create-nextblock 0.14.2 → 0.14.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.14.2",
+  "version": "0.14.5",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/[slug]/page.tsx

@@ -1,6 +1,7 @@
 // app/[slug]/page.tsx
 import React from 'react';
 import { getSsgSupabaseClient } from "@nextblock-cms/db/server";
+import { buildPublishedAtOrFilter } from "@nextblock-cms/utils";
 import { notFound } from "next/navigation";
 import type { Metadata } from 'next';
 import PageClientContent from "./PageClientContent";
@@ -55,7 +56,8 @@ export async function generateStaticParams(): Promise<ResolvedPageParams[]> {
   const { data: pages, error } = await supabase
     .from("pages")
     .select("slug")
-    .eq("status", "published");
+    .eq("status", "published")
+    .or(buildPublishedAtOrFilter());
 
   if (error || !pages) {
     console.error("SSG: Error fetching page slugs for static params:", error);
@@ -105,6 +107,8 @@ export async function generateMetadata(
       .select('language_id, slug')
       .eq('translation_group_id', pageData.translation_group_id)
       .eq('status', 'published')
+      // Never advertise a scheduled translation via hreflang.
+      .or(buildPublishedAtOrFilter())
   ]);
 
   const { data: languages } = languagesResult;
@@ -180,7 +184,8 @@ export default async function DynamicPage({ params: paramsPromise }: PageProps)
       .from("pages")
       .select("slug, languages!inner(code)")
       .eq("translation_group_id", pageData.translation_group_id)
-      .eq("status", "published");
+      .eq("status", "published")
+      .or(buildPublishedAtOrFilter());
 
     if (translations) {
       translations.forEach((translation: PageTranslation) => {

package/templates/nextblock-template/app/[slug]/page.utils.ts

@@ -1,6 +1,7 @@
 // app/[slug]/page.utils.ts
 import { createClient, getSsgSupabaseClient } from "@nextblock-cms/db/server";
 import type { Database } from "@nextblock-cms/db";
+import { buildPublishedAtOrFilter } from "@nextblock-cms/utils";
 import { draftMode } from "next/headers";
 import { resolveMediaUrl } from "../../lib/media/resolveMediaUrl";
 import { getContentDraft } from "../../lib/visual-editing/draft-content";
@@ -96,7 +97,7 @@ function applyDraftToPage(page: SelectedPageType, draft: ContentDraftRow): Selec
     slug: draftString(draft, "slug", page.slug),
     language_id: languageId,
     language_details: languageId === page.language_id ? page.language_details : null,
-    status: draftString(draft, "status", page.status) as PageType["status"],
+    // Visibility is never taken from a draft — it lives on the row.
     meta_title: draftNullableString(draft, "meta_title", page.meta_title),
     meta_description: draftNullableString(draft, "meta_description", page.meta_description),
     custom_canonical: draftNullableString(draft, "custom_canonical", page.custom_canonical),
@@ -280,7 +281,11 @@ export async function getPageDataBySlug(
       .order('order', { foreignTable: 'blocks', ascending: true });
 
     if (!isDraftModeEnabled) {
-      preferredQuery = preferredQuery.eq("status", "published");
+      // A future published_at means "scheduled" — withheld from the public until
+      // it passes. Preview (draft mode) deliberately ignores the schedule.
+      preferredQuery = preferredQuery
+        .eq("status", "published")
+        .or(buildPublishedAtOrFilter());
     }
 
     const { data: preferredData, error: preferredError } = await preferredQuery.maybeSingle();
@@ -298,7 +303,7 @@ export async function getPageDataBySlug(
       .order('order', { foreignTable: 'blocks', ascending: true });
 
     if (!isDraftModeEnabled) {
-      pageQuery = pageQuery.eq("status", "published");
+      pageQuery = pageQuery.eq("status", "published").or(buildPublishedAtOrFilter());
     }
 
     const { data: candidatePagesData, error: pageError } = await pageQuery;

