@shaykec/app-agent 1.0.5 → 1.0.7

package/templates/shared/android/FirebaseBackend/strings.xml

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <!-- Firebase Backend Module -->
+    
+    <!-- Login Screen -->
+    <string name="firebase_login_title">Welcome Back</string>
+    <string name="firebase_login_subtitle">Sign in to continue</string>
+    <string name="firebase_login_email_label">Email</string>
+    <string name="firebase_login_email_placeholder">Enter your email</string>
+    <string name="firebase_login_password_label">Password</string>
+    <string name="firebase_login_password_placeholder">Enter your password</string>
+    <string name="firebase_login_sign_in_button">Sign In</string>
+    <string name="firebase_login_forgot_password_button">Forgot Password?</string>
+    <string name="firebase_login_or_divider">OR</string>
+    <string name="firebase_login_google_button">Continue with Google</string>
+    <string name="firebase_login_no_account_prompt">Don\'t have an account?</string>
+    <string name="firebase_login_sign_up_link">Sign Up</string>
+    
+    <!-- Sign Up Screen -->
+    <string name="firebase_signup_navigation_title">Sign Up</string>
+    <string name="firebase_signup_title">Create Account</string>
+    <string name="firebase_signup_subtitle">Sign up to get started</string>
+    <string name="firebase_signup_display_name_label">Display Name</string>
+    <string name="firebase_signup_display_name_placeholder">Enter your name</string>
+    <string name="firebase_signup_email_label">Email</string>
+    <string name="firebase_signup_email_placeholder">Enter your email</string>
+    <string name="firebase_signup_password_label">Password</string>
+    <string name="firebase_signup_password_placeholder">Create a password</string>
+    <string name="firebase_signup_confirm_password_label">Confirm Password</string>
+    <string name="firebase_signup_confirm_password_placeholder">Confirm your password</string>
+    <string name="firebase_signup_password_hint">Password must be at least 6 characters</string>
+    <string name="firebase_signup_password_mismatch">Passwords do not match</string>
+    <string name="firebase_signup_create_account_button">Create Account</string>
+    
+    <!-- Forgot Password Screen -->
+    <string name="firebase_forgot_password_navigation_title">Forgot Password</string>
+    <string name="firebase_forgot_password_title">Reset Password</string>
+    <string name="firebase_forgot_password_subtitle">Enter your email address and we\'ll send you a link to reset your password</string>
+    <string name="firebase_forgot_password_email_label">Email</string>
+    <string name="firebase_forgot_password_email_placeholder">Enter your email</string>
+    <string name="firebase_forgot_password_send_button">Send Reset Link</string>
+    <string name="firebase_forgot_password_success_title">Check Your Email</string>
+    <string name="firebase_forgot_password_success_message">We\'ve sent a password reset link to %1$s</string>
+    
+    <!-- Profile Screen -->
+    <string name="firebase_profile_navigation_title">Profile</string>
+    <string name="firebase_profile_user_id">User ID: %1$s</string>
+    <string name="firebase_profile_providers_title">Connected Accounts</string>
+    <string name="firebase_profile_email_provider">Email</string>
+    <string name="firebase_profile_google_provider">Google</string>
+    <string name="firebase_profile_apple_provider">Apple</string>
+    <string name="firebase_profile_sign_out_button">Sign Out</string>
+    <string name="firebase_profile_delete_account_button">Delete Account</string>
+    <string name="firebase_profile_cancel_button">Cancel</string>
+    <string name="firebase_profile_sign_out_alert_title">Sign Out</string>
+    <string name="firebase_profile_sign_out_alert_message">Are you sure you want to sign out?</string>
+    <string name="firebase_profile_delete_account_alert_title">Delete Account</string>
+    <string name="firebase_profile_delete_account_alert_message">This action cannot be undone. All your data will be permanently deleted.</string>
+    
+    <!-- Config -->
+    <string name="firebase_web_client_id">YOUR_WEB_CLIENT_ID</string>
+</resources>

