Wire up Supabase auth, Creem billing, and credits

.env.example

@@ -1,16 +1,18 @@
 # App
 NEXT_PUBLIC_APP_URL=http://localhost:3000
+# Optional: comma-separated custom dev origins for Next.js allowedDevOrigins
+# Leave empty unless you access the dev server from non-default origins (e.g. ngrok)
+# Example: abc123.ngrok-free.dev,*.local-origin.dev
+NEXT_ALLOWED_DEV_ORIGINS=
 
 # Supabase
 NEXT_PUBLIC_SUPABASE_URL=
-NEXT_PUBLIC_SUPABASE_ANON_KEY=
+NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=
 SUPABASE_SERVICE_ROLE_KEY=
 
 # Creem
 CREEM_API_KEY=
 CREEM_WEBHOOK_SECRET=
+NEXT_PUBLIC_CREEM_PRODUCT_ID_STARTER=
 NEXT_PUBLIC_CREEM_PRODUCT_ID_PRO=
-NEXT_PUBLIC_CREEM_PRODUCT_ID_CREDITS=
-
-# OAuth (configured in Supabase dashboard)
-# GOOGLE_CLIENT_ID and GITHUB_CLIENT_ID are set in Supabase, not here
+NEXT_PUBLIC_CREEM_PRODUCT_ID_BUSINESS=

.github/workflows/ci.yml

@@ -32,3 +32,34 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run lint
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run test
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+        env:
+          NEXT_PUBLIC_SUPABASE_URL: http://localhost:54321
+          NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: placeholder
+          NEXT_PUBLIC_APP_URL: http://localhost:3000
+          NEXT_PUBLIC_CREEM_PRODUCT_ID_PRO: placeholder
+          NEXT_PUBLIC_CREEM_PRODUCT_ID_BUSINESS: placeholder
+          NEXT_PUBLIC_CREEM_PRODUCT_ID_CREDITS: placeholder

.gitignore

@@ -36,4 +36,4 @@ pnpm-debug.log*
 next-env.d.ts
 
 # local
-TODO.md
+# TODO.md

.oxfmtrc.json

@@ -1,10 +1,8 @@
 {
   "$schema": "./node_modules/oxfmt/configuration_schema.json",
   "endOfLine": "lf",
-  "semi": false,
   "singleQuote": true,
   "tabWidth": 2,
-  "trailingComma": "es5",
   "printWidth": 100,
   "sortTailwindcss": {
     "stylesheet": "src/app/globals.css",

.oxlintrc.json

@@ -7,13 +7,7 @@
   "env": {
     "builtin": true
   },
-  "ignorePatterns": [
-    ".next/**",
-    "out/**",
-    "build/**",
-    "next-env.d.ts",
-    "**/*.mdx"
-  ],
+  "ignorePatterns": [".next/**", "out/**", "build/**", "next-env.d.ts", "**/*.mdx"],
   "rules": {
     "@next/next/google-font-display": "warn",
     "@next/next/google-font-preconnect": "warn",

ARCHITECTURE.md

@@ -116,8 +116,27 @@ supabase/
     ├── 001_profiles.sql               # profiles + auth trigger
     ├── 002_subscriptions.sql          # Creem subscription tracking
     └── 003_credits.sql                # wallet + ledger
+
+tests/                                 # App-level and cross-feature test suites
+├── integration/                       # Multi-feature contracts (auth + billing + credits)
+└── e2e/                               # Playwright user journeys across route groups
 ```
 
+## Testing Strategy
+
+Use a hybrid testing layout so ownership is clear and suites scale with the codebase.
+
+- Colocate unit and component tests with the feature they validate (`src/features/**`) and with shared UI in `src/components/**`.
+- Keep cross-feature integration tests in `tests/integration/` when behavior spans multiple domains.
+- Keep end-to-end tests in `tests/e2e/` to validate full user journeys at the app boundary.
+
+### Example Test Paths
+
+- `src/features/auth/components/login-form.test.tsx`
+- `src/features/billing/actions/create-checkout.test.ts`
+- `tests/integration/subscription-lifecycle.test.ts`
+- `tests/e2e/signup-to-upgrade.spec.ts`
+
 ## Principles
 
 | Rule                             | How it's applied                                                              |
@@ -127,6 +146,7 @@ supabase/
 | `lib/` = zero business logic     | Only infrastructure clients (Supabase, Creem SDK)                             |
 | `components/ui/` = shadcn only   | No feature logic leaks into shared UI primitives                              |
 | Webhooks co-located with billing | `features/billing/webhooks/` not `app/api/webhooks/`                          |
+| Tests follow feature boundaries  | Unit/component tests are colocated; integration + e2e tests live in `tests/` |
 
 ## Why Feature-Based?