create-nextblock 0.14.1 → 0.14.4

package/templates/nextblock-template/lib/logos/active-logo.ts

@@ -1,53 +1,53 @@
-import type { SupabaseClient } from '@supabase/supabase-js';
-import type { Database } from '@nextblock-cms/db';
-
-// The single, shared definition of "the active logo", used by the public header, the CMS
-// branding page, transactional-email branding, and invoices. The operator can pin a
-// specific logo (stored as `site_settings.active_logo_id`); when none is pinned we fall
-// back to the most recently created logo (the historical default). The setting key is a
-// plain, non-secret `site_settings` row, so it is publicly readable under RLS (the public
-// header can read it with the anon client) and writable by ADMIN/WRITER.
-
-/** site_settings key holding the admin-selected active logo id (a `logos.id` uuid string). */
-export const ACTIVE_LOGO_SETTING_KEY = 'active_logo_id';
-
-// Accept any of the app's Supabase clients (request-scoped, static/anon, or service-role).
-type AnyClient = SupabaseClient<Database>;
-
-/** The admin-pinned active logo id, or null when none has been chosen. */
-export async function resolveActiveLogoId(client: AnyClient): Promise<string | null> {
-  const { data } = await client
-    .from('site_settings')
-    .select('value')
-    .eq('key', ACTIVE_LOGO_SETTING_KEY)
-    .maybeSingle();
-  const value = data?.value;
-  return typeof value === 'string' && value.length > 0 ? value : null;
-}
-
-/**
- * Resolve the active logo row (joined with its media) for the given client: the pinned
- * logo when set and still present, otherwise the most recently created logo. Returns the
- * raw row; callers cast to their local logo type. Returns null when there are no logos.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export async function resolveActiveLogo(client: AnyClient): Promise<any> {
-  const activeId = await resolveActiveLogoId(client);
-
-  if (activeId) {
-    const { data } = await client
-      .from('logos')
-      .select('*, media:media_id (*)')
-      .eq('id', activeId)
-      .maybeSingle();
-    if (data) return data;
-  }
-
-  const { data } = await client
-    .from('logos')
-    .select('*, media:media_id (*)')
-    .order('created_at', { ascending: false })
-    .limit(1)
-    .maybeSingle();
-  return data ?? null;
-}
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { Database } from '@nextblock-cms/db';
+
+// The single, shared definition of "the active logo", used by the public header, the CMS
+// branding page, transactional-email branding, and invoices. The operator can pin a
+// specific logo (stored as `site_settings.active_logo_id`); when none is pinned we fall
+// back to the most recently created logo (the historical default). The setting key is a
+// plain, non-secret `site_settings` row, so it is publicly readable under RLS (the public
+// header can read it with the anon client) and writable by ADMIN/WRITER.
+
+/** site_settings key holding the admin-selected active logo id (a `logos.id` uuid string). */
+export const ACTIVE_LOGO_SETTING_KEY = 'active_logo_id';
+
+// Accept any of the app's Supabase clients (request-scoped, static/anon, or service-role).
