@vibes.diy/prompts 6.2.4 → 6.2.6

package/llms/fireproof.md

@@ -15,7 +15,7 @@ Fireproof enforces cryptographic causal consistency and ledger integrity using h
 
 ## Installation
 
-The `use-fireproof` package provides both the core API and React hooks. React hooks are the recommended way to use Fireproof in LLM code generation contexts. Fireproof databases persist data through the Firefly server and sync it live to every viewer. Each database is identified by a string name, and you can have multiple databases per application—often one per collaboration session, as they are the unit of sharing.
+The `use-fireproof` package provides both the core API and React hooks. React hooks are the recommended way to use Fireproof in LLM code generation contexts. Fireproof databases persist data through the Firefly server and sync it live to every viewer. Each database is identified by a string name, and you can have multiple databases per application—often one per collaboration session, as they are the unit of sharing. Database names are the app's own to choose — pick a plain camelCase name for every database the app creates; prefix-namespaced names like `media:*` are platform-reserved for the databases platform components bring with them.
 
 Each document has an `_id`, which can be auto-generated or set explicitly. Auto-generation is recommended to ensure uniqueness and avoid conflicts. The server keeps a per-document sequence, so two clients writing the same `_id` at the same time can collide and one write will be rejected — see the note on continuous updates below. Prefer one document per event over many rapid writes to a single hot document.
 
@@ -59,7 +59,7 @@ export default function App() {
 }
 ```
 
-The access function lives in a separate file. Even simple apps include one — it's the server-side authority for who can write, and it routes each document to a channel so the author can read it back:
+The access function lives in a separate file. Even simple apps include one — it's the server-side authority for who can write, and it routes each document to a channel so the author can read it back. Its scope is the app's own databases: a platform component's own database (a `media:*` name) carries platform-authored access rules the server evaluates separately, so your access function writes rules only for the databases the app itself creates. Within those, it branches on the doc types the app works with — including platform-driven writes onto the app's own docs, like an `<ImgGen>` version append (the `ctx.isImgGenVersionAppend` shape below), which flow through your function like any other write:
 
 access.js
 
@@ -506,17 +506,14 @@ export function announcements(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields (so a viewer's <ImgGen> append passes)
-    // — every other key must match oldDoc (an allowlist; unlisted fields stay author-owned).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.authorHandle !== oldDoc.authorHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     ctx.requireAccess(doc.channel);
     return { channels: [doc.channel] };
@@ -643,17 +640,14 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc
-    // (an allowlist; unlisted fields stay author-owned by default).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.authorHandle !== oldDoc.authorHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     // Any signed-in author may post to this open channel. Do NOT call
     // ctx.requireAccess(doc.channel) here: the channel is grant.public
@@ -798,7 +792,7 @@ Access functions live in `/access.js`, a separate file in the vibe's filesystem
 
 **`requireAccess` checks _membership_, not public read — don't gate an open channel's writes on it.** `ctx.requireAccess(channelId)` passes only for a channel the user is a member of: granted directly through `grant.users[handle]`, or through a `grant.roles` role they hold. **`grant.public` does NOT satisfy `requireAccess`** — public is read-only ("anyone through the door can _read_"), it never confers write membership. So a channel that is only `grant.public` and gated on `ctx.requireAccess` can be written by **nobody** but the owner-in-admin-mode — every other write returns `not in channel`, silently hiding the form (`useVibe().can` faithfully reflects this). Choose by intent:
 
-- **Open channel — any signed-in user may post** (public board, guestbook, comment wall): do **not** call `ctx.requireAccess`. Route the doc to the channel and check the author on create — `if (!oldDoc && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }` — keep ownership immutable on update (`else if (doc.authorHandle !== oldDoc.authorHandle) throw`), and let a non-author's `<ImgGen>` version append through via the field-allowlist in "Author-equality gates create and ownership change" below; `return { channels: [doc.channelId] }`. `grant.public` on the channel doc gives everyone read; the write is open to any author.
+- **Open channel — any signed-in user may post** (public board, guestbook, comment wall): do **not** call `ctx.requireAccess`. Route the doc to the channel and check the author on create — `if (oldDoc === null && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }` — keep ownership immutable on update (`else if (doc.authorHandle !== oldDoc.authorHandle) throw`), and let a non-author's `<ImgGen>` version append through via `ctx.isImgGenVersionAppend(doc, oldDoc)` as shown in "Author-equality gates create and ownership change" below; `return { channels: [doc.channelId] }`. `grant.public` on the channel doc gives everyone read; the write is open to any author.
 - **Restricted channel — only members may post**: gate the write on `ctx.requireAccess(doc.channelId)` **and** grant writers membership explicitly — `grant.users` (direct) or `grant.roles` + a `members`/role-grant doc. `public` alongside is read-only and is fine for letting non-members read, but it is never what lets a member write.
 
 ### AccessDescriptor return type
@@ -807,22 +801,19 @@ All fields are optional, but a stored document must be routed to at least one ch
 
 **Grant/member/meta docs need a channel too.** A role grant, membership, or config singleton that returns only `members`/`grant` with **no `channels`** is refused exactly like any other channel-less write — so the owner can't even create it. Route these to an owner-readable **admin channel** (e.g. `channels: ["admin:grants"]` with `grant: { users: { [user.userHandle]: ["admin:grants"] } }`), not a public channel. The `members`/`grant` still take effect globally; the channel just makes the doc persist and lets the owner read the roster back.
 
-**Author-equality gates create and ownership change, not every update.** Checking the new author field on create isn't enough — also pin ownership with `oldDoc`. But a blanket `if (oldDoc && oldDoc.<authorField> !== user.userHandle) throw` denies `<ImgGen>` version appends on a shared/public-read doc: a version append runs as the VIEWING user, and denying it after the platform already billed it arms a billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to match `oldDoc` — an **allowlist**, so a field you didn't anticipate stays author-protected by default (a denylist of a few named content fields silently unprotects the rest):
+**Author-equality gates create and ownership change, not every update.** Checking the new author field on create isn't enough — also pin ownership with `oldDoc`. But a blanket `if (oldDoc && oldDoc.<authorField> !== user.userHandle) throw` denies `<ImgGen>` version appends on a shared/public-read doc: a version append runs as the VIEWING user, and denying it after the platform already billed it arms a billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changed = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changed && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-`<authorField>` is whatever your doc uses (`authorHandle`, `userHandle`, `senderHandle`, …); `IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes. Write-once docs can simply `if (oldDoc) throw`; a genuinely private per-user doc no other viewer can reach may stay author-only on update.
+`<authorField>` is whatever your doc uses (`authorHandle`, `userHandle`, `senderHandle`, …). The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default; deletes stay author-only. Because `versions`/`currentVersion` are among the version fields it allows, a non-author can also advance the DISPLAYED version (the shared-generation feature); guard `currentVersion` specifically for author-only display control. Write-once docs can simply `if (oldDoc === null) {} else throw`; a genuinely private per-user doc no other viewer can reach may stay author-only on update.
 
 ```ts
 type AccessDescriptor = {
@@ -882,16 +873,14 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "message") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc.
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.userHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.userHandle !== oldDoc.userHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.userHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.userHandle !== oldDoc.userHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.userHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     ctx.requireAccess(doc.channelId);
     return { channels: [doc.channelId] };

package/llms/image-gen.md

@@ -148,22 +148,19 @@ Prefer attaching images to the host doc whose access you already grant; reach fo
 
 **ImgGen does not stamp your app's author field.** The doc ImgGen writes (a standalone `type: "image"` doc, or the version it appends to a host doc) carries no `authorHandle`/`userHandle`/`senderHandle` of yours — that field is `null`/`undefined`. So an access-fn branch that author-gates the type ImgGen writes (`if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }`) **rejects the write**: `null !== user.userHandle`, the signed-in maker included, and the image silently fails to persist as the doc you meant (`Failed to put document:`). Two fixes: (1) **attach the image to a host doc you created with the author field already stamped** — `<ImgGen _id={hostDoc._id} database={db} />` inherits the host's `type` and access, so the author check already passed when you wrote the host; this is the preferred shape. (2) For a genuinely **standalone** image doc, do NOT author-gate the `"image"` branch on strict author equality — route it to the channel you want and skip the author check (the platform's ImgGen write is server-authoritative, so there's no spoof to guard against). Never author-gate a type whose docs ImgGen originates without stamping the author yourself first.
 
-**A version append (regenerate, or an img2img edit on an existing `_id`) arrives as the VIEWING user, not the original author.** So even when you DID stamp the author on the host doc, an `if (oldDoc && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }` on that type denies any _other_ signed-in viewer's generation on a shared/public-read doc — after the platform already billed it, arming an unbounded billed-retry loop (#3784/#3832). Author-equality belongs on **create and ownership change**, not on every update. Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to match `oldDoc` — an allowlist, so a field you didn't anticipate stays author-protected by default:
+**A version append (regenerate, or an img2img edit on an existing `_id`) arrives as the VIEWING user, not the original author.** So even when you DID stamp the author on the host doc, an `if (oldDoc && doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }` on that type denies any _other_ signed-in viewer's generation on a shared/public-read doc — after the platform already billed it, arming an unbounded billed-retry loop (#3784/#3832). Author-equality belongs on **create and ownership change**, not on every update. Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changed = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changed && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-`IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes, so a viewer's version append passes while any other field stays author-owned.
+The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default; deletes stay author-only. Because `versions`/`currentVersion` are among the version fields it allows, a non-author can also advance the DISPLAYED version (the shared-generation feature); guard `currentVersion` specifically if you need author-only display control.
 
