create-nextblock 0.9.95 → 0.9.99

package/templates/nextblock-template/lib/setup/schema-apply.ts

@@ -16,6 +16,7 @@ import { readdir, readFile } from 'node:fs/promises';
 import path from 'node:path';
 import postgres from 'postgres';
 import { isLocalWritableEnv } from './env-status';
+import { MIGRATIONS_BUNDLE } from './migrations-bundle';
 
 export interface SchemaApplyResult {
   ok: boolean;
@@ -238,14 +239,29 @@ export async function resetDatabase(): Promise<{ ok: boolean; error?: string }>
 
 export async function applyMigrations(): Promise<SchemaApplyResult> {
   const migrationsDir = resolveMigrationsDir();
-  if (!migrationsDir) {
-    return { ok: false, applied: 0, error: 'Could not locate the migrations directory.' };
-  }
 
-  const files = (await readdir(migrationsDir))
-    .filter((name) => /^\d+_.*\.sql$/.test(name))
-    .sort();
-  const readSql = (file: string) => readFile(path.join(migrationsDir, file), 'utf8');
+  let files: string[];
+  let readSql: (file: string) => Promise<string>;
+
+  if (migrationsDir) {
+    // Local dev / Docker: read the canonical .sql files from disk (always current).
+    files = (await readdir(migrationsDir))
+      .filter((name) => /^\d+_.*\.sql$/.test(name))
+      .sort();
+    readSql = (file: string) => readFile(path.join(migrationsDir, file), 'utf8');
+  } else if (MIGRATIONS_BUNDLE.length > 0) {
+    // Serverless (Vercel): libs/db isn't on the function filesystem, so fall back to the
+    // build-time embedded bundle (npm run generate:migrations-bundle).
+    files = MIGRATIONS_BUNDLE.map((m) => m.name).sort();
+    const sqlByName = new Map(MIGRATIONS_BUNDLE.map((m) => [m.name, m.sql]));
+    readSql = async (file: string) => sqlByName.get(file) ?? '';
+  } else {
+    return {
+      ok: false,
+      applied: 0,
+      error: 'Could not locate the migrations (no directory and no embedded bundle).',
+    };
+  }
 
   const ref = resolveProjectRef();
   const token = process.env.SUPABASE_ACCESS_TOKEN?.trim();

package/templates/nextblock-template/lib/site-url.ts

@@ -0,0 +1,48 @@
+// Resolve the canonical public site URL across deploy channels WITHOUT requiring
+// NEXT_PUBLIC_URL to be set. On Vercel it falls back to the auto-provisioned
+// production URL, so a one-click deploy needs no URL input at all.
+//
+// Dependency-free and safe to import anywhere — server components, route handlers,
+// or client components — like lib/setup/env-status.ts. It only reads `process.env`:
+// NEXT_PUBLIC_* names are inlined into the browser bundle at build time, the others
+// resolve server-side only (and are simply absent — harmless — in the browser).
+
+const stripTrailingSlash = (value: string): string => value.replace(/\/+$/, '');
+
+/**
+ * Vercel always sets a production domain (even on preview deployments):
+ * `VERCEL_PROJECT_PRODUCTION_URL` server-side, and Vercel exposes the
+ * framework-prefixed `NEXT_PUBLIC_VERCEL_PROJECT_PRODUCTION_URL` to the browser
+ * bundle at build time. Neither includes the protocol. We prefer the production URL
+ * over the per-deployment `VERCEL_URL` so absolute links (sitemap, canonical, OG)
+ * stay stable across deploys.
+ */
+function vercelProductionUrl(): string {
+  const host =
+    process.env.NEXT_PUBLIC_VERCEL_PROJECT_PRODUCTION_URL?.trim() ||
+    process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim();
+  return host ? `https://${stripTrailingSlash(host)}` : '';
+}
+
+/**
+ * Canonical absolute site origin (e.g. `https://example.com`), no trailing slash.
+ * Precedence: explicit `NEXT_PUBLIC_URL` → Vercel production URL → `fallback`.
+ */
+export function resolveSiteUrl(fallback = 'http://localhost:3000'): string {
+  const explicit = process.env.NEXT_PUBLIC_URL?.trim();
+  if (explicit) return stripTrailingSlash(explicit);
+
+  const vercel = vercelProductionUrl();
+  if (vercel) return vercel;
+
+  return stripTrailingSlash(fallback);
+}
+
+/**
+ * True when a real, production-intended site URL is available (an explicit
+ * `NEXT_PUBLIC_URL` or the Vercel production URL) — i.e. {@link resolveSiteUrl}
+ * is NOT returning the local-dev fallback. Use this to gate "URL not set" warnings.
+ */
+export function hasResolvedSiteUrl(): boolean {
+  return Boolean(process.env.NEXT_PUBLIC_URL?.trim() || vercelProductionUrl());
+}

