create-nextblock 0.9.92 → 0.9.98

package/templates/nextblock-template/app/lib/site-settings.ts

@@ -2,6 +2,11 @@ import 'server-only';
 import { unstable_cache } from 'next/cache';
 import { createClient as createSupabaseJsClient } from '@supabase/supabase-js';
 import type { Database } from '@nextblock-cms/db';
+import {
+  resolveSupabaseAnonKey,
+  resolveSupabaseServiceKey,
+  resolveSupabaseUrl,
+} from '../../lib/setup/env-status';
 import {
   DEFAULT_SITE_TITLE,
   DEFAULT_SITE_DESCRIPTION,
@@ -28,11 +33,9 @@ export function createStaticSupabaseClient() {
   // (getSiteSettings + the getCached* helpers) already swallow failures and use
   // fallbacks, and loadLayoutData short-circuits before reaching here when there is
   // no Supabase env at all.
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || 'https://dummy.supabase.co';
+  const supabaseUrl = resolveSupabaseUrl() || 'https://dummy.supabase.co';
   const supabaseKey =
-    process.env.SUPABASE_SERVICE_ROLE_KEY ||
-    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
-    'dummy-anon-key';
+    resolveSupabaseServiceKey() || resolveSupabaseAnonKey() || 'dummy-anon-key';
 
   return createSupabaseJsClient<Database>(supabaseUrl, supabaseKey, {
     auth: {

package/templates/nextblock-template/app/page.tsx

@@ -15,6 +15,7 @@ import {
 } from './lib/seo';
 import { getSiteSettings } from './lib/site-settings';
 import { getRequestOrigin } from '../lib/visual-editing/edit-info';
+import { isSupabaseConfigured } from '../lib/setup/env-status';
 
 const DEFAULT_LOCALE = 'en';
 const LANGUAGE_COOKIE_KEY = 'NEXT_USER_LOCALE';
@@ -65,7 +66,7 @@ async function getPreferredLocale() {
 export async function generateMetadata(): Promise<Metadata> {
   // Unconfigured instance (pre-/setup): skip all DB work so metadata generation
   // can't crash the boot. The proxy redirects unconfigured traffic to /setup anyway.
-  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+  if (!isSupabaseConfigured()) {
     return { title: 'NextBlock' };
   }
 

package/templates/nextblock-template/app/product/[slug]/page.tsx

@@ -74,8 +74,15 @@ function resolveCategoryName(category: any, languageCode?: string | null) {
 }
 
 export async function generateStaticParams() {
-  // Unconfigured instance (pre-/setup): no DB to read product slugs from.
-  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+  // Unconfigured instance (pre-/setup): no DB to read product slugs from. Accept every
+  // Supabase key alias the Vercel integration may inject (incl. the new publishable key).
+  const hasSupabaseEnv =
+    (process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL) &&
+    (process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
+      process.env.SUPABASE_ANON_KEY ||
+      process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ||
+      process.env.SUPABASE_PUBLISHABLE_KEY);
+  if (!hasSupabaseEnv) {
     return [];
   }
 

package/templates/nextblock-template/app/robots.txt/route.ts

@@ -1,9 +1,12 @@
+import { resolveSiteUrl, hasResolvedSiteUrl } from '../../lib/site-url';
+
 export async function GET() {
-  const siteUrl = process.env.NEXT_PUBLIC_URL || 'http://localhost:3000';
+  // Explicit NEXT_PUBLIC_URL → Vercel production URL → local-dev fallback.
+  const siteUrl = resolveSiteUrl();
 
-  if (!process.env.NEXT_PUBLIC_URL) {
+  if (!hasResolvedSiteUrl()) {
     console.warn(
-      'Warning: NEXT_PUBLIC_URL environment variable is not set for robots.txt. Defaulting to http://localhost:3000. Ensure this is set for production.'
+      'Warning: no site URL is set for robots.txt (NEXT_PUBLIC_URL / Vercel production URL). Defaulting to http://localhost:3000. Set NEXT_PUBLIC_URL for production.'
     );
   }
 

