@retinue/agentkit 0.1.0

package/dist/adapters/supabase/index.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Supabase adapter — Postgres stores + RLS + Realtime (#104).
+ *
+ * Supabase *is* Postgres, so every store here is an **alias** of the PostgreSQL implementation rather
+ * than a second one. That is deliberate and it is the whole reason the Supabase column can be trusted:
+ * one implementation cannot drift from itself. The conformance suite still runs the column, because
+ * an alias can be repointed and because RLS changes the executor's effective privileges — "same code"
+ * is a claim worth re-checking rather than assuming.
+ *
+ * What is genuinely Supabase-specific lives in `rls.ts` (policies, tenant binding) and `realtime.ts`
+ * (the live event channel). Both carry no `@supabase/supabase-js` dependency: the host app adapts its
+ * client to the small interfaces here, so this package stays deployable without one.
+ */
+import type { AdapterCapability } from "../../persistence/index.js";
+export { createPostgresConversationStore as createSupabaseConversationStore } from "../postgres/conversation-store.js";
+export { createPostgresSessionStateStore as createSupabaseSessionStateStore, createPostgresThreadSummaryStore as createSupabaseThreadSummaryStore, } from "../postgres/session-state.js";
+export { createPostgresConversationBindingStore as createSupabaseConversationBindingStore, createPostgresMessageStore as createSupabaseMessageStore, createPostgresAgentStore as createSupabaseAgentStore, } from "../postgres/message-store.js";
+export { createPostgresConversationRunCoordinator as createSupabaseConversationRunCoordinator } from "../postgres/run-coordinator.js";
+export { createPostgresUnitOfWork as createSupabaseUnitOfWork } from "../postgres/unit-of-work.js";
+export { createPostgresRunStore as createSupabaseRunStore } from "../postgres/run-store.js";
+export { createPostgresRunEventLog as createSupabaseRunEventLog } from "../postgres/run-event-log.js";
+export { createPostgresCheckpointStore as createSupabaseCheckpointStore } from "../postgres/checkpoint-store.js";
+export { createPostgresInteractionStore as createSupabaseInteractionStore, createPostgresApprovalGrantStore as createSupabaseApprovalGrantStore, } from "../postgres/hitl.js";
+export { createPostgresUsageStore as createSupabaseUsageStore, createPostgresIdempotencyStore as createSupabaseIdempotencyStore, } from "../postgres/usage.js";
+export { createPostgresUsageLimitStore as createSupabaseUsageLimitStore } from "../postgres/usage-limits.js";
+export { createPostgresSkillStore as createSupabaseSkillStore, createPostgresMcpConnectionStore as createSupabaseMcpConnectionStore, } from "../postgres/config.js";
+export { createPostgresPrincipalMemoryStore as createSupabasePrincipalMemoryStore, createPostgresBlobStore as createSupabaseBlobStore, } from "../postgres/memory.js";
+/**
+ * File *metadata* aliases to Postgres. File *bytes* do not, and this is the one port where Supabase is not
+ * simply Postgres under another name.
+ *
+ * `0013_files` keeps metadata only, so `FileMetadataStore` is an alias like every other port. The bytes live
+ * in Supabase Storage, which has its own adapter in `./storage.js` — a genuine second implementation, not an
+ * alias, because there is no Postgres factory to alias to. `notApplicable` in the matrix therefore belongs to
+ * **postgres alone**: file bytes in a relational column is the antipattern #102 rejected, whereas Supabase
+ * has a real home for them.
+ */
+export { createPostgresFileMetadataStore as createSupabaseFileMetadataStore } from "../postgres/files.js";
+export * from "./storage.js";
+/**
+ * Artifacts alias to Postgres like every other relational port (#133).
+ *
+ * Their *content* does not live here at all — it is a `BlobRef`, and where those bytes sit is `BlobStore`'s
+ * business, which is itself an alias. So unlike `FileContentStore` there is nothing Supabase-specific to add:
+ * the artifact row is a relational row.
+ */
+export { createPostgresArtifactStore as createSupabaseArtifactStore } from "../postgres/artifacts.js";
+export { createPostgresArtifactExportStore as createSupabaseArtifactExportStore } from "../postgres/artifact-exports.js";
+/**
+ * Knowledge and vector search alias to Postgres too (#135).
+ *
+ * Supabase ships pgvector, so this is the same adapter and not a second implementation — unlike
+ * `FileContentStore`, where Supabase Storage genuinely is a different service. The vector migrations are
+ * separate from the main list (`migrateVector`) because `CREATE EXTENSION vector` fails where the extension is
+ * absent, and a Supabase project has it while a bare Postgres may not.
