create-nextblock 0.9.95 → 0.9.98

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.9.95",
+  "version": "0.9.98",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/[slug]/page.tsx

@@ -38,8 +38,15 @@ interface PageTranslation {
 }
 
 export async function generateStaticParams(): Promise<ResolvedPageParams[]> {
-  // Unconfigured instance (pre-/setup): no DB to read slugs from.
-  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+  // Unconfigured instance (pre-/setup): no DB to read slugs from. Accept every Supabase
+  // key alias the Vercel integration may inject (incl. the new publishable key).
+  const hasSupabaseEnv =
+    (process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL) &&
+    (process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
+      process.env.SUPABASE_ANON_KEY ||
+      process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ||
+      process.env.SUPABASE_PUBLISHABLE_KEY);
+  if (!hasSupabaseEnv) {
     return [];
   }
 

package/templates/nextblock-template/app/actions/package-actions.ts

@@ -4,6 +4,11 @@ import { createClient } from '@supabase/supabase-js';
 import { NEXTBLOCK_PACKAGES } from '@nextblock-cms/utils';
 import { headers } from 'next/headers';
 import { revalidatePath } from 'next/cache';
+import {
+  resolveSupabaseAnonKey,
+  resolveSupabaseServiceKey,
+  resolveSupabaseUrl,
+} from '../../lib/setup/env-status';
 
 // Freemius handles both Sandbox and Production keys on the same API domain.
 // The key itself determines the environment.
@@ -11,15 +16,15 @@ const FM_API_URL = 'https://api.freemius.com/v1';
 
 // Helper to get service role client
 const getServiceRoleClient = () => {
-    const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-    const supabaseServiceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+    const supabaseUrl = resolveSupabaseUrl();
+    const supabaseServiceKey = resolveSupabaseServiceKey();
 
     if (!supabaseUrl || !supabaseServiceKey) {
         console.error('Missing Supabase credentials');
         throw new Error('Missing Supabase credentials (Service Key required for activation).');
     }
 
-    if (supabaseServiceKey === process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+    if (supabaseServiceKey === resolveSupabaseAnonKey()) {
         console.warn('CRITICAL WARNING: SUPABASE_SERVICE_ROLE_KEY matches NEXT_PUBLIC_SUPABASE_ANON_KEY. This will likely cause Permission Denied errors as RLS cannot be bypassed.');
     }
 
@@ -73,7 +78,7 @@ export async function activatePackage(key: string) {
         }
       });
 
-      const responseData = await response.json();
+      const responseData = await response.json();
       
       // Freemius returns the license object directly if successful, or an error/api_response
       if (response.ok && responseData.install_id) {

package/templates/nextblock-template/app/api/cron/reset-sandbox/route.ts

@@ -2728,8 +2728,9 @@ export async function GET(request: NextRequest) {
     });
   }
 
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const supabaseServiceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL;
+  const supabaseServiceKey =
+    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY;
 
   const r2AccountId = process.env.R2_ACCOUNT_ID;
   const r2AccessKeyId = process.env.R2_ACCESS_KEY_ID;

package/templates/nextblock-template/app/api/cron/sync-currencies/route.ts

@@ -6,9 +6,13 @@ export const dynamic = 'force-dynamic';
 export const maxDuration = 30;
 
 export async function GET(request: NextRequest) {
+  // CRON_SECRET is optional: when set we enforce Vercel's `Authorization: Bearer`
+  // header, but a zero-config deploy can leave it unset (the job only does low-harm
+  // FX-rate sync). Set CRON_SECRET in the project env to lock the endpoint down.
+  const cronSecret = process.env.CRON_SECRET?.trim();
   const authHeader = request.headers.get('authorization');
 
-  if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {
+  if (cronSecret && authHeader !== `Bearer ${cronSecret}`) {
     return new NextResponse('Unauthorized', {
       status: 401,
     });

package/templates/nextblock-template/app/api/draft/route.ts

@@ -7,6 +7,7 @@ import {
   resolveRequestOrigin,
   type DraftPathTarget,
 } from "../../../lib/visual-editing/draft-route";
+import { resolveDraftModeSecret } from "../../../lib/app-secrets";
 
