feat(sync)!: migrate backend from Cloudflare Workers to Supabase

[vscarpenter]

Summary

• Complete backend migration from Cloudflare Workers (D1/KV/custom OIDC) to Supabase (Auth + Postgres + Realtime + PostgREST)
• Net deletion of ~22,500 lines — removes entire worker/ directory, custom OAuth handshake, token manager, vector clocks, health monitor, and all associated tests
• Adds 5 new modules: Supabase client singleton, sync client, realtime listener, auth dialog, and OAuth buttons
• MCP server updated to query Supabase directly via service role key instead of custom JWT auth

What Changed

Replaced

Before (Cloudflare)	After (Supabase)
Custom OIDC OAuth flow	Supabase Auth (Google/Apple)
D1 database + KV storage	Supabase Postgres with RLS
Polling-based sync	Supabase Realtime (WebSocket)
Custom API client + JWT	Supabase SDK direct calls
Vector clocks for conflicts	Last-write-wins (server updated_at)

Removed

• worker/ — entire Cloudflare Worker backend (~150 files)
• Custom OAuth handshake modules (lib/sync/oauth-handshake/)
• Token manager, health monitor, vector clocks, API client
• All tests for removed modules

Added

• lib/supabase.ts — Supabase client singleton
• lib/sync/supabase-sync-client.ts — CRUD operations via Supabase SDK
• lib/sync/realtime-listener.ts — WebSocket subscription manager
• components/sync/supabase-auth-dialog.tsx — Auth UI
• components/sync/supabase-oauth-buttons.tsx — Google/Apple OAuth buttons

Verification

• Sync tested locally — 47 tasks successfully pushed with E2E encryption
• All encrypted blobs have valid nonce + checksum fields
• Zero conflicts in conflict_log
• RLS enabled on all 5 tables (profiles, encrypted_tasks, devices, sync_metadata, conflict_log)

Test plan

• Local sync push verified (47 tasks encrypted and synced)
• Supabase database integrity verified via SQL queries
• Multi-device sync with realtime updates
• OAuth sign-in flow (Google/Apple)
• MCP server queries with new Supabase config
• Build passes (bun run build)

Breaking Changes

Sync backend changed from Cloudflare Workers to Supabase. Users must:

1. Re-authenticate via Supabase Auth
2. Set NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY env vars

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE