@0x0501/mystack 0.0.0-stage → 0.1.0-bootstrap.0

package/template/DESIGN.md

@@ -0,0 +1,58 @@
+# Headless design
+
+The Starter separates platform behavior from presentation. **Headless is an architecture, not a visual style.** Minimalism, expressive branding, dense dashboards, gradients, illustrations, and rich motion are all valid product choices.
+
+## Ownership
+
+| Layer | Owns | Customize here |
+|---|---|---|
+| Platform | Authentication, permissions, RLS, OAuth, locale routing, server functions | `src/services/`, `src/server/`, middleware |
+| Interaction | Focus, keyboard navigation, selection, popup lifecycle, ARIA | Compose `@base-ui/react` parts directly |
+| Theme behavior | Stored light/dark/system preference and system changes | `src/hooks/use-theme.ts`; render your own control |
+| Theme values | Colors, typography, radii, light/dark palettes | `src/styles/theme.css` |
+| Presentation | Controls, states, optional motion | `src/styles/ui.css` |
+| Layout | Auth, dashboard, admin, page widths | `src/styles/layout.css`, `src/components/shells.tsx` |
+
+The supplied pages are working examples. Their default appearance is replaceable. New Base UI controls have no Starter styles until a presentation class is explicitly applied. Use native HTML for ordinary buttons, links, and inputs; use Base UI for composite interactions. Do not add pass-through wrappers or a second interaction library to restyle an existing control.
+
+## Apply a visual identity
+
+Edit the light and dark variables in `theme.css` to change the whole example UI. Semantic names such as `primary`, `muted`, and `destructive` describe presentation roles; they do not prescribe a palette. Include your font assets and change `--font-sans-stack` for typography.
+
+For deeper changes, edit or replace `ui.css` and `layout.css` at their imports in `src/styles.css`. Their rules live in `@layer components`, below Tailwind utilities, so per-page utility classes override the supplied appearance without class-merging tricks. Shared class names in `src/components/ui/styles.ts` are presentation hooks, not component behavior.
+
+For example, this changes an action's radius and padding:
+
+```tsx
+<button className={`${buttonPrimaryClass} rounded-full px-6`} type="submit">
+	Save
+</button>
+```
+
+Shells accept ordinary div props and `className`. Change a shell layout or replace it while retaining the page's platform flow. `useTheme()` returns `preference`, `setTheme`, and `mounted` for a custom theme control; the initial preference is `system` on both server and client, and stored preference is read after hydration. Keep the head initialization script for flash-free theme application.
+
+## Motion
+
+Animations are allowed throughout the app: page transitions, enter/exit effects, hover feedback, theme controls, and decorative sequences. Use CSS transitions/keyframes or add Motion/GSAP when the product needs them. No animation library is required by the Starter.
+
+- Base UI popups expose `data-starting-style` and `data-ending-style` and positioning variables such as `--transform-origin`. The default menu/select transitions demonstrate this lifecycle.
+- Base UI's native `render`, controlled state, portal, and actions APIs remain available for JavaScript animation. Follow the installed component's lifecycle for exit animations so focus restoration and unmounting still complete.
+- Provide a reduced-motion treatment per animated component using `prefers-reduced-motion`, Tailwind `motion-safe`/`motion-reduce`, or the animation library's equivalent. The Starter does not globally force every animation to a near-zero duration.
+- Keep initial rendering deterministic for SSR; read browser state after hydration. Focus visibility, keyboard access, labels, and readable contrast remain requirements for every skin.
+
+## Contracts while customizing
+
+Visual changes must preserve signed OAuth query forwarding, real same-page locale links (path/query/hash), auth capability parity, server authorization, and error/pending feedback. New product visuals and motion do not need to match a reference platform's appearance. Platform behavior still follows the contracts in `CONTEXT.md` and the ADRs.
+
+## Reference choices
+
+Reviewed on 2026-10-09. These are organizational references, not runtime dependencies or copied implementations.
+
+| Reference | Practice adopted |
+|---|---|
+| [Base UI styling](https://base-ui.com/react/handbook/styling) and [animation](https://base-ui.com/react/handbook/animation) | Unstyled interactions, explicit presentation, native state and lifecycle hooks |
+| [Cove Stack](https://github.com/mugnavo/cove) | Working TanStack Start/Query/Better Auth/Drizzle scaffold with documented environment and customization points |
+| [create-t3-turbo](https://github.com/t3-oss/create-t3-turbo) | Clear ownership of app, auth, data, and UI; applied here as directories in the existing standalone app |
+| [TanStack Start examples](https://tanstack.com/start/latest/docs/framework/react/getting-started) | Framework-native routing and full-stack foundations rather than a replacement application framework |
+
+Keep the existing Bun, Workers, Hyperdrive, and platform contracts. Add dependencies only for capabilities used by the actual product.

