Add validation, generation persistence, observability, Supabase reconciliation, and CI/E2E harness

[Armand9999]

Motivation

• Harden the application with explicit input validation, deterministic local date handling, and safer AI generation/persistence contracts.
• Improve observability and error handling by introducing a structured logger that redacts sensitive metadata.
• Make the Supabase schema reproducible and safe for production by adding reconciliation migrations, RLS, and an atomic save_profile_with_tde function.
• Establish automated quality gates and end-to-end test harnesses (Playwright) to validate public and authenticated flows in CI.

Description

• Added environment template .env.example, an env-check script scripts/check-env.mjs, and wired env:check into package.json and a new GitHub Actions workflow (.github/workflows/quality.yml) to run lint, typecheck, build and Playwright E2E.
• Introduced typed domain libraries and validation: app/lib/date.ts, app/lib/auth.ts, app/lib/profile.ts, app/lib/generated-plans.ts, app/lib/profile-options.ts, and app/lib/database.types.ts to enforce schemas for profiles, TDE, generated workouts and meal plans.
• Reworked generation and persistence: app/lib/workout-generator.ts and app/protected/profile/meal-plan/action.ts now validate inputs, optionally use deterministic E2E fixtures, parse OpenAI JSON responses via strict schemas, and persist generated plans with non-destructive upsert.
• Added observability and safer error handling via app/lib/logger.ts, and replaced scattered console.* usages with logError/logInfo; improved middleware and server client cookie handling in utils/supabase/*.
• UI and flow improvements: NavBar uses next/image, sign-out now logs errors, profile/meal-plan/workout components use local date keys from app/lib/date.ts, and auth callbacks use getSafeRedirectPath.
• Supabase: added supabase/config.toml, reconciliation migration supabase/migrations/20260611170000_reconcile_fitness_schema.sql plus a preflight check and an empty remote baseline marker; added app/lib/database.types.ts contract.
• Testing and E2E: added many unit tests under tests/*.test.ts, Playwright tests under e2e/, Playwright config playwright.config.ts, auth setup and mocked-AI fixtures, and updated tsconfig.test.json for the test runner.
• Misc: updated .gitignore to ignore test artifacts, added README.md documentation updates, and small stylistic/CSS and dependency tweaks (package.json, package-lock.json, ESLint config updates).

Testing

• Added a suite of Node-run unit tests and contract tests and executed the local baseline checks with npm run check and npm test (unit/type/lint); these validation tests (including tests/date.test.ts, tests/tde.test.ts, tests/generated-plans.test.ts, and migration contract tests) were included and exercised as part of the quality gate.
• Playwright E2E coverage is configured and run by CI via npm run test:e2e and playwright.config.ts, with deterministic mocked-AI flows gated by E2E_AUTH_EMAIL, E2E_AUTH_PASSWORD, and E2E_MOCK_AI environment variables; the GitHub Actions job Quality is configured to run the full quality gate and upload Playwright artifacts on failure.
• The repository now includes scripts/check-env.mjs and npm run env:check to validate required environment variables; this is used in CI and included in the ci script.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fitness-app	Ready	Preview, Comment	Jun 18, 2026 4:40am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c136eb350a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Load .env.local before validating required env

When developers follow the documented setup and put the required values in .env.local, this script still validates only the parent process environment, so npm run env:check reports missing variables even though the app would load them through Next. I verified this by adding the required keys to .env.local in the target worktree and running the script; it still failed for keys not exported in the shell, which breaks the local/release quality gate described in the README.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Load E2E env before selecting Playwright projects

When E2E_AUTH_EMAIL, E2E_AUTH_PASSWORD, and E2E_MOCK_AI are placed only in .env.local as the README recommends for local runs, the Playwright config never sees them and silently skips the authenticated and mocked-AI projects. I checked with those values present only in .env.local, and npx playwright test --list still listed only the public-auth tests, so the intended protected-flow coverage is not exercised locally unless users separately export the variables.

Useful? React with 👍 / 👎.