New database and backend foundation

.coderabbit.yaml

@@ -0,0 +1,6 @@
+reviews:
+  auto_review:
+    enabled: true
+    # Use ".*" to match all branches and review every PR regardless of target
+    base_branches:
+      - ".*"

.cursorignore

@@ -6,18 +6,15 @@ dist/
 coverage/
 tmp/
 out-tsc/
+test-output/
 
 # Tooling caches
-.nx/cache/
-.nx/workspace-data/
+.nx/
+.pnpm-store/
 .cache/
-.sass-cache/
-typings/
 
 # Logs and runtime artifacts
 *.log
-connect.lock
-libpeerconnection.log
 
 # Environment files
 .env
@@ -26,17 +23,21 @@ libpeerconnection.log
 !supabase/.env.example
 
 # Supabase local state
+supabase/generated-types.ts
 supabase/.temp/
 supabase/.branches/
 supabase/.env
+supabase/.env.keys
+supabase/.env.local
+supabase/.env.*.local
+legacy/supabase/.temp/
+legacy/supabase/.branches/
+
+# AI agent local state
+.claude/worktrees/
 
 # OS / editor noise
 .DS_Store
 Thumbs.db
 .idea/
-.c9/
-.settings/
-.project
-.classpath
-*.launch
 *.sublime-workspace

.dockerignore

@@ -0,0 +1,43 @@
+# Dependencies and build output — reinstalled/rebuilt inside the image.
+node_modules/
+dist/
+tmp/
+out-tsc/
+coverage/
+test-output/
+
+# Nx local cache
+.nx/
+
+# Legacy reference tree — excluded from the graph; not needed to build api/worker.
+legacy/
+
+# VCS and local env
+.git/
+.gitignore
+.env
+.env.*
+
+# Supabase local state (types are committed; CLI state is not)
+supabase/.temp/
+supabase/.branches/
+supabase/.env
+supabase/.env.*
+supabase/generated-types.ts
+
+# IDE, tooling caches, OS
+.vscode/
+.idea/
+.cache/
+.DS_Store
+Thumbs.db
+*.log
+
+# Docs and plans — not needed at build time
+docs/
+.cursor/
+.claude/
+
+# Docker context meta
+Dockerfile
+.dockerignore

.env.example

@@ -0,0 +1,24 @@
+# Shared workspace env for all apps
+# Copy to `.env` at the repo root.
+#
+# Nx loads env files when you run targets (`nx serve api`, etc.):
+#   1) apps/<host>/.env  (host-specific — wins on conflicts)
+#   2) this root .env    (shared defaults)
+# Production injects env via the platform (no .env files in the image).
+# Secrets are validated per provider via requireEnv (ADR-007) — not dotenv-safe.
+#
+# Fill after `pnpm supabase start`. Local CLI may still label keys as
+# anon / service_role in `supabase status`; our env names follow Supabase’s
+# publishable / secret terminology (legacy JWT keys still work as values).
+
+# --- Required (all apps) — admin / secret client --------------------------------
+SUPABASE_URL="http://127.0.0.1:54321"
+SUPABASE_SECRET_KEY=
+
+# --- Logging (optional; used when nestjs-pino is restored) -------------------------
+# LOG_LEVEL=info
+# LOG_PRETTY=true
+
+# --- Config artifact (optional; ADR-007) ------------------------------------------
+# NXT_CONFIG_PATH=
+# NXT_CONFIG_JSON=

.github/CODEOWNERS

@@ -0,0 +1 @@
+supabase/**  @bobbybol

.github/workflows/ci.yml

@@ -0,0 +1,64 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [oss-migration]
+  push:
+    branches: [oss-migration]
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ##
+  # Core CI - lint, test, typecheck affected files
+  ##
+  nx-affected-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+      - run: corepack enable
+      - run: pnpm install --frozen-lockfile
+      - uses: nrwl/nx-set-shas@v5
+        with:
+          main-branch-name: oss-migration
+      - run: pnpm exec nx affected -t lint test typecheck build --parallel=3
+
+  ##
+  # Schema type-drift guard — disabled during the oss-migration phase.
+  # Re-enable (uncomment both jobs below) once migration lands on main.
+  ##
+  # supabase-type-filter:
+  #   runs-on: ubuntu-latest
+  #   outputs:
+  #     schema: ${{ steps.filter.outputs.schema }}
+  #   steps:
+  #     - uses: actions/checkout@v6
+  #     - uses: dorny/paths-filter@v4
+  #       id: filter
+  #       with:
+  #         filters: |
+  #           schema:
+  #             - 'supabase/**'
+  #             - 'libs/core/src/types/**'
+
+  # supabase-type-drift:
+  #   needs: supabase-type-filter
+  #   if: needs.supabase-type-filter.outputs.schema == 'true'
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - uses: actions/checkout@v6
+  #     - uses: actions/setup-node@v6
+  #       with:
+  #         node-version: '24'
+  #     - run: corepack enable
+  #     - run: pnpm install --frozen-lockfile
+  #     - run: pnpm supabase db start
+  #     - run: pnpm gen-types-local && pnpm gen-better-types
+  #     - run: git diff --exit-code libs/core/src/types/supabase-types.ts

.gitignore

@@ -1,52 +1,58 @@
-# See http://help.github.com/ignore-files/ for more about ignoring files.
-
-# compiled output
-dist
-tmp
-/out-tsc
-
-# dependencies
-node_modules
-# temporary until we fix dependencies
-package-lock.json
-
-# IDEs and editors
-/.idea
-.project
-.classpath
-.c9/
-*.launch
-.settings/
-*.sublime-workspace
+# See https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files
+
+# Build / compile output (any project depth)
+dist/
+tmp/
+out-tsc/
+
+# Dependencies
+node_modules/
+
+# Nx
+.nx/
+
+# Test output
+test-output
+coverage/
+
+# Environment & secrets
+.env
+.env.*
+!**/.env.example
+
+# Supabase local state (root chain + legacy reference)
+supabase/generated-types.ts
+supabase/.temp/
+supabase/.branches/
+supabase/.env
+supabase/.env.keys
+supabase/.env.local
+supabase/.env.*.local
+legacy/supabase/.temp/
+legacy/supabase/.branches/
+
+# Logs & runtime artifacts
+*.log
 
-# IDE - VSCode
+# Tooling caches
+.pnpm-store/
+.cache/
+
+# IDE — VSCode (track shared workspace settings)
 .vscode/*
 !.vscode/settings.json
 !.vscode/tasks.json
 !.vscode/launch.json
 !.vscode/extensions.json
 
-# misc
-/.sass-cache
-/connect.lock
-/coverage
-/libpeerconnection.log
-npm-debug.log
-yarn-error.log
-testem.log
-/typings
-
-# System Files
-.DS_Store
-Thumbs.db
-
-.env
-_NOTES
+# IDE — other editors
+.idea/
+*.sublime-workspace
 
-.nx/cache
-# Supabase
-supabase/.temp
-supabase/.branches
-supabase/.env
+# AI agent local state
+.claude/worktrees/
+.claude/settings.local.json
 
-.nx/
+# OS
+.DS_Store
+Thumbs.db

.husky/pre-commit

@@ -1,5 +1,2 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npx lint-staged && npx tsc -p tsconfig.base.json --noEmit --allowSyntheticDefaultImports
-# && npx nx run-many --parallel --target=test
+lint-staged
+pnpm exec nx affected -t typecheck --uncommitted

.nvmrc

@@ -1 +1 @@
-v22.9.0
+v24