# AGENTS.md - this project

Instructions for AI coding agents working in this repository.

## Project

A Expo (React Native) + Supabase + Zod validation + Jest project.

Stack: Expo (React Native), Supabase, Zod validation, Jest.

## Commands

- Start dev server: `npx expo start`
- Add a native-compatible package: `npx expo install <package>`
- Check project health: `npx expo-doctor`
- Type-check: `npx tsc --noEmit`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`
- Unit tests: `npx jest`

## Project structure

- Screens are files in `app/` (Expo Router). Layouts are `_layout.tsx`.
- Reusable components in `components/`, hooks in `hooks/`.

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

## Expo (React Native)

- Install packages with `npx expo install` so versions match the Expo SDK.
- Use Expo Router for navigation (`<Link>`, `router.push`). Do not add React Navigation manually unless it is already in use.
- Use React Native primitives (`View`, `Text`, `Pressable`) only. No DOM elements.
- Use `FlatList` / `FlashList` for long lists, never `.map()` inside a `ScrollView`.
- Wrap screens in safe-area handling (`react-native-safe-area-context`).
- Env vars must start with `EXPO_PUBLIC_` to reach the app, so they are public. Keep secrets on a server.
- Store tokens with `expo-secure-store`, not AsyncStorage.
- Do not edit `ios/` or `android/` by hand when using Continuous Native Generation; use config plugins in `app.json` / `app.config.ts`.

## Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.
- In SSR frameworks use `@supabase/ssr` (`createServerClient` / `createBrowserClient`), not the deprecated auth-helpers packages.
- Regenerate database types after each migration and type the client with them.

## Zod validation

- Validate all untrusted input (request bodies, form data, env vars, third-party API responses) with a Zod schema at the boundary.
- Derive TypeScript types from schemas with `z.infer<typeof schema>`; do not hand-write duplicate types.
- Use `safeParse` where you need to return validation errors to the user.

## Jest

- Co-locate tests as `*.test.ts(x)` or in `__tests__/`, matching the existing convention.
- Use React Native Testing Library or Testing Library queries by role/text, not implementation details.
- Reset mocks between tests; no shared mutable state across tests.

## Reference docs

- [Expo docs](https://docs.expo.dev)
- [Supabase docs](https://supabase.com/docs)
- [Zod docs](https://zod.dev)
- [Jest docs](https://jestjs.io/docs/getting-started)