package/templates/nextblock-template/lib/storage/provider.ts

@@ -0,0 +1,66 @@
+import 'server-only';
+
+import { resolveSupabaseServiceKey, resolveSupabaseUrl } from '../setup/env-status';
+
+// NextBlock has two storage backends:
+//
+//   's3'       — the existing S3-compatible path (Cloudflare R2, self-hosted MinIO, or
+//                even Supabase Storage's S3 endpoint when you create S3 access keys).
+//                Driven by the R2_* env vars + @aws-sdk/client-s3. Unchanged.
+//   'supabase' — native Supabase Storage via the supabase-js client and the injected
+//                service-role/secret key. NO S3 access keys required. This is what makes
+//                the one-click Vercel deploy work with zero storage configuration: the
+//                Marketplace integration injects the Supabase URL + secret key but NOT S3
+//                keys, so the S3 path can't authenticate — the native API can.
+//
+// The S3 path always wins when its keys are present, so local dev, Docker/MinIO, and BYO
+// Cloudflare R2 are completely unaffected. The native path is only chosen as the zero-key
+// fallback for a connected Supabase project.
+
+export type StorageBackend = 's3' | 'supabase';
+
+/** Which storage backend to use. Explicit STORAGE_PROVIDER wins; otherwise inferred. */
+export function getStorageBackend(): StorageBackend {
+  const explicit = process.env.STORAGE_PROVIDER?.trim().toLowerCase();
+  if (explicit === 'supabase') return 'supabase';
+  if (explicit === 's3' || explicit === 'r2' || explicit === 'minio') return 's3';
+
+  // S3/R2/MinIO wins whenever its credentials exist (local, Docker, BYO R2, or
+  // Supabase-S3-with-keys). Only fall back to native Supabase Storage when there are no
+  // S3 keys but a Supabase project IS connected (service key + URL) — the Vercel case.
+  const hasS3Keys = Boolean(
+    process.env.R2_ACCESS_KEY_ID && process.env.R2_SECRET_ACCESS_KEY,
+  );
+  if (hasS3Keys) return 's3';
+  if (resolveSupabaseServiceKey() && resolveSupabaseUrl()) return 'supabase';
+  return 's3';
+}
+
+/** The bucket name to read/write. Defaults to "media" on the native Supabase backend. */
+export function getStorageBucket(): string {
+  const explicit = process.env.STORAGE_BUCKET || process.env.R2_BUCKET_NAME;
+  if (explicit) return explicit;
+  return getStorageBackend() === 'supabase' ? 'media' : '';
+}
+
+/**
+ * The public base URL objects are served from — what resolveMediaUrl() joins object keys
+ * onto. An explicit R2 public/base URL always wins; otherwise, on the native Supabase
+ * backend, derive Supabase Storage's public object endpoint
+ * (`<project>/storage/v1/object/public/<bucket>`) so every display call site works with
+ * zero extra config. Kept in sync with the CJS computation in next.config.js.
+ */
+export function resolveMediaBaseUrl(): string {
+  const explicit =
+    process.env.NEXT_PUBLIC_R2_BASE_URL || process.env.NEXT_PUBLIC_R2_PUBLIC_URL;
+  if (explicit) return explicit.replace(/\/+$/, '');
+
+  if (getStorageBackend() === 'supabase') {
+    const url = resolveSupabaseUrl();
+    const bucket = getStorageBucket();
+    if (url && bucket) {
+      return `${url.replace(/\/+$/, '')}/storage/v1/object/public/${bucket}`;
+    }
+  }
+  return '';
+}

