create-nextblock 0.13.9 → 0.13.11

package/templates/nextblock-template/lib/posts/readTime.ts

@@ -1,60 +1,60 @@
-import type { Database } from '@nextblock-cms/db';
-
-type BlockRow = Database['public']['Tables']['blocks']['Row'];
-
-const WORDS_PER_MINUTE = 200;
-
-function extractPlainTextFromHtml(html: string) {
-  return html
-    .replace(/<style[\s\S]*?<\/style>/gi, ' ')
-    .replace(/<script[\s\S]*?<\/script>/gi, ' ')
-    .replace(/<[^>]+>/g, ' ')
-    .replace(/&nbsp;/g, ' ')
-    .replace(/&amp;/g, '&')
-    .replace(/\s+/g, ' ')
-    .trim();
-}
-
-function countWords(text: string) {
-  if (!text) {
-    return 0;
-  }
-
-  return text.split(' ').length;
-}
-
-export function estimateReadTimeMinutesFromHtmlFragments(htmlFragments: string[]) {
-  const words = htmlFragments.reduce((total, html) => {
-    const plainText = extractPlainTextFromHtml(html);
-    return total + countWords(plainText);
-  }, 0);
-
-  return Math.max(1, Math.round(words / WORDS_PER_MINUTE));
-}
-
-export function estimateReadTimeMinutesFromBlocks(
-  blocks: Array<Pick<BlockRow, 'block_type' | 'content'>> | undefined
-) {
-  if (!blocks || blocks.length === 0) {
-    return 1;
-  }
-
-  const htmlFragments = blocks.reduce<string[]>((fragments, block) => {
-    if (block.block_type !== 'text') {
-      return fragments;
-    }
-
-    const html =
-      typeof block.content === 'object' && block.content && 'html_content' in block.content
-        ? String((block.content as { html_content?: string }).html_content ?? '')
-        : '';
-
-    if (html) {
-      fragments.push(html);
-    }
-
-    return fragments;
-  }, []);
-
-  return estimateReadTimeMinutesFromHtmlFragments(htmlFragments);
-}
+import type { Database } from '@nextblock-cms/db';
+
+type BlockRow = Database['public']['Tables']['blocks']['Row'];
+
+const WORDS_PER_MINUTE = 200;
+
+function extractPlainTextFromHtml(html: string) {
+  return html
+    .replace(/<style[\s\S]*?<\/style>/gi, ' ')
+    .replace(/<script[\s\S]*?<\/script>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/&nbsp;/g, ' ')
+    .replace(/&amp;/g, '&')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function countWords(text: string) {
+  if (!text) {
+    return 0;
+  }
+
+  return text.split(' ').length;
+}
+
+export function estimateReadTimeMinutesFromHtmlFragments(htmlFragments: string[]) {
+  const words = htmlFragments.reduce((total, html) => {
+    const plainText = extractPlainTextFromHtml(html);
+    return total + countWords(plainText);
+  }, 0);
+
+  return Math.max(1, Math.round(words / WORDS_PER_MINUTE));
+}
+
+export function estimateReadTimeMinutesFromBlocks(
+  blocks: Array<Pick<BlockRow, 'block_type' | 'content'>> | undefined
+) {
+  if (!blocks || blocks.length === 0) {
+    return 1;
+  }
+
+  const htmlFragments = blocks.reduce<string[]>((fragments, block) => {
+    if (block.block_type !== 'text') {
+      return fragments;
+    }
+
+    const html =
+      typeof block.content === 'object' && block.content && 'html_content' in block.content
+        ? String((block.content as { html_content?: string }).html_content ?? '')
+        : '';
+
+    if (html) {
+      fragments.push(html);
+    }
+
+    return fragments;
+  }, []);
+
+  return estimateReadTimeMinutesFromHtmlFragments(htmlFragments);
+}

package/templates/nextblock-template/lib/privacy/consent-client.ts

@@ -1,57 +1,57 @@
-// Client-side consent cookie helpers. Safe to import from client components only.
