@vibes.diy/prompts 5.5.11 → 5.5.13

package/llms/voxel.js

@@ -6,8 +6,11 @@ export const voxelConfig = {
         "DDA voxel raycast, an AABB player controller with gravity, jump, sprint, auto step-up and " +
         "un-stick, pointer-lock look with a click-to-play overlay and touch drag, endless chunk " +
         "streaming, a day/night cycle, ambient mobs, and live multiplayer block edits over Fireproof. " +
+        "Covers the survival layer (table-driven crafting tiers, tools with durability, smelting, " +
+        "armor, mob combat, hunger, dimensions, per-player inventory, world reset) and the flat " +
+        "multi-file project split for bigger games. " +
         "minecraft, voxel, block world, sandbox, blocks, mining, building, first-person, 3d game, " +
-        "procedural world, chunks, terrain, overworld, creative mode, survival",
+        "procedural world, chunks, terrain, overworld, creative mode, survival, crafting, nether",
     importModule: "three",
     importName: "THREE",
     importType: "namespace",

package/llms/voxel.js.map

@@ -1 +1 @@
-{"version":3,"file":"voxel.js","sourceRoot":"","sources":["../../jsr/llms/voxel.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,WAAW,EACT,yFAAyF;QACzF,6FAA6F;QAC7F,4FAA4F;QAC5F,yFAAyF;QACzF,+FAA+F;QAC/F,2FAA2F;QAC3F,uEAAuE;IACzE,YAAY,EAAE,OAAO;IACrB,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,WAAW;CACxB,CAAC"}
+{"version":3,"file":"voxel.js","sourceRoot":"","sources":["../../jsr/llms/voxel.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,WAAW,EACT,yFAAyF;QACzF,6FAA6F;QAC7F,4FAA4F;QAC5F,yFAAyF;QACzF,+FAA+F;QAC/F,2FAA2F;QAC3F,yFAAyF;QACzF,6CAA6C;QAC7C,2FAA2F;QAC3F,yFAAyF;IAC3F,YAAY,EAAE,OAAO;IACrB,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,WAAW;CACxB,CAAC"}

package/llms/voxel.md

@@ -7,13 +7,15 @@ voxel-specific architecture that makes such a game actually playable, and it
 calls out the handful of things that make the difference between "cool" and
 "I keep getting stuck / I can't lock my mouse".
 
-The worked example throughout is a real community app, **Voxel World** by
-`isaac-subach` (shared with permission). It ships procedural biomes, caves,
-ore veins, endless chunk streaming, a day/night cycle, live multiplayer edits,
-and ambient wildlife — in a single `App.jsx`. Every pattern below is pulled
-from it.
+The worked examples throughout are real community apps by `isaac-subach`
+(shared with permission): **Voxel World** — procedural biomes, caves, ore
+veins, endless chunk streaming, day/night, live multiplayer edits, ambient
+wildlife — and its bigger successor **Blockcraft World**, which adds the full
+survival layer: crafting tiers, tool durability, smelting, armor, mob combat,
+hunger, creative mode, nether/end dimensions, per-player inventory, and a
+shared world reset. Every pattern below is pulled from them.
 
-## The one-file shape
+## Project shape: an engine in a React shell, split across a few flat files
 
 A voxel game is one big imperative Three.js engine wrapped in a thin React
 shell. Build the engine **once** inside a `useEffect(() => {...}, [])` that owns
@@ -23,6 +25,50 @@ renders only the HUD, the hotbar, and overlays as normal DOM on top of the
 `<canvas>`. Never re-create the engine on re-render, and never drive
 per-frame values through React state — read live values through refs.
 
