refactor: remove live web supabase dependency

.env.example

@@ -25,9 +25,6 @@ NEXT_PUBLIC_TRADING_API_URL=http://localhost:4018/api
 VITE_PRODUCT_ID=invttrdg
 VITE_PLATFORM_URL=http://localhost:4003/api
 VITE_TRADING_API_URL=http://localhost:4018/api
-# Legacy data-plane fallback only. Auth no longer uses Supabase.
-VITE_SUPABASE_URL=
-VITE_SUPABASE_ANON_KEY=
 
 # Mobile public envs
 EXPO_PUBLIC_PRODUCT_ID=invttrdg

docs/OPERATIONS.md

@@ -225,7 +225,7 @@ Manual mobile release smoke is still required before broad rollout:
 ## Known Remaining Gaps
 
 - Cosmos-only execution persistence is now in place for the main backend runtime paths, but dormant legacy code and one-off reference scripts still need cleanup
-- web still carries some compatibility layers around auth/profile bootstrap
+- web now uses platform-session handling end to end; the remaining auth cleanup is removing dormant compatibility stubs and aligning profile bootstrap contracts fully with backend-owned product APIs
 - root `pnpm verify` is green again after aligning the web Vitest harness with platform-session storage and current API contracts
 - mobile does not yet include push notification infrastructure
 - feature-flag ownership and correlation-ID propagation are not fully standardized yet

docs/ROADMAP.md

@@ -510,7 +510,7 @@ Validate that the new monorepo is safer and more coherent than the legacy setup
 ### Risk: auth model remains split between compatibility layers and the target platform-service session contract
 
 - [x] Mitigation: preserve domain behavior while removing migration-only storage fallbacks
-- [ ] Mitigation: define one authoritative session model early
+- [x] Mitigation: define the platform-service session model as the authoritative web/mobile auth contract
 - [ ] Mitigation: document transitional behavior explicitly
 
 ### Risk: repo-level verification stays red due to test-harness drift instead of product regressions

pnpm-lock.yaml

@@ -242,9 +242,6 @@ importers:
       '@bytelyst/telemetry-client':
         specifier: link:../../../learning_ai/learning_ai_common_plat/packages/telemetry-client
         version: link:../../../learning_ai/learning_ai_common_plat/packages/telemetry-client
-      '@supabase/supabase-js':
-        specifier: ^2.90.1
-        version: 2.101.1
       lucide-react:
         specifier: ^0.562.0
         version: 0.562.0(react@19.2.4)

shared/supabase-config.ts

@@ -1,54 +0,0 @@
-export interface SupabaseRuntimeConfig {
-  url: string;
-  anonKey: string;
-  isConfigured: boolean;
-}
-
-const fallbackSupabaseUrl = 'https://placeholder.bytilyst.local';
-const fallbackSupabaseAnonKey = 'placeholder-anon-key';
-
-function pickConfiguredValue(...values: Array<string | undefined>): string | undefined {
-  return values.find((value) => typeof value === 'string' && value.trim().length > 0)?.trim();
-}
-
-export function getWebSupabaseConfig(): SupabaseRuntimeConfig {
-  const url = pickConfiguredValue(
-    process.env.NEXT_PUBLIC_SUPABASE_URL,
-    process.env.VITE_SUPABASE_URL,
-    process.env.VITE_PLATFORM_SUPABASE_URL,
-    process.env.VITE_PUBLIC_SUPABASE_URL
-  );
-
-  const anonKey = pickConfiguredValue(
-    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
-    process.env.VITE_SUPABASE_ANON_KEY,
-    process.env.VITE_PLATFORM_SUPABASE_ANON_KEY,
-    process.env.VITE_PUBLIC_SUPABASE_ANON_KEY
-  );
-
-  return {
-    url: url || fallbackSupabaseUrl,
-    anonKey: anonKey || fallbackSupabaseAnonKey,
-    isConfigured: Boolean(url && anonKey),
-  };
-}
-
-export function getMobileSupabaseConfig(): SupabaseRuntimeConfig {
-  const url = pickConfiguredValue(
-    process.env.EXPO_PUBLIC_SUPABASE_URL,
-    process.env.EXPO_PUBLIC_PLATFORM_SUPABASE_URL,
-    process.env.EXPO_PUBLIC_PUBLIC_SUPABASE_URL
-  );
-
-  const anonKey = pickConfiguredValue(
-    process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY,
-    process.env.EXPO_PUBLIC_PLATFORM_SUPABASE_ANON_KEY,
-    process.env.EXPO_PUBLIC_PUBLIC_SUPABASE_ANON_KEY
-  );
-
-  return {
-    url: url || fallbackSupabaseUrl,
-    anonKey: anonKey || fallbackSupabaseAnonKey,
-    isConfigured: Boolean(url && anonKey),
-  };
-}

