madarx 2.18.0 → 2.19.0

package/lib/cloud-schema.js

@@ -0,0 +1,144 @@
+/**
+ * lib/cloud-schema.js — Supabase shared-layer schema bootstrap (server-only).
+ *
+ * The onboarding wizard's "Build tables" step uses this to:
+ *   1. DETECT  — probe which shared-layer tables exist (service-role .select).
+ *   2. APPLY   — either guide a copy-paste into the project's SQL editor, or,
+ *                one-click, run the bundle via the Supabase Management API.
+ *   3. VERIFY  — re-probe and confirm everything is present.
+ *
+ * The SQL itself is the generated bundle (lib/cloud-schema.generated.js), which
+ * is built from supabase/migrations/*.sql so the migrations stay the single
+ * source of truth. No secret is ever returned, logged, or echoed.
+ */
+
+import { getSharedCloudAdmin, isSharedCloudReady } from './shared-cloud.js';
+import {
+  CLOUD_SCHEMA_SQL,
+  REQUIRED_TABLES,
+  SCHEMA_VERSION,
+  MIGRATION_FILES,
+} from './cloud-schema.generated.js';
+
+export { CLOUD_SCHEMA_SQL, REQUIRED_TABLES, SCHEMA_VERSION, MIGRATION_FILES };
+
+// ── URL / ref helpers ─────────────────────────────────────────────────────────
+
+/**
+ * Accepts a full Supabase URL OR a bare project ref and returns the 20-char ref.
+ * Examples:
+ *   https://abcd1234efgh5678ijkl.supabase.co  → abcd1234efgh5678ijkl
+ *   abcd1234efgh5678ijkl                       → abcd1234efgh5678ijkl
+ * Returns null if it can't confidently extract one.
+ */
+export function projectRefFromUrl(input) {
+  if (!input || typeof input !== 'string') return null;
+  const raw = input.trim();
+  // Bare ref: 20 lowercase alphanumerics, no dots/slashes.
+  if (/^[a-z0-9]{20}$/.test(raw)) return raw;
+  try {
+    const host = new URL(raw.includes('://') ? raw : `https://${raw}`).hostname;
+    const m = host.match(/^([a-z0-9]{20})\.supabase\.(co|in|red)$/);
+    if (m) return m[1];
+    // Fallback: first label if it looks like a ref.
+    const first = host.split('.')[0];
+    if (/^[a-z0-9]{20}$/.test(first)) return first;
+  } catch {
+    /* not a URL */
+  }
+  return null;
+}
+
+/** Builds the canonical project URL from a ref. */
+export function urlFromRef(ref) {
+  return /^[a-z0-9]{20}$/.test(String(ref || '')) ? `https://${ref}.supabase.co` : null;
+}
+
+/** Deep link to the project's SQL editor (new query), from a URL or ref. */
+export function sqlEditorUrl(urlOrRef) {
+  const ref = projectRefFromUrl(urlOrRef);
+  return ref ? `https://supabase.com/dashboard/project/${ref}/sql/new` : null;
+}
+
+// ── Detection ─────────────────────────────────────────────────────────────────
+
+/**
+ * Probes the shared layer for each required table using the service-role
+ * client (RLS-bypassing, so empty/locked tables still resolve). A missing table
+ * surfaces as a PostgREST 404 → counted as missing.
+ *
+ * @param {{ agent_id?: string, project_id?: string }} [options]
+ * @returns {Promise<{ configured: boolean, ready?: boolean, present?: string[],
+ *   missing?: string[], total?: number, version?: string }>}
+ */
+export async function probeCloudSchema(options = {}) {
+  if (!isSharedCloudReady(options)) return { configured: false };
+  const admin = getSharedCloudAdmin(options);
+  const present = [];
+  const missing = [];
+  await Promise.all(
+    REQUIRED_TABLES.map(async (table) => {
+      try {
+        await admin.select(table, { limit: 1 });
+        present.push(table);
+      } catch {
+        missing.push(table);
+      }
+    })
+  );
+  present.sort();
+  missing.sort();
+  return {
+    configured: true,
+    ready: missing.length === 0,
+    present,
+    missing,
+    total: REQUIRED_TABLES.length,
+    version: SCHEMA_VERSION,
+  };
+}
+
+// ── One-click apply via the Supabase Management API ───────────────────────────
+
+const MANAGEMENT_API = 'https://api.supabase.com';
+
+/**
+ * Runs the schema bundle against a project using a Supabase Personal Access
+ * Token (account-level). This is the optional one-click path; the default
+ * onboarding path is copy-paste into the SQL editor, which needs no PAT.
+ *
+ * The PAT is used for this single request and never persisted, logged, or
+ * returned. The target host is the fixed Supabase Management API (no SSRF
+ * surface). On success the bundle's trailing `notify pgrst` refreshes the
+ * PostgREST cache so a follow-up probe sees the new tables.
+ *
+ * @param {{ ref: string, pat: string }} args
+ * @returns {Promise<{ ok: boolean, error?: string }>}
+ */
+export async function applySchemaViaManagementApi({ ref, pat } = {}) {
+  const projectRef = projectRefFromUrl(ref) || (/(^[a-z0-9]{20}$)/.test(String(ref || '')) ? ref : null);
+  if (!projectRef) return { ok: false, error: 'invalid_project_ref' };
+  if (!pat || typeof pat !== 'string' || pat.trim().length < 20) {
+    return { ok: false, error: 'invalid_access_token' };
+  }
+  let res;
+  try {
+    res = await fetch(`${MANAGEMENT_API}/v1/projects/${projectRef}/database/query`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${pat.trim()}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ query: CLOUD_SCHEMA_SQL }),
+      redirect: 'error',
+      signal: AbortSignal.timeout(30000),
+    });
+  } catch {
+    return { ok: false, error: 'unreachable' };
+  }
+  if (res.ok) return { ok: true };
+  // Map the few cases the operator can act on; never echo the upstream body.
+  if (res.status === 401 || res.status === 403) return { ok: false, error: 'unauthorized_token' };
+  if (res.status === 404) return { ok: false, error: 'project_not_found' };
+  return { ok: false, error: `apply_failed_${res.status}` };
+}