package/templates/nextblock-template/lib/storage/supabase-storage.ts

@@ -0,0 +1,103 @@
+import 'server-only';
+
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+import { getStorageBucket } from './provider';
+
+// Native Supabase Storage operations, authenticated with the service-role/secret key.
+// Used only when getStorageBackend() === 'supabase' (the zero-S3-key Vercel path). These
+// mirror what the S3 routes do via @aws-sdk/client-s3, so the upload → process → display
+// → delete pipeline works identically without any S3 access keys.
+
+// The public bucket is created once per process. Cache the in-flight promise (not a bare
+// boolean) so concurrent uploads share a SINGLE createBucket call instead of racing — and
+// clear it on failure so a later request can retry rather than inheriting a cached rejection.
+let bucketEnsurePromise: Promise<void> | null = null;
+
+/** Idempotently ensure a PUBLIC bucket exists for media. Safe to call concurrently. */
+export function ensureStorageBucket(): Promise<void> {
+  if (bucketEnsurePromise) return bucketEnsurePromise;
+
+  bucketEnsurePromise = (async () => {
+    const bucket = getStorageBucket();
+    if (!bucket) throw new Error('No storage bucket name is configured.');
+
+    const admin = getServiceRoleSupabaseClient();
+    // public: true is REQUIRED — media is served from /storage/v1/object/public/<bucket>,
+    // which returns 401 for a private bucket. Do not drop this flag.
+    const { error } = await admin.storage.createBucket(bucket, { public: true });
+    if (error && !/already exists|duplicate|resource already exists/i.test(error.message)) {
+      // Non-"exists" error — confirm via getBucket before treating it as fatal.
+      const { data } = await admin.storage.getBucket(bucket);
+      if (!data) {
+        throw new Error(`Could not ensure storage bucket "${bucket}": ${error.message}`);
+      }
+    }
+  })();
+
+  // On failure, drop the cached promise so the next caller retries (don't cache a rejection).
+  bucketEnsurePromise.catch(() => {
+    bucketEnsurePromise = null;
+  });
+
+  return bucketEnsurePromise;
+}
+
+/** Upload (or overwrite) an object. */
+export async function supabaseUploadObject(
+  key: string,
+  body: Buffer,
+  contentType: string,
+): Promise<void> {
+  await ensureStorageBucket();
+  const admin = getServiceRoleSupabaseClient();
+  const { error } = await admin.storage
+    .from(getStorageBucket())
+    .upload(key, body, { contentType, upsert: true });
+  if (error) {
+    throw new Error(`Supabase Storage upload failed for "${key}": ${error.message}`);
+  }
+}
+
+/** Download an object as a Buffer (used by the image processor to fetch the original). */
+export async function supabaseDownloadObject(key: string): Promise<Buffer> {
+  const admin = getServiceRoleSupabaseClient();
+  const { data, error } = await admin.storage.from(getStorageBucket()).download(key);
+  if (error || !data) {
+    throw new Error(
+      `Supabase Storage download failed for "${key}": ${error?.message ?? 'no data returned'}`,
+    );
+  }
+  return Buffer.from(await data.arrayBuffer());
+}
+
+/**
+ * Create a signed upload URL for a NEW object key. The browser PUTs the file bytes to the
+ * returned URL directly (the same shape as an S3 presigned PUT), so large uploads never
+ * pass through the serverless function. The token is embedded in the URL.
+ */
+export async function supabaseCreateSignedUpload(
+  key: string,
+): Promise<{ signedUrl: string; token: string }> {
+  await ensureStorageBucket();
+  const admin = getServiceRoleSupabaseClient();
+  const { data, error } = await admin.storage
+    .from(getStorageBucket())
+    .createSignedUploadUrl(key);
+  if (error || !data?.signedUrl) {
+    throw new Error(
+      `Supabase Storage signed upload URL failed for "${key}": ${error?.message ?? 'no URL returned'}`,
+    );
+  }
+  return { signedUrl: data.signedUrl, token: data.token };
+}
+
+/** Remove one or more objects. No-op for an empty list. */
+export async function supabaseRemoveObjects(keys: string[]): Promise<void> {
+  if (keys.length === 0) return;
+  const admin = getServiceRoleSupabaseClient();
+  const { error } = await admin.storage.from(getStorageBucket()).remove(keys);
+  if (error) {
+    throw new Error(`Supabase Storage remove failed: ${error.message}`);
+  }
+}

