create-nextblock 0.10.2 → 0.10.4

package/templates/nextblock-template/docs/TECHNICAL_SPECIFICATION.md

@@ -2207,7 +2207,7 @@ Both endpoints enforce `Authorization: Bearer ${CRON_SECRET}` per the security m
 
 ### 3.4.8 Google Tag Manager — Analytics Delivery
 
-Google Tag Manager is loaded via `@next/third-parties` (`^16.1.1`) using the `NEXT_PUBLIC_GTM_ID` environment variable. The production CSP allowlist emitted by `apps/nextblock/proxy.ts` explicitly includes `googletagmanager.com`, `google-analytics.com`, and `analytics.google.com` per F-011's origin allowlist.
+Google Tag Manager is loaded via `@next/third-parties` (`^16.1.1`) using the GTM container id configured in the CMS at **Settings → Privacy** and stored in the `site_settings` table (`privacy_settings.gtm_id`); there is no `NEXT_PUBLIC_GTM_ID` environment variable. The id is read in the root layout via `getPrivacySettings()` and passed through the consent gate, so the tag loads only after the visitor accepts analytics. The production CSP allowlist emitted by `apps/nextblock/proxy.ts` explicitly includes `googletagmanager.com`, `google-analytics.com`, and `analytics.google.com` per F-011's origin allowlist.
 
 ## 3.5 DATABASES AND STORAGE
 
@@ -4192,7 +4192,7 @@ The integration landscape comprises eight external domains declared in `libs/env
 | Frankfurter FX | HTTPS (JSON) | Cron runs 18:00 UTC daily; `maxDuration: 30s` |
 | SMTP | SMTP + TLS | Best-effort from server actions |
 | Vercel Cron | HTTPS + Bearer `CRON_SECRET` | 03:00 UTC (reset-sandbox, 60s); 18:00 UTC (sync-currencies, 30s) |
-| Google Tag Manager | HTTPS (JS) | `NEXT_PUBLIC_GTM_ID`; allowlisted in CSP |
+| Google Tag Manager | HTTPS (JS) | GTM id from `privacy_settings` (site_settings); allowlisted in CSP |
 
 ## 5.2 COMPONENT DETAILS
 
@@ -7135,7 +7135,6 @@ Freemius has the broadest environment surface, reflecting the mixture of store-s
 |:--|:--|
 | `CRON_SECRET` | Bearer token for all `/api/cron/*` endpoints |
 | `REVALIDATE_SECRET_TOKEN` | Header token for `/api/revalidate` |
-| `NEXT_PUBLIC_GTM_ID` | Google Tag Manager container ID |
 
 ##### 6.3.4.4.7 Optional Overrides
 
@@ -7369,7 +7368,7 @@ Per Section 5.1.4.2, each external integration carries explicit SLA-like propert
 | Frankfurter | HTTPS (JSON) | Cron daily 18:00 UTC; `maxDuration: 30s` |
 | SMTP | SMTP + TLS | Best-effort from server actions |
 | Vercel Cron | HTTPS + Bearer CRON_SECRET | 03:00 UTC (reset-sandbox 60s); 18:00 UTC (sync-currencies 30s) |
-| Google Tag Manager | HTTPS (JS) | `NEXT_PUBLIC_GTM_ID`; allowlisted in CSP |
+| Google Tag Manager | HTTPS (JS) | GTM id from `privacy_settings` (site_settings); allowlisted in CSP |
 
 #### 6.3.6.2 Known Integration Limitations
 
@@ -8324,7 +8323,7 @@ The `@vercel/speed-insights ^1.3.1` package is declared in the root `package.jso
 
