create-nextblock 0.16.4 → 0.17.0

package/templates/nextblock-template/lib/media/youtube.ts

@@ -1,99 +1,99 @@
-// Shared YouTube URL normalization.
-//
-// No public render path may emit a www.youtube.com iframe: the player writes
-// cookies via document.cookie on load (TESTCOOKIESENABLED, LAST_RESULT_ENTRY_KEY,
-// ExcludeSameSiteUnspecifiedTreatedAsLax) which Chrome logs as a DevTools "Cookie"
-// issue and Lighthouse fails through the `inspector-issues` audit (Best Practices
-// 26/27 = 96). Switching to youtube-nocookie.com does NOT stop those writes --
-// only not loading the player does. See components/media/YouTubeFacade.tsx.
-
-const YOUTUBE_HOST_RE = /^(?:www\.|m\.|music\.)?(?:youtube\.com|youtube-nocookie\.com)$/i;
-const YOUTU_BE_RE = /^(?:www\.)?youtu\.be$/i;
-const VIDEO_ID_RE = /^[A-Za-z0-9_-]{6,20}$/;
-
-export interface ParsedYouTubeUrl {
-  videoId: string;
-  /** Extra player params carried over from the source URL (v/si/autoplay stripped). */
-  params: URLSearchParams;
-}
-
-/**
- * Accepts every shape an author can paste or that YouTube's Share > Embed panel
- * emits: watch?v= (v anywhere in the query), youtu.be/, /embed/, /shorts/,
- * /live/, /v/, m. and music. subdomains, and youtube-nocookie.com/embed/.
- * Returns null for non-YouTube URLs.
- */
-export function parseYouTubeUrl(rawUrl: string | undefined | null): ParsedYouTubeUrl | null {
-  if (!rawUrl) return null;
-  let url: URL;
-  try {
-    url = new URL(rawUrl, 'https://www.youtube.com');
-  } catch {
-    return null;
-  }
-
-  let videoId = '';
-  if (YOUTU_BE_RE.test(url.hostname)) {
-    videoId = url.pathname.split('/').filter(Boolean)[0] || '';
-  } else if (YOUTUBE_HOST_RE.test(url.hostname)) {
-    const segments = url.pathname.split('/').filter(Boolean);
-    const head = segments[0] || '';
-    if (head === 'watch') {
-      videoId = url.searchParams.get('v') || '';
-    } else if (head === 'embed' || head === 'shorts' || head === 'live' || head === 'v') {
-      videoId = segments[1] || '';
-    }
-  }
-  if (!VIDEO_ID_RE.test(videoId)) return null;
-
-  const params = new URLSearchParams(url.search);
-  params.delete('v');
-  params.delete('si'); // share-tracking token, not needed for playback
-  // Never auto-start on load: an autoplaying frame boots the player (and its
-  // cookie writes) during a Lighthouse run. The facade re-adds autoplay=1 only
-  // after a real user click.
-  params.delete('autoplay');
-  return { videoId, params };
-}
-
-export function buildNoCookieEmbedUrl(
-  videoId: string,
-  params?: URLSearchParams,
-  opts?: { autoplay?: boolean }
-): string {
-  const search = new URLSearchParams(params ? params.toString() : '');
-  if (opts?.autoplay) search.set('autoplay', '1');
-  const qs = search.toString();
-  return `https://www.youtube-nocookie.com/embed/${videoId}${qs ? `?${qs}` : ''}`;
-}
-
-/** Last-resort string rewrite for raw-HTML paths that cannot be parsed into nodes. */
-export function rewriteYouTubeHostsInHtml(html: string): string {
-  if (!html) return html;
-  return html.replace(
-    /(?:https?:)?\/\/(?:www\.|m\.|music\.)?youtube\.com\/embed\//gi,
-    'https://www.youtube-nocookie.com/embed/'
-  );
-}
-
-export type YouTubePosterQuality = 'maxres' | 'hq';
-
-/**
- * Intrinsic size of each poster variant. maxresdefault is 16:9 but is not
- * uploaded for every video; hqdefault always exists and is 4:3 (the frame is
- * letterboxed inside it), which is why the facade object-covers the poster.
