your-ai-workflow-firebase-os 1.14.10 → 1.14.13

package/README.md

@@ -67,6 +67,52 @@ npm install /path/to/your-ai-workflow-firebase-os-1.0.0.tgz  # in your app
 
 Installing runs a postinstall step that patches the consumer project: it clears Vite's default CSS, writes `src/main.tsx` and `src/App.tsx` (both are owned by the library — see below), adds `yourAiFirebase()` from `your-ai-workflow-firebase-os/vite` and Tailwind to `vite.config.ts`, and creates `src/your-ai-workflow-firebase-os/` with the editable theme and configs. It writes no `GEMINI.md` / `AGENTS.md`: AI Studio reserves those filenames for the developer's own instructions, and a package writing them reads as prompt injection.
 
+### Starting from nothing (Claude Code, Codex, Antigravity)
+
+In Google AI Studio the project, the `server.ts` and the Secrets tab all exist before the owner
+arrives. On your own machine none of it does — so the first move is one block of text handed to
+the assistant, not a list of commands for a person:
+
+1. Create a Vite + React + TypeScript app in the folder and delete the starter demo.
+2. `npm install your-ai-workflow-firebase-os`, then `npm install` once more (the install step adds Tailwind).
+3. Write `.env` in the project root — every value empty:
+
+```dotenv
+# Firebase Configuration
+VITE_FIREBASE_API_KEY=""
+VITE_FIREBASE_AUTH_DOMAIN=""
+VITE_FIREBASE_PROJECT_ID=""
+VITE_FIREBASE_STORAGE_BUCKET=""
+VITE_FIREBASE_MESSAGING_SENDER_ID=""
+VITE_FIREBASE_APP_ID=""
+STRIPE_SECRET_KEY=""
+STRIPE_WEBHOOK_SECRET=""
+RESEND_API_KEY=""
+APP_NAME=""
+ADMIN_EMAILS=""
+EMAIL_FROM=""
+
+# Admin Config
+# Comma-separated list of admin emails
+VITE_ADMIN_EMAILS=""
+
+# AI features — server side only, never sent to the browser
+GEMINI_API_KEY=""
+```
+
+4. `npm install express dotenv stripe` and `npm install -D tsx @types/express`, copy
+   `node_modules/your-ai-workflow-firebase-os/server.template.ts` to `server.ts` unchanged, and set the
+   dev script to `tsx server.ts`. Nothing is ever added to that file: every route lives in the package.
+5. `npm run dev`, then open the app — it lands on its Setup screen.
+
+The Setup screen carries the same block behind a copy button. The switch at the top of `/setup`
+("I'm building with…") is what decides whether the whole walkthrough talks about the Secrets tab
+and Apply, or about `.env` and restarting; the choice is remembered and the Payments and Email
+screens read it too.
+
+`GEMINI_API_KEY` is only needed if you later ask for something that uses AI, and it has no `VITE_`
+prefix on purpose — the server reads it, the browser never sees it.
+
 ### What the build enforces
 
 The package ships a Vite plugin, `yourAiFirebase()`, that puts the project's structure out of the assistant's reach. `src/App.tsx` and `src/main.tsx` are owned files: the plugin serves its own canonical source for both and rewrites them on disk whenever they differ, so an edit there has no effect. Pages, forms and content files are discovered from `src/your-ai-workflow-firebase-os/configs/` and `microcomponents/` through a virtual module, so a deleted registry import can no longer make a page vanish. And every discovered file is validated before the build: a config file with the wrong name, a `route` that is not one string starting with `/`, an address used twice, a `*Tab.config.ts` without a valid `pageType`, a missing `*Config` export, a `systemName` that does not match the file, or a content file with no default export fails the build with one sentence that names the fix. A hand-written `<form>` in a content file only warns — its entries would never reach the Inbox.