create-nextblock 0.10.7 → 0.10.9

package/templates/nextblock-template/lib/setup/migrations-bundle.ts

@@ -178,5 +178,25 @@ export const MIGRATIONS_BUNDLE: BundledMigration[] = [
     "version": "00000000000032",
     "name": "00000000000032_neutralize_seeded_contact_emails.sql",
     "sql": "-- 00000000000032_neutralize_seeded_contact_emails.sql\n-- Remove the original authors' contact addresses from seeded content so a\n-- downloaded / self-hosted copy of NextBlock never routes mail to us.\n--\n-- Earlier migrations baked real addresses into block content:\n--   * 00000000000027 seeded `privacy@nextblock.dev` across the Privacy Policy and\n--     Terms pages (EN + FR), as visible text and `mailto:` links.\n--   * 00000000000010 seeded a `mailto:info@nextblock.dev` CTA on the French home\n--     page (the English page correctly links to /contact), and `foo@bar.com` as\n--     the contact form recipient.\n--\n-- Migrations are append-only, so this is a forward-only data fix rather than an\n-- edit of those files. Each statement is idempotent (a no-op once applied).\n--\n-- The `{{privacy_email}}` token is resolved at render time by the app\n-- (apps/nextblock/lib/privacy/contact-emails.ts): admin \"Support email\" setting\n-- -> SANDBOX_PRIVACY_EMAIL env (sandbox only) -> privacy@example.com fallback.\n\n-- 1. Privacy / Terms legal pages: swap the hard-coded address for a merge tag.\nUPDATE public.blocks\nSET content = replace(content::text, 'privacy@nextblock.dev', '{{privacy_email}}')::jsonb\nWHERE content::text LIKE '%privacy@nextblock.dev%';\n\n-- 2. French home \"Nous contacter\" CTA: point at the contact form like the English\n--    page instead of a mailto to our inbox.\nUPDATE public.blocks\nSET content = replace(content::text, 'mailto:info@nextblock.dev', '/contact')::jsonb\nWHERE content::text LIKE '%mailto:info@nextblock.dev%';\n\n-- 3. Contact form default recipient: use a neutral placeholder. In sandbox the\n--    app overrides this with SANDBOX_CONTACT_EMAIL at submit time.\nUPDATE public.blocks\nSET content = replace(content::text, 'foo@bar.com', 'contact@example.com')::jsonb\nWHERE content::text LIKE '%foo@bar.com%';\n"
+  },
+  {
+    "version": "00000000000033",
+    "name": "00000000000033_setup_config_settings.sql",
+    "sql": "-- 00000000000033_setup_config_settings.sql\n-- DB-backed CMS configuration: move SMTP and payment-provider credentials out of\n-- environment variables and into `site_settings`. Secret rows (email_secret,\n-- payment_secret) hold AES-256-GCM envelopes and are restricted to ADMIN / service_role,\n-- extending the sensitive-key masking established in migration 018. Public rows hold\n-- non-secret config (SMTP host/from, publishable keys, provider flags) and the dashboard\n-- onboarding state.\n--\n-- This re-issues ALL FOUR site_settings policies because the masked-key list is embedded\n-- in each policy body and Postgres has no incremental \"add a key\" operation.\n\nCOMMENT ON TABLE public.site_settings IS 'Key-value store for global site settings. Sensitive keys (Cortex AI BYOK, Bot Protection Secret, Email secret, Payment secret) hold encrypted envelopes and are restricted to ADMIN via row-level policies.';\n\nDROP POLICY IF EXISTS site_settings_read_policy ON public.site_settings;\nDROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;\nDROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;\nDROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;\n\nCREATE POLICY site_settings_read_policy\n  ON public.site_settings\n  FOR SELECT\n  TO public\n  USING (\n    key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n    OR (\n      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT auth.role()) = 'authenticated'\n      AND (SELECT public.get_current_user_role()) = 'ADMIN'\n    )\n  );\n\nCREATE POLICY site_settings_insert_policy\n  ON public.site_settings\n  FOR INSERT\n  TO authenticated\n  WITH CHECK (\n    (\n      key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER')\n    )\n    OR (\n      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT public.get_current_user_role()) = 'ADMIN'\n    )\n  );\n\nCREATE POLICY site_settings_update_policy\n  ON public.site_settings\n  FOR UPDATE\n  TO authenticated\n  USING (\n    (\n      key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER')\n    )\n    OR (\n      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT public.get_current_user_role()) = 'ADMIN'\n    )\n  )\n  WITH CHECK (\n    (\n      key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER')\n    )\n    OR (\n      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT public.get_current_user_role()) = 'ADMIN'\n    )\n  );\n\nCREATE POLICY site_settings_delete_policy\n  ON public.site_settings\n  FOR DELETE\n  TO authenticated\n  USING (\n    (\n      key NOT IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER')\n    )\n    OR (\n      key IN ('cortex_ai_openrouter_api_key', 'bot_protection_secret', 'email_secret', 'payment_secret')\n      AND (SELECT public.get_current_user_role()) = 'ADMIN'\n    )\n  );\n\n-- Seed the new configuration rows (idempotent). Secret rows are created on first save\n-- from the CMS, so they are intentionally not seeded here.\nINSERT INTO public.site_settings (key, value)\nVALUES ('email_public', '{\"host\": \"\", \"port\": \"\", \"fromEmail\": \"\", \"fromName\": \"\", \"secure\": true}'::jsonb)\nON CONFLICT (key) DO NOTHING;\n\nINSERT INTO public.site_settings (key, value)\nVALUES ('payment_public', '{\"stripe\": {\"publishableKey\": \"\"}, \"freemius\": {\"developerId\": \"\", \"publicKey\": \"\", \"productId\": \"\", \"sandboxEnabled\": false}}'::jsonb)\nON CONFLICT (key) DO NOTHING;\n\nINSERT INTO public.site_settings (key, value)\nVALUES ('onboarding_state', '{\"dismissed\": false, \"skipped\": []}'::jsonb)\nON CONFLICT (key) DO NOTHING;\n"
+  },
+  {
+    "version": "00000000000034",
+    "name": "00000000000034_enable_staff_2fa_reminder_default.sql",
+    "sql": "-- 00000000000034_enable_staff_2fa_reminder_default.sql\n-- Turn the \"Encourage staff to enable 2FA\" policy ON by default. The reminder banner is\n-- now implemented (shown to ADMIN/WRITER accounts without a second factor); migration 027\n-- seeded this flag to false, so flip the existing security_settings row to true. Admins can\n-- still turn it off afterward. The sandbox never enforces it (handled at runtime), so the\n-- stored value here is harmless after a sandbox reset.\n\nUPDATE public.site_settings\nSET value = jsonb_set(coalesce(value, '{}'::jsonb), '{enforce_staff_2fa}', 'true'::jsonb)\nWHERE key = 'security_settings';\n\n-- Cover the unlikely case where the row is missing (it is seeded in migration 027).\nINSERT INTO public.site_settings (key, value)\nVALUES ('security_settings', '{\"trusted_device_days\": 30, \"enforce_staff_2fa\": true}'::jsonb)\nON CONFLICT (key) DO NOTHING;\n"
+  },
+  {
+    "version": "00000000000035",
+    "name": "00000000000035_reassert_advisor_fixes.sql",
+    "sql": "-- 00000000000035_reassert_advisor_fixes.sql\n-- Re-assert two Supabase Advisor (database linter) fixes that were first applied in\n-- migration 00000000000028 but can be lost when a database is restored/reset to a\n-- pre-028 state while its migration history still records 028 as applied (so the forward\n-- tooling never re-runs it). These two advisors reappeared, so we re-apply the fixes in a\n-- forward-only, idempotent way. No application behaviour changes.\n--\n--   1. 0011 function_search_path_mutable\n--      public.handle_ucp_cart_sessions_update() needs a pinned search_path.\n--   2. 0029 authenticated_security_definer_function_executable\n--      public.duplicate_block_definition(uuid) must run as SECURITY INVOKER (it already\n--      keeps its own ADMIN/WRITER role check and is gated by custom_block_definitions RLS).\n\n-- 1. Pin the search_path. Re-create the function with SET search_path baked into its\n--    definition (not just an ALTER) so a future CREATE OR REPLACE can't silently drop it.