create-nextblock 0.12.9 → 0.12.12

package/templates/nextblock-template/hooks/use-hotkeys.ts

@@ -1,4 +1,4 @@
-import { useEffect, type DependencyList } from 'react';
+import { useEffect, type DependencyList } from 'react';
 
 /**
  * Hook to handle keyboard shortcuts.
@@ -8,26 +8,26 @@ import { useEffect, type DependencyList } from 'react';
  * @param callback The function to call when the key combination is pressed
  * @param deps Dependencies array for the effect
  */
-export function useHotkeys(
-  key: string,
-  callback: (event: KeyboardEvent) => void,
-  deps: DependencyList = [],
-) {
-  useEffect(() => {
-    const normalizedShortcut = key.toLowerCase();
-
-    const handleKeyDown = (event: KeyboardEvent) => {
-      const isCtrl = event.ctrlKey || event.metaKey; // cmd on mac, ctrl on windows
-      const keyLower = typeof event.key === 'string' ? event.key.toLowerCase() : '';
-      const isSaveKey = keyLower === 's' || event.code === 'KeyS';
-
-      // Check for ctrl+s / cmd+s
-      if ((normalizedShortcut === 'ctrl+s' || normalizedShortcut === 'meta+s') && isCtrl && isSaveKey) {
-        event.preventDefault();
-        callback(event);
-      }
-    };
-
+export function useHotkeys(
+  key: string,
+  callback: (event: KeyboardEvent) => void,
+  deps: DependencyList = [],
+) {
+  useEffect(() => {
+    const normalizedShortcut = key.toLowerCase();
+
+    const handleKeyDown = (event: KeyboardEvent) => {
+      const isCtrl = event.ctrlKey || event.metaKey; // cmd on mac, ctrl on windows
+      const keyLower = typeof event.key === 'string' ? event.key.toLowerCase() : '';
+      const isSaveKey = keyLower === 's' || event.code === 'KeyS';
+
+      // Check for ctrl+s / cmd+s
+      if ((normalizedShortcut === 'ctrl+s' || normalizedShortcut === 'meta+s') && isCtrl && isSaveKey) {
+        event.preventDefault();
+        callback(event);
+      }
+    };
+
     window.addEventListener('keydown', handleKeyDown);
     return () => window.removeEventListener('keydown', handleKeyDown);
   }, [key, ...deps]); // callback should be stable or included in deps if handled by caller