package/lib/db.js

@@ -182,6 +182,10 @@ export function getDb() {
     // project (manual or by a mines agent) are pinned to this space so they
     // surface as windows on the dashboard board.
     'ALTER TABLE mines_projects ADD COLUMN default_space_id TEXT',
+    // Chat live-turn continuity: resume an in-flight main-agent turn after the
+    // user navigates away and returns. active_turn_started_at gates a TTL.
+    'ALTER TABLE chat_sessions ADD COLUMN active_turn_id TEXT',
+    'ALTER TABLE chat_sessions ADD COLUMN active_turn_started_at TEXT',
   ]) {
     try { db.exec(sql); } catch (err) {
       if (!/duplicate column name/i.test(String(err?.message || err))) throw err;

package/lib/delegation-contracts.js

@@ -72,6 +72,7 @@ export const LIVE_EVENT_TYPES = [
   'agent.run.status',
   'agent.run.event',
   'agent.run.log',
+  'chat_turn',
 ];
 
 const LEGAL_TASK_TRANSITIONS = {

package/lib/orchestrator-broadcast.js

@@ -0,0 +1,126 @@
+// Phase 2 of chat live continuity: a process-local broadcaster that decouples a
+// running orchestrator turn from the HTTP request that started it.
+//
+// While a turn streams, the route mirrors every SSE event here via `publish`.
+// A client that navigates away and back (or opens a second tab) reconnects to
+// `/api/orchestrator/stream/attach`, which `subscribe`s with the last sequence
+// it saw: the broadcaster replays the buffered tail, then streams live events
+// until the turn ends. On `endTurn` the entry is retained briefly so a client
+// reconnecting right at the finish still gets the terminal `__end`.
+//
+// Local-first / single-process: state is in-memory, keyed off globalThis so it
+// survives Next.js HMR. If the process restarts mid-turn the buffer is lost —
+// Phase 1's persisted per-turn messages + TTL flag are the durable fallback.
+
+const RETENTION_MS = Number(process.env.MADARX_TURN_BUFFER_RETENTION_MS) || 30000;
+const MAX_BUFFER = Number(process.env.MADARX_TURN_BUFFER_MAX) || 1000;
+// Per-session live-subscriber cap. Single-user local-first app: a handful of
+// tabs is the realistic ceiling. Guards against a client loop opening unbounded
+// attach connections. Mirrors the MAX_SUBSCRIBERS discipline in events/stream.
+const MAX_SUBSCRIBERS = Number(process.env.MADARX_TURN_MAX_SUBSCRIBERS) || 8;
+
+function registry() {
+  if (!globalThis.__madarxTurnBroadcast) {
+    globalThis.__madarxTurnBroadcast = new Map(); // session_id -> turn
+  }
+  return globalThis.__madarxTurnBroadcast;
+}
+
+// Fan a control/event frame out to every subscriber. Subscribers receive
+// { seq, event, data } where event '__end' is the terminal frame.
+function fanout(turn, frame) {
+  for (const cb of turn.subscribers) {
+    try { cb(frame); } catch { /* one bad subscriber can't break the turn */ }
+  }
+}
+
+// Begin (or replace) the live turn for a session. If a prior turn is still
+// live for this session it is ended first so its subscribers detach cleanly.
+export function beginTurn(sessionId, turnId) {
+  if (!sessionId || !turnId) return;
+  const reg = registry();
+  const existing = reg.get(sessionId);
