@vibes.diy/prompts 4.2.3 → 4.3.1

package/llms/backend.md

@@ -69,6 +69,7 @@ ctx.secrets; // Record<string,string> — the owner's per-vibe secrets; frozen,
 await ctx.db.put(doc, { db: "notes", id: "optional-id" }); // resolves to the doc id AFTER commit
 await ctx.db.delete(docId, { db: "notes" });
 const docs = await ctx.db.query({ db: "notes" }); // latest non-deleted docs (each with _id)
+const text = await ctx.callAI("prompt", { model: "openrouter/auto", max_tokens: 500 }); // server-side AI call
 ```
 
 - `{ db }` names the Fireproof database (same names `App.jsx` uses with
@@ -101,8 +102,22 @@ const docs = await ctx.db.query({ db: "notes" }); // latest non-deleted docs (ea
   on port 443 only, 15s per request, 10MB responses, per-vibe rate caps
   (30/10s, 300/min). Make all outbound calls **before returning** the Response —
   a `fetch()` fired while a streamed body is still being pulled after the
-  handler returned is unsupported and gets denied. Frontend AI calls stay in
-  `App.jsx` via `callAI`.
+  handler returned is unsupported and gets denied. Interactive frontend AI
+  calls stay in `App.jsx` via `callAI`; server-side AI belongs to `ctx.callAI`.
+- **`ctx.callAI(prompt, options?)` is the server-side AI call.** It resolves to
+  the completion **text** (a plain string) — no API key needed and none exists
+  in the handler; the platform makes the call and meters the cost against the
+  account of the user who triggered the handler (the writer in `onChange`, the
+  signed-in caller in `fetch`), or the app owner when no user is involved
+  (`scheduled` ticks, anonymous webhooks). Options: `model` (default
+  `"openrouter/auto"`), `max_tokens`, `temperature`. No streaming and no schema
+  mode — for structured output, ask for JSON in the prompt and `JSON.parse`
+  defensively. Budget: a handful of calls per invocation (currently 5) and
+  ~64k prompt chars; a denied or failed call **throws** — catch it and degrade
+  (e.g. write the doc back with an error field) rather than losing the event.
+  Keep interactive/streaming AI in `App.jsx` via `callAI`; use `ctx.callAI`
+  when the result must be server-authoritative (moderation, digests,
+  summaries users shouldn't be able to forge).
 
 ## fetch — the app's HTTP endpoint
 

package/llms/calendar.md

@@ -92,6 +92,11 @@ lane can't query access-fn-bound databases at all). So:
 The token is auto-minted when the calendar surface opens, so the Subscribe
 button is simply there once the user has subscribable content.
 
+⚠️ Read the token from its OWN live query on `type: "caltoken"` (as below). A
+`caltoken` doc never appears in your items/favorites query — looking for it
+there means the Subscribe link never renders, even though the mint effect and
+the feed itself work.
+
 ```jsx
 // access.js needs a `caltoken` branch routing the doc to the owner's PRIVATE
 // channel (like notes) — the token is the secret.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "4.2.3",
+  "version": "4.3.1",
   "type": "module",
   "main": "./index.js",
   "description": "",
@@ -24,9 +24,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "^4.2.3",
-    "@vibes.diy/identity": "^4.2.3",
-    "@vibes.diy/use-vibes-types": "^4.2.3",
+    "@vibes.diy/call-ai-v2": "^4.3.1",
+    "@vibes.diy/identity": "^4.3.1",
+    "@vibes.diy/use-vibes-types": "^4.3.1",
     "arktype": "~2.2.2",
     "json-schema-faker": "~0.6.2"
   },