 ## Choosing a Model
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "6.2.4",
+  "version": "6.2.6",
   "type": "module",
   "main": "./index.js",
   "description": "",
@@ -24,9 +24,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@adviser/cement": "~0.5.34",
-    "@vibes.diy/call-ai-v2": "^6.2.4",
-    "@vibes.diy/identity": "^6.2.4",
-    "@vibes.diy/use-vibes-types": "^6.2.4",
+    "@vibes.diy/call-ai-v2": "^6.2.6",
+    "@vibes.diy/identity": "^6.2.6",
+    "@vibes.diy/use-vibes-types": "^6.2.6",
     "arktype": "~2.2.3",
     "json-schema-faker": "~0.6.2"
   },

package/prompts.js

@@ -128,8 +128,10 @@ export async function makeBaseSystemPrompt(model, sessionDoc) {
             selectedNames.push(required);
         }
     }
-    if (llmsCatalogNames.has("image-gen") && !selectedNames.includes("image-gen")) {
-        selectedNames.push("image-gen");
+    for (const capability of ["image-gen", "web-audio"]) {
+        if (llmsCatalogNames.has(capability) && !selectedNames.includes(capability)) {
+            selectedNames.push(capability);
+        }
     }
     const isFirstTurn = sessionDoc?.variant === "initial" || sessionDoc?.variant === "initial-oneshot";
     if (isFirstTurn === false && llmsCatalogNames.has("backend") && selectedNames.includes("backend") === false) {

package/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../jsr/prompts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAmB,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACnI,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACvE,CAAC;AAWD,MAAM,4BAA4B,GAChC,msCAAmsC,CAAC;AAUtsC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,WAAW;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACrH,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,4BAA4B;QAC5B,EAAE;QACF,+UAA+U;QAC/U,EAAE;QACF,gBAAgB;QAChB,WAAW;QACX,EAAE;QACF,gBAAgB;QAChB,SAAS;QACT,EAAE;QACF,eAAe;QACf,UAAU;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAOD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;IAClE,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,WAAW,EACT,2IAA2I;YAC7I,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,WAAW,EACT,kHAAkH;YACpH,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACzB;aACF;SACF;QACD,eAAe,EAAE;YACf,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,+TAA+T;SAClU;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,sXAAsX;SACzX;QACD,gBAAgB,EAAE;YAChB,IAAI,EAAE,SAAS;YACf,WAAW,EACT,0cAA0c;SAC7c;QACD,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACX,wNAAwN;gBACxN,8JAA8J;gBAC9J,goBAAgoB;gBAChoB,4zBAA4zB;gBAC5zB,+OAA+O;gBAC/O,wFAAwF;aACzF,CAAC,IAAI,CAAC,GAAG,CAAC;SACZ;KACF;CACO,CAAC;AAaX,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE;IAC9B,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE;IACxD,eAAe,EAAE,QAAQ;IACzB,QAAQ,EAAE,QAAQ;IAClB,aAAa,EAAE,QAAQ;IACvB,iBAAiB,EAAE,QAAQ;IAC3B,mBAAmB,EAAE,SAAS;CAC/B,CAAC,CAAC;AAYH,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAuE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;SAC3H,KAAK,EAAE;SACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;SAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC;QAC3C,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,WAAW;gBACd,OAAO,iBAAiB,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,YAAY,GAAG,CAAC;YAClE,KAAK,SAAS;gBACZ,OAAO,YAAY,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,YAAY,GAAG,CAAC;YAC7D,KAAK,OAAO,CAAC;YACb;gBACE,OAAO,cAAc,CAAC,CAAC,UAAU,YAAY,CAAC,CAAC,YAAY,GAAG,CAAC;QACnE,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;AAyB7C,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,UAA+D;IAE/D,MAAM,UAAU,GAAG,UAAU,EAAE,UAAU,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,UAAU,EAAE,UAAU,IAAI,oBAAoB,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,aAAa,EAAE,CAAC;IAC1C,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAEpD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,IAAI,aAAa,GAAG,SAAS;QAC3B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1G,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,aAAa,GAAG,CAAC,GAAG,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IAID,KAAK,MAAM,QAAQ,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAUD,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9E,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAMD,MAAM,WAAW,GAAG,UAAU,EAAE,OAAO,KAAK,SAAS,IAAI,UAAU,EAAE,OAAO,KAAK,iBAAiB,CAAC;IACnG,IAAI,WAAW,KAAK,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;QAC5G,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,eAAe,GAAG,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC;IAEtD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7E,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAE/D,OAAO,SAAS,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,EAAE;gBACxC,WAAW,EAAE,UAAU;gBACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;gBAC/B,IAAI,EAAE;oBACJ,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB;aAkBF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,IAAI,YAAY,OAAO,IAAI,CAAC,OAAO,WAAW,GAAG,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3H,SAAS;QACX,CAAC;QACD,oBAAoB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC;QACjD,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5C,oBAAoB,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAQ5D,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,uBAAuB,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,OAAO,UAAU,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,cAAc,GAAG,cAAc,IAAI,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,MAAM,mBAAmB,GAAG,OAAO,UAAU,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,MAAM,mBAAmB,GACvB,mBAAmB,IAAI,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAClE,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,cAAc,IAAI,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,kBAAkB,GAAG,EAAE,CAAC;IAC5B,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACjF,OAAO,SAAS,CAAC,YAAY,cAAc,KAAK,EAAE;gBAChD,WAAW,EAAE,UAAU;gBACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;gBAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,wBAAwB,cAAc,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ,GAAG,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YACjC,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,YAAY,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAC5F,OAAO,SAAS,CAAC,mBAAmB,mBAAmB,OAAO,EAAE;wBAC9D,WAAW,EAAE,UAAU;wBACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;wBAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE;qBAClC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,2BAA2B,mBAAmB,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnF,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YACD,kBAAkB;gBAChB,sBAAsB,QAAQ,0BAA0B;oBACxD,4GAA4G;oBAC5G,4HAA4H;oBAC5H,wIAAwI;oBACxI,4HAA4H;oBAC5H,0GAA0G;oBAC1G,4DAA4D,CAAC;QACjE,CAAC;IACH,CAAC;IAOD,MAAM,aAAa,GAAG,UAAU,EAAE,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,MAAM,WAAW,GAAG,UAAU,EAAE,WAAW,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAEzF,MAAM,aAAa,GAAG,eAAe;QACnC,CAAC,CAAC,2ZAA2Z;QAC7Z,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,YAAY,GAAG,UAAU,EAAE,KAAK;QACpC,CAAC,CAAC,sBAAsB,UAAU,CAAC,KAAK,wFAAwF;QAChI,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,MAAM,iBAAiB,GAAG,OAAO,UAAU,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjH,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,iBAAiB,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnH,MAAM,gBAAgB,GAAG,4BAA4B,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;IAE5F,MAAM,gBAAgB,GACpB,UAAU,EAAE,OAAO,KAAK,SAAS;QAC/B,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,UAAU,EAAE,OAAO,KAAK,iBAAiB;YACzC,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,kBAAkB,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,QAAQ;SAC1B,UAAU,CAAC,kBAAkB,EAAE,WAAW,CAAC;SAC3C,UAAU,CAAC,eAAe,EAAE,aAAa,CAAC;SAC1C,UAAU,CAAC,uBAAuB,EAAE,mBAAmB,CAAC;SACxD,UAAU,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;SAClD,UAAU,CAAC,mBAAmB,EAAE,YAAY,CAAC;SAC7C,UAAU,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;SACxD,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;SAChD,UAAU,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IAEzD,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,eAAe;QACzB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,UAAkB,EAAE,QAAgB,EAAE,OAAsB;IACjG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAClF,OAAO,SAAS,CAAC,KAAK,QAAQ,EAAE,EAAE;YAChC,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;YAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAmB,EAAE,OAAsB;IACnF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAC1E,OAAO,SAAS,CAAC,wBAAwB,EAAE;YACzC,WAAW,EAAE,UAAU,IAAI,oBAAoB;YAC/C,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;YAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAmB,EAAE,OAAsB;IACzF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACjF,OAAO,SAAS,CAAC,+BAA+B,EAAE;YAChD,WAAW,EAAE,UAAU,IAAI,oBAAoB;YAC/C,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;YAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACnE,OAAO,SAAS,CAAC,iBAAiB,EAAE;YAClC,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACnE,OAAO,SAAS,CAAC,iBAAiB,EAAE;YAClC,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAC3D,OAAO,SAAS,CAAC,UAAU,IAAI,KAAK,EAAE;YACpC,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACtE,OAAO,SAAS,CAAC,YAAY,IAAI,KAAK,EAAE;YACtC,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../jsr/prompts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAmB,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACnI,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACvE,CAAC;AAWD,MAAM,4BAA4B,GAChC,msCAAmsC,CAAC;AAUtsC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,WAAW;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACrH,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,4BAA4B;QAC5B,EAAE;QACF,+UAA+U;QAC/U,EAAE;QACF,gBAAgB;QAChB,WAAW;QACX,EAAE;QACF,gBAAgB;QAChB,SAAS;QACT,EAAE;QACF,eAAe;QACf,UAAU;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAOD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;IAClE,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,WAAW,EACT,2IAA2I;YAC7I,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,WAAW,EACT,kHAAkH;YACpH,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACzB;aACF;SACF;QACD,eAAe,EAAE;YACf,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,+TAA+T;SAClU;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,sXAAsX;SACzX;QACD,gBAAgB,EAAE;YAChB,IAAI,EAAE,SAAS;YACf,WAAW,EACT,0cAA0c;SAC7c;QACD,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACX,wNAAwN;gBACxN,8JAA8J;gBAC9J,goBAAgoB;gBAChoB,4zBAA4zB;gBAC5zB,+OAA+O;gBAC/O,wFAAwF;aACzF,CAAC,IAAI,CAAC,GAAG,CAAC;SACZ;KACF;CACO,CAAC;AAaX,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE;IAC9B,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE;IACxD,eAAe,EAAE,QAAQ;IACzB,QAAQ,EAAE,QAAQ;IAClB,aAAa,EAAE,QAAQ;IACvB,iBAAiB,EAAE,QAAQ;IAC3B,mBAAmB,EAAE,SAAS;CAC/B,CAAC,CAAC;AAYH,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAuE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;SAC3H,KAAK,EAAE;SACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;SAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC;QAC3C,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,WAAW;gBACd,OAAO,iBAAiB,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,YAAY,GAAG,CAAC;YAClE,KAAK,SAAS;gBACZ,OAAO,YAAY,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,YAAY,GAAG,CAAC;YAC7D,KAAK,OAAO,CAAC;YACb;gBACE,OAAO,cAAc,CAAC,CAAC,UAAU,YAAY,CAAC,CAAC,YAAY,GAAG,CAAC;QACnE,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;AAyB7C,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,UAA+D;IAE/D,MAAM,UAAU,GAAG,UAAU,EAAE,UAAU,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,UAAU,EAAE,UAAU,IAAI,oBAAoB,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,aAAa,EAAE,CAAC;IAC1C,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAEpD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,IAAI,aAAa,GAAG,SAAS;QAC3B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1G,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,aAAa,GAAG,CAAC,GAAG,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IAID,KAAK,MAAM,QAAQ,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAcD,KAAK,MAAM,UAAU,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QACpD,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAMD,MAAM,WAAW,GAAG,UAAU,EAAE,OAAO,KAAK,SAAS,IAAI,UAAU,EAAE,OAAO,KAAK,iBAAiB,CAAC;IACnG,IAAI,WAAW,KAAK,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;QAC5G,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,eAAe,GAAG,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC;IAEtD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7E,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAE/D,OAAO,SAAS,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,EAAE;gBACxC,WAAW,EAAE,UAAU;gBACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;gBAC/B,IAAI,EAAE;oBACJ,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB;aAkBF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,IAAI,YAAY,OAAO,IAAI,CAAC,OAAO,WAAW,GAAG,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3H,SAAS;QACX,CAAC;QACD,oBAAoB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC;QACjD,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5C,oBAAoB,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAQ5D,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAC;IACjD,MAAM,oBAAoB,GAAG,uBAAuB,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,OAAO,UAAU,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,cAAc,GAAG,cAAc,IAAI,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,MAAM,mBAAmB,GAAG,OAAO,UAAU,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,MAAM,mBAAmB,GACvB,mBAAmB,IAAI,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAClE,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,cAAc,IAAI,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,kBAAkB,GAAG,EAAE,CAAC;IAC5B,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACjF,OAAO,SAAS,CAAC,YAAY,cAAc,KAAK,EAAE;gBAChD,WAAW,EAAE,UAAU;gBACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;gBAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,wBAAwB,cAAc,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ,GAAG,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YACjC,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,YAAY,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAC5F,OAAO,SAAS,CAAC,mBAAmB,mBAAmB,OAAO,EAAE;wBAC9D,WAAW,EAAE,UAAU;wBACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;wBAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE;qBAClC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,2BAA2B,mBAAmB,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnF,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YACD,kBAAkB;gBAChB,sBAAsB,QAAQ,0BAA0B;oBACxD,4GAA4G;oBAC5G,4HAA4H;oBAC5H,wIAAwI;oBACxI,4HAA4H;oBAC5H,0GAA0G;oBAC1G,4DAA4D,CAAC;QACjE,CAAC;IACH,CAAC;IAOD,MAAM,aAAa,GAAG,UAAU,EAAE,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,MAAM,WAAW,GAAG,UAAU,EAAE,WAAW,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAEzF,MAAM,aAAa,GAAG,eAAe;QACnC,CAAC,CAAC,2ZAA2Z;QAC7Z,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,YAAY,GAAG,UAAU,EAAE,KAAK;QACpC,CAAC,CAAC,sBAAsB,UAAU,CAAC,KAAK,wFAAwF;QAChI,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,MAAM,iBAAiB,GAAG,OAAO,UAAU,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjH,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,iBAAiB,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnH,MAAM,gBAAgB,GAAG,4BAA4B,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;IAE5F,MAAM,gBAAgB,GACpB,UAAU,EAAE,OAAO,KAAK,SAAS;QAC/B,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,UAAU,EAAE,OAAO,KAAK,iBAAiB;YACzC,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,kBAAkB,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,QAAQ;SAC1B,UAAU,CAAC,kBAAkB,EAAE,WAAW,CAAC;SAC3C,UAAU,CAAC,eAAe,EAAE,aAAa,CAAC;SAC1C,UAAU,CAAC,uBAAuB,EAAE,mBAAmB,CAAC;SACxD,UAAU,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;SAClD,UAAU,CAAC,mBAAmB,EAAE,YAAY,CAAC;SAC7C,UAAU,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;SACxD,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;SAChD,UAAU,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IAEzD,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,eAAe;QACzB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,UAAkB,EAAE,QAAgB,EAAE,OAAsB;IACjG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAClF,OAAO,SAAS,CAAC,KAAK,QAAQ,EAAE,EAAE;YAChC,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;YAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAmB,EAAE,OAAsB;IACnF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAC1E,OAAO,SAAS,CAAC,wBAAwB,EAAE;YACzC,WAAW,EAAE,UAAU,IAAI,oBAAoB;YAC/C,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;YAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAmB,EAAE,OAAsB;IACzF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACjF,OAAO,SAAS,CAAC,+BAA+B,EAAE;YAChD,WAAW,EAAE,UAAU,IAAI,oBAAoB;YAC/C,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;YAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACnE,OAAO,SAAS,CAAC,iBAAiB,EAAE;YAClC,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACnE,OAAO,SAAS,CAAC,iBAAiB,EAAE;YAClC,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAC3D,OAAO,SAAS,CAAC,UAAU,IAAI,KAAK,EAAE;YACpC,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACtE,OAAO,SAAS,CAAC,YAAY,IAAI,KAAK,EAAE;YACtC,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AACpB,CAAC"}

