Supabaseaccountinfo

.env.example

@@ -0,0 +1,9 @@
+# Local PostgreSQL service only. Replace only in an untracked .env file.
+POSTGRES_DB=quickcop_dev
+POSTGRES_USER=quickcop_dev
+POSTGRES_PASSWORD=change-me-local-only
+POSTGRES_PORT=5432
+
+# Future API configuration: supply real values through a secret manager, never Git.
+DATABASE_URL=postgresql://quickcop_dev:change-me-local-only@postgres:5432/quickcop_dev
+ADDRESS_ENCRYPTION_KEY=replace-with-a-secret-manager-reference

.gitattributes

@@ -0,0 +1 @@
+*.sql text eol=lf

.gitignore

@@ -14,3 +14,8 @@ reports/
 android/.gradle/
 postgres-data/
 *.log
+
+.idea/
+.env
+.env.*
+!.env.example

.gitleaksignore

@@ -0,0 +1 @@
+9d343ec8416f61765d1a0741ee4cb6f394e50243:apps/api/README.md:generic-api-key:5

.prettierignore

@@ -3,3 +3,4 @@ coverage
 dist
 package-lock.json
 .agents/
+supabase/.temp

AGENTS.md

@@ -2,12 +2,12 @@
 
 ## Status and source of truth
 
-This repository has infrastructure only. Read `infrastructure_plan.md` before changing tooling, hosting, security, database, release, or stack choices. The plan selects Expo/React Native Android, NestJS, PostgreSQL, Docker for local services, Cloud Run API/worker services (`min-instances >= 1`), and Cloud SQL private IP. Revise the plan with `infra-planner` before changing any of those decisions.
+This repository contains infrastructure plus initial mobile/API slices. Read `infrastructure_plan.md` before changing tooling, hosting, security, database, release, or stack choices. The plan selects Expo/React Native Android, NestJS, Supabase-managed PostgreSQL, Docker/Supabase CLI for local services, and Cloud Run API/worker services (`min-instances >= 1`). Revise the plan with `infra-planner` before changing any of those decisions.
 
 ## Repository map
 
-- Front end/mobile: `apps/mobile` — not created yet.
-- API/backend: `apps/api` — not created yet.
+- Front end/mobile: `apps/mobile` — Expo/React Native foundation and account/auth slices.
+- API/backend: `apps/api` — NestJS/Supabase account boundary and tests; broader application behavior remains incomplete.
 - Infrastructure: `compose.yaml`, `docker/`, `.env.example`.
 - Tooling/tests: `package.json`, TypeScript/ESLint/Jest/Stryker configs, `scripts/`, `tests/`.
 - CI: `.github/workflows/pr-checks.yml` and `.github/workflows/release.yml`.
@@ -18,7 +18,7 @@ This repository has infrastructure only. Read `infrastructure_plan.md` before ch
 
 - Infrastructure work must not add product screens, API routes, domain models, auth, checkout logic, or production data.
 - Do not commit secrets, `.env` files, certificates, reports, generated artifacts, or local database data.
-- The API Dockerfile is intentionally unbuildable until application-owned `apps/api` exists; do not add a fake entrypoint merely to make it build.
+- The API Dockerfile remains infrastructure-owned and must not be made buildable with a fake entrypoint; application-owned API packaging must be coordinated with the existing `apps/api` boundary.
 - Only approved partner APIs may later support checkout. Never collect or store card numbers/CVV.
 
 ## Skills and workflow
@@ -29,7 +29,7 @@ This repository has infrastructure only. Read `infrastructure_plan.md` before ch
 
 ## Verification and lifecycle
 
-After installing with `npm ci` on Node 22.14.0, run `npm run verify`, `npm run audit`, and `npm run test:smoke`. CI mirrors the static checks and coverage harness; it additionally runs Gitleaks and CodeQL. `npm run test:smoke` starts then removes the PostgreSQL service and volume. For manual local use, start with `npm run docker:up` and always clean up with `npm run docker:down`.
+After installing with `npm ci` on Node 22.14.0, verify root and application packages independently: root `npm ci`, `npm test -- --runInBand`, and `npm run typecheck`; then `cd apps/mobile`, run the same three commands. Run API package tests/typecheck through its own package scripts as they are added. Also run `npm run verify`, `npm run audit`, and `npm run test:smoke` for the root harness. The Compose smoke test is not a Supabase-local-stack check; report those environments separately.
 
 ## Change checklist
 

README.md

@@ -1,6 +1,6 @@
 # QuickCop
 
-Android-first stock tracking and partner-retailer checkout is planned here. The repository currently contains its development infrastructure only; no mobile app, NestJS API, authentication, product model, or checkout behavior has been implemented.
+Android-first stock tracking and partner-retailer checkout is planned here. The repository contains the development infrastructure plus initial mobile authentication/account UI and a NestJS/Supabase account API slice; product monitoring, notifications, and checkout behavior remain incomplete.
 
