create-nextblock 0.16.3 → 0.17.0

package/templates/nextblock-template/lib/setup/env-status.ts

@@ -1,125 +1,125 @@
-// Dependency-free environment / provisioning detection.
-//
-// This module is imported from places that run in very different runtimes — the
-// `proxy.ts` middleware (Edge), server components, server actions, and even
-// `next.config.js` (Node, at build time). It therefore MUST stay free of
-// `server-only`, of any Node-only imports (`node:fs`, etc.), and of any Supabase
-// client so it is safe to evaluate anywhere.
-//
-// "Configured" here means the Supabase connection vars exist — there is no
-// `DATABASE_URL` in NextBlock; the database is reached through
-// `NEXT_PUBLIC_SUPABASE_URL` + the anon / service-role keys.
-
-export type DeployChannel = 'docker' | 'vercel' | 'local';
-
-// --- Supabase env-var resolution (naming-tolerant) ---------------------------
-//
-// NextBlock's own vars are NEXT_PUBLIC_SUPABASE_URL / _ANON_KEY and
-// SUPABASE_SERVICE_ROLE_KEY. But the Supabase Vercel Marketplace integration
-// (the one-click `stores` deploy flow) injects a DIFFERENT set of names:
-//   - URL:     SUPABASE_URL / NEXT_PUBLIC_SUPABASE_URL
-//   - anon:    SUPABASE_PUBLISHABLE_KEY / NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
-//   - service: SUPABASE_SECRET_KEY
-// (the new `sb_publishable_…` / `sb_secret_…` API keys, which supabase-js accepts
-// in place of the legacy anon / service_role JWTs). Resolving every alias here is
-// what makes auto-injected credentials work with zero manual entry. Keep the alias
-// order identical anywhere this chain is duplicated (the published `libs/db`
-// clients can't import this module, so they inline the same order).
-
-/** The Supabase project URL, under either the prefixed or non-prefixed name. */
-export function resolveSupabaseUrl(): string | undefined {
-  return (
-    process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL || undefined
-  );
-}
-
-/** The anon / publishable key — the RLS-respecting public key, under any alias. */
-export function resolveSupabaseAnonKey(): string | undefined {
-  return (
-    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
-    process.env.SUPABASE_ANON_KEY ||
-    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ||
-    process.env.SUPABASE_PUBLISHABLE_KEY ||
-    undefined
-  );
-}
-
-/** The service-role / secret key — the RLS-bypassing admin key, under either alias. */
-export function resolveSupabaseServiceKey(): string | undefined {
-  return (
-    process.env.SUPABASE_SERVICE_ROLE_KEY ||
-    process.env.SUPABASE_SECRET_KEY ||
-    undefined
-  );
-}
-
-/**
- * True when the public Supabase connection vars are present — enough to create an
- * anon client and reach the database. This is the single predicate the boot path,
- * the middleware gate, and the wizard all use to decide "is this instance wired up?".
- */
-export function isSupabaseConfigured(): boolean {
-  return Boolean(resolveSupabaseUrl() && resolveSupabaseAnonKey());
-}
-
-/**
- * True when service-role work is also possible (creating the first admin, applying
- * schema). The wizard's first-admin step and schema-apply step require this.
- */
-export function isFullyConfigured(): boolean {
-  return isSupabaseConfigured() && Boolean(resolveSupabaseServiceKey());
-}
-
-/**
- * Which of the four deploy channels we appear to be running in. Drives the wizard's
- * channel-aware prefills (Docker -> MinIO storage, Vercel -> Supabase Storage S3,
- * local -> the user's own Cloudflare R2).
- */
-export function detectChannel(): DeployChannel {
-  if (process.env.VERCEL === '1') return 'vercel';
-
-  // Docker is identified by the internal Supabase gateway URL (Kong :8000) or the MinIO
-  // storage marker the docker setup writes — NOT by NEXT_PUBLIC_IS_SANDBOX, which the
-  // managed cloud sandbox also sets.
