# P2HS Nuxt App — Cursor Rules

## Platform-First Development
- Use P2HS platform services for database, auth, storage, functions, and AI — never build replacements
- All backend data lives in the Cloud Gateway; this app is a frontend + SSR consumer
- Read .cursor/instructions.md for the complete platform API reference

## Security — Non-Negotiable
- NEVER expose CLOUD_SERVICE_TOKEN, CLOUD_GATEWAY_URL in browser-accessible code
- Server-side runtimeConfig (cloudGatewayUrl, cloudServiceToken, projectId) is only for server/ files
- runtimeConfig.public values are exposed to the browser — only put non-secrets there

## BFF Pattern (Always)
- Data operations (DB, storage, functions, AI) → client calls /api/cloud/{path} → server/api/cloud/[...path].ts → Cloud Gateway
- Auth operations only (signup/signin/refresh/me) → client may call Cloud Gateway directly using user JWT
- Add new server logic in server/api/ as separate named routes, not by modifying the cloud catch-all

## Environment Variables
- Client-safe (runtimeConfig.public): projectId, appName
- Server-only (runtimeConfig): cloudGatewayUrl, cloudServiceToken, projectId
- CF Pages env var names: CLOUD_GATEWAY_URL, CLOUD_SERVICE_TOKEN, PROJECT_ID, NITRO_PRESET

## File Conventions
- Pages: pages/{name}.vue (file-based routing, kebab-case)
- Components: components/Feature/ComponentName.vue
- Composables: composables/useName.ts
- Stores: stores/name.ts
- Server routes: server/api/{feature}/{action}.{method}.ts
- Types: types/domain.ts
- DO NOT MODIFY composables/useP2hsApi.ts

## Code Rules
- Vue 3 Composition API with <script setup lang="ts"> always
- Auto-imports active — do not import Vue, Nuxt, or composable functions manually
- useFetch for SSR-compatible data fetching; $fetch for imperative/mutation calls
- Pinia for shared/cross-component state; composables for reusable logic
- TypeScript throughout; no implicit any
- Tailwind CSS for styling
- definePageMeta({ middleware: 'auth' }) on protected pages
