create-nextblock 0.14.2 → 0.14.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -1,37 +1,37 @@
-// AUTO-GENERATED FILE. Do not edit this file directly.
-// Regenerate it from repo root with: npm run generate:sandbox
-// Source of truth: tools/scripts/generate-sandbox-reset.ts and libs/db/src/supabase/migrations/*.sql
-
-export const SANDBOX_RESET_SQL = `
--- AUTO-GENERATED: Sandbox Reset Script. Do Not Edit Manually.
--- Generated by tools/scripts/generate-sandbox-reset.ts
-
-  -- Step A: Erase all non-demo users
-  DELETE FROM auth.users
-  WHERE id NOT IN (
-    '63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid,
-    'e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid
-  );
-
-  -- Step B: Wipe public schema and truncate migrations
-  DROP SCHEMA public CASCADE;
-  CREATE SCHEMA public;
-
-  -- Restore default public schema privileges so the standard migrations succeed
-  GRANT USAGE ON SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON ROUTINES TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
-
-  TRUNCATE TABLE supabase_migrations.schema_migrations;
-
-  -- Step C: Execute full schema & seed from production migrations
-
-
--- >>> FROM: 00000000000000_baseline_schema.sql <<<
+// AUTO-GENERATED FILE. Do not edit this file directly.
+// Regenerate it from repo root with: npm run generate:sandbox
+// Source of truth: tools/scripts/generate-sandbox-reset.ts and libs/db/src/supabase/migrations/*.sql
+
+export const SANDBOX_RESET_SQL = `
+-- AUTO-GENERATED: Sandbox Reset Script. Do Not Edit Manually.
+-- Generated by tools/scripts/generate-sandbox-reset.ts
+
+  -- Step A: Erase all non-demo users
+  DELETE FROM auth.users
+  WHERE id NOT IN (
+    '63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid,
+    'e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid
+  );
+
+  -- Step B: Wipe public schema and truncate migrations
+  DROP SCHEMA public CASCADE;
+  CREATE SCHEMA public;
+
+  -- Restore default public schema privileges so the standard migrations succeed
+  GRANT USAGE ON SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON ROUTINES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+
+  TRUNCATE TABLE supabase_migrations.schema_migrations;
+
+  -- Step C: Execute full schema & seed from production migrations
+
+
+-- >>> FROM: 00000000000000_baseline_schema.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 00 · schema: enums, functions, tables, sequences, defaults
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -2486,9 +2486,9 @@ CREATE TABLE IF NOT EXISTS public.variant_attribute_mapping (
     variant_id uuid NOT NULL,
     attribute_term_id uuid NOT NULL
 );
-
-
--- >>> FROM: 00000000000001_baseline_constraints_and_indexes.sql <<<
+
+
+-- >>> FROM: 00000000000001_baseline_constraints_and_indexes.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 01 · constraints (PK / unique / check / FK) + indexes
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -3560,9 +3560,9 @@ DO $rb$ BEGIN
         ADD CONSTRAINT variant_attribute_mapping_variant_id_fkey FOREIGN KEY (variant_id) REFERENCES public.product_variants(id) ON DELETE CASCADE;
   END IF;
 END $rb$;
-
-
--- >>> FROM: 00000000000002_baseline_security_and_grants.sql <<<
+
+
+-- >>> FROM: 00000000000002_baseline_security_and_grants.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 02 · row-level security, policies, triggers, grants
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -4898,9 +4898,9 @@ CREATE TRIGGER on_auth_user_created
   FOR EACH ROW
   EXECUTE FUNCTION public.handle_new_user();
 REVOKE EXECUTE ON FUNCTION public.handle_new_user() FROM PUBLIC, anon, authenticated;
-
-
--- >>> FROM: 00000000000003_baseline_seed.sql <<<
+
+
+-- >>> FROM: 00000000000003_baseline_seed.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 03 · seed: canonical NextBlock demo content (no users, no secrets)
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -5369,9 +5369,9 @@ SELECT pg_catalog.setval('public.languages_id_seq', COALESCE((SELECT MAX(id) FRO
 SELECT pg_catalog.setval('public.navigation_items_id_seq', COALESCE((SELECT MAX(id) FROM public.navigation_items), 1), true);
 SELECT pg_catalog.setval('public.pages_id_seq', COALESCE((SELECT MAX(id) FROM public.pages), 1), true);
 SELECT pg_catalog.setval('public.posts_id_seq', COALESCE((SELECT MAX(id) FROM public.posts), 1), true);
-
-
--- >>> FROM: 00000000000004_default_logo_email_safe.sql <<<
+
+
+-- >>> FROM: 00000000000004_default_logo_email_safe.sql <<<
 -- Swap the seeded DEFAULT site logo from the WebP asset to a bundled PNG.
