTier(withApiLogging(async (
+export const DELETE = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
@@ -361,4 +360,4 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
     )
     return addCorsHeaders(response)
   }
-}), 'write');
+})

package/dist/templates/app/api/v1/users/[id]/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { queryOneWithRLS, mutateWithRLS } from '@nextsparkjs/core/lib/db';
-import {
-  createApiResponse,
+import { 
+  createApiResponse, 
   createApiError,
   withApiLogging,
   handleCorsPreflightRequest,
@@ -13,7 +13,6 @@ import {
 } from '@nextsparkjs/core/lib/api/helpers';
 import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth';
 import { z } from 'zod';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 const updateUserSchema = z.object({
   firstName: z.string().min(1).optional(),
@@ -29,7 +28,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/users/:id - Get specific user
-export const GET = withRateLimitTier(withApiLogging(async (
+export const GET = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -88,10 +87,10 @@ export const GET = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'read');
+});
 
 // PATCH /api/v1/users/:id - Update user
-export const PATCH = withRateLimitTier(withApiLogging(async (
+export const PATCH = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -225,10 +224,10 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'write');
+});
 
 // DELETE /api/v1/users/:id - Delete user
-export const DELETE = withRateLimitTier(withApiLogging(async (
+export const DELETE = withApiLogging(async (
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
@@ -300,4 +299,4 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'write');
+});

package/dist/templates/app/api/v1/users/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { queryWithRLS, mutateWithRLS } from '@nextsparkjs/core/lib/db';
-import {
-  createApiResponse,
+import { 
+  createApiResponse, 
   createApiError,
   parsePaginationParams,
   createPaginationMeta,
@@ -17,7 +17,6 @@ import {
 import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth';
 import { hasAdminPermission } from '@nextsparkjs/core/lib/api/auth/permissions';
 import { z } from 'zod';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 const createUserSchema = z.object({
   email: z.string().email('Invalid email format'),
@@ -39,7 +38,7 @@ export async function OPTIONS() {
 }
 
 // GET /api/v1/users - List users with dual auth
-export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const GET = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req);
@@ -109,10 +108,10 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'read');
+});
 
 // POST /api/v1/users - Create user with dual auth
-export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
     // Authenticate using dual auth
     const authResult = await authenticateRequest(req);
@@ -194,5 +193,5 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     const response = createApiError('Internal server error', 500);
     return addCorsHeaders(response);
   }
-}), 'write');
+});
 

package/dist/templates/app/dashboard/(main)/[entity]/[id]/page.tsx

@@ -38,12 +38,11 @@ async function EntityDetailPage({ params }: PageProps) {
   }
 
   // Verificar que la entidad existe en el registro
-  const registry = getEntityRegistry()
-  if (!(entitySlug in registry)) {
+  if (!(entitySlug in getEntityRegistry())) {
     notFound()
   }
 
-  const entityConfig = getEntity(entitySlug)
+  const entityConfig = getEntity(entitySlug as string)
   if (!entityConfig || !isEntityConfig(entityConfig)) {
     notFound()
   }
@@ -66,7 +65,7 @@ async function EntityDetailPage({ params }: PageProps) {
   }
 
   // Get child entities for this parent entity
-  const childEntities = getChildEntities(entitySlug)
+  const childEntities = getChildEntities(entitySlug as string)
   const childEntityNames = childEntities.map(child => child.name)
 
   return (
@@ -82,14 +81,13 @@ export async function generateMetadata({ params }: PageProps): Promise<Metadata>
   const resolvedParams = await params
   const entitySlug = resolvedParams.entity
 
-  const registry = getEntityRegistry()
-  if (!(entitySlug in registry)) {
+  if (!(entitySlug in getEntityRegistry())) {
     return {
       title: 'Not Found - Dashboard'
     }
   }
 
-  const entityConfig = getEntity(entitySlug)
+  const entityConfig = getEntity(entitySlug as string)
   if (!entityConfig || !isEntityConfig(entityConfig)) {
     return {
       title: 'Not Found - Dashboard'

