Deploy combined Node and Python backend in one Docker Space

.dockerignore

@@ -1,5 +1,11 @@
-.env
-.env.*
-__pycache__/
-.venv/
-test_app.py
+# Include only Docker build inputs; credentials and local artifacts stay out.
+*
+!Dockerfile
+!package.json
+!package-lock.json
+!tsconfig.json
+!src/
+!src/**
+!requirements.txt
+!app.py
+!start.py

.env.example

@@ -1,5 +1,14 @@
+PORT=4000
+TRUST_PROXY_HOPS=1
+NODE_ENV=development
+FRONTEND_URL=http://localhost:8080
+BACKEND_URL=http://localhost:4000
+ANALYSIS_PROXY_SECRET=replace-with-a-random-secret-of-at-least-32-characters
+SUPABASE_URL=https://your-project.supabase.co
+SUPABASE_ANON_KEY=your-publishable-or-anon-key
+SUPABASE_SERVICE_ROLE_KEY=your-service-role-or-secret-key
 CORE_REPO_ID=your-account/sporalize-core
 STORAGE_REPO_ID=your-account/sporalize-application-storage
 HF_TOKEN=
-ANALYSIS_PROXY_SECRET=
-BACKEND_URL=http://localhost:4000
+# CORE_REVISION=optional-pinned-revision
+# Internal Node/AI URLs are set automatically by start.py.

.gitignore

@@ -1,3 +1,9 @@
 .env
+.env.*
+!.env.example
+node_modules/
+dist/
 __pycache__/
+*.py[cod]
 .venv/
+*.log

Dockerfile

@@ -1,11 +1,23 @@
-FROM python:3.10-slim
-ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 HF_HOME=/home/appuser/.cache/huggingface
-RUN apt-get update && apt-get install -y --no-install-recommends libglib2.0-0 libgl1 && rm -rf /var/lib/apt/lists/*
-RUN useradd --create-home --uid 1000 appuser
+FROM node:22-bookworm-slim AS node-build
 WORKDIR /app
-COPY requirements.txt .
+COPY package*.json ./
+RUN npm ci
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build && npm prune --omit=dev
+
+FROM python:3.10-slim-bookworm
+ENV NODE_ENV=production PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 HF_HOME=/home/appuser/.cache/huggingface PORT=7860
+RUN apt-get update && apt-get install -y --no-install-recommends libglib2.0-0 libgl1 \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 1000 appuser
+COPY --from=node-build /usr/local/bin/node /usr/local/bin/node
+WORKDIR /app
+COPY requirements.txt ./
 RUN pip install --no-cache-dir -r requirements.txt
-COPY --chown=appuser:appuser app.py .
+COPY --from=node-build --chown=appuser:appuser /app/dist ./dist
+COPY --from=node-build --chown=appuser:appuser /app/node_modules ./node_modules
+COPY --chown=appuser:appuser package.json app.py start.py ./
 USER appuser
 EXPOSE 7860
-CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860", "--workers", "1"]
+CMD ["python", "start.py"]

README.md

@@ -1,21 +1,106 @@
----
-title: Sporalize AI API
+---
+title: Sporalize Backend
 sdk: docker
 app_port: 7860
 ---
 
-# Sporalize AI API
+# Sporalize Backend
+
+One Docker service runs Express for authentication, subscriptions and Supabase access, and FastAPI for video analysis. Node exposes port 7860 in the Space; Python binds only to 127.0.0.1:8000. `start.py` supervises both processes and stops the service if either exits. Python calls Node over loopback; `BACKEND_URL` remains the public origin for authentication redirects and media links.
+
+## Local development
+
+From this directory:
+
+```powershell
+Copy-Item .env.example .env
+npm ci
+npm run build
+python -m pip install -r requirements.txt
+npm start
+```
+
+Fill in `.env` before starting. Both processes share this file. The default local public port is 4000. Rebuild TypeScript after editing Node code. `npm run dev` starts only Node; use `npm start` for the full application.
+
+## Hugging Face deployment
+
+Upload the contents of `Backend/` as the root of a Docker Space, including this README and Dockerfile. Exclude `.env`, `node_modules`, and local build/cache directories. The Space downloads Core from its private dataset repository; local development uses the root `Core/` directory.
+
+Set these Space variables/secrets from `.env.example`:
+
+- `PORT=7860`, `NODE_ENV=production`, `TRUST_PROXY_HOPS=1` (adjust to the actual trusted proxy chain).
+- `FRONTEND_URL`: public HTTPS Cloudflare frontend origin.
+- `BACKEND_URL`: public HTTPS origin of this Space.
+- `SUPABASE_URL`, `SUPABASE_ANON_KEY`, `SUPABASE_SERVICE_ROLE_KEY`.
+- `CORE_REPO_ID`, `STORAGE_REPO_ID`, `HF_TOKEN`; optionally `CORE_REVISION`.
+- `ANALYSIS_PROXY_SECRET`: a random secret with at least 32 characters.
+
+Store tokens, the service-role key, and proxy secret as Space secrets. `HF_TOKEN` requires read access to Core and write access to the private storage dataset. Use a dedicated storage dataset for this application. `start.py` sets `ANALYSIS_API_URL` and `BACKEND_INTERNAL_URL` automatically; do not configure a separate public AI URL.
+
+For a local Docker check, build with `docker build -t sporalize-backend .`, then run `docker run --rm --env-file .env -e PORT=7860 -p 7860:7860 sporalize-backend`. The `.env` NODE_ENV setting controls whether production HTTPS checks apply.
+
+Node health: `GET /health`. AI health is internal at `http://127.0.0.1:8000/healthz` and becomes available after model initialization. Node health alone does not indicate model readiness. Video uploads go through Node directly to Python without Vercel. Validate hosting timeouts and representative large uploads before release.
+
+Run one container with one Python worker: analysis jobs and retry payloads are in memory and are lost on restart. Temporary local files are ephemeral. Completed videos and `results.json` are stored in the private HF dataset; Node stores session metadata and frame indices in Supabase. Model constants are in `app.py`.
+
+Apply `../Database/migrations/20261016_node_analysis.sql` before analyses. It assumes the legacy actions table is empty. Secret-protected `/internal/analysis` routes authorize sessions and persist completion/failure.
+
+## Supabase dashboard setup
+
+1. Authentication → Providers → Email: enable it and enable **Confirm email**.
+2. Authentication → Providers → Google: enable it, add the Google client ID/secret, and use Supabase's displayed callback URL in Google Cloud.
+3. Authentication → URL Configuration:
+   - Site URL: `http://localhost:8080` during development.
+   - Redirect URLs: `http://localhost:4000/api/auth/callback` and the production equivalent.
+
+## Brevo email verification
+
+Brevo is configured as Supabase Auth's SMTP provider; the Express API does not send verification messages directly.
+
+1. Create a Brevo account and verify the sender email/domain you will use.
+2. In Brevo open **Transactional → Settings → SMTP & API → SMTP** and create an SMTP key.
+3. In Supabase open **Authentication → Emails → SMTP Settings**, enable custom SMTP, and enter:
+   - Host: `smtp-relay.brevo.com`
+   - Port: `587`
+   - Username: the Brevo SMTP login shown on the SMTP page (not the account email unless they match)
+   - Password: the Brevo SMTP key (not the account password)
+   - Sender email: the verified Brevo sender
+   - Sender name: `Sporalize`
+4. Keep **Confirm email** enabled under Authentication → Providers → Email.
+5. In **Authentication → Email Templates → Confirm signup**, set the confirmation link to the backend's absolute URL (replace `https://your-api-domain` with the deployed API origin):
+
+   ```html
+   <h2>Confirm your Sporalize account</h2>
+   <p><a href="https://your-api-domain/api/auth/confirm?token_hash={{ .TokenHash }}">Confirm email</a></p>
+   ```
+
+   Set **Site URL** to the frontend origin. Keep the backend callback URL in **Authentication → URL Configuration → Redirect URLs** for Google sign-in, and add its production equivalent. The email template links directly to the backend confirmation endpoint, which verifies the one-time token and creates the application's secure session cookies.
+
+Brevo credentials stay in Supabase SMTP settings and are not added to the browser or committed to `.env`.
+
+## Routes
 
-Deploy `AI/API` as a public Docker Space and `AI/Core` as a private dataset. The API loads `pipeline.py` and weights from Core at startup. The public service is accessible only through the Node backend using `ANALYSIS_PROXY_SECRET`; the health endpoint is public. Supabase credentials stay in Node.
+- `POST /api/auth/signup` — `{ fname, lname, email, password, academy? }`; sends Supabase's confirmation email when confirmation is enabled.
+- `POST /api/auth/login` — `{ email, password }`.
+- `GET /api/auth/google?redirect=/labs` — starts Google OAuth.
+- `GET /api/auth/callback` — exchanges the Supabase code and sets HttpOnly cookies.
+- `GET /api/auth/confirm?token_hash=...` — verifies the signup email and sets HttpOnly cookies.
+- `GET /api/auth/me` — verifies the session and refreshes it when necessary.
+- `POST /api/auth/logout` — clears the session cookies.
+- `GET /api/auth/profile` and `PATCH /api/auth/profile` — read and update the signed-in user's profile.
+- `POST /api/auth/password` — change or set the signed-in user's password.
+- `DELETE /api/auth/account` — delete the signed-in user's Supabase Auth account and profile row.
 
