ekx-supabaselisted

# Supabase **The Ekinoxis default database.** In 13 of 26 projects. If a new project needs persistence, it uses Supabase unless there is a stated reason not to. Authoritative: the **`supabase` MCP server** (8 of our repos configure it) — use it to inspect schema, run SQL, apply migrations and read logs rather than guessing. --- ## Environment ```bash NEXT_PUBLIC_SUPABASE_URL= NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY= # public (older repos: ..._ANON_KEY) SUPABASE_SERVICE_ROLE_KEY= # SECRET — bypasses ALL RLS ``` ⚠️ The portfolio has three names for the publishable key (`_ANON_KEY`, `_PUBLISHABLE_KEY`, `_PUBLISHABLE_DEFAULT_KEY`). New code uses `_PUBLISHABLE_KEY`. **The service-role key bypasses every RLS policy.** It belongs in server code only — route handlers, server actions, cron jobs. If it appears in a `"use client"` file or behind a `NEXT_PUBLIC_` prefix, the database is fully open to the internet. --- ## The client pair (Next.js App Router) This is written from scratch in 9 projects. It should be a shared package; until it is, copy it exactly. **`lib/supabase/client.ts`** — browser: ```ts import { createBrowserClient } from "@supabase/ssr"; export function createClient() { return createBrowserClient( process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!, ); } ``` **`lib/supabase/server.ts`** — server components, actions, route handlers: ```ts import { createServerClient } from "@supabase/ssr"; impo