Files
HealthLog/src
Marc-André Bombeck 12e422c25e Lighten the client shell and finish four client surfaces
- Load each settings section on its own: the section route imported all
  twenty-one statically. A preload starts the chunk beside the record
  gate's read, and the loading state paints the settings card shell.
  /settings/[section] goes from 611 to 403 KB gz.
- Take Zod out of the shell every route shares: the account-access parse
  run on each boot is plain TypeScript now, held to the published schema
  by an equivalence test over good and broken blocks. The canonical unit
  table moves to its own module, so the display transform no longer
  pulls Zod in either. Layout entry 199 to 136 KB gz; /insights 369 to
  304, /medications 428 to 365, /labs 400 to 337.
- Open a saved Coach conversation at its last answer: an instant jump
  instead of the smooth scroll that lost the end, then follow late
  layout (charts, tables) for a few seconds until the reader scrolls.
- Show the document archive as a month grid of preview tiles, two
  across on a phone and three or four on a desktop, with the month
  headings kept.
- Add the admin card for the measurement table maintenance: a status
  read on the maintenance route, one calm confirmation, and the run's
  state while it is queued, running, finished or stopped.
- Re-base the bundle budget: /insights at 304, /settings/[section]
  watched at 403, aggregate cap 4335 with the reason written down.
2026-10-08 11:25:11 +02:00
..
…

src/

Application source. HealthLog is a Next.js 16 App Router project (output: "standalone", React 19, TypeScript strict). The path alias @/* resolves to this directory. Everything a request touches lives under here; the layout below follows the request flow rather than alphabetical order.

Request flow

client → src/proxy.ts → src/app/<route>/route.ts → src/lib/api-handler.ts → handler body → src/lib/api-response.ts → client
  • proxy.ts — the HTTP edge (Next.js 16's renamed middleware). Public-path allowlist, demo-mode mutation block, server-side onboarding redirect, worker-only refusal, x-request-id + CSP nonce generation, every security header.
  • app/ — App Router pages (RSC by default) and API routes. Every API route wraps its handler in apiHandler. See app/README.md.
  • lib/ — the server/runtime toolkit: apiHandler, auth, crypto, rollups, AI, notifications, pg-boss jobs, integrations, rate limiting. See lib/README.md.
  • components/ — React components (shadcn/ui new-york, kebab-case files). See components/README.md.

Other directories

  • hooks/ — shared React hooks (use- prefix, kebab-case).
  • types/ — shared TypeScript declarations.
  • generated/prisma/ — the generated Prisma client (do not edit; regenerated by prisma generate). Imported as @/generated/prisma.
  • instrumentation.ts — Next.js startup hook; boots the pg-boss worker registry and boot-time backfill queues.
  • __tests__/ — cross-cutting unit tests; most tests live in __tests__/ folders next to the code they cover.

Conventions

See ../CLAUDE.md for the full set. The load-bearing ones: RSC by default ("use client" only when a hook/state/browser API needs it); every API route wraps apiHandler and parses its body with Zod safeParse; userId is always narrowed from session or Bearer, never accepted as a body field; TanStack Query keys come only from src/lib/query-keys/; outbound HTTP goes through src/lib/safe-fetch.ts.