-// The cookie is intentionally NOT HttpOnly so the analytics guard can read it
-// before any third-party request is made.
-import {
-  CONSENT_COOKIE_MAX_AGE,
-  CONSENT_COOKIE_NAME,
-  type ConsentPreference,
-} from './types';
-
-/** Window event dispatched when the visitor changes their consent choice. */
-export const CONSENT_CHANGE_EVENT = 'nb:consent-change';
-
-export function readConsent(): ConsentPreference | null {
-  if (typeof document === 'undefined') return null;
-  const entry = document.cookie
-    .split('; ')
-    .find((row) => row.startsWith(`${CONSENT_COOKIE_NAME}=`));
-  if (!entry) return null;
-  try {
-    const raw = decodeURIComponent(entry.slice(CONSENT_COOKIE_NAME.length + 1));
-    const parsed = JSON.parse(raw) as Partial<ConsentPreference>;
-    if (!parsed || typeof parsed !== 'object') return null;
-    return {
-      necessary: true,
-      analytics: Boolean(parsed.analytics),
-      marketing: Boolean(parsed.marketing),
-      token: typeof parsed.token === 'string' ? parsed.token : '',
-      ts: typeof parsed.ts === 'number' ? parsed.ts : 0,
-    };
-  } catch {
-    return null;
-  }
-}
-
-function randomToken(): string {
-  if (typeof window !== 'undefined' && window.crypto?.randomUUID) {
-    return window.crypto.randomUUID();
-  }
-  return `${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
-}
-
-/** Persist a consent decision, broadcast the change, and return the record. */
-export function writeConsent(choice: { analytics: boolean; marketing: boolean }): ConsentPreference {
-  const value: ConsentPreference = {
-    necessary: true,
-    analytics: choice.analytics,
-    marketing: choice.marketing,
-    token: randomToken(),
-    ts: Date.now(),
-  };
-  const secure = typeof location !== 'undefined' && location.protocol === 'https:' ? '; Secure' : '';
-  document.cookie =
-    `${CONSENT_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(value))}` +
-    `; Max-Age=${CONSENT_COOKIE_MAX_AGE}; Path=/; SameSite=Lax${secure}`;
-  window.dispatchEvent(new CustomEvent<ConsentPreference>(CONSENT_CHANGE_EVENT, { detail: value }));
-  return value;
-}
+// Client-side consent cookie helpers. Safe to import from client components only.
+// The cookie is intentionally NOT HttpOnly so the analytics guard can read it
+// before any third-party request is made.
+import {
+  CONSENT_COOKIE_MAX_AGE,
+  CONSENT_COOKIE_NAME,
+  type ConsentPreference,
+} from './types';
+
+/** Window event dispatched when the visitor changes their consent choice. */
+export const CONSENT_CHANGE_EVENT = 'nb:consent-change';
+
+export function readConsent(): ConsentPreference | null {
+  if (typeof document === 'undefined') return null;
+  const entry = document.cookie
+    .split('; ')
+    .find((row) => row.startsWith(`${CONSENT_COOKIE_NAME}=`));
+  if (!entry) return null;
+  try {
+    const raw = decodeURIComponent(entry.slice(CONSENT_COOKIE_NAME.length + 1));
+    const parsed = JSON.parse(raw) as Partial<ConsentPreference>;
+    if (!parsed || typeof parsed !== 'object') return null;
+    return {
+      necessary: true,
+      analytics: Boolean(parsed.analytics),
+      marketing: Boolean(parsed.marketing),
+      token: typeof parsed.token === 'string' ? parsed.token : '',
+      ts: typeof parsed.ts === 'number' ? parsed.ts : 0,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function randomToken(): string {
+  if (typeof window !== 'undefined' && window.crypto?.randomUUID) {
+    return window.crypto.randomUUID();
+  }
+  return `${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+}
+
+/** Persist a consent decision, broadcast the change, and return the record. */
+export function writeConsent(choice: { analytics: boolean; marketing: boolean }): ConsentPreference {
+  const value: ConsentPreference = {
+    necessary: true,
+    analytics: choice.analytics,
+    marketing: choice.marketing,
+    token: randomToken(),
+    ts: Date.now(),
+  };
+  const secure = typeof location !== 'undefined' && location.protocol === 'https:' ? '; Secure' : '';
+  document.cookie =
+    `${CONSENT_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(value))}` +
+    `; Max-Age=${CONSENT_COOKIE_MAX_AGE}; Path=/; SameSite=Lax${secure}`;
+  window.dispatchEvent(new CustomEvent<ConsentPreference>(CONSENT_CHANGE_EVENT, { detail: value }));
+  return value;
+}

package/templates/nextblock-template/lib/privacy/contact-emails.ts

@@ -1,64 +1,64 @@
-// Server-only resolution of the public-facing contact addresses that used to be
-// hard-coded into seed data. The goal: a downloaded/self-hosted copy of NextBlock
-// must NEVER route mail to the original authors. Real addresses live only in
-// sandbox env vars (never committed); committed seeds use neutral @example.com
-// placeholders.
