=== foundation rules === # Laravel Boost Guidelines The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications. ## Foundational Context This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions. - php - 8.3 - inertiajs/inertia-laravel (INERTIA_LARAVEL) - v3 - laravel/fortify (FORTIFY) - v1 - laravel/framework (LARAVEL) - v13 - laravel/prompts (PROMPTS) - v0 - laravel/wayfinder (WAYFINDER) - v0 - laravel/boost (BOOST) - v2 - laravel/mcp (MCP) - v0 - laravel/pail (PAIL) - v1 - laravel/pint (PINT) - v1 - laravel/sail (SAIL) - v1 - pestphp/pest (PEST) - v4 - phpunit/phpunit (PHPUNIT) - v12 - @inertiajs/react (INERTIA_REACT) - v3 - react (REACT) - v19 - tailwindcss (TAILWINDCSS) - v4 - @laravel/vite-plugin-wayfinder (WAYFINDER_VITE) - v0 - eslint (ESLINT) - v9 - prettier (PRETTIER) - v3 ## Skills Activation This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck. - `fortify-development` — ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features. - `laravel-best-practices` — Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns. - `wayfinder-development` — Use this skill for Laravel Wayfinder which auto-generates typed functions for Laravel controllers and routes. ALWAYS use this skill when frontend code needs to call backend routes or controller actions. Trigger when: connecting any React/Vue/Svelte/Inertia frontend to Laravel controllers, routes, building end-to-end features with both frontend and backend, wiring up forms or links to backend endpoints, fixing route-related TypeScript errors, importing from @/actions or @/routes, or running wayfinder:generate. Use Wayfinder route functions instead of hardcoded URLs. Covers: wayfinder() vite plugin, .url()/.get()/.post()/.form(), query params, route model binding, tree-shaking. Do not use for backend-only task - `pest-testing` — Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: test()/it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code. - `inertia-react-development` — Develops Inertia.js v3 React client-side applications. Activates when creating React pages, forms, or navigation; using ,

, useForm, useHttp, setLayoutProps, or router; working with deferred props, prefetching, optimistic updates, instant visits, or polling; or when user mentions React with Inertia, React pages, React forms, or React navigation. - `tailwindcss-development` — Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS. - `laravel-backup` — Configure and extend spatie/laravel-backup for database and file backups, cleanup strategies, health monitoring, and notifications. Activates when working with backup configuration, scheduling backups, creating custom cleanup strategies or health checks, customizing notifications, or when the user mentions backups, backup monitoring, backup cleanup, or spatie/laravel-backup. - `laravel-permission-development` — Build and work with Spatie Laravel Permission features, including roles, permissions, middleware, policies, teams, and Blade directives. ## Conventions - You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming. - Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`. - Check for existing components to reuse before writing a new one. ## Verification Scripts - Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important. ## Application Structure & Architecture - Stick to existing directory structure; don't create new base folders without approval. - Do not change the application's dependencies without approval. ## Frontend Bundling - If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them. ## Documentation Files - You must only create documentation files if explicitly requested by the user. ## Replies - Be concise in your explanations - focus on what's important rather than explaining obvious details. === boost rules === # Laravel Boost ## Tools - Laravel Boost is an MCP server with tools designed specifically for this application. Prefer Boost tools over manual alternatives like shell commands or file reads. - Use `database-query` to run read-only queries against the database instead of writing raw SQL in tinker. - Use `database-schema` to inspect table structure before writing migrations or models. - Use `get-absolute-url` to resolve the correct scheme, domain, and port for project URLs. Always use this before sharing a URL with the user. - Use `browser-logs` to read browser logs, errors, and exceptions. Only recent logs are useful, ignore old entries. ## Searching Documentation (IMPORTANT) - Always use `search-docs` before making code changes. Do not skip this step. It returns version-specific docs based on installed packages automatically. - Pass a `packages` array to scope results when you know which packages are relevant. - Use multiple broad, topic-based queries: `['rate limiting', 'routing rate limiting', 'routing']`. Expect the most relevant results first. - Do not add package names to queries because package info is already shared. Use `test resource table`, not `filament 4 test resource table`. ### Search Syntax 1. Use words for auto-stemmed AND logic: `rate limit` matches both "rate" AND "limit". 