create-nextblock 0.11.3 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.11.3",
+  "version": "0.12.0",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/(auth-pages)/sign-up/SignUpForm.tsx

@@ -0,0 +1,141 @@
+'use client';
+
+import { signUpAction } from "../../actions";
+import { FormMessage, Message } from "../../../components/form-message";
+import { SubmitButton } from "../../../components/submit-button";
+import { Button, Input, Label } from "@nextblock-cms/ui";
+import Link from "next/link";
+import { useTranslations } from "@nextblock-cms/utils";
+import { useSearchParams } from "next/navigation";
+import { GitHubLoginButton } from "../../../components/GitHubLoginButton";
+import { ArrowRight, CheckCircle2, Mail } from "lucide-react";
+
+import { SandboxCredentialsAlert } from "../../../components/SandboxCredentialsAlert";
+import { AuthBotProtection } from "../../../components/auth/AuthBotProtection";
+
+type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
+
+interface SignUpFormProps {
+  botProtection: { provider: BotProtectionProvider; siteKey: string };
+  scriptNonce?: string;
+}
+
+function getMessage(searchParams: URLSearchParams): Message | undefined {
+    if (searchParams.has('error')) {
+        const error = searchParams.get('error');
+        if (error) return { error };
+    }
+    if (searchParams.has('success')) {
+        const success = searchParams.get('success');
+        if (success) return { success };
+    }
+    if (searchParams.has('message')) {
+        const message = searchParams.get('message');
+        if (message) return { message };
+    }
+    return undefined;
+}
+
+export default function SignUpForm({ botProtection, scriptNonce }: SignUpFormProps) {
+  const { t } = useTranslations();
+  const searchParams = useSearchParams();
+  const formMessage = getMessage(searchParams);
+  const successKey = searchParams.get('success');
+
+  if (successKey) {
+    return (
+      <div className="flex-1 flex flex-col w-full max-w-160 mx-auto">
+        <div className="mb-4 flex h-11 w-11 items-center justify-center rounded-full bg-primary/10 text-primary">
+          <CheckCircle2 className="h-5 w-5" />
+        </div>
+        <p className="text-xs font-medium uppercase tracking-[0.18em] text-muted-foreground">
+          {t('auth.signup_success_badge')}
+        </p>
+        <h1 className="mt-3 text-2xl font-medium">{t('auth.signup_success_title')}</h1>
+        <p className="mt-2 text-sm leading-6 text-muted-foreground">
+          {t(successKey)}
+        </p>
+
+        <div className="mt-8 rounded-lg border p-5">
+          <div className="flex items-start gap-3">
+            <div className="mt-0.5 rounded-full bg-muted p-2 text-muted-foreground">
+              <Mail className="h-4 w-4" />
+            </div>
+            <div className="space-y-3 text-sm text-muted-foreground">
+              <p>{t('auth.signup_success_step_confirm')}</p>
+              <p>{t('auth.signup_success_step_profile')}</p>
+              <p>{t('auth.signup_success_step_spam')}</p>
+            </div>
+          </div>
+        </div>
+
+        <div className="mt-6 flex flex-col gap-3 sm:flex-row">
+          <Button asChild>
+            <Link href="/sign-in">
+              {t('auth.back_to_sign_in')}
+              <ArrowRight className="ml-2 h-4 w-4" />
+            </Link>
+          </Button>
+          <Button asChild variant="outline">
+            <Link href="/sign-up">{t('auth.signup_use_different_email')}</Link>
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex-1 flex flex-col w-full max-w-160 mx-auto">
+      <form className="flex flex-col">
+        <SandboxCredentialsAlert />
+        <h1 className="text-2xl font-medium">{t('sign_up')}</h1>
+        <p className="mt-2 text-sm leading-6 text-muted-foreground">
+          {t('auth.signup_form_description')}
+        </p>
+        <p className="text-sm text-foreground">
+          {t('already_have_account')}{" "}
+          <Link className="text-foreground font-medium underline" href="/sign-in">
+            {t('sign_in')}
+          </Link>
+        </p>
+
+        <div className="mt-8 flex flex-col gap-2">
+          <GitHubLoginButton t={t} redirectTo="/profile" />
+
+          <div className="relative py-2">
+            <div className="absolute inset-0 flex items-center">
+              <span className="w-full border-t" />
+            </div>
+            <div className="relative flex justify-center text-xs uppercase">
+              <span className="bg-background px-2 text-muted-foreground">
+                {t('or_continue_with') || "Or continue with"}
+              </span>
+            </div>
+          </div>
+
+          <div className="flex flex-col gap-2 [&>input]:mb-3">
+            <Label htmlFor="email">{t('email')}</Label>
+            <Input name="email" placeholder={t('you_at_example_com')} required />
+            <Label htmlFor="password">{t('password')}</Label>
+            <Input
+              type="password"
+              name="password"
+              placeholder={t('your_password')}
+              minLength={6}
+              required
+            />
+            <AuthBotProtection
+              provider={botProtection.provider}
+              siteKey={botProtection.siteKey}
+              scriptNonce={scriptNonce}
+            />
+            <SubmitButton formAction={signUpAction} pendingText={t('signing_up_pending')}>
+              {t('sign_up')}
+            </SubmitButton>
+            <FormMessage message={formMessage} />
+          </div>
+        </div>
+      </form>
+    </div>
+  );
+}

