create-nextblock 0.11.3 → 0.12.1

package/templates/nextblock-template/lib/visual-editing/draft-content.ts

@@ -117,7 +117,7 @@ async function readPageSnapshot(
   const client = supabase as any;
   const { data: page, error: pageError } = await client
     .from("pages")
-    .select("id, title, slug, language_id, status, meta_title, meta_description, feature_image_id, version, translation_group_id")
+    .select("id, title, slug, language_id, status, meta_title, meta_description, custom_canonical, feature_image_id, version, translation_group_id")
     .eq("id", pageId)
     .single();
 
@@ -144,6 +144,7 @@ async function readPageSnapshot(
       status: page.status,
       meta_title: page.meta_title,
       meta_description: page.meta_description,
+      custom_canonical: page.custom_canonical,
       feature_image_id: page.feature_image_id,
       translation_group_id: page.translation_group_id,
     } as Record<string, Json>,
@@ -158,7 +159,7 @@ async function readPostSnapshot(
   const client = supabase as any;
   const { data: post, error: postError } = await client
     .from("posts")
-    .select("id, title, slug, language_id, status, meta_title, meta_description, label, excerpt, subtitle, published_at, feature_image_id, version, translation_group_id")
+    .select("id, title, slug, language_id, status, meta_title, meta_description, custom_canonical, label, excerpt, subtitle, published_at, feature_image_id, version, translation_group_id")
     .eq("id", postId)
     .single();
 
@@ -185,6 +186,7 @@ async function readPostSnapshot(
       status: post.status,
       meta_title: post.meta_title,
       meta_description: post.meta_description,
+      custom_canonical: post.custom_canonical,
       label: post.label,
       excerpt: post.excerpt,
       subtitle: post.subtitle,

package/templates/nextblock-template/lib/visual-editing/mutations.ts

@@ -94,11 +94,11 @@ export function formatVisualEditingError(error: unknown, fallback: string) {
   const message = error instanceof Error ? error.message : fallback;
 
   if (isMissingDraftStorageError(message, "content_drafts")) {
-    return "Draft storage is not set up in this database. Apply the content_drafts migration: libs/db/src/supabase/migrations/00000000000014_setup_content_drafts.sql.";
+    return "Draft storage is not set up in this database. Apply the schema (npm run db:migrate or the /setup wizard); content_drafts is created by the baseline schema migration.";
   }
 
   if (isMissingDraftStorageError(message, "product_drafts")) {
-    return "Product draft storage is not set up in this database. Apply the product_drafts migration: libs/db/src/supabase/migrations/00000000000015_setup_product_drafts.sql.";
+    return "Product draft storage is not set up in this database. Apply the schema (npm run db:migrate or the /setup wizard); product_drafts is created by the baseline schema migration.";
   }
 
   return message;

package/templates/nextblock-template/lib/visual-editing/product-drafts.ts

@@ -62,6 +62,7 @@ const productSnapshotFields = [
   "translation_group_id",
   "meta_title",
   "meta_description",
+  "custom_canonical",
   "freemius_product_id",
   "freemius_plan_id",
   "trial_period_days",

package/templates/nextblock-template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/template",
-  "version": "0.11.3",
+  "version": "0.12.1",
   "private": true,
   "scripts": {
     "dev": "next dev",

package/templates/nextblock-template/proxy.ts

@@ -57,6 +57,12 @@ function isSetupAllowlisted(pathname: string): boolean {
     pathname.startsWith('/auth/') ||
     pathname.startsWith('/_next/') ||
     pathname.startsWith('/favicon') ||
+    // Bundled public image assets (the site logo, marketing art). These are referenced by
+    // the public chrome AND transactional-email templates, and the Next Image optimizer
+    // fetches them server-side WITHOUT an auth cookie — so if the gate bounced them to
+    // /setup the optimizer would receive a redirect instead of image bytes and the logo
+    // would render broken ("isn't a valid image … received null"). Always serve them.
+    pathname.startsWith('/images/') ||
     // Crawler-facing static routes: keep them reachable while unprovisioned so a fresh
     // deploy never redirects robots.txt / the sitemap to /setup (which would let crawlers
     // treat the wizard as the canonical entry point).
@@ -235,6 +241,11 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | u
   ];
   const vercelToolbarConnectSources = ['wss://ws-us3.pusher.com'];
   const turnstileSources = ['https://challenges.cloudflare.com'];
+  // Google reCAPTCHA: api.js is served from www.google.com, the widget worker from
+  // www.gstatic.com, and the challenge/badge iframe + verification calls hit
+  // www.google.com/recaptcha. Needed by both the bot-protected contact forms and
+  // the signup page when the reCAPTCHA provider is selected.
+  const recaptchaSources = ['https://www.google.com', 'https://www.gstatic.com'];
 
   const developmentHttpSources = isDev
     ? [
@@ -266,6 +277,7 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | u
             'data:',
             ...vercelSources,
             ...turnstileSources,
+            ...recaptchaSources,
             ...developmentHttpSources,
           ]
         : [
@@ -275,6 +287,7 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | u
             ...googleSources,
             ...vercelSources,
             ...turnstileSources,
+            ...recaptchaSources,
           ],
     ),
     createDirective('script-src-attr', ["'none'"]),
@@ -293,6 +306,7 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | u
       'https://checkout.freemius.com',
       ...googleSources,
       ...vercelSources,
+      ...recaptchaSources,
       ...developmentHttpSources,
     ]),
     createDirective('font-src', [
@@ -310,6 +324,7 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | u
       ...vercelSources,
       ...vercelToolbarConnectSources,
       ...turnstileSources,
+      ...recaptchaSources,
       ...developmentConnectSources,
     ]),
     createDirective('frame-src', [
@@ -323,6 +338,7 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | u
       'https://vercel.live',
       'https://vercel.com',
       ...turnstileSources,
+      ...recaptchaSources,
     ]),
     createDirective('media-src', ["'self'", 'data:', 'blob:', supabaseOrigin, ...assetSources]),
     createDirective('worker-src', ["'self'", 'blob:']),