Build in small, verifiable steps

Starting prompt

You are building FileLoveNote. Start in a new, empty project folder and use all documents in prompt/. You do not need the original source code.
Read prompt/design.html for the app’s appearance and layout. Read prompt/data-structure.html for record fields, storage ownership, relationships and compatibility limits. Read prompt/security.html too. Treat its proposed improvements as work to do; only describe them as implemented after implementation and verification.

Read solution-intent.html, solution-design.html, requirements.html, user-stories.html, verificatie.html and bronnen.html before writing code. Also read API Contracts, Failure & Recovery, Markdown Compatibility, Setup & Operations and Acceptance & Fixtures. Apply the chapter ownership/precedence rule in Sources & decisions. Use the requirement IDs in this kit, not IDs from older external documents.

Goal: a calm thinking workspace with notes, files and optional folders. Use clear, plain English. Do not add unsolicited productivity features.

Keep the described Bun/CommonJS, HTML renderer, TypeScript custom element and ProseMirror architecture. Work directly on main if the project uses Git. Preserve unrelated existing work. Do not publish, push or change an external account without an instruction.

Required contracts:
- Persist notes in account-specific IndexedDB first. Optionally store Markdown in the user's own Google Drive. No new readable server copy, content log, server search index or content snapshot.
- Automatic two-way sync on the web. Keep the queue after failures. A ticket is not Drive confirmation. An acknowledgement applies only to that exact local version.
- Temporary server packages must be encrypted, account-specific and cleaned up after the Drive result is retrieved. Do not claim end-to-end encryption.
- Global search covers only notes and folders. Files has its own search scope.
- Inserting existing Drive sources and writing annotations in notes is mandatory FR-17, P03/P04. No duplicate source upload.
- Removing a reference never deletes its original file. Deleting notes, library metadata, originals and accounts follows the explicit failure-recovery.html scope table. Handle old trash separately.
- Google OAuth is required to sign in. Missing AI, Drive or media configuration must not block writing after sign-in.
- No API keys, personal email addresses or production data in code or docs.

Use P00–P04 and P07 in order for the web core. P05 extends it to the full web scope. State the chosen scope before starting. Ask only for genuinely missing information; keep routine implementation choices small and explicit.

For each step:
1. State inputs, assumptions, relevant requirements/stories and a short plan.
2. Write meaningful tests for contracts and failures; build the smallest working implementation. Use fakes for external APIs; do not claim live verification based on a fake.
3. Actually run the tests. Check user flows with BrowserOS Neo. Continue only when the chosen acceptance criteria work or an external dependency is clearly identified separately.
4. Report changed files, test commands and actual results, open criteria and startup instructions. Update build-status.md with requirement ID, phase, evidence and limitation. Keep intent/design in the new project docs current without silently rewriting this source package.

Start with P00 only. Do not half-implement every phase at once. Do not stop permanently after a plan: make the requested phase work and verify it.

P00 · Foundation and executable plan

NFR-08; V01

Read the full kit, including data-structure.html. Define the chosen record schemas and migration boundaries. Report the chosen scope and key invariants. Create a concise phase plan and build-status.md with all chosen FR/NFR IDs, linked US/V IDs and an open status. No external services are needed.
Use the portable baseline/package.json and baseline/bun.lock from Setup & Operations; record Bun/runtime versions and pass a frozen install. Run fixtures/verify.mjs and generate isolated test records. Create a minimal Bun app: package.json, lockfile, .gitignore, .env.example, server.js, router, responder, env/path context and basic HTML. Use CommonJS on the server and separate routes/services/views. Scripts: start= bun server.js; dev= bun --watch --no-clear-screen server.js; test= NODE_ENV=test bun test; test:browser= bunx --bun playwright test --config=playwright/layout.config.js. Implement the browser config and isolated Google-session fixture before running test:browser; connect to BrowserOS Neo CDP 9110 and explicitly clear storageState for anonymous checks. Do not introduce a runtime test-login bypass.
Create GET / with a redirect to /notes and a public login page. The notes shell requires auth from P01 onward. Test route matching, invalid URL encoding, unknown routes, env parsing and actual startup. Log the actual bound address. Keep runtime data separate from source files. Provide installation and startup instructions. Do not start the editor, AI or Drive yet.

P01 · Sign-in and local notes

FR-01, FR-02; NFR-01–03, NFR-09; US-01, US-02, US-15; V01, V02

Requires: working P00. Build Google OAuth as the only login method with your own client configuration: POST /auth/google and GET /auth/google/callback. Check state and the Google profile, require signup consent and clearly handle denied access and missing configuration. Test the callback with a fake provider; verify real browser sign-in separately using your own Google test account. Do not add an alternative login route.
Create signed HttpOnly/SameSite=Lax sessions, secure in production, rotation at sign-in, logout and account-specific access. Protect APIs with 401 and browser pages with a login redirect. Do not hardcode a personal admin address.
Use data-structure.html for records and browser-store contracts. Build the local document store in IndexedDB, scoped to each account; do not reproduce the legacy browser-only database naming limitation. Create, open, edit and save simple notes with stable IDs and revisions. No note text or titles in server JSON or .md files. A later Drive contract may already shape the base version and queue, without partially working endpoints.
Prove two-account isolation, local persistence/reload and preservation after a network failure. Check the server data folder for a unique test sentence. Use synthetic content.

