# P2HS Nuxt App — Cursor Rules

## Platform-First Development
- Use P2HS platform services for database, auth, storage, functions, and AI — never build replacements
- All backend data lives in PC Gateway; this app is a frontend + SSR consumer only
- Read .cursor/instructions.md for the complete platform API reference

## Security — Non-Negotiable
- NEVER expose CLOUD_SERVICE_TOKEN or CLOUD_GATEWAY_URL in browser-accessible code
- Server-side runtimeConfig (cloudGatewayUrl, cloudServiceToken, projectId) is only for server/ files
- runtimeConfig.public values are exposed to the browser — only put non-secrets there (projectId, appName, gatewayPublicUrl)
- Generated apps have no direct relationship with P2HS Core — never call Core API endpoints

## BFF Pattern (Always)
- Data operations (DB, storage, functions, AI) → client calls /api/cloud/{path} → server/api/cloud/[...path].ts → PC Gateway
- App-user auth only (signup/signin/signout/me) → client may call PC Gateway directly using user JWT
- Add new server logic in server/api/ as separate named routes; do not modify the cloud catch-all

## Environment Variables
- Client-safe (runtimeConfig.public): projectId, appName, gatewayPublicUrl
- Server-only (runtimeConfig): cloudGatewayUrl, cloudServiceToken, projectId
- CF Pages env var names: CLOUD_GATEWAY_URL, CLOUD_SERVICE_TOKEN, PROJECT_ID, NITRO_PRESET
- Dev proxy target: NUXT_P2HS_GATEWAY_PROXY_TARGET (defaults to http://127.0.0.1:8787)
- Public Gateway URL: NUXT_PUBLIC_P2HS_GATEWAY_URL (used for auth and realtime SSE)

## File Conventions
- Pages: pages/{name}.vue (file-based routing, kebab-case)
- Components: components/Feature/ComponentName.vue
- Composables: composables/useName.ts
- Stores: stores/name.ts
- Server routes: server/api/{feature}/{action}.{method}.ts
- Types: types/domain.ts
- DO NOT MODIFY composables/useP2hsApi.ts — use gatewayFetch for direct Gateway calls (auth/realtime)

## Code Rules
- Vue 3 Composition API with <script setup lang="ts"> always
- Auto-imports active — do not import Vue, Nuxt, or composable functions manually
- useFetch for SSR-compatible data fetching; $fetch for imperative/mutation calls
- Pinia for shared/cross-component state; composables for reusable logic
- TypeScript throughout; no implicit any
- Tailwind CSS for styling
- definePageMeta({ middleware: 'auth' }) on protected pages