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -54,7 +55,10 @@ async function targetExists(target: DraftPathTarget) {
 }
 
 export async function GET(request: NextRequest) {
-  const configuredSecret = process.env.DRAFT_MODE_SECRET;
+  // Explicit DRAFT_MODE_SECRET wins; otherwise it is derived from the service-role
+  // key so this preview entry works on a zero-config deploy. Empty only when Supabase
+  // itself is unconfigured.
+  const configuredSecret = resolveDraftModeSecret();
 
   if (!configuredSecret) {
     return NextResponse.json(

package/templates/nextblock-template/app/api/media/library/route.ts

@@ -7,8 +7,12 @@ const DEFAULT_MEDIA_LIBRARY_ITEMS = 50;
 export const dynamic = 'force-dynamic';
 
 function getMediaLibrarySupabaseClient() {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL;
+  const supabaseAnonKey =
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
+    process.env.SUPABASE_ANON_KEY ||
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ||
+    process.env.SUPABASE_PUBLISHABLE_KEY;
 
   if (!supabaseUrl || !supabaseAnonKey) {
     throw new Error('Missing Supabase environment variables for media library API');

package/templates/nextblock-template/app/api/process-image/route.ts

@@ -5,6 +5,15 @@ import { GetObjectCommand, PutObjectCommand } from '@aws-sdk/client-s3';
 import sharp from 'sharp';
 import { Readable } from 'stream';
 import { getPlaiceholder } from 'plaiceholder';
+import {
+  getStorageBackend,
+  getStorageBucket,
+  resolveMediaBaseUrl,
+} from '../../../lib/storage/provider';
+import {
+  supabaseDownloadObject,
+  supabaseUploadObject,
+} from '../../../lib/storage/supabase-storage';
 
 // Helper to convert stream to buffer
 async function streamToBuffer(stream: Readable): Promise<Buffer> {
@@ -16,12 +25,6 @@ async function streamToBuffer(stream: Readable): Promise<Buffer> {
   });
 }
 
-const R2_BUCKET_NAME = process.env.R2_BUCKET_NAME;
-// Construct the public URL base. Assumes your R2 bucket is set up for public access.
-// Example: https://<your-bucket>.<account-id>.r2.cloudflarestorage.com
-// Or if you use a custom domain: https://your.custom.domain
-const R2_PUBLIC_URL_BASE = process.env.NEXT_PUBLIC_R2_BASE_URL;
-
 interface ProcessedImageVariant {
   objectKey: string;
   url: string;
@@ -44,22 +47,45 @@ const TARGET_FORMAT = 'avif';
 const TARGET_MIME_TYPE = 'image/avif';
 
 export async function POST(request: NextRequest) {
-  if (!R2_BUCKET_NAME) {
-    return NextResponse.json({ error: 'R2 bucket name is not configured.' }, { status: 500 });
+  const backend = getStorageBackend();
+  const bucket = getStorageBucket();
+  const publicUrlBase = resolveMediaBaseUrl();
+
+  if (!bucket) {
+    return NextResponse.json({ error: 'Storage bucket is not configured.' }, { status: 500 });
+  }
+  // The native Supabase path derives the public base from the project URL — if that's
+  // somehow empty (e.g. STORAGE_PROVIDER=supabase forced without a URL), fail loudly
+  // rather than minting malformed `/key` URLs that won't resolve to the bucket.
+  if (backend === 'supabase' && !publicUrlBase) {
+    return NextResponse.json({ error: 'Supabase URL is required for image processing on the Supabase backend.' }, { status: 500 });
   }
-  if (!process.env.R2_S3_ENDPOINT && !process.env.R2_ACCOUNT_ID) {
-    console.error("R2_S3_ENDPOINT or R2_ACCOUNT_ID must be set to construct R2_PUBLIC_URL_BASE");
-    return NextResponse.json({ error: 'Server configuration error for R2 public URL.' }, { status: 500 });
+  // The S3 path needs an endpoint to construct the public URL base; the native Supabase
+  // path derives it from the project URL, so this check only applies to S3/R2.
+  if (backend === 's3' && !process.env.R2_S3_ENDPOINT && !process.env.R2_ACCOUNT_ID) {
+    console.error('R2_S3_ENDPOINT or R2_ACCOUNT_ID must be set to construct the public URL base');
+    return NextResponse.json({ error: 'Server configuration error for storage public URL.' }, { status: 500 });
   }
 
 
   try {
-    const s3Client = await getS3Client();
-    if (!s3Client) {
+    const s3Client = backend === 's3' ? await getS3Client() : null;
+    if (backend === 's3' && !s3Client) {
       console.error('R2 client is not configured. Check your R2 environment variables.');
       return NextResponse.json({ error: 'Image processing is not configured on this server.' }, { status: 500 });
     }
 
