@lssm-tech/integration.lssm-os-provider-supabase
Authoritative Supabase adapter for the LSSM OS ProviderExecutionPort. It binds provider-neutral plans to injected management and database drivers and never reads credentials or calls Supabase directly.
The ./runtime-node export directly implements ProviderLifecyclePortV1 over closed, secret-free, digest-bound V2 commands. It reserves the exact execution fence before an effect, routes Postgres/Queues/Cron commands to the database driver and other product commands to the management driver, persists an exact V2 receipt, and replays only independently verified durable receipts. It does not load or call the legacy ProviderExecutionPort.
Management API access tokens and database credentials remain outside commands, receipts, errors, and durable state. The injected driver owns current Supabase API details and OAuth scopes. Database migrations that expect Data API access must explicitly grant the intended roles and enable matching RLS; new tables must not rely on historical automatic exposure defaults. Timed-out mutations are aborted and retained in indeterminate custody before any redelivery.
The v0 discovery/import surface covers projects, Postgres, Auth, Storage, Realtime, Edge Functions, Queues, and Cron. Every family needs explicit terminal completion evidence. Usage/billing is represented as actual, estimated, or unavailable with evidence and limitations.
Execution is reserved before effects in a durable store. Reservations bind the tenant scope, owner, lease expiry, fencing token, current step, effect digest, authorization attestation, observations, result, and receipt. Expired work can be taken over atomically; a resource-scoped high-water fence survives completion. Uncertain effects persist as indeterminate for reconciliation and never emit an unverifiable receipt. Compensation and decommission fail closed without an exact trusted prior effect and verified pre/post observations.
Each provider mutation is preceded by an atomic durable attempt marker that binds its provider idempotency key and exact mutation digest. If receipt completion cannot be confirmed, retry performs read-only reconciliation from that marker and never submits the mutation again. Deterministic delete or compensation precondition failures use a typed
no_effect attempt marker with the exact failure resolution. The externally signed terminal record binds that marker, so retry replays the failure without provider reconciliation or mutation.
All discovery pages and their family-specific resources, driver results, observations, billing records, and webhook evidence are decoded into fresh allowlisted objects before aggregation, trust, or persistence. Durable operation and resource identities use the shared runtime scope encoding plus versioned code-point length-prefixed identifiers, so delimiters and Unicode cannot alias. Ambiguous legacy keys fail migration with an explicit error. Trusted clock, receipt, trust-record, attempt, lease, and stored-row timestamps must be real canonical UTC millisecond instants ending in Z; normalized offsets, date-only values, invalid dates, and future receipts fail closed. A separate private-row issuance anchor is signed by an injected external receipt authority and bound to the operation, resource, reservation, fence, attempt, receipt, and trust record. The database stores only the Ed25519 algorithm, key reference, and signature; no signing key or recomputable row-local seal.
migrations/0001_execution_state.sql is transactional, repeatable, upgrade-safe, and tested on PGlite. It moves earlier public tables into the private
lssm_os_provider_private schema, revokes Data API roles, enables RLS, indexes tenant policy paths, and supplies SELECT plus UPDATE USING/WITH CHECK
policies. It forces RLS and grants a dedicated non-owner, non-BYPASSRLS
runtime role; detectable owner or bypass-role composition is refused. Terminal rows are immutable and legacy completions without an external signature require review. Tenant identifiers are portable nonempty text, including non-UUID runtime identities. Only a trusted server-side migration-owner connection may use it; do not expose or grant this execution-authority schema to anon or authenticated.
The ./conformance export supplies the verifier-owned V0 offline target, and
./testing provides deterministic fakes. Passing offline conformance does not claim live Supabase qualification or production certification.
bun run test:node-package extracts the publish-ready adapter tarball into a clean temporary Node consumer and imports all four declared public subpaths through Node conditions, with external packages stubbed at their module boundary.
Release follow-up: this package-scoped change intentionally does not edit the repository-root .changeset directory. The repository release owner must add the paired changeset note and release capsule before publication.
