# Supabase
NEXT_PUBLIC_SUPABASE_URL=https://<project>.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=<anon_key>
SUPABASE_SERVICE_ROLE_KEY=<service_role_key>

# OpenAI
AI_PROVIDER=openai  # or 'ollama' for dev
OPENAI_API_KEY=<openai_key>
OPENAI_MODEL=gpt-5
OPENAI_FALLBACK_MODEL=gpt-4-turbo

# Ollama (development)
OLLAMA_BASE_URL=http://localhost:11434
OLLAMA_MODEL=llama3.3

# Vercel KV (Redis)
KV_URL=<kv_url>
KV_REST_API_URL=<kv_rest_api_url>
KV_REST_API_TOKEN=<kv_rest_api_token>
KV_REST_API_READ_ONLY_TOKEN=<kv_rest_api_read_only_token>

# Apple IAP
APPLE_SHARED_SECRET=<apple_shared_secret>
APPLE_BUNDLE_ID=com.yourcompany.photojournal

{
  photo_url: string;           // Supabase Storage URL (already uploaded)
  photo_width: number;
  photo_height: number;
  photo_size_bytes: number;
  journal_text: string;
  ai_prompt_used?: string;     // Optional (null if manual entry)
  emotion_ids: string[];       // Array of emotion UUIDs
  location_name?: string;
  latitude?: number;
  longitude?: number;
  photo_taken_at?: string;     // ISO timestamp
}

{
  id: string;
  user_id: string;
  photo_url: string;
  journal_text: string;
  emotions: Array<{
    id: string;
    name: string;
    category: string;
    color_hex: string;
  }>;
  created_at: string;
}

?limit=20           # Default 20, max 100
&offset=0           # Pagination offset
&orderBy=created_at # Default created_at, also supports photo_taken_at
&order=desc         # desc or asc

{
  entries: Array<{
    id: string;
    photo_url: string;
    photo_width: number;
    photo_height: number;
    journal_text: string;      // Truncated to 100 chars for list view
    emotions: Array<{          // Max 3 emotions shown in list
      id: string;
      name: string;
      color_hex: string;
    }>;
    created_at: string;
    photo_taken_at: string;
  }>;
  total_count: number;
  has_more: boolean;
}

{
  id: string;
  photo_url: string;
  photo_width: number;
  photo_height: number;
  photo_size_bytes: number;
  journal_text: string;        // Full text
  ai_prompt_used: string | null;
  emotions: Array<{            // All emotions
    id: string;
    name: string;
    category: string;
    color_hex: string;
    icon_name: string;
  }>;
  location_name: string | null;
  latitude: number | null;
  longitude: number | null;
  photo_taken_at: string;
  created_at: string;
  updated_at: string;
}

{
  journal_text?: string;
  emotion_ids?: string[];
  location_name?: string;
  latitude?: number;
  longitude?: number;
}

photo: File (JPEG/PNG, max 4MB)

{
  original_url: string;        // Original photo URL
  thumbnail_url: string;       // 400×400px thumbnail
  preview_url: string;         // 1024×1024px preview
  width: number;
  height: number;
  size_bytes: number;
}

{
  photo_url: string;  // Supabase Storage URL
}

{
  job_id: string;     // e.g., "prompt_abc123"
  status: "pending";
  message: "AI is analyzing your photo..."
}

You are a thoughtful journal prompt generator. The user just captured a photo for their journal.

Analyze this photo and generate 3 creative, emotionally resonant journal prompts that help the user reflect on this moment.

Prompts should be:
- Personal and reflective (not generic)
- Open-ended questions or thought starters
- 10-20 words each
- Varied in tone (gratitude, memory, emotion, future)

Photo URL: {photo_url}

Return only the 3 prompts as a JSON array of strings.

