create-nextblock 0.12.13 → 0.12.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.12.13",
+  "version": "0.12.15",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/(auth-pages)/sign-in/page.tsx

@@ -26,8 +26,6 @@ function getMessage(searchParams: URLSearchParams): Message | undefined {
     return undefined;
 }
 
-import { GitHubLoginButton } from "../../../components/GitHubLoginButton";
-
 export default function Login() {
   const { t } = useTranslations();
   const searchParams = useSearchParams();
@@ -46,17 +44,6 @@ export default function Login() {
       </p>
 
       <div className="flex flex-col gap-2 mt-8">
-        <GitHubLoginButton t={t} redirectTo={redirectParam || undefined} />
-
-        <div className="relative py-2">
-          <div className="absolute inset-0 flex items-center">
-            <span className="w-full border-t" />
-          </div>
-          <div className="relative flex justify-center text-xs uppercase">
-            <span className="bg-background px-2 text-muted-foreground">{t('or_continue_with') || "Or continue with"}</span>
-          </div>
-        </div>
-
         <form className="flex flex-col gap-2 [&>input]:mb-3">
           {redirectParam && <input type="hidden" name="redirect" value={redirectParam} />}
           <Label htmlFor="email">{t('email')}</Label>

package/templates/nextblock-template/app/(auth-pages)/sign-up/SignUpForm.tsx

@@ -7,7 +7,6 @@ import { Button, Input, Label } from "@nextblock-cms/ui";
 import Link from "next/link";
 import { useTranslations } from "@nextblock-cms/utils";
 import { useSearchParams } from "next/navigation";
-import { GitHubLoginButton } from "../../../components/GitHubLoginButton";
 import { ArrowRight, CheckCircle2, Mail } from "lucide-react";
 
 import { SandboxCredentialsAlert } from "../../../components/SandboxCredentialsAlert";
@@ -100,19 +99,6 @@ export default function SignUpForm({ botProtection, scriptNonce }: SignUpFormPro
         </p>
 
         <div className="mt-8 flex flex-col gap-2">
-          <GitHubLoginButton t={t} redirectTo="/profile" />
-
-          <div className="relative py-2">
-            <div className="absolute inset-0 flex items-center">
-              <span className="w-full border-t" />
-            </div>
-            <div className="relative flex justify-center text-xs uppercase">
-              <span className="bg-background px-2 text-muted-foreground">
-                {t('or_continue_with') || "Or continue with"}
-              </span>
-            </div>
-          </div>
-
           <div className="flex flex-col gap-2 [&>input]:mb-3">
             <Label htmlFor="email">{t('email')}</Label>
             <Input name="email" placeholder={t('you_at_example_com')} required />

package/templates/nextblock-template/app/[slug]/page.tsx

@@ -78,8 +78,12 @@ export async function generateMetadata(
   if (!preferredLocale) {
     try {
       const hdrs = await headers();
-      const al = hdrs.get("accept-language");
-      if (al) preferredLocale = al.split(",")[0]?.split("-")[0];
+      // Proxy-detected locale first: it honors the CMS language-detection settings.
+      preferredLocale = hdrs.get("x-user-locale") || undefined;
+      if (!preferredLocale) {
+        const al = hdrs.get("accept-language");
+        if (al) preferredLocale = al.split(",")[0]?.split("-")[0];
+      }
     } catch {
       // ignore header lookup errors
     }
@@ -153,8 +157,12 @@ export default async function DynamicPage({ params: paramsPromise }: PageProps)
   if (!preferredLocale) {
     try {
       const hdrs = await headers();
-      const al = hdrs.get("accept-language");
-      if (al) preferredLocale = al.split(",")[0]?.split("-")[0];
+      // Proxy-detected locale first: it honors the CMS language-detection settings.
+      preferredLocale = hdrs.get("x-user-locale") || undefined;
+      if (!preferredLocale) {
+        const al = hdrs.get("accept-language");
+        if (al) preferredLocale = al.split(",")[0]?.split("-")[0];
+      }
     } catch {
       // ignore header lookup errors
     }

