This page holds every rule your AI assistant needs to get your project ready for Ai to App. You do not have to read it; just give your assistant the message below.

Read the guide at https://aitoapp.com/upload-guide. Get my project ready for Ai to App by following it, go through the checklist item by item and prepare the zip file.

Ai to App reviews and publishes websites and apps that are uploaded as zip files. Uploaded files are not executed during the review. Server applications run live in their own isolated space, separate from other projects. This guide contains all the rules needed for your project to pass the first upload without problems.

1. Determine the Project Type

Ai to App detects the type itself from the files inside the zip. If more than one type matches, the order below applies; the one higher up wins.

Important:

• For built sites (React, Vue, Vite, Angular, Svelte, Astro), run npm run build first. Zip the files INSIDE the resulting dist (or build) folder. index.html must be directly in the root of the zip.
• Go projects are published only with a Dockerfile.
• docker-compose is not supported; only the main application (Dockerfile) runs. Ai to App provides the database separately (see Section 4).

2. Zip Rules

Limits

Folder Structure

• The project files must be in the root of the zip or inside a single top-level folder.
• For a static site, index.html must be in the root of the zip or inside the single top-level folder.
• Two files at the same path and unsafe paths containing ../ are not accepted.

Do NOT Put in the Zip (automatically discarded, only wastes space)

• Dependencies: node_modules, .venv, venv, __pycache__, bower_components, .pytest_cache, .mypy_cache
• Tool and version control folders: .git, .svn, .hg, .idea, .vscode, .vs, .cache, .turbo, .parcel-cache, .gradle
• Build output: .next, .nuxt, .svelte-kit. In .NET, also bin and obj.
• System files: __MACOSX, .DS_Store, Thumbs.db, desktop.ini, *.pyc

NEVER Put in the Zip (discarded and not stored)

• .env files: such as .env, .env.local, .env.production. Example files may stay: .env.example, .env.sample, .env.template. If your zip has a .env, the file is not stored; only public values with the VITE_, NEXT_PUBLIC_, PUBLIC_, REACT_APP_ prefixes go to the build. Enter secrets in the panel.
• Key and credential files: *.pem, *.key, *.p12, *.pfx, *.ppk, *.jks, *.keystore, id_rsa, id_ed25519, .npmrc, .pypirc, .netrc. If any of these was shared before, rotate the key.

Files That Stop the Upload

• In application source: Windows script and installer files (.bat, .cmd, .ps1, .vbs, .scr, .msi). Compiled program files (.exe, .dll, .so and similar) are discarded; the server builds the project from source.
• In a static site:
  • Server code and executable files are forbidden: .php, .py, .rb, .pl, .cgi, .asp, .aspx, .cshtml, .jsp, .exe, .dll, .sh, .jar, .htaccess, .config.
  • Allowed types: .html, .htm, .css, .js, .mjs, .json, .webmanifest, .txt, .xml, .csv, .svg, .png, .jpg, .jpeg, .gif, .webp, .avif, .ico, .bmp, .woff, .woff2, .ttf, .otf, .eot, .mp4, .webm, .mp3, .ogg, .wav, .pdf.
  • .map and .md files are skipped.

3. Required Settings for Server Applications

Port and Address

Ai to App provides the port the application must listen on through the PORT environment variable. The application must bind to the address 0.0.0.0; localhost or 127.0.0.1 cannot be reached from outside.

Start Command

• Node.js:
  • The start script in package.json must start the production server, e.g. "start": "node server.js".
  • Development commands must NOT be in start: vite, next dev, nodemon, ts-node-dev, tsx watch, webpack serve, react-scripts start, npm run dev. Leave these in the dev script.
  • TypeScript: Add "build": "tsc" and set "start": "node dist/index.js". Compiling TypeScript at run time is slow.
  • Include the lock file (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lockb) in the zip.
  • Specify the Node version with package.json → engines.node or .nvmrc.
• Python:
  • FastAPI, Flask, Django, Streamlit and Gradio are detected automatically.
  • If you use a different structure, create a Procfile in the root: web: <start command>. The command must use 0.0.0.0 and $PORT.
  • Flask: gunicorn must be in requirements.txt.
  • Django: ALLOWED_HOSTS must not be empty, DEBUG = False must be set, and SECRET_KEY must be read from an environment variable.
  • Specify the Python version with runtime.txt or .python-version.
• .NET: There must be a .csproj in the root. Ai to App builds with dotnet publish -c Release; the target version is read from TargetFramework in the .csproj.
• Dockerfile: Specify the application's port with EXPOSE. The application must still read the PORT variable.