-//
-// Resolution precedence (highest first):
-//   1. The admin-configured value (CMS Settings -> Privacy "Support email").
-//   2. The sandbox env var, but only when NEXT_PUBLIC_IS_SANDBOX === 'true'.
-//   3. A neutral @example.com placeholder.
-//
-// Sandbox DB resets re-seed dummy values on every run, so a static seed value
-// could never stay correct for the hosted demo — hence env-var-backed resolution
-// at render time instead of baking the address into the migration.
-import 'server-only';
-import { cache } from 'react';
-import { getPrivacySettings } from './settings';
-
-/** Neutral placeholder shown when nothing is configured (real installs). */
-const DUMMY_PRIVACY_EMAIL = 'privacy@example.com';
-
-/** Merge tag seeded into the Privacy Policy / Terms page copy. */
-export const PRIVACY_EMAIL_TAG = '{{privacy_email}}';
-
-function isSandbox(): boolean {
-  return process.env.NEXT_PUBLIC_IS_SANDBOX === 'true';
-}
-
-/**
- * Resolve the privacy/legal contact address. `supportEmail` is the admin-set
- * value from privacy settings (reused as the legal contact per product choice).
- */
-export function resolvePrivacyEmail(supportEmail: string): string {
-  const configured = supportEmail.trim();
-  if (configured) return configured;
-
-  if (isSandbox()) {
-    const fromEnv = process.env.SANDBOX_PRIVACY_EMAIL?.trim();
-    if (fromEnv) return fromEnv;
-  }
-
-  return DUMMY_PRIVACY_EMAIL;
-}
-
-/**
- * Per-request cached read of the resolved privacy email. Wrapped in React
- * `cache()` so the many text blocks on a legal page share a single settings
- * lookup within one render.
- */
-export const getPrivacyMergeEmail = cache(async (): Promise<string> => {
-  const settings = await getPrivacySettings();
-  return resolvePrivacyEmail(settings.corporate.support_email);
-});
-
-/**
- * Substitute supported merge tags in a block's HTML. Callers should guard with a
- * cheap `html.includes('{{')` check first so normal blocks pay nothing.
- * Currently supports `{{privacy_email}}` (text and `mailto:` href forms).
- */
-export async function substitutePrivacyMergeTags(html: string): Promise<string> {
-  if (!html.includes(PRIVACY_EMAIL_TAG)) return html;
-  const email = await getPrivacyMergeEmail();
-  return html.split(PRIVACY_EMAIL_TAG).join(email);
-}
+// Server-only resolution of the public-facing contact addresses that used to be
+// hard-coded into seed data. The goal: a downloaded/self-hosted copy of NextBlock
+// must NEVER route mail to the original authors. Real addresses live only in
+// sandbox env vars (never committed); committed seeds use neutral @example.com
+// placeholders.
+//
+// Resolution precedence (highest first):
+//   1. The admin-configured value (CMS Settings -> Privacy "Support email").
+//   2. The sandbox env var, but only when NEXT_PUBLIC_IS_SANDBOX === 'true'.