- */
-export const YOUTUBE_POSTER_DIMENSIONS: Record<
-  YouTubePosterQuality,
-  { width: number; height: number }
-> = {
-  maxres: { width: 1280, height: 720 },
-  hq: { width: 480, height: 360 },
-};
-
-export function youTubePosterUrl(
-  videoId: string,
-  quality: YouTubePosterQuality = 'maxres'
-): string {
-  return `https://i.ytimg.com/vi/${videoId}/${quality === 'maxres' ? 'maxresdefault' : 'hqdefault'}.jpg`;
-}
+// Shared YouTube URL normalization.
+//
+// No public render path may emit a www.youtube.com iframe: the player writes
+// cookies via document.cookie on load (TESTCOOKIESENABLED, LAST_RESULT_ENTRY_KEY,
+// ExcludeSameSiteUnspecifiedTreatedAsLax) which Chrome logs as a DevTools "Cookie"
+// issue and Lighthouse fails through the `inspector-issues` audit (Best Practices
+// 26/27 = 96). Switching to youtube-nocookie.com does NOT stop those writes --
+// only not loading the player does. See components/media/YouTubeFacade.tsx.
+
+const YOUTUBE_HOST_RE = /^(?:www\.|m\.|music\.)?(?:youtube\.com|youtube-nocookie\.com)$/i;
+const YOUTU_BE_RE = /^(?:www\.)?youtu\.be$/i;
+const VIDEO_ID_RE = /^[A-Za-z0-9_-]{6,20}$/;
+
+export interface ParsedYouTubeUrl {
+  videoId: string;
+  /** Extra player params carried over from the source URL (v/si/autoplay stripped). */
+  params: URLSearchParams;
+}
+
+/**
+ * Accepts every shape an author can paste or that YouTube's Share > Embed panel
+ * emits: watch?v= (v anywhere in the query), youtu.be/, /embed/, /shorts/,
+ * /live/, /v/, m. and music. subdomains, and youtube-nocookie.com/embed/.
+ * Returns null for non-YouTube URLs.
+ */
+export function parseYouTubeUrl(rawUrl: string | undefined | null): ParsedYouTubeUrl | null {
+  if (!rawUrl) return null;
+  let url: URL;
+  try {
+    url = new URL(rawUrl, 'https://www.youtube.com');
+  } catch {
+    return null;
+  }
+
+  let videoId = '';
+  if (YOUTU_BE_RE.test(url.hostname)) {
+    videoId = url.pathname.split('/').filter(Boolean)[0] || '';
+  } else if (YOUTUBE_HOST_RE.test(url.hostname)) {
+    const segments = url.pathname.split('/').filter(Boolean);
+    const head = segments[0] || '';
+    if (head === 'watch') {
+      videoId = url.searchParams.get('v') || '';
+    } else if (head === 'embed' || head === 'shorts' || head === 'live' || head === 'v') {
+      videoId = segments[1] || '';
+    }
+  }
+  if (!VIDEO_ID_RE.test(videoId)) return null;
+
+  const params = new URLSearchParams(url.search);
+  params.delete('v');
+  params.delete('si'); // share-tracking token, not needed for playback
+  // Never auto-start on load: an autoplaying frame boots the player (and its
+  // cookie writes) during a Lighthouse run. The facade re-adds autoplay=1 only
+  // after a real user click.
+  params.delete('autoplay');
+  return { videoId, params };
+}
+
+export function buildNoCookieEmbedUrl(
+  videoId: string,
+  params?: URLSearchParams,
+  opts?: { autoplay?: boolean }
+): string {
+  const search = new URLSearchParams(params ? params.toString() : '');
+  if (opts?.autoplay) search.set('autoplay', '1');
+  const qs = search.toString();
+  return `https://www.youtube-nocookie.com/embed/${videoId}${qs ? `?${qs}` : ''}`;
+}
+
+/** Last-resort string rewrite for raw-HTML paths that cannot be parsed into nodes. */
+export function rewriteYouTubeHostsInHtml(html: string): string {
+  if (!html) return html;
+  return html.replace(
+    /(?:https?:)?\/\/(?:www\.|m\.|music\.)?youtube\.com\/embed\//gi,
+    'https://www.youtube-nocookie.com/embed/'
+  );
+}
+
+export type YouTubePosterQuality = 'maxres' | 'hq';
+
+/**
+ * Intrinsic size of each poster variant. maxresdefault is 16:9 but is not
+ * uploaded for every video; hqdefault always exists and is 4:3 (the frame is
+ * letterboxed inside it), which is why the facade object-covers the poster.
