@kensaurus/skills 0.0.0-stage → 2.0.0

package/rules/full-stack-ship-discipline.mdc

@@ -0,0 +1,37 @@
+---
+description: Require frontend changes and their DB/RPC/RLS/storage/secret dependencies to ship and be remotely verified together. Apply when implementing code that reads or writes backend state. Do not apply to plan-* or present-then-stop audits; production data mutation still requires confirmation.
+alwaysApply: false
+---
+
+# Full-Stack Ship Discipline
+
+A feature is **not done** when the UI compiles — it is done when the flow
+works end-to-end against the **remote** backend the user actually hits. The
+recurring failure this prevents: a migration file authored beside a feature
+is never deployed, the live API 404s, and the bug masquerades as a UI issue.
+
+1. **Inventory backend dependencies first.** Before editing components ask:
+   does this read/write data, call an RPC, or depend on a table / column /
+   function / policy / bucket / secret? Fix those in the same turn.
+2. **Deploy schema, don't just author it.** Supabase: `apply_migration` /
+   `execute_sql` on the confirmed `project_id`, then verify in the same turn
+   — re-query `information_schema` / `pg_proc` / `pg_policies`, exercise the
+   surface as `anon` / `authenticated`, check `query_logs` and `get_advisors`.
+   Other stacks: run the real deploy command (`prisma migrate deploy`,
+   `drizzle-kit push`, `rails db:migrate`, …) against the confirmed
+   environment before the turn ends.
+3. **Keep file and deploy in sync.** SQL applied via MCP also gets a matching
+   versioned file in the repo's migrations folder. Do not `git push` unless
+   the user asked in this turn.
+4. **Edge functions, secrets, RLS, buckets, and cron jobs count as schema** —
+   deploy and configure them with the UI change (`verify_jwt`, CORS, keys).
+5. **Schema vs data.** Deploy schema the user asked to ship without
+   re-asking — the request was the approval. Ask before mutating production
+   data (`DELETE` / `TRUNCATE` / `UPDATE` on real rows) — it is hard to reverse.
+6. **Do not attach during a present-then-stop pass.** If the active skill is
+   `plan-*` or a read-only `audit-*`, emit findings/plan only — do not
+   `apply_migration` or deploy until the user approves a phase.
+
+Done means: remote objects verified to exist, anon + authenticated paths
+exercised, migration file on disk, and the frontend observed hitting a 200 —
+not a stale 404.

package/rules/native-rn-monorepo/README.md

@@ -0,0 +1,63 @@
+# Native RN-monorepo rules (Cursor)
+
+Drop-in rules for a React Native + Web monorepo where the developer
+is on **Linux/Windows (no Mac)** and iOS verification is **CI-only**.
+
+## What's here
+
+| Rule | Auto-attaches when |
+|---|---|
+| `_project.mdc` | always (`alwaysApply: true`) — declares the no-Mac dev env |
+| `native-android.mdc` | `android/**`, `*.kt`, `*.kts`, `*.gradle`, `AndroidManifest.xml` |
+| `native-ios.mdc` | `ios/**`, `*.swift`, `*.m`, `*.mm`, `*.h`, `Podfile`, `Info.plist` |
+| `react-native-js.mdc` | `src/**/*.{ts,tsx}`, `App.tsx`, `index.{js,ts}`, Metro/Babel configs |
+| `web.mdc` | `web/**`, `packages/web/**` |
+
+## Install into a project
+
+```bash
+mkdir -p <project>/.cursor/rules
+cp ~/skills/rules/native-rn-monorepo/*.mdc <project>/.cursor/rules/
+```
+
+Rename the files to match the project's existing naming if needed
+(e.g. prefix `rn-monorepo-` to avoid collisions).
+Claude Code reads `.claude/rules/*.md` instead of `.cursor/rules/`.
+Copy the same files there with a `.md` extension; leave `_project`
+without frontmatter so it loads at session start, and translate each
+`globs:` line into `paths:` frontmatter so the target-specific rules
+load only when a matching file is read.
+
+## Customisation required after install
+
+Open each rule and:
+
+1. Replace path globs to match the actual repo layout (e.g.
+   `apps/mobile/android/` instead of `android/` if you use a
+   nested-package monorepo).
+2. Fill in `<FILL IN>` placeholders in `react-native-js.mdc` (state
+   library, networking client, styling approach) and `web.mdc`
+   (framework, styling, state).
+3. Adjust the iOS workflow filename references in any companion
+   commands you also install.
+
+## Why these rules?
+
+Most RN agent guidance assumes the developer can build iOS locally.
+This bundle inverts that assumption:
+
+- iOS edits route through CI (`gh workflow run …`) instead of
+  Xcode.
+- Verification happens via `/rn-verify` (TS + lint + Android Kotlin
+  compile) before triggering the expensive macOS runner.
+- TestFlight is the install target for iOS — there's no simulator
+  in the dev loop.
+
+This is the cheapest, fastest path for a solo / small-team RN
+project that doesn't justify dedicated Mac hardware.
+
+## Companion commands
+
+The matching slash-command bundle lives at
+`~/skills/commands/native-rn-monorepo/`. Install both
+together for the full workflow.

