Validation scripts

QA Sync has no automated test suite. Instead it has a type-check and three Node validators in scripts/, each behind an npm script.

Command	Needs	Safe against production?
npm run lint	Nothing	Yes (local only)
npm run validate:local-env	Local Supabase running	Local only
npm run validate:core	Local Supabase running, seeded	Never run against production
npm run validate:prod-env	Production env values	Yes; that’s its purpose

npm run lint

Runs tsc --noEmit. It’s a type-check: there’s no ESLint or Prettier in the repository. It’s the only check that runs without a local Supabase, and the gate to run before calling a change done.

npm run validate:local-env

Script: scripts/validate-local-env.mjs (with scripts/lib/local-env-health.mjs). Checks that:

• the browser env values point at the running local Supabase stack;
• local migrations match the repository;
• required tables and storage buckets exist;
• the local auth settings endpoint is reachable;
• the active Node architecture can load the installed Rollup native package.

Use it when the app behaves oddly locally, after pulling new migrations, or after changing Node versions. It prints a JSON summary.

npm run validate:core

Script: scripts/validate-core-workflows.mjs. It signs in as the seeded local accounts and exercises the core workflows end to end:

• seeded accounts authenticate and resolve to the expected roles;
• tester passing and failing submissions;
• developer status updates, and note save and clear;
• developer suggestion escalation into a task request;
• admin task-request publishing;
• task-request attachment upload and authorised access;
• representative admin create, update and delete and access changes;
• that these mutations write audit-log rows.

It cleans up every temporary record afterwards using the local service-role key from supabase status -o env.

Danger

Never aim validate:core at a live production project. It uses seeded credentials and a service-role key, and it writes and deletes data.

Run it after any change to workflows, RLS policies, RPCs or audit logging.

npm run validate:prod-env

Script: scripts/validate-production-env.mjs. Loads .env.production.local, .env.production, .env.local and .env (in that order, without overriding values already set) and checks the production browser env contract:

• VITE_SUPABASE_URL is present, isn’t a placeholder, is a valid https URL and doesn’t point at localhost or a local network host;
• VITE_SUPABASE_ANON_KEY is present and isn’t a placeholder;
• VITE_DEV_LOGIN_SHORTCUTS is not present anywhere a production build can read it.

Run it before every production deploy. It prints a JSON summary and exits non-zero on errors.

Suggested routine

When	Run
Before every commit	npm run lint
After pulling migrations or switching Node	npm run validate:local-env
After changing workflows, RLS or RPCs	npm run validate:core
Before deploying	npm run validate:prod-env, then npm run build