create-nextblock 0.14.4 → 0.14.6

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -6154,6 +6154,459 @@ VALUES
 ON CONFLICT (slug) DO NOTHING;
 
 
+-- >>> FROM: 00000000000015_scheduled_publishing.sql <<<
+-- Scheduled publishing for pages and products.
+--
+-- Posts already support scheduling: \`posts.published_at\` exists and every public
+-- read gates on \`published_at IS NULL OR published_at <= now()\`, so a row with
+-- status='published' and a future date is withheld until the date passes. Pages
+-- and products had no equivalent column, so "go live on Tuesday" was impossible
+-- for them. This adds the same column with the same semantics.
+--
+-- Visibility is derived from the (status, published_at) PAIR — no new enum value:
+--
+--   status = draft/archived                      -> not public, whatever the date
+--   status = published|active, published_at NULL -> public now
+--   status = published|active, date <= now()     -> public now
+--   status = published|active, date >  now()     -> SCHEDULED (withheld)
+--
+-- Deriving "scheduled" instead of storing it keeps \`page_status\` unchanged (adding
+-- an enum value can't be done inside a transaction with other DDL in Postgres) and
+-- matches what posts have always done, so one code path covers all three types.
+--
+-- NULL is the safe default: every existing published row keeps rendering exactly as
+-- before, so this migration needs no backfill and changes no current behavior.
+--
+-- Forward-only and idempotent.
+
+ALTER TABLE public.pages
+    ADD COLUMN IF NOT EXISTS published_at timestamp with time zone;
+
+COMMENT ON COLUMN public.pages.published_at IS
+    'Optional go-live moment. NULL = live as soon as status is published. A future value withholds the page from public reads until it passes (status stays "published"; the CMS renders that pair as "Scheduled").';
+
+ALTER TABLE public.products
+    ADD COLUMN IF NOT EXISTS published_at timestamp with time zone;
+
+COMMENT ON COLUMN public.products.published_at IS
+    'Optional go-live moment. NULL = live as soon as status is active. A future value withholds the product from public reads until it passes (status stays "active"; the CMS renders that pair as "Scheduled").';
+
+-- Public listing/index queries filter on the (status, published_at) pair together
+-- (catalog, sitemap, page lookups), so a composite index serves them in one pass.
+CREATE INDEX IF NOT EXISTS pages_status_published_at_idx
+    ON public.pages (status, published_at);
+
+CREATE INDEX IF NOT EXISTS products_status_published_at_idx
+    ON public.products (status, published_at);
+
+
+-- >>> FROM: 00000000000016_product_revisions_and_revision_baseline.sql <<<
+-- 00000000000016_product_revisions_and_revision_baseline.sql
+--
+-- Revision History, part 1 of 2 (schema). The application-side rewrite lives in
+-- apps/nextblock/app/cms/revisions/**.
+--
+-- Three things happen here:
+--
+--   1. products.version    — the monotonic counter the hybrid revision engine drives,
+--                            mirroring pages.version / posts.version.
+--
+--   2. product_revisions   — a structural mirror of page_revisions / post_revisions.
+--                            product_id is uuid (products.id is uuid, not bigint), and
+--                            writes are gated on is_admin() to match products_*_policy
+--                            rather than the ADMIN|WRITER pattern the page/post revision
+--                            tables use. A WRITER who could insert a revision but not
+--                            apply a restore would get a silent no-op restore, because
+--                            PostgREST returns no error for an UPDATE matching zero rows.
+--
+--   3. Revision baseline   — every page, post and product gets a real \`snapshot\` row to
+--                            restore to. Until now the CMS synthesised a fake "Initial
+--                            Version" entry in the UI whose Restore button resolved to
+--                            "current metadata + zero blocks" and wiped the content.
+--                            There is now an actual stored baseline instead.
