Initialize Next.js + TypeScript + Supabase foundation

[besfeng23]

Motivation

• Establish a minimal, production-ready foundation for the Pandora Memory Engine with a strict Next.js App Router + TypeScript project layout.
• Provide clear server/client separation for Supabase usage so public keys are the only values available client-side and server-only keys remain out of browser code.
• Prepare validation primitives and a clean UI shell so subsequent memory engine, DB schema, RLS, and OpenAI integration tasks can build on a stable base.

Description

• Added project configuration files and tooling including package.json, tsconfig.json, next.config.ts, and eslint.config.mjs with strict TypeScript enabled and an ESLint ignore for build artifacts.
• Created a lightweight App Router structure and UI shell with app/layout.tsx, app/page.tsx, app/dashboard/page.tsx, and styles in app/globals.css, plus layout components components/layout/{app-shell,sidebar,topbar}.tsx.
• Implemented a simple server API route app/api/health/route.ts that returns a JSON health/status response indicating foundation-only state.
• Added Supabase helpers: a browser-safe client in lib/supabase/client.ts that only reads NEXT_PUBLIC_ env vars and a server client in lib/supabase/server.ts that uses cookie-backed SSR APIs while avoiding exposing any service role key to client code.
• Added authentication helpers lib/security/auth.ts that resolve or require the current Supabase user for future protected routes.
• Introduced Zod validation enums and a classification schema in lib/validation/schemas.ts for namespace, strength, canonStatus, and memoryType to satisfy the memory classification contract.
• Added repository hygiene files: .gitignore and .env.example (contains placeholders including SUPABASE_SERVICE_ROLE_KEY and OPENAI_API_KEY but no real secrets).

Testing

• Ran npm install successfully to install dependencies.
• Ran npm run typecheck (tsc --noEmit) and TypeScript strict checks passed after minor type annotations were added to the server cookie handler.
• Ran npm run lint with eslint (configured to ignore .next and node_modules) and the build-time linting completed as part of next build.
• Ran npm run build which compiled and optimized the app successfully.
• Launched the dev server with npm run dev -- -H 0.0.0.0 and verified GET /api/health returns the expected JSON response.

---

Codex Task

[coderabbitai]

Warning

Review limit reached

@besfeng23, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 49 minutes and 20 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 977b27cf-635e-4b9a-b149-c71bbd937220

📥 Commits

Reviewing files that changed from the base of the PR and between 83d4433 and 90742a4.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (18)

• .env.example
• .gitignore
• app/api/health/route.ts
• app/dashboard/page.tsx
• app/globals.css
• app/layout.tsx
• app/page.tsx
• components/layout/app-shell.tsx
• components/layout/sidebar.tsx
• components/layout/topbar.tsx
• eslint.config.mjs
• lib/security/auth.ts
• lib/supabase/client.ts
• lib/supabase/server.ts
• lib/validation/schemas.ts
• next.config.ts
• package.json
• tsconfig.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/set-up-next.js-typescript-supabase-project-structure

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90742a4184

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Inline public env reads for the browser client

Because this file is a "use client" module, this dynamic lookup has to survive into the browser bundle. Next.js only inlines NEXT_PUBLIC_* values for static process.env.NEXT_PUBLIC_... references, and its docs call out that dynamic lookups like process.env[varName] are not inlined (https://nextjs.org/docs/pages/guides/environment-variables#bundling-environment-variables-for-the-browser). When a client component uses createSupabaseBrowserClient, these reads will be undefined in the browser and the helper will throw despite valid build-time env config; read the URL and anon key with static property access before passing them to Supabase.

Useful? React with 👍 / 👎.