insforge 0.3.1

package/README.md

@@ -0,0 +1,134 @@
+<div align="center">
+  <a href="https://insforge.com">
+    <img src="assets/banner.png" alt="Insforge Logo">
+  </a>
+  
+</div>
+<p align="center">
+   <a href="#quickstart-tldr">Get Started</a> · 
+   <a href="https://docs.insforge.dev/introduction">Documentation</a> · 
+   <a href="https://discord.gg/MPxwj5xVvW">Discord</a>
+</p>
+<p align="center">
+   <a href="https://opensource.org/licenses/Apache-2.0"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License"></a>
+   <a href="https://discord.gg/MPxwj5xVvW"><img src="https://img.shields.io/badge/Discord-Join%20Community-7289DA?logo=discord&logoColor=white" alt="Discord"></a>
+   <a href="https://github.com/InsForge/insforge/stargazers"><img src="https://img.shields.io/github/stars/InsForge/insforge?style=social" alt="GitHub Stars"></a>
+</p>
+
+# InsForge
+
+**InsForge is the Agent-Native Supabase Alternative.** We are building the features of Supabase in an AI-native way, enabling AI agents to build and manage full-stack applications autonomously. 
+
+## Key Features & Use Cases
+
+### Core Features:
+- **Authentication** - Complete user management system
+- **Database** - Flexible data storage and retrieval
+- **Storage** - File management and organization
+- **Serverless Functions** - Scalable compute power
+- **Site Deployment** *(coming soon)* - Easy application deployment
+
+### Use Cases: Building full-stack applications using natural language
+- **Connect AI agents to InsForge** - Enable Claude, GPT, or other AI agents to manage your backend
+- **Add backend to Lovable or Bolt-style vibe coding project projects** - Instant backend for AI-generated frontends
+
+## Prompt Examples:
+
+<td align="center">
+  <img src="assets/userflow.png" alt="userFlow">
+  <br>
+</td>
+
+## Quickstart TLDR;
+
+### 1. Install and run InsForge
+
+**Use Docker (Recommended)**  
+Prerequisites: [Docker](https://www.docker.com/) + [Node.js](https://nodejs.org/)
+
+```bash
+# Run with Docker
+git clone https://github.com/insforge/insforge.git
+cd insforge
+cp .env.example .env
+docker compose up
+```
+
+### 2. Connect an AI Agent
+
+Visit InsForge Dashboard (default: http://localhost:7131), log in, and follow the "Connect" guide, and set up your MCP.
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center">
+        <img src="assets/signin.png" alt="Sign In">
+        <br>
+        <em>Sign in to InsForge</em>
+      </td>
+      <td align="center">
+        <img src="assets/mcpInstallv2.png" alt="MCP Configuration"">
+        <br>
+        <em>Configure MCP connection</em>
+      </td>
+    </tr>
+  </table>
+</div>
+
+### 3. Test the Connection
+
+In your agent, send:
+```
+InsForge is my backend platform, what is my current backend structure?
+```
+
+<div align="center">
+  <img src="assets/sampleResponse.png" alt="Successful Connection Response" width="600">
+  <br>
+  <em>Sample successful response calling insforge MCP tools</em>
+</div>
+
+### 4. Start Using InsForge
+
+Start building your project in a new directory! Build your next todo app, Instagram clone, or online platform in seconds!
+
+**Sample Project Prompts:**
+- "Build a todo app with user authentication"
+- "Create an Instagram with image upload"
+
+## Architecture
+
+
+<div align="center">
+  <img src="assets/archDiagram.png" alt="Carch">
+  <br>
+</div>
+
+
+
+## Contributing
+
+**Contributing**: If you're interested in contributing, you can check our guide here [CONTRIBUTING.md](CONTRIBUTING.md). We truly appreciate pull requests, all types of help are appreciated!
+
+**Support**: If you need any type of help support, we're responsive on our [Discord channel](https://discord.gg/MPxwj5xVvW), and also feel free to email us [info@insforge.dev](mailto:info@insforge.dev) too!
+
+
+## Documentation & Support
+
+### Documentation
+- **[Official Docs](https://docs.insforge.dev/introduction)** - Comprehensive guides and API references
+
+### Community
+- **[Discord](https://discord.gg/D3Vf8zD2ZS)** - Join our vibrant community
+- **[Twitter](https://x.com/InsForge_dev)** - Follow for updates and tips
+
+### Contact
+- **Email**: info@insforge.dev
+
+## License
+
+This project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.
+
+---
+
+[![Star History Chart](https://api.star-history.com/svg?repos=InsForge/insforge&type=Date)](https://www.star-history.com/#InsForge/insforge&Date)

package/assets/Dark.svg

@@ -0,0 +1,23 @@
+<svg width="1080" height="400" viewBox="0 0 1080 400" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="1080" height="400" fill="black"/>
+<path d="M253 281C253 284 251.664 286.164 249 287.5C247.739 288.132 247 288.5 245.8 288.5C245 288.5 243.54 288.193 242.5 287.5C239.5 285.5 164 209 164 209L192 181L248.607 237.607C251.42 240.42 253 244.222 253 248.201V281Z" fill="url(#paint0_linear_101_25)"/>
+<path d="M136.244 230.934L107.134 201.96C104.302 199.142 104.302 194.559 107.134 191.741L170.07 129.1C171.421 127.755 173.25 127 175.156 127H199.878C201.784 127 203.612 127.755 204.963 129.1L221.694 145.751C225.657 149.697 225.657 156.113 221.694 160.058L150.484 230.934C146.546 234.853 140.182 234.853 136.244 230.934Z" fill="url(#paint1_linear_101_25)"/>
+<path d="M949.564 209.58C949.328 203.246 947.74 198.204 944.797 194.456C941.972 190.578 937.912 188.639 932.616 188.639C927.319 188.639 922.788 190.707 919.022 194.843C915.373 198.851 913.019 204.732 911.96 212.488H949.564V209.58ZM937.029 270.659C922.788 270.659 911.548 266.005 903.309 256.698C895.07 247.391 890.951 235.175 890.951 220.051C890.951 204.797 894.835 192.711 902.603 183.791C910.371 174.872 920.081 170.412 931.733 170.412C943.385 170.412 952.624 174.29 959.45 182.046C966.277 189.802 969.69 201.113 969.69 215.979C969.69 219.598 969.278 224.252 968.454 229.94H912.313C913.843 237.049 917.021 242.479 921.846 246.227C926.79 249.976 933.439 251.85 941.796 251.85C950.152 251.85 957.567 249.265 964.041 244.094V264.26C957.803 268.526 948.799 270.659 937.029 270.659Z" fill="white"/>
+<path d="M832.287 190.19C826.402 190.19 821.694 192.84 818.163 198.14C814.632 203.31 812.867 210.42 812.867 219.469C812.867 228.518 814.691 235.498 818.34 240.41C821.988 245.193 826.637 247.585 832.287 247.585C838.054 247.585 842.88 245.128 846.764 240.216C850.648 235.175 852.59 228.065 852.59 218.887C852.59 209.58 850.706 202.47 846.94 197.558C843.174 192.646 838.289 190.19 832.287 190.19ZM873.775 260.77C873.775 276.282 869.656 287.916 861.417 295.672C853.296 303.557 843.115 307.5 830.875 307.5C818.752 307.5 808.277 305.173 799.45 300.52V276.864C807.453 283.068 817.045 286.171 828.226 286.171C844.468 286.171 852.59 277.639 852.59 260.576V252.044C847.176 261.739 839.054 266.587 828.226 266.587C817.516 266.587 808.571 262.58 801.392 254.565C794.33 246.421 790.799 234.981 790.799 220.244C790.799 205.379 794.153 193.357 800.862 184.179C807.688 174.872 816.633 170.218 827.697 170.218C838.878 170.218 847.176 175.324 852.59 185.536V171.381H873.775V260.77Z" fill="white"/>
+<path d="M753.806 269.689H732.444L732.62 171.381H753.806V188.833C757.925 176.681 765.458 170.606 776.404 170.606C778.875 170.606 780.876 170.8 782.406 171.188V193.68C779.699 192.387 776.698 191.741 773.402 191.741C767.635 191.741 762.927 194.326 759.279 199.497C755.63 204.668 753.806 211.131 753.806 218.887V269.689Z" fill="white"/>