4. Database

Ai to App sets up the database itself and provides the connection details through an environment variable. Do not hard-code the connection address; read it from the variable below.

• Prisma: Include the prisma/migrations folder in the zip; otherwise the tables may not be created automatically.
• Alembic: If alembic.ini exists, alembic upgrade head runs automatically before publishing.
• SQLite file: The SQLite file in the zip is used only as starting data on the first publish; later uploads do not overwrite live data. Do not put a test database containing personal data in the zip.
• Updates: When you upload a new version, the data in the database is preserved.

5. Persistent Files

The disk of the space where the application runs is not persistent; it is wiped on every new publish. The only persistent folder is /data.

• Save photos and documents uploaded by visitors, generated files and the SQLite database under /data.
• Read the folder path from the DATA_DIR environment variable; Ai to App sets it to /data for you.

6. Secrets and Environment Variables

• Do not hard-code passwords, API keys and tokens; read them from environment variables. You enter the values in the Ai to App dashboard; they are stored encrypted.
• Public prefixes: Variables with the prefixes VITE_, NEXT_PUBLIC_, REACT_APP_ and PUBLIC_ are embedded in the code at build time and every visitor can see them. Do not put secret values in these.
• Login system (NextAuth / Auth.js): NEXTAUTH_URL (or AUTH_URL) must be the real address of the site, and NEXTAUTH_SECRET (or AUTH_SECRET) must be filled in.
• OAuth (Google, GitHub): Add the published address as an authorized redirect URI in the provider's settings.
• Supabase sign-in: In Supabase, under Authentication > URL Configuration, set Site URL to your published address and add the exact address to Redirect URLs (https://your-app.aitoapp.com/). Otherwise links in confirmation and sign-in emails go to localhost:3000 and sign-in does not complete. For Google sign-in, in Google Cloud add your published address to Authorized JavaScript origins and https://PROJECT.supabase.co/auth/v1/callback to Authorized redirect URIs.
• Variables Ai to App provides itself: PORT, HOST=0.0.0.0, DATA_DIR=/data and the database variables (Section 4). In Node.js, NODE_ENV=production.

7. What Must Not Be in the Code

• localhost addresses: Code that sends requests to http://localhost:... or http://127.0.0.1:... will go to the visitor's own computer once published and will not work. Read the address from an environment variable (e.g. import.meta.env.VITE_API_URL) or, if it is on the same server, use a relative path (fetch('/api/...')).
• /api/... requests in a static site: A static site has no server behind it. If you need an API, prepare the project as a single server application (e.g. Express) that runs together with its API.
• Fixed port: const PORT = 3000 must not stand alone; use process.env.PORT || 3000.
• Debug mode: debug=True or DEBUG = True must not be on in production.
• Secrets embedded in code: Any key found there is considered shared; rotate it.

8. Checklist for the Assistant

• The project type has been determined (Section 1).
• If it is a built site, the build was run and only the inside of the dist / build / out folder was zipped; index.html is in the root.
• If it is a server application, the start script (or Procfile) starts the production server.
• The port is read from the PORT environment variable; the server binds to 0.0.0.0.
• No localhost / 127.0.0.1 address is left in the code.
• Passwords and keys have been removed from the code; they are read from environment variables.
• The database connection is read from DATABASE_URL / MONGODB_URI / REDIS_URL / DATABASE_PATH.
• Persistent files are written under /data.
• A lock file is present (package-lock.json etc.).
• node_modules, .git, .venv, .next, bin, obj, .env and key files are NOT in the zip.
• The zip is under 50 MB and each single file is under 25 MB; at most 2000 files.

9. When You Are Done, Tell Me the Following

1. The exact location of the prepared zip file.
2. The type of the project and the language or framework used (e.g. "Node.js + Express").
3. The list of environment variables I need to enter in the dashboard: the name of each and what it is for. Do not write the values; I will enter them.
4. A short summary of the changes you made.

If there is a problem after you upload the zip, Ai to App explains it in plain language; paste that text into your assistant.