package/rules/native-rn-monorepo/_project.mdc

@@ -0,0 +1,69 @@
+---
+description: Project-wide conventions and developer environment context (RN monorepo, no-Mac dev)
+alwaysApply: true
+---
+
+# Project conventions
+
+## Targets
+
+- `android/` — native Android (Kotlin/Java/Gradle)
+- `ios/` — native iOS (Swift/Obj-C/Xcode)
+- `src/` — shared React Native JS/TS
+- `web/` — web build (separate target)
+
+> Adjust these paths if your monorepo uses a different layout
+> (e.g. `apps/mobile/{android,ios,src}/` or `packages/web/`).
+
+## Developer environment (no Mac)
+
+The developer works on Linux/Windows; there is no Mac. This means:
+
+- iOS cannot be built or tested locally, so `xcodebuild`, `pod install`,
+  `xcrun simctl`, and Xcode are not options to hand the developer;
+  iOS work routes through CI.
+- iOS verification happens entirely on **GitHub Actions CI** with
+  macOS runners.
+- iOS distribution happens via **TestFlight** — the developer
+  installs builds on a real iPhone from TestFlight after CI uploads
+  them.
+- Android local dev uses ADB + Android emulator + Metro for hot
+  reload.
+- For iOS-affecting changes, the loop is: edit → verify TS / lint /
+  Android compile locally → push → CI builds iOS → TestFlight →
+  install on device.
+
+When the developer reports an iOS issue, look in shared JS first —
+most "iOS bugs" also reproduce on Android, the only place they can be
+verified locally. If it is genuinely iOS-specific (native bridge,
+`Podfile`, iOS-only code), edit the file and trigger CI instead of
+asking the developer to run `pod install` or open Xcode;
+`/ios-ci-logs` reads the failure.
+
+## Hard rules
+
+- Identify the target before editing. The path tells you which.
+- Each target's patterns stay in its own tree:
+  - No JSX/React in `android/` or `ios/`
+  - No native bridge code in `src/`
+  - No `react-native` imports in `web/` (unless `react-native-web`
+    is configured)
+  - No browser APIs (`window`, `document`, `localStorage`) in `src/`
+- Never declare a task complete without running the verification
+  command for the affected target.
+- For iOS-affecting changes: declare "ready to ship to CI" — never
+  claim "iOS verified" since you cannot.
+- TypeScript strict; do not introduce `any` without an inline
+  justification comment.
+- Never disable a lint rule inline without an explanatory comment.
+- Never commit secrets, signing keys, `local.properties`, `.env`,
+  or `*.keystore`.
+
+## When unsure
+
+If the request is ambiguous about which target it touches, read the
+relevant trees first; ask before editing only if the paths still
+don't settle it. A single feature may need parallel changes in
+`src/` (JS) and `android/` + `ios/` (native bridge) — call this out
+explicitly. For iOS native changes, also note that verification
+will require a CI run and explain the wait time.

