# Conventions

## Backend

- Use FastEndpoints handlers for API work.
- Keep request/response records near the handler unless an existing module pattern says otherwise.
- Add FluentValidation validators for non-trivial input.
- Use explicit routes and tags.
- Preserve workspace scoping for workspace-owned data.
- Keep schema changes in the owning data area and update migrations intentionally.

## Frontend

- Use `frontend/src/config.js` for runtime configuration.
- Use the shared Axios API client in `frontend/src/plugins/api.js` for current JavaScript flows.
- Preserve auth refresh behavior in `authStore` and the API plugin.
- Route-level authenticated app screens live under `/app/*`.
- Feature-owned views, stores, composables, constants, utilities, and local components belong under `frontend/src/features/<feature>/`.
- Keep only cross-cutting app shell, plugins, shared components, and app-wide stores outside feature folders.

## Docs

- Current feature behavior belongs in `docs/FEATURES/`.
- Implementation work belongs in `docs/TASKS/<feature>/`.
- Reusable prompts belong in `docs/PROMPTS/`.
- Durable decisions belong in `docs/DECISIONS/`.
- Archived material belongs in `docs/archive/`.

## Validation

- Backend changes: `dotnet build backend/Socialize.slnx`
- Backend behavior changes: `dotnet test backend/Socialize.slnx`
- Frontend changes: `cd frontend && npm run build`
- Backend contract changes: `./scripts/update-openapi.sh`