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -1,37 +1,37 @@
-// AUTO-GENERATED FILE. Do not edit this file directly.
-// Regenerate it from repo root with: npm run generate:sandbox
-// Source of truth: tools/scripts/generate-sandbox-reset.ts and libs/db/src/supabase/migrations/*.sql
-
-export const SANDBOX_RESET_SQL = `
--- AUTO-GENERATED: Sandbox Reset Script. Do Not Edit Manually.
--- Generated by tools/scripts/generate-sandbox-reset.ts
-
-  -- Step A: Erase all non-demo users
-  DELETE FROM auth.users
-  WHERE id NOT IN (
-    '63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid,
-    'e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid
-  );
-
-  -- Step B: Wipe public schema and truncate migrations
-  DROP SCHEMA public CASCADE;
-  CREATE SCHEMA public;
-
-  -- Restore default public schema privileges so the standard migrations succeed
-  GRANT USAGE ON SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON ROUTINES TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
-
-  TRUNCATE TABLE supabase_migrations.schema_migrations;
-
-  -- Step C: Execute full schema & seed from production migrations
-
-
--- >>> FROM: 00000000000000_baseline_schema.sql <<<
+// AUTO-GENERATED FILE. Do not edit this file directly.
+// Regenerate it from repo root with: npm run generate:sandbox
+// Source of truth: tools/scripts/generate-sandbox-reset.ts and libs/db/src/supabase/migrations/*.sql
+
+export const SANDBOX_RESET_SQL = `
+-- AUTO-GENERATED: Sandbox Reset Script. Do Not Edit Manually.
+-- Generated by tools/scripts/generate-sandbox-reset.ts
+
+  -- Step A: Erase all non-demo users
+  DELETE FROM auth.users
+  WHERE id NOT IN (
+    '63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid,
+    'e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid
+  );
+
+  -- Step B: Wipe public schema and truncate migrations
+  DROP SCHEMA public CASCADE;
+  CREATE SCHEMA public;
+
+  -- Restore default public schema privileges so the standard migrations succeed
+  GRANT USAGE ON SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON ROUTINES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+
+  TRUNCATE TABLE supabase_migrations.schema_migrations;
+
+  -- Step C: Execute full schema & seed from production migrations
+
+
+-- >>> FROM: 00000000000000_baseline_schema.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 00 · schema: enums, functions, tables, sequences, defaults
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -2486,9 +2486,9 @@ CREATE TABLE IF NOT EXISTS public.variant_attribute_mapping (
     variant_id uuid NOT NULL,
     attribute_term_id uuid NOT NULL
 );
-
-
--- >>> FROM: 00000000000001_baseline_constraints_and_indexes.sql <<<
+
+
+-- >>> FROM: 00000000000001_baseline_constraints_and_indexes.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 01 · constraints (PK / unique / check / FK) + indexes
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -3560,9 +3560,9 @@ DO $rb$ BEGIN
         ADD CONSTRAINT variant_attribute_mapping_variant_id_fkey FOREIGN KEY (variant_id) REFERENCES public.product_variants(id) ON DELETE CASCADE;
   END IF;
 END $rb$;
-
-
--- >>> FROM: 00000000000002_baseline_security_and_grants.sql <<<
+
+
+-- >>> FROM: 00000000000002_baseline_security_and_grants.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 02 · row-level security, policies, triggers, grants
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -4898,9 +4898,9 @@ CREATE TRIGGER on_auth_user_created
   FOR EACH ROW
   EXECUTE FUNCTION public.handle_new_user();
 REVOKE EXECUTE ON FUNCTION public.handle_new_user() FROM PUBLIC, anon, authenticated;
-
-
--- >>> FROM: 00000000000003_baseline_seed.sql <<<
+
+
+-- >>> FROM: 00000000000003_baseline_seed.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 03 · seed: canonical NextBlock demo content (no users, no secrets)
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -5369,9 +5369,9 @@ SELECT pg_catalog.setval('public.languages_id_seq', COALESCE((SELECT MAX(id) FRO
 SELECT pg_catalog.setval('public.navigation_items_id_seq', COALESCE((SELECT MAX(id) FROM public.navigation_items), 1), true);
 SELECT pg_catalog.setval('public.pages_id_seq', COALESCE((SELECT MAX(id) FROM public.pages), 1), true);
 SELECT pg_catalog.setval('public.posts_id_seq', COALESCE((SELECT MAX(id) FROM public.posts), 1), true);
-
-
--- >>> FROM: 00000000000004_default_logo_email_safe.sql <<<
+
+
+-- >>> FROM: 00000000000004_default_logo_email_safe.sql <<<
 -- Swap the seeded DEFAULT site logo from the WebP asset to a bundled PNG.
 --
 -- WebP (and AVIF) don't render in Outlook and several other email clients, so the default
@@ -5396,9 +5396,9 @@ UPDATE public.logos
 SET media_id = 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
 WHERE id = 'd45ef03d-27fc-4099-8b46-1cdf82d658d2'
   AND media_id = 'ea6fdaf5-f8de-416c-9f2b-b689b7a4ed38';
-
-
