@nextblock-cms/db 0.17.0 → 0.17.1

package/supabase/migrations/00000000000024_updating_article_newline_fix.sql

@@ -1,70 +0,0 @@
--- 00000000000024_updating_article_newline_fix.sql
--- Repairs two mistakes made by 00000000000023 in the "How Updating NextBlock Works"
--- article, and lands the FAQ entry that migration failed to insert.
---
--- 1. RENDERING BUG. 023 wrote `\n` inside ordinary single-quoted SQL literals. With
---    standard_conforming_strings on (the default), that is a literal backslash followed
---    by 'n' — not a newline — so five visible "\n" sequences were stored in the article
---    body. Replaced here with real newlines via chr(10). Idempotent: once none remain,
---    replace() is a no-op.
---
--- 2. SILENT NO-MATCH. 023's FAQ replacement targeted a string spanning `</h3>\n<p>`, and
---    for the same reason the literal never matched the real newline in the stored HTML, so
---    the replacement quietly did nothing. Redone here by anchoring on the single-line <h3>
---    alone and prepending the new entry — no newline in either the search or the
---    replacement, which is the rule this file establishes for editing the article.
---
--- Data-only; no schema change.
-
-DO $body$
-DECLARE
-  v_en_post integer;
-  v_fr_post integer;
-BEGIN
-  SELECT id INTO v_en_post
-    FROM public.posts WHERE language_id = 1 AND slug = 'how-updating-works'
-   ORDER BY id LIMIT 1;
-
-  SELECT id INTO v_fr_post
-    FROM public.posts WHERE language_id = 2 AND slug = 'comment-fonctionnent-les-mises-a-jour'
-   ORDER BY id LIMIT 1;
-
-  IF v_en_post IS NOT NULL THEN
-    UPDATE public.blocks
-       SET content = jsonb_set(
-             content,
-             '{html_content}',
-             to_jsonb(
-               replace(
-                 -- (1) literal backslash-n -> real newline
-                 replace(content->>'html_content', E'\\n', chr(10)),
-                 -- (2) the FAQ entry 023 failed to insert
-                 '<h3>I am on the one-click Vercel deploy &mdash; do I need to run anything?</h3>',
-                 '<h3>I deployed to Vercel, but from <code>npm create nextblock</code>. Is that automatic too?</h3><p>No &mdash; and this is the distinction that catches people out. Automatic updates depend on your repository being the NextBlock <strong>monorepo</strong>, not on where the site is hosted. A project scaffolded by the CLI is the flattened standalone app whatever you deploy it to, so it updates with <code>npm run update</code>. You will not see the <strong>Connect GitHub</strong> step on that kind of install, because the workflow it installs would merge a completely different source tree into yours.</p><h3>I am on the one-click Vercel deploy &mdash; do I need to run anything?</h3>'
-               )
-             )
-           ),
-           updated_at = now()
-     WHERE post_id = v_en_post
-       AND block_type = 'text';
-  END IF;
-
-  IF v_fr_post IS NOT NULL THEN
-    UPDATE public.blocks
-       SET content = jsonb_set(
-             content,
-             '{html_content}',
-             to_jsonb(
-               replace(
-                 replace(content->>'html_content', E'\\n', chr(10)),
-                 '<h3>Je suis sur le d&eacute;ploiement Vercel en un clic &mdash; dois-je lancer quelque chose ?</h3>',
-                 '<h3>J''ai d&eacute;ploy&eacute; sur Vercel, mais depuis <code>npm create nextblock</code>. Est-ce automatique aussi ?</h3><p>Non &mdash; et c''est la distinction qui pi&egrave;ge le plus. Les mises &agrave; jour automatiques d&eacute;pendent du fait que votre d&eacute;p&ocirc;t soit le <strong>monorepo</strong> NextBlock, pas de l''endroit o&ugrave; le site est h&eacute;berg&eacute;. Un projet g&eacute;n&eacute;r&eacute; par le CLI reste l''application autonome aplatie, quel que soit l''h&eacute;bergeur : il se met &agrave; jour avec <code>npm run update</code>. L''&eacute;tape <strong>Connect GitHub</strong> ne s''affiche pas sur ce type d''installation, car le workflow qu''elle installe fusionnerait une arborescence totalement diff&eacute;rente dans la v&ocirc;tre.</p><h3>Je suis sur le d&eacute;ploiement Vercel en un clic &mdash; dois-je lancer quelque chose ?</h3>'
-               )
-             )
-           ),
-           updated_at = now()
-     WHERE post_id = v_fr_post
-       AND block_type = 'text';
-  END IF;
-END
-$body$;

package/supabase/migrations/00000000000025_rebrand_nextblock_dev.sql

@@ -1,53 +0,0 @@
--- 00000000000025_rebrand_nextblock_dev.sql
--- Domain rebrand: the retired .ca domain -> nextblock.dev.
