@vibes.diy/prompts 14.3.178 → 14.3.184

package/llms/backend.js

@@ -1,7 +1,7 @@
 export const backendConfig = {
     name: "backend",
     label: "backend-js",
-    description: "server-side backend.js file: answer HTTP/webhook requests at the app's /_api URL, react to committed data changes, and run scheduled jobs — its writes go through the app's own access rules; reads a web page, feed or API the person names and hands it to the page through /_api; emails, notifies and reminds people through ctx.notify by handle — a weekly digest, a summary for the owner, a Monday email to the manager — and invites a recipient who is not in the app yet; and sends a record to a tool the person names (Slack, Google Sheets, a CRM, Zapier) through a Zapier Catch Hook the owner connects",
-    cues: ["email", "notify", "remind", "digest", "zapier", "catch hook", "webhook", "slack", "sheets", "crm"],
+    description: "server-side backend.js file: answer HTTP/webhook requests at the app's /_api URL, react to committed data changes, and run scheduled jobs — its writes go through the app's own access rules; reads a web page, feed or API the person names and hands it to the page through /_api; emails, notifies and reminds people through ctx.notify by handle — a weekly digest, a summary for the owner, a Monday email to the manager — and invites a recipient who is not in the app yet; sends a record to a tool the person names (Slack, Google Sheets, a CRM, Zapier) through a Zapier Catch Hook the owner connects; and takes records in from Zapier — a Google Forms response, a new sheet row, an email — at its /_api URL, checked against a shared secret",
+    cues: ["email", "notify", "remind", "digest", "zapier", "catch hook", "webhook", "slack", "sheets", "crm", "google forms"],
 };
 //# sourceMappingURL=backend.js.map

package/llms/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../jsr/llms/backend.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,YAAY;IACnB,WAAW,EACT,ylBAAylB;IAK3lB,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC;CAC3G,CAAC"}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../jsr/llms/backend.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,YAAY;IACnB,WAAW,EACT,guBAAguB;IAKluB,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;CAC3H,CAAC"}

package/llms/backend.md

@@ -21,7 +21,9 @@ create or mention `backend.js`.
 ## When to use which handler — signal words
 
 - **`fetch`** — "webhook", "OAuth", "callback", "API endpoint", "receive",
-  "form POST", "Stripe/GitHub/Sonos sends us…". Something **external → us**.
+  "form POST", "Stripe/GitHub/Sonos sends us…", "from Zapier", "when a form
+  is submitted in Google Forms", "every new row in my sheet". Something
+  **external → us**.
 - **`onChange`** — "when X is created", "after a write", "notify", "send an
   email", "aggregate", "moderate", "sync to…". An **internal write → a side
   effect**: `ctx.notify` for every person the app emails, notifies or reminds,
@@ -158,8 +160,12 @@ await ctx.notify({ toHandle: "alice", body: "Your turn", dedupeKey: "game-7-turn
 ctx.log("info", "tick finished", { written: 3 }); // diagnostics — read back with: vibes-diy app logs owner/slug
 const gh = await ctx.github.fetch("/repos/acme/site/issues", { method: "POST", body: { title: "Filed from the vibe" } }); // connected GitHub repo
 const routes = await ctx.github.routes(); // [{ repo, accountLogin, binderHandle, installationId }] — who connected which repo; no GitHub call
+const session = await ctx.stripe.fetch("/v1/checkout/sessions", { method: "POST", body: form, mode: "test" }); // the owner's connected Stripe account
+const stripe = await ctx.stripe.status(); // { test: { available, state }, live: { available, state } }
 ```
 
+- An app that takes money loads the `stripe` skill (one-time charges) or the `stripe-subscriptions` skill (recurring): the Connect Stripe setup item, `ctx.stripe.fetch` with the order's `mode` on every call, hosted Checkout and a complete example.
+
 - An app that works with somebody's GitHub repo loads the `github` skill: the connect link, `config.github`, `ctx.github.routes()`, deliveries and a complete example.
 - `ctx.github.fetch(path, init)` calls the GitHub REST API **as the GitHub App
   installation the owner connected to this vibe**. It is the only GitHub surface
@@ -400,7 +406,9 @@ const routes = await ctx.github.routes(); // [{ repo, accountLogin, binderHandle
     anything else **throw** — a handler that returns normally has acknowledged
     the event, so the platform will not call it again for that write, while a
     thrown `onChange` is re-delivered with backoff (a handful of tries over a few
-    minutes) and a run that never succeeds lands in the app's logs.
