SvelteKit + Supabase + Tailwind rules for AI coding agents

# AGENTS.md - this project

Instructions for AI coding agents working in this repository.

## Project

A SvelteKit (Svelte 5) + Tailwind CSS v4 + Supabase + Zod validation project.

Stack: SvelteKit (Svelte 5), Tailwind CSS v4, Supabase, Zod validation.

## Commands

- Dev server: `npm run dev`
- Build: `npm run build`
- Type check: `npm run check`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`

## Project structure

- Routes in `src/routes/` (`+page.svelte`, `+page.server.ts`, `+layout.svelte`, `+server.ts`).
- Shared code in `src/lib/` (import as `$lib/...`), server-only code in `src/lib/server/`.

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

## SvelteKit (Svelte 5)

- Use Svelte 5 runes: `$state`, `$derived`, `$effect`, `$props`. Do not use legacy `export let` or `$:` syntax in new code.
- Prefer `$derived` over `$effect` for computed values. Use `$effect` only for real side effects.
- Load data in `+page.server.ts` / `+layout.server.ts` `load` functions, not in `onMount`.
- Handle form submissions with form actions and `use:enhance`.
- Read secrets from `$env/static/private` or `$env/dynamic/private`, only in server files.
- Use `error()` and `redirect()` from `@sveltejs/kit` for control flow in load functions and actions.

## Tailwind CSS v4

- Tailwind v4 is configured in CSS: `@import "tailwindcss";` plus `@theme { ... }` for design tokens. Do not create a `tailwind.config.js` unless the project already has one.
- Use theme tokens (colors, spacing) instead of arbitrary values like `w-[37px]`.
- Build responsive layouts mobile-first with `sm:`, `md:`, `lg:` prefixes.
- Extract repeated class lists into components, not `@apply` chains.
- Support dark mode with the `dark:` variant when the project uses it.

## Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.
- In SSR frameworks use `@supabase/ssr` (`createServerClient` / `createBrowserClient`), not the deprecated auth-helpers packages.
- Regenerate database types after each migration and type the client with them.

## Zod validation

- Validate all untrusted input (request bodies, form data, env vars, third-party API responses) with a Zod schema at the boundary.
- Derive TypeScript types from schemas with `z.infer<typeof schema>`; do not hand-write duplicate types.
- Use `safeParse` where you need to return validation errors to the user.

## Reference docs

- [SvelteKit docs](https://svelte.dev/docs/kit)
- [Svelte 5 runes](https://svelte.dev/docs/svelte/what-are-runes)
- [Tailwind CSS docs](https://tailwindcss.com/docs)
- [Supabase docs](https://supabase.com/docs)
- [Zod docs](https://zod.dev)

# CLAUDE.md - this project

Project instructions for Claude Code.

## Project

A SvelteKit (Svelte 5) + Tailwind CSS v4 + Supabase + Zod validation project.

Stack: SvelteKit (Svelte 5), Tailwind CSS v4, Supabase, Zod validation.

## Commands

- Dev server: `npm run dev`
- Build: `npm run build`
- Type check: `npm run check`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`

## Project structure

- Routes in `src/routes/` (`+page.svelte`, `+page.server.ts`, `+layout.svelte`, `+server.ts`).
- Shared code in `src/lib/` (import as `$lib/...`), server-only code in `src/lib/server/`.

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

## SvelteKit (Svelte 5)

- Use Svelte 5 runes: `$state`, `$derived`, `$effect`, `$props`. Do not use legacy `export let` or `$:` syntax in new code.
- Prefer `$derived` over `$effect` for computed values. Use `$effect` only for real side effects.
- Load data in `+page.server.ts` / `+layout.server.ts` `load` functions, not in `onMount`.
- Handle form submissions with form actions and `use:enhance`.
- Read secrets from `$env/static/private` or `$env/dynamic/private`, only in server files.
- Use `error()` and `redirect()` from `@sveltejs/kit` for control flow in load functions and actions.

## Tailwind CSS v4

- Tailwind v4 is configured in CSS: `@import "tailwindcss";` plus `@theme { ... }` for design tokens. Do not create a `tailwind.config.js` unless the project already has one.
- Use theme tokens (colors, spacing) instead of arbitrary values like `w-[37px]`.
- Build responsive layouts mobile-first with `sm:`, `md:`, `lg:` prefixes.
- Extract repeated class lists into components, not `@apply` chains.
- Support dark mode with the `dark:` variant when the project uses it.

## Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.
- In SSR frameworks use `@supabase/ssr` (`createServerClient` / `createBrowserClient`), not the deprecated auth-helpers packages.
- Regenerate database types after each migration and type the client with them.