+ */
+export { createPostgresUsageRollupStore as createSupabaseUsageRollupStore } from "../postgres/rollups.js";
+export { createPostgresEvaluationStore as createSupabaseEvaluationStore } from "../postgres/evaluation.js";
+export { createPostgresKnowledgeStore as createSupabaseKnowledgeStore, createPostgresVectorIndex as createSupabaseVectorIndex, createPostgresKeywordIndex as createSupabaseKeywordIndex, } from "../postgres/knowledge.js";
+export * from "./rls.js";
+export * from "./realtime.js";
+/**
+ * What a Supabase deployment can honestly advertise.
+ *
+ * **`distributed-locking` is included, and the SPEC expected it not to be.** #104 asks to declare it
+ * unsupported "if pooled connections make advisory locks unavailable" — but the premise no longer
+ * holds. #98 deliberately avoided advisory locks: a lock whose lifetime is a transaction cannot hold
+ * a run slot across a `waiting-for-approval` state that waits hours for a human, and the port
+ * promises a FIFO queue a lock cannot express. The coordinator is a slot table with
+ * `SELECT … FOR UPDATE` inside a short transaction, which is exactly what transaction pooling
+ * supports. Declaring it unsupported would skip real coverage for a reason that stopped being true.
+ *
+ * **`full-text-search` is removed.** Nothing implements it in either adapter, so it was a claim with
+ * nothing behind it — one of the two unproven capabilities flagged on #98. `POSTGRES_CAPABILITIES`
+ * still lists it; that is tracked separately rather than changed here, since Postgres is not this
+ * SPEC's subject.
+ */
+export declare const SUPABASE_CAPABILITIES: readonly AdapterCapability[];
+/**
+ * Flows — #187, #186.
+ *
+ * Aliased, like every other relational port: the tables are ordinary Postgres and there is nothing
+ * Supabase-specific about a flow definition or an execution. An alias rather than a wrapper keeps AC-5's
+ * "identical results" true by identity rather than by proof.
+ */
+export { createPostgresFlowDefinitionStore as createSupabaseFlowDefinitionStore } from "../postgres/flows.js";
+export { createPostgresFlowExecutionStore as createSupabaseFlowExecutionStore } from "../postgres/flows.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/supabase/index.js

@@ -0,0 +1,84 @@
+// Conversation and session
+export { createPostgresConversationStore as createSupabaseConversationStore } from "../postgres/conversation-store.js";
+export { createPostgresSessionStateStore as createSupabaseSessionStateStore, createPostgresThreadSummaryStore as createSupabaseThreadSummaryStore, } from "../postgres/session-state.js";
+export { createPostgresConversationBindingStore as createSupabaseConversationBindingStore, createPostgresMessageStore as createSupabaseMessageStore, createPostgresAgentStore as createSupabaseAgentStore, } from "../postgres/message-store.js";
+export { createPostgresConversationRunCoordinator as createSupabaseConversationRunCoordinator } from "../postgres/run-coordinator.js";
+export { createPostgresUnitOfWork as createSupabaseUnitOfWork } from "../postgres/unit-of-work.js";
+// Run lifecycle
+export { createPostgresRunStore as createSupabaseRunStore } from "../postgres/run-store.js";
+export { createPostgresRunEventLog as createSupabaseRunEventLog } from "../postgres/run-event-log.js";
+export { createPostgresCheckpointStore as createSupabaseCheckpointStore } from "../postgres/checkpoint-store.js";
+// HITL, accounting and configuration
+export { createPostgresInteractionStore as createSupabaseInteractionStore, createPostgresApprovalGrantStore as createSupabaseApprovalGrantStore, } from "../postgres/hitl.js";
+export { createPostgresUsageStore as createSupabaseUsageStore, createPostgresIdempotencyStore as createSupabaseIdempotencyStore, } from "../postgres/usage.js";
+// The limit store is the Postgres one: it is ordinary SQL over an ordinary table, and Supabase's differences
+// (RLS, the connection mode) are handled by the executor rather than by the statement (#175).
+export { createPostgresUsageLimitStore as createSupabaseUsageLimitStore } from "../postgres/usage-limits.js";
+export { createPostgresSkillStore as createSupabaseSkillStore, createPostgresMcpConnectionStore as createSupabaseMcpConnectionStore, } from "../postgres/config.js";
+export { createPostgresPrincipalMemoryStore as createSupabasePrincipalMemoryStore, createPostgresBlobStore as createSupabaseBlobStore, } from "../postgres/memory.js";
+/**
+ * File *metadata* aliases to Postgres. File *bytes* do not, and this is the one port where Supabase is not
+ * simply Postgres under another name.