package/templates/nextblock-template/app/setup/SetupWizard.tsx

@@ -43,6 +43,15 @@ interface SmtpPrefill {
   fromName: string;
 }
 
+export interface SupabaseEnvDetected {
+  NEXT_PUBLIC_SUPABASE_URL: boolean;
+  SUPABASE_URL: boolean;
+  NEXT_PUBLIC_SUPABASE_ANON_KEY: boolean;
+  SUPABASE_ANON_KEY: boolean;
+  SUPABASE_SERVICE_ROLE_KEY: boolean;
+  POSTGRES_URL: boolean;
+}
+
 interface Props {
   channel: DeployChannel;
   configured: boolean;
@@ -51,6 +60,8 @@ interface Props {
   storagePrefill: StoragePrefill;
   smtpPrefill: SmtpPrefill;
   turnstilePrefill: { siteKey: string };
+  /** Which Supabase env vars the running deployment can actually see (read-only channels). */
+  supabaseEnvDetected: SupabaseEnvDetected;
 }
 
 type StepId = 'connection' | 'storage' | 'email' | 'bot' | 'signups' | 'admin';
@@ -80,6 +91,7 @@ export default function SetupWizard({
   storagePrefill,
   smtpPrefill,
   turnstilePrefill,
+  supabaseEnvDetected,
 }: Props) {
   const [isPending, startTransition] = useTransition();
   const [message, setMessage] = useState<Msg>(null);
@@ -114,9 +126,14 @@ export default function SetupWizard({
     if (!configured) {
       list.push('connection');
     }
-    list.push('storage', 'email', 'bot', 'signups', 'admin');
+    // One-click Vercel deploys use the connected Supabase project for media storage with
+    // zero keys (native Supabase Storage), so there's nothing to configure — skip the step.
+    if (channel !== 'vercel') {
+      list.push('storage');
+    }
+    list.push('email', 'bot', 'signups', 'admin');
     return list;
-  }, [configured]);
+  }, [configured, channel]);
 
   const [stepIndex, setStepIndex] = useState(0);
   const current = steps[stepIndex];
@@ -339,12 +356,42 @@ export default function SetupWizard({
                 />
               </Field>
               {!writable && (
-                <Alert variant="destructive" className="py-2 px-4">
-                  <AlertDescription>
-                    This environment is read-only. Set the Supabase variables on your hosting
-                    platform; this step only works in local development.
-                  </AlertDescription>
-                </Alert>
+                <div className="space-y-3 rounded-md border p-4">
+                  <p className="text-sm font-medium">
+                    On {CHANNEL_LABEL[channel]} you don&apos;t fill this in — the database is
+                    connected through your platform&apos;s environment variables (e.g. Vercel&apos;s
+                    Supabase integration).
+                  </p>
+                  <div className="text-xs">
+                    <p className="mb-1 text-muted-foreground">
+                      Supabase variables this deployment can currently see:
+                    </p>
+                    <ul className="space-y-0.5 font-mono">
+                      {(
+                        [
+                          'NEXT_PUBLIC_SUPABASE_URL',
+                          'SUPABASE_URL',
+                          'NEXT_PUBLIC_SUPABASE_ANON_KEY',
+                          'SUPABASE_ANON_KEY',
+                          'SUPABASE_SERVICE_ROLE_KEY',
+                          'POSTGRES_URL',
+                        ] as const
+                      ).map((k) => (
+                        <li key={k}>
+                          {supabaseEnvDetected[k] ? '✅' : '❌'} {k}
+                        </li>
+                      ))}
+                    </ul>
+                  </div>
+                  <Alert className="py-2 px-4">
+                    <AlertDescription className="text-xs">
+                      {supabaseEnvDetected.NEXT_PUBLIC_SUPABASE_URL ||
+                      supabaseEnvDetected.SUPABASE_URL
+                        ? 'Keys detected — reload this page and the database step will be skipped.'
+                        : 'No Supabase keys are visible to this deployment yet. If you just created the database via the Vercel integration, the keys were added AFTER this build — open Vercel → Deployments → ⋯ → Redeploy once, then reload. Env vars only bind on a new deployment.'}
+                    </AlertDescription>
+                  </Alert>
+                </div>
               )}
             </div>
           )}

package/templates/nextblock-template/app/setup/page.tsx

@@ -81,7 +81,8 @@ export default async function SetupPage() {
   }
 
   const channel = detectChannel();
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL ?? '';
+  const supabaseUrl =
+    process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL || '';
 