 --
 -- WebP (and AVIF) don't render in Outlook and several other email clients, so the default
@@ -5396,9 +5396,9 @@ UPDATE public.logos
 SET media_id = 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
 WHERE id = 'd45ef03d-27fc-4099-8b46-1cdf82d658d2'
   AND media_id = 'ea6fdaf5-f8de-416c-9f2b-b689b7a4ed38';
-
-
--- >>> FROM: 00000000000005_add_custom_canonical.sql <<<
+
+
+-- >>> FROM: 00000000000005_add_custom_canonical.sql <<<
 -- Add a nullable \`custom_canonical\` column to pages, posts and products.
 --
 -- This is the per-content manual canonical override used by each route's
@@ -5412,9 +5412,9 @@ WHERE id = 'd45ef03d-27fc-4099-8b46-1cdf82d658d2'
 ALTER TABLE public.pages ADD COLUMN IF NOT EXISTS custom_canonical text;
 ALTER TABLE public.posts ADD COLUMN IF NOT EXISTS custom_canonical text;
 ALTER TABLE public.products ADD COLUMN IF NOT EXISTS custom_canonical text;
-
-
--- >>> FROM: 00000000000006_home_live_demo_promo.sql <<<
+
+
+-- >>> FROM: 00000000000006_home_live_demo_promo.sql <<<
 -- 00000000000006_home_sandbox_promo.sql
 -- Adds a "Live Demo" promo section to the English (slug 'home') and French
 -- (slug 'accueil') home pages that drives visitors to the public sandbox at
@@ -5482,9 +5482,9 @@ $fr$::jsonb, 1);
   END IF;
 END
 $body$;
-
-
--- >>> FROM: 00000000000007_home_live_demo_promo_copy_fix.sql <<<
+
+
+-- >>> FROM: 00000000000007_home_live_demo_promo_copy_fix.sql <<<
 -- 00000000000007_home_live_demo_promo_copy_fix.sql
 -- Corrects the "Live Demo" promo that migration 006 seeded on the EN (slug 'home')
 -- and FR (slug 'accueil') home pages. 006 was already applied to production and the
@@ -5534,9 +5534,9 @@ $fr$::jsonb,
      AND content::text LIKE '%nb-sandbox-promo%';
 END
 $body$;
-
-
--- >>> FROM: 00000000000008_setup_article_reorder.sql <<<
+
+
+-- >>> FROM: 00000000000008_setup_article_reorder.sql <<<
 -- 00000000000008_setup_article_reorder.sql
 -- Reorders and rewrites the "How to Install NextBlock" setup guide on BOTH language
 -- twins: EN (post slug 'how-to-setup-nextblock', post_id=3 / block id=40) and FR
@@ -5567,9 +5567,9 @@ $nbfr$::jsonb,
        updated_at = now()
  WHERE post_id = 4
    AND block_type = 'text';
-
-
--- >>> FROM: 00000000000009_home_live_demo_promo_contrast.sql <<<
+
+
+-- >>> FROM: 00000000000009_home_live_demo_promo_contrast.sql <<<
 -- 00000000000009_home_live_demo_promo_contrast.sql
 -- Restyles the "Live Demo" promo that migrations 006/007 seeded on the EN (slug 'home')
 -- and FR (slug 'accueil') home pages. 006/007 gave it a fixed dark-navy GRADIENT section
@@ -5622,9 +5622,9 @@ $fr$::jsonb,
      AND content::text LIKE '%nb-sandbox-promo%';
 END
 $body$;
-
-
--- >>> FROM: 00000000000010_drop_github_username.sql <<<
+
+
+-- >>> FROM: 00000000000010_drop_github_username.sql <<<
 -- Drop the github_username profile column and remove the GitHub-auth artifacts.