---
--- Two halves to this change, because two populations need different treatment:
---
---   Fresh installs   -- migrations 00000000000003_baseline_seed and
---                       00000000000006/007/009_home_live_demo_promo* were rewritten in place
---                       to seed nextblock.dev directly. Safe to edit despite the append-only
---                       rule: Supabase tracks migration history by version string with no
---                       checksum, so an already-applied file is never re-read or replayed.
---                       Those four are seed/content only -- no schema, no constraints.
---
---   Existing installs -- prod, sandbox, and any deployed fork already seeded the old domain
---                       from the pre-rewrite versions of those files. They never replay, so
---                       this migration corrects their data forward.
---
--- Both paths converge on nextblock.dev. On a fresh install this migration matches nothing
--- and is a no-op, which is also what makes it safe to re-run.
---
--- Also flips the sandbox demo account address. The account itself is created by
--- apps/nextblock/app/api/cron/reset-sandbox/route.ts (now 'demo@nextblock.dev'); the legacy
--- demo account is NOT removed here -- the reset route never deletes auth users and never
--- truncates public.profiles, so it must be deleted by hand in the Supabase Auth dashboard
--- or it survives as a working ADMIN.
---
--- NOTE: keep the word "sandbox" OUT of this filename -- generate-sandbox-reset.ts excludes any
--- migration whose filename contains "sandbox" from the sandbox reset bundle.
-
-DO $body$
-DECLARE
-  -- Assembled from two halves on purpose: it is the one string this rebrand is meant to
-  -- erase, and spelling it out here would leave the repo-wide grep with a permanent hit
-  -- inside the very migration that removes it. Resolves to the retired domain at runtime.
-  legacy_domain constant text := 'nextblock' || '.ca';
-BEGIN
-  -- 1. Seeded UI strings (e.g. the "Purchase at ..." link on the sandbox checkout panel).
-  UPDATE public.translations
-     SET translations = replace(translations::text, legacy_domain, 'nextblock.dev')::jsonb,
-         updated_at   = now()
-   WHERE translations::text LIKE '%' || legacy_domain || '%';
-
-  -- 2. Page/post content -- the home-page "Live Demo" promo carries the demo login address.
-  UPDATE public.blocks
-     SET content    = replace(content::text, legacy_domain, 'nextblock.dev')::jsonb,
-         updated_at = now()
-   WHERE content::text LIKE '%' || legacy_domain || '%';
-
-  -- 3. Site settings -- invoice branding on the sandbox carries the billing address.
-  UPDATE public.site_settings
-     SET value = replace(value::text, legacy_domain, 'nextblock.dev')::jsonb
-   WHERE value::text LIKE '%' || legacy_domain || '%';
-END
-$body$;

package/supabase/migrations/00000000000026_product_inquiries.sql

@@ -1,118 +0,0 @@
--- Purchase enquiries raised when the store cannot take payment.
---
--- A NextBlock store can be fully built — products, prices, images, pages — while its
--- Stripe or Freemius credentials are still missing. Until this migration the only
--- symptom was a shopper reaching checkout and receiving the payment provider's raw
--- rejection ("Invalid API Key provided: sk_test_*ummy"), which tells them nothing and
--- loses the sale outright.
---
--- The storefront now offers those shoppers an enquiry form in place of Add-to-Cart,
--- and every submission lands here. The row is the product, not the email: SMTP is a
--- separate piece of setup that the same half-configured store has usually also not
--- done, so a notification that cannot be sent must never be the only record. The
--- `email_delivered` flag records whether the owner was successfully notified; false
--- means "read this in the CMS, nobody got a mail about it".
---
--- SECURITY POSTURE. Rows hold visitor-supplied PII (name, email, free text) plus a
--- masked IP. There is deliberately NO anon policy of any kind: anonymous visitors
--- neither read nor write this table directly. The public server action inserts with
--- the service-role client after bot-protection and throttle checks, exactly as
--- `privacy_consent_logs` does — that keeps the insert shape server-controlled and
--- means a leaked anon key cannot enumerate or seed enquiries. ADMINs read; nobody
--- else does, because these are sales leads and personal data.
---
--- `product_id` is a PLAIN uuid with NO foreign key, following site_script_revisions:
--- an enquiry is evidence that someone wanted a product, and deleting the product
--- should not delete or rewrite that evidence. `product_slug` and `product_title` are
--- denormalised so a deleted product is still identifiable in the list.
---
--- Forward-only and idempotent.
-
-CREATE TABLE IF NOT EXISTS public.product_inquiries (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    -- No FK by design (see header). Null when the product was deleted after the fact.
-    product_id uuid,
-    product_slug text,
-    product_title text,
-    sender_name text NOT NULL,
-    sender_email text NOT NULL,
-    message text NOT NULL,
-    -- Which language the visitor was browsing in, so the owner can reply in kind.
-    locale text,
-    ip_masked text,
-    user_agent text,
-    -- False when SMTP was unconfigured or the send failed: the CMS list is then the
-    -- only place this enquiry exists.
