create-nextblock 0.15.10 → 0.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.15.10",
+  "version": "0.16.1",
   "description": "Scaffold a production-ready NextBlock CMS project — the open-source, full-stack AI-native CMS for Next.js 16, Supabase, and Tailwind CSS.",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/api/ai/seo/alt-text/route.ts

@@ -0,0 +1,221 @@
+import { NextResponse } from 'next/server';
+
+import { createClient, verifyPackageOnline } from '@nextblock-cms/db/server';
+
+import { generateCortexAiAltText } from '@nextblock-cms/cortex';
+import {
+  safeParseCortexAiModelSelection,
+  summarizeCortexAiRoutingError,
+} from '@nextblock-cms/cortex';
+
+import { z } from '../../../../../lib/zod-config';
+
+export const dynamic = 'force-dynamic';
+
+type SupabaseServerClient = ReturnType<typeof createClient>;
+
+/**
+ * The request contract for the alt-text endpoint.
+ *
+ * `z.strictObject` rather than `z.object`, for the same reason the rest of the
+ * Cortex surface uses it: an unknown key is almost always a caller that has drifted
+ * from the contract — a stale client still sending `mediaId`, or a hand-rolled
+ * fetch that guessed at the field names — and silently discarding it produces a
+ * generation that ignores half of what the caller asked for. Rejecting loudly at
+ * the boundary turns that into a 400 the developer can actually read.
+ *
+ * `maxLength` is validated only for shape (a positive integer), not for range. The
+ * engine in `ai-vision.ts` deliberately CLAMPS an out-of-range budget into its own
+ * 20..1000 bounds instead of throwing, precisely so that a careless call site
+ * cannot break a media upload flow; duplicating those bounds here would both
+ * contradict that decision and leave two copies of the same numbers free to drift
+ * apart.
+ */
+const altTextRequestSchema = z.strictObject({
+  context: z.string().max(2000).optional(),
+  imageUrl: z.string().min(1),
+  maxLength: z.number().int().positive().optional(),
+});
+
+async function requireCmsWriterAccess(supabase: SupabaseServerClient) {
+  const {
+    data: { user },
+    error: userError,
+  } = await supabase.auth.getUser();
+
+  if (userError || !user) {
+    return null;
+  }
+
+  const { data: profile, error: profileError } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+
+  if (profileError || !profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+    return null;
+  }
+
+  return { userId: user.id };
+}
+
+function jsonError(message: string, status: number) {
+  return NextResponse.json({ error: message }, { status });
+}
+
+/**
+ * Return a human-readable reason the supplied image URL cannot be sent to a vision
+ * model, or `null` when it is usable.
+ *
+ * This duplicates a check that `generateCortexAiAltText` also performs, and it does
+ * so deliberately. The engine's copy throws, which would surface here as a 500 —
+ * the status code that means "the server broke" — when the truth is that the caller
+ * sent an unusable value and needs a 400 telling them exactly that. Running the
+ * check first gives the common mistake the right status and an actionable message,
+ * while the engine keeps its own guard for every other call site.
+ *
+ * The mistake being guarded against is concrete rather than hypothetical:
+ * `resolveMediaUrl()` returns a bare `/${objectKey}` whenever no R2 base URL is
+ * configured, so an install that has not finished its media setup hands every
+ * caller a site-relative path. Because the Cortex OpenRouter provider is created
+ * without `supportedUrls`, the AI SDK does not forward a link to the model — it
+ * downloads the image server-side and inlines it as base64 — so a relative path
+ * would fail inside the SDK's own fetch, once per model in the fallback chain, with
+ * an error that never mentions the actual problem.
+ *
+ * The scheme test is strict rather than allowlist-based: any absolute URL is
+ * acceptable as long as it is http or https, but `file:`, `data:`, and `blob:` are
+ * refused. Those are the schemes that would either read the server's own disk or
+ * push an unbounded inline payload through every model in the fallback chain.
