@vibes.diy/prompts 14.3.38 → 14.3.40

package/llms/access.md

@@ -14,7 +14,13 @@ including the intended next status. For example, cancelling a reservation constr
 `const next = { ...reservation, status: "cancelled" }`, checks `can.edit(next).ok`, and
 saves `next`. A creation control checks the complete creation draft. On a denial render a
 sentence in the app's own words — `reason` is a machine token that informs that sentence —
-and keep loading and signed-out states distinct from denial.
+and keep loading and signed-out states distinct from denial. Name the invite screen in the
+app's world — a party board says "Invite a friend" while a team workspace keeps the fitting
+"Invite Collaborator" — and shape the denial for who is reading it: a signed-out visitor gets
+the contextual sign-in invitation ("Sign in to add your roast", wired to `requestLogin()`); a
+signed-in viewer outside the membership gets the membership explanation, not another sign-in
+button. A playful occasion never widens the audience — the rules still decide who reads and
+writes.
 
 ## Reference
 

package/llms/callai.initial.md

@@ -6,6 +6,8 @@ The browser runtime validates each answer against your schema. A schema mismatch
 
 Use this capability when an app turns words into structured records or provides requested model-generated text. Direct controls handle known values, and a simple message saves directly when its text is the whole record.
 
+Name what the app does in the app's own words. The function name `callAI` stays in implementation context — it never becomes a label, a badge, or a credit line in the UI (a roast board says what it makes, not what it is powered by). One plain sentence about AI is right where it helps the person understand the experience; the function name is not.
+
 ## Text to records
 
 An ordinary tracker with several facts per entry uses sentence creation even when the person never asks for AI, pasting, or a chat interface. A packing board with item, quantity, and who is bringing it, or a potluck board with dish, servings, and contributor, starts with this composer. Keep quantity steppers, claim buttons, and toggles on existing records as direct controls; they complement sentence creation. A name-only list, a simple message, and a timer stay direct because their input already is the whole record or an explicit setting.

package/llms/callai.md

@@ -6,6 +6,8 @@ The browser runtime validates each answer against your schema. A schema mismatch
 
 Use this capability when an app turns words into structured records or provides requested model-generated text. Direct controls handle known values, and a simple message saves directly when its text is the whole record.
 
+Name what the app does in the app's own words. The function name `callAI` stays in implementation context — it never becomes a label, a badge, or a credit line in the UI (a roast board says what it makes, not what it is powered by). One plain sentence about AI is right where it helps the person understand the experience; the function name is not.
+
 ## Text to records
 
 An ordinary tracker with several facts per entry uses sentence creation even when the person never asks for AI, pasting, or a chat interface. A packing board with item, quantity, and who is bringing it, or a potluck board with dish, servings, and contributor, starts with this composer. Keep quantity steppers, claim buttons, and toggles on existing records as direct controls; they complement sentence creation. A name-only list, a simple message, and a timer stay direct because their input already is the whole record or an explicit setting.

package/llms/use-viewer.initial.md

@@ -274,6 +274,8 @@ Copy that works, and copy that doesn't:
 
 And never disable the app's real controls on `!viewer`. If favoriting works signed out, keep it working signed out — the platform refuses the *cloud* write on its own, calmly, while the local write still succeeds. Turning a working app into a signup wall is worse than never asking at all.
 
+Keep the guest's composed text across sign-in. Draft input lives in component state (or a local draft the app already saves) — and signing in never clears it. The new identity arrives on its own through `viewer`; the words they typed stay where they left them, and they continue from there. A form that resets on identity change makes the guest write everything twice.
+
 ## Notes
 
 - Never use Clerk user IDs. Only `userHandle` crosses into vibe code.

package/llms/use-viewer.md

@@ -265,6 +265,8 @@ Copy that works, and copy that doesn't:
 
 And never disable the app's real controls on `!viewer`. If favoriting works signed out, keep it working signed out — the access function refuses the *cloud* write on its own, calmly, while the local write still succeeds. Turning a working app into a signup wall is worse than never asking at all.
 
