@selvajs/supabase-provider 0.12.0 → 0.13.0

package/supabase/migrations/{0001_initial.sql → 20260425155514_selva_initial.sql}

@@ -1,3 +1,48 @@
+-- ============================================================================
+-- 0. Dedicated `selva` schema
+-- All engine objects live here, never in `public`, so a consuming app that
+-- shares the database keeps `public` entirely for its own tables. Cross-schema
+-- refs from the app (FKs into selva.orgs, calls to selva.is_org_member) are
+-- supported. The provider's data client targets it (db: { schema: 'selva' }).
+--
+-- PostgREST must expose `selva` to serve it over REST. We do that HERE, from the
+-- migration, rather than from config.toml's static `[api] schemas`: that config
+-- is read at stack boot, before migrations run, so naming a not-yet-created
+-- schema there fails the health check and aborts `supabase start`. Setting it on
+-- the `authenticator` role after the schema exists, then signalling a reload,
+-- avoids the bootstrap race and works identically on hosted projects.
+-- ============================================================================
+create schema if not exists selva;
+grant usage on schema selva to anon, authenticated, service_role;
+alter default privileges in schema selva grant all on tables to anon, authenticated, service_role;
+alter default privileges in schema selva grant all on functions to anon, authenticated, service_role;
+alter default privileges in schema selva grant all on sequences to anon, authenticated, service_role;
+
+-- Expose `selva` over PostgREST (additive to whatever is already exposed).
+do $$
+declare
+	current_schemas text;
+begin
+	select coalesce(
+		(select setting from pg_db_role_setting s
+		 join pg_roles r on r.oid = s.setrole
+		 cross join lateral unnest(s.setconfig) as setting
+		 where r.rolname = 'authenticator' and setting like 'pgrst.db_schemas=%'),
+		'pgrst.db_schemas=public, graphql_public'
+	) into current_schemas;
+
+	if current_schemas not like '%selva%' then
+		execute format(
+			'alter role authenticator set pgrst.db_schemas = %L',
+			replace(current_schemas, 'pgrst.db_schemas=', '') || ', selva'
+		);
+	end if;
+end $$;
+
+notify pgrst, 'reload config';
+notify pgrst, 'reload schema';
+
+
 -- ============================================================================
 -- Selva — initial schema (consolidated bootstrap).
 --
@@ -27,7 +72,7 @@
 -- Maintains updated_at on every UPDATE without adapter involvement.
 -- ============================================================================
 
-create or replace function public.set_updated_at()
+create or replace function selva.set_updated_at()
 returns trigger
 language plpgsql
 as $$
@@ -44,7 +89,7 @@ $$;
 -- starred definitions, recent runs). Auto-seeded by trigger on signup.
 -- ============================================================================
 
-create table if not exists public.user_profiles (
+create table if not exists selva.user_profiles (
 	user_id uuid primary key references auth.users(id) on delete cascade,
 	display_name text,
 	platform_permissions text[] not null default '{}',
@@ -54,14 +99,14 @@ create table if not exists public.user_profiles (
 	last_login_at timestamptz
 );
 
-create or replace function public.handle_new_auth_user()
+create or replace function selva.handle_new_auth_user()
 returns trigger
 language plpgsql
 security definer
 set search_path = public
 as $$
 begin
-	insert into public.user_profiles (user_id)
+	insert into selva.user_profiles (user_id)
 	values (new.id)
 	on conflict (user_id) do nothing;
 	return new;
@@ -71,17 +116,17 @@ $$;
 drop trigger if exists trg_auth_user_created on auth.users;
 create trigger trg_auth_user_created
 	after insert on auth.users
-	for each row execute function public.handle_new_auth_user();
+	for each row execute function selva.handle_new_auth_user();
 
-alter table public.user_profiles enable row level security;
+alter table selva.user_profiles enable row level security;
 
 create policy "user_profiles: any authenticated can read"
-on public.user_profiles for select
+on selva.user_profiles for select
 to authenticated
 using (true);
 
 create policy "user_profiles: users can update own"
-on public.user_profiles for update
+on selva.user_profiles for update
 to authenticated
 using (user_id = auth.uid())
 with check (
@@ -89,7 +134,7 @@ with check (
 	-- Users cannot escalate their own platform permissions; only service-role
 	-- writes (which bypass RLS) may change that column.
 	and platform_permissions is not distinct from (
-		select platform_permissions from public.user_profiles where user_id = auth.uid()
+		select platform_permissions from selva.user_profiles where user_id = auth.uid()
 	)
 );
 
@@ -100,7 +145,7 @@ with check (
 -- reads filter deleted_at IS NULL.
 -- ============================================================================
 
-create table if not exists public.orgs (
+create table if not exists selva.orgs (
 	id uuid primary key,
 	name text not null,
 	slug text not null unique,
@@ -111,10 +156,10 @@ create table if not exists public.orgs (
 	updated_at timestamptz not null default now(),
 	deleted_at timestamptz
 );
-create index if not exists idx_orgs_live on public.orgs(id) where deleted_at is null;
+create index if not exists idx_orgs_live on selva.orgs(id) where deleted_at is null;
 
-create table if not exists public.org_members (
-	org_id uuid not null references public.orgs(id) on delete cascade,
+create table if not exists selva.org_members (
+	org_id uuid not null references selva.orgs(id) on delete cascade,
 	user_id uuid not null references auth.users(id) on delete cascade,
 	role text not null check (role in ('owner', 'admin', 'member')),
 	permissions text[] not null default '{}',
@@ -125,11 +170,11 @@ create table if not exists public.org_members (
 	primary key (org_id, user_id)
 );
 create index if not exists idx_org_members_user
-	on public.org_members(user_id) where deleted_at is null;
+	on selva.org_members(user_id) where deleted_at is null;
 