P02 · Editor, folders and navigation

FR-03–08, FR-16 local; NFR-04, NFR-06, NFR-07; US-01–04, US-08, US-14; V02–V06, V15

Requires: P01 and a tested IndexedDB store. Follow markdown-compatibility.html for node/mark/attribute defaults, plain export losses, safe image fallback and app-preserving round trips. Build ProseMirror with Markdown import/export, schema, marks, lists/task lists, tables, quotes, links, undo/redo, input rules, @ references and keyboard menus. Debounce saves; do not serialize the whole document on every keystroke. Test supported Markdown round trips, media references and tables. Enter on an empty quote line exits the quote.
Use the visual reference in prompt/design.html for layouts, colours, type and controls. Build a simple notes shell, note list, optional folders, renaming, nesting, dragging, multi-select with Shift/Cmd/Ctrl and immediate moves with targeted rollback on failure. A load token protects the most recently selected note and prevents duplicate editors. A deleted ID must not return because of a late response.
Global search covers notes and folders, not direct files or trash. In browser mode, current content may temporarily accompany the search request. A result opens that exact note with a fully initialized editor. Files keeps its own filter.
Delete permanently removes the selection after one confirmation; old trash items can be restored or erased separately. Implement Markdown import, individual export and ZIP export entirely in the browser.
Add light/dark mode, Cmd/Ctrl+K, New note/folder, Search, Markdown help, Settings and Log out. Menus close with Escape and restore focus. /upload, /drive, /youtube and /gemini may open a working integration only after that step is complete; otherwise show an honest unavailable state. /table, /canvas, /date, /datetime and /time follow their own available functionality.
Test keyboard operation, cursor/menu conflicts, stale selection, deletion during loading, desktop and mobile using BrowserOS Neo. Use clear, plain English and calm 1:1.618 proportions.

P03 · Files, playback and uploads

FR-09, FR-10, FR-17; NFR-02, NFR-05; US-09, US-10, US-11; V11/V16

Requires: P01/P02. Build /files with a list, pagination, source filter, file search, preview and download. Support audio/video, images, PDF and EPUB; annotations, playback position, labels and author belong to the account.
Implement byte-range streaming without loading entire files into RAM: normal, suffix and open-ended ranges; 206 with Content-Range/Accept-Ranges and 416 for invalid ranges. Use ffmpeg for cached thumbnails; show a placeholder without ffmpeg. Test seeking and resuming in the browser.
Create an upload adapter for Google Drive, the only external file storage. Drive storage is connected in P04. Test the adapter with a fake at this stage and state that explicitly. A local library may show existing test media, but do not build a new universal server upload archive to hide a missing Drive connection.
Enable the upload UI only with a valid source; otherwise show a clear status. Support chunks/resume, safe names, offsets, a name reservation before the first byte and repeatable finalization. Test two identical uploads at once, missing chunks and a lost finalization response. Do not overwrite an existing file.
Build the mandatory source-to-note flow with a fake Drive provider: /drive inline at the saved cursor, all file types, folders/search/pagination, one selection, request cancellation and original-source link. Write annotations as normal note content. Reopening uses the same source ID; inserting or removing a reference must issue no source upload/delete. Complete the live connection in P04; this flow is not deferred to P05.

P04 · Google Drive and safe automatic sync

FR-11–15, FR-16 migration, FR-17; NFR-01–05; US-05–08, US-09, US-11, US-14, US-15; V06–V10/V16

