@vibes.diy/prompts 14.1.25 → 14.1.26

package/llms/access.md

@@ -230,6 +230,20 @@ export function chat(doc, oldDoc, user, ctx) {
 
 **A follow-up edit that adds a NEW doc type updates `access.js` FIRST.** The app runs live while your edits stream in, and writes are enforced against the access.js that was in force before this turn until the whole turn completes — so a `db.put` of a doc type the old function rejects fails immediately (`unknown document type`), even though your access.js update lands later in the same reply. Emit the access.js edit adding the new type's branch before the App.jsx edits that write it. And never fire-and-forget background writes of a newly added type: gate seed/auto-write effects on `useVibe(dbName)` — `if (!ready || !can.create(sampleDoc).ok) return;` with `ready`/`can` in the effect deps, checking a representative sample of **each** doc type the effect writes — so a not-yet-allowed write is skipped quietly instead of surfacing rejection errors the user didn't cause.
 
+### Reconciling `seed.json` when you write or change `access.js`
+
+An app usually gets its `seed.json` on an earlier turn than its `access.js`. So when you add or change an access function, you are almost always meeting a seed file that was written before any of these rules existed — **and the seed is yours to bring into line, not the other way round.** The access function is the constraint; the seed is a sample of the data. When a sample violates a constraint, change the sample.
+
+This matters beyond the import itself. The app's `seed.json` stays in your context on every later turn, so it is what a future turn reads to learn the app's document shape. A seed that disagrees with the access function teaches the wrong shape to every turn that follows.
+
+So, in the same turn as the access edit and after it:
+
+- **Re-emit `seed.json` to fit the function.** Drop items whose `type` the function does not authorize, and add to each remaining item the field its branch actually routes on — the channel-determining id, the author handle, whatever an `audience` reads. A seed item missing that field is denied `unknown document type` when the owner applies the import, and the same gap resurfaces as a hard error the moment the running app writes that type.
+- **Never add a branch to `access.js` just to admit a seed item.** A branch exists because the app writes that type. If a seed item's type appears nowhere in the app's own code, delete the item — do not widen the permission model to let example data through.
+- **Keep every explicit `_id` byte-identical.** Seed items that other items reference, and well-known singletons (`config:profile`, `settings:sharing`), carry an explicit `_id` that the app's code matches literally. Renaming one during a reconcile breaks that lookup in `App.jsx` and orphans any document an owner already imported, in a single edit. Keep the `key` slugs stable for the same reason — the platform derives idempotency from them.
+
+If the reconcile removes every item, **still emit `seed.json`, containing `{}`**. Omitting the file does NOT delete it — a file your turn does not touch is carried forward from the previous version verbatim, so leaving `seed.json` out preserves exactly the stale, unauthorized seed you were removing. An empty object is a valid seed and replaces it.
+
 ### Ending the function: terminal denial (the default) vs. the discard channel
 
 Every access function ends by handling the doc types it knows and **denying everything else**. The **default** ending — closing every worked example below — is the terminal `throw { forbidden: "unknown document type" }`: fail-closed, and loud. If the app later writes a type nobody added a branch for, the write is rejected with a visible error, so type-enumeration drift surfaces instead of silently corrupting the data model. **Reach for the throw unless you have a specific, named reason not to.**

package/llms/bluesky.d.ts

@@ -0,0 +1,2 @@
+import type { LlmConfig } from "./types.js";
+export declare const blueskyConfig: LlmConfig;

package/llms/bluesky.js

@@ -0,0 +1,15 @@
+export const blueskyConfig = {
+    name: "bluesky",
+    label: "Bluesky public data",
+    description: "Reading PUBLIC Bluesky data with no credential of any kind: the unauthenticated XRPC host, profiles, follows and followers, an account's own feed, actor search, why post search is not available without a session, checking a response's status before parsing it because a refusal comes back as HTML, and paging on the cursor rather than on emptiness",
+    cues: [
+        "bluesky",
+        "bsky",
+        "at protocol",
+        "atproto",
+        "my bluesky followers",
+        "bluesky profile",
+        "bluesky feed",
+    ],
+};
+//# sourceMappingURL=bluesky.js.map

package/llms/bluesky.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bluesky.js","sourceRoot":"","sources":["../../jsr/llms/bluesky.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,qBAAqB;IAC5B,WAAW,EACT,6VAA6V;IAC/V,IAAI,EAAE;QACJ,SAAS;QACT,MAAM;QACN,aAAa;QACb,SAAS;QACT,sBAAsB;QACtB,iBAAiB;QACjB,cAAc;KACf;CACF,CAAC"}