   return (
     <SetupWizard
@@ -98,6 +99,21 @@ export default async function SetupPage() {
         fromName: process.env.SMTP_FROM_NAME ?? '',
       }}
       turnstilePrefill={{ siteKey: process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY ?? '' }}
+      supabaseEnvDetected={{
+        NEXT_PUBLIC_SUPABASE_URL: Boolean(process.env.NEXT_PUBLIC_SUPABASE_URL),
+        SUPABASE_URL: Boolean(process.env.SUPABASE_URL),
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: Boolean(
+          process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
+            process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY,
+        ),
+        SUPABASE_ANON_KEY: Boolean(
+          process.env.SUPABASE_ANON_KEY || process.env.SUPABASE_PUBLISHABLE_KEY,
+        ),
+        SUPABASE_SERVICE_ROLE_KEY: Boolean(
+          process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY,
+        ),
+        POSTGRES_URL: Boolean(process.env.POSTGRES_URL),
+      }}
     />
   );
 }

package/templates/nextblock-template/app/sitemap.ts

@@ -6,6 +6,7 @@ import {
   fetchAllPublishedPosts,
   type SitemapEntry,
 } from './lib/sitemap-utils';
+import { resolveSiteUrl, hasResolvedSiteUrl } from '../lib/site-url';
 
 /**
  * Cache the generated sitemap and rebuild it at most once an hour. Crawlers get
@@ -23,7 +24,8 @@ export const revalidate = 3600;
 type SitemapItem = MetadataRoute.Sitemap[number];
 type ChangeFrequency = NonNullable<SitemapItem['changeFrequency']>;
 
-const BASE_URL = (process.env.NEXT_PUBLIC_URL || 'http://localhost:3000').replace(/\/+$/, '');
+// Explicit NEXT_PUBLIC_URL → Vercel production URL → local-dev fallback.
+const BASE_URL = resolveSiteUrl();
 
 function toAbsolute(path: string): string {
   return `${BASE_URL}${path.startsWith('/') ? path : `/${path}`}`;
@@ -73,9 +75,9 @@ export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
     return [];
   }
 
-  if (!process.env.NEXT_PUBLIC_URL) {
+  if (!hasResolvedSiteUrl()) {
     console.warn(
-      'Warning: NEXT_PUBLIC_URL is not set for the sitemap. Defaulting to http://localhost:3000 — set this in production.',
+      'Warning: no site URL is set for the sitemap (NEXT_PUBLIC_URL / Vercel production URL). Defaulting to http://localhost:3000 — set NEXT_PUBLIC_URL in production.',
     );
   }
 

package/templates/nextblock-template/context/language-rest-client.ts

@@ -1,10 +1,11 @@
 import type { Database } from '@nextblock-cms/db';
+import { resolveSupabaseAnonKey, resolveSupabaseUrl } from '../lib/setup/env-status';
 
 type Language = Database['public']['Tables']['languages']['Row'];
 
 export async function fetchActiveLanguagesFromRest(): Promise<Language[]> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+  const supabaseUrl = resolveSupabaseUrl();
+  const supabaseAnonKey = resolveSupabaseAnonKey();
 
   if (!supabaseUrl || !supabaseAnonKey) {
     return [];

package/templates/nextblock-template/docs/12-VERCEL-DEPLOYMENT.md

@@ -12,32 +12,127 @@ The badge links to `https://vercel.com/new/clone` with these query parameters:
 | Parameter | Purpose |
 | :--- | :--- |
 | `repository-url` | The NextBlock repo to clone into the user's Git provider. |
-| `integration-ids=oac_VqOgBHqhEoFTPzGkPd7L0iH6` | Vercel's **Supabase integration**. During import, Vercel provisions (or links) a Supabase project and injects its environment variables automatically. |
-| `env=NEXT_PUBLIC_URL,CRON_SECRET,DRAFT_MODE_SECRET,REVALIDATE_SECRET_TOKEN` | The remaining variables Vercel prompts for. Only variable **names** are listed — never secret values. |
-| `envDescription` / `envLink` | Help text + a link back to this doc. |
+| `project-name` / `repository-name` | Pre-fill the new Vercel project and Git repo names. |
+| `stores=[{"type":"integration","integrationSlug":"supabase","productSlug":"supabase"}]` | Vercel's **native Supabase Marketplace integration**. During import you're prompted to **create a Supabase database** (name + region); Vercel **provisions it, connects it to the project, and injects the env vars before the first build**. |
 
