PR7: Real Supabase + real Anthropic; harden remaining mocks

[Regantih]

PR7: Real Supabase + real Anthropic; harden remaining mocks

Supersedes #4, #5 (backend), #6.
Single-merge ship of: intake parser + chat memo + auth/upload/RLS + real-wire.
Branch pr7/real-wire cut from pr7/auth-upload-db — all predecessor changes included.

---

What's built in this PR

Real services (wired — no mocks in production path)

Service	Implementation	Credential
Supabase Auth (magic link + GitHub OAuth)	app/(auth)/, middleware.ts, app/auth/callback/	NEXT_PUBLIC_SUPABASE_URL + key
Supabase DB + RLS (4 migrations)	supabase/migrations/000001–000004	SUPABASE_SECRET_KEY
Supabase Storage (deal-uploads)	lib/storage.supabase.ts → SupabaseStorageClient	SUPABASE_SECRET_KEY
Anthropic LLM (MVI router)	lib/llm.anthropic.ts → AnthropicModelRouter (SDK 0.95.1)	ANTHROPIC_API_KEY
Jobs queue (SELECT FOR UPDATE SKIP LOCKED)	lib/jobs.supabase.ts → SupabaseJobsQueue	SUPABASE_SECRET_KEY
Jobs worker (generic_webpage)	app/api/jobs/worker/route.ts	WORKER_SECRET
Path B ingest route (queue side)	app/api/ingest-link/route.ts	—
Health check	app/api/health/route.ts	—
File upload (Path A)	app/api/upload/route.ts	inherited
Usage limits	app/api/usage/route.ts	inherited

Stubbed services (throw clear error until credentials added)

Service	Stub	Missing credential
Google Drive	lib/connectors/google-drive.ts	GOOGLE_OAUTH_CLIENT_ID/SECRET
Dropbox	lib/connectors/dropbox.ts	DROPBOX_APP_KEY/SECRET
Stripe	lib/stripe.ts	STRIPE_SECRET_KEY/WEBHOOK/PRICE

Dev-only mocks (throw in production if USE_MOCKS ≠ true)

• lib/llm.mock.ts — MockModelRouter
• lib/storage.mock.ts — MockStorageClient
• api/ingest-queue.mock.ts — MockIngestQueue

Ported from predecessors (already in this branch)

All content from PR #4 (path-b + swarm), PR #5 (chat memo), PR #6 (auth + DB) is included and upgraded.

Package pins (two critical build fixes)

• @anthropic-ai/sdk: 0.95.1 — ^0.39.0 had no matching npm releases
• @supabase/supabase-js: 2.49.4 — ^2.49.4 resolved to 2.105.4 which ships @supabase/postgrest-js@2.105.4; that version changed GenericTable to require Relationships: GenericRelationship[], breaking .from().select() type inference in strict TS mode

---

What's still pending after this PR

• POST /api/runs — swarm run trigger (create deal_runs row → SwarmOrchestrator.run() → persist CostLedger)
• Cost ledger DB persistence (cost_ledger table exists; no write path yet)
• Cost transparency UI reading from DB
• Free-trial enforcement UI (API works; no UI block)
• Google Drive connector (needs GOOGLE_OAUTH_CLIENT_ID/SECRET)
• Dropbox connector (needs DROPBOX_APP_KEY/SECRET)
• Stripe billing + paywall screen
• Vercel Cron for jobs worker (vercel.json)
• PR PR4: rendering, exhibits, cost transparency #5 (rendering) re-targeted to main after this merges

---

DB migrations (apply before/after merge)

npx supabase link --project-ref <your-project-ref>
npx supabase db push
# Applies: 000001_init, 000002_rls, 000003_storage, 000004_jobs

---

How to verify

1. Health check (tests Supabase + Anthropic live)

curl https://your-app.vercel.app/api/health
# Expected 200: { "supabase": "ok", "anthropic": "ok", "version": "0.5.0", "commit": "<sha>" }

2. Sign up / log in

Visit: https://your-app.vercel.app/login
Action: Enter email → receive magic link → click to sign in
Expected: Session established, redirect to /deals.html

3. Upload a file

# Requires a valid session cookie + a real deal UUID in the DB
curl -X POST https://your-app.vercel.app/api/upload \
  -H "Cookie: <session-cookie>" \
  -F "deal_id=<uuid>" \
  -F "file=@pitch-deck.pdf"
# Expected: { "ok": true, "file": { "id": "...", "storage_path": "deals/..." } }

4. Jobs worker (empty queue)

curl -X POST https://your-app.vercel.app/api/jobs/worker \
  -H "Authorization: Bearer $WORKER_SECRET"
# Expected: { "ok": true, "processed": 0, "detail": "No queued jobs." }

5. Ingest a generic URL (Path B)

curl -X POST https://your-app.vercel.app/api/ingest-link \
  -H "Content-Type: application/json" \
  -H "Cookie: <session-cookie>" \
  -d '{ "url": "https://techcrunch.com/2025/05/01/ai-funding/", "deal_id": "<uuid>" }'
# Expected: { "ok": true, "job_id": "<uuid>", "source_type": "generic_webpage" }

6. Run the swarm

# Will be enabled once POST /api/runs is built (next PR)

7. Type-check

npm run type-check       # 0 errors expected
npm run type-check:lib   # 0 errors expected

---

Vercel build status

Local build: ✅ Verified clean — npx next build passes with 0 TypeScript errors across all 10 routes + middleware (Node 22, TypeScript strict).
Vercel preview: 🔴 Failing — likely a Vercel project configuration issue not visible without credentials.
Diagnostic command: npx vercel inspect dpl_J2WJd4QgXa1M1wJf3W3e2XgQWWxG --logs

---

Acceptance checklist

• AnthropicModelRouter — reads real response.usage tokens, computes USD, appends to CostLedger
• AnthropicModelRouter — throws 'ANTHROPIC_API_KEY missing...' if key absent
• SupabaseJobsQueue — claimNext() uses claim_next_job() RPC (SELECT FOR UPDATE SKIP LOCKED)
• GET /api/health — pings Supabase + Anthropic; 200 when both ok, 503 when either fails
• POST /api/ingest-link — auth-checks, ownership-checks, enqueues to real SupabaseJobsQueue
• POST /api/jobs/worker — queued→running→done/failed; generic_webpage fetches + stores HTML
• supabase/migrations/20260510000004_jobs.sql — jobs table + claim_next_job() RPC + RLS
• Google Drive / Dropbox / Stripe stubs — throw clear error until credentials set
• Mock guards — all mocks throw in production unless USE_MOCKS=true
• USE_MOCKS fallback removed for Supabase and Anthropic paths
• @anthropic-ai/sdk pinned to 0.95.1; @supabase/supabase-js pinned to 2.49.4
• No fake data, no [MOCK] in production paths, no placeholder URLs, no real secrets

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
deallenz	Ready	Preview, Comment	May 10, 2026 8:02am