+<path d="M671.46 188.832C664.516 188.832 659.219 191.87 655.571 197.946C652.04 204.021 650.275 211.648 650.275 220.826C650.275 229.875 652.099 237.437 655.747 243.513C659.396 249.588 664.634 252.626 671.46 252.626C678.286 252.626 683.465 249.653 686.996 243.706C690.527 237.76 692.292 230.133 692.292 220.826C692.292 211.519 690.586 203.892 687.172 197.946C683.759 191.87 678.522 188.832 671.46 188.832ZM671.637 169.83C685.054 169.83 695.529 174.613 703.062 184.179C710.594 193.615 714.36 205.702 714.36 220.438C714.36 235.175 710.535 247.326 702.885 256.892C695.352 266.458 684.76 271.24 671.107 271.24C657.572 271.24 646.979 266.587 639.329 257.28C631.796 247.972 628.03 235.95 628.03 221.214C628.03 206.477 631.973 194.262 639.858 184.567C647.744 174.742 658.337 169.83 671.637 169.83Z" fill="white"/>
+<path d="M609.312 217.53H568V269.689H545.579V139H615.314V158.972H568V197.558H609.312V217.53Z" fill="white"/>
+<path d="M527.791 241.38C527.791 250.558 524.79 257.732 518.787 262.903C512.784 268.073 504.487 270.659 493.894 270.659C483.419 270.659 474.768 268.655 467.942 264.648V243.319C475.828 249.136 484.361 252.044 493.541 252.044C497.425 252.044 500.426 251.269 502.545 249.717C504.781 248.037 505.899 246.098 505.899 243.9C505.899 241.574 505.546 239.764 504.84 238.471C504.134 237.049 502.78 235.692 500.779 234.399C498.19 232.719 495.542 231.297 492.835 230.133C490.246 228.841 488.833 228.13 488.598 228C488.48 227.871 488.245 227.742 487.892 227.613C487.539 227.483 487.244 227.354 487.009 227.225C473.945 220.762 467.412 211.454 467.412 199.303C467.412 190.254 470.531 183.145 476.769 177.974C483.007 172.803 490.716 170.218 499.897 170.218C509.195 170.218 516.845 171.64 522.848 174.484V195.037C516.963 191.159 509.607 189.22 500.779 189.22C497.131 189.22 494.247 190.125 492.129 191.935C490.128 193.615 489.127 195.813 489.127 198.528C489.127 200.725 489.657 202.406 490.716 203.569C491.776 204.732 492.658 205.637 493.365 206.284C494.071 206.93 495.071 207.641 496.366 208.416C499.544 210.097 501.956 211.325 503.604 212.101C511.725 215.849 517.787 220.051 521.788 224.704C525.79 229.229 527.791 234.787 527.791 241.38Z" fill="white"/>
+<path d="M447.21 269.689H426.025V209.192C426.025 202.729 424.613 197.881 421.788 194.649C418.963 191.289 414.962 189.608 409.783 189.608C404.604 189.608 400.132 191.999 396.365 196.782C392.599 201.436 390.716 208.158 390.716 216.948V269.689H369.531V171.381H390.716V188.251C395.777 176.229 404.957 170.218 418.257 170.218C427.202 170.218 434.264 173.191 439.442 179.137C444.621 185.084 447.21 193.486 447.21 204.345V269.689Z" fill="white"/>
+<path d="M344.245 269.689H322V139H344.245V269.689Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_101_25" x1="264.639" y1="302.534" x2="192.289" y2="165.357" gradientUnits="userSpaceOnUse">
+<stop stop-color="#009DFF"/>
+<stop offset="1" stop-color="#004E75"/>
+</linearGradient>
+<linearGradient id="paint1_linear_101_25" x1="210.858" y1="136.372" x2="87.5817" y2="259.648" gradientUnits="userSpaceOnUse">
+<stop stop-color="#009DFF"/>
+<stop offset="1" stop-color="#004E75"/>
+</linearGradient>
+</defs>
+</svg>

