create-nextblock 0.13.9 → 0.13.11

package/templates/nextblock-template/app/api/ai/cortex/build-widget/route.ts

@@ -1,153 +1,153 @@
-import { NextResponse } from 'next/server';
-import { revalidatePath, revalidateTag } from 'next/cache';
-
-import { createClient, verifyPackageOnline } from '@nextblock-cms/db/server';
-
-import { generateCortexWidgetDefinition } from '@nextblock-cms/cortex';
-import {
-  cortexWidgetBuildRequestSchema,
-} from '@nextblock-cms/cortex';
-import {
-  CortexWidgetRegistryInsertError,
-  insertCortexWidgetDefinition,
-} from '@nextblock-cms/cortex';
-import {
-  CUSTOM_BLOCK_DEFINITIONS_CACHE_TAG,
-  getCustomBlockDefinitionCacheTag,
-} from '../../../../../lib/custom-block-definitions';
-import {
-  safeParseCortexAiModelSelection,
-  summarizeCortexAiRoutingError,
-} from '@nextblock-cms/cortex';
-
-export const dynamic = 'force-dynamic';
-
-const DYNAMIC_LAYOUT_ENGINE_CACHE_TAG = 'dynamic-layout-engine';
-
-type SupabaseServerClient = ReturnType<typeof createClient>;
-
-async function requireCmsWriterAccess(supabase: SupabaseServerClient) {
-  const {
-    data: { user },
-    error: userError,
-  } = await supabase.auth.getUser();
-
-  if (userError || !user) {
-    return null;
-  }
-
-  const { data: profile, error: profileError } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', user.id)
-    .single();
-
-  if (profileError || !profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
-    return null;
-  }
-
-  return { userId: user.id };
-}
-
-function jsonError(message: string, status: number) {
-  return NextResponse.json({ error: message }, { status });
-}
-
-function getDynamicLayoutDefinitionCacheTag(idOrSlug: string) {
-  return `${DYNAMIC_LAYOUT_ENGINE_CACHE_TAG}:definition:${idOrSlug}`;
-}
-
-function revalidateCortexWidgetDefinition(definition: { id: string; slug: string }) {
-  revalidateTag(CUSTOM_BLOCK_DEFINITIONS_CACHE_TAG, 'max');
-  revalidateTag(getCustomBlockDefinitionCacheTag(definition.id), 'max');
-  revalidateTag(getCustomBlockDefinitionCacheTag(definition.slug), 'max');
-  revalidateTag(DYNAMIC_LAYOUT_ENGINE_CACHE_TAG, 'max');
-  revalidateTag(getDynamicLayoutDefinitionCacheTag(definition.id), 'max');
-  revalidateTag(getDynamicLayoutDefinitionCacheTag(definition.slug), 'max');
-  revalidatePath('/cms/blocks');
-  revalidatePath('/cms/custom-blocks');
-}
-
-export async function POST(request: Request) {
-  try {
-    const supabase = createClient();
-    const access = await requireCmsWriterAccess(supabase);
-
-    if (!access) {
-      return jsonError('You do not have permission to build Cortex widgets.', 403);
-    }
-
-    const isCortexAiActive = await verifyPackageOnline('cortex-ai');
-
-    if (!isCortexAiActive) {
-      return jsonError('NextBlock Cortex AI is not active for this workspace.', 403);
-    }
-
-    const body = await request.json().catch(() => null);
-    const parsedRequest = cortexWidgetBuildRequestSchema.safeParse(body);
-
-    if (!parsedRequest.success) {
-      return jsonError('Invalid Cortex widget build request.', 400);
-    }
-
-    const sandboxKey =
-      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
-        ? request.headers.get('x-sandbox-openrouter-key')
-        : null;
-    const sandboxModelRaw =
-      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
-        ? request.headers.get('x-sandbox-openrouter-model')
-        : null;
-
-    let modelSelection = null;
-    if (sandboxModelRaw) {
-      try {
-        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
-      } catch {
-        // Ignore malformed sandbox model headers.