package/templates/nextblock-template/app/actions/postActions.ts

@@ -2,6 +2,7 @@
 
 import { cache } from 'react';
 import { createClient } from '@nextblock-cms/db/server';
+import { buildPublishedAtOrFilter } from '@nextblock-cms/utils';
 import { revalidatePath } from 'next/cache';
 import type { Database } from '@nextblock-cms/db';
 import type { PostWithMediaDimensions } from '../../components/blocks/types';
@@ -105,6 +106,8 @@ async function fetchPublishedPostsPage(languageId: number, page: number, limit:
       { count: 'exact' }
     )
     .eq('status', 'published')
+    // Without this a scheduled post is listed here while its own URL 404s.
+    .or(buildPublishedAtOrFilter())
     .eq('language_id', languageId)
     .order('published_at', { ascending: false })
     .range(offset, offset + limit - 1);

package/templates/nextblock-template/app/actions/visibilityActions.ts

@@ -0,0 +1,210 @@
+"use server";
+
+/**
+ * Visibility actions — the ONLY writes that can change what the public sees.
+ *
+ * These deliberately bypass the Live Draft pipeline (`content_drafts` /
+ * `product_drafts`) entirely: they read nothing from a draft, create nothing, and
+ * leave any pending content edits exactly where they are. Publishing a page and
+ * publishing your unsaved edits are two different decisions, so they are two
+ * different code paths.
+ *
+ * Visibility is stored as the (status, published_at) pair — see
+ * `libs/utils/src/lib/publishing.ts` for how "scheduled" is derived from it.
+ */
+
+import { createClient } from "@nextblock-cms/db/server";
+import { revalidatePath } from "next/cache";
+import {
+  LIVE_STATUS,
+  isFutureSchedule,
+  resolveVisibilityState,
+  type PublishableType,
+  type VisibilityState,
+} from "@nextblock-cms/utils";
+import { getHomepageTranslationGroupId } from "../lib/homepage";
+
+export interface VisibilityResult {
+  error?: string;
+  state?: VisibilityState;
+  publishedAt?: string | null;
+}
+
+/** What the caller wants the content to become. */
+export type VisibilityIntent =
+  | { action: "publish" }
+  | { action: "schedule"; publishedAt: string }
+  | { action: "unpublish" }
+  | { action: "archive" };
+
+const TABLE: Record<PublishableType, "pages" | "posts" | "products"> = {
+  page: "pages",
+  post: "posts",
+  product: "products",
+};
+
+const CMS_LIST_PATH: Record<PublishableType, string> = {
+  page: "/cms/pages",
+  post: "/cms/posts",
+  product: "/cms/products",
+};
+
+function publicPath(type: PublishableType, slug: string): string {
+  if (type === "post") return `/article/${slug}`;
+  if (type === "product") return `/product/${slug}`;
+  return `/${slug}`;
+}
+
+/**
+ * Turn an intent into the columns to write.
+ *
+ * "Publish" always clears `published_at`. Leaving a past timestamp behind would be
+ * harmless for the public gate but would keep rendering as a stale schedule in the
+ * CMS; leaving a FUTURE one would mean "Publish now" silently did nothing.
+ */
+function buildUpdate(type: PublishableType, intent: VisibilityIntent) {
+  const liveStatus = LIVE_STATUS[type];
+
+  switch (intent.action) {
+    case "publish":
+      return { status: liveStatus, published_at: null };
+    case "schedule":
+      return { status: liveStatus, published_at: intent.publishedAt };
+    case "unpublish":
+      return { status: "draft", published_at: null };
+    case "archive":
+      return { status: "archived", published_at: null };
+  }
+}
+
+/**
+ * Set a page/post/product's visibility directly on its row.
+ *
+ * `id` is a number for pages and posts, a uuid string for products.
+ */
+export async function setContentVisibility(