package/templates/nextblock-template/app/(auth-pages)/sign-up/page.tsx

@@ -1,128 +1,46 @@
-'use client';
-
-import { signUpAction } from "../../actions";
-import { FormMessage, Message } from "../../../components/form-message";
-import { SubmitButton } from "../../../components/submit-button";
-import { Button, Input, Label } from "@nextblock-cms/ui";
-import Link from "next/link";
-import { useTranslations } from "@nextblock-cms/utils";
-import { useSearchParams } from "next/navigation";
-import { GitHubLoginButton } from "../../../components/GitHubLoginButton";
-import { ArrowRight, CheckCircle2, Mail } from "lucide-react";
-
-import { SandboxCredentialsAlert } from "../../../components/SandboxCredentialsAlert";
-
-function getMessage(searchParams: URLSearchParams): Message | undefined {
-    if (searchParams.has('error')) {
-        const error = searchParams.get('error');
-        if (error) return { error };
-    }
-    if (searchParams.has('success')) {
-        const success = searchParams.get('success');
-        if (success) return { success };
-    }
-    if (searchParams.has('message')) {
-        const message = searchParams.get('message');
-        if (message) return { message };
-    }
-    return undefined;
-}
-
-export default function Signup() {
-  const { t } = useTranslations();
-  const searchParams = useSearchParams();
-  const formMessage = getMessage(searchParams);
-  const successKey = searchParams.get('success');
-
-  if (successKey) {
-    return (
-      <div className="flex-1 flex flex-col w-full max-w-160 mx-auto">
-        <div className="mb-4 flex h-11 w-11 items-center justify-center rounded-full bg-primary/10 text-primary">
-          <CheckCircle2 className="h-5 w-5" />
-        </div>
-        <p className="text-xs font-medium uppercase tracking-[0.18em] text-muted-foreground">
-          {t('auth.signup_success_badge')}
-        </p>
-        <h1 className="mt-3 text-2xl font-medium">{t('auth.signup_success_title')}</h1>
-        <p className="mt-2 text-sm leading-6 text-muted-foreground">
-          {t(successKey)}
-        </p>
-
-        <div className="mt-8 rounded-lg border p-5">
-          <div className="flex items-start gap-3">
-            <div className="mt-0.5 rounded-full bg-muted p-2 text-muted-foreground">
-              <Mail className="h-4 w-4" />
-            </div>
-            <div className="space-y-3 text-sm text-muted-foreground">
-              <p>{t('auth.signup_success_step_confirm')}</p>
-              <p>{t('auth.signup_success_step_profile')}</p>
-              <p>{t('auth.signup_success_step_spam')}</p>
-            </div>
-          </div>
-        </div>
+import { Suspense } from "react";
+import { headers } from "next/headers";
+import { createClient } from "@nextblock-cms/db/server";
+import SignUpForm from "./SignUpForm";
+
+type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
+
+// Server wrapper: resolves the site-wide bot-protection provider + site key
+// (CMS → Settings → Bot Protection) and the CSP nonce, then hands them to the
+// interactive client form. Mirrors the read in components/BlockRenderer.tsx.
+export default async function SignUpPage() {
+  let scriptNonce = '';
+  try {
+    scriptNonce = (await headers()).get('x-nonce') || '';
+  } catch (e) {
+    console.error('[Bot Protection] Error loading CSP nonce on sign-up page:', e);
+  }
 