\n--    The body only calls now() (pg_catalog, always implicitly searched), so an empty\n--    search_path is safe. CREATE OR REPLACE keeps the function OID, so the existing\n--    trg_handle_ucp_cart_sessions_update trigger and the service_role grant are preserved.\nCREATE OR REPLACE FUNCTION public.handle_ucp_cart_sessions_update()\nRETURNS trigger\nLANGUAGE plpgsql\nSET search_path = ''\nAS $$\nBEGIN\n  NEW.updated_at = now();\n  RETURN NEW;\nEND;\n$$;\n\n-- 2. Ensure the duplicate helper runs with the caller's privileges. The function body\n--    (unchanged) still raises 42501 for non-ADMIN/WRITER callers, and its SELECT/INSERT\n--    are gated by custom_block_definitions RLS, so it does not need definer privileges.\nALTER FUNCTION public.duplicate_block_definition(uuid) SECURITY INVOKER;\n"
+  },
+  {
+    "version": "00000000000036",
+    "name": "00000000000036_setup_system_alerts.sql",
+    "sql": "-- System notification layer for the automated upstream-update architecture.\n--\n-- `system_alerts` is the single sink that every update track writes into:\n--   * Track A (the .github/workflows/nextblock-sync.yml GitHub Action) inserts a\n--     'merge_conflict' row via the Supabase REST API when an upstream merge can't be\n--     auto-resolved, so the CMS dashboard can point an operator at GitHub to sort it.\n--   * Track B (the runtime update engine, app/api/cms/check-updates) inserts a\n--     'runtime_update_available' row for non-git installs (npm create / local / Docker)\n--     with a download link to the latest verified release tarball.\n-- The dashboard banner (cms/layout.tsx -> SystemAlertsBanner) renders unresolved rows.\n--\n-- Writers always use the service-role key (REST API / getServiceRoleSupabaseClient),\n-- which bypasses RLS; RLS below only governs who can READ/RESOLVE from the dashboard.\n\ncreate table if not exists public.system_alerts (\n  id uuid primary key default gen_random_uuid(),\n  -- The notification kind. Constrained to the two tracks this system emits; widen the\n  -- CHECK in a later migration if new alert kinds are added.\n  alert_type text not null check (alert_type in ('merge_conflict', 'runtime_update_available')),\n  title text not null,\n  message text not null,\n  -- Structured context for deep-linking the banner CTA, e.g.\n  --   merge_conflict           -> { \"repo\": \"owner/name\", \"branch\": \"...\", \"action_url\": \"https://github.com/owner/name/branches\" }\n  --   runtime_update_available -> { \"latest_version\": \"0.11.0\", \"download_url\": \"https://github.com/.../v0.11.0.tar.gz\" }\n  metadata jsonb not null default '{}'::jsonb,\n  is_resolved boolean not null default false,\n  resolved_at timestamptz,\n  created_at timestamptz not null default now(),\n  updated_at timestamptz not null default now()\n);\n\ncomment on table public.system_alerts is 'System notifications for the automated upstream-update architecture (merge conflicts, runtime updates available). Written by service-role; read by ADMINs.';\ncomment on column public.system_alerts.alert_type is 'One of: merge_conflict, runtime_update_available.';\ncomment on column public.system_alerts.metadata is 'Structured deep-link context for the dashboard banner CTA (repo/branch/action_url or latest_version/download_url).';\ncomment on column public.system_alerts.is_resolved is 'When true the alert is hidden from the dashboard banner.';\n\n-- Banner query: unresolved alerts, newest first.\ncreate index if not exists idx_system_alerts_unresolved\n  on public.system_alerts (is_resolved, created_at desc);\n\n-- Keep updated_at fresh on every mutation (same helper used across the schema).\ndrop trigger if exists trg_system_alerts_updated_at on public.system_alerts;\ncreate trigger trg_system_alerts_updated_at\n  before update on public.system_alerts\n  for each row\n  execute function public.set_current_timestamp_updated_at();\n\nalter table public.system_alerts enable row level security;\n\n-- Only authenticated ADMINs may view alerts in the dashboard. WRITERs and the public\n-- anon role get zero rows (RLS default-deny: no policy applies to them).