-The Supabase integration injects the keys the app needs to boot:
-`NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`,
-`SUPABASE_SERVICE_ROLE_KEY`, and `POSTGRES_URL`. Because those are present on first
-boot, the instance is **Profile A (pre-configured)**: the wizard skips the connection
-step and goes straight to creating the first administrator.
+There is deliberately **no `env=` parameter** — the deploy prompts for **zero** values you
+have to type (see "No environment variables required" below). The only interaction is the
+Supabase integration's "create database" step, which can't be skipped because provisioning
+a Postgres DB requires choosing a region/plan.
+
+> **Why `stores`, not `integration-ids`?** The legacy `integration-ids=oac_…` parameter
+> triggers an OAuth integration that *creates* a Supabase project but leaves it
+> **disconnected** — it injects **no** environment variables into the Vercel project, so
+> the app boots unconfigured and you have to wire the keys up by hand. The modern `stores`
+> parameter is the native Marketplace path that actually **connects the store and injects
+> credentials before the build**. ([Vercel Deploy Button docs](https://vercel.com/docs/deploy-button/source))
+
+## Connect the database (Supabase integration)
+
+The `stores` parameter makes Vercel prompt you to create a Supabase database during import.
+Pick a **name** and **region**, and Vercel **automatically injects** the integration's
+environment variables into the project — you never copy a value. The native integration
+injects the **new-style** Supabase key names, e.g.:
+
+`NEXT_PUBLIC_SUPABASE_URL` / `SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY` /
+`SUPABASE_PUBLISHABLE_KEY` (the anon-equivalent), `SUPABASE_SECRET_KEY` (the
+service-role-equivalent), and `POSTGRES_URL` (+ the other `POSTGRES_*` parts).
+
+NextBlock reads **all** of these aliases (see `apps/nextblock/lib/setup/env-status.ts`):
+it accepts `NEXT_PUBLIC_SUPABASE_URL` *or* `SUPABASE_URL`; anon *or* `PUBLISHABLE_KEY`;
+`SUPABASE_SERVICE_ROLE_KEY` *or* `SUPABASE_SECRET_KEY`. So the wizard's connection step
+auto-skips no matter which copy the integration set, and the browser client gets the
+publishable key bridged in as the anon key at build time.
+
+> If the database step still appears after a deploy that connected the store, the env vars
+> landed **after** that build — **Redeploy** once (Vercel binds env vars at deploy time).
+> With the `stores` flow they're injected *before* the first build, so this is rarely needed.
+
+On that deploy the wizard skips the database-connection step, **auto-applies the schema**
+(the migrations are embedded in the build — see `lib/setup/migrations-bundle.ts` — and run
+via the injected `POSTGRES_URL`), uses the connected Supabase project for media storage,
+and goes straight to creating the first administrator.
+
+> Until the schema is applied and the first admin exists, **every route redirects to
+> `/setup`** (the homepage does *not* 404). The middleware treats a "schema not applied yet"
+> database error as *unprovisioned* and funnels traffic to the wizard.
+
+## Build configuration (Nx monorepo)
+
+NextBlock is an Nx monorepo — the Next.js app lives at `apps/nextblock`, not the repo
+root — so a bare `next build` at the root fails with *"Couldn't find any `pages` or
+`app` directory."* The root [`vercel.json`](../vercel.json) pins the correct build, so
+the one-click deploy needs **no manual dashboard configuration**:
+
+```json
+{
+  "buildCommand": "npx nx build nextblock --prod",
+  "outputDirectory": "apps/nextblock/.next",
+  "framework": "nextjs"
+}
+```
+
+- **`buildCommand`** runs the Nx target from the repo root, which resolves the
+  workspace libraries (`@nextblock-cms/*` via the TS path aliases) and builds the app.
+- **`outputDirectory`** points at the app's `.next`. This `@nx/next` version emits it
+  to `apps/nextblock/.next` — **not** `dist/apps/nextblock/.next` (which only receives
+  the deploy wrapper: `package.json`, `next.config.js`, `public/`). Verify with
+  `npx nx build nextblock --prod` then check `apps/nextblock/.next/BUILD_ID`.
+- **`framework: nextjs`** keeps Vercel's first-class Next.js runtime (SSR/ISR
+  functions, image optimization, the `proxy.ts` middleware).
+
+Leave the Vercel project's **Root Directory unset** (the repo root) — the build command
+already targets the app. Do **not** set Root Directory to `apps/nextblock`: the app
+imports the workspace libraries one level up, which a custom Root Directory would hide
+(Vercel forbids `..` above a custom root).
+
+## No environment variables required
+
+A Deploy-Button URL can only carry variable **names**, never values — so secrets can
+never be pre-filled through it. Rather than make you paste random strings, NextBlock
+resolves everything in-app, and the button prompts for nothing:
+
+- **`NEXT_PUBLIC_URL`** — optional. When unset the app falls back to Vercel's
+  production URL (`VERCEL_PROJECT_PRODUCTION_URL` server-side /
+  `NEXT_PUBLIC_VERCEL_PROJECT_PRODUCTION_URL` in the browser), i.e. your
+  `*.vercel.app` domain. Sitemap, robots, and canonical links use it automatically.
+  Add a custom domain later, set `NEXT_PUBLIC_URL=https://yourdomain.com` in the
+  Vercel project, and redeploy (it is inlined at build time).
+- **`DRAFT_MODE_SECRET`** and **`REVALIDATE_SECRET_TOKEN`** — optional. When unset they
+  are derived deterministically from the Supabase service-role key (HMAC-SHA256), so
+  Draft Mode and on-demand revalidation work out of the box. Setting either env var
+  overrides the derived value — do this if you want a fixed `REVALIDATE_SECRET_TOKEN`
+  to paste into a Supabase revalidation webhook. (See `apps/nextblock/lib/app-secrets.ts`.)
+- **`CRON_SECRET`** — optional. The cron endpoints enforce the `Authorization: Bearer`
+  header **only when it is set**. Leave it unset for a frictionless deploy, or set it
+  in the Vercel project to lock the cron endpoints down. The destructive
+  `/api/cron/reset-sandbox` job is independently gated to sandbox-mode only (404
+  otherwise), so it never runs on a normal deploy.
 
