@nextblock-cms/db 0.14.4 → 0.14.6

package/lib/supabase/server.d.ts

@@ -725,6 +725,45 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 referencedColumns: ["id"];
             }];
         };
+        mcp_access_tokens: {
+            Row: {
+                created_at: string;
+                created_by: string | null;
+                expires_at: string | null;
+                id: string;
+                last_used_at: string | null;
+                name: string;
+                revoked_at: string | null;
+                scopes: string[];
+                token_hash: string;
+                token_prefix: string;
+            };
+            Insert: {
+                created_at?: string;
+                created_by?: string | null;
+                expires_at?: string | null;
+                id?: string;
+                last_used_at?: string | null;
+                name: string;
+                revoked_at?: string | null;
+                scopes?: string[];
+                token_hash: string;
+                token_prefix: string;
+            };
+            Update: {
+                created_at?: string;
+                created_by?: string | null;
+                expires_at?: string | null;
+                id?: string;
+                last_used_at?: string | null;
+                name?: string;
+                revoked_at?: string | null;
+                scopes?: string[];
+                token_hash?: string;
+                token_prefix?: string;
+            };
+            Relationships: [];
+        };
         media: {
             Row: {
                 blur_data_url: string | null;
@@ -1083,6 +1122,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 language_id: number;
                 meta_description: string | null;
                 meta_title: string | null;
+                published_at: string | null;
                 slug: string;
                 status: Database["public"]["Enums"]["page_status"];
                 title: string;
@@ -1099,6 +1139,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 language_id: number;
                 meta_description?: string | null;
                 meta_title?: string | null;
+                published_at?: string | null;
                 slug: string;
                 status?: Database["public"]["Enums"]["page_status"];
                 title: string;
@@ -1115,6 +1156,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 language_id?: number;
                 meta_description?: string | null;
                 meta_title?: string | null;
+                published_at?: string | null;
                 slug?: string;
                 status?: Database["public"]["Enums"]["page_status"];
                 title?: string;
@@ -1520,6 +1562,48 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 referencedColumns: ["id"];
             }];
         };
+        product_revisions: {
+            Row: {
+                author_id: string | null;
+                content: import('./types').Json;
+                created_at: string;
+                id: number;
+                product_id: string;
+                revision_type: Database["public"]["Enums"]["revision_type"];
+                version: number;
+            };
+            Insert: {
+                author_id?: string | null;
+                content: import('./types').Json;
+                created_at?: string;
+                id?: number;
+                product_id: string;
+                revision_type: Database["public"]["Enums"]["revision_type"];
+                version: number;
+            };
+            Update: {
+                author_id?: string | null;
+                content?: import('./types').Json;
+                created_at?: string;
+                id?: number;
+                product_id?: string;
+                revision_type?: Database["public"]["Enums"]["revision_type"];
+                version?: number;
+            };
+            Relationships: [{
+                foreignKeyName: "product_revisions_author_id_fkey";
+                columns: ["author_id"];
+                isOneToOne: false;
+                referencedRelation: "profiles";
+                referencedColumns: ["id"];
+            }, {
+                foreignKeyName: "product_revisions_product_id_fkey";
+                columns: ["product_id"];
+                isOneToOne: false;
+                referencedRelation: "products";
+                referencedColumns: ["id"];
+            }];
+        };
         product_variants: {
             Row: {
                 created_at: string | null;
@@ -1613,6 +1697,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 price: number;
                 prices: import('./types').Json;
                 product_type: string;
+                published_at: string | null;
                 sale_end_at: string | null;
                 sale_price: number | null;
                 sale_prices: import('./types').Json | null;
@@ -1632,6 +1717,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 trial_requires_payment_method: boolean;
                 upc: string | null;
                 updated_at: string | null;
+                version: number;
             };
             Insert: {
                 average_rating?: number;
@@ -1650,6 +1736,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 price: number;
