# P2HS React App — Cursor Rules

## Platform-First Development
- Use P2HS platform services for database, auth, storage, functions, and AI — never build replacements
- All backend data lives in the Cloud Gateway; this app is a frontend consumer
- Read .cursor/instructions.md for the complete platform API reference

## Security — Non-Negotiable
- NEVER put CLOUD_SERVICE_TOKEN, CLOUD_GATEWAY_URL, or PROJECT_ID in client-side code (VITE_ prefix = exposed to browser)
- NEVER call Cloud Gateway with the service token from the browser
- CLOUD_SERVICE_TOKEN is only used inside functions/ (CF Pages Functions / BFF)

## BFF Pattern (Always)
- Data operations (DB, storage, functions, AI) → client calls /api/cloud/{path} → functions/api/cloud/[[path]].ts → Cloud Gateway
- Auth operations only (signup/signin/refresh/me) → client may call Cloud Gateway directly using user JWT
- Do not add new files to functions/api/cloud/ — the catch-all [[path]].ts handles everything
- Add new BFF routes only for non-Cloud operations (e.g. functions/api/webhooks.ts)

## Environment Variables
- Client-safe: VITE_PROJECT_ID, VITE_P2HS_CLOUD_PUBLIC_URL
- Server-only (CF Pages): CLOUD_GATEWAY_URL, CLOUD_SERVICE_TOKEN, PROJECT_ID

## File Conventions
- Pages: src/pages/PageName.tsx
- Components: src/components/Feature/ComponentName.tsx
- Hooks: src/hooks/useName.ts
- Types: src/types/domain.ts
- DO NOT MODIFY src/lib/p2hs/ files

## Code Rules
- TypeScript strict mode; no `any` types
- Functional components only — no class components
- Named exports preferred over default exports
- async/await over .then() chains
- Every data-fetching component must handle loading and error states
- Tailwind CSS for all styling
- TanStack Query for server state (cache, invalidate after mutations)
- React Router v7 for routing and navigation