-  const url = resolveSupabaseUrl() ?? '';
-  if (
-    url.includes('localhost:8000') ||
-    url.includes('127.0.0.1:8000') ||
-    url.includes('kong:8000') ||
-    process.env.R2_ACCOUNT_ID === 'minio'
-  ) {
-    return 'docker';
-  }
-
-  return 'local';
-}
-
-/**
- * True only where the wizard may safely write `.env.local` to the working directory:
- * local dev. NOT on Vercel (read-only FS, env is injected by the platform) and NOT
- * inside the baked standalone Docker runner (env is set by compose, FS is read-only).
- */
-export function isLocalWritableEnv(): boolean {
-  // Require NODE_ENV === 'development' explicitly (not `!== 'production'`): an UNSET
-  // NODE_ENV must NOT count as local. `next dev` / `nx serve` set it to 'development';
-  // `next build`/`next start`, Vercel, and the Docker runner set it to 'production'.
-  // The remaining checks are belt-and-suspenders. This is a SAFETY boundary (it gates
-  // destructive setup actions), so it must fail closed.
-  return (
-    process.env.NODE_ENV === 'development' &&
-    process.env.VERCEL !== '1' &&
-    process.env.DOCKER_BUILD !== 'true' &&
-    process.env.NEXTBLOCK_RUNTIME !== 'standalone'
-  );
-}
-
-/**
- * Records the unconfigured state on `process.env.NEXTBLOCK_UNCONFIGURED` so other
- * call sites (CSP construction, middleware) can read it without recomputing.
- * Idempotent; returns the boolean it set.
- */
-export function markUnconfiguredFlag(): boolean {
-  const unconfigured = !isSupabaseConfigured();
-  process.env.NEXTBLOCK_UNCONFIGURED = unconfigured ? 'true' : 'false';
-  return unconfigured;
-}
+// Dependency-free environment / provisioning detection.
+//
+// This module is imported from places that run in very different runtimes — the
+// `proxy.ts` middleware (Edge), server components, server actions, and even
+// `next.config.js` (Node, at build time). It therefore MUST stay free of
+// `server-only`, of any Node-only imports (`node:fs`, etc.), and of any Supabase
+// client so it is safe to evaluate anywhere.
+//
+// "Configured" here means the Supabase connection vars exist — there is no
+// `DATABASE_URL` in NextBlock; the database is reached through
+// `NEXT_PUBLIC_SUPABASE_URL` + the anon / service-role keys.
+
+export type DeployChannel = 'docker' | 'vercel' | 'local';
+
+// --- Supabase env-var resolution (naming-tolerant) ---------------------------
+//
+// NextBlock's own vars are NEXT_PUBLIC_SUPABASE_URL / _ANON_KEY and
+// SUPABASE_SERVICE_ROLE_KEY. But the Supabase Vercel Marketplace integration
+// (the one-click `stores` deploy flow) injects a DIFFERENT set of names:
+//   - URL:     SUPABASE_URL / NEXT_PUBLIC_SUPABASE_URL
+//   - anon:    SUPABASE_PUBLISHABLE_KEY / NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
+//   - service: SUPABASE_SECRET_KEY
+// (the new `sb_publishable_…` / `sb_secret_…` API keys, which supabase-js accepts
+// in place of the legacy anon / service_role JWTs). Resolving every alias here is
+// what makes auto-injected credentials work with zero manual entry. Keep the alias
+// order identical anywhere this chain is duplicated (the published `libs/db`
+// clients can't import this module, so they inline the same order).