-    email_delivered boolean DEFAULT false NOT NULL,
-    is_resolved boolean DEFAULT false NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT product_inquiries_pkey PRIMARY KEY (id),
-    CONSTRAINT product_inquiries_sender_name_not_blank CHECK ((char_length(btrim(sender_name)) > 0)),
-    CONSTRAINT product_inquiries_sender_email_not_blank CHECK ((char_length(btrim(sender_email)) > 0)),
-    CONSTRAINT product_inquiries_message_not_blank CHECK ((char_length(btrim(message)) > 0))
-);
-
-COMMENT ON TABLE public.product_inquiries IS 'Visitor purchase enquiries raised when the store cannot take payment. Written by the service role from a public server action; read by ADMINs only.';
-
-COMMENT ON COLUMN public.product_inquiries.product_id IS 'Plain uuid, no FK: an enquiry outlives the product it was about.';
-
-COMMENT ON COLUMN public.product_inquiries.ip_masked IS 'Partially masked IP (e.g. 203.0.113.x) - never store a full address. Also backs the per-IP submission throttle.';
-
-COMMENT ON COLUMN public.product_inquiries.email_delivered IS 'False when the owner notification could not be sent (e.g. SMTP unconfigured); the stored row is then the only record.';
-
--- Newest-first is the only listing order the CMS needs.
-CREATE INDEX IF NOT EXISTS product_inquiries_created_idx
-    ON public.product_inquiries USING btree (created_at DESC);
-
--- Backs the throttle lookup in the public server action: count recent rows per IP.
-CREATE INDEX IF NOT EXISTS product_inquiries_ip_created_idx
-    ON public.product_inquiries USING btree (ip_masked, created_at DESC);
-
--- Lets the CMS count outstanding enquiries without scanning resolved history.
-CREATE INDEX IF NOT EXISTS product_inquiries_unresolved_idx
-    ON public.product_inquiries USING btree (created_at DESC)
-    WHERE (is_resolved = false);
-
-ALTER TABLE public.product_inquiries ENABLE ROW LEVEL SECURITY;
-
--- anon is deliberately absent: the public path goes through the service role.
-GRANT SELECT, UPDATE ON TABLE public.product_inquiries TO authenticated;
-GRANT ALL ON TABLE public.product_inquiries TO service_role;
-
-DROP POLICY IF EXISTS product_inquiries_admin_read_policy ON public.product_inquiries;
-CREATE POLICY product_inquiries_admin_read_policy ON public.product_inquiries FOR SELECT TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
-
--- ADMINs may only flip the resolved flag; the enquiry content itself is a record.
-DROP POLICY IF EXISTS product_inquiries_admin_update_policy ON public.product_inquiries;
-CREATE POLICY product_inquiries_admin_update_policy ON public.product_inquiries FOR UPDATE TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)) WITH CHECK ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS product_inquiries_service_role_policy ON public.product_inquiries;
-CREATE POLICY product_inquiries_service_role_policy ON public.product_inquiries TO service_role USING (true) WITH CHECK (true);
-
--- Where enquiry notifications are sent. Kept in the PUBLIC settings row rather than the
--- secret one because it is an address, not a credential — but it is never rendered to
--- the storefront: the public form posts a product id and the server resolves the
--- recipient. Empty string means "fall back", see resolveSellerContactEmail().
-INSERT INTO public.site_settings (key, value)
-VALUES ('store_contact', '{"contactEmail": ""}'::jsonb)
-ON CONFLICT (key) DO NOTHING;
-
--- Storefront copy for the enquiry flow. Public-facing, so it must be translatable;
--- the components pass an English literal as the fallback, so an install that never
--- runs this seed still renders correctly.