 ## Repository map
 
@@ -12,7 +12,7 @@ Android-first stock tracking and partner-retailer checkout is planned here. The
 - `.github/workflows/` — pull-request checks and guarded release prerequisite workflow.
 - `.agents/skills/` — project-supplied agent guidance.
 - `apps/mobile` — Expo/React Native Android foundation with local-only login and account-creation UI.
-- `apps/api` — not created yet; application implementation owns it.
+- `apps/api` — initial NestJS/Supabase account boundary and tests; application behavior is incomplete.
 
 ## Getting Started
 
@@ -37,14 +37,21 @@ Android-first stock tracking and partner-retailer checkout is planned here. The
    docker run --rm --user "$(id -u):$(id -g)" -v "$PWD":/workspace -w /workspace node:22.14-bookworm-slim npm ci
    ```
 
-4. Run quality checks and the local database smoke test:
+4. Verify the root package and then the mobile package independently:
 
    ```bash
    npm run verify
+   npm test -- --runInBand
+   npm run typecheck
    npm run test:smoke
+
+   cd apps/mobile
+   npm ci
+   npm test -- --runInBand
+   npm run typecheck
    ```
 
-   `npm test` and `npm run test:integration` validate an empty harness until application-owned tests exist. `npm run test:smoke` starts PostgreSQL, performs only `SELECT 1`, and stops/removes its local volume.
+   Each package's clean `npm ci` must succeed; root `npm ci` does not restore mobile or API dependencies. `npm run test:smoke` starts Compose PostgreSQL, performs only `SELECT 1`, and stops/removes its local volume. It does not validate the Supabase local stack used by application development.
 
 5. For an interactive local database, run `npm run docker:up`; clean it up with `npm run docker:down`.
 
@@ -54,13 +61,13 @@ The initial Android UI is in `apps/mobile`. It does not authenticate or persist
 
 ## Docker and deployment boundary
 
-`compose.yaml` runs pinned `postgres:17.2-bookworm` locally and exposes it only on `127.0.0.1`. `docker/api.Dockerfile` is a hardened future NestJS image template and cannot build until `apps/api` is created by the application phase.
+`compose.yaml` runs pinned `postgres:17.2-bookworm` locally and exposes it only on `127.0.0.1`; it is retained for the root smoke gate. Application development and Supabase migrations use the Supabase CLI/local stack. `docker/api.Dockerfile` remains a hardened API image template and must be coordinated with the existing `apps/api` application boundary.
 
-Production is planned for Cloud Run API and worker services with at least one minimum instance each, plus private-IP Cloud SQL PostgreSQL with automated backups. The release workflow deliberately stops at prerequisites while mobile/API entrypoints and real protected-environment settings are absent; it does not publish, deploy, migrate, or contact Google Cloud.
+Production is planned for Cloud Run API and worker services with at least one minimum instance each, plus a dedicated Supabase project providing managed PostgreSQL and backups. The release workflow deliberately stops at prerequisites while production credentials and protected-environment settings are absent; it does not publish, deploy, migrate, or contact cloud services.
 
 ## GitHub setup required later
 
-Create a `production` protected environment and configure the plan-named `GCP_WORKLOAD_IDENTITY_PROVIDER`, `GCP_SERVICE_ACCOUNT`, `GCP_PROJECT_ID`, `GCP_REGION`, `CLOUD_SQL_INSTANCE`, `CLOUD_RUN_API_SERVICE`, and `CLOUD_RUN_WORKER_SERVICE` variables. Google Play publishing also needs its service-account JSON, Android signing key/password secrets, Google Cloud Workload Identity Federation, Artifact Registry, Cloud Run services, Cloud SQL instance, partner credentials, encryption-key management, and legal/privacy approval.
+Create a `production` protected environment and configure the plan-named Google Cloud, Supabase, partner, encryption, and Android signing credentials. Google Play publishing also needs its service-account JSON and Android signing key/password secrets; Supabase migrations require protected project access and server-only credentials.
 
