create-nextblock 0.14.0 → 0.14.2

package/templates/nextblock-template/app/api/ai/generate-blocks/route.ts

@@ -1,96 +1,96 @@
-import { NextResponse } from 'next/server';
-
-import { createClient } from '@nextblock-cms/db/server';
-
-import {
-  generateEditorHtmlFragment,
-  generateEditorBlocksRequestSchema,
-} from '@nextblock-cms/cortex';
-import {
-  safeParseCortexAiModelSelection,
-  summarizeCortexAiRoutingError,
-} from '@nextblock-cms/cortex';
-
-export const dynamic = 'force-dynamic';
-
-async function requireCmsEditorAccess() {
-  const supabase = createClient();
-  const {
-    data: { user },
-    error: userError,
-  } = await supabase.auth.getUser();
-
-  if (userError || !user) {
-    return false;
-  }
-
-  const { data: profile, error: profileError } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', user.id)
-    .single();
-
-  return !profileError && (profile?.role === 'ADMIN' || profile?.role === 'WRITER');
-}
-
-function jsonError(message: string, status: number) {
-  return NextResponse.json({ error: message }, { status });
-}
-
-export async function POST(request: Request) {
-  try {
-    const hasAccess = await requireCmsEditorAccess();
-
-    if (!hasAccess) {
-      return jsonError('You do not have permission to generate editor blocks.', 403);
-    }
-
-    const body = await request.json().catch(() => null);
-    const parsedRequest = generateEditorBlocksRequestSchema.safeParse(body);
-
-    if (!parsedRequest.success) {
-      return jsonError('Invalid Cortex AI block generation request.', 400);
-    }
-
-    const sandboxKey = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-key') : null;
-    const sandboxModelRaw = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-model') : null;
-    
-    let modelSelection = null;
-    if (sandboxModelRaw) {
-      try {
-        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
-      } catch {
-        // Ignore parse errors from headers
-      }
-    }
-
-    const result = await generateEditorHtmlFragment({
-      ...parsedRequest.data,
-      apiKey: sandboxKey || undefined,
-      modelSelection: sandboxKey && modelSelection ? modelSelection : undefined,
-    });
-
-    return NextResponse.json({
-      credentialSource: result.credentialSource,
-      html: result.html,
-      modelId: result.modelId,
-    }, {
-      headers: {
-        'x-cortex-ai-credential-source': result.credentialSource,
-        'x-cortex-ai-model': result.modelId,
-      },
-    });
-  } catch (error) {
-    if (error && typeof error === 'object' && 'attempts' in error) {
-      console.error(
-        '[Cortex AI] Failed to generate editor HTML after model attempts:',
-        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
-      );
-    }
-    console.error('[Cortex AI] Failed to generate editor HTML:', error);
-    return jsonError(
-      summarizeCortexAiRoutingError(error, 'Failed to generate editor HTML.'),
-      500
-    );
-  }
-}
+import { NextResponse } from 'next/server';
+
+import { createClient } from '@nextblock-cms/db/server';
+
+import {
+  generateEditorHtmlFragment,
+  generateEditorBlocksRequestSchema,
+} from '@nextblock-cms/cortex';
+import {
+  safeParseCortexAiModelSelection,
+  summarizeCortexAiRoutingError,
+} from '@nextblock-cms/cortex';
+
+export const dynamic = 'force-dynamic';
+
+async function requireCmsEditorAccess() {
+  const supabase = createClient();
+  const {
+    data: { user },
+    error: userError,
+  } = await supabase.auth.getUser();
+
+  if (userError || !user) {
+    return false;
+  }
+
+  const { data: profile, error: profileError } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+
+  return !profileError && (profile?.role === 'ADMIN' || profile?.role === 'WRITER');
+}
+
+function jsonError(message: string, status: number) {
+  return NextResponse.json({ error: message }, { status });
+}
+
+export async function POST(request: Request) {
+  try {
+    const hasAccess = await requireCmsEditorAccess();
+
+    if (!hasAccess) {
+      return jsonError('You do not have permission to generate editor blocks.', 403);
+    }
+
+    const body = await request.json().catch(() => null);
+    const parsedRequest = generateEditorBlocksRequestSchema.safeParse(body);
+
+    if (!parsedRequest.success) {
+      return jsonError('Invalid Cortex AI block generation request.', 400);
+    }
+
+    const sandboxKey = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-key') : null;
+    const sandboxModelRaw = process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' ? request.headers.get('x-sandbox-openrouter-model') : null;
+    
+    let modelSelection = null;
+    if (sandboxModelRaw) {
+      try {
+        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
+      } catch {
+        // Ignore parse errors from headers
+      }
+    }
+
+    const result = await generateEditorHtmlFragment({
+      ...parsedRequest.data,
+      apiKey: sandboxKey || undefined,
+      modelSelection: sandboxKey && modelSelection ? modelSelection : undefined,
+    });
+
+    return NextResponse.json({
+      credentialSource: result.credentialSource,
+      html: result.html,
+      modelId: result.modelId,
+    }, {
+      headers: {
+        'x-cortex-ai-credential-source': result.credentialSource,
+        'x-cortex-ai-model': result.modelId,
+      },
+    });
+  } catch (error) {
+    if (error && typeof error === 'object' && 'attempts' in error) {
+      console.error(
+        '[Cortex AI] Failed to generate editor HTML after model attempts:',
+        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
+      );
+    }
+    console.error('[Cortex AI] Failed to generate editor HTML:', error);
+    return jsonError(
+      summarizeCortexAiRoutingError(error, 'Failed to generate editor HTML.'),
+      500
+    );
+  }
+}