+    // Backend-agnostic object writer used for every processed variant below.
+    const putObject = async (key: string, body: Buffer, contentType: string) => {
+      if (backend === 'supabase') {
+        await supabaseUploadObject(key, body, contentType);
+      } else {
+        await s3Client!.send(
+          new PutObjectCommand({ Bucket: bucket, Key: key, Body: body, ContentType: contentType }),
+        );
+      }
+    };
+
     const { objectKey: originalObjectKey, contentType: originalContentType } = await request.json();
 
     if (!originalObjectKey || !originalContentType) {
@@ -70,25 +96,25 @@ export async function POST(request: NextRequest) {
       // For now, we only process images. Could be extended for other file types if needed.
       return NextResponse.json({
         message: 'File is not an image. Skipping processing.',
-        originalImage: { objectKey: originalObjectKey, fileType: originalContentType, url: `${R2_PUBLIC_URL_BASE}/${originalObjectKey}` },
+        originalImage: { objectKey: originalObjectKey, fileType: originalContentType, url: `${publicUrlBase}/${originalObjectKey}` },
         processedVariants: [],
         blurDataURL: null // Or an empty string, depending on how you want to handle non-images
       }, { status: 200 });
     }
 
-    // 1. Fetch the original image from R2
-    const getObjectParams = {
-      Bucket: R2_BUCKET_NAME,
-      Key: originalObjectKey,
-    };
-    const getObjectCommand = new GetObjectCommand(getObjectParams);
-    const getObjectResponse = await s3Client.send(getObjectCommand);
-
-    if (!getObjectResponse.Body) {
-      throw new Error('Failed to retrieve image from R2: Empty body.');
+    // 1. Fetch the original image from storage
+    let imageBuffer: Buffer;
+    if (backend === 'supabase') {
+      imageBuffer = await supabaseDownloadObject(originalObjectKey);
+    } else {
+      const getObjectResponse = await s3Client!.send(
+        new GetObjectCommand({ Bucket: bucket, Key: originalObjectKey }),
+      );
+      if (!getObjectResponse.Body) {
+        throw new Error('Failed to retrieve image from storage: Empty body.');
+      }
+      imageBuffer = await streamToBuffer(getObjectResponse.Body as Readable);
     }
-
-    let imageBuffer = await streamToBuffer(getObjectResponse.Body as Readable);
     let sharpInstance = sharp(imageBuffer);
     let originalMetadata = await sharpInstance.metadata();
 
@@ -132,15 +158,9 @@ export async function POST(request: NextRequest) {
       // already .avif — strip it so keys read `..._large.avif`, not `..._large_avif.avif`.
       const fileSuffix = size.label.replace(/_avif$/, '');
       const newObjectKey = `${baseName}_${fileSuffix}.${TARGET_FORMAT}`;
-      const newPublicUrl = `${R2_PUBLIC_URL_BASE}/${newObjectKey}`;
+      const newPublicUrl = `${publicUrlBase}/${newObjectKey}`;
 
-      const putObjectParams = {
-        Bucket: R2_BUCKET_NAME,
-        Key: newObjectKey,
-        Body: processedImageBuffer,
-        ContentType: TARGET_MIME_TYPE,
-      };
-      await s3Client.send(new PutObjectCommand(putObjectParams));
+      await putObject(newObjectKey, processedImageBuffer, TARGET_MIME_TYPE);
 
       const newMetadata = await sharp(processedImageBuffer).metadata();
       processedVariants.push({
@@ -163,14 +183,9 @@ export async function POST(request: NextRequest) {
             .toBuffer();
         