package/backend/migrations/000_create-base-tables.sql

@@ -0,0 +1,142 @@
+-- Migration: 000 - Create base system tables
+-- This migration creates all the initial tables that the application needs
+
+-- System configuration
+CREATE TABLE IF NOT EXISTS _config (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL,
+  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+
+-- App metadata
+CREATE TABLE IF NOT EXISTS _metadata (
+  key TEXT PRIMARY KEY,
+  value TEXT,
+  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Storage buckets table to track bucket-level settings
+CREATE TABLE IF NOT EXISTS _storage_buckets (
+  name TEXT PRIMARY KEY,
+  public BOOLEAN DEFAULT TRUE,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Storage files table
+CREATE TABLE IF NOT EXISTS _storage (
+  bucket TEXT NOT NULL,
+  key TEXT NOT NULL,
+  size INTEGER NOT NULL,
+  mime_type TEXT,
+  uploaded_at TIMESTAMPTZ DEFAULT NOW(),
+  PRIMARY KEY (bucket, key),
+  FOREIGN KEY (bucket) REFERENCES _storage_buckets(name) ON DELETE CASCADE
+);
+
+-- MCP usage tracking table
+CREATE TABLE IF NOT EXISTS _mcp_usage (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tool_name VARCHAR(255) NOT NULL,
+  success BOOLEAN DEFAULT true,
+  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+
+-- AI configurations table
+CREATE TABLE IF NOT EXISTS _ai_configs (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  modality VARCHAR(255) NOT NULL,
+  provider VARCHAR(255) NOT NULL,
+  model_id VARCHAR(255) UNIQUE NOT NULL,
+  system_prompt TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS _ai_usage (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  config_id UUID NOT NULL,
+  input_tokens INT,
+  output_tokens INT,
+  image_count INT,
+  image_resolution TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  FOREIGN KEY (config_id) REFERENCES _ai_configs(id) ON DELETE NO ACTION
+);
+
+-- Indexes for AI tables
+CREATE INDEX IF NOT EXISTS idx_ai_usage_config_id ON _ai_usage(config_id);
+CREATE INDEX IF NOT EXISTS idx_ai_usage_created_at ON _ai_usage(created_at DESC);
+
+-- Index for efficient date range queries
+CREATE INDEX IF NOT EXISTS idx_mcp_usage_created_at ON _mcp_usage(created_at DESC);
+
+-- Edge functions
+CREATE TABLE IF NOT EXISTS _edge_functions (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  slug VARCHAR(255) UNIQUE NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  description TEXT,
+  code TEXT NOT NULL,
+  status VARCHAR(50) DEFAULT 'draft',
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW(),
+  deployed_at TIMESTAMPTZ
+);
+
+-- Auth Tables (2-table structure)
+-- User table
+CREATE TABLE IF NOT EXISTS _user (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  email TEXT UNIQUE NOT NULL,
+  password TEXT, -- NULL for OAuth-only users
+  name TEXT,
+  email_verified BOOLEAN DEFAULT false,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Account table (for OAuth connections)
+CREATE TABLE IF NOT EXISTS _account (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES _user(id) ON DELETE CASCADE,
+  provider TEXT NOT NULL, -- OAuth provider name: 'google', 'github', etc.
+  provider_account_id TEXT NOT NULL, -- User's unique ID on the provider's system
+  access_token TEXT, -- OAuth access token for making API calls to provider
+  refresh_token TEXT, -- OAuth refresh token for renewing access
+  provider_data JSONB, -- OAuth provider's user profile
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW(),
+  UNIQUE(provider, provider_account_id)
+);
+
+-- Create update timestamp function
+CREATE OR REPLACE FUNCTION update_updated_at_column()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = NOW();
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+-- Create triggers for updated_at
+DROP TRIGGER IF EXISTS update__config_updated_at ON _config;
+CREATE TRIGGER update__config_updated_at BEFORE UPDATE ON _config
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+DROP TRIGGER IF EXISTS update__metadata_updated_at ON _metadata;
+CREATE TRIGGER update__metadata_updated_at BEFORE UPDATE ON _metadata
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+DROP TRIGGER IF EXISTS update__edge_functions_updated_at ON _edge_functions;
+CREATE TRIGGER update__edge_functions_updated_at BEFORE UPDATE ON _edge_functions
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Insert initial metadata
+INSERT INTO _metadata (key, value) VALUES ('version', '1.0.0')
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO _metadata (key, value) VALUES ('created_at', NOW()::TEXT)
+ON CONFLICT (key) DO NOTHING;