package/template/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Darling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/template/biome.json

@@ -0,0 +1,46 @@
+{
+	"$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
+	"vcs": {
+		"enabled": true,
+		"clientKind": "git",
+		"useIgnoreFile": true
+	},
+	"files": {
+		"ignoreUnknown": false,
+		"includes": [
+			"**/src/**/*",
+			"**/.vscode/**/*",
+			"**/index.html",
+			"**/vite.config.ts",
+			"!**/src/routeTree.gen.ts",
+			"!**/src/paraglide"
+		]
+	},
+	"formatter": {
+		"enabled": true,
+		"indentStyle": "tab"
+	},
+	"assist": {
+		"actions": {
+			"source": {
+				"organizeImports": "on"
+			}
+		}
+	},
+	"linter": {
+		"enabled": true,
+		"rules": {
+			"preset": "recommended"
+		}
+	},
+	"javascript": {
+		"formatter": {
+			"quoteStyle": "double"
+		}
+	},
+	"css": {
+		"parser": {
+			"tailwindDirectives": true
+		}
+	}
+}

package/template/docker-compose.yml

@@ -0,0 +1,47 @@
+# Local Postgres for TanStack Starter development.
+# Usage: bun run db:up   /   bun run db:down
+#
+# Credentials live in .env.docker (committed dev defaults).
+# Mirror the same passwords in .env (DATABASE_MIGRATION_URL) and
+# wrangler.jsonc hyperdrive.localConnectionString.
+
+services:
+  postgres:
+    image: postgres:17
+    container_name: tanstack-starter-db
+    restart: unless-stopped
+
+    env_file:
+      - .env.docker
+
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+      PGDATA: /var/lib/postgresql/data/pgdata
+
+      # runtime db user (read by create-app-role.sh)
+      APP_DB_USER: ${APP_DB_USER}
+      APP_DB_PASSWORD: ${APP_DB_PASSWORD}
+
+    # Host port (POSTGRES_PORT) → container 5432 (Postgres always listens on 5432 inside).
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+
+    volumes:
+      - tanstack_starter_data:/var/lib/postgresql/data
+      - ./scripts/postgres:/docker-entrypoint-initdb.d:ro
+
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          'pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"',
+        ]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+
+volumes:
+  tanstack_starter_data:

package/template/docs/project-guide.md

@@ -0,0 +1,61 @@
+# Work in a Mystack project
+
+Your project was generated by `mystack create`. Start with the root README: it lists your database, runtime, email and payments, with setup commands for that configuration. `mystack.json` is a record of creation choices; editing it does not change application source or dependencies.
+
+## Local configuration
+
+Use Bun for application commands. Copy `.env.example` to `.env` and configure the selected database. Run `bun run db:migrate` before `bun run dev`. PostgreSQL variants also include `db:up` for local Docker and `db:seed` for development users. SQLite variants use normal registration and omit PostgreSQL container/seed scripts.
+
+Open `http://localhost:3000`, matching `APP_ORIGIN` and `BETTER_AUTH_URL`. Authentication email is logged in development when provider credentials are absent. Set a verified sender and real credentials for production. Turnstile and GitHub sign-in are enabled when their required environment values are set.
+
+Migration credentials and runtime credentials have different purposes. PostgreSQL's `DATABASE_MIGRATION_URL` is privileged; runtime access uses an app role via `DATABASE_URL` or the `HYPERDRIVE` binding. D1 uses its `DB` binding, Turso Cloud needs its remote URL/token, and local libSQL/Bun SQLite use a file. Keep file databases on persistent storage in production.
+
+## Application structure
+
+| Path | Responsibility |
+|---|---|
+| `src/routes/` | TanStack Router pages and HTTP endpoints |
+| `src/server/` | Thin TanStack Start server functions |
+| `src/services/` | Framework-independent business and domain logic |
+| `src/middlewares/` | Database, authentication and authorization boundaries |
+| `src/db/` | Selected database driver, generated auth schema and platform tables |
+| `src/lib/auth.ts`, `src/lib/auth-client.ts` | Better Auth server/client configuration |
+| `src/lib/email.tsx`, `src/lib/email-transport.ts` | React Email rendering and selected transport |
+| `src/styles/`, `DESIGN.md` | Replaceable presentation and design guidance |
+| `messages/`, `project.inlang/settings.json` | Paraglide messages and locale configuration |
+| `src/__tests__/`, `e2e/` | Vitest and Playwright checks |
+| `drizzle/`, `scripts/` | Migrations and application hygiene scripts |
+
+## Add your product
+
+Put domain logic in `src/services/` and product tables in the hand-maintained platform schema or new schema modules exported by `src/db/schema.ts`. Keep server functions in `src/server/`; state-changing functions use `method: "POST"` and validate input. Route changes require `bun run generate-routes` and committing the generated tree.
+
+PostgreSQL work that respects RLS uses `withRlsUser` / `withRlsService`. SQLite uses `withDatabaseUser` / `withDatabaseService` as database scopes, plus explicit ownership predicates and authenticated/admin middleware; those helpers do not provide RLS. Preserve the authorization checks when adding tables or queries.
+
+Better Auth is an OAuth/OIDC issuer as well as supporting account sign-in. Preserve signed OAuth search parameters, issuer metadata, the consent query and disabled HTTP paths when customizing authentication. Keep `tanstackStartCookies()` last. After plugin or field changes, run `bun run auth:generate`, then `bun run db:generate` and `bun run db:migrate`. Never edit `src/db/auth.schema.ts` by hand.
+
+Payment integrations record a Purchase and expose the purchase-paid extension point. PostgreSQL fulfillment runs database work inside the paid-state transaction; external IO needs a durable row processed afterward. SQLite atomically writes `purchase_delivery` with the paid state. Implement a consumer using `purchase_id` as its idempotency key for product fulfillment. The starter supplies no wallet, subscription or entitlement domain.
+
+Compose Base UI directly and customize the CSS, layouts, typography and motion. See [DESIGN.md](../DESIGN.md). Preserve focus, reduced-motion behavior and SSR hydration. Add locales through Paraglide and keep user-facing pages localized in both messages and URLs; API/webhook routes stay unprefixed.
+
+## Validate and deploy
+
+```sh
+bun run check
+bun run typecheck
+bun run test:unit
+bun run build
+bun run check:client-bundle
+```
+
+PostgreSQL integration suites use `bun run test` and require Docker. Use `bun run test:e2e` for browser checks with an application running on its configured origin. Native Bun SQLite has its own `bun test` database checks in addition to Vitest.
+
+For production, use the root README's instructions for your selected runtime. `bun run deploy` validates production configuration and checks the client bundle. Workers deploy through Wrangler with `.env.prod`; Nitro and Bun build for a host that injects the production environment, then run `bun run start`. Apply migrations against the production database before starting the new server; D1 hosted migrations use `bun run db:migrate:remote`.
+
+Supply real application origins, a new auth secret, database credentials/resource IDs, email credentials and selected webhook signature secrets. Auth registration creates ordinary users; promote the first administrator through an operator-controlled database action, never open registration. For PostgreSQL, after creating the normal user:
+
+```sql
+UPDATE "user" SET role = 'superadmin' WHERE email = 'you@example.com';
+```
+
+Use the equivalent SQL through your selected database's administrative tool for SQLite. Each generated application is owned and maintained independently; the CLI is a creation tool, not an upgrade or runtime dependency.