-        <div className="mt-6 flex flex-col gap-3 sm:flex-row">
-          <Button asChild>
-            <Link href="/sign-in">
-              {t('auth.back_to_sign_in')}
-              <ArrowRight className="ml-2 h-4 w-4" />
-            </Link>
-          </Button>
-          <Button asChild variant="outline">
-            <Link href="/sign-up">{t('auth.signup_use_different_email')}</Link>
-          </Button>
-        </div>
-      </div>
-    );
+  let botProtection: { provider: BotProtectionProvider; siteKey: string } = {
+    provider: 'none',
+    siteKey: '',
+  };
+  try {
+    const supabase = createClient();
+    const { data: publicSetting } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', 'bot_protection_public')
+      .maybeSingle();
+    if (publicSetting?.value) {
+      const publicVal = publicSetting.value as Record<string, any>;
+      botProtection = {
+        provider: publicVal.provider || 'none',
+        siteKey: publicVal.siteKey || '',
+      };
+    }
+  } catch (e) {
+    console.error('[Bot Protection] Error loading settings on sign-up page:', e);
   }
 
   return (
-    <div className="flex-1 flex flex-col w-full max-w-160 mx-auto">
-      <form className="flex flex-col">
-        <SandboxCredentialsAlert />
-        <h1 className="text-2xl font-medium">{t('sign_up')}</h1>
-        <p className="mt-2 text-sm leading-6 text-muted-foreground">
-          {t('auth.signup_form_description')}
-        </p>
-        <p className="text-sm text-foreground">
-          {t('already_have_account')}{" "}
-          <Link className="text-foreground font-medium underline" href="/sign-in">
-            {t('sign_in')}
-          </Link>
-        </p>
-
-        <div className="mt-8 flex flex-col gap-2">
-          <GitHubLoginButton t={t} redirectTo="/profile" />
-
-          <div className="relative py-2">
-            <div className="absolute inset-0 flex items-center">
-              <span className="w-full border-t" />
-            </div>
-            <div className="relative flex justify-center text-xs uppercase">
-              <span className="bg-background px-2 text-muted-foreground">
-                {t('or_continue_with') || "Or continue with"}
-              </span>
-            </div>
-          </div>
-
-          <div className="flex flex-col gap-2 [&>input]:mb-3">
-            <Label htmlFor="email">{t('email')}</Label>
-            <Input name="email" placeholder={t('you_at_example_com')} required />
-            <Label htmlFor="password">{t('password')}</Label>
-            <Input
-              type="password"
-              name="password"
-              placeholder={t('your_password')}
-              minLength={6}
-              required
-            />
-            <SubmitButton formAction={signUpAction} pendingText={t('signing_up_pending')}>
-              {t('sign_up')}
-            </SubmitButton>
-            <FormMessage message={formMessage} />
-          </div>
-        </div>
-      </form>
-    </div>
+    <Suspense fallback={null}>
+      <SignUpForm botProtection={botProtection} scriptNonce={scriptNonce} />
+    </Suspense>
   );
 }

package/templates/nextblock-template/app/(auth-pages)/two-factor/components/TwoFactorForm.tsx