package/backend/migrations/001_create-helper-functions.sql

@@ -0,0 +1,41 @@
+-- Migration: 001 - Create helper functions for RLS
+-- These functions extract user information from JWT claims
+
+-- Function to get current user ID from JWT
+CREATE OR REPLACE FUNCTION public.uid()
+RETURNS uuid
+LANGUAGE sql STABLE
+AS $$
+  SELECT
+  nullif(
+    coalesce(
+      current_setting('request.jwt.claim.sub', true),
+      (current_setting('request.jwt.claims', true)::jsonb ->> 'sub')
+    ),
+    ''
+  )::uuid
+$$;
+
+-- Function to get current user role from JWT
+CREATE OR REPLACE FUNCTION public.role()
+RETURNS text
+LANGUAGE sql STABLE
+AS $$
+  SELECT
+  coalesce(
+    current_setting('request.jwt.claim.role', true),
+    (current_setting('request.jwt.claims', true)::jsonb ->> 'role')
+  )::text
+$$;
+
+-- Function to get current user email from JWT
+CREATE OR REPLACE FUNCTION public.email()
+RETURNS text
+LANGUAGE sql STABLE
+AS $$
+  SELECT
+  coalesce(
+    current_setting('request.jwt.claim.email', true),
+    (current_setting('request.jwt.claims', true)::jsonb ->> 'email')
+  )::text
+$$;

package/backend/migrations/002_rename-auth-tables.sql

@@ -0,0 +1,30 @@
+-- Migration: 002 - Rename authentication tables to better auth naming convention
+
+DO $$
+BEGIN
+    -- Handle _account to _oauth_connections
+    IF EXISTS (SELECT FROM information_schema.tables 
+              WHERE table_name = '_account' AND table_schema = 'public') THEN
+        IF EXISTS (SELECT FROM information_schema.tables 
+                   WHERE table_name = '_oauth_connections' AND table_schema = 'public') THEN
+            -- Both exist, drop the old one
+            DROP TABLE _account CASCADE;
+        ELSE
+            -- Only old exists, rename it
+            ALTER TABLE _account RENAME TO _oauth_connections;
+        END IF;
+    END IF;
+
+    -- Handle _user to _accounts
+    IF EXISTS (SELECT FROM information_schema.tables 
+              WHERE table_name = '_user' AND table_schema = 'public') THEN
+        IF EXISTS (SELECT FROM information_schema.tables 
+                   WHERE table_name = '_accounts' AND table_schema = 'public') THEN
+            -- Both exist, drop the old one
+            DROP TABLE _user CASCADE;
+        ELSE
+            -- Only old exists, rename it
+            ALTER TABLE _user RENAME TO _accounts;
+        END IF;
+    END IF;
+END $$;

package/backend/migrations/003_create-users-table.sql

@@ -0,0 +1,56 @@
+-- Migration: 003 - Create users table for user profiles
+
+DO $$
+BEGIN
+    CREATE TABLE IF NOT EXISTS users (
+      id UUID PRIMARY KEY REFERENCES _accounts(id) ON DELETE CASCADE,
+      nickname TEXT,
+      avatar_url TEXT,
+      bio TEXT,
+      birthday DATE,
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      updated_at TIMESTAMPTZ DEFAULT NOW()
+    );
+    
+    -- Check and create policies only if they don't exist
+    -- Allow everyone to read users table
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies 
+      WHERE tablename = 'users' 
+      AND policyname = 'Enable read access for all users'
+    ) THEN
+      CREATE POLICY "Enable read access for all users" ON users
+        FOR SELECT
+        USING (true);  -- Allow all reads
+    END IF;
+    
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies 
+      WHERE tablename = 'users' 
+      AND policyname = 'Disable delete for users'
+    ) THEN
+      CREATE POLICY "Disable delete for users" ON users
+        FOR DELETE
+        TO authenticated
+        USING (false);
+    END IF;
+
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies 
+      WHERE tablename = 'users' 
+      AND policyname = 'Enable update for users based on user_id'
+    ) THEN
+      CREATE POLICY "Enable update for users based on user_id" ON users
+        FOR UPDATE
+        TO authenticated
+        USING (uid() = id)
+        WITH CHECK (uid() = id);  -- make sure only the owner can update
+    END IF;
+    
+    -- Enable Row Level Security on the users table
+    ALTER TABLE users ENABLE ROW LEVEL SECURITY;
+    
+    -- Grant permissions to anon and authenticated roles
+    GRANT SELECT ON users TO anon;
+    GRANT SELECT, UPDATE ON users TO authenticated;
+END $$;