         const originalAvifObjectKey = `${baseName}_original.${TARGET_FORMAT}`;
-        const originalAvifPublicUrl = `${R2_PUBLIC_URL_BASE}/${originalAvifObjectKey}`;
-
-        await s3Client.send(new PutObjectCommand({
-            Bucket: R2_BUCKET_NAME,
-            Key: originalAvifObjectKey,
-            Body: originalAvifBuffer,
-            ContentType: TARGET_MIME_TYPE,
-        }));
+        const originalAvifPublicUrl = `${publicUrlBase}/${originalAvifObjectKey}`;
+
+        await putObject(originalAvifObjectKey, originalAvifBuffer, TARGET_MIME_TYPE);
         const originalAvifMetadata = await sharp(originalAvifBuffer).metadata();
         processedVariants.push({
             objectKey: originalAvifObjectKey,
@@ -188,7 +203,7 @@ export async function POST(request: NextRequest) {
     // The client already has some of this, but good to have a consistent structure.
     const originalImageDetails: ProcessedImageVariant = {
         objectKey: originalObjectKey,
-        url: `${R2_PUBLIC_URL_BASE}/${originalObjectKey}`,
+        url: `${publicUrlBase}/${originalObjectKey}`,
         width: originalMetadata.width || 0,
         height: originalMetadata.height || 0,
         fileType: originalContentType,

package/templates/nextblock-template/app/api/revalidate/route.ts

@@ -1,8 +1,7 @@
 // app/api/revalidate/route.ts
 import { NextRequest, NextResponse } from 'next/server';
 import { revalidatePath } from 'next/cache';
-
-const REVALIDATE_SECRET = process.env.REVALIDATE_SECRET_TOKEN;
+import { resolveRevalidateSecret } from '../../../lib/app-secrets';
 
 // Define the expected structure of the Supabase webhook payload
 interface SupabaseWebhookPayload {
@@ -15,8 +14,12 @@ interface SupabaseWebhookPayload {
 
 export async function POST(request: NextRequest) {
   const secret = request.headers.get('x-revalidate-secret');
+  // Explicit REVALIDATE_SECRET_TOKEN wins; otherwise derived from the service-role
+  // key. Empty only when Supabase is unconfigured — reject in that case rather than
+  // allowing an empty-header match.
+  const expectedSecret = resolveRevalidateSecret();
 
-  if (secret !== REVALIDATE_SECRET) {
+  if (!expectedSecret || secret !== expectedSecret) {
     console.warn("Revalidation attempt with invalid secret token.");
     return NextResponse.json({ message: 'Invalid secret token' }, { status: 401 });
   }
@@ -42,8 +45,8 @@ export async function POST(request: NextRequest) {
 
   if (table === 'pages') {
     pathToRevalidate = `/${relevantRecord.slug}`;
-  } else if (table === 'posts') {
-    pathToRevalidate = `/article/${relevantRecord.slug}`;
+  } else if (table === 'posts') {
+    pathToRevalidate = `/article/${relevantRecord.slug}`;
   } else {
     console.log(`Revalidation not configured for table: ${table}`);
     return NextResponse.json({ message: `Revalidation not configured for table: ${table}` }, { status: 200 }); // Acknowledge but don't process
@@ -59,19 +62,19 @@ export async function POST(request: NextRequest) {
       await revalidatePath(normalizedPath, 'page'); 
       console.log(`Successfully revalidated path: ${normalizedPath}`);
       
-      // Additionally, if it's an article, you might want to revalidate the main listing page.
-      if (table === 'posts') {
-        // Assuming your main articles listing page is at '/articles' or similar.
-        // This path needs to be known and consistent.
-        // If your listing is at the root of the language segment (e.g. /en/articles),
-        // and you are NOT using [lang] in URL, then the path is just '/articles'.
-        // However, if your LanguageContext means /articles shows different content per lang,
-        // revalidating just '/articles' will rebuild its default language version.
-        // Client-side fetches would still get latest for other languages.
-        // For now, let's revalidate a generic /articles path if it exists.
-        // await revalidatePath('/articles', 'page'); // Example: revalidate main listing
-        // console.log("Also attempted to revalidate /articles listing page.");
-      }
+      // Additionally, if it's an article, you might want to revalidate the main listing page.
+      if (table === 'posts') {
+        // Assuming your main articles listing page is at '/articles' or similar.
+        // This path needs to be known and consistent.
+        // If your listing is at the root of the language segment (e.g. /en/articles),
+        // and you are NOT using [lang] in URL, then the path is just '/articles'.
+        // However, if your LanguageContext means /articles shows different content per lang,
+        // revalidating just '/articles' will rebuild its default language version.
+        // Client-side fetches would still get latest for other languages.
+        // For now, let's revalidate a generic /articles path if it exists.
+        // await revalidatePath('/articles', 'page'); // Example: revalidate main listing
+        // console.log("Also attempted to revalidate /articles listing page.");
+      }
 