-Copy `.env.example` to `.env` for local use. Set `HF_TOKEN` with read access to Core and write access to a new private storage dataset. Set `BACKEND_URL` and the same `ANALYSIS_PROXY_SECRET` as Node. `CORE_REVISION` can pin the private Core dataset revision.
+To allow profiles with no selected role, apply `Database/migrations/20261015_user_role_optional.sql` to the Supabase database once. New accounts start with a `NULL` role and academy; users can complete both from `/labs/profile`.
 
-Model settings are constants near the top of `app.py`: `POSE_MODEL_FILE`, `POSE_MODEL_REPO_ID`, `YOLO_MODEL_FILE`, `YOLO_MODEL_REPO_ID`, and `YOLO_IMGSZ`. Change those values to select weights or detector input size. Video uploads do not have an application-level size limit.
+## Subscription activation flow
 
-The storage dataset contains only the pipeline's `results.json` and source videos under `sessions/<session UUID>/`. Calibration and action input files are temporary. `results.json` is the direct pipeline return after NumPy values are serialized and non-finite values become `null`.
+The access gate already reads `users_subscriptions` and only unlocks Sporalize Labs while `startdate` and `enddate` include today.
 
-`POST /api/analyze` accepts `playerId`, `clientId`, `videoOrders`, either uploaded `videos` or `videoDriveLinks`, `actionsJson`, `calibration`, and optional `sessionName`. Drive videos must be publicly downloadable. The service asks Node to authorize/create the session, saves results and videos to the HF dataset, then sends the path and action frame details to Node. Node owns the database and stores frame indices; FPS remains in `results.json`.
+When a payment provider is added, the server-side webhook flow should:
 
-The authorized session endpoint adapts stored reports to the Results screen shape and provides private video URLs. Other endpoints include `/api/progress/{clientId}`, `/api/active-analyses`, `/api/cancel/{clientId}`, and `/api/retry-save/{clientId}`. All except `/healthz` require trusted proxy headers. Run one process because jobs and retry payloads are held in memory and do not survive a restart.
+1. Verify the provider signature and confirm the payment is paid.
+2. Resolve the authenticated Sporalize user ID and the selected `subscriptions.subscription_id` from trusted checkout metadata.
+3. Call `assignPaidSubscription` from `src/subscriptions.ts` with the paid period dates.
 
-Apply `../../Database/migrations/20261016_node_analysis.sql` in Supabase. The older `20261016_analysis_persistence.sql` migration is not used.
+That helper upserts the user's single current plan in `users_subscriptions`. The existing access check then opens Labs, session details, and analysis automatically. The browser return page must not assign access by itself. Store provider payment references/idempotency records when the provider integration is implemented.

app.py

@@ -47,7 +47,7 @@ def hub():
 def backend(path, user_id, method="GET", body=None):
     for attempt in range(3):
         try:
-            response = httpx.request(method, f'{os.environ["BACKEND_URL"].rstrip("/")}/internal/analysis{path}',
+            response = httpx.request(method, f'{os.environ["BACKEND_INTERNAL_URL"].rstrip("/")}/internal/analysis{path}',
                 json=body, timeout=60, headers={"x-sporalize-proxy-secret": os.environ["ANALYSIS_PROXY_SECRET"], "x-sporalize-user-id": user_id})
             response.raise_for_status()
             return response.json() if response.content else None
@@ -59,9 +59,13 @@ def backend(path, user_id, method="GET", body=None):
 
 @lru_cache(maxsize=1)
 def runtime():
-    root = Path(snapshot_download(repo_id=os.environ["CORE_REPO_ID"], repo_type="dataset",
-        revision=os.environ.get("CORE_REVISION"), token=os.environ["HF_TOKEN"],
-        allow_patterns=["pipeline.py", "Weights/*"]))
+    root = Path(__file__).resolve().parent.parent / "Core"
+    if not (root / "pipeline.py").is_file():
+        if not os.environ.get("CORE_REPO_ID"):
+            raise RuntimeError("CORE_REPO_ID is required when Core is not included locally")
+        root = Path(snapshot_download(repo_id=os.environ["CORE_REPO_ID"], repo_type="dataset",
+            revision=os.environ.get("CORE_REVISION"), token=os.environ["HF_TOKEN"],
+            allow_patterns=["pipeline.py", "Weights/*"]))
     spec = importlib.util.spec_from_file_location("sporalize_core", root / "pipeline.py")
     module = importlib.util.module_from_spec(spec)
     spec.loader.exec_module(module)
@@ -98,7 +102,7 @@ def runtime():
 
 @asynccontextmanager
 async def lifespan(app):
-    for name in ("CORE_REPO_ID", "STORAGE_REPO_ID", "HF_TOKEN", "BACKEND_URL"):
+    for name in ("STORAGE_REPO_ID", "HF_TOKEN", "BACKEND_INTERNAL_URL"):
         if not os.environ.get(name):
             raise RuntimeError(f"{name} is required")
     if len(os.environ.get("ANALYSIS_PROXY_SECRET", "")) < 32:

