@nextblock-cms/db 0.13.9 → 0.13.11

package/supabase/migrations/00000000000009_home_live_demo_promo_contrast.sql

@@ -1,52 +1,52 @@
--- 00000000000009_home_live_demo_promo_contrast.sql
--- Restyles the "Live Demo" promo that migrations 006/007 seeded on the EN (slug 'home')
--- and FR (slug 'accueil') home pages. 006/007 gave it a fixed dark-navy GRADIENT section
--- background -- and a gradient background is an inline style, so it renders identically
--- in light and dark theme. Sitting directly under the (also dark) hero, that made the
--- first two sections both dark in light mode and killed the old dark-hero -> white-second
--- contrast rhythm.
---
--- Fix (append-only, do NOT edit 006/007 -- both already applied to prod + sandbox):
--- switch the section background to "none" (transparent -> inherits the theme-aware page
--- background: light in light theme, dark in dark theme) and render the promo as a single
--- self-contained ELEVATED PANEL. The panel is a soft light card in light theme and keeps
--- the rich navy look in dark theme (dark: gradient), with the browser mockup deliberately
--- kept dark in both themes as a "product screenshot" focal point. The <!--nb-sandbox-promo-->
--- sentinel is preserved so the reset-sandbox route still strips it on cms.nextblock.dev.
---
--- Idempotent: re-running sets identical content. Targets exactly the promo blocks via the
--- nb-sandbox-promo sentinel, scoped by language (mirrors 00000000000007). blocks.content is
--- JSONB, written with dollar-quoting.
---
--- NOTE: keep the word "sandbox" OUT of this filename -- generate-sandbox-reset.ts excludes
--- any migration whose filename contains "sandbox" from the sandbox reset bundle.
-
-DO $body$
-DECLARE
-  v_en_lang integer;
-  v_fr_lang integer;
-BEGIN
-  SELECT id INTO v_en_lang FROM public.languages WHERE code = 'en' LIMIT 1;
-  SELECT id INTO v_fr_lang FROM public.languages WHERE code = 'fr' LIMIT 1;
-
-  UPDATE public.blocks
-     SET content = $en$
-{"container_type":"container","background":{"type":"none"},"responsive_columns":{"mobile":1,"tablet":1,"desktop":1},"column_gap":"xl","vertical_alignment":"center","padding":{"top":"xl","bottom":"xl"},"column_blocks":[[{"block_type":"text","content":{"html_content":"<!--nb-sandbox-promo--><div class='relative overflow-hidden rounded-[2.5rem] border border-slate-200 bg-gradient-to-br from-white via-slate-50 to-blue-50 shadow-2xl shadow-slate-900/10 dark:border-white/10 dark:from-slate-900 dark:via-slate-900 dark:to-blue-950 dark:shadow-black/40'><div class='grid gap-10 p-8 sm:p-12 lg:grid-cols-2 lg:items-center'><div><p class='text-xs uppercase tracking-[0.25em] text-cyan-600 dark:text-cyan-400 font-bold mb-4'>Live Demo &middot; No Signup</p><h2 class='text-4xl md:text-5xl font-bold text-slate-900 dark:text-white mb-6 leading-tight'>Try the full CMS,<br/>live right now.</h2><p class='text-lg text-slate-600 dark:text-slate-300 max-w-xl leading-relaxed mb-8'>Don't just read about NextBlock&trade; &mdash; take the wheel. Our public sandbox is a complete, pre-loaded install where you can build pages with the block editor, manage bilingual content, and browse a working demo store. It resets daily, so explore freely and break whatever you like.