+Keep the guest's composed text across sign-in. Draft input lives in component state (or a local draft the app already saves) — and signing in never clears it. The new identity arrives on its own through `viewer`; the words they typed stay where they left them, and they continue from there. A form that resets on identity change makes the guest write everything twice.
+
 ## Notes
 
 - Never use Clerk user IDs. Only `userHandle` crosses into vibe code.

package/llms/web-audio.js

@@ -12,9 +12,15 @@ export const webAudioConfig = {
         "oscillator",
         "metronome",
         "drum machine",
+        "drum",
+        "drums",
         "midi",
         "melody",
         "web audio",
+        "samples",
+        "sampled",
+        "sampled sounds",
+        "audio engine",
     ],
     draftVariant: true,
 };

package/llms/web-audio.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-audio.js","sourceRoot":"","sources":["../../jsr/llms/web-audio.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,eAAe;IACtB,WAAW,EACT,2NAA2N;IAC7N,IAAI,EAAE;QACJ,OAAO;QACP,OAAO;QACP,QAAQ;QACR,OAAO;QACP,OAAO;QACP,aAAa;QACb,YAAY;QACZ,WAAW;QACX,cAAc;QACd,MAAM;QACN,QAAQ;QACR,WAAW;KACZ;IAGD,YAAY,EAAE,IAAI;CACnB,CAAC"}
+{"version":3,"file":"web-audio.js","sourceRoot":"","sources":["../../jsr/llms/web-audio.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,eAAe;IACtB,WAAW,EACT,2NAA2N;IAC7N,IAAI,EAAE;QACJ,OAAO;QACP,OAAO;QACP,QAAQ;QACR,OAAO;QACP,OAAO;QACP,aAAa;QACb,YAAY;QACZ,WAAW;QACX,cAAc;QACd,MAAM;QACN,OAAO;QACP,MAAM;QACN,QAAQ;QACR,WAAW;QACX,SAAS;QACT,SAAS;QACT,gBAAgB;QAChB,cAAc;KACf;IAGD,YAAY,EAAE,IAAI;CACnB,CAAC"}

package/llms/web-audio.md

@@ -289,4 +289,68 @@ The shape that works (filenames illustrative — split by responsibility, matche
 - Never autoplay audio on load; playback must follow a user gesture (the `unlockAudio()` gate in §1).
 - Wire brief feedback to the app's one or two satisfying core actions — the "it worked" beats (a point scored, a post landing, a match made) — and route it through the resume-on-user-gesture unlock so it sounds on mobile. Quiet/utility apps skip audio entirely.
 