                 prices?: import('./types').Json;
                 product_type: string;
+                published_at?: string | null;
                 sale_end_at?: string | null;
                 sale_price?: number | null;
                 sale_prices?: import('./types').Json | null;
@@ -1669,6 +1756,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 trial_requires_payment_method?: boolean;
                 upc?: string | null;
                 updated_at?: string | null;
+                version?: number;
             };
             Update: {
                 average_rating?: number;
@@ -1687,6 +1775,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 price?: number;
                 prices?: import('./types').Json;
                 product_type?: string;
+                published_at?: string | null;
                 sale_end_at?: string | null;
                 sale_price?: number | null;
                 sale_prices?: import('./types').Json | null;
@@ -1706,6 +1795,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 trial_requires_payment_method?: boolean;
                 upc?: string | null;
                 updated_at?: string | null;
+                version?: number;
             };
             Relationships: [{
                 foreignKeyName: "products_language_id_fkey";

package/lib/supabase/types.d.ts

@@ -749,6 +749,45 @@ export type Database = {
                     }
                 ];
             };
+            mcp_access_tokens: {
+                Row: {
+                    created_at: string;
+                    created_by: string | null;
+                    expires_at: string | null;
+                    id: string;
+                    last_used_at: string | null;
+                    name: string;
+                    revoked_at: string | null;
+                    scopes: string[];
+                    token_hash: string;
+                    token_prefix: string;
+                };
+                Insert: {
+                    created_at?: string;
+                    created_by?: string | null;
+                    expires_at?: string | null;
+                    id?: string;
+                    last_used_at?: string | null;
+                    name: string;
+                    revoked_at?: string | null;
+                    scopes?: string[];
+                    token_hash: string;
+                    token_prefix: string;
+                };
+                Update: {
+                    created_at?: string;
+                    created_by?: string | null;
+                    expires_at?: string | null;
+                    id?: string;
+                    last_used_at?: string | null;
+                    name?: string;
+                    revoked_at?: string | null;
+                    scopes?: string[];
+                    token_hash?: string;
+                    token_prefix?: string;
+                };
+                Relationships: [];
+            };
             media: {
                 Row: {
                     blur_data_url: string | null;
@@ -1122,6 +1161,7 @@ export type Database = {
                     language_id: number;
                     meta_description: string | null;
                     meta_title: string | null;
+                    published_at: string | null;
                     slug: string;
                     status: Database["public"]["Enums"]["page_status"];
                     title: string;
@@ -1138,6 +1178,7 @@ export type Database = {
                     language_id: number;
                     meta_description?: string | null;
                     meta_title?: string | null;
+                    published_at?: string | null;
                     slug: string;
                     status?: Database["public"]["Enums"]["page_status"];
                     title: string;
@@ -1154,6 +1195,7 @@ export type Database = {
                     language_id?: number;
                     meta_description?: string | null;
                     meta_title?: string | null;
+                    published_at?: string | null;
                     slug?: string;
                     status?: Database["public"]["Enums"]["page_status"];
                     title?: string;
@@ -1583,6 +1625,51 @@ export type Database = {
                     }
                 ];
             };
+            product_revisions: {
+                Row: {
+                    author_id: string | null;
+                    content: Json;
+                    created_at: string;
+                    id: number;
+                    product_id: string;
+                    revision_type: Database["public"]["Enums"]["revision_type"];
+                    version: number;
+                };
+                Insert: {
+                    author_id?: string | null;
+                    content: Json;
+                    created_at?: string;
+                    id?: number;
+                    product_id: string;
+                    revision_type: Database["public"]["Enums"]["revision_type"];
+                    version: number;
+                };
+                Update: {
+                    author_id?: string | null;
+                    content?: Json;
+                    created_at?: string;
+                    id?: number;