+    minutes) and a run that never succeeds lands in the app's logs. Records
+    travelling the other way, from a tool into the app, arrive at `fetch`:
+    see *Records in from Zapier* below.
 
     ```js
     export async function onChange(event, ctx) {
@@ -843,6 +851,162 @@ signed in.
 Writes a handler makes with `ctx.db.put` still pass through `access.js` as the
 caller, so the app's rules hold for API writes too.
 
+### Records in from Zapier — a Zap that POSTs to `/_api`
+
+A Zap brings records into the app by POSTing to its `/_api` route.
+Reach for it when the ask says the records come *from* another tool — "from
+Zapier", "when a form is submitted in Google Forms", "every new row in my
+sheet", "each new email in my inbox". The owner makes a Zap whose trigger is
+that tool and whose action is **Webhooks by Zapier → POST** to
+`https://vibes.diy/vibe/<owner>/<slug>/_api/zapier/lead`, sending the fields as
+JSON and mapping the tool's own id for the record (the form response id, the
+row id, the message id) to `id`. The route answers the world once the app is
+published.
+
+A Zap carries no vibes.diy sign-in, so the route runs as nobody, and the
+recipe has three parts:
+
+- **A shared secret proves the sender.** The owner picks a long random value,
+  saves it as a secret (`vibes-diy secrets set ZAPIER_INBOUND_SECRET`), and
+  pastes the same value into the Zap as an `x-zapier-secret` header. The
+  handler compares the two in constant time and answers `401` when they
+  differ. The secret rides a header of the app's own naming: `Authorization`
+  and `Cookie` are removed before the handler sees the request, and
+  `x-vibes-*` belongs to the platform.
+- **The same record lands on the same document.** Zapier can deliver one
+  record twice, so its key comes from the record itself — the mapped `id`, or
+  a hash of the body — and the record the app shows is written at
+  `lead:<key>` with `ifRev: null`, so a second delivery meets a `conflict`
+  and changes nothing.
+- **The route writes a sealed arrival, and the tick turns it into the
+  record.** The route's write is anonymous, so `access.js` admits it with
+  `allowAnonymous: true` — and a type an anonymous route may write, any
+  visitor may write directly too. So the route writes an `arrival` carrying a
+  seal (an HMAC of its fields under the secret) on a channel no reader is
+  granted, and `scheduled`, which reads every channel, makes the seal again,
+  writes each matching arrival as the record the app shows (a type only
+  `scheduled` writes), and clears the arrival. An arrival with no matching
+  seal is cleared without becoming a record. The tick pages through every
+  arrival on the `next` cursor, up to ten pages a tick, so a pile of unsealed
+  arrivals never stands in front of a real one, and it handles each arrival
+  on its own — fields checked as strings, any failure logged — so one odd
+  document is cleared and the rest go through. `access.js` keeps every
+  arrival at an `arrival:` id, so none can occupy a lead's id.
+
+Gate both handlers on the secret, so the app works fully before any Zap
+exists, and say in your reply what the owner sets up: the secret, the Zap's
+POST address and header, and anonymous writes for the app (publishing from
+the editor turns them on when `access.js` declares `allowAnonymous`; after a
+CLI push, `vibes-diy app anon-write <owner>/<slug> on`).
+
+### `backend.js`
+```js
+export const config = { scheduled: { interval: "1m" } };
+
+const enc = new TextEncoder();
+
+function json(data, status) {
+  return new Response(JSON.stringify(data), { status: status ?? 200, headers: { "content-type": "application/json" } });
+}
+
+function hex(buf) {
+  return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// The seal: an HMAC of the record's fields under the shared secret.
+async function sealOf(secret, arrival) {
+  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return hex(await crypto.subtle.sign("HMAC", key, enc.encode(JSON.stringify([arrival.key, arrival.name, arrival.email]))));
+}
+
+// Constant time: both sides become fixed-length digests, compared byte by byte with no early exit.