Use data-structure.html for the pending/base/token schema, Drive index allowlist and Markdown encoding. Requires: P01–P03, local store/revisions and meaningful fake Drive tests. Ask for the user's own OAuth configuration only when a real integration test is needed; store secrets outside Git. Implement the Google sign-in from P01 and separate Drive OAuth for browsing/uploads/notes. Show the connected Drive account and distinguish connected from active. Use FileLoveNote as the app folder; rename an old FilesandNotes folder only while preserving its ID and content.
Implement the concrete shared payload, result, limit and retry contracts in api-contracts.html; use fixtures/api-examples.json. Preserve existing-wire distinctions only where interoperability is required; implement the explicitly marked required rebuild corrections. Build an account-specific durable IndexedDB queue for notes AND folders, a base version, revision token, BroadcastChannel and exclusive write lock.
Read the cache before the network. POST /api/drive-notes receives known revisions and responds in batches of at most 40 with documents, the full revisions index and hasMore. Download only changed/missing content. A 503 or malformed Markdown is not an empty successful list; check missing IDs separately. Preserve new, unconfirmed local notes.
Push automatically through POST /api/drive-notes/push with upserts/deletes/folders and station:true. The server stores only an AES-256-GCM package and returns queued/ticket; then process at most eight Drive writes at once. Create required folders first and delete folders last. GET /api/drive-notes/push-ticket?ticket=... returns a waiting status or per-item results and cleans up completed packages. A ticket is not sync success. The browser removes only exactly acknowledged jobs. New text written during a push stays separately in the queue and is sent next.
Use base/local/Drive three-way merging and etags. Merge independent changes; if the same words were changed differently, create a verified conflict copy. A temporary network failure must not create a false conflict version. Do not overwrite without the correct base/revision. Written text and metadata must agree before an acknowledgement applies.
Sync after changes, on reconnect/return and periodically while visible. The Sync now button forces the queue. Show local state, pending item count, in progress, partial failure, retry and confirmed with a timestamp. Share persistent status per account. Pagehide keepalive is limited extra protection, not a replacement for the queue.
Connect the Drive picker/source flow and media upload adapter from P03. Complete V16/A01: existing GB source → insert → annotate → sync → reopen with the same file ID and zero insertion upload calls. Apply the exact disconnect, quota, revoked-permission and missing-source outcomes in failure-recovery.html. A new build needs no migration. With old data, prove receipt and read-back before deleting sources; status/read requests do not start migration. No server content cache or plaintext logging. Test server restart, tickets, two accounts, 429/503, lost responses, an etag race, unreadable notes and an incomplete Drive listing. A live Drive test using your own test account is separate evidence.

P05 · Full web extensions

FR-18–21; US-12, US-13, US-15, US-17; V12, V13

Requires: a tested web core. Build each extension separately and report its status. Keep missing credentials visible as an external dependency; ordinary notes must keep working.
1. Confirm the core FR-17 source-reference flow already works from P03/P04; do not postpone or rebuild it as an optional extension.
2. Canvas: create/edit/move text/note/media cards, connections, pan/zoom, per-account persistence and deletion. Slash /canvas works only after this implementation.
3. AI: explicit /gemini or note action with the current selected browser context; streaming output, cancellation and a visible error. No automatic paste translation, stored forced language or background sending of all notes. Build with a test double; ask for the user's own provider configuration only for live evidence.
4. /youtube: search and insert a source using the user's own configuration. Whisper: optional local transcription job and status; no crash without a binary/model. Do not use invented results.
5. Settings/account: connections, theme, logout, reset/deletion and admin rights through configuration. Implement the exact reset/deletion scope and export-or-discard choice in failure-recovery.html#deletion. Confirm destructive account actions and describe what is deleted inside/outside the app. Do not implicitly delete Drive data merely because the user logs out or disconnects.
Retest V12/V13 and relevant privacy/auth checks. Mark unbuilt extensions as open; do not present them as a complete web reconstruction.

P07 · Delivery and verifiable checks

All chosen requirements; NFR-09, NFR-10; Included verification scenarios where applicable

Requires: the chosen scope has been implemented. Reread all chosen requirements and stories. Execute A01–A12 against the fixed acceptance baseline, record raw performance samples, and follow the clean-folder setup instructions. Run the relevant scenarios from verificatie.html with synthetic data. In build-status.md, record for each FR/NFR: met/open/not chosen, linked US/V, test command, actual result and browser evidence. A test double does not count as live Google Drive or Google sign-in.
Check server data folders and logs for plaintext note content using a unique test sentence, including after search/AI and a server restart. Check deletion, account switching, tickets and failed sync. Preserve every unconfirmed local version.
Provide a README with installation, the user's own .env configuration, startup, tests, feature choices and known limits. Do not document secrets. Include .env.example and the lockfile.
Provide deployment instructions for HTTPS, secure cookies, the user's own Google OAuth, persistent APP_DATA_DIR outside the checkout and the backup/restore matrix in setup-operations.html. Verify recovery with synthetic data and reconcile old delete jobs before enabling writes. Do not promise zero data loss. Do not publish without a separate instruction.
Report clearly: what works locally, what was tested with fakes, which real integrations were verified and which deployment was not performed. The app is complete only for the explicitly chosen scope and the criteria that actually passed.

Prompt for a failed step

Stay in the current build step. Investigate the first concrete error in the test or browser output. State the cause and relevant requirement ID. Add a small regression test where useful, fix only the cause and rerun the affected checks. Do not erase a browser store, queue or other user data to make a test pass. Update build-status.md with actual evidence before continuing.

Prompt for a new chat session

Read prompt/ and the existing build-status.md in this new project. Inspect git status and the relevant code. Do not treat claims from a previous session as fresh evidence. Report the chosen scope, reached phase, open requirements and next check. Resume the first incomplete phase while preserving existing work. Run focused tests before marking a step complete.