+ *
+ * `0013_files` keeps metadata only, so `FileMetadataStore` is an alias like every other port. The bytes live
+ * in Supabase Storage, which has its own adapter in `./storage.js` — a genuine second implementation, not an
+ * alias, because there is no Postgres factory to alias to. `notApplicable` in the matrix therefore belongs to
+ * **postgres alone**: file bytes in a relational column is the antipattern #102 rejected, whereas Supabase
+ * has a real home for them.
+ */
+export { createPostgresFileMetadataStore as createSupabaseFileMetadataStore } from "../postgres/files.js";
+export * from "./storage.js";
+/**
+ * Artifacts alias to Postgres like every other relational port (#133).
+ *
+ * Their *content* does not live here at all — it is a `BlobRef`, and where those bytes sit is `BlobStore`'s
+ * business, which is itself an alias. So unlike `FileContentStore` there is nothing Supabase-specific to add:
+ * the artifact row is a relational row.
+ */
+export { createPostgresArtifactStore as createSupabaseArtifactStore } from "../postgres/artifacts.js";
+export { createPostgresArtifactExportStore as createSupabaseArtifactExportStore } from "../postgres/artifact-exports.js";
+/**
+ * Knowledge and vector search alias to Postgres too (#135).
+ *
+ * Supabase ships pgvector, so this is the same adapter and not a second implementation — unlike
+ * `FileContentStore`, where Supabase Storage genuinely is a different service. The vector migrations are
+ * separate from the main list (`migrateVector`) because `CREATE EXTENSION vector` fails where the extension is
+ * absent, and a Supabase project has it while a bare Postgres may not.
+ */
+export { createPostgresUsageRollupStore as createSupabaseUsageRollupStore } from "../postgres/rollups.js";
+export { createPostgresEvaluationStore as createSupabaseEvaluationStore } from "../postgres/evaluation.js";
+export { createPostgresKnowledgeStore as createSupabaseKnowledgeStore, createPostgresVectorIndex as createSupabaseVectorIndex, createPostgresKeywordIndex as createSupabaseKeywordIndex, } from "../postgres/knowledge.js";
+export * from "./rls.js";
+export * from "./realtime.js";
+/**
+ * What a Supabase deployment can honestly advertise.
+ *
+ * **`distributed-locking` is included, and the SPEC expected it not to be.** #104 asks to declare it
+ * unsupported "if pooled connections make advisory locks unavailable" — but the premise no longer
+ * holds. #98 deliberately avoided advisory locks: a lock whose lifetime is a transaction cannot hold
+ * a run slot across a `waiting-for-approval` state that waits hours for a human, and the port
+ * promises a FIFO queue a lock cannot express. The coordinator is a slot table with
+ * `SELECT … FOR UPDATE` inside a short transaction, which is exactly what transaction pooling
+ * supports. Declaring it unsupported would skip real coverage for a reason that stopped being true.
+ *
+ * **`full-text-search` is removed.** Nothing implements it in either adapter, so it was a claim with
+ * nothing behind it — one of the two unproven capabilities flagged on #98. `POSTGRES_CAPABILITIES`
+ * still lists it; that is tracked separately rather than changed here, since Postgres is not this
+ * SPEC's subject.
+ */
+export const SUPABASE_CAPABILITIES = [
+    "transactions",
+    "row-level-security",
+    "distributed-locking",
+    "realtime",
+];
+/**
+ * Flows — #187, #186.
+ *
+ * Aliased, like every other relational port: the tables are ordinary Postgres and there is nothing
+ * Supabase-specific about a flow definition or an execution. An alias rather than a wrapper keeps AC-5's
+ * "identical results" true by identity rather than by proof.
+ */
+export { createPostgresFlowDefinitionStore as createSupabaseFlowDefinitionStore } from "../postgres/flows.js";
+export { createPostgresFlowExecutionStore as createSupabaseFlowExecutionStore } from "../postgres/flows.js";
+//# sourceMappingURL=index.js.map

package/dist/adapters/supabase/realtime.d.ts

@@ -0,0 +1,30 @@
+import type { RealtimePublisher } from "../../core/events.js";
+import type { LiveEventSource } from "../../runtime/streaming.js";
+/** The app adapts a Supabase channel's `send` to this (`channel.send({ type, event, payload })`). */
+export interface RealtimeBroadcaster {
+    send(channel: string, event: string, payload: unknown): Promise<void> | void;
+}
+export declare const createSupabaseRealtimePublisher: (broadcaster: RealtimeBroadcaster) => RealtimePublisher;
+/**
+ * The receive side the host adapts a subscribed channel to.