</p><div class='flex flex-col sm:flex-row gap-4'><a href='https://cms.nextblock.dev' target='_blank' rel='noopener noreferrer' class='inline-flex items-center justify-center gap-2 rounded-xl px-7 h-12 text-sm font-semibold text-white bg-blue-600 hover:bg-blue-700 shadow-lg shadow-blue-500/25 transition-all no-underline'>Explore the Live Demo &rarr;</a><a href='https://cms.nextblock.dev/sign-in' target='_blank' rel='noopener noreferrer' class='inline-flex items-center justify-center gap-2 rounded-xl px-7 h-12 text-sm font-semibold text-slate-700 dark:text-white border border-slate-300 dark:border-white/20 hover:bg-slate-100 dark:hover:bg-white/10 transition-all no-underline'>Open the CMS Dashboard &rarr;</a></div><p class='text-xs text-slate-500 dark:text-slate-400 mt-4'>Demo login <span class='font-mono text-slate-700 dark:text-slate-300'>demo@nextblock.ca</span> / <span class='font-mono text-slate-700 dark:text-slate-300'>password</span> &middot; Resets daily</p></div><div class='rounded-3xl overflow-hidden border border-slate-800 bg-slate-900 shadow-xl shadow-slate-900/20 dark:border-white/10 dark:bg-white/5 dark:backdrop-blur-xl'><div class='flex items-center gap-2 px-4 py-3 border-b border-white/10 bg-white/5'><span class='w-3 h-3 rounded-full bg-red-400/70'></span><span class='w-3 h-3 rounded-full bg-yellow-400/70'></span><span class='w-3 h-3 rounded-full bg-green-400/70'></span><span class='ml-3 flex-1 truncate rounded-md bg-black/30 px-3 py-1 text-xs font-mono text-slate-300'>cms.nextblock.dev</span></div><div class='p-6 sm:p-8'><p class='text-sm text-slate-300 mb-5'>A living NextBlock&trade; install &mdash; everything here is real and clickable:</p><ul class='space-y-4 text-sm text-slate-200'><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Full block editor</strong> with slash commands &amp; drag-and-drop.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Bilingual</strong> English / French content management.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>A complete demo storefront</strong> with a full checkout flow.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Wipes clean daily</strong> &mdash; always a fresh start.</span></li></ul></div></div></div></div>"}}]]}
-$en$::jsonb,
-         updated_at = now()
-   WHERE block_type = 'section'
-     AND page_id IS NOT NULL
-     AND language_id = v_en_lang
-     AND content::text LIKE '%nb-sandbox-promo%';
-
-  UPDATE public.blocks
-     SET content = $fr$
-{"container_type":"container","background":{"type":"none"},"responsive_columns":{"mobile":1,"tablet":1,"desktop":1},"column_gap":"xl","vertical_alignment":"center","padding":{"top":"xl","bottom":"xl"},"column_blocks":[[{"block_type":"text","content":{"html_content":"<!--nb-sandbox-promo--><div class='relative overflow-hidden rounded-[2.5rem] border border-slate-200 bg-gradient-to-br from-white via-slate-50 to-blue-50 shadow-2xl shadow-slate-900/10 dark:border-white/10 dark:from-slate-900 dark:via-slate-900 dark:to-blue-950 dark:shadow-black/40'><div class='grid gap-10 p-8 sm:p-12 lg:grid-cols-2 lg:items-center'><div><p class='text-xs uppercase tracking-[0.25em] text-cyan-600 dark:text-cyan-400 font-bold mb-4'>D&eacute;mo en direct &middot; Sans inscription</p><h2 class='text-4xl md:text-5xl font-bold text-slate-900 dark:text-white mb-6 leading-tight'>Essayez le CMS complet,<br/>en direct d&egrave;s maintenant.</h2><p class='text-lg text-slate-600 dark:text-slate-300 max-w-xl leading-relaxed mb-8'>Ne vous contentez pas de lire des articles sur NextBlock&trade; &mdash; prenez les commandes. Notre bac &agrave; sable public est une installation compl&egrave;te et pr&eacute;charg&eacute;e o&ugrave; vous pouvez cr&eacute;er des pages avec l'&eacute;diteur de blocs, g&eacute;rer du contenu bilingue et parcourir une vraie boutique de d&eacute;monstration. Il se r&eacute;initialise chaque jour : explorez librement et cassez tout ce que vous voulez.