+  type: PublishableType,
+  id: number | string,
+  intent: VisibilityIntent,
+): Promise<VisibilityResult> {
+  const supabase = createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) {
+    return { error: "You must be signed in to change visibility." };
+  }
+
+  const { data: profile } = await supabase
+    .from("profiles")
+    .select("role")
+    .eq("id", user.id)
+    .single();
+  if (!profile || !["ADMIN", "WRITER"].includes(profile.role)) {
+    return { error: "You do not have permission to change visibility." };
+  }
+
+  if (intent.action === "schedule" && !isFutureSchedule(intent.publishedAt)) {
+    return { error: "Pick a date and time in the future, or publish now instead." };
+  }
+
+  const update = buildUpdate(type, intent);
+  const { data: row, error } = await supabase
+    .from(TABLE[type])
+    .update({ ...update, updated_at: new Date().toISOString() } as never)
+    .eq("id", id as never)
+    .select("slug, status, published_at, translation_group_id")
+    .single();
+
+  if (error || !row) {
+    return { error: error?.message || "Could not update visibility." };
+  }
+
+  const updated = row as unknown as {
+    slug: string | null;
+    status: string;
+    published_at: string | null;
+    translation_group_id: string | null;
+  };
+
+  revalidatePath(CMS_LIST_PATH[type]);
+  revalidatePath(`${CMS_LIST_PATH[type]}/${id}/edit`);
+
+  if (updated.slug) {
+    revalidatePath(publicPath(type, updated.slug));
+  }
+
+  // Every language variation of the homepage is also served at "/", whatever its
+  // slug, so taking one down (or putting it up) has to bust that cache too.
+  if (type === "page") {
+    const homepageGroupId = await getHomepageTranslationGroupId(supabase);
+    if (
+      (homepageGroupId && updated.translation_group_id === homepageGroupId) ||
+      updated.slug === "home"
+    ) {
+      revalidatePath("/");
+    }
+  }
+
+  if (type === "post") {
+    revalidatePath("/articles");
+  }
+
+  return {
+    state: resolveVisibilityState({
+      status: updated.status,
+      publishedAt: updated.published_at,
+      liveStatus: LIVE_STATUS[type],
+    }),
+    publishedAt: updated.published_at,
+  };
+}
+
+/**
+ * Sibling-language versions of the same content, with their visibility state.
+ *
+ * Status is per-row, so publishing the French page does nothing for English. The
+ * publish dialog shows this list to catch the half-published translation — the
+ * single most common multilingual mistake.
+ */
+export interface SiblingVisibility {
+  id: number | string;
+  languageId: number;
+  title: string;
+  state: VisibilityState;
+}
+
+export async function getSiblingVisibility(
+  type: PublishableType,
+  translationGroupId: string,
+  excludeId: number | string,
+): Promise<SiblingVisibility[]> {
+  if (!translationGroupId) return [];
+
+  const supabase = createClient();
+  const { data, error } = await supabase
+    .from(TABLE[type])
+    .select("id, title, language_id, status, published_at")
+    .eq("translation_group_id", translationGroupId);
+
+  if (error || !data) return [];
+
+  return (data as unknown as Array<{
+    id: number | string;
+    title: string;
+    language_id: number;
+    status: string;
+    published_at: string | null;
+  }>)
+    .filter((row) => String(row.id) !== String(excludeId))
+    .map((row) => ({
+      id: row.id,
+      languageId: row.language_id,
+      title: row.title,
+      state: resolveVisibilityState({
+        status: row.status,
+        publishedAt: row.published_at,
+        liveStatus: LIVE_STATUS[type],
+      }),
+    }));
+}

