create-nextblock 0.10.1 → 0.10.3

package/templates/nextblock-template/app/cms/settings/privacy/actions.ts

@@ -4,7 +4,7 @@ import { createClient } from '@nextblock-cms/db/server';
 import { revalidatePath } from 'next/cache';
 import {
   getPrivacySettings as readPrivacySettings,
-  savePrivacySettings,
+  mergePrivacySettings,
 } from '../../../../lib/privacy/settings';
 import type { PrivacySettings } from '../../../../lib/privacy/types';
 
@@ -33,11 +33,10 @@ async function assertAdmin(): Promise<void> {
 export async function updatePrivacySettings(formData: FormData) {
   await assertAdmin();
 
-  const settings: PrivacySettings = {
+  // Analytics fields (GTM/GA4/custom scripts) are owned by the Google Analytics
+  // settings page; merge only the consent + corporate fields so they aren't clobbered.
+  const patch: Partial<PrivacySettings> = {
     banner_enabled: formData.get('banner_enabled') === 'true',
-    gtm_id: (formData.get('gtm_id')?.toString() ?? '').trim(),
-    ga_measurement_id: (formData.get('ga_measurement_id')?.toString() ?? '').trim(),
-    custom_scripts: formData.get('custom_scripts')?.toString() ?? '',
     corporate: {
       legal_name: (formData.get('legal_name')?.toString() ?? '').trim(),
       address: (formData.get('address')?.toString() ?? '').trim(),
@@ -45,7 +44,7 @@ export async function updatePrivacySettings(formData: FormData) {
     },
   };
 
-  await savePrivacySettings(settings);
+  await mergePrivacySettings(patch);
   // Footer (corporate identity) and the analytics guard live in the root layout.
   revalidatePath('/', 'layout');
 

package/templates/nextblock-template/app/cms/settings/privacy/components/PrivacyForm.tsx

@@ -26,9 +26,6 @@ export default function PrivacyForm({ initialSettings }: PrivacyFormProps) {
   const [message, setMessage] = useState<Message | null>(null);
 
   const [bannerEnabled, setBannerEnabled] = useState(initialSettings.banner_enabled);
-  const [gtmId, setGtmId] = useState(initialSettings.gtm_id);
-  const [gaId, setGaId] = useState(initialSettings.ga_measurement_id);
-  const [customScripts, setCustomScripts] = useState(initialSettings.custom_scripts);
   const [legalName, setLegalName] = useState(initialSettings.corporate.legal_name);
   const [address, setAddress] = useState(initialSettings.corporate.address);
   const [supportEmail, setSupportEmail] = useState(initialSettings.corporate.support_email);
@@ -42,9 +39,6 @@ export default function PrivacyForm({ initialSettings }: PrivacyFormProps) {
 
     const formData = new FormData();
     formData.append('banner_enabled', String(bannerEnabled));
-    formData.append('gtm_id', gtmId);
-    formData.append('ga_measurement_id', gaId);
-    formData.append('custom_scripts', customScripts);
     formData.append('legal_name', legalName);
     formData.append('address', address);
     formData.append('support_email', supportEmail);
@@ -84,48 +78,6 @@ export default function PrivacyForm({ initialSettings }: PrivacyFormProps) {
 
