# Textxt Mini App Platform

Textxt Mini Apps are HTTPS web applications that run in a sandboxed panel inside a Textxt chat or topic. They use Bridge 1.0 to read permitted context, send user-confirmed results back to the conversation, use chat-scoped resources, and invoke explicitly registered platform services.

AUTHORITATIVE SOURCES

- AI build guide: https://textxt.com/mini-apps/developers/ai-build.md
- Bridge machine contract: https://textxt.com/mini-apps/developers/bridge-v1.json
- Manifest 1 schema: https://textxt.com/mini-apps/schema/manifest-v1.json
- SDK 1.0.3: https://textxt.com/mini-apps/sdk/1.0.3/textxt-mini-app.js
- TypeScript declarations: https://textxt.com/mini-apps/sdk/textxt-mini-app.d.ts
- Starter app and simulator: https://textxt.com/mini-apps/starter/
- Security checklist: https://textxt.com/mini-apps/developers/security/
- Platform policy: https://textxt.com/mini-apps/developers/policies/
- Changelog: https://textxt.com/mini-apps/developers/changelog/

CORE RULES

1. Use the official SDK. Never implement raw postMessage transport.
2. Call getContext and feature-detect optional commands through context.bridge.availableCommands.
3. Request the smallest possible permission set in Manifest 1.
4. Treat session.id and sessionToken only as correlation values, never authentication.
5. Never request Textxt/Firebase credentials or access Textxt Firestore directly.
6. Production assets must use one HTTPS origin and immutable semantic-version URLs.
7. The server must send a CSP response header allowing frame ancestors https://textxt.com and https://textxt-14209.web.app.
8. Never invent commands or manifest fields. Use bridge-v1.json, the TypeScript declarations, and the Manifest JSON Schema.
9. Keep message sends, uploads, TXT payments, and other visible writes behind explicit user actions.
10. Support mobile layouts from 320px wide and handle denied permissions, offline state, command timeout, and session expiry.

QUICK START

mkdir my-textxt-mini-app && cd my-textxt-mini-app
BASE=https://textxt.com/mini-apps/starter
curl -fsSLO "$BASE/index.html"
curl -fsSLO "$BASE/manifest.json"
curl -fsSLO "$BASE/host.html"
curl -fsSLO "$BASE/textxt-mini-app.js"
curl -fsSLO "$BASE/validate-manifest.mjs"
npx serve .

Open the local URL plus /host.html. Validate with:

node validate-manifest.mjs --local manifest.json
node validate-manifest.mjs --remote manifest.json

SDK BASELINE

<script src="https://textxt.com/mini-apps/sdk/1.0.3/textxt-mini-app.js"></script>
<script>
  const bridge = window.TextxtMiniApp.createBridge();
  (async () => {
    const context = await bridge.getContext();
    if (context.bridge.availableCommands.includes("sendMessage")) {
      await bridge.sendMessage({ text: "Result from my Mini App" });
    }
  })().catch((error) => console.error(error));
</script>

PERMISSIONS

- readContext: Read user, theme, locale, chat, topic, launch, and runtime context.
- sendMessage: Send and update messages or share a standard Mini App card.
- setDraft: Update the Textxt composer draft.
- openTopic: Switch the active topic.
- uploadFile: Ask the host to choose and upload files.
- generateImages: Use host-controlled image generation or editing.
- wallet: Read TXT balance and request a host-confirmed TXT payment.
- gptPro: Use GPT PRO operations exposed by the current host.
- invokeServices: Invoke backend services registered for this Mini App.
- boards: Use chat-scoped board and Caro resources.
- polls: Create, read, vote on, and close chat-scoped polls.

BRIDGE COMMAND GROUPS

- Context: getContext, pickChatContent.
- Conversation: sendMessage, setDraft, updateMessage, shareMiniAppMessage, openTopic.
- Host: uploadFile, generateImage, resize, logEvent, reportError, closeMiniApp, openCreditWallet.
- TXT wallet: getTxtWallet, requestTxtPayment.
- Services: invokeTextxtService. The SDK also provides invokeService(service, operation, input).
- Boards: listBoards, createBoard, getBoard, saveBoard, subscribeBoard, unsubscribeBoard, createCaroMatch, mutateCaroMatch.
- Polls: createPoll, getPoll, listPolls, castVote, closePoll.
- GPT PRO: getGptProConfig, getGptProCreditRequest, createGptProCreditRequest, createGptProPublicShare, saveGptProResponseToTextxt, listGptProConversations, getGptProConversation, submitGptProQuestion, getGptProResult, cancelGptProQuestion, downloadGptProOutput, startGptProGameSession, submitGptProGameScore, getGptProGameLeaderboard.

RUNTIME EVENTS

context, permissionsChanged, boardChanged, pollUpdated, themeChanged, localeChanged, networkChanged, layoutChanged, visibilityChanged, fullscreenChanged, sessionExpired.

MANIFEST REQUIREMENTS

Manifest version is 1 and Bridge version is 1.0. Validate against https://textxt.com/mini-apps/schema/manifest-v1.json. A release normally declares appId, name, description, iconUrl, startUrl, allowedOrigins, permissions, capabilities, bridgeVersion, visibility, tags, version, privacyPolicyUrl, supportUrl, and releaseNotes. Do not add ownerId, review status, timestamps, credentials, or unrecognized fields.

PRODUCTION CSP BASELINE

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors https://textxt.com https://textxt-14209.web.app

RELEASE

Host the release at an immutable semantic-version URL, validate locally and remotely, test at 320px width, and submit the manifest from Textxt Settings -> Mini app developer. The platform fetches and verifies the release, archives its digest, reviews requested capabilities, and supports staged updates and rollback.