What we shipped

• Single sign-on for the console. Connect an OIDC provider or a SAML 2.0 identity provider under Single sign-on in the console. Verify your email domain with a DNS TXT record and people on it are sent to your IdP from the sign-in page, optionally joining with a role you choose. SAML responses are checked against your IdP certificate (signature, issuer, audience, recipient, request binding, and validity window); OIDC ID tokens against your provider's published keys. A connection test links your own IdP identity to your account, and only after a passing test can you require SSO for everyone except owners.
• scribase db pull. Dumps a remote schema, replays your local migrations into a temporary shadow database, and writes only the difference as a new migration file. Destructive changes are written commented out for review, and --mark-applied records the file in the remote migration ledger.
• Docs search. The documentation site now has full-text search (press Ctrl K or /), built from the docs themselves at build time.
• Import resume on tables without a primary key. A resumed import no longer inserts a page twice when the table has no single-column key.

Moving a backend in is now a verified, one-run move from three sources.

• Firebase importer. Firestore collections and subcollections become Postgres tables with a jsonb data column. Firebase Auth users move with their modified-scrypt password hashes, which the auth server verifies natively, so nobody resets a password. Cloud Storage buckets copy with a SHA-256 check per file.
• InstantDB importer. Every namespace, $users, and $files, with entity and user ids preserved so links keep resolving.
• Verification report, old versus new. Every import now ends with per-table source and target row counts and checksums, auth-user and storage-object counts, policy parity, and a sign-in proof. The verdict stays fail-closed.
• Console wizards for all three sources, with an optional sign-in proof.
• scribase/importers exports Firestore, Cloud Storage, and Instant apps into the folder layout the importer reads.
• New pricing. Free (2 projects, never paused), Builder $19/mo, Pro $79/mo with verified restore and SSO, and self-host support at $2,000/yr. All flat, all hard-capped.
• MCP page and Claude Code skill for the preview branch, RLS test, confirm, and merge flow.

scribase import moves a live hosted Postgres project in — schema, data, auth.users and identities, storage objects, and RLS policies — with a resumable state machine so a large import can survive an interruption.

• --dry-run prints the full inventory of what will and will not move before you commit. Run it against a real project on a call.
• User IDs preserved, so existing password logins and JWTs keep working with no forced reset.
• Signing keys are never copied — the importer issues new ones.
• A verification pass proves the import with row counts, checksums, policy parity, and a login proof.

Pricing is now stated plainly and enforced as a product rule.

• Pro is $99/mo flat; Scale is $499/mo. Verified restore, previews, custom domains, and export are included — never metered add-ons.
• A pricing calculator shows what your projects cost.
• Free projects are confirmed to never pause.

scribase export is here, and the promise is now executable.

• Produces a bundle with schema, table data, auth users, storage bytes, and policies — not just a database dump.
• Ships a checksummed manifest (sha256 over ordered artifact digests) so you can verify the bundle before trusting it.
• The boots_elsewhere acceptance test is green: an exported bundle starts up as a runnable stack.
• Available in the CLI, the /v1 API (POST /v1/…/projects/{id}/export), and the console.

Preview environments are now end to end and included in paid plans.

• Create a preview from production in under three minutes with zero cloned secrets.
• TTL expiry runs unattended in the operator's reconcile loop, so forgotten branches are swept automatically.
• data_mode and ttl are first-class on POST /v1/…/environments; extend with POST /v1/…/environments/{id}/renew.
• Usage envelope and caps are readable at GET /v1/…/environments/{id}/usage.

Restore is no longer a leap of faith.

• Every restore runs against an ephemeral target and records evidence: archive integrity, pg_restore readability, row-count parity, per-table checksums, policy parity, and a login proof against the restored copy.
• The console restore-evidence viewer renders all of it, so "the backup works" is a claim you can read, not one you take on trust.
• GET /v1/…/backups/{id} now returns the verification evidence alongside the record.
• Verified restore is included in Pro and Scale — never a $100/mo add-on.

The durable backup path is complete: a dedicated operator tool plus the /v1 backup routes.

• The scribase-backup operator binary ships create, upload (to S3-compatible object storage under content-addressed keys), and prepare-restore-target. Backup records live in durable Postgres-backed state; list, create, and restore them through the /v1 API or the console.
• Backups use PostgreSQL custom format, validate via pg_restore --list, compute SHA-256 evidence, and publish archive and manifest atomically with no-clobber links.
• GET/POST /v1/…/environments/{id}/backups and POST /v1/…/backups/{id}/restore are live and contract-tested against the OpenAPI spec.
• Every API mutation takes an idempotency key and returns an operation ID.

The first public increment: a real, durable management API.

• /v1 management API over a PostgreSQL executor covering orgs, memberships, projects, environments, operations, and audit.
• OIDC token introspection with authorization loaded from forced-RLS membership state — token metadata is never trusted for authorization.
• Ordered, checksummed, lock-guarded, idempotent migration runner. 0001 freezes.
• ORION_*/SCRIBASE_* configuration only; the API process never holds the operator or schema-migrator credential.