PeptidePal v2 — Phase 3b (insights + share + admin) COMPLETE + verified (2026-07-07, Opus)

The three deferred Phase-3 pieces, built + hard-verified. This closes out §5.1/§5.2 premium features. Still TEST mode, nothing public.

What shipped

• DB — migrations 0006_phase3b_... + 0007_share_premium_gate (applied live):
• is_admin(uid) helper; claim_ai_run(uid, cap) (atomic per-day AI meter).
• Tables: ai_usage (service-only), insights (owner-read), share_links (owner-all + premium-insert trigger), admin_audit (service-only).
• Advisor: 2 new INFO lints (ai_usage/admin_audit = RLS on, no policy) are intentional — deny-all to clients, service-role only. Plus the one carried pg_net-in-public WARN.
• AI insight cards (§5.2 #5) — edge fn generate-insights (premium-gated via is_premium, 5/day rate cap via claim_ai_run, fail-closed, OpenRouter anthropic/claude-sonnet-5 on her key). Strong compliance prompt: descriptive-only, never advice/dose/diagnosis. pages/Insights.tsx rebuilt: free users get a client-side descriptive summary (injections, streak, avg mood, top site) + a premium lock; premium users get AI cards + Refresh.
• Clinician share links (§5.1) — public edge fn share-view (no auth; the token is the credential; returns a sanitized whitelist — name + compounds + injections + check-ins, never email/id/user_id; noindex, no-store; 404 on revoked/unknown, 410 on expired). pages/Share.tsx (premium-gated create/list/copy/revoke; 30-day expiry; premium enforced by DB trigger). pages/SharedView.tsx = the public read page at /s/:token, rendered OUTSIDE the auth gate (App.tsx restructured to one router). CSV export stays free in Settings.
• Admin console (§5.1 + §5.4 #3) — edge fn admin (action-dispatched: list/grant/revoke/delete; every action requires caller is_admin server-side; writes admin_audit; never deletes self). pages/Admin.tsx (client-gated by profiles.is_admin + server-enforced): user list with premium/admin badges, grant/revoke premium, multi-select bulk delete. More menu shows an Admin link only to admins. profiles.is_admin set manually in DB for Sondra when she wants access.

Verification (done)

• npx tsc -b clean · npm run build clean.
• PHASE 3B PROOF — 18/18 PASS (forged sessions + a real AI call, throwaway users): free user → insights 403; premium user → real AI cards generated (and with sparse data it correctly said "too early to spot patterns" — compliance guardrail working); 5/day cap → 429; free user blocked creating a share link (trigger); premium creates one; public view returns the log and is sanitized (no email/user_id); expired → 410, revoked/unknown → 404; non-admin → admin 403; admin lists users, grants premium (plan=admin), bulk-deletes, cannot delete self, actions audited.
• Bug found + fixed mid-verify: OpenRouter wraps JSON in ``` `json `` fences → JSON.parse` threw → 502. Parser now strips fences / extracts the JSON object; redeployed (v2); re-verified green.
• DB clean afterward (0 rows; test users cascade-deleted; test audit rows cleared).

New edge functions (all deployed, TEST/live-key as noted)

generate-insights (jwt), share-view (public), admin (jwt) — plus Phase 3's create-checkout, stripe-webhook, and Phase 2's send-reminders.

Only-Sondra / launch items

• Make yourself admin: set profiles.is_admin = true on your row (one SQL line) to see the Admin console.
• Real Stripe test-card checkout (carried from Phase 3).
• Insight cards cost: ~pennies/run on her OpenRouter key, capped 5/user/day. Consider tightening the cap or adding a monthly ceiling before wide launch.

Phase 4 (launch) — remaining, unchanged

Landing page, legal pages (privacy/terms/cookie), in-app support form + email alert (her standing rule), empty-state/microcopy polish, mobile Lighthouse gate, /app-safety-check, flip Stripe TEST→live (+ email-confirm ON), domain cutover to getpeptidepal.com, cancel Emergent. Also: set APP_URL edge secret to the real domain; regenerate types.ts from live DB; decide the pg_net-schema move during the launch DB pass.