package-lock.json

@@ -0,0 +1,1749 @@
+{
+  "name": "sporalize-backend",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "sporalize-backend",
+      "version": "1.0.0",
+      "dependencies": {
+        "@supabase/supabase-js": "^2.57.0",
+        "bcryptjs": "^3.0.2",
+        "cookie-parser": "^1.4.7",
+        "cors": "^2.8.5",
+        "dotenv": "^16.6.1",
+        "express": "^5.1.0",
+        "express-rate-limit": "^8.1.0",
+        "helmet": "^8.1.0",
+        "zod": "^4.1.5"
+      },
+      "devDependencies": {
+        "@types/cookie-parser": "^1.4.9",
+        "@types/cors": "^2.8.19",
+        "@types/express": "^5.0.3",
+        "@types/node": "^22.16.5",
+        "tsx": "^4.20.5",
+        "typescript": "^5.8.3"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
+      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
+      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
+      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
+      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
+      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
+      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
+      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
+      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
+      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
+      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
+      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
+      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
+      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
+      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
+      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
+      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
+      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
+      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
+      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
+      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
+      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@supabase/auth-js": {
+      "version": "2.118.0",
+      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.118.0.tgz",
+      "integrity": "sha512-xWfPXyhS2KDSfAneMtI6p/tBnbdiz/5vaRKXEqUfzfC9WCniKr2Ds5o5G7RIGig0bom4z6wUY9zaV07WDVTfnQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/functions-js": {
+      "version": "2.118.0",
+      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.118.0.tgz",
+      "integrity": "sha512-4ofletPa/noKAU6KHeqsd3FztGzRPUEJRey1MKY0o+PIHaVePqRPShIXtl37gcVyIWaFM+zNg6r9zh0uUSFOSA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/phoenix": {
+      "version": "0.4.5",
+      "resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.5.tgz",
+      "integrity": "sha512-aAn9H9ovVyeApKy11OWOrrOGq8DV68yWeH4ud2lN9fzn4aO8Zb5GLL9m1pUg9nLqIcT+ZDfAcsZe0E/nqdv2lw==",
+      "license": "MIT"
+    },
+    "node_modules/@supabase/postgrest-js": {
+      "version": "2.118.0",
+      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.118.0.tgz",
+      "integrity": "sha512-JXy+37KPApHsyotaQACovv/Jy9E22rfiWLRuT+2UjoEAcAIelDFIrsF/FY47Dy19mO7lI0Tq+zDCX8oJ2Ozfiw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/realtime-js": {
+      "version": "2.118.0",
+      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.118.0.tgz",
+      "integrity": "sha512-pzCIEWjqD5/xqEZQerpt+q9rsgYkcrkgCJgf0W2ULqC4fYUeB/p9CFa3t9vn+IVh6dMN9r4ZCE262lZvUC+Bfw==",
+      "license": "MIT",
+      "dependencies": {
+        "@supabase/phoenix": "0.4.5",
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/storage-js": {
+      "version": "2.118.0",
+      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.118.0.tgz",
+      "integrity": "sha512-5MNkKt2Moy7Jud/sPX7/28BwdDxZMCVHGJT00b8op3KRa9LKSjOAYU5IcfGWIstaasAqY8GkbA6oI3IRDgB1YQ==",
+      "license": "MIT",
+      "dependencies": {
+        "iceberg-js": "^0.8.1",
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/supabase-js": {
+      "version": "2.118.0",
+      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.118.0.tgz",
+      "integrity": "sha512-FxI8UXMVC2UG7IkeiI8fuQZqq2oI3JeSuN8MPIC2RLVaoEAxKS0nqE6kii9Ewpq8f9gNPM6git1Y8f0vN/QLFw==",
+      "license": "MIT",
+      "dependencies": {
+        "@supabase/auth-js": "2.118.0",
+        "@supabase/functions-js": "2.118.0",
+        "@supabase/postgrest-js": "2.118.0",
+        "@supabase/realtime-js": "2.118.0",
+        "@supabase/storage-js": "2.118.0"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@opentelemetry/api": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@types/body-parser": {
+      "version": "1.19.6",
+      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
+      "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/connect": "*",
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/connect": {
+      "version": "3.4.38",
+      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
+      "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/cookie-parser": {
+      "version": "1.4.10",
+      "resolved": "https://registry.npmjs.org/@types/cookie-parser/-/cookie-parser-1.4.10.tgz",
+      "integrity": "sha512-B4xqkqfZ8Wek+rCOeRxsjMS9OgvzebEzzLYw7NHYuvzb7IdxOkI0ZHGgeEBX4PUM7QGVvNSK60T3OvWj3YfBRg==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/express": "*"
+      }
+    },
+    "node_modules/@types/cors": {
+      "version": "2.8.19",
+      "resolved": "https://registry.npmjs.org/@types/cors/-/cors-2.8.19.tgz",
+      "integrity": "sha512-mFNylyeyqN93lfe/9CSxOGREz8cpzAhH+E93xJ4xWQf62V8sQ/24reV2nyzUWM6H6Xji+GGHpkbLe7pVoUEskg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/express": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.6.tgz",
+      "integrity": "sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/body-parser": "*",
+        "@types/express-serve-static-core": "^5.0.0",
+        "@types/serve-static": "^2"
+      }
+    },
+    "node_modules/@types/express-serve-static-core": {
+      "version": "5.1.3",
+      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.3.tgz",
+      "integrity": "sha512-dPfW8NFiOF4wOHc7+N/QSxlY9cfSsenewGbAz8C8U/MULPd/YZ27LvJUIlzaXie7e6Ove9YunJGgC9tbHD2cKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "@types/qs": "*",
+        "@types/range-parser": "*",
+        "@types/send": "*"
+      }
+    },
+    "node_modules/@types/http-errors": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz",
+      "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "22.20.5",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
+      "integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@types/qs": {
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/range-parser": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
+      "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/send": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz",
+      "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/serve-static": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-2.2.0.tgz",
+      "integrity": "sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/http-errors": "*",
+        "@types/node": "*"
+      }
+    },
+    "node_modules/accepts": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
+      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "^3.0.0",
+        "negotiator": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/bcryptjs": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-3.0.3.tgz",
+      "integrity": "sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g==",
+      "license": "BSD-3-Clause",
+      "bin": {
+        "bcrypt": "bin/bcrypt"
+      }
+    },
+    "node_modules/body-parser": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "^3.1.2",
+        "content-type": "^2.0.0",
+        "debug": "^4.4.3",
+        "http-errors": "^2.0.1",
+        "iconv-lite": "^0.7.2",
+        "on-finished": "^2.4.1",
+        "qs": "^6.15.2",
+        "raw-body": "^3.0.2",
+        "type-is": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
+      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-parser": {
+      "version": "1.4.7",
+      "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.7.tgz",
+      "integrity": "sha512-nGUvgXnotP3BsjiLX2ypbQnWoGUPIIfHQNZkkC668ntrzGWEZVW70HDEB1qnNGMicPje6EttlIgzo51YSwNQGw==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "0.7.2",
+        "cookie-signature": "1.0.6"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==",
+      "license": "MIT"
+    },
+    "node_modules/cors": {
+      "version": "2.8.6",
+      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
+      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
+      "license": "MIT",
+      "dependencies": {
+        "object-assign": "^4",
+        "vary": "^1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/dotenv": {
+      "version": "16.6.1",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
+      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "license": "MIT"
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
+      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.28.2",
+        "@esbuild/android-arm": "0.28.2",
+        "@esbuild/android-arm64": "0.28.2",
+        "@esbuild/android-x64": "0.28.2",
+        "@esbuild/darwin-arm64": "0.28.2",
+        "@esbuild/darwin-x64": "0.28.2",
+        "@esbuild/freebsd-arm64": "0.28.2",
+        "@esbuild/freebsd-x64": "0.28.2",
+        "@esbuild/linux-arm": "0.28.2",
+        "@esbuild/linux-arm64": "0.28.2",
+        "@esbuild/linux-ia32": "0.28.2",
+        "@esbuild/linux-loong64": "0.28.2",
+        "@esbuild/linux-mips64el": "0.28.2",
+        "@esbuild/linux-ppc64": "0.28.2",
+        "@esbuild/linux-riscv64": "0.28.2",
+        "@esbuild/linux-s390x": "0.28.2",
+        "@esbuild/linux-x64": "0.28.2",
+        "@esbuild/netbsd-arm64": "0.28.2",
+        "@esbuild/netbsd-x64": "0.28.2",
+        "@esbuild/openbsd-arm64": "0.28.2",
+        "@esbuild/openbsd-x64": "0.28.2",
+        "@esbuild/openharmony-arm64": "0.28.2",
+        "@esbuild/sunos-x64": "0.28.2",
+        "@esbuild/win32-arm64": "0.28.2",
+        "@esbuild/win32-ia32": "0.28.2",
+        "@esbuild/win32-x64": "0.28.2"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/express": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/express/-/express-5.3.0.tgz",
+      "integrity": "sha512-qCqy1xSoaugxOD4IVHb1ZWdkvCF2W3aE2okKouWj8VwJ+ztskSiXoBnCSJqfKT+cVPJhuJqe9YLbY425+Zh00g==",
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "^2.0.0",
+        "body-parser": "^2.3.0",
+        "content-disposition": "^2.0.1",
+        "content-type": "^2.0.0",
+        "cookie": "^0.7.1",
+        "cookie-signature": "^1.2.1",
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "finalhandler": "^2.1.0",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.0",
+        "merge-descriptors": "^2.0.0",
+        "mime-types": "^3.0.0",
+        "on-finished": "^2.4.1",
+        "once": "^1.4.0",
+        "parseurl": "^1.3.3",
+        "proxy-addr": "^2.0.8",
+        "qs": "^6.16.0",
+        "range-parser": "^1.2.1",
+        "router": "^2.2.0",
+        "send": "^1.1.0",
+        "serve-static": "^2.2.0",
+        "statuses": "^2.0.1",
+        "type-is": "^2.1.0",
+        "vary": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/express-rate-limit": {
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.1.tgz",
+      "integrity": "sha512-2FXbqkygil3mZiXzEtM0IjE/UBmBNot0J1GEVrJT4JbrvwOSoEtqtO+wHbiMQELWe1eNvHoYRg2dkjOid+6JkA==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "ip-address": "^10.2.0"
+      },
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": ">= 4.11"
+      }
+    },
+    "node_modules/express/node_modules/cookie-signature": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
+      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.6.0"
+      }
+    },
+    "node_modules/finalhandler": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
+      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "on-finished": "^2.4.1",
+        "parseurl": "^1.3.3",
+        "statuses": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
+      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/helmet": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.3.0.tgz",
+      "integrity": "sha512-Qgpiaws3Sm30Av8Eah6sjMCZZwjlBu+E68rhpCWBshY1lb09HtLwj5GviX0OyQIn+ulUS0iX0AxN5n3tLZzz1w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/EvanHahn"
+      }
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/iceberg-js": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/iceberg-js/-/iceberg-js-0.8.1.tgz",
+      "integrity": "sha512-1dhVQZXhcHje7798IVM+xoo/1ZdVfzOMIc8/rgVSijRK38EDqOJoGula9N/8ZI5RD8QTxNQtK/Gozpr+qUqRRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ip-address": {
+      "version": "10.7.4",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz",
+      "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/is-promise": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
+      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
+      "license": "MIT"
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz",
+      "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
+      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.54.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
+      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
+      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "^1.54.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/negotiator": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz",
+      "integrity": "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==",
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "8.4.2",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
+      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.16.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
+      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
+      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.7.0",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/router": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
+      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "is-promise": "^4.0.0",
+        "parseurl": "^1.3.3",
+        "path-to-regexp": "^8.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/send": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
+      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.1",
+        "mime-types": "^3.0.2",
+        "ms": "^2.1.3",
+        "on-finished": "^2.4.1",
+        "range-parser": "^1.2.1",
+        "statuses": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/serve-static": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
+      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "parseurl": "^1.3.3",
+        "send": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/tsx": {
+      "version": "4.23.15",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.15.tgz",
+      "integrity": "sha512-Yiex1Ovn8z2xPpOWckIiysV1SSyRMY9BkLF++q0yKiDxCqRhosKfMg3janKkiLBwZ5c/YryloKwGZcrEmtwxKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "~0.28.0"
+      },
+      "bin": {
+        "tsx": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^2.0.0",
+        "media-typer": "^1.1.0",
+        "mime-types": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
+    "node_modules/zod": {
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}

