Sauci/apps/supabase/AGENTS.md

Legacy Supabase data plane

This directory preserves the former product-data schema, Edge Functions, seeds, and migration source needed for audited cutover. Hosted Supabase now owns Auth only. The active application schema and server code live under apps/api.

Schema safety

• Do not add product-data migrations or functions here.
• Do not deploy this migration tree or these Edge Functions to hosted Supabase.
• Never use any remote apply_migration tool.
• Never execute DDL through MCP or provider SQL tools.
• Never link or reset a remote project during local verification.

Function boundaries

• Set deployment JWT configuration deliberately per function. A function using verify_jwt = false must implement the correct manual, webhook, cron, or internal authentication boundary; it is not permission to omit authorization.
• Service-role clients never run in customer clients.
• Preserve CORS handling and return non-sensitive errors.
• Test RLS, authorization, and important side effects, not only HTTP status.

Legacy tests may be run during cutover archaeology, but they are not the active deployment gate. See docs/operations/database-migrations.md.