@realtimex/folio 0.1.2

package/docs-dev/port-from-email-automator.md

@@ -0,0 +1,32 @@
+# Folio Port Map
+
+This document maps what was intentionally inherited from `email-automator` into Folio before adding product features.
+
+## Inherited Foundations
+
+- Local desktop runtime shape: React frontend + local Express backend
+- Remote Supabase data plane with RLS-first schema and migrations
+- Hybrid API client pattern: Edge Functions + Local API
+- Dynamic Supabase config strategy: BYOK via UI/localStorage with env fallback
+- Middleware stack: auth, validation, rate-limit, centralized error handling
+- RealTimeX SDK bootstrap and provider detection service
+- Migration/version check utility pattern
+- CLI wrappers and migration script conventions
+
+## Adapted for Folio
+
+- Default local API port changed to `3006`
+- Domain models reduced to foundation tables (`user_settings`, `integrations`, `processing_jobs`, `system_logs`)
+- Processing route is scaffold-only (`/api/processing/dispatch`), no business logic
+- Edge function baseline includes only `api-v1-settings`
+
+## Explicitly Deferred
+
+- Any Folio ingestion funnel implementation
+- OCR/classification/extraction behavior
+- Rule/routing business actions
+- Calendar/ledger side effects
+
+## Why this sequence
+
+This keeps architecture parity with the proven runtime and prevents rework. Feature development can now layer on top of stable app/server/database/runtime contracts.

package/docs-dev/tech-spec.md

@@ -0,0 +1,98 @@
+# Technical Specification (Tech Spec)
+
+**Project:** Folio Core Engine
+
+## 1. System Architecture
+
+The system follows a **Pipeline Architecture**:
+`Watcher` $\rightarrow$ `Preprocessor` $\rightarrow$ `Intelligence Engine` $\rightarrow$ `Actuator`
+
+### 1.1 Component Diagram
+1.  **Watcher Service:** Python `watchdog` library monitoring local paths.
+2.  **OCR/Vision Module:** Converts PDF/Images to text/layout data.
+3.  **LLM Router:** The decision maker (OpenAI GPT-4o via API or Local Llama 3 via Ollama).
+4.  **File System Manager:** Python `shutil` / `os` for moving/renaming.
+5.  **Integration Manager:** APIs for Google Sheets, Notion, or CalDAV.
+
+## 2. Data Flow & Logic
+
+### Step 1: Ingestion & Pre-processing
+*   **Trigger:** New file detected in `/input`.
+*   **Action:**
+    *   Generate SHA-256 hash (to prevent duplicate processing).
+    *   Convert PDF to Image (for Vision models) using `pdf2image`.
+    *   **Text Extraction:** Use `Tesseract` (Local) for basic text or send Image to Multimodal LLM.
+
+### Step 2: The "Reasoning Loop" (LLM Prompt Strategy)
+*   **Input:** Raw OCR text + Image.
+*   **Prompt Structure (System Prompt):**
+    > "You are Folio, a document assistant. Analyze the attached image.
+    > 1. Classify the document (Tax, Bill, Junk, Medical).
+    > 2. Extract the Document Date (YYYY-MM-DD).
+    > 3. Identify the Vendor/Sender Entity.
+    > 4. If Bill: Extract Total Amount.
+    > 5. If Tax: Extract Form Type (e.g., 1099-DIV).
+    > Return response STRICTLY as JSON."
+
+### Step 3: Validation & Routing
+*   **JSON Validation:** Python `Pydantic` validates the LLM output.
+    *   *Check:* Is the date valid? Is the amount a float?
+*   **Confidence Check:** If critical fields are missing, move file to `/Needs_Review`.
+
+### Step 4: Execution (The "Actuator")
+*   **Renaming Logic:**
+    ```python
+    new_filename = f"{date}_{entity}_{doc_type}.pdf"
+    # Example: 2023-12-01_Kaiser_MedicalBill.pdf
+    ```
+*   **Filing Logic:**
+    *   Map `Tax` $\rightarrow$ `/Server/Docs/Financial/Taxes/{Year}/`
+    *   Map `Junk` $\rightarrow$ `/Server/Trash/`
+*   **Side Effects:**
+    *   Update `ledger.csv` with `[Date, Entity, Type, Amount, FilePath]`.
+
+## 3. Data Schema (The "Manifest")
+
+Every processed document generates a "Sidecar JSON" metadata file stored in a hidden `.folio` folder for searchability.
+
+```json
+{
+  "id": "a1b2c3d4",
+  "original_name": "scan_001.pdf",
+  "processed_name": "2024-02-14_Chase_Statement.pdf",
+  "classification": "Financial_Statement",
+  "confidence_score": 0.98,
+  "metadata": {
+    "entity": "Chase Bank",
+    "account_last_4": "4490",
+    "statement_period": "Jan 2024",
+    "total_balance": 4500.00
+  },
+  "actions_taken": [
+    "Renamed",
+    "Moved to /Financial/Bank/Chase",
+    "Logged to SQLite DB"
+  ]
+}
+```
+
+## 4. API & Integration Design
+
+### 4.1 Internal APIs (Python Classes)
+*   `DocumentProcessor.process(file_path)`
+*   `Classifier.predict(text_content)`
+*   `Extractor.get_entities(text_content, schema)`
+
+### 4.2 External Hooks
+*   **Google Sheets:** Use `gspread` library to append rows for tax tracking.
+*   **Notion:** Use Notion API to create a database entry for every "Legal" document found.
+
+## 5. Security & Privacy Implementation
+
+To handle the "Sunnyvale Resident" requirement (SSN, Financials):
+
+1.  **Tier 1 (Junk/Generic):** Can use Cloud LLM (OpenAI/Anthropic) for high accuracy.
+2.  **Tier 2 (Sensitive - Tax/Medical):**
+    *   **Option A:** Use **Local LLM** (Mistral-7B or Llama-3 running on local Mac Studio/PC). **Zero data leaves the house.**
+    *   **Option B:** Redact PII (Regex for SSN patterns) before sending to Cloud API.
+