+                    product_id?: string;
+                    revision_type?: Database["public"]["Enums"]["revision_type"];
+                    version?: number;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "product_revisions_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profiles";
+                        referencedColumns: ["id"];
+                    },
+                    {
+                        foreignKeyName: "product_revisions_product_id_fkey";
+                        columns: ["product_id"];
+                        isOneToOne: false;
+                        referencedRelation: "products";
+                        referencedColumns: ["id"];
+                    }
+                ];
+            };
             product_variants: {
                 Row: {
                     created_at: string | null;
@@ -1679,6 +1766,7 @@ export type Database = {
                     price: number;
                     prices: Json;
                     product_type: string;
+                    published_at: string | null;
                     sale_end_at: string | null;
                     sale_price: number | null;
                     sale_prices: Json | null;
@@ -1698,6 +1786,7 @@ export type Database = {
                     trial_requires_payment_method: boolean;
                     upc: string | null;
                     updated_at: string | null;
+                    version: number;
                 };
                 Insert: {
                     average_rating?: number;
@@ -1716,6 +1805,7 @@ export type Database = {
                     price: number;
                     prices?: Json;
                     product_type: string;
+                    published_at?: string | null;
                     sale_end_at?: string | null;
                     sale_price?: number | null;
                     sale_prices?: Json | null;
@@ -1735,6 +1825,7 @@ export type Database = {
                     trial_requires_payment_method?: boolean;
                     upc?: string | null;
                     updated_at?: string | null;
+                    version?: number;
                 };
                 Update: {
                     average_rating?: number;
@@ -1753,6 +1844,7 @@ export type Database = {
                     price?: number;
                     prices?: Json;
                     product_type?: string;
+                    published_at?: string | null;
                     sale_end_at?: string | null;
                     sale_price?: number | null;
                     sale_prices?: Json | null;
@@ -1772,6 +1864,7 @@ export type Database = {
                     trial_requires_payment_method?: boolean;
                     upc?: string | null;
                     updated_at?: string | null;
+                    version?: number;
                 };
                 Relationships: [
                     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/db",
-  "version": "0.14.4",
+  "version": "0.14.6",
   "main": "index.cjs.js",
   "module": "index.es.js",
   "types": "index.d.ts",

package/supabase/migrations/00000000000015_scheduled_publishing.sql

@@ -0,0 +1,43 @@
+-- Scheduled publishing for pages and products.
+--
+-- Posts already support scheduling: `posts.published_at` exists and every public
+-- read gates on `published_at IS NULL OR published_at <= now()`, so a row with
+-- status='published' and a future date is withheld until the date passes. Pages
+-- and products had no equivalent column, so "go live on Tuesday" was impossible
+-- for them. This adds the same column with the same semantics.
+--
+-- Visibility is derived from the (status, published_at) PAIR — no new enum value:
+--
+--   status = draft/archived                      -> not public, whatever the date
+--   status = published|active, published_at NULL -> public now
+--   status = published|active, date <= now()     -> public now
+--   status = published|active, date >  now()     -> SCHEDULED (withheld)
+--
+-- Deriving "scheduled" instead of storing it keeps `page_status` unchanged (adding
+-- an enum value can't be done inside a transaction with other DDL in Postgres) and
+-- matches what posts have always done, so one code path covers all three types.
+--
+-- NULL is the safe default: every existing published row keeps rendering exactly as
+-- before, so this migration needs no backfill and changes no current behavior.
+--
+-- Forward-only and idempotent.
+
+ALTER TABLE public.pages
+    ADD COLUMN IF NOT EXISTS published_at timestamp with time zone;
+
+COMMENT ON COLUMN public.pages.published_at IS
+    'Optional go-live moment. NULL = live as soon as status is published. A future value withholds the page from public reads until it passes (status stays "published"; the CMS renders that pair as "Scheduled").';
+
+ALTER TABLE public.products
+    ADD COLUMN IF NOT EXISTS published_at timestamp with time zone;
+
+COMMENT ON COLUMN public.products.published_at IS
+    'Optional go-live moment. NULL = live as soon as status is active. A future value withholds the product from public reads until it passes (status stays "active"; the CMS renders that pair as "Scheduled").';
+
+-- Public listing/index queries filter on the (status, published_at) pair together
+-- (catalog, sitemap, page lookups), so a composite index serves them in one pass.