package/templates/nextblock-template/lib/visual-editing/draft-content.ts

@@ -372,7 +372,7 @@ export function updateDraftBlockContent(
 }
 
 export function createVerificationClient() {
-  if (process.env.SUPABASE_SERVICE_ROLE_KEY) {
+  if (process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY) {
     return getServiceRoleSupabaseClient();
   }
 

package/templates/nextblock-template/next.config.js

@@ -96,8 +96,24 @@ const nextConfig = {
     optimizePackageImports: ['@nextblock-cms/ui', '@nextblock-cms/utils'],
   },
   env: {
-    NEXT_PUBLIC_SUPABASE_URL: process.env.NEXT_PUBLIC_SUPABASE_URL,
-    NEXT_PUBLIC_SUPABASE_ANON_KEY: process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
+    // Bridge every alias the Vercel Supabase integration may inject into the public
+    // vars the app + browser client read, so the build inlines a value whichever copy
+    // is present. The Marketplace integration injects the new publishable key
+    // (NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY) rather than the legacy anon key — without
+    // this bridge the client bundle would ship an empty anon key. Keep the alias order
+    // in sync with apps/nextblock/lib/setup/env-status.ts.
+    NEXT_PUBLIC_SUPABASE_URL:
+      process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL,
+    NEXT_PUBLIC_SUPABASE_ANON_KEY:
+      process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
+      process.env.SUPABASE_ANON_KEY ||
+      process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ||
+      process.env.SUPABASE_PUBLISHABLE_KEY,
+    // On a zero-key Supabase deploy, media is served from Supabase Storage's public
+    // object endpoint — inline that as the base URL so every resolveMediaUrl() display
+    // call site works with no manual storage config (see lib/storage/provider.ts).
+    NEXT_PUBLIC_R2_BASE_URL:
+      process.env.NEXT_PUBLIC_R2_BASE_URL || computeSupabaseMediaBaseUrl(),
   },
   images: {
     formats: ['image/avif', 'image/webp'],
@@ -147,6 +163,25 @@ module.exports = shouldEnableVercelToolbarPlugin
   ? withVercelToolbar()(nextConfig)
   : nextConfig;
 
+/**
+ * Mirror of lib/storage/provider.ts resolveMediaBaseUrl() for the native Supabase backend,
+ * in CJS so it can run at build time. Returns undefined unless this is a zero-S3-key
+ * Supabase deploy (no R2 keys, a connected Supabase project), in which case it returns
+ * Supabase Storage's public object endpoint for the media bucket.
+ * @returns {string | undefined}
+ */
+function computeSupabaseMediaBaseUrl() {
+  if (process.env.R2_ACCESS_KEY_ID && process.env.R2_SECRET_ACCESS_KEY) return undefined;
+  const explicit = (process.env.STORAGE_PROVIDER || '').toLowerCase();
+  if (explicit && explicit !== 'supabase') return undefined;
+  const url = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL;
+  const hasSecret =
+    process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY;
+  if (!url || !hasSecret) return undefined;
+  const bucket = process.env.STORAGE_BUCKET || process.env.R2_BUCKET_NAME || 'media';
+  return `${url.replace(/\/+$/, '')}/storage/v1/object/public/${bucket}`;
+}
+
 function getRemotePatterns() {
   /** @type {RemotePattern[]} */
   const patterns = [];

package/templates/nextblock-template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/template",
-  "version": "0.9.95",
+  "version": "0.9.99",
   "private": true,
   "scripts": {
     "dev": "next dev",