package/templates/shared/android/FirebaseProvider/FirebaseAuthManager.kt

@@ -0,0 +1,177 @@
+package com.appship.shared.firebase
+
+import android.content.Context
+import com.google.android.gms.auth.api.signin.GoogleSignIn
+import com.google.android.gms.auth.api.signin.GoogleSignInAccount
+import com.google.android.gms.auth.api.signin.GoogleSignInClient
+import com.google.android.gms.auth.api.signin.GoogleSignInOptions
+import com.google.android.gms.common.api.ApiException
+import com.google.firebase.auth.FirebaseAuth
+import com.google.firebase.auth.FirebaseUser
+import com.google.firebase.auth.GoogleAuthProvider
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.tasks.await
+
+/**
+ * Firebase authentication manager with email/password and Google Sign-In support.
+ * Manages auth state, session persistence, and sign-in flows.
+ */
+class FirebaseAuthManager(private val context: Context) {
+    private val auth = FirebaseAuth.getInstance()
+    private val _currentUser = MutableStateFlow<FirebaseUser?>(auth.currentUser)
+    val currentUser: StateFlow<FirebaseUser?> = _currentUser.asStateFlow()
+    
+    private val _isAuthenticated = MutableStateFlow<Boolean>(auth.currentUser != null)
+    val isAuthenticated: StateFlow<Boolean> = _isAuthenticated.asStateFlow()
+    
+    private val _isLoading = MutableStateFlow<Boolean>(false)
+    val isLoading: StateFlow<Boolean> = _isLoading.asStateFlow()
+    
+    private val _error = MutableStateFlow<String?>(null)
+    val error: StateFlow<String?> = _error.asStateFlow()
+    
+    private var googleSignInClient: GoogleSignInClient? = null
+    
+    init {
+        setupAuthStateListener()
+        setupGoogleSignIn()
+    }
+    
+    private fun setupAuthStateListener() {
+        auth.addAuthStateListener { firebaseAuth ->
+            _currentUser.value = firebaseAuth.currentUser
+            _isAuthenticated.value = firebaseAuth.currentUser != null
+        }
+    }
+    
+    private fun setupGoogleSignIn() {
+        // CUSTOMIZE: Replace with your Firebase Web Client ID from google-services.json
+        val gso = GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
+            .requestIdToken("YOUR_WEB_CLIENT_ID")
+            .requestEmail()
+            .build()
+        googleSignInClient = GoogleSignIn.getClient(context, gso)
+    }
+    
+    /**
+     * Sign in with email and password
+     */
+    suspend fun signIn(email: String, password: String): Result<FirebaseUser> {
+        return try {
+            _isLoading.value = true
+            _error.value = null
+            
+            val result = auth.signInWithEmailAndPassword(email, password).await()
+            Result.success(result.user!!)
+        } catch (e: Exception) {
+            _error.value = e.message ?: "Sign in failed"
+            Result.failure(e)
+        } finally {
+            _isLoading.value = false
+        }
+    }
+    
+    /**
+     * Sign up with email and password
+     */
+    suspend fun signUp(email: String, password: String): Result<FirebaseUser> {
+        return try {
+            _isLoading.value = true
+            _error.value = null
+            
+            val result = auth.createUserWithEmailAndPassword(email, password).await()
+            Result.success(result.user!!)
+        } catch (e: Exception) {
+            _error.value = e.message ?: "Sign up failed"
+            Result.failure(e)
+        } finally {
+            _isLoading.value = false
+        }
+    }
+    
+    /**
+     * Sign out
+     */
+    fun signOut() {
+        auth.signOut()
+        googleSignInClient?.signOut()
+        _currentUser.value = null
+        _isAuthenticated.value = false
+    }
+    
+    /**
+     * Reset password via email
+     */
+    suspend fun resetPassword(email: String): Result<Unit> {
+        return try {
+            _isLoading.value = true
+            _error.value = null
+            
+            auth.sendPasswordResetEmail(email).await()
+            Result.success(Unit)
+        } catch (e: Exception) {
+            _error.value = e.message ?: "Password reset failed"
+            Result.failure(e)
+        } finally {
+            _isLoading.value = false
+        }
+    }
+    
+    /**
+     * Sign in with Google
+     * Returns the GoogleSignInClient for use with Activity result handling
+     */
+    fun getGoogleSignInIntent() = googleSignInClient?.signInIntent
+    
+    /**
+     * Handle Google Sign-In result from Activity
+     */
+    suspend fun handleGoogleSignInResult(data: android.content.Intent?): Result<FirebaseUser> {
+        return try {
+            _isLoading.value = true
+            _error.value = null
+            
+            val task = GoogleSignIn.getSignedInAccountFromIntent(data)
+            val account = task.getResult(ApiException::class.java)
+            
+            val credential = GoogleAuthProvider.getCredential(account?.idToken, null)
+            val result = auth.signInWithCredential(credential).await()
+            
+            Result.success(result.user!!)
+        } catch (e: Exception) {
+            _error.value = e.message ?: "Google sign in failed"
+            Result.failure(e)
+        } finally {
+            _isLoading.value = false
+        }
+    }
+    
+    /**
+     * Get current user's email
+     */
+    fun getCurrentUserEmail(): String? = auth.currentUser?.email
+    
+    /**
+     * Get current user's display name
+     */
+    fun getCurrentUserDisplayName(): String? = auth.currentUser?.displayName
+    
+    /**
+     * Update user's display name
+     */
+    suspend fun updateDisplayName(name: String): Result<Unit> {
+        return try {
+            val user = auth.currentUser ?: return Result.failure(Exception("No user signed in"))
+            val profileUpdates = com.google.firebase.auth.UserProfileChangeRequest.Builder()
+                .setDisplayName(name)
+                .build()
+            user.updateProfile(profileUpdates).await()
+            Result.success(Unit)
+        } catch (e: Exception) {
+            _error.value = e.message ?: "Update display name failed"
+            Result.failure(e)
+        }
+    }
+}

