demo(recipe): vanilla recipe app on the Firebase JS SDK

recipe-demo/.env.local.example

@@ -0,0 +1,9 @@
+# Emulators are the default. Set to false to run against a real project.
+NEXT_PUBLIC_USE_EMULATORS=true
+
+# With emulators on, only the project id matters and it must match whatever the
+# emulator suite was started with (npm scripts at the repo root use rxfire-525a3).
+NEXT_PUBLIC_FIREBASE_PROJECT_ID=rxfire-525a3
+NEXT_PUBLIC_FIREBASE_API_KEY=fake-api-key
+NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=
+NEXT_PUBLIC_FIREBASE_APP_ID=

recipe-demo/.gitignore

@@ -0,0 +1,5 @@
+node_modules
+.next
+next-env.d.ts
+*.tsbuildinfo
+.env.local

recipe-demo/AGENTS.md

@@ -0,0 +1,9 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

recipe-demo/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

recipe-demo/firestore.rules

@@ -0,0 +1,43 @@
+// Rules for this demo's data model. NOT the rules the local emulator loads:
+// the repo root's firebase.json points at the root firestore.rules, which is
+// open by design because reactfire's own test suite depends on it. Deploy these
+// to whichever project the demo runs against.
+rules_version = '2';
+
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /recipes/{recipeId} {
+      allow read: if true;
+
+      // The list is server-rendered, so one document missing an array field
+      // fails the whole homepage rather than one card. The shape is enforced
+      // here because `toRecipes` casts to Recipe without checking.
+      allow create: if request.auth != null
+                    && request.resource.data.keys().hasOnly(
+                         ['title', 'cuisine', 'ingredients', 'steps', 'likedBy', 'createdAt'])
+                    && request.resource.data.keys().hasAll(
+                         ['title', 'cuisine', 'ingredients', 'steps', 'likedBy', 'createdAt'])
+                    && request.resource.data.title is string
+                    && request.resource.data.cuisine in
+                         ['Italian', 'Japanese', 'Mexican', 'Indian', 'French']
+                    && request.resource.data.ingredients is list
+                    && request.resource.data.steps is list
+                    && request.resource.data.createdAt is timestamp
+                    && request.resource.data.likedBy == [];
+
+      // Signed-in users may only ever add or remove their own uid from likedBy.
+      // The set difference is blind to duplicates, so the size check is what
+      // stops a uid being written many times to inflate the count.
+      allow update: if request.auth != null
+                    && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['likedBy'])
+                    && request.resource.data.likedBy.size() ==
+                       request.resource.data.likedBy.toSet().size()
+                    && request.resource.data.likedBy.toSet().difference(resource.data.likedBy.toSet())
+                       in [[].toSet(), [request.auth.uid].toSet()]
+                    && resource.data.likedBy.toSet().difference(request.resource.data.likedBy.toSet())
+                       in [[].toSet(), [request.auth.uid].toSet()];
+
+      allow delete: if false;
+    }
+  }
+}

recipe-demo/next.config.ts

@@ -0,0 +1,5 @@
+import type { NextConfig } from 'next';
+
+const nextConfig: NextConfig = {};
+
+export default nextConfig;