+async function sameText(a, b) {
+  const [x, y] = await Promise.all([a, b].map(async (s) => new Uint8Array(await crypto.subtle.digest("SHA-256", enc.encode(s)))));
+  let diff = 0;
+  for (let i = 0; i < x.length; i++) diff |= x[i] ^ y[i];
+  return diff === 0;
+}
+
+export async function fetch(request, ctx) {
+  const url = new URL(request.url);
+  if (url.pathname !== "/zapier/lead" || request.method !== "POST") return json({ ok: false, reason: "not found" }, 404);
+  const secret = ctx.secrets.ZAPIER_INBOUND_SECRET;
+  if (!secret) return json({ ok: false, reason: "this app is still being set up" }, 503);
+  const given = request.headers.get("x-zapier-secret") ?? "";
+  if (!(await sameText(given, secret))) return json({ ok: false, reason: "unrecognized sender" }, 401);
+  const raw = await request.text();
+  let body;
+  try {
+    body = JSON.parse(raw);
+  } catch {
+    return json({ ok: false, reason: "send the fields as JSON" }, 400);
+  }
+  if (typeof body?.name !== "string" || typeof body?.email !== "string") {
+    return json({ ok: false, reason: "name and email are needed" }, 400);
+  }
+  // The key comes from the record itself, so a second delivery of it lands on the same lead.
+  const source = typeof body.id === "string" && body.id !== "" ? body.id : raw;
+  const key = hex(await crypto.subtle.digest("SHA-256", enc.encode(source)));
+  const arrival = { type: "arrival", key, name: body.name.slice(0, 200), email: body.email.slice(0, 200) };
+  arrival.seal = await sealOf(secret, arrival);
+  await ctx.db.put(arrival, { db: "leads", id: "arrival:" + arrival.seal });
+  return json({ ok: true, key });
+}
+
+export async function scheduled(event, ctx) {
+  const secret = ctx.secrets.ZAPIER_INBOUND_SECRET;
+  let added = 0;
+  let cleared = 0;
+  let after;
+  let pages = 0;
+  // Page through every arrival (up to 10 pages a tick), so a pile of unsealed ones never hides a real one.
+  do {
+    const page = secret ? await ctx.db.query({ db: "leads", field: "type", key: "arrival", limit: 200, after }) : [];
+    for (const arrival of page) {
+      // Each arrival is handled on its own: whatever one holds, the tick clears it and moves on.
+      try {
+        const wellFormed = ["key", "name", "email", "seal"].every((f) => typeof arrival[f] === "string");
+        if (wellFormed && (await sameText(arrival.seal, await sealOf(secret, arrival)))) {
+          const lead = { type: "lead", name: arrival.name, email: arrival.email, addedAt: event.scheduledTime };
+          await ctx.db.put(lead, { db: "leads", id: "lead:" + arrival.key, ifRev: null });
+          added += 1;
+        } else {
+          cleared += 1;
+        }
+      } catch (err) {
+        // A conflict means this lead is already here; anything else is logged and the arrival cleared.
+        if (err?.code !== "conflict") ctx.log("warn", "arrival set aside", { id: arrival._id, reason: String(err?.message ?? err) });
+      }
+      await ctx.db.delete(arrival._id, { db: "leads" }).catch((err) => ctx.log("warn", "arrival kept", { id: arrival._id, reason: String(err?.message ?? err) }));
+    }
+    after = page.next;
+    pages += 1;
+  } while (after && pages < 10);
+  ctx.log("info", "zapier arrivals", { added, cleared });
+}
+```
+
+### `access.js`
+```js
+export function leads(doc, oldDoc, user, ctx) {
+  if (oldDoc && oldDoc.type !== doc.type) throw { forbidden: "a record keeps its type" }; // a delete arrives as the stored record, type and all
+  if (doc.type === "arrival") {
+    // An arrival lives at `arrival:<seal>`, so no arrival can sit at a lead's id.
+    if (typeof doc._id !== "string" || !doc._id.startsWith("arrival:")) throw { forbidden: "an arrival lives at arrival:<seal>" };
+    if (doc._deleted) ctx.requireBackend("scheduled"); // the tick clears arrivals
+    return { channels: ["arrivals"], allowAnonymous: true }; // no reader is granted this channel
+  }
+  if (doc.type === "lead") {
+    ctx.requireBackend("scheduled"); // a lead is written only after its seal matched
+    return { channels: ["leads"], grant: { users: { [user.userHandle]: ["leads"] } } };
+  }
+  throw { forbidden: "unknown type" };
+}
+```
+
+The page lists `lead` records with `useLiveQuery("type", { key: "lead" })`,
+and the owner sees each one within a minute of the Zap firing.