package/llms/bluesky.md

@@ -0,0 +1,343 @@
+# Bluesky — public profiles, follows and feeds, with no login
+
+When someone asks to look at Bluesky — a profile card, who somebody follows, a
+wall of an account's posts, a search for people — build it on the **public
+AT Protocol XRPC host**, `https://public.api.bsky.app/xrpc`. Every endpoint on
+this page answers an anonymous request. This is a `backend.js` feature (see the
+backend docs for the general handler contract); this page is the recipe that
+keeps it credential-free, honest about what the host refuses, and correct about
+paging.
+
+## 1. No credential, ever — and why this is not a connection
+
+Bluesky's public API needs no login, so the app renders no token field, no password box and no sign-in step.
+
+There is no API key to get, no app password to paste, no OAuth redirect and no
+`ctx.secrets` entry. `public.api.bsky.app` reads **public data about any
+account** — the same data an anonymous visitor to bsky.app can see — and it
+reads it for anybody who asks. An app that grows a "Bluesky app password" input
+has invented a requirement the API does not have, and has put a credential in a
+readable channel for nothing.
+
+**This is public data about any account, so no login is needed. An app where
+each visitor links their OWN account is a different thing — that is a
+connection (the `connections` skill) — and Bluesky is not a connections
+provider, so it needs none.** Read the boundary the way the request is worded:
+"show me @alice's followers", "a wall of posts from these five accounts",
+"search Bluesky for people who mention pottery" are all public reads and belong
+here. "Post to my Bluesky", "show me MY timeline", "reply as me" need an
+authenticated session this page does not give you — say so plainly and build
+the public half, rather than asking the person for a password.
+
+## 2. What answers unauthenticated, and what does not
+
+Base: `https://public.api.bsky.app/xrpc`. `actor` takes a handle
+(`alice.bsky.social`) or a DID (`did:plc:…`) — the same value works either way.
+
+| Endpoint                     | Query                | Answers                                                        |
+| ---------------------------- | -------------------- | -------------------------------------------------------------- |
+| `app.bsky.actor.getProfile`  | `actor`              | `{ did, handle, displayName, avatar, description, followersCount, followsCount, postsCount }` |
+| `app.bsky.graph.getFollows`  | `actor`, `limit`, `cursor` | `{ follows: [profile…], cursor }`                        |
+| `app.bsky.graph.getFollowers`| `actor`, `limit`, `cursor` | `{ followers: [profile…], cursor }`                      |
+| `app.bsky.feed.getAuthorFeed`| `actor`, `limit`, `cursor` | `{ feed: [{ post: { uri, cid, author, record, … } }], cursor }` |
+| `app.bsky.actor.searchActors`| `q`, `limit`, `cursor`     | `{ actors: [profile…], cursor }`                         |
+| `app.bsky.feed.getPostThread`| `uri` (`at://…`)     | a post and its replies                                           |
+
+**`app.bsky.feed.searchPosts` is not available unauthenticated — it answers
+`403`, so do not build post search on this host.** Full-text post search needs
+a logged-in session. When somebody asks to search posts, `searchActors` finds
+the people and `getAuthorFeed` reads what they wrote — say what the app does
+instead of failing silently on a refusal it was never going to survive.
+
+The profile objects inside `follows`, `followers`, `actors` and `post.author`
+are the same small shape: `did`, `handle`, `displayName`, `avatar`,
+`description`. A post's text is at `post.record.text` and its time at
+`post.record.createdAt`; `displayName` and `avatar` are frequently absent, so
+fall back to the handle rather than rendering an empty card.
+
+## 3. Check the response before you parse it
+
+Check `res.ok` before calling `res.json()` — a refusal from this host comes back as HTML, so parsing it first throws instead of returning an error object.
+
+This is the trap that turns a handled refusal into a dead app. The `403` from
+`searchPosts` has an HTML body, so `await res.json()` raises a `SyntaxError`
+before any `if (body.error)` line can run, and — because an uncaught throw in a
+handler renders as an opaque `404` — the app tells its user it does not exist.
+A 400 from a real XRPC route (a bad `uri`, an unknown actor) *is* JSON, shaped
+`{ "error": "NotFound", "message": … }`, which is worth passing to the screen.
+
+So: status first, JSON second, and a stated reason either way.
+
+```js
+async function bsky(ctx, method, params) {
+  const url = new URL(`https://public.api.bsky.app/xrpc/${method}`);
+  for (const [k, v] of Object.entries(params)) if (v != null) url.searchParams.set(k, String(v));
+  const res = await ctx.fetch(url.toString(), { headers: { accept: "application/json" } });
+  const type = res.headers.get("content-type") ?? "";
+  if (!type.includes("application/json")) {
+    // A 403 from searchPosts lands here, as HTML. Parsing it would throw.
+    return { ok: false, reason: "unavailable", message: `Bluesky answered ${res.status} for ${method}.` };
+  }
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body) {
+    return { ok: false, reason: body?.error ?? "http-error", message: body?.message ?? `HTTP ${res.status}` };
+  }
+  return { ok: true, body };
+}
+```
+
+The host is CORS-open (`access-control-allow-origin: *`), so a direct call from
+`App.jsx` would reach it too. Build it in `backend.js` anyway: the status check,
+the paging loop and the read cache then live in one place, and the client has
+one `/_api` shape to branch on instead of a raw upstream body.
+
+## 4. Paging follows the cursor
+
+Page with `cursor`: pass the previous response's `cursor` back as `?cursor=`, and stop when the response carries none — never loop until a page comes back empty.
+
+`limit` caps a page (100 is the ceiling on the graph and feed routes). The
+response's `cursor` is the address of the next page; its **absence** is the end
+of the list. A filtered page can be empty and still carry a cursor, so an
+emptiness test stops early and quietly loses the rest of somebody's followers.
+
+```js
+async function pages(ctx, method, params, key, max = 500) {
+  const rows = [];
+  let cursor;
+  do {
+    const page = await bsky(ctx, method, { ...params, limit: 100, cursor });
+    if (!page.ok) return rows.length ? { ok: true, rows, partial: page.reason } : page;
+    rows.push(...(page.body[key] ?? []));
+    cursor = page.body.cursor;
+  } while (cursor && rows.length < max);
+  return { ok: true, rows };
+}
+```
+
+Bound the walk. A popular account has hundreds of thousands of followers, and a
+handler that walks all of them hits the 15s request budget and returns nothing
+at all — so cap the sweep, and tell the screen the list was capped rather than
+implying it is complete.
+
+## 5. Every `/_api` route keeps its reason
+
+An uncaught throw in a handler is folded into an opaque `404 backend.js _api: not found`, so every `/_api` route wraps its work in try/catch and answers with a stated reason.
+
+That fold is why a transient upstream blip reads to the user as "this app does
+not exist". Wrap the body of each route, answer `{ ok: false, reason }`, and log
+the throw with `ctx.log` so an operator can tell "the request never arrived"
+from "the request arrived and died".
+
+A `not-found` from Bluesky is worth its own reason too: an actor who does not
+exist, a renamed handle, and a deactivated account all come back as a 400 with
+`error: "NotFound"`, and "we could not find @name on Bluesky" is an answer the
+person can act on — "no data" is not.
+
+## Complete backend.js
+
+```js
+const XRPC = "https://public.api.bsky.app/xrpc";
+const DB = "bluesky";
+
+async function bsky(ctx, method, params) {
