create-nextblock 0.16.4 → 0.17.1

package/templates/nextblock-template/.browserslistrc

@@ -1,11 +1,11 @@
-chrome >= 109
-edge >= 109
-firefox >= 115
-safari >= 15.4
-ios_saf >= 15.4
-and_chr >= 109
-and_ff >= 115
-samsung >= 21
-opera >= 95
-not dead
-not op_mini all
+chrome >= 109
+edge >= 109
+firefox >= 115
+safari >= 15.4
+ios_saf >= 15.4
+and_chr >= 109
+and_ff >= 115
+samsung >= 21
+opera >= 95
+not dead
+not op_mini all

package/templates/nextblock-template/.swcrc

@@ -1,30 +1,30 @@
-{
-  "jsc": {
-    "target": "es2022",
-    "parser": {
-      "syntax": "typescript",
-      "decorators": true,
-      "dynamicImport": true
-    },
-    "transform": {
-      "decoratorMetadata": true,
-      "legacyDecorator": true
-    },
-    "keepClassNames": true,
-    "externalHelpers": true,
-    "loose": true
-  },
-  "module": {
-    "type": "commonjs"
-  },
-  "sourceMaps": true,
-  "exclude": [
-    "jest.config.ts",
-    ".*\\.spec.tsx?$",
-    ".*\\.test.tsx?$",
-    "./src/jest-setup.ts$",
-    "./**/jest-setup.ts$",
-    ".*.js$",
-    ".*.d.ts$"
-  ]
-}
+{
+  "jsc": {
+    "target": "es2022",
+    "parser": {
+      "syntax": "typescript",
+      "decorators": true,
+      "dynamicImport": true
+    },
+    "transform": {
+      "decoratorMetadata": true,
+      "legacyDecorator": true
+    },
+    "keepClassNames": true,
+    "externalHelpers": true,
+    "loose": true
+  },
+  "module": {
+    "type": "commonjs"
+  },
+  "sourceMaps": true,
+  "exclude": [
+    "jest.config.ts",
+    ".*\\.spec.tsx?$",
+    ".*\\.test.tsx?$",
+    "./src/jest-setup.ts$",
+    "./**/jest-setup.ts$",
+    ".*.js$",
+    ".*.d.ts$"
+  ]
+}

package/templates/nextblock-template/CLAUDE.md

@@ -1 +1,27 @@
 @AGENTS.md
+
+# apps/nextblock — the NextBlock app
+
+Next.js 16 App Router app: public site, CMS under `app/cms`, API routes under `app/api`,
+first-boot wizard under `app/setup`. Standalone projects are a copy of this directory with
+`@nextblock-cms/*` installed from npm.
+
+## Map
+- `proxy.ts` (Next 16 middleware): `/setup` gate, DB redirects, CSP nonce, `/cms` session + role
+  checks (`/cms/admin|users|settings` ADMIN-only); `app/cms/layout.tsx` adds 2FA.
+- `lib/blocks/blockRegistry.ts` + `blockTypes.ts`: built-in block schemas and defaults.
+  `components/BlockRenderer.tsx` resolves `block_type` via `components/blocks/publicRendererLoaders.ts`,
+  then the ecommerce loaders, then custom blocks; unknown types render null unless editing.
+- Block row writes (delete+insert): `app/actions/visualEditingActions.ts`, `app/cms/revisions/service.ts`,
+  `lib/cms-transfer/server.ts`, `lib/visual-editing/product-drafts.ts`.
+- `lib/setup/env-status.ts` resolves Supabase env; keep it free of Node/Supabase imports.
+
+## Commands
+Monorepo: `npx nx serve nextblock`, `npx nx build nextblock`, `npx vitest run apps/nextblock/<file>`.
+Standalone: `npm run dev`, `npm run build`.
+
+## Rules
+- Import `z` from `lib/zod-config.ts` (jitless; the prod CSP bans eval).
+- Server modules `import 'server-only'`; set `export const runtime = 'nodejs'` on Node-only route handlers.
+- Generated, never edit: `lib/setup/migrations-bundle.ts`, `app/api/cron/reset-sandbox/sandboxResetSql.ts`,
+  `lib/custom-block-safelist.ts`, `next-env.d.ts`, the Next block in `AGENTS.md`.