+ */
+function describeUnusableImageUrl(imageUrl: string): string | null {
+  const trimmed = imageUrl.trim();
+
+  if (!trimmed) {
+    return 'An image URL is required to generate alt text.';
+  }
+
+  let parsed: URL;
+
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return `Alt text generation needs an absolute http(s) image URL, but received "${trimmed}". A storage key or site-relative path has to be resolved to a publicly fetchable URL first, because the model provider downloads the image server-side rather than following the link.`;
+  }
+
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    return `Alt text generation needs an http(s) image URL, but received the "${parsed.protocol}" scheme.`;
+  }
+
+  return null;
+}
+
+export async function POST(request: Request) {
+  try {
+    const supabase = createClient();
+    const access = await requireCmsWriterAccess(supabase);
+
+    if (!access) {
+      return jsonError('You do not have permission to generate image alt text.', 403);
+    }
+
+    // The package gate that /api/ai/generate-blocks is missing (docs/08 follow-up
+    // #6). Alt-text generation is a paid Cortex AI feature that burns either the
+    // operator's own OpenRouter credit or the shared house key, so an install
+    // without an active `cortex-ai` activation must not reach a model at all. The
+    // package id is `cortex-ai`; `ai` is not a package id anywhere in this system.
+    const isCortexAiActive = await verifyPackageOnline('cortex-ai');
+
+    if (!isCortexAiActive) {
+      return jsonError('NextBlock Cortex AI is not active for this workspace.', 403);
+    }
+
+    const body = await request.json().catch(() => null);
+    const parsedRequest = altTextRequestSchema.safeParse(body);
+
+    if (!parsedRequest.success) {
+      return jsonError('Invalid Cortex AI alt text request.', 400);
+    }
+
+    const unusableImageUrlReason = describeUnusableImageUrl(parsedRequest.data.imageUrl);
+
+    if (unusableImageUrlReason) {
+      return jsonError(unusableImageUrlReason, 400);
+    }
+
+    // Sandbox installs have no server-side OpenRouter credential at all: the demo
+    // visitor pastes their own key into the browser, it lives in localStorage under
+    // `cortex_ai_sandbox_openrouter_api_key`, and it rides along on these headers.
+    // The env guard matters as much as the headers do — outside a sandbox the
+    // server must never accept a caller-supplied credential, because that would let
+    // any authenticated writer redirect generation through a key the operator never
+    // chose.
+    const sandboxKey =
+      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+        ? request.headers.get('x-sandbox-openrouter-key')
+        : null;
+    const sandboxModelRaw =
+      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+        ? request.headers.get('x-sandbox-openrouter-model')
+        : null;
+
+    let modelSelection = null;
+    if (sandboxModelRaw) {
+      try {
+        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
+      } catch {
+        // Ignore malformed sandbox model headers.
+      }
+    }
+
+    // `generateCortexAiAltText` takes a requested model id rather than a whole
+    // stored selection, because its vision routing policy has to decide for itself
+    // whether an id is plausibly multimodal before it will route an image to it.
+    // The header is still parsed through `safeParseCortexAiModelSelection` so that
+    // a malformed value is discarded rather than forwarded as a bogus id, and the
+    // id is only honoured alongside the sandbox key so that a caller-supplied model
+    // choice can never be applied to the operator's own credential.
+    const result = await generateCortexAiAltText({
+      apiKey: sandboxKey || undefined,
+      context: parsedRequest.data.context,
+      imageUrl: parsedRequest.data.imageUrl,
+      maxLength: parsedRequest.data.maxLength,
+      modelId: sandboxKey && modelSelection ? modelSelection.modelId : undefined,
+    });
+
+    return NextResponse.json(
+      {
+        altText: result.altText,
+        credentialSource: result.credentialSource,
+        modelId: result.modelId,
+      },
+      {
+        headers: {
+          'x-cortex-ai-credential-source': result.credentialSource,
+          'x-cortex-ai-model': result.modelId,
+        },
+      }
+    );
+  } catch (error) {
+    // A CortexAiRoutingError is recognised STRUCTURALLY rather than with
+    // `instanceof`. The class is defined in @nextblock-cms/cortex, which resolves to
+    // library source inside this monorepo but to a published package in a
+    // standalone install; when both shapes end up in one bundle the two class
+    // identities are not the same object and `instanceof` silently returns false,
+    // swallowing the per-model attempt log that is the only useful diagnostic for a
+    // routing failure.