</p><div class='flex flex-col sm:flex-row gap-4'><a href='https://cms.nextblock.dev' target='_blank' rel='noopener noreferrer' class='inline-flex items-center justify-center gap-2 rounded-xl px-7 h-12 text-sm font-semibold text-white bg-blue-600 hover:bg-blue-700 shadow-lg shadow-blue-500/25 transition-all no-underline'>D&eacute;couvrir la d&eacute;mo &rarr;</a><a href='https://cms.nextblock.dev/sign-in' target='_blank' rel='noopener noreferrer' class='inline-flex items-center justify-center gap-2 rounded-xl px-7 h-12 text-sm font-semibold text-slate-700 dark:text-white border border-slate-300 dark:border-white/20 hover:bg-slate-100 dark:hover:bg-white/10 transition-all no-underline'>Ouvrir le tableau de bord &rarr;</a></div><p class='text-xs text-slate-500 dark:text-slate-400 mt-4'>Identifiants d&eacute;mo <span class='font-mono text-slate-700 dark:text-slate-300'>demo@nextblock.ca</span> / <span class='font-mono text-slate-700 dark:text-slate-300'>password</span> &middot; R&eacute;initialis&eacute; chaque jour</p></div><div class='rounded-3xl overflow-hidden border border-slate-800 bg-slate-900 shadow-xl shadow-slate-900/20 dark:border-white/10 dark:bg-white/5 dark:backdrop-blur-xl'><div class='flex items-center gap-2 px-4 py-3 border-b border-white/10 bg-white/5'><span class='w-3 h-3 rounded-full bg-red-400/70'></span><span class='w-3 h-3 rounded-full bg-yellow-400/70'></span><span class='w-3 h-3 rounded-full bg-green-400/70'></span><span class='ml-3 flex-1 truncate rounded-md bg-black/30 px-3 py-1 text-xs font-mono text-slate-300'>cms.nextblock.dev</span></div><div class='p-6 sm:p-8'><p class='text-sm text-slate-300 mb-5'>Une installation NextBlock&trade; bien vivante &mdash; tout ici est r&eacute;el et cliquable :</p><ul class='space-y-4 text-sm text-slate-200'><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>&Eacute;diteur de blocs complet</strong> : commandes slash et glisser-d&eacute;poser.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Gestion bilingue</strong> du contenu fran&ccedil;ais / anglais.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Une boutique de d&eacute;monstration compl&egrave;te</strong> avec un parcours de paiement complet.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Remis &agrave; z&eacute;ro chaque jour</strong> &mdash; toujours un nouveau d&eacute;part.</span></li></ul></div></div></div></div>"}}]]}
-$fr$::jsonb,
-         updated_at = now()
-   WHERE block_type = 'section'
-     AND page_id IS NOT NULL
-     AND language_id = v_fr_lang
-     AND content::text LIKE '%nb-sandbox-promo%';
-END
-$body$;
+-- 00000000000009_home_live_demo_promo_contrast.sql
+-- Restyles the "Live Demo" promo that migrations 006/007 seeded on the EN (slug 'home')
+-- and FR (slug 'accueil') home pages. 006/007 gave it a fixed dark-navy GRADIENT section
+-- background -- and a gradient background is an inline style, so it renders identically
+-- in light and dark theme. Sitting directly under the (also dark) hero, that made the
+-- first two sections both dark in light mode and killed the old dark-hero -> white-second
+-- contrast rhythm.
+--
+-- Fix (append-only, do NOT edit 006/007 -- both already applied to prod + sandbox):
+-- switch the section background to "none" (transparent -> inherits the theme-aware page
+-- background: light in light theme, dark in dark theme) and render the promo as a single
+-- self-contained ELEVATED PANEL. The panel is a soft light card in light theme and keeps
+-- the rich navy look in dark theme (dark: gradient), with the browser mockup deliberately
+-- kept dark in both themes as a "product screenshot" focal point. The <!--nb-sandbox-promo-->
+-- sentinel is preserved so the reset-sandbox route still strips it on cms.nextblock.dev.
+--
+-- Idempotent: re-running sets identical content. Targets exactly the promo blocks via the
+-- nb-sandbox-promo sentinel, scoped by language (mirrors 00000000000007). blocks.content is
+-- JSONB, written with dollar-quoting.
+--
+-- NOTE: keep the word "sandbox" OUT of this filename -- generate-sandbox-reset.ts excludes
+-- any migration whose filename contains "sandbox" from the sandbox reset bundle.