 --
 -- GitHub OAuth sign-in / account-linking was removed from the app: it cannot be
@@ -5704,9 +5704,9 @@ WHERE key IN (
   'github_link_failed',
   'github_connected'
 );
-
-
--- >>> FROM: 00000000000011_language_detection_admin_only.sql <<<
+
+
+-- >>> FROM: 00000000000011_language_detection_admin_only.sql <<<
 -- Restrict writes to the language-detection settings row to ADMIN only.
 --
 -- \`site_settings.language_detection_settings\` is a non-sensitive, anon-READABLE
@@ -5728,9 +5728,9 @@ CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO
 
 DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
 CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-
--- >>> FROM: 00000000000012_cortex_ai_stock_photo_settings.sql <<<
+
+
+-- >>> FROM: 00000000000012_cortex_ai_stock_photo_settings.sql <<<
 -- Protect the Cortex AI stock-photo provider API keys stored in site_settings.
 --
 -- The stock-photo search tool (search_stock_photos) can read a Pexels or Unsplash
@@ -5756,9 +5756,9 @@ CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO
 
 DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
 CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-
--- >>> FROM: 00000000000013_youtube_nocookie_embeds.sql <<<
+
+
+-- >>> FROM: 00000000000013_youtube_nocookie_embeds.sql <<<
 -- 00000000000013_youtube_nocookie_embeds.sql
 --
 -- Lighthouse Best Practices scored 96 instead of 100: the \`inspector-issues\` audit
@@ -5895,47 +5895,305 @@ UPDATE public.custom_block_definitions
        )::jsonb
  WHERE layout_schema::text LIKE '%www.youtube.com/embed/%'
     OR layout_schema::text LIKE '%accelerated-motion%';
-
-
-  -- Step D: Record the applied migrations in history (truncated in Step B) so
-  -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
-  INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
-    ('00000000000000', 'baseline_schema'),
-    ('00000000000001', 'baseline_constraints_and_indexes'),
-    ('00000000000002', 'baseline_security_and_grants'),
-    ('00000000000003', 'baseline_seed'),
-    ('00000000000004', 'default_logo_email_safe'),
-    ('00000000000005', 'add_custom_canonical'),
-    ('00000000000006', 'home_live_demo_promo'),
-    ('00000000000007', 'home_live_demo_promo_copy_fix'),
-    ('00000000000008', 'setup_article_reorder'),
-    ('00000000000009', 'home_live_demo_promo_contrast'),
-    ('00000000000010', 'drop_github_username'),
-    ('00000000000011', 'language_detection_admin_only'),
-    ('00000000000012', 'cortex_ai_stock_photo_settings'),
-    ('00000000000013', 'youtube_nocookie_embeds')
-  ON CONFLICT (version) DO NOTHING;
-
-  -- Step E: Anchor preserved profiles
-  INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
-  SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'
-  FROM (
-    VALUES
-      ('63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid),
-      ('e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid)
-  ) AS preserved_user(id)
-  WHERE EXISTS (SELECT 1 FROM auth.users WHERE id = preserved_user.id)
-    AND NOT EXISTS (SELECT 1 FROM public.profiles WHERE id = preserved_user.id);
-
-  -- Step F: Re-assert the "first admin exists" flag. The sandbox preserves its demo
-  -- ADMIN users across the wipe (Steps A & E), but the reseeded baseline resets
-  -- is_admin_created to 'false' and handle_new_user() only flips it on a NEW auth.users
-  -- INSERT -- which never fires for preserved users. Without this the proxy setup-gate
-  -- funnels ALL sandbox traffic (including this reset cron on its next run) to /setup even
-  -- though admins already exist. Guarded on an ADMIN profile actually being present.