--- >>> FROM: 00000000000005_add_custom_canonical.sql <<<
+
+
+-- >>> FROM: 00000000000005_add_custom_canonical.sql <<<
 -- Add a nullable \`custom_canonical\` column to pages, posts and products.
 --
 -- This is the per-content manual canonical override used by each route's
@@ -5412,9 +5412,9 @@ WHERE id = 'd45ef03d-27fc-4099-8b46-1cdf82d658d2'
 ALTER TABLE public.pages ADD COLUMN IF NOT EXISTS custom_canonical text;
 ALTER TABLE public.posts ADD COLUMN IF NOT EXISTS custom_canonical text;
 ALTER TABLE public.products ADD COLUMN IF NOT EXISTS custom_canonical text;
-
-
--- >>> FROM: 00000000000006_home_live_demo_promo.sql <<<
+
+
+-- >>> FROM: 00000000000006_home_live_demo_promo.sql <<<
 -- 00000000000006_home_sandbox_promo.sql
 -- Adds a "Live Demo" promo section to the English (slug 'home') and French
 -- (slug 'accueil') home pages that drives visitors to the public sandbox at
@@ -5482,9 +5482,9 @@ $fr$::jsonb, 1);
   END IF;
 END
 $body$;
-
-
--- >>> FROM: 00000000000007_home_live_demo_promo_copy_fix.sql <<<
+
+
+-- >>> FROM: 00000000000007_home_live_demo_promo_copy_fix.sql <<<
 -- 00000000000007_home_live_demo_promo_copy_fix.sql
 -- Corrects the "Live Demo" promo that migration 006 seeded on the EN (slug 'home')
 -- and FR (slug 'accueil') home pages. 006 was already applied to production and the
@@ -5534,9 +5534,9 @@ $fr$::jsonb,
      AND content::text LIKE '%nb-sandbox-promo%';
 END
 $body$;
-
-
--- >>> FROM: 00000000000008_setup_article_reorder.sql <<<
+
+
+-- >>> FROM: 00000000000008_setup_article_reorder.sql <<<
 -- 00000000000008_setup_article_reorder.sql
 -- Reorders and rewrites the "How to Install NextBlock" setup guide on BOTH language
 -- twins: EN (post slug 'how-to-setup-nextblock', post_id=3 / block id=40) and FR
@@ -5567,9 +5567,9 @@ $nbfr$::jsonb,
        updated_at = now()
  WHERE post_id = 4
    AND block_type = 'text';
-
-
--- >>> FROM: 00000000000009_home_live_demo_promo_contrast.sql <<<
+
+
+-- >>> FROM: 00000000000009_home_live_demo_promo_contrast.sql <<<
 -- 00000000000009_home_live_demo_promo_contrast.sql
 -- Restyles the "Live Demo" promo that migrations 006/007 seeded on the EN (slug 'home')
 -- and FR (slug 'accueil') home pages. 006/007 gave it a fixed dark-navy GRADIENT section
@@ -5622,43 +5622,151 @@ $fr$::jsonb,
      AND content::text LIKE '%nb-sandbox-promo%';
 END
 $body$;
-
-
-  -- Step D: Record the applied migrations in history (truncated in Step B) so
-  -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
-  INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
-    ('00000000000000', 'baseline_schema'),
-    ('00000000000001', 'baseline_constraints_and_indexes'),
-    ('00000000000002', 'baseline_security_and_grants'),
-    ('00000000000003', 'baseline_seed'),
-    ('00000000000004', 'default_logo_email_safe'),
-    ('00000000000005', 'add_custom_canonical'),
-    ('00000000000006', 'home_live_demo_promo'),
-    ('00000000000007', 'home_live_demo_promo_copy_fix'),
-    ('00000000000008', 'setup_article_reorder'),
-    ('00000000000009', 'home_live_demo_promo_contrast')
-  ON CONFLICT (version) DO NOTHING;
-
-  -- Step E: Anchor preserved profiles
-  INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
-  SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'
-  FROM (
-    VALUES
-      ('63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid),
-      ('e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid)
-  ) AS preserved_user(id)
-  WHERE EXISTS (SELECT 1 FROM auth.users WHERE id = preserved_user.id)
-    AND NOT EXISTS (SELECT 1 FROM public.profiles WHERE id = preserved_user.id);
-
-  -- Step F: Re-assert the "first admin exists" flag. The sandbox preserves its demo
-  -- ADMIN users across the wipe (Steps A & E), but the reseeded baseline resets
-  -- is_admin_created to 'false' and handle_new_user() only flips it on a NEW auth.users
-  -- INSERT -- which never fires for preserved users. Without this the proxy setup-gate
-  -- funnels ALL sandbox traffic (including this reset cron on its next run) to /setup even
-  -- though admins already exist. Guarded on an ADMIN profile actually being present.
-  UPDATE public.site_settings
-  SET value = 'true'::jsonb
-  WHERE key = 'is_admin_created'
-    AND EXISTS (SELECT 1 FROM public.profiles WHERE role = 'ADMIN'::public.user_role);
-
-`;
+
+
+-- >>> FROM: 00000000000010_drop_github_username.sql <<<
+-- Drop the github_username profile column and remove the GitHub-auth artifacts.
+--
+-- GitHub OAuth sign-in / account-linking was removed from the app: it cannot be
+-- provisioned as part of a one-click deployment (each install needs its own GitHub
+-- OAuth app + client secret + Supabase's manual-linking toggle, none of which can
+-- ship in a migration). github_username was only ever populated from that OAuth
+-- flow, so the column and its seed strings are now dead.
+--