-INSERT INTO public.translations (key, translations, created_at, updated_at) VALUES
-    ('ecommerce.contact_seller', '{"en": "Contact the seller", "fr": "Contacter le vendeur"}', now(), now()),
-    ('ecommerce.contact_seller_heading', '{"en": "Interested in this product?", "fr": "Ce produit vous intéresse ?"}', now(), now()),
-    ('ecommerce.contact_seller_intro', '{"en": "Online ordering isn''t available for this item yet. Send the seller a message and they''ll get back to you about buying it.", "fr": "La commande en ligne n''est pas encore disponible pour cet article. Envoyez un message au vendeur et il vous répondra au sujet de son achat."}', now(), now()),
-    ('ecommerce.contact_seller_name', '{"en": "Your name", "fr": "Votre nom"}', now(), now()),
-    ('ecommerce.contact_seller_email', '{"en": "Your email", "fr": "Votre courriel"}', now(), now()),
-    ('ecommerce.contact_seller_message', '{"en": "Message", "fr": "Message"}', now(), now()),
-    ('ecommerce.contact_seller_send', '{"en": "Send message", "fr": "Envoyer le message"}', now(), now()),
-    ('ecommerce.contact_seller_sending', '{"en": "Sending...", "fr": "Envoi..."}', now(), now()),
-    ('ecommerce.contact_seller_sent', '{"en": "Thanks - your message has been sent to the seller. They''ll reply to the email address you gave.", "fr": "Merci - votre message a été envoyé au vendeur. Il répondra à l''adresse courriel que vous avez indiquée."}', now(), now()),
-    ('ecommerce.contact_seller_error', '{"en": "Sorry, your message couldn''t be sent. Please try again in a moment.", "fr": "Désolé, votre message n''a pas pu être envoyé. Veuillez réessayer dans un instant."}', now(), now()),
-    ('ecommerce.contact_seller_invalid', '{"en": "Please check your name, email address and message, then try again.", "fr": "Veuillez vérifier votre nom, votre adresse courriel et votre message, puis réessayer."}', now(), now()),
-    ('ecommerce.contact_seller_throttled', '{"en": "You''ve sent several messages already. Please wait a few minutes before sending another.", "fr": "Vous avez déjà envoyé plusieurs messages. Veuillez patienter quelques minutes avant d''en envoyer un autre."}', now(), now()),
-    ('ecommerce.not_available_for_purchase', '{"en": "Not available for online purchase", "fr": "Non disponible à l''achat en ligne"}', now(), now()),
-    ('ecommerce.checkout_payments_unavailable', '{"en": "This store is not able to take payments right now. Please contact the seller to complete your purchase.", "fr": "Cette boutique ne peut pas accepter de paiements pour le moment. Veuillez contacter le vendeur pour finaliser votre achat."}', now(), now())
-ON CONFLICT (key) DO NOTHING;

package/supabase/migrations/00000000000027_message_threads.sql

@@ -1,391 +0,0 @@
--- Private conversations with anonymous visitors, and the end of the exposed form address.
---
--- Two problems, one shape.
---
--- FIRST: a contact-form block stores its destination address in the block's own
--- content, and `FormBlockRenderer` is a "use client" component that receives that
--- content wholesale. Everything crossing that boundary is serialized into the RSC
--- payload, so the shop owner's inbox is published in the markup of every page
--- carrying a form. `form_endpoints` moves the address server-side and leaves behind a
--- `form_key` — an opaque handle that grants nothing and is safe to serialize.
---
--- SECOND: a visitor who sends a message has nowhere to receive an answer. They are
--- anonymous — `cms_interactions` cannot hold them, because its `user_id` is NOT NULL
--- with a foreign key to `profiles`. So this is a separate lane: `message_threads` plus
--- `thread_messages`, reached by a tokenised link rather than an account.
---
--- WHY REVIEWS AND COMMENTS ARE NOT HERE. They are already public, already tied to a
--- registered account, and a staff answer to them is published content, not a private
--- reply. That lane stays in `cms_interactions` and is handled by migration 28. One
--- inbox reads both; the storage stays honest about the difference.
---
--- SECURITY POSTURE. Rows hold visitor PII (name, email, free text) and a masked IP.
--- There is NO anon grant and NO anon policy: the tokenised visitor page verifies the
--- token in application code and then reads with the service role, the same posture the
--- MCP token route takes against `mcp_access_tokens`. ADMINs read; nobody else does.
---
--- `token_hash` stores only a SHA-256 of the visitor's token. The plaintext exists long
--- enough to be placed in one outbound email and is never written down. A token is
--- minted on the FIRST ADMIN REPLY, never at submission — a store that receives a
--- hundred enquiries and answers three has three live credentials, not a hundred.
---
--- `source` is a text column with a CHECK rather than an enum, deliberately.
--- `interaction_type` in this same schema is the cautionary tale: a two-value enum
--- guarded by an exhaustive CHECK, where adding a third value needs ALTER TYPE ... ADD
--- VALUE — and PostgreSQL forbids using a value added in the transaction that added it,
--- which is exactly one migration file. A CHECK is replaceable in one statement.
---
--- Forward-only and idempotent.
-
--- ---------------------------------------------------------------------------
--- 1. form_endpoints — where a contact-form block's mail goes, and what its fields
---    are called. `fields` is a SERVER-SIDE snapshot of the field manifest so the
---    notification email renders labels the browser did not supply; the same rule
---    the product-enquiry action follows when it looks the product title up itself.
--- ---------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS public.form_endpoints (
-    form_key uuid NOT NULL,
-    label text DEFAULT 'Contact form' NOT NULL,
-    -- NULL/empty means "fall back to the resolver ladder", like store_contact.