-  UPDATE public.site_settings
-  SET value = 'true'::jsonb
-  WHERE key = 'is_admin_created'
-    AND EXISTS (SELECT 1 FROM public.profiles WHERE role = 'ADMIN'::public.user_role);
-
-`;
+
+
+-- >>> FROM: 00000000000014_site_themes.sql <<<
+-- Editable site themes.
+--
+-- Themes used to be hardcoded CSS classes in libs/ui/src/styles/theme.css
+-- (:root / .dark / .vibrant) with the switcher list duplicated in
+-- apps/nextblock/app/providers.tsx and components/theme-switcher.tsx. This moves
+-- the palette into the database so an ADMIN can retint the site, add themes and
+-- remove them from /cms/settings/global-css without a redeploy.
+--
+-- Rendering: apps/nextblock/lib/themes/buildThemeCss.ts turns each row into a
+-- \`:root.<slug> { --token: value; ... }\` rule injected into <head> by
+-- app/layout.tsx. The \`:root.x\` form is two-class specificity, so generated
+-- themes always beat the (0,1,0) fallback rules still shipped in theme.css for
+-- consumers of the published @nextblock-cms/ui package.
+--
+-- Forward-only and idempotent.
+
+CREATE TABLE IF NOT EXISTS public.site_themes (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    slug text NOT NULL,
+    name text NOT NULL,
+    description text,
+    -- lucide-react icon name rendered by the theme switcher.
+    icon text NOT NULL DEFAULT 'Palette',
+    -- Drives the CSS \`color-scheme\` property and decides whether the theme also
+    -- carries Tailwind's \`.dark\` class so \`dark:\` variants resolve correctly.
+    color_scheme text NOT NULL DEFAULT 'light',
+    -- Flat map of design token -> raw CSS value, keys WITHOUT the leading \`--\`,
+    -- e.g. {"background": "0 0% 100%", "radius": "0.75rem"}.
+    tokens jsonb NOT NULL DEFAULT '{}'::jsonb,
+    -- Optional per-theme CSS, emitted nested inside the theme rule so it is
+    -- automatically scoped. Authors use the \`&\` nesting selector,
+    -- e.g. \`& h1 { text-shadow: 0 0 5px hsl(var(--primary)); }\`.
+    extra_css text,
+    -- System themes cannot be deleted: next-themes' \`enableSystem\` resolves to
+    -- 'light' or 'dark', so those two slugs must always exist.
+    is_system boolean DEFAULT false NOT NULL,
+    is_default boolean DEFAULT false NOT NULL,
+    is_active boolean DEFAULT true NOT NULL,
+    sort_order integer DEFAULT 0 NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT site_themes_pkey PRIMARY KEY (id),
+    CONSTRAINT site_themes_slug_key UNIQUE (slug),
+    CONSTRAINT site_themes_color_scheme_check CHECK ((color_scheme = ANY (ARRAY['light'::text, 'dark'::text]))),
+    -- The slug becomes a CSS class and a next-themes value; keep it safe for both.
+    CONSTRAINT site_themes_slug_format_check CHECK ((slug ~ '^[a-z][a-z0-9-]{0,38}[a-z0-9]$')),
+    CONSTRAINT site_themes_tokens_is_object_check CHECK ((jsonb_typeof(tokens) = 'object'))
+);
+
+COMMENT ON TABLE public.site_themes IS 'Editable colour themes. Each row renders to a \`:root.<slug>\` CSS rule injected by the root layout. Publicly readable (anonymous visitors need the palette); only ADMIN may write.';
+
+CREATE INDEX IF NOT EXISTS site_themes_active_sort_idx ON public.site_themes USING btree (is_active, sort_order);
+
+-- Exactly one default theme.
+CREATE UNIQUE INDEX IF NOT EXISTS site_themes_single_default_idx ON public.site_themes USING btree (is_default) WHERE (is_default = true);
+
+DROP TRIGGER IF EXISTS set_site_themes_updated_at ON public.site_themes;
+CREATE TRIGGER set_site_themes_updated_at
+    BEFORE UPDATE ON public.site_themes
+    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
+
+-- A system theme must never be deleted, whoever asks.
