---
paths:
  - "app/api/**/*.ts"
---

# API Route Rules

Every API route in this project must follow these conventions:

## Required exports
```typescript
export const runtime = 'nodejs'
export const dynamic = 'force-dynamic'
```

## Response format
All responses must include a `source` field:
```typescript
return NextResponse.json({ data: ..., source: 'directus' | 'fallback' | 'error' })
```

## Error handling
- Wrap all external calls (Directus, n8n, Redis, PostgreSQL) in try/catch
- Return graceful fallback data on failure — never let an external service crash the page
- Error logging: `if (process.env.NODE_ENV === "development") console.error(...)`

## n8n proxies (app/api/n8n/)
- Rate limiting required on all public endpoints (use `lib/auth.ts`)
- 10 second timeout on upstream n8n calls
- Auth via `N8N_SECRET_TOKEN` and/or `N8N_API_KEY` headers

## Directus queries
- Use `directusRequest()` from `lib/directus.ts`
- 2 second timeout is already set in `directusRequest()`
- Always have a hardcoded fallback when Directus returns null