package/templates/nextblock-template/app/(auth-pages)/sign-up/page.tsx

@@ -1,46 +1,46 @@
-import { Suspense } from "react";
-import { headers } from "next/headers";
-import { createClient } from "@nextblock-cms/db/server";
-import SignUpForm from "./SignUpForm";
-
-type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
-
-// Server wrapper: resolves the site-wide bot-protection provider + site key
-// (CMS → Settings → Bot Protection) and the CSP nonce, then hands them to the
-// interactive client form. Mirrors the read in components/BlockRenderer.tsx.
-export default async function SignUpPage() {
-  let scriptNonce = '';
-  try {
-    scriptNonce = (await headers()).get('x-nonce') || '';
-  } catch (e) {
-    console.error('[Bot Protection] Error loading CSP nonce on sign-up page:', e);
-  }
-
-  let botProtection: { provider: BotProtectionProvider; siteKey: string } = {
-    provider: 'none',
-    siteKey: '',
-  };
-  try {
-    const supabase = createClient();
-    const { data: publicSetting } = await supabase
-      .from('site_settings')
-      .select('value')
-      .eq('key', 'bot_protection_public')
-      .maybeSingle();
-    if (publicSetting?.value) {
-      const publicVal = publicSetting.value as Record<string, any>;
-      botProtection = {
-        provider: publicVal.provider || 'none',
-        siteKey: publicVal.siteKey || '',
-      };
-    }
-  } catch (e) {
-    console.error('[Bot Protection] Error loading settings on sign-up page:', e);
-  }
-
-  return (
-    <Suspense fallback={null}>
-      <SignUpForm botProtection={botProtection} scriptNonce={scriptNonce} />
-    </Suspense>
-  );
-}
+import { Suspense } from "react";
+import { headers } from "next/headers";
+import { createClient } from "@nextblock-cms/db/server";
+import SignUpForm from "./SignUpForm";
+
+type BotProtectionProvider = 'none' | 'turnstile' | 'recaptcha';
+
+// Server wrapper: resolves the site-wide bot-protection provider + site key
+// (CMS → Settings → Bot Protection) and the CSP nonce, then hands them to the
+// interactive client form. Mirrors the read in components/BlockRenderer.tsx.
+export default async function SignUpPage() {
+  let scriptNonce = '';
+  try {
+    scriptNonce = (await headers()).get('x-nonce') || '';
+  } catch (e) {
+    console.error('[Bot Protection] Error loading CSP nonce on sign-up page:', e);
+  }
+
+  let botProtection: { provider: BotProtectionProvider; siteKey: string } = {
+    provider: 'none',
+    siteKey: '',
+  };
+  try {
+    const supabase = createClient();
+    const { data: publicSetting } = await supabase
+      .from('site_settings')
+      .select('value')
+      .eq('key', 'bot_protection_public')
+      .maybeSingle();
+    if (publicSetting?.value) {
+      const publicVal = publicSetting.value as Record<string, any>;
+      botProtection = {
+        provider: publicVal.provider || 'none',
+        siteKey: publicVal.siteKey || '',
+      };
+    }
+  } catch (e) {
+    console.error('[Bot Protection] Error loading settings on sign-up page:', e);
+  }
+
+  return (
+    <Suspense fallback={null}>
+      <SignUpForm botProtection={botProtection} scriptNonce={scriptNonce} />
+    </Suspense>
+  );
+}

