updated

Author: rezwana-karim

.github/instructions/nextjs.instructions.md

@@ -394,7 +394,7 @@ Always move client-only UI into a Client Component and import it directly in you
 - **Dynamic Segments:** Use `[param]` for dynamic API routes (e.g., `app/api/users/[id]/route.ts`).
 - **Validation:** Always validate and sanitize input. Use libraries like `zod` or `yup`.
 - **Error Handling:** Return appropriate HTTP status codes and error messages.
-- **Authentication:** Protect sensitive routes using middleware or server-side session checks.
+- **Authentication:** Protect sensitive routes using proxy or server-side session checks.
 
 ### StormCom API Standards (CRITICAL)
 
@@ -1060,16 +1060,16 @@ export async function checkRateLimit(request: NextRequest) {
 }
 ```
 
-### Middleware Best Practices
+### Proxy Best Practices (Next.js 16)
 
 **Authentication & Tenant Isolation** (REQUIRED):
 ```typescript
-// middleware.ts
+// proxy.ts (formerly middleware.ts in Next.js 15)
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 import { getToken } from 'next-auth/jwt';
 
-export async function middleware(request: NextRequest) {
+export async function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl;
 
   // 1. Rate limiting for API routes
@@ -1136,7 +1136,7 @@ When building features for StormCom, ensure:
 - [ ] All database queries filter by `storeId`
 - [ ] Prisma middleware auto-injects `storeId`
 - [ ] Session includes `storeId` for tenant context
-- [ ] Middleware validates tenant access
+- [ ] Proxy validates tenant access
 
 ### ✅ Database (Prisma)
 - [ ] Use Prisma Client (NO raw SQL)
@@ -1189,6 +1189,206 @@ When building features for StormCom, ensure:
 