 ##### 6.5.2.1.2 Google Tag Manager and Client-Side Analytics
 
-Google Tag Manager is integrated via `@next/third-parties` and the `<GoogleTagManager gtmId={process.env.NEXT_PUBLIC_GTM_ID || ''} nonce={nonce} />` component, also mounted in the root layout. Configuration is environment-driven via `NEXT_PUBLIC_GTM_ID`; when the variable is not set, the tag is rendered with an empty `gtmId` and effectively disabled. The CSP allowlists `googletagmanager.com`, `google-analytics.com`, `analytics.google.com`, and `*.googletagmanager.com` origins for `script-src`, `img-src`, and `connect-src`, so analytics delivery operates without breaking the nonce policy.
+Google Tag Manager is integrated via `@next/third-parties`, wrapped by `ConsentGatedAnalytics` → `DeferredGoogleTagManager` and mounted in the root layout. The container id is database-driven: the layout resolves `const resolvedGtmId = privacySettings.gtm_id || ''` from `getPrivacySettings()` (the `privacy_settings` row of `site_settings`, edited at **Settings → Privacy**) — there is no `NEXT_PUBLIC_GTM_ID` env fallback. When the id is empty, no GTM chunk is imported; when set, the tag still loads only after the visitor consents to analytics and after the first interaction event. The CSP allowlists `googletagmanager.com`, `google-analytics.com`, `analytics.google.com`, and `*.googletagmanager.com` origins for `script-src`, `img-src`, and `connect-src`, so analytics delivery operates without breaking the nonce policy.
 
 ##### 6.5.2.1.3 Declared-but-Unused @vercel/analytics
 
@@ -8393,7 +8392,7 @@ The primary alert pathway is the **Feedback System** implemented by `FeedbackMod
 
 ##### 6.5.2.4.2 Configuration-Discovery Alerts
 
-The CMS dashboard at `/cms/dashboard/page.tsx` reads `process.env.NEXT_PUBLIC_GTM_ID` during render and conditionally displays a destructive `<Alert>` banner when GTM is unconfigured (suppressed when explicitly set to the string `'false'`). This is a CMS-admin-facing configuration alert — not a runtime monitoring alert — designed to catch missing telemetry configuration during deployment.
+The CMS dashboard at `/cms/dashboard/page.tsx` calls `getPrivacySettings()` during render and conditionally displays a destructive `<Alert>` banner (linking to **Settings → Privacy**) when no GTM container id is configured in the `privacy_settings` row. This is a CMS-admin-facing configuration alert — not a runtime monitoring alert — designed to catch missing telemetry configuration after deployment.
 
 ##### 6.5.2.4.3 Platform-Managed Alerts
 
@@ -8441,7 +8440,7 @@ flowchart TB
         end
 
         subgraph ConfigAlert["Configuration Banner"]
-            GtmBanner{{NEXT_PUBLIC_GTM_ID not set?<br/>Show destructive Alert}}
+            GtmBanner{{privacy_settings.gtm_id not set?<br/>Show destructive Alert}}
         end
 
         GtmBanner --> MetricRow
@@ -8896,7 +8895,7 @@ The following observability gaps are acknowledged and documented for honest stak
 - `apps/nextblock/app/providers.tsx` — Client provider composition order
 - `libs/ecommerce/src/lib/stripe/webhooks.ts` — Stripe webhook handler with `[Stripe Webhook Error]` prefix; `console.error` on missing `STRIPE_WEBHOOK_SECRET` and on `constructEvent` failure
 - `libs/db/src/lib/package-validation.ts` — License gate with `console.error` and 60-second `unstable_cache` tagged `'package-activation'`
-- `libs/environment.d.ts` — `NodeJS.ProcessEnv` augmentation declaring all telemetry and external-service env vars (`NEXT_PUBLIC_GTM_ID`, `NEXT_PUBLIC_IS_SANDBOX`, `REVALIDATE_SECRET_TOKEN`, `CRON_SECRET`, SMTP vars)
+- `libs/environment.d.ts` — `NodeJS.ProcessEnv` augmentation declaring external-service env vars (Supabase, R2/S3, SMTP, Freemius, OpenRouter/Cortex AI). GTM is no longer env-configured — it lives in `privacy_settings`.
 - `vercel.json` — Two cron schedule declarations: `0 3 * * *` reset-sandbox (60s) and `0 18 * * *` sync-currencies (30s)
 - `package.json` (root) — Dependency declarations including `@vercel/speed-insights ^1.3.1` and `@next/third-parties ^16.1.1`
 - `apps/nextblock/package.json` — Template-level dependency declarations including `@vercel/analytics ^1.6.1` (declared but not imported)
@@ -10423,7 +10422,7 @@ graph TB
 