-    recipient_email text,
-    fields jsonb DEFAULT '[]'::jsonb NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT form_endpoints_pkey PRIMARY KEY (form_key),
-    CONSTRAINT form_endpoints_label_not_blank CHECK ((char_length(btrim(label)) > 0)),
-    CONSTRAINT form_endpoints_fields_array CHECK ((jsonb_typeof(fields) = 'array'))
-);
-
-COMMENT ON TABLE public.form_endpoints IS 'Server-side destination and field manifest for a contact-form block, keyed by the non-secret form_key carried in block content. The address never reaches the browser.';
-
-COMMENT ON COLUMN public.form_endpoints.form_key IS 'Non-secret opaque handle. Safe in the RSC payload: it grants nothing, it is only a lookup key.';
-
-COMMENT ON COLUMN public.form_endpoints.fields IS 'Snapshot of [{temp_id,label,field_type}] written by the CMS editor, so labels in emails and the inbox are server-trusted.';
-
-DROP TRIGGER IF EXISTS set_form_endpoints_updated_at ON public.form_endpoints;
-CREATE TRIGGER set_form_endpoints_updated_at BEFORE UPDATE ON public.form_endpoints
-    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
-
-ALTER TABLE public.form_endpoints ENABLE ROW LEVEL SECURITY;
-
--- anon deliberately absent: the public submit path goes through the service role.
-GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.form_endpoints TO authenticated;
-GRANT ALL ON TABLE public.form_endpoints TO service_role;
-
-DROP POLICY IF EXISTS form_endpoints_editor_read_policy ON public.form_endpoints;
-CREATE POLICY form_endpoints_editor_read_policy ON public.form_endpoints FOR SELECT TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])));
-
-DROP POLICY IF EXISTS form_endpoints_admin_write_policy ON public.form_endpoints;
-CREATE POLICY form_endpoints_admin_write_policy ON public.form_endpoints FOR ALL TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)) WITH CHECK ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS form_endpoints_service_role_policy ON public.form_endpoints;
-CREATE POLICY form_endpoints_service_role_policy ON public.form_endpoints TO service_role USING (true) WITH CHECK (true);
-
--- ---------------------------------------------------------------------------
--- 2. message_threads — the private-lane spine and the only home of a thread token.
---    `subject_id` and `form_key` are PLAIN uuids with NO foreign key: a conversation
---    outlives the product or the form block it started from.
--- ---------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS public.message_threads (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    source text NOT NULL,
-    -- product_inquiries.id when source = 'product_inquiry'.
-    subject_id uuid,
-    -- form_endpoints.form_key when source = 'contact_form'.
-    form_key uuid,
-    -- Denormalised so a deleted product or removed form block stays identifiable.
-    subject_label text DEFAULT 'Message' NOT NULL,
-    sender_name text,
-    -- NULL when a contact form collected no email field. Such a thread can never be
-    -- answered, and the CMS says so rather than failing silently at reply time.
-    sender_email text,
-    locale text,
-    -- Submitted field map for a contact form: {temp_id: value}.
-    fields jsonb DEFAULT '{}'::jsonb NOT NULL,
-    status text DEFAULT 'open' NOT NULL,
-    unread_for_admin boolean DEFAULT true NOT NULL,
-    unread_for_visitor boolean DEFAULT false NOT NULL,
-    -- SHA-256 hex of the visitor's token; NULL until the first admin reply.
-    token_hash text,
-    token_expires_at timestamp with time zone,
-    token_revoked_at timestamp with time zone,
-    token_last_used_at timestamp with time zone,
-    last_message_at timestamp with time zone DEFAULT now() NOT NULL,
-    ip_masked text,
-    user_agent text,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT message_threads_pkey PRIMARY KEY (id),
-    CONSTRAINT message_threads_token_hash_key UNIQUE (token_hash),
-    CONSTRAINT message_threads_source_check
-        CHECK ((source = ANY (ARRAY['product_inquiry'::text, 'contact_form'::text]))),
-    CONSTRAINT message_threads_status_check
-        CHECK ((status = ANY (ARRAY['open'::text, 'closed'::text]))),
-    CONSTRAINT message_threads_subject_check CHECK (
-        (((source = 'product_inquiry'::text) AND (subject_id IS NOT NULL)) OR
-         ((source = 'contact_form'::text) AND (form_key IS NOT NULL)))),
-    CONSTRAINT message_threads_fields_object CHECK ((jsonb_typeof(fields) = 'object'))
-);
-
-COMMENT ON TABLE public.message_threads IS 'Private conversations with anonymous visitors (product enquiries and contact-form submissions). Written by the service role from public server actions; read by ADMINs only. Public reviews and comments are NOT here - they live in cms_interactions.';
-
-COMMENT ON COLUMN public.message_threads.token_hash IS 'SHA-256 hex of the visitor thread token. The raw token is never stored; it is minted on the first admin reply and mailed once.';
-
-COMMENT ON COLUMN public.message_threads.subject_id IS 'product_inquiries.id. Plain uuid, no FK: a conversation outlives the enquiry record it grew from.';
-
-CREATE INDEX IF NOT EXISTS message_threads_last_message_idx
-    ON public.message_threads USING btree (last_message_at DESC);
-
-CREATE INDEX IF NOT EXISTS message_threads_source_last_idx
-    ON public.message_threads USING btree (source, last_message_at DESC);
-
--- Backs the CMS nav unread badge without scanning read history.
-CREATE INDEX IF NOT EXISTS message_threads_unread_idx
-    ON public.message_threads USING btree (last_message_at DESC)
-    WHERE (unread_for_admin = true);
-
--- Idempotent backfill / dedupe of enquiry threads.