+
 ### Bulk transformations run as a route
 
 A change that touches many stored records is written once, as a named `/_api` route, and run

package/llms/connections.js

@@ -1,20 +1,25 @@
 export const connectionsConfig = {
     name: "connections",
     label: "Connections",
-    description: "Connect a visitor's own GitHub profile, Threads or Instagram account with one click and read it from backend.js — config.connections, useConnection, @vibes.diy/social",
+    description: "Connect a visitor's own GitHub profile, Threads, Instagram or LinkedIn account with one click, read it from backend.js, and post to their Threads, Instagram or LinkedIn — config.connections, useConnection, @vibes.diy/social",
     cues: [
         "connect my",
         "sign in with github",
         "sign in with instagram",
         "sign in with threads",
+        "sign in with linkedin",
         "my instagram",
         "my threads",
         "my github",
+        "my linkedin",
+        "post to linkedin",
+        "share on linkedin",
         "my posts",
         "my followers",
         "social media login",
         "instagram",
         "threads",
+        "linkedin",
         "github account",
     ],
     importModule: "use-vibes",

package/llms/connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../jsr/llms/connections.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAc;IAC1C,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,wKAAwK;IAC1K,IAAI,EAAE;QACJ,YAAY;QACZ,qBAAqB;QACrB,wBAAwB;QACxB,sBAAsB;QACtB,cAAc;QACd,YAAY;QACZ,WAAW;QACX,UAAU;QACV,cAAc;QACd,oBAAoB;QACpB,WAAW;QACX,SAAS;QACT,gBAAgB;KACjB;IACD,YAAY,EAAE,WAAW;IACzB,UAAU,EAAE,eAAe;CAC5B,CAAC"}
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../jsr/llms/connections.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAc;IAC1C,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,iOAAiO;IACnO,IAAI,EAAE;QACJ,YAAY;QACZ,qBAAqB;QACrB,wBAAwB;QACxB,sBAAsB;QACtB,uBAAuB;QACvB,cAAc;QACd,YAAY;QACZ,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,mBAAmB;QACnB,UAAU;QACV,cAAc;QACd,oBAAoB;QACpB,WAAW;QACX,SAAS;QACT,UAAU;QACV,gBAAgB;KACjB;IACD,YAAY,EAAE,WAAW;IACzB,UAAU,EAAE,eAAe;CAC5B,CAAC"}

package/llms/connections.md

@@ -1,7 +1,7 @@
 # Connections — a visitor's own account, spent by your app
 
 A **connection** lets a visitor link their own third-party account (GitHub,
-Threads, Instagram) to your app in one click, and lets your `backend.js` read
+Threads, Instagram, LinkedIn) to your app in one click, and lets your `backend.js` read
 from that account — and, when they approve it, post to it — as them. The platform shows the consent screen, runs the
 sign-in, holds the credential, refreshes it, and warns the person before it
 expires. Your app contains **no** client id, secret, redirect route, token
@@ -17,7 +17,7 @@ to replace.
 
 ## When to use it — signal words
 
-"connect my Instagram", "sign in with GitHub", "my Threads posts", "show my
+"connect my Instagram", "sign in with GitHub", "my Threads posts", "post this to my LinkedIn", "show my
 profile from …", "which of my videos got the most likes", "my followers on …".
 A request that names one of the providers below and wants **their** data is a
 connection. A request for public data nobody has to log in for (a public feed,
@@ -62,6 +62,8 @@ GitHub profile next to your entries."), never as a note to yourself.
 | `threads`   | `threads_content_publish`             | **post to their Threads feed** (`threads(ctx).publish()`)        |
 | `instagram` | `instagram_business_basic`            | read the account's profile and its own media with like/comment counts |
 | `instagram` | `instagram_business_content_publish`  | **post a photo or video to their Instagram** (`instagram(ctx).publish()`) |
+| `linkedin`  | `profile`                             | read the member's name and profile photo (`linkedin(ctx).me()`)  |
+| `linkedin`  | `w_member_social`                     | **post to their LinkedIn feed** (`linkedin(ctx).post()`); declare `profile` beside it |
 
 **A scope that posts is a separate scope, and asking for it is the whole
 authorization.** Declare it only when the app really posts, and say so in `why`
@@ -158,8 +160,18 @@ provider call as a typed request with a typed response, so there is no
 - `instagram(ctx).publish({ imageUrl, caption? })` → `{ id }`. Needs
   `instagram_business_content_publish`. Instagram has no text-only post, so
   `imageUrl` is required.
