@vibes.diy/prompts 14.3.191 → 14.3.192

package/llms/access.md

@@ -30,7 +30,7 @@ writes.
 
 **UserContext:** `{ userHandle: string, displayName?: string, backend?: "scheduled" | "onChange" | "fetch" }` — `userHandle` is stable unique id (use for all auth checks), `displayName` is display only (never use for identity checks), and `backend` is present only when the app's own `backend.js` issued this write, naming the handler that did (`scheduled`, `onChange` or `fetch`). Every write from a browser or the CLI arrives with `backend` absent, the app owner's own writes included — it says where a write came from, never who the writer is. Gate on `ctx.requireBackend(...)` rather than throwing on `user.backend` yourself: a bare `throw` on `user.backend` refuses the hand-repair lane admin mode exists for, and returns no descriptor for the write it refused.
 
-**Helpers (`ctx`):** Opaque closures over the materialized grant state. They throw or pass — you cannot enumerate channels, list members, or iterate grants. They also throw when `user` is null: `ctx.requireAccess(channelId)` throws if user is not in the channel, `ctx.requireRole(roleName)` throws if user is not in the role, and `ctx.requireBackend()` throws unless the app's own `backend.js` issued this write — `ctx.requireBackend("scheduled")` narrows that to one handler. All three no-op under admin mode.
+**Helpers (`ctx`):** Opaque closures over the materialized grant state. They throw or pass — you cannot enumerate channels, list members, or iterate grants. They also throw when `user` is null: `ctx.requireAccess(channelId)` throws if user is not in the channel, `ctx.requireRole(roleName)` throws if user is not in the role, and `ctx.requireBackend()` throws unless the app's own `backend.js` issued this write — `ctx.requireBackend("scheduled")` narrows that to one handler. `ctx.requireBackend` reads the write's origin, not its writer, so it also passes when nobody is signed in (a guest calling your `fetch` handler, or an `onChange` run a signed-out write triggered), while `user` stays null and the write still needs `allowAnonymous: true`. All three no-op under admin mode.
 
 Express every refusal about **who may act** through the supplied validators — `ctx.requireAccess`, `ctx.requireRole`, `ctx.requireBackend` — so that admin mode passes them and the function still runs, applying your own channels and grants to the repaired document; a refusal about the document's own **shape**, like an unknown type or a missing field, stays a plain `throw` and is right to, while a write-once check sits in between and is worth naming in a comment, since a schema repair has to get past it.
 

package/llms/backend.md

@@ -85,6 +85,15 @@ escalation. For documents only the server should control, use `scheduled` and
 gate them on the origin with `ctx.requireBackend("scheduled")`, which admits the
 run and turns every ordinary client write away.
 
+The origin travels with the write even when nobody is signed in, for every
+handler. A guest's `apiFetch` into the `fetch` handler arrives with `user` null,
+and `ctx.requireBackend("fetch")` still passes for it, so a guest-checkout
+record can be one only the handler writes; an `onChange` run triggered by a
+signed-out writer passes `ctx.requireBackend("onChange")` the same way. The function still opts that anonymous
+write in with `allowAnonymous: true`, and the app's anonymous-write setting
+still has to admit signed-out writers; `user.backend` itself is read only off a
+signed-in user, so gate with `ctx.requireBackend`.
+
 `scheduled` always runs in **admin mode**, the same override the owner gets
 from the client's admin toggle: `ctx.requireAccess(...)`, `ctx.requireRole(...)`
 and `ctx.requireBackend(...)` all no-op, and its `ctx.db.query` reads are

package/llms/cues.js.map

@@ -1 +1 @@
-{"version":3,"file":"cues.js","sourceRoot":"","sources":["../../jsr/llms/cues.ts"],"names":[],"mappings":"AAIA,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAmC;IAChF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvG,CAAC"}
+{"version":3,"file":"cues.js","sourceRoot":"","sources":["../../jsr/llms/cues.ts"],"names":[],"mappings":"AAKA,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAmC;IAChF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvG,CAAC"}

package/llms/custom-look.js

@@ -17,9 +17,10 @@ export const customLookConfig = {
         "shadcn",
         "neo-brutalist",
         "neobrutalism",
-        "gumroad",
+        "like gumroad",
         "terminal style",
-        "newspaper",
+        "like a newspaper",
+        "newspaper style",
         "linear style",
         "like linear",
         "ios settings",

package/llms/custom-look.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-look.js","sourceRoot":"","sources":["../../jsr/llms/custom-look.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,gXAAgX;IAClX,IAAI,EAAE;QACJ,aAAa;QACb,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,cAAc;QACd,aAAa;QACb,YAAY;QACZ,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,cAAc;QACd,QAAQ;QACR,eAAe;QACf,cAAc;QACd,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,cAAc;QACd,aAAa;QACb,cAAc;KACf;CACF,CAAC"}
+{"version":3,"file":"custom-look.js","sourceRoot":"","sources":["../../jsr/llms/custom-look.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,gXAAgX;IAClX,IAAI,EAAE;QACJ,aAAa;QACb,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,cAAc;QACd,aAAa;QACb,YAAY;QACZ,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,cAAc;QACd,QAAQ;QACR,eAAe;QACf,cAAc;QACd,cAAc;QACd,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,cAAc;QACd,aAAa;QACb,cAAc;KACf;CACF,CAAC"}

package/llms/stripe-subscriptions.md

@@ -51,8 +51,7 @@ a link to the exact page and uses the words that page uses:
    or change a card, and the portal exists once it is saved.
 3. Come back to the app. The Join buttons work in test mode the moment both
    items are done; the card `4242 4242 4242 4242` with any future date pays.
-4. Go live, one app at a time. Once a test payment goes through and live
-   payments are open on vibes.diy, press **Go live with Stripe** under
+4. Go live, one app at a time. Once a test payment goes through, press **Go live with Stripe** under
    **Payments** on the Settings tab and finish Stripe's live setup (once, for
    every app). Then press **Take live payments in this app** on this app's
    Setup screen, and save the **Customer portal** once more in live mode at

package/llms/stripe.md

@@ -59,8 +59,7 @@ a link to the exact page and uses the words that page uses:
 2. Come back to the app. The Pay buttons work in test mode the moment Stripe
    says the account is ready, with no redeploy; the card
    `4242 4242 4242 4242` with any future date pays.
-3. Go live, one app at a time. Once a test payment goes through and live
-   payments are open on vibes.diy, press **Go live with Stripe** under
+3. Go live, one app at a time. Once a test payment goes through, press **Go live with Stripe** under
    **Payments** on the Settings tab and finish Stripe's live setup (once, for
    every app). Then press **Take live payments in this app** on this app's
    Setup screen. This step stays on the Setup screen after the item is done,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "14.3.191",
+  "version": "14.3.192",
   "type": "module",
   "main": "./index.js",
   "exports": {
@@ -39,10 +39,10 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/api-types": "14.3.191",
-    "@vibes.diy/call-ai-v2": "14.3.191",
-    "@vibes.diy/identity": "14.3.191",
-    "@vibes.diy/use-vibes-types": "14.3.191",
+    "@vibes.diy/api-types": "14.3.192",
+    "@vibes.diy/call-ai-v2": "14.3.192",
+    "@vibes.diy/identity": "14.3.192",
+    "@vibes.diy/use-vibes-types": "14.3.192",
     "arktype": "~2.2.8",
     "json-schema-faker": "~0.6.3"
   },