-CREATE INDEX IF NOT EXISTS message_threads_subject_idx
-    ON public.message_threads USING btree (subject_id) WHERE (subject_id IS NOT NULL);
-
--- No separate token index: message_threads_token_hash_key is already the unique
--- btree the /thread lookup probes.
-
-DROP TRIGGER IF EXISTS set_message_threads_updated_at ON public.message_threads;
-CREATE TRIGGER set_message_threads_updated_at BEFORE UPDATE ON public.message_threads
-    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
-
-ALTER TABLE public.message_threads ENABLE ROW LEVEL SECURITY;
-
-GRANT SELECT, UPDATE ON TABLE public.message_threads TO authenticated;
-GRANT ALL ON TABLE public.message_threads TO service_role;
-
-DROP POLICY IF EXISTS message_threads_admin_read_policy ON public.message_threads;
-CREATE POLICY message_threads_admin_read_policy ON public.message_threads FOR SELECT TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS message_threads_admin_update_policy ON public.message_threads;
-CREATE POLICY message_threads_admin_update_policy ON public.message_threads FOR UPDATE TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)) WITH CHECK ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS message_threads_service_role_policy ON public.message_threads;
-CREATE POLICY message_threads_service_role_policy ON public.message_threads TO service_role USING (true) WITH CHECK (true);
-
--- ---------------------------------------------------------------------------
--- 3. thread_messages — one turn of a private conversation.
--- ---------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS public.thread_messages (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    thread_id uuid NOT NULL,
-    direction text NOT NULL,
-    body text NOT NULL,
-    -- profiles.id for an outbound reply. No FK: a departing admin must not take the
-    -- conversation with them.
-    author_id uuid,
-    author_name text,
-    -- False when SMTP was unconfigured or the send failed. sendEmail() throws when
-    -- unconfigured, so this row - not the mail - is the record.
-    email_delivered boolean DEFAULT false NOT NULL,
-    email_error text,
-    ip_masked text,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT thread_messages_pkey PRIMARY KEY (id),
-    CONSTRAINT thread_messages_direction_check
-        CHECK ((direction = ANY (ARRAY['inbound'::text, 'outbound'::text]))),
-    CONSTRAINT thread_messages_body_not_blank CHECK ((char_length(btrim(body)) > 0))
-);
-
-COMMENT ON TABLE public.thread_messages IS 'Turns of a private conversation. Content is append-only; only the delivery flags may change after insert.';
-
--- A real foreign key here, unlike the outward pointers above: a message has no
--- meaning without its thread.
-DO $rb$ BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint
-                 WHERE conname = 'thread_messages_thread_id_fkey'
-                   AND conrelid = 'public.thread_messages'::regclass) THEN
-    ALTER TABLE ONLY public.thread_messages
-      ADD CONSTRAINT thread_messages_thread_id_fkey FOREIGN KEY (thread_id)
-      REFERENCES public.message_threads(id) ON DELETE CASCADE;
-  END IF;
-END $rb$;
-
-CREATE INDEX IF NOT EXISTS thread_messages_thread_created_idx
-    ON public.thread_messages USING btree (thread_id, created_at);
-
--- Backs the per-IP reply throttle on the public thread page.
-CREATE INDEX IF NOT EXISTS thread_messages_ip_created_idx
-    ON public.thread_messages USING btree (ip_masked, created_at DESC);
-
--- Message TEXT is append-only — not the whole row, because email_delivered has to be
--- settable after the send completes. The trigger blocks rewrites of the load-bearing
--- columns only, and it binds the service role too, which otherwise bypasses RLS.
-CREATE OR REPLACE FUNCTION public.prevent_thread_message_rewrite() RETURNS trigger
-    LANGUAGE plpgsql SET search_path = '' AS $$
-BEGIN
-  IF TG_OP = 'DELETE' THEN
-    RAISE EXCEPTION 'thread_messages is append-only; DELETE is not permitted'
-      USING ERRCODE = 'restrict_violation';
-  END IF;
-  IF NEW.body IS DISTINCT FROM OLD.body
-     OR NEW.direction IS DISTINCT FROM OLD.direction
-     OR NEW.thread_id IS DISTINCT FROM OLD.thread_id
-     OR NEW.created_at IS DISTINCT FROM OLD.created_at THEN
-    RAISE EXCEPTION 'thread_messages content is append-only; only delivery flags may change'
-      USING ERRCODE = 'restrict_violation';
-  END IF;
-  RETURN NEW;
-END;
-$$;
-
-DROP TRIGGER IF EXISTS trg_thread_messages_append_only ON public.thread_messages;
-CREATE TRIGGER trg_thread_messages_append_only BEFORE UPDATE OR DELETE ON public.thread_messages
-    FOR EACH ROW EXECUTE FUNCTION public.prevent_thread_message_rewrite();
-
--- NB: the ON DELETE CASCADE above fires this trigger, so deleting a thread is
--- impossible by design. "Delete" in the CMS means status='closed' plus a revoked
--- token, and the UI says so.