     subgraph Telemetry["Observability Sinks"]
         SpeedIns[(Vercel Speed Insights<br/>LCP · INP · CLS · TTFB)]
-        GTM[(Google Tag Manager<br/>NEXT_PUBLIC_GTM_ID)]
+        GTM[(Google Tag Manager<br/>privacy_settings.gtm_id)]
         VercelLogs[(Vercel Log Stream<br/>warn + error preserved)]
         FeedbackInbox[(feedback@nextblock.ca<br/>SMTP inbox)]
     end
@@ -10541,7 +10540,7 @@ Runtime configuration is **exclusively environment-variable driven**, consumed t
 
 | Category | Variable Count | Examples |
 |:--|:--|:--|
-| Platform | 4 | `NEXT_PUBLIC_URL`, `TARGET_URL`, `NEXT_PUBLIC_IS_SANDBOX`, `NEXT_PUBLIC_GTM_ID` |
+| Platform | 3 | `NEXT_PUBLIC_URL`, `TARGET_URL`, `NEXT_PUBLIC_IS_SANDBOX` |
 | Secrets / Auth | 3 | `CRON_SECRET`, `REVALIDATE_SECRET_TOKEN`, `LHCI_GITHUB_APP_TOKEN` |
 | FX | 1 | `FX_API_BASE_URL` (defaults to `https://api.frankfurter.dev`) |
 | Supabase | 6 | `SUPABASE_PROJECT_ID`, `POSTGRES_URL`, `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, `SUPABASE_SERVICE_ROLE_KEY`, `SUPABASE_ACCESS_TOKEN` |
@@ -10723,7 +10722,7 @@ Eight external service integrations are declared across the workspace:
 | Frankfurter FX | native `fetch` | N/A (`api.frankfurter.dev`) | Best-effort (skipped currency telemetry) |
 | SMTP | `nodemailer` | `^7.0.10` | Best-effort degrade |
 | Vercel Speed Insights | `@vercel/speed-insights` | `^1.3.1` | Observational |
-| Google Tag Manager | `@next/third-parties` | `^16.1.1` / `1.1.1` | Observational (disabled if `NEXT_PUBLIC_GTM_ID` unset) |
+| Google Tag Manager | `@next/third-parties` | `^16.1.1` / `1.1.1` | Observational (disabled if `privacy_settings.gtm_id` unset) |
 
 ### 8.3.3 High Availability Design
 
@@ -11380,7 +11379,7 @@ graph TB
 
     subgraph InternalDash["In-App Dashboards"]
         CmsDash[/cms/dashboard<br/>Live counts via Supabase]
-        GtmBanner[GTM Config Banner<br/>when NEXT_PUBLIC_GTM_ID unset]
+        GtmBanner[GTM Config Banner<br/>when privacy_settings.gtm_id unset]
     end
 
     SpeedInsClient --> SpeedDash
@@ -11690,7 +11689,6 @@ The following table enumerates environment variables declared in the `NodeJS.Pro
 | `SMTP_FROM_NAME` | SMTP | From-name for transactional mail |
 | `NEXT_PUBLIC_URL` | Platform | Canonical application base URL |
 | `NEXT_PUBLIC_IS_SANDBOX` | Platform | Enables sandbox banner and demo behaviors |
-| `NEXT_PUBLIC_GTM_ID` | Platform | Google Tag Manager container ID |
 | `CRON_SECRET` | Platform | Bearer token authenticating cron endpoints |
 | `REVALIDATE_SECRET_TOKEN` | Platform | Validates on-demand revalidation requests |
 | `FX_API_BASE_URL` | Platform | Frankfurter FX API base URL override |

package/templates/nextblock-template/lib/auth/twoFactor.ts

@@ -10,6 +10,7 @@ import {
   setSecureCookie,
 } from './cookies';
 import { hasValidTrustedDevice } from './trustedDevices';
+import { getSecuritySettings } from '../privacy/settings';
 
 const EMAIL_CODE_TTL_MS = 5 * 60 * 1000; // 5 minutes
 const TWO_FACTOR_SESSION_TTL_SECONDS = 12 * 60 * 60; // 12 hours
@@ -117,6 +118,46 @@ export interface TwoFactorEvaluation {
   mfaType: 'totp' | 'email' | null;
 }
 