package/templates/nextblock-template/app/api/brand/email-logo/route.ts

@@ -1,48 +1,48 @@
-import { NextResponse } from 'next/server';
-
-import { resolveEmailBranding } from '../../../../lib/email/branding';
-
-// Public, unauthenticated logo endpoint for the Supabase auth emails (magic link, password
-// reset, confirm email, invite, ...). Those templates are rendered and sent by Supabase's
-// own SMTP from static HTML, so they cannot read the CMS logo per-send. Instead their
-// `<img>` points here (`{{ .SiteURL }}/api/brand/email-logo`); when the recipient opens the
-// email their client fetches this route, which 302-redirects to the operator's CURRENT
-// uploaded logo. That keeps the statically-pushed auth templates in sync with the live CMS
-// logo with no re-deploy — "change at will".
-//
-// Email image proxies (e.g. Gmail) hit this unauthenticated and follow the redirect, so it
-// must never require auth and must always return an image (never a 4xx/5xx that would show
-// a broken-image icon). When no logo is configured it returns a 1x1 transparent PNG — a
-// static <img> can't fall back to a text banner the way the app-rendered emails do.
-export const dynamic = 'force-dynamic';
-
-// 1x1 transparent PNG.
-const TRANSPARENT_PNG = Buffer.from(
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==',
-  'base64',
-);
-
-function transparentPixel(): NextResponse {
-  return new NextResponse(TRANSPARENT_PNG, {
-    status: 200,
-    headers: {
-      'Content-Type': 'image/png',
-      // Short cache so a newly-set logo starts showing quickly on freshly-sent emails.
-      'Cache-Control': 'public, max-age=60',
-    },
-  });
-}
-
-export async function GET() {
-  try {
-    const { logoUrl } = await resolveEmailBranding();
-    if (logoUrl) {
-      const response = NextResponse.redirect(logoUrl, 302);
-      response.headers.set('Cache-Control', 'public, max-age=300');
-      return response;
-    }
-  } catch {
-    // Fall through to the transparent pixel — never surface an error to an email client.
-  }
-  return transparentPixel();
-}
+import { NextResponse } from 'next/server';
+
+import { resolveEmailBranding } from '../../../../lib/email/branding';
+
+// Public, unauthenticated logo endpoint for the Supabase auth emails (magic link, password
+// reset, confirm email, invite, ...). Those templates are rendered and sent by Supabase's
+// own SMTP from static HTML, so they cannot read the CMS logo per-send. Instead their
+// `<img>` points here (`{{ .SiteURL }}/api/brand/email-logo`); when the recipient opens the
+// email their client fetches this route, which 302-redirects to the operator's CURRENT
+// uploaded logo. That keeps the statically-pushed auth templates in sync with the live CMS
+// logo with no re-deploy — "change at will".
+//
+// Email image proxies (e.g. Gmail) hit this unauthenticated and follow the redirect, so it
+// must never require auth and must always return an image (never a 4xx/5xx that would show
+// a broken-image icon). When no logo is configured it returns a 1x1 transparent PNG — a
+// static <img> can't fall back to a text banner the way the app-rendered emails do.
+export const dynamic = 'force-dynamic';
+
+// 1x1 transparent PNG.
+const TRANSPARENT_PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==',
+  'base64',
+);
+
+function transparentPixel(): NextResponse {
+  return new NextResponse(TRANSPARENT_PNG, {
+    status: 200,
+    headers: {
+      'Content-Type': 'image/png',
+      // Short cache so a newly-set logo starts showing quickly on freshly-sent emails.
+      'Cache-Control': 'public, max-age=60',
+    },
+  });
+}
+
+export async function GET() {
+  try {
+    const { logoUrl } = await resolveEmailBranding();
+    if (logoUrl) {
+      const response = NextResponse.redirect(logoUrl, 302);
+      response.headers.set('Cache-Control', 'public, max-age=300');
+      return response;
+    }
+  } catch {
+    // Fall through to the transparent pixel — never surface an error to an email client.
+  }
+  return transparentPixel();
+}