+ *
+ * The contract that matters is inherited from `LiveEventSource`: **buffering must begin at call
+ * time**, before the caller's first `next()`. `openRunEventStream` subscribes and *then* reads the
+ * durable log, and that ordering is the only thing stopping an event published during catch-up from
+ * being lost. An adapter that connects lazily on first `next()` silently breaks it.
+ */
+export interface RealtimeSubscriber {
+    subscribe(channel: string): AsyncIterable<unknown>;
+}
+export type LiveEventSourceOptions = {
+    /**
+     * Whether this subscriber may read the channel. Rejected subscriptions yield nothing and end.
+     * Absent means every channel is allowed, which is only appropriate when the caller has already
+     * authorized — the GraphQL resolver path, for instance.
+     */
+    readonly authorize?: (channel: string) => Promise<boolean> | boolean;
+    /** Called for each payload that fails validation. Defaults to silence. */
+    readonly onInvalid?: (channel: string, payload: unknown) => void;
+};
+export declare const createSupabaseLiveEventSource: (subscriber: RealtimeSubscriber, options?: LiveEventSourceOptions) => LiveEventSource;
+//# sourceMappingURL=realtime.d.ts.map

package/dist/adapters/supabase/realtime.js

@@ -0,0 +1,53 @@
+/**
+ * Supabase Realtime — the publisher and, as of #104, the `LiveEventSource` half.
+ *
+ * Both sides are defined against tiny interfaces the host app adapts its Supabase client to, so this
+ * package carries no `@supabase/supabase-js` dependency and stays deployable without one.
+ *
+ * Two things the in-memory bus never had to worry about, and this does:
+ *
+ * **A Realtime payload is network input.** `openRunEventStream` feeds whatever the live source yields
+ * straight into `reduceRunEvents`, so an unvalidated payload would put attacker-shaped or merely
+ * corrupt data into a run's projected state. Every payload is parsed with `parseRunEvent` and dropped
+ * if it fails, rather than trusted because it arrived on the right channel.
+ *
+ * **Entitlement is checked at subscribe time, not on delivery.** Filtering events after subscribing
+ * would still reveal that a conversation exists and roughly how active it is. Refusing the
+ * subscription is the only version that leaks nothing.
+ */
+import { parseRunEvent } from "../../core/validation.js";
+export const createSupabaseRealtimePublisher = (broadcaster) => ({
+    async publish(channel, event) {
+        await broadcaster.send(channel, event.type, event);
+    },
+});
+export const createSupabaseLiveEventSource = (subscriber, options = {}) => ({
+    subscribe(channel) {
+        // Subscribe eagerly, before the authorization check resolves, so the buffering contract above
+        // holds. An unauthorized channel yields nothing regardless — see below.
+        const upstream = subscriber.subscribe(channel);
+        return {
+            async *[Symbol.asyncIterator]() {
+                const allowed = options.authorize === undefined ? true : await options.authorize(channel);
+                // Ending the stream rather than throwing: a subscriber that is not entitled should observe
+                // an ordinary empty stream, not an error that distinguishes "forbidden" from "no such run".
+                if (!allowed)
+                    return;
+                for await (const payload of upstream) {
+                    let event;
+                    try {
+                        event = parseRunEvent(payload);
+                    }
+                    catch {
+                        // Dropped, not thrown: one malformed broadcast must not tear down a live stream that is
+                        // otherwise healthy, and the durable log remains the source of truth for the run.
+                        options.onInvalid?.(channel, payload);
+                        continue;
+                    }
+                    yield event;
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=realtime.js.map

package/dist/adapters/supabase/rls.d.ts

@@ -0,0 +1,99 @@
+import type { SqlExecutor } from "../postgres/sql.js";
+import type { TransactionRunner } from "../postgres/transaction.js";
+/**
+ * A table whose rows belong to a tenant, plus any predicate beyond the tenant match.
+ *
+ * `extraPredicate` exists for one case today. Tenant-only scoping on `principal_memory` would leak
+ * one user's memories to every other user of the same customer, which is the opposite of what
+ * per-principal memory is for.
+ */
+export type RlsTable = {
+    readonly table: string;
+    readonly extraPredicate?: string;
+};
+/**
+ * Tenant-scoped tables that live behind the optional pgvector migration (#135).