+CREATE OR REPLACE FUNCTION public.prevent_system_theme_delete() RETURNS trigger
+    LANGUAGE plpgsql
+    SET search_path = ''
+    AS $$
+BEGIN
+  IF OLD.is_system THEN
+    RAISE EXCEPTION 'Theme "%" is a system theme and cannot be deleted', OLD.slug
+      USING ERRCODE = 'restrict_violation';
+  END IF;
+  RETURN OLD;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_prevent_system_theme_delete ON public.site_themes;
+CREATE TRIGGER trg_prevent_system_theme_delete
+    BEFORE DELETE ON public.site_themes
+    FOR EACH ROW EXECUTE FUNCTION public.prevent_system_theme_delete();
+
+-- Promoting a theme to default demotes the previous one, so the unique partial
+-- index above can never trip on a normal "make this the default" write.
+CREATE OR REPLACE FUNCTION public.handle_default_theme_change() RETURNS trigger
+    LANGUAGE plpgsql
+    SET search_path = ''
+    AS $$
+BEGIN
+  IF NEW.is_default THEN
+    UPDATE public.site_themes
+       SET is_default = false
+     WHERE id <> NEW.id AND is_default;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_handle_default_theme_change ON public.site_themes;
+CREATE TRIGGER trg_handle_default_theme_change
+    AFTER INSERT OR UPDATE OF is_default ON public.site_themes
+    FOR EACH ROW WHEN (NEW.is_default) EXECUTE FUNCTION public.handle_default_theme_change();
+
+ALTER TABLE public.site_themes ENABLE ROW LEVEL SECURITY;
+
+GRANT ALL ON TABLE public.site_themes TO anon;
+GRANT ALL ON TABLE public.site_themes TO authenticated;
+GRANT ALL ON TABLE public.site_themes TO service_role;
+
+DROP POLICY IF EXISTS "Public read active themes" ON public.site_themes;
+CREATE POLICY "Public read active themes" ON public.site_themes
+    FOR SELECT TO authenticated, anon USING (true);
+
+DROP POLICY IF EXISTS "Admins insert themes" ON public.site_themes;
+CREATE POLICY "Admins insert themes" ON public.site_themes
+    FOR INSERT TO authenticated
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins update themes" ON public.site_themes;
+CREATE POLICY "Admins update themes" ON public.site_themes
+    FOR UPDATE TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role))
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins delete themes" ON public.site_themes;
+CREATE POLICY "Admins delete themes" ON public.site_themes
+    FOR DELETE TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Service role manages themes" ON public.site_themes;
+CREATE POLICY "Service role manages themes" ON public.site_themes
+    TO service_role USING (true) WITH CHECK (true);
+
+-- Seed the three shipped themes from libs/ui/src/styles/theme.css.
+-- \`--warning\` / \`--warning-foreground\` are declared in the Tailwind theme
+-- (libs/ui/tailwind.config.js) but were never defined in CSS, so bg-warning and
+-- text-warning resolved to an invalid colour. They are given real values here.