-create table if not exists public.projects (
+create table if not exists selva.projects (
 	id uuid primary key,
-	org_id uuid not null references public.orgs(id) on delete cascade,
+	org_id uuid not null references selva.orgs(id) on delete cascade,
 	name text not null,
 	slug text not null,
 	description text,
@@ -142,19 +187,19 @@ create table if not exists public.projects (
 	updated_at timestamptz not null default now(),
 	deleted_at timestamptz,
 	unique (org_id, slug),
-	-- Spec §4: commons mode requires visibility=public.
+	-- Spec §4: commons mode requires visibility=selva.
 	constraint projects_commons_requires_public check (
 		auto_join_on_upload = false or visibility = 'public'
 	)
 );
 create index if not exists idx_projects_org
-	on public.projects(org_id) where deleted_at is null;
+	on selva.projects(org_id) where deleted_at is null;
 -- Case-insensitive unique name per org (defense beyond slug uniqueness).
 create unique index if not exists projects_org_name_unique
-	on public.projects (org_id, lower(name));
+	on selva.projects (org_id, lower(name));
 
-create table if not exists public.project_members (
-	project_id uuid not null references public.projects(id) on delete cascade,
+create table if not exists selva.project_members (
+	project_id uuid not null references selva.projects(id) on delete cascade,
 	user_id uuid not null references auth.users(id) on delete cascade,
 	role text not null check (role in ('owner', 'editor', 'viewer')),
 	joined_at timestamptz not null default now(),
@@ -164,21 +209,21 @@ create table if not exists public.project_members (
 	primary key (project_id, user_id)
 );
 create index if not exists idx_project_members_user
-	on public.project_members(user_id) where deleted_at is null;
+	on selva.project_members(user_id) where deleted_at is null;
 
 
 -- ============================================================================
 -- 4. updated_at triggers
 -- ============================================================================
 
-create trigger trg_orgs_updated_at before update on public.orgs
-	for each row execute function public.set_updated_at();
-create trigger trg_projects_updated_at before update on public.projects
-	for each row execute function public.set_updated_at();
-create trigger trg_org_members_updated_at before update on public.org_members
-	for each row execute function public.set_updated_at();
-create trigger trg_project_members_updated_at before update on public.project_members
-	for each row execute function public.set_updated_at();
+create trigger trg_orgs_updated_at before update on selva.orgs
+	for each row execute function selva.set_updated_at();
+create trigger trg_projects_updated_at before update on selva.projects
+	for each row execute function selva.set_updated_at();
+create trigger trg_org_members_updated_at before update on selva.org_members
+	for each row execute function selva.set_updated_at();
+create trigger trg_project_members_updated_at before update on selva.project_members
+	for each row execute function selva.set_updated_at();
 
 
 -- ============================================================================
@@ -187,83 +232,83 @@ create trigger trg_project_members_updated_at before update on public.project_me
 -- recursion). All filter deleted_at IS NULL.
 -- ============================================================================
 
-create or replace function public.is_instance_admin()
+create or replace function selva.is_instance_admin()
 returns boolean
 language sql stable security definer set search_path = public
 as $$
 	select exists (
-		select 1 from public.user_profiles
+		select 1 from selva.user_profiles
 		where user_id = auth.uid() and 'instance_admin' = any(platform_permissions)
 	);
 $$;
 
-create or replace function public.is_org_member(o uuid)
+create or replace function selva.is_org_member(o uuid)
 returns boolean
 language sql stable security definer set search_path = public
 as $$
 	select exists (
-		select 1 from public.org_members
+		select 1 from selva.org_members
 		where org_id = o and user_id = auth.uid() and deleted_at is null
 	);
 $$;
 
-create or replace function public.is_org_admin(o uuid)
+create or replace function selva.is_org_admin(o uuid)
 returns boolean
 language sql stable security definer set search_path = public
 as $$
 	select exists (
-		select 1 from public.org_members
+		select 1 from selva.org_members
 		where org_id = o and user_id = auth.uid() and deleted_at is null
 		and role in ('owner', 'admin')
 	);
 $$;
 
-create or replace function public.is_org_owner(o uuid)
+create or replace function selva.is_org_owner(o uuid)
 returns boolean
 language sql stable security definer set search_path = public
 as $$
 	select exists (
-		select 1 from public.org_members
+		select 1 from selva.org_members
 		where org_id = o and user_id = auth.uid() and deleted_at is null
 		and role = 'owner'
 	);
 $$;
 
-create or replace function public.has_org_permission(o uuid, perm text)
+create or replace function selva.has_org_permission(o uuid, perm text)
 returns boolean
 language sql stable security definer set search_path = public
 as $$
-	select public.is_instance_admin() or exists (
-		select 1 from public.org_members
+	select selva.is_instance_admin() or exists (
+		select 1 from selva.org_members
 		where org_id = o and user_id = auth.uid() and deleted_at is null
 		and perm = any(permissions)
 	);
 $$;
 
-create or replace function public.is_project_member(p uuid)
+create or replace function selva.is_project_member(p uuid)
 returns boolean
 language sql stable security definer set search_path = public
 as $$
 	select exists (
-		select 1 from public.project_members
+		select 1 from selva.project_members
 		where project_id = p and user_id = auth.uid() and deleted_at is null
 	);
 $$;
 