+    if (error && typeof error === 'object' && 'attempts' in error) {
+      console.error(
+        '[Cortex AI] Failed to generate alt text after model attempts:',
+        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
+      );
+    }
+
+    console.error('[Cortex AI] Failed to generate alt text:', error);
+    return jsonError(
+      summarizeCortexAiRoutingError(error, 'Failed to generate image alt text.'),
+      500
+    );
+  }
+}

package/templates/nextblock-template/app/api/ai/seo/metadata/route.ts

@@ -0,0 +1,186 @@
+import { NextResponse } from 'next/server';
+
+import { createClient, verifyPackageOnline } from '@nextblock-cms/db/server';
+
+import { generateCortexAiSeoMetadata } from '@nextblock-cms/cortex';
+import {
+  safeParseCortexAiModelSelection,
+  summarizeCortexAiRoutingError,
+} from '@nextblock-cms/cortex';
+
+import { z } from '../../../../../lib/zod-config';
+
+export const dynamic = 'force-dynamic';
+
+type SupabaseServerClient = ReturnType<typeof createClient>;
+
+/**
+ * How much page copy this endpoint will accept in one request.
+ *
+ * The engine truncates the content to `CORTEX_AI_SEO_METADATA_CONTENT_BUDGET`
+ * (6000 characters) before it ever reaches a model, so anything beyond that is
+ * discarded rather than summarised. This ceiling is therefore not a content rule —
+ * it is a request-body bound, set far above the engine's budget so that a genuinely
+ * long post is never rejected with a confusing 400, but low enough that a runaway
+ * client cannot push megabytes of HTML through the JSON parser on every keystroke
+ * of an editor that generates metadata as you type.
+ */
+const SEO_METADATA_CONTENT_REQUEST_LIMIT = 200_000;
+
+/**
+ * The request contract for the metadata endpoint.
+ *
+ * Strict, for the reason every Cortex request schema is strict: an unrecognised key
+ * means the caller and this route disagree about the contract, and the failure mode
+ * of quietly dropping it is a generation that ignored the focus keyword or the
+ * locale the caller thought it had supplied. A 400 naming the mismatch is far
+ * cheaper to debug than metadata that is merely subtly wrong.
+ *
+ * Only `content` is required. Everything else is a hint the engine folds into the
+ * prompt when present and omits entirely when absent, which is why each optional
+ * field is bounded but never given a minimum beyond one character — an empty string
+ * from a form field that the user left blank should not fail the whole request, and
+ * the engine's own `?.trim() || null` normalisation already treats blank as absent.
+ */
+const seoMetadataRequestSchema = z.strictObject({
+  content: z.string().min(1).max(SEO_METADATA_CONTENT_REQUEST_LIMIT),
+  focusKeyword: z.string().max(200).optional(),
+  locale: z.string().max(64).optional(),
+  siteTitle: z.string().max(200).optional(),
+  title: z.string().max(500).optional(),
+});
+
+async function requireCmsWriterAccess(supabase: SupabaseServerClient) {
+  const {
+    data: { user },
+    error: userError,
+  } = await supabase.auth.getUser();
+
+  if (userError || !user) {
+    return null;
+  }
+
+  const { data: profile, error: profileError } = await supabase
+    .from('profiles')
+    .select('role')
+    .eq('id', user.id)
+    .single();
+
+  if (profileError || !profile || !['ADMIN', 'WRITER'].includes(profile.role)) {
+    return null;
+  }
+
+  return { userId: user.id };
+}
+
+function jsonError(message: string, status: number) {
+  return NextResponse.json({ error: message }, { status });
+}
+
+export async function POST(request: Request) {
+  try {
+    const supabase = createClient();
+    const access = await requireCmsWriterAccess(supabase);
+
+    if (!access) {
+      return jsonError('You do not have permission to generate SEO metadata.', 403);
+    }
+
+    // The package gate that /api/ai/generate-blocks is missing (docs/08 follow-up
+    // #6). Metadata generation is a paid Cortex AI feature that burns either the
+    // operator's own OpenRouter credit or the shared house key, so an install
+    // without an active `cortex-ai` activation must not reach a model at all. The
+    // package id is `cortex-ai`; `ai` is not a package id anywhere in this system.
+    const isCortexAiActive = await verifyPackageOnline('cortex-ai');
+
+    if (!isCortexAiActive) {
+      return jsonError('NextBlock Cortex AI is not active for this workspace.', 403);
+    }
+
+    const body = await request.json().catch(() => null);
+    const parsedRequest = seoMetadataRequestSchema.safeParse(body);
+
+    if (!parsedRequest.success) {
+      return jsonError('Invalid Cortex AI SEO metadata request.', 400);
+    }
+
+    // Sandbox installs have no server-side OpenRouter credential at all: the demo
+    // visitor pastes their own key into the browser, it lives in localStorage under
+    // `cortex_ai_sandbox_openrouter_api_key`, and it rides along on these headers.