+/**
+ * Whether to surface the "set up two-factor authentication" reminder banner to the
+ * currently signed-in staff user. True only when: not in sandbox, the user is an
+ * ADMIN/WRITER, the global "encourage staff to enable 2FA" policy is on, and the user
+ * has not enrolled a second factor. Best-effort — any failure resolves to no banner.
+ */
+export async function getStaffTwoFactorReminder(): Promise<boolean> {
+  // Sandbox runs on a shared demo account; never nag it (the page is disabled there too).
+  if (process.env.NEXT_PUBLIC_IS_SANDBOX === 'true') return false;
+
+  try {
+    const supabase = createClient();
+    const {
+      data: { user },
+    } = await supabase.auth.getUser();
+    if (!user) return false;
+
+    const { data: profile } = await supabase
+      .from('profiles')
+      .select('role')
+      .eq('id', user.id)
+      .maybeSingle();
+    const role = profile?.role;
+    if (role !== 'ADMIN' && role !== 'WRITER') return false;
+
+    const { enforce_staff_2fa } = await getSecuritySettings();
+    if (!enforce_staff_2fa) return false;
+
+    const { data: settings } = await supabase
+      .from('user_security_settings')
+      .select('mfa_enabled, mfa_type')
+      .eq('user_id', user.id)
+      .maybeSingle();
+
+    return !(settings?.mfa_enabled && settings?.mfa_type);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Decide whether the currently signed-in user still owes a second factor.
  * Used both to route sign-in and to guard /cms server-side.