+  if (existing && existing.status === 'live' && existing.turnId !== turnId) {
+    endTurn(sessionId, existing.turnId);
+  }
+  reg.set(sessionId, {
+    turnId,
+    seq: 0,
+    buffer: [],
+    subscribers: new Set(),
+    status: 'live',
+    cleanupTimer: null,
+  });
+}
+
+// Mirror one SSE event into the turn buffer + live subscribers. `data` is kept
+// in its raw form (string or object) exactly as the route's emit() passes it,
+// so attach can re-serialise it identically.
+export function publish(sessionId, turnId, event, data) {
+  const turn = registry().get(sessionId);
+  if (!turn || turn.turnId !== turnId || turn.status !== 'live') return;
+  const frame = { seq: ++turn.seq, event, data };
+  turn.buffer.push(frame);
+  if (turn.buffer.length > MAX_BUFFER) turn.buffer.shift();
+  fanout(turn, frame);
+}
+
+// End the live turn. Emits a terminal `__end` frame, then schedules the entry
+// for deletion after RETENTION_MS (idempotent; a new turn cancels it).
+export function endTurn(sessionId, turnId) {
+  const reg = registry();
+  const turn = reg.get(sessionId);
+  if (!turn || turn.turnId !== turnId) return;
+  if (turn.status === 'live') {
+    turn.status = 'done';
+    const frame = { seq: ++turn.seq, event: '__end', data: {} };
+    turn.buffer.push(frame);
+    fanout(turn, frame);
+    turn.subscribers.clear();
+  }
+  if (turn.cleanupTimer) clearTimeout(turn.cleanupTimer);
+  turn.cleanupTimer = setTimeout(() => {
+    const cur = reg.get(sessionId);
+    if (cur && cur.turnId === turnId) reg.delete(sessionId);
+  }, RETENTION_MS);
+  if (typeof turn.cleanupTimer?.unref === 'function') turn.cleanupTimer.unref();
+}
+
+// Snapshot of the active turn for a session, or null. `lastSeq` lets a caller
+// decide whether it already has everything.
+export function getActiveTurn(sessionId) {
+  const turn = registry().get(sessionId);
+  if (!turn) return null;
+  return { turnId: turn.turnId, status: turn.status, lastSeq: turn.seq };
+}
+
+// Subscribe to a turn, replaying buffered frames with seq > fromSeq first, then
+// streaming live ones. Returns an unsubscribe fn. If the turn is already done,
+// replays the tail (incl. `__end`) and does not register a live listener.
+export function subscribe(sessionId, fromSeq, cb) {
+  const turn = registry().get(sessionId);
+  if (!turn) return () => {};
+  const from = Number.isFinite(fromSeq) ? fromSeq : 0;
+  for (const frame of turn.buffer) {
+    if (frame.seq > from) {
+      try { cb(frame); } catch { /* ignore */ }
+    }
+  }
+  if (turn.status !== 'live') return () => {};
+  if (turn.subscribers.size >= MAX_SUBSCRIBERS) {
+    // At capacity: the caller still got the buffered replay above; it just
+    // won't receive live tail frames. Better than leaking unbounded listeners.
+    return () => {};
+  }
+  turn.subscribers.add(cb);
+  return () => { turn.subscribers.delete(cb); };
+}
+
+// Test helper — wipe all turns.
+export function __resetTurnBroadcast() {
+  const reg = registry();
+  for (const turn of reg.values()) {
+    if (turn.cleanupTimer) clearTimeout(turn.cleanupTimer);
+  }
+  reg.clear();
+}