+    // The env guard matters as much as the headers do — outside a sandbox the
+    // server must never accept a caller-supplied credential, because that would let
+    // any authenticated writer redirect generation through a key the operator never
+    // chose.
+    const sandboxKey =
+      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+        ? request.headers.get('x-sandbox-openrouter-key')
+        : null;
+    const sandboxModelRaw =
+      process.env.NEXT_PUBLIC_IS_SANDBOX === 'true'
+        ? request.headers.get('x-sandbox-openrouter-model')
+        : null;
+
+    let modelSelection = null;
+    if (sandboxModelRaw) {
+      try {
+        modelSelection = safeParseCortexAiModelSelection(JSON.parse(sandboxModelRaw));
+      } catch {
+        // Ignore malformed sandbox model headers.
+      }
+    }
+
+    // `generateCortexAiSeoMetadata` accepts a requested model id rather than a
+    // whole stored selection; the header is still parsed through
+    // `safeParseCortexAiModelSelection` so that a malformed value is discarded
+    // instead of being forwarded as a bogus id. Note that the ordinary text routing
+    // policy will IGNORE the requested id whenever the credential came from the
+    // environment, which is exactly the intended behaviour here: a model choice is
+    // only ever honoured when it arrives with the key that will pay for it.
+    const result = await generateCortexAiSeoMetadata({
+      apiKey: sandboxKey || undefined,
+      content: parsedRequest.data.content,
+      focusKeyword: parsedRequest.data.focusKeyword,
+      locale: parsedRequest.data.locale,
+      modelId: sandboxKey && modelSelection ? modelSelection.modelId : undefined,
+      siteTitle: parsedRequest.data.siteTitle,
+      title: parsedRequest.data.title,
+    });
+
+    return NextResponse.json(
+      {
+        credentialSource: result.credentialSource,
+        metaDescription: result.metaDescription,
+        metaTitle: result.metaTitle,
+        modelId: result.modelId,
+        ogDescription: result.ogDescription,
+        ogTitle: result.ogTitle,
+      },
+      {
+        headers: {
+          'x-cortex-ai-credential-source': result.credentialSource,
+          'x-cortex-ai-model': result.modelId,
+        },
+      }
+    );
+  } catch (error) {
+    // A CortexAiRoutingError is recognised STRUCTURALLY rather than with
+    // `instanceof`. The class is defined in @nextblock-cms/cortex, which resolves to
+    // library source inside this monorepo but to a published package in a
+    // standalone install; when both shapes end up in one bundle the two class
+    // identities are not the same object and `instanceof` silently returns false,
+    // swallowing the per-model attempt log that is the only useful diagnostic for a
+    // routing failure.
+    if (error && typeof error === 'object' && 'attempts' in error) {
+      console.error(
+        '[Cortex AI] Failed to generate SEO metadata after model attempts:',
+        JSON.stringify((error as { attempts: unknown }).attempts, null, 2)
+      );
+    }
+
+    console.error('[Cortex AI] Failed to generate SEO metadata:', error);
+    return jsonError(
+      summarizeCortexAiRoutingError(error, 'Failed to generate SEO metadata.'),
+      500
+    );
+  }
+}

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -8028,6 +8028,196 @@ UPDATE public.site_settings
    AND lower(value->>'contactEmail') LIKE '%@example.%';
 
 
+-- >>> FROM: 00000000000030_seo_redirects_and_robots.sql <<<
+-- SEO engine: managed 301/302 redirects and operator-configurable robots directives.
+--
+-- Two unrelated-looking things ship in one migration because they are the same
+-- feature from an operator's point of view: the \`/cms/settings/seo\` screen is where
+-- someone goes to say "this URL moved" and "do not crawl that". Splitting them
+-- across two migrations would only mean two files that must always be applied
+-- together.
+--
+-- WHY A TABLE AND NOT next.config.js redirects(). Redirects are content, not
+-- configuration. An editor who renames a page's slug needs the old URL to keep
+-- working immediately, without a redeploy and without touching source control.
