# Web and API

ServDiary exposes two client surfaces that share the same Laravel app and domain modules.

## Web (Inertia + Jetstream)

- Session auth via Fortify / Jetstream
- Inertia + Vue pages under `laravel/resources/js/`
- Team-aware UI and policies
- Domain web routes: `laravel/app/Domains/{Feature}/routes/web.php`

## API (Sanctum — Android / iOS)

- Token (and/or SPA) auth via Sanctum
- JSON endpoints for mobile clients
- Domain API routes: `laravel/app/Domains/{Feature}/routes/api.php`
- Same domain Actions/Policies as the web where possible — controllers adapt HTTP only

## Shared expectations

- Authorization and team scoping apply on both surfaces.
- Feature tests should cover the surfaces that domain owns (web, API, or both).
- Do not put product business rules only in Vue or only in a mobile client; keep them in domain Actions.