+  const url = new URL(`${XRPC}/${method}`);
+  for (const [k, v] of Object.entries(params)) if (v != null) url.searchParams.set(k, String(v));
+  const res = await ctx.fetch(url.toString(), { headers: { accept: "application/json" } });
+  // Status and content-type BEFORE parsing: a refusal from this host has an HTML body.
+  const type = res.headers.get("content-type") ?? "";
+  if (!type.includes("application/json")) {
+    return { ok: false, reason: "unavailable", message: `Bluesky answered ${res.status} for ${method}.` };
+  }
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body) {
+    return { ok: false, reason: body?.error ?? "http-error", message: body?.message ?? `HTTP ${res.status}` };
+  }
+  return { ok: true, body };
+}
+
+/** Walk `cursor` to the end, or to `max` rows — never until a page looks empty. */
+async function pages(ctx, method, params, key, max = 500) {
+  const rows = [];
+  let cursor;
+  do {
+    const page = await bsky(ctx, method, { ...params, limit: 100, cursor });
+    if (!page.ok) return rows.length ? { ok: true, rows, capped: true, partial: page.reason } : page;
+    rows.push(...(page.body[key] ?? []));
+    cursor = page.body.cursor;
+  } while (cursor && rows.length < max);
+  return { ok: true, rows, capped: Boolean(cursor) };
+}
+
+const asProfile = (p) => ({
+  did: p.did,
+  handle: p.handle,
+  displayName: p.displayName ?? p.handle,
+  avatar: p.avatar ?? null,
+  description: p.description ?? "",
+});
+
+function json(payload, status = 200) {
+  return new Response(JSON.stringify(payload), { status, headers: { "content-type": "application/json" } });
+}
+
+export async function fetch(request, ctx) {
+  const url = new URL(request.url);
+  const actor = (url.searchParams.get("actor") ?? "").trim().replace(/^@/, "");
+
+  try {
+    if (url.pathname === "/profile") {
+      if (!actor) return json({ ok: false, reason: "no-actor", message: "Type a Bluesky handle." }, 400);
+      const result = await bsky(ctx, "app.bsky.actor.getProfile", { actor });
+      if (!result.ok) return json(result);
+      const p = result.body;
+      return json({
+        ok: true,
+        profile: {
+          ...asProfile(p),
+          followersCount: p.followersCount ?? 0,
+          followsCount: p.followsCount ?? 0,
+          postsCount: p.postsCount ?? 0,
+        },
+      });
+    }
+
+    if (url.pathname === "/follows" || url.pathname === "/followers") {
+      if (!actor) return json({ ok: false, reason: "no-actor", message: "Type a Bluesky handle." }, 400);
+      const following = url.pathname === "/follows";
+      const method = following ? "app.bsky.graph.getFollows" : "app.bsky.graph.getFollowers";
+      const result = await pages(ctx, method, { actor }, following ? "follows" : "followers");
+      if (!result.ok) return json(result);
+      return json({ ok: true, capped: result.capped === true, people: result.rows.map(asProfile) });
+    }
+
+    if (url.pathname === "/feed") {
+      if (!actor) return json({ ok: false, reason: "no-actor", message: "Type a Bluesky handle." }, 400);
+      const result = await pages(ctx, "app.bsky.feed.getAuthorFeed", { actor }, "feed", 100);
+      if (!result.ok) return json(result);
+      const posts = result.rows
+        .map((row) => row.post)
+        .filter(Boolean)
+        .map((post) => ({
+          uri: post.uri,
+          cid: post.cid,
+          text: post.record?.text ?? "",
+          createdAt: post.record?.createdAt ?? null,
+          author: asProfile(post.author ?? {}),
+          replyCount: post.replyCount ?? 0,
+          repostCount: post.repostCount ?? 0,
+          likeCount: post.likeCount ?? 0,
+        }));
+      return json({ ok: true, posts });
+    }
+
+    if (url.pathname === "/search") {
+      const q = (url.searchParams.get("q") ?? "").trim();
+      if (!q) return json({ ok: false, reason: "no-query", message: "Type something to search for." }, 400);
+      // Only PEOPLE search answers without a session; post search is a 403 on this host.
+      const result = await bsky(ctx, "app.bsky.actor.searchActors", { q, limit: 25 });
+      if (!result.ok) return json(result);
+      return json({ ok: true, people: (result.body.actors ?? []).map(asProfile) });
+    }
+
+    return new Response("not found", { status: 404 });
+  } catch (err) {
+    // Without this, the throw is folded into an opaque 404 and the app claims it does not exist.
+    ctx.log("error", "bluesky route failed", { path: url.pathname, message: String(err) });
+    return json({ ok: false, reason: "handler-failed", message: "Bluesky could not be read just now." }, 500);
+  }
+}
+```
+
+## App.jsx sketch
+
+A profile card, its follow graph, and the account's posts — one handle in, no
+account of the visitor's involved.
+
+```jsx
+import React, { useState } from "react";
+
+export default function App() {
+  const [handle, setHandle] = useState("bsky.app");
+  const [profile, setProfile] = useState(null);
+  const [people, setPeople] = useState([]);
+  const [posts, setPosts] = useState([]);
+  const [problem, setProblem] = useState(null);
+
+  // Takes the handle as an argument, defaulting to what is in the input. A click
+  // in the follow list below passes the person's handle straight in: calling
+  // `load()` right after `setHandle(...)` would read the PREVIOUS handle, because
+  // the state update has not applied yet — an off-by-one that looks correct on
+  // the second click.
+  const load = async (who = handle) => {
+    setProblem(null);
+    const actor = encodeURIComponent(who.trim().replace(/^@/, ""));
+    const [p, f, w] = await Promise.all([
+      fetch(`/_api/profile?actor=${actor}`).then((r) => r.json()),
+      fetch(`/_api/follows?actor=${actor}`).then((r) => r.json()),
+      fetch(`/_api/feed?actor=${actor}`).then((r) => r.json()),
+    ]);
+    if (!p.ok) {
+      setProblem(p.reason === "NotFound" ? `We could not find @${who} on Bluesky.` : p.message);
+      return;
+    }
+    setProfile(p.profile);
+    setPeople(f.ok ? f.people : []);
+    setPosts(w.ok ? w.posts : []);
+  };
+
+  return (
+    <div>
+      <input value={handle} onChange={(e) => setHandle(e.target.value)} placeholder="alice.bsky.social" />
+      <button onClick={load}>Look up</button>
+      {problem && <p role="alert">{problem}</p>}
+
+      {profile && (
+        <section>
+          {profile.avatar && <img src={profile.avatar} alt="" width={64} height={64} />}
+          <h2>{profile.displayName}</h2>
+          <p>@{profile.handle}</p>
+          <p>{profile.description}</p>
+          <p>
+            {profile.followersCount} followers · {profile.followsCount} following · {profile.postsCount} posts
+          </p>
+        </section>
+      )}
+
+      <section>
+        <h3>Following</h3>
+        <ul>
+          {people.map((person) => (
+            <li key={person.did}>
+              <button
+                onClick={() => {
+                  setHandle(person.handle);
+                  load(person.handle);
+                }}
+              >
+                {person.displayName} (@{person.handle})
+              </button>
+            </li>
+          ))}
+        </ul>
+      </section>
+
+      <section>
+        <h3>Posts</h3>
+        {posts.map((post) => (
+          <article key={post.uri}>
+            <p>{post.text}</p>
+            <small>
+              {post.createdAt} · {post.likeCount} likes · {post.replyCount} replies
+            </small>
+          </article>
+        ))}
+      </section>
+    </div>
+  );
+}
+```
+
+Clicking a person in the follow list re-runs the same three routes against their
+handle, which is the whole of a follower-graph explorer. A search page is the
+same shape over `/_api/search`, and a multi-account wall is `/_api/feed` per
+handle merged and sorted by `createdAt`.