+-- That rules out the build-time array; it has to be data.
+--
+-- WHY THE PROXY READS THIS WITH THE ANON KEY. apps/nextblock/proxy.ts (Next 16's
+-- renamed middleware) resolves redirects before rendering, and it holds a Supabase
+-- client built from the anon key. So the public SELECT policy below is load-bearing:
+-- without an explicit \`TO authenticated, anon\` grant the proxy's lookup would return
+-- zero rows for every anonymous visitor -- silently, with no error -- and no redirect
+-- would ever fire. Only is_active rows are exposed, so a half-written rule is never
+-- live.
+--
+-- WHY status_code IS AN integer AND NOT AN ENUM. The same reasoning migration 27
+-- recorded for \`source\`: a Postgres enum cannot be extended and used inside the same
+-- transaction, which is exactly the scope of one migration file. A CHECK constraint
+-- is replaceable in a single statement. 301 and 302 are the only two values the
+-- admin UI offers; 307/308 are deliberately not exposed, because their
+-- method-preserving semantics surprise operators who just want "this page moved".
+--
+-- LOOP SAFETY is enforced in application code (wouldCreateLoop in
+-- @nextblock-cms/utils, called by the admin server actions) rather than by a
+-- constraint, because detecting a cycle requires walking the whole table and a CHECK
+-- constraint can only see one row. The self-redirect case IS cheap to check per row,
+-- so that one is a constraint -- it is the cycle operators actually hit.
+--
+-- SECURITY POSTURE. A redirect can send every visitor of a path to an arbitrary
+-- external origin, which makes this table an open-redirect surface and a phishing
+-- lever. Writes are therefore ADMIN-only -- WRITER is deliberately excluded, matching
+-- site_scripts rather than the content tables. Reads are public but limited to active
+-- rows. The robots settings live in site_settings, whose existing read policy is
+-- already public for non-secret keys; nothing here is secret.
+--
+-- Forward-only and idempotent.
+
+CREATE TABLE IF NOT EXISTS public.cms_redirects (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    -- The incoming site-relative path to match, normalized by the application to a
+    -- leading slash with no trailing slash (except root). Matching is exact: prefix
+    -- and wildcard rules are deliberately not supported, because they are the usual
+    -- way an operator builds an accidental loop.
+    source_path text NOT NULL,
+    -- Where to send the visitor. Either another site-relative path or a fully
+    -- qualified https URL for an off-site move.
+    destination_path text NOT NULL,
+    -- 301 permanent (the SEO-meaningful one: search engines transfer ranking signals
+    -- and browsers cache it aggressively) or 302 temporary.
+    status_code integer DEFAULT 301 NOT NULL,
+    is_active boolean DEFAULT true NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT cms_redirects_pkey PRIMARY KEY (id),
+    -- One rule per source. This UNIQUE constraint also provides the index the proxy
+    -- lookup relies on, so no separate plain index on source_path is needed.
+    CONSTRAINT cms_redirects_source_path_key UNIQUE (source_path),
+    CONSTRAINT cms_redirects_status_code_check
+        CHECK ((status_code = ANY (ARRAY[301, 302]))),
+    -- A source is always a path on this site; accepting an absolute URL here would
+    -- silently never match, since the proxy only ever compares pathnames.
+    CONSTRAINT cms_redirects_source_path_check
+        CHECK ((source_path ~ '^/')),
+    -- A destination is either a site-relative path or an https URL. Plain http is
+    -- refused so a redirect can never downgrade a visitor to cleartext.
+    CONSTRAINT cms_redirects_destination_path_check
+        CHECK (((destination_path ~ '^/') OR (destination_path ~ '^https://'))),
+    -- The one cycle a single row can express, and the one operators actually create.