package.json

@@ -0,0 +1,30 @@
+{
+  "name": "sporalize-backend",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/server.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "python start.py"
+  },
+  "dependencies": {
+    "@supabase/supabase-js": "^2.57.0",
+    "bcryptjs": "^3.0.2",
+    "cookie-parser": "^1.4.7",
+    "cors": "^2.8.5",
+    "dotenv": "^16.6.1",
+    "express": "^5.1.0",
+    "express-rate-limit": "^8.1.0",
+    "helmet": "^8.1.0",
+    "zod": "^4.1.5"
+  },
+  "devDependencies": {
+    "@types/cookie-parser": "^1.4.9",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.3",
+    "@types/node": "^22.16.5",
+    "tsx": "^4.20.5",
+    "typescript": "^5.8.3"
+  }
+}

src/analysis.ts

@@ -0,0 +1,84 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import express from "express";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { z } from "zod";
+
+export function stableId(value: string) {
+  const hex = createHash("sha256").update(value).digest("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-5${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+
+const beginSchema = z.object({ clientId: z.uuid(), playerId: z.string().trim().min(1).max(100), name: z.string().trim().max(150) });
+const reportSchema = z.object({
+  index: z.number().int().nonnegative(), action: z.string().min(1).max(50),
+  start_frame: z.number().int().nonnegative().optional(), end_frame: z.number().int().nonnegative().optional(),
+  error: z.string().max(2000).optional(),
+});
+export const completionSchema = z.discriminatedUnion("status", [
+  z.object({ status: z.literal("completed"), path: z.string(), actions: z.array(reportSchema).max(5000) }),
+  z.object({ status: z.enum(["failed", "cancelled"]) }),
+]);
+
+export function actionRows(sessionId: string, reports: z.infer<typeof reportSchema>[]) {
+  if (new Set(reports.map((report) => report.index)).size !== reports.length) throw new Error("Duplicate action index");
+  return reports.filter((report) => report.error === undefined).map((report) => {
+    const { start_frame: startFrame, end_frame: endFrame } = report;
+    if (startFrame === undefined || endFrame === undefined || endFrame < startFrame) throw new Error("Invalid action interval");
+    return { action_id: stableId(`${sessionId}:${report.index}`), type: report.action,
+      start_frame: startFrame, end_frame: endFrame };
+  });
+}
+
+export function analysisRouter(db: SupabaseClient, secret: string) {
+  const router = express.Router();
+  router.use((req, res, next) => {
+    const supplied = Buffer.from(req.header("x-sporalize-proxy-secret") ?? "");
+    const expected = Buffer.from(secret);
+    if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) return res.sendStatus(403);
+    const user = z.uuid().safeParse(req.header("x-sporalize-user-id"));
+    if (!user.success) return res.sendStatus(403);
+    res.locals.userId = user.data;
+    next();
+  });
+  router.use(express.json({ limit: "2mb" }));
+  router.post("/", async (req, res, next) => {
+    try {
+      const input = beginSchema.parse(req.body);
+      const playerId = z.uuid().safeParse(input.playerId);
+      const { data, error } = await db.rpc("begin_analysis", {
+        p_session_id: input.clientId, p_user_id: res.locals.userId,
+        p_player_id: playerId.success ? playerId.data : stableId(`${res.locals.userId}:player:${input.playerId}`),
+        p_reference: playerId.success ? null : input.playerId,
+        p_name: input.name || `Session ${input.clientId.slice(0, 8)}`,
+      });
+      if (error) return res.status(error.code === "P0001" ? 409 : 503).json({ error: "Unable to prepare analysis session" });
+      return res.json(data);
+    } catch (error) { next(error); }
+  });
+  router.get("/:sessionId", async (req, res, next) => {
+    try {
+      const sessionId = z.uuid().parse(req.params.sessionId);
+      const { data, error } = await db.from("sessions").select("session_id,player_id,path,status,name,created_at")
+        .eq("session_id", sessionId).eq("user_id", res.locals.userId).maybeSingle();
+      if (error) return res.status(503).json({ error: "Unable to load session" });
+      return data ? res.json(data) : res.sendStatus(404);
+    } catch (error) { next(error); }
+  });
+  router.put("/:sessionId", async (req, res, next) => {
+    try {
+      const sessionId = z.uuid().parse(req.params.sessionId);
+      const input = completionSchema.parse(req.body);
+      if (input.status === "completed" && input.path !== `sessions/${sessionId}`) return res.sendStatus(400);
+      let actions;
+      try { actions = input.status === "completed" ? actionRows(sessionId, input.actions) : []; }
+      catch { return res.status(400).json({ error: "Invalid action details" }); }
+      const { error } = await db.rpc("finish_analysis", {
+        p_session_id: sessionId, p_user_id: res.locals.userId, p_status: input.status,
+        p_path: input.status === "completed" ? input.path : null, p_actions: actions,
+      });
+      if (error) return res.status(error.code === "P0001" ? 409 : 503).json({ error: "Unable to save analysis" });
+      return res.json({ ok: true });
+    } catch (error) { next(error); }
+  });
+  return router;
+}

src/auth.ts

@@ -0,0 +1,54 @@
+import type { Request, Response } from "express";
+import type { Session, User } from "@supabase/supabase-js";
+import { env, isProduction } from "./config.js";
+import { supabaseAuth } from "./supabase.js";
+
+const accessCookie = "sp_access";
+const refreshCookie = "sp_refresh";
+const sameSite = isProduction ? "none" as const : "lax" as const;
+const cookieOptions = { httpOnly: true, secure: isProduction, sameSite, path: "/" };
+
+export function setSessionCookies(res: Response, session: Session) {
+  res.cookie(accessCookie, session.access_token, { ...cookieOptions, maxAge: Math.max(session.expires_in * 1000, 60_000) });
+  res.cookie(refreshCookie, session.refresh_token, { ...cookieOptions, maxAge: 1000 * 60 * 60 * 24 * 30 });
+}
+
+export function clearSessionCookies(res: Response) {
+  res.clearCookie(accessCookie, cookieOptions);
+  res.clearCookie(refreshCookie, cookieOptions);
+}
+
+export async function authenticatedUser(req: Request, res: Response): Promise<{ user: User; session?: Session } | null> {
+  const accessToken = req.cookies?.[accessCookie] as string | undefined;
+  const refreshToken = req.cookies?.[refreshCookie] as string | undefined;
+  if (!accessToken && !refreshToken) return null;
+
+  if (accessToken) {
+    const { data, error } = await supabaseAuth.auth.getUser(accessToken);
+    if (data.user && !error) return { user: data.user };
+  }
+
+  if (!refreshToken) {
+    clearSessionCookies(res);
+    return null;
+  }
+  const { data, error } = await supabaseAuth.auth.refreshSession({ refresh_token: refreshToken });
+  if (error || !data.user || !data.session) {
+    clearSessionCookies(res);
+    return null;
+  }
+  setSessionCookies(res, data.session);
+  return { user: data.user, session: data.session };
+}
+
+export function safeRedirect(path: unknown) {
+  const frontend = new URL(env.FRONTEND_URL);
+  const fallback = new URL("/labs", frontend).toString();
+  if (typeof path !== "string" || !path.startsWith("/")) return fallback;
+  try {
+    const target = new URL(path, frontend);
+    return target.origin === frontend.origin ? target.toString() : fallback;
+  } catch {
+    return fallback;
+  }
+}