package/llms/index.d.ts

@@ -15,5 +15,7 @@ export { createVibeConfig } from "./create-vibe.js";
 export { accessConfig } from "./access.js";
 export { connectionsConfig } from "./connections.js";
 export { youtubeConfig } from "./youtube.js";
+export { blueskyConfig } from "./bluesky.js";
+export { spotifyConfig } from "./spotify.js";
 export type { LlmConfig } from "./types.js";
-export declare const allConfigs: readonly [import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig];
+export declare const allConfigs: readonly [import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig];

package/llms/index.js

@@ -15,6 +15,8 @@ import { createVibeConfig } from "./create-vibe.js";
 import { accessConfig } from "./access.js";
 import { connectionsConfig } from "./connections.js";
 import { youtubeConfig } from "./youtube.js";
+import { blueskyConfig } from "./bluesky.js";
+import { spotifyConfig } from "./spotify.js";
 export { backendConfig } from "./backend.js";
 export { calendarConfig } from "./calendar.js";
 export { callaiConfig } from "./callai.js";
@@ -32,6 +34,8 @@ export { createVibeConfig } from "./create-vibe.js";
 export { accessConfig } from "./access.js";
 export { connectionsConfig } from "./connections.js";
 export { youtubeConfig } from "./youtube.js";
+export { blueskyConfig } from "./bluesky.js";
+export { spotifyConfig } from "./spotify.js";
 export const allConfigs = [
     callaiConfig,
     imageGenConfig,
@@ -50,5 +54,7 @@ export const allConfigs = [
     accessConfig,
     connectionsConfig,
     youtubeConfig,
+    blueskyConfig,
+    spotifyConfig,
 ];
 //# sourceMappingURL=index.js.map

package/llms/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../jsr/llms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,WAAW;IACX,eAAe;IACf,WAAW;IACX,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,YAAY;IACZ,iBAAiB;IACjB,aAAa;CACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../jsr/llms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,WAAW;IACX,eAAe;IACf,WAAW;IACX,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,aAAa;CACL,CAAC"}