+## 8) Heavyweight audio engines arrive by runtime import
+
+When the app needs a serious sound engine — sampled drums, a full synth framework — rather than hand-built oscillators, import the engine with its full pinned esm.sh URL in a memoized module-level loader, and call that loader only from a user gesture. Laziness is doing two jobs here: a body-position `await import("engine-name")` with a bare specifier ships unrewritten — the import rewrite covers only the top-of-file import region — and dies at runtime with `Failed to resolve module specifier`, so the specifier is the complete versioned URL; and an engine plus its sample bank stays off first paint entirely.
+
+The gesture handler unlocks synchronously FIRST, before any await: call `unlockAudio()` (§1) at the top of the handler and keep its return — the context the gesture unlocked. Then await the loader, and bind the engine to that SAME context before creating any voice: `Tone.setContext(ctx)` drives the engine on the already-running context, and `Tone.getContext().rawContext === ctx` verifies the identity. Without the bind, `Tone.start()` resumes a context the engine created lazily after the await — a different context from the one the gesture unlocked. Verified on desktop Chromium; on mobile the engine's first sound still follows the loader's await, so claim only what desktop evidence shows (iOS counts a synchronous start inside the gesture, and a lazily imported engine starts after an await).
+
+A stop control silences everything — pending playback, retained voices, the transport and its future callbacks. Plays and stops share one generation counter: Stop increments it, and a playback still awaiting the loader checks it after every await and stays silent when it moved — otherwise Play → Stop → load-resolves creates and plays a voice after Stop cleared the set. Then release the retained voices and stop/cancel the transport: stopping the transport alone leaves sounding voices droning on.
+
+Check the engine's license first: reach for a permissively licensed engine (the worked sample below is Tone.js 15.1.22, MIT), credit it visibly in the UI, and load it at runtime from the CDN — its code lives at its URL, not in the app.
+
+```js
+// Memoized module-level loader — one network fetch no matter how many pads play it.
+let tonePromise;
+function loadTone() {
+  tonePromise ??= import("https://esm.sh/tone@15.1.22");
+  return tonePromise;
+}
+
+// Every voice the app created, so Stop can silence retained voices too.
+const liveVoices = new Set();
+// Plays AND stops count here: a playback still awaiting the loader belongs to
+// an older generation once Stop runs, and must never sound.
+let playEpoch = 0;
+```
+
+```js
+async function handlePlay() {
+  const ctx = unlockAudio(); // §1 gate — synchronous, in the gesture
+  const myTurn = playEpoch;
+  const Tone = await loadTone();
+  if (myTurn !== playEpoch) return; // Stop ran while loading — stay silent
+  // The engine drives the context the gesture unlocked: bind once per context,
+  // then verify the identity before creating any voice.
+  if (Tone.getContext().rawContext !== ctx) Tone.setContext(ctx);
+  const synth = new Tone.MembraneSynth().toDestination();
+  if (myTurn !== playEpoch) {
+    synth.dispose?.(); // Stop landed between the bind and here — no sound
+    return;
+  }
+  liveVoices.add(synth);
+  synth.triggerAttackRelease("C2", "8n");
+}
+
+function handleStop() {
+  playEpoch++; // cancel any playback still waiting on the loader
+  // Silence retained voices first, then the transport and its future callbacks.
+  for (const voice of liveVoices) {
+    try {
+      voice.triggerRelease?.();
+      voice.dispose?.();
+    } catch {
+      /* a voice that already ended needs nothing */
+    }
+  }
+  liveVoices.clear();
+  loadTone().then((Tone) => {
+    Tone.getTransport().stop();
+    Tone.getTransport().cancel();
+  });
+}
+```
+
+The Play button names what it plays ("Play the drums"), the Stop button is beside it from the first sound, and a small line credits the engine ("Sounds by Tone.js (MIT)") — the audience hears drums, not infrastructure.
+
 — End —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "14.3.38",
+  "version": "14.3.40",
   "type": "module",
   "main": "./index.js",
   "exports": {
@@ -37,9 +37,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "14.3.38",
-    "@vibes.diy/identity": "14.3.38",
-    "@vibes.diy/use-vibes-types": "14.3.38",
+    "@vibes.diy/call-ai-v2": "14.3.40",
+    "@vibes.diy/identity": "14.3.40",
+    "@vibes.diy/use-vibes-types": "14.3.40",
     "arktype": "~2.2.3",
     "json-schema-faker": "~0.6.3"
   },

package/system-prompt-initial-oneshot.md

@@ -174,6 +174,7 @@ A second visitor should arrive at a party, not a parking lot: within five second
 - **Generated images as content, not decoration.** Where pictures naturally belong (avatars, covers, cards, monsters, prizes), render them with `<ImgGen>` and a vivid specific prompt — never a placeholder box or a generic prompt like "an image".
 - **Motion on state changes.** Small fast transitions (150–300ms) when things appear, complete, or score — enough that actions feel acknowledged, not a light show.
 - **Empty states invite, they don't announce.** "Draw the first monster" with the button right there, not "No data yet".
+- **Carry the occasion into every word.** Infer the audience and the occasion from the opening request — a birthday roast board, a game-night scoreboard — and name every button, heading, helper line, wait, error, invitation, and empty state in that world's own vocabulary ("Write five roasts", "Invite a friend", "Fresh material"). Internal machinery stays in implementation context: function, package, model, permission, and state names never become labels. One plain sentence about AI is right where it helps the person understand the experience; the function name is not.
 - **A share affordance on the FIRST screen — for apps where sharing fits.** When the app is social, collaborative, or built to be shown to others, surface its invite/share/publish action where a first-time user can see it without digging, gate it like any write surface (`can.create({...draft}).ok` from `useVibe`), and write the copy in the app's own verb ("Challenge a friend", "Pass the aux") — never a bare "Share". Private-by-nature and solo apps get NO share affordance (the guidance above about private apps omitting sharing controls wins).
 
