# First App Pack — README

Your app needs people to **log in**, and somewhere for their stuff to
**live**. That pair — login + a simple backend — is where first apps go
to burn credits: in the beginner research behind this pack, one login
bug ate ~260 Lovable credits before it worked.

This pack's answer is **PocketBase**: a complete backend in ONE file —
user accounts, a database, file storage, and an admin screen — MIT
licensed, free, written by Gani Georgiev and contributors. One small
program does the jobs beginners usually rent four services to do, and
because it's one file, an AI helping you has far fewer places to get
lost.

## The route

1. **Get PocketBase** (one download, ~12 MB):
   https://pocketbase.io/ — or releases at
   https://github.com/pocketbase/pocketbase/releases
   Written against **v0.40.6** (released 2026-10-23). The license is
   MIT, verified in the repository:
   https://github.com/pocketbase/pocketbase/blob/master/LICENSE.md
2. **Make login work** (`login-that-works.md`) — run PocketBase, create
   the users collection in its admin screen, set the access rules that
   keep one user's data invisible to another, and wire your app's login
   form to it with ONE bounded prompt instead of an open-ended "fix
   auth" loop.
3. **Put it somewhere** (`hosting-and-costs.md`) — free while you
   build (your own computer), honest prices for an always-on public
   home, checked 2026-10-23. No fake "free forever" claims.
4. **Freeze the bar** (`acceptance-template.md`) — what "login works"
   means in checkable sentences, including the two-account test, frozen
   BEFORE the build session that touches auth.

## What BAH does NOT ship you

The PocketBase binary. It's a ~12 MB download from its own project,
which will always be more current than a copy here. What this pack
ships is the part PocketBase doesn't come with: the order to do things
in, the rules settings that make login SAFE, the bounded prompt, and
the frozen test.

## Pairs with

- **"Sign in with Google" instead of passwords** — use the harness's
  research pack `google:oauth-signin`: ask your AI to fetch it with the
  research tools on this site's /mcp (`research_get_pack`). It covers
  the Google-console side; this pack covers the PocketBase side, and
  PocketBase speaks OAuth2 to Google with the same users collection.
- **Safe-to-Share check** (/safe-to-share) — the two-account test in
  this pack's acceptance IS step two of that check. Run the whole
  check before you share your app's link with anyone.