 ## What the wizard does on Vercel
 
 1. **Database** — already connected (integration-injected). The wizard verifies a
-   first admin doesn't exist yet, otherwise it redirects to `/cms/dashboard`.
-2. **Schema** — apply the migrations to the managed Supabase project. The Supabase
-   integration creates the project but does **not** run NextBlock's migrations, so run
-   them once after the first deploy (locally against the project, or via the Supabase
-   dashboard SQL editor) — see [docs/04](./04-DATABASE-AND-AUTH.md) and
-   [docs/05](./05-DEVELOPER-GUIDE.md).
-3. **Storage** — pre-filled for **Supabase Storage** (S3-compatible). The wizard's
-   storage step shows the endpoint derived from your Supabase URL
-   (`<project>/storage/v1/s3`). Create an S3 access key in the Supabase dashboard
-   (Storage → S3 connection) and set `R2_ACCESS_KEY_ID` / `R2_SECRET_ACCESS_KEY` in
-   your Vercel project environment. (Cloudflare R2 remains the default for non-Vercel
-   installs — it has a more generous free storage tier; only the one-click Vercel
-   path defaults to Supabase Storage.)
+   first admin doesn't exist yet, otherwise it redirects to `/cms/dashboard`. The
+   connection step is **auto-skipped**.
+2. **Schema** — applied **automatically**. The Supabase integration creates the project
+   but does **not** run NextBlock's migrations, so the wizard applies them itself on the
+   final step: it runs the build-embedded migration bundle over the injected
+   `POSTGRES_URL` (no CLI, no manual SQL). Idempotent — a re-run is a no-op. See
+   [docs/04](./04-DATABASE-AND-AUTH.md) and [docs/05](./05-DEVELOPER-GUIDE.md).
+3. **Storage** — **skipped on Vercel; nothing to configure.** Media uses **native
+   Supabase Storage** through the already-connected project: the injected
+   `SUPABASE_SECRET_KEY` authenticates uploads/downloads/deletes via the Supabase client
+   (no S3 access keys required), a public `media` bucket is auto-created, and images are
+   served from `<project>/storage/v1/object/public/media/…`. The storage backend is
+   selected automatically (`apps/nextblock/lib/storage/provider.ts`): if S3/R2 keys are
+   present it uses them; otherwise it falls back to native Supabase Storage. (Cloudflare
+   R2 remains the default for non-Vercel installs — it has a more generous free storage
+   tier; set the `R2_*` env vars to use it on Vercel instead.)
+
+   > **Upload size:** the CMS media uploader proxies the file through a serverless
+   > function (`/api/upload/proxy`), which is subject to Vercel's ~4.5 MB request-body
+   > limit — larger single images fail on the Hobby/Pro serverless runtime regardless of
+   > storage backend. This is a platform constraint, not a NextBlock one.
 4. **Email / Bot protection / Sign-ups** — optional steps; bot-protection and the
    sign-up policy persist to the database and work immediately. SMTP, if used, is set
    as Vercel environment variables.
@@ -47,19 +142,17 @@ step and goes straight to creating the first administrator.
 > Filesystem is read-only on Vercel, so the wizard never writes `.env.local` there —
 > all configuration is environment variables (platform-managed) plus the database.
 
