First App Pack: login that works, a backend in one file.
Games got wave 1. This one is for the app builders — because the thing that eats their credits isn't the pages, it's login. In the beginner research behind this pack, one login bug burned ~260 Lovable credits. The fix isn't a better prompt. It's removing the design question: PocketBase, a complete backend in a single file — accounts, database, file storage, admin screen — MIT-licensed and free.
Forge entry · Wave 2 · backend by Gani Georgiev and the PocketBase contributors (MIT), harness pack by this project, 2026-10-23. One of the Forge shelf.
Why PocketBase (the anchor it replaces)
The stack beginners get sold is separate rented pieces — an auth service, a database service, a storage service, on a $5–25/mo server — each with its own keys, its own dashboard, and its own way for an AI session to wire them together wrong. PocketBase is one ~12 MB program that does all four jobs, stores everything in one folder you can copy, and has exactly one design for login: its built-in users collection. One file, one design, far fewer ways to burn a week of credits.
Measured facts (checked 2026-10-23)
| Current release | PocketBase v0.40.6, released 2026-10-23. This pack is written against the current 0.x line. |
| Download | 12.2–12.4 MB per platform (Linux / macOS / Windows amd64 zips, release assets) — one file, no installer, no dependencies. |
| What's inside | Realtime database, authentication (email + OAuth2), file storage, and an admin dashboard — PocketBase's own description, verified at pocketbase.io. |
| License | MIT, verified against the repository's LICENSE.md. Your app and your data are yours; the data lives in one copyable folder (pb_data). |
What the pack makes happen
- Login, set up once — run the file, use the built-in users collection (passwords hashed by PocketBase; a hand-rolled password table is fenced off by name, because two sources of truth for login is the exact shape of the 260-credit bug).
- The rules that make it safe — the three access-rule settings that mean a logged-in person can only ever see their own rows. This, not the login form, is what makes the two-account test pass.
- One bounded wiring prompt — register form, login form, logout, nothing else changed, with the verification listed at the end. Repairs happen inside the one design; switching auth designs mid-project is refused by the pack, in writing.
- An honest hosting table — $0 while you build on your own machine, free tiers for your app's pages, and the real always-on prices for the backend itself: PocketHost at $5.00/mo paid yearly ($9.99 monthly) or a small server from $4/mo. No “free forever backend” claim, because there isn't one we could verify.
- A frozen acceptance — login, data isolation, and hosting each graded by using the live app with two fresh accounts, never by reading the builder's summary.
The nits, stated plainly
- We don't ship the binary. A ~12 MB program belongs on PocketBase's own download pages, which will always be more current than a copy here. The pack ships the route, the rules, the prompt, and the test.
- “Free hosting” has a boundary. Building and your app's pages: $0. An always-on public backend costs about $4–10/mo on every route we could verify on 2026-10-23. The pack prints that instead of pretending otherwise — a backend that sleeps when your laptop sleeps is a demo, not a launch.
- PocketBase is pre-1.0 software (v0.40.6). It is widely used and actively released — today's version shipped this morning — but a 0.x can change APIs between releases. The pack pins its version and says to upgrade deliberately, with a snapshot first.
- Password reset needs mail settings. Until you fill them in (or connect a mail service), reset emails can't send. The acceptance template forces the choice into the open: working reset, or the app says plainly it isn't available yet.
- This is a first-app backend. Thousands of daily users or can't-lose data outgrows it; the pack says so instead of overselling. When that day comes it's a good problem, and your data folder copies out.
Run it yourself
Download PocketBase (link in the pack's README), download the pack below, and do the steps in order: run it, users collection, access rules, the one bounded prompt, the two-account proof. Want Google sign-in instead of passwords? That's the harness's research pack google:oauth-signin— ask your AI to fetch it with the research tools on this site's research-run connection; it covers the Google side while this pack covers the PocketBase side, and they meet at the same users collection. Before you share your app's link, run the Safe-to-Share check— its second test is this pack's acceptance, by hand.
Download the pack
| File | What it is | Size |
|---|---|---|
| README.md | The route: PocketBase links, then the pack's steps in order | 2,549 B |
| login-that-works.md | Run it, the users collection, the access rules that isolate users, one bounded wiring prompt | 4,123 B |
| hosting-and-costs.md | Free while you build; the honest always-on table — PocketHost vs a small server, checked 2026-10-23 | 2,875 B |
| acceptance-template.md | Frozen acceptance: login done, the two-account test, hosting done — graded on the live app | 2,924 B |
⬇ Download all four — first-app-pack.zip⬇ Get PocketBase (official)
Adding to the Forge
A Forge entry needs a name, a one-line claim, an author line, a worked example with real measurements, the files, and its limitations on its page — this one included.