       return NextResponse.json({ revalidated: true, revalidatedPath: normalizedPath, now: Date.now() });
     } catch (err: unknown) {

package/templates/nextblock-template/app/api/upload/presigned-url/route.ts

@@ -4,8 +4,8 @@ import { createClient } from "@nextblock-cms/db/server"; // Server client for au
 import { getS3PresignClient } from "@nextblock-cms/utils/server";
 import { PutObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-
-const R2_BUCKET_NAME = process.env.R2_BUCKET_NAME;
+import { getStorageBackend, getStorageBucket } from "../../../../lib/storage/provider";
+import { supabaseCreateSignedUpload } from "../../../../lib/storage/supabase-storage";
 
 export async function POST(request: NextRequest) {
   const supabase = createClient();
@@ -26,14 +26,16 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: "Forbidden: Insufficient permissions" }, { status: 403 });
   }
 
-  if (!R2_BUCKET_NAME) {
-    console.error("R2_BUCKET_NAME is not set.");
+  const backend = getStorageBackend();
+  const bucket = getStorageBucket();
+  if (!bucket) {
+    console.error("No storage bucket is configured.");
     return NextResponse.json({ error: "Server configuration error for file uploads." }, { status: 500 });
   }
 
   try {
-    const s3Client = await getS3PresignClient();
-    if (!s3Client) {
+    const s3Client = backend === 's3' ? await getS3PresignClient() : null;
+    if (backend === 's3' && !s3Client) {
       console.error('R2 client is not configured. Check your R2 environment variables.');
       return NextResponse.json({ error: 'File uploads are not configured on this server.' }, { status: 500 });
     }
@@ -79,8 +81,18 @@ export async function POST(request: NextRequest) {
 
     const uniqueKey = `${folder}${sanitizedBaseFilename}_${timestamp}${fileExtension ? '.' + fileExtension : ''}`;
 
+    if (backend === 'supabase') {
+      // Native Supabase Storage: hand the browser a signed upload URL to PUT to directly.
+      const { signedUrl } = await supabaseCreateSignedUpload(uniqueKey);
+      return NextResponse.json({
+        presignedUrl: signedUrl,
+        objectKey: uniqueKey,
+        method: "PUT",
+      });
+    }
+
     const command = new PutObjectCommand({
-      Bucket: R2_BUCKET_NAME,
+      Bucket: bucket,
       Key: uniqueKey,
       ContentType: contentType,
       // ACL: 'public-read', // R2 objects are private by default unless bucket is public or presigned URL for GET is used
@@ -91,7 +103,7 @@ export async function POST(request: NextRequest) {
     });
 
     const expiresIn = 300; // 5 minutes
-    const presignedUrl = await getSignedUrl(s3Client, command, { expiresIn });
+    const presignedUrl = await getSignedUrl(s3Client!, command, { expiresIn });
 
     return NextResponse.json({
       presignedUrl,

package/templates/nextblock-template/app/api/upload/proxy/route.ts

@@ -1,10 +1,10 @@
 // apps/nextblock/app/api/upload/proxy/route.ts
 import { NextRequest, NextResponse } from 'next/server';
 import { createClient } from '@nextblock-cms/db/server';
-import { getS3Client } from '@nextblock-cms/utils/server';
+import { getS3Client } from '@nextblock-cms/utils/server';
 import { PutObjectCommand } from '@aws-sdk/client-s3';
-
-const R2_BUCKET_NAME = process.env.R2_BUCKET_NAME;
+import { getStorageBackend, getStorageBucket } from '../../../../lib/storage/provider';
+import { supabaseUploadObject } from '../../../../lib/storage/supabase-storage';
 
 export async function POST(request: NextRequest) {
   const supabase = createClient();
@@ -14,19 +14,22 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
   }
 