+
+DO $body$
+DECLARE
+  v_en_lang integer;
+  v_fr_lang integer;
+BEGIN
+  SELECT id INTO v_en_lang FROM public.languages WHERE code = 'en' LIMIT 1;
+  SELECT id INTO v_fr_lang FROM public.languages WHERE code = 'fr' LIMIT 1;
+
+  UPDATE public.blocks
+     SET content = $en$
+{"container_type":"container","background":{"type":"none"},"responsive_columns":{"mobile":1,"tablet":1,"desktop":1},"column_gap":"xl","vertical_alignment":"center","padding":{"top":"xl","bottom":"xl"},"column_blocks":[[{"block_type":"text","content":{"html_content":"<!--nb-sandbox-promo--><div class='relative overflow-hidden rounded-[2.5rem] border border-slate-200 bg-gradient-to-br from-white via-slate-50 to-blue-50 shadow-2xl shadow-slate-900/10 dark:border-white/10 dark:from-slate-900 dark:via-slate-900 dark:to-blue-950 dark:shadow-black/40'><div class='grid gap-10 p-8 sm:p-12 lg:grid-cols-2 lg:items-center'><div><p class='text-xs uppercase tracking-[0.25em] text-cyan-600 dark:text-cyan-400 font-bold mb-4'>Live Demo &middot; No Signup</p><h2 class='text-4xl md:text-5xl font-bold text-slate-900 dark:text-white mb-6 leading-tight'>Try the full CMS,<br/>live right now.</h2><p class='text-lg text-slate-600 dark:text-slate-300 max-w-xl leading-relaxed mb-8'>Don't just read about NextBlock&trade; &mdash; take the wheel. Our public sandbox is a complete, pre-loaded install where you can build pages with the block editor, manage bilingual content, and browse a working demo store. It resets daily, so explore freely and break whatever you like.</p><div class='flex flex-col sm:flex-row gap-4'><a href='https://cms.nextblock.dev' target='_blank' rel='noopener noreferrer' class='inline-flex items-center justify-center gap-2 rounded-xl px-7 h-12 text-sm font-semibold text-white bg-blue-600 hover:bg-blue-700 shadow-lg shadow-blue-500/25 transition-all no-underline'>Explore the Live Demo &rarr;</a><a href='https://cms.nextblock.dev/sign-in' target='_blank' rel='noopener noreferrer' class='inline-flex items-center justify-center gap-2 rounded-xl px-7 h-12 text-sm font-semibold text-slate-700 dark:text-white border border-slate-300 dark:border-white/20 hover:bg-slate-100 dark:hover:bg-white/10 transition-all no-underline'>Open the CMS Dashboard &rarr;</a></div><p class='text-xs text-slate-500 dark:text-slate-400 mt-4'>Demo login <span class='font-mono text-slate-700 dark:text-slate-300'>demo@nextblock.ca</span> / <span class='font-mono text-slate-700 dark:text-slate-300'>password</span> &middot; Resets daily</p></div><div class='rounded-3xl overflow-hidden border border-slate-800 bg-slate-900 shadow-xl shadow-slate-900/20 dark:border-white/10 dark:bg-white/5 dark:backdrop-blur-xl'><div class='flex items-center gap-2 px-4 py-3 border-b border-white/10 bg-white/5'><span class='w-3 h-3 rounded-full bg-red-400/70'></span><span class='w-3 h-3 rounded-full bg-yellow-400/70'></span><span class='w-3 h-3 rounded-full bg-green-400/70'></span><span class='ml-3 flex-1 truncate rounded-md bg-black/30 px-3 py-1 text-xs font-mono text-slate-300'>cms.nextblock.dev</span></div><div class='p-6 sm:p-8'><p class='text-sm text-slate-300 mb-5'>A living NextBlock&trade; install &mdash; everything here is real and clickable:</p><ul class='space-y-4 text-sm text-slate-200'><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Full block editor</strong> with slash commands &amp; drag-and-drop.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Bilingual</strong> English / French content management.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>A complete demo storefront</strong> with a full checkout flow.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Wipes clean daily</strong> &mdash; always a fresh start.</span></li></ul></div></div></div></div>"}}]]}
+$en$::jsonb,
+         updated_at = now()
+   WHERE block_type = 'section'
+     AND page_id IS NOT NULL
+     AND language_id = v_en_lang
+     AND content::text LIKE '%nb-sandbox-promo%';
+
+  UPDATE public.blocks
+     SET content = $fr$