       <Separator />
 
-      {/* Analytics */}
-      <section className="space-y-4">
-        <div>
-          <h3 className="text-sm font-semibold">Analytics &amp; tracking</h3>
-          <p className="text-xs text-slate-500">
-            These load <strong>only</strong> after a visitor consents to analytics, so
-            the default page weight stays at zero tracking bytes.
-          </p>
-        </div>
-        <div className="space-y-2">
-          <Label htmlFor="gtm_id">Google Tag Manager ID</Label>
-          <Input
-            id="gtm_id"
-            value={gtmId}
-            onChange={(e) => setGtmId(e.target.value)}
-            placeholder="GTM-XXXXXXX"
-          />
-        </div>
-        <div className="space-y-2">
-          <Label htmlFor="ga_measurement_id">GA4 Measurement ID (optional)</Label>
-          <Input
-            id="ga_measurement_id"
-            value={gaId}
-            onChange={(e) => setGaId(e.target.value)}
-            placeholder="G-XXXXXXXXXX"
-          />
-        </div>
-        <div className="space-y-2">
-          <Label htmlFor="custom_scripts">Custom consented scripts (optional)</Label>
-          <Textarea
-            id="custom_scripts"
-            value={customScripts}
-            onChange={(e) => setCustomScripts(e.target.value)}
-            placeholder="<!-- Additional marketing/analytics <script> tags, injected only after consent -->"
-            rows={4}
-            className="font-mono text-xs"
-          />
-        </div>
-      </section>
-
-      <Separator />
-
       {/* Corporate identity */}
       <section className="space-y-4">
         <div>

package/templates/nextblock-template/app/cms/settings/privacy/page.tsx

@@ -12,9 +12,10 @@ export default async function PrivacySettingsPage() {
         <CardHeader>
           <CardTitle>Privacy &amp; Consent (Law 25 / CASL)</CardTitle>
           <CardDescription>
-            Control the Quebec Law 25 consent banner, the analytics that load only
-            after consent, and the corporate identity appended to the CASL-compliant
-            footer. Analytics scripts download zero bytes until a visitor opts in.
+            Control the Quebec Law 25 consent banner and the corporate identity appended
+            to the CASL-compliant footer. Analytics tags (Google Tag Manager / GA4) are
+            configured under Settings &rarr; Google Analytics and download zero bytes until
+            a visitor opts in here.
           </CardDescription>
         </CardHeader>
         <CardContent>

package/templates/nextblock-template/app/cms/settings/registration/actions.ts

@@ -0,0 +1,44 @@
+// app/cms/settings/registration/actions.ts
+'use server';
+
+import { createClient } from '@nextblock-cms/db/server';
+import { revalidatePath } from 'next/cache';
+import {
+  getSystemConfiguration,
+  updateSystemConfiguration,
+} from '../../../../lib/setup/system-config';
+
+export async function getRegistrationSettings(): Promise<{ autoAcceptSignups: boolean }> {
+  const config = await getSystemConfiguration();
+  return { autoAcceptSignups: config.auto_accept_signups };
+}
+
+async function assertAdmin() {
+  const supabase = createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) {
+    throw new Error('You must be logged in to update settings.');
+  }
+  const { data: profile, error } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+  if (error || !profile || profile.role !== 'ADMIN') {
+    throw new Error('You do not have permission to perform this action.');
+  }
+}
+
+export async function updateRegistrationSettings(formData: FormData) {
+  await assertAdmin();
+
+  const autoAcceptSignups =
+    formData.get('autoAcceptSignups') === 'on' || formData.get('autoAcceptSignups') === 'true';
+
+  await updateSystemConfiguration({ auto_accept_signups: autoAcceptSignups });
+
+  revalidatePath('/cms/settings/registration');
+  return { success: true as const, message: 'Registration settings saved.' };
+}

package/templates/nextblock-template/app/cms/settings/registration/components/RegistrationForm.tsx