package/templates/shared/android/FirebaseProvider/FirebaseConfig.kt

@@ -0,0 +1,54 @@
+package com.appship.shared.firebase
+
+/**
+ * Firebase configuration with placeholder values.
+ * CUSTOMIZE: Replace with your Firebase project settings.
+ */
+object FirebaseConfig {
+    // CUSTOMIZE: Your Firebase project ID (found in Firebase Console > Project Settings)
+    const val PROJECT_ID = "your-project-id"
+    
+    // CUSTOMIZE: Your Firebase storage bucket (found in Firebase Console > Storage)
+    const val STORAGE_BUCKET = "your-project-id.appspot.com"
+    
+    // CUSTOMIZE: Firestore collection names
+    const val COLLECTION_ITEMS = "items"
+    const val COLLECTION_CATEGORIES = "categories"
+    const val COLLECTION_USERS = "users"
+    
+    // CUSTOMIZE: Add more collection names as needed
+    // const val COLLECTION_ORDERS = "orders"
+    // const val COLLECTION_REVIEWS = "reviews"
+    
+    /**
+     * Firestore security rules template hint.
+     * Copy this to Firebase Console > Firestore Database > Rules
+     * 
+     * rules_version = '2';
+     * service cloud.firestore {
+     *   match /databases/{database}/documents {
+     *     // Users can only read/write their own data
+     *     match /items/{itemId} {
+     *       allow read, write: if request.auth != null && request.auth.uid == resource.data.userId;
+     *       allow create: if request.auth != null && request.auth.uid == request.resource.data.userId;
+     *     }
+     *     
+     *     // Categories are read-only for all authenticated users
+     *     match /categories/{categoryId} {
+     *       allow read: if request.auth != null;
+     *       allow write: if false; // Only admins can write (configure separately)
+     *     }
+     *     
+     *     // User profiles
+     *     match /users/{userId} {
+     *       allow read: if request.auth != null;
+     *       allow write: if request.auth != null && request.auth.uid == userId;
+     *     }
+     *   }
+     * }
+     */
+    val FIRESTORE_RULES_HINT = """
+        Configure Firestore security rules in Firebase Console.
+        Ensure users can only access their own data.
+    """.trimIndent()
+}