\ndrop policy if exists system_alerts_select_admin on public.system_alerts;\ncreate policy system_alerts_select_admin\n  on public.system_alerts\n  for select\n  to authenticated\n  using ((select public.get_current_user_role()) = 'ADMIN');\n\n-- ADMINs may resolve (dismiss) alerts from the dashboard. Inserts are service-role only\n-- (RLS-bypassing), so there is intentionally no INSERT policy.\ndrop policy if exists system_alerts_update_admin on public.system_alerts;\ncreate policy system_alerts_update_admin\n  on public.system_alerts\n  for update\n  to authenticated\n  using ((select public.get_current_user_role()) = 'ADMIN')\n  with check ((select public.get_current_user_role()) = 'ADMIN');\n\n-- Base table privileges (RLS still filters rows on top of these). Mirrors the grant\n-- model the rest of the schema uses; service_role keeps full access for the writers.\ngrant select, update on public.system_alerts to authenticated;\ngrant all on public.system_alerts to service_role;\n"
   }
 ];

package/templates/nextblock-template/lib/updates/check-upstream.ts

@@ -0,0 +1,404 @@
+import 'server-only';
+// Track B — Decoupled application runtime update engine + Track-A conflict mirror.
+//
+// Two responsibilities, both writing into system_alerts via the service-role client
+// (the key this install already has — no GitHub secrets required):
+//   1. checkForUpstreamUpdate(): poll the public GitHub Releases API, compare the latest
+//      release against this install's package.json version, and on a NON-git (standalone)
+//      install record a 'runtime_update_available' alert with a tarball download link.
+//   2. checkForSyncConflicts(): for git-backed installs, poll THIS fork's issues for the
+//      'nextblock-sync-conflict' label the sync workflow opens, and mirror open ones into
+//      'merge_conflict' alerts (clearing them when the issue closes). This is the "pull"
+//      half of Track A: the GitHub Action signals with the auto-provided GITHUB_TOKEN, and
+//      the app — which holds the Supabase key — owns the alert write. Zero GitHub secrets.
+//
+// Private forks: set NEXTBLOCK_GITHUB_TOKEN so the issue/run polling is authenticated.
+// Public forks need nothing (the unauthenticated GitHub API is sufficient).
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+import { getSystemConfiguration, setSystemConfigurationServiceRole } from '../setup/system-config';
+import { resolveSelfRepo } from './repo-identity';
+import pkg from '../../package.json';
+
+const UPSTREAM_REPO = 'nextblock-cms/nextblock';
+const RELEASES_API = `https://api.github.com/repos/${UPSTREAM_REPO}/releases/latest`;
+const CONFLICT_LABEL = 'nextblock-sync-conflict';
+const REFRESH_INTERVAL_MS = 6 * 60 * 60 * 1000; // throttle the background poll to every 6h
+
+export type UpdateTrack = 'git' | 'standalone';
+
+export interface UpstreamUpdateResult {
+  ok: boolean;
+  currentVersion: string;
+  latestVersion: string | null;
+  updateAvailable: boolean;
+  track: UpdateTrack;
+  htmlUrl?: string;
+  tarballUrl?: string;
+  zipballUrl?: string;
+  publishedAt?: string;
+  alertRecorded: boolean;
+  error?: string;
+}
+
+export interface SyncConflictResult {
+  ok: boolean;
+  repo: string | null;
+  openConflicts: number;
+  actionsActive: boolean;
+  alertsWritten: number;
+  alertsResolved: number;
+  error?: string;
+}
+
+/** GitHub API headers, authenticated when a token is configured (needed for private forks). */
+function githubHeaders(): Record<string, string> {
+  const token =
+    process.env.NEXTBLOCK_GITHUB_TOKEN?.trim() ||
+    process.env.GITHUB_TOKEN?.trim() ||
+    process.env.GH_TOKEN?.trim();
+  const headers: Record<string, string> = {
+    Accept: 'application/vnd.github+json',
+    'X-GitHub-Api-Version': '2022-11-28',
+    'User-Agent': 'nextblock-update-checker',
+  };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  return headers;
+}
+
+/** Compare two semver-ish strings. >0 if a>b, <0 if a<b, 0 if equal. */
+function compareSemver(a: string, b: string): number {
+  const parse = (v: string) =>
+    v
+      .trim()
+      .replace(/^v/i, '')
+      .split('-')[0]
+      .split('.')