@@ -1,6 +1,7 @@
 'use client';
 
 import { useState, useTransition } from 'react';
+import { unstable_rethrow } from 'next/navigation';
 import { Alert, AlertDescription, Button, Input, Label, Spinner } from '@nextblock-cms/ui';
 import { resendEmailCode, verifyEmailCode, verifyTotpChallenge } from '../actions';
 
@@ -36,6 +37,10 @@ export default function TwoFactorForm({
         // A successful action redirects server-side; only failures return here.
         if (result?.error) setError(result.error);
       } catch (err) {
+        // A successful verify ends in redirect(), which Next signals by throwing a
+        // NEXT_REDIRECT control-flow error. Let Next handle it (perform the navigation)
+        // instead of surfacing it as a red error flash; only real errors fall through.
+        unstable_rethrow(err);
         setError(err instanceof Error ? err.message : 'Verification failed.');
       }
     });

package/templates/nextblock-template/app/[slug]/page.tsx

@@ -12,6 +12,7 @@ import {
   resolvePageMetaDescription,
   stringifyJsonLd,
   buildSocialMetadata,
+  buildCanonicalUrl,
   toOpenGraphLocale,
 } from "../lib/seo";
 import { getSiteSettings } from "../lib/site-settings";
@@ -118,6 +119,8 @@ export async function generateMetadata(
   const title = resolveMetaTitle(pageData.meta_title, pageData.title);
   const description = resolvePageMetaDescription(pageData.meta_description, pageData.blocks);
   const { siteTitle } = await getSiteSettings();
+  // Self-referencing `<siteUrl>/<slug>` unless the page sets a manual custom_canonical override.
+  const canonicalUrl = buildCanonicalUrl(pageData.custom_canonical, siteUrl, `/${params.slug}`);
 
   return {
     title,
@@ -125,14 +128,14 @@ export async function generateMetadata(
     ...buildSocialMetadata({
       title,
       description,
-      url: `${siteUrl}/${params.slug}`,
+      url: canonicalUrl,
       siteTitle,
       imageUrl: pageData.feature_image_url,
       type: 'website',
       locale: toOpenGraphLocale(pageData.language_code),
     }),
     alternates: {
-      canonical: `${siteUrl}/${params.slug}`,
+      canonical: canonicalUrl,
       languages: Object.keys(alternates).length > 0 ? alternates : undefined,
     },
   };

package/templates/nextblock-template/app/[slug]/page.utils.ts

@@ -99,6 +99,7 @@ function applyDraftToPage(page: SelectedPageType, draft: ContentDraftRow): Selec
     status: draftString(draft, "status", page.status) as PageType["status"],
     meta_title: draftNullableString(draft, "meta_title", page.meta_title),
     meta_description: draftNullableString(draft, "meta_description", page.meta_description),
+    custom_canonical: draftNullableString(draft, "custom_canonical", page.custom_canonical),
     feature_image_id: draftNullableString(draft, "feature_image_id", page.feature_image_id),
     translation_group_id: draftString(
       draft,
@@ -255,7 +256,7 @@ export async function getPageDataBySlug(
   const supabase = isDraftModeEnabled ? createClient() : getSsgSupabaseClient();
 
   const baseSelect = `
-      id, slug, title, meta_title, meta_description, feature_image_id, status, language_id, translation_group_id, author_id, created_at, updated_at,
+      id, slug, title, meta_title, meta_description, custom_canonical, feature_image_id, status, language_id, translation_group_id, author_id, created_at, updated_at,
       language_details:languages!inner(id, code),
       feature_media_object:media!pages_feature_image_id_fkey(object_key, file_path, blur_data_url, width, height),
       blocks (id, page_id, block_type, content, order)
@@ -404,14 +405,14 @@ export async function getPageDataBySlug(
         .select('id, object_key, blur_data_url')
         .in('id', mediaIds);
 