+CREATE INDEX IF NOT EXISTS pages_status_published_at_idx
+    ON public.pages (status, published_at);
+
+CREATE INDEX IF NOT EXISTS products_status_published_at_idx
+    ON public.products (status, published_at);

package/supabase/migrations/00000000000016_product_revisions_and_revision_baseline.sql

@@ -0,0 +1,310 @@
+-- 00000000000016_product_revisions_and_revision_baseline.sql
+--
+-- Revision History, part 1 of 2 (schema). The application-side rewrite lives in
+-- apps/nextblock/app/cms/revisions/**.
+--
+-- Three things happen here:
+--
+--   1. products.version    — the monotonic counter the hybrid revision engine drives,
+--                            mirroring pages.version / posts.version.
+--
+--   2. product_revisions   — a structural mirror of page_revisions / post_revisions.
+--                            product_id is uuid (products.id is uuid, not bigint), and
+--                            writes are gated on is_admin() to match products_*_policy
+--                            rather than the ADMIN|WRITER pattern the page/post revision
+--                            tables use. A WRITER who could insert a revision but not
+--                            apply a restore would get a silent no-op restore, because
+--                            PostgREST returns no error for an UPDATE matching zero rows.
+--
+--   3. Revision baseline   — every page, post and product gets a real `snapshot` row to
+--                            restore to. Until now the CMS synthesised a fake "Initial
+--                            Version" entry in the UI whose Restore button resolved to
+--                            "current metadata + zero blocks" and wiped the content.
+--                            There is now an actual stored baseline instead.
+--
+--                            Case A (version = 1, no revisions at all): the live row IS
+--                            version 1. This covers seeded content — 00000000000003
+--                            inserts every page and post at version 1 and writes no
+--                            revision rows — and everything authored since the CMS save
+--                            path stopped recording revisions. Snapshotting it at
+--                            version 1 is what makes "restore the original seeded page"
+--                            real for the first time.
+--
+--                            Case B (version > 1 but no snapshot at or below it): the
+--                            true v1 is unrecoverable and is NOT fabricated. A snapshot
+--                            of the current state is stored at the current version so the
+--                            diff chain has a valid base and future restores resolve.
+--
+-- Forward-only, idempotent, and it modifies no existing row: every backfill is an
+-- INSERT ... WHERE NOT EXISTS ... ON CONFLICT DO NOTHING.
+
+-- ---------------------------------------------------------------------------
+-- 1. products.version
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.products
+    ADD COLUMN IF NOT EXISTS version integer DEFAULT 1 NOT NULL;
+
+COMMENT ON COLUMN public.products.version IS 'Monotonic version number for hybrid revisions.';
+
+-- ---------------------------------------------------------------------------
+-- 2. product_revisions
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS public.product_revisions (
+    id bigint NOT NULL,
+    product_id uuid NOT NULL,
+    author_id uuid,
+    version integer NOT NULL,
+    revision_type public.revision_type NOT NULL,
+    content jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+COMMENT ON TABLE public.product_revisions IS 'Hybrid (snapshot/diff) revisions for products.';
+COMMENT ON COLUMN public.product_revisions.content IS 'If snapshot: full content; if diff: JSON Patch array.';
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_attribute
+     WHERE attrelid = 'public.product_revisions'::regclass
+       AND attname  = 'id'
+       AND attidentity <> ''
+  ) THEN
+    ALTER TABLE public.product_revisions
+      ALTER COLUMN id ADD GENERATED BY DEFAULT AS IDENTITY (