+      .map((n) => Number.parseInt(n, 10) || 0);
+  const pa = parse(a);
+  const pb = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0) return diff > 0 ? 1 : -1;
+  }
+  return 0;
+}
+
+/**
+ * Classify how this install receives updates. Explicit NEXTBLOCK_UPDATE_TRACK wins;
+ * otherwise Vercel / repos carrying the sync workflow or an upstream remote are 'git'
+ * (Track A), everything else is 'standalone' (Track B).
+ */
+function detectTrack(): UpdateTrack {
+  const override = process.env.NEXTBLOCK_UPDATE_TRACK?.trim().toLowerCase();
+  if (override === 'git' || override === 'standalone') return override;
+
+  if (process.env.VERCEL === '1') return 'git';
+  if (resolveSelfRepo()) {
+    // A resolvable GitHub repo identity means git-backed; double-check it's a NextBlock fork.
+    const cwd = process.cwd();
+    try {
+      if (existsSync(path.join(cwd, '.github', 'workflows', 'nextblock-sync.yml'))) return 'git';
+    } catch {
+      /* ignore */
+    }
+    try {
+      const gitConfig = path.join(cwd, '.git', 'config');
+      if (existsSync(gitConfig) && /nextblock/i.test(readFileSync(gitConfig, 'utf8'))) return 'git';
+    } catch {
+      /* ignore */
+    }
+  }
+  return 'standalone';
+}
+
+/**
+ * Poll GitHub Releases and, on a standalone install with a newer release, record a
+ * runtime_update_available alert (deduped by latest version). Never throws.
+ */
+export async function checkForUpstreamUpdate(): Promise<UpstreamUpdateResult> {
+  const currentVersion = pkg.version;
+  const track = detectTrack();
+  const base: UpstreamUpdateResult = {
+    ok: false,
+    currentVersion,
+    latestVersion: null,
+    updateAvailable: false,
+    track,
+    alertRecorded: false,
+  };
+
+  let release: {
+    tag_name?: string;
+    html_url?: string;
+    tarball_url?: string;
+    zipball_url?: string;
+    published_at?: string;
+  };
+  try {
+    const res = await fetch(RELEASES_API, {
+      headers: githubHeaders(),
+      signal: AbortSignal.timeout(15_000),
+      next: { revalidate: 3600 },
+    });
+    if (res.status === 404) return { ...base, ok: true }; // no releases yet
+    if (!res.ok) return { ...base, error: `GitHub Releases API returned HTTP ${res.status}.` };
+    release = await res.json();
+  } catch (caught) {
+    return {
+      ...base,
+      error:
+        caught instanceof Error
+          ? `Could not reach the GitHub Releases API: ${caught.message}`
+          : 'Could not reach the GitHub Releases API.',
+    };
+  }
+
+  const tag = release.tag_name?.trim();
+  if (!tag) return { ...base, ok: true };
+
+  const latestVersion = tag.replace(/^v/i, '');
+  const tarballUrl =
+    release.tarball_url || `https://github.com/${UPSTREAM_REPO}/archive/refs/tags/${tag}.tar.gz`;
+  const zipballUrl =
+    release.zipball_url || `https://github.com/${UPSTREAM_REPO}/archive/refs/tags/${tag}.zip`;
+  const updateAvailable = compareSemver(latestVersion, currentVersion) > 0;
+
+  const result: UpstreamUpdateResult = {
+    ...base,
+    ok: true,
+    latestVersion,
+    updateAvailable,
+    htmlUrl: release.html_url,
+    tarballUrl,
+    zipballUrl,
+    publishedAt: release.published_at,
+  };
+
+  // Git-backed installs auto-merge via Track A — no runtime update alert for them.