src/config.ts

@@ -0,0 +1,42 @@
+import "dotenv/config";
+import { z } from "zod";
+
+const envSchema = z.object({
+  PORT: z.coerce.number().int().min(1).max(65535).default(4000),
+  TRUST_PROXY_HOPS: z.coerce.number().int().min(0).max(5).default(1),
+  NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
+  FRONTEND_URL: z.string().url(),
+  BACKEND_URL: z.string().url(),
+  ANALYSIS_API_URL: z.string().url().default("http://127.0.0.1:8000"),
+  ANALYSIS_PROXY_SECRET: z.string().min(32),
+  SUPABASE_URL: z.string().url(),
+  SUPABASE_ANON_KEY: z.string().min(1),
+  SUPABASE_SERVICE_ROLE_KEY: z.string().min(1),
+});
+
+const parsed = envSchema.safeParse(process.env);
+if (!parsed.success) {
+  console.error("Invalid environment configuration:", parsed.error.flatten().fieldErrors);
+  process.exit(1);
+}
+
+export const env = parsed.data;
+export const isProduction = env.NODE_ENV === "production";
+
+if (isProduction) {
+  for (const name of ["FRONTEND_URL", "BACKEND_URL", "SUPABASE_URL"] as const) {
+    const url = new URL(env[name]);
+    if (url.protocol !== "https:" || ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
+      console.error(`${name} must use a public HTTPS URL in production`);
+      process.exit(1);
+    }
+  }
+}
+
+
+// Trusted identity headers must stay inside the combined backend.
+const analysisUrl = new URL(env.ANALYSIS_API_URL);
+if (analysisUrl.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(analysisUrl.hostname)) {
+  console.error("ANALYSIS_API_URL must use HTTP on loopback");
+  process.exit(1);
+}