-
-ALTER TABLE public.thread_messages ENABLE ROW LEVEL SECURITY;
-
-GRANT SELECT ON TABLE public.thread_messages TO authenticated;
-GRANT ALL ON TABLE public.thread_messages TO service_role;
-
-DROP POLICY IF EXISTS thread_messages_admin_read_policy ON public.thread_messages;
-CREATE POLICY thread_messages_admin_read_policy ON public.thread_messages FOR SELECT TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS thread_messages_service_role_policy ON public.thread_messages;
-CREATE POLICY thread_messages_service_role_policy ON public.thread_messages TO service_role USING (true) WITH CHECK (true);
-
--- ---------------------------------------------------------------------------
--- 4. Backfill: every existing enquiry becomes a thread whose first inbound turn is
---    the original message. product_inquiries is KEPT and kept written — it is the
---    enquiry's own record and owns the ip_masked the submission throttle counts.
---    The thread is a conversation ABOUT the enquiry, not a replacement for it.
--- ---------------------------------------------------------------------------
-INSERT INTO public.message_threads
-  (source, subject_id, subject_label, sender_name, sender_email, locale,
-   ip_masked, user_agent, unread_for_admin, status, last_message_at, created_at)
-SELECT 'product_inquiry', i.id, COALESCE(i.product_title, 'Product enquiry'),
-       i.sender_name, i.sender_email, i.locale, i.ip_masked, i.user_agent,
-       NOT i.is_resolved, CASE WHEN i.is_resolved THEN 'closed' ELSE 'open' END,
-       i.created_at, i.created_at
-FROM public.product_inquiries i
-WHERE NOT EXISTS (SELECT 1 FROM public.message_threads t WHERE t.subject_id = i.id);
-
-INSERT INTO public.thread_messages (thread_id, direction, body, email_delivered, ip_masked, created_at)
-SELECT t.id, 'inbound', i.message, i.email_delivered, i.ip_masked, i.created_at
-FROM public.product_inquiries i
-JOIN public.message_threads t ON t.subject_id = i.id
-WHERE NOT EXISTS (SELECT 1 FROM public.thread_messages m WHERE m.thread_id = t.id);
-
--- ---------------------------------------------------------------------------
--- 5. The form-block data migration.
---    Rewrites every stored form block: mints a form_key, moves recipient_email into
---    form_endpoints, snapshots the field manifest, and DELETES recipient_email from
---    the jsonb. Three shapes have to be handled, because a form nested inside a
---    section has no blocks row of its own — it lives in the section's content:
---      a) blocks.content where block_type = 'form'
---      b) blocks.content where block_type = 'section' (column_blocks, slides)
---      c) content_drafts.blocks / product_drafts.blocks (jsonb arrays of snapshots)
--- ---------------------------------------------------------------------------
-CREATE OR REPLACE FUNCTION public.nb_migrate_form_columns(p_cols jsonb)
-RETURNS jsonb LANGUAGE plpgsql VOLATILE SET search_path = '' AS $fn$
-DECLARE v_col jsonb; v_blk jsonb; v_new_cols jsonb := '[]'::jsonb; v_new_col jsonb;
-BEGIN
-  FOR v_col IN SELECT * FROM jsonb_array_elements(p_cols) LOOP
-    v_new_col := '[]'::jsonb;
-    FOR v_blk IN SELECT * FROM jsonb_array_elements(coalesce(v_col, '[]'::jsonb)) LOOP
-      v_new_col := v_new_col || jsonb_build_array(
-        v_blk || jsonb_build_object('content', public.nb_migrate_form_content(v_blk->'content')));
-    END LOOP;
-    v_new_cols := v_new_cols || jsonb_build_array(v_new_col);
-  END LOOP;
-  RETURN v_new_cols;
-END;
-$fn$;
-
-CREATE OR REPLACE FUNCTION public.nb_migrate_form_content(p_content jsonb)
-RETURNS jsonb LANGUAGE plpgsql VOLATILE SET search_path = '' AS $fn$
-DECLARE
-  v_key uuid; v_email text; v_fields jsonb; v_slide jsonb; v_new_slides jsonb;
-BEGIN
-  IF p_content IS NULL OR jsonb_typeof(p_content) <> 'object' THEN
-    RETURN p_content;
-  END IF;
-
-  -- Leaf: this object IS a form block's content.
-  IF (p_content ? 'recipient_email') AND (p_content ? 'fields') THEN
-    v_key   := gen_random_uuid();
-    v_email := nullif(btrim(coalesce(p_content->>'recipient_email','')), '');
-    SELECT coalesce(jsonb_agg(jsonb_build_object(
-             'temp_id', f->>'temp_id', 'label', f->>'label', 'field_type', f->>'field_type')), '[]'::jsonb)
-      INTO v_fields
-      FROM jsonb_array_elements(coalesce(p_content->'fields', '[]'::jsonb)) f;
-    INSERT INTO public.form_endpoints (form_key, label, recipient_email, fields)
-    VALUES (v_key, 'Contact form', v_email, v_fields)
-    ON CONFLICT (form_key) DO NOTHING;
-    RETURN (p_content - 'recipient_email') || jsonb_build_object('form_key', v_key::text);
-  END IF;
-
-  -- Container: a section's slides, each with column_blocks.
