- Use
pnpmfor all Node.js commands. - Keep migration and implementation notes in Markdown under
docs/, especiallydocs/migration/for shadcn migration work. - Prefer sustainable component structure over one-off compatibility fallbacks. If a fallback seems necessary, document the tradeoff before implementing it.
- For shadcn work, use the project components under
components/ui/and keep feature-level composition near the route or tab that owns it. - Run
pnpm lint,pnpm exec tsc --noEmit, andpnpm buildbefore handing off UI migration steps. - Do not commit
.env.localor other local secret files. - For local performance profiling, use the server-only
DEV_AUTH_BYPASS=truewithDEV_AUTH_BYPASS_MEMBER_ID=<members_main.id>. It is guarded to localhost/127.0.0.1. - Use
NEXT_PUBLIC_LOG_WEB_VITALS=true,NEXT_PUBLIC_MEMBERS_PERF_PROBE=true, andPERF_LOG_SERVER=truefor local/membersprofiling. UseNEXT_PUBLIC_DASHBOARD_BACKGROUND_ANIMATION=falsewhen isolating idle CPU/paint cost from dashboard background animations. - Keep
NEXT_PUBLIC_MEMBERS_OVERSCANmodest; high values can negate virtualization and broad manual image preloading can flood the browser with avatar requests. - Do not reintroduce route-wide member avatar preloading on
/members; the fixed CPU regression came from loading far more avatar resources than mounted virtualized cards. - Events are split into
internalandexternalrows viaevents.event_kind. Applysupabase/events_external_metadata.sqlbefore deploying event UI changes that select external-event metadata columns. - Link redirect analytics are sourced from
link_redirect_definitionsandlink_redirect_clicks. Keep the/link-analyticspage board-only server-side and do not send raw click rows to the client. Applysupabase/link_redirect_assets.sqlbefore deploying changes that select link display labels, hardcoded/soft status fields, or uploaded link images. Link images live in the privatelink-redirect-imagesbucket and should be served through the guarded app API, not as public storage URLs. - Newsletter campaigns use GrapesJS in the guarded
/newsletterdashboard tab, Mailgun server-side API routes,newsletter_projects,newsletter_deliveries,newsletter_delivery_events, and the publicnewsletter-assetsSupabase Storage bucket. Applysupabase/newsletter_projects.sqlbefore deploying newsletter UI/API changes. The active Mailgun domain ismg.tum-blockchain.comwithMAILGUN_REGION=eu; do not usenewsletter.tum-blockchain.comas the Mailgun API domain. docs/database/schema.mdis the canonical database schema overview. Update it when changing Supabase tables, columns, policies, functions, storage buckets, or import workflows.