-      }
-    }
-
-    const generation = await generateCortexWidgetDefinition({
-      ...parsedRequest.data,
-      apiKey: sandboxKey || undefined,
-      modelSelection: sandboxKey && modelSelection ? modelSelection : undefined,
-    });
-    const definition = await insertCortexWidgetDefinition(supabase, generation.definition);
-
-    revalidateCortexWidgetDefinition(definition);
-
-    return NextResponse.json(
-      {
-        attempts: generation.attempts,
-        credentialSource: generation.credentialSource,
-        definition,
-        modelId: generation.modelId,
-        success: true,
-      },
-      {
-        headers: {
-          'x-cortex-ai-credential-source': generation.credentialSource,
-          'x-cortex-ai-model': generation.modelId,
-        },
-      }
-    );
-  } catch (error) {
-    if (error instanceof CortexWidgetRegistryInsertError) {
-      return jsonError(error.message, error.status);
-    }
-
-    if (error && typeof error === 'object' && 'attempts' in error) {
-      console.error(
-        '[Cortex AI] Failed to build widget after model attempts:',
-        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
-      );
-    }
-
-    console.error('[Cortex AI] Failed to build widget:', error);
-    return jsonError(
-      summarizeCortexAiRoutingError(error, 'Failed to build Cortex widget.'),
-      500
-    );
-  }
-}
+import { NextResponse } from 'next/server';
+import { revalidatePath, revalidateTag } from 'next/cache';
+
+import { createClient, verifyPackageOnline } from '@nextblock-cms/db/server';
+
+import { generateCortexWidgetDefinition } from '@nextblock-cms/cortex';
+import {
+  cortexWidgetBuildRequestSchema,
+} from '@nextblock-cms/cortex';
+import {
+  CortexWidgetRegistryInsertError,
+  insertCortexWidgetDefinition,
+} from '@nextblock-cms/cortex';
+import {
+  CUSTOM_BLOCK_DEFINITIONS_CACHE_TAG,
+  getCustomBlockDefinitionCacheTag,
+} from '../../../../../lib/custom-block-definitions';
+import {
+  safeParseCortexAiModelSelection,
+  summarizeCortexAiRoutingError,
+} from '@nextblock-cms/cortex';
+
+export const dynamic = 'force-dynamic';
+
+const DYNAMIC_LAYOUT_ENGINE_CACHE_TAG = 'dynamic-layout-engine';
+
+type SupabaseServerClient = ReturnType<typeof createClient>;
+
+async function requireCmsWriterAccess(supabase: SupabaseServerClient) {
+  const {
+    data: { user },
+    error: userError,
+  } = await supabase.auth.getUser();
+
+  if (userError || !user) {
+    return null;
+  }
+
+  const { data: profile, error: profileError } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+
+  if (profileError || !profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+    return null;
+  }
+
+  return { userId: user.id };
+}
+
+function jsonError(message: string, status: number) {
+  return NextResponse.json({ error: message }, { status });
+}
+
+function getDynamicLayoutDefinitionCacheTag(idOrSlug: string) {
+  return `${DYNAMIC_LAYOUT_ENGINE_CACHE_TAG}:definition:${idOrSlug}`;
+}
+
+function revalidateCortexWidgetDefinition(definition: { id: string; slug: string }) {
+  revalidateTag(CUSTOM_BLOCK_DEFINITIONS_CACHE_TAG, 'max');
+  revalidateTag(getCustomBlockDefinitionCacheTag(definition.id), 'max');
+  revalidateTag(getCustomBlockDefinitionCacheTag(definition.slug), 'max');
+  revalidateTag(DYNAMIC_LAYOUT_ENGINE_CACHE_TAG, 'max');
+  revalidateTag(getDynamicLayoutDefinitionCacheTag(definition.id), 'max');
+  revalidateTag(getDynamicLayoutDefinitionCacheTag(definition.slug), 'max');
+  revalidatePath('/cms/blocks');
+  revalidatePath('/cms/custom-blocks');
+}
+
+export async function POST(request: Request) {
+  try {
+    const supabase = createClient();
+    const access = await requireCmsWriterAccess(supabase);
+
+    if (!access) {
+      return jsonError('You do not have permission to build Cortex widgets.', 403);
+    }
+
+    const isCortexAiActive = await verifyPackageOnline('cortex-ai');
+
+    if (!isCortexAiActive) {
+      return jsonError('NextBlock Cortex AI is not active for this workspace.', 403);
+    }
+
+    const body = await request.json().catch(() => null);
+    const parsedRequest = cortexWidgetBuildRequestSchema.safeParse(body);
+
+    if (!parsedRequest.success) {
+      return jsonError('Invalid Cortex widget build request.', 400);
+    }
+
+    const sandboxKey =
+      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+        ? request.headers.get('x-sandbox-openrouter-key')
+        : null;
+    const sandboxModelRaw =
+      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+        ? request.headers.get('x-sandbox-openrouter-model')
+        : null;
+
+    let modelSelection = null;
+    if (sandboxModelRaw) {
+      try {
+        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
+      } catch {
+        // Ignore malformed sandbox model headers.