package/templates/nextblock-template/lib/config/email-settings.ts

@@ -0,0 +1,217 @@
+import 'server-only';
+// DB-backed SMTP configuration. Non-secret fields (host, port, from, secure) live in the
+// public `email_public` row; the SMTP username and password live encrypted in the
+// ADMIN-only `email_secret` row. Resolution is DB-first with an env fallback
+// (SMTP_HOST / SMTP_PORT / SMTP_USER / SMTP_PASS / SMTP_FROM_EMAIL / SMTP_FROM_NAME) so
+// existing deployments keep working until the values are moved into the CMS.
+import {
+  createClient,
+  getServiceRoleSupabaseClient,
+  encryptWithEnvKey,
+  getSecretEnvelopeStatus,
+  isSandboxEnvironment,
+  resolveConfigValue,
+  tryDecryptWithEnvKey,
+} from '@nextblock-cms/db/server';
+
+const EMAIL_PUBLIC_KEY = 'email_public';
+const EMAIL_SECRET_KEY = 'email_secret';
+
+export type EmailPublicSettings = {
+  host: string;
+  port: string;
+  fromEmail: string;
+  fromName: string;
+  secure: boolean;
+};
+
+export const DEFAULT_EMAIL_PUBLIC_SETTINGS: EmailPublicSettings = {
+  host: '',
+  port: '',
+  fromEmail: '',
+  fromName: '',
+  secure: true,
+};
+
+/** What the CMS form needs: public fields + whether each secret is already stored. */
+export type EmailSettingsView = EmailPublicSettings & {
+  hasUser: boolean;
+  hasPass: boolean;
+  userLast4: string | null;
+  envFallbackActive: boolean;
+};
+
+/** Fully-resolved transport config consumed by nodemailer. */
+export type ResolvedEmailConfig = {
+  host: string;
+  port: number;
+  secure: boolean;
+  auth: { user: string; pass: string };
+  from: string;
+};
+
+function asString(value: unknown, fallback = ''): string {
+  return typeof value === 'string' ? value : fallback;
+}
+
+function asBool(value: unknown, fallback: boolean): boolean {
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'string') return value === 'true' || value === 'on';
+  return fallback;
+}
+
+function normalizePublic(value: unknown): EmailPublicSettings {
+  const raw = (value && typeof value === 'object' ? value : {}) as Record<string, unknown>;
+  return {
+    host: asString(raw['host']),
+    port: asString(raw['port']),
+    fromEmail: asString(raw['fromEmail']),
+    fromName: asString(raw['fromName']),
+    secure: asBool(raw['secure'], true),
+  };
+}
+
+export async function getEmailPublicSettings(): Promise<EmailPublicSettings> {
+  const supabase = createClient();
+  const { data } = await supabase
+    .from('site_settings')
+    .select('value')
+    .eq('key', EMAIL_PUBLIC_KEY)
+    .maybeSingle();
+  return normalizePublic(data?.value);
+}
+
+/**
+ * Read the public settings plus stored-secret status for the CMS form. Uses the
+ * request-scoped client; RLS restricts the secret row to ADMIN, which is who reaches
+ * this page.
+ */
+export async function getEmailSettingsView(): Promise<EmailSettingsView> {
+  const supabase = createClient();
+  const [{ data: publicData }, { data: secretData }] = await Promise.all([
+    supabase.from('site_settings').select('value').eq('key', EMAIL_PUBLIC_KEY).maybeSingle(),
+    supabase.from('site_settings').select('value').eq('key', EMAIL_SECRET_KEY).maybeSingle(),
+  ]);
+
+  const pub = normalizePublic(publicData?.value);
+  const secret = (secretData?.value ?? {}) as Record<string, unknown>;
+  const userStatus = getSecretEnvelopeStatus(secret['user']);
+  const passStatus = getSecretEnvelopeStatus(secret['pass']);
+
+  return {
+    ...pub,
+    hasUser: userStatus.hasStoredValue,
+    hasPass: passStatus.hasStoredValue,
+    userLast4: userStatus.last4,
+    // Show a hint in the UI when SMTP still comes from env vars rather than the CMS.
+    envFallbackActive: !pub.host && Boolean(process.env['SMTP_HOST']),
+  };
+}
+
+export type SaveEmailSettingsInput = {
+  host: string;
+  port: string;
+  fromEmail: string;
+  fromName: string;
+  secure: boolean;
+  /** Only persisted when non-empty — a blank field keeps the existing stored secret. */