-      if (mediaError) {
-        console.error('Error fetching media data:', mediaError);
-      } else if (mediaItems) {
-        const mediaMap = new Map(mediaItems.map(m => [m.id, { object_key: m.object_key, blur_data_url: m.blur_data_url }]));
-        blocksWithMediaData = blocksWithMediaData.map(block => mapMediaDataToBlock(block, mediaMap));
-      }
-    }
-  }
+      if (mediaError) {
+        console.error('Error fetching media data:', mediaError);
+      } else if (mediaItems) {
+        const mediaMap = new Map(mediaItems.map(m => [m.id, { object_key: m.object_key, blur_data_url: m.blur_data_url }]));
+        blocksWithMediaData = blocksWithMediaData.map(block => mapMediaDataToBlock(block, mediaMap));
+      }
+    }
+  }
 
   let featureMedia = selectedPage.feature_media_object ?? null;
   if (selectedPage.feature_image_id && (!featureMedia || contentDraft)) {

package/templates/nextblock-template/app/actions/email.ts

@@ -1,6 +1,7 @@
 "use server";
 
 import { resolveEmailServerConfig } from '../../lib/config/email-settings';
+import { applyEmailBranding, resolveEmailBranding } from '../../lib/email/branding';
 import nodemailer from 'nodemailer';
 
 interface EmailParams {
@@ -18,6 +19,12 @@ export async function sendEmail({ to, subject, text, html }: EmailParams) {
     throw new Error("Email server is not configured. Configure SMTP in CMS Settings → Configuration → Email.");
   }
 
+  // Single interception point: white-label every outgoing email with the tenant's own
+  // logo + site name (or a text banner when no logo is set). Every app-dispatched email
+  // funnels through here, so branding is applied once, centrally.
+  const branding = await resolveEmailBranding();
+  const brandedHtml = applyEmailBranding(html, branding);
+
   const transporter = nodemailer.createTransport(emailConfig);
 
   const options = {
@@ -25,7 +32,7 @@ export async function sendEmail({ to, subject, text, html }: EmailParams) {
     to,
     subject,
     text,
-    html,
+    html: brandedHtml,
   };
 
   return transporter.sendMail(options);

package/templates/nextblock-template/app/actions/feedback.ts

@@ -19,6 +19,7 @@ export async function submitFeedback(data: FeedbackData) {
     const { subject, message, userEmail, userName, url } = data;
     
     const htmlContent = `
+      {{brand_header}}
       <h2>New Feedback Received</h2>
       <p><strong>From:</strong> ${userName || 'Unknown'} (${userEmail})</p>
       <p><strong>Subject:</strong> ${subject}</p>

package/templates/nextblock-template/app/actions/formActions.ts

@@ -2,15 +2,19 @@
 "use server";
 
 import { sendEmail } from './email';
-import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+import {
+  verifyBotProtection,
+  type BotProtectionProvider,
+  HONEYPOT_FIELD,
+  TURNSTILE_TOKEN_FIELD,
+  RECAPTCHA_TOKEN_FIELD,
+} from '../../lib/botProtection/verify';
 
 interface FormSubmissionResult {
   success: boolean;
   message: string;
 }
 
-type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
-
 type FormSubmissionConfig = {
   recipient: string;
   botProtectionProvider?: BotProtectionProvider;
@@ -43,96 +47,14 @@ export async function handleFormSubmission(
       : '';
   const recipient = sandboxRecipient || configuredRecipient;
 
