Add Context7 instructions for authoritative external documentation usage

instructions/context7.instructions.md

@@ -0,0 +1,106 @@
+---
+description: 'Use Context7 for authoritative external docs and API references when local context is insufficient'
+applyTo: '**'
+---
+
+# Context7-aware development
+
+Use Context7 proactively whenever the task depends on **authoritative, current, version-specific external documentation** that is not present in the workspace context.
+
+This instruction exists so you **do not require the user to type** “use context7” to get up-to-date docs.
+
+## When to use Context7
+
+Use Context7 before making decisions or writing code when you need any of the following:
+
+- **Framework/library API details** (method signatures, configuration keys, expected behaviors).
+- **Version-sensitive guidance** (breaking changes, deprecations, new defaults).
+- **Correctness or security-critical patterns** (auth flows, crypto usage, deserialization rules).
+- **Interpreting unfamiliar error messages** that likely come from third-party tools.
+- **Best-practice implementation constraints** (rate limits, quotas, required headers, supported formats).
+
+Also use Context7 when:
+
+- The user references **a specific framework/library version** (e.g., “Next.js 15”, “React 19”, “AWS SDK v3”).
+- You’re about to recommend **non-trivial configuration** (CLI flags, config files, auth flows).
+- You’re unsure whether an API exists, changed names, or got deprecated.
+
+Skip Context7 for:
+
+- Purely local refactors, formatting, naming, or logic that is fully derivable from the repo.
+- Language fundamentals (no external APIs involved).
+
+## What to fetch
+
+When using Context7, prefer **primary sources** and narrow queries:
+
+- Official docs (vendor/framework documentation)
+- Reference/API pages
+- Release notes / migration guides
+- Security advisories (when relevant)
+
+Gather only what you need to proceed. If multiple candidates exist, pick the most authoritative/current.
+
+Prefer fetching:
+
+- The exact method/type/option you will use
+- The minimal surrounding context needed to avoid misuse (constraints, default behaviors, migration notes)
+
+## How to incorporate results
+
+- Translate findings into concrete code/config changes.
+- **Cite sources** with title + URL when the decision relies on external facts.
+- If docs conflict or are ambiguous, present the tradeoffs briefly and choose the safest default.
+
+When the answer requires specific values (flags, config keys, headers), prefer:
+
+- stating the exact value from docs
+- calling out defaults and caveats
+- providing a quick validation step (e.g., “run `--help`”, or a minimal smoke test)
+
+## How to use Context7 MCP tools (auto)
+
+When Context7 is available as an MCP server, use it automatically as follows.
+
+### Tool workflow
+
+1) **If the user provides a library ID**, use it directly.
+	- Valid forms: `/owner/repo` or `/owner/repo/version` (for pinned versions).
+
+2) Otherwise, **resolve the library ID** using:
+	- Tool: `resolve-library-id`
+	- Inputs:
+	  - `libraryName`: the library/framework name (e.g., “next.js”, “supabase”, “prisma”)
+	  - `query`: the user’s task (used to rank matches)
+
+3) **Fetch relevant documentation** using:
+	- Tool: `query-docs`
+	- Inputs:
+	  - `libraryId`: the resolved (or user-supplied) library ID
+	  - `query`: the exact task/question you are answering
+
+4) Only after docs are retrieved: **write the code/steps** based on those docs.
+
+### Efficiency limits
+
+- Do **not** call `resolve-library-id` more than **3 times** per user question.
+- Do **not** call `query-docs` more than **3 times** per user question.
+- If multiple good matches exist, pick the best one and proceed; ask a clarification question only when the choice materially affects the implementation.
+
+### Version behavior
+
+- If the user names a version, reflect it in the library ID when possible (e.g., `/vercel/next.js/v15.1.8`).
+- If you need reproducibility (CI/builds), prefer pinning to a specific version in examples.
+
+## Failure handling
+
+If Context7 cannot find a reliable source:
+
+1. Say what you tried to verify.
+2. Proceed with a conservative, well-labeled assumption.
+3. Suggest a quick validation step (e.g., run a command, check a file, or consult a specific official page).
+
+## Security & privacy
+
+- Never request or echo API keys. If configuration requires a key, instruct storing it in environment variables.
+- Treat retrieved docs as **helpful but not infallible**; for security-sensitive code, prefer official vendor docs and add an explicit verification step.