+{"container_type":"container","background":{"type":"none"},"responsive_columns":{"mobile":1,"tablet":1,"desktop":1},"column_gap":"xl","vertical_alignment":"center","padding":{"top":"xl","bottom":"xl"},"column_blocks":[[{"block_type":"text","content":{"html_content":"<!--nb-sandbox-promo--><div class='relative overflow-hidden rounded-[2.5rem] border border-slate-200 bg-gradient-to-br from-white via-slate-50 to-blue-50 shadow-2xl shadow-slate-900/10 dark:border-white/10 dark:from-slate-900 dark:via-slate-900 dark:to-blue-950 dark:shadow-black/40'><div class='grid gap-10 p-8 sm:p-12 lg:grid-cols-2 lg:items-center'><div><p class='text-xs uppercase tracking-[0.25em] text-cyan-600 dark:text-cyan-400 font-bold mb-4'>D&eacute;mo en direct &middot; Sans inscription</p><h2 class='text-4xl md:text-5xl font-bold text-slate-900 dark:text-white mb-6 leading-tight'>Essayez le CMS complet,<br/>en direct d&egrave;s maintenant.</h2><p class='text-lg text-slate-600 dark:text-slate-300 max-w-xl leading-relaxed mb-8'>Ne vous contentez pas de lire des articles sur NextBlock&trade; &mdash; prenez les commandes. Notre bac &agrave; sable public est une installation compl&egrave;te et pr&eacute;charg&eacute;e o&ugrave; vous pouvez cr&eacute;er des pages avec l'&eacute;diteur de blocs, g&eacute;rer du contenu bilingue et parcourir une vraie boutique de d&eacute;monstration. Il se r&eacute;initialise chaque jour : explorez librement et cassez tout ce que vous voulez.</p><div class='flex flex-col sm:flex-row gap-4'><a href='https://cms.nextblock.dev' target='_blank' rel='noopener noreferrer' class='inline-flex items-center justify-center gap-2 rounded-xl px-7 h-12 text-sm font-semibold text-white bg-blue-600 hover:bg-blue-700 shadow-lg shadow-blue-500/25 transition-all no-underline'>D&eacute;couvrir la d&eacute;mo &rarr;</a><a href='https://cms.nextblock.dev/sign-in' target='_blank' rel='noopener noreferrer' class='inline-flex items-center justify-center gap-2 rounded-xl px-7 h-12 text-sm font-semibold text-slate-700 dark:text-white border border-slate-300 dark:border-white/20 hover:bg-slate-100 dark:hover:bg-white/10 transition-all no-underline'>Ouvrir le tableau de bord &rarr;</a></div><p class='text-xs text-slate-500 dark:text-slate-400 mt-4'>Identifiants d&eacute;mo <span class='font-mono text-slate-700 dark:text-slate-300'>demo@nextblock.ca</span> / <span class='font-mono text-slate-700 dark:text-slate-300'>password</span> &middot; R&eacute;initialis&eacute; chaque jour</p></div><div class='rounded-3xl overflow-hidden border border-slate-800 bg-slate-900 shadow-xl shadow-slate-900/20 dark:border-white/10 dark:bg-white/5 dark:backdrop-blur-xl'><div class='flex items-center gap-2 px-4 py-3 border-b border-white/10 bg-white/5'><span class='w-3 h-3 rounded-full bg-red-400/70'></span><span class='w-3 h-3 rounded-full bg-yellow-400/70'></span><span class='w-3 h-3 rounded-full bg-green-400/70'></span><span class='ml-3 flex-1 truncate rounded-md bg-black/30 px-3 py-1 text-xs font-mono text-slate-300'>cms.nextblock.dev</span></div><div class='p-6 sm:p-8'><p class='text-sm text-slate-300 mb-5'>Une installation NextBlock&trade; bien vivante &mdash; tout ici est r&eacute;el et cliquable :</p><ul class='space-y-4 text-sm text-slate-200'><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>&Eacute;diteur de blocs complet</strong> : commandes slash et glisser-d&eacute;poser.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Gestion bilingue</strong> du contenu fran&ccedil;ais / anglais.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Une boutique de d&eacute;monstration compl&egrave;te</strong> avec un parcours de paiement complet.</span></li><li class='flex items-start gap-3'><span class='mt-0.5 flex h-6 w-6 flex-shrink-0 items-center justify-center rounded-full bg-cyan-500/15 text-cyan-300 text-xs'>&#10003;</span><span><strong class='text-white'>Remis &agrave; z&eacute;ro chaque jour</strong> &mdash; toujours un nouveau d&eacute;part.</span></li></ul></div></div></div></div>"}}]]}
+$fr$::jsonb,
+         updated_at = now()
+   WHERE block_type = 'section'
+     AND page_id IS NOT NULL
+     AND language_id = v_fr_lang
+     AND content::text LIKE '%nb-sandbox-promo%';
+END
+$body$;

package/supabase/migrations/00000000000010_drop_github_username.sql

@@ -1,79 +1,79 @@
--- Drop the github_username profile column and remove the GitHub-auth artifacts.