package/system-prompt-initial-oneshot.md

@@ -27,7 +27,7 @@ You are an AI assistant tasked with creating React components. You should create
 
 {{CONCATENATED_LLMS}}
 {{THEME_DESIGN}}
-{{TITLE_SECTION}}{{ENRICHED_PROMPT}}{{USER_PROMPT}}IMPORTANT: Your main file is `App.jsx` (the React component). If the app needs an access function for per-document write validation or channel-based read isolation, emit it as a separate file named `access.js` — never put access function code inside `App.jsx`. This is the **first turn** — `App.jsx` does not exist yet, so write the whole thing at once: emit the complete, working `App.jsx` as a single full-file block (every feature wired, hooks and data in place — not a stub, not a placeholder shell), then any companion feature files if the app is large enough to split (each as its own complete full-file block), then, if the app needs one, a complete `access.js` block, then, if the prompt gave you concrete example data to launch with, a `seed.json` block. That is the entire first turn — the finished app in one `App.jsx` block, companion feature files if any, then `access.js`, then `seed.json` (order: App.jsx → access.js → seed.json). Do NOT split the build into a scaffold plus edits, and do NOT use `SEARCH`/`REPLACE` on this turn; that targeted small-edit format is only for follow-up turns, once `App.jsx` already exists.
+{{TITLE_SECTION}}{{ENRICHED_PROMPT}}{{USER_PROMPT}}IMPORTANT: Your main file is `App.jsx` (the React component). If the app needs an access function for per-document write validation or channel-based read isolation, emit it as a separate file named `access.js` — never put access function code inside `App.jsx`. This is the **first turn** — `App.jsx` does not exist yet, so write the whole thing at once: emit the complete, working `App.jsx` as a single full-file block (every feature wired, hooks and data in place — not a stub, not a placeholder shell), then the companion feature files (each as its own complete full-file block — splitting features out is the default for any app with more than a couple of them), then, if the app needs one, a complete `access.js` block, then a `seed.json` block with the app's launch content — the user's concrete example data when the prompt gave you some, otherwise the vivid seeded world described below (skipped only for private-by-nature record-keeping). That is the entire first turn — the finished app in one `App.jsx` block, companion feature files if any, then `access.js`, then `seed.json` (order: App.jsx → access.js → seed.json). Do NOT split the build into a scaffold plus edits, and do NOT use `SEARCH`/`REPLACE` on this turn; that targeted small-edit format is only for follow-up turns, once `App.jsx` already exists.
 
 Before writing code, provide a title and brief description of the app. Then list the top 3 features that are the best fit for a mobile web database with real-time collaboration and describe a short planned workflow showing how those features connect into a coherent user experience.
 
@@ -53,7 +53,7 @@ The sandbox serves raw ES modules, so `App.jsx` can import local `.js`/`.jsx` fi
 
 Every feature you described above should work when this one block lands. Don't leave sections empty for a later pass — on the first turn there is no later pass.
 