+INSERT INTO public.site_themes (slug, name, description, icon, color_scheme, is_system, is_default, sort_order, tokens, extra_css)
+VALUES
+  (
+    'light', 'Light', 'Clean, technical, stark.', 'Sun', 'light', true, true, 10,
+    '{
+      "background": "0 0% 100%",
+      "foreground": "222 47% 11%",
+      "card": "0 0% 100%",
+      "card-foreground": "222 47% 11%",
+      "popover": "0 0% 100%",
+      "popover-foreground": "222 47% 11%",
+      "primary": "211.55 50.26% 37.84%",
+      "primary-foreground": "210 40% 98%",
+      "secondary": "210 40% 96.1%",
+      "secondary-foreground": "222 47% 11%",
+      "muted": "210 40% 96.1%",
+      "muted-foreground": "215 16% 47%",
+      "accent": "210 40% 96.1%",
+      "accent-foreground": "222 47% 11%",
+      "destructive": "0 84.2% 60.2%",
+      "destructive-foreground": "210 40% 98%",
+      "warning": "38 92% 50%",
+      "warning-foreground": "222 47% 11%",
+      "border": "214.3 31.8% 91.4%",
+      "input": "214.3 31.8% 91.4%",
+      "ring": "211.55 50.26% 37.84%",
+      "radius": "0.75rem",
+      "chart-1": "211.55 50.26% 37.84%",
+      "chart-2": "215 16% 47%",
+      "chart-3": "215 25% 27%",
+      "chart-4": "210 40% 96%",
+      "chart-5": "214 32% 91%"
+    }'::jsonb,
+    NULL
+  ),
+  (
+    'dark', 'Dark', 'Midnight / neon tech.', 'Moon', 'dark', true, false, 20,
+    '{
+      "background": "222 47% 2%",
+      "foreground": "210 40% 98%",
+      "card": "222 47% 11%",
+      "card-foreground": "210 40% 98%",
+      "popover": "222 47% 11%",
+      "popover-foreground": "210 40% 98%",
+      "primary": "217 91% 60%",
+      "primary-foreground": "222 47% 11%",
+      "secondary": "217.2 32.6% 17.5%",
+      "secondary-foreground": "210 40% 98%",
+      "muted": "217.2 32.6% 17.5%",
+      "muted-foreground": "215 20.2% 65.1%",
+      "accent": "217.2 32.6% 17.5%",
+      "accent-foreground": "210 40% 98%",
+      "destructive": "0 62.8% 30.6%",
+      "destructive-foreground": "210 40% 98%",
+      "warning": "38 92% 50%",
+      "warning-foreground": "222 47% 11%",
+      "border": "217.2 32.6% 17.5%",
+      "input": "217.2 32.6% 17.5%",
+      "ring": "224 76% 48%",
+      "radius": "0.75rem",
+      "chart-1": "220 70% 50%",
+      "chart-2": "160 60% 45%",
+      "chart-3": "30 80% 55%",
+      "chart-4": "280 65% 60%",
+      "chart-5": "340 75% 55%"
+    }'::jsonb,
+    NULL
+  ),
+  (
+    'vibrant', 'Vibrant', 'Cyberpunk neon.', 'Zap', 'dark', false, false, 30,
+    '{
+      "background": "260 50% 5%",
+      "foreground": "180 100% 90%",
+      "card": "260 50% 8%",
+      "card-foreground": "180 100% 90%",
+      "popover": "260 50% 8%",
+      "popover-foreground": "180 100% 90%",
+      "primary": "320 100% 55%",
+      "primary-foreground": "0 0% 100%",
+      "secondary": "180 100% 50%",
+      "secondary-foreground": "260 50% 5%",
+      "muted": "260 30% 15%",
+      "muted-foreground": "260 20% 65%",
+      "accent": "280 100% 50%",
+      "accent-foreground": "0 0% 100%",
+      "destructive": "0 100% 50%",
+      "destructive-foreground": "0 0% 100%",
+      "warning": "60 100% 50%",
+      "warning-foreground": "260 50% 5%",
+      "border": "320 100% 55%",
+      "input": "260 30% 15%",
+      "ring": "320 100% 55%",
+      "radius": "0px",
+      "chart-1": "320 100% 55%",
+      "chart-2": "180 100% 50%",
+      "chart-3": "280 100% 50%",
+      "chart-4": "60 100% 50%",
+      "chart-5": "120 100% 50%"
+    }'::jsonb,
+    '& h1, & h2, & h3, & h4, & h5, & h6 {
+  text-shadow: 0 0 5px hsl(var(--primary)), 0 0 10px hsl(var(--secondary));
+}
+& button, & [role="button"] {
+  box-shadow: 0 0 5px hsl(var(--primary) / 0.5);
+  transition: box-shadow 0.3s ease;
+}
+& button:hover, & [role="button"]:hover {
+  box-shadow: 0 0 15px hsl(var(--primary));
+}
+& .card, & [class*="card"] {
+  border: 1px solid hsl(var(--primary));
+  box-shadow: 0 0 10px hsl(var(--primary) / 0.2);
