@vibes.diy/prompts 4.0.4 → 4.0.6

package/json-docs.d.ts

@@ -5,6 +5,7 @@ export interface JsonDoc<T = LlmConfig> {
     readonly obj: T;
 }
 export interface JsonDocs {
+    "backend.json": JsonDoc;
     "callai.json": JsonDoc;
     "create-vibe.json": JsonDoc;
     "d3.json": JsonDoc;

package/json-docs.js.map

@@ -1 +1 @@
-{"version":3,"file":"json-docs.js","sourceRoot":"","sources":["../jsr/json-docs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAyB7C,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,IAAuB,EAAE;IAC5D,MAAM,CAAC,GAAa,EAAc,CAAC;IAGnC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,CAAC"}
+{"version":3,"file":"json-docs.js","sourceRoot":"","sources":["../jsr/json-docs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA0B7C,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,IAAuB,EAAE;IAC5D,MAAM,CAAC,GAAa,EAAc,CAAC;IAGnC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC;QACvC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,CAAC"}

package/llms/backend.d.ts

@@ -0,0 +1,2 @@
+import type { LlmConfig } from "./types.js";
+export declare const backendConfig: LlmConfig;

package/llms/backend.js

@@ -0,0 +1,6 @@
+export const backendConfig = {
+    name: "backend",
+    label: "backend-js",
+    description: "server-side backend.js file: answer HTTP/webhook requests at the app's /_api URL, react to committed data changes, and run scheduled jobs — its writes go through the app's own access rules",
+};
+//# sourceMappingURL=backend.js.map

package/llms/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../jsr/llms/backend.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,aAAa,GAAc;IACtC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,YAAY;IACnB,WAAW,EACT,8LAA8L;CACjM,CAAC"}

package/llms/backend.md

@@ -0,0 +1,157 @@
+# backend.js — the app's server-side backend
+
+`backend.js` is an optional **server-side** file, a sibling of `access.js`. It
+runs on the platform's servers — never in the browser — and gives the app three
+server superpowers, each an exported function:
+
+- **`fetch(request, ctx)`** — answer HTTP requests at the app's `/_api/...` URL
+  (webhooks from outside, or `fetch("/_api/…")` from the app itself).
+- **`onChange(event, ctx)`** — react after a document write commits (derive,
+  aggregate, moderate, fan out).
+- **`scheduled(event, ctx)`** — run periodically (cleanup, digests, timers).
+
+Export only the handlers the app needs. Most apps need **no** `backend.js` at
+all — normal CRUD flows through Fireproof directly. Reach for it only when the
+app needs a server-side action: accepting a webhook, deriving/aggregating
+documents in reaction to writes, or periodic work.
+
+## Output format
+
+`backend.js` is a separate file, exactly like `access.js`: one prose line, the
+filename `backend.js` on its own line, then one **complete** fenced block (the
+whole file — don't use SEARCH/REPLACE for it; re-emit the full file to change
+it). **Never put backend code inside an `App.jsx` block**, and never import
+`backend.js` from `App.jsx` — the browser can't run it.
+
+## Writes go through the access function
+
+Every `ctx.db.put`/`ctx.db.delete` is enforced by the app's own `access.js` —
+the exact gate user writes pass through — acting as the **trigger's identity**:
+
+| Handler     | Writes act as…                                                    |
+| ----------- | ----------------------------------------------------------------- |
+| `onChange`  | the user whose write triggered the event                          |
+| `fetch`     | the signed-in caller when verifiable — treat as possibly anonymous |
+| `scheduled` | the app owner                                                     |
+
+So the permission model stays in `access.js`, and `backend.js` writes must be
+allowed by it for the acting identity. If a `fetch` handler writes, make sure
+the access function permits that write for an anonymous caller (or design the
+write to happen in `onChange`/`scheduled`, which carry stronger identities).
+
+The flip side: the access function **cannot tell** a backend write from a user
+write — that's the invariant. An `onChange` write acts as the triggering user,
+so anything it may write, that user's own client could write too. `onChange` is
+for **derivation and convenience**, never privilege escalation. For documents
+only the server should control, use `scheduled` — it acts as the **owner**, an
+identity `access.js` can genuinely restrict a database to.
+
+## ctx — what a handler gets
+
+```js
+ctx.appInfo; // { ownerHandle, appSlug } — this app's identity
+ctx.userInfo; // { userHandle } or null — who the handler is acting as
+await ctx.db.put(doc, { db: "notes", id: "optional-id" }); // resolves to the doc id AFTER commit
+await ctx.db.delete(docId, { db: "notes" });
+```
+
+- `{ db }` names the Fireproof database (same names `App.jsx` uses with
+  `useFireproof`). It is **required** — except inside `onChange`, where the
+  database that triggered the event is the default.
+- Always `await` db calls; they resolve only after the write commits (or throw
+  when the access function denies it).
+- **No outside network access**: `fetch()` to external URLs is refused inside
+  `backend.js`, and there are no secrets/API keys yet. Don't call third-party
+  APIs from the backend; AI calls stay in `App.jsx` via `callAI`.
+
+## fetch — the app's HTTP endpoint
+
+Runs for requests to the app's `/_api` route. The request path is rooted after
+`/_api`: a call to `https://slug--owner.host/_api/webhooks/pay` arrives with
+pathname `/webhooks/pay`. Return a standard `Response`.
+
+```js
+export async function fetch(request, ctx) {
+  const url = new URL(request.url);
+  if (url.pathname === "/rsvp" && request.method === "POST") {
+    const body = await request.json();
+    const id = await ctx.db.put({ kind: "rsvp", name: body.name, at: Date.now() }, { db: "rsvps" });
+    return new Response(JSON.stringify({ ok: true, id }), {
+      headers: { "content-type": "application/json" },
+    });
+  }
+  return new Response("not found", { status: 404 });
+}
+```
+
+From `App.jsx`, call it with a relative fetch — no host needed:
+
+```js
+const res = await fetch("/_api/rsvp", { method: "POST", body: JSON.stringify({ name }) });
+```
+
+## onChange — react to committed writes
+
+Runs after any document write to the app's databases commits (user writes and
+backend writes alike). The event:
+
+```js
+export async function onChange(event, ctx) {
+  // event: { dbName, docId, doc, oldDoc, seq, deleted }
+  if (event.dbName !== "votes" || event.deleted) return;
+  // Maintain a server-authoritative tally the UI reads but users can't forge.
+  await ctx.db.put({ _id: "tally-" + event.doc.pollId, kind: "tally", bump: event.seq }, { db: "tallies" });
+}
+```
+
+Two rules keep change-reactions sane:
+
+1. **Guard on `event.dbName` first.** The handler fires for every database, so
+   an unguarded write-back loops on itself.
+2. **Write derived docs to a different database** than the one that triggered
+   the event. A backend write triggers `onChange` again (one generation deeper);
+   the platform caps runaway chains after a few generations, but a tight
+   same-database ping-pong is still wasted work. Different db + dbName guard
+   makes loops structurally impossible.
+
+## scheduled — periodic work
+
+Requires a `config` export with a **static string-literal** interval between
+`"5s"` and `"1h"` (e.g. `"30s"`, `"5m"`, `"1h"` — computed values are rejected):
+
+```js
+export const config = { scheduled: { interval: "15m" } };
+
+export async function scheduled(event, ctx) {
+  // event: { scheduledTime } — ISO timestamp of this tick
+  await ctx.db.put({ kind: "heartbeat", at: event.scheduledTime }, { db: "status" });
+}
+```
+
+Runs as the app owner. Use it for cleanup, digests, and time-based state — not
+for anything that needs a user in the loop.
+
+## A complete example — activity feed + owner-only digest
+
+Users write `note` docs from `App.jsx`. The backend does two jobs: `onChange`
+mirrors each note into a per-author `activity` entry (acting as that author —
+same privilege, just automated), and a `scheduled` sweep maintains one `digest`
+doc that `access.js` restricts to the **owner**, so no user can forge it.
+
+```js
+export const config = { scheduled: { interval: "15m" } };
+
+export async function onChange(event, ctx) {
+  if (event.dbName !== "notes" || event.deleted) return;
+  await ctx.db.put(
+    { _id: "act-" + event.docId, kind: "activity", srcId: event.docId, by: ctx.userInfo, at: event.seq },
+    { db: "activity" }
+  );
+}
+
+export async function scheduled(event, ctx) {
+  // Acts as the app owner — access.js allows `digest` docs for the owner only,
+  // making this document genuinely server-controlled.
+  await ctx.db.put({ _id: "digest", kind: "digest", updatedAt: event.scheduledTime }, { db: "digest" });
+}
+```