src/server.ts

@@ -0,0 +1,494 @@
+import express, { type NextFunction, type Request, type Response } from "express";
+import cors from "cors";
+import cookieParser from "cookie-parser";
+import helmet from "helmet";
+import rateLimit from "express-rate-limit";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { z } from "zod";
+import { env } from "./config.js";
+import { analysisRouter } from "./analysis.js";
+import { authenticatedUser, clearSessionCookies, safeRedirect, setSessionCookies } from "./auth.js";
+import { hashPassword, supabaseAdmin, supabaseAuth, syncProfile, userHasPassword, userPayload } from "./supabase.js";
+
+const app = express();
+app.disable("x-powered-by");
+app.set("trust proxy", env.TRUST_PROXY_HOPS);
+app.use(helmet());
+app.use(cors({
+  origin: env.FRONTEND_URL,
+  credentials: true,
+  methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+}));
+app.use("/internal/analysis", analysisRouter(supabaseAdmin, env.ANALYSIS_PROXY_SECRET));
+app.use(express.json({ limit: "32kb" }));
+app.use(cookieParser());
+app.use((req, res, next) => {
+  if (["GET", "HEAD", "OPTIONS"].includes(req.method)) return next();
+  if (req.header("origin") !== new URL(env.FRONTEND_URL).origin) return res.sendStatus(403);
+  return next();
+});
+
+const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 25, standardHeaders: "draft-8", legacyHeaders: false });
+const signupSchema = z.object({ fname: z.string().trim().min(1).max(100), lname: z.string().trim().min(1).max(100), email: z.string().trim().toLowerCase().email().max(255), password: z.string().min(8).max(128), academy: z.string().trim().max(150).optional() });
+const loginSchema = z.object({ email: z.string().trim().toLowerCase().email(), password: z.string().min(1).max(128) });
+const profileRoles = ["football_player", "coach", "club_manager", "academy_manager", "scout", "performance_analyst", "sports_director", "other"] as const;
+const profileSchema = z.object({
+  fname: z.string().trim().min(1).max(100),
+  lname: z.string().trim().min(1).max(100),
+  academy: z.string().trim().max(150).transform((value) => value || null).nullable(),
+  role: z.enum(profileRoles).nullable(),
+});
+const passwordSchema = z.object({ currentPassword: z.string().max(128).optional(), newPassword: z.string().min(8).max(128) });
+
+async function activeSubscriptionFor(userId: string) {
+  const today = new Date().toISOString().slice(0, 10);
+  const { data: assignment, error } = await supabaseAdmin.from("users_subscriptions")
+    .select("subscription_id,startdate,enddate").eq("user_id", userId).maybeSingle();
+  if (error) throw new Error(`Unable to check subscription: ${error.message}`);
+  if (!assignment?.subscription_id || assignment.startdate > today || assignment.enddate < today) return null;
+
+  const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions")
+    .select("subscription_id,plan,price").eq("subscription_id", assignment.subscription_id).maybeSingle();
+  if (planError) throw new Error(`Unable to load subscription plan: ${planError.message}`);
+  return plan ? { ...plan, startdate: assignment.startdate, enddate: assignment.enddate } : null;
+}
+
+async function requireActiveSubscription(req: Request, res: Response) {
+  const current = await authenticatedUser(req, res);
+  if (!current) {
+    res.status(401).json({ error: "Authentication required." });
+    return null;
+  }
+  if (!await activeSubscriptionFor(current.user.id)) {
+    res.status(402).json({ error: "An active subscription is required to access Sporalize Labs.", code: "subscription_required" });
+    return null;
+  }
+  return current;
+}
+
+app.get("/health", (_req, res) => res.json({ ok: true }));
+
+app.get("/api/subscriptions", async (_req, res, next) => {
+  try {
+    const { data, error } = await supabaseAdmin.from("subscriptions")
+      .select("subscription_id,plan,price")
+      .order("price", { ascending: true });
+    if (error) throw new Error(`Unable to load subscription plans: ${error.message}`);
+    const plans = (data ?? []).map((row) => ({
+      id: row.plan.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-"),
+      subscriptionId: row.subscription_id,
+      name: row.plan,
+      monthlyPrice: Number(row.price),
+    }));
+    return res.json({ plans });
+  } catch (error) { next(error); }
+});
+
+app.get("/api/subscription/access", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    const subscription = await activeSubscriptionFor(current.user.id);
+    return res.json({ active: Boolean(subscription), subscription });
+  } catch (error) { next(error); }
+});
+
+// Players and sessions are currently a shared workspace: all signed-in users
+// can read the common catalogue. Revisit these read scopes if per-user data is
+// introduced later. The service-role client bypasses RLS, so keep this explicit.
+app.get("/api/players-overview", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+
+    const { data: rows, error } = await supabaseAdmin.from("players")
+      .select("player_id,user_id,fname,lname,bdate,height,weight,position,club")
+      .order("fname", { ascending: true });
+    if (error) throw new Error(`Unable to load players: ${error.message}`);
+
+    const playerIds = (rows ?? []).map((row) => row.player_id);
+    const { data: sessions, error: sessionsError } = playerIds.length
+      ? await supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at")
+        .in("player_id", playerIds).order("created_at", { ascending: false })
+      : { data: [], error: null };
+    if (sessionsError) throw new Error(`Unable to load player sessions: ${sessionsError.message}`);
+
+    const sessionIds = (sessions ?? []).map((row) => row.session_id);
+    const { data: actions, error: actionsError } = sessionIds.length
+      ? await supabaseAdmin.from("actions").select("action_id,session_id,type")
+        .in("session_id", sessionIds)
+      : { data: [], error: null };
+    if (actionsError) throw new Error(`Unable to load player actions: ${actionsError.message}`);
+
+    const actionIds = (actions ?? []).map((row) => row.action_id);
+    const { data: annotations, error: annotationsError } = actionIds.length
+      ? await supabaseAdmin.from("annotations").select("action_id,score").in("action_id", actionIds)
+      : { data: [], error: null };
+    if (annotationsError) throw new Error(`Unable to load action scores: ${annotationsError.message}`);
+
+    const scoresByAction = new Map((annotations ?? []).map((row) => [row.action_id, row.score == null ? null : Number(row.score)]));
+    const sessionsByPlayer = new Map<string, typeof sessions>();
+    for (const session of sessions ?? []) sessionsByPlayer.set(session.player_id, [...(sessionsByPlayer.get(session.player_id) ?? []), session]);
+    const actionsBySession = new Map<string, typeof actions>();
+    for (const action of actions ?? []) actionsBySession.set(action.session_id, [...(actionsBySession.get(action.session_id) ?? []), action]);
+
+    const players = (rows ?? []).map((row) => {
+      const playerSessions = sessionsByPlayer.get(row.player_id) ?? [];
+      const playerActions = playerSessions.flatMap((session) => actionsBySession.get(session.session_id) ?? []);
+      const scored = playerActions.map((action) => scoresByAction.get(action.action_id)).filter((score): score is number => score != null && Number.isFinite(score));
+      const byAction = [...new Set(playerActions.map((action) => action.type))].map((type) => {
+        const matching = playerActions.filter((action) => action.type === type);
+        const values = matching.map((action) => scoresByAction.get(action.action_id)).filter((score): score is number => score != null && Number.isFinite(score));
+        return { axis: type, score: values.length ? values.reduce((sum, value) => sum + value, 0) / values.length : null, samples: values.length };
+      });
+      const playerScoreSessions = playerSessions.map((session) => {
+        const sessionActions = actionsBySession.get(session.session_id) ?? [];
+        const values = sessionActions.map((action) => scoresByAction.get(action.action_id)).filter((score): score is number => score != null && Number.isFinite(score));
+        return { sessionId: session.session_id, createdAt: Date.parse(session.created_at) || 0, score: values.length ? values.reduce((sum, value) => sum + value, 0) / values.length : null, actionCount: sessionActions.length, scoredCount: values.length };
+      });
+      return {
+        playerId: row.player_id,
+        name: [row.fname, row.lname].filter(Boolean).join(" "),
+        age: row.bdate ? String(Math.max(0, new Date().getFullYear() - new Date(row.bdate).getFullYear())) : "",
+        heightCm: row.height == null ? "" : String(row.height),
+        weightKg: row.weight == null ? "" : String(row.weight),
+        club: row.club ?? "", position: row.position ?? "", dominantFoot: "", notes: "", avatarPath: "",
+        createdAt: "", updatedAt: "", hasProfile: true,
+        sessionCount: playerSessions.length, actionCount: playerActions.length,
+        lastSessionAt: playerScoreSessions[0]?.createdAt ?? 0,
+        scores: {
+          playerId: row.player_id, rubricVersion: "database", totalActions: playerActions.length,
+          scoredActions: scored.length, byAction, byQuality: [],
+          overall: scored.length ? scored.reduce((sum, value) => sum + value, 0) / scored.length : null,
+          sessions: playerScoreSessions,
+        },
+      };
+    });
+
+    return res.json({ players });
+  } catch (error) { next(error); }
+});
+
+app.get("/api/players-overview/:playerId", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    const playerId = z.string().uuid().safeParse(req.params.playerId);
+    if (!playerId.success) return res.status(404).json({ error: "Player not found." });
+    const { data, error } = await supabaseAdmin.from("players").select("player_id")
+      .eq("player_id", playerId.data).maybeSingle();
+    if (error) throw new Error(`Unable to load player: ${error.message}`);
+    if (!data) return res.status(404).json({ error: "Player not found." });
+
+    const { data: overview, error: overviewError } = await supabaseAdmin.from("players")
+      .select("player_id,user_id,fname,lname,bdate,height,weight,position,club")
+      .order("fname", { ascending: true });
+    if (overviewError) throw new Error(`Unable to load players: ${overviewError.message}`);
+    const { data: sessions, error: sessionsError } = await supabaseAdmin.from("sessions")
+      .select("session_id,player_id,name,created_at");
+    if (sessionsError) throw new Error(`Unable to load sessions: ${sessionsError.message}`);
+    const { data: actions, error: actionsError } = (sessions ?? []).length
+      ? await supabaseAdmin.from("actions").select("action_id,session_id,type").in("session_id", sessions!.map((row) => row.session_id))
+      : { data: [], error: null };
+    if (actionsError) throw new Error(`Unable to load actions: ${actionsError.message}`);
+    const actionIds = (actions ?? []).map((row) => row.action_id);
+    const { data: annotations, error: annotationsError } = actionIds.length
+      ? await supabaseAdmin.from("annotations").select("action_id,score").in("action_id", actionIds)
+      : { data: [], error: null };
+    if (annotationsError) throw new Error(`Unable to load action scores: ${annotationsError.message}`);
+
+    const scoreMap = new Map((annotations ?? []).map((row) => [row.action_id, row.score == null ? null : Number(row.score)]));
+    const ownSessions = (sessions ?? []).filter((row) => row.player_id === playerId.data);
+    const ownActions = (actions ?? []).filter((row) => ownSessions.some((session) => session.session_id === row.session_id));
+    const ownScores = ownActions.map((row) => scoreMap.get(row.action_id)).filter((score): score is number => score != null && Number.isFinite(score));
+    const byAction = [...new Set(ownActions.map((row) => row.type))].map((type) => {
+      const matching = ownActions.filter((row) => row.type === type);
+      const values = matching.map((row) => scoreMap.get(row.action_id)).filter((score): score is number => score != null && Number.isFinite(score));
+      return { axis: type, score: values.length ? values.reduce((sum, value) => sum + value, 0) / values.length : null, samples: values.length };
+    });
+    const player = overview?.find((row) => row.player_id === playerId.data);
+    if (!player) return res.status(404).json({ error: "Player not found." });
+    const sessionsForPlayer = ownSessions.map((row) => {
+      const sessionActions = ownActions.filter((action) => action.session_id === row.session_id);
+      const values = sessionActions.map((action) => scoreMap.get(action.action_id)).filter((score): score is number => score != null && Number.isFinite(score));
+      return { sessionId: row.session_id, createdAt: Date.parse(row.created_at) || 0, score: values.length ? values.reduce((sum, value) => sum + value, 0) / values.length : null, actionCount: sessionActions.length, scoredCount: values.length };
+    });
+    const { data: peers, error: peersError } = await supabaseAdmin.from("players").select("player_id");
+    if (peersError) throw new Error(`Unable to load roster: ${peersError.message}`);
+    const squadAverage = { byQuality: [], byAction };
+    return res.json({
+      playerId: player.player_id, name: [player.fname, player.lname].filter(Boolean).join(" "),
+      age: player.bdate ? String(Math.max(0, new Date().getFullYear() - new Date(player.bdate).getFullYear())) : "",
+      heightCm: player.height == null ? "" : String(player.height), weightKg: player.weight == null ? "" : String(player.weight),
+      club: player.club ?? "", position: player.position ?? "", dominantFoot: "", notes: "", avatarPath: "",
+      createdAt: "", updatedAt: "", hasProfile: true, sessionCount: ownSessions.length, actionCount: ownActions.length,