@@ -0,0 +1,65 @@
+'use client';
+
+import { useRef, useState, useTransition } from 'react';
+import { Alert, AlertDescription, Button, Checkbox, Spinner } from '@nextblock-cms/ui';
+import { updateRegistrationSettings } from '../actions';
+import type { Message } from '../../../../../components/form-message';
+import { useHotkeys } from '../../../../../hooks/use-hotkeys';
+
+interface RegistrationFormProps {
+  initialSettings: { autoAcceptSignups: boolean };
+}
+
+export default function RegistrationForm({ initialSettings }: RegistrationFormProps) {
+  const [isPending, startTransition] = useTransition();
+  const [message, setMessage] = useState<Message | null>(null);
+  const [autoAccept, setAutoAccept] = useState(initialSettings.autoAcceptSignups);
+
+  const formRef = useRef<HTMLFormElement>(null);
+  useHotkeys('ctrl+s', () => formRef.current?.requestSubmit());
+
+  const handleSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    setMessage(null);
+    const formData = new FormData();
+    formData.append('autoAcceptSignups', autoAccept ? 'on' : '');
+
+    startTransition(async () => {
+      try {
+        const result = await updateRegistrationSettings(formData);
+        setMessage({ success: result.message });
+      } catch (error) {
+        setMessage({ error: error instanceof Error ? error.message : 'Failed to save settings.' });
+      }
+    });
+  };
+
+  return (
+    <form ref={formRef} onSubmit={handleSubmit} className="space-y-6">
+      <label className="flex items-start gap-3 rounded-lg border p-4">
+        <Checkbox checked={autoAccept} onCheckedChange={(c) => setAutoAccept(c === true)} className="mt-1" />
+        <span className="text-sm">
+          <span className="font-medium">Auto-approve new registrations (skip email verification)</span>
+          <span className="block text-xs text-muted-foreground">
+            New sign-ups become active immediately, even without SMTP configured. Convenient for
+            local / self-hosted use. Leave off for public production sites so new accounts must
+            confirm their email address.
+          </span>
+        </span>
+      </label>
+
+      <div className="flex items-center gap-4">
+        <Button type="submit" disabled={isPending}>
+          {isPending ? (<><Spinner className="mr-2 h-4 w-4" /> Saving…</>) : 'Save settings'}
+        </Button>
+        {message && (
+          <Alert variant={'error' in message ? 'destructive' : 'success'} className="py-2 px-4 w-auto inline-flex items-center">
+            <AlertDescription>
+              {'error' in message ? message.error : 'success' in message ? message.success : message.message}
+            </AlertDescription>
+          </Alert>
+        )}
+      </div>
+    </form>
+  );
+}

package/templates/nextblock-template/app/cms/settings/registration/page.tsx

@@ -0,0 +1,27 @@
+// app/cms/settings/registration/page.tsx
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@nextblock-cms/ui';
+import { getRegistrationSettings } from './actions';
+import RegistrationForm from './components/RegistrationForm';
+
+export const dynamic = 'force-dynamic';
+
+export default async function RegistrationSettingsPage() {
+  const settings = await getRegistrationSettings();
+
+  return (
+    <div className="max-w-4xl mx-auto">
+      <Card>
+        <CardHeader>
+          <CardTitle>Sign-ups &amp; Registration</CardTitle>
+          <CardDescription>
+            Control how new public registrations are handled. Email verification requires a
+            configured SMTP server (Settings → Configuration → Email).
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <RegistrationForm initialSettings={settings} />
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

package/templates/nextblock-template/app/cms/settings/security/actions.ts

@@ -106,6 +106,9 @@ export async function updateAutoAcceptSignups(formData: FormData) {
 // --- Global policy (admin only) -------------------------------------------------
 
 export async function updateGlobalSecuritySettings(formData: FormData) {
+  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
+    throw new Error('Security settings are disabled in the sandbox environment.');
+  }
   const { supabase, user } = await requireUser();
   const { data: profile } = await supabase
     .from('profiles')

package/templates/nextblock-template/app/cms/settings/security/components/SecurityPanel.tsx

