chore: update supabase config, docs, deps, and security overrides

Author: gaboesquivel

apps/api/README.md

@@ -6,6 +6,8 @@ Type-safe REST API built with Fastify & OpenAPI. Routes in `src/routes/` are the
 
 Start database first (`pnpm db:start`), then `pnpm dev`. Uses Supabase CLI for PostgreSQL, or `PGLITE=true` for in-memory. Dev server at [http://localhost:3000](http://localhost:3000).
 
+**Switching project_id:** If you change `project_id` in `supabase/config.toml` (e.g. after a rebrand), run `pnpm db:stop` before `pnpm db:start`—only one Supabase instance runs per host.
+
 ## Vercel
 
 Uses `framework: "fastify"` in vercel.json. Vercel auto-detects `server.ts` as the entrypoint. PostgreSQL migrations run at build time; PGLite migrations run at runtime.
@@ -30,9 +32,9 @@ Copy `.env.test.example` to `.env.test` (gitignored) for unit tests. Vitest load
 - `pnpm test:e2e:debug` — Debug E2E tests
 - `pnpm checktypes` — Type-check
 - `pnpm db:start` — Start Supabase (local)
-- `pnpm db:stop` — Stop Supabase
-- `pnpm db:reset` — Reset Supabase database (recreates from scratch)
-- `pnpm db:reset-and-migrate` — Reset DB then run Drizzle migrations
+- `pnpm db:stop` — Stop Supabase (run before switching to another project’s Supabase)
+- `pnpm db:reset` — Reset Supabase database (drops and recreates; no Supabase seed.sql)
+- `pnpm db:reset-and-migrate` — Reset DB, then run Drizzle migrations. Seeding via Drizzle (no Supabase seed.sql)
 - `pnpm db:migrate` — Run migrations (skips when PGLITE=true; use `RUN_PG_MIGRATE=true` to force PostgreSQL)
 - `pnpm db:generate` — Generate migrations from schema
 - `pnpm db:push` — Push schema (dev only)

apps/api/supabase/config.toml

@@ -2,7 +2,7 @@
 # https://supabase.com/docs/guides/local-development/cli/config
 # A string used to distinguish different Supabase projects on the same host. Defaults to the
 # working directory name when running `supabase init`.
-project_id = "basilic-fastify"
+project_id = "basilic-api"
 
 [api]
 enabled = true
@@ -59,10 +59,8 @@ schema_paths = []
 
 [db.seed]
 # If enabled, seeds the database after migrations during a db reset.
-enabled = true
-# Specifies an ordered list of seed files to load during db reset.
-# Supports glob patterns relative to supabase directory: "./seeds/*.sql"
-sql_paths = ["./seed.sql"]
+# Disabled — seeding via Drizzle (db:reset-and-migrate, seed script)
+enabled = false
 
 [db.network_restrictions]
 # Enable management of network restrictions.

apps/docu/content/docs/adrs/008-database.mdx

@@ -192,6 +192,16 @@ All platforms use the same build command pattern:
 - **Railway/Fly.io/Render**: `build: pnpm build` (runs migrations)
 - **Local dev**: PostgreSQL migrations run at build time (via `pnpm dev` → `pnpm db:migrate`), PGLite migrations run at runtime
 
+### Local database reset (Supabase + Drizzle)
+
+For local Postgres via Supabase CLI (`project_id: basilic-api` in `apps/api/supabase/config.toml`):
+
+1. **`pnpm db:reset`** — Drops and recreates the Supabase database. Supabase seeds are disabled; no `seed.sql` is used.
+2. **`pnpm db:reset-and-migrate`** — Reset, then run Drizzle migrations. Use this for a fresh schema.
+3. **Seeding** — Via Drizzle (seed script if configured), not Supabase `seed.sql`.
+
+Run `pnpm db:stop` before switching to another project's Supabase instance (e.g. different repo); only one Supabase runs per host.
+
 ### Key Benefits
 
 - **Host-agnostic**: No platform-specific code, standard npm scripts work everywhere

apps/docu/package.json

@@ -22,7 +22,7 @@
     "fumadocs-ui": "16.6.0",
     "lucide-react": "^0.564.0",
     "mermaid": "^11.12.2",
-    "next": "16.1.6",
+    "next": "16.1.7",
     "next-themes": "^0.4.6",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",

apps/web/.env.development

@@ -9,4 +9,6 @@ LOG_ENABLED=true
 LOG_LEVEL=debug
 
 # Google One Tap (client-side). Same value as Fastify GOOGLE_CLIENT_ID.
-NEXT_PUBLIC_GOOGLE_CLIENT_ID=767744818103-5vme8soap4h1p6hmactlv4gr54n0qvbd.apps.googleusercontent.com
+NEXT_PUBLIC_GOOGLE_CLIENT_ID=767744818103-5vme8soap4h1p6hmactlv4gr54n0qvbd.apps.googleusercontent.com
+
+

apps/web/package.json

@@ -56,7 +56,7 @@
     "import-in-the-middle": "^3.0.0",
     "jose": "^6.1.3",
     "lucide-react": "^0.564.0",
-    "next": "16.1.6",
+    "next": "16.1.7",
     "next-themes": "^0.4.6",
     "nuqs": "^2.8.8",
     "react": "^19.2.4",

package.json

@@ -61,6 +61,13 @@
     ],
     "overrides": {
       "lightningcss": "1.30.1",
+      "flatted@<3.4.2": "3.4.2",
+      "h3@<1.15.9": "1.15.9",
+      "socket.io-parser@4.2.5": "4.2.6",
+      "undici@5.28.4": "6.24.0",
+      "undici@6.23.0": "6.24.0",
+      "undici@7.22.0": "7.24.0",
+      "next@16.1.6": "16.1.7",
       "tar@<7.5.11": "7.5.11",
       "basic-ftp@<5.2.0": "5.2.0",
       "bn.js@4.12.2": "4.12.3",
@@ -83,7 +90,7 @@
     "@isaacs/brace-expansion@5.0.0": "5.0.1",
     "esbuild@<0.25.0": ">=0.25.0",
     "path-to-regexp@<6.3.0": ">=6.3.0",
-    "next@<16.1.5": ">=16.1.5",
+    "next@<16.1.7": ">=16.1.7",
     "lodash@<4.17.23": ">=4.17.23",
     "lodash-es@<4.17.23": ">=4.17.23",
     "@tootallnate/once@<3.0.1": "3.0.1"