 -- Spec §5 canView: private → member, org → org member, public → everyone.
-create or replace function public.visible_project(p uuid)
+create or replace function selva.visible_project(p uuid)
 returns boolean
 language sql stable security definer set search_path = public
 as $$
-	select public.is_instance_admin() or exists (
+	select selva.is_instance_admin() or exists (
 		select 1
-		from public.projects
+		from selva.projects
 		where id = p
 		and deleted_at is null
 		and (
 			visibility = 'public'
-			or (visibility = 'org' and public.is_org_member(org_id))
-			or public.is_project_member(id)
+			or (visibility = 'org' and selva.is_org_member(org_id))
+			or selva.is_project_member(id)
 		)
 	);
 $$;
@@ -273,7 +318,7 @@ $$;
 -- 6. Org / project RLS policies
 -- ============================================================================
 
-alter table public.orgs enable row level security;
+alter table selva.orgs enable row level security;
 
 -- RLS gates "may this principal touch this row?", not "is the row in a state
 -- worth showing?". Soft-delete filtering (`deleted_at is null`) belongs at the
@@ -284,118 +329,118 @@ alter table public.orgs enable row level security;
 -- out the just-tombstoned row and surfaces as "new row violates RLS". Same
 -- trap for `revoked_at` on share_links below.
 create policy "orgs: members and instance admins can read"
-on public.orgs for select
+on selva.orgs for select
 to authenticated
-using (public.is_instance_admin() or public.is_org_member(id));
+using (selva.is_instance_admin() or selva.is_org_member(id));
 
 create policy "orgs: authenticated can create their own"
-on public.orgs for insert
+on selva.orgs for insert
 to authenticated
-with check (public.is_instance_admin() or owner_id = auth.uid());
+with check (selva.is_instance_admin() or owner_id = auth.uid());
 
 create policy "orgs: owners and instance admins can update"
-on public.orgs for update
+on selva.orgs for update
 to authenticated
-using (public.is_instance_admin() or public.is_org_owner(id))
-with check (public.is_instance_admin() or public.is_org_owner(id));
+using (selva.is_instance_admin() or selva.is_org_owner(id))
+with check (selva.is_instance_admin() or selva.is_org_owner(id));
 
 create policy "orgs: owners and instance admins can delete"
-on public.orgs for delete
+on selva.orgs for delete
 to authenticated
-using (public.is_instance_admin() or public.is_org_owner(id));
+using (selva.is_instance_admin() or selva.is_org_owner(id));
 
-alter table public.org_members enable row level security;
+alter table selva.org_members enable row level security;
 
 create policy "org_members: org members can read roster"
-on public.org_members for select
+on selva.org_members for select
 to authenticated
-using (public.is_instance_admin() or public.is_org_member(org_id));
+using (selva.is_instance_admin() or selva.is_org_member(org_id));
 
 create policy "org_members: admins can insert"
-on public.org_members for insert
+on selva.org_members for insert
 to authenticated
-with check (public.is_instance_admin() or public.is_org_admin(org_id));
+with check (selva.is_instance_admin() or selva.is_org_admin(org_id));
 
 create policy "org_members: admins can update"
-on public.org_members for update
+on selva.org_members for update
 to authenticated
-using (public.is_instance_admin() or public.is_org_admin(org_id))
-with check (public.is_instance_admin() or public.is_org_admin(org_id));
+using (selva.is_instance_admin() or selva.is_org_admin(org_id))
+with check (selva.is_instance_admin() or selva.is_org_admin(org_id));
 
 create policy "org_members: admins can delete"
-on public.org_members for delete
+on selva.org_members for delete
 to authenticated
-using (public.is_instance_admin() or public.is_org_admin(org_id));
+using (selva.is_instance_admin() or selva.is_org_admin(org_id));
 
-alter table public.projects enable row level security;
+alter table selva.projects enable row level security;
 
 create policy "projects: visible to members"
-on public.projects for select
+on selva.projects for select
 to authenticated
-using (public.visible_project(id));
+using (selva.visible_project(id));
 
 create policy "projects: manage_projects can create"
-on public.projects for insert
+on selva.projects for insert
 to authenticated
-with check (public.has_org_permission(org_id, 'manage_projects'));
+with check (selva.has_org_permission(org_id, 'manage_projects'));
 
 -- Project settings (name, slug, description, visibility, flags) are owner-only.
 create policy "projects: owners can update"
-on public.projects for update
+on selva.projects for update
 to authenticated
-using (public.is_instance_admin() or owner_id = auth.uid())
-with check (public.is_instance_admin() or owner_id = auth.uid());
+using (selva.is_instance_admin() or owner_id = auth.uid())
+with check (selva.is_instance_admin() or owner_id = auth.uid());
 
 create policy "projects: owners can delete"
-on public.projects for delete
+on selva.projects for delete
 to authenticated
-using (public.is_instance_admin() or owner_id = auth.uid());
+using (selva.is_instance_admin() or owner_id = auth.uid());
 
-alter table public.project_members enable row level security;
+alter table selva.project_members enable row level security;
 
 create policy "project_members: visible to project members"
-on public.project_members for select
+on selva.project_members for select
 to authenticated
-using (public.is_instance_admin() or public.visible_project(project_id));
+using (selva.is_instance_admin() or selva.visible_project(project_id));
 