@@ -503,8 +503,8 @@ function AdminPolicyCard({
             <div className="space-y-1">
               <Label htmlFor="enforce_staff_2fa">Encourage staff to enable 2FA</Label>
               <p className="text-xs text-slate-500">
-                Surfaces a reminder for ADMIN/WRITER accounts that haven&rsquo;t set up a
-                second factor.
+                Shows a reminder banner across the CMS to ADMIN/WRITER accounts that
+                haven&rsquo;t set up a second factor. On by default.
               </p>
             </div>
           </div>

package/templates/nextblock-template/app/cms/settings/security/page.tsx

@@ -1,8 +1,28 @@
 // app/cms/settings/security/page.tsx
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@nextblock-cms/ui';
 import { getSecurityPanelData } from './actions';
 import SecurityPanel from './components/SecurityPanel';
 
 export default async function SecuritySettingsPage() {
+  // The sandbox/demo runs on a single shared account, so per-account security (2FA,
+  // trusted devices, policy) is intentionally disabled there.
+  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') {
+    return (
+      <div className="max-w-4xl mx-auto">
+        <Card>
+          <CardHeader>
+            <CardTitle>Security &amp; 2FA</CardTitle>
+            <CardDescription>
+              Security settings are disabled in the sandbox/demo environment, which runs on a
+              shared account and resets daily. They are available in a real installation.
+            </CardDescription>
+          </CardHeader>
+          <CardContent />
+        </Card>
+      </div>
+    );
+  }
+
   const data = await getSecurityPanelData();
 
   return (

package/templates/nextblock-template/app/layout.tsx

@@ -440,7 +440,10 @@ export default async function RootLayout({
     privacySettings,
   } = await loadLayoutData();
   const draft = await draftMode();
-  const resolvedGtmId = privacySettings.gtm_id || process.env.NEXT_PUBLIC_GTM_ID || '';
+  // GTM container id comes solely from the privacy settings row (site_settings).
+  // There is intentionally no NEXT_PUBLIC_GTM_ID env fallback — analytics is
+  // configured in the CMS (Settings -> Privacy), not via build-time env.
+  const resolvedGtmId = privacySettings.gtm_id || '';
   const visualEditingEnabled =
     draft.isEnabled || process.env.NEXTBLOCK_VISUAL_EDITING_ENABLED === 'true';
   const isVercelDeployment = process.env.VERCEL === '1';
@@ -519,6 +522,7 @@ export default async function RootLayout({
         <DeferredSpeedInsights />
         <ConsentGatedAnalytics
           gtmId={resolvedGtmId}
+          gaMeasurementId={privacySettings.ga_measurement_id || ''}
           customScripts={privacySettings.custom_scripts}
           nonce={nonce}
         />

package/templates/nextblock-template/app/setup/SetupWizard.tsx

@@ -35,14 +35,6 @@ export interface StoragePrefill {
   secretAccessKey: string;
 }
 
-interface SmtpPrefill {
-  host: string;
-  port: string;
-  user: string;
-  fromEmail: string;
-  fromName: string;
-}
-
 export interface SupabaseEnvDetected {
   NEXT_PUBLIC_SUPABASE_URL: boolean;
   SUPABASE_URL: boolean;
@@ -58,20 +50,19 @@ interface Props {
   writable: boolean;
   siteUrl: string;
   storagePrefill: StoragePrefill;
-  smtpPrefill: SmtpPrefill;
-  turnstilePrefill: { siteKey: string };
   /** Which Supabase env vars the running deployment can actually see (read-only channels). */
   supabaseEnvDetected: SupabaseEnvDetected;
 }
 
-type StepId = 'connection' | 'storage' | 'email' | 'bot' | 'signups' | 'admin';
+// Email (SMTP), bot protection, and sign-up policy are no longer collected here — they
+// moved to the CMS (Settings → Configuration) and are nudged from the dashboard onboarding
+// checklist. A fresh install only needs the database connection, media storage, and the
+// first administrator account.
+type StepId = 'connection' | 'storage' | 'admin';
 
 const STEP_TITLES: Record<StepId, string> = {
   connection: 'Database connection',
   storage: 'Media storage',
-  email: 'Email (SMTP)',
-  bot: 'Bot protection',
-  signups: 'Sign-ups',
   admin: 'Administrator account',
 };
 