package/templates/nextblock-template/app/actions/visualEditingActions.test.ts

@@ -18,13 +18,20 @@ const cacheMocks = vi.hoisted(() => ({
 
 vi.mock("next/cache", () => cacheMocks);
 vi.mock("server-only", () => ({}));
-vi.mock("../cms/revisions/utils", () => ({
+const revisionMocks = vi.hoisted(() => ({
+  createPageRevision: vi.fn(),
+  createPostRevision: vi.fn(),
   getFullPageContent: vi.fn(),
   getFullPostContent: vi.fn(),
 }));
+
+vi.mock("../cms/revisions/utils", () => ({
+  getFullPageContent: revisionMocks.getFullPageContent,
+  getFullPostContent: revisionMocks.getFullPostContent,
+}));
 vi.mock("../cms/revisions/service", () => ({
-  createPageRevision: vi.fn(),
-  createPostRevision: vi.fn(),
+  createPageRevision: revisionMocks.createPageRevision,
+  createPostRevision: revisionMocks.createPostRevision,
 }));
 vi.mock("../../lib/visual-editing/draft-content", () => draftContentMocks);
 vi.mock("../../lib/visual-editing/product-drafts", () => ({
@@ -176,4 +183,77 @@ describe("visual editing server actions", () => {
     expect(result).toEqual({ error: "No draft exists for this content." });
     expect(from).toHaveBeenCalledWith("content_drafts");
   });
+
+  describe("publishing a page draft", () => {
+    const previousContent = { meta: { title: "Before" }, blocks: [] };
+    const nextContent = { meta: { title: "After" }, blocks: [] };
+
+    /**
+     * Publishing is the only path that writes the live tables, so it is also the only
+     * place a page/post revision gets recorded. The chain here mirrors the real one:
+     * read the draft, update the row, swap the blocks, delete the draft.
+     */
+    function mockPublishChain() {
+      const chain: any = {
+        delete: vi.fn(() => chain),
+        eq: vi.fn(() => chain),
+        error: null,
+        insert: vi.fn(() => chain),
+        maybeSingle: vi.fn().mockResolvedValue({ data: baseDraft, error: null }),
+        select: vi.fn(() => chain),
+        update: vi.fn(() => chain),
+      };
+      const from = vi.fn(() => chain);
+      draftContentMocks.getCurrentUserCanEdit.mockResolvedValue({
+        canEdit: true,
+        supabase: { from },
+        user: { id: "user-1" },
+      });
+      return { chain, from };
+    }
+
+    it("records a revision from the pre-publish state", async () => {
+      mockPublishChain();
+      revisionMocks.getFullPageContent
+        .mockResolvedValueOnce(previousContent)
+        .mockResolvedValueOnce(nextContent);
+      revisionMocks.createPageRevision.mockResolvedValue({
+        recorded: true,
+        success: true,
+        version: 2,
+      });
+
+      const result = await publishVisualEditingDraft("page", 2);
+
+      expect(result).toEqual({ success: true });
+      expect(revisionMocks.createPageRevision).toHaveBeenCalledWith(
+        2,
+        "user-1",
+        previousContent,
+        nextContent
+      );
+    });
+
+    it("still completes the publish when the revision fails, and warns instead of erroring", async () => {
+      const { chain } = mockPublishChain();
+      revisionMocks.getFullPageContent
+        .mockResolvedValueOnce(previousContent)
+        .mockResolvedValueOnce(nextContent);
+      revisionMocks.createPageRevision.mockResolvedValue({
+        error: "Failed to insert page revision: permission denied",
+      });
+
+      const result = await publishVisualEditingDraft("page", 2);
+
+      // The page row and its blocks are already live at this point. Aborting would strand
+      // the draft row and leave the public route un-revalidated, which is worse than a
+      // missing history entry — so this is a partial success, not a failure.
+      expect(result).toMatchObject({
+        success: true,
+        warning: expect.stringContaining("history was not recorded"),
+      });
+      expect(chain.delete).toHaveBeenCalled();
+      expect(cacheMocks.revalidatePath).toHaveBeenCalledWith("/about");
+    });
+  });
 });