+--
+--                            Case A (version = 1, no revisions at all): the live row IS
+--                            version 1. This covers seeded content — 00000000000003
+--                            inserts every page and post at version 1 and writes no
+--                            revision rows — and everything authored since the CMS save
+--                            path stopped recording revisions. Snapshotting it at
+--                            version 1 is what makes "restore the original seeded page"
+--                            real for the first time.
+--
+--                            Case B (version > 1 but no snapshot at or below it): the
+--                            true v1 is unrecoverable and is NOT fabricated. A snapshot
+--                            of the current state is stored at the current version so the
+--                            diff chain has a valid base and future restores resolve.
+--
+-- Forward-only, idempotent, and it modifies no existing row: every backfill is an
+-- INSERT ... WHERE NOT EXISTS ... ON CONFLICT DO NOTHING.
+
+-- ---------------------------------------------------------------------------
+-- 1. products.version
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.products
+    ADD COLUMN IF NOT EXISTS version integer DEFAULT 1 NOT NULL;
+
+COMMENT ON COLUMN public.products.version IS 'Monotonic version number for hybrid revisions.';
+
+-- ---------------------------------------------------------------------------
+-- 2. product_revisions
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS public.product_revisions (
+    id bigint NOT NULL,
+    product_id uuid NOT NULL,
+    author_id uuid,
+    version integer NOT NULL,
+    revision_type public.revision_type NOT NULL,
+    content jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+COMMENT ON TABLE public.product_revisions IS 'Hybrid (snapshot/diff) revisions for products.';
+COMMENT ON COLUMN public.product_revisions.content IS 'If snapshot: full content; if diff: JSON Patch array.';
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_attribute
+     WHERE attrelid = 'public.product_revisions'::regclass
+       AND attname  = 'id'
+       AND attidentity <> ''
+  ) THEN
+    ALTER TABLE public.product_revisions
+      ALTER COLUMN id ADD GENERATED BY DEFAULT AS IDENTITY (
+        SEQUENCE NAME public.product_revisions_id_seq
+        START WITH 1
+        INCREMENT BY 1
+        NO MINVALUE
+        NO MAXVALUE
+        CACHE 1
+      );
+  END IF;
+END $rb$;
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                  WHERE conname = 'product_revisions_pkey'
+                    AND conrelid = 'public.product_revisions'::regclass) THEN
+    ALTER TABLE ONLY public.product_revisions
+      ADD CONSTRAINT product_revisions_pkey PRIMARY KEY (id);
+  END IF;
+END $rb$;
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                  WHERE conname = 'product_revisions_product_version_key'
+                    AND conrelid = 'public.product_revisions'::regclass) THEN
+    ALTER TABLE ONLY public.product_revisions
+      ADD CONSTRAINT product_revisions_product_version_key UNIQUE (product_id, version);
+  END IF;
+END $rb$;
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                  WHERE conname = 'product_revisions_author_id_fkey'
+                    AND conrelid = 'public.product_revisions'::regclass) THEN
+    ALTER TABLE ONLY public.product_revisions
+      ADD CONSTRAINT product_revisions_author_id_fkey
+      FOREIGN KEY (author_id) REFERENCES public.profiles(id) ON DELETE SET NULL;
+  END IF;
+END $rb$;
+
+DO $rb$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                  WHERE conname = 'product_revisions_product_id_fkey'
+                    AND conrelid = 'public.product_revisions'::regclass) THEN
+    ALTER TABLE ONLY public.product_revisions
+      ADD CONSTRAINT product_revisions_product_id_fkey
+      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE CASCADE;
+  END IF;
+END $rb$;
+
+CREATE INDEX IF NOT EXISTS idx_product_revisions_author_id