+//   3. A neutral @example.com placeholder.
+//
+// Sandbox DB resets re-seed dummy values on every run, so a static seed value
+// could never stay correct for the hosted demo — hence env-var-backed resolution
+// at render time instead of baking the address into the migration.
+import 'server-only';
+import { cache } from 'react';
+import { getPrivacySettings } from './settings';
+
+/** Neutral placeholder shown when nothing is configured (real installs). */
+const DUMMY_PRIVACY_EMAIL = 'privacy@example.com';
+
+/** Merge tag seeded into the Privacy Policy / Terms page copy. */
+export const PRIVACY_EMAIL_TAG = '{{privacy_email}}';
+
+function isSandbox(): boolean {
+  return process.env.NEXT_PUBLIC_IS_SANDBOX === 'true';
+}
+
+/**
+ * Resolve the privacy/legal contact address. `supportEmail` is the admin-set
+ * value from privacy settings (reused as the legal contact per product choice).
+ */
+export function resolvePrivacyEmail(supportEmail: string): string {
+  const configured = supportEmail.trim();
+  if (configured) return configured;
+
+  if (isSandbox()) {
+    const fromEnv = process.env.SANDBOX_PRIVACY_EMAIL?.trim();
+    if (fromEnv) return fromEnv;
+  }
+
+  return DUMMY_PRIVACY_EMAIL;
+}
+
+/**
+ * Per-request cached read of the resolved privacy email. Wrapped in React
+ * `cache()` so the many text blocks on a legal page share a single settings
+ * lookup within one render.
+ */
+export const getPrivacyMergeEmail = cache(async (): Promise<string> => {
+  const settings = await getPrivacySettings();
+  return resolvePrivacyEmail(settings.corporate.support_email);
+});
+
+/**
+ * Substitute supported merge tags in a block's HTML. Callers should guard with a
+ * cheap `html.includes('{{')` check first so normal blocks pay nothing.
+ * Currently supports `{{privacy_email}}` (text and `mailto:` href forms).
+ */
+export async function substitutePrivacyMergeTags(html: string): Promise<string> {
+  if (!html.includes(PRIVACY_EMAIL_TAG)) return html;
+  const email = await getPrivacyMergeEmail();
+  return html.split(PRIVACY_EMAIL_TAG).join(email);
+}

package/templates/nextblock-template/lib/privacy/settings.ts

@@ -1,115 +1,115 @@
-// Server-only read/write for the `privacy_settings` and `security_settings`
-// rows in the site_settings key-value table. Mirrors the copyright/bot-protection
-// pattern (createClient + RLS for writes; revalidatePath handled by callers).
-import { createClient } from '@nextblock-cms/db/server';
-import {
-  DEFAULT_PRIVACY_SETTINGS,
-  DEFAULT_SECURITY_SETTINGS,
-  MAX_TRUSTED_DEVICE_DAYS,
-  MIN_TRUSTED_DEVICE_DAYS,
-  type CorporateIdentity,
-  type PrivacySettings,
-  type SecuritySettings,
-} from './types';
-
-const PRIVACY_KEY = 'privacy_settings';
-const SECURITY_KEY = 'security_settings';
-
-function asString(value: unknown, fallback = ''): string {
-  return typeof value === 'string' ? value : fallback;
-}
-
-function asBool(value: unknown, fallback: boolean): boolean {
-  if (typeof value === 'boolean') return value;
-  if (typeof value === 'string') return value === 'true' || value === 'on';
-  return fallback;
-}
-
-function normalizePrivacy(value: unknown): PrivacySettings {
-  const raw = (value && typeof value === 'object' ? value : {}) as Record<string, unknown>;
-  const corporateRaw = (raw.corporate && typeof raw.corporate === 'object'
-    ? raw.corporate
-    : {}) as Record<string, unknown>;