+      lastSessionAt: sessionsForPlayer[0]?.createdAt ?? 0,
+      scores: { playerId: player.player_id, rubricVersion: "database", totalActions: ownActions.length, scoredActions: ownScores.length, byAction, byQuality: [], overall: ownScores.length ? ownScores.reduce((sum, value) => sum + value, 0) / ownScores.length : null, sessions: sessionsForPlayer },
+      squadAverage, rank: null, playerCount: peers?.length ?? 0,
+    });
+  } catch (error) { next(error); }
+});
+
+app.get("/api/sessions-overview", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+
+    const { data: sessions, error } = await supabaseAdmin.from("sessions")
+      .select("session_id,player_id,name,path,created_at,status")
+      .order("created_at", { ascending: false });
+    if (error) throw new Error(`Unable to load sessions: ${error.message}`);
+    const playerIds = [...new Set((sessions ?? []).flatMap((row) => row.player_id ? [row.player_id] : []))];
+    const { data: players, error: playersError } = playerIds.length
+      ? await supabaseAdmin.from("players").select("player_id,fname,lname").in("player_id", playerIds)
+      : { data: [], error: null };
+    if (playersError) throw new Error(`Unable to load session players: ${playersError.message}`);
+    const sessionIds = (sessions ?? []).map((row) => row.session_id);
+    const { data: actions, error: actionsError } = sessionIds.length
+      ? await supabaseAdmin.from("actions").select("session_id,type").in("session_id", sessionIds)
+      : { data: [], error: null };
+    if (actionsError) throw new Error(`Unable to load session actions: ${actionsError.message}`);
+    const playerNames = new Map((players ?? []).map((row) => [row.player_id, [row.fname, row.lname].filter(Boolean).join(" ")]));
+    const breakdownBySession = new Map<string, Record<string, number>>();
+    for (const action of actions ?? []) {
+      const breakdown = breakdownBySession.get(action.session_id) ?? {};
+      breakdown[action.type] = (breakdown[action.type] ?? 0) + 1;
+      breakdownBySession.set(action.session_id, breakdown);
+    }
+    return res.json({ sessions: (sessions ?? []).map((row) => {
+      const actionBreakdown = breakdownBySession.get(row.session_id) ?? {};
+      return {
+        sessionId: row.session_id, playerId: row.player_id ?? "", playerName: row.player_id ? playerNames.get(row.player_id) ?? "" : "",
+        name: row.name, createdAt: Date.parse(row.created_at) || 0,
+        actionCount: Object.values(actionBreakdown).reduce((sum, count) => sum + count, 0),
+        cameraCount: 0, actionBreakdown, path: row.path, status: row.status,
+      };
+    }) });
+  } catch (error) { next(error); }
+});
+
+// Session deletion is handled by the AI service through the proxy below so
+// the session folder and database records are deleted together.
+
+app.post("/api/auth/signup", authLimiter, async (req, res, next) => {
+  try {
+    const input = signupSchema.parse(req.body);
+    const passwordHash = await hashPassword(input.password);
+    const { data, error } = await supabaseAuth.auth.signUp({ email: input.email, password: input.password, options: { data: { fname: input.fname, lname: input.lname, academy: input.academy ?? null } } });
+    if (error) {
+      console.error("Supabase signup failed", { status: error.status, code: error.code, message: error.message });
+      return res.status(400).json({ error: env.NODE_ENV === "development" ? error.message : "Unable to create the account with these details." });
+    }
+    if (data.user?.identities?.length) await syncProfile(data.user, { ...input, passwordHash });
+    if (data.user && data.session) {
+      setSessionCookies(res, data.session);
+      return res.status(201).json({ user: userPayload(data.user), requiresEmailVerification: false });
+    }
+    return res.status(201).json({ user: data.user ? userPayload(data.user) : null, requiresEmailVerification: true });
+  } catch (error) { next(error); }
+});
+
+app.post("/api/auth/login", authLimiter, async (req, res, next) => {
+  try {
+    const input = loginSchema.parse(req.body);
+    const { data, error } = await supabaseAuth.auth.signInWithPassword(input);
+    if (error || !data.user || !data.session) return res.status(401).json({ error: "Invalid email or password." });
+    await syncProfile(data.user);
+    setSessionCookies(res, data.session);
+    return res.json({ user: userPayload(data.user) });
+  } catch (error) { next(error); }
+});
+
+app.get("/api/auth/google", authLimiter, async (req, res, next) => {
+  try {
+    const redirect = typeof req.query.redirect === "string" ? req.query.redirect : "/labs";
+    const { data, error } = await supabaseAuth.auth.signInWithOAuth({ provider: "google", options: { redirectTo: `${env.BACKEND_URL}/api/auth/callback?next=${encodeURIComponent(redirect)}` } });
+    if (error || !data.url) return res.status(502).json({ error: "Google sign-in is currently unavailable." });
+    return res.redirect(data.url);
+  } catch (error) { next(error); }
+});
+
+app.get("/api/auth/callback", async (req, res, next) => {
+  try {
+    const code = typeof req.query.code === "string" ? req.query.code : null;
+    // Explicitly terminate any fragment from an unexpected implicit-flow
+    // response so access tokens cannot be inherited by this redirect URL.
+    if (!code) return res.redirect(`${env.FRONTEND_URL}/login?error=oauth_callback_failed#`);
+    const { data, error } = await supabaseAuth.auth.exchangeCodeForSession(code);
+    if (error || !data.user || !data.session) return res.redirect(`${env.FRONTEND_URL}/login?error=oauth_callback_failed`);
+    await syncProfile(data.user);
+    setSessionCookies(res, data.session);
+    return res.redirect(safeRedirect(req.query.next));
+  } catch (error) { next(error); }
+});
+
+// Supabase confirmation emails can use {{ .TokenHash }} to deliver the one-time
+// token directly to this server. This lets us establish the same HttpOnly
+// cookie session used by password and Google sign-in.
+app.get("/api/auth/confirm", async (req, res, next) => {
+  try {
+    const tokenHash = typeof req.query.token_hash === "string" ? req.query.token_hash : "";
+    if (!tokenHash) return res.redirect(`${env.FRONTEND_URL}/login?error=email_confirmation_failed`);
+
+    const { data, error } = await supabaseAuth.auth.verifyOtp({ token_hash: tokenHash, type: "email" });
+    if (error || !data.user || !data.session) return res.redirect(`${env.FRONTEND_URL}/login?error=email_confirmation_failed`);
+
+    await syncProfile(data.user);
+    setSessionCookies(res, data.session);
+    return res.redirect(`${env.FRONTEND_URL}/labs`);
+  } catch (error) { next(error); }
+});
+
+app.post("/api/auth/logout", async (req, res, next) => {
+  try {
+    clearSessionCookies(res);
+    return res.status(204).send();
+  } catch (error) { next(error); }
+});
+
+app.get("/api/auth/me", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    return res.json({ user: userPayload(current.user) });
+  } catch (error) { next(error); }
+});
+
+app.get("/api/auth/profile", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    await syncProfile(current.user);
+    const { data, error } = await supabaseAdmin.from("users")
+      .select("fname,lname,email,academy,role")
+      .eq("user_id", current.user.id)
+      .single();
+    if (error || !data) throw new Error(`Unable to load user profile: ${error?.message ?? "Profile not found"}`);
+    const hasPassword = userHasPassword(current.user);
+    return res.json({ profile: { ...data, emailVerified: Boolean(current.user.email_confirmed_at), hasPassword } });
+  } catch (error) { next(error); }
+});
+
+app.patch("/api/auth/profile", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    const input = profileSchema.parse(req.body);
+    const profile = { ...input, academy: input.academy?.trim() || null };
+    const { data, error } = await supabaseAdmin.from("users")
+      .update(profile)
+      .eq("user_id", current.user.id)
+      .select("fname,lname,email,academy,role")
+      .single();
+    if (error || !data) throw new Error(`Unable to save user profile: ${error?.message ?? "Profile not found"}`);
+
+    // Keep auth metadata useful for integrations while the users row remains canonical.
+    const { error: metadataError } = await supabaseAdmin.auth.admin.updateUserById(current.user.id, {
+      user_metadata: { ...current.user.user_metadata, ...profile },
+    });
+    if (metadataError) console.error("Unable to sync profile metadata", { code: metadataError.code, message: metadataError.message });
+    return res.json({ profile: { ...data, emailVerified: Boolean(current.user.email_confirmed_at), hasPassword: userHasPassword(current.user) } });
+  } catch (error) { next(error); }
+});
+
+app.post("/api/auth/password", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    const input = passwordSchema.parse(req.body);
+    const hasPassword = userHasPassword(current.user);
+    if (hasPassword) {
+      if (!input.currentPassword) return res.status(400).json({ error: "Enter your current password." });
+      const { error: verifyError } = await supabaseAuth.auth.signInWithPassword({ email: current.user.email ?? "", password: input.currentPassword });
+      if (verifyError) return res.status(400).json({ error: "Your current password is incorrect." });
+    }
+
+    const { error } = await supabaseAdmin.auth.admin.updateUserById(current.user.id, {
+      password: input.newPassword,
+      app_metadata: { ...current.user.app_metadata, has_password: true },
+    });
+    if (error) return res.status(400).json({ error: "Unable to update the password. Please try again." });
+    const passwordHash = await hashPassword(input.newPassword);
+    const { error: profileError } = await supabaseAdmin.from("users").update({ password_hash: passwordHash }).eq("user_id", current.user.id);
+    if (profileError) throw new Error(`Password updated but profile hash sync failed: ${profileError.message}`);
+    return res.json({ ok: true });
+  } catch (error) { next(error); }
+});
+
+app.delete("/api/auth/account", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    if (req.body?.confirmation !== "DELETE") return res.status(400).json({ error: "Confirm account deletion by typing DELETE." });
+    const { error: authError } = await supabaseAdmin.auth.admin.deleteUser(current.user.id);
+    if (authError) return res.status(500).json({ error: "Unable to delete your account. Please try again." });
+    const { error: profileError } = await supabaseAdmin.from("users").delete().eq("user_id", current.user.id);
+    clearSessionCookies(res);
+    if (profileError) throw new Error(`Account deleted but profile cleanup failed: ${profileError.message}`);
+    return res.status(204).send();
+  } catch (error) { next(error); }
+});
+
+async function proxyAnalysisRequest(req: Request, res: Response) {
+  const current = await requireActiveSubscription(req, res);
+  if (!current) return;
+
+  const target = new URL(req.originalUrl, env.ANALYSIS_API_URL);
+  const headers = new Headers();
+  headers.set("x-sporalize-proxy-secret", env.ANALYSIS_PROXY_SECRET);
+  // Derived from the verified cookie session; never trust a browser-supplied ID.
+  headers.set("x-sporalize-user-id", current.user.id);
+  headers.set("x-forwarded-host", new URL(env.BACKEND_URL).host);
+  headers.set("x-forwarded-proto", new URL(env.BACKEND_URL).protocol.replace(":", ""));
+  for (const name of ["accept", "content-type", "range", "if-range"]) {
+    const value = req.header(name);
+    if (value) headers.set(name, value);
+  }
+
+  const hasBody = req.method !== "GET" && req.method !== "HEAD";
+  const body = !hasBody ? undefined : req.is("application/json")
+    ? JSON.stringify(req.body ?? {})
+    : req as unknown as BodyInit;
+  const init: RequestInit & { duplex?: "half" } = {
+    method: req.method,
+    headers,
+    body,
+    ...(body && typeof body !== "string" ? { duplex: "half" as const } : {}),
+  };
+
+  const upstream = await fetch(target, init);
+  res.status(upstream.status);
+  res.set("Cross-Origin-Resource-Policy", "cross-origin");
+  for (const name of ["content-type", "content-disposition", "cache-control", "accept-ranges", "content-range", "last-modified"]) {
+    const value = upstream.headers.get(name);
+    if (value) res.set(name, value);
+  }
+  if (!upstream.body) return res.end();
+  await pipeline(Readable.fromWeb(upstream.body as import("node:stream/web").ReadableStream), res);
+}
+
+const analysisProxy = (req: Request, res: Response, next: NextFunction) => {
+  void proxyAnalysisRequest(req, res).catch((error: unknown) => {
+    if (res.headersSent) return res.destroy(error instanceof Error ? error : undefined);
+    console.error("Analysis API proxy failed", error);
+    return res.status(502).json({ error: "The analysis service is unavailable." });
+  });
+};
+
+// All analysis API traffic and stored media pass through this subscription
+// gate. Auth and subscription status endpoints remain available without a plan.
+app.use("/api", (req, res, next) => {
+  if (req.originalUrl.startsWith("/api/auth/") || req.originalUrl === "/api/subscriptions" || req.originalUrl === "/api/subscription/access" || req.originalUrl === "/api/public-config") return next();
+  return analysisProxy(req, res, next);
+});
+app.use("/storage", analysisProxy);
+
+app.use((_req, res) => res.status(404).json({ error: "Route not found." }));
+app.use((error: unknown, _req: Request, res: Response, _next: NextFunction) => {
+  console.error(error);
+  if (error instanceof z.ZodError) return res.status(400).json({ error: "Please check the submitted fields." });
+  return res.status(500).json({ error: "Something went wrong. Please try again." });
+});
+
+app.listen(env.PORT, () => console.log(`Sporalize API listening on http://localhost:${env.PORT}`));

