> [!IMPORTANT] > This project is connected to [Lovable](https://lovable.dev). Avoid rewriting > published git history — force pushing, or rebasing/amending/squashing commits > that are already pushed — as it rewrites history on Lovable's side and the > user will likely lose their project history. > > Commits you push to the connected branch sync back to Lovable and show up in > the editor, so keep the branch in a working state. ## What Lovable manages Rules outside this block are the project's own. Change the pieces below in Lovable, not by hand. With the [Lovable MCP](https://mcp.lovable.dev) connected, `send_message` asks Lovable to do it; otherwise ask the user to use the editor. - **Database.** Do not add or edit `supabase/migrations/` or `drizzle/`. Ask Lovable to change the schema. - **Generated files.** Do not edit a file whose header says it is automatically generated. - **AI gateway.** Keep model calls on Lovable's gateway, and keep `LOVABLE_API_KEY` out of browser code. - **Connectors.** Lovable provides native connectors. `list_connectors` shows which are enabled; `add_connector` only returns the dashboard link. When a connector is enabled, calls go through the connector gateway and need `LOVABLE_API_KEY`. When Lovable does not provide one, users can bring their own key and store it in Secrets. - **Secrets.** Lovable manages them. Do not put secret values in the repo. - Shared site header and page headings use mobile-first sizing; the phone menu scrolls within the viewport so every page remains reachable on short screens. - PageHero enables the shared palm decoration by default; custom interior heading layouts use the same clipped decorative asset behind their content for consistent backgrounds. - Use the shared ParallaxImage for scroll-driven photos; clipped overscan and reduced-motion support keep layouts stable and motion accessible. - Contact forms share a validation schema and submit through a public server function with a database-enforced rate limit; private submissions are accessible only to the service role so visitors cannot read leads. - Careers applications validate shared schemas and PDF signatures server-side, store résumés in private storage with service-role-only access, and remove uploads when saving the application fails to avoid orphan files. - Public sitemap URLs derive from explicit route sitemap decisions and existing public content collections; omit lastmod without authoritative page-specific change dates.