2. Use `"quoted phrases"` for exact position matching: `"infinite scroll"` requires adjacent words in order. 3. Combine words and phrases for mixed queries: `middleware "rate limit"`. 4. Use multiple queries for OR logic: `queries=["authentication", "middleware"]`. ## Artisan - Run Artisan commands directly via the command line (e.g., `php artisan route:list`). Use `php artisan list` to discover available commands and `php artisan [command] --help` to check parameters. - Inspect routes with `php artisan route:list`. Filter with: `--method=GET`, `--name=users`, `--path=api`, `--except-vendor`, `--only-vendor`. - Read configuration values using dot notation: `php artisan config:show app.name`, `php artisan config:show database.default`. Or read config files directly from the `config/` directory. - To check environment variables, read the `.env` file directly. ## Tinker - Execute PHP in app context for debugging and testing code. Do not create models without user approval, prefer tests with factories instead. Prefer existing Artisan commands over custom tinker code. - Always use single quotes to prevent shell expansion: `php artisan tinker --execute 'Your::code();'` - Double quotes for PHP strings inside: `php artisan tinker --execute 'User::where("active", true)->count();'` === php rules === # PHP - Always use curly braces for control structures, even for single-line bodies. - Use PHP 8 constructor property promotion: `public function __construct(public GitHub $github) { }`. Do not leave empty zero-parameter `__construct()` methods unless the constructor is private. - Use explicit return type declarations and type hints for all method parameters: `function isAccessible(User $user, ?string $path = null): bool` - Use TitleCase for Enum keys: `FavoritePerson`, `BestLake`, `Monthly`. - Prefer PHPDoc blocks over inline comments. Only add inline comments for exceptionally complex logic. - Use array shape type definitions in PHPDoc blocks. === tests rules === # Test Enforcement - Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass. - Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter. === inertia-laravel/core rules === # Inertia - Inertia creates fully client-side rendered SPAs without modern SPA complexity, leveraging existing server-side patterns. - Components live in `resources/js/pages` (unless specified in `vite.config.js`). Use `Inertia::render()` for server-side routing instead of Blade views. - ALWAYS use `search-docs` tool for version-specific Inertia documentation and updated code examples. - IMPORTANT: Activate `inertia-react-development` when working with Inertia client-side patterns. # Inertia v3 - Use all Inertia features from v1, v2, and v3. Check the documentation before making changes to ensure the correct approach. - New v3 features: standalone HTTP requests (`useHttp` hook), optimistic updates with automatic rollback, layout props (`useLayoutProps` hook), instant visits, simplified SSR via `@inertiajs/vite` plugin, custom exception handling for error pages. - Carried over from v2: deferred props, infinite scroll, merging props, polling, prefetching, once props, flash data. - When using deferred props, add an empty state with a pulsing or animated skeleton. - Axios has been removed. Use the built-in XHR client with interceptors, or install Axios separately if needed. - `Inertia::lazy()` / `LazyProp` has been removed. Use `Inertia::optional()` instead. - Prop types (`Inertia::optional()`, `Inertia::defer()`, `Inertia::merge()`) work inside nested arrays with dot-notation paths. - SSR works automatically in Vite dev mode with `@inertiajs/vite` - no separate Node.js server needed during development. - Event renames: `invalid` is now `httpException`, `exception` is now `networkError`. - `router.cancel()` replaced by `router.cancelAll()`. - The `future` configuration namespace has been removed - all v2 future options are now always enabled. === laravel/core rules === # Do Things the Laravel Way - Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using `php artisan list` and check their parameters with `php artisan [command] --help`. - If you're creating a generic PHP class, use `php artisan make:class`. - Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior. ### Model Creation - When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `php artisan make:model --help` to check the available options. ## APIs & Eloquent Resources - For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention. ## URL Generation - When generating links to other pages, prefer named routes and the `route()` function. ## Testing - When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model. - Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`. - When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests. ## Vite Error - If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`. ## Deployment - Laravel can be deployed using [Laravel Cloud](https://cloud.laravel.com/), which is the fastest way to deploy and scale production Laravel applications. === wayfinder/core rules === # Laravel Wayfinder Use Wayfinder to generate TypeScript functions for Laravel routes. Import from `@/actions/` (controllers) or `@/routes/` (named routes). === pint/core rules === # Laravel Pint Code Formatter - If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style. - Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues. === pest/core rules === ## Pest - This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`. - Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`. - Do NOT delete tests without approval. === inertia-react/core rules === # Inertia + React - IMPORTANT: Activate `inertia-react-development` when working with Inertia React client-side patterns. === barryvdh/laravel-debugbar rules === ## Laravel Debugbar Laravel Debugbar stores data from each request (queries, exceptions, views, routes, mail, etc.) for review via Artisan commands. ### Finding Requests # List recent requests (shows summary with status, duration, memory, query count) php artisan debugbar:find # Filter by URI pattern (fnmatch) and/or HTTP method php artisan debugbar:find --uri="/api/*" --method=POST # Only show requests with issues (exceptions, slow queries, duplicates, errors) php artisan debugbar:find --issues --max=50 # Customize issue thresholds (defaults: --min-queries=50, --min-duration=1000, --min-duplicates=2) php artisan debugbar:find --issues --min-queries=10 --min-duration=500 # Threshold options also work standalone, filtering on just that criteria php artisan debugbar:find --min-queries=20 `--issues` flags: exceptions, non-2xx status, high query count, slow queries, duplicate query groups, slow request duration, and failed queries. Issue filtering applies on top of the fetched result set — increase `--max` to scan further back. ### Inspecting a Request # Summary of all collectors (available collectors depend on config) php artisan debugbar:get latest php artisan debugbar:get {id} # Full data for a specific collector php artisan debugbar:get {id} --collector=exceptions Use the collector name from the summary table. Common ones by issue type: - **Error/500** → `exceptions` · **Slow page** → `queries`, `time` · **Auth** → `auth`, `gate` · **Cache** → `cache` ### Analyzing Queries # Overview with duplicate detection and slow query flags php artisan debugbar:queries {id} # Backtrace and params for a specific statement php artisan debugbar:queries {id} --statement=N # EXPLAIN plan or re-execute a SELECT php artisan debugbar:queries {id} --statement=N --explain php artisan debugbar:queries {id} --statement=N --result Duplicate queries are a strong N+1 signal. Use `--statement=N` to get the backtrace and find the origin. ### Other Commands - `debugbar:clear` — Clear all stored debugbar data. === spatie/laravel-activitylog rules === # spatie/laravel-activitylog Activity logging package for Laravel. Logs model events and manual activities to a database table. ## Key Concepts - **Activity**: An Eloquent model (`Spatie\Activitylog\Models\Activity`) storing log entries with subject, causer, event, attribute_changes, and properties. - **Subject**: The model being acted upon (polymorphic `subject_type`/`subject_id`). - **Causer**: The model that caused the action, typically the authenticated user (polymorphic `causer_type`/`causer_id`). - **LogOptions**: Fluent configuration object returned by `getActivitylogOptions()` on models using the `LogsActivity` trait. - **ActivityEvent**: Enum with cases `Created`, `Updated`, `Deleted`, `Restored`. - **`attribute_changes`** column: stores `{"attributes": {...