package/lib/public-url.js

@@ -0,0 +1,89 @@
+/**
+ * lib/public-url.js — the canonical public base URL of this install.
+ *
+ * Invite links and share links get COPIED and sent to other people, so they must
+ * point at a URL the recipient can actually reach — not `window.location.origin`
+ * of whoever generated them (which is `http://localhost:8787` in dev). This is
+ * the single source of truth for that base URL.
+ *
+ * Precedence:
+ *   config table  `public_base_url`   (UI-settable from Settings → Team)
+ *   → env  MADARX_PUBLIC_URL / MADARX_PUBLIC_SHARE_BASE_URL / NEXT_PUBLIC_SHARE_BASE_URL / NEXT_PUBLIC_SITE_URL
+ *   → ''   (callers fall back to the request origin)
+ *
+ * Server-only (reads the config table via lib/config.js). For client code, the
+ * value is surfaced through GET /api/auth/config.
+ */
+
+import { getConfig, setConfig } from './config.js';
+
+export const PUBLIC_BASE_URL_KEY = 'public_base_url';
+
+const ENV_KEYS = [
+  'MADARX_PUBLIC_URL',
+  'MADARX_PUBLIC_SHARE_BASE_URL',
+  'NEXT_PUBLIC_SHARE_BASE_URL',
+  'NEXT_PUBLIC_SITE_URL',
+];
+
+function clean(raw) {
+  if (!raw || !String(raw).trim()) return '';
+  const value = String(raw).trim().replace(/\/+$/, '');
+  return /^https?:\/\//i.test(value) ? value : '';
+}
+
+/** True for a syntactically valid http(s) URL. */
+export function isValidPublicUrl(raw) {
+  const v = clean(raw);
+  if (!v) return false;
+  try {
+    new URL(v);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** The configured public base URL, or '' when none is set. Never trailing-slashed. */
+export function getPublicBaseUrl() {
+  try {
+    const stored = clean(getConfig(PUBLIC_BASE_URL_KEY, null));
+    if (stored) return stored;
+  } catch {
+    // config table not ready (very early boot) — fall through to env.
+  }
+  for (const key of ENV_KEYS) {
+    const v = clean(process.env[key]);
+    if (v) return v;
+  }
+  return '';
+}
+
+/**
+ * Persists the public base URL (UI-driven). Pass '' to clear it (fall back to
+ * env / request origin). Throws on a non-http(s) value.
+ */
+export function setPublicBaseUrl(raw) {
+  const trimmed = raw == null ? '' : String(raw).trim();
+  if (trimmed === '') {
+    setConfig(PUBLIC_BASE_URL_KEY, '');
+    return '';
+  }
+  if (!isValidPublicUrl(trimmed)) {
+    throw new Error('public app URL must be a valid http(s) URL, e.g. https://madarx.io');
+  }
+  const value = clean(trimmed);
+  setConfig(PUBLIC_BASE_URL_KEY, value);
+  return value;
+}
+
+/**
+ * Joins a path onto the public base URL. Returns the bare path when no base is
+ * configured, so callers can prepend the request origin as a fallback.
+ */
+export function publicUrl(path) {
+  const p = String(path || '');
+  const normalizedPath = p.startsWith('/') ? p : `/${p}`;
+  const base = getPublicBaseUrl();
+  return base ? `${base}${normalizedPath}` : normalizedPath;
+}

package/lib/runtime.js

@@ -1483,8 +1483,20 @@ function processesSnapshot(projectId) {
 
 // ── Chat sessions ─────────────────────────────────────────────────────────────
 