+  if (!updateAvailable || track !== 'standalone') return result;
+
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const { data: existing } = await supabase
+      .from('system_alerts')
+      .select('id, metadata')
+      .eq('alert_type', 'runtime_update_available')
+      .eq('is_resolved', false)
+      .limit(50);
+
+    const alreadyAlerted = (existing ?? []).some(
+      (row) =>
+        (row.metadata as { latest_version?: string } | null)?.latest_version === latestVersion,
+    );
+    if (alreadyAlerted) return result;
+
+    const { error } = await supabase.from('system_alerts').insert({
+      alert_type: 'runtime_update_available',
+      title: `NextBlock ${latestVersion} is available`,
+      message: `A newer NextBlock release (${latestVersion}) is available — you are on ${currentVersion}. Download the release archive, replace your files, and update dependencies to upgrade.`,
+      metadata: {
+        latest_version: latestVersion,
+        current_version: currentVersion,
+        download_url: tarballUrl,
+        zipball_url: zipballUrl,
+        html_url: release.html_url ?? null,
+      },
+    });
+    if (error) return { ...result, error: `Could not record the update alert: ${error.message}` };
+    return { ...result, alertRecorded: true };
+  } catch (caught) {
+    return {
+      ...result,
+      error:
+        caught instanceof Error
+          ? `Could not record the update alert: ${caught.message}`
+          : 'Could not record the update alert.',
+    };
+  }
+}
+
+/**
+ * Mirror Track-A sync conflicts (open GitHub issues labeled nextblock-sync-conflict in
+ * THIS fork) into merge_conflict alerts, and resolve alerts whose issue has closed.
+ * Returns a soft result (never throws) so the caller can surface errors without 500ing.
+ */
+export async function checkForSyncConflicts(): Promise<SyncConflictResult> {
+  const self = resolveSelfRepo();
+  const base: SyncConflictResult = {
+    ok: false,
+    repo: self ? `${self.owner}/${self.repo}` : null,
+    openConflicts: 0,
+    actionsActive: false,
+    alertsWritten: 0,
+    alertsResolved: 0,
+  };
+  if (!self) return { ...base, ok: true }; // not git-backed / repo unknown — nothing to mirror
+
+  // 1) Open conflict issues. The /issues endpoint also returns PRs — filter them out.
+  // Only an AUTHORITATIVE res.ok read may drive the resolve loop below: a 404 (private
+  // fork without NEXTBLOCK_GITHUB_TOKEN, or a transient error) must NOT be read as "zero
+  // open conflicts", or live conflict alerts would be wrongly auto-resolved and hidden.