## Zod validation

- Validate all untrusted input (request bodies, form data, env vars, third-party API responses) with a Zod schema at the boundary.
- Derive TypeScript types from schemas with `z.infer<typeof schema>`; do not hand-write duplicate types.
- Use `safeParse` where you need to return validation errors to the user.

## Reference docs

- [SvelteKit docs](https://svelte.dev/docs/kit)
- [Svelte 5 runes](https://svelte.dev/docs/svelte/what-are-runes)
- [Tailwind CSS docs](https://tailwindcss.com/docs)
- [Supabase docs](https://supabase.com/docs)
- [Zod docs](https://zod.dev)

---
description: "Core rules for this project"
alwaysApply: true
---

# this project

A SvelteKit (Svelte 5) + Tailwind CSS v4 + Supabase + Zod validation project.

Stack: SvelteKit (Svelte 5), Tailwind CSS v4, Supabase, Zod validation.

## Commands

- Dev server: `npm run dev`
- Build: `npm run build`
- Type check: `npm run check`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

---
description: "SvelteKit (Svelte 5) conventions: SvelteKit with Svelte 5 runes and TypeScript."
globs: src/**/*.svelte, src/**/*.ts
alwaysApply: false
---

# SvelteKit (Svelte 5)

- Use Svelte 5 runes: `$state`, `$derived`, `$effect`, `$props`. Do not use legacy `export let` or `$:` syntax in new code.
- Prefer `$derived` over `$effect` for computed values. Use `$effect` only for real side effects.
- Load data in `+page.server.ts` / `+layout.server.ts` `load` functions, not in `onMount`.
- Handle form submissions with form actions and `use:enhance`.
- Read secrets from `$env/static/private` or `$env/dynamic/private`, only in server files.
- Use `error()` and `redirect()` from `@sveltejs/kit` for control flow in load functions and actions.

Docs: https://svelte.dev/docs/kit, https://svelte.dev/docs/svelte/what-are-runes

---
description: "Tailwind CSS v4 conventions: Utility-first styling with Tailwind CSS v4."
globs: **/*.css, **/*.tsx, **/*.vue, **/*.svelte, **/*.astro, **/*.html, **/*.blade.php, **/*.erb
alwaysApply: false
---

# Tailwind CSS v4

- Tailwind v4 is configured in CSS: `@import "tailwindcss";` plus `@theme { ... }` for design tokens. Do not create a `tailwind.config.js` unless the project already has one.
- Use theme tokens (colors, spacing) instead of arbitrary values like `w-[37px]`.
- Build responsive layouts mobile-first with `sm:`, `md:`, `lg:` prefixes.
- Extract repeated class lists into components, not `@apply` chains.
- Support dark mode with the `dark:` variant when the project uses it.

Docs: https://tailwindcss.com/docs

---
description: "Supabase conventions: Postgres, auth and storage from Supabase."
globs: supabase/**, **/supabase/**/*.ts, lib/supabase/**
alwaysApply: false
---

# Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.
- In SSR frameworks use `@supabase/ssr` (`createServerClient` / `createBrowserClient`), not the deprecated auth-helpers packages.
- Regenerate database types after each migration and type the client with them.

Docs: https://supabase.com/docs

---
description: "Zod validation conventions: Runtime schema validation with Zod."
globs: **/*.ts, **/*.tsx
alwaysApply: false
---

# Zod validation

- Validate all untrusted input (request bodies, form data, env vars, third-party API responses) with a Zod schema at the boundary.
- Derive TypeScript types from schemas with `z.infer<typeof schema>`; do not hand-write duplicate types.
- Use `safeParse` where you need to return validation errors to the user.

Docs: https://zod.dev

# Cursor rules - this project

You are an expert SvelteKit (Svelte 5), Tailwind CSS v4, Supabase, Zod validation engineer working on this codebase. Follow these rules.

## Project

A SvelteKit (Svelte 5) + Tailwind CSS v4 + Supabase + Zod validation project.

Stack: SvelteKit (Svelte 5), Tailwind CSS v4, Supabase, Zod validation.

## Commands

- Dev server: `npm run dev`
- Build: `npm run build`
- Type check: `npm run check`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`

## Project structure

- Routes in `src/routes/` (`+page.svelte`, `+page.server.ts`, `+layout.svelte`, `+server.ts`).
- Shared code in `src/lib/` (import as `$lib/...`), server-only code in `src/lib/server/`.