package/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <title>Folio</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/package.json

@@ -0,0 +1,101 @@
+{
+  "name": "@realtimex/folio",
+  "version": "0.1.2",
+  "type": "module",
+  "main": "dist/api/server.js",
+  "bin": {
+    "folio": "./bin/folio.js",
+    "folio-setup": "./bin/folio-setup.js",
+    "folio-deploy": "./bin/folio-deploy.js"
+  },
+  "files": [
+    "bin",
+    "api",
+    "dist",
+    "docs-dev",
+    "supabase",
+    "scripts",
+    "public",
+    ".env.example",
+    "tsconfig.json",
+    "tsconfig.api.json",
+    "vite.config.ts",
+    "index.html",
+    "README.md"
+  ],
+  "scripts": {
+    "dev": "vite",
+    "dev:api": "tsx watch api/server.ts",
+    "build": "npm run build:ui && npm run build:api",
+    "build:ui": "vite build",
+    "build:api": "tsc -p tsconfig.api.json",
+    "preview": "vite preview",
+    "serve": "node dist/api/server.js",
+    "start": "node dist/api/server.js",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --ext .ts,.tsx --max-warnings=0",
+    "migrate": "bash ./scripts/migrate.sh",
+    "task": "node scripts/dev-task.mjs"
+  },
+  "keywords": [
+    "folio",
+    "realtimex",
+    "desktop",
+    "supabase",
+    "local-app",
+    "document-automation"
+  ],
+  "license": "MIT",
+  "description": "Folio: local desktop app + remote Supabase + RealTimeX SDK backend runtime",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "@radix-ui/react-alert-dialog": "^1.1.15",
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-label": "^2.1.8",
+    "@radix-ui/react-slot": "^1.2.4",
+    "@realtimex/sdk": "^1.3.3",
+    "@supabase/supabase-js": "^2.90.1",
+    "@tailwindcss/vite": "^4.2.1",
+    "@types/multer": "^2.0.0",
+    "axios": "^1.13.4",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cors": "^2.8.5",
+    "dotenv": "^17.2.3",
+    "express": "^5.2.1",
+    "framer-motion": "^12.34.3",
+    "js-yaml": "^4.1.1",
+    "lucide-react": "^0.575.0",
+    "multer": "^2.0.2",
+    "next-themes": "^0.4.6",
+    "pdf-parse": "^2.4.5",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
+    "tailwind-merge": "^3.5.0",
+    "tailwindcss": "^4.2.1",
+    "tsx": "^4.21.0",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.39.3",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.6",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^25.0.8",
+    "@types/react": "^19.2.8",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^5.1.2",
+    "eslint": "^9.39.3",
+    "eslint-plugin-react-hooks": "^7.0.1",
+    "eslint-plugin-react-refresh": "^0.4.26",
+    "globals": "^16.5.0",
+    "jsdom": "^26.1.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.1",
+    "vite": "^7.3.1",
+    "vitest": "^3.2.4"
+  }
+}