package/template/drizzle/0000_create-app-role.sql

@@ -0,0 +1,54 @@
+-- App role for Hyperdrive connections. NOBYPASSRLS so policies always apply.
+-- Local Docker: also created by scripts/postgres/create-app-role.sh on first boot
+-- (same name/password as .env.docker). This migration stays idempotent for
+-- hosted Postgres where the Docker init script never ran.
+-- Password below is a local-dev default; production must use a strong secret.
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'starter_app'
+  ) THEN
+    CREATE ROLE starter_app
+      LOGIN
+      PASSWORD 'starter_app_dev_password'
+      NOSUPERUSER
+      NOCREATEDB
+      NOCREATEROLE
+      NOINHERIT
+      NOBYPASSRLS;
+  END IF;
+END $$;
+
+-- Grant CONNECT on the current database (works for `starter`, `postgres`, …)
+DO $$
+BEGIN
+  EXECUTE format(
+    'GRANT CONNECT ON DATABASE %I TO starter_app',
+    current_database()
+  );
+END $$;
+
+GRANT USAGE ON SCHEMA public TO starter_app;
+
+GRANT SELECT, INSERT, UPDATE, DELETE
+ON ALL TABLES IN SCHEMA public
+TO starter_app;
+
+GRANT USAGE, SELECT, UPDATE
+ON ALL SEQUENCES IN SCHEMA public
+TO starter_app;
+
+ALTER DEFAULT PRIVILEGES
+FOR ROLE postgres
+IN SCHEMA public
+GRANT SELECT, INSERT, UPDATE, DELETE
+ON TABLES
+TO starter_app;
+
+ALTER DEFAULT PRIVILEGES
+FOR ROLE postgres
+IN SCHEMA public
+GRANT USAGE, SELECT, UPDATE
+ON SEQUENCES
+TO starter_app;

package/template/drizzle/0001_add-rls-context.sql

@@ -0,0 +1,21 @@
+-- RLS context helpers. is_admin() is created in 0002 after "user" exists
+-- (SQL-language functions validate relation names at CREATE time).
+
+CREATE SCHEMA IF NOT EXISTS app_private;
+
+REVOKE ALL ON SCHEMA app_private FROM PUBLIC;
+
+GRANT USAGE ON SCHEMA app_private TO starter_app;
+
+CREATE OR REPLACE FUNCTION app_private.current_user_id()
+RETURNS text
+LANGUAGE sql
+STABLE
+SECURITY INVOKER
+SET search_path = pg_catalog
+AS $$
+    SELECT NULLIF(current_setting('app.user_id', true), '');
+$$;
+
+REVOKE ALL ON FUNCTION app_private.current_user_id() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION app_private.current_user_id() TO starter_app;

