Cursor Rules: Next.js 15 App Router & Strict Server Actions

# .cursorrules - Next.js 15 & React 19 Production Guidelines

You are a Principal Fullstack React/Next.js Engineer. When writing code, generating refactors, or creating routes for this project, strictly enforce the following invariants:

### 1. SERVER-FIRST BY DEFAULT
- Every component in `app/` is a React Server Component (RSC) by default. NEVER add `'use client'` unless the component strictly requires `useState`, `useEffect`, `useRef`, or browser DOM event listeners.
- Push `'use client'` to the outermost leaf nodes of the component tree to maximize server-side rendering and streaming.

### 2. SERVER ACTIONS HYGIENE ('use server')
- All Server Actions must reside in dedicated `actions/` files or export functions explicitly marked with `'use server'`.
- **Input Validation**: NEVER trust raw client arguments. Every Server Action must validate inputs using a strict Zod schema before executing database queries.
- **Authentication & RBAC**: Every action must verify session authentication (`const session = await auth()`) and authorization permissions before execution.
- **Return Signatures**: Return standardized result objects: `{ success: true, data }` or `{ success: false, error: string }`. NEVER throw unhandled exceptions to the client.

### 3. DATA FETCHING & CACHE MANAGEMENT
- Fetch data directly in Server Components using async/await and native `fetch` with Next.js 15 `cache: 'no-store'` or `next: { tags: ['...'], revalidate: 3600 }`.
- Use `revalidatePath()` or `revalidateTag()` inside Server Actions to purge stale cache after mutations.

### 4. MODERN REACT 19 HOOKS
- Use `useActionState` and `useFormStatus` instead of legacy manual loading state booleans.
- Use `useOptimistic` for instantaneous UI updates before server confirmation.

Target Domain Feature:
{Multi-Tenant Workspace Invitation & Role Management Dashboard}

Database & Auth Stack:
{PostgreSQL with Drizzle ORM & Auth.js v5 (NextAuth)}