+  user?: string;
+  pass?: string;
+};
+
+/**
+ * Persist email settings. Public fields always overwrite; secret fields are encrypted
+ * and only written when a new value is supplied. Refuses to store real secrets in the
+ * sandbox (its DB resets daily). Caller must enforce ADMIN; RLS double-enforces.
+ */
+export async function saveEmailSettings(input: SaveEmailSettingsInput): Promise<void> {
+  const supabase = createClient();
+
+  const publicValue: EmailPublicSettings = {
+    host: input.host.trim(),
+    port: input.port.trim(),
+    fromEmail: input.fromEmail.trim(),
+    fromName: input.fromName.trim(),
+    secure: input.secure,
+  };
+
+  const { error: publicError } = await supabase
+    .from('site_settings')
+    .upsert({ key: EMAIL_PUBLIC_KEY, value: publicValue });
+  if (publicError) {
+    console.error('Error saving email_public settings:', publicError.message);
+    throw new Error('Failed to save email settings.');
+  }
+
+  const newUser = input.user?.trim();
+  const newPass = input.pass?.trim();
+  if (newUser || newPass) {
+    if (isSandboxEnvironment()) {
+      throw new Error('The sandbox cannot store live SMTP credentials.');
+    }
+
+    // Read-merge so updating only one of user/pass keeps the other.
+    const { data: existing } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', EMAIL_SECRET_KEY)
+      .maybeSingle();
+    const current = (existing?.value ?? {}) as Record<string, unknown>;
+
+    const nextValue: Record<string, unknown> = { ...current };
+    if (newUser) nextValue['user'] = encryptWithEnvKey(newUser);
+    if (newPass) nextValue['pass'] = encryptWithEnvKey(newPass);
+
+    const { error: secretError } = await supabase
+      .from('site_settings')
+      .upsert({ key: EMAIL_SECRET_KEY, value: nextValue });
+    if (secretError) {
+      console.error('Error saving email_secret settings:', secretError.message);
+      throw new Error('Failed to save email credentials.');
+    }
+  }
+}
+
+/**
+ * Resolve the full SMTP transport config, DB-first with an env fallback. Uses the
+ * service-role client so it works from any context (the secret row is ADMIN-only under
+ * RLS). Returns null when host/user/pass/from cannot be resolved from either source.
+ */
+export async function resolveEmailServerConfig(): Promise<ResolvedEmailConfig | null> {
+  let pub: EmailPublicSettings = DEFAULT_EMAIL_PUBLIC_SETTINGS;
+  let secret: Record<string, unknown> = {};
+
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const [{ data: publicData }, { data: secretData }] = await Promise.all([
+      supabase.from('site_settings').select('value').eq('key', EMAIL_PUBLIC_KEY).maybeSingle(),
+      supabase.from('site_settings').select('value').eq('key', EMAIL_SECRET_KEY).maybeSingle(),
+    ]);
+    pub = normalizePublic(publicData?.value);
+    secret = (secretData?.value ?? {}) as Record<string, unknown>;
+  } catch {
+    // No service-role key (unconfigured instance) — fall through to env-only resolution.
+  }
+
+  const host = resolveConfigValue(pub.host, 'SMTP_HOST');
+  const port = resolveConfigValue(pub.port, 'SMTP_PORT');
+  const fromEmail = resolveConfigValue(pub.fromEmail, 'SMTP_FROM_EMAIL');
+  const fromName = resolveConfigValue(pub.fromName, 'SMTP_FROM_NAME');
+  const user = resolveConfigValue(tryDecryptWithEnvKey(secret['user']), 'SMTP_USER');
+  const pass = resolveConfigValue(tryDecryptWithEnvKey(secret['pass']), 'SMTP_PASS');
+
+  if (!host || !port || !user || !pass || !fromEmail) {
+    console.warn('Email is not configured (CMS or SMTP_* env). Outbound email will not be sent.');
+    return null;
+  }
+
+  const portNumber = Number(port);
+  return {
+    host,
+    port: portNumber,
+    // Honor the CMS toggle; fall back to the SMTPS convention (465 ⇒ implicit TLS).
+    secure: pub.host ? pub.secure : portNumber === 465,
+    auth: { user, pass },
+    from: fromName ? `"${fromName}" <${fromEmail}>` : fromEmail,
+  };
+}

