# CLAUDE.md — Clinic booking app

## Stack
- Next.js (App Router, TypeScript) from the official `with-supabase` starter
- Supabase: Postgres, Auth, Row Level Security
- Tailwind CSS + shadcn/ui (already in the starter)

## Rules
- Read `supabase/schema.sql` before touching data. Never change the schema without asking.
- All data access goes through the Supabase client from `lib/supabase` (server client in Server Components, Route Handlers and Server Actions).
- Security lives in RLS. Never use the service role key in the browser or in this app.
- Patients see free times through the `busy_slots` RPC, never through other patients' appointments.
- Times: store `timestamptz`. Convert weekly hours to real times in the clinic's time zone `CLINIC_TIMEZONE` (e.g. `Asia/Kolkata`).
- Double booking is blocked by a unique index. Catch error code `23505` and show "That time was just taken, pick another".
- Keep components small. Server Actions for writes. Show loading and error states.
- After each step: run `npm run build` and fix every error before continuing.

## Done means
- Patient: sign up → pick doctor → pick a free time → see it under "My appointments" → cancel.
- Staff: manage doctors and weekly hours, see today's schedule per doctor.