package/templates/shared/android/FirebaseProvider/FirebaseDataProvider.kt

@@ -0,0 +1,152 @@
+package com.appship.shared.firebase
+
+import com.google.firebase.auth.FirebaseAuth
+import com.google.firebase.firestore.FirebaseFirestore
+import com.google.firebase.firestore.ListenerRegistration
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.tasks.await
+
+/**
+ * DataRepository implementation backed by Firebase Firestore.
+ * Uses Firestore's built-in offline persistence for automatic caching.
+ * 
+ * CUSTOMIZE: Replace Item, Category with your app's domain models.
+ * CUSTOMIZE: Adjust collection names in FirebaseConfig.
+ */
+class FirebaseDataProvider : DataRepository {
+    private val db = FirebaseFirestore.getInstance()
+    private val auth = FirebaseAuth.getInstance()
+    private val listeners = mutableListOf<ListenerRegistration>()
+    
+    private val _items = MutableStateFlow<List<Item>>(emptyList())
+    override val items: StateFlow<List<Item>> = _items.asStateFlow()
+    
+    private val _categories = MutableStateFlow<List<Category>>(emptyList())
+    override val categories: StateFlow<List<Category>> = _categories.asStateFlow()
+    
+    private val _favoriteItems = MutableStateFlow<List<Item>>(emptyList())
+    override val favoriteItems: StateFlow<List<Item>> = _favoriteItems.asStateFlow()
+    
+    init {
+        setupListeners()
+    }
+    
+    private fun setupListeners() {
+        val userId = auth.currentUser?.uid ?: return
+        
+        val itemsListener = db.collection(FirebaseConfig.COLLECTION_ITEMS)
+            .whereEqualTo("userId", userId)
+            .orderBy("createdAt", com.google.firebase.firestore.Query.Direction.DESCENDING)
+            .addSnapshotListener { snapshot, error ->
+                if (error != null) {
+                    // CUSTOMIZE: Handle error appropriately
+                    return@addSnapshotListener
+                }
+                snapshot?.let {
+                    _items.value = it.documents.mapNotNull { doc ->
+                        doc.toObject(Item::class.java)?.copy(id = doc.id)
+                    }
+                    _favoriteItems.value = _items.value.filter { item -> item.isFavorite }
+                }
+            }
+        listeners.add(itemsListener)
+        
+        val categoriesListener = db.collection(FirebaseConfig.COLLECTION_CATEGORIES)
+            .addSnapshotListener { snapshot, error ->
+                if (error != null) {
+                    // CUSTOMIZE: Handle error appropriately
+                    return@addSnapshotListener
+                }
+                snapshot?.let {
+                    _categories.value = it.documents.mapNotNull { doc ->
+                        doc.toObject(Category::class.java)?.copy(id = doc.id)
+                    }
+                }
+            }
+        listeners.add(categoriesListener)
+    }
+    
+    override fun loadData() {
+        cleanup()
+        setupListeners()
+    }
+    
+    override fun addItem(item: Item) {
+        val userId = auth.currentUser?.uid ?: return
+        val data = item.copy(
+            id = db.collection(FirebaseConfig.COLLECTION_ITEMS).document().id,
+            metadata = item.metadata + ("userId" to userId, "createdAt" to System.currentTimeMillis())
+        )
+        db.collection(FirebaseConfig.COLLECTION_ITEMS).document(data.id).set(data)
+    }
+    
+    override fun updateItem(item: Item) {
+        db.collection(FirebaseConfig.COLLECTION_ITEMS).document(item.id).set(item)
+    }
+    
+    override fun deleteItem(item: Item) {
+        db.collection(FirebaseConfig.COLLECTION_ITEMS).document(item.id).delete()
+    }
+    
+    override fun toggleFavorite(item: Item) {
+        val updated = item.copy(isFavorite = !item.isFavorite)
+        updateItem(updated)
+    }
+    
+    override fun searchItems(query: String): List<Item> {
+        if (query.isBlank()) return _items.value
+        val lower = query.lowercase()
+        return _items.value.filter {
+            it.title.lowercase().contains(lower) || 
+            it.subtitle?.lowercase()?.contains(lower) == true
+        }
+    }
+    
+    override fun itemsByCategory(categoryName: String): List<Item> {
+        return _items.value.filter { it.category == categoryName }
+    }
+    
+    fun cleanup() {
+        listeners.forEach { it.remove() }
+        listeners.clear()
+    }
+}
+
+/**
+ * CUSTOMIZE: Replace with your app's domain models.
+ * These are placeholder models that the agent will replace during integration.
+ */
+data class Item(
+    val id: String,
+    val title: String,
+    val subtitle: String? = null,
+    val category: String? = null,
+    val isFavorite: Boolean = false,
+    val metadata: Map<String, Any> = emptyMap()
+)
+
+data class Category(
+    val id: String,
+    val name: String,
+    val metadata: Map<String, Any> = emptyMap()
+)
+
+/**
+ * CUSTOMIZE: Replace with your app's DataRepository interface.
+ * This is a placeholder interface that matches the Skeleton template pattern.
+ */
+interface DataRepository {
+    val items: StateFlow<List<Item>>
+    val categories: StateFlow<List<Category>>
+    val favoriteItems: StateFlow<List<Item>>
+    
+    fun loadData()
+    fun addItem(item: Item)
+    fun updateItem(item: Item)
+    fun deleteItem(item: Item)
+    fun toggleFavorite(item: Item)
+    fun searchItems(query: String): List<Item>
+    fun itemsByCategory(categoryName: String): List<Item>
+}

