# State

Prefer Nuxt/Vue composables/useState.

Separate:
- server/API state
- auth/session state
- cart
- UI
- forms

Introduce Pinia only if proven necessary.

Do not add caching that could leak data between users or go stale across
permission changes (global AGENTS.md). Never cache private or authorization
decisions indefinitely.

Store session/auth tokens per the established pattern (`useAuth`, mirrored into
the shared Axios client). Never put tokens in source or logs.