package/llms/spotify.d.ts

@@ -0,0 +1,2 @@
+import type { LlmConfig } from "./types.js";
+export declare const spotifyConfig: LlmConfig;

package/llms/spotify.js

@@ -0,0 +1,15 @@
+export const spotifyConfig = {
+    name: "spotify",
+    label: "Spotify catalog",
+    description: "Reading Spotify's public catalog with the owner's own Spotify app credentials: the setup steps the app shows when SPOTIFY_CLIENT_ID/SPOTIFY_CLIENT_SECRET are missing, the client-credentials token minted in backend.js and cached in memory rather than stored, searching artists/albums/tracks, the boundary that a listener's own top tracks and playlists need a connection instead, and keeping every refusal's reason",
+    cues: [
+        "spotify",
+        "spotify search",
+        "album art",
+        "track search",
+        "artist lookup",
+        "music catalog",
+        "audio features",
+    ],
+};
+//# sourceMappingURL=spotify.js.map

package/llms/spotify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spotify.js","sourceRoot":"","sources":["../../jsr/llms/spotify.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,iBAAiB;IACxB,WAAW,EACT,8ZAA8Z;IACha,IAAI,EAAE;QACJ,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,cAAc;QACd,eAAe;QACf,eAAe;QACf,gBAAgB;KACjB;CACF,CAAC"}