+}
+& .border {
+  border-color: hsl(var(--border));
+  box-shadow: 0 0 5px hsl(var(--border) / 0.3);
+}'
+  )
+ON CONFLICT (slug) DO NOTHING;
+
+
+  -- Step D: Record the applied migrations in history (truncated in Step B) so
+  -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
+  INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
+    ('00000000000000', 'baseline_schema'),
+    ('00000000000001', 'baseline_constraints_and_indexes'),
+    ('00000000000002', 'baseline_security_and_grants'),
+    ('00000000000003', 'baseline_seed'),
+    ('00000000000004', 'default_logo_email_safe'),
+    ('00000000000005', 'add_custom_canonical'),
+    ('00000000000006', 'home_live_demo_promo'),
+    ('00000000000007', 'home_live_demo_promo_copy_fix'),
+    ('00000000000008', 'setup_article_reorder'),
+    ('00000000000009', 'home_live_demo_promo_contrast'),
+    ('00000000000010', 'drop_github_username'),
+    ('00000000000011', 'language_detection_admin_only'),
+    ('00000000000012', 'cortex_ai_stock_photo_settings'),
+    ('00000000000013', 'youtube_nocookie_embeds'),
+    ('00000000000014', 'site_themes')
+  ON CONFLICT (version) DO NOTHING;
+
+  -- Step E: Anchor preserved profiles
+  INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
+  SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'
+  FROM (
+    VALUES
+      ('63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid),
+      ('e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid)
+  ) AS preserved_user(id)
+  WHERE EXISTS (SELECT 1 FROM auth.users WHERE id = preserved_user.id)
+    AND NOT EXISTS (SELECT 1 FROM public.profiles WHERE id = preserved_user.id);
+
+  -- Step F: Re-assert the "first admin exists" flag. The sandbox preserves its demo
+  -- ADMIN users across the wipe (Steps A & E), but the reseeded baseline resets
+  -- is_admin_created to 'false' and handle_new_user() only flips it on a NEW auth.users
+  -- INSERT -- which never fires for preserved users. Without this the proxy setup-gate
+  -- funnels ALL sandbox traffic (including this reset cron on its next run) to /setup even
+  -- though admins already exist. Guarded on an ADMIN profile actually being present.
+  UPDATE public.site_settings
+  SET value = 'true'::jsonb
+  WHERE key = 'is_admin_created'
+    AND EXISTS (SELECT 1 FROM public.profiles WHERE role = 'ADMIN'::public.user_role);
+
+`;

package/templates/nextblock-template/app/cms/CmsClientLayout.tsx

@@ -228,7 +228,7 @@ export default function CmsClientLayout({
   // Fallback for general /cms/settings if no more specific language path matches
   else if (pathname.startsWith("/cms/settings/logos")) pageTitle = "Branding";
   else if (pathname.startsWith("/cms/settings/copyright")) pageTitle = "Copyright Settings";
-  else if (pathname.startsWith("/cms/settings/global-css")) pageTitle = "Global CSS Settings";
+  else if (pathname.startsWith("/cms/settings/global-css")) pageTitle = "Themes & CSS";
   else if (pathname.startsWith("/cms/settings/extra-translations")) pageTitle = "Extra Translations";
   else if (pathname.startsWith("/cms/settings/backup-restore")) pageTitle = "Backup And Restore";
   else if (pathname.startsWith("/cms/settings/currencies")) pageTitle = "Currency Settings";
@@ -422,7 +422,7 @@ export default function CmsClientLayout({
                       Copyright
                     </NavItem>
                     <NavItem href="/cms/settings/global-css" icon={Paintbrush} isActive={pathname.startsWith("/cms/settings/global-css")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
-                      Global CSS
+                      Themes &amp; CSS
                     </NavItem>
                     <NavItem href="/cms/settings/privacy" icon={Cookie} isActive={pathname.startsWith("/cms/settings/privacy")} adminOnly isAdmin={isAdmin} onClick={closeSidebarOnMobile}>
                       Privacy &amp; Consent