package/template/drizzle/0002_platform_tables.sql

@@ -0,0 +1,320 @@
+-- Table and policy DDL generated by drizzle-kit from the configured schema.
+-- The is_admin() function must precede the generated policies that call it.
+CREATE TABLE "account" (
+	"id" text PRIMARY KEY NOT NULL,
+	"account_id" text NOT NULL,
+	"provider_id" text NOT NULL,
+	"user_id" text NOT NULL,
+	"access_token" text,
+	"refresh_token" text,
+	"id_token" text,
+	"access_token_expires_at" timestamp,
+	"refresh_token_expires_at" timestamp,
+	"scope" text,
+	"password" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "jwks" (
+	"id" text PRIMARY KEY NOT NULL,
+	"public_key" text NOT NULL,
+	"private_key" text NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"expires_at" timestamp,
+	"alg" text,
+	"crv" text
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_access_token" (
+	"id" text PRIMARY KEY NOT NULL,
+	"token" text NOT NULL,
+	"client_id" text NOT NULL,
+	"session_id" text,
+	"user_id" text,
+	"reference_id" text,
+	"authorization_code_id" text,
+	"resources" text[],
+	"requested_user_info_claims" text[],
+	"refresh_id" text,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"revoked" timestamp,
+	"confirmation" jsonb,
+	"scopes" text[] NOT NULL,
+	CONSTRAINT "oauth_access_token_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_client" (
+	"id" text PRIMARY KEY NOT NULL,
+	"client_id" text NOT NULL,
+	"client_secret" text,
+	"client_discovery_id" text,
+	"disabled" boolean DEFAULT false,
+	"skip_consent" boolean,
+	"enable_end_session" boolean,
+	"subject_type" text,
+	"scopes" text[],
+	"client_credentials_scopes" text[] DEFAULT '{}',
+	"user_id" text,
+	"created_at" timestamp,
+	"updated_at" timestamp,
+	"name" text,
+	"uri" text,
+	"icon" text,
+	"contacts" text[],
+	"tos" text,
+	"policy" text,
+	"software_id" text,
+	"software_version" text,
+	"software_statement" text,
+	"redirect_uris" text[] NOT NULL,
+	"post_logout_redirect_uris" text[],
+	"backchannel_logout_uri" text,
+	"backchannel_logout_session_required" boolean,
+	"token_endpoint_auth_method" text,
+	"application_type" text,
+	"jwks" text,
+	"jwks_uri" text,
+	"grant_types" text[],
+	"response_types" text[],
+	"require_pkce" boolean,
+	"dpop_bound_access_tokens" boolean DEFAULT false,
+	"reference_id" text,
+	"metadata" jsonb,
+	CONSTRAINT "oauth_client_client_id_unique" UNIQUE("client_id")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_client_assertion" (
+	"id" text PRIMARY KEY NOT NULL,
+	"expires_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_client_resource" (
+	"id" text PRIMARY KEY NOT NULL,
+	"client_id" text NOT NULL,
+	"resource_id" text NOT NULL,
+	"metadata" jsonb,
+	"created_at" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_consent" (
+	"id" text PRIMARY KEY NOT NULL,
+	"client_id" text NOT NULL,
+	"user_id" text,
+	"reference_id" text,
+	"resources" text[],
+	"requested_user_info_claims" text[],
+	"scopes" text[] NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"updated_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_refresh_token" (
+	"id" text PRIMARY KEY NOT NULL,
+	"token" text NOT NULL,
+	"client_id" text NOT NULL,
+	"session_id" text,
+	"user_id" text NOT NULL,
+	"reference_id" text,
+	"authorization_code_id" text,
+	"resources" text[],
+	"requested_user_info_claims" text[],
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"revoked" timestamp,
+	"rotated_at" timestamp,
+	"rotation_replay_response" text,
+	"rotation_replay_expires_at" timestamp,
+	"auth_time" timestamp,
+	"confirmation" jsonb,
+	"scopes" text[] NOT NULL,
+	CONSTRAINT "oauth_refresh_token_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_resource" (
+	"id" text PRIMARY KEY NOT NULL,
+	"identifier" text NOT NULL,
+	"name" text NOT NULL,
+	"access_token_ttl" integer,
+	"refresh_token_ttl" integer,
+	"signing_algorithm" text,
+	"signing_key_id" text,
+	"allowed_scopes" text[],
+	"custom_claims" jsonb,
+	"dpop_bound_access_tokens_required" boolean DEFAULT false,
+	"disabled" boolean DEFAULT false,
+	"created_at" timestamp,
+	"updated_at" timestamp,
+	"policy_version" integer DEFAULT 1,
+	"metadata" jsonb,
+	CONSTRAINT "oauth_resource_identifier_unique" UNIQUE("identifier")
+);
+--> statement-breakpoint
+CREATE TABLE "passkey" (
+	"id" text PRIMARY KEY NOT NULL,
+	"name" text,
+	"public_key" text NOT NULL,
+	"user_id" text NOT NULL,
+	"credential_id" text NOT NULL,
+	"counter" integer NOT NULL,
+	"device_type" text NOT NULL,
+	"backed_up" boolean NOT NULL,