+A small game fits in one `App.jsx`; past ~1,000 lines, split it. The proven
+layout (this is exactly how Blockcraft World is factored):
+
+```
+App.jsx          entry — the app component; ONLY file with `export default`
+core.js          data tables (blocks/items/recipes/tools), worldgen noise,
+                 texture/material builders, styles — no React, named exports
+WorldCanvas.jsx  the 3D engine component (+ error boundary), named exports
+ui.jsx           Hotbar, InventoryPanel, CraftingPanel, panels — named exports
+access.js        the access function (see multiplayer section)
+```
+
+Multi-file rules — each one is load-bearing, breaking any of them breaks the
+deployed app:
+
+- **All files flat at the root.** The CLI push / codegen path reads top-level
+  files only — a subdirectory (`components/…`) is silently not uploaded and
+  every import of it dangles.
+- **Relative imports include the extension**: `./core.js`, `./ui.jsx` — the
+  client serves files by exact path, so an extensionless `./core` 404s in the
+  browser.
+- **`App.jsx` is the only entry** and — among the client modules — the only
+  `export default`; the other client files use named exports and are reached
+  from App by imports. **`access.js` is exempt**: it is server-run, never
+  imported from `App.jsx`, and follows the access contract's own export rules
+  (`export default` is the catch-all access function; a named export gates
+  only the database with the matching name).
+- **Never import from the entry** (`../App.jsx` / `./App.jsx`) — shared
+  constants live in a sibling module (`core.js`), imported by both sides.
+- **Imported bindings are read-only.** Module-scope mutable state (a
+  `let peaceful` flag, a difficulty setting) cannot be assigned from another
+  file — `PEACEFUL = v` across modules throws a TypeError at runtime (message
+  varies by engine, e.g. "Assignment to constant variable"). Keep the `let` in
+  its home module and export a setter; reads stay live through ESM bindings:
+
+  ```js
+  // core.js
+  export let PEACEFUL = false
+  export function setPeaceful(v) { PEACEFUL = v }
+  // WorldCanvas.jsx
+  import { PEACEFUL, setPeaceful } from "./core.js"
+  setPeaceful(true)   // ✓ — assignment to the import would crash
+  ```
+
 ```jsx
 function CanvasStage({ engineRef, onReady }) {
   const canvasRef = React.useRef(null);
@@ -291,25 +337,112 @@ React.useEffect(() => {
 Apply the local edit **before** the `put` so the world never waits on the
 network, and read live handles/permissions through refs (a value captured in the
 engine closure at load time goes stale — bind live state via `state.on*`
-callbacks or refs, never the closure). Keep the shared world **open** so anyone
-with the link can build — an `access.js` that channels block docs publicly and
-allows anonymous writers:
+callbacks or refs, never the closure).
+
+The `access.js` keeps the shared world **open** — block docs channel publicly
+with anonymous writers allowed — while survival doc types each get a branch
+with their natural owner. Every type the app writes needs its own branch
+**before the final unknown-type throw** (an unhandled type fails the write):
 
