-- Survivor TAZ cloud persistence schema
-- Run this ONCE in Supabase Dashboard -> SQL Editor for the project you want Survivor TAZ to use.
-- These table names are app-prefixed so they can safely share a Supabase project with other personal apps.

create table if not exists public.survivor_taz_state (
  workspace_id text primary key,
  revision bigint not null default 0,
  state jsonb not null default '{}'::jsonb,
  device_id text,
  updated_at timestamptz not null default now()
);

create table if not exists public.survivor_taz_events (
  id bigint generated by default as identity primary key,
  workspace_id text not null,
  revision bigint not null,
  event_type text not null,
  payload jsonb not null default '{}'::jsonb,
  device_id text,
  created_at timestamptz not null default now()
);

create index if not exists survivor_taz_events_workspace_revision_idx
  on public.survivor_taz_events (workspace_id, revision desc);

create index if not exists survivor_taz_events_workspace_created_idx
  on public.survivor_taz_events (workspace_id, created_at desc);

-- Keep browser/public clients locked out. Survivor TAZ talks to Supabase only from its Python backend.
alter table public.survivor_taz_state enable row level security;
alter table public.survivor_taz_events enable row level security;

revoke all on table public.survivor_taz_state from anon, authenticated;
revoke all on table public.survivor_taz_events from anon, authenticated;

grant select, insert, update, delete on table public.survivor_taz_state to service_role;
grant select, insert, update, delete on table public.survivor_taz_events to service_role;
grant usage, select on sequence public.survivor_taz_events_id_seq to service_role;