package/public/favicon.svg

@@ -0,0 +1,31 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <!-- 
+     FAVICON STRATEGY: 
+     1. High Contrast: Uses the brand Indigo against transparent/white.
+     2. Simplified Geometry: Removed shadows and subtle opacity layers.
+     3. Scalable: This vector will look crisp on Retina displays.
+  -->
+
+  <defs>
+    <linearGradient id="faviconGradient" x1="0" y1="0" x2="64" y2="64" gradientUnits="userSpaceOnUse">
+      <stop offset="0%" stop-color="#6366F1" /> <!-- Indigo-500 -->
+      <stop offset="100%" stop-color="#4338CA" /> <!-- Indigo-700 -->
+    </linearGradient>
+  </defs>
+
+  <!-- The "Back" Page (Input) - Lighter/Translucent representation -->
+  <!-- Positioned to create the right stem of the abstract 'F' -->
+  <path d="M28 12 H 48 C 50.2 12 52 13.8 52 16 V 48 L 40 36 V 12 Z" 
+        fill="url(#faviconGradient)" 
+        fill-opacity="0.5" />
+
+  <!-- The "Front" Page (Output) - Solid representation -->
+  <!-- Positioned to create the main body of the 'F' -->
+  <path d="M12 12 H 36 C 38.2 12 40 13.8 40 16 V 52 C 40 54.2 38.2 56 36 56 H 12 V 12 Z" 
+        fill="url(#faviconGradient)" />
+
+  <!-- The "Fold" (Action) - The distinctive dog-ear -->
+  <path d="M40 16 L 36 16 C 34.9 16 34 15.1 34 14 L 34 12" 
+        fill="#FFFFFF" 
+        fill-opacity="0.6"/>
+</svg>

package/public/folio-logo.svg

@@ -0,0 +1,46 @@
+<svg width="512" height="512" viewBox="0 0 512 512" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <!-- Main Gradient: Gives a subtle 'tech' feel and depth -->
+    <linearGradient id="folioGradient" x1="0" y1="0" x2="512" y2="512" gradientUnits="userSpaceOnUse">
+      <stop offset="0%" stop-color="#6366F1" /> <!-- Indigo-500 -->
+      <stop offset="100%" stop-color="#4338CA" /> <!-- Indigo-700 -->
+    </linearGradient>
+    
+    <!-- Shadow for depth between the pages -->
+    <filter id="dropShadow" x="-20%" y="-20%" width="140%" height="140%">
+      <feGaussianBlur in="SourceAlpha" stdDeviation="8"/>
+      <feOffset dx="4" dy="8" result="offsetblur"/>
+      <feComponentTransfer>
+        <feFuncA type="linear" slope="0.3"/>
+      </feComponentTransfer>
+      <feMerge> 
+        <feMergeNode/>
+        <feMergeNode in="SourceGraphic"/> 
+      </feMerge>
+    </filter>
+  </defs>
+
+  <!-- BACKGROUND CONTAINER: Ensures visibility on both Dark and Light modes -->
+  <rect x="32" y="32" width="448" height="448" rx="112" fill="url(#folioGradient)" />
+
+  <!-- ICON ELEMENTS -->
+  <g filter="url(#dropShadow)">
+    <!-- The "Back" Page (The Foundation) -->
+    <!-- Representing the raw data/input -->
+    <path d="M180 140 H 330 C 352.09 140 370 157.91 370 180 V 370 C 370 370 370 370 370 370 H 260 L 180 290 V 140 Z" 
+          fill="#FFFFFF" 
+          fill-opacity="0.4" />
+
+    <!-- The "Front" Page (The Organization) -->
+    <!-- Representing the processed, clean output. 
+         Notice how it creates an abstract 'F' shape with the back page. -->
+    <path d="M140 140 H 280 C 302.09 140 320 157.91 320 180 V 332 C 320 354.09 302.09 372 280 372 H 140 V 140 Z" 
+          fill="#FFFFFF" />
+    
+    <!-- The "Action" Accent (The Dog Ear / Fold) -->
+    <!-- Adds a tactile feel, implying this is a document being handled. -->
+    <path d="M320 180 L 280 180 C 268.95 180 260 171.05 260 160 L 260 140" 
+          fill="#C7D2FE" 
+          fill-opacity="0.5"/>
+  </g>
+</svg>