package/templates/nextblock-template/hooks/useGlobalSearch.ts

@@ -1,101 +1,101 @@
-'use client';
-
-import { useEffect, useMemo, useState } from 'react';
-import { useLanguage } from '../context/LanguageContext';
-import type {
-  GlobalSearchFilter,
-  GlobalSearchResponse,
-  GlobalSearchResult,
-} from '../lib/search/types';
-
-type SearchStatus = 'idle' | 'loading' | 'success' | 'error';
-
-export function useGlobalSearch({
-  initialQuery = '',
-  initialFilter = 'all',
-  limit = 12,
-}: {
-  initialQuery?: string;
-  initialFilter?: GlobalSearchFilter;
-  limit?: number;
-} = {}) {
-  const { currentLocale } = useLanguage();
-  const [query, setQuery] = useState(initialQuery);
-  const [filter, setFilter] = useState<GlobalSearchFilter>(initialFilter);
-  const [results, setResults] = useState<GlobalSearchResult[]>([]);
-  const [counts, setCounts] = useState<GlobalSearchResponse['counts']>({
-    all: 0,
-    page: 0,
-    post: 0,
-    product: 0,
-  });
-  const [status, setStatus] = useState<SearchStatus>('idle');
-
-  const normalizedQuery = useMemo(() => query.replace(/\s+/g, ' ').trim(), [query]);
-  const canSearch = normalizedQuery.length >= 2;
-
-  useEffect(() => {
-    if (!canSearch) {
-      setResults([]);
-      setCounts({ all: 0, page: 0, post: 0, product: 0 });
-      setStatus('idle');
-      return;
-    }
-
-    const controller = new AbortController();
-    const timeoutId = window.setTimeout(async () => {
-      setStatus('loading');
-
-      const params = new URLSearchParams({
-        q: normalizedQuery,
-        type: filter,
-        limit: String(limit),
-      });
-
-      if (currentLocale) {
-        params.set('locale', currentLocale);
-      }
-
-      try {
-        const response = await fetch(`/api/search?${params.toString()}`, {
-          signal: controller.signal,
-        });
-
-        if (!response.ok) {
-          throw new Error(`Search request failed with ${response.status}`);
-        }
-
-        const payload = (await response.json()) as GlobalSearchResponse;
-        setResults(payload.results);
-        setCounts(payload.counts);
-        setStatus('success');
-      } catch (error) {
-        if ((error as Error).name === 'AbortError') {
-          return;
-        }
-
-        console.error('Global search request failed:', error);
-        setResults([]);
-        setCounts({ all: 0, page: 0, post: 0, product: 0 });
-        setStatus('error');
-      }
-    }, 180);
-
-    return () => {
-      controller.abort();
-      window.clearTimeout(timeoutId);
-    };
-  }, [canSearch, currentLocale, filter, limit, normalizedQuery]);
-
-  return {
-    query,
-    setQuery,
-    filter,
-    setFilter,
-    results,
-    counts,
-    status,
-    canSearch,
-    isLoading: status === 'loading',
-  };
-}
+'use client';
+
+import { useEffect, useMemo, useState } from 'react';
+import { useLanguage } from '../context/LanguageContext';
+import type {
+  GlobalSearchFilter,
+  GlobalSearchResponse,
+  GlobalSearchResult,
+} from '../lib/search/types';
+
+type SearchStatus = 'idle' | 'loading' | 'success' | 'error';
+
+export function useGlobalSearch({
+  initialQuery = '',
+  initialFilter = 'all',
+  limit = 12,
+}: {
+  initialQuery?: string;
+  initialFilter?: GlobalSearchFilter;
+  limit?: number;
+} = {}) {
+  const { currentLocale } = useLanguage();
+  const [query, setQuery] = useState(initialQuery);
+  const [filter, setFilter] = useState<GlobalSearchFilter>(initialFilter);
+  const [results, setResults] = useState<GlobalSearchResult[]>([]);
+  const [counts, setCounts] = useState<GlobalSearchResponse['counts']>({
+    all: 0,
+    page: 0,
+    post: 0,
+    product: 0,
+  });
+  const [status, setStatus] = useState<SearchStatus>('idle');
+
+  const normalizedQuery = useMemo(() => query.replace(/\s+/g, ' ').trim(), [query]);
+  const canSearch = normalizedQuery.length >= 2;
+
+  useEffect(() => {
+    if (!canSearch) {
+      setResults([]);
+      setCounts({ all: 0, page: 0, post: 0, product: 0 });
+      setStatus('idle');
+      return;
+    }
+
+    const controller = new AbortController();
+    const timeoutId = window.setTimeout(async () => {
+      setStatus('loading');
+
+      const params = new URLSearchParams({
+        q: normalizedQuery,
+        type: filter,
+        limit: String(limit),
+      });
+
+      if (currentLocale) {
+        params.set('locale', currentLocale);
+      }
+
+      try {
+        const response = await fetch(`/api/search?${params.toString()}`, {
+          signal: controller.signal,
+        });
+
+        if (!response.ok) {
+          throw new Error(`Search request failed with ${response.status}`);
+        }
+
+        const payload = (await response.json()) as GlobalSearchResponse;
+        setResults(payload.results);
+        setCounts(payload.counts);
+        setStatus('success');
+      } catch (error) {
+        if ((error as Error).name === 'AbortError') {
+          return;
+        }
+
+        console.error('Global search request failed:', error);
+        setResults([]);
+        setCounts({ all: 0, page: 0, post: 0, product: 0 });
+        setStatus('error');
+      }
+    }, 180);
+
+    return () => {
+      controller.abort();
+      window.clearTimeout(timeoutId);
+    };
+  }, [canSearch, currentLocale, filter, limit, normalizedQuery]);
+
+  return {
+    query,
+    setQuery,
+    filter,
+    setFilter,
+    results,
+    counts,
+    status,
+    canSearch,
+    isLoading: status === 'loading',
+  };
+}