-  // Phase 1: Honeypot Validation
-  const honeypot = formData.get('verification_secondary_email');
-  if (honeypot && typeof honeypot === 'string' && honeypot.length > 0) {
-    console.warn("[Bot Protection] Honeypot triggered. Discarding submission from bot.");
-    // Fool the bot by returning a fake success response immediately
-    return { success: true, message: "Submission successful!" };
-  }
-
-  // Phase 2: Advanced Captcha Verification
-  try {
-    const supabase = getServiceRoleSupabaseClient();
-    
-    // Fetch global bot protection settings
-    const { data: publicSetting } = await supabase
-      .from('site_settings')
-      .select('value')
-      .eq('key', 'bot_protection_public')
-      .maybeSingle();
-
-    const { data: secretSetting } = await supabase
-      .from('site_settings')
-      .select('value')
-      .eq('key', 'bot_protection_secret')
-      .maybeSingle();
-
-    const publicVal = (publicSetting?.value || {}) as Record<string, any>;
-    const secretVal = (secretSetting?.value || {}) as Record<string, any>;
-
-    const blockProvider =
-      botProtectionProvider === 'turnstile' || botProtectionProvider === 'recaptcha'
-        ? botProtectionProvider
-        : undefined;
-    const provider = blockProvider || publicVal.provider || 'none';
-    const secretKey = secretVal.secretKey || 
-      (provider === 'turnstile' ? process.env.TURNSTILE_SECRET_KEY : process.env.RECAPTCHA_SECRET_KEY) || 
-      '';
-
-    if (provider === 'turnstile') {
-      const token = formData.get('cf-turnstile-response') as string;
-      if (!token) {
-        return { success: false, message: "Security verification token is missing. Please try again." };
-      }
-      if (!secretKey) {
-        console.error("[Bot Protection] Turnstile secret key is not configured.");
-        return { success: false, message: "Bot protection is misconfigured. Please contact support." };
-      }
-
-      const res = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded',
-        },
-        body: `secret=${encodeURIComponent(secretKey)}&response=${encodeURIComponent(token)}`,
-      });
-
-      const outcome = await res.json();
-      if (!outcome.success) {
-        console.warn("[Bot Protection] Turnstile verification failed:", outcome);
-        return { success: false, message: "Security verification failed. Please try again." };
-      }
-    } else if (provider === 'recaptcha') {
-      const token = formData.get('g-recaptcha-response') as string;
-      if (!token) {
-        return { success: false, message: "Security verification token is missing. Please try again." };
-      }
-      if (!secretKey) {
-        console.error("[Bot Protection] reCAPTCHA secret key is not configured.");
-        return { success: false, message: "Bot protection is misconfigured. Please contact support." };
-      }
-
-      const res = await fetch('https://www.google.com/recaptcha/api/siteverify', {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded',
-        },
-        body: `secret=${encodeURIComponent(secretKey)}&response=${encodeURIComponent(token)}`,
-      });
-
-      const outcome = await res.json();
-      if (!outcome.success || outcome.score < 0.5) {
-        console.warn("[Bot Protection] reCAPTCHA verification failed:", outcome);
-        return { success: false, message: "Security verification failed. Please try again." };
-      }
+  // Honeypot + captcha verification (shared with the account-signup flow).
+  const verification = await verifyBotProtection(formData, { botProtectionProvider });
+  if (!verification.ok) {
+    if (verification.reason === 'honeypot') {
+      // Fool the bot by returning a fake success response immediately.
+      return { success: true, message: "Submission successful!" };
     }
-  } catch (error) {
-    console.error("[Bot Protection] Error during validation:", error);
-    // If database or fetch error occurs, we gracefully degrade or warn, but let's be secure and fail open/closed depending on preference.
-    // The requirement says: "If the API indicates a verification failure or falls below a threshold... reject the operation securely."
-    // Let's return error message.
-    return { success: false, message: "Sorry, security verification could not be completed at this time." };
+    return { success: false, message: verification.message };
   }
 