@@ -89,8 +80,6 @@ export default function SetupWizard({
   writable,
   siteUrl,
   storagePrefill,
-  smtpPrefill,
-  turnstilePrefill,
   supabaseEnvDetected,
 }: Props) {
   const [isPending, startTransition] = useTransition();
@@ -110,15 +99,8 @@ export default function SetupWizard({
   // "Start from a clean database" — only offered/honored on a local fresh install.
   const [resetFirst, setResetFirst] = useState(true);
 
-  // Storage / SMTP / bot / signups / admin.
+  // Storage / admin.
   const [storage, setStorage] = useState(storagePrefill);
-  const [smtp, setSmtp] = useState({ ...smtpPrefill, pass: '' });
-  const [turnstileEnabled, setTurnstileEnabled] = useState(false);
-  const [turnstile, setTurnstile] = useState({
-    siteKey: turnstilePrefill.siteKey,
-    secretKey: '',
-  });
-  const [autoAccept, setAutoAccept] = useState(false); // off by default (defense-in-depth)
   const [admin, setAdmin] = useState({ email: '', password: '', fullName: '' });
 
   const steps = useMemo<StepId[]>(() => {
@@ -131,7 +113,7 @@ export default function SetupWizard({
     if (channel !== 'vercel') {
       list.push('storage');
     }
-    list.push('email', 'bot', 'signups', 'admin');
+    list.push('admin');
     return list;
   }, [configured, channel]);
 
@@ -205,12 +187,6 @@ export default function SetupWizard({
       // (baseUrl only differs if a channel prefilled a separate custom domain).
       put('NEXT_PUBLIC_R2_PUBLIC_URL', storage.publicUrl);
       put('NEXT_PUBLIC_R2_BASE_URL', storage.baseUrl || storage.publicUrl);
-      put('SMTP_HOST', smtp.host);
-      put('SMTP_PORT', smtp.port);
-      put('SMTP_USER', smtp.user);
-      put('SMTP_PASS', smtp.pass);
-      put('SMTP_FROM_EMAIL', smtp.fromEmail);
-      put('SMTP_FROM_NAME', smtp.fromName);
     }
 
     setMessage(null);
@@ -218,12 +194,8 @@ export default function SetupWizard({
     startTransition(async () => {
       const result = await completeSetup({
         admin,
-        autoAcceptSignups: autoAccept,
         envValues,
         resetFirst: resetFirst && writable,
-        turnstile: turnstileEnabled
-          ? { provider: 'turnstile', siteKey: turnstile.siteKey, secretKey: turnstile.secretKey }
-          : { provider: 'none', siteKey: '', secretKey: '' },
       });
 
       if (!result.ok) {
@@ -400,122 +372,6 @@ export default function SetupWizard({
             <StorageStep storage={storage} setStorage={setStorage} channel={channel} />
           )}
 