+ *
+ * Separate from `TENANT_SCOPED_TABLES` because `knowledge_chunks` does not exist until `migrateVector` runs, and
+ * `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` on an absent table fails. A deployment that runs the vector
+ * migration runs `applyVectorRls` with it; one that does not has no table to protect. Listed rather than
+ * omitted so the requirement is recorded — a tenant-scoped table without RLS is the one omission that matters.
+ */
+export declare const VECTOR_TENANT_SCOPED_TABLES: readonly {
+    readonly table: string;
+}[];
+export declare const TENANT_SCOPED_TABLES: readonly RlsTable[];
+/**
+ * Tables that deliberately have no tenant policy, each with the reason.
+ *
+ * Classified rather than skipped. A silent omission is indistinguishable from a forgotten table,
+ * which is exactly what the coverage gate exists to catch — so an exemption has to be a decision
+ * someone wrote down.
+ */
+export declare const RLS_EXEMPT_TABLES: readonly {
+    readonly table: string;
+    readonly reason: string;
+}[];
+export declare const RLS_STATEMENTS: readonly string[];
+export declare const applyRls: (sql: SqlExecutor) => Promise<void>;
+/** The same policies for the vector table, applied by whoever ran `migrateVector` (#135). */
+export declare const VECTOR_RLS_STATEMENTS: readonly string[];
+export declare const applyVectorRls: (sql: SqlExecutor) => Promise<void>;
+/**
+ * Every table `MIGRATIONS` creates, in migration order.
+ *
+ * Derived rather than transcribed: the SPEC's hand-written list named `interactions` and `blob_refs`,
+ * neither of which exists, and missed `schema_migrations`. A list that can disagree with the schema
+ * will eventually disagree with the schema.
+ */
+/**
+ * Every table any migration creates — **both** lists (#145).
+ *
+ * `VECTOR_MIGRATIONS` was missing, and that was a hole in the coverage gate rather than an oversight in a list:
+ * a table added there was never scanned, so it could ship with no RLS policy and no exemption and nothing would
+ * say so. `knowledge_chunks` happened to be covered because someone remembered; the *next* vector table would
+ * not have been.
+ *
+ * Found by auditing the gate rather than the list, which is the difference between checking the answer and
+ * checking the thing that produces it.
+ */
+export declare const tablesInMigrations: () => readonly string[];
+/**
+ * Bind the **session** to a tenant. Safe only on a direct connection.
+ *
+ * `is_local = false` makes the setting outlive the current transaction, which is right for a
+ * connection this process owns exclusively — and **dangerous behind a transaction-mode pooler**, which
+ * is how Supabase's pooler port works. There, a backend is handed to a different client after each
+ * transaction while the session GUC stays set, so tenant A's binding is still in place when tenant B's
+ * query lands on that backend, and B's queries are evaluated against A's tenant id.
+ *
+ * That is a cross-tenant read produced by the mechanism introduced to prevent cross-tenant reads, and
+ * it is worse than having no policy at all, because the policy makes it look handled.
+ *
+ * Prefer `withTenantContext` unless you are certain the connection is not pooled. See the open
+ * question on #104 about removing this entirely.
+ */
+export declare const setTenantContext: (sql: SqlExecutor, tenantId: string) => Promise<void>;
+/**
+ * Run `fn` with the tenant (and optionally the principal) bound **for the duration of one
+ * transaction**, which is the only binding that is safe behind a pooler.
+ *
+ * `is_local = true` scopes the setting to the transaction, so it is discarded at commit or rollback
+ * and cannot be observed by whoever gets the backend next. The transaction comes from #98's
+ * `TransactionRunner`, and the executor handed to `fn` is the transaction's — so stores built over a
+ * `scoped()` executor participate without knowing any of this exists.
+ */
+export declare const withTenantContext: <T>(runner: TransactionRunner, scope: {
+    readonly tenantId: string;
+    readonly principalId?: string;
+}, fn: (sql: SqlExecutor) => Promise<T>) => Promise<T>;
+/**
+ * Bind the **session** to a principal. Same pooling caveat as `setTenantContext` — prefer passing
+ * `principalId` to `withTenantContext`.
+ *
+ * Separate from `setTenantContext` because most work has a tenant and no principal — a background
+ * reaper, a migration, a rollup. Those must not be able to read principal-scoped rows, and with this
+ * unset they cannot: the predicate compares against NULL and matches nothing.
+ */
+export declare const setPrincipalContext: (sql: SqlExecutor, principalId: string) => Promise<void>;
+//# sourceMappingURL=rls.d.ts.map

package/dist/adapters/supabase/rls.js

@@ -0,0 +1,216 @@
+/**
+ * Row-Level Security — `docs/02` + `docs/11`.
