# gem.md: State & Quality Charter for ./hAPI_face2

## 1. Directory Scope & Purpose
Docker-friendly Express mediator API deployed to Hugging Face Spaces. Proxies Aura Venture requests into Supabase functions/tables and enforces server-side auth.

## 2. Architectural & Quality Mandate
- Keep the codebase self-contained; no relative imports from parent repo.
- All outbound data access routes through Supabase service client with least privilege secrets held in env.
- Every route except `/health` must verify `AIS3_API_KEY` bearer token.
- Return JSON envelopes (`{ success, ... }`) and never crash on missing tables—fallback to safe defaults.
- Maintain TypeScript source compiled to JS for production.

## 3. Content Manifest
- Dockerfile — container build for Hugging Face.
- app.yaml — Space metadata.
- package.json / tsconfig.json — Node + TypeScript config.
- src/server.ts — Express bootstrap and middleware.
- src/routes/*.ts — Modular route handlers for river, flows, money, book empire.
- src/supabase.ts — Supabase admin client helper.
- .env.example — Reference for required secrets.

## 4. State Change Log (Newest First)
- 2025-10-07 | Documented Docker CLI setup | README.md | Added explicit huggingface-cli example for Docker SDK Spaces.
- 2025-10-07 | Initial mediator scaffolding | * | Created Express/Supabase bridge tailored for Hugging Face Spaces.