+type AnyClient = SupabaseClient<Database>;
+
+/** The admin-pinned active logo id, or null when none has been chosen. */
+export async function resolveActiveLogoId(client: AnyClient): Promise<string | null> {
+  const { data } = await client
+    .from('site_settings')
+    .select('value')
+    .eq('key', ACTIVE_LOGO_SETTING_KEY)
+    .maybeSingle();
+  const value = data?.value;
+  return typeof value === 'string' && value.length > 0 ? value : null;
+}
+
+/**
+ * Resolve the active logo row (joined with its media) for the given client: the pinned
+ * logo when set and still present, otherwise the most recently created logo. Returns the
+ * raw row; callers cast to their local logo type. Returns null when there are no logos.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export async function resolveActiveLogo(client: AnyClient): Promise<any> {
+  const activeId = await resolveActiveLogoId(client);
+
+  if (activeId) {
+    const { data } = await client
+      .from('logos')
+      .select('*, media:media_id (*)')
+      .eq('id', activeId)
+      .maybeSingle();
+    if (data) return data;
+  }
+
+  const { data } = await client
+    .from('logos')
+    .select('*, media:media_id (*)')
+    .order('created_at', { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  return data ?? null;
+}

package/templates/nextblock-template/lib/media/resolveMediaUrl.ts

@@ -1,54 +1,54 @@
-const BUNDLED_PUBLIC_MEDIA_KEYS = new Set([
-  'images/NBcover.webp',
-  'images/cap.webp',
-  'images/commerce-plan.webp',
-  'images/commerce-square.webp',
-  'images/commerce-wide.webp',
-  'images/cortex-ai-square.webp',
-  'images/cortex-ai.webp',
-  'images/developer.webp',
-  'images/extensibility.webp',
-  'images/goals.webp',
-  'images/included.webp',
-  'images/metadata_image.webp',
-  'images/nextblock-logo-small.webp',
-  'images/nextblock-logo-button-tiny.png',
-  'images/nx-graph.webp',
-  'images/pants.webp',
-  'images/programmer-upscaled.webp',
-  'images/t-shirt.webp',
-]);
-
-export function resolveMediaUrl(
-  objectKey?: string | null,
-  // On the client, NEXT_PUBLIC_R2_BASE_URL is inlined at build time, so a fresh-clone
-  // dev bundle built with no env holds an empty string; fall back to the runtime value
-  // injected by <PublicEnvBootstrap> (window.__NEXTBLOCK_PUBLIC_ENV__.r2Base). On the
-  // server, process.env is always current and the window branch is skipped.
-  baseUrl = process.env.NEXT_PUBLIC_R2_BASE_URL ||
-    (typeof window !== 'undefined'
-      ? (window as { __NEXTBLOCK_PUBLIC_ENV__?: { r2Base?: string } })
-          .__NEXTBLOCK_PUBLIC_ENV__?.r2Base || ''
-      : '')
-) {
-  if (!objectKey) return null;
-
-  if (objectKey.startsWith('http://') || objectKey.startsWith('https://')) {
-    return objectKey;
-  }
-
-  if (objectKey.startsWith('/')) {
-    return objectKey;
-  }
-
-  if (BUNDLED_PUBLIC_MEDIA_KEYS.has(objectKey)) {
-    return `/${objectKey}`;
-  }
-
-  const normalizedBaseUrl = baseUrl.replace(/\/+$/, '');
-  const normalizedObjectKey = objectKey.replace(/^\/+/, '');
-
-  return normalizedBaseUrl
-    ? `${normalizedBaseUrl}/${normalizedObjectKey}`
-    : `/${normalizedObjectKey}`;
-}
+const BUNDLED_PUBLIC_MEDIA_KEYS = new Set([
+  'images/NBcover.webp',
+  'images/cap.webp',
+  'images/commerce-plan.webp',
+  'images/commerce-square.webp',
+  'images/commerce-wide.webp',
+  'images/cortex-ai-square.webp',
+  'images/cortex-ai.webp',
+  'images/developer.webp',
+  'images/extensibility.webp',
+  'images/goals.webp',
+  'images/included.webp',
+  'images/metadata_image.webp',
+  'images/nextblock-logo-small.webp',
+  'images/nextblock-logo-button-tiny.png',
+  'images/nx-graph.webp',
+  'images/pants.webp',
+  'images/programmer-upscaled.webp',
+  'images/t-shirt.webp',
+]);
+
+export function resolveMediaUrl(
+  objectKey?: string | null,
+  // On the client, NEXT_PUBLIC_R2_BASE_URL is inlined at build time, so a fresh-clone
+  // dev bundle built with no env holds an empty string; fall back to the runtime value
+  // injected by <PublicEnvBootstrap> (window.__NEXTBLOCK_PUBLIC_ENV__.r2Base). On the
+  // server, process.env is always current and the window branch is skipped.