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

## SvelteKit (Svelte 5)

- Use Svelte 5 runes: `$state`, `$derived`, `$effect`, `$props`. Do not use legacy `export let` or `$:` syntax in new code.
- Prefer `$derived` over `$effect` for computed values. Use `$effect` only for real side effects.
- Load data in `+page.server.ts` / `+layout.server.ts` `load` functions, not in `onMount`.
- Handle form submissions with form actions and `use:enhance`.
- Read secrets from `$env/static/private` or `$env/dynamic/private`, only in server files.
- Use `error()` and `redirect()` from `@sveltejs/kit` for control flow in load functions and actions.

## Tailwind CSS v4

- Tailwind v4 is configured in CSS: `@import "tailwindcss";` plus `@theme { ... }` for design tokens. Do not create a `tailwind.config.js` unless the project already has one.
- Use theme tokens (colors, spacing) instead of arbitrary values like `w-[37px]`.
- Build responsive layouts mobile-first with `sm:`, `md:`, `lg:` prefixes.
- Extract repeated class lists into components, not `@apply` chains.
- Support dark mode with the `dark:` variant when the project uses it.

## Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.
- In SSR frameworks use `@supabase/ssr` (`createServerClient` / `createBrowserClient`), not the deprecated auth-helpers packages.
- Regenerate database types after each migration and type the client with them.

## Zod validation

- Validate all untrusted input (request bodies, form data, env vars, third-party API responses) with a Zod schema at the boundary.
- Derive TypeScript types from schemas with `z.infer<typeof schema>`; do not hand-write duplicate types.
- Use `safeParse` where you need to return validation errors to the user.

## Reference docs

- [SvelteKit docs](https://svelte.dev/docs/kit)
- [Svelte 5 runes](https://svelte.dev/docs/svelte/what-are-runes)
- [Tailwind CSS docs](https://tailwindcss.com/docs)
- [Supabase docs](https://supabase.com/docs)
- [Zod docs](https://zod.dev)

# Copilot instructions - this project

A SvelteKit (Svelte 5) + Tailwind CSS v4 + Supabase + Zod validation project.

Stack: SvelteKit (Svelte 5), Tailwind CSS v4, Supabase, Zod validation.

## Commands

- Dev server: `npm run dev`
- Build: `npm run build`
- Type check: `npm run check`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

---
applyTo: "src/**/*.svelte,src/**/*.ts"
---

# SvelteKit (Svelte 5)

- Use Svelte 5 runes: `$state`, `$derived`, `$effect`, `$props`. Do not use legacy `export let` or `$:` syntax in new code.
- Prefer `$derived` over `$effect` for computed values. Use `$effect` only for real side effects.
- Load data in `+page.server.ts` / `+layout.server.ts` `load` functions, not in `onMount`.
- Handle form submissions with form actions and `use:enhance`.
- Read secrets from `$env/static/private` or `$env/dynamic/private`, only in server files.
- Use `error()` and `redirect()` from `@sveltejs/kit` for control flow in load functions and actions.

---
applyTo: "**/*.css,**/*.tsx,**/*.vue,**/*.svelte,**/*.astro,**/*.html,**/*.blade.php,**/*.erb"
---

# Tailwind CSS v4

- Tailwind v4 is configured in CSS: `@import "tailwindcss";` plus `@theme { ... }` for design tokens. Do not create a `tailwind.config.js` unless the project already has one.
- Use theme tokens (colors, spacing) instead of arbitrary values like `w-[37px]`.
- Build responsive layouts mobile-first with `sm:`, `md:`, `lg:` prefixes.
- Extract repeated class lists into components, not `@apply` chains.
- Support dark mode with the `dark:` variant when the project uses it.

---
applyTo: "supabase/**,**/supabase/**/*.ts,lib/supabase/**"
---

# Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.
- In SSR frameworks use `@supabase/ssr` (`createServerClient` / `createBrowserClient`), not the deprecated auth-helpers packages.
- Regenerate database types after each migration and type the client with them.

---
applyTo: "**/*.ts,**/*.tsx"
---

# Zod validation

- Validate all untrusted input (request bodies, form data, env vars, third-party API responses) with a Zod schema at the boundary.
- Derive TypeScript types from schemas with `z.infer<typeof schema>`; do not hand-write duplicate types.
- Use `safeParse` where you need to return validation errors to the user.

---
trigger: always_on
---

# this project

A SvelteKit (Svelte 5) + Tailwind CSS v4 + Supabase + Zod validation project.

Stack: SvelteKit (Svelte 5), Tailwind CSS v4, Supabase, Zod validation.

