app/: Next.js app-router pages, layouts, and API routes (auth, dashboard, login, register).app/globals.csssets global Tailwind layers.components/: Reusable UI blocks (Radix/Tailwind driven). Prefer new shared UI here instead of duplicating inside routes.hooks/andlib/: Client utilities (React hooks, data helpers, Supabase/TOTP helpers).styles/: Tailwind config helpers;public/holds static assets (e.g.,preview.png, favicons).- Config roots:
next.config.mjs,tailwind.config.ts,tsconfig.json,postcss.config.mjs,components.json.
pnpm installto sync dependencies (pnpm is preferred; lockfile is present).pnpm devstarts the Next.js dev server with hot reload.pnpm buildproduces the production bundle; use before release to catch type/route issues.pnpm startruns the built app.pnpm lintruns Next.js/ESLint/Tailwind rules; fix warnings before opening a PR.
- TypeScript-first; keep strict types and narrow
anyusage. Use 2-space indentation and consistent single quotes where applicable. - Components: PascalCase files/exports in
components/; hooks:useXinhooks/; route segments follow Next.js folder casing. - Favor server components unless client interactivity is required; add
"use client"sparingly. - Tailwind for styling; prefer utility classes over custom CSS unless shared styles belong in
globals.css. - Run
pnpm lintafter changes; rely on built-in Next.js ESLint config and Tailwind plugin.
- No automated tests currently; at minimum run
pnpm lintand exercise critical flows (login/register/dashboard) locally. - When adding tests, prefer
*.test.ts(x)colocated with the subject or under__tests__/, and aim to cover auth flows and OTP handling edge cases.
- Follow conventional commit prefixes seen in history (
init:,chore:,fix:). Keep scopes concise (e.g.,fix(auth): handle otp refresh). - PRs should include: clear summary of behavior change, linked issue (if any), screenshots/GIFs for UI changes, and steps to verify (commands run, flows exercised).
- Keep diffs focused; refactors and feature work should be separate PRs when possible.
- Copy
.env.exampleto.envand fillNEXT_PUBLIC_SUPABASE_URLandNEXT_PUBLIC_SUPABASE_ANON_KEY; never commit secrets. - If recording UI media, scrub any real accounts or codes. Rotate keys if they were exposed during debugging.