+  baseUrl = process.env.NEXT_PUBLIC_R2_BASE_URL ||
+    (typeof window !== 'undefined'
+      ? (window as { __NEXTBLOCK_PUBLIC_ENV__?: { r2Base?: string } })
+          .__NEXTBLOCK_PUBLIC_ENV__?.r2Base || ''
+      : '')
+) {
+  if (!objectKey) return null;
+
+  if (objectKey.startsWith('http://') || objectKey.startsWith('https://')) {
+    return objectKey;
+  }
+
+  if (objectKey.startsWith('/')) {
+    return objectKey;
+  }
+
+  if (BUNDLED_PUBLIC_MEDIA_KEYS.has(objectKey)) {
+    return `/${objectKey}`;
+  }
+
+  const normalizedBaseUrl = baseUrl.replace(/\/+$/, '');
+  const normalizedObjectKey = objectKey.replace(/^\/+/, '');
+
+  return normalizedBaseUrl
+    ? `${normalizedBaseUrl}/${normalizedObjectKey}`
+    : `/${normalizedObjectKey}`;
+}

package/templates/nextblock-template/lib/media/youtube.ts

@@ -1,99 +1,99 @@
-// Shared YouTube URL normalization.
-//
-// No public render path may emit a www.youtube.com iframe: the player writes
-// cookies via document.cookie on load (TESTCOOKIESENABLED, LAST_RESULT_ENTRY_KEY,
-// ExcludeSameSiteUnspecifiedTreatedAsLax) which Chrome logs as a DevTools "Cookie"
-// issue and Lighthouse fails through the `inspector-issues` audit (Best Practices
-// 26/27 = 96). Switching to youtube-nocookie.com does NOT stop those writes --
-// only not loading the player does. See components/media/YouTubeFacade.tsx.
-
-const YOUTUBE_HOST_RE = /^(?:www\.|m\.|music\.)?(?:youtube\.com|youtube-nocookie\.com)$/i;
-const YOUTU_BE_RE = /^(?:www\.)?youtu\.be$/i;
-const VIDEO_ID_RE = /^[A-Za-z0-9_-]{6,20}$/;
-
-export interface ParsedYouTubeUrl {
-  videoId: string;
-  /** Extra player params carried over from the source URL (v/si/autoplay stripped). */
-  params: URLSearchParams;
-}
-
-/**
- * Accepts every shape an author can paste or that YouTube's Share > Embed panel
- * emits: watch?v= (v anywhere in the query), youtu.be/, /embed/, /shorts/,
- * /live/, /v/, m. and music. subdomains, and youtube-nocookie.com/embed/.
- * Returns null for non-YouTube URLs.
- */
-export function parseYouTubeUrl(rawUrl: string | undefined | null): ParsedYouTubeUrl | null {
-  if (!rawUrl) return null;
-  let url: URL;
-  try {
-    url = new URL(rawUrl, 'https://www.youtube.com');
-  } catch {
-    return null;
-  }
-
-  let videoId = '';
-  if (YOUTU_BE_RE.test(url.hostname)) {
-    videoId = url.pathname.split('/').filter(Boolean)[0] || '';
-  } else if (YOUTUBE_HOST_RE.test(url.hostname)) {
-    const segments = url.pathname.split('/').filter(Boolean);
-    const head = segments[0] || '';
-    if (head === 'watch') {
-      videoId = url.searchParams.get('v') || '';
-    } else if (head === 'embed' || head === 'shorts' || head === 'live' || head === 'v') {
-      videoId = segments[1] || '';
-    }
-  }
-  if (!VIDEO_ID_RE.test(videoId)) return null;
-
-  const params = new URLSearchParams(url.search);
-  params.delete('v');
-  params.delete('si'); // share-tracking token, not needed for playback
-  // Never auto-start on load: an autoplaying frame boots the player (and its
-  // cookie writes) during a Lighthouse run. The facade re-adds autoplay=1 only
-  // after a real user click.