package/templates/nextblock-template/lib/onboarding/actions.ts

@@ -0,0 +1,31 @@
+'use server';
+
+import { createClient } from '@nextblock-cms/db/server';
+import { revalidatePath } from 'next/cache';
+
+/** Persist the onboarding dismiss flag in the `onboarding_state` row (read-merge). */
+export async function setOnboardingDismissed(dismissed: boolean) {
+  const supabase = createClient();
+
+  const { data: existing } = await supabase
+    .from('site_settings')
+    .select('value')
+    .eq('key', 'onboarding_state')
+    .maybeSingle();
+
+  const current =
+    existing?.value && typeof existing.value === 'object' && !Array.isArray(existing.value)
+      ? (existing.value as Record<string, unknown>)
+      : {};
+
+  const { error } = await supabase
+    .from('site_settings')
+    .upsert({ key: 'onboarding_state', value: { ...current, dismissed } });
+
+  if (error) {
+    console.error('Error updating onboarding state:', error.message);
+    throw new Error('Failed to update onboarding state.');
+  }
+
+  revalidatePath('/cms/dashboard');
+}

package/templates/nextblock-template/lib/onboarding/status.ts

@@ -0,0 +1,136 @@
+import 'server-only';
+// Derives the dashboard onboarding checklist live from configuration state. Every check
+// reads public/service-role data only, so it works for both ADMIN and WRITER dashboards.
+import { createClient } from '@nextblock-cms/db/server';
+import { getStoreConfigStatus } from '@nextblock-cms/ecommerce/server';
+import { getEmailPublicSettings } from '../config/email-settings';
+import { getPrivacySettings } from '../privacy/settings';
+
+export type OnboardingStep = {
+  key: string;
+  title: string;
+  description: string;
+  href: string;
+  done: boolean;
+  optional: boolean;
+};
+
+export type OnboardingStatus = {
+  steps: OnboardingStep[];
+  completed: number;
+  total: number;
+  dismissed: boolean;
+};
+
+function hasCopyright(value: unknown): boolean {
+  if (!value || typeof value !== 'object') return false;
+  return Object.values(value as Record<string, unknown>).some(
+    (v) => typeof v === 'string' && v.trim().length > 0
+  );
+}
+
+export async function getOnboardingStatus(opts: {
+  isEcommerceActive: boolean;
+}): Promise<OnboardingStatus> {
+  const supabase = createClient();
+
+  const [{ data: settingRows }, { data: logoRow }, emailPublic, privacy] = await Promise.all([
+    supabase
+      .from('site_settings')
+      .select('key, value')
+      .in('key', ['footer_copyright', 'bot_protection_public', 'onboarding_state']),
+    supabase.from('logos').select('id').limit(1).maybeSingle(),
+    getEmailPublicSettings(),
+    getPrivacySettings(),
+  ]);
+
+  const rows = new Map((settingRows ?? []).map((r) => [r.key, r.value]));
+  const botPublic = (rows.get('bot_protection_public') ?? {}) as Record<string, unknown>;
+  const onboardingState = (rows.get('onboarding_state') ?? {}) as Record<string, unknown>;
+
+  const brandingDone = Boolean(logoRow);
+  const copyrightDone = hasCopyright(rows.get('footer_copyright'));
+  const emailDone = Boolean(emailPublic.host) || Boolean(process.env['SMTP_HOST']);
+  const analyticsDone = Boolean(privacy.gtm_id);
+  const botProvider = typeof botPublic['provider'] === 'string' ? (botPublic['provider'] as string) : 'none';
+  const botDone = botProvider !== 'none' && botProvider !== '';
+
+  const steps: OnboardingStep[] = [
+    {
+      key: 'admin',
+      title: 'Create your admin account',
+      description: 'Your administrator account is set up.',
+      href: '/cms/users',
+      done: true,
+      optional: false,
+    },
+    {
+      key: 'branding',
+      title: 'Add your branding',
+      description: 'Upload your logo and set your site identity.',
+      href: '/cms/settings/logos',
+      done: brandingDone,
+      optional: false,
+    },
+    {
+      key: 'copyright',
+      title: 'Set your copyright / footer',
+      description: 'Configure the footer copyright shown across your site.',
+      href: '/cms/settings/copyright',
+      done: copyrightDone,
+      optional: false,
+    },
+    {
+      key: 'email',
+      title: 'Configure email (SMTP)',
+      description: 'Enable verification emails, password resets, and notifications.',
+      href: '/cms/settings/email',
+      done: emailDone,
+      optional: false,
+    },
+    {
+      key: 'analytics',
+      title: 'Connect analytics',
+      description: 'Add a Google Tag Manager ID for consent-gated analytics.',
+      href: '/cms/settings/google-analytics',
+      done: analyticsDone,
+      optional: true,
+    },
+    {
+      key: 'bot',
+      title: 'Enable bot protection',
+      description: 'Protect your sign-up and sign-in forms with a CAPTCHA.',
+      href: '/cms/settings/bot-protection',
+      done: botDone,
+      optional: true,
+    },
+  ];
+
+  if (opts.isEcommerceActive) {
+    let paymentsDone = false;
+    try {
+      const storeStatus = await getStoreConfigStatus();
+      paymentsDone = storeStatus.stripe.hasKeys || storeStatus.freemius.hasKeys;
+    } catch {
+      paymentsDone = false;
+    }
+    // Insert Payments before the optional steps.
+    steps.splice(4, 0, {
+      key: 'payments',
+      title: 'Set up payment providers',
+      description: 'Add your Stripe and/or Freemius API keys to accept payments.',
+      href: '/cms/payments',
+      done: paymentsDone,
+      optional: false,
+    });
+  }
+
+  const completed = steps.filter((s) => s.done).length;
+
+  return {
+    steps,
+    completed,
+    total: steps.length,
+    dismissed: onboardingState['dismissed'] === true,
+  };
+}