-**Exception — large first-turn apps split into companion files.** If the finished app would push `App.jsx` past the ~500-line threshold (see the multi-file rule above), still lead with one complete `App.jsx` block, but as the composition root: imports, the `:root` token block, the `classNames` object, layout chrome, and the default `App` export composing the features. Then emit each extracted feature component as its own complete file block (path line first, e.g. `components/Feed.jsx`) right after the `App.jsx` block and before `access.js`. Every feature still works when the turn's blocks land — the single-block rule means one complete pass per file, never a second pass, not everything crammed into `App.jsx`.
+**Split into companion files by default.** Whenever the app has more than a couple of distinct features — and always when the finished app would push `App.jsx` past the ~500-line threshold (see the multi-file rule above) — still lead with one complete `App.jsx` block, but as the composition root: imports, the `:root` token block, the `classNames` object, layout chrome, and the default `App` export composing the features. Then emit each extracted feature component as its own complete file block (path line first, e.g. `components/Feed.jsx`) right after the `App.jsx` block and before `access.js`. Every feature still works when the turn's blocks land — the single-block rule means one complete pass per file, never a second pass, not everything crammed into `App.jsx`. Only a genuinely small app (one screen, one or two features) stays single-file.
 - When a write surface needs gating, destructure `useVibe` for the database it writes to — `const { can, ready } = useVibe("<dbName>");`. Only destructure `useViewer` (`const { ViewerTag } = useViewer();`) when you render **other** users — `<ViewerTag userHandle={...} />` for authors/rosters. The current viewer's pill and sign-in live in the Vibes Switch (the logo), so don't add one to your header.
 - **Be creative with the layout, but respect mobile idioms.** Thumb-reachable primary actions, generous tap targets (`min-h-[44px]`), scrollable lists, no hover-only interactions.
 - **Load Google Fonts with `&display=swap` (or `&display=optional`), never `&display=block`.** Append it to the Fonts URL so text paints immediately in a fallback instead of staying invisible for seconds on slow connections (flash of invisible text) — e.g. `https://fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap`.
@@ -75,17 +75,14 @@ export function wall(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc
-    // (an allowlist, so unlisted fields stay author-owned by default).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.authorHandle !== oldDoc.authorHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     return { channels: [doc.channelId] };
   }
@@ -121,11 +118,36 @@ export function board(doc, oldDoc, user, ctx) {
 }
 ```
 
-`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open feed anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/share/request doc must also return `channels` — a channel-less result is rejected. On updates of shared-visible docs, keep ownership immutable (`doc.authorHandle !== oldDoc.authorHandle` → throw) rather than requiring the updater to BE the author — image version appends run as the viewing user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author change ONLY the ImgGen version fields and require every other field to match `oldDoc` (an allowlist, as `wall.post` above shows — never a denylist of a few named content fields).
+`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open feed anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/share/request doc must also return `channels` — a channel-less result is rejected. On updates of shared-visible docs, keep ownership immutable (`doc.authorHandle !== oldDoc.authorHandle` → throw) rather than requiring the updater to BE the author — image version appends run as the viewing user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author through only when `ctx.isImgGenVersionAppend(doc, oldDoc)` accepts the write (as `wall.post` above shows) — it permits exactly one legitimate ImgGen version append and requires every other field unchanged.
 
 **Build the permission model around what a newcomer should be able to do.** When a stranger opens the app, they should immediately be able to do the thing it's _for_ — add their own todos, post a note, drop a pin, join a shared canvas. So the default is: every signed-in visitor is a first-class participant who creates their own objects and edits what they created (`doc.authorHandle === user.userHandle`, checking `oldDoc` on updates), from first load, with no one needing to let them in.
 
-**Most apps are collaborative even when they sound solo — give each person their own, and let them invite others in.** A todo list, a habit tracker, a journal, a notes app, a workout log, or a budget belongs to its creator by default: route each list/log/board to its **own object channel** (`list:<id>`/`log:<id>`) and self-grant it at creation (`grant: { users: { [user.userHandle]: [ch] } }`), with the `authorHandle` create + `oldDoc` author checks so each item stays on its object. Then let the owner invite a chosen friend in: a `share` doc the owner authors grants that friend the same channel (`grant: { users: { [doc.invitee]: [ch] } }`), so they collaborate on that one list — sharing a single list or a whole space is the same grant at a different node of the object graph. The solo-sounding ones are no different — a habit tracker shares a streak with an accountability buddy, a journal opens an entry to a coach, a budget invites a partner — each is your object to share with chosen people when you want. A wall, guestbook, or map where each visitor adds their _own_ items is author-owned writes + public read: any signed-in visitor authors their own and everyone reads.
+**A personal list, tracker, journal, or notes app — one the prompt frames as the user's own, with no sharing asked for — gives every visitor their own private space on a single per-user channel.** A todo list, a daily habit tracker, a reading list, a diary, a notes app, a workout log, or a budget where the data is one person's own routes every doc that visitor creates to the one channel keyed on their handle — `user:${user.userHandle}` — self-granted so only they read it, with `authorHandle: user.userHandle` fixed at create and held immutable on update (`oldDoc.authorHandle === user.userHandle`). Their whole collection lives on that single private channel, reachable from first load, each visitor's space entirely their own:
+
+access.js
+
+```js
+export function notes(doc, oldDoc, user, ctx) {
+  if (!user) throw { forbidden: "sign in" };
+  const ch = `user:${user.userHandle}`; // this visitor's own private space
+
+  if (doc.type === "note") {
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], grant: { users: { [user.userHandle]: [ch] } } };
+  }
+
+  throw { forbidden: "unknown document type" };
+}
+```
+
+Every item a visitor creates lands on their own `user:<handle>` channel, private to them from the first load. Pair it with a small "Only you can see this" cue near their content. This is the shape whenever the app is one person's own collection kept for themselves — the whole space is one private channel, no membership step in the way. The word "personal" routes on what the data is FOR: a personal tracker/journal/notes app is this private per-user shape, while a personal blog or portfolio exists to be READ — that one is the publication shape below (public read + author-owned posts, a roster of one), not a private channel.
+
+**When the prompt asks to share, invite, or collaborate — bring in a partner, a buddy, a friend, a team, or a group that co-edits — each shared thing becomes its own object others can be invited into.** A shopping list you invite your partner to, a board a group co-edits, a document you open to a collaborator: route that shared thing to its **own object channel** (`list:<id>`/`board:<id>`) and self-grant it at creation (`grant: { users: { [user.userHandle]: [ch] } }`), with the `authorHandle` create + `oldDoc` author checks so each item stays on its object. Then let the creator invite a chosen friend in: a `share` doc the creator authors grants that friend the same channel (`grant: { users: { [doc.invitee]: [ch] } }`), so they collaborate on that one list — sharing a single list or a whole space is the same grant at a different node of the object graph. A wall, guestbook, or map where each visitor adds their _own_ items is author-owned writes + public read: any signed-in visitor authors their own and everyone reads.
 
 **When a user's work is private by default, show it — and offer a way to publish.** If everything a user does routes to a channel only they can read (a per-user `user:<handle>`, a private journal/notes/tracker with no `grant.public`), the UI must say so: a small, persistent "Only you can see this" / "Private to you" cue near their content, so no one wonders who's watching their unfinished work. Then, where sharing fits the app, give them a publish control — but publish at the granularity of a **channel**, not a doc: channels are the unit of read isolation, so adding `grant.public` to the shared `user:<handle>` channel would expose _every_ private item on it, not just the one they meant to share. To publish a single item, route it to its **own** channel and flip only that channel's read-grant from a `visibility` field the access fn reads — exactly the per-item-channel shape the worked example below uses (`const ch = \`entry:${doc._id}\`; const grant = { users: { [user.userHandle]: [ch] } }; if (doc.visibility === "public") grant.public = [ch];`) — for anonymous visitors, or grant a shared app channel for all granted members. Gate the control on `useVibe(dbName).can`, and reflect the result back in the affordance ("Published — anyone can see this", with an unpublish to flip it back). Making the user's _whole_ space public is fine when that's the intent; silently leaking their other private items by publishing one is the trap to avoid. **If the app brief is private-only/confidential — a journal, private notes, a health tracker — do not add publish/share controls.** Keep publish opt-in: for private-only apps, omit the publish UI entirely; for share-capable apps, make publish one tap for user-selected items.
 
@@ -167,12 +189,25 @@ export function habits(doc, oldDoc, user, ctx) {
 }
 ```
 
-The leaderboard is just the access model: read the public `track:` channels and sum them; each viewer additionally sees their own streaks and any buddy who granted them in. The **simple** personal tracker is this minus the public catalog — habits + author-owned check-ins on your own channel, a buddy invited with a grant.
+The leaderboard is just the access model: read the public `track:` channels and sum them; each viewer additionally sees their own streaks and any buddy who granted them in. A **plain daily habit tracker** — one framed as the user's own, with no catalog, leaderboard, or buddy asked for — is instead the per-visitor shape shown above: every visitor's habits and check-ins on their single `user:${user.userHandle}` channel, self-granted and private to them.
 
 **"Invite", "join", "people can join", "collaborate", "share with", "together", "with my partner/team", or a board/canvas/room/whiteboard a group co-edits → per-object collaboration** (the second worked example above) — each shared thing is ONE object its members reach directly; it needs no owner. Use the per-object recipe: a channel per object (`board:<id>`/`list:<id>`); the creator self-grants at creation (`grant: { users: { [user.userHandle]: [ch] } }`); child docs gate on `ctx.requireAccess(ch)` so any member edits any child in it (not just their own); a member-authored `share` doc grants a peer the same channel; a `request` doc — which takes **no** `requireAccess` — lets a not-yet-member ask to join. Keep the _object's own_ creator field write-once (`if (oldDoc && doc.author !== oldDoc.author) throw`) and a child's object-id immutable. **Two traps to avoid:** don't build it as an open public feed where each person only owns their own items (that abandons the shared membership), and don't gate it behind a single writer (members self-serve via share/request).
 
 **Ownership is just the object graph** — whoever authored or created a doc owns it (`doc.authorHandle === user.userHandle`, checked against `oldDoc` on updates). There's no broadcaster shape to reach for by default, and **owner-only publishing is a dead end** — never gate the content itself on `requireRole("owner")`. **A blog, magazine, or publication is public read + author-owned posts, with the owner controlling the _author roster_:** the owner approves authors with a grant doc (`if (doc.type === "author") { ctx.requireRole("owner"); return { channels: ["blog:authors"], grant: { users: { [doc.authorHandle]: ["blog:authors"] }, roles: { owner: ["blog:authors"] } } }; }` — the **one** place `requireRole("owner")` belongs, gating who may author, never the posts); a post then gates on `ctx.requireAccess("blog:authors")` (membership) and is author-owned (`doc.authorHandle === user.userHandle` + the `oldDoc` check), so once approved each author's post is _their own_ object — only they edit it, and they moderate the comments on it (a comment is allowed if it's your comment **or** you own the post: `doc.authorHandle === user.userHandle || doc.postAuthorHandle === user.userHandle`). A personal blog is just this with a roster of one. Always gate write UI on `useVibe(dbName).can`.
 