+	"transports" text,
+	"created_at" timestamp,
+	"aaguid" text
+);
+--> statement-breakpoint
+CREATE TABLE "session" (
+	"id" text PRIMARY KEY NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"token" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp NOT NULL,
+	"ip_address" text,
+	"user_agent" text,
+	"user_id" text NOT NULL,
+	"impersonated_by" text,
+	CONSTRAINT "session_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
+CREATE TABLE "two_factor" (
+	"id" text PRIMARY KEY NOT NULL,
+	"secret" text NOT NULL,
+	"backup_codes" text NOT NULL,
+	"user_id" text NOT NULL,
+	"verified" boolean DEFAULT true,
+	"failed_verification_count" integer DEFAULT 0,
+	"locked_until" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "user" (
+	"id" text PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"email" text NOT NULL,
+	"email_verified" boolean DEFAULT false NOT NULL,
+	"image" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	"role" text,
+	"banned" boolean DEFAULT false,
+	"ban_reason" text,
+	"ban_expires" timestamp,
+	"two_factor_enabled" boolean DEFAULT false,
+	"tokens_revoked_at" timestamp,
+	"locale" text,
+	CONSTRAINT "user_email_unique" UNIQUE("email")
+);
+--> statement-breakpoint
+CREATE TABLE "verification" (
+	"id" text PRIMARY KEY NOT NULL,
+	"identifier" text NOT NULL,
+	"value" text NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "admin_action" (
+	"id" text PRIMARY KEY NOT NULL,
+	"actor_id" text,
+	"action" text NOT NULL,
+	"target_type" text,
+	"target_id" text,
+	"detail" jsonb,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "admin_action" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+CREATE TABLE "purchase" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"provider" text NOT NULL,
+	"external_id" text NOT NULL,
+	"amount" text NOT NULL,
+	"currency" text DEFAULT 'usd' NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"metadata" jsonb,
+	"paid_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "purchase" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+CREATE TABLE "system_config" (
+	"key" text PRIMARY KEY NOT NULL,
+	"value" jsonb NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "system_config" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+ALTER TABLE "account" ADD CONSTRAINT "account_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_token" ADD CONSTRAINT "oauth_access_token_client_id_oauth_client_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_client"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_token" ADD CONSTRAINT "oauth_access_token_session_id_session_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."session"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_token" ADD CONSTRAINT "oauth_access_token_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_token" ADD CONSTRAINT "oauth_access_token_refresh_id_oauth_refresh_token_id_fk" FOREIGN KEY ("refresh_id") REFERENCES "public"."oauth_refresh_token"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_client" ADD CONSTRAINT "oauth_client_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_client_resource" ADD CONSTRAINT "oauth_client_resource_client_id_oauth_client_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_client"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_client_resource" ADD CONSTRAINT "oauth_client_resource_resource_id_oauth_resource_identifier_fk" FOREIGN KEY ("resource_id") REFERENCES "public"."oauth_resource"("identifier") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_consent" ADD CONSTRAINT "oauth_consent_client_id_oauth_client_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_client"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_consent" ADD CONSTRAINT "oauth_consent_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_token" ADD CONSTRAINT "oauth_refresh_token_client_id_oauth_client_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_client"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_token" ADD CONSTRAINT "oauth_refresh_token_session_id_session_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."session"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_token" ADD CONSTRAINT "oauth_refresh_token_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "passkey" ADD CONSTRAINT "passkey_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session" ADD CONSTRAINT "session_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "two_factor" ADD CONSTRAINT "two_factor_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "admin_action" ADD