package/scripts/dev-task.mjs

@@ -0,0 +1,51 @@
+import { execSync } from 'node:child_process';
+
+// Helper to check for gh CLI
+try {
+  execSync('gh --version', { stdio: 'ignore' });
+} catch (e) {
+  console.error('Error: GitHub CLI (gh) is not installed. Please install it first: https://cli.github.com/');
+  process.exit(1);
+}
+
+// Helper to check for gh auth
+try {
+  execSync('gh auth status', { stdio: 'ignore' });
+} catch (e) {
+  console.error('Error: GitHub CLI is not authenticated. Run "gh auth login" first.');
+  process.exit(1);
+}
+
+const title = process.argv[2];
+const body = process.argv.slice(3).join(' ');
+
+if (!title) {
+  console.error('Usage: npm run task "Task title" "Task description (optional)"');
+  process.exit(1);
+}
+
+const label = 'agent-task';
+
+// Create label if it doesn't exist
+try {
+  execSync(`gh label list | grep -q "${label}"`, { stdio: 'ignore' });
+} catch (e) {
+  console.log(`Creating label "${label}"...`);
+  try {
+    execSync(`gh label create ${label} --color "#5319e7" --description "Tasks for the Gemini agent to process"`, { stdio: 'inherit' });
+  } catch (labelError) {
+    // Label might have been created by another process or exist but grep failed
+    console.warn(`Note: Could not create label "${label}", it may already exist or there was a permission issue.`);
+  }
+}
+
+console.log(`Creating issue: ${title}...`);
+try {
+  const result = execSync(`gh issue create --title "${title}" --body "${body || 'No description provided.'}" --label "${label}"`, { encoding: 'utf8' }).trim();
+  console.log(`
+Successfully created issue: ${result}`);
+  console.log(`Agent is now ready to pick up: ${title}`);
+} catch (e) {
+  console.error('Failed to create issue:', e.message);
+  process.exit(1);
+}

package/scripts/get-latest-migration-timestamp.mjs

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+
+import { readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+const migrationsDir = join(__dirname, "..", "supabase", "migrations");
+
+try {
+  const files = readdirSync(migrationsDir);
+  const timestamps = files
+    .filter((file) => file.endsWith(".sql"))
+    .filter((file) => !file.toLowerCase().includes("test")) // exclude test migrations
+    .map((file) => {
+      const match = file.match(/^(\d{14})_/);
+      return match ? match[1] : null;
+    })
+    .filter(Boolean)
+    .sort()
+    .reverse();
+
+  if (timestamps.length === 0) {
+    console.log("20240101000000");
+    process.exit(0);
+  }
+
+  console.log(timestamps[0]);
+} catch (error) {
+  console.error("Error reading migrations:", error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}