 -- canManage (§5) collapses to owner-only; org admins no longer silently
 -- manage project members.
 create policy "project_members: managers can insert"
-on public.project_members for insert
+on selva.project_members for insert
 to authenticated
 with check (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
-		select 1 from public.projects p
+		select 1 from selva.projects p
 		where p.id = project_id and p.deleted_at is null and p.owner_id = auth.uid()
 	)
 );
 
 create policy "project_members: managers can update"
-on public.project_members for update
+on selva.project_members for update
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
-		select 1 from public.projects p
+		select 1 from selva.projects p
 		where p.id = project_id and p.deleted_at is null and p.owner_id = auth.uid()
 	)
 )
 with check (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
-		select 1 from public.projects p
+		select 1 from selva.projects p
 		where p.id = project_id and p.deleted_at is null and p.owner_id = auth.uid()
 	)
 );
 
 create policy "project_members: managers can delete"
-on public.project_members for delete
+on selva.project_members for delete
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
-		select 1 from public.projects p
+		select 1 from selva.projects p
 		where p.id = project_id and p.deleted_at is null and p.owner_id = auth.uid()
 	)
 );
@@ -413,9 +458,9 @@ using (
 -- not on definitions — different versions can carry different uploaded shapes.
 -- ============================================================================
 
-create table if not exists public.definitions (
+create table if not exists selva.definitions (
 	guid uuid primary key,
-	project_id uuid not null references public.projects(id) on delete cascade,
+	project_id uuid not null references selva.projects(id) on delete cascade,
 	owner_id uuid not null references auth.users(id) on delete cascade,
 	created_by uuid references auth.users(id) on delete set null,
 	updated_by uuid references auth.users(id) on delete set null,
@@ -436,19 +481,19 @@ create table if not exists public.definitions (
 );
 
 create index if not exists idx_definitions_project
-	on public.definitions(project_id) where deleted_at is null;
+	on selva.definitions(project_id) where deleted_at is null;
 create index if not exists idx_definitions_status
-	on public.definitions(status) where deleted_at is null;
+	on selva.definitions(status) where deleted_at is null;
 create index if not exists idx_definitions_pending_updated
-	on public.definitions(updated_at)
+	on selva.definitions(updated_at)
 	where status = 'pending' and deleted_at is null;
 
-create trigger trg_definitions_updated_at before update on public.definitions
-	for each row execute function public.set_updated_at();
+create trigger trg_definitions_updated_at before update on selva.definitions
+	for each row execute function selva.set_updated_at();
 
-create table if not exists public.definition_versions (
+create table if not exists selva.definition_versions (
 	id uuid primary key,
-	definition_guid uuid not null references public.definitions(guid) on delete cascade,
+	definition_guid uuid not null references selva.definitions(guid) on delete cascade,
 	version_number integer not null check (version_number >= 1),
 	file_ext text not null check (file_ext in ('gh', 'ghx')),
 	file_key text not null,
@@ -459,47 +504,47 @@ create table if not exists public.definition_versions (
 );
 
 create index if not exists idx_definition_versions_def
-	on public.definition_versions(definition_guid, version_number desc);
+	on selva.definition_versions(definition_guid, version_number desc);
 
 -- Spec §6 deletion protection: cannot delete a version while it's serving
 -- either channel. Postgres raises 23503; the store maps that to 409.
-alter table public.definitions
+alter table selva.definitions
 	add constraint fk_definitions_live_version
-	foreign key (live_version_id) references public.definition_versions(id)
+	foreign key (live_version_id) references selva.definition_versions(id)
 	on delete restrict;
 
-alter table public.definitions
+alter table selva.definitions
 	add constraint fk_definitions_draft_version
-	foreign key (draft_version_id) references public.definition_versions(id)
+	foreign key (draft_version_id) references selva.definition_versions(id)
 	on delete restrict;
 
 -- Atomic run-count increment. Called after each successful solve. No-op on
 -- missing or soft-deleted rows.
-create or replace function public.increment_run_count(g uuid)
+create or replace function selva.increment_run_count(g uuid)
 returns void
 language sql security definer set search_path = public
 as $$
-	update public.definitions
+	update selva.definitions
 	set run_count = run_count + 1
 	where guid = g and deleted_at is null;
 $$;
-grant execute on function public.increment_run_count(uuid) to authenticated, service_role;
+grant execute on function selva.increment_run_count(uuid) to authenticated, service_role;
 
-alter table public.definitions enable row level security;
+alter table selva.definitions enable row level security;
 
 create policy "definitions: visible via project"
-on public.definitions for select
+on selva.definitions for select
 to authenticated
-using (public.visible_project(project_id));
+using (selva.visible_project(project_id));
 
 create policy "definitions: editors can insert"
-on public.definitions for insert
+on selva.definitions for insert
 to authenticated
 with check (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	-- Container mode: project editor/owner required.
 	or exists (
-		select 1 from public.project_members m
+		select 1 from selva.project_members m
 		where m.project_id = definitions.project_id
 		and m.user_id = auth.uid()
 		and m.deleted_at is null
@@ -508,7 +553,7 @@ with check (
 	-- Commons mode: any authenticated user may create on a public + commons
 	-- project; they become its owner_id.
 	or exists (
-		select 1 from public.projects p
+		select 1 from selva.projects p
 		where p.id = definitions.project_id
 		and p.deleted_at is null
 		and p.visibility = 'public'
@@ -518,19 +563,19 @@ with check (
 );
 
 create policy "definitions: editors can update"
-on public.definitions for update
+on selva.definitions for update
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
-		select 1 from public.project_members m
+		select 1 from selva.project_members m
 		where m.project_id = definitions.project_id
 		and m.user_id = auth.uid()
 		and m.deleted_at is null
 		and m.role in ('owner', 'editor')
 	)
 	or exists (
-		select 1 from public.projects p
+		select 1 from selva.projects p
 		where p.id = definitions.project_id
 		and p.deleted_at is null
 		and p.auto_join_on_upload = true
@@ -538,16 +583,16 @@ using (
 	)
 )
 with check (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
-		select 1 from public.project_members m
+		select 1 from selva.project_members m
 		where m.project_id = definitions.project_id
 		and m.user_id = auth.uid()
 		and m.deleted_at is null
 		and m.role in ('owner', 'editor')
 	)
 	or exists (
-		select 1 from public.projects p
+		select 1 from selva.projects p
 		where p.id = definitions.project_id
 		and p.deleted_at is null
 		and p.auto_join_on_upload = true
@@ -556,19 +601,19 @@ with check (
 );
 
 create policy "definitions: editors can delete"
-on public.definitions for delete
+on selva.definitions for delete
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
-		select 1 from public.project_members m
+		select 1 from selva.project_members m
 		where m.project_id = definitions.project_id
 		and m.user_id = auth.uid()
 		and m.deleted_at is null
 		and m.role in ('owner', 'editor')
 	)
 	or exists (
-		select 1 from public.projects p
+		select 1 from selva.projects p
 		where p.id = definitions.project_id
 		and p.deleted_at is null
 		and p.auto_join_on_upload = true
@@ -576,31 +621,31 @@ using (
 	)
 );
 
-alter table public.definition_versions enable row level security;
+alter table selva.definition_versions enable row level security;
 
 -- Versions inherit visibility from the parent definition (which inherits
 -- from the parent project). Versions are immutable — no UPDATE policy.
 create policy "definition_versions: visible via parent"
-on public.definition_versions for select
+on selva.definition_versions for select
 to authenticated
 using (
 	exists (
-		select 1 from public.definitions d
+		select 1 from selva.definitions d
 		where d.guid = definition_versions.definition_guid
 		and d.deleted_at is null
-		and public.visible_project(d.project_id)
+		and selva.visible_project(d.project_id)
 	)
 );
 
 create policy "definition_versions: editors can insert"
-on public.definition_versions for insert
+on selva.definition_versions for insert
 to authenticated
 with check (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
 		select 1
-		from public.definitions d
-		join public.project_members m on m.project_id = d.project_id
+		from selva.definitions d
+		join selva.project_members m on m.project_id = d.project_id
 		where d.guid = definition_guid
 		and d.deleted_at is null
 		and m.user_id = auth.uid()
@@ -609,8 +654,8 @@ with check (
 	)
 	or exists (
 		select 1
-		from public.definitions d
-		join public.projects p on p.id = d.project_id
+		from selva.definitions d
+		join selva.projects p on p.id = d.project_id
 		where d.guid = definition_guid
 		and d.deleted_at is null
 		and p.deleted_at is null
@@ -626,14 +671,14 @@ with check (
 -- `definitions.live_version_id` / `draft_version_id` never gets a chance to
 -- raise the 23503 the store maps to a 409. Same authority as INSERT.
 create policy "definition_versions: editors can delete"
-on public.definition_versions for delete
+on selva.definition_versions for delete
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
 		select 1
-		from public.definitions d
-		join public.project_members m on m.project_id = d.project_id
+		from selva.definitions d
+		join selva.project_members m on m.project_id = d.project_id
 		where d.guid = definition_versions.definition_guid
 		and d.deleted_at is null
 		and m.user_id = auth.uid()
@@ -642,8 +687,8 @@ using (
 	)
 	or exists (
 		select 1
-		from public.definitions d
-		join public.projects p on p.id = d.project_id
+		from selva.definitions d
+		join selva.projects p on p.id = d.project_id
 		where d.guid = definition_versions.definition_guid
 		and d.deleted_at is null
 		and p.deleted_at is null
@@ -652,6 +697,41 @@ using (
 	)
 );
 
+-- Without an explicit UPDATE policy, RLS silently affects 0 rows on every
+-- `update definition_versions` — `SupabaseDefinitionStore.setVersionSchema`
+-- (which caches the compute-extracted UI schema, migration 0002) returns
+-- success without persisting anything for a user-scoped caller. Same authority
+-- as INSERT/DELETE: project owner/editor, or instance admin.
+create policy "definition_versions: editors can update"
+on selva.definition_versions for update
+to authenticated
+using (
+	selva.is_instance_admin()
+	or exists (
+		select 1
+		from selva.definitions d
+		join selva.project_members m on m.project_id = d.project_id
+		where d.guid = definition_versions.definition_guid
+		and d.deleted_at is null
+		and m.user_id = auth.uid()
+		and m.deleted_at is null
+		and m.role in ('owner', 'editor')
+	)
+)
+with check (
+	selva.is_instance_admin()
+	or exists (
+		select 1
+		from selva.definitions d
+		join selva.project_members m on m.project_id = d.project_id
+		where d.guid = definition_versions.definition_guid
+		and d.deleted_at is null
+		and m.user_id = auth.uid()
+		and m.deleted_at is null
+		and m.role in ('owner', 'editor')
+	)
+);
+
 