 ```js
 export default function (doc, oldDoc, user, ctx) {
   const WORLD = "world:overworld";
+  // No branch may change a doc's type: without this, the open block branch
+  // could squat a reserved _id (inv:<handle>, world:reset) and lock out the
+  // legitimate writer.
+  if (oldDoc && oldDoc.type !== doc.type) throw { forbidden: "type change" };
   if (doc.type === "block") {
+    // Block docs are PINNED to their own _id namespace — an open branch that
+    // accepted arbitrary _ids could occupy other types' reserved keys.
+    if (doc._id !== `block:${doc.key}`) throw { forbidden: "block docs live at block:<key>" };
     if (user && doc.authorHandle && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
     return { channels: [WORLD], grant: { public: [WORLD] }, allowAnonymous: true };
   }
+  if (doc.type === "inventory") {
+    // Exactly one doc per player: the _id is BOUND to the caller's handle, so
+    // nobody can mint or overwrite someone else's pouch. Ownership is checked
+    // on create AND update — oldDoc is the doc being replaced.
+    if (!user) throw { forbidden: "sign in" };
+    if (doc._id !== `inv:${user.userHandle}`) throw { forbidden: "not your inventory" };
+    if (doc.authorHandle !== user.userHandle) throw { forbidden: "not your inventory" };
+    if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not your inventory" };
+    return { channels: [WORLD], grant: { public: [WORLD] } };
+  }
+  if (doc.type === "presence") {
+    // Roster heartbeat — same self-only rule and _id binding, create AND update.
+    if (!user) throw { forbidden: "sign in" };
+    if (doc._id !== `presence:${user.userHandle}`) throw { forbidden: "not you" };
+    if (doc.authorHandle !== user.userHandle) throw { forbidden: "not you" };
+    if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not you" };
+    return { channels: [WORLD], grant: { public: [WORLD] } };
+  }
+  if (doc.type === "worldReset") {
+    // Singleton at a FIXED _id, owner only — destructive for the whole group.
+    // Clients ignore voxel edits older than doc.at, so "reset" deletes
+    // nothing; enforce the watermark so it can only move forward.
+    if (!user) throw { forbidden: "sign in" };
+    ctx.requireRole("owner");
+    if (doc._id !== "world:reset") throw { forbidden: "singleton lives at world:reset" };
+    if (typeof doc.at !== "number" || (oldDoc && !(doc.at > oldDoc.at))) throw { forbidden: "watermark must move forward" };
+    return { channels: [WORLD], grant: { public: [WORLD] } };
+  }
   throw { forbidden: "unknown document type" };
 }
 ```
 
+The pattern generalizes: **self-owned docs bind their `_id` to the writer's
+handle and check ownership on both create and update**; group-destructive
+singletons gate on the owner role.
+
 Do the world's block editing on the **client** regardless of write
 permission (`applyBlock` always runs locally); gate only the **sync** on
 `can.create(...)` so a slow or stale rule binding can never freeze the game.
 
+## The survival layer: data tables first, systems second
+
+Everything Minecraft-ish about progression is **table-driven**. Define the
+tables once in `core.js` and every system (mining, crafting, combat, UI) reads
+them — adding content then means adding rows, not code:
+
+```js
+export const BLOCKS = [ { id: "grass", name: "Grass", top: 0x5fbf3f, side: 0x7a5230, drops: "dirt" }, /* … */ ]
+export const ITEMS = { plank: { name: "Plank" }, stick: { name: "Stick" }, ironIngot: { name: "Iron Ingot" }, /* … */ }
+export const RECIPES = [
+  { id: "planks", out: { plank: 4 }, needs: { wood: 1 } },
+  { id: "stonePick", out: { stonePick: 1 }, needs: { cobble: 3, stick: 2 }, station: "bench" },
+  { id: "ironIngot", out: { ironIngot: 1 }, needs: { ironOre: 1, coal: 1 }, station: "kiln" },
+]
+export const TOOLS = { woodPick: { speed: 2, durability: 60 }, stonePick: { speed: 4, durability: 130 }, /* … */ }
+export const HARDNESS = { dirt: 1, stone: 3, ore: 4, obsidian: 5 /* hits (or seconds) to break */ }
+```
+
+The systems that ride those tables:
+
+- **Mining speed & drops** — breaking takes `HARDNESS[type]` effort divided by
+  the equipped tool's `speed`; wear the tool's `durability` per break and drop
+  the block's `drops` item into the inventory.
+- **Crafting** — `craftableCount(recipe, inv)` = how many times the inventory
+  covers `needs`; stations (bench/kiln) gate recipe visibility. Tiers emerge
+  from the tables alone: wood → stone → iron (smelt ore at the kiln).
+- **Combat** — clicking a mob applies weapon damage + knockback (impulse along
+  the camera ray), mobs carry `hp`, and a death spawns a particle poof and
+  drops. Hostiles pathfind toward the player at night; armor rows reduce
+  incoming damage.
+- **Hunger / health** — a slow hunger drain, eating restores it, starvation
+  chips health; respawn resets position and bars.
+- **Creative mode** — one boolean that bypasses inventory checks, hardness,
+  and durability; keep it a UI toggle, not a fork of the systems.
+- **Dimensions** — nether/end are just different `baseBlock(x, y, z, dim)`
+  generators plus a portal block that flips `dim`; the engine, collision, and
+  streaming code don't change.
+- **World depth** — keep a real vertical range (e.g. bedrock at `y = -128`)
+  so caves and ores have somewhere to live.
+
+Persist the survival state as typed docs (see access function below): one
+`inventory` doc per player (`inv:<handle>`), and a `worldReset` singleton the
+owner writes — clients ignore voxel edits older than its timestamp, which
+resets the shared world without deleting anything.
+
 ## Ambient life & atmosphere (cheap, high-impact)
 
 None of this needs persistence — keep it purely visual and client-side:
@@ -339,5 +472,6 @@ None of this needs persistence — keep it purely visual and client-side:
   draw distance.
 
 That set — exposed-face meshing, per-axis collision with step-up and un-stick,
-a click-to-play pointer-lock overlay, a DDA raycast, and per-voxel Fireproof