---
--- GitHub OAuth sign-in / account-linking was removed from the app: it cannot be
--- provisioned as part of a one-click deployment (each install needs its own GitHub
--- OAuth app + client secret + Supabase's manual-linking toggle, none of which can
--- ship in a migration). github_username was only ever populated from that OAuth
--- flow, so the column and its seed strings are now dead.
---
--- NOTE: the self-update "Connect GitHub" flow (lib/updates/*, ConnectGitHubButton)
--- is a separate feature and is intentionally left untouched — the connect_github
--- translation is kept for it.
-
--- 1. Rewrite handle_new_user() so new signups no longer read/populate github_username.
-CREATE OR REPLACE FUNCTION public.handle_new_user() RETURNS trigger
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  admin_flag_set boolean := false;
-  user_role public.user_role;
-  v_full_name text;
-  v_avatar_url text;
-BEGIN
-  INSERT INTO public.site_settings (key, value)
-  VALUES ('is_admin_created', 'false'::jsonb)
-  ON CONFLICT (key) DO NOTHING;
-
-  SELECT COALESCE(value::jsonb::boolean, false)
-    INTO admin_flag_set
-  FROM public.site_settings
-  WHERE key = 'is_admin_created'
-  FOR UPDATE;
-
-  IF admin_flag_set = false THEN
-    user_role := 'ADMIN'::public.user_role;
-
-    UPDATE public.site_settings
-    SET value = 'true'::jsonb
-    WHERE key = 'is_admin_created';
-  ELSE
-    user_role := 'USER'::public.user_role;
-  END IF;
-
-  v_full_name := NEW.raw_user_meta_data->>'full_name';
-  v_avatar_url := NEW.raw_user_meta_data->>'avatar_url';
-
-  INSERT INTO public.profiles (
-    id,
-    role,
-    full_name,
-    avatar_url
-  )
-  VALUES (
-    NEW.id,
-    user_role,
-    v_full_name,
-    v_avatar_url
-  )
-  ON CONFLICT (id) DO UPDATE SET
-    full_name = EXCLUDED.full_name,
-    avatar_url = EXCLUDED.avatar_url;
-
-  RETURN NEW;
-END;
-$$;
-
--- 2. Drop the column now that nothing writes it.
-ALTER TABLE public.profiles DROP COLUMN IF EXISTS github_username;
-
--- 3. Remove the GitHub-auth-only translation strings. connect_github is intentionally
---    kept — it is still used by the self-update "Connect GitHub" button.
-DELETE FROM public.translations
-WHERE key IN (
-  'continue_with_github',
-  'github_username',
-  'github_username_help',
-  'github_link_failed',
-  'github_connected'
-);
+-- Drop the github_username profile column and remove the GitHub-auth artifacts.
+--
+-- GitHub OAuth sign-in / account-linking was removed from the app: it cannot be
+-- provisioned as part of a one-click deployment (each install needs its own GitHub
+-- OAuth app + client secret + Supabase's manual-linking toggle, none of which can
+-- ship in a migration). github_username was only ever populated from that OAuth
+-- flow, so the column and its seed strings are now dead.
+--
+-- NOTE: the self-update "Connect GitHub" flow (lib/updates/*, ConnectGitHubButton)
+-- is a separate feature and is intentionally left untouched — the connect_github
+-- translation is kept for it.
+
+-- 1. Rewrite handle_new_user() so new signups no longer read/populate github_username.
+CREATE OR REPLACE FUNCTION public.handle_new_user() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  admin_flag_set boolean := false;
+  user_role public.user_role;
+  v_full_name text;
+  v_avatar_url text;
+BEGIN
+  INSERT INTO public.site_settings (key, value)
+  VALUES ('is_admin_created', 'false'::jsonb)
+  ON CONFLICT (key) DO NOTHING;
+
+  SELECT COALESCE(value::jsonb::boolean, false)
+    INTO admin_flag_set
+  FROM public.site_settings
+  WHERE key = 'is_admin_created'
+  FOR UPDATE;
+
+  IF admin_flag_set = false THEN
+    user_role := 'ADMIN'::public.user_role;
+
+    UPDATE public.site_settings
+    SET value = 'true'::jsonb
+    WHERE key = 'is_admin_created';
+  ELSE
+    user_role := 'USER'::public.user_role;
+  END IF;
+
+  v_full_name := NEW.raw_user_meta_data->>'full_name';
+  v_avatar_url := NEW.raw_user_meta_data->>'avatar_url';
+
+  INSERT INTO public.profiles (
+    id,
+    role,
+    full_name,
+    avatar_url
+  )
+  VALUES (
+    NEW.id,
+    user_role,
+    v_full_name,
+    v_avatar_url
+  )
+  ON CONFLICT (id) DO UPDATE SET
+    full_name = EXCLUDED.full_name,
+    avatar_url = EXCLUDED.avatar_url;
+
+  RETURN NEW;
+END;
+$$;
+
+-- 2. Drop the column now that nothing writes it.