package/templates/nextblock-template/app/(auth-pages)/two-factor/page.tsx

@@ -1,51 +1,51 @@
-import { redirect } from 'next/navigation';
-import { createClient } from '@nextblock-cms/db/server';
-import {
-  evaluateTwoFactor,
-  hasPendingEmailChallenge,
-} from '../../../lib/auth/twoFactor';
-import TwoFactorForm from './components/TwoFactorForm';
-
-function safeRedirect(path?: string): string {
-  return path && path.startsWith('/') && !path.startsWith('//') ? path : '/cms/dashboard';
-}
-
-export default async function TwoFactorPage({
-  searchParams,
-}: {
-  searchParams: Promise<{ redirect_to?: string }>;
-}) {
-  const params = await searchParams;
-  const redirectTo = safeRedirect(params.redirect_to);
-
-  const evaluation = await evaluateTwoFactor();
-  const userId = evaluation.userId;
-  if (!userId) {
-    redirect('/sign-in');
-  }
-  // Already satisfied (or no MFA) -> straight through.
-  if (evaluation.status === 'satisfied' || evaluation.status === 'not_required') {
-    redirect(redirectTo);
-  }
-
-  const type = evaluation.status === 'totp_required' ? 'totp' : 'email';
-
-  const supabase = createClient();
-  const {
-    data: { user },
-  } = await supabase.auth.getUser();
-
-  const pendingEmailCode =
-    type === 'email' ? await hasPendingEmailChallenge(userId) : false;
-
-  return (
-    <div className="flex-1 flex flex-col w-full max-w-md mx-auto py-10">
-      <TwoFactorForm
-        type={type}
-        email={user?.email ?? ''}
-        redirectTo={redirectTo}
-        pendingEmailCode={pendingEmailCode}
-      />
-    </div>
-  );
-}
+import { redirect } from 'next/navigation';
+import { createClient } from '@nextblock-cms/db/server';
+import {
+  evaluateTwoFactor,
+  hasPendingEmailChallenge,
+} from '../../../lib/auth/twoFactor';
+import TwoFactorForm from './components/TwoFactorForm';
+
+function safeRedirect(path?: string): string {
+  return path && path.startsWith('/') && !path.startsWith('//') ? path : '/cms/dashboard';
+}
+
+export default async function TwoFactorPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ redirect_to?: string }>;
+}) {
+  const params = await searchParams;
+  const redirectTo = safeRedirect(params.redirect_to);
+
+  const evaluation = await evaluateTwoFactor();
+  const userId = evaluation.userId;
+  if (!userId) {
+    redirect('/sign-in');
+  }
+  // Already satisfied (or no MFA) -> straight through.
+  if (evaluation.status === 'satisfied' || evaluation.status === 'not_required') {
+    redirect(redirectTo);
+  }
+
+  const type = evaluation.status === 'totp_required' ? 'totp' : 'email';
+
+  const supabase = createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  const pendingEmailCode =
+    type === 'email' ? await hasPendingEmailChallenge(userId) : false;
+
+  return (
+    <div className="flex-1 flex flex-col w-full max-w-md mx-auto py-10">
+      <TwoFactorForm
+        type={type}
+        email={user?.email ?? ''}
+        redirectTo={redirectTo}
+        pendingEmailCode={pendingEmailCode}
+      />
+    </div>
+  );
+}

package/templates/nextblock-template/app/.well-known/ucp/route.ts

@@ -1,16 +1,16 @@
-import { NextResponse } from 'next/server';
-import { buildUcpProfile } from '../../lib/ucp/protocol';
-
-export const dynamic = 'force-dynamic';
-export const runtime = 'nodejs';
-
-export async function GET(request: Request) {
-  const baseUrl =
-    process.env.NEXT_PUBLIC_URL?.replace(/\/+$/, '') || new URL(request.url).origin;
-
-  return NextResponse.json(buildUcpProfile(baseUrl), {
-    headers: {
-      'Cache-Control': 'public, max-age=300, s-maxage=300',
-    },
-  });
-}
+import { NextResponse } from 'next/server';
+import { buildUcpProfile } from '../../lib/ucp/protocol';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function GET(request: Request) {
+  const baseUrl =
+    process.env.NEXT_PUBLIC_URL?.replace(/\/+$/, '') || new URL(request.url).origin;
+
+  return NextResponse.json(buildUcpProfile(baseUrl), {
+    headers: {
+      'Cache-Control': 'public, max-age=300, s-maxage=300',
+    },
+  });
+}

