@vibes.diy/prompts 14.3.186 → 14.3.188

package/llms/backend.md

@@ -893,6 +893,15 @@ recipe has three parts:
   document is cleared and the rest go through. `access.js` keeps every
   arrival at an `arrival:` id, so none can occupy a lead's id.
 
+**A lead list belongs to the owner and the teammates they add.** Records
+that carry people's names and contact details — leads, sign-ups, form
+responses, inquiries — land on one members channel. The owner reads it from
+the very first lead through the reserved `owner` role, and a `member` record
+the owner writes lets a teammate in (`grant.users` names that teammate's
+handle). The page gates its add-a-teammate control on
+`useVibe("leads").can`, says who sees the list beside it ("Just you and the
+teammates you add see these leads"), and your reply says the same.
+
 Gate both handlers on the secret, so the app works fully before any Zap
 exists, and say in your reply what the owner sets up: the secret, the Zap's
 POST address and header, and anonymous writes for the app (publishing from
@@ -998,14 +1007,21 @@ export function leads(doc, oldDoc, user, ctx) {
   }
   if (doc.type === "lead") {
     ctx.requireBackend("scheduled"); // a lead is written only after its seal matched
-    return { channels: ["leads"], grant: { users: { [user.userHandle]: ["leads"] } } };
+    return { channels: ["leads"], grant: { roles: { owner: ["leads"] } } }; // the owner reads every lead
+  }
+  if (doc.type === "member") {
+    ctx.requireRole("owner"); // the owner adds and removes teammates
+    if (typeof doc.userHandle !== "string" || doc.userHandle === "") throw { forbidden: "a member names a handle" };
+    if (oldDoc && oldDoc.userHandle !== doc.userHandle) throw { forbidden: "a member keeps its handle" };
+    return { channels: ["leads"], grant: { users: { [doc.userHandle]: ["leads"] }, roles: { owner: ["leads"] } } };
   }
   throw { forbidden: "unknown type" };
 }
 ```
 
 The page lists `lead` records with `useLiveQuery("type", { key: "lead" })`,
-and the owner sees each one within a minute of the Zap firing.
+and the owner and their teammates see each one within a minute of the Zap
+firing.
 
 ### Bulk transformations run as a route
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "14.3.186",
+  "version": "14.3.188",
   "type": "module",
   "main": "./index.js",
   "exports": {
@@ -39,10 +39,10 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/api-types": "14.3.186",
-    "@vibes.diy/call-ai-v2": "14.3.186",
-    "@vibes.diy/identity": "14.3.186",
-    "@vibes.diy/use-vibes-types": "14.3.186",
+    "@vibes.diy/api-types": "14.3.188",
+    "@vibes.diy/call-ai-v2": "14.3.188",
+    "@vibes.diy/identity": "14.3.188",
+    "@vibes.diy/use-vibes-types": "14.3.188",
     "arktype": "~2.2.8",
     "json-schema-faker": "~0.6.3"
   },