-## Cron jobs and the free tier
-
-`vercel.json` declares two daily crons (`/api/cron/reset-sandbox` and
-`/api/cron/sync-currencies`). Vercel's **Hobby (free) tier allows one cron per day**.
-For a free-tier production deploy, either:
+## Cron jobs and the Hobby plan
 
-- Upgrade to a paid plan (both crons run as declared), **or**
-- Keep only the cron you need (most production sites don't need `reset-sandbox`, which
-  exists for the public demo sandbox), **or**
-- Consolidate both jobs into a single cron handler.
+`vercel.json` declares two crons (`/api/cron/reset-sandbox` at 03:00 and
+`/api/cron/sync-currencies` at 18:00). Vercel's **Hobby (free) tier allows up to 100
+cron jobs, each running at most once per day** — both jobs are daily, so they deploy
+fine on the free tier. (Hobby timing is approximate, ±59 min, which is irrelevant for
+daily jobs; only sub-daily schedules like `0 * * * *` are rejected on Hobby.)
 
-This is intentionally left as a deploy-time decision rather than changed in the repo,
-since the sandbox/demo deploy relies on both crons.
+`reset-sandbox` only does work in sandbox mode — it returns 404 otherwise — so on a
+normal deploy it is a harmless no-op. Delete it from `vercel.json` if you'd rather not
+see it scheduled.
 
 ## After deploy
 

package/templates/nextblock-template/lib/app-secrets.ts

@@ -0,0 +1,39 @@
+import 'server-only';
+import { createHmac } from 'node:crypto';
+
+// Resolve the app's internal shared secrets WITHOUT requiring the operator to paste
+// random strings at deploy time. When an explicit env var is set it always wins;
+// otherwise the secret is derived deterministically from the always-present Supabase
+// service-role key. This is what lets a one-click Vercel deploy work with zero env
+// input while Draft Mode and on-demand revalidation still function out of the box.
+//
+// HMAC-SHA256 is one-way, so a leaked derived secret never exposes the service-role
+// key. The derived value is stable for a given Supabase project; rotating the
+// service-role key rotates these secrets too (set the explicit env var to pin one
+// independently — e.g. to configure a Supabase revalidation webhook with a fixed
+// token). `npm run setup` still writes explicit values locally, so dev is unchanged.
+//
+// CRON_SECRET is intentionally NOT derived here: Vercel Cron injects
+// `Authorization: Bearer ${process.env.CRON_SECRET}` read from the env at invocation,
+// so a derived value could never match it. The cron routes instead treat CRON_SECRET
+// as optional (enforced only when set) — see app/api/cron/*/route.ts.
+
+function deriveFromServiceRole(label: string): string {
+  // Accept the Marketplace integration's SUPABASE_SECRET_KEY alias too, so derivation
+  // still works on a one-click deploy that only injected the new key name.
+  const master = (
+    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY
+  )?.trim();
+  if (!master) return '';
+  return createHmac('sha256', master).update(`nextblock:${label}`).digest('hex');
+}
+
+/** Secret for the programmatic Draft Mode preview entry (`/api/draft?secret=`). */
+export function resolveDraftModeSecret(): string {
+  return process.env.DRAFT_MODE_SECRET?.trim() || deriveFromServiceRole('draft-mode');
+}
+
+/** Shared secret a Supabase webhook sends to `/api/revalidate` (`x-revalidate-secret`). */
+export function resolveRevalidateSecret(): string {
+  return process.env.REVALIDATE_SECRET_TOKEN?.trim() || deriveFromServiceRole('revalidate');
+}