-  IF (p_content ? 'slides') AND jsonb_typeof(p_content->'slides') = 'array' THEN
-    v_new_slides := '[]'::jsonb;
-    FOR v_slide IN SELECT * FROM jsonb_array_elements(p_content->'slides') LOOP
-      v_new_slides := v_new_slides || jsonb_build_array(
-        v_slide || jsonb_build_object('column_blocks',
-          public.nb_migrate_form_columns(coalesce(v_slide->'column_blocks','[]'::jsonb))));
-    END LOOP;
-    p_content := p_content || jsonb_build_object('slides', v_new_slides);
-  END IF;
-
-  -- Container: a standard section's column_blocks.
-  IF (p_content ? 'column_blocks') AND jsonb_typeof(p_content->'column_blocks') = 'array' THEN
-    p_content := p_content || jsonb_build_object('column_blocks',
-      public.nb_migrate_form_columns(p_content->'column_blocks'));
-  END IF;
-
-  RETURN p_content;
-END;
-$fn$;
-
--- The LIKE guard keeps this from rewriting (and bumping updated_at on) every block.
-UPDATE public.blocks
-   SET content = public.nb_migrate_form_content(content)
- WHERE content::text LIKE '%recipient_email%';
-
-UPDATE public.content_drafts d
-   SET blocks = (SELECT coalesce(jsonb_agg(b || jsonb_build_object(
-                          'content', public.nb_migrate_form_content(b->'content'))), '[]'::jsonb)
-                 FROM jsonb_array_elements(d.blocks) b)
- WHERE d.blocks::text LIKE '%recipient_email%';
-
-UPDATE public.product_drafts d
-   SET blocks = (SELECT coalesce(jsonb_agg(b || jsonb_build_object(
-                          'content', public.nb_migrate_form_content(b->'content'))), '[]'::jsonb)
-                 FROM jsonb_array_elements(d.blocks) b)
- WHERE d.blocks::text LIKE '%recipient_email%';
-
--- One-shot helpers. Dropping them keeps the public schema (and db:types) clean.
-DROP FUNCTION IF EXISTS public.nb_migrate_form_content(jsonb);
-DROP FUNCTION IF EXISTS public.nb_migrate_form_columns(jsonb);
-
--- ---------------------------------------------------------------------------
--- 6. Seeds. Thread-page copy is public-facing so it must be translatable; the
---    components pass an English literal as the fallback, so an install that never
---    runs this seed still renders correctly.
--- ---------------------------------------------------------------------------
-INSERT INTO public.site_settings (key, value)
-VALUES ('forms_contact', '{"contactEmail": ""}'::jsonb)
-ON CONFLICT (key) DO NOTHING;
-
-INSERT INTO public.translations (key, translations, created_at, updated_at) VALUES
-  ('thread.heading', '{"en": "Your conversation", "fr": "Votre conversation"}', now(), now()),
-  ('thread.reply_label', '{"en": "Write a reply", "fr": "Écrire une réponse"}', now(), now()),
-  ('thread.send', '{"en": "Send reply", "fr": "Envoyer la réponse"}', now(), now()),
-  ('thread.sending', '{"en": "Sending...", "fr": "Envoi..."}', now(), now()),
-  ('thread.sent', '{"en": "Thanks - your reply has been sent.", "fr": "Merci - votre réponse a été envoyée."}', now(), now()),
-  ('thread.error', '{"en": "Sorry, your reply couldn''t be sent. Please try again in a moment.", "fr": "Désolé, votre réponse n''a pas pu être envoyée. Veuillez réessayer dans un instant."}', now(), now()),
-  ('thread.throttled', '{"en": "You''ve sent several replies already. Please wait a few minutes.", "fr": "Vous avez déjà envoyé plusieurs réponses. Veuillez patienter quelques minutes."}', now(), now()),
-  ('thread.closed', '{"en": "This conversation has been closed.", "fr": "Cette conversation est fermée."}', now(), now()),
-  ('thread.invalid', '{"en": "This link has expired or is no longer valid. If you still need help, please contact us again from our website.", "fr": "Ce lien a expiré ou n''est plus valide. Si vous avez encore besoin d''aide, contactez-nous de nouveau depuis notre site."}', now(), now()),
-  ('thread.you', '{"en": "You", "fr": "Vous"}', now(), now()),
-  ('forms.submission_stored', '{"en": "Thanks - your message has been received.", "fr": "Merci - votre message a bien été reçu."}', now(), now())
-ON CONFLICT (key) DO NOTHING;