+// A live turn older than this is treated as stale (server crashed mid-turn
+// without clearing the flag), so the session reports idle and self-heals.
+const ACTIVE_TURN_TTL_MS = Number(process.env.MADARX_ACTIVE_TURN_TTL_MS) || 900000; // 15min
+
+function isActiveTurnFresh(startedAt) {
+  if (!startedAt) return false;
+  const started = Date.parse(startedAt);
+  if (Number.isNaN(started)) return false;
+  return (Date.now() - started) < ACTIVE_TURN_TTL_MS;
+}
+
 function rowToChatSession(row) {
   if (!row) return null;
+  const fresh = isActiveTurnFresh(row.active_turn_started_at);
   return {
     id: row.id,
     title: row.title,
@@ -1497,6 +1509,10 @@ function rowToChatSession(row) {
     total_cache_read_tokens: row.total_cache_read_tokens,
     total_cache_creation_tokens: row.total_cache_creation_tokens,
     last_context_tokens: row.last_context_tokens,
+    // Only surface the turn id while it is fresh — a stale flag reads as idle.
+    active_turn_id: fresh ? (row.active_turn_id || null) : null,
+    active_turn_started_at: fresh ? (row.active_turn_started_at || null) : null,
+    agent_working: fresh && Boolean(row.active_turn_id),
   };
 }
 
@@ -1613,6 +1629,28 @@ export function appendChatMessage(session_id, {
   return { id, session_id, role, at };
 }
 
+// Mark a chat session as having a live (streaming) turn in flight, or clear it.
+// Pass a turnId to begin, null to end. Idempotent and best-effort: a missing
+// session row is a no-op (it may have been deleted mid-turn).
+export function setSessionActiveTurn(session_id, turnId) {
+  if (!session_id) return { ok: false };
+  const db = getDb();
+  try {
+    if (turnId) {
+      db.prepare(
+        'UPDATE chat_sessions SET active_turn_id = ?, active_turn_started_at = ? WHERE id = ?'
+      ).run(String(turnId), nowIso(), session_id);
+    } else {
+      db.prepare(
+        'UPDATE chat_sessions SET active_turn_id = NULL, active_turn_started_at = NULL WHERE id = ?'
+      ).run(session_id);
+    }
+    return { ok: true };
+  } catch {
+    return { ok: false };
+  }
+}
+
 export function renameChatSession(id, title) {
   const db = getDb();
   const t = String(title || '').slice(0, 200);

package/lib/schema.js

@@ -516,7 +516,12 @@ CREATE TABLE IF NOT EXISTS chat_sessions (
   total_output_tokens INTEGER NOT NULL DEFAULT 0,
   total_cache_read_tokens INTEGER NOT NULL DEFAULT 0,
   total_cache_creation_tokens INTEGER NOT NULL DEFAULT 0,
-  last_context_tokens INTEGER NOT NULL DEFAULT 0
+  last_context_tokens INTEGER NOT NULL DEFAULT 0,
+  -- Live-turn continuity: set while an orchestrator turn is streaming for this
+  -- session, cleared when it finishes. active_turn_started_at gates a TTL so a
+  -- crashed turn self-heals to "idle" instead of pinning the flag forever.
+  active_turn_id TEXT,
+  active_turn_started_at TEXT
 );
 
 CREATE TABLE IF NOT EXISTS whatsapp_messages (

package/lib/share-url.js

@@ -1,21 +1,13 @@
-const SHARE_BASE_ENV_KEYS = [
-  'MADARX_PUBLIC_SHARE_BASE_URL',
-  'NEXT_PUBLIC_SHARE_BASE_URL',
-  'NEXT_PUBLIC_SITE_URL',
-];
+/**
+ * lib/share-url.js — share-link URL builder.
+ *
+ * Thin back-compat wrapper over lib/public-url.js (the single source of truth
+ * for this install's public base URL, now UI-settable from Settings → Team).
+ * Kept so existing imports of `publicShareUrl` keep working.
+ */
 