package/rules/native-rn-monorepo/native-android.mdc

@@ -0,0 +1,72 @@
+---
+description: Native Android (Kotlin/Java/Gradle) conventions
+globs: android/**, **/*.kt, **/*.kts, **/*.gradle, **/AndroidManifest.xml
+alwaysApply: false
+---
+
+# Native Android
+
+Stack: Kotlin first, Java only when required by RN bridge or
+legacy code.
+Build: Gradle (Kotlin DSL where present).
+Min SDK / target SDK / compile SDK: read `android/build.gradle`;
+change them only on explicit instruction — they cascade through AGP,
+Gradle, and every native dependency.
+
+> Adjust `android/` to your repo's actual path (e.g.
+> `apps/mobile/android/`).
+
+## Conventions
+
+- Package matches what's already declared in `AndroidManifest.xml`
+  and `build.gradle` `namespace`.
+- Native modules for RN go under
+  `android/app/src/main/java/<package>/modules/`.
+- Each native module = one `*Module.kt` (extends
+  `ReactContextBaseJavaModule`) + one `*Package.kt`.
+- Register packages in `MainApplication.kt` unless RN autolinking
+  already picks them up.
+- Async: Coroutines + Flow (`AsyncTask` is deprecated since API 30;
+  a raw `Thread` has no lifecycle scope). RxJava only if the project
+  already uses it.
+- Logging: `android.util.Log` with tag = class name. Wrap verbose
+  logs in `BuildConfig.DEBUG` checks.
+- Strings: `android/app/src/main/res/values/strings.xml`. No
+  hardcoded user-facing text.
+- Permissions: declare in `AndroidManifest.xml` AND request at
+  runtime for dangerous permissions (camera, mic, location, storage
+  on older API levels, notifications on API 33+).
+- Compose (if used): follow `MaterialTheme` tokens, no raw
+  `Color()` literals in screen code.
+
+## Build verification (after any change)
+
+Run `/android-build` or directly:
+
+```
+cd android && ./gradlew :app:assembleDebug --console=plain
+```
+
+The change is verified only on `BUILD SUCCESSFUL`; on `BUILD FAILED`
+the first error is usually the root cause and later ones cascade.
+
+If you hit `OutOfMemoryError` or metaspace errors, add to
+`android/gradle.properties`:
+
+```
+org.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=512m
+org.gradle.daemon=true
+org.gradle.parallel=true
+org.gradle.caching=true
+```
+
+## Boundaries
+
+- Do not add a new native module if the JS-side library can do it.
+- Do not edit `MainActivity.kt` ReactRootView wiring without
+  explicit instruction.
+- Do not bump `compileSdk`, `targetSdk`, AGP, or Gradle wrapper
+  versions casually — these cascade.
+- Do not commit `local.properties`, `*.keystore`, or
+  `google-services.json` if it's gitignored.
+- Do not edit auto-generated files under `android/app/build/`.

package/rules/native-rn-monorepo/native-ios.mdc

@@ -0,0 +1,61 @@
+---
+description: Native iOS conventions — verification is CI-only (no Mac locally)
+globs: ios/**, **/*.swift, **/*.m, **/*.mm, **/*.h, **/Podfile, **/Podfile.lock, **/Info.plist
+alwaysApply: false
+---
+
+# Native iOS
+
+The developer has no Mac: iOS code is written here and verified on CI,
+so local Xcode, `pod install`, and `xcodebuild` are not options to
+suggest.
+
+> Adjust `ios/` to your repo's actual path (e.g.
+> `apps/mobile/ios/`).
+
+Stack: Swift first, Obj-C only for RN bridge boilerplate.
+Build: Xcode + CocoaPods on the CI runner.
+Deployment target: read `ios/Podfile` `platform :ios, 'X.Y'`; raise it
+only after checking which RN libraries it breaks.
+
+## Conventions
+
+- Native modules for RN: `*.swift` for logic + `*.m` bridge with
+  `RCT_EXTERN_METHOD` declarations.
+- Async: Swift Concurrency (`async`/`await`, `Task`). Combine only
+  where the API requires it.
+- No callback pyramids. No `DispatchQueue.main.async` wrapping
+  unless updating UIKit on a background queue.
+- Logging: `os_log` or `Logger` with subsystem matching the bundle
+  ID.
+- UI: SwiftUI for new screens; programmatic UIKit if existing
+  patterns require it.
+- Strings: `Localizable.strings`. No hardcoded user-facing text.
+- Permissions: usage descriptions in `Info.plist`
+  (NSCameraUsageDescription, NSMicrophoneUsageDescription, etc.)
+  AND runtime requests.
+
+## Verification (CI only)
+
+After editing iOS files:
+
+1. Make the edit.
+2. Suggest `/rn-verify` to catch JS/Android-side issues.
+3. When ready, suggest `/rn-ship-ios` to push and trigger CI.
+4. If CI fails, use `/ios-ci-logs` to diagnose.
+
+Special case: if the change is purely in `Info.plist` strings
+(e.g., adding a permission description), it's worth flagging that
+the change is low-risk but must still go through CI.
+
+## Boundaries
+
+- Do not edit `*.pbxproj` by hand. The developer can't open Xcode
+  to fix a corrupted project file.
+- Do not bump `Podfile.lock` unless that's the explicit task —
+  `pod install` runs on CI.
+- Do not change `IPHONEOS_DEPLOYMENT_TARGET` without checking
+  which RN libs it breaks.
+- Do not commit `.xcuserstate`, `xcuserdata/`, or `ios/build/`.
+- Do not claim iOS changes are verified just because TS passed —
+  the developer must trigger CI.

