Out of Scope and Stale Code

The codebase contains several inactive code paths from earlier iterations - a NextAuth.js migration and a Drizzle ORM integration. These are not part of the current architecture and must not be represented in documentation as active subsystems.

Cover and File Upload API Stubs

Six API routes are stubs that return 401:

• POST/PUT /api/books/[bookId]/cover/upload
• GET/DELETE /api/books/[bookId]/cover
• POST /api/books/[bookId]/files/upload
• GET/DELETE /api/books/[bookId]/files
• GET/DELETE /api/files/[fileId]
• GET/POST/DELETE /api/categories/[slug]/image

These are remnants of the same abandoned ORM migration. The active book upload pipeline bypasses them entirely by calling Supabase Storage directly from the server action.

NextAuth.js Integration (Stale)

The files auth.ts and auth.config.ts export named functions that match NextAuth.js's NextAuth and auth signatures. They are stubs - they export an empty object:

export const { auth, handlers, signIn, signOut } = { ... };

The real auth is handled by the Supabase SSR helper in the same auth.ts file. The NextAuth.js exports exist because an early version of the project started with NextAuth.js and was migrated to Supabase Auth before the route handlers were refactored.

Unused Dependencies

• Drizzle ORM (drizzle-orm, @libsql/client, @libsql/linux-x64-gnu) - installed but never used outside the lib/storage/ dead code.
• @aws-sdk/types - from the Drizzle integration era.
• multer - was used for file upload parsing before the current server-action-based approach.

Docker Compose

The compose.yaml file at the repo root is not referenced by the frontend's Dockerfile or the backend's Docker instructions. It is from an earlier period when the project was monolithic.

What This Means for Documentation

When describing the frontend architecture:

• The only file storage path is the book upload pipeline via lib/book-upload/upload-service.ts.
• The only API layer is the Next.js route handlers under app/api/.
• The only auth system is Supabase Auth with SSR cookies.
• The only ORM is raw Supabase client queries (no Drizzle, no Prisma).

Any reference to Drizzle or NextAuth.js as active components is incorrect and should be removed.