package/templates/nextblock-template/lib/auth/crypto.ts

@@ -21,7 +21,10 @@ export function generateNumericCode(digits = 6): string {
 function getSecret(): string {
   // Dedicated secret if provided, otherwise fall back to the service-role key
   // (server-only, never shipped to the client).
-  const secret = process.env.NB_2FA_SECRET || process.env.SUPABASE_SERVICE_ROLE_KEY;
+  const secret =
+    process.env.NB_2FA_SECRET ||
+    process.env.SUPABASE_SERVICE_ROLE_KEY ||
+    process.env.SUPABASE_SECRET_KEY;
   if (!secret) {
     throw new Error('Missing NB_2FA_SECRET / SUPABASE_SERVICE_ROLE_KEY for 2FA signing.');
   }

package/templates/nextblock-template/lib/custom-block-r2-upload.ts

@@ -5,6 +5,8 @@ import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 import { getS3PresignClient } from '@nextblock-cms/utils/server';
 
 import { resolveMediaUrl } from './media/resolveMediaUrl';
+import { getStorageBackend, getStorageBucket } from './storage/provider';
+import { supabaseCreateSignedUpload } from './storage/supabase-storage';
 import {
   buildR2UploadObjectKey,
   R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS,
@@ -30,17 +32,36 @@ export async function createR2PresignedUpload(
   payload: ValidR2PresignedUploadPayload,
   options: { now?: Date; nonce?: string; userId: string }
 ): Promise<R2PresignedUploadResult> {
-  const bucketName = process.env.R2_BUCKET_NAME;
+  const backend = getStorageBackend();
+  const bucketName = getStorageBucket();
   if (!bucketName) {
     throw new R2PresignedUploadError('File uploads are not configured on this server.', 500);
   }
 
+  const objectKey = buildR2UploadObjectKey(payload, options);
+  const publicUrl = resolveMediaUrl(objectKey) ?? `/${objectKey}`;
+
+  if (backend === 'supabase') {
+    // Native Supabase Storage: a signed upload URL the browser PUTs to directly.
+    const { signedUrl } = await supabaseCreateSignedUpload(objectKey);
+    return {
+      expiresIn: R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS,
+      headers: {
+        'Content-Type': payload.contentType,
+      },
+      method: 'PUT',
+      objectKey,
+      presignedUrl: signedUrl,
+      publicUrl,
+      uploadUrl: signedUrl,
+    };
+  }
+
   const s3Client = await getS3PresignClient();
   if (!s3Client) {
     throw new R2PresignedUploadError('File uploads are not configured on this server.', 500);
   }
 
-  const objectKey = buildR2UploadObjectKey(payload, options);
   const command = new PutObjectCommand({
     Bucket: bucketName,
     ContentType: payload.contentType,
@@ -52,7 +73,6 @@ export async function createR2PresignedUpload(
   const presignedUrl = await getSignedUrl(s3Client, command, {
     expiresIn: R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS,
   });
-  const publicUrl = resolveMediaUrl(objectKey) ?? `/${objectKey}`;
 
   return {
     expiresIn: R2_PRESIGNED_UPLOAD_EXPIRES_IN_SECONDS,

package/templates/nextblock-template/lib/setup/actions.ts

@@ -13,6 +13,8 @@ import {
 } from './provisioning';
 import { applyMigrations, resetDatabase } from './schema-apply';
 import { setSystemConfigurationServiceRole } from './system-config';
+import { getStorageBackend } from '../storage/provider';
+import { ensureStorageBucket } from '../storage/supabase-storage';
 
 export interface ActionResult {
   ok: boolean;
@@ -360,6 +362,20 @@ export async function completeSetup(input: CompleteSetupInput): Promise<ActionRe
   // fresh apply AND a cold cache over a pre-existing schema (Docker boot race / re-run).
   await waitForSchemaCache(admin);
 
+  // On the native Supabase Storage backend (zero-key Vercel deploy), provision the public
+  // media bucket now so the first upload doesn't have to. Best-effort — the upload path
+  // also ensures it lazily, so a transient failure here never blocks finishing setup.
+  if (getStorageBackend() === 'supabase') {
+    try {
+      await ensureStorageBucket();
+    } catch (caught) {
+      console.warn(
+        'Could not pre-create the Supabase Storage media bucket (will retry on first upload):',
+        caught instanceof Error ? caught.message : caught,
+      );
+    }
+  }
+
   // 4) Persist DB-backed settings (service role bypasses RLS — no admin exists yet).
   try {
     if (input.turnstile && input.turnstile.provider !== 'none') {