-          {current === 'email' && (
-            <div className="space-y-4">
-              {channel === 'docker' && (
-                <p className="text-xs text-muted-foreground">
-                  Docker auto-confirms sign-ups when SMTP is not configured, so this is optional.
-                </p>
-              )}
-              <div className="grid gap-4 sm:grid-cols-2">
-                <Field label="SMTP host" htmlFor="smtpHost">
-                  <Input
-                    id="smtpHost"
-                    value={smtp.host}
-                    onChange={(e) => setSmtp({ ...smtp, host: e.target.value })}
-                  />
-                </Field>
-                <Field label="Port" htmlFor="smtpPort">
-                  <Input
-                    id="smtpPort"
-                    value={smtp.port}
-                    onChange={(e) => setSmtp({ ...smtp, port: e.target.value })}
-                  />
-                </Field>
-                <Field label="Username" htmlFor="smtpUser">
-                  <Input
-                    id="smtpUser"
-                    value={smtp.user}
-                    onChange={(e) => setSmtp({ ...smtp, user: e.target.value })}
-                  />
-                </Field>
-                <Field label="Password" htmlFor="smtpPass">
-                  <Input
-                    id="smtpPass"
-                    type="password"
-                    value={smtp.pass}
-                    onChange={(e) => setSmtp({ ...smtp, pass: e.target.value })}
-                  />
-                </Field>
-                <Field label="From email" htmlFor="smtpFromEmail">
-                  <Input
-                    id="smtpFromEmail"
-                    value={smtp.fromEmail}
-                    onChange={(e) => setSmtp({ ...smtp, fromEmail: e.target.value })}
-                  />
-                </Field>
-                <Field label="From name" htmlFor="smtpFromName">
-                  <Input
-                    id="smtpFromName"
-                    value={smtp.fromName}
-                    onChange={(e) => setSmtp({ ...smtp, fromName: e.target.value })}
-                  />
-                </Field>
-              </div>
-              {!writable && channel !== 'docker' && (
-                <p className="text-xs text-muted-foreground">
-                  On this platform, set SMTP_* as environment variables in your hosting dashboard.
-                </p>
-              )}
-            </div>
-          )}
-
-          {current === 'bot' && (
-            <div className="space-y-4">
-              <label className="flex items-start gap-3">
-                <Checkbox
-                  checked={turnstileEnabled}
-                  onCheckedChange={(c) => setTurnstileEnabled(c === true)}
-                  className="mt-1"
-                />
-                <span className="text-sm">
-                  <span className="font-medium">Enable Cloudflare Turnstile</span>
-                  <span className="block text-xs text-muted-foreground">
-                    Protects sign-up / sign-in forms. Stored securely in the database.
-                  </span>
-                </span>
-              </label>
-              {turnstileEnabled && (
-                <div className="grid gap-4 sm:grid-cols-2">
-                  <Field label="Site key" htmlFor="tsSite">
-                    <Input
-                      id="tsSite"
-                      value={turnstile.siteKey}
-                      onChange={(e) => setTurnstile({ ...turnstile, siteKey: e.target.value })}
-                    />
-                  </Field>
-                  <Field label="Secret key" htmlFor="tsSecret">
-                    <Input
-                      id="tsSecret"
-                      type="password"
-                      value={turnstile.secretKey}
-                      onChange={(e) => setTurnstile({ ...turnstile, secretKey: e.target.value })}
-                    />
-                  </Field>
-                </div>
-              )}
-            </div>
-          )}
-
-          {current === 'signups' && (
-            <label className="flex items-start gap-3">
-              <Checkbox
-                checked={autoAccept}
-                onCheckedChange={(c) => setAutoAccept(c === true)}
-                className="mt-1"
-              />
-              <span className="text-sm">
-                <span className="font-medium">
-                  Auto-approve local registrations (skip outbound email verification)
-                </span>
-                <span className="block text-xs text-muted-foreground">
-                  New sign-ups become active immediately, even without SMTP configured. Convenient
-                  for local / self-hosted use; leave off for public production sites.
-                </span>
-              </span>
-            </label>
-          )}
-
           {current === 'admin' && (
             <div className="space-y-4">
               <Field label="Full name" htmlFor="adminName">
@@ -546,6 +402,13 @@ export default function SetupWizard({
                 verification email needed). Finishing also applies the database schema and saved
                 settings, so it can take up to a minute.
               </p>
+              <Alert className="py-2 px-4">
+                <AlertDescription className="text-xs">
+                  Next, your dashboard will guide you through finishing setup — branding, copyright,
+                  email (SMTP), payment providers, and bot protection are all configured there, no
+                  environment variables required.
+                </AlertDescription>
+              </Alert>
 