package/templates/nextblock-template/index.d.ts

@@ -1,7 +1,7 @@
-declare module '*.svg' {
-  const content: any;
-  export const ReactComponent: any;
-  export default content;
-}
-
-declare module 'uuid';
+declare module '*.svg' {
+  const content: any;
+  export const ReactComponent: any;
+  export default content;
+}
+
+declare module 'uuid';

package/templates/nextblock-template/lib/app-secrets.ts

@@ -1,39 +1,39 @@
-import 'server-only';
-import { createHmac } from 'node:crypto';
-
-// Resolve the app's internal shared secrets WITHOUT requiring the operator to paste
-// random strings at deploy time. When an explicit env var is set it always wins;
-// otherwise the secret is derived deterministically from the always-present Supabase
-// service-role key. This is what lets a one-click Vercel deploy work with zero env
-// input while Draft Mode and on-demand revalidation still function out of the box.
-//
-// HMAC-SHA256 is one-way, so a leaked derived secret never exposes the service-role
-// key. The derived value is stable for a given Supabase project; rotating the
-// service-role key rotates these secrets too (set the explicit env var to pin one
-// independently — e.g. to configure a Supabase revalidation webhook with a fixed
-// token). `npm run setup` still writes explicit values locally, so dev is unchanged.
-//
-// CRON_SECRET is intentionally NOT derived here: Vercel Cron injects
-// `Authorization: Bearer ${process.env.CRON_SECRET}` read from the env at invocation,
-// so a derived value could never match it. The cron routes instead treat CRON_SECRET
-// as optional (enforced only when set) — see app/api/cron/*/route.ts.
-
-function deriveFromServiceRole(label: string): string {
-  // Accept the Marketplace integration's SUPABASE_SECRET_KEY alias too, so derivation
-  // still works on a one-click deploy that only injected the new key name.
-  const master = (
-    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY
-  )?.trim();
-  if (!master) return '';
-  return createHmac('sha256', master).update(`nextblock:${label}`).digest('hex');
-}
-
-/** Secret for the programmatic Draft Mode preview entry (`/api/draft?secret=`). */
-export function resolveDraftModeSecret(): string {
-  return process.env.DRAFT_MODE_SECRET?.trim() || deriveFromServiceRole('draft-mode');
-}
-
-/** Shared secret a Supabase webhook sends to `/api/revalidate` (`x-revalidate-secret`). */
-export function resolveRevalidateSecret(): string {
-  return process.env.REVALIDATE_SECRET_TOKEN?.trim() || deriveFromServiceRole('revalidate');
-}
+import 'server-only';
+import { createHmac } from 'node:crypto';
+
+// Resolve the app's internal shared secrets WITHOUT requiring the operator to paste
+// random strings at deploy time. When an explicit env var is set it always wins;
+// otherwise the secret is derived deterministically from the always-present Supabase
+// service-role key. This is what lets a one-click Vercel deploy work with zero env
+// input while Draft Mode and on-demand revalidation still function out of the box.
+//
+// HMAC-SHA256 is one-way, so a leaked derived secret never exposes the service-role
+// key. The derived value is stable for a given Supabase project; rotating the
+// service-role key rotates these secrets too (set the explicit env var to pin one
+// independently — e.g. to configure a Supabase revalidation webhook with a fixed
+// token). `npm run setup` still writes explicit values locally, so dev is unchanged.
+//
+// CRON_SECRET is intentionally NOT derived here: Vercel Cron injects
+// `Authorization: Bearer ${process.env.CRON_SECRET}` read from the env at invocation,
+// so a derived value could never match it. The cron routes instead treat CRON_SECRET
+// as optional (enforced only when set) — see app/api/cron/*/route.ts.
+
+function deriveFromServiceRole(label: string): string {
+  // Accept the Marketplace integration's SUPABASE_SECRET_KEY alias too, so derivation
+  // still works on a one-click deploy that only injected the new key name.
+  const master = (
+    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY
+  )?.trim();
+  if (!master) return '';
+  return createHmac('sha256', master).update(`nextblock:${label}`).digest('hex');
+}
+
+/** Secret for the programmatic Draft Mode preview entry (`/api/draft?secret=`). */
+export function resolveDraftModeSecret(): string {
+  return process.env.DRAFT_MODE_SECRET?.trim() || deriveFromServiceRole('draft-mode');
+}
+
+/** Shared secret a Supabase webhook sends to `/api/revalidate` (`x-revalidate-secret`). */
+export function resolveRevalidateSecret(): string {
+  return process.env.REVALIDATE_SECRET_TOKEN?.trim() || deriveFromServiceRole('revalidate');
+}