+      }
+    }
+
+    const generation = await generateCortexWidgetDefinition({
+      ...parsedRequest.data,
+      apiKey: sandboxKey || undefined,
+      modelSelection: sandboxKey && modelSelection ? modelSelection : undefined,
+    });
+    const definition = await insertCortexWidgetDefinition(supabase, generation.definition);
+
+    revalidateCortexWidgetDefinition(definition);
+
+    return NextResponse.json(
+      {
+        attempts: generation.attempts,
+        credentialSource: generation.credentialSource,
+        definition,
+        modelId: generation.modelId,
+        success: true,
+      },
+      {
+        headers: {
+          'x-cortex-ai-credential-source': generation.credentialSource,
+          'x-cortex-ai-model': generation.modelId,
+        },
+      }
+    );
+  } catch (error) {
+    if (error instanceof CortexWidgetRegistryInsertError) {
+      return jsonError(error.message, error.status);
+    }
+
+    if (error && typeof error === 'object' && 'attempts' in error) {
+      console.error(
+        '[Cortex AI] Failed to build widget after model attempts:',
+        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
+      );
+    }
+
+    console.error('[Cortex AI] Failed to build widget:', error);
+    return jsonError(
+      summarizeCortexAiRoutingError(error, 'Failed to build Cortex widget.'),
+      500
+    );
+  }
+}

package/templates/nextblock-template/app/api/ai/generate-blocks/route.ts

@@ -1,96 +1,96 @@
-import { NextResponse } from 'next/server';
-
-import { createClient } from '@nextblock-cms/db/server';
-
-import {
-  generateEditorHtmlFragment,
-  generateEditorBlocksRequestSchema,
-} from '@nextblock-cms/cortex';
-import {
-  safeParseCortexAiModelSelection,
-  summarizeCortexAiRoutingError,
-} from '@nextblock-cms/cortex';
-
-export const dynamic = 'force-dynamic';
-
-async function requireCmsEditorAccess() {
-  const supabase = createClient();
-  const {
-    data: { user },
-    error: userError,
-  } = await supabase.auth.getUser();
-
-  if (userError || !user) {
-    return false;
-  }
-
-  const { data: profile, error: profileError } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', user.id)
-    .single();
-
-  return !profileError && (profile?.role === 'ADMIN' || profile?.role === 'WRITER');
-}
-
-function jsonError(message: string, status: number) {
-  return NextResponse.json({ error: message }, { status });
-}
-
-export async function POST(request: Request) {
-  try {
-    const hasAccess = await requireCmsEditorAccess();
-
-    if (!hasAccess) {
-      return jsonError('You do not have permission to generate editor blocks.', 403);
-    }
-
-    const body = await request.json().catch(() => null);
-    const parsedRequest = generateEditorBlocksRequestSchema.safeParse(body);
-
-    if (!parsedRequest.success) {
-      return jsonError('Invalid Cortex AI block generation request.', 400);
-    }
-
-    const sandboxKey = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-key') : null;
-    const sandboxModelRaw = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-model') : null;
-    
-    let modelSelection = null;
-    if (sandboxModelRaw) {
-      try {
-        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
-      } catch {
-        // Ignore parse errors from headers
-      }
-    }
-
-    const result = await generateEditorHtmlFragment({
-      ...parsedRequest.data,
-      apiKey: sandboxKey || undefined,
-      modelSelection: sandboxKey && modelSelection ? modelSelection : undefined,
-    });
-
-    return NextResponse.json({
-      credentialSource: result.credentialSource,
-      html: result.html,
-      modelId: result.modelId,
-    }, {
-      headers: {
-        'x-cortex-ai-credential-source': result.credentialSource,
-        'x-cortex-ai-model': result.modelId,
-      },
-    });
-  } catch (error) {
-    if (error && typeof error === 'object' && 'attempts' in error) {
-      console.error(