+    CONSTRAINT cms_redirects_no_self_redirect_check
+        CHECK ((source_path <> destination_path))
+);
+
+COMMENT ON TABLE public.cms_redirects IS
+    'Operator-managed 301/302 redirects resolved by apps/nextblock/proxy.ts before rendering. Only is_active rows are publicly readable; only ADMIN may write, because a redirect rule is an open-redirect surface.';
+COMMENT ON COLUMN public.cms_redirects.source_path IS
+    'Exact site-relative path to match, normalized to a leading slash and no trailing slash (except root). No wildcards, by design.';
+COMMENT ON COLUMN public.cms_redirects.destination_path IS
+    'Site-relative path or absolute https URL to send the visitor to.';
+COMMENT ON COLUMN public.cms_redirects.status_code IS
+    '301 permanent or 302 temporary. 307/308 are not offered by the admin UI.';
+COMMENT ON COLUMN public.cms_redirects.is_active IS
+    'Only active rows are readable by anon, and only active rows are matched by the proxy.';
+
+-- The proxy loads the whole active set once per cache window rather than querying per
+-- request, so the hot query is "all active rows" and this partial index is what serves
+-- it. Carrying source_path in the index keeps that read index-only.
+CREATE INDEX IF NOT EXISTS cms_redirects_active_source_idx
+    ON public.cms_redirects USING btree (source_path) WHERE (is_active);
+
+DROP TRIGGER IF EXISTS set_cms_redirects_updated_at ON public.cms_redirects;
+CREATE TRIGGER set_cms_redirects_updated_at
+    BEFORE UPDATE ON public.cms_redirects
+    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
+
+ALTER TABLE public.cms_redirects ENABLE ROW LEVEL SECURITY;
+
+GRANT ALL ON TABLE public.cms_redirects TO anon;
+GRANT ALL ON TABLE public.cms_redirects TO authenticated;
+GRANT ALL ON TABLE public.cms_redirects TO service_role;
+
+-- The proxy runs as anon for a logged-out visitor, which is the overwhelming majority
+-- of traffic and the only traffic redirects really matter for. Without this policy the
+-- lookup returns zero rows and the feature is silently dead.
+DROP POLICY IF EXISTS "Public read active redirects" ON public.cms_redirects;
+CREATE POLICY "Public read active redirects" ON public.cms_redirects
+    FOR SELECT TO authenticated, anon USING (is_active);
+
+DROP POLICY IF EXISTS "Admins read all redirects" ON public.cms_redirects;
+CREATE POLICY "Admins read all redirects" ON public.cms_redirects
+    FOR SELECT TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins insert redirects" ON public.cms_redirects;
+CREATE POLICY "Admins insert redirects" ON public.cms_redirects
+    FOR INSERT TO authenticated
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins update redirects" ON public.cms_redirects;
+CREATE POLICY "Admins update redirects" ON public.cms_redirects
+    FOR UPDATE TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role))
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins delete redirects" ON public.cms_redirects;
+CREATE POLICY "Admins delete redirects" ON public.cms_redirects
+    FOR DELETE TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+-- Robots directives live in site_settings rather than a table of their own: there is
+-- exactly one robots.txt per install, so a dedicated table would only ever hold one
+-- row, and site_settings already carries the public-read / staff-write policy this
+-- needs. The stored shape matches \`RobotsSettings\` in @nextblock-cms/utils, and
+-- \`normalizeRobotsSettings\` tolerates a missing or malformed value -- so this seed is
+-- a convenience for the settings screen, not a correctness requirement for rendering.
+--
+-- ON CONFLICT DO NOTHING because an install that has already configured robots must
+-- not have its rules reset by a replay of this migration.
+INSERT INTO public.site_settings (key, value)
+VALUES (
+    'seo_robots_settings',
+    '{"customRules": "", "isIndexingEnabled": true, "sitemapEnabled": true, "userAgentRules": [{"allow": ["/"], "disallow": [], "userAgent": "*"}]}'::jsonb
+)
+ON CONFLICT (key) DO NOTHING;
+
+
+-- >>> FROM: 00000000000031_seo_robots_settings_admin_only.sql <<<
+-- Restrict writes to the robots.txt settings row to ADMIN only.
+--
+-- \`site_settings.seo_robots_settings\` is the row that decides whether the whole site
+-- is crawlable: app/robots.ts reads it on every /robots.txt hit and serves a blanket
+-- \`Disallow: /\` when \`isIndexingEnabled\` is false. The CMS only offers that switch
+-- under /cms/settings/seo, and \`saveRobotsSettings\` re-checks for ADMIN before it
+-- writes — but RLS is the independent boundary, and it did not agree. The baseline
+-- write policies let ADMIN *or* WRITER write any key outside the sensitive array, so
+-- a WRITER holding a normal session could PATCH this row through PostgREST and take
+-- the entire site out of Google. That failure is quiet (nothing in the CMS shows it),
+-- slow to notice (search traffic decays over weeks) and hard to attribute after the
+-- fact, which is why the database has to refuse it rather than trusting the one
+-- server action that happens to guard it today.