package/backend/migrations/004_add-reload-postgrest-func.sql

@@ -0,0 +1,24 @@
+-- Migration: 004 - add reload_postgrest_schema function.
+
+DO $$
+BEGIN
+    -- Create a function to reload PostgREST schema
+    CREATE OR REPLACE FUNCTION reload_postgrest_schema()
+    RETURNS void
+    LANGUAGE plpgsql
+    AS $reload_function$
+    BEGIN
+        -- Method 1: Use NOTIFY to signal PostgREST to reload schema
+        -- PostgREST listens to 'pgrst' channel for schema changes
+        NOTIFY pgrst, 'reload schema';
+        
+        RAISE NOTICE 'PostgREST schema reload notification sent';
+    END
+    $reload_function$;
+
+    -- Grant execute permission to project_admin and authenticated users
+    GRANT EXECUTE ON FUNCTION reload_postgrest_schema() TO project_admin;
+    GRANT EXECUTE ON FUNCTION reload_postgrest_schema() TO authenticated;
+    
+    RAISE NOTICE 'PostgREST schema reload function created successfully';
+END $$;

package/backend/migrations/005_enable-project-admin-modify-users.sql

@@ -0,0 +1,30 @@
+-- Migration: 005 - Enable project admin modify any users.
+
+DO $$
+BEGIN
+    -- Create policy to allow project_admin to update any user
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_policies 
+        WHERE tablename = 'users' 
+        AND policyname = 'Allow project_admin to update any user'
+    ) THEN
+        CREATE POLICY "Allow project_admin to update any user" ON users
+            FOR UPDATE
+            TO project_admin
+            USING (true)
+            WITH CHECK (true);  -- Ensure project_admin always can update
+    END IF;
+
+    -- Grant necessary permissions
+    GRANT SELECT, UPDATE ON users TO project_admin;
+    
+    -- Notify PostgREST to reload schema after policy changes
+    IF EXISTS (SELECT 1 FROM pg_proc WHERE proname = 'reload_postgrest_schema') THEN
+        PERFORM reload_postgrest_schema();
+        RAISE NOTICE 'PostgREST schema reload requested after migration';
+    ELSE
+        RAISE WARNING 'PostgREST reload function not found - please restart PostgREST manually';
+    END IF;
+    
+    RAISE NOTICE 'Migration project-admin-update-users completed successfully';
+END $$;

package/backend/migrations/006_modify-ai-usage-table.sql

@@ -0,0 +1,25 @@
+-- Migration: 006 - Modify AI usage table
+-- This migration modifies the _ai_usage table to:
+-- 1. Change foreign key constraint on config_id to SET NULL
+-- 2. Make config_id nullable
+-- 3. Add model_id column
+
+-- Drop existing foreign key constraint
+ALTER TABLE _ai_usage 
+DROP CONSTRAINT IF EXISTS _ai_usage_config_id_fkey;
+
+-- Make config_id nullable
+ALTER TABLE _ai_usage 
+ALTER COLUMN config_id DROP NOT NULL;
+
+-- Add new foreign key constraint with SET NULL on delete
+ALTER TABLE _ai_usage 
+ADD CONSTRAINT _ai_usage_config_id_fkey 
+FOREIGN KEY (config_id) REFERENCES _ai_configs(id) ON DELETE SET NULL;
+
+-- Add new columns for model identification
+ALTER TABLE _ai_usage 
+ADD COLUMN IF NOT EXISTS model_id VARCHAR(255);
+
+-- Create indexes for the new columns
+CREATE INDEX IF NOT EXISTS idx_ai_usage_model_id ON _ai_usage(model_id);

package/backend/migrations/007_drop-metadata-table.sql

@@ -0,0 +1,2 @@
+-- Drop the _metadata table if it exists
+DROP TABLE IF EXISTS _metadata CASCADE;