-docs — is what turns a voxel tech demo into a game people actually play.
+a click-to-play pointer-lock overlay, a DDA raycast, per-voxel Fireproof docs,
+table-driven survival systems, and a flat multi-file split once it grows — is
+what turns a voxel tech demo into a game people actually play.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "5.5.11",
+  "version": "5.5.13",
   "type": "module",
   "main": "./index.js",
   "description": "",
@@ -24,9 +24,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "^5.5.11",
-    "@vibes.diy/identity": "^5.5.11",
-    "@vibes.diy/use-vibes-types": "^5.5.11",
+    "@vibes.diy/call-ai-v2": "^5.5.13",
+    "@vibes.diy/identity": "^5.5.13",
+    "@vibes.diy/use-vibes-types": "^5.5.13",
     "arktype": "~2.2.3",
     "json-schema-faker": "~0.6.2"
   },

package/system-prompt-initial-oneshot.md

@@ -256,6 +256,7 @@ Rules for the items:
 - Set `_id` explicitly **only** for a well-known singleton (a `config:setname` settings doc); the `key` is still required.
 - Multi-db apps get one array per db; use the exact db names from `App.jsx`.
 - **JSON only — no images or binary.** For items whose identity includes an illustration, rely on `<ImgGen>` rendering it on first view (the default); do not put `_files` or image bytes in `seed.json`.
+- **If the app has an `access.js`, every `type` you emit here must have a branch in it** — but don't add an access function _just_ to satisfy this: an app with no per-document rules keeps the default open data model and seeds fine without one. When there **is** an `access.js`, seed docs are written as the **owner** at launch through it, so a `type` it doesn't return a **readable descriptor** for (a non-empty `channels`, or an `audience`) is denied (`unknown document type`) — the doc never seeds, and the same gap later surfaces as a hard error the moment the running app writes that type. Before finishing, if you emitted an `access.js`, confirm it returns a readable descriptor for every distinct `type` present in `seed.json`. (Deletes go through the same gate: a `db.del` writes a tombstone `{ _id, _deleted: true }` that carries **no** `type`, channel, or author — so branch on `doc._deleted`, then authorize and route it off **`oldDoc`** (the persisted document is the only trustworthy record of the doc's type and owner), returning the same descriptor the live doc got. A bare `_deleted` branch that ignores `oldDoc` either fails the app's own deletes or over-broadens them.)
 
 ## End every turn with one improvement question
 

package/system-prompt-initial.md

@@ -257,6 +257,7 @@ Rules for the items:
 - Set `_id` explicitly **only** for a well-known singleton (a `config:setname` settings doc); the `key` is still required.
 - Multi-db apps get one array per db; use the exact db names from `App.jsx`.
 - **JSON only — no images or binary.** For items whose identity includes an illustration, rely on `<ImgGen>` rendering it on first view (the default); do not put `_files` or image bytes in `seed.json`.
+- **If the app has an `access.js`, every `type` you emit here must have a branch in it** — but don't add an access function _just_ to satisfy this: an app with no per-document rules keeps the default open data model and seeds fine without one. When there **is** an `access.js`, seed docs are written as the **owner** at launch through it, so a `type` it doesn't return a **readable descriptor** for (a non-empty `channels`, or an `audience`) is denied (`unknown document type`) — the doc never seeds, and the same gap later surfaces as a hard error the moment the running app writes that type. Before finishing, if you emitted an `access.js`, confirm it returns a readable descriptor for every distinct `type` present in `seed.json`. (Deletes go through the same gate: a `db.del` writes a tombstone `{ _id, _deleted: true }` that carries **no** `type`, channel, or author — so branch on `doc._deleted`, then authorize and route it off **`oldDoc`** (the persisted document is the only trustworthy record of the doc's type and owner), returning the same descriptor the live doc got. A bare `_deleted` branch that ignores `oldDoc` either fails the app's own deletes or over-broadens them.)
 
 ## End every turn with one improvement question
 

package/system-prompt.md

@@ -573,6 +573,7 @@ Rules for the items:
 - Set `_id` explicitly **only** for a well-known singleton (a `config:setname` settings doc); the `key` is still required.
 - Multi-db apps get one array per db; use the exact db names from `App.jsx`.
 - **JSON only — no images or binary.** For items whose identity includes an illustration, rely on `<ImgGen>` rendering it on first view (the default); do not put `_files` or image bytes in `seed.json`.
+- **If the app has an `access.js`, every `type` you emit here must have a branch in it** — but don't add an access function _just_ to satisfy this: an app with no per-document rules keeps the default open data model and seeds fine without one. When there **is** an `access.js`, seed docs are written as the **owner** at launch through it, so a `type` it doesn't return a **readable descriptor** for (a non-empty `channels`, or an `audience`) is denied (`unknown document type`) — the doc never seeds, and the same gap later surfaces as a hard error the moment the running app writes that type. Before finishing, if you emitted an `access.js`, confirm it returns a readable descriptor for every distinct `type` present in `seed.json`. (Deletes go through the same gate: a `db.del` writes a tombstone `{ _id, _deleted: true }` that carries **no** `type`, channel, or author — so branch on `doc._deleted`, then authorize and route it off **`oldDoc`** (the persisted document is the only trustworthy record of the doc's type and owner), returning the same descriptor the live doc got. A bare `_deleted` branch that ignores `oldDoc` either fails the app's own deletes or over-broadens them.)
 
 ## End every turn with one improvement question