package/llms/index.d.ts

@@ -1,3 +1,4 @@
+export { backendConfig } from "./backend.js";
 export { callaiConfig } from "./callai.js";
 export { fireproofConfig } from "./fireproof.js";
 export { imageGenConfig } from "./image-gen.js";
@@ -9,4 +10,4 @@ export { useViewerConfig } from "./use-viewer.js";
 export { useVibeConfig } from "./use-vibe.js";
 export { createVibeConfig } from "./create-vibe.js";
 export type { LlmConfig } from "./types.js";
-export declare const allConfigs: readonly [import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig];
+export declare const allConfigs: readonly [import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig, import("./types.js").LlmConfig];

package/llms/index.js

@@ -1,3 +1,4 @@
+import { backendConfig } from "./backend.js";
 import { callaiConfig } from "./callai.js";
 import { fireproofConfig } from "./fireproof.js";
 import { imageGenConfig } from "./image-gen.js";
@@ -8,6 +9,7 @@ import { webxrConfig } from "./webxr.js";
 import { useViewerConfig } from "./use-viewer.js";
 import { useVibeConfig } from "./use-vibe.js";
 import { createVibeConfig } from "./create-vibe.js";
+export { backendConfig } from "./backend.js";
 export { callaiConfig } from "./callai.js";
 export { fireproofConfig } from "./fireproof.js";
 export { imageGenConfig } from "./image-gen.js";
@@ -29,5 +31,6 @@ export const allConfigs = [
     useViewerConfig,
     useVibeConfig,
     createVibeConfig,
+    backendConfig,
 ];
 //# sourceMappingURL=index.js.map

package/llms/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../jsr/llms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,QAAQ;IACR,aAAa;IACb,eAAe;IACf,WAAW;IACX,eAAe;IACf,aAAa;IACb,gBAAgB;CACR,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../jsr/llms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,QAAQ;IACR,aAAa;IACb,eAAe;IACf,WAAW;IACX,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,aAAa;CACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "type": "module",
   "main": "./index.js",
   "description": "",
@@ -24,9 +24,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "^4.0.4",
-    "@vibes.diy/identity": "^4.0.4",
-    "@vibes.diy/use-vibes-types": "^4.0.4",
+    "@vibes.diy/call-ai-v2": "^4.0.6",
+    "@vibes.diy/identity": "^4.0.6",
+    "@vibes.diy/use-vibes-types": "^4.0.6",
     "arktype": "~2.2.1",
     "json-schema-faker": "~0.6.2"
   },