package/llms/spotify.md

@@ -0,0 +1,376 @@
+# Spotify catalog — with the owner's own Spotify app
+
+When someone asks for a page built on Spotify's catalog — search an artist, show
+an album's tracks, chart the tempo of a playlist's songs — build it on the **Spotify
+Web API** with app credentials the owner supplies. This is a `backend.js` feature
+(see the backend docs for the general handler contract); this page is the recipe
+that makes the credentials safe, the token short-lived and unstored, and the app
+honest about which half of Spotify it can actually see.
+
+**This is the owner-dashboard pattern, and it has a boundary.** The credentials
+are the owner's, the rate limit is the owner's, and every visitor sees the *same*
+public catalog. That is exactly right for "let people search Spotify from my page"
+and exactly wrong for "show each visitor their own top tracks". An app where each
+person who opens it sees **their own** Spotify account is a **connection** — the
+platform renders the consent screen, runs the sign-in, holds the credential and
+refreshes it, and your code never sees a token (see the connections page). So
+never render an input asking a visitor to paste an access token, and never send a
+visitor to a developer console to mint one: that is the flow connections exists to
+replace. The console trip below is for the **owner** of this app, once, and for
+nobody else.
+
+## 1. Bring your own app credentials, and explain how
+
+The owner registers an app with Spotify, once:
+
+1. Open the Spotify developer dashboard and log in with a Spotify account.
+2. Create an app — any name and description; a redirect URI is not used by this
+   flow, so put the app's own URL in if the form insists on one.
+3. Open the app's settings and copy the **Client ID**.
+4. Reveal and copy the **Client secret**.
+5. Set both on the vibe as `SPOTIFY_CLIENT_ID` and `SPOTIFY_CLIENT_SECRET` — the
+   vibe's settings page, or `vibes-diy secrets set SPOTIFY_CLIENT_ID <the id>` and
+   `vibes-diy secrets set SPOTIFY_CLIENT_SECRET <the secret>`.
+
+The app carries those five steps in its own UI, because the person reading them is
+the person who has to do them.
+
+When the credentials are missing, the app shows the owner the setup steps for a Spotify app instead of an error.
+
+The backend answers `{ ok: false, reason: "missing-key" }` when either
+`ctx.secrets.SPOTIFY_CLIENT_ID` or `ctx.secrets.SPOTIFY_CLIENT_SECRET` is absent,
+and the client renders the numbered steps, naming the Spotify developer dashboard
+and both secret names in so many words so the owner knows what to create and what
+to call it. Two secrets means two ways to be half-configured: say "missing-key"
+once and list both, rather than letting one set and one unset look like a broken
+API.
+
+Only the owner can set or rotate a secret, and handlers see the current value on
+every invocation — so the page starts working the moment the pair lands, with no
+redeploy.
+
+## 2. The credentials never reach the browser
+
+Every Spotify request is made in backend.js with ctx.fetch and the two ctx.secrets values; App.jsx never calls api.spotify.com or accounts.spotify.com.
+
+The client talks to the app's own `/_api/...` routes with a relative `fetch`, and
+the backend is the only place that knows the client id and secret exist. A client
+secret pasted into a React component ships to every visitor who views source, and
+anyone who reads it can mint tokens against the owner's app until it is rotated.
+The client id alone is no better: it is half of the pair and it names the owner's
+app to anyone collecting them.
+
+## 3. Mint a token, hold it in memory, never write it down
+
+The public catalog is not open. `GET https://api.spotify.com/v1/search` with no
+`Authorization` header answers **401** `Missing/invalid/expired access token` —
+there is no anonymous catalog access, so every app on this page mints a token
+before its first call.
+
+This is the **client-credentials** flow: server to server, with **no redirect, no
+user login and no callback route**. Do not add one; there is nothing for a visitor
+to approve.
+
+```
+POST https://accounts.spotify.com/api/token
+Content-Type: application/x-www-form-urlencoded
+
+grant_type=client_credentials&client_id=<SPOTIFY_CLIENT_ID>&client_secret=<SPOTIFY_CLIENT_SECRET>
+```
+
+Spotify documents two ways to present the pair: in the form body as above, or as
+HTTP Basic auth over `client_id:client_secret`. **Use the form body.** It is one
+less thing to base64-encode and it keeps the request shape plain; both are
+accepted by the same endpoint.
+
+The answer is `{ access_token, token_type: "Bearer", expires_in }`, and
+`expires_in` is seconds — about an hour. Every catalog call then carries
+`Authorization: Bearer <access_token>`.
+
+The token is cached in a module-scope variable in backend.js and re-minted when it expires or when a call answers 401 — it is never written to a document.
+
+A token in a document is a credential at rest with a readable lifetime and no
+reason to exist: it buys nothing a fresh mint does not, it outlives the isolate
+that needed it, and anything that can read the app's data can then spend the
+owner's app. Hold it beside the handler, treat a cold isolate as a cache miss, and
+mint again. Re-mint slightly early — a token that expires mid-request looks like a
+broken API — and re-mint once on a 401 rather than surfacing it, since a revoked or
+rotated secret and an expired token arrive as the same status.
+
+## 4. What client credentials buys, and what it does not
+
+Client credentials buys the **public catalog** and nothing that belongs to a listener.
+
+| Available | Not available with client credentials |
+| --- | --- |
+| `search` across tracks, artists, albums, playlists | "my top tracks", "my recently played" |
+| an artist, their albums, their top tracks | the visitor's saved songs or library |
+| an album and its tracks | the visitor's own playlists |
+| a track and its audio features | playback, queue, or anything that controls a player |
+| public playlists and their tracks | private playlists, follows, or listening history |
+
+Everything in the right column needs the visitor's own Spotify account, which is a
+**connection** and not this flow. Do not imply the app can reach it, do not add an
+input that asks for a token to unlock it, and do not render an empty "Your top
+tracks" section waiting for a capability that will never arrive. If the person
+asked for their own listening data, say plainly that this page reads Spotify's
+public catalog and point at the connections page.
+
+## 5. Reading the catalog
+
+```
+GET https://api.spotify.com/v1/search?q=<terms>&type=track,artist&limit=20
+GET https://api.spotify.com/v1/artists/<id>/top-tracks?market=US
+GET https://api.spotify.com/v1/albums/<id>
+GET https://api.spotify.com/v1/tracks?ids=<up to 50 comma-joined ids>
+```
+
+Each answers JSON with a paging object — `items`, `total`, `limit`, `offset` — so
+page with `offset` rather than asking for a bigger `limit` than the endpoint allows
+(50 for most, 20 for search per type). Several endpoints want a `market`; without
+one an item can come back playable nowhere and render as a blank row.
+
+An empty `items` array means nothing matched — say that, and keep the search terms
+on screen so the person can fix them. Images arrive as a `images` array ordered
+largest first; take the smallest one that is big enough rather than the first.
+
+## 6. Errors keep their reason
+
+Spotify answers a refusal with `{ "error": { "status", "message" } }` on the Web
+API, and `{ "error", "error_description" }` on the token endpoint. Classify and
+pass the reason through:
+
+- `invalid_client` from the token endpoint — the id and secret do not match a real
+  app. Show the setup steps from section 1 again.
+- `401` from the Web API — mint a fresh token and retry once; if the second try is
+  also 401, show the setup steps.
+- `429` — Spotify is rate-limiting the owner's app. The `Retry-After` header is
+  seconds; say "Spotify asked us to wait N seconds" rather than "no results".
+- `404` — no such artist, album or track. Keep the id on screen.
+- anything else — show the API's own `error.message`.