+ALTER TABLE public.profiles DROP COLUMN IF EXISTS github_username;
+
+-- 3. Remove the GitHub-auth-only translation strings. connect_github is intentionally
+--    kept — it is still used by the self-update "Connect GitHub" button.
+DELETE FROM public.translations
+WHERE key IN (
+  'continue_with_github',
+  'github_username',
+  'github_username_help',
+  'github_link_failed',
+  'github_connected'
+);

package/supabase/migrations/00000000000011_language_detection_admin_only.sql

@@ -1,21 +1,21 @@
--- Restrict writes to the language-detection settings row to ADMIN only.
---
--- `site_settings.language_detection_settings` is a non-sensitive, anon-READABLE
--- key (the request proxy reads it with the anon client to pick a visitor's first
--- language). The CMS surfaces it under /cms/settings (ADMIN-only) and the server
--- action guards with an ADMIN check, but the baseline write policies let ADMIN
--- *or* WRITER write any non-sensitive key — so a WRITER could change site-wide
--- detection directly via PostgREST. This migration adds the key to the ADMIN-only
--- write group (INSERT/UPDATE/DELETE) to match the UI boundary, while leaving the
--- SELECT policy untouched so the proxy's anon read keeps working.
---
--- Forward-only; recreates the three write policies idempotently.
-
-DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
-CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
-CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
-CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+-- Restrict writes to the language-detection settings row to ADMIN only.
+--
+-- `site_settings.language_detection_settings` is a non-sensitive, anon-READABLE
+-- key (the request proxy reads it with the anon client to pick a visitor's first
+-- language). The CMS surfaces it under /cms/settings (ADMIN-only) and the server
+-- action guards with an ADMIN check, but the baseline write policies let ADMIN
+-- *or* WRITER write any non-sensitive key — so a WRITER could change site-wide
+-- detection directly via PostgREST. This migration adds the key to the ADMIN-only
+-- write group (INSERT/UPDATE/DELETE) to match the UI boundary, while leaving the
+-- SELECT policy untouched so the proxy's anon read keeps working.
+--
+-- Forward-only; recreates the three write policies idempotently.
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));

package/supabase/migrations/00000000000013_youtube_nocookie_embeds.sql

@@ -0,0 +1,136 @@
+-- 00000000000013_youtube_nocookie_embeds.sql
+--
+-- Lighthouse Best Practices scored 96 instead of 100: the `inspector-issues` audit
+-- (binary, weight 1 of 27 -> 26/27 = 96) failed with a DevTools "Cookie" issue
+-- attributed to www.youtube.com/embed/71MyfoL4YVM. The seeded home-page hero and the
+-- seeded articles embed raw <iframe> markup pointing at www.youtube.com, whose player
+-- writes cookies on load.
+--
+-- The real fix is the render-time click-to-play facade added in
+-- apps/nextblock/components/media/YouTubeFacade.tsx (the nocookie host does NOT stop
+-- the player's document.cookie writes -- only not loading the player does). This
+-- migration is the data-hygiene half: it rewrites every stored embed to the
+-- privacy-enhanced host so any surface that still renders a raw iframe (published-lib
+-- renderers, CMS previews, exports, downstream installs on an older app build) is at
+-- least cookie-reduced, and so the stored content matches what we ship.
+--
+-- It also fixes the bogus Permissions Policy feature in the seeded allow attribute:
+-- 'accelerated-motion' is not a real feature (Chrome logs "Unrecognized feature");
+-- the canonical YouTube embed uses 'accelerometer'.
+--
+-- Append-only: 00000000000003_baseline_seed.sql is applied everywhere and is NOT edited.