+  let issues: Array<{ number: number; html_url: string; pull_request?: unknown }> = [];
+  let issuesFetched = false;
+  let fetchError: string | undefined;
+  try {
+    const url = `https://api.github.com/repos/${self.owner}/${self.repo}/issues?labels=${CONFLICT_LABEL}&state=open&per_page=20`;
+    const res = await fetch(url, {
+      headers: githubHeaders(),
+      signal: AbortSignal.timeout(15_000),
+      next: { revalidate: 600 },
+    });
+    if (res.ok) {
+      issuesFetched = true;
+      const data = await res.json();
+      issues = (Array.isArray(data) ? data : []).filter((i) => !i.pull_request);
+    } else if (res.status === 404) {
+      fetchError =
+        'Could not read repository issues (HTTP 404). For a private fork, set NEXTBLOCK_GITHUB_TOKEN.';
+    } else {
+      fetchError = `GitHub issues API returned HTTP ${res.status}.`;
+    }
+  } catch (caught) {
+    fetchError = caught instanceof Error ? caught.message : 'Could not reach the GitHub issues API.';
+  }
+
+  // 2) Has the sync workflow ever run? (drives the onboarding "Actions enabled" state)
+  let actionsActive = false;
+  try {
+    const wfUrl = `https://api.github.com/repos/${self.owner}/${self.repo}/actions/workflows/nextblock-sync.yml/runs?per_page=1`;
+    const res = await fetch(wfUrl, {
+      headers: githubHeaders(),
+      signal: AbortSignal.timeout(15_000),
+      next: { revalidate: 600 },
+    });
+    if (res.ok) {
+      const data = await res.json();
+      actionsActive = (data?.total_count ?? 0) > 0;
+    }
+  } catch {
+    /* best-effort */
+  }
+
+  // 3) Mirror issues <-> system_alerts.
+  let alertsWritten = 0;
+  let alertsResolved = 0;
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+    const { data: existing } = await supabase
+      .from('system_alerts')
+      .select('id, metadata')
+      .eq('alert_type', 'merge_conflict')
+      .eq('is_resolved', false)
+      .limit(50);
+
+    const alertByIssue = new Map<number, string>();
+    for (const row of existing ?? []) {
+      const issueNumber = (row.metadata as { issue_number?: number } | null)?.issue_number;
+      if (typeof issueNumber === 'number') alertByIssue.set(issueNumber, row.id);
+    }
+    const openIssueNumbers = new Set(issues.map((i) => i.number));
+
+    for (const issue of issues) {
+      if (alertByIssue.has(issue.number)) continue;
+      const { error } = await supabase.from('system_alerts').insert({
+        alert_type: 'merge_conflict',
+        title: 'Upstream sync needs manual resolution',
+        message: `An automated upstream sync hit conflicts and could not merge. Resolve it on GitHub (issue #${issue.number}), then close the issue to clear this alert.`,
+        metadata: {
+          issue_number: issue.number,
+          action_url: issue.html_url,
+          repo: `${self.owner}/${self.repo}`,
+        },
+      });
+      if (!error) alertsWritten += 1;
+    }
+
+    // Only resolve when the open-issue list is authoritative (res.ok). On a 404/error we
+    // can't tell which issues are still open, so we leave existing alerts untouched.
+    if (issuesFetched) {
+      for (const [issueNumber, alertId] of alertByIssue) {
+        if (openIssueNumbers.has(issueNumber)) continue;
+        const { error } = await supabase
+          .from('system_alerts')
+          .update({ is_resolved: true, resolved_at: new Date().toISOString() })
+          .eq('id', alertId);
+        if (!error) alertsResolved += 1;
+      }
+    }
+  } catch (caught) {
+    return {
+      ...base,
+      actionsActive,
+      openConflicts: issues.length,
+      error: caught instanceof Error ? caught.message : 'Could not mirror conflict alerts.',
+    };
+  }
+
+  return {
+    ok: !fetchError,
+    repo: `${self.owner}/${self.repo}`,
+    openConflicts: issues.length,
+    actionsActive,
+    alertsWritten,
+    alertsResolved,
+    error: fetchError,
+  };
+}
+
+export interface UpstreamStatusSnapshot {
+  checked_at: string;
+  current_version: string;