+
+/** The Supabase project URL, under either the prefixed or non-prefixed name. */
+export function resolveSupabaseUrl(): string | undefined {
+  return (
+    process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL || undefined
+  );
+}
+
+/** The anon / publishable key — the RLS-respecting public key, under any alias. */
+export function resolveSupabaseAnonKey(): string | undefined {
+  return (
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
+    process.env.SUPABASE_ANON_KEY ||
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ||
+    process.env.SUPABASE_PUBLISHABLE_KEY ||
+    undefined
+  );
+}
+
+/** The service-role / secret key — the RLS-bypassing admin key, under either alias. */
+export function resolveSupabaseServiceKey(): string | undefined {
+  return (
+    process.env.SUPABASE_SERVICE_ROLE_KEY ||
+    process.env.SUPABASE_SECRET_KEY ||
+    undefined
+  );
+}
+
+/**
+ * True when the public Supabase connection vars are present — enough to create an
+ * anon client and reach the database. This is the single predicate the boot path,
+ * the middleware gate, and the wizard all use to decide "is this instance wired up?".
+ */
+export function isSupabaseConfigured(): boolean {
+  return Boolean(resolveSupabaseUrl() && resolveSupabaseAnonKey());
+}
+
+/**
+ * True when service-role work is also possible (creating the first admin, applying
+ * schema). The wizard's first-admin step and schema-apply step require this.
+ */
+export function isFullyConfigured(): boolean {
+  return isSupabaseConfigured() && Boolean(resolveSupabaseServiceKey());
+}
+
+/**
+ * Which of the four deploy channels we appear to be running in. Drives the wizard's
+ * channel-aware prefills (Docker -> MinIO storage, Vercel -> Supabase Storage S3,
+ * local -> the user's own Cloudflare R2).
+ */
+export function detectChannel(): DeployChannel {
+  if (process.env.VERCEL === '1') return 'vercel';
+
+  // Docker is identified by the internal Supabase gateway URL (Kong :8000) or the MinIO
+  // storage marker the docker setup writes — NOT by NEXT_PUBLIC_IS_SANDBOX, which the
+  // managed cloud sandbox also sets.
+  const url = resolveSupabaseUrl() ?? '';
+  if (
+    url.includes('localhost:8000') ||
+    url.includes('127.0.0.1:8000') ||
+    url.includes('kong:8000') ||
+    process.env.R2_ACCOUNT_ID === 'minio'
+  ) {
+    return 'docker';
+  }
+
+  return 'local';
+}
+
+/**
+ * True only where the wizard may safely write `.env.local` to the working directory:
+ * local dev. NOT on Vercel (read-only FS, env is injected by the platform) and NOT
+ * inside the baked standalone Docker runner (env is set by compose, FS is read-only).
+ */
+export function isLocalWritableEnv(): boolean {
+  // Require NODE_ENV === 'development' explicitly (not `!== 'production'`): an UNSET
+  // NODE_ENV must NOT count as local. `next dev` / `nx serve` set it to 'development';
+  // `next build`/`next start`, Vercel, and the Docker runner set it to 'production'.
+  // The remaining checks are belt-and-suspenders. This is a SAFETY boundary (it gates
+  // destructive setup actions), so it must fail closed.
+  return (
+    process.env.NODE_ENV === 'development' &&
+    process.env.VERCEL !== '1' &&
+    process.env.DOCKER_BUILD !== 'true' &&
+    process.env.NEXTBLOCK_RUNTIME !== 'standalone'
+  );
+}
+
+/**
+ * Records the unconfigured state on `process.env.NEXTBLOCK_UNCONFIGURED` so other
+ * call sites (CSP construction, middleware) can read it without recomputing.
+ * Idempotent; returns the boolean it set.
+ */
+export function markUnconfiguredFlag(): boolean {
+  const unconfigured = !isSupabaseConfigured();
+  process.env.NEXTBLOCK_UNCONFIGURED = unconfigured ? 'true' : 'false';
+  return unconfigured;
+}

package/templates/nextblock-template/lib/setup/env-write.ts

@@ -1,111 +1,111 @@
-import 'server-only';
-// Server-only `.env.local` writer for the local-dev (Profile B) setup path.
-//
-// Reimplements the three tiny helpers from tools/scripts/lib/supabase-keys.mjs
-// (generateSecret / readEnvValue / upsertEnv) inside the app so the browser wizard
-// writes `.env.local` identically to the terminal flow it replaces — without pulling
-// a file from outside the app's build graph. Kept dependency-free (node built-ins).
