Moup (Airtribe Team 54): Personal Relationship Manager

Next.js 15 (App Router) + Supabase (Postgres, Auth, RLS) unified platform, alongside the FastAPI prototype backend and static runner.

Validation and local setup

For credential-free checks, start with the acceptance evidence and safe reproduction commands. The setup below is separate: installing dependencies, starting Supabase and applying migrations/seeds require deliberate operator approval and a disposable local target. They are not prerequisites for the isolated test fixtures.

Run locally

1. Unified App (Next.js 15)

pnpm install
supabase start                 # needs Docker; applies migrations + seed.sql
cp .env.example .env.local     # fill keys from: supabase status
pnpm dev                       # http://localhost:3000
pnpm test                      # test suite; use sanitized commands linked above for isolated validation

Legacy live-target smoke is not a safe default gate. scripts/smoke.mjs loads .env.local for a local target (or an explicitly supplied env file), signs up users and writes API data; optional service-role checks also write database rows. Run it only after an operator explicitly approves the exact disposable target and side effects. Do not run it against a deployment merely to verify that deployment, and do not change Auth/security settings just to make it pass. It was not used for the credential-free acceptance evidence below.

Deploying (Vercel + hosted Supabase): see DEPLOY.md. pnpm check-env validates the env (--prod for production values).

2. FastAPI Prototype Runner

pip install -r requirements.txt
python -m uvicorn main:app --reload --port 8000

Open http://127.0.0.1:8000 - API docs at http://127.0.0.1:8000/docs

Auth

• /login has a minimal page (magic link, or email+password sign-in/sign-up).
• Social sign-in candidates are Google, Facebook, LinkedIn and Instagram through Supabase Auth OAuth, but buttons are filtered by the project's provider settings. Google is the initial/failure fallback, not proof it is configured. The custom Instagram recipe remains unverified. See provider setup and readiness boundaries.
• Magic links require the requesting browser's PKCE cookie. Use the latest link; if it fails, request a fresh one. See magic-link retry and account-switch boundaries.
• In the browser the session lives in cookies, so fetch('/api/me/...') just works.
• From scripts/curl: Authorization: Bearer <supabase access_token>.

Google Contacts import

Contacts → Import Google Contacts offers a separate, read-only Google consent flow, an unchecked preview, category selection, duplicate detection, and explicit saves in batches of up to five. It never imports automatically or changes Google Contacts. Onboarding retains its separate five-person limit.

The connector stays disabled until an authorized operator configures its own OAuth client, server-side encryption key, and reviewed database migration. See Google Contacts setup and security notes for exact scopes, redirects, retention/cleanup, revocation limitations and mock-test coverage. Adding the code does not connect a real Google account.

API-generated meetup invitation text includes Bengaluru date/time with an explicit IST (Asia/Kolkata) label, independent of the server timezone. Stored meetup instants are unchanged; meetup screens continue to display device-local time. Unscheduled meetups do not invent a date. A separately generated voice-plan share message is not reformatted by this API fallback.

Private API (signed-in user, scoped by RLS)

Method	Path	Body / query	Notes
GET	/api/me/dashboard		goals, contact_counts, recorded_activity (separate measures), contacts_by_category, followups, upcoming_meetups, recent_activity, is_empty
GET	/api/me/contacts	?category=personal|professional|community
POST	/api/me/contacts	one contact, or { contacts: [...] } (max 5, onboarding confirm)
GET	/api/me/contacts/:id		contact + interaction history
PATCH / DELETE	/api/me/contacts/:id	partial contact
GET / PUT	/api/me/goals	{ personal, professional, community }	must total 100
GET	/api/me/followups	?days=14	{ overdue, upcoming }
GET	/api/me/interactions	?limit=20	recent activity
POST	/api/me/interactions	{ contact_id, type?, notes?, occurred_at?, next_followup_at? }	completes a follow-up; updates last_interaction_at and next_followup_at
GET / POST	/api/me/meetups	{ title, activity?, area?, starts_at?, budget? }	POST returns meetup.room_url + invite_text. Nothing is sent automatically.
GET / PATCH / DELETE	/api/me/meetups/:id	partial + status, final_venue_id	edit / close
POST	/api/extract	{ transcript } (max 20,000 chars)	onboarding pre-fill; see below. Stateless, never writes to the DB
GET	/api/voice/signed-url		{ signed_url } for the ElevenLabs onboarding agent; 503 if not configured

Contacts, full contact history, Meetups, follow-ups and dashboard reads return complete results within a shared per-request safety budget, or an explicit 503 instead of silently truncated lists or counts. See bounded organizer reads for limits, keyset/HEAD verification, ordering and concurrency guarantees.

Voice onboarding and extraction

Ported from Arindom Chetia's PR #3 (FastAPI routers/voice.py, static/voice.*).

This is the beginning of the README. Read the rest at the original. Read the full README ↗