package/templates/nextblock-template/lib/privacy/contact-emails.ts

@@ -0,0 +1,64 @@
+// Server-only resolution of the public-facing contact addresses that used to be
+// hard-coded into seed data. The goal: a downloaded/self-hosted copy of NextBlock
+// must NEVER route mail to the original authors. Real addresses live only in
+// sandbox env vars (never committed); committed seeds use neutral @example.com
+// placeholders.
+//
+// Resolution precedence (highest first):
+//   1. The admin-configured value (CMS Settings -> Privacy "Support email").
+//   2. The sandbox env var, but only when NEXT_PUBLIC_IS_SANDBOX === 'true'.
+//   3. A neutral @example.com placeholder.
+//
+// Sandbox DB resets re-seed dummy values on every run, so a static seed value
+// could never stay correct for the hosted demo — hence env-var-backed resolution
+// at render time instead of baking the address into the migration.
+import 'server-only';
+import { cache } from 'react';
+import { getPrivacySettings } from './settings';
+
+/** Neutral placeholder shown when nothing is configured (real installs). */
+const DUMMY_PRIVACY_EMAIL = 'privacy@example.com';
+
+/** Merge tag seeded into the Privacy Policy / Terms page copy. */
+export const PRIVACY_EMAIL_TAG = '{{privacy_email}}';
+
+function isSandbox(): boolean {
+  return process.env.NEXT_PUBLIC_IS_SANDBOX === 'true';
+}
+
+/**
+ * Resolve the privacy/legal contact address. `supportEmail` is the admin-set
+ * value from privacy settings (reused as the legal contact per product choice).
+ */
+export function resolvePrivacyEmail(supportEmail: string): string {
+  const configured = supportEmail.trim();
+  if (configured) return configured;
+
+  if (isSandbox()) {
+    const fromEnv = process.env.SANDBOX_PRIVACY_EMAIL?.trim();
+    if (fromEnv) return fromEnv;
+  }
+
+  return DUMMY_PRIVACY_EMAIL;
+}
+
+/**
+ * Per-request cached read of the resolved privacy email. Wrapped in React
+ * `cache()` so the many text blocks on a legal page share a single settings
+ * lookup within one render.
+ */
+export const getPrivacyMergeEmail = cache(async (): Promise<string> => {
+  const settings = await getPrivacySettings();
+  return resolvePrivacyEmail(settings.corporate.support_email);
+});
+
+/**
+ * Substitute supported merge tags in a block's HTML. Callers should guard with a
+ * cheap `html.includes('{{')` check first so normal blocks pay nothing.
+ * Currently supports `{{privacy_email}}` (text and `mailto:` href forms).
+ */
+export async function substitutePrivacyMergeTags(html: string): Promise<string> {
+  if (!html.includes(PRIVACY_EMAIL_TAG)) return html;
+  const email = await getPrivacyMergeEmail();
+  return html.split(PRIVACY_EMAIL_TAG).join(email);
+}

package/templates/nextblock-template/lib/privacy/settings.ts

@@ -90,6 +90,18 @@ export async function savePrivacySettings(input: PrivacySettings): Promise<void>
   }
 }
 
+// Privacy/consent and Google Analytics share the single `privacy_settings` row but
+// are edited from two different CMS pages (Settings -> Privacy vs Settings -> Google
+// Analytics). Each page must persist only its own fields without clobbering the other
+// page's, so writes read-merge against the current row. (We may split this into a
+// dedicated `analytics_settings` key later.)
+export async function mergePrivacySettings(
+  patch: Partial<PrivacySettings>
+): Promise<void> {
+  const current = await getPrivacySettings();
+  await savePrivacySettings({ ...current, ...patch });
+}
+
 export async function saveSecuritySettings(input: SecuritySettings): Promise<void> {
   const supabase = createClient();
   const value = normalizeSecurity(input);

package/templates/nextblock-template/lib/privacy/types.ts

@@ -61,7 +61,9 @@ export const DEFAULT_TRUSTED_DEVICE_DAYS = 30;
 
 export const DEFAULT_SECURITY_SETTINGS: SecuritySettings = {
   trusted_device_days: DEFAULT_TRUSTED_DEVICE_DAYS,
-  enforce_staff_2fa: false,
+  // On by default: staff are encouraged to enable 2FA (a CMS reminder banner is shown to
+  // ADMIN/WRITER accounts without a second factor). Never enforced in the sandbox.
+  enforce_staff_2fa: true,
 };
 
 export type MfaType = 'totp' | 'email';