Database Schema

Tables, RLS, and grants.

All tables are in public, RLS-enabled, and scoped to auth.uid() = user_id.

profiles

One row per user, created automatically by trigger on signup.

Column	Type
id	uuid (= auth.users.id)
display_name	text
created_at	timestamptz

brews

Column	Type
id	uuid
user_id	uuid
title	text
brew_type	text (research/prompt/strategy/cleanse/critique)
goal, context, tone, output_format	text
status	text (steeping/ready)
final_output	jsonb
tea_score	int
created_at, updated_at	timestamptz

brew_steps

Column	Type
id	uuid
brew_id	uuid → brews.id
step_name	text (Leaves/Steep/Taste/Pour/Archive)
agent_name	text
status	text (pending/running/done)
content	jsonb
step_order	int

brew_outputs

Append-only history of refinements.

Column	Type
id	uuid
brew_id	uuid
output_type	text (refinement, etc.)
content	jsonb
created_at	timestamptz

recipes

Column	Type
id	uuid
user_id	uuid
name	text
brew_type	text
description	text
recipe_config	jsonb

cellar_entries

Durable memory distilled from finished brews, re-injected into future brew prompts.

Column	Type
id	uuid
user_id	uuid
brew_id	uuid (nullable — source brew)
kind	text (fact/preference/pattern/glossary)
content	text (≤ 280 chars)
weight	int (higher = more prominent in the prompt)
created_at	timestamptz

cellar_settings

Per-user controls for the Cellar.

Column	Type
user_id	uuid (pk)
enabled	bool
max_entries	int
manual_pack	text (always prepended to the Cellar block)

brew_shares

Public read-only links for finished brews.

Column	Type
id	uuid
brew_id	uuid → brews.id
slug	text (nanoid, unique)
created_at	timestamptz
revoked_at	timestamptz (nullable)

Anonymous read access to a shared brew goes through supabaseAdmin inside the /api/public/brew/$slug route — there are no anon grants on these tables.

RLS policies

Every table follows the same pattern:

CREATE POLICY "owners only"
ON public.<table>
FOR ALL
TO authenticated
USING (auth.uid() = user_id)
WITH CHECK (auth.uid() = user_id);

brew_steps and brew_outputs join through brews.user_id.