@usegraft/sdk-next 1.0.0-beta.2 → 1.0.0-beta.3

package/README.md

@@ -62,14 +62,18 @@ Pass `trust="full"` only when every author of the repository has commit access,
 ```ts
 import { revalidateContent, updateContent } from "@usegraft/sdk-next";
 
-// in a route handler, after a compile webhook
+// in your own route handler, called with a compile's change list
 revalidateContent(branch, changes);
 
-// in a Server Action, for read-your-own-writes
+// in a Server Action, for read-your-own-writes (Next.js 16 only)
 updateContent(branch, changes);
 ```
 
-Both turn a compile's `ChangeSet` into the exact `revalidateTag` / `updateTag` calls that refresh the changed pages, and no others. A no-op unless your reads were cached with `'use cache'` and `cacheTag`, but always safe to call.
+Both turn a compile's `ChangeSet` into the exact `revalidateTag` / `updateTag` calls that refresh the changed pages, and no others. A no-op unless your reads were tagged, but always safe to call. On Next.js 16, tag reads with `'use cache'` and `cacheTag`. On Next.js 15, wrap them in `unstable_cache` with `tags: tagsFor(...)`. `updateContent` needs Next.js 16 and throws on older versions. Use `revalidateContent` there.
+
+## Supported versions
+
+Next.js 15.5.24 and later 15.x, and 16.3.3 and later, with the App Router and React 19. Those are the first releases with the fixes for the critical Next.js advisories published in 2026. CI builds and serves a real app on each major. Next.js 14 is not supported: it no longer gets security fixes, and it has open critical advisories.
 
 ---
 

package/dist/index.d.ts

@@ -31,14 +31,16 @@ type RevalidateProfile = string | {
 };
 /**
  * Background-invalidate the Data Cache for everything a compile changed, on
- * `branch`. Call it from a **route handler** (a compile webhook): the next
- * request triggers a background refresh (stale-while-revalidate). Refreshes
- * only the changed pages — per-doc + per-collection tags — and returns them.
+ * `branch`. Call it from a **route handler** (your own route, called with a
+ * compile's change list): the next request triggers a background refresh
+ * (stale-while-revalidate). Refreshes only the changed pages — per-doc +
+ * per-collection tags — and returns them.
  *
  * `profile` is Next 16's required cache-life argument to `revalidateTag`
  * (a built-in name like `"max"`/`"hours"` or `{ expire }`); defaults to `"max"`.
- * A no-op unless the reads were cached with `'use cache'` + `cacheTag`, but
- * always safe to call.
+ * Next 15 takes the tag alone and ignores a second argument, so it is passed
+ * on every version. A no-op unless the reads were tagged (`'use cache'` +
+ * `cacheTag`, or `unstable_cache` with `tags`), but always safe to call.
  */
 declare function revalidateContent(branch: string, changes: ChangeSet, profile?: RevalidateProfile): string[];
 /**
@@ -47,6 +49,9 @@ declare function revalidateContent(branch: string, changes: ChangeSet, profile?:
  * in-app "publish" that compiles then updates): the same request sees fresh
  * content. Returns the tags it hit. Like `revalidateContent`, a no-op unless
  * the reads were cached with `'use cache'` + `cacheTag`.
+ *
+ * Needs Next 16, the release that added `updateTag`. On 15 it throws before
+ * touching any tag, and the error names `revalidateContent` as the fallback.
  */
 declare function updateContent(branch: string, changes: ChangeSet): string[];
 

package/dist/index.js

@@ -1,5 +1,6 @@
 // src/graft.ts
-import { revalidateTag, updateTag } from "next/cache";
+import { GraftError } from "@usegraft/contracts";
+import * as nextCache from "next/cache";
 import { cache } from "react";
 import { createDbClient } from "@usegraft/sdk-core/db";
 import {
@@ -28,12 +29,22 @@ function createGraft(options) {
     searchContent: (collection, query, opts) => cachedSearch(collection, query, opts?.branch, opts?.limit)
   };
 }
+var nextCacheApi = nextCache;
 function revalidateContent(branch, changes, profile = "max") {
   const tags = tagsForChanges(branch, changes);
-  for (const tag of tags) revalidateTag(tag, profile);
+  for (const tag of tags) nextCacheApi.revalidateTag(tag, profile);
   return tags;
 }
 function updateContent(branch, changes) {
+  const { updateTag } = nextCacheApi;
+  if (typeof updateTag !== "function") {
+    throw new GraftError({
+      code: "FRAMEWORK_VERSION_UNSUPPORTED",
+      message: "updateContent needs Next.js 16. This version of next/cache has no updateTag.",
+      fix: "Call revalidateContent(branch, changes) instead. It works on Next.js 15 and 16 and refreshes on the next request rather than this one. Or upgrade to Next.js 16.",
+      details: { missing: "next/cache updateTag", fallback: "revalidateContent" }
+    });
+  }
   const tags = tagsForChanges(branch, changes);
   for (const tag of tags) updateTag(tag);
   return tags;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usegraft/sdk-next",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.3",
   "description": "Next.js App Router adapter: typed content reads in Server Components, cache-tag invalidation, and real MDX rendering.",
   "keywords": [
     "agent",
@@ -30,6 +30,13 @@
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "config": [
+        "./dist/next-config.d.ts"
+      ]
+    }
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -46,20 +53,23 @@
   },
   "dependencies": {
     "@mdx-js/mdx": "^3.1.1",
-    "@usegraft/db": "1.0.0-beta.2",
-    "@usegraft/mdx-safety": "1.0.0-beta.2",
-    "@usegraft/sdk-core": "1.0.0-beta.2",
+    "@usegraft/contracts": "1.0.0-beta.3",
+    "@usegraft/db": "1.0.0-beta.3",
+    "@usegraft/mdx-safety": "1.0.0-beta.3",
+    "@usegraft/sdk-core": "1.0.0-beta.3",
     "remark-gfm": "^4.0.1"
   },
   "devDependencies": {
     "@types/mdx": "^2.0.14",
     "@types/react": "^19.2.18",
-    "@usegraft/core": "1.0.0-beta.2",
-    "next": "^16.3.3",
+    "@usegraft/auth": "1.0.0-beta.3",
+    "@usegraft/core": "1.0.0-beta.3",
+    "@usegraft/mcp": "1.0.0-beta.3",
+    "next": "^16.3.8",
     "react": "^19.2.8"
   },
   "peerDependencies": {
-    "next": ">=15.0.0",
+    "next": "^15.5.24 || ^16.3.3",
     "react": "^19.0.0"
   },
   "engines": {
@@ -68,7 +78,7 @@
   "scripts": {
     "build": "tsup src/index.ts src/next-config.ts --format esm --dts --clean --external react --external react/jsx-runtime --external next",
     "dev": "tsup src/index.ts src/next-config.ts --format esm --watch --external react --external react/jsx-runtime --external next",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && node scripts/typecheck-guide.mjs",
     "test": "vitest run --passWithNoTests"
   }
 }