Fullstack Conventions

Project Structure

• app/ — Next.js App Router pages and API routes
• components/ — Shared React components (server-first)
• lib/ — Utilities, auth helpers, Supabase clients
• db/ — Database schema, migrations, seed data
• packages/cli/ — The @web42/cli package
• hooks/ — React hooks (client-side only)

API Routes

• File: app/api/{resource}/route.ts
• Always export named functions: GET, POST, PUT, DELETE
• Always call authenticateRequest(request) first for protected routes
• Use createClient() for authenticated queries (respects RLS)
• Use createServiceClient() ONLY in webhooks and system operations
• Return NextResponse.json({ error: "..." }, { status: 4xx }) for errors
• Validate bodies with Zod: const body = schema.parse(await request.json())