-        '[Cortex AI] Failed to generate editor HTML after model attempts:',
-        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
-      );
-    }
-    console.error('[Cortex AI] Failed to generate editor HTML:', error);
-    return jsonError(
-      summarizeCortexAiRoutingError(error, 'Failed to generate editor HTML.'),
-      500
-    );
-  }
-}
+import { NextResponse } from 'next/server';
+
+import { createClient } from '@nextblock-cms/db/server';
+
+import {
+  generateEditorHtmlFragment,
+  generateEditorBlocksRequestSchema,
+} from '@nextblock-cms/cortex';
+import {
+  safeParseCortexAiModelSelection,
+  summarizeCortexAiRoutingError,
+} from '@nextblock-cms/cortex';
+
+export const dynamic = 'force-dynamic';
+
+async function requireCmsEditorAccess() {
+  const supabase = createClient();
+  const {
+    data: { user },
+    error: userError,
+  } = await supabase.auth.getUser();
+
+  if (userError || !user) {
+    return false;
+  }
+
+  const { data: profile, error: profileError } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+
+  return !profileError && (profile?.role === 'ADMIN' || profile?.role === 'WRITER');
+}
+
+function jsonError(message: string, status: number) {
+  return NextResponse.json({ error: message }, { status });
+}
+
+export async function POST(request: Request) {
+  try {
+    const hasAccess = await requireCmsEditorAccess();
+
+    if (!hasAccess) {
+      return jsonError('You do not have permission to generate editor blocks.', 403);
+    }
+
+    const body = await request.json().catch(() => null);
+    const parsedRequest = generateEditorBlocksRequestSchema.safeParse(body);
+
+    if (!parsedRequest.success) {
+      return jsonError('Invalid Cortex AI block generation request.', 400);
+    }
+
+    const sandboxKey = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-key') : null;
+    const sandboxModelRaw = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-model') : null;
+    
+    let modelSelection = null;
+    if (sandboxModelRaw) {
+      try {
+        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
+      } catch {
+        // Ignore parse errors from headers
+      }
+    }
+
+    const result = await generateEditorHtmlFragment({
+      ...parsedRequest.data,
+      apiKey: sandboxKey || undefined,
+      modelSelection: sandboxKey && modelSelection ? modelSelection : undefined,
+    });
+
+    return NextResponse.json({
+      credentialSource: result.credentialSource,
+      html: result.html,
+      modelId: result.modelId,
+    }, {
+      headers: {
+        'x-cortex-ai-credential-source': result.credentialSource,
+        'x-cortex-ai-model': result.modelId,
+      },
+    });
+  } catch (error) {
+    if (error && typeof error === 'object' && 'attempts' in error) {
+      console.error(
+        '[Cortex AI] Failed to generate editor HTML after model attempts:',
+        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
+      );
+    }
+    console.error('[Cortex AI] Failed to generate editor HTML:', error);
+    return jsonError(
+      summarizeCortexAiRoutingError(error, 'Failed to generate editor HTML.'),
+      500
+    );
+  }
+}

package/templates/nextblock-template/app/api/brand/email-logo/route.ts

@@ -1,48 +1,48 @@
-import { NextResponse } from 'next/server';
-
-import { resolveEmailBranding } from '../../../../lib/email/branding';
-
-// Public, unauthenticated logo endpoint for the Supabase auth emails (magic link, password
-// reset, confirm email, invite, ...). Those templates are rendered and sent by Supabase's
-// own SMTP from static HTML, so they cannot read the CMS logo per-send. Instead their
-// `<img>` points here (`{{ .SiteURL }}/api/brand/email-logo`); when the recipient opens the
-// email their client fetches this route, which 302-redirects to the operator's CURRENT
-// uploaded logo. That keeps the statically-pushed auth templates in sync with the live CMS
-// logo with no re-deploy — "change at will".
