# FamChore v2 — Rules

## Auth
- Every collection query includes `famId = @request.auth.famId` filter
- Super admin bypasses famId filter (access via PB admin API)
- `deviceToken` stored as SHA-256 hash; never log raw tokens

## Config
- Use `.env` at root for runtime config values (ports, secrets). `.env.example` committed as template.
- `config.ts` at root for dev/build-time shared config (e.g. `PROXY_PORT`), reads from env with fallback defaults.
- Never commit `.env` files (already in `.gitignore`).

## Ports
- Frontend: `2080`
- Proxy: `3456`
- Container external: `3001` (port `3000` is reserved)
- Must not use port `3000` for anything.

## Docker
- Prod: `docker/Dockerfile` (multi-stage + nginx)
- Dev: `docker/Dockerfile.dev` (PocketBase)
- Nginx routes: `/api/*` → Hono (`:3456`), `/*` → SvelteKit (`:2080`)

## Monorepo
- SvelteKit in `frontend/`, Hono in `proxy/`
- `pnpm dev` / `pnpm build` at root runs both in parallel
- Decisions tracked in `MEMORY.md`

## Environment Variables
- `FRONTEND_PORT` — frontend server port
- `PROXY_PORT` — Hono proxy port
- `PB_URL`, `PB_ADMIN_EMAIL`, `PB_ADMIN_PASSWORD` — PocketBase admin
- `STRIPE_SECRET_KEY` — Stripe
- `DONATION_MODAL_INTERVAL` — donation modal frequency