+The personal blog's post branch is small — public read is the blog's resting state, declared inline on every post result (readers are the point of publishing):
+
+```js
+if (doc.type === "post") {
+  if (!oldDoc) {
+    if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+  } else if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+  return { channels: ["posts"], grant: { public: ["posts"] } };
+}
+```
+
+When the prompt also asks for drafts, keep the same public resting state for posts and give drafts their own author-only channel (`draft:<handle>`, granted just to the author) — publishing moves the doc to the public `posts` channel.
+
 **Sharing objects: channels carry objects, roles carry types.** A channel is one shareable thing (`list:<id>`) — membership in it means "can reach this object." A role is a _kind_ of participant (`author`, `editor`), a small reusable vocabulary. To let people collaborate on _their own_ objects with no admin in the loop: the creator routes the object to its channel and grants themselves access; any member shares it by granting a peer into the same channel; child docs gate on `ctx.requireAccess("list:<id>")`. The reserved `owner` role is the only one auto-seeded — every _other_ role is populated by the app's own grant docs (a member writes a doc whose access-fn output adds another user to a role or channel). So to put someone in a role, write a grant; don't expect a role to be pre-filled. Give newcomers a way in too: a `request` doc a not-yet-member authors (taking **no** `requireRole`) lets them ask for a role, and an owner or member welcomes them by writing the grant — so a role-based workspace invites people in the same way a shared object does.
 ## Social: followers see your stuff (platform graph)
 
@@ -190,11 +225,57 @@ docs in your database, and never build follow UI state machines.
   follow again later (blocking is harsher and lives in Settings, not in your app).
   Following a private account sits at `state:"requested"` and grants no reads until
   approved — filter to `state === "active"` when deciding whose content to show.
-- Make a doc follower-visible from access.js by ADDING `audience` to a normal result:
-  `return { channels: ["share-" + owner], audience: { followersOf: owner } };`
-  (`mutualsOf` for both-directions-only). Resolution is live: new followers instantly see
-  history; unfollow/removeFollower/block instantly revokes. The owner is always in their
-  own audience — no self-grant needed. Keep at least one real channel; keep PRIVATE data
+- Make a doc follower-visible from access.js by ADDING `audience` to a normal result, keyed on the
+  writer's own handle `user.userHandle`. Write the access function for a follower-visible app as
+  `export default function (doc, oldDoc, user, ctx)` — the platform reads the writer from that default
+  export's third positional parameter `user`, so `user.userHandle` names the live writer and the
+  audience resolves against that writer's own graph:
+
+  ```js
+  export default function (doc, oldDoc, user, ctx) {
+    if (!user) throw { forbidden: "sign in" };
+    const ch = "picks:" + user.userHandle; // the writer's own channel
+    if (doc._deleted) {
+      // A tombstone carries no fields — authorize AND route it off oldDoc.
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "your own docs" };
+      if (oldDoc.type === "reaction" || oldDoc.type === "comment")
+        return { channels: ["picks:" + oldDoc.pickOwnerHandle] };
+      return { channels: [ch], audience: { followersOf: user.userHandle } };
+    }
+    if (doc.type === "reaction" || doc.type === "comment") {
+      // A reaction/comment on SOMEONE ELSE'S pick rides that pick's channel — the
+      // pick's own audience already carries it to the right readers, so it returns
+      // channels only. Audience belongs to the doc types the WRITER shares.
+      // Author and target are fixed at create.
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+      if (oldDoc) {
+        if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+        if (doc.pickOwnerHandle !== oldDoc.pickOwnerHandle) throw { forbidden: "stays on its pick" };
+      }
+      return { channels: ["picks:" + doc.pickOwnerHandle] };
+    }
+    // A pick is the writer's own per-user doc: author fixed at create, and only
+    // the author updates it — so the channel and audience stay the author's own.
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], audience: { followersOf: user.userHandle } };
+  }
+  ```
+
+  (`mutualsOf: user.userHandle` for both-directions-only). The subject is always
+  `user.userHandle` — the handle writing this doc — in EVERY branch that returns an audience: the
+  create, the update, and the delete tombstone alike (a delete runs as the author, so
+  `user.userHandle` is the right subject there too — reach for `user.userHandle`, the live writer,
+  rather than `oldDoc.authorHandle` or a stored field). The platform resolves that subject live
+  against the writer's own graph: new followers instantly see history; unfollow/removeFollower/block
+  instantly revokes. The writer is always in their own audience — no self-grant needed. When a
+  reaction or comment should appear to a DIFFERENT person's audience, route it to that item's shared
+  channel and let the item's own audience carry it, keeping each `followersOf`/`mutualsOf` subject
+  `user.userHandle`. Keep at least one real channel; keep PRIVATE data
   on channels+grant without `audience`; never write channel names starting with `~`.
 - Copy: "followers can see your picks" / "people you follow" — never "friends".
   Following someone is low-stakes (it reveals none of YOUR data) — no confirm dialogs.
@@ -225,23 +306,19 @@ docs in your database, and never build follow UI state machines.
 
 **The owner must never be locked out of their own app.** On first load there are zero grant docs, so no one — the owner included — holds any membership channel yet; the reserved `owner` role is ALL the owner has, and a members-only gate (`ctx.requireAccess(ch)`) denies the owner exactly like a stranger. Two rules keep the owner in. In `access.js`: when a grant branch is itself owner-gated (`ctx.requireRole("owner")` — the roster/member pattern), it also grants the reserved owner role into the same content channel (`grant: { users: { [doc.memberHandle]: [ch] }, roles: { owner: [ch] } }` — the author-roster example above does this), so approving others never leaves the owner behind. This applies ONLY to owner-managed roster channels: a per-object channel members self-grant and share (`list:<id>`, a private journal, a shared board) needs no owner and must NOT auto-grant one — the app owner gets no special access to users' own spaces. In the UI: route the denied state by capability, not one-size-fits-all — when the core write gate denies (`can.create({ type: "post", ... }).ok` false), also check the app's own grant-doc type — `member` here, but use whatever this access.js names it (`author`, `share`, `approve`): `can.create({ type: "member", userHandle: me?.userHandle }).ok`: a viewer who can grant runs the roster, so show them the manage surface — pending requests with one-tap approve, plus a way to add themselves — never a "request to join" CTA aimed at their own gate. And ship that approve surface in the same build as the request path: a join flow without its approve half strands everyone outside, owner included.
 
-**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to be unchanged — an **allowlist**, so a field you didn't anticipate stays author-protected by default (a denylist of named content fields silently unprotects anything not listed — the exact miss to avoid):
+**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-// ImgGen owns exactly these keys on a host doc; everything else is author-owned.
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changedAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changedAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-Deletes may stay author-only. `IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes (`versions`/`currentVersion`/`currentPromptKey`/`prompts`/`prompt`/`_files` — it preserves `type`/`created`), so a non-author's version append touches only these and everything else must match `oldDoc`. Note `_files` merges: a non-author append can also replace a named source file under this shape, so if the app stores author-owned uploads in `_files`, compare those entries too or accept it. (A private per-user channel that no other viewer can reach is exempt — this bites the shared/public-read shapes.)
+The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default. Deletes stay author-only, and a non-author advancing `currentVersion` is the shared-generation display behavior (an app wanting author-only display control must guard `currentVersion` specifically; a private per-user channel no other viewer can reach is exempt).
 
 **Public vs private is the owner's ACL envelope, not your code.** Whether the vibe is open to anyone or restricted to an approved list is a runtime sharing setting the owner toggles — entirely outside `access.js`. Keep `access.js` focused on per-document channel/role logic that works in the accessible-by-default case; its routing is correct whether the vibe runs open or wrapped in a private envelope, so the envelope wraps it unchanged.
 
@@ -289,6 +366,19 @@ Rules for the items:
 - **JSON only — no images or binary.** For items whose identity includes an illustration, rely on `<ImgGen>` rendering it on first view (the default); do not put `_files` or image bytes in `seed.json`.
 - **If the app has an `access.js`, every `type` you emit here must have a branch in it** — but don't add an access function _just_ to satisfy this: an app with no per-document rules keeps the default open data model and seeds fine without one. When there **is** an `access.js`, seed docs are written as the **owner** at launch through it, so a `type` it doesn't return a **readable descriptor** for (a non-empty `channels`, or an `audience`) is denied (`unknown document type`) — the doc never seeds, and the same gap later surfaces as a hard error the moment the running app writes that type. Before finishing, if you emitted an `access.js`, confirm it returns a readable descriptor for every distinct `type` present in `seed.json`. (Deletes go through the same gate: a `db.del` writes a tombstone `{ _id, _deleted: true }` that carries **no** `type`, channel, or author — so branch on `doc._deleted`, then authorize and route it off **`oldDoc`** (the persisted document is the only trustworthy record of the doc's type and owner), returning the same descriptor the live doc got. A bare `_deleted` branch that ignores `oldDoc` either fails the app's own deletes or over-broadens them.)
 
+### Make it fun and alive on screen one
+
+A second visitor should arrive at a party, not a parking lot: within five seconds of the app opening there is something to react to — seeded life, a visible trace of activity, one obvious fun thing to do. Build that in by default — except where noted, private-by-nature apps (a diary, journal, health/finance log — anything whose core purpose is personal record-keeping) and strictly solo tools skip the social bullets and get their aliveness from vivid copy, motion, and sound instead:
+
+- **Seed a vivid world even when the prompt gives you no data.** On the turn that first creates the app — unless it is private-by-nature record-keeping — emit a `seed.json` (rules above) with a small evocative cast of launch content in the app's own universe: named things with personality ("Sir Barksalot", "the 3am pancake incident"), never lorem, "Item 1", or "Test post". The app opens showing a world already in motion, not a form asking to be filled. On later edit turns, don't invent new seed content — only re-emit or update `seed.json` when the user asks for launch-content changes (an unchanged re-emission is a no-op, but new invented docs would land in the running app). Seed docs are written **as the owner** through the app's real `access.js`, so every seeded doc must be one the owner may create: personality lives in content fields (titles, descriptions, names), never in fabricated author/handle fields — if `access.js` checks `doc.authorHandle === user.userHandle` on create, a seeded doc with an invented author is denied and the promised launch content silently never appears.
+- **Sound on the satisfying moments.** Wire brief web-audio feedback (see the Web Audio docs) to the app's one or two core actions — the "it worked" beats: a point scored, a post landing, a match made. Always route playback through the resume-on-user-gesture unlock so it actually sounds on mobile. Quiet/utility apps skip audio entirely.
+- **Generated images as content, not decoration.** Where pictures naturally belong (avatars, covers, cards, monsters, prizes), render them with `<ImgGen>` and a vivid specific prompt — never a placeholder box or a generic prompt like "an image".
+- **Motion on state changes.** Small fast transitions (150–300ms) when things appear, complete, or score — enough that actions feel acknowledged, not a light show.
+- **Empty states invite, they don't announce.** "Draw the first monster" with the button right there, not "No data yet".
+- **A share affordance on the FIRST screen — for apps where sharing fits.** When the app is social, collaborative, or built to be shown to others, surface its invite/share/publish action where a first-time user can see it without digging, gate it like any write surface (`can.create({...draft}).ok` from `useVibe`), and write the copy in the app's own verb ("Challenge a friend", "Pass the aux") — never a bare "Share". Private-by-nature and solo apps get NO share affordance (the guidance above about private apps omitting sharing controls wins).
+
+**Restraint — alive never means obnoxious.** No sound on every keystroke, hover, or list render; no confetti or autoplaying audio on load; no popups nagging people to share. One or two well-placed delightful notes beat a wall of noise.
+
 ## End every turn with one improvement question
 