 ## Troubleshooting
 

apps/api/.prettierrc

@@ -0,0 +1,4 @@
+{
+  "singleQuote": true,
+  "trailingComma": "all"
+}

apps/api/README.md

@@ -0,0 +1,98 @@
+<p align="center">
+  <a href="http://nestjs.com/" target="blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
+</p>
+
+[circleci-image]: https://img.shields.io/circleci/build/github/nestjs/nest/master?token=abc123def456
+[circleci-url]: https://circleci.com/gh/nestjs/nest
+
+  <p align="center">A progressive <a href="http://nodejs.org" target="_blank">Node.js</a> framework for building efficient and scalable server-side applications.</p>
+    <p align="center">
+<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/v/@nestjs/core.svg" alt="NPM Version" /></a>
+<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/l/@nestjs/core.svg" alt="Package License" /></a>
+<a href="https://www.npmjs.com/~nestjscore" target="_blank"><img src="https://img.shields.io/npm/dm/@nestjs/common.svg" alt="NPM Downloads" /></a>
+<a href="https://circleci.com/gh/nestjs/nest" target="_blank"><img src="https://img.shields.io/circleci/build/github/nestjs/nest/master" alt="CircleCI" /></a>
+<a href="https://discord.gg/G7Qnnhy" target="_blank"><img src="https://img.shields.io/badge/discord-online-brightgreen.svg" alt="Discord"/></a>
+<a href="https://opencollective.com/nest#backer" target="_blank"><img src="https://opencollective.com/nest/backers/badge.svg" alt="Backers on Open Collective" /></a>
+<a href="https://opencollective.com/nest#sponsor" target="_blank"><img src="https://opencollective.com/nest/sponsors/badge.svg" alt="Sponsors on Open Collective" /></a>
+  <a href="https://paypal.me/kamilmysliwiec" target="_blank"><img src="https://img.shields.io/badge/Donate-PayPal-ff3f59.svg" alt="Donate us"/></a>
+    <a href="https://opencollective.com/nest#sponsor"  target="_blank"><img src="https://img.shields.io/badge/Support%20us-Open%20Collective-41B883.svg" alt="Support us"></a>
+  <a href="https://twitter.com/nestframework" target="_blank"><img src="https://img.shields.io/twitter/follow/nestframework.svg?style=social&label=Follow" alt="Follow us on Twitter"></a>
+</p>
+  <!--[![Backers on Open Collective](https://opencollective.com/nest/backers/badge.svg)](https://opencollective.com/nest#backer)
+  [![Sponsors on Open Collective](https://opencollective.com/nest/sponsors/badge.svg)](https://opencollective.com/nest#sponsor)-->
+
+## Description
+
+[Nest](https://github.com/nestjs/nest) framework TypeScript starter repository.
+
+## Project setup
+
+```bash
+$ npm install
+```
+
+## Compile and run the project
+
+```bash
+# development
+$ npm run start
+
+# watch mode
+$ npm run start:dev
+
+# production mode
+$ npm run start:prod
+```
+
+## Run tests
+
+```bash
+# unit tests
+$ npm run test
+
+# e2e tests
+$ npm run test:e2e
+
+# test coverage
+$ npm run test:cov
+```
+
+## Deployment
+
+When you're ready to deploy your NestJS application to production, there are some key steps you can take to ensure it runs as efficiently as possible. Check out the [deployment documentation](https://docs.nestjs.com/deployment) for more information.
+
+If you are looking for a cloud-based platform to deploy your NestJS application, check out [Mau](https://mau.nestjs.com), our official platform for deploying NestJS applications on AWS. Mau makes deployment straightforward and fast, requiring just a few simple steps:
+
+```bash
+$ npm install -g @nestjs/mau
+$ mau deploy
+```
+
+With Mau, you can deploy your application in just a few clicks, allowing you to focus on building features rather than managing infrastructure.
+
+## Resources
+
+Check out a few resources that may come in handy when working with NestJS:
+
+- Visit the [NestJS Documentation](https://docs.nestjs.com) to learn more about the framework.
+- For questions and support, please visit our [Discord channel](https://discord.gg/G7Qnnhy).
+- To dive deeper and get more hands-on experience, check out our official video [courses](https://courses.nestjs.com/).
+- Deploy your application to AWS with the help of [NestJS Mau](https://mau.nestjs.com) in just a few clicks.
+- Visualize your application graph and interact with the NestJS application in real-time using [NestJS Devtools](https://devtools.nestjs.com).
+- Need help with your project (part-time to full-time)? Check out our official [enterprise support](https://enterprise.nestjs.com).
+- To stay in the loop and get updates, follow us on [X](https://x.com/nestframework) and [LinkedIn](https://linkedin.com/company/nestjs).
+- Looking for a job, or have a job to offer? Check out our official [Jobs board](https://jobs.nestjs.com).
+
+## Support
+
+Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please [read more here](https://docs.nestjs.com/support).
+
+## Stay in touch
+
+- Author - [Kamil Myśliwiec](https://twitter.com/kammysliwiec)
+- Website - [https://nestjs.com](https://nestjs.com/)
+- Twitter - [@nestframework](https://twitter.com/nestframework)
+
+## License
+
+Nest is [MIT licensed](https://github.com/nestjs/nest/blob/master/LICENSE).

apps/api/eslint.config.mjs

@@ -0,0 +1,44 @@
+// @ts-check
+import eslint from '@eslint/js';
+import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  {
+    ignores: [
+      'coverage/**',
+      'node_modules/**',
+      'dist/**',
+      '**/dist/**',
+      '**/node_modules/**',
+      '**/coverage/**',
+      '**/.expo/**',
+      'supabase/.temp',
+    ],
+  },
+  eslint.configs.recommended,
+  ...tseslint.configs.recommendedTypeChecked,
+  eslintPluginPrettierRecommended,
+  {
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...globals.jest,
+      },
+      sourceType: 'commonjs',
+      parserOptions: {
+        projectService: true,
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+  },
+  {
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-floating-promises': 'warn',
+      '@typescript-eslint/no-unsafe-argument': 'warn',
+      'prettier/prettier': ['error', { endOfLine: 'auto' }],
+    },
+  },
+);

apps/api/nest-cli.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json.schemastore.org/nest-cli",
+  "collection": "@nestjs/schematics",
+  "sourceRoot": "src",
+  "compilerOptions": {
+    "deleteOutDir": true
+  }
+}