-
-**Video posting is not available on either provider yet** — the provider hands
+- `linkedin(ctx).me()` → `{ id, name, givenName, familyName, picture, personUrn }`.
+  Needs `profile`.
+- `linkedin(ctx).post({ text, visibility?, link? })` → `{ id }`. Needs
+  `w_member_social` and `profile` (a post is authored as the member, and
+  `profile` is where their id comes from). `text` is plain prose: the library
+  escapes LinkedIn's formatting characters and keeps `#hashtags` live.
+  `visibility` is `"PUBLIC"` (default) or `"CONNECTIONS"`. `link` is
+  `{ url, title?, description? }` and becomes the post's card exactly as given,
+  since LinkedIn shows what the request carries. LinkedIn posts carry text and
+  a link card.
+
+**Video posting is not available on any provider yet** — the provider hands
 back a container while the video is still processing, and the platform cannot
 yet read that container's status, so a video post would intermittently fail
 rather than land. Build on text and images; do not work around it with a raw

package/llms/stripe-subscriptions.js

@@ -1,7 +1,7 @@
 export const stripeSubscriptionsConfig = {
     name: "stripe-subscriptions",
     label: "Stripe subscriptions",
-    description: "A paid membership or subscription through Stripe Checkout in subscription mode, ONLY when the person asks for recurring money — monthly, yearly, subscribe, membership fee, paid tier, paywall — on the owner's own STRIPE_SECRET_KEY: the setup steps the app shows when the key or the Customer Portal is missing, the key kept in backend.js with no Stripe.js in the page, one pending membership then one Checkout Session opened in a new tab, entitlement computed from Stripe's status plus one GRACE_DAYS knob for a past_due card, members-only content as a channel the membership record grants and the backend withdraws, cancellation and card changes in Stripe's Customer Portal, and a scheduled sweep that re-reads every live subscription. A one-time charge (dues once, a ticket, a deposit) is the stripe skill; an app with members-only content that charges nothing does not need this — offer it as the [pay] option instead",
+    description: "A paid membership or subscription through Stripe Checkout in subscription mode, ONLY when the person asks for recurring money — monthly, yearly, subscribe, membership fee, paid tier, paywall — into the owner's own Stripe account through ctx.stripe, connected once with Connect Stripe: the Connect Stripe and Customer Portal setup items, test mode first with the membership's mode passed on every call and live once the owner takes this app live, every Stripe call in backend.js with no Stripe.js in the page, one pending membership then one Checkout Session opened in a new tab, entitlement computed from Stripe's status plus one GRACE_DAYS knob for a past_due card, members-only content as a channel the membership record grants and the backend withdraws, cancellation and card changes in Stripe's Customer Portal, and a scheduled sweep that re-reads every live subscription. A one-time charge (dues once, a ticket, a deposit) is the stripe skill; an app with members-only content that charges nothing does not need this — offer it as the [pay] option instead",
     cues: [
         "subscription",
         "subscribe",

package/llms/stripe-subscriptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"stripe-subscriptions.js","sourceRoot":"","sources":["../../jsr/llms/stripe-subscriptions.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,yBAAyB,GAAc;IAClD,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,w5BAAw5B;IAC15B,IAAI,EAAE;QACJ,cAAc;QACd,WAAW;QACX,SAAS;QACT,WAAW;QACX,SAAS;QACT,QAAQ;QACR,gBAAgB;QAChB,iBAAiB;QACjB,WAAW;QACX,SAAS;QACT,WAAW;QACX,cAAc;QACd,iBAAiB;KAClB;CACF,CAAC"}
+{"version":3,"file":"stripe-subscriptions.js","sourceRoot":"","sources":["../../jsr/llms/stripe-subscriptions.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,yBAAyB,GAAc;IAClD,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,siCAAsiC;IACxiC,IAAI,EAAE;QACJ,cAAc;QACd,WAAW;QACX,SAAS;QACT,WAAW;QACX,SAAS;QACT,QAAQ;QACR,gBAAgB;QAChB,iBAAiB;QACjB,WAAW;QACX,SAAS;QACT,WAAW;QACX,cAAc;QACd,iBAAiB;KAClB;CACF,CAAC"}