package/templates/nextblock-template/app/actions/visualEditingActions.ts

@@ -164,7 +164,15 @@ function addNumberMeta(
   }
 }
 
-async function publishPageDraft(draft: ContentDraftRow, authorId: string) {
+/**
+ * Applies a page draft to the live tables and records the revision.
+ *
+ * Returns a warning string when the content went live but the revision did not record —
+ * never throws for that case. Once the page row and its blocks have been rewritten, the
+ * publish has happened; aborting here would leave the draft row undeleted and the public
+ * route un-revalidated, which is strictly worse than a missing history entry.
+ */
+async function publishPageDraft(draft: ContentDraftRow, authorId: string): Promise<string | null> {
   const auth = await getCurrentUserCanEdit();
   const supabase = auth.supabase;
   const previousContent = await getFullPageContent(draft.parent_id);
@@ -172,7 +180,11 @@ async function publishPageDraft(draft: ContentDraftRow, authorId: string) {
   addStringMeta(pageUpdate, draft, "title");
   addStringMeta(pageUpdate, draft, "slug");
   addNumberMeta(pageUpdate, draft, "language_id");
-  addStringMeta(pageUpdate, draft, "status");
+  // `status`/`published_at` are deliberately NOT copied from the draft. Visibility
+  // is owned by the top-bar control (setPageVisibility) and written straight to the
+  // row; publishing a draft that still carries an old status would silently roll a
+  // page back to draft — or push one live — behind the editor's back. Older drafts
+  // may still hold those keys; they are inert.
   addNullableStringMeta(pageUpdate, draft, "meta_title");
   addNullableStringMeta(pageUpdate, draft, "meta_description");
   addNullableStringMeta(pageUpdate, draft, "custom_canonical");
@@ -204,12 +216,15 @@ async function publishPageDraft(draft: ContentDraftRow, authorId: string) {
   }
 
   const nextContent = await getFullPageContent(draft.parent_id);
-  if (previousContent && nextContent) {
-    await createPageRevision(draft.parent_id, authorId, previousContent, nextContent);
+  if (!previousContent || !nextContent) {
+    return "the page content could not be read back";
   }
+  const revision = await createPageRevision(draft.parent_id, authorId, previousContent, nextContent);
+  return "error" in revision ? revision.error : null;
 }
 
-async function publishPostDraft(draft: ContentDraftRow, authorId: string) {
+/** See publishPageDraft — same contract. */
+async function publishPostDraft(draft: ContentDraftRow, authorId: string): Promise<string | null> {
   const auth = await getCurrentUserCanEdit();
   const supabase = auth.supabase;
   const previousContent = await getFullPostContent(draft.parent_id);
@@ -217,14 +232,14 @@ async function publishPostDraft(draft: ContentDraftRow, authorId: string) {
   addStringMeta(postUpdate, draft, "title");
   addStringMeta(postUpdate, draft, "slug");
   addNumberMeta(postUpdate, draft, "language_id");
-  addStringMeta(postUpdate, draft, "status");
+  // See publishPageDraft: visibility (`status`/`published_at`) never rides along
+  // with a content draft.
   addNullableStringMeta(postUpdate, draft, "meta_title");
   addNullableStringMeta(postUpdate, draft, "meta_description");
   addNullableStringMeta(postUpdate, draft, "custom_canonical");
   addNullableStringMeta(postUpdate, draft, "label");
   addNullableStringMeta(postUpdate, draft, "excerpt");
   addNullableStringMeta(postUpdate, draft, "subtitle");
-  addNullableStringMeta(postUpdate, draft, "published_at");
   addNullableStringMeta(postUpdate, draft, "feature_image_id");
 
   const { error: postError } = await supabase
@@ -253,9 +268,11 @@ async function publishPostDraft(draft: ContentDraftRow, authorId: string) {
   }
 
   const nextContent = await getFullPostContent(draft.parent_id);
-  if (previousContent && nextContent) {
-    await createPostRevision(draft.parent_id, authorId, previousContent, nextContent);
+  if (!previousContent || !nextContent) {
+    return "the post content could not be read back";
   }
+  const revision = await createPostRevision(draft.parent_id, authorId, previousContent, nextContent);
+  return "error" in revision ? revision.error : null;
 }
 
 export async function publishVisualEditingDraft(parentType: NextblockDocumentType, parentId: number) {
@@ -283,11 +300,10 @@ export async function publishVisualEditingDraft(parentType: NextblockDocumentTyp
 
     const draft = normalizeContentDraftRow(data);
 