package/templates/shared/android/FirebaseProvider/strings.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <!-- Firebase Auth Module -->
+    <string name="firebase_auth_sign_in_title">Sign In</string>
+    <string name="firebase_auth_sign_up_title">Create Account</string>
+    <string name="firebase_auth_email_label">Email</string>
+    <string name="firebase_auth_password_label">Password</string>
+    <string name="firebase_auth_sign_in_button">Sign In</string>
+    <string name="firebase_auth_sign_up_button">Sign Up</string>
+    <string name="firebase_auth_sign_out_button">Sign Out</string>
+    <string name="firebase_auth_forgot_password">Forgot Password?</string>
+    <string name="firebase_auth_reset_password">Reset Password</string>
+    <string name="firebase_auth_reset_password_sent">Password reset email sent</string>
+    <string name="firebase_auth_google_sign_in">Sign in with Google</string>
+    <string name="firebase_auth_already_have_account">Already have an account? Sign in</string>
+    <string name="firebase_auth_no_account">Don\'t have an account? Sign up</string>
+    <string name="firebase_auth_loading">Signing in…</string>
+    <string name="firebase_auth_error_invalid_email">Invalid email address</string>
+    <string name="firebase_auth_error_weak_password">Password should be at least 6 characters</string>
+    <string name="firebase_auth_error_user_not_found">No account found with this email</string>
+    <string name="firebase_auth_error_wrong_password">Incorrect password</string>
+    <string name="firebase_auth_error_email_already_in_use">This email is already registered</string>
+    <string name="firebase_auth_error_network">Network error. Please check your connection.</string>
+    <string name="firebase_auth_error_unknown">An error occurred. Please try again.</string>
+</resources>

package/templates/shared/android/SecretsConfig/INTEGRATION.md

@@ -0,0 +1,109 @@
+# SecretsConfig Module — Integration Guide (Android)
+
+## Prerequisites
+
+### 1. Create the secrets file
+
+```bash
+cp secrets.properties.template secrets.properties
+```
+
+### 2. Add BuildConfig field injection to build.gradle.kts
+
+Add the following to your `app/build.gradle.kts`, inside `android { defaultConfig { } }`:
+
+```kotlin
+import java.util.Properties
+
+// Inside android { defaultConfig { } }:
+val secretsFile = rootProject.file("secrets.properties")
+if (secretsFile.exists()) {
+    val secrets = Properties().apply { load(secretsFile.inputStream()) }
+    buildConfigField("String", "WIX_CLIENT_ID", "\"${secrets.getProperty("WIX_CLIENT_ID", "")}\"")
+    buildConfigField("String", "WIX_SITE_ID", "\"${secrets.getProperty("WIX_SITE_ID", "")}\"")
+    buildConfigField("String", "WIX_API_KEY", "\"${secrets.getProperty("WIX_API_KEY", "")}\"")
+    buildConfigField("String", "SUPABASE_URL", "\"${secrets.getProperty("SUPABASE_URL", "")}\"")
+    buildConfigField("String", "SUPABASE_ANON_KEY", "\"${secrets.getProperty("SUPABASE_ANON_KEY", "")}\"")
+} else {
+    buildConfigField("String", "WIX_CLIENT_ID", "\"\"")
+    buildConfigField("String", "WIX_SITE_ID", "\"\"")
+    buildConfigField("String", "WIX_API_KEY", "\"\"")
+    buildConfigField("String", "SUPABASE_URL", "\"\"")
+    buildConfigField("String", "SUPABASE_ANON_KEY", "\"\"")
+}
+```
+
+Also ensure BuildConfig generation is enabled:
+```kotlin
+android {
+    buildFeatures {
+        buildConfig = true
+    }
+}
+```
+
+See `build.gradle.snippet.kts` for the full snippet.
+
+### 3. Add to .gitignore
+
+```
+secrets.properties
+```
+
+The `.template` file is safe to commit — it contains only placeholder values.
+
+## AppConfig Additions
+
+No AppConfig changes needed. `SecretsConfig` reads directly from `BuildConfig`.
+
+## Navigation Wiring
+
+None — `SecretsConfig` is a utility module with no UI.
+
+## String Merge
+
+None — no user-facing strings.
+
+## Test IDs
+
+None — no UI elements.
+
+## Module Dependencies
+
+- None (uses only Android `Log` and Java reflection)
+
+## Usage Notes
+
+### Reading keys in code
+
+```kotlin
+// Read a specific key
+val clientId = SecretsConfig.wixClientId
+
+// Check if a service is configured
+if (SecretsConfig.isWixMemberConfigured) {
+    // Initialize Wix services
+}
+
+if (SecretsConfig.isSupabaseConfigured) {
+    // Initialize Supabase client
+}
+```
+
+### Package name configuration
+
+The `SecretsConfig.kt` file has a `getBuildConfigPackage()` method that returns the package name for BuildConfig access. The agent will replace `com.appship.app` with the actual app package name during integration.
+
+### Adding new keys
+
+1. Add the key to `secrets.properties.template` with a placeholder value
+2. Add a `buildConfigField` line to `build.gradle.kts`
+3. Add a `val` property to `SecretsConfig.kt` using `getField()`
+
+### Security model
+
+| Key Type | Where it goes | Safety |
+|----------|--------------|--------|
+| Client-safe public keys (Supabase anon key, Wix client ID) | secrets.properties -> BuildConfig | Safe in client, protected by RLS/OAuth |
+| SDK config files (google-services.json) | app/ directory, gitignored | Standard SDK pattern |
+| Server-side secrets (database passwords) | NEVER in client app | Set up on your backend |