-  const corporate: CorporateIdentity = {
-    legal_name: asString(corporateRaw.legal_name),
-    address: asString(corporateRaw.address),
-    support_email: asString(corporateRaw.support_email),
-  };
-  return {
-    banner_enabled: asBool(raw.banner_enabled, DEFAULT_PRIVACY_SETTINGS.banner_enabled),
-    gtm_id: asString(raw.gtm_id),
-    ga_measurement_id: asString(raw.ga_measurement_id),
-    custom_scripts: asString(raw.custom_scripts),
-    corporate,
-  };
-}
-
-function clampTrustDays(value: unknown): number {
-  const n = typeof value === 'number' ? value : Number.parseInt(asString(value), 10);
-  if (!Number.isFinite(n)) return DEFAULT_SECURITY_SETTINGS.trusted_device_days;
-  return Math.min(MAX_TRUSTED_DEVICE_DAYS, Math.max(MIN_TRUSTED_DEVICE_DAYS, Math.round(n)));
-}
-
-function normalizeSecurity(value: unknown): SecuritySettings {
-  const raw = (value && typeof value === 'object' ? value : {}) as Record<string, unknown>;
-  return {
-    trusted_device_days: clampTrustDays(raw.trusted_device_days),
-    enforce_staff_2fa: asBool(raw.enforce_staff_2fa, DEFAULT_SECURITY_SETTINGS.enforce_staff_2fa),
-  };
-}
-
-export async function getPrivacySettings(): Promise<PrivacySettings> {
-  const supabase = createClient();
-  const { data } = await supabase
-    .from('site_settings')
-    .select('value')
-    .eq('key', PRIVACY_KEY)
-    .maybeSingle();
-  return normalizePrivacy(data?.value);
-}
-
-export async function getSecuritySettings(): Promise<SecuritySettings> {
-  const supabase = createClient();
-  const { data } = await supabase
-    .from('site_settings')
-    .select('value')
-    .eq('key', SECURITY_KEY)
-    .maybeSingle();
-  return normalizeSecurity(data?.value);
-}
-
-export async function savePrivacySettings(input: PrivacySettings): Promise<void> {
-  const supabase = createClient();
-  const value = normalizePrivacy(input);
-  const { error } = await supabase
-    .from('site_settings')
-    .upsert({ key: PRIVACY_KEY, value });
-  if (error) {
-    console.error('Error saving privacy settings:', error.message);
-    throw new Error('Failed to save privacy settings.');
-  }
-}
-
-// Privacy/consent and Google Analytics share the single `privacy_settings` row but
-// are edited from two different CMS pages (Settings -> Privacy vs Settings -> Google
-// Analytics). Each page must persist only its own fields without clobbering the other
-// page's, so writes read-merge against the current row. (We may split this into a
-// dedicated `analytics_settings` key later.)
-export async function mergePrivacySettings(
-  patch: Partial<PrivacySettings>
-): Promise<void> {
-  const current = await getPrivacySettings();
-  await savePrivacySettings({ ...current, ...patch });
-}
-
-export async function saveSecuritySettings(input: SecuritySettings): Promise<void> {
-  const supabase = createClient();
-  const value = normalizeSecurity(input);
-  const { error } = await supabase
-    .from('site_settings')
-    .upsert({ key: SECURITY_KEY, value });
-  if (error) {
-    console.error('Error saving security settings:', error.message);
-    throw new Error('Failed to save security settings.');
-  }
-}
+// Server-only read/write for the `privacy_settings` and `security_settings`
+// rows in the site_settings key-value table. Mirrors the copyright/bot-protection
+// pattern (createClient + RLS for writes; revalidatePath handled by callers).