package/scripts/migrate.sh

@@ -0,0 +1,91 @@
+#!/bin/bash
+
+set -euo pipefail
+
+echo "🚀 Starting Folio migration..."
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT_DIR=$(cd "$SCRIPT_DIR/.." && pwd)
+cd "$ROOT_DIR"
+
+SUPABASE_CMD="supabase"
+if [ -x "./node_modules/.bin/supabase" ]; then
+  SUPABASE_CMD="./node_modules/.bin/supabase"
+elif ! command -v supabase &> /dev/null; then
+  SUPABASE_CMD="npx supabase@latest"
+fi
+
+if [ -z "${SUPABASE_PROJECT_ID:-}" ]; then
+  read -p "👉 Enter Supabase Project ID: " SUPABASE_PROJECT_ID
+fi
+
+if [ -z "${SUPABASE_PROJECT_ID:-}" ]; then
+  echo "❌ Error: SUPABASE_PROJECT_ID is required"
+  exit 1
+fi
+
+if [ -n "${SUPABASE_ACCESS_TOKEN:-}" ]; then
+  echo "🔑 Using provided Supabase Access Token"
+  export SUPABASE_ACCESS_TOKEN="$SUPABASE_ACCESS_TOKEN"
+fi
+
+echo "🔗 Linking project: $SUPABASE_PROJECT_ID"
+$SUPABASE_CMD link --project-ref "$SUPABASE_PROJECT_ID" --yes
+
+echo "📂 Pushing database migrations..."
+max_retries="${DB_PUSH_MAX_RETRIES:-3}"
+attempt=1
+while true; do
+  set +e
+  DB_PUSH_OUTPUT=$($SUPABASE_CMD db push --include-all --yes 2>&1)
+  status=$?
+  set -e
+
+  echo "$DB_PUSH_OUTPUT"
+
+  if [ $status -eq 0 ]; then
+    break
+  fi
+
+  if echo "$DB_PUSH_OUTPUT" | grep -q "57P03\\|shutting down\\|Failed to create login role\\|connection reset"; then
+    if [ $attempt -lt $max_retries ]; then
+      wait_seconds=$((attempt * 10))
+      echo "⏳ Database appears busy/restarting. Retrying in ${wait_seconds}s (${attempt}/${max_retries})..."
+      sleep $wait_seconds
+      attempt=$((attempt + 1))
+      continue
+    fi
+  fi
+
+  echo "❌ Database push failed"
+  exit $status
+done
+
+echo "⚙️  Pushing Supabase project config..."
+$SUPABASE_CMD config push --yes
+
+if [ "${SKIP_FUNCTIONS:-0}" != "1" ]; then
+  echo "⚡ Deploying Edge Functions..."
+  if [ -d "supabase/functions" ]; then
+    for dir in supabase/functions/*/ ; do
+      func_name=$(basename "$dir")
+
+      if [ ! -d "$dir" ] || [[ "$func_name" =~ ^[._] ]] || [ "$func_name" == "_shared" ]; then
+        continue
+      fi
+
+      if [ -f "$dir/index.ts" ]; then
+        echo "   Deploying $func_name"
+        $SUPABASE_CMD functions deploy "$func_name" --no-verify-jwt --use-api --yes
+      else
+        echo "   ⏭️  Skipping $func_name (missing index.ts)"
+      fi
+    done
+  fi
+else
+  echo "⏭️  SKIP_FUNCTIONS=1, skipping function deployment"
+fi
+
+echo ""
+echo "✅ Folio migration completed"
+echo ""

package/supabase/.temp/cli-latest

@@ -0,0 +1 @@
+v2.75.0

package/supabase/.temp/gotrue-version

@@ -0,0 +1 @@
+v2.187.0

package/supabase/.temp/pooler-url

@@ -0,0 +1 @@
+postgresql://postgres.hywjwqqgrhofmjddpswj@aws-1-us-west-1.pooler.supabase.com:5432/postgres

