Merge pull request #787

# Conflicts:
#	.github/workflows/migration-drift-check.yml
#	CONTRIBUTING.md
#	backend/migrations/_archived/add_pause_columns.sql
#	backend/migrations/_archived/create_audit_logs.sql
#	backend/migrations/_archived/create_renewal_tables.sql
#	backend/migrations/_archived/create_team_invitations.sql

Author: Codex

.github/workflows/ci.yml

@@ -268,8 +268,8 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: client/package-lock.json
 
       - name: Audit client dependencies
@@ -420,7 +420,7 @@ jobs:
 
       - name: Install backend dependencies
         working-directory: backend
-        run: npm ci
+        run: npm install
 
       - name: Run backend tests
         working-directory: backend

.github/workflows/database.yml

@@ -4,13 +4,13 @@ on:
   push:
     branches: [main, develop]
     paths:
-      - 'supabase/migrations/**'
-      - 'supabase/config.toml'
+      - "supabase/migrations/**"
+      - "supabase/config.toml"
   pull_request:
     branches: [main, develop]
     paths:
-      - 'supabase/migrations/**'
-      - 'supabase/config.toml'
+      - "supabase/migrations/**"
+      - "supabase/config.toml"
 
 jobs:
   validate-migrations:
@@ -38,13 +38,13 @@ jobs:
       - name: Setup Node.js for RLS audit
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies for RLS audit
         working-directory: backend
-        run: npm ci
+        run: npm install
 
       - name: Run migration drift check against local database
         id: local-drift-check
@@ -77,4 +77,4 @@ jobs:
 
       - name: Stop Supabase local stack
         if: always()
-        run: supabase stop
+        run: if command -v supabase &> /dev/null; then supabase stop; fi

.github/workflows/lint.yml

@@ -69,7 +69,7 @@ jobs:
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies
-        run: npm ci
+        run: npm install
 
       - name: Run ESLint
         run: npx eslint src --ext .ts --max-warnings 0

.github/workflows/rls-audit.yml

@@ -4,37 +4,37 @@ on:
   push:
     branches: [main, develop]
     paths:
-      - 'supabase/migrations/**'
-      - 'backend/migrations/**'
-      - 'scripts/check-rls-compliance.js'
-      - '.github/workflows/rls-audit.yml'
+      - "supabase/migrations/**"
+      - "backend/migrations/**"
+      - "scripts/check-rls-compliance.js"
+      - ".github/workflows/rls-audit.yml"
   pull_request:
     branches: [main, develop]
     paths:
-      - 'supabase/migrations/**'
-      - 'backend/migrations/**'
-      - 'scripts/check-rls-compliance.js'
-      - '.github/workflows/rls-audit.yml'
+      - "supabase/migrations/**"
+      - "backend/migrations/**"
+      - "scripts/check-rls-compliance.js"
+      - ".github/workflows/rls-audit.yml"
 
 jobs:
   audit-rls-policies:
     name: Audit RLS Policies
     runs-on: ubuntu-latest
-    
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies
         working-directory: backend
-        run: npm ci
+        run: npm install
 
       - name: Setup Supabase CLI
         uses: supabase/setup-cli@v2
@@ -61,29 +61,29 @@ jobs:
 
       - name: Stop Supabase local stack
         if: always()
-        run: supabase stop
+        run: if command -v supabase &> /dev/null; then supabase stop; fi
 
   # Integration with main CI pipeline
   validate-rls-on-production:
     name: Validate RLS on Production Schema
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     needs: audit-rls-policies
-    
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies
         working-directory: backend
-        run: npm ci
+        run: npm install
 
       - name: Validate RLS on Production Database
         env:
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     needs: audit-rls-policies
-    
+
     steps:
       - name: Comment PR with RLS Status
         uses: actions/github-script@v9
@@ -111,4 +111,4 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: '✅ **RLS Policy Audit Passed**\n\nAll tables in the database have Row Level Security enabled with appropriate policies. Your changes maintain data security compliance.'
-            });
+            });

.github/workflows/test.yml

@@ -85,7 +85,7 @@ jobs:
           cache-dependency-path: backend/package-lock.json
 
       - name: Install dependencies
-        run: npm ci
+        run: npm install
 
       - name: Run tests with coverage
         run: npm test -- --coverage --ci

.github/workflows/typecheck.yml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
     inputs:
       force_full_run:
-        description: 'Force a full typecheck run'
+        description: "Force a full typecheck run"
         type: boolean
         default: false
 
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         package: [backend, client, sdk, shared, root]
-    
+
     if: |
       needs.changes.outputs.force_full_run == 'true' ||
       (matrix.package == 'backend' && needs.changes.outputs.backend == 'true') ||
@@ -65,15 +65,15 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
-      
+
       - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "npm"
-          
+
       - name: Install dependencies
         run: npm install
-        
+
       - name: Run Typecheck
         run: |
           if [ "${{ matrix.package }}" = "root" ]; then

CONTRIBUTING.md

@@ -229,6 +229,8 @@ supabase migration new <description>
 
 **Why `supabase/migrations/` wins:** SYNCRO uses Supabase as its database provider. The Supabase CLI is the authoritative migration runner. Any migrations run outside it will not be tracked in `supabase_migrations.schema_migrations` and can cause sync errors.
 
+**Rollback strategy:** Supabase does not support automatic down migrations. For destructive changes, document manual rollback SQL in a comment block at the top of the migration file.
+
 For rollback guidance see [docs/MIGRATION_ROLLBACK_PLAYBOOKS.md](./docs/MIGRATION_ROLLBACK_PLAYBOOKS.md).
 
 ## Package-specific guides

backend/src/dependency-vulnerability-scanning/ci.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: "20"
 
       - name: Validate client environment variables
         env:
@@ -66,13 +66,13 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: client/package-lock.json
 
       - name: Install client dependencies
         working-directory: client
-        run: npm ci --ignore-scripts
+        run: npm install --ignore-scripts
 
       - name: Security audit – client
         working-directory: client
@@ -93,8 +93,8 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: backend/package-lock.json
 
       - name: Install backend dependencies
@@ -121,13 +121,13 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: client/package-lock.json
 
       - name: Install client dependencies
         working-directory: client
-        run: npm ci
+        run: npm install
 
       - name: Build client
         working-directory: client
@@ -156,8 +156,8 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: backend/package-lock.json
 
       - name: Install backend dependencies

backend/src/dependency-vulnerability-scanning/security.yml

@@ -44,7 +44,7 @@ jobs:
 
       - name: Install client dependencies (ci — no scripts)
         working-directory: client
-        run: npm ci --ignore-scripts
+        run: npm install --ignore-scripts
 
       # --audit-level=high  → exit 1 on high or critical CVEs
       # The JSON output is saved so it can be inspected in the log even after

package.json

@@ -16,16 +16,16 @@
     "typecheck:client": "npm run typecheck -w client",
     "typecheck:sdk": "npm run typecheck -w sdk",
     "typecheck:shared": "npm run typecheck -w shared",
-    "generate:openapi": "cd backend && npm run swagger:export"
+    "generate:openapi": "cd backend && npm run swagger:export",
+    "lint:todos": "node scripts/check-todos.mjs",
+    "check:migrations": "node scripts/check-migration-drift.js",
+    "cleanup:migrations": "node scripts/cleanup-duplicate-migrations.js"
   },
   "devDependencies": {
     "@types/node": "^25.6.0"
   },
   "dependencies": {
     "@supabase/supabase-js": "^2.105.0",
     "typescript": "^6.0.3"
-  },
-  "scripts": {
-    "lint:todos": "node scripts/check-todos.mjs"
   }
 }