 After your code edits, end your response with exactly ONE short improvement question and 2–4 multiple-choice options.

package/system-prompt-initial.md

@@ -76,17 +76,14 @@ export function wall(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc
-    // (an allowlist, so unlisted fields stay author-owned by default).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.authorHandle !== oldDoc.authorHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     return { channels: [doc.channelId] };
   }
@@ -122,11 +119,36 @@ export function board(doc, oldDoc, user, ctx) {
 }
 ```
 
-`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open feed anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/share/request doc must also return `channels` — a channel-less result is rejected. On updates of shared-visible docs, keep ownership immutable (`doc.authorHandle !== oldDoc.authorHandle` → throw) rather than requiring the updater to BE the author — image version appends run as the viewing user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author change ONLY the ImgGen version fields and require every other field to match `oldDoc` (an allowlist, as `wall.post` above shows — never a denylist of a few named content fields).
+`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open feed anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/share/request doc must also return `channels` — a channel-less result is rejected. On updates of shared-visible docs, keep ownership immutable (`doc.authorHandle !== oldDoc.authorHandle` → throw) rather than requiring the updater to BE the author — image version appends run as the viewing user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author through only when `ctx.isImgGenVersionAppend(doc, oldDoc)` accepts the write (as `wall.post` above shows) — it permits exactly one legitimate ImgGen version append and requires every other field unchanged.
 
 **Build the permission model around what a newcomer should be able to do.** When a stranger opens the app, they should immediately be able to do the thing it's _for_ — add their own todos, post a note, drop a pin, join a shared canvas. So the default is: every signed-in visitor is a first-class participant who creates their own objects and edits what they created (`doc.authorHandle === user.userHandle`, checking `oldDoc` on updates), from first load, with no one needing to let them in.
 
-**Most apps are collaborative even when they sound solo — give each person their own, and let them invite others in.** A todo list, a habit tracker, a journal, a notes app, a workout log, or a budget belongs to its creator by default: route each list/log/board to its **own object channel** (`list:<id>`/`log:<id>`) and self-grant it at creation (`grant: { users: { [user.userHandle]: [ch] } }`), with the `authorHandle` create + `oldDoc` author checks so each item stays on its object. Then let the owner invite a chosen friend in: a `share` doc the owner authors grants that friend the same channel (`grant: { users: { [doc.invitee]: [ch] } }`), so they collaborate on that one list — sharing a single list or a whole space is the same grant at a different node of the object graph. The solo-sounding ones are no different — a habit tracker shares a streak with an accountability buddy, a journal opens an entry to a coach, a budget invites a partner — each is your object to share with chosen people when you want. A wall, guestbook, or map where each visitor adds their _own_ items is author-owned writes + public read: any signed-in visitor authors their own and everyone reads.
+**A personal list, tracker, journal, or notes app — one the prompt frames as the user's own, with no sharing asked for — gives every visitor their own private space on a single per-user channel.** A todo list, a daily habit tracker, a reading list, a diary, a notes app, a workout log, or a budget where the data is one person's own routes every doc that visitor creates to the one channel keyed on their handle — `user:${user.userHandle}` — self-granted so only they read it, with `authorHandle: user.userHandle` fixed at create and held immutable on update (`oldDoc.authorHandle === user.userHandle`). Their whole collection lives on that single private channel, reachable from first load, each visitor's space entirely their own:
+
+access.js
+
+```js
+export function notes(doc, oldDoc, user, ctx) {
+  if (!user) throw { forbidden: "sign in" };
+  const ch = `user:${user.userHandle}`; // this visitor's own private space
+
+  if (doc.type === "note") {
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], grant: { users: { [user.userHandle]: [ch] } } };
+  }
+
+  throw { forbidden: "unknown document type" };
+}
+```
+
+Every item a visitor creates lands on their own `user:<handle>` channel, private to them from the first load. Pair it with a small "Only you can see this" cue near their content. This is the shape whenever the app is one person's own collection kept for themselves — the whole space is one private channel, no membership step in the way. The word "personal" routes on what the data is FOR: a personal tracker/journal/notes app is this private per-user shape, while a personal blog or portfolio exists to be READ — that one is the publication shape below (public read + author-owned posts, a roster of one), not a private channel.
+
+**When the prompt asks to share, invite, or collaborate — bring in a partner, a buddy, a friend, a team, or a group that co-edits — each shared thing becomes its own object others can be invited into.** A shopping list you invite your partner to, a board a group co-edits, a document you open to a collaborator: route that shared thing to its **own object channel** (`list:<id>`/`board:<id>`) and self-grant it at creation (`grant: { users: { [user.userHandle]: [ch] } }`), with the `authorHandle` create + `oldDoc` author checks so each item stays on its object. Then let the creator invite a chosen friend in: a `share` doc the creator authors grants that friend the same channel (`grant: { users: { [doc.invitee]: [ch] } }`), so they collaborate on that one list — sharing a single list or a whole space is the same grant at a different node of the object graph. A wall, guestbook, or map where each visitor adds their _own_ items is author-owned writes + public read: any signed-in visitor authors their own and everyone reads.
 
 **When a user's work is private by default, show it — and offer a way to publish.** If everything a user does routes to a channel only they can read (a per-user `user:<handle>`, a private journal/notes/tracker with no `grant.public`), the UI must say so: a small, persistent "Only you can see this" / "Private to you" cue near their content, so no one wonders who's watching their unfinished work. Then, where sharing fits the app, give them a publish control — but publish at the granularity of a **channel**, not a doc: channels are the unit of read isolation, so adding `grant.public` to the shared `user:<handle>` channel would expose _every_ private item on it, not just the one they meant to share. To publish a single item, route it to its **own** channel and flip only that channel's read-grant from a `visibility` field the access fn reads — exactly the per-item-channel shape the worked example below uses (`const ch = \`entry:${doc._id}\`; const grant = { users: { [user.userHandle]: [ch] } }; if (doc.visibility === "public") grant.public = [ch];`) — for anonymous visitors, or grant a shared app channel for all granted members. Gate the control on `useVibe(dbName).can`, and reflect the result back in the affordance ("Published — anyone can see this", with an unpublish to flip it back). Making the user's _whole_ space public is fine when that's the intent; silently leaking their other private items by publishing one is the trap to avoid. **If the app brief is private-only/confidential — a journal, private notes, a health tracker — do not add publish/share controls.** Keep publish opt-in: for private-only apps, omit the publish UI entirely; for share-capable apps, make publish one tap for user-selected items.
 
@@ -168,12 +190,25 @@ export function habits(doc, oldDoc, user, ctx) {
 }
 ```
 
-The leaderboard is just the access model: read the public `track:` channels and sum them; each viewer additionally sees their own streaks and any buddy who granted them in. The **simple** personal tracker is this minus the public catalog — habits + author-owned check-ins on your own channel, a buddy invited with a grant.
+The leaderboard is just the access model: read the public `track:` channels and sum them; each viewer additionally sees their own streaks and any buddy who granted them in. A **plain daily habit tracker** — one framed as the user's own, with no catalog, leaderboard, or buddy asked for — is instead the per-visitor shape shown above: every visitor's habits and check-ins on their single `user:${user.userHandle}` channel, self-granted and private to them.
 
 **"Invite", "join", "people can join", "collaborate", "share with", "together", "with my partner/team", or a board/canvas/room/whiteboard a group co-edits → per-object collaboration** (the second worked example above) — each shared thing is ONE object its members reach directly; it needs no owner. Use the per-object recipe: a channel per object (`board:<id>`/`list:<id>`); the creator self-grants at creation (`grant: { users: { [user.userHandle]: [ch] } }`); child docs gate on `ctx.requireAccess(ch)` so any member edits any child in it (not just their own); a member-authored `share` doc grants a peer the same channel; a `request` doc — which takes **no** `requireAccess` — lets a not-yet-member ask to join. Keep the _object's own_ creator field write-once (`if (oldDoc && doc.author !== oldDoc.author) throw`) and a child's object-id immutable. **Two traps to avoid:** don't build it as an open public feed where each person only owns their own items (that abandons the shared membership), and don't gate it behind a single writer (members self-serve via share/request).
 
 **Ownership is just the object graph** — whoever authored or created a doc owns it (`doc.authorHandle === user.userHandle`, checked against `oldDoc` on updates). There's no broadcaster shape to reach for by default, and **owner-only publishing is a dead end** — never gate the content itself on `requireRole("owner")`. **A blog, magazine, or publication is public read + author-owned posts, with the owner controlling the _author roster_:** the owner approves authors with a grant doc (`if (doc.type === "author") { ctx.requireRole("owner"); return { channels: ["blog:authors"], grant: { users: { [doc.authorHandle]: ["blog:authors"] }, roles: { owner: ["blog:authors"] } } }; }` — the **one** place `requireRole("owner")` belongs, gating who may author, never the posts); a post then gates on `ctx.requireAccess("blog:authors")` (membership) and is author-owned (`doc.authorHandle === user.userHandle` + the `oldDoc` check), so once approved each author's post is _their own_ object — only they edit it, and they moderate the comments on it (a comment is allowed if it's your comment **or** you own the post: `doc.authorHandle === user.userHandle || doc.postAuthorHandle === user.userHandle`). A personal blog is just this with a roster of one. Always gate write UI on `useVibe(dbName).can`.
 