-function normalizedBaseUrl() {
-  for (const key of SHARE_BASE_ENV_KEYS) {
-    const raw = process.env[key];
-    if (!raw || !String(raw).trim()) continue;
-    const value = String(raw).trim().replace(/\/+$/, '');
-    if (/^https?:\/\//i.test(value)) return value;
-  }
-  return '';
-}
+import { publicUrl } from './public-url.js';
 
 export function publicShareUrl(path) {
-  const normalizedPath = String(path || '').startsWith('/') ? String(path || '') : `/${path || ''}`;
-  const base = normalizedBaseUrl();
-  return base ? `${base}${normalizedPath}` : normalizedPath;
+  return publicUrl(path);
 }

package/middleware.js

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server';
 import { createServerClient } from '@supabase/ssr';
+import { resolveEnvAuthConfig } from './lib/auth-env-fastpath.js';
 
 const PUBLIC_PREFIXES = [
   '/login',
@@ -59,18 +60,14 @@ function safeNext(pathname, search) {
 
 // Runs in the Edge runtime — cannot read node:sqlite. Resolves the UI-driven
 // auth config via the public /api/auth/config route, cached briefly in module
-// scope. An explicit MADARX_AUTH_MODE env value is the fast-path backstop.
+// scope. An explicit MADARX_AUTH_MODE env value WITH resolvable creds is the
+// fast-path backstop (resolveEnvAuthConfig); mode-without-creds defers to the
+// fetch so vault-stored keys still resolve.
 let _cfgCache = { at: 0, data: null };
 
 async function resolveAuthConfig(request) {
-  const envRaw = (process.env.MADARX_AUTH_MODE || '').trim().toLowerCase();
-  if (envRaw === 'local' || envRaw === 'supabase') {
-    return {
-      authMode: envRaw,
-      supabaseUrl: process.env.NEXT_PUBLIC_SUPABASE_URL || null,
-      supabaseAnonKey: process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || null,
-    };
-  }
+  const fromEnv = resolveEnvAuthConfig(process.env);
+  if (fromEnv) return fromEnv;
   const now = Date.now();
   if (_cfgCache.data && now - _cfgCache.at < 10_000) return _cfgCache.data;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madarx",
-  "version": "2.18.0",
+  "version": "2.19.0",
   "type": "module",
   "description": "Madarx OS — Next.js product with SQLite-backed runtime, scheduled cron daemon, and approval-gated local runners.",
   "license": "MIT",
@@ -44,6 +44,8 @@
     "prepublishOnly": "npm run build && node --no-warnings scripts/prepack-guard.mjs",
     "prepack": "node --no-warnings scripts/prepack-guard.mjs",
     "clean:dist-data": "node --no-warnings scripts/prepack-guard.mjs",
+    "build:cloud-schema": "node --no-warnings scripts/build-cloud-schema.mjs",
+    "prebuild": "node --no-warnings scripts/build-cloud-schema.mjs",
     "build": "NODE_OPTIONS=--no-warnings next build",
     "postbuild": "node --no-warnings scripts/postbuild-standalone.mjs",
     "postinstall": "node --no-warnings scripts/postinstall-splash.mjs",

