# P2HS HTML App — Cursor Rules

## Platform-First Development
- Use P2HS platform services for database, auth, storage, functions, and AI — never build replacements
- All backend data lives in the Cloud Gateway; this app calls it directly from the browser
- Read .cursor/instructions.md for the complete platform API reference

## Security
- This boilerplate has no server-side BFF — do NOT add CLOUD_SERVICE_TOKEN anywhere in this project
- Auth tokens (user JWT from signin) go in localStorage — never expose service tokens
- For privileged server-side operations, deploy a separate Cloudflare Worker

## API Calls
- Always use the base URL from meta tags: document.querySelector('meta[name="p2hs-cloud-public-url"]').content
- Always use the project ID from meta tags: document.querySelector('meta[name="p2hs-project-id"]').content
- Always check res.ok before calling .json()
- Always handle 401 by redirecting to login

## File Conventions
- Pages: {name}.html in root (e.g. products.html, dashboard.html)
- Scripts: js/{name}.js (ES modules)
- Auth helper: js/auth.js (create this if it doesn't exist)
- DO NOT MODIFY js/p2hs-api.js

## Code Rules
- Vanilla ES modules (type="module" on script tags)
- async/await for all fetch calls — no .then() chains
- Tailwind CSS via CDN for styling — no separate build step
- Always handle loading states (disable buttons, show spinners)
- Always handle error states (show user-friendly messages, not raw error strings)
- No external JS frameworks — keep it vanilla
