PeptidePal v2 — Phase 1 foundation built + verified (2026-07-07)

What's done + verified this session

Fresh v2 app at PROJECTS/Peptide Pal/app-v2/ (React + Vite + TS + Tailwind v4).

• Toolchain: Node 24, Supabase CLI 2.108, keys present (SUPABASE_ACCESS_TOKEN, STRIPE_TEST_SECRET_KEY, STRIPE_API_KEY_MAIN, RESEND, OPENROUTER, ANTHROPIC). Docker is NOT installed → no local Supabase; Phase 1 needs a cloud project.
• Theme system (§5.4 #6): single token source src/branding.css (light default + .dark Oura-style), src/branding.ts (name/copy/logo/chart colors). Verified live at 390px: light + dark both render, one-tap toggle, persists per-device, primed before paint (no flash). Screenshots in app-v2/verify/.
• App shell + nav (§5.4 #2): sticky header (logo + theme toggle) + mobile bottom nav = 5 core (Home/Log/Supply/Insights/More); everything else (Compounds, Cycles & stacks, Reminders, Clinician share, Settings, Help & support) behind More. Routing verified.
• Schema migration written, NOT yet applied: supabase/migrations/0001_phase1_core.sql — profiles, entitlements (tamper-proof: read-own, no client writes), compounds, compound_dose_history, supply_items reworked (one row = one container; status in_use/backup + location), injections. Owner-only RLS on every table; auto-profile trigger on signup.
• Verify: npx tsc -b clean, 0 console errors, dev server boots on 4780.
• v1 fully mined from app/backend/server.py — data model + compliance-safe logic (cycle calendar math, premium expiry, reminder scheduler, LRU site rotation) captured as the reference.

Backend — LIVE (Sondra chose the FREE org, $0/mo)

• Project peptidepal-v2 zhcxygxjvcatvdodovtd on org foeliowlfikzqfwyxcst (FREE), region us-east-1, ACTIVE_HEALTHY.
• Schema applied (migrations 0001_phase1_core + 0002_harden_functions). 6 tables, RLS on all: profiles, entitlements, compounds, compound_dose_history, supply_items, injections. Security advisor: 0 lints.
• URL + publishable key in app-v2/.env.local (gitignored). Anon key = sb_publishable_....
• ⚠️ Free-project sleep risk mitigated by design: the reminder dispatcher pings the DB on schedule = built-in keep-alive (wire the cron in Phase 2; add a daily heartbeat if reminders are ever off).

Theme decision (updated per Perplexity a11y research Sondra ran)

• 3-way Light / Dark / System, default = System (follows the phone). Header = quick light/dark override; full 3-way selector goes in Settings (Phase 1). Choice persists per-device.
• Dark softened off pure black (#12181a surfaces) + brighter text per Apple a11y guidance. Verified in app-v2/verify/pp-dark-softened.png.

Resume (next: Phase 1 features)

Auth (magic link + Google) → onboarding (tracking_focus: glp1/research/both) → compound CRUD → injection log (body-map site rotation) → supply rework UI (group by product; in-use/backup + fridge/freezer). Then the 2-account RLS isolation proof (two live signups, confirm neither sees the other's rows both directions) to close Phase 1. Settings page carries the 3-way theme selector + units + export/delete.