@vibes.diy/prompts 14.3.140 → 14.3.141

package/llms/access.md

@@ -633,7 +633,7 @@ The leaderboard is just the access model: read the public `track:` channels and
 
 **Per-object collaboration is the shape of every second or shared thing** (the second worked example above), and certainly of anything that says "invite", "join", "people can join", "collaborate", "share with", "together", "with my partner/team", or names a board/canvas/room/whiteboard a group co-edits — each shared thing is ONE object its members reach directly; it needs no owner. Use the per-object recipe: a channel per object, named from the record (`board:${doc._id}` on the object, `board:${doc.boardId}` on its children); the creator self-grants at creation (`grant: { users: { [user.userHandle]: [ch] } }`); child docs gate on `ctx.requireAccess(ch)` so any member edits any child in it (not just their own); a member-authored `share` doc grants a peer the same channel; a `request` doc — which takes **no** `requireAccess` — lets a not-yet-member ask to join. Keep the _object's own_ creator field write-once (`if (oldDoc && doc.author !== oldDoc.author) throw`) and a child's object-id immutable. **Two traps to avoid:** don't build it as an open public feed where each person only owns their own items (that abandons the shared membership), and don't gate it behind a single writer (members self-serve via share/request). The app owner is not special in the data model: any signed-in person creates their own object and invites a friend into it, and the rule keys on `user.userHandle` or the object's creator, never on `user.isOwner`.
 
-**A page a person sets up for their own visitors is a product its provider owns** — a booking page, a storefront, office hours, a menu, a class sign-up. "My page", "my clients" and "my shop" are the words of the service provider speaking, who is usually the person who made the app and is never assumed to be: any signed-in person can set up a page of their own, a provider can run more than one, and nothing in the rules or the screens asks who owns the vibe. The page is a document like any product (`_id: "page-" + crypto.randomUUID()`), its provider in a write-once `creatorHandle`, readable by everyone on its own `page:<id>` channel, and every record a visitor makes on it carries that page's id in `pageId`, so bookings live under their page rather than beside it. A visitor's record is private between that visitor and the page's provider: it routes to the page's inbox channel, which the page branch grants to its provider alone, and to the visitor's own `user:<handle>` channel, which grants them their own; what other visitors need to know — that a time is taken — rides a separate marker holding only the page and the time, routed to the page's public channel; a client who cancels deletes their booking, and the provider or the scheduled run frees the time. Each page has its own link (`#page=<pageId>`): the provider's view shows it to copy and share, a visitor who opens it lands on that page's open times, and someone who opens the app with no page in the link sees the pages they run and can set up a new one. Clients can offer services too, by setting up a page of their own.
+**A page a person sets up for their own visitors is a product its provider owns** — a booking page, a storefront, office hours, a menu, a class sign-up. "My page", "my clients" and "my shop" are the words of the service provider speaking, who is usually the person who made the app and is never assumed to be: any signed-in person can set up a page of their own, a provider can run more than one, and nothing in the rules or the screens asks who owns the vibe. The page is a document like any product (`_id: "page-" + crypto.randomUUID()`), its provider in a write-once `creatorHandle`, readable by everyone on its own `page:<id>` channel, and every record a visitor makes on it carries that page's id in `pageId`, so bookings live under their page rather than beside it. A visitor's record is private between that visitor and the page's provider: it routes to the page's inbox channel, which the page branch grants to its provider alone, and to the visitor's own `user:<handle>` channel, which grants them their own; what other visitors need to know — that a time is taken — rides a separate marker holding only the page and the time, routed to the page's public channel; a client who cancels deletes their booking, and the provider or the scheduled run frees the time. A count of what is left — seats in a class, loaves in this week's bake, spots in an evening — rides the same kind of marker: each visitor's record comes with a twin holding only the page, the item and how many it takes, routed to the page's public channel, and what's left is the item's total minus those twins, so the visitors' own records stay between each of them and the provider. Each page has its own link (`#page=<pageId>`): the provider's view shows it to copy and share, a visitor who opens it lands on that page's open times, and someone who opens the app with no page in the link sees the pages they run and can set up a new one. Clients can offer services too, by setting up a page of their own.
 
 ### `access.js`
 ```js partial

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "14.3.140",
+  "version": "14.3.141",
   "type": "module",
   "main": "./index.js",
   "exports": {
@@ -39,10 +39,10 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/api-types": "14.3.140",
-    "@vibes.diy/call-ai-v2": "14.3.140",
-    "@vibes.diy/identity": "14.3.140",
-    "@vibes.diy/use-vibes-types": "14.3.140",
+    "@vibes.diy/api-types": "14.3.141",
+    "@vibes.diy/call-ai-v2": "14.3.141",
+    "@vibes.diy/identity": "14.3.141",
+    "@vibes.diy/use-vibes-types": "14.3.141",
     "arktype": "~2.2.6",
     "json-schema-faker": "~0.6.3"
   },