+
+A failure keeps its reason all the way to the screen. "No data" tells the owner
+nothing they can act on, and the five cases above each have a different fix.
+
+Every `_api` route wraps its handler in `try`/`catch` and answers with a stated
+reason, because an uncaught throw leaves the route rendering as an opaque 404 and
+the app looks broken rather than misconfigured.
+
+## Complete backend.js
+
+```js
+const TOKEN_URL = "https://accounts.spotify.com/api/token";
+const API = "https://api.spotify.com/v1";
+
+/**
+ * The token lives HERE — beside the handler, for as long as this isolate does.
+ * Never in a document: a stored bearer outlives the request that needed it and
+ * buys nothing a fresh mint does not.
+ */
+let cachedToken = null;
+let cachedUntil = 0;
+
+function json(payload, status = 200) {
+  return new Response(JSON.stringify(payload), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+/** Both halves or neither — one set and one unset is still "not configured yet". */
+function credentials(ctx) {
+  const id = ctx.secrets.SPOTIFY_CLIENT_ID;
+  const secret = ctx.secrets.SPOTIFY_CLIENT_SECRET;
+  return id && secret ? { id, secret } : null;
+}
+
+/** Client credentials: no redirect, no user login, no callback route. */
+async function mintToken(ctx, creds) {
+  const body = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: creds.id,
+    client_secret: creds.secret,
+  });
+  const res = await ctx.fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body.toString(),
+  });
+  const payload = await res.json().catch(() => null);
+  if (res.status !== 200 || !payload?.access_token) {
+    return { ok: false, reason: payload?.error ?? "token-failed", message: payload?.error_description ?? `HTTP ${res.status}` };
+  }
+  // Re-mint a minute early: a token that expires mid-request reads as a broken API.
+  cachedToken = payload.access_token;
+  cachedUntil = Date.now() + Math.max(0, Number(payload.expires_in ?? 3600) - 60) * 1000;
+  return { ok: true, token: cachedToken };
+}
+
+async function token(ctx, creds, { fresh = false } = {}) {
+  if (!fresh && cachedToken && Date.now() < cachedUntil) return { ok: true, token: cachedToken };
+  cachedToken = null;
+  return mintToken(ctx, creds);
+}
+
+/** One call, with exactly one retry when the token turned out to be stale. */
+async function callSpotify(ctx, path, params = {}) {
+  const creds = credentials(ctx);
+  if (!creds) return { ok: false, reason: "missing-key" };
+
+  const url = new URL(`${API}${path}`);
+  for (const [k, v] of Object.entries(params)) if (v != null) url.searchParams.set(k, String(v));
+
+  for (const fresh of [false, true]) {
+    const minted = await token(ctx, creds, { fresh });
+    if (!minted.ok) return minted;
+    const res = await ctx.fetch(url.toString(), {
+      headers: { authorization: `Bearer ${minted.token}`, accept: "application/json" },
+    });
+    if (res.status === 401 && fresh === false) continue; // expired or rotated — mint once more
+    const payload = await res.json().catch(() => null);
+    if (res.status === 200 && payload) return { ok: true, body: payload };
+    if (res.status === 429) {
+      return { ok: false, reason: "rate-limited", retryAfter: Number(res.headers.get("retry-after") ?? 1) };
+    }
+    return { ok: false, reason: String(payload?.error?.status ?? res.status), message: payload?.error?.message ?? `HTTP ${res.status}` };
+  }
+  return { ok: false, reason: "unauthorized", message: "Spotify refused the app credentials twice." };
+}
+
+export async function fetch(request, ctx) {
+  const url = new URL(request.url);
+  if (request.method !== "GET") {
+    return new Response("method not allowed", { status: 405, headers: { allow: "GET" } });
+  }
+
+  // An uncaught throw renders as an opaque 404, so every route answers with a reason.
+  try {
+    if (url.pathname === "/search") {
+      const q = (url.searchParams.get("q") ?? "").trim();
+      if (q === "") return json({ ok: true, tracks: [], artists: [] });
+      const result = await callSpotify(ctx, "/search", { q, type: "track,artist", limit: 20, market: "US" });
+      if (!result.ok) return json(result);
+      return json({
+        ok: true,
+        tracks: (result.body.tracks?.items ?? []).map(trackRow),
+        artists: (result.body.artists?.items ?? []).map(artistRow),
+      });
+    }
+
+    if (url.pathname === "/artist") {
+      const id = url.searchParams.get("id");
+      if (!id) return json({ ok: false, reason: "no-artist", message: "Pick an artist first." });
+      const top = await callSpotify(ctx, `/artists/${encodeURIComponent(id)}/top-tracks`, { market: "US" });
+      if (!top.ok) return json(top);
+      return json({ ok: true, tracks: (top.body.tracks ?? []).map(trackRow) });
+    }
+
+    return new Response("not found", { status: 404 });
+  } catch (err) {
+    ctx.log("error", "spotify route failed", { path: url.pathname, message: String(err?.message ?? err) });
+    return json({ ok: false, reason: "handler-failed", message: "Something went wrong reading Spotify." }, 500);
+  }
+}
+
+function smallestImage(images) {
+  const sorted = [...(images ?? [])].sort((a, b) => (a.width ?? 0) - (b.width ?? 0));
+  return sorted.find((i) => (i.width ?? 0) >= 160)?.url ?? sorted.at(-1)?.url ?? null;
+}
+
+function trackRow(t) {
+  return {
+    id: t.id,
+    name: t.name,
+    artists: (t.artists ?? []).map((a) => a.name).join(", "),
+    album: t.album?.name ?? null,
+    image: smallestImage(t.album?.images),
+    url: t.external_urls?.spotify ?? null,
+  };
+}
+
+function artistRow(a) {
+  return {
+    id: a.id,
+    name: a.name,
+    genres: a.genres ?? [],
+    image: smallestImage(a.images),
+    url: a.external_urls?.spotify ?? null,
+  };
+}
+```
+
+## App.jsx sketch
+
+```jsx
+import React, { useState } from "react";
+
+const SETUP_STEPS = [
+  "Open the Spotify developer dashboard and log in.",
+  "Create an app — any name and description will do.",
+  "Copy the Client ID from the app's settings.",
+  "Reveal and copy the Client secret.",
+  "Set them on this vibe as SPOTIFY_CLIENT_ID and SPOTIFY_CLIENT_SECRET.",
+];
+
+export default function App() {
+  const [query, setQuery] = useState("");
+  const [tracks, setTracks] = useState([]);
+  const [problem, setProblem] = useState(null);
+
+  const search = async () => {
+    const res = await fetch(`/_api/search?q=${encodeURIComponent(query)}`);
+    const data = await res.json();
+    if (!data.ok) {
+      setProblem(data);
+      return;
+    }
+    setProblem(null);
+    setTracks(data.tracks);
+  };
+
+  return (
+    <div>
+      <input value={query} onChange={(e) => setQuery(e.target.value)} placeholder="Search Spotify" />
+      <button onClick={search}>Search</button>
+
+      {problem?.reason === "missing-key" && (
+        <section>
+          <h2>Add your Spotify app credentials</h2>
+          <ol>
+            {SETUP_STEPS.map((step) => (
+              <li key={step}>{step}</li>
+            ))}
+          </ol>
+          <p>Both values stay on the server and are never sent to the browser.</p>
+        </section>
+      )}
+      {problem?.reason === "rate-limited" && <p>Spotify asked us to wait {problem.retryAfter} seconds.</p>}
+      {problem && !["missing-key", "rate-limited"].includes(problem.reason) && <p role="alert">{problem.message}</p>}
+
+      <ul>
+        {tracks.map((t) => (
+          <li key={t.id}>
+            {t.image && <img src={t.image} alt="" width={64} height={64} />}
+            <a href={t.url} target="_blank" rel="noreferrer">
+              {t.name}
+            </a>{" "}
+            — {t.artists}
+          </li>
+        ))}
+      </ul>
+
+      <section>
+        <h3>What this page can see</h3>
+        <p>
+          Spotify's public catalog — search, artists, albums and tracks. Your own top tracks, playlists and saved songs
+          belong to your Spotify account and are not part of this.
+        </p>
+      </section>
+    </div>
+  );
+}
+```
+
+Store what the person keeps — a shortlist, a rating, a note on a track — in the
+app's own database keyed by the Spotify track id. The catalog is Spotify's and
+gets re-read; the opinions about it are the app's and get saved.