+--
+-- The SELECT policy is deliberately NOT touched. This key must stay anon-READABLE:
+-- app/robots.ts reads it with the anon (SSG) client on every crawl, and adding the key
+-- to the read policy's sensitive array would make robots.txt fall back to its
+-- permissive defaults for every crawler. Only INSERT/UPDATE/DELETE move to ADMIN-only,
+-- matching the UI boundary — exactly the shape migration 00000000000011 used for
+-- language_detection_settings, which is anon-readable for the same reason.
+--
+-- Every key already present in each policy's array is preserved (dropping one would
+-- silently widen write access back to WRITER for that key); \`seo_robots_settings\` is
+-- appended to the three write policies only.
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+-- Forward-only and idempotent.
+
+
   -- Step D: Record the applied migrations in history (truncated in Step B) so
   -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
   INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
@@ -8060,7 +8250,9 @@ UPDATE public.site_settings
     ('00000000000026', 'product_inquiries'),
     ('00000000000027', 'message_threads'),
     ('00000000000028', 'interaction_replies'),
-    ('00000000000029', 'form_endpoints_default_empty')
+    ('00000000000029', 'form_endpoints_default_empty'),
+    ('00000000000030', 'seo_redirects_and_robots'),
+    ('00000000000031', 'seo_robots_settings_admin_only')
   ON CONFLICT (version) DO NOTHING;
 
   -- Step E: Anchor preserved profiles

package/templates/nextblock-template/app/cms/CmsClientLayout.tsx

@@ -9,7 +9,7 @@ import {
   LayoutDashboard, FileText, PenTool, Users, Settings, ChevronRight, LogOut, Menu, ListTree, Image as ImageIconLucide, X, Languages as LanguagesIconLucide, MessageSquare,
   Copyright as CopyrightIcon, ShoppingBag, ListOrdered, CreditCard, Package, Coins, MessageSquareText,
   ExternalLink, Paintbrush, Brain, TicketPercent, ShieldAlert, Folder, DatabaseBackup, Boxes, Tag,
-  ShieldCheck, Code2, Cookie, LineChart, Mail, UserPlus, SlidersHorizontal,
+  ShieldCheck, Code2, Cookie, LineChart, Mail, UserPlus, SlidersHorizontal, Search,
 } from "lucide-react"
 import TwoFactorReminderBanner from "./components/TwoFactorReminderBanner"
 import SystemAlertsBanner, { type SystemAlertItem } from "./components/SystemAlertsBanner"
@@ -249,6 +249,9 @@ export default function CmsClientLayout({
   else if (pathname.startsWith("/cms/settings/copyright")) pageTitle = "Copyright Settings";
   else if (pathname.startsWith("/cms/settings/global-css")) pageTitle = "Themes & CSS";
   else if (pathname.startsWith("/cms/settings/site-scripts")) pageTitle = "Site Scripts";
+  // Must stay ABOVE the generic "/cms/settings" arm below: this chain is
+  // first-match-wins, so anything placed after that fallback is dead code.
+  else if (pathname.startsWith("/cms/settings/seo")) pageTitle = "SEO & Redirects";
   else if (pathname.startsWith("/cms/settings/extra-translations")) pageTitle = "Extra Translations";
   else if (pathname.startsWith("/cms/settings/backup-restore")) pageTitle = "Backup And Restore";
   else if (pathname.startsWith("/cms/settings/currencies")) pageTitle = "Currency Settings";
@@ -455,6 +458,9 @@ export default function CmsClientLayout({
                     <NavItem href="/cms/settings/google-analytics" icon={LineChart} isActive={pathname.startsWith("/cms/settings/google-analytics")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                       Google Analytics
                     </NavItem>
+                    <NavItem href="/cms/settings/seo" icon={Search} isActive={pathname.startsWith("/cms/settings/seo")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
+                      SEO &amp; Redirects
+                    </NavItem>
                     <NavItem href="/cms/settings/extra-translations" icon={MessageSquare} isActive={pathname.startsWith("/cms/settings/extra-translations")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                       Extra Translations
                     </NavItem>