+ *
+ * Enforces tenant isolation *at the database*, independent of any app-level `WHERE`. The policy
+ * predicate `tenant_id = current_setting('app.tenant_id')` is exactly the filter the authorization
+ * `scope()` produces (see `tenantRlsFilter`), so the two agree by construction — and if the
+ * application filter is ever forgotten, the database still refuses.
+ *
+ * Until #103 this covered exactly one table, because `conversations` was the only table when it was
+ * written. There are now 19, and a table without a policy means a Supabase deployment relies on
+ * application filtering alone — the single point of failure REQ-014 exists to remove.
+ *
+ * **Policies are generated from the registry below rather than written out**, so adding a table's
+ * policy is a one-line entry and the statements cannot drift from the list. The coverage gate in
+ * `supabase-rls.test.ts` derives the table list from `MIGRATIONS`, so a new table cannot ship
+ * uncovered and a stale entry for a dropped table fails too.
+ */
+import { MIGRATIONS, VECTOR_MIGRATIONS } from "../postgres/migrations.js";
+/**
+ * The principal predicate is written so an **absent** setting matches nothing.
+ *
+ * `current_setting('app.principal_id', true)` returns NULL when unset, and `principal_id = NULL` is
+ * NULL — which the policy treats as false. That is the behaviour we want: a connection with no
+ * principal bound sees no memories at all, rather than seeing every row whose `principal_id` happens
+ * to equal the empty string. Getting this backwards is how a background job ends up able to read
+ * everyone's memory.
+ */
+const PRINCIPAL_PREDICATE = `principal_id = current_setting('app.principal_id', true)`;
+/**
+ * Tenant-scoped tables that live behind the optional pgvector migration (#135).
+ *
+ * Separate from `TENANT_SCOPED_TABLES` because `knowledge_chunks` does not exist until `migrateVector` runs, and
+ * `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` on an absent table fails. A deployment that runs the vector
+ * migration runs `applyVectorRls` with it; one that does not has no table to protect. Listed rather than
+ * omitted so the requirement is recorded — a tenant-scoped table without RLS is the one omission that matters.
+ */
+export const VECTOR_TENANT_SCOPED_TABLES = [
+    { table: "knowledge_chunks" },
+];
+export const TENANT_SCOPED_TABLES = [
+    { table: "conversations" },
+    { table: "runs" },
+    { table: "run_events" },
+    { table: "checkpoints" },
+    { table: "messages" },
+    { table: "agents" },
+    { table: "conversation_bindings" },
+    { table: "session_state" },
+    { table: "thread_summaries" },
+    { table: "conversation_run_slots" },
+    // Two tables, not one: #99 split questions from approvals because PendingQuestion and
+    // PendingApproval share only three fields. The SPEC's list named a single `interactions`.
+    { table: "interaction_questions" },
+    { table: "interaction_approvals" },
+    { table: "approval_grants" },
+    { table: "usage_records" },
+    { table: "usage_rollups" },
+    /**
+     * Tenant-scoped only, deliberately — #175.
+     *
+     * Not `PRINCIPAL_PREDICATE`, even though the table has a `principal_id`. A spend limit is a fact *about* a
+     * person that belongs to the tenant's administrator, not to the person it constrains: someone who could only
+     * see their own row could not be shown the tenant default they inherit, and — the part that matters — a
+     * limit nobody but its subject can read is a limit its subject can quietly delete.
+     *
+     * The principal column here is a dimension, not an owner. That distinction is why this needs saying: the
+     * neighbouring `principal_memory` has the same column and the opposite answer.
+     */
+    { table: "usage_limits" },
+    { table: "evaluation_runs" },
+    { table: "evaluation_case_results" },
+    { table: "idempotency_keys" },
+    { table: "skills" },
+    { table: "mcp_connections" },
+    { table: "principal_memory", extraPredicate: PRINCIPAL_PREDICATE },
+    // `blobs`, not the SPEC's `blob_refs`: BlobStore stores the value, and the metadata-and-pointer
+    // design belongs to FileMetadataStore (#129) / ArtifactStore (#133).
+    { table: "blobs" },
+    /**
+     * #129, revised by #185.
+     *
+     * This used to say "the bytes are not in Postgres at all, so this policy covers the metadata only". That was
+     * true when the only content stores were in-memory and Supabase Storage. `createPostgresFileContentStore`
+     * changed it: bytes can now live in `file_objects`, in the same database, and a metadata policy that implied
+     * the bytes were somebody else's problem would have been the most reassuring kind of wrong.