+        SEQUENCE NAME public.product_revisions_id_seq
+        START WITH 1
+        INCREMENT BY 1
+        NO MINVALUE
+        NO MAXVALUE
+        CACHE 1
+      );
+  END IF;
+END $rb$;
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                  WHERE conname = 'product_revisions_pkey'
+                    AND conrelid = 'public.product_revisions'::regclass) THEN
+    ALTER TABLE ONLY public.product_revisions
+      ADD CONSTRAINT product_revisions_pkey PRIMARY KEY (id);
+  END IF;
+END $rb$;
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                  WHERE conname = 'product_revisions_product_version_key'
+                    AND conrelid = 'public.product_revisions'::regclass) THEN
+    ALTER TABLE ONLY public.product_revisions
+      ADD CONSTRAINT product_revisions_product_version_key UNIQUE (product_id, version);
+  END IF;
+END $rb$;
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                  WHERE conname = 'product_revisions_author_id_fkey'
+                    AND conrelid = 'public.product_revisions'::regclass) THEN
+    ALTER TABLE ONLY public.product_revisions
+      ADD CONSTRAINT product_revisions_author_id_fkey
+      FOREIGN KEY (author_id) REFERENCES public.profiles(id) ON DELETE SET NULL;
+  END IF;
+END $rb$;
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                  WHERE conname = 'product_revisions_product_id_fkey'
+                    AND conrelid = 'public.product_revisions'::regclass) THEN
+    ALTER TABLE ONLY public.product_revisions
+      ADD CONSTRAINT product_revisions_product_id_fkey
+      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE CASCADE;
+  END IF;
+END $rb$;
+
+CREATE INDEX IF NOT EXISTS idx_product_revisions_author_id
+    ON public.product_revisions USING btree (author_id);
+
+CREATE INDEX IF NOT EXISTS idx_product_revisions_product_id_version
+    ON public.product_revisions USING btree (product_id, version);
+
+ALTER TABLE public.product_revisions ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS product_revisions_read_policy ON public.product_revisions;
+CREATE POLICY product_revisions_read_policy ON public.product_revisions
+  FOR SELECT TO authenticated USING (true);
+
+DROP POLICY IF EXISTS product_revisions_insert_policy ON public.product_revisions;
+CREATE POLICY product_revisions_insert_policy ON public.product_revisions
+  FOR INSERT TO authenticated
+  WITH CHECK (((SELECT public.is_admin() AS is_admin) IS TRUE));
+
+DROP POLICY IF EXISTS product_revisions_update_policy ON public.product_revisions;
+CREATE POLICY product_revisions_update_policy ON public.product_revisions
+  FOR UPDATE TO authenticated
+  USING (((SELECT public.is_admin() AS is_admin) IS TRUE))
+  WITH CHECK (((SELECT public.is_admin() AS is_admin) IS TRUE));
+
+DROP POLICY IF EXISTS product_revisions_delete_policy ON public.product_revisions;
+CREATE POLICY product_revisions_delete_policy ON public.product_revisions
+  FOR DELETE TO authenticated
+  USING (((SELECT public.is_admin() AS is_admin) IS TRUE));
+
+GRANT ALL ON TABLE    public.product_revisions        TO anon;
+GRANT ALL ON TABLE    public.product_revisions        TO authenticated;
+GRANT ALL ON TABLE    public.product_revisions        TO service_role;
+GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO anon;
+GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO authenticated;
+GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO service_role;
+
+-- ---------------------------------------------------------------------------
+-- 3. Revision baseline backfill
+--
+-- The JSON shape must match FullPageContent / FullPostContent / FullProductContent
+-- in apps/nextblock/app/cms/revisions/utils.ts exactly, or the first diff taken
+-- against a baseline row will be full of phantom operations.
+--
+-- Timestamps are rendered with an explicit millisecond-precision UTC format so they
+-- match JavaScript's Date#toISOString() ("2026-07-03T17:52:15.643Z"). Postgres'
+-- default jsonb rendering of timestamptz ("2026-07-03T17:52:15.643901+00:00") would
+-- differ from the value the application writes and produce a spurious diff on the
+-- very next save.