web/README.md

@@ -98,7 +98,7 @@ src/
 ├── hooks/
 │   └── useWebSocket.ts         # Socket.IO hook for real-time data
 ├── lib/
-│   ├── supabaseClient.ts       # Supabase client initialization
+│   ├── authSession.ts          # Platform-service session bootstrap + token refresh
 │   └── const.ts                # Table names + constants
 ├── App.tsx                      # Main app layout + tab navigation
 ├── main.tsx                     # React entry point
@@ -109,9 +109,9 @@ src/
 
 | Variable | Required | Description |
 |---|---|---|
-| `VITE_SUPABASE_URL` | Yes | Supabase project URL |
+| `VITE_PLATFORM_URL` | Yes | Platform-service API base URL |
-| `VITE_SUPABASE_ANON_KEY` | Yes | Supabase anonymous key |
+| `VITE_TRADING_API_URL` | Yes | Trading backend API base URL |
-| `VITE_API_URL` | Yes | Bot service API URL (default: `http://localhost:5000`) |
+| `VITE_PRODUCT_ID` | No | Product identifier override |
 | `VITE_SOCKET_PATH` | No | Custom Socket.IO path |
 
 ## Dashboard Tabs

web/package.json

@@ -21,7 +21,6 @@
     "@bytelyst/kill-switch-client": "link:../../../learning_ai/learning_ai_common_plat/packages/kill-switch-client",
     "@bytelyst/react-auth": "link:../../../learning_ai/learning_ai_common_plat/packages/react-auth",
     "@bytelyst/telemetry-client": "link:../../../learning_ai/learning_ai_common_plat/packages/telemetry-client",
-    "@supabase/supabase-js": "^2.90.1",
     "lucide-react": "^0.562.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",

web/src/lib/supabaseClient.test.ts

@@ -1,12 +1,9 @@
 import { describe, expect, it, vi } from 'vitest';
 
 describe('supabaseClient', () => {
-    it('creates a client when environment variables are present', async () => {
+    it('throws when legacy supabase access is used', async () => {
         vi.resetModules();
-        vi.stubEnv('VITE_SUPABASE_URL', 'https://example.supabase.co');
-        vi.stubEnv('VITE_SUPABASE_ANON_KEY', 'anon-key');
-
         const mod = await import('./supabaseClient');
-        expect(mod.supabase).toBeTruthy();
+        expect(() => mod.supabase.from('orders')).toThrowError(/no longer supported/i);
     });
-});
+});

web/src/lib/supabaseClient.ts

@@ -1,21 +1,10 @@
-import { createClient } from '@supabase/supabase-js';
+const unsupportedMessage = 'Legacy Supabase data access is no longer supported in learning_ai_invt_trdg web runtime.';
-import { getWebSupabaseConfig } from '../../../shared/supabase-config.js';
-
-const supabaseConfig = getWebSupabaseConfig();
-
-if (!supabaseConfig.isConfigured) {
-    console.warn('Missing Supabase environment variables for legacy data client fallback');
-}
-
-const dataClient = supabaseConfig.isConfigured
-    ? createClient(supabaseConfig.url, supabaseConfig.anonKey)
-    : null;
 
 export const supabase = {
     from: (...args: any[]) => {
-        if (!dataClient) {
+        void args;
-            throw new Error('Legacy Supabase data client is not configured');
+        throw new Error(unsupportedMessage);
-        }
-        return (dataClient.from as any)(...args);
     },
 };
+
+export const SUPABASE_UNSUPPORTED_MESSAGE = unsupportedMessage;