How it fits together
Why the token never reaches the browser, why the code is copied in rather than installed, where the content comes from, and what a caller past the gate may still do.
Four facts decide almost everything else about the app the wizard writes.
A Chatfuel token can read and change every bot in an account, so it never reaches the browser.
Nothing in the project's package.json points back at our repository, so the design system, the
API client and the proxy are copied in as source instead. The package you install carries none of
that source — it arrives over the network, checked against a digest, on the run that needs it. And
the CLI is gone once it has run, so every convention below had to be one you can live with without
us.
These pages are the reasons. The values — flags, variable names, error codes — live in Reference.
Architecture
Three things with three lifetimes: a CLI that writes an app, an app you own, and the API it talks to.
The token boundary
Why every call goes to your own origin first, and what a VITE_ prefix really means.
Vendoring, not depending
The design system and the client arrive as source. What that buys you, and what it costs.
Where the content comes from
The package holds a commit and a digest per file, not the files. What that means for what you install.
Modules
A directory, a manifest and a React tree — plus two tables that register it.
Routing
The shell owns the address bar; a module never touches window.location.
State
A pure reducer, a useReducer binding and a throwing context. No state library.
The auth gate
Two fences answering different questions, both failing closed.
Ceilings and fences
The gate says who may call. This is what a caller who got past it may actually do.
Agent skills
Why the app arrives with notes for the coding agent that continues the work.