Virtual Restyle — Base44 white-label build (Phase 2) — 2026-07-11

LIVE + remixable: https://virtual-restyle.base44.app · app 6a526acda9e181b2df0d8c04 · slug virtual-restyle

What this is

The clone-and-distribute Base44 version of virtualrestyle.com. Sondra imported the GitHub repo into Base44 (pages/design came over, backend didn't); Claude finished it as a fully working native Base44 app per her build spec.

Built + verified this session

• stageRoom backend fn — auth → structure guard → credit check → Gemini

gemini-2.5-flash-image image-EDIT (model overridable via GEMINI_IMAGE_MODEL secret) → upload result → Staging row → spend 1 credit AFTER success. Prompts ported from the live app incl. the 07-11 removal fix (rebuild revealed floor/wall, never reshape property).

• credits backend fn — ensures 3 free credits on first login, returns balance.
• Entities w/ enforced granular rls (verified live on the platform, NOT the shorthand trap):
• Staging: create signed-in-only, read/update/delete created_by == {{user.email}}
• CreditBalance: read own row (data.user_email) or admin; create/update/delete admin-only
• Feedback: create signed-in-only; read/update/delete admin-only
• Frontend: RoomUploader → upload + invoke stageRoom (7 room types / 8 styles per spec);

before/after slider; Change-one-thing edit loop (6 chips + free text); MLS Compliance Kit (canvas-burned "Virtually Staged" pill + Download Original + disclosure copy button + caption note); Gallery (own rows, click → before/after modal w/ kit); Pricing → "How credits work"; Landing honesty pass (no invented claims, credits section, no Unsubscribe); Feedback → entity; Admin page (user.role === 'admin' — first signup on a clone becomes their own admin): balances table + grant credits + feedback inbox; brand config in ONE file src/config/brand.js; old Login/Register/Forgot/Reset/Unsubscribe pages + orphan components deleted; sonner toaster mounted; hosted-login redirect fixed (app.base44.com/login?app_id=… — new hosting doesn't serve /login on the app domain).

• Secret set: GEMINI_API_KEY (hers). Clones need their own — the UI says exactly that

if missing ("Dashboard → Settings → Secrets").

Proof run (all machine-verified)

• Real staging: vacant-room photo → furnished in 11s, structure preserved (visual check),

credit 3→2. Edit "remove the rug": rug gone, floor rebuilt seamlessly, 12s, credit 2→1, is_edit + parent_staging_id correct.

• Structure guard: "make the room bigger" → 422 + MLS-safe message, no credit spent

(client AND server). "add a floor lamp"-class phrases pass (guard ported from live app's 18-case-tested regex).

• Zero credits → 402 refusal. Admin grant (client-side as admin) works.
• Anonymous: functions 401; entity reads return [] despite rows existing (RLS filtering

proven); entity writes 403 (tightened this session — anon create was initially possible on Staging/Feedback, fixed + re-verified).

• Live bundle serves master app id + new code; entities + functions verified in final state.

Sondra's 2 taps

1. Second-account check: sign in at virtual-restyle.base44.app with any non-owner

account (Google login is on) → gallery EMPTY, credits pill = own 3. (Email-OTP signups weren't delivering during the build; Turnstile blocked automated signup, so this last cross-user eyeball is manual.)

2. Flow eyeball: stage a room → try "make the room bigger" (refused, no credit) →

download watermarked staged + original + copy disclosure.

For future sessions (gotchas — also added to the base44-workflow skill)

• ⚠ entities push / site deploy WIPES the function registry → `npx base44 functions

deploy` must be the LAST deploy command, always. Functions 404? That's why.

• Function source ALSO lives in the sandbox at src/functions/*.js (clones copy source).
• Hosted login on this newer hosting = https://app.base44.com/login?app_id=<id>&from_url=<url>.
• Windows CLI commands via npx are capped ~8k chars (cmd.exe) — sandbox file pushes are

chunked base64 (scratchpad push_sandbox.py pattern).

New-owner instruction sheet (for clone distribution)

1. Remix the app → open your copy.
2. Dashboard → Settings → Secrets → add GEMINI_API_KEY (free key from Google AI Studio).
3. Publish once (fresh clones show "waiting to shine" until Publish is clicked).
4. Sign in first — the first account becomes admin (Admin page: grant credits, read feedback).
5. Rebrand in one file: src/config/brand.js (name, tagline, support email).

Known limitations (deliberate, per spec)

• No structure-drift judge (live app has one; spec said no unrequested features) — Gemini

occasionally adds curtains/implied windows; the upgrade path is the live app's judge+retry.

• Credit decrement is read-then-write (ponytail: noted in code) — fine for a no-payments

template; switch to atomic $inc via updateMany if credits ever become paid.

• Landing/showcase images hot-link virtualrestyle.com assets (kept per keep-the-design rule) —

clones depend on that domain staying up; swap to uploaded assets if that ever bothers her.

• One invisible orphan Staging row from a pre-fix anon probe (unreadable by anyone, harmless).
• Her admin CreditBalance left at 25 (from testing).

Local working copy: PROJECTS/Virtual Restyle/base44-app/ (mirror/ = source, clone/ = build copy, verify/ = proof screenshots incl. original/staged/edit images + live landing). Sandbox checkpoints: before Virtual Restyle native build → verified native build v1.