@vibes.diy/prompts 14.1.16 → 14.1.17

package/llms/backend.js

@@ -1,7 +1,7 @@
 export const backendConfig = {
     name: "backend",
     label: "backend-js",
-    description: "server-side backend.js file: answer HTTP/webhook requests at the app's /_api URL, react to committed data changes, and run scheduled jobs — its writes go through the app's own access rules; sends a record on to another service through a Zapier Catch Hook when the person asks for Zapier",
+    description: "server-side backend.js file: answer HTTP/webhook requests at the app's /_api URL, react to committed data changes, and run scheduled jobs — its writes go through the app's own access rules; reads a web page, feed or API the person names and hands it to the page through /_api; sends a record on to another service through a Zapier Catch Hook when the person asks for Zapier",
     cues: ["zapier", "catch hook"],
 };
 //# sourceMappingURL=backend.js.map

package/llms/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../jsr/llms/backend.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,YAAY;IACnB,WAAW,EACT,gSAAgS;IAMlS,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;CAC/B,CAAC"}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../jsr/llms/backend.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,YAAY;IACnB,WAAW,EACT,uXAAuX;IAMzX,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;CAC/B,CAAC"}

package/llms/backend.md

@@ -601,6 +601,81 @@ From `App.jsx`, call it with a relative fetch — no host needed:
 const res = await fetch("/_api/rsvp", { method: "POST", body: JSON.stringify({ name }) });
 ```
 
+### Reading a page the person names — the `/_api` proxy
+
+A page the person names is read in `backend.js` and handed to the app through `/_api`. A browser
+reaches its own app and the hosts that publish CORS headers, so an ordinary web page — somebody's
+homepage, a blog post, a competitor's landing page — is readable from a handler and from nowhere
+else. This is the shape for every "scan this site", "check this URL", "summarize this page" ask:
+the handler takes the address, reads it with `ctx.fetch`, strips the markup to text, and answers
+with what it measured. Repeat reads of the same address come back from the read cache (about five
+minutes), so a person re-scanning a site pays for one read.
+
+The handler settles the address before reading it. The platform reads `https:` hosts, so an
+address typed without a scheme, or with `http:`, is normalized to `https:` and anything else comes
+back as a stated refusal rather than a thrown handler — a refusal the app can show is worth more
+than a policy error the app has to guess at.
+
+`ok` means TEXT CAME BACK. A 200 that strips to nothing — a page that renders itself in the
+browser, a consent wall, a host answering with an empty body — is a read that produced no page, so
+it answers `ok: false` with a reason. That is what makes `page.ok` a sound thing for the app to
+branch on: a score or a summary is only ever computed from text the handler actually returned.
+
+backend.js
+
+```js
+export async function fetch(request, ctx) {
+  const url = new URL(request.url);
+  if (url.pathname === "/page") {
+    const typed = (url.searchParams.get("url") ?? "").trim();
+    let parsed;
+    try {
+      parsed = new URL(/^[a-z]+:/i.test(typed) ? typed : `https://${typed}`);
+    } catch {
+      return Response.json({ ok: false, reason: "that does not look like a web address" }, { status: 400 });
+    }
+    // The platform reads https hosts, so http is normalized rather than refused.
+    if (parsed.protocol === "http:") parsed.protocol = "https:";
+    if (parsed.protocol !== "https:") {
+      return Response.json({ ok: false, reason: "only web pages can be read" }, { status: 400 });
+    }
+    const res = await ctx.fetch(parsed.href, { headers: { accept: "text/html" } });
+    const html = await res.text();
+    // Script and style bodies first — their contents are not page text — then the tags themselves.
+    const text = html
+      .replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi, " ")
+      .replace(/<[^>]+>/g, " ")
+      .replace(/\s+/g, " ")
+      .trim()
+      .slice(0, 20000);
+    // A page that came back with no readable text is a read that produced no page.
+    if (res.ok === false || text.length === 0) {
+      const reason = res.ok ? "that page returned nothing we could read" : `that page answered ${res.status}`;
+      return Response.json({ ok: false, status: res.status, reason });
+    }
+    const title = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(html)?.[1]?.trim() ?? "";
+    return Response.json({ ok: true, status: res.status, title, text });
+  }
+  return new Response("not found", { status: 404 });
+}
+```
+
+From `App.jsx`, the page asks the handler for the address it was given:
+
+```js