-import { randomBytes } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { readFile, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import { isLocalWritableEnv } from './env-status';
-
-/**
- * Where `.env.local` belongs. In this Nx monorepo the canonical location is the
- * workspace root (where `npm run setup` writes and `db:migrate`/`db:types` read), but
- * `nx serve` runs server actions with cwd = apps/nextblock — so we walk up to the
- * nearest ancestor containing `nx.json`. A standalone create-nextblock project has no
- * `nx.json`, so we fall back to cwd (its own root, where `next dev` runs).
- */
-function resolveEnvDir(): string {
-  let dir = process.cwd();
-  for (let i = 0; i < 8; i++) {
-    if (existsSync(path.join(dir, 'nx.json'))) return dir;
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return process.cwd();
-}
-
-/** 64-char (32-byte) hex secret. Matches tools/scripts/lib/supabase-keys.mjs. */
-export function generateSecret(): string {
-  return randomBytes(32).toString('hex');
-}
-
-/** Read a `KEY=` value from an .env body (tolerates surrounding quotes). */
-function readEnvValue(envContent: string, key: string): string {
-  for (const line of envContent.split(/\r?\n/)) {
-    if (line.startsWith(`${key}=`)) {
-      return line
-        .slice(key.length + 1)
-        .trim()
-        .replace(/^"(.*)"$/, '$1');
-    }
-  }
-  return '';
-}
-
-/** Apply `KEY=value` replacements line-by-line, appending keys not already present. */
-function upsertEnv(envContent: string, replacements: Record<string, string>): string {
-  const applied = new Set<string>();
-  const lines = envContent.split(/\r?\n/).map((line) => {
-    for (const [key, value] of Object.entries(replacements)) {
-      if (line.startsWith(`${key}=`)) {
-        applied.add(key);
-        return `${key}=${value}`;
-      }
-    }
-    return line;
-  });
-
-  for (const [key, value] of Object.entries(replacements)) {
-    if (!applied.has(key)) {
-      lines.push(`${key}=${value}`);
-    }
-  }
-
-  return lines.join('\n');
-}
-
-const ROTATING_SECRET_KEYS = ['CRON_SECRET', 'DRAFT_MODE_SECRET', 'REVALIDATE_SECRET_TOKEN'];
-
-/**
- * Write KEY=value pairs to `.env.local` at the working directory AND mirror them into
- * the live `process.env` so the running dev server can use them for server-side work
- * (schema probe, admin creation) without a hard restart.
- *
- * Caveat the caller must surface: `NEXT_PUBLIC_*` values are inlined into client
- * bundles at build/compile time, so the browser-side Supabase client still needs a
- * dev-server restart to pick them up. No-op (returns false) outside a local writable
- * environment (Vercel/Docker runner are read-only / platform-managed).
- */
-export async function writeEnvLocal(values: Record<string, string>): Promise<boolean> {
-  if (!isLocalWritableEnv()) return false;
-
-  const envPath = path.join(resolveEnvDir(), '.env.local');
-  let existing = '';
-  try {
-    existing = await readFile(envPath, 'utf8');
-  } catch {
-    existing = '';
-  }
-
-  // Generate the three rotating secrets only if absent (idempotent), like setup.mjs.
-  const ensured: Record<string, string> = { ...values };
-  for (const key of ROTATING_SECRET_KEYS) {
-    if (!ensured[key] && !readEnvValue(existing, key)) {
-      ensured[key] = generateSecret();
-    }
-  }
-
-  const next = upsertEnv(existing, ensured);
-  await writeFile(envPath, next.endsWith('\n') ? next : `${next}\n`, 'utf8');
-
-  for (const [key, value] of Object.entries(ensured)) {
-    process.env[key] = value;
-  }
-
-  return true;
-}
+import 'server-only';
+// Server-only `.env.local` writer for the local-dev (Profile B) setup path.