package/scripts/build-cloud-schema.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * scripts/build-cloud-schema.mjs — generate the shipped cloud-schema bundle.
+ *
+ * WHY THIS EXISTS
+ *   The onboarding wizard needs to (a) show the operator the exact SQL that
+ *   stands up the Supabase shared layer, and (b) apply it one-click via the
+ *   Management API. The canonical SQL lives in supabase/migrations/*.sql — but
+ *   `supabase/` is NOT in package.json `files`, so a global install never ships
+ *   those files. This script concatenates the migrations (in deterministic
+ *   order) into lib/cloud-schema.generated.js, which DOES ship (lib/ is
+ *   whitelisted). The migrations stay the single source of truth; this is a
+ *   build artifact, regenerated on every `prebuild`.
+ *
+ * OUTPUT
+ *   lib/cloud-schema.generated.js exporting:
+ *     - CLOUD_SCHEMA_SQL  : one idempotent SQL script (all migrations, ordered)
+ *     - REQUIRED_TABLES   : the public.* tables the script creates
+ *     - SCHEMA_VERSION    : short content hash (changes when the SQL changes)
+ *     - MIGRATION_FILES   : the source filenames, in applied order
+ *
+ * Run: node scripts/build-cloud-schema.mjs   (also wired into `prebuild`)
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(here, '..');
+const MIGRATIONS_DIR = path.join(ROOT, 'supabase', 'migrations');
+const OUT_FILE = path.join(ROOT, 'lib', 'cloud-schema.generated.js');
+
+function main() {
+  if (!fs.existsSync(MIGRATIONS_DIR)) {
+    console.error(`[build-cloud-schema] migrations dir not found: ${MIGRATIONS_DIR}`);
+    process.exit(1);
+  }
+
+  // Deterministic order: lexical filename sort. The migrations are numbered and
+  // every statement is idempotent (CREATE … IF NOT EXISTS, drop-then-create
+  // policies), so concatenation in this order is safe to run as one script.
+  const files = fs
+    .readdirSync(MIGRATIONS_DIR)
+    .filter((f) => f.endsWith('.sql'))
+    .sort((a, b) => a.localeCompare(b));
+
+  if (!files.length) {
+    console.error('[build-cloud-schema] no .sql migrations found');
+    process.exit(1);
+  }
+
+  const parts = [];
+  parts.push('-- MadarX OS — Supabase shared-layer schema (generated bundle).');
+  parts.push('-- Generated from supabase/migrations/*.sql — DO NOT EDIT THE BUNDLE.');
+  parts.push('-- Idempotent: safe to run repeatedly in the Supabase SQL editor.');
+  parts.push('');
+
+  for (const file of files) {
+    const sql = fs.readFileSync(path.join(MIGRATIONS_DIR, file), 'utf8').trim();
+    parts.push(`-- ════════════════════════════════════════════════════════════════════`);
+    parts.push(`-- ▶ ${file}`);
+    parts.push(`-- ════════════════════════════════════════════════════════════════════`);
+    parts.push(sql);
+    parts.push('');
+  }
+
+  // Ask PostgREST to reload its schema cache so freshly-created tables are
+  // queryable immediately (the readiness probe hits PostgREST). Supabase also
+  // reloads via DDL event triggers, but this makes manual SQL-editor runs and
+  // Management-API applies verifiable without a wait.
+  parts.push('-- Refresh the PostgREST schema cache so new tables are visible now.');
+  parts.push("notify pgrst, 'reload schema';");
+  parts.push('');
+
+  const bundle = parts.join('\n');
+
+  // Parse the public.* tables the bundle creates so REQUIRED_TABLES stays in
+  // sync with the SQL automatically.
+  const tableRe = /create\s+table\s+(?:if\s+not\s+exists\s+)?public\.([a-z_][a-z0-9_]*)/gi;
+  const tables = new Set();
+  let m;
+  while ((m = tableRe.exec(bundle)) !== null) tables.add(m[1]);
+  const requiredTables = [...tables].sort();
+
+  const version = createHash('sha256').update(bundle).digest('hex').slice(0, 12);
+
+  const out =
+`/**
+ * lib/cloud-schema.generated.js — GENERATED. DO NOT EDIT BY HAND.
+ *
+ * Produced by scripts/build-cloud-schema.mjs from supabase/migrations/*.sql.
+ * Regenerate with: node scripts/build-cloud-schema.mjs  (runs on \`prebuild\`).
+ */
+
+/** The full idempotent SQL that stands up the Supabase shared layer. */
+export const CLOUD_SCHEMA_SQL = ${JSON.stringify(bundle)};
+
+/** Tables the bundle creates — used to probe whether the schema is applied. */
+export const REQUIRED_TABLES = ${JSON.stringify(requiredTables)};
+
+/** Source migration filenames, in applied order. */
+export const MIGRATION_FILES = ${JSON.stringify(files)};
+
+/** Short content hash; changes whenever the bundled SQL changes. */
+export const SCHEMA_VERSION = ${JSON.stringify(version)};
+`;
+
+  fs.writeFileSync(OUT_FILE, out, 'utf8');
+  console.log(
+    `[build-cloud-schema] wrote ${path.relative(ROOT, OUT_FILE)} ` +
+    `(${files.length} migrations, ${requiredTables.length} tables, ` +
+    `${bundle.length} bytes SQL, version ${version})`
+  );
+}
+
+main();