# Textxt

> Textxt is a messaging workspace where Markdown messages, topics, files, tags, reminders, and Mini Apps turn conversations into organized work.

## Mini App development

- [AI build guide](https://textxt.com/mini-apps/developers/ai-build.md): The shortest complete path for an AI coding assistant to build, test, and prepare a Textxt Mini App.
- [Full AI context](https://textxt.com/llms-full.txt): Consolidated Mini App platform rules, examples, and release requirements.
- [Developer guide](https://textxt.com/mini-apps/developers/): Human-readable platform guide and release workflow.
- [Bridge 1 machine contract](https://textxt.com/mini-apps/developers/bridge-v1.json): Permissions, commands, events, versions, and canonical artifact URLs.
- [Reusable AI prompt](https://textxt.com/mini-apps/developers/ai-prompt.txt): Prompt a developer can paste into an AI coding assistant.
- [Starter app](https://textxt.com/mini-apps/starter/): Working static app, local host simulator, manifest, SDK, and validator.
- [Manifest 1 JSON Schema](https://textxt.com/mini-apps/schema/manifest-v1.json): Authoritative release manifest schema.
- [Bridge SDK 1.0.3](https://textxt.com/mini-apps/sdk/1.0.3/textxt-mini-app.js): Immutable versioned browser SDK.
- [TypeScript declarations](https://textxt.com/mini-apps/sdk/textxt-mini-app.d.ts): Bridge command and context types.
- [Security checklist](https://textxt.com/mini-apps/developers/security/): Hosting, CSP, sandbox, permission, and authentication requirements.
- [Platform policy](https://textxt.com/mini-apps/developers/policies/): Review, lifecycle, support, and compatibility policy.
- [Changelog](https://textxt.com/mini-apps/developers/changelog/): Bridge and platform changes.

## Non-negotiable rules

- Use the official SDK. Do not implement raw `postMessage` transport.
- Feature-detect commands through `context.bridge.availableCommands`.
- Request only the permissions the app actually uses.
- Never treat `session.id` or `sessionToken` as authentication.
- Never ask for Textxt or Firebase credentials and never access Textxt Firestore directly.
- Production releases require HTTPS, immutable semantic-version URLs, and a CSP response header.
- Do not invent Bridge commands or manifest fields. Use the machine contract, TypeScript declarations, and Manifest JSON Schema.