               {writable && (
                 <label className="flex items-start gap-3 rounded-lg border p-3">
@@ -606,14 +469,8 @@ function stepDescription(step: StepId, channel: DeployChannel): string {
         : channel === 'vercel'
           ? 'Using Supabase Storage (S3-compatible) for media.'
           : 'Bring your own Cloudflare R2 bucket for media storage.';
-    case 'email':
-      return 'Optional. Used for verification emails, password resets, and 2FA codes.';
-    case 'bot':
-      return 'Optional. Add Cloudflare Turnstile to your auth forms.';
-    case 'signups':
-      return 'Choose how new public registrations are handled.';
     case 'admin':
-      return 'Create the first administrator account.';
+      return 'Create the first administrator account — the last step. Email, payments, branding, and the rest are configured from your dashboard.';
     default:
       return '';
   }

package/templates/nextblock-template/app/setup/page.tsx

@@ -91,14 +91,6 @@ export default async function SetupPage() {
       writable={isLocalWritableEnv()}
       siteUrl={process.env.NEXT_PUBLIC_URL ?? ''}
       storagePrefill={buildStoragePrefill(channel, supabaseUrl)}
-      smtpPrefill={{
-        host: process.env.SMTP_HOST ?? '',
-        port: process.env.SMTP_PORT ?? '465',
-        user: process.env.SMTP_USER ?? '',
-        fromEmail: process.env.SMTP_FROM_EMAIL ?? '',
-        fromName: process.env.SMTP_FROM_NAME ?? '',
-      }}
-      turnstilePrefill={{ siteKey: process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY ?? '' }}
       supabaseEnvDetected={{
         NEXT_PUBLIC_SUPABASE_URL: Boolean(process.env.NEXT_PUBLIC_SUPABASE_URL),
         SUPABASE_URL: Boolean(process.env.SUPABASE_URL),

package/templates/nextblock-template/components/AppShell.tsx

@@ -3,7 +3,6 @@
 import type { Database } from '@nextblock-cms/db';
 import { cn } from '@nextblock-cms/utils';
 import { usePathname } from 'next/navigation';
-import Link from 'next/link';
 import { createContext, useContext, useMemo, type ReactNode } from 'react';
 import Header from './Header';
 import FooterNavigation from './FooterNavigation';
@@ -148,12 +147,6 @@ export function AppShell({
                   )}
                 <div className="flex flex-row items-center gap-4">
                   <p className="text-muted-foreground">{copyrightText}</p>
-                  <Link href="/privacy-policy" className="hover:underline">
-                    Privacy Policy
-                  </Link>
-                  <Link href="/terms-of-service" className="hover:underline">
-                    Terms of Service
-                  </Link>
                   <ThemeSwitcher />
                 </div>
               </div>

package/templates/nextblock-template/components/BlockRenderer.tsx

@@ -17,6 +17,7 @@ import ClientTextBlockRenderer from "./blocks/renderers/ClientTextBlockRenderer"
 import { getCachedCustomBlockDefinitionBySlug } from "../lib/custom-block-definitions";
 import { CachedDynamicLayoutEngine } from "./renderers/CachedDynamicLayoutEngine";
 import { resolveBlockRelations } from "../lib/resolve-block-relations";
+import { substitutePrivacyMergeTags } from "../lib/privacy/contact-emails";
 
 const ECOMMERCE_BLOCK_TYPES = new Set([
   "product_grid",
@@ -143,9 +144,16 @@ async function renderLoadedBlock({
 
   // Keep common LCP-adjacent text blocks out of the dynamic renderer manifest.
   if (block.block_type === 'text') {
+    // Top-level text blocks bypass the server TextBlockRenderer, so resolve any
+    // merge tags (e.g. {{privacy_email}} on the Privacy/Terms pages) here.
+    const textContent = block.content as { html_content?: string } | null;
+    const rawHtml = typeof textContent?.html_content === 'string' ? textContent.html_content : '';
+    const html = rawHtml.includes('{{')
+      ? await substitutePrivacyMergeTags(rawHtml)
+      : rawHtml;
     return (
       <ClientTextBlockRenderer
-        content={block.content as any}
+        content={{ ...(textContent as any), html_content: html }}
         languageId={languageId}
         visualEditAttributes={visualEditAttributes}
       />