package/templates/nextblock-template/app/actions/consent.ts

@@ -1,57 +1,57 @@
-'use server';
-
-import { headers } from 'next/headers';
-import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
-
-/** Reduce an IP to a non-identifying form for the consent audit log. */
-function maskIp(ip: string | null): string | null {
-  if (!ip) return null;
-  const first = ip.split(',')[0]?.trim();
-  if (!first) return null;
-  if (first.includes(':')) {
-    // IPv6: keep the first three hextets, drop the rest.
-    const hextets = first.split(':').filter(Boolean);
-    return `${hextets.slice(0, 3).join(':')}::x`;
-  }
-  const octets = first.split('.');
-  if (octets.length === 4) {
-    octets[3] = 'x';
-    return octets.join('.');
-  }
-  return null;
-}
-
-export interface ConsentLogInput {
-  token: string;
-  analytics: boolean;
-  marketing: boolean;
-}
-
-/**
- * Record a consent decision for Law 25 / PIPEDA accountability. Best-effort:
- * failures never block the visitor's choice from taking effect client-side.
- */
-export async function logConsentDecision(input: ConsentLogInput): Promise<{ ok: boolean }> {
-  if (!input?.token) return { ok: false };
-  try {
-    const h = await headers();
-    const ip = h.get('x-forwarded-for') ?? h.get('x-real-ip');
-    const userAgent = h.get('user-agent');
-
-    const supabase = getServiceRoleSupabaseClient();
-    await supabase.from('privacy_consent_logs').insert({
-      consent_token: input.token,
-      categories: {
-        necessary: true,
-        analytics: Boolean(input.analytics),
-        marketing: Boolean(input.marketing),
-      },
-      ip_masked: maskIp(ip),
-      user_agent: userAgent ? userAgent.slice(0, 500) : null,
-    });
-    return { ok: true };
-  } catch (error) {
-    console.error('Failed to record consent decision:', error);
-    return { ok: false };
-  }
-}
+'use server';
+
+import { headers } from 'next/headers';
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+/** Reduce an IP to a non-identifying form for the consent audit log. */
+function maskIp(ip: string | null): string | null {
+  if (!ip) return null;
+  const first = ip.split(',')[0]?.trim();
+  if (!first) return null;
+  if (first.includes(':')) {
+    // IPv6: keep the first three hextets, drop the rest.
+    const hextets = first.split(':').filter(Boolean);
+    return `${hextets.slice(0, 3).join(':')}::x`;
+  }
+  const octets = first.split('.');
+  if (octets.length === 4) {
+    octets[3] = 'x';
+    return octets.join('.');
+  }
+  return null;
+}
+
+export interface ConsentLogInput {
+  token: string;
+  analytics: boolean;
+  marketing: boolean;
+}
+
+/**
+ * Record a consent decision for Law 25 / PIPEDA accountability. Best-effort:
+ * failures never block the visitor's choice from taking effect client-side.
+ */
+export async function logConsentDecision(input: ConsentLogInput): Promise<{ ok: boolean }> {
+  if (!input?.token) return { ok: false };
+  try {
+    const h = await headers();
+    const ip = h.get('x-forwarded-for') ?? h.get('x-real-ip');
+    const userAgent = h.get('user-agent');
+
+    const supabase = getServiceRoleSupabaseClient();
+    await supabase.from('privacy_consent_logs').insert({
+      consent_token: input.token,
+      categories: {
+        necessary: true,
+        analytics: Boolean(input.analytics),
+        marketing: Boolean(input.marketing),
+      },
+      ip_masked: maskIp(ip),
+      user_agent: userAgent ? userAgent.slice(0, 500) : null,
+    });
+    return { ok: true };
+  } catch (error) {
+    console.error('Failed to record consent decision:', error);
+    return { ok: false };
+  }
+}

package/templates/nextblock-template/app/actions/twoFactorEmail.ts

@@ -1,22 +1,22 @@
-// Shared transactional email for 2FA codes. Server-only helper (not a server
-// action); callable from sign-in, the challenge page, and the security panel.
-import { sendEmail } from './email';
-
-export async function sendTwoFactorCodeEmail(
-  to: string,
-  code: string,
-  purpose = 'verify your sign-in',
-): Promise<void> {
-  await sendEmail({
-    to,
-    subject: 'Your verification code',
-    text: `Your verification code is ${code}. It expires in 5 minutes. If you didn't request it, you can ignore this email.`,
-    html: `
-  <div style="font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;max-width:480px;margin:0 auto;padding:24px;">
-    {{brand_header}}
-    <p style="font-size:14px;color:#475569;">Use this code to ${purpose}:</p>
-    <p style="font-size:32px;font-weight:700;letter-spacing:8px;margin:16px 0;color:#0f172a;">${code}</p>
-    <p style="font-size:13px;color:#64748b;">This code expires in 5 minutes. If you didn't request it, you can safely ignore this email.</p>
-  </div>`,
-  });
-}
+// Shared transactional email for 2FA codes. Server-only helper (not a server
+// action); callable from sign-in, the challenge page, and the security panel.
+import { sendEmail } from './email';
+
+export async function sendTwoFactorCodeEmail(
+  to: string,
+  code: string,
+  purpose = 'verify your sign-in',
+): Promise<void> {
+  await sendEmail({
+    to,
+    subject: 'Your verification code',
+    text: `Your verification code is ${code}. It expires in 5 minutes. If you didn't request it, you can ignore this email.`,
+    html: `
+  <div style="font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;max-width:480px;margin:0 auto;padding:24px;">
+    {{brand_header}}
+    <p style="font-size:14px;color:#475569;">Use this code to ${purpose}:</p>
+    <p style="font-size:32px;font-weight:700;letter-spacing:8px;margin:16px 0;color:#0f172a;">${code}</p>
+    <p style="font-size:13px;color:#64748b;">This code expires in 5 minutes. If you didn't request it, you can safely ignore this email.</p>
+  </div>`,
+  });
+}