## Commands

- Dev server: `npm run dev`
- Build: `npm run build`
- Type check: `npm run check`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

---
trigger: glob
globs: src/**/*.svelte, src/**/*.ts
---

# SvelteKit (Svelte 5)

- Use Svelte 5 runes: `$state`, `$derived`, `$effect`, `$props`. Do not use legacy `export let` or `$:` syntax in new code.
- Prefer `$derived` over `$effect` for computed values. Use `$effect` only for real side effects.
- Load data in `+page.server.ts` / `+layout.server.ts` `load` functions, not in `onMount`.
- Handle form submissions with form actions and `use:enhance`.
- Read secrets from `$env/static/private` or `$env/dynamic/private`, only in server files.
- Use `error()` and `redirect()` from `@sveltejs/kit` for control flow in load functions and actions.

---
trigger: glob
globs: **/*.css, **/*.tsx, **/*.vue, **/*.svelte, **/*.astro, **/*.html, **/*.blade.php, **/*.erb
---

# Tailwind CSS v4

- Tailwind v4 is configured in CSS: `@import "tailwindcss";` plus `@theme { ... }` for design tokens. Do not create a `tailwind.config.js` unless the project already has one.
- Use theme tokens (colors, spacing) instead of arbitrary values like `w-[37px]`.
- Build responsive layouts mobile-first with `sm:`, `md:`, `lg:` prefixes.
- Extract repeated class lists into components, not `@apply` chains.
- Support dark mode with the `dark:` variant when the project uses it.

---
trigger: glob
globs: supabase/**, **/supabase/**/*.ts, lib/supabase/**
---

# Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.
- In SSR frameworks use `@supabase/ssr` (`createServerClient` / `createBrowserClient`), not the deprecated auth-helpers packages.
- Regenerate database types after each migration and type the client with them.

---
trigger: glob
globs: **/*.ts, **/*.tsx
---

# Zod validation

- Validate all untrusted input (request bodies, form data, env vars, third-party API responses) with a Zod schema at the boundary.
- Derive TypeScript types from schemas with `z.infer<typeof schema>`; do not hand-write duplicate types.
- Use `safeParse` where you need to return validation errors to the user.

# GEMINI.md - this project

Project context for Gemini CLI.

## Project

A SvelteKit (Svelte 5) + Tailwind CSS v4 + Supabase + Zod validation project.

Stack: SvelteKit (Svelte 5), Tailwind CSS v4, Supabase, Zod validation.

## Commands

- Dev server: `npm run dev`
- Build: `npm run build`
- Type check: `npm run check`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`

## Project structure

- Routes in `src/routes/` (`+page.svelte`, `+page.server.ts`, `+layout.svelte`, `+server.ts`).
- Shared code in `src/lib/` (import as `$lib/...`), server-only code in `src/lib/server/`.

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

## SvelteKit (Svelte 5)

- Use Svelte 5 runes: `$state`, `$derived`, `$effect`, `$props`. Do not use legacy `export let` or `$:` syntax in new code.
- Prefer `$derived` over `$effect` for computed values. Use `$effect` only for real side effects.
- Load data in `+page.server.ts` / `+layout.server.ts` `load` functions, not in `onMount`.
- Handle form submissions with form actions and `use:enhance`.
- Read secrets from `$env/static/private` or `$env/dynamic/private`, only in server files.
- Use `error()` and `redirect()` from `@sveltejs/kit` for control flow in load functions and actions.

## Tailwind CSS v4

- Tailwind v4 is configured in CSS: `@import "tailwindcss";` plus `@theme { ... }` for design tokens. Do not create a `tailwind.config.js` unless the project already has one.
- Use theme tokens (colors, spacing) instead of arbitrary values like `w-[37px]`.
- Build responsive layouts mobile-first with `sm:`, `md:`, `lg:` prefixes.
- Extract repeated class lists into components, not `@apply` chains.
- Support dark mode with the `dark:` variant when the project uses it.

## Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.
- In SSR frameworks use `@supabase/ssr` (`createServerClient` / `createBrowserClient`), not the deprecated auth-helpers packages.
- Regenerate database types after each migration and type the client with them.

## Zod validation

- Validate all untrusted input (request bodies, form data, env vars, third-party API responses) with a Zod schema at the boundary.
- Derive TypeScript types from schemas with `z.infer<typeof schema>`; do not hand-write duplicate types.
- Use `safeParse` where you need to return validation errors to the user.

## Reference docs

- [SvelteKit docs](https://svelte.dev/docs/kit)
- [Svelte 5 runes](https://svelte.dev/docs/svelte/what-are-runes)
- [Tailwind CSS docs](https://tailwindcss.com/docs)
- [Supabase docs](https://supabase.com/docs)
- [Zod docs](https://zod.dev)