+ */
+export const YOUTUBE_POSTER_DIMENSIONS: Record<
+  YouTubePosterQuality,
+  { width: number; height: number }
+> = {
+  maxres: { width: 1280, height: 720 },
+  hq: { width: 480, height: 360 },
+};
+
+export function youTubePosterUrl(
+  videoId: string,
+  quality: YouTubePosterQuality = 'maxres'
+): string {
+  return `https://i.ytimg.com/vi/${videoId}/${quality === 'maxres' ? 'maxresdefault' : 'hqdefault'}.jpg`;
+}

package/templates/nextblock-template/lib/onboarding/actions.ts

@@ -1,31 +1,31 @@
-'use server';
-
-import { createClient } from '@nextblock-cms/db/server';
-import { revalidatePath } from 'next/cache';
-
-/** Persist the onboarding dismiss flag in the `onboarding_state` row (read-merge). */
-export async function setOnboardingDismissed(dismissed: boolean) {
-  const supabase = createClient();
-
-  const { data: existing } = await supabase
-    .from('site_settings')
-    .select('value')
-    .eq('key', 'onboarding_state')
-    .maybeSingle();
-
-  const current =
-    existing?.value && typeof existing.value === 'object' && !Array.isArray(existing.value)
-      ? (existing.value as Record<string, unknown>)
-      : {};
-
-  const { error } = await supabase
-    .from('site_settings')
-    .upsert({ key: 'onboarding_state', value: { ...current, dismissed } });
-
-  if (error) {
-    console.error('Error updating onboarding state:', error.message);
-    throw new Error('Failed to update onboarding state.');
-  }
-
-  revalidatePath('/cms/dashboard');
-}
+'use server';
+
+import { createClient } from '@nextblock-cms/db/server';
+import { revalidatePath } from 'next/cache';
+
+/** Persist the onboarding dismiss flag in the `onboarding_state` row (read-merge). */
+export async function setOnboardingDismissed(dismissed: boolean) {
+  const supabase = createClient();
+
+  const { data: existing } = await supabase
+    .from('site_settings')
+    .select('value')
+    .eq('key', 'onboarding_state')
+    .maybeSingle();
+
+  const current =
+    existing?.value && typeof existing.value === 'object' && !Array.isArray(existing.value)
+      ? (existing.value as Record<string, unknown>)
+      : {};
+
+  const { error } = await supabase
+    .from('site_settings')
+    .upsert({ key: 'onboarding_state', value: { ...current, dismissed } });
+
+  if (error) {
+    console.error('Error updating onboarding state:', error.message);
+    throw new Error('Failed to update onboarding state.');
+  }
+
+  revalidatePath('/cms/dashboard');
+}

package/templates/nextblock-template/lib/privacy/consent-client.ts

@@ -1,57 +1,57 @@
-// Client-side consent cookie helpers. Safe to import from client components only.
-// The cookie is intentionally NOT HttpOnly so the analytics guard can read it
-// before any third-party request is made.
-import {
-  CONSENT_COOKIE_MAX_AGE,
-  CONSENT_COOKIE_NAME,
-  type ConsentPreference,
-} from './types';
-
-/** Window event dispatched when the visitor changes their consent choice. */
-export const CONSENT_CHANGE_EVENT = 'nb:consent-change';
-
-export function readConsent(): ConsentPreference | null {
-  if (typeof document === 'undefined') return null;
-  const entry = document.cookie
-    .split('; ')
-    .find((row) => row.startsWith(`${CONSENT_COOKIE_NAME}=`));
-  if (!entry) return null;
-  try {
-    const raw = decodeURIComponent(entry.slice(CONSENT_COOKIE_NAME.length + 1));
-    const parsed = JSON.parse(raw) as Partial<ConsentPreference>;
-    if (!parsed || typeof parsed !== 'object') return null;
-    return {
-      necessary: true,
-      analytics: Boolean(parsed.analytics),
-      marketing: Boolean(parsed.marketing),
-      token: typeof parsed.token === 'string' ? parsed.token : '',
-      ts: typeof parsed.ts === 'number' ? parsed.ts : 0,
-    };
-  } catch {
-    return null;
-  }
-}
-
-function randomToken(): string {
-  if (typeof window !== 'undefined' && window.crypto?.randomUUID) {
-    return window.crypto.randomUUID();
-  }
-  return `${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
-}
-
-/** Persist a consent decision, broadcast the change, and return the record. */
-export function writeConsent(choice: { analytics: boolean; marketing: boolean }): ConsentPreference {
-  const value: ConsentPreference = {
-    necessary: true,
-    analytics: choice.analytics,
-    marketing: choice.marketing,
-    token: randomToken(),
-    ts: Date.now(),
-  };
-  const secure = typeof location !== 'undefined' && location.protocol === 'https:' ? '; Secure' : '';
-  document.cookie =
-    `${CONSENT_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(value))}` +
-    `; Max-Age=${CONSENT_COOKIE_MAX_AGE}; Path=/; SameSite=Lax${secure}`;
-  window.dispatchEvent(new CustomEvent<ConsentPreference>(CONSENT_CHANGE_EVENT, { detail: value }));
-  return value;
-}
+// Client-side consent cookie helpers. Safe to import from client components only.