package/rules/native-rn-monorepo/react-native-js.mdc

@@ -0,0 +1,78 @@
+---
+description: React Native JS/TS shared layer conventions
+globs: src/**/*.{ts,tsx}, App.tsx, App.ts, index.js, index.ts, metro.config.js, babel.config.js
+alwaysApply: false
+---
+
+# React Native (JS/TS layer)
+
+Shared code that runs on both Android and iOS. Does NOT include
+native module code (that lives in `android/` or `ios/`).
+
+> Adjust `src/` to your repo's actual path (e.g.
+> `apps/mobile/src/`).
+
+## Stack assumptions (verify against `package.json` before assuming)
+
+- React Native — version per `package.json`
+- TypeScript strict
+- Navigation: React Navigation
+- State: <FILL IN — Zustand / Redux Toolkit / Jotai / React Query /
+  Context>
+- Networking: <FILL IN — fetch / axios / ky>
+- Styling: <FILL IN — StyleSheet.create / styled-components /
+  NativeWind>
+
+If unsure, grep the codebase before introducing a new pattern.
+
+## Conventions
+
+- Components in `src/components/`, screens in `src/screens/`,
+  hooks in `src/hooks/`, utils in `src/utils/`.
+- One component per file. Named export. File name matches the
+  component name (PascalCase.tsx).
+- Hooks prefix `use`; custom hook files start with lowercase `use`.
+- Platform-specific code:
+  - Small divergence: `Platform.OS === 'ios'` / `'android'` checks
+    at the top of a function
+  - Large divergence: `*.ios.tsx` / `*.android.tsx` files with
+    shared interface
+- Persistence: `@react-native-async-storage/async-storage`. Never
+  `localStorage`.
+- Environment vars: via `react-native-config` or `react-native-dotenv`
+  (whichever the repo uses). Never hardcoded.
+- Imports: absolute imports if `tsconfig.json` paths is set up;
+  otherwise relative within a feature module.
+
+## Hard exclusions
+
+- Never import from `react-native-web` in this layer.
+- Never use browser globals (`window`, `document`,
+  `navigator.geolocation` directly — use the RN APIs).
+- Never bypass the bridge with raw native calls; if you need native
+  behavior, add a typed native module under `android/` and `ios/`.
+
+## Verification
+
+```
+npx tsc --noEmit
+npm run lint  # if a lint script exists
+```
+
+For runtime sanity:
+
+```
+npx react-native start --reset-cache
+```
+
+## Boundaries
+
+- Do not commit `.env*` files unless they are the example/template
+  (`.env.example`).
+- Do not pin RN to a non-stable version (`0.x.0-rc.x`) without
+  explicit instruction.
+- Do not add new dependencies without checking they support both
+  iOS and Android and the current RN version.
+- Do not run codegen scripts (`pod install`, `gradle sync`)
+  silently — flag them as side effects. Note: `pod install` is
+  CI-only here.