}, "old": {...}}` for tracked model changes. - **`properties`** column: stores custom user data set via `withProperties()`. ## Traits ### `LogsActivity` Add to models to automatically log create/update/delete events. Optionally implement `getActivitylogOptions()` to configure which attributes to track (defaults to logging events without attribute changes). ```php use Spatie\Activitylog\Models\Concerns\LogsActivity; use Spatie\Activitylog\Support\LogOptions; class Article extends Model { use LogsActivity; public function getActivitylogOptions(): LogOptions { return LogOptions::defaults() ->logFillable() ->logOnlyDirty() ->dontLogEmptyChanges(); } } ``` ### `CausesActivity` Add to user/causer models. Provides `activitiesAsCauser()` relationship. ### `HasActivity` Combines `LogsActivity` and `CausesActivity`. Provides `activities()`, `activitiesAsSubject()`, and `activitiesAsCauser()`. ## Manual Logging ```php activity() ->performedOn($article) ->causedBy($user) ->event(ActivityEvent::Updated) ->withProperties(['key' => 'value']) ->log('Article was updated'); ``` ## LogOptions Methods | Method | Description | |--------|-------------| | `logFillable()` | Log all fillable attributes | | `logAll()` | Log all attributes | | `logOnly(array)` | Log specific attributes | | `logExcept(array)` | Exclude attributes | | `logOnlyDirty()` | Only log changed attributes | | `dontLogEmptyChanges()` | Skip logging when no tracked attributes changed | | `dontLogIfAttributesChangedOnly(array)` | Ignore updates that only change these attributes | | `useLogName(string)` | Set custom log name | | `setDescriptionForEvent(Closure)` | Custom description per event | | `useAttributeRawValues(array)` | Store raw (uncast) values | ## Querying Activities ```php use Spatie\Activitylog\Models\Activity; use Spatie\Activitylog\Enums\ActivityEvent; Activity::forEvent(ActivityEvent::Created)->get(); Activity::causedBy($user)->get(); Activity::forSubject($article)->get(); Activity::inLog('orders')->get(); ``` ## Setting the causer Override the causer for a block of code: ```php use Spatie\Activitylog\Facades\Activity; Activity::defaultCauser($admin, function () { // all activities here are caused by $admin }); // or set globally for the rest of the request Activity::defaultCauser($admin); ``` ## Disabling Logging ```php activity()->withoutLogging(function () { // no activities logged here }); ``` ## Accessing Changes and Properties ```php $activity = Activity::latest()->first(); // Tracked model changes (set automatically by LogsActivity) $activity->attribute_changes; // Collection: {"attributes": {...}, "old": {...}} // Custom user data (set via withProperties) $activity->properties; // Collection $activity->getProperty('key'); // single value ``` ## Custom Activity Model Set `activity_model` in `config/activitylog.php` to a class that extends `Model` and implements `Spatie\Activitylog\Contracts\Activity`. Use a custom model for custom table names or database connections. ## Customizing Actions The package uses action classes (`LogActivityAction`, `CleanActivityLogAction`) that can be extended and swapped via config: ```php // config/activitylog.php 'actions' => [ 'log_activity' => \App\Actions\CustomLogActivityAction::class, 'clean_log' => \App\Actions\CustomCleanAction::class, ], ``` Custom action classes must extend the originals. Override protected methods (`save()`, `beforeActivityLogged()`, `resolveDescription()`, etc.) to customize behavior. ## Configuration Key config options in `config/activitylog.php`: - `enabled`: Master on/off switch (env: `ACTIVITYLOG_ENABLED`) - `clean_after_days`: Days to keep records for `activitylog:clean` command - `default_log_name`: Default log name (string) - `default_auth_driver`: Auth driver for causer resolution - `include_soft_deleted_subjects`: Include soft-deleted subjects - `activity_model`: Custom Activity model class - `default_except_attributes`: Globally excluded attributes - `actions.log_activity`: Action class for logging activities - `actions.clean_log`: Action class for cleaning old activities