   const data: Record<string, string | File> = {};
@@ -141,11 +63,11 @@ export async function handleFormSubmission(
   formData.forEach((value, key) => {
     // Avoid sending internal bot protection tokens and honeypots in the notification email
     if (
-      typeof value === 'string' && 
-      !key.startsWith('$') && 
-      key !== 'verification_secondary_email' && 
-      key !== 'g-recaptcha-response' && 
-      key !== 'cf-turnstile-response'
+      typeof value === 'string' &&
+      !key.startsWith('$') &&
+      key !== HONEYPOT_FIELD &&
+      key !== RECAPTCHA_TOKEN_FIELD &&
+      key !== TURNSTILE_TOKEN_FIELD
     ) {
       data[key] = value;
       // Attempt to find a field that looks like an email address to use in the subject
@@ -157,6 +79,7 @@ export async function handleFormSubmission(
 
   // Create a more readable HTML body for the email
   const htmlBody = `
+    {{brand_header}}
     <h2>New Form Submission</h2>
     <p>You have received a new submission from your website form.</p>
     <table border="1" cellpadding="5" cellspacing="0" style="border-collapse: collapse;">

package/templates/nextblock-template/app/actions/interactions.ts

@@ -88,10 +88,11 @@ export async function submitInteraction(input: SubmitInteractionInput) {
           const origin = `${protocol}://${host}`;
 
           const capitalizedType = input.type.charAt(0).toUpperCase() + input.type.slice(1);
-          const subject = `[NextBlock CMS] New Pending ${capitalizedType} Submitted`;
+          const subject = `New Pending ${capitalizedType} Submitted`;
 
           const html = `
             <div style="font-family: sans-serif; padding: 20px; color: #333; max-width: 600px; margin: 0 auto; border: 1px solid #eee; border-radius: 8px;">
+              {{brand_header}}
               <h2 style="color: #6366f1; margin-top: 0;">New Pending ${capitalizedType} Submitted</h2>
               <p>Hello,</p>
               <p>A new content interaction has been submitted and is currently <strong>pending moderation</strong>.</p>
@@ -111,7 +112,7 @@ export async function submitInteraction(input: SubmitInteractionInput) {
                 </a>
               </p>
               <hr style="border: 0; border-top: 1px solid #eee; margin: 20px 0;" />
-              <p style="font-size: 11px; color: #888;">This is an automated notification from your NextBlock™ CMS instance.</p>
+              <p style="font-size: 11px; color: #888;">This is an automated notification from your CMS.</p>
             </div>
           `;
 

package/templates/nextblock-template/app/actions/twoFactorEmail.ts

@@ -9,10 +9,11 @@ export async function sendTwoFactorCodeEmail(
 ): Promise<void> {
   await sendEmail({
     to,
-    subject: 'Your NextBlock verification code',
-    text: `Your NextBlock verification code is ${code}. It expires in 5 minutes. If you didn't request it, you can ignore this email.`,
+    subject: 'Your verification code',
+    text: `Your verification code is ${code}. It expires in 5 minutes. If you didn't request it, you can ignore this email.`,
     html: `
   <div style="font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;max-width:480px;margin:0 auto;padding:24px;">
+    {{brand_header}}
     <p style="font-size:14px;color:#475569;">Use this code to ${purpose}:</p>
     <p style="font-size:32px;font-weight:700;letter-spacing:8px;margin:16px 0;color:#0f172a;">${code}</p>
     <p style="font-size:13px;color:#64748b;">This code expires in 5 minutes. If you didn't request it, you can safely ignore this email.</p>

package/templates/nextblock-template/app/actions/visualEditingActions.test.ts

@@ -132,7 +132,7 @@ describe("visual editing server actions", () => {
 
     expect(result).toEqual({
       error:
-        "Draft storage is not set up in this database. Apply the content_drafts migration: libs/db/src/supabase/migrations/00000000000014_setup_content_drafts.sql.",
+        "Draft storage is not set up in this database. Apply the schema (npm run db:migrate or the /setup wizard); content_drafts is created by the baseline schema migration.",
     });
   });