package/templates/nextblock-template/app/api/cms/check-updates/route.ts

@@ -1,44 +1,44 @@
-import { NextResponse } from 'next/server';
-import { createClient } from '@nextblock-cms/db/server';
-import { refreshUpstreamStatus } from '../../../../lib/updates/check-upstream';
-
-// Node runtime: the update checker reads the filesystem (.git / workflow detection) and
-// uses the service-role client. force-dynamic so it never gets statically cached.
-export const runtime = 'nodejs';
-export const dynamic = 'force-dynamic';
-
-/** Authenticated ADMIN gate, mirroring lib/full-backup/server.ts. */
-async function requireAdmin(): Promise<string | null> {
-  const supabase = createClient();
-  const {
-    data: { user },
-  } = await supabase.auth.getUser();
-  if (!user) return 'Not authenticated.';
-
-  const { data: profile, error } = await supabase
-    .from('profiles')
-    .select('role')
-    .eq('id', user.id)
-    .single();
-  if (error || profile?.role !== 'ADMIN') return 'Administrator role required.';
-  return null;
-}
-
-/**
- * Admin-triggered upstream update check (Track B). Polls the GitHub Releases API,
- * compares versions, and — on a standalone install — records a runtime_update_available
- * alert. Returns the comparison either way so an admin "Check for updates" control can
- * show the result inline.
- */
-export async function POST() {
-  const denied = await requireAdmin();
-  if (denied) {
-    return NextResponse.json({ ok: false, error: denied }, { status: 401 });
-  }
-
-  const { update, conflicts, snapshot } = await refreshUpstreamStatus();
-  // The check itself succeeded as an operation even if a network call failed; surface any
-  // soft error in the body rather than 500ing the admin action.
-  const ok = update.ok && conflicts.ok;
-  return NextResponse.json({ ok, update, conflicts, snapshot }, { status: ok ? 200 : 502 });
-}
+import { NextResponse } from 'next/server';
+import { createClient } from '@nextblock-cms/db/server';
+import { refreshUpstreamStatus } from '../../../../lib/updates/check-upstream';
+
+// Node runtime: the update checker reads the filesystem (.git / workflow detection) and
+// uses the service-role client. force-dynamic so it never gets statically cached.
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+/** Authenticated ADMIN gate, mirroring lib/full-backup/server.ts. */
+async function requireAdmin(): Promise<string | null> {
+  const supabase = createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return 'Not authenticated.';
+
+  const { data: profile, error } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+  if (error || profile?.role !== 'ADMIN') return 'Administrator role required.';
+  return null;
+}
+
+/**
+ * Admin-triggered upstream update check (Track B). Polls the GitHub Releases API,
+ * compares versions, and — on a standalone install — records a runtime_update_available
+ * alert. Returns the comparison either way so an admin "Check for updates" control can
+ * show the result inline.
+ */
+export async function POST() {
+  const denied = await requireAdmin();
+  if (denied) {
+    return NextResponse.json({ ok: false, error: denied }, { status: 401 });
+  }
+
+  const { update, conflicts, snapshot } = await refreshUpstreamStatus();
+  // The check itself succeeded as an operation even if a network call failed; surface any
+  // soft error in the body rather than 500ing the admin action.
+  const ok = update.ok && conflicts.ok;
+  return NextResponse.json({ ok, update, conflicts, snapshot }, { status: ok ? 200 : 502 });
+}

package/templates/nextblock-template/app/api/cms/full-backup/export/route.ts

@@ -1,33 +1,33 @@
-import { NextResponse } from "next/server";
-
-import { exportFullBackupArchive } from "../../../../../lib/full-backup/server";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-export async function POST() {
-  try {
-    const archive = await exportFullBackupArchive();
-    const body = archive.content.buffer.slice(
-      archive.content.byteOffset,
-      archive.content.byteOffset + archive.content.byteLength
-    ) as ArrayBuffer;
-
-    return new NextResponse(body, {
-      headers: {
-        "Content-Type": archive.mimeType,
-        "Content-Disposition": `attachment; filename="${archive.fileName}"`,
-        "Content-Length": String(archive.content.byteLength),
-        "Cache-Control": "no-store",
-      },
-    });
-  } catch (error) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "Failed to export full ZIP backup.",
-      },
-      { status: 500 }
-    );
-  }
-}
+import { NextResponse } from "next/server";
+
+import { exportFullBackupArchive } from "../../../../../lib/full-backup/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function POST() {
+  try {
+    const archive = await exportFullBackupArchive();
+    const body = archive.content.buffer.slice(
+      archive.content.byteOffset,
+      archive.content.byteOffset + archive.content.byteLength
+    ) as ArrayBuffer;
+
+    return new NextResponse(body, {
+      headers: {
+        "Content-Type": archive.mimeType,
+        "Content-Disposition": `attachment; filename="${archive.fileName}"`,
+        "Content-Length": String(archive.content.byteLength),
+        "Cache-Control": "no-store",
+      },
+    });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : "Failed to export full ZIP backup.",
+      },
+      { status: 500 }
+    );
+  }
+}