+// The cookie is intentionally NOT HttpOnly so the analytics guard can read it
+// before any third-party request is made.
+import {
+  CONSENT_COOKIE_MAX_AGE,
+  CONSENT_COOKIE_NAME,
+  type ConsentPreference,
+} from './types';
+
+/** Window event dispatched when the visitor changes their consent choice. */
+export const CONSENT_CHANGE_EVENT = 'nb:consent-change';
+
+export function readConsent(): ConsentPreference | null {
+  if (typeof document === 'undefined') return null;
+  const entry = document.cookie
+    .split('; ')
+    .find((row) => row.startsWith(`${CONSENT_COOKIE_NAME}=`));
+  if (!entry) return null;
+  try {
+    const raw = decodeURIComponent(entry.slice(CONSENT_COOKIE_NAME.length + 1));
+    const parsed = JSON.parse(raw) as Partial<ConsentPreference>;
+    if (!parsed || typeof parsed !== 'object') return null;
+    return {
+      necessary: true,
+      analytics: Boolean(parsed.analytics),
+      marketing: Boolean(parsed.marketing),
+      token: typeof parsed.token === 'string' ? parsed.token : '',
+      ts: typeof parsed.ts === 'number' ? parsed.ts : 0,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function randomToken(): string {
+  if (typeof window !== 'undefined' && window.crypto?.randomUUID) {
+    return window.crypto.randomUUID();
+  }
+  return `${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+}
+
+/** Persist a consent decision, broadcast the change, and return the record. */
+export function writeConsent(choice: { analytics: boolean; marketing: boolean }): ConsentPreference {
+  const value: ConsentPreference = {
+    necessary: true,
+    analytics: choice.analytics,
+    marketing: choice.marketing,
+    token: randomToken(),
+    ts: Date.now(),
+  };
+  const secure = typeof location !== 'undefined' && location.protocol === 'https:' ? '; Secure' : '';
+  document.cookie =
+    `${CONSENT_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(value))}` +
+    `; Max-Age=${CONSENT_COOKIE_MAX_AGE}; Path=/; SameSite=Lax${secure}`;
+  window.dispatchEvent(new CustomEvent<ConsentPreference>(CONSENT_CHANGE_EVENT, { detail: value }));
+  return value;
+}

package/templates/nextblock-template/lib/privacy/contact-emails.ts

@@ -1,64 +1,64 @@
-// Server-only resolution of the public-facing contact addresses that used to be
-// hard-coded into seed data. The goal: a downloaded/self-hosted copy of NextBlock
-// must NEVER route mail to the original authors. Real addresses live only in
-// sandbox env vars (never committed); committed seeds use neutral @example.com
-// placeholders.
-//
-// Resolution precedence (highest first):
-//   1. The admin-configured value (CMS Settings -> Privacy "Support email").
-//   2. The sandbox env var, but only when NEXT_PUBLIC_IS_SANDBOX === 'true'.
-//   3. A neutral @example.com placeholder.
-//
-// Sandbox DB resets re-seed dummy values on every run, so a static seed value
-// could never stay correct for the hosted demo — hence env-var-backed resolution
-// at render time instead of baking the address into the migration.
-import 'server-only';
-import { cache } from 'react';
-import { getPrivacySettings } from './settings';
-
-/** Neutral placeholder shown when nothing is configured (real installs). */
-const DUMMY_PRIVACY_EMAIL = 'privacy@example.com';
-
-/** Merge tag seeded into the Privacy Policy / Terms page copy. */
-export const PRIVACY_EMAIL_TAG = '{{privacy_email}}';
-
-function isSandbox(): boolean {
-  return process.env.NEXT_PUBLIC_IS_SANDBOX === 'true';
-}
-
-/**
- * Resolve the privacy/legal contact address. `supportEmail` is the admin-set
- * value from privacy settings (reused as the legal contact per product choice).