 -- ============================================================================
 -- 8. invites
@@ -666,11 +746,11 @@ using (
 -- token is shown to the admin once and never persisted. A DB-only leak
 -- therefore can't be replayed without the instance's INVITE_TOKEN_SECRET.
 -- Mirrors the share-link design (`share_links.token_hash`).
-create table if not exists public.invites (
+create table if not exists selva.invites (
 	id uuid primary key,
 	token_hash text not null unique,
 	email text not null,
-	org_id uuid not null references public.orgs(id) on delete cascade,
+	org_id uuid not null references selva.orgs(id) on delete cascade,
 	org_role text not null check (org_role in ('owner', 'admin', 'member')),
 	org_permissions text[] not null default '{}',
 	invited_by uuid not null references auth.users(id) on delete cascade,
@@ -680,47 +760,47 @@ create table if not exists public.invites (
 	accepted_by_user_id uuid references auth.users(id) on delete set null
 );
 
-create index if not exists idx_invites_org on public.invites(org_id, created_at desc);
+create index if not exists idx_invites_org on selva.invites(org_id, created_at desc);
 
-alter table public.invites enable row level security;
+alter table selva.invites enable row level security;
 
 create policy "invites: manage_org_members can read org invites"
-on public.invites for select
+on selva.invites for select
 to authenticated
-using (public.has_org_permission(org_id, 'manage_org_members'));
+using (selva.has_org_permission(org_id, 'manage_org_members'));
 
 create policy "invites: manage_org_members can insert"
-on public.invites for insert
+on selva.invites for insert
 to authenticated
-with check (public.has_org_permission(org_id, 'manage_org_members'));
+with check (selva.has_org_permission(org_id, 'manage_org_members'));
 
 create policy "invites: manage_org_members can update"
-on public.invites for update
+on selva.invites for update
 to authenticated
-using (public.has_org_permission(org_id, 'manage_org_members'))
-with check (public.has_org_permission(org_id, 'manage_org_members'));
+using (selva.has_org_permission(org_id, 'manage_org_members'))
+with check (selva.has_org_permission(org_id, 'manage_org_members'));
 
 create policy "invites: manage_org_members can delete"
-on public.invites for delete
+on selva.invites for delete
 to authenticated
-using (public.has_org_permission(org_id, 'manage_org_members'));
+using (selva.has_org_permission(org_id, 'manage_org_members'));
 
 -- Hash-gated read via SECURITY DEFINER so the token itself is the capability.
 -- Caller hashes the raw URL token at the route layer and passes the digest;
 -- the function just looks up the row. Returns SETOF so a missing match
 -- becomes an empty array (not a composite of nulls).
-create or replace function public.get_invite_by_token_hash(h text)
-returns setof public.invites
+create or replace function selva.get_invite_by_token_hash(h text)
+returns setof selva.invites
 language sql stable security definer set search_path = public
 as $$
 	select *
-	from public.invites
+	from selva.invites
 	where token_hash = h
 	and accepted_at is null
 	and expires_at > now()
 	limit 1;
 $$;
-grant execute on function public.get_invite_by_token_hash(text) to anon, authenticated, service_role;
+grant execute on function selva.get_invite_by_token_hash(text) to anon, authenticated, service_role;
 
 
 -- ============================================================================
@@ -759,10 +839,10 @@ grant execute on function public.get_invite_by_token_hash(text) to anon, authent
 --     `owner_org_id` is required and visibility is implicit (only members
 --     of `owner_org_id` can see it). Gated by the platform flag
 --     ALLOW_ORG_COMPUTE_OVERRIDE at the TS layer.
-create table if not exists public.compute_servers (
+create table if not exists selva.compute_servers (
 	id uuid primary key,
 	scope text not null check (scope in ('platform', 'org')),
-	owner_org_id uuid references public.orgs(id) on delete cascade,
+	owner_org_id uuid references selva.orgs(id) on delete cascade,
 	shared_with_all boolean not null default false,
 	label text not null,
 	server_url text not null,
@@ -776,37 +856,37 @@ create table if not exists public.compute_servers (
 		or (scope = 'org' and owner_org_id is not null and shared_with_all = false)
 	)
 );
-create index if not exists idx_compute_servers_owner_org on public.compute_servers(owner_org_id);
+create index if not exists idx_compute_servers_owner_org on selva.compute_servers(owner_org_id);
 
 -- Per-org share allowlist for platform servers. Empty rows = dormant
 -- platform server (admin-only) unless it's the global default.
-create table if not exists public.compute_server_shares (
-	server_id uuid not null references public.compute_servers(id) on delete cascade,
-	org_id uuid not null references public.orgs(id) on delete cascade,
+create table if not exists selva.compute_server_shares (
+	server_id uuid not null references selva.compute_servers(id) on delete cascade,
+	org_id uuid not null references selva.orgs(id) on delete cascade,
 	primary key (server_id, org_id)
 );
-create index if not exists idx_compute_server_shares_org on public.compute_server_shares(org_id);
+create index if not exists idx_compute_server_shares_org on selva.compute_server_shares(org_id);
 
 -- Per-org default override (orgDefaults[orgId]).
-create table if not exists public.compute_server_org_defaults (
-	org_id uuid primary key references public.orgs(id) on delete cascade,
-	default_server_id uuid references public.compute_servers(id) on delete set null
+create table if not exists selva.compute_server_org_defaults (
+	org_id uuid primary key references selva.orgs(id) on delete cascade,
+	default_server_id uuid references selva.compute_servers(id) on delete set null
 );
 