-//
-// Email image proxies (e.g. Gmail) hit this unauthenticated and follow the redirect, so it
-// must never require auth and must always return an image (never a 4xx/5xx that would show
-// a broken-image icon). When no logo is configured it returns a 1x1 transparent PNG — a
-// static <img> can't fall back to a text banner the way the app-rendered emails do.
-export const dynamic = 'force-dynamic';
-
-// 1x1 transparent PNG.
-const TRANSPARENT_PNG = Buffer.from(
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==',
-  'base64',
-);
-
-function transparentPixel(): NextResponse {
-  return new NextResponse(TRANSPARENT_PNG, {
-    status: 200,
-    headers: {
-      'Content-Type': 'image/png',
-      // Short cache so a newly-set logo starts showing quickly on freshly-sent emails.
-      'Cache-Control': 'public, max-age=60',
-    },
-  });
-}
-
-export async function GET() {
-  try {
-    const { logoUrl } = await resolveEmailBranding();
-    if (logoUrl) {
-      const response = NextResponse.redirect(logoUrl, 302);
-      response.headers.set('Cache-Control', 'public, max-age=300');
-      return response;
-    }
-  } catch {
-    // Fall through to the transparent pixel — never surface an error to an email client.
-  }
-  return transparentPixel();
-}
+import { NextResponse } from 'next/server';
+
+import { resolveEmailBranding } from '../../../../lib/email/branding';
+
+// Public, unauthenticated logo endpoint for the Supabase auth emails (magic link, password
+// reset, confirm email, invite, ...). Those templates are rendered and sent by Supabase's
+// own SMTP from static HTML, so they cannot read the CMS logo per-send. Instead their
+// `<img>` points here (`{{ .SiteURL }}/api/brand/email-logo`); when the recipient opens the
+// email their client fetches this route, which 302-redirects to the operator's CURRENT
+// uploaded logo. That keeps the statically-pushed auth templates in sync with the live CMS
+// logo with no re-deploy — "change at will".
+//
+// Email image proxies (e.g. Gmail) hit this unauthenticated and follow the redirect, so it
+// must never require auth and must always return an image (never a 4xx/5xx that would show
+// a broken-image icon). When no logo is configured it returns a 1x1 transparent PNG — a
+// static <img> can't fall back to a text banner the way the app-rendered emails do.
+export const dynamic = 'force-dynamic';
+
+// 1x1 transparent PNG.
+const TRANSPARENT_PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==',
+  'base64',
+);
+
+function transparentPixel(): NextResponse {
+  return new NextResponse(TRANSPARENT_PNG, {
+    status: 200,
+    headers: {
+      'Content-Type': 'image/png',
+      // Short cache so a newly-set logo starts showing quickly on freshly-sent emails.
+      'Cache-Control': 'public, max-age=60',
+    },
+  });
+}
+
+export async function GET() {
+  try {
+    const { logoUrl } = await resolveEmailBranding();
+    if (logoUrl) {
+      const response = NextResponse.redirect(logoUrl, 302);
+      response.headers.set('Cache-Control', 'public, max-age=300');
+      return response;
+    }
+  } catch {
+    // Fall through to the transparent pixel — never surface an error to an email client.
+  }
+  return transparentPixel();
+}