+-- ---------------------------------------------------------------------------
+
+-- 3a. Pages
+INSERT INTO public.page_revisions (page_id, author_id, version, revision_type, content)
+SELECT
+    p.id,
+    NULL::uuid,
+    p.version,
+    'snapshot'::public.revision_type,
+    jsonb_build_object(
+      'meta', jsonb_build_object(
+        'title',            p.title,
+        'slug',             p.slug,
+        'language_id',      p.language_id,
+        'status',           p.status,
+        'meta_title',       p.meta_title,
+        'meta_description', p.meta_description,
+        'custom_canonical', p.custom_canonical,
+        'published_at',     to_char(p.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+        'feature_image_id', p.feature_image_id
+      ),
+      'blocks', COALESCE((
+        SELECT jsonb_agg(
+                 jsonb_build_object(
+                   'language_id', b.language_id,
+                   'block_type',  b.block_type,
+                   'content',     b.content,
+                   'order',       b."order"
+                 ) ORDER BY b."order" ASC, b.id ASC
+               )
+          FROM public.blocks b
+         WHERE b.page_id = p.id
+      ), '[]'::jsonb)
+    )
+  FROM public.pages p
+ WHERE NOT EXISTS (
+         SELECT 1 FROM public.page_revisions r
+          WHERE r.page_id = p.id
+            AND r.revision_type = 'snapshot'
+            AND r.version <= p.version
+       )
+ON CONFLICT (page_id, version) DO NOTHING;
+
+-- 3b. Posts
+INSERT INTO public.post_revisions (post_id, author_id, version, revision_type, content)
+SELECT
+    po.id,
+    NULL::uuid,
+    po.version,
+    'snapshot'::public.revision_type,
+    jsonb_build_object(
+      'meta', jsonb_build_object(
+        'title',            po.title,
+        'slug',             po.slug,
+        'language_id',      po.language_id,
+        'status',           po.status,
+        'meta_title',       po.meta_title,
+        'meta_description', po.meta_description,
+        'custom_canonical', po.custom_canonical,
+        'published_at',     to_char(po.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+        'feature_image_id', po.feature_image_id,
+        'label',            po.label,
+        'excerpt',          po.excerpt,
+        'subtitle',         po.subtitle
+      ),
+      'blocks', COALESCE((
+        SELECT jsonb_agg(
+                 jsonb_build_object(
+                   'language_id', b.language_id,
+                   'block_type',  b.block_type,
+                   'content',     b.content,
+                   'order',       b."order"
+                 ) ORDER BY b."order" ASC, b.id ASC
+               )
+          FROM public.blocks b
+         WHERE b.post_id = po.id
+      ), '[]'::jsonb)
+    )
+  FROM public.posts po
+ WHERE NOT EXISTS (
+         SELECT 1 FROM public.post_revisions r
+          WHERE r.post_id = po.id
+            AND r.revision_type = 'snapshot'
+            AND r.version <= po.version
+       )
+ON CONFLICT (post_id, version) DO NOTHING;
+
+-- 3c. Products.
+--
+-- Content only. price/prices/sale_*/scheduled_*/stock/sku/average_rating/total_reviews
+-- are deliberately excluded from the snapshot: pricing and inventory are mutated from
+-- outside the editor (promotions, Freemius sync, order fulfilment), ratings are derived
+-- aggregates, and inventory_items is keyed by bare SKU text with no FK to products — so
+-- replaying commerce state on restore would reach rows the editor never touched.
+-- Restoring a product restores its content, not its commerce state.
+INSERT INTO public.product_revisions (product_id, author_id, version, revision_type, content)
+SELECT
+    pr.id,
+    NULL::uuid,
+    pr.version,
+    'snapshot'::public.revision_type,
+    jsonb_build_object(
+      'meta', jsonb_build_object(
+        'title',             pr.title,
+        'slug',              pr.slug,
+        'language_id',       pr.language_id,
+        'status',            pr.status,
+        'meta_title',        pr.meta_title,
+        'meta_description',  pr.meta_description,
+        'custom_canonical',  pr.custom_canonical,
+        'published_at',      to_char(pr.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+        'short_description', pr.short_description,
+        'description_json',  pr.description_json
+      ),
+      'blocks', COALESCE((
+        SELECT jsonb_agg(
+                 jsonb_build_object(
+                   'language_id', b.language_id,
+                   'block_type',  b.block_type,
+                   'content',     b.content,
+                   'order',       b."order"
+                 ) ORDER BY b."order" ASC, b.id ASC
+               )
+          FROM public.blocks b
+         WHERE b.product_id = pr.id
+      ), '[]'::jsonb)
+    )
+  FROM public.products pr
+ WHERE NOT EXISTS (
+         SELECT 1 FROM public.product_revisions r
+          WHERE r.product_id = pr.id
+            AND r.revision_type = 'snapshot'
+            AND r.version <= pr.version
+       )
+ON CONFLICT (product_id, version) DO NOTHING;

package/supabase/migrations/00000000000017_cortex_ai_mcp_server.sql

@@ -0,0 +1,91 @@
+-- Cortex AI MCP (Model Context Protocol) server access.