+-- NOTE: the self-update "Connect GitHub" flow (lib/updates/*, ConnectGitHubButton)
+-- is a separate feature and is intentionally left untouched — the connect_github
+-- translation is kept for it.
+
+-- 1. Rewrite handle_new_user() so new signups no longer read/populate github_username.
+CREATE OR REPLACE FUNCTION public.handle_new_user() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  admin_flag_set boolean := false;
+  user_role public.user_role;
+  v_full_name text;
+  v_avatar_url text;
+BEGIN
+  INSERT INTO public.site_settings (key, value)
+  VALUES ('is_admin_created', 'false'::jsonb)
+  ON CONFLICT (key) DO NOTHING;
+
+  SELECT COALESCE(value::jsonb::boolean, false)
+    INTO admin_flag_set
+  FROM public.site_settings
+  WHERE key = 'is_admin_created'
+  FOR UPDATE;
+
+  IF admin_flag_set = false THEN
+    user_role := 'ADMIN'::public.user_role;
+
+    UPDATE public.site_settings
+    SET value = 'true'::jsonb
+    WHERE key = 'is_admin_created';
+  ELSE
+    user_role := 'USER'::public.user_role;
+  END IF;
+
+  v_full_name := NEW.raw_user_meta_data->>'full_name';
+  v_avatar_url := NEW.raw_user_meta_data->>'avatar_url';
+
+  INSERT INTO public.profiles (
+    id,
+    role,
+    full_name,
+    avatar_url
+  )
+  VALUES (
+    NEW.id,
+    user_role,
+    v_full_name,
+    v_avatar_url
+  )
+  ON CONFLICT (id) DO UPDATE SET
+    full_name = EXCLUDED.full_name,
+    avatar_url = EXCLUDED.avatar_url;
+
+  RETURN NEW;
+END;
+$$;
+
+-- 2. Drop the column now that nothing writes it.
+ALTER TABLE public.profiles DROP COLUMN IF EXISTS github_username;
+
+-- 3. Remove the GitHub-auth-only translation strings. connect_github is intentionally
+--    kept — it is still used by the self-update "Connect GitHub" button.
+DELETE FROM public.translations
+WHERE key IN (
+  'continue_with_github',
+  'github_username',
+  'github_username_help',
+  'github_link_failed',
+  'github_connected'
+);
+
+
+-- >>> FROM: 00000000000011_language_detection_admin_only.sql <<<
+-- Restrict writes to the language-detection settings row to ADMIN only.
+--
+-- \`site_settings.language_detection_settings\` is a non-sensitive, anon-READABLE
+-- key (the request proxy reads it with the anon client to pick a visitor's first
+-- language). The CMS surfaces it under /cms/settings (ADMIN-only) and the server
+-- action guards with an ADMIN check, but the baseline write policies let ADMIN
+-- *or* WRITER write any non-sensitive key — so a WRITER could change site-wide
+-- detection directly via PostgREST. This migration adds the key to the ADMIN-only
+-- write group (INSERT/UPDATE/DELETE) to match the UI boundary, while leaving the
+-- SELECT policy untouched so the proxy's anon read keeps working.
+--
+-- Forward-only; recreates the three write policies idempotently.
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+
+  -- Step D: Record the applied migrations in history (truncated in Step B) so
+  -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
+  INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
+    ('00000000000000', 'baseline_schema'),
+    ('00000000000001', 'baseline_constraints_and_indexes'),
+    ('00000000000002', 'baseline_security_and_grants'),
+    ('00000000000003', 'baseline_seed'),
+    ('00000000000004', 'default_logo_email_safe'),
+    ('00000000000005', 'add_custom_canonical'),
+    ('00000000000006', 'home_live_demo_promo'),
+    ('00000000000007', 'home_live_demo_promo_copy_fix'),
+    ('00000000000008', 'setup_article_reorder'),
+    ('00000000000009', 'home_live_demo_promo_contrast'),
+    ('00000000000010', 'drop_github_username'),
+    ('00000000000011', 'language_detection_admin_only')
+  ON CONFLICT (version) DO NOTHING;
+
+  -- Step E: Anchor preserved profiles
+  INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
+  SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'
+  FROM (
+    VALUES
+      ('63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid),
+      ('e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid)
+  ) AS preserved_user(id)
+  WHERE EXISTS (SELECT 1 FROM auth.users WHERE id = preserved_user.id)
+    AND NOT EXISTS (SELECT 1 FROM public.profiles WHERE id = preserved_user.id);
+
+  -- Step F: Re-assert the "first admin exists" flag. The sandbox preserves its demo
+  -- ADMIN users across the wipe (Steps A & E), but the reseeded baseline resets
+  -- is_admin_created to 'false' and handle_new_user() only flips it on a NEW auth.users
+  -- INSERT -- which never fires for preserved users. Without this the proxy setup-gate
+  -- funnels ALL sandbox traffic (including this reset cron on its next run) to /setup even
+  -- though admins already exist. Guarded on an ADMIN profile actually being present.
+  UPDATE public.site_settings
+  SET value = 'true'::jsonb
+  WHERE key = 'is_admin_created'
+    AND EXISTS (SELECT 1 FROM public.profiles WHERE role = 'ADMIN'::public.user_role);
+
+`;