 ---
 
+## Next.js 16 Migration Guide (Critical Changes)
+
+**REQUIRED**: StormCom uses Next.js 16.0.0+ with breaking changes from v15. Follow this migration checklist:
+
+### 1. Proxy (Formerly Middleware)
+
+**Breaking Change**: `middleware.ts` renamed to `proxy.ts` with new terminology.
+
+```typescript
+// ❌ DEPRECATED (Next.js 15):
+// middleware.ts
+export default function middleware(request: NextRequest) {
+  return NextResponse.next();
+}
+
+// ✅ REQUIRED (Next.js 16):
+// proxy.ts (at project root or in src/)
+export default function proxy(request: NextRequest) {
+  return NextResponse.next();
+}
+```
+
+**Migration**:
+```bash
+# Use automated codemod
+npx @next/codemod@canary middleware-to-proxy .
+
+# Or manually:
+# 1. Rename middleware.ts → proxy.ts
+# 2. Rename function: middleware → proxy
+# 3. Update all references in codebase
+```
+
+**Why**: Clarifies network boundary and aligns with proxy pattern. Only ONE proxy file per project allowed.
+
+**Documentation**: https://nextjs.org/docs/app/api-reference/file-conventions/proxy
+
+### 2. Async Route Parameters
+
+**Breaking Change**: `params` and `searchParams` are now Promises.
+
+```typescript
+// ❌ DEPRECATED (Next.js 15):
+export default function Page({ params, searchParams }: Props) {
+  const { id } = params;  // Synchronous access
+  const query = searchParams.q;
+}
+
+// ✅ REQUIRED (Next.js 16):
+export default async function Page({ params, searchParams }: Props) {
+  const { id } = await params;  // Must await
+  const { q: query } = await searchParams;  // Must await
+}
+```
+
+**Applies to**:
+- Page components (`page.tsx`)
+- Layout components (`layout.tsx`)
+- Route handlers (`route.ts`)
+- `generateMetadata()` functions
+
+### 3. Server-Only Functions Now Async
+
+**Breaking Change**: `cookies()`, `headers()`, `draftMode()` now return Promises.
+
+```typescript
+// ❌ DEPRECATED (Next.js 15):
+import { cookies } from 'next/headers';
+const cookieStore = cookies();
+
+// ✅ REQUIRED (Next.js 16):
+import { cookies } from 'next/headers';
+const cookieStore = await cookies();
+```
+
+### 4. Image Component Defaults
+
+**Breaking Change**: Default quality changed, minimum cache TTL increased.
+
+```typescript
+// Next.js 15 defaults:
+// - quality: 75
+// - minimumCacheTTL: 60 seconds
+// - imageSizes: [16, 32, 48, 64, 96, 128, 256, 384]
+
+// Next.js 16 defaults:
+// - quality: 75 (unchanged)
+// - minimumCacheTTL: 14400 seconds (4 hours)
+// - imageSizes: [32, 48, 64, 96, 128, 256, 384] (removed 16)
+```
+
+**If you relied on 16px size**:
+```typescript
+// next.config.ts
+export default {
+  images: {
+    imageSizes: [16, 32, 48, 64, 96, 128, 256, 384],
+  },
+};
+```
+
+### 5. Turbopack Now Default
+
+**Breaking Change**: Turbopack is now the default bundler (2-5x faster builds).
+
+```bash
+# Use webpack if needed (custom webpack config)
+next dev --webpack
+next build --webpack
+
+# Or in package.json
+{
+  "scripts": {
+    "dev": "next dev --webpack",
+    "build": "next build --webpack"
+  }
+}
+```
+
+### 6. Caching Model Changes
+
+**Breaking Change**: Explicit opt-in caching with `"use cache"` directive.
+
+```typescript
+// Next.js 15: Implicit caching (fetch auto-cached)
+async function getData() {
+  const res = await fetch('https://api.example.com/data');
+  return res.json();
+}
+
+// Next.js 16: Explicit caching required
+"use cache";
+async function getData() {
+  const res = await fetch('https://api.example.com/data');
+  return res.json();
+}
+```
+
+**Enable Cache Components** (Optional):
+```typescript
+// next.config.ts
+export default {
+  cacheComponents: true,  // Opt-in to new caching model
+};
+```
+
+### 7. revalidateTag() Signature Change
+
+**Breaking Change**: Requires `cacheLife` profile as second argument.
+
+```typescript
+// ❌ DEPRECATED (Next.js 15):
+revalidateTag('blog-posts');
+
+// ✅ REQUIRED (Next.js 16):
+revalidateTag('blog-posts', 'max');  // Use cacheLife profile
+
+// Or with custom revalidate time:
+revalidateTag('products', { revalidate: 3600 });
+```
+
+### 8. Parallel Routes Require default.js
+
+**Breaking Change**: All parallel route slots MUST have `default.js`.
+
+```typescript
+// app/
+// ├── @modal/
+// │   ├── default.tsx  // ✅ REQUIRED (was optional in v15)
+// │   └── photo/
+// │       └── page.tsx
+// └── page.tsx
+
+// default.tsx
+export default function Default() {
+  return null;  // or call notFound()
+}
+```
+
+### Migration Checklist
+
+- [ ] Rename `middleware.ts` → `proxy.ts`
+- [ ] Update function name: `middleware` → `proxy`
+- [ ] Add `await` to all `params` and `searchParams` usage
+- [ ] Add `await` to `cookies()`, `headers()`, `draftMode()`
+- [ ] Update `revalidateTag()` calls to include second argument
+- [ ] Add `default.js` to all parallel route slots
+- [ ] Test with Turbopack (or opt into webpack if needed)
+- [ ] Consider enabling `cacheComponents` for explicit caching
+- [ ] Update image component usage if relying on 16px size
+- [ ] Run type-check: `npm run type-check`
+- [ ] Run build: `npm run build`
+
+**Resources**:
+- [Next.js 16 Upgrade Guide](https://nextjs.org/docs/app/guides/upgrading/version-16)
+- [Next.js 16 Blog Post](https://nextjs.org/blog/next-16)
+- [Proxy Documentation](https://nextjs.org/docs/app/api-reference/file-conventions/proxy)
+
+---
+
 ## Next.js MCP Server Integration (REQUIRED)
 
 **CRITICAL**: Next.js 16.0.0+ includes built-in Model Context Protocol (MCP) server support for AI-assisted development. StormCom REQUIRES both MCP servers for optimal Copilot agent experience.
@@ -1297,7 +1497,7 @@ npm run dev
 
 **Benefits for StormCom Development**:
 - **Context-Aware Suggestions**: Agent recommends features based on existing structure
-- **Live Application State**: Query current routes, middleware, errors during development
+- **Live Application State**: Query current routes, proxy configuration, errors during development
 - **Multi-Tenant Awareness**: Agent understands route groups and tenant isolation patterns
 - **Performance Insights**: Get recommendations based on actual performance metrics
 - **Accurate Implementations**: Generate code following StormCom patterns and conventions

.gitignore

@@ -34,8 +34,8 @@ dist/
 *.test.ts.snap
 
 # Prisma
-# /prisma/*.db
-# /prisma/*.db-journal
+/prisma/*.db
+/prisma/*.db-journal
 /prisma/prisma/*.db
 # /prisma/prisma/dev.db
 