+--
+-- Adds the bearer-token store that gates /api/mcp, the endpoint that exposes the
+-- Cortex AI tool registry to external MCP clients (Claude Code, Claude Desktop,
+-- Cursor, VS Code). Two pieces:
+--
+--   1. public.mcp_access_tokens — one row per issued token. We store ONLY the
+--      SHA-256 hash of the token, never the token itself: the plaintext is shown
+--      to the admin exactly once at mint time and is unrecoverable afterwards, so
+--      a database leak cannot be replayed against the MCP endpoint. `token_prefix`
+--      is the non-secret leading fragment kept purely so the UI can tell two tokens
+--      apart in a list.
+--
+--   2. cortex_ai_mcp_settings — a non-secret JSON site_settings row holding the
+--      server on/off switch and the localhost-trust flag. It is added to all four
+--      site_settings policies so only authenticated ADMINs can read or write it;
+--      the MCP route itself reads it through the service-role client, which
+--      bypasses RLS.
+--
+-- Forward-only. Recreates the four site_settings policies idempotently, preserving
+-- every key already in each policy's sensitive array (note that
+-- language_detection_settings stays anon-READABLE and so is absent from the SELECT
+-- policy, exactly as migration 00000000000012 left it).
+
+CREATE TABLE IF NOT EXISTS public.mcp_access_tokens (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL,
+  -- Lowercase hex SHA-256 of the plaintext token. Unique so a lookup is a single
+  -- indexed equality probe and duplicate mints are impossible.
+  token_hash text NOT NULL UNIQUE,
+  -- Non-secret display fragment, e.g. "nbmcp_a1b2c3d4". Never enough to authenticate.
+  token_prefix text NOT NULL,
+  -- 'read' grants the read-only tools; 'write' additionally grants the mutating ones.
+  scopes text[] NOT NULL DEFAULT ARRAY['read', 'write']::text[],
+  created_by uuid REFERENCES auth.users (id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  last_used_at timestamptz,
+  expires_at timestamptz,
+  revoked_at timestamptz
+);
+
+COMMENT ON TABLE public.mcp_access_tokens IS
+  'Bearer tokens for the Cortex AI MCP server at /api/mcp. Stores SHA-256 hashes only; plaintext is displayed once at mint time.';
+
+CREATE INDEX IF NOT EXISTS mcp_access_tokens_token_hash_idx
+  ON public.mcp_access_tokens (token_hash);
+
+-- Orders the admin token list newest-first without a sort.
+CREATE INDEX IF NOT EXISTS mcp_access_tokens_created_at_idx
+  ON public.mcp_access_tokens (created_at DESC);
+
+ALTER TABLE public.mcp_access_tokens ENABLE ROW LEVEL SECURITY;
+
+-- Tokens are credentials: admin-only, with no anon or WRITER access at all. The
+-- MCP route verifies them with the service-role client, which bypasses RLS.
+DROP POLICY IF EXISTS mcp_access_tokens_admin_select ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_select ON public.mcp_access_tokens
+  FOR SELECT TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_insert ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_insert ON public.mcp_access_tokens
+  FOR INSERT TO authenticated
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_update ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_update ON public.mcp_access_tokens
+  FOR UPDATE TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role)
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_delete ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_delete ON public.mcp_access_tokens
+  FOR DELETE TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.mcp_access_tokens TO authenticated;
+GRANT ALL ON public.mcp_access_tokens TO service_role;
+
+-- Add cortex_ai_mcp_settings to the admin-only site_settings group (all four policies).
+DROP POLICY IF EXISTS site_settings_read_policy ON public.site_settings;
+CREATE POLICY site_settings_read_policy ON public.site_settings FOR SELECT USING (((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT auth.role() AS role) = 'authenticated'::text) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));