package/backend/migrations/008_add-system-tables.sql

@@ -0,0 +1,77 @@
+-- Migration: 008 - Create new system tables and rename OAuth connections table
+
+-- 1. Create _secrets table for storing application secrets
+CREATE TABLE IF NOT EXISTS _secrets (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  name TEXT UNIQUE NOT NULL,
+  value_ciphertext TEXT NOT NULL,
+  is_active BOOLEAN DEFAULT TRUE,
+  last_used_at TIMESTAMPTZ,
+  expires_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- 2. Create _oauth_configs table for OAuth provider configurations
+CREATE TABLE IF NOT EXISTS _oauth_configs (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  provider TEXT UNIQUE NOT NULL,
+  client_id TEXT,
+  secret_id UUID REFERENCES _secrets(id) ON DELETE RESTRICT,
+  scopes TEXT[],
+  redirect_uri TEXT,
+  use_shared_key BOOLEAN DEFAULT FALSE,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- 3. Create _audit_logs table for storing admin operation logs
+CREATE TABLE IF NOT EXISTS _audit_logs (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  actor TEXT NOT NULL,
+  action TEXT NOT NULL,
+  module TEXT NOT NULL,
+  details JSONB,
+  ip_address INET,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- 4. Rename _oauth_connections to _account_providers
+DO $$
+BEGIN
+    IF EXISTS (SELECT FROM information_schema.tables
+              WHERE table_name = '_oauth_connections' AND table_schema = 'public') THEN
+        IF EXISTS (SELECT FROM information_schema.tables
+                  WHERE table_name = '_account_providers' AND table_schema = 'public') THEN
+            -- _account_providers already exists, just drop _oauth_connections
+            DROP TABLE _oauth_connections CASCADE;
+        ELSE
+            -- _account_providers doesn't exist, rename _oauth_connections to _account_providers
+            ALTER TABLE _oauth_connections RENAME TO _account_providers;
+        END IF;
+    END IF;
+END $$;
+
+-- 5. Drop the old _config system table
+DROP TABLE IF EXISTS _config CASCADE;
+
+-- Create indexes for better query performance
+CREATE INDEX IF NOT EXISTS idx_secrets_name ON _secrets(name);
+CREATE INDEX IF NOT EXISTS idx_oauth_configs_provider ON _oauth_configs(provider);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_actor ON _audit_logs(actor);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_module ON _audit_logs(module);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_created_at ON _audit_logs(created_at DESC);
+
+-- Add triggers for updated_at
+DROP TRIGGER IF EXISTS update__secrets_updated_at ON _secrets;
+CREATE TRIGGER update__secrets_updated_at BEFORE UPDATE ON _secrets
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+DROP TRIGGER IF EXISTS update__oauth_configs_updated_at ON _oauth_configs;
+CREATE TRIGGER update__oauth_configs_updated_at BEFORE UPDATE ON _oauth_configs
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+DROP TRIGGER IF EXISTS update__audit_logs_updated_at ON _audit_logs;
+CREATE TRIGGER update__audit_logs_updated_at BEFORE UPDATE ON _audit_logs
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();

package/backend/migrations/009_add-function-secrets.sql

@@ -0,0 +1,24 @@
+-- Migration: 009 - Create function secrets table for edge functions environment variables
+-- This table stores encrypted secrets that are injected into edge functions as Deno.env variables
+
+CREATE TABLE IF NOT EXISTS _function_secrets (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  key VARCHAR(255) UNIQUE NOT NULL,
+  value_ciphertext TEXT NOT NULL,      -- Encrypted value using AES-256-GCM
+  is_reserved BOOLEAN DEFAULT FALSE,   -- System-reserved keys that can't be modified/deleted
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Create index for faster key lookups
+CREATE INDEX IF NOT EXISTS idx_function_secrets_key ON _function_secrets(key);
+
+-- Add trigger for updated_at
+DROP TRIGGER IF EXISTS update__function_secrets_updated_at ON _function_secrets;
+CREATE TRIGGER update__function_secrets_updated_at BEFORE UPDATE ON _function_secrets
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Note: Reserved system secrets will be initialized by the application on startup
+
+-- Rename _edge_functions table to functions
+ALTER TABLE IF EXISTS _edge_functions RENAME TO _functions;