+-- Scoped by CONTENT MATCH, never by block id -- ids drift on installs where the demo
+-- content was re-created (see the convention documented in 00000000000006:11-13 and
+-- used by 007/009). This is a pure host-substring swap, so it never clobbers a user's
+-- edited copy, it also repairs author-pasted embeds, and it is naturally idempotent
+-- (a second run matches zero rows) which matters because the nightly sandbox reset
+-- replays the whole migration chain from a truncated history.
+--
+-- No dollar-quoting is needed here: neither search nor replacement literal contains a
+-- single quote, and neither contains a JSON metacharacter, so the ::text round-trip
+-- always re-parses as valid JSON. Query strings (?si=...) are preserved.
+--
+-- NOTE: keep the word "sandbox" OUT of this filename -- generate-sandbox-reset.ts
+-- excludes any migration whose filename contains "sandbox".
+
+-- 1. Live page/post block content (the 4 seeded rows + any author-added embed).
+UPDATE public.blocks
+   SET content = replace(
+         replace(content::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE content IS NOT NULL
+   AND (content::text LIKE '%www.youtube.com/embed/%'
+        OR content::text LIKE '%accelerated-motion%');
+
+-- 2. Live Draft Mode snapshots. Publishing a pre-existing draft would otherwise write
+--    the cookie host straight back into public.blocks.
+UPDATE public.content_drafts
+   SET blocks = replace(
+         replace(blocks::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE blocks::text LIKE '%www.youtube.com/embed/%'
+    OR blocks::text LIKE '%accelerated-motion%';
+
+UPDATE public.content_drafts
+   SET meta = replace(
+         replace(meta::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE meta::text LIKE '%www.youtube.com/embed/%'
+    OR meta::text LIKE '%accelerated-motion%';
+
+UPDATE public.product_drafts
+   SET blocks = replace(
+         replace(blocks::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE blocks::text LIKE '%www.youtube.com/embed/%'
+    OR blocks::text LIKE '%accelerated-motion%';
+
+-- product_drafts.meta carries short_description / description_json.
+UPDATE public.product_drafts
+   SET meta = replace(
+         replace(meta::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE meta::text LIKE '%www.youtube.com/embed/%'
+    OR meta::text LIKE '%accelerated-motion%';
+
+-- 3. Revision history. apps/nextblock/app/cms/revisions/service.ts replays a snapshot
+--    verbatim, so one "Restore version" click would otherwise reintroduce the issue.
+--    URL-only rewrite; nothing else about the historical snapshot is touched.
+UPDATE public.page_revisions
+   SET content = replace(
+         replace(content::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE content::text LIKE '%www.youtube.com/embed/%'
+    OR content::text LIKE '%accelerated-motion%';
+
+UPDATE public.post_revisions
+   SET content = replace(
+         replace(content::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE content::text LIKE '%www.youtube.com/embed/%'
+    OR content::text LIKE '%accelerated-motion%';
+
+-- 4. Product rich text rendered on public /product/* routes.
+UPDATE public.products
+   SET short_description = replace(
+         replace(short_description, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )
+ WHERE short_description IS NOT NULL
+   AND (short_description LIKE '%www.youtube.com/embed/%'
+        OR short_description LIKE '%accelerated-motion%');
+
+UPDATE public.products
+   SET description_json = replace(
+         replace(description_json::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE description_json IS NOT NULL
+   AND (description_json::text LIKE '%www.youtube.com/embed/%'
+        OR description_json::text LIKE '%accelerated-motion%');
+
+-- 5. Custom block definitions (rich-text defaults / emptyFallback markup rendered by
+--    DynamicLayoutEngine). Host-only swap, so the is_valid_custom_block_* CHECK
+--    constraints still hold. No-op on a fresh install.
+UPDATE public.custom_block_definitions
+   SET fields = replace(
+         replace(fields::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE fields::text LIKE '%www.youtube.com/embed/%'
+    OR fields::text LIKE '%accelerated-motion%';
+
+UPDATE public.custom_block_definitions
+   SET layout_schema = replace(
+         replace(layout_schema::text, 'www.youtube.com/embed/', 'www.youtube-nocookie.com/embed/'),
+         'accelerated-motion', 'accelerometer'
+       )::jsonb
+ WHERE layout_schema::text LIKE '%www.youtube.com/embed/%'
+    OR layout_schema::text LIKE '%accelerated-motion%';