 **Restraint — alive never means obnoxious.** No confetti on load; no popups nagging people to share. One or two well-placed delightful touches beat a wall of noise.

package/system-prompt-initial.md

@@ -176,6 +176,7 @@ A second visitor should arrive at a party, not a parking lot: within five second
 - **Generated images as content, not decoration.** Where pictures naturally belong (avatars, covers, cards, monsters, prizes), render them with `<ImgGen>` and a vivid specific prompt — never a placeholder box or a generic prompt like "an image".
 - **Motion on state changes.** Small fast transitions (150–300ms) when things appear, complete, or score — enough that actions feel acknowledged, not a light show.
 - **Empty states invite, they don't announce.** "Draw the first monster" with the button right there, not "No data yet".
+- **Carry the occasion into every word.** Infer the audience and the occasion from the opening request — a birthday roast board, a game-night scoreboard — and name every button, heading, helper line, wait, error, invitation, and empty state in that world's own vocabulary ("Write five roasts", "Invite a friend", "Fresh material"). Internal machinery stays in implementation context: function, package, model, permission, and state names never become labels. One plain sentence about AI is right where it helps the person understand the experience; the function name is not.
 - **A share affordance on the FIRST screen — for apps where sharing fits.** When the app is social, collaborative, or built to be shown to others, surface its invite/share/publish action where a first-time user can see it without digging, gate it like any write surface (`can.create({...draft}).ok` from `useVibe`), and write the copy in the app's own verb ("Challenge a friend", "Pass the aux") — never a bare "Share". Private-by-nature and solo apps get NO share affordance (the guidance above about private apps omitting sharing controls wins).
 
 **Restraint — alive never means obnoxious.** No confetti on load; no popups nagging people to share. One or two well-placed delightful touches beat a wall of noise.

package/system-prompt.md

@@ -775,6 +775,7 @@ A second visitor should arrive at a party, not a parking lot: within five second
 - **Generated images as content, not decoration.** Where pictures naturally belong (avatars, covers, cards, monsters, prizes), render them with `<ImgGen>` and a vivid specific prompt — never a placeholder box or a generic prompt like "an image".
 - **Motion on state changes.** Small fast transitions (150–300ms) when things appear, complete, or score — enough that actions feel acknowledged, not a light show.
 - **Empty states invite, they don't announce.** "Draw the first monster" with the button right there, not "No data yet".
+- **Carry the occasion into every word.** Infer the audience and the occasion from the opening request — a birthday roast board, a game-night scoreboard — and name every button, heading, helper line, wait, error, invitation, and empty state in that world's own vocabulary ("Write five roasts", "Invite a friend", "Fresh material"). Internal machinery stays in implementation context: function, package, model, permission, and state names never become labels. One plain sentence about AI is right where it helps the person understand the experience; the function name is not.
 - **A share affordance on the FIRST screen — for apps where sharing fits.** When the app is social, collaborative, or built to be shown to others, surface its invite/share/publish action where a first-time user can see it without digging, gate it like any write surface (`can.create({...draft}).ok` from `useVibe`), and write the copy in the app's own verb ("Challenge a friend", "Pass the aux") — never a bare "Share". Private-by-nature and solo apps get NO share affordance (the guidance above about private apps omitting sharing controls wins).
 
 **Restraint — alive never means obnoxious.** No confetti on load; no popups nagging people to share. One or two well-placed delightful touches beat a wall of noise.