package/dist/templates/app/dashboard/(main)/[entity]/layout.tsx

@@ -1,27 +1,113 @@
 /**
- * Entity Layout (Dynamic Routes Fallback)
+ * Entity Permission Layout
  *
- * This layout handles dynamic entity routes that don't have specific template pages.
+ * Server Component that validates entity permissions BEFORE rendering any page.
+ * This layout is NOT overridable by themes to ensure security.
  *
- * IMPORTANT: Permission checking is now handled by the parent layout at:
- * app/dashboard/(main)/layout.tsx
+ * IMPORTANT: Do NOT use getTemplateOrDefault here - security must not be bypassable.
  *
- * This ensures permissions are checked for ALL routes, including:
- * - Template routes (e.g., /dashboard/ai-agents/create with specific page.tsx)
- * - Dynamic routes (e.g., /dashboard/[entity]/create fallback)
+ * Flow:
+ * 1. User navigates to /dashboard/companies/create
+ * 2. Browser sends activeTeamId cookie automatically
+ * 3. This layout reads cookie and checks permission via checkPermission()
+ * 4. If denied, redirects to /dashboard/permission-denied
+ * 5. If allowed, renders the page (children)
+ */
+import { headers, cookies } from 'next/headers'
+import { redirect } from 'next/navigation'
+import { checkPermission } from '@nextsparkjs/core/lib/permissions/check'
+import { isValidPermission } from '@nextsparkjs/core/lib/permissions/init'
+import type { Permission } from '@nextsparkjs/core/lib/permissions/types'
+
+type EntityAction = 'list' | 'read' | 'create' | 'update' | 'delete'
+
+/**
+ * Detect the required action from the pathname
  *
- * Previously, permission checking was here but it never executed for template routes
- * because Next.js route specificity gives priority to explicit paths over dynamic ones.
+ * @param pathname - Full pathname (e.g., /dashboard/companies/create)
+ * @param entitySlug - Entity slug (e.g., companies)
+ * @returns The action being attempted
  */
+function detectActionFromPathname(pathname: string, entitySlug: string): EntityAction {
+  const entityPath = `/dashboard/${entitySlug}`
+  const relativePath = pathname.replace(entityPath, '')
+
+  // List: /dashboard/companies or /dashboard/companies/
+  if (relativePath === '' || relativePath === '/') return 'list'
+
+  // Create: /dashboard/companies/create
+  if (relativePath === '/create') return 'create'
+
+  // Update: /dashboard/companies/[id]/edit
+  if (relativePath.match(/^\/[^/]+\/edit$/)) return 'update'
+
+  // Read: /dashboard/companies/[id] (single detail view)
+  if (relativePath.match(/^\/[^/]+$/)) return 'read'
+
+  // Default fallback for any other path
+  return 'read'
+}
 
 interface EntityLayoutProps {
   children: React.ReactNode
   params: Promise<{ entity: string }>
 }
 
-export default async function EntityLayout({
-  children
+export default async function EntityPermissionLayout({
+  children,
+  params
 }: EntityLayoutProps) {
-  // Permission checking handled by parent (main)/layout.tsx
+  const { entity } = await params
+  const headersList = await headers()
+  const cookieStore = await cookies()
+
+  // Get pathname from middleware header
+  const pathname = headersList.get('x-pathname') || ''
+
+  // Get userId from middleware header (set for all authenticated routes)
+  const userId = headersList.get('x-user-id')
+
+  // Get teamId from cookie (set by TeamContext and /api/v1/teams/switch)
+  const teamId = cookieStore.get('activeTeamId')?.value
+
+  // Skip validation if missing required data
+  // - No userId: middleware will redirect to login (shouldn't happen for dashboard routes)
+  // - No teamId: user hasn't selected a team yet, let page handle it
+  if (!userId || !teamId) {
+    console.log('[EntityPermissionLayout] Skipping validation - missing data:', {
+      entity,
+      userId: !!userId,
+      teamId: !!teamId
+    })
+    return <>{children}</>
+  }
+
+  // Skip permission validation for routes that don't have entity permissions
+  // These are custom template pages (like agent-single, agent-multi) that aren't real entities
+  if (!isValidPermission(`${entity}.list` as Permission)) {
+    console.log('[EntityPermissionLayout] Skipping validation - no entity permission config for:', entity)
+    return <>{children}</>
+  }
+
+  // Detect required action from pathname
+  const action = detectActionFromPathname(pathname, entity)
+  const permission = `${entity}.${action}` as Permission
+
+  console.log('[EntityPermissionLayout] Checking permission:', {
+    entity,
+    action,
+    permission,
+    userId,
+    teamId
+  })
+
+  // Check permission using existing core function
+  const hasPermission = await checkPermission(userId, teamId, permission)
+
+  if (!hasPermission) {
+    console.log('[EntityPermissionLayout] Permission denied, redirecting')
+    redirect(`/dashboard/permission-denied?entity=${entity}&action=${action}`)
+  }
+
   return <>{children}</>
 }

package/dist/templates/app/dashboard/(main)/[entity]/page.tsx

@@ -8,7 +8,6 @@ import type { EntityConfig, ChildEntityDefinition } from '@nextsparkjs/core/lib/
 import { ENTITY_REGISTRY, ENTITY_METADATA } from '@nextsparkjs/registries/entity-registry'
 
