[rd-code-23]

Summary

Adds the first authenticated routine read endpoint: GET /routines.

The endpoint provides owner-scoped summary data for future routine-list cards and new-user empty states without loading full exercise configuration.

Closes #71.

What changed

• Added shared Zod contracts and inferred TypeScript types for routine summaries and list responses.
• Added authenticated GET /routines routing.
• Added an owner-filtered database query for routine summaries.
• Mounted the routine router in the API composition root.
• Added focused contract, route, and service tests.

Response shape

{
  "routines": [
    {
      "id": "routine-uuid",
      "name": "Upper Body",
      "description": null,
      "exerciseCount": 3,
      "scheduledDays": [1, 3, 5],
      "createdAt": "2026-08-24T18:00:00.000Z",
      "updatedAt": "2026-08-24T19:00:00.000Z"
    }
  ]
}

A user without routines receives:

{ "routines": [] }

Authorization

The user ID is read from the authenticated server-side session. The database query filters by routines.user_id, so clients cannot request another user's routine collection.

Anonymous requests receive 401 authentication_required.

Query behavior

The query:

• returns only the authenticated user's routines;
• counts distinct routine exercises;
• aggregates distinct scheduled days;
• sorts scheduled days from Sunday 0 through Saturday 6;
• serializes timestamps as ISO strings;
• sorts routines by most recently updated and then alphabetically by name.

countDistinct prevents the schedule join from inflating exercise counts.

Scope boundary

This is a lightweight collection endpoint. It intentionally excludes full exercise configuration, sets, reps, weights, rest periods, and notes. Those belong in routine detail and mutation endpoints.

Verification

• Type-checking passed.
• ESLint passed.
• All 89 tests passed.
• Changed files pass Prettier.

Out of scope

• Routine detail
• Routine creation, editing, and deletion
• Frontend routine-list UI
• Guest routine persistence