@vibes.diy/prompts 14.0.14 → 14.0.16

package/llms/backend.md

@@ -815,6 +815,22 @@ export async function scheduled(event, ctx) {
 }
 ```
 
+The run's own bookkeeping is the server's, not a user's. `scheduled` acts as the
+app owner, so `user.isOwner` is the one condition that separates a run's write
+from a client pretending to be one — and `access.js` is where that is said:
+
+```js
+// access.js
+export default function ({ doc, user }) {
+  if (doc.type === "runState" || doc.type === "runStatus") {
+    if (!user?.isOwner) throw { forbidden: "the run writes its own state" };
+    return { channels: ["show"] };
+  }
+  // …the app's own document types…
+  throw { forbidden: "unknown document type" };
+}
+```
+
 App.jsx reads the same database, and renders that status beside the drafts, so a
 failed run and a good one never look alike:
 
@@ -853,6 +869,20 @@ export async function onChange(event, ctx) {
 export async function scheduled(event, ctx) {
   // Acts as the app owner — access.js allows `digest` docs for the owner only,
   // making this document genuinely server-controlled.
-  await ctx.db.put({ _id: "digest", kind: "digest", updatedAt: event.scheduledTime }, { db: "digest" });
+  //
+  // What this tick already did is read BY ID, never re-derived from a scan, and
+  // the sweep is bounded by what is NEW rather than by how big the app has grown.
+  const state = await ctx.db.get("digest:state", { db: "digest" });
+  const since = state?.throughSeq ?? 0;
+  const fresh = await ctx.db.query({ db: "activity", field: "at", range: [since + 1, Number.MAX_SAFE_INTEGER], limit: 200 });
+  if (fresh.length === 0) return; // nothing happened — write nothing at all
+
+  const throughSeq = fresh.reduce((max, doc) => (doc.at > max ? doc.at : max), since);
+  const next = { _id: "digest", kind: "digest", headline: `${fresh.length} new notes`, throughSeq };
+  const existing = await ctx.db.get("digest", { db: "digest" });
+  if (existing?.headline === next.headline && existing?.throughSeq === next.throughSeq) return; // unchanged
+
+  await ctx.db.put(next, { db: "digest" });
+  await ctx.db.put({ _id: "digest:state", type: "digestState", throughSeq }, { db: "digest" });
 }
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "14.0.14",
+  "version": "14.0.16",
   "type": "module",
   "main": "./index.js",
   "exports": {
@@ -34,9 +34,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "14.0.14",
-    "@vibes.diy/identity": "14.0.14",
-    "@vibes.diy/use-vibes-types": "14.0.14",
+    "@vibes.diy/call-ai-v2": "14.0.16",
+    "@vibes.diy/identity": "14.0.16",
+    "@vibes.diy/use-vibes-types": "14.0.16",
     "arktype": "~2.2.3",
     "json-schema-faker": "~0.6.3"
   },