package/templates/nextblock-template/app/api/cms/full-backup/restore/route.ts

@@ -1,63 +1,63 @@
-import { NextResponse } from "next/server";
-
-import {
-  requireFullBackupAdmin,
-  restoreFullBackupArchive,
-  reviewFullBackupArchiveForAdmin,
-} from "../../../../../lib/full-backup/server";
-import type { FullBackupMediaUrlMode } from "../../../../../lib/full-backup/manifest";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-function normalizeMediaUrlMode(value: FormDataEntryValue | null): FullBackupMediaUrlMode {
-  return value === "keep_exact_urls" ? "keep_exact_urls" : "rewrite_to_destination";
-}
-
-async function readZipFile(formData: FormData) {
-  const file = formData.get("file");
-  if (!(file instanceof File)) {
-    throw new Error("Choose a full backup ZIP file first.");
-  }
-
-  return new Uint8Array(await file.arrayBuffer());
-}
-
-export async function POST(request: Request) {
-  try {
-    await requireFullBackupAdmin();
-    const formData = await request.formData();
-    const action = String(formData.get("action") || "review");
-    const archive = await readZipFile(formData);
-
-    if (action === "review") {
-      return NextResponse.json(await reviewFullBackupArchiveForAdmin(archive));
-    }
-
-    if (action !== "restore") {
-      return NextResponse.json(
-        { success: false, error: "Unknown full backup restore action.", warnings: [] },
-        { status: 400 }
-      );
-    }
-
-    const result = await restoreFullBackupArchive({
-      archive,
-      confirmation: String(formData.get("confirmation") || ""),
-      mediaUrlMode: normalizeMediaUrlMode(formData.get("mediaUrlMode")),
-      destinationBaseUrl: String(formData.get("destinationBaseUrl") || ""),
-      deleteExtraneousR2Objects: formData.get("deleteExtraneousR2Objects") === "true",
-    });
-
-    return NextResponse.json(result, { status: result.success ? 200 : 400 });
-  } catch (error) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : "Failed to restore full ZIP backup.",
-        warnings: [],
-      },
-      { status: 500 }
-    );
-  }
-}
+import { NextResponse } from "next/server";
+
+import {
+  requireFullBackupAdmin,
+  restoreFullBackupArchive,
+  reviewFullBackupArchiveForAdmin,
+} from "../../../../../lib/full-backup/server";
+import type { FullBackupMediaUrlMode } from "../../../../../lib/full-backup/manifest";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+function normalizeMediaUrlMode(value: FormDataEntryValue | null): FullBackupMediaUrlMode {
+  return value === "keep_exact_urls" ? "keep_exact_urls" : "rewrite_to_destination";
+}
+
+async function readZipFile(formData: FormData) {
+  const file = formData.get("file");
+  if (!(file instanceof File)) {
+    throw new Error("Choose a full backup ZIP file first.");
+  }
+
+  return new Uint8Array(await file.arrayBuffer());
+}
+
+export async function POST(request: Request) {
+  try {
+    await requireFullBackupAdmin();
+    const formData = await request.formData();
+    const action = String(formData.get("action") || "review");
+    const archive = await readZipFile(formData);
+
+    if (action === "review") {
+      return NextResponse.json(await reviewFullBackupArchiveForAdmin(archive));
+    }
+
+    if (action !== "restore") {
+      return NextResponse.json(
+        { success: false, error: "Unknown full backup restore action.", warnings: [] },
+        { status: 400 }
+      );
+    }
+
+    const result = await restoreFullBackupArchive({
+      archive,
+      confirmation: String(formData.get("confirmation") || ""),
+      mediaUrlMode: normalizeMediaUrlMode(formData.get("mediaUrlMode")),
+      destinationBaseUrl: String(formData.get("destinationBaseUrl") || ""),
+      deleteExtraneousR2Objects: formData.get("deleteExtraneousR2Objects") === "true",
+    });
+
+    return NextResponse.json(result, { status: result.success ? 200 : 400 });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : "Failed to restore full ZIP backup.",
+        warnings: [],
+      },
+      { status: 500 }
+    );
+  }
+}