+  latest_version: string | null;
+  update_available: boolean;
+  track: UpdateTrack;
+  repo: string | null;
+  open_conflicts: number;
+  actions_active: boolean;
+}
+
+/** Run both checks and persist a status snapshot (read by the onboarding checklist). */
+export async function refreshUpstreamStatus(): Promise<{
+  update: UpstreamUpdateResult;
+  conflicts: SyncConflictResult;
+  snapshot: UpstreamStatusSnapshot | null;
+}> {
+  const update = await checkForUpstreamUpdate();
+  const conflicts = await checkForSyncConflicts();
+
+  let snapshot: UpstreamStatusSnapshot | null = null;
+  try {
+    const config = await getSystemConfiguration();
+    snapshot = {
+      checked_at: new Date().toISOString(),
+      current_version: update.currentVersion,
+      latest_version: update.latestVersion,
+      update_available: update.updateAvailable,
+      track: update.track,
+      repo: conflicts.repo,
+      open_conflicts: conflicts.openConflicts,
+      actions_active: conflicts.actionsActive,
+    };
+    await setSystemConfigurationServiceRole({
+      settings: { ...config.settings, upstream_status: snapshot },
+    });
+  } catch {
+    /* best-effort — the alerts themselves are already written */
+  }
+
+  return { update, conflicts, snapshot };
+}
+
+/** Throttled background refresh for the CMS layout's after() hook. Never throws. */
+export async function maybeRefreshUpstreamStatus(): Promise<void> {
+  try {
+    const config = await getSystemConfiguration();
+    const status = config.settings?.['upstream_status'] as { checked_at?: string } | undefined;
+    const last = status?.checked_at ? Date.parse(status.checked_at) : 0;
+    if (Number.isFinite(last) && Date.now() - last < REFRESH_INTERVAL_MS) return;
+    await refreshUpstreamStatus();
+  } catch {
+    /* best-effort */
+  }
+}

package/templates/nextblock-template/lib/updates/repo-identity.ts

@@ -0,0 +1,46 @@
+import 'server-only';
+// Resolve THIS install's own GitHub repo (the fork), so the runtime engine can poll the
+// fork's issues/workflow runs and the onboarding checklist can deep-link its Actions tab.
+// Order: Vercel's injected git vars -> explicit override -> parsed .git/config origin.
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+
+export interface SelfRepo {
+  owner: string;
+  repo: string;
+}
+
+export function resolveSelfRepo(): SelfRepo | null {
+  // Vercel auto-injects these for git-connected projects (incl. 1-click forks).
+  const vercelOwner = process.env.VERCEL_GIT_REPO_OWNER?.trim();
+  const vercelSlug = process.env.VERCEL_GIT_REPO_SLUG?.trim();
+  if (vercelOwner && vercelSlug) return { owner: vercelOwner, repo: vercelSlug };
+
+  // Explicit override for self-hosted git installs: NEXTBLOCK_REPO=owner/repo.
+  const explicit = process.env.NEXTBLOCK_REPO?.trim();
+  if (explicit && explicit.includes('/')) {
+    const [owner, repo] = explicit.split('/');
+    if (owner && repo) return { owner, repo: repo.replace(/\.git$/i, '') };
+  }
+
+  // Local / self-hosted clone: parse the origin remote from .git/config.
+  try {
+    const cfg = path.join(process.cwd(), '.git', 'config');
+    if (existsSync(cfg)) {
+      const match = readFileSync(cfg, 'utf8').match(
+        /github\.com[:/]([^/\s]+)\/([^/\s]+?)(?:\.git)?(?:\s|$)/i,
+      );
+      if (match) return { owner: match[1], repo: match[2] };
+    }
+  } catch {
+    /* ignore */
+  }
+
+  return null;
+}
+
+/** The fork's GitHub Actions tab, for the onboarding "enable Actions" reminder. */
+export function selfActionsUrl(): string | null {
+  const self = resolveSelfRepo();
+  return self ? `https://github.com/${self.owner}/${self.repo}/actions` : null;
+}

package/templates/nextblock-template/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@nextblock-cms/template",
-  "version": "0.10.7",
+  "version": "0.10.9",
   "private": true,
   "scripts": {
     "dev": "next dev",
+    "prebuild": "node tools/build-migrate.mjs",
     "build": "next build",
     "start": "next start",
     "lint": "next lint",