PeptidePal v2 — Phase 1 features COMPLETE + verified (2026-07-07, Opus)

Resumed the foundation handoff on Opus (Sondra's call) and built out all Phase-1 features against the live free Supabase project zhcxygxjvcatvdodovtd.

What shipped this session (all in app-v2/src/)

• Auth — lib/auth.tsx (AuthProvider + useAuth: session, profile, refresh, signOut) wired into main.tsx. pages/Login.tsx: Google button + email magic-link, friendly "Google not enabled yet" fallback.
• Route guard — App.tsx gates on auth: no session → Login only; signed-in but !onboarded → Onboarding only; else the app shell. Added routes for Compounds + Settings; honest pages/Placeholder.tsx stubs for cycles/reminders/share/support so More never dead-ends.
• Onboarding — pages/Onboarding.tsx: 2-step (tracking_focus glp1/research/both → name + weight units, weight only shown for glp1/both), writes profile + onboarded=true.
• Compounds CRUD — pages/Compounds.tsx: add/edit/soft-delete, bulk multi-select delete, dose-history row inserted automatically when the dose changes. Soft-delete (active=false) so past injections/history survive.
• Injection log — pages/Log.tsx + components/BodyMap.tsx: pick compound (prefills dose), optional "draw from" an in-use supply container, functional body map (abdomen quadrants + thighs) with LRU "next" suggestion (least-recently-used site), datetime, notes. On save: inserts injection, auto-decrements the in-use container and promotes a backup to in-use when it hits 0 (§5.4 #4). Recent list with bulk delete.
• Supply rework (§5.4 #4) — pages/Supply.tsx: containers grouped by product, in-use vs backup with fridge/freezer location, doses-left (user-typed, never computed), low-stock "low" badge, quick "Use" (promote backup), add/edit sheet (form-adaptive: reconstitution fluid only for powder), multi-select bulk delete.
• Settings — pages/Settings.tsx: 3-way Light/Dark/System theme selector (syncs the theme context + persists to profiles.theme), units, free CSV export of injections (anti-hostage, §5.1), sign out, delete-all-my-data (double confirm).
• Dashboard — pages/Dashboard.tsx: real greeting, last-injection card, "Log an injection" CTA, running-low nudges. (The composite ring is Phase 2.)
• Shared: components/EmptyState.tsx, components/SelectableList.tsx (reusable multi-select+bulk-delete list, §5.4 #3), components/ui/field.tsx (Input/Textarea/Select/Field), components/ui/sheet.tsx (bottom-sheet dialog), lib/types.ts (row types).

Verification (done)

• npx tsc -b --force → clean. npm run build → clean (dist built).
• Dev server booted on 4780; Login renders at 390px with 0 console errors (screenshot app-v2/verify/pp-login-2026-07-07.png).
• 2-account RLS isolation PROOF PASSED — 15/15 checks (script ran two real users via the anon client): each inserts own compound, each sees exactly their own row, neither sees the other's (both directions), explicit cross-user_id filter returns 0, and entitlements can't be self-granted (tamper-proof). Test users deleted; DB confirmed back to 0 rows across all tables (auto-profile trigger + delete-cascade both confirmed working).

Not verifiable here (needs Sondra / launch flips)

• The authenticated UI flow end-to-end — magic-link needs a real email round-trip and Google needs the provider enabled in Supabase (launch-day flip). API-level isolation is proven; Sondra should click through signup → onboard → add compound → log → supply on her phone once a provider is on.
• Google sign-in shows a kind "not available yet" error until the provider is configured.

Next (Phase 2, per PRD §13)

Dashboard ring + check-ins, body-map polish (illustrated art), reminders + push dispatcher that provably fire (§5.4 #1 — the #1 must-fix), cycles. Then Phase 3 (Stripe money spine + premium gates + half-life curves + stacks + insight cards + share links + admin) and Phase 4 (landing, legal, support form, /app-safety-check, domain cutover).

Still open (unchanged from foundation handoff)

• Free-tier "1 compound" gate intentionally NOT enforced yet — lands with the Phase 3 paywall (don't gate before the money spine exists).
• types.ts is hand-written; regenerate from the live DB at launch.
• Emergent plan cancellation = Sondra's manual step (getpeptidepal.com dark until cutover, no users).