CONSTRAINT "admin_action_actor_id_user_id_fk" FOREIGN KEY ("actor_id") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "purchase" ADD CONSTRAINT "purchase_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "account_userId_idx" ON "account" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_clientId_idx" ON "oauth_access_token" USING btree ("client_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_sessionId_idx" ON "oauth_access_token" USING btree ("session_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_userId_idx" ON "oauth_access_token" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_authorizationCodeId_idx" ON "oauth_access_token" USING btree ("authorization_code_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_refreshId_idx" ON "oauth_access_token" USING btree ("refresh_id");--> statement-breakpoint
+CREATE INDEX "oauthClient_userId_idx" ON "oauth_client" USING btree ("user_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "oauthClientResource_clientId_resourceId_uidx" ON "oauth_client_resource" USING btree ("client_id","resource_id");--> statement-breakpoint
+CREATE INDEX "oauthClientResource_clientId_idx" ON "oauth_client_resource" USING btree ("client_id");--> statement-breakpoint
+CREATE INDEX "oauthClientResource_resourceId_idx" ON "oauth_client_resource" USING btree ("resource_id");--> statement-breakpoint
+CREATE INDEX "oauthConsent_clientId_idx" ON "oauth_consent" USING btree ("client_id");--> statement-breakpoint
+CREATE INDEX "oauthConsent_userId_idx" ON "oauth_consent" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "oauthRefreshToken_clientId_idx" ON "oauth_refresh_token" USING btree ("client_id");--> statement-breakpoint
+CREATE INDEX "oauthRefreshToken_sessionId_idx" ON "oauth_refresh_token" USING btree ("session_id");--> statement-breakpoint
+CREATE INDEX "oauthRefreshToken_userId_idx" ON "oauth_refresh_token" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "oauthRefreshToken_authorizationCodeId_idx" ON "oauth_refresh_token" USING btree ("authorization_code_id");--> statement-breakpoint
+CREATE INDEX "passkey_userId_idx" ON "passkey" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "passkey_credentialID_idx" ON "passkey" USING btree ("credential_id");--> statement-breakpoint
+CREATE INDEX "session_userId_idx" ON "session" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "twoFactor_secret_idx" ON "two_factor" USING btree ("secret");--> statement-breakpoint
+CREATE INDEX "twoFactor_userId_idx" ON "two_factor" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "verification_identifier_idx" ON "verification" USING btree ("identifier");--> statement-breakpoint
+CREATE INDEX "admin_action_created_idx" ON "admin_action" USING btree ("created_at" DESC NULLS LAST);--> statement-breakpoint
+CREATE UNIQUE INDEX "purchase_provider_external_uq" ON "purchase" USING btree ("provider","external_id");--> statement-breakpoint
+CREATE INDEX "purchase_userId_idx" ON "purchase" USING btree ("user_id");--> statement-breakpoint
+-- is_admin(): service GUC bypass OR user.role in (admin, superadmin).
+-- Must live after "user" exists — SQL functions validate relations at CREATE.
+CREATE OR REPLACE FUNCTION app_private.is_admin()
+RETURNS boolean
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, public
+AS $$
+    SELECT COALESCE(current_setting('app.service', true), '') = 'true'
+    OR EXISTS (
+        SELECT 1
+        FROM public."user" AS u
+        WHERE u.id = app_private.current_user_id()
+        AND u.role IN ('admin', 'superadmin')
+    );
+$$;
+
+REVOKE ALL ON FUNCTION app_private.is_admin() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION app_private.is_admin() TO starter_app;
+--> statement-breakpoint
+CREATE POLICY "rls_policy" ON "admin_action" AS PERMISSIVE FOR ALL TO "starter_app" USING (app_private.is_admin()) WITH CHECK (app_private.is_admin());--> statement-breakpoint
+CREATE POLICY "rls_user_read" ON "purchase" AS PERMISSIVE FOR SELECT TO "starter_app" USING (app_private.is_admin() OR user_id = app_private.current_user_id());--> statement-breakpoint
+CREATE POLICY "rls_service_write" ON "purchase" AS PERMISSIVE FOR ALL TO "starter_app" USING (app_private.is_admin()) WITH CHECK (app_private.is_admin());--> statement-breakpoint
+CREATE POLICY "rls_policy" ON "system_config" AS PERMISSIVE FOR ALL TO "starter_app" USING (app_private.is_admin()) WITH CHECK (app_private.is_admin());
+--> statement-breakpoint
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO starter_app;