package/templates/nextblock-template/app/cms/CmsClientLayout.tsx

@@ -191,7 +191,6 @@ export default function CmsClientLayout({
 
   const getInitials = () => {
     if (profile && profile.full_name) return profile.full_name.split(' ').map((n: string) => n[0]).join('').substring(0,2).toUpperCase();
-    if (profile && profile.github_username) return profile.github_username.substring(0,2).toUpperCase();
     if (user && user.email) return user.email.charAt(0).toUpperCase();
     return "U"; // Default fallback
   }
@@ -470,11 +469,11 @@ export default function CmsClientLayout({
           <div className="mt-auto p-3 border-t border-slate-200 dark:border-slate-700/60 shrink-0">
             <div className="flex items-center gap-3">
               <Avatar className="h-10 w-10 border">
-                <AvatarImage src={profile?.avatar_url || undefined} alt={profile?.github_username || user?.email} />
+                <AvatarImage src={profile?.avatar_url || undefined} alt={profile?.full_name || user?.email} />
                 <AvatarFallback className="bg-primary/10 text-primary font-medium">{getInitials()}</AvatarFallback>
               </Avatar>
               <div className="flex-1 min-w-0">
-                <p className="text-sm font-medium truncate text-slate-700 dark:text-slate-200">{profile?.full_name || profile?.github_username || user?.email}</p>
+                <p className="text-sm font-medium truncate text-slate-700 dark:text-slate-200">{profile?.full_name || user?.email}</p>
                 <div className="flex items-center gap-1.5">
                   <div className={cn("h-2 w-2 rounded-full", getRoleColor())}></div>
                   <p className="text-xs text-slate-500 dark:text-slate-400 capitalize">{role}</p>

package/templates/nextblock-template/app/cms/components/FeatureImageField.tsx

@@ -157,6 +157,7 @@ export default function FeatureImageField({
             </DialogHeader>
             <div className="p-1">
               <MediaUploadForm
+                compact
                 returnJustData={true}
                 defaultFolder={uploadFolder}
                 onUploadSuccess={(newlyUploadedMedia) => {

package/templates/nextblock-template/app/cms/interactions/InteractionsModerationClient.tsx