+import { createClient } from '@nextblock-cms/db/server';
+import {
+  DEFAULT_PRIVACY_SETTINGS,
+  DEFAULT_SECURITY_SETTINGS,
+  MAX_TRUSTED_DEVICE_DAYS,
+  MIN_TRUSTED_DEVICE_DAYS,
+  type CorporateIdentity,
+  type PrivacySettings,
+  type SecuritySettings,
+} from './types';
+
+const PRIVACY_KEY = 'privacy_settings';
+const SECURITY_KEY = 'security_settings';
+
+function asString(value: unknown, fallback = ''): string {
+  return typeof value === 'string' ? value : fallback;
+}
+
+function asBool(value: unknown, fallback: boolean): boolean {
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'string') return value === 'true' || value === 'on';
+  return fallback;
+}
+
+function normalizePrivacy(value: unknown): PrivacySettings {
+  const raw = (value && typeof value === 'object' ? value : {}) as Record<string, unknown>;
+  const corporateRaw = (raw.corporate && typeof raw.corporate === 'object'
+    ? raw.corporate
+    : {}) as Record<string, unknown>;
+  const corporate: CorporateIdentity = {
+    legal_name: asString(corporateRaw.legal_name),
+    address: asString(corporateRaw.address),
+    support_email: asString(corporateRaw.support_email),
+  };
+  return {
+    banner_enabled: asBool(raw.banner_enabled, DEFAULT_PRIVACY_SETTINGS.banner_enabled),
+    gtm_id: asString(raw.gtm_id),
+    ga_measurement_id: asString(raw.ga_measurement_id),
+    custom_scripts: asString(raw.custom_scripts),
+    corporate,
+  };
+}
+
+function clampTrustDays(value: unknown): number {
+  const n = typeof value === 'number' ? value : Number.parseInt(asString(value), 10);
+  if (!Number.isFinite(n)) return DEFAULT_SECURITY_SETTINGS.trusted_device_days;
+  return Math.min(MAX_TRUSTED_DEVICE_DAYS, Math.max(MIN_TRUSTED_DEVICE_DAYS, Math.round(n)));
+}
+
+function normalizeSecurity(value: unknown): SecuritySettings {
+  const raw = (value && typeof value === 'object' ? value : {}) as Record<string, unknown>;
+  return {
+    trusted_device_days: clampTrustDays(raw.trusted_device_days),
+    enforce_staff_2fa: asBool(raw.enforce_staff_2fa, DEFAULT_SECURITY_SETTINGS.enforce_staff_2fa),
+  };
+}
+
+export async function getPrivacySettings(): Promise<PrivacySettings> {
+  const supabase = createClient();
+  const { data } = await supabase
+    .from('site_settings')
+    .select('value')
+    .eq('key', PRIVACY_KEY)
+    .maybeSingle();
+  return normalizePrivacy(data?.value);
+}
+
+export async function getSecuritySettings(): Promise<SecuritySettings> {
+  const supabase = createClient();
+  const { data } = await supabase
+    .from('site_settings')
+    .select('value')
+    .eq('key', SECURITY_KEY)
+    .maybeSingle();
+  return normalizeSecurity(data?.value);
+}
+
+export async function savePrivacySettings(input: PrivacySettings): Promise<void> {
+  const supabase = createClient();
+  const value = normalizePrivacy(input);
+  const { error } = await supabase
+    .from('site_settings')
+    .upsert({ key: PRIVACY_KEY, value });
+  if (error) {
+    console.error('Error saving privacy settings:', error.message);
+    throw new Error('Failed to save privacy settings.');
+  }
+}
+
+// Privacy/consent and Google Analytics share the single `privacy_settings` row but
+// are edited from two different CMS pages (Settings -> Privacy vs Settings -> Google
+// Analytics). Each page must persist only its own fields without clobbering the other
+// page's, so writes read-merge against the current row. (We may split this into a
+// dedicated `analytics_settings` key later.)
+export async function mergePrivacySettings(
+  patch: Partial<PrivacySettings>
+): Promise<void> {
+  const current = await getPrivacySettings();
+  await savePrivacySettings({ ...current, ...patch });
+}
+
+export async function saveSecuritySettings(input: SecuritySettings): Promise<void> {
+  const supabase = createClient();
+  const value = normalizeSecurity(input);
+  const { error } = await supabase
+    .from('site_settings')
+    .upsert({ key: SECURITY_KEY, value });
+  if (error) {
+    console.error('Error saving security settings:', error.message);
+    throw new Error('Failed to save security settings.');
+  }
+}