+    ON public.product_revisions USING btree (author_id);
+
+CREATE INDEX IF NOT EXISTS idx_product_revisions_product_id_version
+    ON public.product_revisions USING btree (product_id, version);
+
+ALTER TABLE public.product_revisions ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS product_revisions_read_policy ON public.product_revisions;
+CREATE POLICY product_revisions_read_policy ON public.product_revisions
+  FOR SELECT TO authenticated USING (true);
+
+DROP POLICY IF EXISTS product_revisions_insert_policy ON public.product_revisions;
+CREATE POLICY product_revisions_insert_policy ON public.product_revisions
+  FOR INSERT TO authenticated
+  WITH CHECK (((SELECT public.is_admin() AS is_admin) IS TRUE));
+
+DROP POLICY IF EXISTS product_revisions_update_policy ON public.product_revisions;
+CREATE POLICY product_revisions_update_policy ON public.product_revisions
+  FOR UPDATE TO authenticated
+  USING (((SELECT public.is_admin() AS is_admin) IS TRUE))
+  WITH CHECK (((SELECT public.is_admin() AS is_admin) IS TRUE));
+
+DROP POLICY IF EXISTS product_revisions_delete_policy ON public.product_revisions;
+CREATE POLICY product_revisions_delete_policy ON public.product_revisions
+  FOR DELETE TO authenticated
+  USING (((SELECT public.is_admin() AS is_admin) IS TRUE));
+
+GRANT ALL ON TABLE    public.product_revisions        TO anon;
+GRANT ALL ON TABLE    public.product_revisions        TO authenticated;
+GRANT ALL ON TABLE    public.product_revisions        TO service_role;
+GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO anon;
+GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO authenticated;
+GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO service_role;
+
+-- ---------------------------------------------------------------------------
+-- 3. Revision baseline backfill
+--
+-- The JSON shape must match FullPageContent / FullPostContent / FullProductContent
+-- in apps/nextblock/app/cms/revisions/utils.ts exactly, or the first diff taken
+-- against a baseline row will be full of phantom operations.
+--
+-- Timestamps are rendered with an explicit millisecond-precision UTC format so they
+-- match JavaScript's Date#toISOString() ("2026-07-03T17:52:15.643Z"). Postgres'
+-- default jsonb rendering of timestamptz ("2026-07-03T17:52:15.643901+00:00") would
+-- differ from the value the application writes and produce a spurious diff on the
+-- very next save.
+-- ---------------------------------------------------------------------------
+
+-- 3a. Pages
+INSERT INTO public.page_revisions (page_id, author_id, version, revision_type, content)
+SELECT
+    p.id,
+    NULL::uuid,
+    p.version,
+    'snapshot'::public.revision_type,
+    jsonb_build_object(
+      'meta', jsonb_build_object(
+        'title',            p.title,
+        'slug',             p.slug,
+        'language_id',      p.language_id,
+        'status',           p.status,
+        'meta_title',       p.meta_title,
+        'meta_description', p.meta_description,
+        'custom_canonical', p.custom_canonical,
+        'published_at',     to_char(p.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+        'feature_image_id', p.feature_image_id
+      ),
+      'blocks', COALESCE((
+        SELECT jsonb_agg(
+                 jsonb_build_object(
+                   'language_id', b.language_id,
+                   'block_type',  b.block_type,
+                   'content',     b.content,
+                   'order',       b."order"
+                 ) ORDER BY b."order" ASC, b.id ASC
+               )
+          FROM public.blocks b
+         WHERE b.page_id = p.id
+      ), '[]'::jsonb)
+    )
+  FROM public.pages p
+ WHERE NOT EXISTS (
+         SELECT 1 FROM public.page_revisions r
+          WHERE r.page_id = p.id
+            AND r.revision_type = 'snapshot'
+            AND r.version <= p.version
+       )
+ON CONFLICT (page_id, version) DO NOTHING;
+
+-- 3b. Posts
+INSERT INTO public.post_revisions (post_id, author_id, version, revision_type, content)
+SELECT
+    po.id,
+    NULL::uuid,
+    po.version,
+    'snapshot'::public.revision_type,
+    jsonb_build_object(