package/templates/shared/android/SecretsConfig/SETUP.md

@@ -0,0 +1,67 @@
+# SecretsConfig — Setup Guide
+
+This app uses `SecretsConfig` to manage API keys securely. Keys are stored in a local properties file that is **never committed to git**.
+
+## Quick Start
+
+```bash
+# 1. Copy the template
+cp secrets.properties.template secrets.properties
+
+# 2. Open secrets.properties and fill in your keys
+```
+
+## Where to Get Your Keys
+
+### Wix (Member / Customer apps)
+
+1. Go to [https://dev.wix.com](https://dev.wix.com)
+2. Create a new Headless project (or open your existing Wix site)
+3. Navigate to **OAuth Apps** and create a new OAuth app
+4. Copy the **Client ID** → paste as `WIX_CLIENT_ID`
+5. Copy your **Site ID** from the site dashboard URL → paste as `WIX_SITE_ID` (optional if using WixSiteSelector)
+6. Add the redirect URL `{your.package.name}://oauth/callback` to the OAuth app's allowed redirects
+   - The app auto-derives this from its package name — just register it in Wix
+7. Enable the APIs you need (Stores, Bookings, Events, Blog) in the OAuth app permissions
+
+### Wix (Owner / Admin apps)
+
+1. Go to your Wix site **Dashboard > Settings > API Keys**
+2. Click **Generate API Key**
+3. Select the permissions you need (Stores, Bookings, Events, Blog, Site Management)
+4. Copy the **API Key** → paste as `WIX_API_KEY`
+5. Copy your **Site ID** → paste as `WIX_SITE_ID`
+
+### Firebase
+
+Firebase does **not** use `secrets.properties`. Instead:
+
+1. Go to [https://console.firebase.google.com](https://console.firebase.google.com)
+2. Create a project and register your Android app (use your package name)
+3. Download `google-services.json`
+4. Place it in the `app/` directory of your project
+5. The Firebase SDK reads this file automatically at build time
+
+### Supabase
+
+1. Go to [https://supabase.com/dashboard](https://supabase.com/dashboard)
+2. Create a new project (or open an existing one)
+3. Go to **Project Settings > API**
+4. Copy the **Project URL** → paste as `SUPABASE_URL`
+5. Copy the **anon/public key** → paste as `SUPABASE_ANON_KEY`
+6. The anon key is safe for client apps — your data is protected by Row Level Security (RLS)
+
+## Verify Your Setup
+
+After filling in keys, build and run the app. Check Logcat for warnings:
+
+- `SecretsConfig: 'KEY_NAME' is not configured` — this key is missing or still has a placeholder value
+- No warnings = all keys are properly configured
+
+## Security Notes
+
+- `secrets.properties` is in `.gitignore` — it will **never** be committed
+- `secrets.properties.template` is safe to commit — it only contains placeholder values
+- Never hardcode API keys directly in Kotlin source files
+- Supabase anon keys and Wix client IDs are **client-safe** (designed to be in mobile apps)
+- Server-side secrets (database passwords, Stripe secret keys) should **never** be in a mobile app