+     *
+     * Both are covered now. A Storage bucket still needs its own access rules, and RLS here says nothing about
+     * those — that part of the original comment stands.
+     */
+    { table: "files" },
+    { table: "file_objects" },
+    { table: "artifacts" },
+    { table: "artifact_versions" },
+    { table: "artifact_exports" },
+    /**
+     * #187, #186. A flow definition is a tenant's automation and an execution is a tenant's data — including its
+     * `state`, which routinely holds whatever the automation was working on.
+     */
+    { table: "flow_definitions" },
+    { table: "flow_executions" },
+];
+/**
+ * Tables that deliberately have no tenant policy, each with the reason.
+ *
+ * Classified rather than skipped. A silent omission is indistinguishable from a forgotten table,
+ * which is exactly what the coverage gate exists to catch — so an exemption has to be a decision
+ * someone wrote down.
+ */
+export const RLS_EXEMPT_TABLES = [
+    {
+        table: "schema_migrations",
+        reason: "Records which migrations have been applied. Deployment state, not customer data, and it holds " +
+            "no tenant_id to scope on. A migration runner must read it before any tenant context exists.",
+    },
+];
+const policyFor = ({ table, extraPredicate }) => {
+    const tenant = `tenant_id = current_setting('app.tenant_id', true)`;
+    const predicate = extraPredicate === undefined ? tenant : `${tenant} AND ${extraPredicate}`;
+    return [
+        `ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY`,
+        // FORCE matters more than it looks. Without it the table owner bypasses every policy — and the
+        // owner is the role that runs migrations, and in many deployments the role the app connects as.
+        // An isolation test would then pass while proving nothing.
+        `ALTER TABLE ${table} FORCE ROW LEVEL SECURITY`,
+        `DROP POLICY IF EXISTS tenant_isolation ON ${table}`,
+        `CREATE POLICY tenant_isolation ON ${table}
+       USING (${predicate})
+       WITH CHECK (${predicate})`,
+    ];
+};
+export const RLS_STATEMENTS = TENANT_SCOPED_TABLES.flatMap(policyFor);
+export const applyRls = async (sql) => {
+    for (const stmt of RLS_STATEMENTS)
+        await sql.query(stmt);
+};
+/** The same policies for the vector table, applied by whoever ran `migrateVector` (#135). */
+export const VECTOR_RLS_STATEMENTS = VECTOR_TENANT_SCOPED_TABLES.flatMap(policyFor);
+export const applyVectorRls = async (sql) => {
+    for (const stmt of VECTOR_RLS_STATEMENTS)
+        await sql.query(stmt);
+};
+/**
+ * Every table `MIGRATIONS` creates, in migration order.
+ *
+ * Derived rather than transcribed: the SPEC's hand-written list named `interactions` and `blob_refs`,
+ * neither of which exists, and missed `schema_migrations`. A list that can disagree with the schema
+ * will eventually disagree with the schema.
+ */
+/**
+ * Every table any migration creates — **both** lists (#145).
+ *
+ * `VECTOR_MIGRATIONS` was missing, and that was a hole in the coverage gate rather than an oversight in a list:
+ * a table added there was never scanned, so it could ship with no RLS policy and no exemption and nothing would
+ * say so. `knowledge_chunks` happened to be covered because someone remembered; the *next* vector table would
+ * not have been.
+ *
+ * Found by auditing the gate rather than the list, which is the difference between checking the answer and
+ * checking the thing that produces it.
+ */
+export const tablesInMigrations = () => {
+    const names = [];
+    for (const migration of [...MIGRATIONS, ...VECTOR_MIGRATIONS]) {
+        for (const statement of migration.up) {
+            const match = /CREATE TABLE (?:IF NOT EXISTS )?([a-z_][a-z0-9_]*)/i.exec(statement);
+            if (match?.[1] && !names.includes(match[1]))
+                names.push(match[1]);
+        }
+    }
+    return names;
+};
+/**
+ * Bind the **session** to a tenant. Safe only on a direct connection.
+ *
+ * `is_local = false` makes the setting outlive the current transaction, which is right for a
+ * connection this process owns exclusively — and **dangerous behind a transaction-mode pooler**, which
+ * is how Supabase's pooler port works. There, a backend is handed to a different client after each
+ * transaction while the session GUC stays set, so tenant A's binding is still in place when tenant B's
+ * query lands on that backend, and B's queries are evaluated against A's tenant id.