+      'meta', jsonb_build_object(
+        'title',            po.title,
+        'slug',             po.slug,
+        'language_id',      po.language_id,
+        'status',           po.status,
+        'meta_title',       po.meta_title,
+        'meta_description', po.meta_description,
+        'custom_canonical', po.custom_canonical,
+        'published_at',     to_char(po.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+        'feature_image_id', po.feature_image_id,
+        'label',            po.label,
+        'excerpt',          po.excerpt,
+        'subtitle',         po.subtitle
+      ),
+      'blocks', COALESCE((
+        SELECT jsonb_agg(
+                 jsonb_build_object(
+                   'language_id', b.language_id,
+                   'block_type',  b.block_type,
+                   'content',     b.content,
+                   'order',       b."order"
+                 ) ORDER BY b."order" ASC, b.id ASC
+               )
+          FROM public.blocks b
+         WHERE b.post_id = po.id
+      ), '[]'::jsonb)
+    )
+  FROM public.posts po
+ WHERE NOT EXISTS (
+         SELECT 1 FROM public.post_revisions r
+          WHERE r.post_id = po.id
+            AND r.revision_type = 'snapshot'
+            AND r.version <= po.version
+       )
+ON CONFLICT (post_id, version) DO NOTHING;
+
+-- 3c. Products.
+--
+-- Content only. price/prices/sale_*/scheduled_*/stock/sku/average_rating/total_reviews
+-- are deliberately excluded from the snapshot: pricing and inventory are mutated from
+-- outside the editor (promotions, Freemius sync, order fulfilment), ratings are derived
+-- aggregates, and inventory_items is keyed by bare SKU text with no FK to products — so
+-- replaying commerce state on restore would reach rows the editor never touched.
+-- Restoring a product restores its content, not its commerce state.
+INSERT INTO public.product_revisions (product_id, author_id, version, revision_type, content)
+SELECT
+    pr.id,
+    NULL::uuid,
+    pr.version,
+    'snapshot'::public.revision_type,
+    jsonb_build_object(
+      'meta', jsonb_build_object(
+        'title',             pr.title,
+        'slug',              pr.slug,
+        'language_id',       pr.language_id,
+        'status',            pr.status,
+        'meta_title',        pr.meta_title,
+        'meta_description',  pr.meta_description,
+        'custom_canonical',  pr.custom_canonical,
+        'published_at',      to_char(pr.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+        'short_description', pr.short_description,
+        'description_json',  pr.description_json
+      ),
+      'blocks', COALESCE((
+        SELECT jsonb_agg(
+                 jsonb_build_object(
+                   'language_id', b.language_id,
+                   'block_type',  b.block_type,
+                   'content',     b.content,
+                   'order',       b."order"
+                 ) ORDER BY b."order" ASC, b.id ASC
+               )
+          FROM public.blocks b
+         WHERE b.product_id = pr.id
+      ), '[]'::jsonb)
+    )
+  FROM public.products pr
+ WHERE NOT EXISTS (
+         SELECT 1 FROM public.product_revisions r
+          WHERE r.product_id = pr.id
+            AND r.revision_type = 'snapshot'
+            AND r.version <= pr.version
+       )
+ON CONFLICT (product_id, version) DO NOTHING;
+
+
+-- >>> FROM: 00000000000017_cortex_ai_mcp_server.sql <<<
+-- Cortex AI MCP (Model Context Protocol) server access.
+--
+-- Adds the bearer-token store that gates /api/mcp, the endpoint that exposes the
+-- Cortex AI tool registry to external MCP clients (Claude Code, Claude Desktop,
+-- Cursor, VS Code). Two pieces:
+--
+--   1. public.mcp_access_tokens — one row per issued token. We store ONLY the
+--      SHA-256 hash of the token, never the token itself: the plaintext is shown
+--      to the admin exactly once at mint time and is unrecoverable afterwards, so
+--      a database leak cannot be replayed against the MCP endpoint. \`token_prefix\`
+--      is the non-secret leading fragment kept purely so the UI can tell two tokens
+--      apart in a list.