-  params.delete('autoplay');
-  return { videoId, params };
-}
-
-export function buildNoCookieEmbedUrl(
-  videoId: string,
-  params?: URLSearchParams,
-  opts?: { autoplay?: boolean }
-): string {
-  const search = new URLSearchParams(params ? params.toString() : '');
-  if (opts?.autoplay) search.set('autoplay', '1');
-  const qs = search.toString();
-  return `https://www.youtube-nocookie.com/embed/${videoId}${qs ? `?${qs}` : ''}`;
-}
-
-/** Last-resort string rewrite for raw-HTML paths that cannot be parsed into nodes. */
-export function rewriteYouTubeHostsInHtml(html: string): string {
-  if (!html) return html;
-  return html.replace(
-    /(?:https?:)?\/\/(?:www\.|m\.|music\.)?youtube\.com\/embed\//gi,
-    'https://www.youtube-nocookie.com/embed/'
-  );
-}
-
-export type YouTubePosterQuality = 'maxres' | 'hq';
-
-/**
- * Intrinsic size of each poster variant. maxresdefault is 16:9 but is not
- * uploaded for every video; hqdefault always exists and is 4:3 (the frame is
- * letterboxed inside it), which is why the facade object-covers the poster.
- */
-export const YOUTUBE_POSTER_DIMENSIONS: Record<
-  YouTubePosterQuality,
-  { width: number; height: number }
-> = {
-  maxres: { width: 1280, height: 720 },
-  hq: { width: 480, height: 360 },
-};
-
-export function youTubePosterUrl(
-  videoId: string,
-  quality: YouTubePosterQuality = 'maxres'
-): string {
-  return `https://i.ytimg.com/vi/${videoId}/${quality === 'maxres' ? 'maxresdefault' : 'hqdefault'}.jpg`;
-}
+// Shared YouTube URL normalization.
+//
+// No public render path may emit a www.youtube.com iframe: the player writes
+// cookies via document.cookie on load (TESTCOOKIESENABLED, LAST_RESULT_ENTRY_KEY,
+// ExcludeSameSiteUnspecifiedTreatedAsLax) which Chrome logs as a DevTools "Cookie"
+// issue and Lighthouse fails through the `inspector-issues` audit (Best Practices
+// 26/27 = 96). Switching to youtube-nocookie.com does NOT stop those writes --
+// only not loading the player does. See components/media/YouTubeFacade.tsx.
+
+const YOUTUBE_HOST_RE = /^(?:www\.|m\.|music\.)?(?:youtube\.com|youtube-nocookie\.com)$/i;
+const YOUTU_BE_RE = /^(?:www\.)?youtu\.be$/i;
+const VIDEO_ID_RE = /^[A-Za-z0-9_-]{6,20}$/;
+
+export interface ParsedYouTubeUrl {
+  videoId: string;
+  /** Extra player params carried over from the source URL (v/si/autoplay stripped). */
+  params: URLSearchParams;
+}
+
+/**
+ * Accepts every shape an author can paste or that YouTube's Share > Embed panel
+ * emits: watch?v= (v anywhere in the query), youtu.be/, /embed/, /shorts/,
+ * /live/, /v/, m. and music. subdomains, and youtube-nocookie.com/embed/.
+ * Returns null for non-YouTube URLs.
+ */
+export function parseYouTubeUrl(rawUrl: string | undefined | null): ParsedYouTubeUrl | null {
+  if (!rawUrl) return null;
+  let url: URL;
+  try {
+    url = new URL(rawUrl, 'https://www.youtube.com');
+  } catch {
+    return null;
+  }
+
+  let videoId = '';
+  if (YOUTU_BE_RE.test(url.hostname)) {
+    videoId = url.pathname.split('/').filter(Boolean)[0] || '';
+  } else if (YOUTUBE_HOST_RE.test(url.hostname)) {
+    const segments = url.pathname.split('/').filter(Boolean);
+    const head = segments[0] || '';
+    if (head === 'watch') {
+      videoId = url.searchParams.get('v') || '';
+    } else if (head === 'embed' || head === 'shorts' || head === 'live' || head === 'v') {
+      videoId = segments[1] || '';
+    }
+  }
+  if (!VIDEO_ID_RE.test(videoId)) return null;
+
+  const params = new URLSearchParams(url.search);
+  params.delete('v');
+  params.delete('si'); // share-tracking token, not needed for playback
+  // Never auto-start on load: an autoplaying frame boots the player (and its
+  // cookie writes) during a Lighthouse run. The facade re-adds autoplay=1 only
+  // after a real user click.