+const res = await fetch(`/_api/page?url=${encodeURIComponent(url)}`);
+const page = await res.json();
+if (page.ok === false) {
+  setResult({ read: false, reason: page.reason });
+  return; // nothing is scored, summarized or graded from a page that was not read
+}
+setResult({ read: true, ...(await scorePage(page.title, page.text)) });
+```
+
+The refusal lands where the result would have gone — "we could not read that page: it returned
+nothing we could read" — so the person sees the read fail instead of a number computed from
+nothing.
+
 ## onChange — react to committed writes
 
 **When the request says a record is kept on the server, or that the server reacts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "14.1.16",
+  "version": "14.1.17",
   "type": "module",
   "main": "./index.js",
   "exports": {
@@ -34,9 +34,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "14.1.16",
-    "@vibes.diy/identity": "14.1.16",
-    "@vibes.diy/use-vibes-types": "14.1.16",
+    "@vibes.diy/call-ai-v2": "14.1.17",
+    "@vibes.diy/identity": "14.1.17",
+    "@vibes.diy/use-vibes-types": "14.1.17",
     "arktype": "~2.2.3",
     "json-schema-faker": "~0.6.3"
   },

package/system-prompt-initial-oneshot.md

@@ -188,6 +188,10 @@ When someone reports that their app won't open ("App not available", a blank scr
 
 Static assets. Files the maker added in the Files tab (or pushed with the CLI) are part of the app and are listed in the context as `assets:`. Reference them by absolute path from the app root — `<img src="/logo.png" alt="…">`, `<audio src="/intro.mp3">`, `fetch("/data.csv")` — never by an external URL and never by inlining bytes. If the maker asks for an image the app does not have, say which file to add rather than inventing a path.
 
+### Reading a page the person names
+
+When an app works on the contents of a URL the person types — scanning it, checking it, scoring it, summarizing it — that address is read server-side: a `backend.js` `fetch` handler reads it with `ctx.fetch` and the page asks `/_api/…` for the text, because a page in a browser reaches its own app and the hosts that invite it. If that read comes back empty or fails, the app says so where the result goes, before anything worked out without it appears.
+
 ## End every turn with one improvement question
 
 After your code edits, end your response with exactly ONE short improvement question and 2–4 multiple-choice options.

package/system-prompt-initial.md

@@ -190,6 +190,10 @@ When someone reports that their app won't open ("App not available", a blank scr
 
 Static assets. Files the maker added in the Files tab (or pushed with the CLI) are part of the app and are listed in the context as `assets:`. Reference them by absolute path from the app root — `<img src="/logo.png" alt="…">`, `<audio src="/intro.mp3">`, `fetch("/data.csv")` — never by an external URL and never by inlining bytes. If the maker asks for an image the app does not have, say which file to add rather than inventing a path.
 
+### Reading a page the person names
+
+When an app works on the contents of a URL the person types — scanning it, checking it, scoring it, summarizing it — that address is read server-side: a `backend.js` `fetch` handler reads it with `ctx.fetch` and the page asks `/_api/…` for the text, because a page in a browser reaches its own app and the hosts that invite it. If that read comes back empty or fails, the app says so where the result goes, before anything worked out without it appears.
+
 ## End every turn with one improvement question
 
 After your code edits, end your response with exactly ONE short improvement question and 2–4 multiple-choice options.

package/system-prompt.md

@@ -752,6 +752,10 @@ When someone reports that their app won't open ("App not available", a blank scr
 
 Static assets. Files the maker added in the Files tab (or pushed with the CLI) are part of the app and are listed in the context as `assets:`. Reference them by absolute path from the app root — `<img src="/logo.png" alt="…">`, `<audio src="/intro.mp3">`, `fetch("/data.csv")` — never by an external URL and never by inlining bytes. If the maker asks for an image the app does not have, say which file to add rather than inventing a path.
 
+### Reading a page the person names
+
+When an app works on the contents of a URL the person types — scanning it, checking it, scoring it, summarizing it — that address is read server-side: a `backend.js` `fetch` handler reads it with `ctx.fetch` and the page asks `/_api/…` for the text, because a page in a browser reaches its own app and the hosts that invite it. If that read comes back empty or fails, the app says so where the result goes, before anything worked out without it appears.
+
 ## End every turn with one improvement question
 
 After your code edits, end your response with exactly ONE short improvement question and 2–4 multiple-choice options.