-    if (parentType === "page") {
-      await publishPageDraft(draft, auth.user.id);
-    } else {
-      await publishPostDraft(draft, auth.user.id);
-    }
+    const revisionWarning =
+      parentType === "page"
+        ? await publishPageDraft(draft, auth.user.id)
+        : await publishPostDraft(draft, auth.user.id);
 
     const { error: deleteError } = await (auth.supabase as any)
       .from("content_drafts")
@@ -304,6 +320,10 @@ export async function publishVisualEditingDraft(parentType: NextblockDocumentTyp
     }
     revalidateVisualEditingPath(parentType === "page" ? `/cms/pages/${parentId}/edit` : `/cms/posts/${parentId}/edit`);
 
+    if (revisionWarning) {
+      return { success: true, warning: `Published, but history was not recorded: ${revisionWarning}` };
+    }
+
     return { success: true };
   } catch (error) {
     return {

package/templates/nextblock-template/app/api/ai/global-agent/route.ts

@@ -41,6 +41,11 @@ import {
 } from '@nextblock-cms/cortex';
 import { validateBlockContent } from '../../../../lib/blocks/blockRegistry';
 import { importExternalImageToMedia } from '../../../cms/media/import-external-image';
+import {
+  captureRevisionBaseline,
+  commitRevisionFromBaseline,
+} from '../../../cms/revisions/service';
+import type { AnyFullContent } from '../../../cms/revisions/utils';
 
 export const dynamic = 'force-dynamic';
 
@@ -72,6 +77,43 @@ async function importExternalImageForCortex(input: {
   return { id: result.media.id };
 }
 
+/**
+ * Bridges the app's revision engine into the Cortex tool context so that content the agent
+ * writes straight to the live tables lands in Revision History like any other edit.
+ *
+ * Every AI write goes through here, including the ones inside a multi-step action plan —
+ * the callback lives on the tool context, not on the route, so it also covers the executors
+ * that run in-stream rather than via the Confirm button.
+ *
+ * `authorId` is the admin whose session authorised the request; the agent's Supabase client
+ * is service-role, so without this the revision row would land with a null author.
+ */
+function createCortexRevisionRecorder(authorId: string | null) {
+  return async function recordRevision(input: {
+    baseline?: unknown;
+    contentType: 'page' | 'post' | 'product';
+    entityId: number | string;
+    phase: 'capture' | 'commit';
+  }): Promise<unknown> {
+    if (input.phase === 'capture') {
+      return captureRevisionBaseline(input.contentType, input.entityId);
+    }
+
+    const result = await commitRevisionFromBaseline(
+      input.contentType,
+      input.entityId,
+      authorId,
+      (input.baseline ?? null) as AnyFullContent | null
+    );
+
+    if ('error' in result) {
+      console.error('Cortex AI: revision not recorded —', result.error);
+    }
+
+    return undefined;
+  };
+}
+
 const globalAgentMessageSchema = z.strictObject({
   content: z.string().min(1).max(8000),
   role: z.enum(['system', 'user', 'assistant']),
@@ -909,6 +951,7 @@ export async function POST(request: Request) {
           importExternalImage: importExternalImageForCortex,
           latestUserMessage: confirmedToolCall.confirmationPhrase,
           pageContext,
+          recordRevision: createCortexRevisionRecorder(adminAccess.userId),
           supabase: getServiceRoleSupabaseClient(),
           validateBlockContent,
         },
@@ -935,6 +978,7 @@ export async function POST(request: Request) {
           importExternalImage: importExternalImageForCortex,
           latestUserMessage,
           pageContext,
+          recordRevision: createCortexRevisionRecorder(adminAccess.userId),
           supabase: getServiceRoleSupabaseClient(),
           validateBlockContent,
         },
@@ -980,6 +1024,7 @@ export async function POST(request: Request) {
       importExternalImage: importExternalImageForCortex,
       latestUserMessage,
       pageContext,
+      recordRevision: createCortexRevisionRecorder(adminAccess.userId),
       supabase: getServiceRoleSupabaseClient(),
       validateBlockContent,
     });