Production .cursorrules, .windsurfrules & CLAUDE.md Directory

# .cursorrules — 2026 Next.js 15 + Supabase Production Standard
# Curated by Nextora Insights (https://nextorainsight.com)

You are an elite Principal Full-Stack Engineer building production Next.js 15 applications.

## 1. Architecture & Rendering Rules
- Default all routes and components to React Server Components (RSC).
- Add 'use client' ONLY at the leaf node when browser hooks (useState, useEffect) or event listeners are strictly required.
- Never fetch internal API routes from Server Components; call server functions or database repositories directly.

## 2. TypeScript & Validation
- Enforce strict TypeScript: zero 'any' types. Use 'unknown' + Zod schema narrowing.
- Validate all route params, searchParams, and POST bodies using Zod before executing mutations.

## 3. Supabase & PostgreSQL Security
- Always enforce Row-Level Security (RLS) on every public table.
- Use @supabase/ssr for cookie-based authentication; never expose SUPABASE_SERVICE_ROLE_KEY to client bundles.
- Index all foreign keys and frequently filtered columns (user_id, status, created_at).

# .windsurfrules — Windsurf Cascade Autonomous Agent Guardrails
# Curated by Nextora Insights (https://nextorainsight.com)

## Cascade Execution Protocol
1. Before modifying any shared utility or type definition, search all importing files across the repository.
2. Preserve all existing environment variable fallbacks, webhook signatures, and authentication middleware.
3. Make atomic, minimal diffs. Never reformat unrelated lines or strip comments.
4. After completing multi-file edits, run typecheck and build verification to confirm zero regressions.

# CLAUDE.md — Autonomous Repository Context
# Curated by Nextora Insights (https://nextorainsight.com)

## Core Commands
- Install dependencies: `npm ci`
- Typecheck & Build: `npm run build`
- Security & Integrity Check: `node scripts/verify-security-and-data.mjs`

## Engineering Standards
- Keep functions under 60 lines with single responsibility.
- Return structured JSON responses `{ ok: boolean, data?: T, error?: string }` from all API endpoints.
- Never commit secrets, .env files, or hardcoded API tokens.

# .cursorrules — FastAPI + Pydantic v2 + Async SQLAlchemy 2.0
# Curated by Nextora Insights (https://nextorainsight.com)

- Use Python 3.12+ type annotations (list[str], dict[str, Any], str | None).
- Use Pydantic v2 BaseModel with model_config = ConfigDict(extra="forbid", strict=True).
- All I/O routes and database queries must use async def with AsyncSession.
- Never block the event loop with synchronous requests or time.sleep(); use httpx.AsyncClient and asyncio.sleep().

# .cursorrules — TanStack Router & SSR SEO Architecture
# Curated by Nextora Insights (https://nextorainsight.com)

- Use createFileRoute with typed loader and validateSearch functions.
- Always declare canonical links, OpenGraph 1200x630 images, and JSON-LD structured data inside head().
- Prefer Link with typed params={{ slug }} over raw anchor tags for internal navigation.

{
  "mcpServers": {
    "nextora-software-intelligence": {
      "url": "https://nextorainsight.com/api/mcp",
      "description": "Query live SaaS pricing, Cursor vs Windsurf benchmarks, and $500+ verified cloud coupons."
    }
  }
}