-  if (!R2_BUCKET_NAME) {
-    console.error('R2_BUCKET_NAME is not set.');
-    return NextResponse.json({ error: 'Server configuration error for file uploads.' }, { status: 500 });
-  }
-
-  try {
-    const s3Client = await getS3Client();
-    if (!s3Client) {
-      console.error('R2 client is not configured. Check your R2 environment variables.');
-      return NextResponse.json({ error: 'File uploads are not configured on this server.' }, { status: 500 });
-    }
-
-    const formData = await request.formData();
+  const backend = getStorageBackend();
+  const bucket = getStorageBucket();
+  if (!bucket) {
+    console.error('No storage bucket is configured.');
+    return NextResponse.json({ error: 'Server configuration error for file uploads.' }, { status: 500 });
+  }
+
+  try {
+    // On the S3 path we need a configured client; the native Supabase path needs none.
+    const s3Client = backend === 's3' ? await getS3Client() : null;
+    if (backend === 's3' && !s3Client) {
+      console.error('R2 client is not configured. Check your R2 environment variables.');
+      return NextResponse.json({ error: 'File uploads are not configured on this server.' }, { status: 500 });
+    }
+
+    const formData = await request.formData();
     const file = formData.get('file') as File | null;
     const rawFolder = (formData.get('folder') as string | null) ?? undefined;
 
@@ -58,18 +61,21 @@ export async function POST(request: NextRequest) {
     const bytes = await file.arrayBuffer();
     const buffer = Buffer.from(bytes);
 
-    const command = new PutObjectCommand({
-      Bucket: R2_BUCKET_NAME,
-      Key: uniqueKey,
-      Body: buffer,
-      ContentType: file.type,
-      ContentLength: file.size,
-      Metadata: {
-        'uploader-user-id': user.id,
-      },
-    });
-
-    await s3Client.send(command);
+    if (backend === 'supabase') {
+      await supabaseUploadObject(uniqueKey, buffer, file.type);
+    } else {
+      const command = new PutObjectCommand({
+        Bucket: bucket,
+        Key: uniqueKey,
+        Body: buffer,
+        ContentType: file.type,
+        ContentLength: file.size,
+        Metadata: {
+          'uploader-user-id': user.id,
+        },
+      });
+      await s3Client!.send(command);
+    }
 
     return NextResponse.json({
       objectKey: uniqueKey,

package/templates/nextblock-template/app/article/[slug]/page.tsx

@@ -1,8 +1,5 @@
 // app/article/[slug]/page.tsx
 import React from 'react';
-// Remove or alias the problematic import if only used by other functions:
-// import { createClient } from "@nextblock-cms/db/server";
-import { createClient as createSupabaseJsClient } from '@supabase/supabase-js'; // Import base client
 import { notFound } from "next/navigation";
 import type { Metadata } from 'next';
 import PostClientContent from "./PostClientContent";
@@ -58,16 +55,10 @@ const resolveLanguageCode = (languagesField: PostTranslation["languages"]): stri
 };
 
 export async function generateStaticParams(): Promise<ResolvedPostParams[]> {
-  // Use a new Supabase client instance that doesn't rely on cookies
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-  
-  if (!supabaseUrl || !supabaseAnonKey) {
-    console.warn('Missing Supabase environment variables in generateStaticParams (Posts)');
-    return [];
-  }
-  
-  const supabase = createSupabaseJsClient(supabaseUrl, supabaseAnonKey);
+  // Cookie-free SSG client. getSsgSupabaseClient() resolves the Supabase URL/anon key
+  // under every alias the Vercel integration may inject (incl. the new publishable key)
+  // and degrades to a dummy client when unconfigured (the query below then returns []).
+  const supabase = getSsgSupabaseClient();
 
   const { data: posts, error } = await supabase
     .from("posts")

package/templates/nextblock-template/app/checkout/success/actions.ts

@@ -8,10 +8,11 @@ import {
   stripe,
   syncStripeOrderFromSession,
 } from '@nextblock-cms/ecommerce/server';
+import { resolveSupabaseServiceKey, resolveSupabaseUrl } from '../../../lib/setup/env-status';
 
 function getServiceRoleSupabaseClient() {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+  const supabaseUrl = resolveSupabaseUrl();
+  const serviceRoleKey = resolveSupabaseServiceKey();
 
   if (!supabaseUrl || !serviceRoleKey) {
     throw new Error('Missing Supabase Service Role environment variables');