@@ -212,7 +212,7 @@ export default function InteractionsModerationClient({
       <div className="space-y-4">
         {filteredInteractions.length > 0 ? (
           filteredInteractions.map((item) => {
-            const authorName = item.profiles?.full_name || item.profiles?.github_username || "Anonymous";
+            const authorName = item.profiles?.full_name || "Anonymous";
             const dateStr = new Date(item.created_at).toLocaleString();
             const targetName = item.products?.title || item.posts?.title || "Unknown Target";
             const targetUrl = item.product_id

package/templates/nextblock-template/app/cms/interactions/page.tsx

@@ -32,7 +32,7 @@ export default async function InteractionsPage() {
       created_at,
       product_id,
       post_id,
-      profiles(full_name, avatar_url, github_username),
+      profiles(full_name, avatar_url),
       products(title, slug),
       posts(title, slug)
     `)

package/templates/nextblock-template/app/cms/media/components/MediaPickerDialog.tsx

@@ -158,12 +158,13 @@ export default function MediaPickerDialog({
         </DialogTrigger>
       )}
       <DialogContent className="sm:max-w-[650px] md:max-w-[800px] lg:max-w-[1000px] max-h-[90vh] flex flex-col">
-        <DialogHeader>
+        <DialogHeader className="shrink-0 pb-1">
           <DialogTitle>{title}</DialogTitle>
         </DialogHeader>
 
-        <div className="p-1">
+        <div className="flex-1 min-h-0 overflow-y-auto pr-1">
           <MediaUploadForm
+            compact
             returnJustData={true}
             defaultFolder={defaultFolder}
             onUploadSuccess={(newMedia) => {
@@ -171,39 +172,40 @@ export default function MediaPickerDialog({
               handleSelect(newMedia);
             }}
           />
-        </div>
 
-        <Separator className="my-4" />
-
-        <div className="flex flex-col flex-grow overflow-hidden">
-          <h3 className="text-lg font-medium mb-3 text-center">Or Select from Library</h3>
-          <div className="relative mb-2">
-            <Input
-              type="search"
-              placeholder="Search library..."
-              value={searchTerm}
-              onChange={(e) => setSearchTerm(e.target.value)}
-              className="pl-10"
-            />
-            <Search className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
-          </div>
-          {isLoading && filtered.length === 0 ? (
-            <div className="flex-grow flex items-center justify-center">
-              <p>Loading media...</p>
-            </div>
-          ) : loadError && filtered.length === 0 ? (
-            <div className="flex-grow flex flex-col items-center justify-center gap-3 text-center">
-              <p className="max-w-sm text-sm text-muted-foreground">{loadError}</p>
-              <Button type="button" variant="outline" size="sm" onClick={() => void fetchLibrary()}>
-                Retry
-              </Button>
-            </div>
-          ) : filtered.length === 0 ? (
-            <div className="flex-grow flex items-center justify-center">
-              <p>No media found.</p>
+          <Separator className="my-3" />
+
+          <div className="flex flex-col">
+            <h3 className="text-base font-medium mb-2 text-center">Or Select from Library</h3>
+            <div className="sticky top-0 z-10 -mx-1 mb-2 bg-background px-1 pb-1">
+              <div className="relative">
+                <Input
+                  type="search"
+                  placeholder="Search library..."
+                  value={searchTerm}
+                  onChange={(e) => setSearchTerm(e.target.value)}
+                  className="pl-10"
+                />
+                <Search className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
+              </div>
             </div>
-          ) : (
-            <div className="flex flex-wrap gap-3 overflow-y-auto min-h-0 pr-2 pb-2">
+            {isLoading && filtered.length === 0 ? (
+              <div className="flex items-center justify-center py-10">
+                <p>Loading media...</p>
+              </div>
+            ) : loadError && filtered.length === 0 ? (
+              <div className="flex flex-col items-center justify-center gap-3 py-10 text-center">
+                <p className="max-w-sm text-sm text-muted-foreground">{loadError}</p>
+                <Button type="button" variant="outline" size="sm" onClick={() => void fetchLibrary()}>
+                  Retry
+                </Button>
+              </div>
+            ) : filtered.length === 0 ? (
+              <div className="flex items-center justify-center py-10">
+                <p>No media found.</p>
+              </div>
+            ) : (
+              <div className="flex flex-wrap gap-3 pb-2">
               {filtered.map((media: Media) => {
                 const previewPath = resolveMediaPreviewPath(media);
                 const previewSrc = previewPath ? resolveMediaPreviewSrc(previewPath) : null;
@@ -241,8 +243,9 @@ export default function MediaPickerDialog({
                   </button>
                 );
               })}
-            </div>
-          )}
+              </div>
+            )}
+          </div>
         </div>
       </DialogContent>
     </Dialog>