// lib/ai/provider.ts
interface AIProvider {
  generatePrompts(photoUrl: string): Promise<string[]>;
}

class OpenAIProvider implements AIProvider {
  async generatePrompts(photoUrl: string): Promise<string[]> {
    const response = await openai.chat.completions.create({
      model: process.env.OPENAI_MODEL || 'gpt-5',
      messages: [
        { role: 'system', content: '...' },
        { role: 'user', content: photoUrl }
      ],
      max_tokens: 150,
      temperature: 0.8
    });
    return JSON.parse(response.choices[0].message.content);
  }
}

class OllamaProvider implements AIProvider {
  async generatePrompts(photoUrl: string): Promise<string[]> {
    const response = await fetch(`${process.env.OLLAMA_BASE_URL}/api/generate`, {
      method: 'POST',
      body: JSON.stringify({
        model: process.env.OLLAMA_MODEL || 'llama3.3',
        prompt: '...',
        stream: false
      })
    });
    return JSON.parse(response.json().response);
  }
}

export const aiProvider: AIProvider =
  process.env.AI_PROVIDER === 'ollama'
    ? new OllamaProvider()
    : new OpenAIProvider();

// Pending
{
  job_id: string;
  status: "pending";
  message: "AI is analyzing your photo..."
}

// Completed
{
  job_id: string;
  status: "completed";
  prompts: [
    "What made this moment special today?",
    "If you could relive this moment, what would you notice that you missed?",
    "How does this photo make you feel right now?"
  ]
}

// Error
{
  job_id: string;
  status: "error";
  error: "AI generation failed. Please try again."
}

const FALLBACK_PROMPTS = [
  "What's the story behind this photo?",
  "What were you thinking or feeling in this moment?",
  "What do you want to remember about today?"
];

?q=beach                        # Keyword search (full-text)
&start_date=2025-01-01          # Optional date range
&end_date=2025-01-31
&emotion_ids=uuid1,uuid2        # Optional emotion filter (OR logic)
&limit=20
&offset=0

{
  entries: Array<{
    id: string;
    photo_url: string;
    journal_text: string;        // Highlighted keywords
    emotions: Array<{...}>;
    created_at: string;
    relevance: number;           // Search ranking score
  }>;
  total_count: number;
  has_more: boolean;
}

SELECT DISTINCT je.*,
  ts_rank(je.search_vector, to_tsquery('english', :query)) AS relevance
FROM journal_entries je
LEFT JOIN entry_emotions ee ON je.id = ee.entry_id
WHERE
  je.user_id = :user_id
  AND je.search_vector @@ to_tsquery('english', :query)
  AND je.created_at BETWEEN :start_date AND :end_date
  AND (ee.emotion_id IN (:emotion_ids) OR :emotion_ids IS NULL)
ORDER BY relevance DESC, je.created_at DESC
LIMIT :limit OFFSET :offset;

{
  id: string;
  email: string;
  display_name: string;
  bio: string | null;
  profile_photo_url: string | null;
  subscription_tier: 'free' | 'premium';
  subscription_status: string | null;
  monthly_photo_count: number;
  created_at: string;
}

{
  display_name?: string;
  bio?: string;
}

photo: File (JPEG/PNG, max 2MB)

{
  profile_photo_url: string;
}

{
  receipt_data: string;        // Base64-encoded Apple receipt
  transaction_id: string;
  plan: 'monthly' | 'annual';
}

{
  subscription_id: string;
  status: 'trial' | 'active';
  current_period_start: string;
  current_period_end: string;
  is_trial: boolean;
}

const verifyReceipt = async (receiptData: string) => {
  const response = await fetch('https://buy.itunes.apple.com/verifyReceipt', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      'receipt-data': receiptData,
      'password': process.env.APPLE_SHARED_SECRET,
      'exclude-old-transactions': true
    })
  });

  const data = await response.json();

  if (data.status === 21007) {
    // Sandbox receipt, retry with sandbox URL
    return verifySandboxReceipt(receiptData);
  }

  if (data.status !== 0) {
    throw new Error(`Receipt verification failed: ${data.status}`);
  }

  return data.latest_receipt_info[0]; // Most recent transaction
};

{
  notification_type: 'DID_RENEW' | 'DID_FAIL_TO_RENEW' | 'CANCEL' | 'EXPIRED';
  unified_receipt: {...};
  latest_receipt_info: {...};
}

{
  message: "Your data export is being prepared. We'll email you a download link shortly."
}

{
  "user": {
    "email": "user@example.com",
    "display_name": "John Doe",
    "created_at": "2025-01-01T00:00:00Z"
  },
  "entries": [
    {
      "id": "...",
      "journal_text": "...",
      "emotions": ["Happy", "Grateful"],
      "photo_url": "...",
      "created_at": "..."
    }
  ]
}

Subject: Your PhotoJournal Data Export is Ready

Hi {display_name},

Your data export is ready for download:

{download_link}

This link expires in 7 days.