+--
+--   2. cortex_ai_mcp_settings — a non-secret JSON site_settings row holding the
+--      server on/off switch and the localhost-trust flag. It is added to all four
+--      site_settings policies so only authenticated ADMINs can read or write it;
+--      the MCP route itself reads it through the service-role client, which
+--      bypasses RLS.
+--
+-- Forward-only. Recreates the four site_settings policies idempotently, preserving
+-- every key already in each policy's sensitive array (note that
+-- language_detection_settings stays anon-READABLE and so is absent from the SELECT
+-- policy, exactly as migration 00000000000012 left it).
+
+CREATE TABLE IF NOT EXISTS public.mcp_access_tokens (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL,
+  -- Lowercase hex SHA-256 of the plaintext token. Unique so a lookup is a single
+  -- indexed equality probe and duplicate mints are impossible.
+  token_hash text NOT NULL UNIQUE,
+  -- Non-secret display fragment, e.g. "nbmcp_a1b2c3d4". Never enough to authenticate.
+  token_prefix text NOT NULL,
+  -- 'read' grants the read-only tools; 'write' additionally grants the mutating ones.
+  scopes text[] NOT NULL DEFAULT ARRAY['read', 'write']::text[],
+  created_by uuid REFERENCES auth.users (id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  last_used_at timestamptz,
+  expires_at timestamptz,
+  revoked_at timestamptz
+);
+
+COMMENT ON TABLE public.mcp_access_tokens IS
+  'Bearer tokens for the Cortex AI MCP server at /api/mcp. Stores SHA-256 hashes only; plaintext is displayed once at mint time.';
+
+CREATE INDEX IF NOT EXISTS mcp_access_tokens_token_hash_idx
+  ON public.mcp_access_tokens (token_hash);
+
+-- Orders the admin token list newest-first without a sort.
+CREATE INDEX IF NOT EXISTS mcp_access_tokens_created_at_idx
+  ON public.mcp_access_tokens (created_at DESC);
+
+ALTER TABLE public.mcp_access_tokens ENABLE ROW LEVEL SECURITY;
+
+-- Tokens are credentials: admin-only, with no anon or WRITER access at all. The
+-- MCP route verifies them with the service-role client, which bypasses RLS.
+DROP POLICY IF EXISTS mcp_access_tokens_admin_select ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_select ON public.mcp_access_tokens
+  FOR SELECT TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_insert ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_insert ON public.mcp_access_tokens
+  FOR INSERT TO authenticated
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_update ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_update ON public.mcp_access_tokens
+  FOR UPDATE TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role)
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_delete ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_delete ON public.mcp_access_tokens
+  FOR DELETE TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.mcp_access_tokens TO authenticated;
+GRANT ALL ON public.mcp_access_tokens TO service_role;
+
+-- Add cortex_ai_mcp_settings to the admin-only site_settings group (all four policies).
+DROP POLICY IF EXISTS site_settings_read_policy ON public.site_settings;
+CREATE POLICY site_settings_read_policy ON public.site_settings FOR SELECT USING (((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT auth.role() AS role) = 'authenticated'::text) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+
   -- Step D: Record the applied migrations in history (truncated in Step B) so
   -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
   INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
@@ -6171,7 +6624,10 @@ ON CONFLICT (slug) DO NOTHING;
     ('00000000000011', 'language_detection_admin_only'),
     ('00000000000012', 'cortex_ai_stock_photo_settings'),
     ('00000000000013', 'youtube_nocookie_embeds'),
-    ('00000000000014', 'site_themes')
+    ('00000000000014', 'site_themes'),
+    ('00000000000015', 'scheduled_publishing'),
+    ('00000000000016', 'product_revisions_and_revision_baseline'),
+    ('00000000000017', 'cortex_ai_mcp_server')
   ON CONFLICT (version) DO NOTHING;
 
   -- Step E: Anchor preserved profiles