# [App Name] · SvelteKit + Lucia

Full-stack SvelteKit app. Server actions for mutations, Lucia for sessions, Drizzle for the DB. No third-party auth providers.

## Source of truth
Vercel auto-deploys from main. Lucia stores sessions in Postgres (column on `sessions` table). Session cookie is httpOnly.

## Tech stack
SvelteKit 2 + Svelte 5 (runes mode) + TypeScript. Drizzle ORM with Postgres. Lucia 4 for session-based auth (no JWTs, sessions live in your DB). Tailwind v4. Resend for transactional email (verification, password reset). Deployed to Vercel via `@sveltejs/adapter-vercel`.

## Deploy
`git push origin main`. Vercel builds with the SvelteKit Vercel adapter. Postgres via Vercel Postgres or Neon.

## File map
- `src/routes/` file-based routing
- `src/routes/(marketing)/` public: `/`, `/pricing`, `/privacy`
- `src/routes/(app)/` authed: `/dashboard`, `/settings`
- `src/routes/api/` route handlers (rare; prefer form actions)
- `src/lib/server/db/schema.ts` Drizzle tables
- `src/lib/server/db/index.ts` DB client
- `src/lib/server/auth.ts` Lucia instance + session helpers
- `src/hooks.server.ts` request hook attaching `locals.user`
- `drizzle.config.ts`

## .env keys
- `DATABASE_URL`
- `RESEND_API_KEY`
- `RESEND_FROM_EMAIL`
- `PUBLIC_SITE_URL`

## Hard rules
- Mutations via form actions (`+page.server.ts` actions), NOT API routes. Progressive enhancement matters.
- All authed pages check `locals.user` in `+page.server.ts` `load`. NEVER trust the client.
- Lucia sessions live in `sessions` table with an FK to `users`. Stale sessions cleaned via a cron.
- Use Svelte 5 runes (`$state`, `$derived`, `$effect`). Don't mix in legacy `$:` reactive statements.
- Form actions return either `{ form }` or `redirect()`. Never return raw data the client can't use.
- Password hashing with Lucia's recommended Argon2id, NOT bcrypt.

## Recent significant changes
- 2026-05-15: Scaffolded. Locked: Lucia over Auth.js (full control of session lifetime), Drizzle over Prisma (smaller, faster), Resend over SendGrid (DX).

## Next session: start here
1. Create Vercel project + Postgres.
2. `npm run db:push` to apply Drizzle schema.
3. Implement signup form action. Test the cookie flow with a real browser.
4. Add a protected `/dashboard` page; confirm unauthed redirects to login.
5. Set up Resend with verified domain for the magic-link / verification emails.