Questions? Reply to this email.

- PhotoJournal Team

{
  password: string;  // Confirm password
}

// Cron job runs daily
const hardDeleteExpiredAccounts = async () => {
  const expiredUsers = await supabase
    .from('users')
    .select('id')
    .not('deleted_at', 'is', null)
    .lt('deleted_at', new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString());

  for (const user of expiredUsers.data) {
    // Delete all user data
    await supabase.from('journal_entries').delete().eq('user_id', user.id);
    await supabase.from('users').delete().eq('id', user.id);
    await supabase.auth.admin.deleteUser(user.id);

    // Delete photos from Storage
    const { data: photos } = await supabase.storage
      .from('journal-photos')
      .list(`${user.id}/`);

    for (const photo of photos) {
      await supabase.storage
        .from('journal-photos')
        .remove([`${user.id}/${photo.name}`]);
    }
  }
};

import { createClient } from '@supabase/supabase-js';
import { NextRequest, NextResponse } from 'next/server';

export const withAuth = (handler: Function) => {
  return async (req: NextRequest, ...args: any[]) => {
    const token = req.headers.get('Authorization')?.replace('Bearer ', '');

    if (!token) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const supabase = createClient(
      process.env.NEXT_PUBLIC_SUPABASE_URL!,
      process.env.SUPABASE_SERVICE_ROLE_KEY! // Use service role for server-side
    );

    const { data: { user }, error } = await supabase.auth.getUser(token);

    if (error || !user) {
      return NextResponse.json({ error: 'Invalid token' }, { status: 401 });
    }

    // Attach user to request
    (req as any).user = user;

    return handler(req, ...args);
  };
};

// app/api/entries/route.ts
export const GET = withAuth(async (req: NextRequest) => {
  const user = (req as any).user;
  // ... fetch entries for user.id
});

// lib/errors.ts
export class ApiError extends Error {
  constructor(public statusCode: number, message: string) {
    super(message);
  }
}

export const errorHandler = (error: any) => {
  if (error instanceof ApiError) {
    return NextResponse.json({ error: error.message }, { status: error.statusCode });
  }

  console.error('Unexpected error:', error);
  return NextResponse.json(
    { error: 'Internal server error' },
    { status: 500 }
  );
};

// Usage
try {
  // ...
} catch (error) {
  return errorHandler(error);
}

// lib/ratelimit.ts
import { Ratelimit } from '@upstash/ratelimit';
import { Redis } from '@upstash/redis';

const redis = new Redis({
  url: process.env.KV_REST_API_URL!,
  token: process.env.KV_REST_API_TOKEN!
});

export const ratelimit = new Ratelimit({
  redis,
  limiter: Ratelimit.slidingWindow(10, '10s'), // 10 requests per 10 seconds
  analytics: true
});

// Usage in API route
export const POST = withAuth(async (req: NextRequest) => {
  const user = (req as any).user;
  const { success } = await ratelimit.limit(user.id);

  if (!success) {
    return NextResponse.json(
      { error: 'Too many requests. Please try again later.' },
      { status: 429 }
    );
  }

  // ... handle request
});

# Install Vercel CLI
npm i -g vercel

# Link project
vercel link

# Set environment variables
vercel env add NEXT_PUBLIC_SUPABASE_URL production
vercel env add SUPABASE_SERVICE_ROLE_KEY production
vercel env add OPENAI_API_KEY production
vercel env add KV_URL production
# ... etc

// app/api/ai/prompts/route.ts
export const maxDuration = 60; // Max 60s for Pro plan (use async queue instead)
export const runtime = 'edge'; // Use Edge Runtime for faster cold starts