# User Guide

## Roles and entry points

- **Admin** users create projects, manage credentials and users, inspect execution history, and publish applications.
- **User** users open restricted published applications and manage their own local password/profile.
- Public applications can be opened without signing in.

A fresh installation creates its first administrator in the browser. Later accounts are managed from **Users**.

## Building an application

1. Create or load a project in **Visual Editor**.
2. Use **Pages** to add, duplicate, reorder, name, slug, hide, default, or delete pages.
3. Add components from the palette and configure the selected component in the inspector.
4. Define variables, REST actions, credentials, and response bindings in **Actions & Bindings**.
5. Configure Button action/navigation events and page `onLoad`/`onEnter` lifecycle actions.
6. Use **Preview** to exercise the application without changing canonical saved state.
7. Save or update the project.
8. Publish from **Publishing** as public or restricted.

Public publications may use only anonymous actions. Restricted publications may use backend-held credentials. Publishing creates an immutable snapshot; edit/save and republish to release changes.

## Variable and component scope

Component names are local to a page. The same name may be reused on different pages. Global variables are available throughout the app; page variables belong to one page. Values persist while navigating in one loaded session and reset on full reload.

## Lifecycle behavior

- `onLoad`: first entry to that page during the loaded session.
- `onEnter`: subsequent entry when returning to the page.

## JSON Editor

The JSON Editor edits the same canonical document as the Visual Editor. Validate and apply before saving. Invalid JSON or semantic references do not replace the last valid in-memory document.

## Credentials

Credential values are submitted to encrypted server-side storage and are never displayed again. Projects contain opaque secret references, not values. Replacing a credential requires entering the new value twice where applicable.

## Published URLs

- `/apps/<app-slug>` opens the default page.
- `/apps/<app-slug>/<page-slug>` is a refreshable page deep link.

Hiding a page removes it from automatic navigation; it is not an authorization rule.