- */
-export function resolvePrivacyEmail(supportEmail: string): string {
-  const configured = supportEmail.trim();
-  if (configured) return configured;
-
-  if (isSandbox()) {
-    const fromEnv = process.env.SANDBOX_PRIVACY_EMAIL?.trim();
-    if (fromEnv) return fromEnv;
-  }
-
-  return DUMMY_PRIVACY_EMAIL;
-}
-
-/**
- * Per-request cached read of the resolved privacy email. Wrapped in React
- * `cache()` so the many text blocks on a legal page share a single settings
- * lookup within one render.
- */
-export const getPrivacyMergeEmail = cache(async (): Promise<string> => {
-  const settings = await getPrivacySettings();
-  return resolvePrivacyEmail(settings.corporate.support_email);
-});
-
-/**
- * Substitute supported merge tags in a block's HTML. Callers should guard with a
- * cheap `html.includes('{{')` check first so normal blocks pay nothing.
- * Currently supports `{{privacy_email}}` (text and `mailto:` href forms).
- */
-export async function substitutePrivacyMergeTags(html: string): Promise<string> {
-  if (!html.includes(PRIVACY_EMAIL_TAG)) return html;
-  const email = await getPrivacyMergeEmail();
-  return html.split(PRIVACY_EMAIL_TAG).join(email);
-}
+// Server-only resolution of the public-facing contact addresses that used to be
+// hard-coded into seed data. The goal: a downloaded/self-hosted copy of NextBlock
+// must NEVER route mail to the original authors. Real addresses live only in
+// sandbox env vars (never committed); committed seeds use neutral @example.com
+// placeholders.
+//
+// Resolution precedence (highest first):
+//   1. The admin-configured value (CMS Settings -> Privacy "Support email").
+//   2. The sandbox env var, but only when NEXT_PUBLIC_IS_SANDBOX === 'true'.
+//   3. A neutral @example.com placeholder.
+//
+// Sandbox DB resets re-seed dummy values on every run, so a static seed value
+// could never stay correct for the hosted demo — hence env-var-backed resolution
+// at render time instead of baking the address into the migration.
+import 'server-only';
+import { cache } from 'react';
+import { getPrivacySettings } from './settings';
+
+/** Neutral placeholder shown when nothing is configured (real installs). */
+const DUMMY_PRIVACY_EMAIL = 'privacy@example.com';
+
+/** Merge tag seeded into the Privacy Policy / Terms page copy. */
+export const PRIVACY_EMAIL_TAG = '{{privacy_email}}';
+
+function isSandbox(): boolean {
+  return process.env.NEXT_PUBLIC_IS_SANDBOX === 'true';
+}
+
+/**
+ * Resolve the privacy/legal contact address. `supportEmail` is the admin-set
+ * value from privacy settings (reused as the legal contact per product choice).
+ */
+export function resolvePrivacyEmail(supportEmail: string): string {
+  const configured = supportEmail.trim();
+  if (configured) return configured;
+
+  if (isSandbox()) {
+    const fromEnv = process.env.SANDBOX_PRIVACY_EMAIL?.trim();
+    if (fromEnv) return fromEnv;
+  }
+
+  return DUMMY_PRIVACY_EMAIL;
+}
+
+/**
+ * Per-request cached read of the resolved privacy email. Wrapped in React
+ * `cache()` so the many text blocks on a legal page share a single settings
+ * lookup within one render.
+ */
+export const getPrivacyMergeEmail = cache(async (): Promise<string> => {
+  const settings = await getPrivacySettings();
+  return resolvePrivacyEmail(settings.corporate.support_email);
+});
+
+/**
+ * Substitute supported merge tags in a block's HTML. Callers should guard with a
+ * cheap `html.includes('{{')` check first so normal blocks pay nothing.
+ * Currently supports `{{privacy_email}}` (text and `mailto:` href forms).
+ */
+export async function substitutePrivacyMergeTags(html: string): Promise<string> {
+  if (!html.includes(PRIVACY_EMAIL_TAG)) return html;
+  const email = await getPrivacyMergeEmail();
+  return html.split(PRIVACY_EMAIL_TAG).join(email);
+}