 // Initialize registry at module load time (before any component renders)
-// This ensures the registry is available even if this page loads before the layout
 setEntityRegistry(ENTITY_REGISTRY, ENTITY_METADATA)
 
 // Type guard to check if entity is a full EntityConfig

package/dist/templates/app/dashboard/(main)/layout.tsx

@@ -32,20 +32,17 @@ type EntityAction = 'list' | 'read' | 'create' | 'update' | 'delete'
  * Handles paths like: /dashboard/ai-agents, /dashboard/ai-agents/create, /dashboard/ai-agents/[id]/edit
  */
 function parseEntityFromPathname(pathname: string): { entity: string; action: EntityAction } | null {
-  // Match /dashboard/[entity] patterns
   const match = pathname.match(/^\/dashboard\/([^/]+)(?:\/(.*))?$/)
   if (!match) return null
 
   const entity = match[1]
   const rest = match[2] || ''
 
-  // Detect action from the rest of the path
   if (rest === '' || rest === '/') return { entity, action: 'list' }
   if (rest === 'create') return { entity, action: 'create' }
   if (rest.match(/^[^/]+\/edit$/)) return { entity, action: 'update' }
   if (rest.match(/^[^/]+$/)) return { entity, action: 'read' }
 
-  // Default to read for any other path
   return { entity, action: 'read' }
 }
 
@@ -61,9 +58,7 @@ async function DefaultMainDashboardLayout({
   children: React.ReactNode
 }) {
   // Get entities directly from the imported registry
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const allEntities = Object.values(ENTITY_REGISTRY).map(entry => (entry as any).config)
-  // Filter to only include full EntityConfig (not child entities)
+  const allEntities = Object.values(ENTITY_REGISTRY).map(entry => entry.config)
   const entities = allEntities.filter(isEntityConfig)
   const serializedEntities: SerializableEntityConfig[] = entities.map(serializeEntityConfig)
 
@@ -71,12 +66,10 @@ async function DefaultMainDashboardLayout({
   const headersList = await headers()
   const cookieStore = await cookies()
 
-  // Get pathname from middleware header
   const pathname = headersList.get('x-pathname') || ''
   const userId = headersList.get('x-user-id')
   const teamId = cookieStore.get('activeTeamId')?.value
 
-  // Only check permissions if we have the required data
   if (userId && teamId && pathname) {
     const parsed = parseEntityFromPathname(pathname)
 
@@ -84,7 +77,6 @@ async function DefaultMainDashboardLayout({
       const { entity, action } = parsed
       const permission = `${entity}.${action}` as Permission
 
-      // Only check if this is a valid entity permission
       if (isValidPermission(`${entity}.list` as Permission)) {
         const hasPermission = await checkPermission(userId, teamId, permission)
 
@@ -103,4 +95,4 @@ async function DefaultMainDashboardLayout({
 }
 
 // Export the resolved component (theme override or default)
-export default getTemplateOrDefault('app/dashboard/(main)/layout.tsx', DefaultMainDashboardLayout)
+export default getTemplateOrDefault('app/dashboard/(main)/layout.tsx', DefaultMainDashboardLayout)

package/dist/templates/app/dashboard/(main)/page.tsx

@@ -78,7 +78,7 @@ function DefaultDashboardPage() {
         <div className="mb-8" data-cy="dashboard-welcome">
           <h1 className="text-3xl font-bold">{t('title')}</h1>
           <p className="text-muted-foreground mt-1">
-            {t('welcome', { name: user?.firstName || user?.email || '' })}
+            {t('welcome', { name: user.firstName || user.email })}
           </p>
         </div>
 
@@ -102,8 +102,6 @@ function DefaultDashboardPage() {
           ))}
         </div>
 
-
-
         {/* Quick Actions */}
         <Card>
           <CardHeader>

package/dist/templates/app/dashboard/(main)/patterns/page.tsx

@@ -42,7 +42,7 @@ export default function PatternsListPage() {
   const router = useRouter()
 
   // Use the new centralized hook for entity configuration
-  const { config: entityConfig, isLoading, error: configError } = useEntityConfig(entityType)
+  const { config: entityConfig, isLoading, error: configError, isOverride } = useEntityConfig(entityType)
 
   // Get current team for relation resolution
   const { teamId } = useTeam()