+//
+// Reimplements the three tiny helpers from tools/scripts/lib/supabase-keys.mjs
+// (generateSecret / readEnvValue / upsertEnv) inside the app so the browser wizard
+// writes `.env.local` identically to the terminal flow it replaces — without pulling
+// a file from outside the app's build graph. Kept dependency-free (node built-ins).
+import { randomBytes } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { isLocalWritableEnv } from './env-status';
+
+/**
+ * Where `.env.local` belongs. In this Nx monorepo the canonical location is the
+ * workspace root (where `npm run setup` writes and `db:migrate`/`db:types` read), but
+ * `nx serve` runs server actions with cwd = apps/nextblock — so we walk up to the
+ * nearest ancestor containing `nx.json`. A standalone create-nextblock project has no
+ * `nx.json`, so we fall back to cwd (its own root, where `next dev` runs).
+ */
+function resolveEnvDir(): string {
+  let dir = process.cwd();
+  for (let i = 0; i < 8; i++) {
+    if (existsSync(path.join(dir, 'nx.json'))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.cwd();
+}
+
+/** 64-char (32-byte) hex secret. Matches tools/scripts/lib/supabase-keys.mjs. */
+export function generateSecret(): string {
+  return randomBytes(32).toString('hex');
+}
+
+/** Read a `KEY=` value from an .env body (tolerates surrounding quotes). */
+function readEnvValue(envContent: string, key: string): string {
+  for (const line of envContent.split(/\r?\n/)) {
+    if (line.startsWith(`${key}=`)) {
+      return line
+        .slice(key.length + 1)
+        .trim()
+        .replace(/^"(.*)"$/, '$1');
+    }
+  }
+  return '';
+}
+
+/** Apply `KEY=value` replacements line-by-line, appending keys not already present. */
+function upsertEnv(envContent: string, replacements: Record<string, string>): string {
+  const applied = new Set<string>();
+  const lines = envContent.split(/\r?\n/).map((line) => {
+    for (const [key, value] of Object.entries(replacements)) {
+      if (line.startsWith(`${key}=`)) {
+        applied.add(key);
+        return `${key}=${value}`;
+      }
+    }
+    return line;
+  });
+
+  for (const [key, value] of Object.entries(replacements)) {
+    if (!applied.has(key)) {
+      lines.push(`${key}=${value}`);
+    }
+  }
+
+  return lines.join('\n');
+}
+
+const ROTATING_SECRET_KEYS = ['CRON_SECRET', 'DRAFT_MODE_SECRET', 'REVALIDATE_SECRET_TOKEN'];
+
+/**
+ * Write KEY=value pairs to `.env.local` at the working directory AND mirror them into
+ * the live `process.env` so the running dev server can use them for server-side work
+ * (schema probe, admin creation) without a hard restart.
+ *
+ * Caveat the caller must surface: `NEXT_PUBLIC_*` values are inlined into client
+ * bundles at build/compile time, so the browser-side Supabase client still needs a
+ * dev-server restart to pick them up. No-op (returns false) outside a local writable
+ * environment (Vercel/Docker runner are read-only / platform-managed).
+ */
+export async function writeEnvLocal(values: Record<string, string>): Promise<boolean> {
+  if (!isLocalWritableEnv()) return false;
+
+  const envPath = path.join(resolveEnvDir(), '.env.local');
+  let existing = '';
+  try {
+    existing = await readFile(envPath, 'utf8');
+  } catch {
+    existing = '';
+  }
+
+  // Generate the three rotating secrets only if absent (idempotent), like setup.mjs.
+  const ensured: Record<string, string> = { ...values };
+  for (const key of ROTATING_SECRET_KEYS) {
+    if (!ensured[key] && !readEnvValue(existing, key)) {
+      ensured[key] = generateSecret();
+    }
+  }
+
+  const next = upsertEnv(existing, ensured);
+  await writeFile(envPath, next.endsWith('\n') ? next : `${next}\n`, 'utf8');
+
+  for (const [key, value] of Object.entries(ensured)) {
+    process.env[key] = value;
+  }
+
+  return true;
+}