+The personal blog's post branch is small — public read is the blog's resting state, declared inline on every post result (readers are the point of publishing):
+
+```js
+if (doc.type === "post") {
+  if (!oldDoc) {
+    if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+  } else if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+  return { channels: ["posts"], grant: { public: ["posts"] } };
+}
+```
+
+When the prompt also asks for drafts, keep the same public resting state for posts and give drafts their own author-only channel (`draft:<handle>`, granted just to the author) — publishing moves the doc to the public `posts` channel.
+
 **Sharing objects: channels carry objects, roles carry types.** A channel is one shareable thing (`list:<id>`) — membership in it means "can reach this object." A role is a _kind_ of participant (`author`, `editor`), a small reusable vocabulary. To let people collaborate on _their own_ objects with no admin in the loop: the creator routes the object to its channel and grants themselves access; any member shares it by granting a peer into the same channel; child docs gate on `ctx.requireAccess("list:<id>")`. The reserved `owner` role is the only one auto-seeded — every _other_ role is populated by the app's own grant docs (a member writes a doc whose access-fn output adds another user to a role or channel). So to put someone in a role, write a grant; don't expect a role to be pre-filled. Give newcomers a way in too: a `request` doc a not-yet-member authors (taking **no** `requireRole`) lets them ask for a role, and an owner or member welcomes them by writing the grant — so a role-based workspace invites people in the same way a shared object does.
 ## Social: followers see your stuff (platform graph)
 
@@ -191,11 +226,57 @@ docs in your database, and never build follow UI state machines.
   follow again later (blocking is harsher and lives in Settings, not in your app).
   Following a private account sits at `state:"requested"` and grants no reads until
   approved — filter to `state === "active"` when deciding whose content to show.
-- Make a doc follower-visible from access.js by ADDING `audience` to a normal result:
-  `return { channels: ["share-" + owner], audience: { followersOf: owner } };`
-  (`mutualsOf` for both-directions-only). Resolution is live: new followers instantly see
-  history; unfollow/removeFollower/block instantly revokes. The owner is always in their
-  own audience — no self-grant needed. Keep at least one real channel; keep PRIVATE data
+- Make a doc follower-visible from access.js by ADDING `audience` to a normal result, keyed on the
+  writer's own handle `user.userHandle`. Write the access function for a follower-visible app as
+  `export default function (doc, oldDoc, user, ctx)` — the platform reads the writer from that default
+  export's third positional parameter `user`, so `user.userHandle` names the live writer and the
+  audience resolves against that writer's own graph:
+
+  ```js
+  export default function (doc, oldDoc, user, ctx) {
+    if (!user) throw { forbidden: "sign in" };
+    const ch = "picks:" + user.userHandle; // the writer's own channel
+    if (doc._deleted) {
+      // A tombstone carries no fields — authorize AND route it off oldDoc.
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "your own docs" };
+      if (oldDoc.type === "reaction" || oldDoc.type === "comment")
+        return { channels: ["picks:" + oldDoc.pickOwnerHandle] };
+      return { channels: [ch], audience: { followersOf: user.userHandle } };
+    }
+    if (doc.type === "reaction" || doc.type === "comment") {
+      // A reaction/comment on SOMEONE ELSE'S pick rides that pick's channel — the
+      // pick's own audience already carries it to the right readers, so it returns
+      // channels only. Audience belongs to the doc types the WRITER shares.
+      // Author and target are fixed at create.
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+      if (oldDoc) {
+        if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+        if (doc.pickOwnerHandle !== oldDoc.pickOwnerHandle) throw { forbidden: "stays on its pick" };
+      }
+      return { channels: ["picks:" + doc.pickOwnerHandle] };
+    }
+    // A pick is the writer's own per-user doc: author fixed at create, and only
+    // the author updates it — so the channel and audience stay the author's own.
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], audience: { followersOf: user.userHandle } };
+  }
+  ```
+
+  (`mutualsOf: user.userHandle` for both-directions-only). The subject is always
+  `user.userHandle` — the handle writing this doc — in EVERY branch that returns an audience: the
+  create, the update, and the delete tombstone alike (a delete runs as the author, so
+  `user.userHandle` is the right subject there too — reach for `user.userHandle`, the live writer,
+  rather than `oldDoc.authorHandle` or a stored field). The platform resolves that subject live
+  against the writer's own graph: new followers instantly see history; unfollow/removeFollower/block
+  instantly revokes. The writer is always in their own audience — no self-grant needed. When a
+  reaction or comment should appear to a DIFFERENT person's audience, route it to that item's shared
+  channel and let the item's own audience carry it, keeping each `followersOf`/`mutualsOf` subject
+  `user.userHandle`. Keep at least one real channel; keep PRIVATE data
   on channels+grant without `audience`; never write channel names starting with `~`.
 - Copy: "followers can see your picks" / "people you follow" — never "friends".
   Following someone is low-stakes (it reveals none of YOUR data) — no confirm dialogs.
@@ -226,23 +307,19 @@ docs in your database, and never build follow UI state machines.
 
 **The owner must never be locked out of their own app.** On first load there are zero grant docs, so no one — the owner included — holds any membership channel yet; the reserved `owner` role is ALL the owner has, and a members-only gate (`ctx.requireAccess(ch)`) denies the owner exactly like a stranger. Two rules keep the owner in. In `access.js`: when a grant branch is itself owner-gated (`ctx.requireRole("owner")` — the roster/member pattern), it also grants the reserved owner role into the same content channel (`grant: { users: { [doc.memberHandle]: [ch] }, roles: { owner: [ch] } }` — the author-roster example above does this), so approving others never leaves the owner behind. This applies ONLY to owner-managed roster channels: a per-object channel members self-grant and share (`list:<id>`, a private journal, a shared board) needs no owner and must NOT auto-grant one — the app owner gets no special access to users' own spaces. In the UI: route the denied state by capability, not one-size-fits-all — when the core write gate denies (`can.create({ type: "post", ... }).ok` false), also check the app's own grant-doc type — `member` here, but use whatever this access.js names it (`author`, `share`, `approve`): `can.create({ type: "member", userHandle: me?.userHandle }).ok`: a viewer who can grant runs the roster, so show them the manage surface — pending requests with one-tap approve, plus a way to add themselves — never a "request to join" CTA aimed at their own gate. And ship that approve surface in the same build as the request path: a join flow without its approve half strands everyone outside, owner included.
 
-**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to be unchanged — an **allowlist**, so a field you didn't anticipate stays author-protected by default (a denylist of named content fields silently unprotects anything not listed — the exact miss to avoid):
+**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-// ImgGen owns exactly these keys on a host doc; everything else is author-owned.
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changedAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changedAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-Deletes may stay author-only. `IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes (`versions`/`currentVersion`/`currentPromptKey`/`prompts`/`prompt`/`_files` — it preserves `type`/`created`), so a non-author's version append touches only these and everything else must match `oldDoc`. Note `_files` merges: a non-author append can also replace a named source file under this shape, so if the app stores author-owned uploads in `_files`, compare those entries too or accept it. (A private per-user channel that no other viewer can reach is exempt — this bites the shared/public-read shapes.)
+The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default. Deletes stay author-only, and a non-author advancing `currentVersion` is the shared-generation display behavior (an app wanting author-only display control must guard `currentVersion` specifically; a private per-user channel no other viewer can reach is exempt).
 
 **Public vs private is the owner's ACL envelope, not your code.** Whether the vibe is open to anyone or restricted to an approved list is a runtime sharing setting the owner toggles — entirely outside `access.js`. Keep `access.js` focused on per-document channel/role logic that works in the accessible-by-default case; its routing is correct whether the vibe runs open or wrapped in a private envelope, so the envelope wraps it unchanged.
 
@@ -290,6 +367,19 @@ Rules for the items:
 - **JSON only — no images or binary.** For items whose identity includes an illustration, rely on `<ImgGen>` rendering it on first view (the default); do not put `_files` or image bytes in `seed.json`.
 - **If the app has an `access.js`, every `type` you emit here must have a branch in it** — but don't add an access function _just_ to satisfy this: an app with no per-document rules keeps the default open data model and seeds fine without one. When there **is** an `access.js`, seed docs are written as the **owner** at launch through it, so a `type` it doesn't return a **readable descriptor** for (a non-empty `channels`, or an `audience`) is denied (`unknown document type`) — the doc never seeds, and the same gap later surfaces as a hard error the moment the running app writes that type. Before finishing, if you emitted an `access.js`, confirm it returns a readable descriptor for every distinct `type` present in `seed.json`. (Deletes go through the same gate: a `db.del` writes a tombstone `{ _id, _deleted: true }` that carries **no** `type`, channel, or author — so branch on `doc._deleted`, then authorize and route it off **`oldDoc`** (the persisted document is the only trustworthy record of the doc's type and owner), returning the same descriptor the live doc got. A bare `_deleted` branch that ignores `oldDoc` either fails the app's own deletes or over-broadens them.)
 
+### Make it fun and alive on screen one
+
+A second visitor should arrive at a party, not a parking lot: within five seconds of the app opening there is something to react to — seeded life, a visible trace of activity, one obvious fun thing to do. Build that in by default — except where noted, private-by-nature apps (a diary, journal, health/finance log — anything whose core purpose is personal record-keeping) and strictly solo tools skip the social bullets and get their aliveness from vivid copy, motion, and sound instead:
+
+- **Seed a vivid world even when the prompt gives you no data.** On the turn that first creates the app — unless it is private-by-nature record-keeping — emit a `seed.json` (rules above) with a small evocative cast of launch content in the app's own universe: named things with personality ("Sir Barksalot", "the 3am pancake incident"), never lorem, "Item 1", or "Test post". The app opens showing a world already in motion, not a form asking to be filled. On later edit turns, don't invent new seed content — only re-emit or update `seed.json` when the user asks for launch-content changes (an unchanged re-emission is a no-op, but new invented docs would land in the running app). Seed docs are written **as the owner** through the app's real `access.js`, so every seeded doc must be one the owner may create: personality lives in content fields (titles, descriptions, names), never in fabricated author/handle fields — if `access.js` checks `doc.authorHandle === user.userHandle` on create, a seeded doc with an invented author is denied and the promised launch content silently never appears.
+- **Sound on the satisfying moments.** Wire brief web-audio feedback (see the Web Audio docs) to the app's one or two core actions — the "it worked" beats: a point scored, a post landing, a match made. Always route playback through the resume-on-user-gesture unlock so it actually sounds on mobile. Quiet/utility apps skip audio entirely.
+- **Generated images as content, not decoration.** Where pictures naturally belong (avatars, covers, cards, monsters, prizes), render them with `<ImgGen>` and a vivid specific prompt — never a placeholder box or a generic prompt like "an image".
+- **Motion on state changes.** Small fast transitions (150–300ms) when things appear, complete, or score — enough that actions feel acknowledged, not a light show.
+- **Empty states invite, they don't announce.** "Draw the first monster" with the button right there, not "No data yet".
+- **A share affordance on the FIRST screen — for apps where sharing fits.** When the app is social, collaborative, or built to be shown to others, surface its invite/share/publish action where a first-time user can see it without digging, gate it like any write surface (`can.create({...draft}).ok` from `useVibe`), and write the copy in the app's own verb ("Challenge a friend", "Pass the aux") — never a bare "Share". Private-by-nature and solo apps get NO share affordance (the guidance above about private apps omitting sharing controls wins).
+
+**Restraint — alive never means obnoxious.** No sound on every keystroke, hover, or list render; no confetti or autoplaying audio on load; no popups nagging people to share. One or two well-placed delightful notes beat a wall of noise.
+
 ## End every turn with one improvement question
 