package/llms/youtube.md

@@ -6,6 +6,18 @@ with a key the owner supplies. This is a `backend.js` feature (see the backend
 docs for the general handler contract); this page is the recipe that makes the
 key safe, the quota survivable, and the numbers honest about what they are.
 
+**This is the owner-dashboard pattern, and it has a boundary.** The key is the
+owner's, the quota is the owner's, and every visitor sees the *owner's* channel.
+That is exactly right for "show me how my channel is doing" and exactly wrong for
+the same sentence asked by a visitor about theirs. An app where each person who
+opens it sees **their own** account is a **connection** — the platform renders the
+consent screen, runs the sign-in, holds the credential and refreshes it, and your
+code never sees a token (see the connections page). So never render an input
+asking a visitor to paste an access token, and never send a visitor to a
+developer console to mint one: that is the flow connections exists to replace.
+The console trip below is for the **owner** of this app, once, and for nobody
+else.
+
 ## 1. Bring your own key, and explain how
 
 The owner gets a key from Google, once:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "14.1.25",
+  "version": "14.1.26",
   "type": "module",
   "main": "./index.js",
   "exports": {
@@ -34,9 +34,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "14.1.25",
-    "@vibes.diy/identity": "14.1.25",
-    "@vibes.diy/use-vibes-types": "14.1.25",
+    "@vibes.diy/call-ai-v2": "14.1.26",
+    "@vibes.diy/identity": "14.1.26",
+    "@vibes.diy/use-vibes-types": "14.1.26",
     "arktype": "~2.2.3",
     "json-schema-faker": "~0.6.3"
   },

package/system-prompt.md

@@ -708,7 +708,7 @@ Rules for the items:
 - **Seed every app-written document type.** For every string-literal `type` that `App.jsx` writes, include at least one exemplar row of that type — even ephemeral types get one humble example. Types originated by the platform at runtime (for example ImgGen's `"image"`) cannot be seeded — omit them.
 - **JSON only — no images or binary.** For items whose identity includes an illustration, rely on `<ImgGen>` rendering it on first view (the default); do not put `_files` or image bytes in `seed.json` — put binaries in the Files tab instead.
 - **Platform-originated types can't be seeded.** Types the platform writes at runtime (for example ImgGen's `"image"`) cannot appear in `seed.json`; give those their own `access.js` branch instead.
-- **If the app has an `access.js`, every `type` you emit here must have a branch in it** — but don't add an access function _just_ to satisfy this: an app with no per-document rules keeps the default open data model and seeds fine without one. When there **is** an `access.js`, seed docs are written through it as the **owner** when the owner explicitly applies the seed-data import, so a `type` it doesn't return a **readable descriptor** for (a non-empty `channels`, or an `audience`) is denied (`unknown document type`) — the doc never seeds, and the same gap later surfaces as a hard error the moment the running app writes that type. Before finishing, if you emitted an `access.js`, confirm it returns a readable descriptor for every distinct `type` present in `seed.json`. (Deletes go through the same gate: a `db.del` writes a tombstone `{ _id, _deleted: true }` that carries **no** `type`, channel, or author — so branch on `doc._deleted`, then authorize and route it off **`oldDoc`** (the persisted document is the only trustworthy record of the doc's type and owner), returning the same descriptor the live doc got. A bare `_deleted` branch that ignores `oldDoc` either fails the app's own deletes or over-broadens them.)
+- **`access.js` decides which types a seed may carry — not the other way round.** Don't add an access function just to satisfy a seed: an app with no per-document rules keeps the default open data model and seeds fine without one. When there **is** an `access.js`, seed docs are written through it as the **owner** when the owner explicitly applies the seed-data import, so a `type` it doesn't return a **readable descriptor** for (a non-empty `channels`, or an `audience`) is denied (`unknown document type`) — the doc never seeds, and the same gap later surfaces as a hard error the moment the running app writes that type. So when you write or change an `access.js`, bring `seed.json` into line with it in the same turn: drop items whose type it doesn't authorize, add the field each branch routes on, and never add a branch just to admit a seed item. The full rule, including which ids must stay byte-identical, is in the `access.js` skill under _Reconciling `seed.json` when you write or change `access.js`_. (Deletes go through the same gate: a `db.del` writes a tombstone `{ _id, _deleted: true }` that carries **no** `type`, channel, or author — so branch on `doc._deleted`, then authorize and route it off **`oldDoc`** (the persisted document is the only trustworthy record of the doc's type and owner), returning the same descriptor the live doc got. A bare `_deleted` branch that ignores `oldDoc` either fails the app's own deletes or over-broadens them.)
 
 ### Make it fun and alive on screen one