Deleting or unpublishing a plugin returns 200 but the plugin stays published

Deleting a plugin on cursor.directory reports success and redirects to the homepage, but the plugin is still live afterwards and still holds its slug and its repository URL.

Steps to reproduce

1. Sign in and open a plugin you own, for example https://cursor.directory/plugins/spicyapi
2. Plugin options, then Delete
3. Confirm the "Delete plugin permanently?" dialog
4. The request POST https://cursor.directory/plugins/spicyapi returns HTTP 200 and the app navigates to /
5. Reload https://cursor.directory/plugins/spicyapi

Expected

The plugin is removed.

Actual

The plugin still renders, still marked published. Unpublish behaves the same way: it reports success and the plugin stays published. No client-side console errors are produced, and the server action returns 200 either way.

It looks like the delete matches zero rows, perhaps an ownership or row-level-security predicate that does not match the current session, and the affected row count is never checked before reporting success. A delete that cannot find its target should surface an error rather than a 200.

Knock-on effect

Because the record survives, re-submitting the same repository from a different account fails with:

A plugin with this name or repository already exists. Please choose a different name or repository.

Changing the plugin name (tried spicy-api) fails identically, so the conflict is on the repository URL rather than the slug. The practical result is that the repository is permanently unusable for a new listing, with no self-serve way out.

Request

Please remove the listing spicyapi (https://cursor.directory/plugins/spicyapi, repository https://github.com/Wayfinity/spicyapi-skills). It was published from the wrong account and needs relisting from the correct one, which is currently impossible.

Start at the POST /plugins/:slug server action used by the Delete and Unpublish flows, then trace its ownership or row-level-security predicate and affected-row handling. Reproduce the request for spicyapi and verify that a successful deletion removes the listing, while a zero-row match reports an error instead of returning 200.