.specify/memory/constitution.md

@@ -1,3 +1,28 @@
+# Sync Impact Report
+<!--
+Version change: 1.1.0 → 1.2.0
+
+Modified principles:
+- Required Technologies: replaced "Custom Auth System" note with a pinned NextAuth.js requirement (NextAuth.js v4.24.13).
+- Authentication & Authorization: pinned to NextAuth.js v4.24.13 and added compatibility guidance for Next.js v16.0.1.
+
+Added / Removed sections:
+- Removed: explicit note recommending a custom auth system due to NextAuth v5 incompatibility.
+
+Templates & files checked and sync status:
+- .specify/memory/constitution.md — ✅ updated
+- specs/001-multi-tenant-ecommerce/plan.md — ✅ updated to reference NextAuth.js v4.24.13
+- specs/001-multi-tenant-ecommerce/tasks.md — ✅ updated to reinstate T022 for NextAuth.js v4.24.13
+- .specify/templates/plan-template.md — ✅ reviewed (no changes required)
+- .specify/templates/spec-template.md — ✅ reviewed (no changes required)
+- .specify/templates/tasks-template.md — ✅ reviewed (no changes required)
+
+Follow-up TODOs:
+- Verify `package.json` pins or allows `next-auth@4.24.13` and `next@16.0.1`. If not, propose dependency update and run `npm install`.
+- Run full test suite (Vitest + Playwright) to validate NextAuth integration and resolve any auth-related test mocks.
+- Remove or migrate any legacy custom-auth code paths once NextAuth integration is fully validated.
+-->
+
 # StormCom Constitution
 
 ## Core Principles
@@ -159,7 +184,7 @@ Performance is a priority. All features must meet defined performance budgets: p
 - ✅ **PostgreSQL** (production on Vercel Postgres).
 - ✅ **Tailwind CSS** `4.1.14+` (utility-first styling).
 - ✅ **Radix UI** + **shadcn/ui** (accessible component library).
-- ✅ **Custom Auth System** (JWT + Vercel KV session storage) - **NOTE**: NextAuth.js v5 incompatible with Next.js 16; custom implementation used instead (see plan.md, tasks.md).
+- ✅ **NextAuth.js** `v4.24.13` - Official authentication framework configured for Next.js `v16.0.1`. Use NextAuth.js v4.24.13 for session management (JWT sessions), provider integrations, and optional 2FA/TOTP flows. In production, session state SHOULD be stored in Vercel KV or another secure session store. This replaces the prior custom-auth note: NextAuth v4.x is the supported authentication system for the project and is verified compatible with Next.js 16.0.1.
 - ✅ **Zod** (runtime validation).
 - ✅ **React Hook Form** (form state management).
 - ✅ **Vitest** `3.2.4+` (unit/integration testing).
@@ -275,7 +300,7 @@ Performance is a priority. All features must meet defined performance budgets: p
 Ensure all user data is encrypted at rest and in transit. Follow industry best practices for authentication and authorization, including HTTPS, secure cookies, and role-based access control.
 
 **Authentication & Authorization**
-- Use NextAuth.js v4+ for authentication.
+- Use NextAuth.js `v4.24.13` (compatible with Next.js `v16.0.1`) for authentication. Configure providers, JWT session handling, and optional 2FA/TOTP via NextAuth integrations where applicable. Session cookies MUST be HTTP-only and SameSite=Lax; store session state in Vercel KV in production.
 - Implement JWT sessions with HTTP-only cookies (SameSite=Lax).
 - Hash passwords with bcrypt (cost factor: 12).
 - Enforce Role-Based Access Control (RBAC) with granular permissions.
@@ -309,4 +334,4 @@ Ensure compliance with GDPR, CCPA, and other relevant data protection regulation
 
 This constitution supersedes all other practices. Amendments require documentation, approval, and a migration plan. All pull requests and reviews must verify compliance with the principles outlined in this document. Complexity must be justified, and runtime development guidance must be followed as outlined in the project documentation.
 
-**Version**: 1.1.0 | **Ratified**: 2025-10-17 | **Last Amended**: 2025-10-17
+**Version**: 1.2.0 | **Ratified**: 2025-10-17 | **Last Amended**: 2025-11-08

README.md

@@ -728,3 +728,9 @@ MIT License - see [LICENSE](LICENSE) file
 ---
 
 **Built with ❤️ using Next.js 16 (Including), TypeScript 5.9, Prisma, and Spec-Driven Development**
+
+## Login credentials:
+- Super Admin: admin@stormcom.io / Admin@123
+- TechHub Admin: admin@techhub.example.com / Admin@123
+- StyleStreet Admin: admin@stylestreet.example.com / Admin@123
+- CozyHome Admin: admin@cozyhome.example.com / Admin@123