package/supabase/.temp/postgres-version

@@ -0,0 +1 @@
+17.6.1.063

package/supabase/.temp/project-ref

@@ -0,0 +1 @@
+hywjwqqgrhofmjddpswj

package/supabase/.temp/rest-version

@@ -0,0 +1 @@
+v14.1

package/supabase/.temp/storage-migration

@@ -0,0 +1 @@
+fix-optimized-search-function

package/supabase/.temp/storage-version

@@ -0,0 +1 @@
+v1.37.7

package/supabase/config.toml

@@ -0,0 +1,64 @@
+[api]
+enabled = true
+port = 54321
+schemas = ["public", "storage", "graphql_public"]
+extra_search_path = ["public", "extensions"]
+max_rows = 1000
+
+[db]
+port = 54322
+major_version = 17
+
+[studio]
+enabled = true
+port = 54323
+
+[storage]
+enabled = true
+file_size_limit = "50MiB"
+
+[auth]
+enabled = true
+site_url = "http://localhost:5176"
+additional_redirect_urls = ["http://localhost:5173", "http://localhost:5176", "http://localhost:3006"]
+jwt_expiry = 3600
+enable_refresh_token_rotation = true
+refresh_token_reuse_interval = 10
+enable_signup = true
+enable_anonymous_sign_ins = false
+enable_manual_linking = false
+minimum_password_length = 6
+password_requirements = ""
+
+[auth.email]
+enable_signup = true
+double_confirm_changes = true
+enable_confirmations = false
+secure_password_change = false
+max_frequency = "1s"
+otp_length = 6
+otp_expiry = 3600
+
+[auth.email.template.invite]
+subject = "You have been invited to Folio"
+content_path = "supabase/templates/invite.html"
+
+[auth.email.template.confirmation]
+subject = "Confirm your Folio account"
+content_path = "supabase/templates/confirmation.html"
+
+[auth.email.template.recovery]
+subject = "Reset your Folio password"
+content_path = "supabase/templates/recovery.html"
+
+[auth.email.template.magic_link]
+subject = "Login to Folio"
+content_path = "supabase/templates/magic-link.html"
+
+[auth.email.template.email_change]
+subject = "Confirm your new email for Folio"
+content_path = "supabase/templates/email-change.html"
+
+[functions]
+# Required runtime secret for some local processing paths:
+# TOKEN_ENCRYPTION_KEY

package/supabase/functions/_shared/auth.ts

@@ -0,0 +1,35 @@
+import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
+
+export async function authenticate(req: Request) {
+  const authHeader = req.headers.get("Authorization");
+  if (!authHeader?.startsWith("Bearer ")) {
+    throw new Error("Missing bearer token");
+  }
+
+  const token = authHeader.replace("Bearer ", "");
+  const supabaseUrl = Deno.env.get("SUPABASE_URL") || "";
+  const supabaseAnon = Deno.env.get("SUPABASE_ANON_KEY") || "";
+
+  if (!supabaseUrl || !supabaseAnon) {
+    throw new Error("Supabase env not configured");
+  }
+
+  const client = createClient(supabaseUrl, supabaseAnon, {
+    global: {
+      headers: {
+        Authorization: `Bearer ${token}`
+      }
+    }
+  });
+
+  const {
+    data: { user },
+    error
+  } = await client.auth.getUser(token);
+
+  if (error || !user) {
+    throw new Error(error?.message || "Invalid token");
+  }
+
+  return { user, client };
+}

package/supabase/functions/_shared/cors.ts

@@ -0,0 +1,12 @@
+export const corsHeaders = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
+  "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+};
+
+export function createErrorResponse(status: number, message: string) {
+  return new Response(JSON.stringify({ error: { message } }), {
+    status,
+    headers: { "Content-Type": "application/json", ...corsHeaders }
+  });
+}

package/supabase/functions/_shared/supabaseAdmin.ts

@@ -0,0 +1,17 @@
+import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
+
+export function getAdminClient() {
+  const supabaseUrl = Deno.env.get("SUPABASE_URL") || "";
+  const serviceRoleKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") || "";
+
+  if (!supabaseUrl || !serviceRoleKey) {
+    throw new Error("SUPABASE_URL or SUPABASE_SERVICE_ROLE_KEY missing");
+  }
+
+  return createClient(supabaseUrl, serviceRoleKey, {
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false
+    }
+  });
+}