 -- Single-row sentinel for the global default.
-create table if not exists public.compute_server_platform_default (
+create table if not exists selva.compute_server_platform_default (
 	singleton boolean primary key default true,
-	default_server_id uuid references public.compute_servers(id) on delete set null,
+	default_server_id uuid references selva.compute_servers(id) on delete set null,
 	check (singleton)
 );
-insert into public.compute_server_platform_default (singleton, default_server_id)
+insert into selva.compute_server_platform_default (singleton, default_server_id)
 	values (true, null)
 on conflict (singleton) do nothing;
 
-alter table public.compute_servers enable row level security;
-alter table public.compute_server_shares enable row level security;
-alter table public.compute_server_org_defaults enable row level security;
-alter table public.compute_server_platform_default enable row level security;
+alter table selva.compute_servers enable row level security;
+alter table selva.compute_server_shares enable row level security;
+alter table selva.compute_server_org_defaults enable row level security;
+alter table selva.compute_server_platform_default enable row level security;
 
 -- Read: instance_admin sees everything. Otherwise visibility follows §3:
 --   * platform server with shared_with_all = true → all authenticated users
@@ -815,70 +895,70 @@ alter table public.compute_server_platform_default enable row level security;
 --   * platform server that is the current global default → all (floor)
 --   * org server → only members of owner_org_id
 create policy "compute_servers: visibility-scoped read"
-on public.compute_servers for select
+on selva.compute_servers for select
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or (scope = 'platform' and shared_with_all)
 	or (scope = 'platform' and id = (
-		select default_server_id from public.compute_server_platform_default where singleton
+		select default_server_id from selva.compute_server_platform_default where singleton
 	))
 	or (scope = 'platform' and exists (
-		select 1 from public.compute_server_shares s
-		where s.server_id = compute_servers.id and public.is_org_member(s.org_id)
+		select 1 from selva.compute_server_shares s
+		where s.server_id = compute_servers.id and selva.is_org_member(s.org_id)
 	))
-	or (scope = 'org' and public.is_org_member(owner_org_id))
+	or (scope = 'org' and selva.is_org_member(owner_org_id))
 );
 
 -- Writes:
 --   * scope = 'platform' → instance_admin only.
 --   * scope = 'org'      → manage_org_compute on owner_org_id.
 create policy "compute_servers: scoped write"
-on public.compute_servers for all
+on selva.compute_servers for all
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or (scope = 'org' and owner_org_id is not null
-		and public.has_org_permission(owner_org_id, 'manage_org_compute'))
+		and selva.has_org_permission(owner_org_id, 'manage_org_compute'))
 )
 with check (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or (scope = 'org' and owner_org_id is not null
-		and public.has_org_permission(owner_org_id, 'manage_org_compute'))
+		and selva.has_org_permission(owner_org_id, 'manage_org_compute'))
 );
 
 create policy "compute_server_shares: read"
-on public.compute_server_shares for select
+on selva.compute_server_shares for select
 to authenticated
-using (public.is_instance_admin() or public.is_org_member(org_id));
+using (selva.is_instance_admin() or selva.is_org_member(org_id));
 
 create policy "compute_server_shares: admin write"
-on public.compute_server_shares for all
+on selva.compute_server_shares for all
 to authenticated
-using (public.is_instance_admin())
-with check (public.is_instance_admin());
+using (selva.is_instance_admin())
+with check (selva.is_instance_admin());
 
 create policy "compute_server_org_defaults: members can read"
-on public.compute_server_org_defaults for select
+on selva.compute_server_org_defaults for select
 to authenticated
-using (public.is_instance_admin() or public.is_org_member(org_id));
+using (selva.is_instance_admin() or selva.is_org_member(org_id));
 
 create policy "compute_server_org_defaults: manage_org_compute can write"
-on public.compute_server_org_defaults for all
+on selva.compute_server_org_defaults for all
 to authenticated
-using (public.is_instance_admin() or public.has_org_permission(org_id, 'manage_org_compute'))
-with check (public.is_instance_admin() or public.has_org_permission(org_id, 'manage_org_compute'));
+using (selva.is_instance_admin() or selva.has_org_permission(org_id, 'manage_org_compute'))
+with check (selva.is_instance_admin() or selva.has_org_permission(org_id, 'manage_org_compute'));
 
 create policy "compute_server_platform_default: read all"
-on public.compute_server_platform_default for select
+on selva.compute_server_platform_default for select
 to authenticated
 using (true);
 
 create policy "compute_server_platform_default: admin write"
-on public.compute_server_platform_default for all
+on selva.compute_server_platform_default for all
 to authenticated
-using (public.is_instance_admin())
-with check (public.is_instance_admin());
+using (selva.is_instance_admin())
+with check (selva.is_instance_admin());
 
 
 -- ============================================================================
@@ -889,9 +969,9 @@ with check (public.is_instance_admin());
 -- raw token is shown to the minter once at creation.
 -- ============================================================================
 
-create table if not exists public.share_links (
+create table if not exists selva.share_links (
 	id uuid primary key,
-	definition_guid uuid not null references public.definitions(guid) on delete cascade,
+	definition_guid uuid not null references selva.definitions(guid) on delete cascade,
 	channel text not null check (channel in ('live', 'draft')),
 	token_hash text not null unique,
 	name text,
@@ -905,17 +985,17 @@ create table if not exists public.share_links (
 );
 
 create index if not exists idx_share_links_definition
-	on public.share_links(definition_guid, created_at desc)
+	on selva.share_links(definition_guid, created_at desc)
 	where revoked_at is null;
 