+ *
+ * That is a cross-tenant read produced by the mechanism introduced to prevent cross-tenant reads, and
+ * it is worse than having no policy at all, because the policy makes it look handled.
+ *
+ * Prefer `withTenantContext` unless you are certain the connection is not pooled. See the open
+ * question on #104 about removing this entirely.
+ */
+export const setTenantContext = async (sql, tenantId) => {
+    await sql.query(`SELECT set_config('app.tenant_id', $1, false)`, [tenantId]);
+};
+/**
+ * Run `fn` with the tenant (and optionally the principal) bound **for the duration of one
+ * transaction**, which is the only binding that is safe behind a pooler.
+ *
+ * `is_local = true` scopes the setting to the transaction, so it is discarded at commit or rollback
+ * and cannot be observed by whoever gets the backend next. The transaction comes from #98's
+ * `TransactionRunner`, and the executor handed to `fn` is the transaction's — so stores built over a
+ * `scoped()` executor participate without knowing any of this exists.
+ */
+export const withTenantContext = async (runner, scope, fn) => runner.transaction(async (sql) => {
+    await sql.query(`SELECT set_config('app.tenant_id', $1, true)`, [scope.tenantId]);
+    if (scope.principalId !== undefined) {
+        await sql.query(`SELECT set_config('app.principal_id', $1, true)`, [scope.principalId]);
+    }
+    return fn(sql);
+});
+/**
+ * Bind the **session** to a principal. Same pooling caveat as `setTenantContext` — prefer passing
+ * `principalId` to `withTenantContext`.
+ *
+ * Separate from `setTenantContext` because most work has a tenant and no principal — a background
+ * reaper, a migration, a rollup. Those must not be able to read principal-scoped rows, and with this
+ * unset they cannot: the predicate compares against NULL and matches nothing.
+ */
+export const setPrincipalContext = async (sql, principalId) => {
+    await sql.query(`SELECT set_config('app.principal_id', $1, false)`, [principalId]);
+};
+//# sourceMappingURL=rls.js.map

package/dist/adapters/supabase/storage.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `FileContentStore` over Supabase Storage — the production object-storage adapter (#129).
+ *
+ * This is the first store where Supabase is not simply Postgres. Every other port aliases straight to the
+ * Postgres implementation, and `supabase-conformance.test.ts` asserts that by identity. File bytes are the
+ * exception, and not incidentally: #102 declined to make `blobs` a pointer table, and `0013_files` keeps
+ * only metadata, precisely so that bytes live somewhere built for them.
+ *
+ * **Over `fetch`, not an SDK.** Supabase Storage is a plain REST API with a bearer token, so an SDK would
+ * add a dependency, a client lifecycle and an auth model for four HTTP calls. `fetch` is injected rather
+ * than reached for, so the conformance harness runs the real URL construction and status handling against
+ * an in-process double instead of a live bucket.
+ *
+ * **Two properties that are not obvious from the port:**
+ *
+ * - **The tenant is the path prefix, and a content key may not contain a separator.** `sanitizeMediaRefs` in
+ *   ShareFlow is the cautionary tale this is written against — its workspace-prefix check was *"the ONLY
+ *   thing standing between a forged path and a signed URL to another tenant's private object."* Here the
+ *   key is validated to a character class, so `../` cannot be spelled at all.
+ * - **Listing is offset-paged, because the API is.** Unlike the metadata stores, which use keyset cursors
+ *   deliberately, this one cannot: a concurrent upload can shift a page. That is tolerable only because the
+ *   sole caller is reconciliation, which reports rather than deletes and runs again.
+ */
+import type { FileContentStore } from "../../persistence/index.js";
+/** The slice of `fetch` this adapter uses. Injected so the harness can run the real request building. */
+export type FetchLike = (url: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: Uint8Array | string;
+}) => Promise<{
+    readonly status: number;
+    readonly ok: boolean;
+    text(): Promise<string>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+}>;
+export type SupabaseStorageConfig = {
+    /** Project URL, e.g. `https://abc.supabase.co`. No trailing slash required. */
+    readonly url: string;
+    /**
+     * The service-role key.
+     *
+     * A `secret://` reference in a manifest, resolved by the host before it reaches here — the same rule
+     * #96 set for MCP credentials. Never logged: every error below reports status and path, never headers.
+     */
+    readonly serviceKey: string;
+    readonly bucket: string;
+    readonly fetch: FetchLike;
+};
+export declare const createSupabaseStorageFileContentStore: (config: SupabaseStorageConfig) => FileContentStore;
+//# sourceMappingURL=storage.d.ts.map