+  params.delete('autoplay');
+  return { videoId, params };
+}
+
+export function buildNoCookieEmbedUrl(
+  videoId: string,
+  params?: URLSearchParams,
+  opts?: { autoplay?: boolean }
+): string {
+  const search = new URLSearchParams(params ? params.toString() : '');
+  if (opts?.autoplay) search.set('autoplay', '1');
+  const qs = search.toString();
+  return `https://www.youtube-nocookie.com/embed/${videoId}${qs ? `?${qs}` : ''}`;
+}
+
+/** Last-resort string rewrite for raw-HTML paths that cannot be parsed into nodes. */
+export function rewriteYouTubeHostsInHtml(html: string): string {
+  if (!html) return html;
+  return html.replace(
+    /(?:https?:)?\/\/(?:www\.|m\.|music\.)?youtube\.com\/embed\//gi,
+    'https://www.youtube-nocookie.com/embed/'
+  );
+}
+
+export type YouTubePosterQuality = 'maxres' | 'hq';
+
+/**
+ * Intrinsic size of each poster variant. maxresdefault is 16:9 but is not
+ * uploaded for every video; hqdefault always exists and is 4:3 (the frame is
+ * letterboxed inside it), which is why the facade object-covers the poster.
+ */
+export const YOUTUBE_POSTER_DIMENSIONS: Record<
+  YouTubePosterQuality,
+  { width: number; height: number }
+> = {
+  maxres: { width: 1280, height: 720 },
+  hq: { width: 480, height: 360 },
+};
+
+export function youTubePosterUrl(
+  videoId: string,
+  quality: YouTubePosterQuality = 'maxres'
+): string {
+  return `https://i.ytimg.com/vi/${videoId}/${quality === 'maxres' ? 'maxresdefault' : 'hqdefault'}.jpg`;
+}

package/templates/nextblock-template/lib/onboarding/actions.ts

@@ -1,31 +1,31 @@
-'use server';
-
-import { createClient } from '@nextblock-cms/db/server';
-import { revalidatePath } from 'next/cache';
-
-/** Persist the onboarding dismiss flag in the `onboarding_state` row (read-merge). */
-export async function setOnboardingDismissed(dismissed: boolean) {
-  const supabase = createClient();
-
-  const { data: existing } = await supabase
-    .from('site_settings')
-    .select('value')
-    .eq('key', 'onboarding_state')
-    .maybeSingle();
-
-  const current =
-    existing?.value && typeof existing.value === 'object' && !Array.isArray(existing.value)
-      ? (existing.value as Record<string, unknown>)
-      : {};
-
-  const { error } = await supabase
-    .from('site_settings')
-    .upsert({ key: 'onboarding_state', value: { ...current, dismissed } });
-
-  if (error) {
-    console.error('Error updating onboarding state:', error.message);
-    throw new Error('Failed to update onboarding state.');
-  }
-
-  revalidatePath('/cms/dashboard');
-}
+'use server';
+
+import { createClient } from '@nextblock-cms/db/server';
+import { revalidatePath } from 'next/cache';
+
+/** Persist the onboarding dismiss flag in the `onboarding_state` row (read-merge). */
+export async function setOnboardingDismissed(dismissed: boolean) {
+  const supabase = createClient();
+
+  const { data: existing } = await supabase
+    .from('site_settings')
+    .select('value')
+    .eq('key', 'onboarding_state')
+    .maybeSingle();
+
+  const current =
+    existing?.value && typeof existing.value === 'object' && !Array.isArray(existing.value)
+      ? (existing.value as Record<string, unknown>)
+      : {};
+
+  const { error } = await supabase
+    .from('site_settings')
+    .upsert({ key: 'onboarding_state', value: { ...current, dismissed } });
+
+  if (error) {
+    console.error('Error updating onboarding state:', error.message);
+    throw new Error('Failed to update onboarding state.');
+  }
+
+  revalidatePath('/cms/dashboard');
+}