package/templates/nextblock-template/lib/auth/cookies.ts

@@ -1,47 +1,47 @@
-// Server-only cookie helpers for the 2FA / trusted-device flow.
-// All three cookies are HttpOnly so they are never readable from JS.
-import { cookies } from 'next/headers';
-
-/** Long-lived "remember this device" token (raw token; its SHA-256 is in the DB). */
-export const TRUSTED_DEVICE_COOKIE = 'nb_trusted_device';
-/** Signed marker proving the email second factor was satisfied this session. */
-export const TWO_FACTOR_COOKIE = 'nb_2fa_verified';
-/** Short-lived flag carrying the "remember me" checkbox from login to post-2FA. */
-export const REMEMBER_INTENT_COOKIE = 'nb_remember_intent';
-
-const isProd = process.env.NODE_ENV === 'production';
-
-export async function setSecureCookie(
-  name: string,
-  value: string,
-  maxAgeSeconds: number,
-): Promise<void> {
-  const store = await cookies();
-  store.set({
-    name,
-    value,
-    httpOnly: true,
-    secure: isProd,
-    sameSite: 'lax',
-    path: '/',
-    maxAge: maxAgeSeconds,
-  });
-}
-
-export async function getCookieValue(name: string): Promise<string | null> {
-  const store = await cookies();
-  return store.get(name)?.value ?? null;
-}
-
-export async function clearCookie(name: string): Promise<void> {
-  const store = await cookies();
-  store.set({
-    name,
-    value: '',
-    httpOnly: true,
-    secure: isProd,
-    sameSite: 'lax',
-    path: '/',
-    maxAge: 0,
-  });
-}
+// Server-only cookie helpers for the 2FA / trusted-device flow.
+// All three cookies are HttpOnly so they are never readable from JS.
+import { cookies } from 'next/headers';
+
+/** Long-lived "remember this device" token (raw token; its SHA-256 is in the DB). */
+export const TRUSTED_DEVICE_COOKIE = 'nb_trusted_device';
+/** Signed marker proving the email second factor was satisfied this session. */
+export const TWO_FACTOR_COOKIE = 'nb_2fa_verified';
+/** Short-lived flag carrying the "remember me" checkbox from login to post-2FA. */
+export const REMEMBER_INTENT_COOKIE = 'nb_remember_intent';
+
+const isProd = process.env.NODE_ENV === 'production';
+
+export async function setSecureCookie(
+  name: string,
+  value: string,
+  maxAgeSeconds: number,
+): Promise<void> {
+  const store = await cookies();
+  store.set({
+    name,
+    value,
+    httpOnly: true,
+    secure: isProd,
+    sameSite: 'lax',
+    path: '/',
+    maxAge: maxAgeSeconds,
+  });
+}
+
+export async function getCookieValue(name: string): Promise<string | null> {
+  const store = await cookies();
+  return store.get(name)?.value ?? null;
+}
+
+export async function clearCookie(name: string): Promise<void> {
+  const store = await cookies();
+  store.set({
+    name,
+    value: '',
+    httpOnly: true,
+    secure: isProd,
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 0,
+  });
+}