package/rules/native-rn-monorepo/web.mdc

@@ -0,0 +1,60 @@
+---
+description: Web build conventions (separate from native and RN JS)
+globs: web/**, packages/web/**
+alwaysApply: false
+---
+
+# Web build
+
+Web-only target; it shares no patterns with the RN/native side.
+Shared logic comes in through an explicit shared package
+(`packages/shared/`), not from the RN `src/` tree.
+
+> Adjust the globs to your repo's actual web path (e.g. `app/**`,
+> `components/**` for a Next.js root layout).
+
+## Stack assumptions (verify before assuming)
+
+- Framework: <FILL IN — Next.js / Vite + React / RN Web>
+- Routing: per the framework's convention
+- Styling: <FILL IN — Tailwind / CSS Modules / styled-components>
+- State: <FILL IN — React Query / Zustand / Redux Toolkit>
+
+## Conventions
+
+- React + hooks, TypeScript strict.
+- Web-only APIs are fine here: `window`, `document`, `localStorage`,
+  `IntersectionObserver`, etc.
+- Server components / SSR (if Next.js): be deliberate about
+  `'use client'` boundaries.
+- Images: optimized via the framework's image component, not raw
+  `<img>` for above-the-fold content.
+- No `react-native` imports unless `react-native-web` is explicitly
+  configured.
+
+## Hard exclusions
+
+- Never import from the RN `src/` tree unless there's an explicit
+  shared package (e.g., `packages/shared/`).
+- Never assume mobile code runs here. RN-only libraries will break
+  the web build.
+- Never use native bridge code or `Platform.OS` checks here.
+
+## Verification
+
+```
+cd web && npm run build
+```
+
+Or for a quick check without building:
+
+```
+cd web && npm run typecheck
+```
+
+## Boundaries
+
+- Do not duplicate logic that already exists in a shared package —
+  import it.
+- Do not introduce a new state library if one is already in use.
+- Do not commit `.next/`, `dist/`, or `build/` output.

package/rules/project-starter/components.mdc

@@ -0,0 +1,54 @@
+---
+description: Component patterns and UI conventions
+globs: "**/*.tsx"
+alwaysApply: false
+---
+
+# Component Conventions
+
+Performance (LCP images, INP, bfcache) → `web-performance.mdc`.
+
+## Reuse First
+- Check `@/components/ui/` before creating any UI element; a second Button or Dialog forks the design system
+- Import existing primitives: Button, Card, Input, Dialog, etc.
+- Use `cn()` from `@/lib/utils` for className composition
+- Use CVA (class-variance-authority) for component variants
+
+## Component Structure
+```tsx
+// 1. Imports
+import { cn } from '@/lib/utils'
+
+// 2. Types (or import from types.ts if >5 lines)
+interface Props { ... }
+
+// 3. Component (named export, not default)
+export function ComponentName({ prop1, prop2, className }: Props) {
+  // hooks first
+  // derived state
+  // handlers
+  // render
+}
+```
+
+## Rules
+- Server Components by default — only add `'use client'` at leaf components
+- Max 300 lines per component — extract sub-components if larger
+- Props destructured in function signature
+- No inline styles — use Tailwind classes
+- No business logic in components — extract to hooks or utils
+- All interactive elements need hover, focus, active, and disabled states
+- All async UI needs loading, error, and empty states
+
+## Naming
+- Components: `PascalCase.tsx`
+- Hooks: `useCamelCase.ts`
+- Utils: `camelCase.ts`
+- Types: `types.ts` or `camelCase.types.ts`
+
+## Accessibility
+- Semantic HTML elements (`<button>`, `<nav>`, `<main>`)
+- All inputs have associated `<label>` or `aria-label`
+- All images have descriptive `alt` text
+- Focus indicators visible on keyboard navigation
+- `aria-live` for dynamic content updates