src/subscriptions.ts

@@ -0,0 +1,37 @@
+import { supabaseAdmin } from "./supabase.js";
+
+type AssignSubscriptionInput = {
+  userId: string;
+  subscriptionId: string;
+  startDate: string;
+  endDate: string;
+};
+
+/**
+ * Persist a paid subscription after a payment provider's webhook has been
+ * authenticated and its payment has been confirmed. Never call this directly
+ * from a browser request.
+ */
+export async function assignPaidSubscription(input: AssignSubscriptionInput) {
+  const { userId, subscriptionId, startDate, endDate } = input;
+  const isoDate = /^\d{4}-\d{2}-\d{2}$/;
+  if (!isoDate.test(startDate) || !isoDate.test(endDate) || endDate < startDate) {
+    throw new Error("Invalid subscription period.");
+  }
+
+  const { data: plan, error: planError } = await supabaseAdmin
+    .from("subscriptions")
+    .select("subscription_id")
+    .eq("subscription_id", subscriptionId)
+    .maybeSingle();
+  if (planError) throw new Error(`Unable to validate subscription plan: ${planError.message}`);
+  if (!plan) throw new Error("Subscription plan was not found.");
+
+  const { data, error } = await supabaseAdmin
+    .from("users_subscriptions")
+    .upsert({ user_id: userId, subscription_id: subscriptionId, startdate: startDate, enddate: endDate }, { onConflict: "user_id" })
+    .select("user_id,subscription_id,startdate,enddate")
+    .single();
+  if (error) throw new Error(`Unable to assign paid subscription: ${error.message}`);
+  return data;
+}

src/supabase.ts

@@ -0,0 +1,53 @@
+import { createClient, type User } from "@supabase/supabase-js";
+import bcrypt from "bcryptjs";
+import { randomBytes } from "node:crypto";
+import { env } from "./config.js";
+
+export const supabaseAuth = createClient(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, {
+  // OAuth returns a one-time code for the backend callback to exchange, rather
+  // than placing session tokens in the browser URL fragment.
+  auth: { autoRefreshToken: false, persistSession: false, detectSessionInUrl: false, flowType: "pkce" },
+});
+
+export const supabaseAdmin = createClient(env.SUPABASE_URL, env.SUPABASE_SERVICE_ROLE_KEY, {
+  auth: { autoRefreshToken: false, persistSession: false, detectSessionInUrl: false },
+});
+
+export async function hashPassword(password: string) {
+  return bcrypt.hash(password, 12);
+}
+
+export function userHasPassword(user: User) {
+  return user.app_metadata?.has_password === true || Boolean(user.identities?.some((identity) => identity.provider === "email"));
+}
+
+async function randomPasswordHash() {
+  return bcrypt.hash(randomBytes(32).toString("hex"), 12);
+}
+
+export async function syncProfile(user: User, profile?: { fname?: string; lname?: string; academy?: string | null; role?: string | null; passwordHash?: string }) {
+  const metadata = user.user_metadata ?? {};
+  const { data: existing, error: readError } = await supabaseAdmin.from("users").select("user_id").eq("user_id", user.id).maybeSingle();
+  if (readError) throw new Error(`Unable to read user profile: ${readError.message}`);
+  if (existing) {
+    // The profile table is the canonical source for editable profile fields.
+    // Auth callbacks should only keep the email in sync, never reset user edits.
+    const { error } = await supabaseAdmin.from("users").update({ email: user.email }).eq("user_id", user.id);
+    if (error) throw new Error(`Unable to update user profile: ${error.message}`);
+    return;
+  }
+  const fields = {
+    user_id: user.id,
+    fname: profile?.fname ?? metadata.fname ?? metadata.full_name?.split(" ")[0] ?? "User",
+    lname: profile?.lname ?? metadata.lname ?? metadata.full_name?.split(" ").slice(1).join(" ") ?? "User",
+    email: user.email,
+    academy: profile?.academy ?? metadata.academy ?? null,
+    role: profile?.role ?? metadata.role ?? null,
+  };
+  const { error } = await supabaseAdmin.from("users").insert({ ...fields, password_hash: profile?.passwordHash ?? await randomPasswordHash() });
+  if (error) throw new Error(`Unable to create user profile: ${error.message}`);
+}
+
+export function userPayload(user: User) {
+  return { id: user.id, email: user.email, emailVerified: Boolean(user.email_confirmed_at), metadata: user.user_metadata ?? {} };
+}

start.py

@@ -0,0 +1,55 @@
+"""Run the public Node API and private Python worker as one service."""
+import os
+from pathlib import Path
+import signal
+import subprocess
+import sys
+import time
+
+from dotenv import load_dotenv
+
+
+def main():
+    root = Path(__file__).resolve().parent
+    load_dotenv(root / ".env")
+    port = int(os.environ.get("PORT", "4000"))
+    if not 1 <= port <= 65535 or port == 8000:
+        raise ValueError("PORT must be between 1 and 65535 and differ from AI port 8000")
+    env = dict(os.environ, PORT=str(port),
+               ANALYSIS_API_URL="http://127.0.0.1:8000",
+               BACKEND_INTERNAL_URL=f"http://127.0.0.1:{port}")
+    children = []
+    stopping = False
+
+    def stop(signum, frame):
+        nonlocal stopping
+        stopping = True
+
+    for sig in (signal.SIGINT, signal.SIGTERM):
+        signal.signal(sig, stop)
+    try:
+        children.append(subprocess.Popen([sys.executable, "-m", "uvicorn", "app:app",
+            "--host", "127.0.0.1", "--port", "8000", "--workers", "1"], cwd=root, env=env))
+        children.append(subprocess.Popen(["node", "dist/server.js"], cwd=root, env=env))
+        while not stopping:
+            for child in children:
+                if child.poll() is not None:
+                    print(f"Backend process {child.pid} exited ({child.returncode}); stopping service", flush=True)
+                    return child.returncode or 1
+            time.sleep(0.25)
+        return 0
+    finally:
+        for child in children:
+            if child.poll() is None:
+                child.terminate()
+        deadline = time.monotonic() + 15
+        for child in children:
+            try:
+                child.wait(timeout=max(0, deadline - time.monotonic()))
+            except subprocess.TimeoutExpired:
+                child.kill()
+                child.wait()
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src"]
+}