package/templates/nextblock-template/lib/auth/crypto.ts

@@ -1,45 +1,45 @@
-// Server-only crypto helpers for 2FA tokens, trusted-device hashing, and the
-// signed "second factor satisfied" session marker. Uses Node's crypto module.
-import crypto from 'node:crypto';
-
-/** SHA-256 hex digest. Used to store device/code hashes (never the raw value). */
-export function sha256Hex(input: string): string {
-  return crypto.createHash('sha256').update(input).digest('hex');
-}
-
-/** Cryptographically random URL-safe token (default 32 bytes -> 43 chars). */
-export function randomToken(bytes = 32): string {
-  return crypto.randomBytes(bytes).toString('base64url');
-}
-
-/** Random fixed-length numeric code, e.g. a 6-digit email 2FA code. */
-export function generateNumericCode(digits = 6): string {
-  const max = 10 ** digits;
-  return crypto.randomInt(0, max).toString().padStart(digits, '0');
-}
-
-function getSecret(): string {
-  // Dedicated secret if provided, otherwise fall back to the service-role key
-  // (server-only, never shipped to the client).
-  const secret =
-    process.env.NB_2FA_SECRET ||
-    process.env.SUPABASE_SERVICE_ROLE_KEY ||
-    process.env.SUPABASE_SECRET_KEY;
-  if (!secret) {
-    throw new Error('Missing NB_2FA_SECRET / SUPABASE_SERVICE_ROLE_KEY for 2FA signing.');
-  }
-  return secret;
-}
-
-/** HMAC-SHA256 signature (base64url) of an arbitrary payload string. */
-export function hmacSign(payload: string): string {
-  return crypto.createHmac('sha256', getSecret()).update(payload).digest('base64url');
-}
-
-/** Constant-time string comparison that never throws on length mismatch. */
-export function safeEqual(a: string, b: string): boolean {
-  const ab = Buffer.from(a);
-  const bb = Buffer.from(b);
-  if (ab.length !== bb.length) return false;
-  return crypto.timingSafeEqual(ab, bb);
-}
+// Server-only crypto helpers for 2FA tokens, trusted-device hashing, and the
+// signed "second factor satisfied" session marker. Uses Node's crypto module.
+import crypto from 'node:crypto';
+
+/** SHA-256 hex digest. Used to store device/code hashes (never the raw value). */
+export function sha256Hex(input: string): string {
+  return crypto.createHash('sha256').update(input).digest('hex');
+}
+
+/** Cryptographically random URL-safe token (default 32 bytes -> 43 chars). */
+export function randomToken(bytes = 32): string {
+  return crypto.randomBytes(bytes).toString('base64url');
+}
+
+/** Random fixed-length numeric code, e.g. a 6-digit email 2FA code. */
+export function generateNumericCode(digits = 6): string {
+  const max = 10 ** digits;
+  return crypto.randomInt(0, max).toString().padStart(digits, '0');
+}
+
+function getSecret(): string {
+  // Dedicated secret if provided, otherwise fall back to the service-role key
+  // (server-only, never shipped to the client).
+  const secret =
+    process.env.NB_2FA_SECRET ||
+    process.env.SUPABASE_SERVICE_ROLE_KEY ||
+    process.env.SUPABASE_SECRET_KEY;
+  if (!secret) {
+    throw new Error('Missing NB_2FA_SECRET / SUPABASE_SERVICE_ROLE_KEY for 2FA signing.');
+  }
+  return secret;
+}
+
+/** HMAC-SHA256 signature (base64url) of an arbitrary payload string. */
+export function hmacSign(payload: string): string {
+  return crypto.createHmac('sha256', getSecret()).update(payload).digest('base64url');
+}
+
+/** Constant-time string comparison that never throws on length mismatch. */
+export function safeEqual(a: string, b: string): boolean {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}