 -- Atomic check-and-increment. Returns the new solve_count on success, NULL
 -- when the cap was reached (no row updated) or the link is revoked /
 -- expired / missing. Single-statement = no race even under concurrent solves.
-create or replace function public.try_increment_share_link_solve_count(link_id uuid)
+create or replace function selva.try_increment_share_link_solve_count(link_id uuid)
 returns integer
 language sql security definer set search_path = public
 as $$
-	update public.share_links
+	update selva.share_links
 	set solve_count = solve_count + 1
 	where id = link_id
 	  and revoked_at is null
@@ -923,10 +1003,10 @@ as $$
 	  and (max_solves is null or solve_count < max_solves)
 	returning solve_count;
 $$;
-grant execute on function public.try_increment_share_link_solve_count(uuid)
+grant execute on function selva.try_increment_share_link_solve_count(uuid)
 	to authenticated, anon, service_role;
 
-alter table public.share_links enable row level security;
+alter table selva.share_links enable row level security;
 
 -- Read/insert/revoke: same authority that can edit the parent definition
 -- (project owner/editor or commons-mode definition owner). Token resolution
@@ -934,14 +1014,14 @@ alter table public.share_links enable row level security;
 -- IS the credential there.
 
 create policy "share_links: editors can read"
-on public.share_links for select
+on selva.share_links for select
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
 		select 1
-		from public.definitions d
-		join public.project_members m on m.project_id = d.project_id
+		from selva.definitions d
+		join selva.project_members m on m.project_id = d.project_id
 		where d.guid = share_links.definition_guid
 		and d.deleted_at is null
 		and m.user_id = auth.uid()
@@ -950,8 +1030,8 @@ using (
 	)
 	or exists (
 		select 1
-		from public.definitions d
-		join public.projects p on p.id = d.project_id
+		from selva.definitions d
+		join selva.projects p on p.id = d.project_id
 		where d.guid = share_links.definition_guid
 		and d.deleted_at is null
 		and p.deleted_at is null
@@ -961,14 +1041,14 @@ using (
 );
 
 create policy "share_links: editors can insert"
-on public.share_links for insert
+on selva.share_links for insert
 to authenticated
 with check (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
 		select 1
-		from public.definitions d
-		join public.project_members m on m.project_id = d.project_id
+		from selva.definitions d
+		join selva.project_members m on m.project_id = d.project_id
 		where d.guid = share_links.definition_guid
 		and d.deleted_at is null
 		and m.user_id = auth.uid()
@@ -977,8 +1057,8 @@ with check (
 	)
 	or exists (
 		select 1
-		from public.definitions d
-		join public.projects p on p.id = d.project_id
+		from selva.definitions d
+		join selva.projects p on p.id = d.project_id
 		where d.guid = share_links.definition_guid
 		and d.deleted_at is null
 		and p.deleted_at is null
@@ -989,14 +1069,14 @@ with check (
 
 -- UPDATE policy covers `revoke` (set revoked_at). Same authority as insert.
 create policy "share_links: editors can revoke"
-on public.share_links for update
+on selva.share_links for update
 to authenticated
 using (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
 		select 1
-		from public.definitions d
-		join public.project_members m on m.project_id = d.project_id
+		from selva.definitions d
+		join selva.project_members m on m.project_id = d.project_id
 		where d.guid = share_links.definition_guid
 		and d.deleted_at is null
 		and m.user_id = auth.uid()
@@ -1005,11 +1085,11 @@ using (
 	)
 )
 with check (
-	public.is_instance_admin()
+	selva.is_instance_admin()
 	or exists (
 		select 1
-		from public.definitions d
-		join public.project_members m on m.project_id = d.project_id
+		from selva.definitions d
+		join selva.project_members m on m.project_id = d.project_id
 		where d.guid = share_links.definition_guid
 		and d.deleted_at is null
 		and m.user_id = auth.uid()
@@ -1036,6 +1116,7 @@ with check (
 
 -- selva-public is served directly from the CDN (cover images, brand assets);
 -- anonymous reads are required. Writes are service-role only.
+drop policy if exists "selva-public: anyone can read" on storage.objects;
 create policy "selva-public: anyone can read"
 on storage.objects for select
 to anon, authenticated
@@ -1061,7 +1142,7 @@ using (bucket_id = 'selva-public');
 -- exists today so audit data is captured from the moment the system goes live.
 -- ============================================================================
 
-create table if not exists public.audit_events (
+create table if not exists selva.audit_events (
 	id uuid primary key default gen_random_uuid(),
 	type text not null,
 	actor_id text not null,
@@ -1070,15 +1151,15 @@ create table if not exists public.audit_events (
 );
 
 create index if not exists audit_events_occurred_at_idx
-	on public.audit_events (occurred_at desc);
+	on selva.audit_events (occurred_at desc);
 
 create index if not exists audit_events_type_occurred_at_idx
-	on public.audit_events (type, occurred_at desc);
+	on selva.audit_events (type, occurred_at desc);
 
 create index if not exists audit_events_actor_occurred_at_idx
-	on public.audit_events (actor_id, occurred_at desc);
+	on selva.audit_events (actor_id, occurred_at desc);
 
 -- RLS: writes always go through service-role (the sink uses the service
 -- client). Authenticated users have NO read access today — the audit-log
 -- viewer UI will land later with its own instance_admin-only policy.
-alter table public.audit_events enable row level security;
+alter table selva.audit_events enable row level security;