package/templates/nextblock-template/proxy.ts

@@ -2,6 +2,7 @@ import { createServerClient, type CookieOptions } from '@supabase/ssr';
 import { NextResponse, type NextRequest } from 'next/server';
 import type { SupabaseClient } from '@supabase/supabase-js';
 import type { Database } from '@nextblock-cms/db';
+import { resolveSupabaseAnonKey, resolveSupabaseUrl } from './lib/setup/env-status';
 
 type Profile = Database['public']['Tables']['profiles']['Row'];
 type UserRole = Database['public']['Enums']['user_role'];
@@ -55,7 +56,12 @@ function isSetupAllowlisted(pathname: string): boolean {
     pathname.startsWith('/api/setup') ||
     pathname.startsWith('/auth/') ||
     pathname.startsWith('/_next/') ||
-    pathname.startsWith('/favicon')
+    pathname.startsWith('/favicon') ||
+    // Crawler-facing static routes: keep them reachable while unprovisioned so a fresh
+    // deploy never redirects robots.txt / the sitemap to /setup (which would let crawlers
+    // treat the wizard as the canonical entry point).
+    pathname === '/robots.txt' ||
+    pathname.startsWith('/sitemap')
   );
 }
 
@@ -63,12 +69,32 @@ function isSetupAllowlisted(pathname: string): boolean {
 // modules persist across requests in a worker, so this avoids a per-request DB hit.
 let provisionedAdminCache: { value: boolean; expires: number } | null = null;
 
+/**
+ * A Supabase/PostgREST error that means the table itself is absent — i.e. the schema
+ * was never applied. This is NOT a transient hiccup: it's the signature of a fresh,
+ * unprovisioned deploy (env injected, migrations not yet run), so the caller treats it
+ * as "no admin" and funnels traffic to /setup instead of failing open.
+ * 42P01 = undefined_table (Postgres); PGRST205 = PostgREST "table not in schema cache".
+ */
+function isSchemaMissingError(error: { code?: string; message?: string } | null): boolean {
+  if (!error) return false;
+  const code = error.code ?? '';
+  if (code === '42P01' || code === 'PGRST205') return true;
+  const message = (error.message ?? '').toLowerCase();
+  return (
+    message.includes('does not exist') ||
+    message.includes('schema cache') ||
+    message.includes('could not find the table')
+  );
+}
+
 /**
  * Returns true once the system has a first admin (site_settings.is_admin_created).
  * `is_admin_created` is a non-sensitive, anon-readable key, so the request-scoped
  * anon client can read it. Cached aggressively once true (it never reverts) and
  * briefly while false (so the gate releases promptly after the wizard runs).
- * Fail-open: any read error returns true so a hiccup never traps the whole site.
+ * A missing-schema error returns false (unprovisioned → /setup); any OTHER read error
+ * fails open (returns true) so a transient hiccup never traps the whole site.
  */
 async function hasProvisionedAdmin(supabase: SupabaseClient): Promise<boolean> {
   const now = Date.now();
@@ -84,6 +110,12 @@ async function hasProvisionedAdmin(supabase: SupabaseClient): Promise<boolean> {
       .maybeSingle();
 
     if (error) {
+      // Schema not applied yet → definitively unprovisioned: send traffic to /setup
+      // (otherwise the homepage 404s on a fresh deploy because no content exists).
+      if (isSchemaMissingError(error)) {
+        provisionedAdminCache = { value: false, expires: now + 3_000 };
+        return false;
+      }
       return true;
     }
 
@@ -307,8 +339,11 @@ function createContentSecurityPolicy(nonceValue: string, supabaseUrl: string | u
 
 export async function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl;
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+  // Resolve Supabase creds under every alias the Vercel integration may inject (prefixed,
+  // non-prefixed, and the new publishable key) so the gate doesn't bounce a configured
+  // deploy to /setup just because the credentials arrived under a different name.
+  const supabaseUrl = resolveSupabaseUrl();
+  const supabaseAnonKey = resolveSupabaseAnonKey();
   const configured = Boolean(supabaseUrl && supabaseAnonKey);
   process.env.NEXTBLOCK_UNCONFIGURED = configured ? 'false' : 'true';