package/rules/project-starter/data-fetching.mdc

@@ -0,0 +1,77 @@
+---
+description: Data fetching patterns with TanStack Query, Server Components, and Supabase
+globs: "**/*.ts,**/*.tsx"
+alwaysApply: false
+---
+
+# Data Fetching Conventions
+
+## Decision Matrix
+
+| Context | Pattern |
+|---------|---------|
+| Server Component (initial load) | Direct Supabase/Prisma query |
+| Client Component (read) | TanStack Query `useQuery` |
+| Client Component (mutation) | TanStack Query `useMutation` or Server Action |
+| Form submission | Server Action with `useActionState` |
+| Real-time updates | Supabase Realtime subscription |
+| URL-driven state | nuqs `useQueryStates` |
+
+## TanStack Query Patterns
+
+```tsx
+// Query with proper key factory
+const queryKeys = {
+  all: ['features'] as const,
+  lists: () => [...queryKeys.all, 'list'] as const,
+  list: (filters: Filters) => [...queryKeys.lists(), filters] as const,
+  details: () => [...queryKeys.all, 'detail'] as const,
+  detail: (id: string) => [...queryKeys.details(), id] as const,
+}
+
+// Hook
+export function useFeatures(filters: Filters) {
+  return useQuery({
+    queryKey: queryKeys.list(filters),
+    queryFn: () => fetchFeatures(filters),
+    staleTime: 5 * 60 * 1000, // 5 minutes
+  })
+}
+```
+
+## Next.js 16 caching
+
+Caching is explicit: `'use cache'` + `cacheComponents` (static shell / dynamic
+holes). Do not assume implicit `fetch` caching. Turbopack is default for
+dev and build. React Compiler: `reactCompiler: true`.
+
+## Server Component Prefetching
+
+```tsx
+// Prefetch in Server Component, hydrate in Client
+import { HydrationBoundary, dehydrate } from '@tanstack/react-query'
+
+export default async function Page() {
+  const queryClient = new QueryClient()
+  await queryClient.prefetchQuery({
+    queryKey: ['features'],
+    queryFn: fetchFeatures,
+  })
+
+  return (
+    <HydrationBoundary state={dehydrate(queryClient)}>
+      <FeatureList />
+    </HydrationBoundary>
+  )
+}
+```
+
+## Error Handling
+- Always handle `error` state from `useQuery`
+- Show `<ErrorState>` component with retry button
+- Mutations: use `onSuccess` for cache invalidation, `onError` for toast
+
+## Caching
+- Set `staleTime` based on data freshness needs
+- Use `queryClient.invalidateQueries` after mutations
+- Use `revalidatePath` / `revalidateTag` in Server Actions

package/rules/project-starter/git.mdc

@@ -0,0 +1,41 @@
+---
+description: Git workflow and commit conventions
+globs:
+alwaysApply: false
+---
+
+# Git Conventions
+
+## Branch Naming
+```
+feature/description    — New functionality
+fix/description        — Bug fixes
+chore/description      — Maintenance, deps, config
+refactor/description   — Code restructuring
+docs/description       — Documentation only
+```
+
+## Commit Messages
+Conventional commit format:
+```
+<type>(<scope>): <description>
+
+[optional body with details]
+```
+
+Types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`, `ci`
+
+Examples:
+- `feat(auth): add Google OAuth login`
+- `fix(cart): prevent duplicate items on rapid clicks`
+- `refactor(hooks): extract useDebounce from search component`
+
+## Rules
+
+- Commit only what the task touched; scratch scripts, ad-hoc test files, and unrelated cleanup stay out (note pre-existing bugs as follow-ups instead)
+- Atomic commits — one logical change per commit
+- Never commit secrets, `.env` files, or API keys
+- Never commit `node_modules/`, `.next/`, build artifacts
+- Run `npm run build` before pushing to main
+- Squash fixup commits before merging PRs
+- Delete feature branches after merge

package/rules/project-starter/supabase.mdc

@@ -0,0 +1,37 @@
+---
+description: Supabase patterns and conventions for this project
+globs: "**/*.ts,**/*.tsx"
+alwaysApply: false
+---
+
+# Supabase Conventions
+
+## Client Usage
+- Use typed Supabase client from `@/lib/supabase`
+- Always use `.select()` with specific columns (never `SELECT *`)
+- Use `.single()` when expecting one row
+- Handle errors: `const { data, error } = await supabase.from(...)`
+
+## RLS
+- Enable RLS on every table; without it the publishable/anon key reads and writes every row
+- Test policies after creation with Supabase MCP
+- Use `auth.uid()` for user-scoped access
+- Role-based access: `EXISTS` / `IN (select …)` subqueries against the membership table, or a `security definer` helper when the policy would otherwise recurse; wrap `auth.uid()` and helper functions as `(select auth.uid())` so Postgres evaluates them once per query, not per row
+
+## Migrations
+- File naming: `YYYYMMDD_description.sql`
+- Always include `created_at TIMESTAMPTZ DEFAULT now()`
+- Always include `updated_at` with moddatetime trigger
+- Always add indexes on foreign keys
+- After migration: regenerate types with `supabase gen types typescript`
+
+## Edge Functions
+- Verify JWT or API key in every function
+- Handle CORS preflight OPTIONS requests
+- Return proper status codes (401, 403, 400, 500)
+- Use `Deno.env.get()` for secrets
+
+## Data Fetching
+- Server Components: use Supabase server client directly
+- Client Components: use TanStack Query with Supabase client
+- Real-time: subscribe at component level, cleanup on unmount