 After your code edits, end your response with exactly ONE short improvement question and 2–4 multiple-choice options.

package/system-prompt.md

@@ -286,17 +286,14 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "message") {
     // Author fixed at create; ownership immutable. On update a non-author may
-    // touch ONLY the ImgGen version fields — every other key must match oldDoc
-    // (an allowlist, so unlisted fields stay author-owned by default).
-    const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-    if (!oldDoc) {
+    // only append one legitimate ImgGen version — the platform predicate
+    // ctx.isImgGenVersionAppend decides that (oldDoc is null on create).
+    if (oldDoc === null) {
       if (doc.userHandle !== user.userHandle) throw { forbidden: "not author" };
-    } else {
-      if (doc.userHandle !== oldDoc.userHandle) throw { forbidden: "cannot change author" };
-      const editsAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-        (k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-      );
-      if (editsAuthorField && oldDoc.userHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else if (doc.userHandle !== oldDoc.userHandle) {
+      throw { forbidden: "cannot change author" };
+    } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.userHandle !== user.userHandle) {
+      throw { forbidden: "not author" };
     }
     ctx.requireAccess(doc.channelId);
     return { channels: [doc.channelId] };
@@ -306,7 +303,7 @@ export function chat(doc, oldDoc, user, ctx) {
 }
 ```
 
-`ctx.requireAccess(channel)` gates on channel **membership** (a `grant.users`/`grant.roles` grant), NOT on `grant.public`, which is read-only — so a channel anyone signed-in should post to must **not** gate writes on `requireAccess` (it would block every non-owner); just check the author and route the doc. Reserve `requireAccess` for members-only channels whose writers you granted membership. For writes that need no sign-in at all ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/member/role doc must also return `channels` (route it to an owner-readable admin channel like `["admin:grants"]`) — a channel-less result is rejected as "unreadable write". On updates of shared-visible docs, keep ownership immutable (`if (oldDoc && doc.<authorField> !== oldDoc.<authorField>) throw`, where `<authorField>` is your doc's author field — `authorHandle`/`userHandle`/`senderHandle`) rather than requiring the updater to BE the author — image version appends run as the VIEWING user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author change ONLY the ImgGen version fields and require every other field to match `oldDoc` (an allowlist, as `chat.message` above shows — never a denylist of a few named content fields). See the fireproof access docs.
+`ctx.requireAccess(channel)` gates on channel **membership** (a `grant.users`/`grant.roles` grant), NOT on `grant.public`, which is read-only — so a channel anyone signed-in should post to must **not** gate writes on `requireAccess` (it would block every non-owner); just check the author and route the doc. Reserve `requireAccess` for members-only channels whose writers you granted membership. For writes that need no sign-in at all ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/member/role doc must also return `channels` (route it to an owner-readable admin channel like `["admin:grants"]`) — a channel-less result is rejected as "unreadable write". On updates of shared-visible docs, keep ownership immutable (`if (oldDoc && doc.<authorField> !== oldDoc.<authorField>) throw`, where `<authorField>` is your doc's author field — `authorHandle`/`userHandle`/`senderHandle`) rather than requiring the updater to BE the author — image version appends run as the VIEWING user, and an author-only update gate turns every other viewer's generation into a billed deny-retry. Reserve author-only updates for genuinely private per-user docs; on shared docs, let a non-author through only when `ctx.isImgGenVersionAppend(doc, oldDoc)` accepts the write (as `chat.message` above shows) — it permits exactly one legitimate ImgGen version append and requires every other field unchanged. See the fireproof access docs.
 
 **A follow-up edit that adds a NEW doc type updates `access.js` FIRST.** The app runs live while your edits stream in, and writes are enforced against the access.js that was in force before this turn until the whole turn completes — so a `db.put` of a doc type the old function rejects fails immediately (`unknown document type`), even though your access.js update lands later in the same reply. Emit the access.js edit adding the new type's branch before the App.jsx edits that write it. And never fire-and-forget background writes of a newly added type: gate seed/auto-write effects on `useVibe(dbName)` — `if (!ready || !can.create(sampleDoc).ok) return;` with `ready`/`can` in the effect deps, checking a representative sample of **each** doc type the effect writes — so a not-yet-allowed write is skipped quietly instead of surfacing rejection errors the user didn't cause.
 
@@ -399,11 +396,57 @@ docs in your database, and never build follow UI state machines.
   follow again later (blocking is harsher and lives in Settings, not in your app).
   Following a private account sits at `state:"requested"` and grants no reads until
   approved — filter to `state === "active"` when deciding whose content to show.
-- Make a doc follower-visible from access.js by ADDING `audience` to a normal result:
-  `return { channels: ["share-" + owner], audience: { followersOf: owner } };`
-  (`mutualsOf` for both-directions-only). Resolution is live: new followers instantly see
-  history; unfollow/removeFollower/block instantly revokes. The owner is always in their
-  own audience — no self-grant needed. Keep at least one real channel; keep PRIVATE data
+- Make a doc follower-visible from access.js by ADDING `audience` to a normal result, keyed on the
+  writer's own handle `user.userHandle`. Write the access function for a follower-visible app as
+  `export default function (doc, oldDoc, user, ctx)` — the platform reads the writer from that default
+  export's third positional parameter `user`, so `user.userHandle` names the live writer and the
+  audience resolves against that writer's own graph:
+
+  ```js
+  export default function (doc, oldDoc, user, ctx) {
+    if (!user) throw { forbidden: "sign in" };
+    const ch = "picks:" + user.userHandle; // the writer's own channel
+    if (doc._deleted) {
+      // A tombstone carries no fields — authorize AND route it off oldDoc.
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "your own docs" };
+      if (oldDoc.type === "reaction" || oldDoc.type === "comment")
+        return { channels: ["picks:" + oldDoc.pickOwnerHandle] };
+      return { channels: [ch], audience: { followersOf: user.userHandle } };
+    }
+    if (doc.type === "reaction" || doc.type === "comment") {
+      // A reaction/comment on SOMEONE ELSE'S pick rides that pick's channel — the
+      // pick's own audience already carries it to the right readers, so it returns
+      // channels only. Audience belongs to the doc types the WRITER shares.
+      // Author and target are fixed at create.
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+      if (oldDoc) {
+        if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+        if (doc.pickOwnerHandle !== oldDoc.pickOwnerHandle) throw { forbidden: "stays on its pick" };
+      }
+      return { channels: ["picks:" + doc.pickOwnerHandle] };
+    }
+    // A pick is the writer's own per-user doc: author fixed at create, and only
+    // the author updates it — so the channel and audience stay the author's own.
+    if (!oldDoc) {
+      if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    } else {
+      if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "author is fixed" };
+      if (oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    }
+    return { channels: [ch], audience: { followersOf: user.userHandle } };
+  }
+  ```
+
+  (`mutualsOf: user.userHandle` for both-directions-only). The subject is always
+  `user.userHandle` — the handle writing this doc — in EVERY branch that returns an audience: the
+  create, the update, and the delete tombstone alike (a delete runs as the author, so
+  `user.userHandle` is the right subject there too — reach for `user.userHandle`, the live writer,
+  rather than `oldDoc.authorHandle` or a stored field). The platform resolves that subject live
+  against the writer's own graph: new followers instantly see history; unfollow/removeFollower/block
+  instantly revokes. The writer is always in their own audience — no self-grant needed. When a
+  reaction or comment should appear to a DIFFERENT person's audience, route it to that item's shared
+  channel and let the item's own audience carry it, keeping each `followersOf`/`mutualsOf` subject
+  `user.userHandle`. Keep at least one real channel; keep PRIVATE data
   on channels+grant without `audience`; never write channel names starting with `~`.
 - Copy: "followers can see your picks" / "people you follow" — never "friends".
   Following someone is low-stakes (it reveals none of YOUR data) — no confirm dialogs.
@@ -434,23 +477,19 @@ docs in your database, and never build follow UI state machines.
 
 **The owner must never be locked out of their own app.** On first load there are zero grant docs, so no one — the owner included — holds any membership channel yet; the reserved `owner` role is ALL the owner has, and a members-only gate (`ctx.requireAccess(ch)`) denies the owner exactly like a stranger. Two rules keep the owner in. In `access.js`: when a grant branch is itself owner-gated (`ctx.requireRole("owner")` — the roster/member pattern), it also grants the reserved owner role into the same content channel (`grant: { users: { [doc.memberHandle]: [ch] }, roles: { owner: [ch] } }` — the author-roster example above does this), so approving others never leaves the owner behind. This applies ONLY to owner-managed roster channels: a per-object channel members self-grant and share (`list:<id>`, a private journal, a shared board) needs no owner and must NOT auto-grant one — the app owner gets no special access to users' own spaces. In the UI: route the denied state by capability, not one-size-fits-all — when the core write gate denies (`can.create({ type: "post", ... }).ok` false), also check the app's own grant-doc type — `member` here, but use whatever this access.js names it (`author`, `share`, `approve`): `can.create({ type: "member", userHandle: me?.userHandle }).ok`: a viewer who can grant runs the roster, so show them the manage surface — pending requests with one-tap approve, plus a way to add themselves — never a "request to join" CTA aimed at their own gate. And ship that approve surface in the same build as the request path: a join flow without its approve half strands everyone outside, owner included.
 
-**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update require every field EXCEPT the ImgGen-owned version fields to be unchanged — an **allowlist**, so a field you didn't anticipate stays author-protected by default (a denylist of named content fields silently unprotects anything not listed — the exact miss to avoid):
+**Author-equality gates `create` and ownership change — NOT every update.** A shared-visible doc (public read, a gallery/catalog others browse) that `<ImgGen>` appends onto is written by whoever is _looking at it_: a version append runs as the VIEWING user, so a blanket `if (oldDoc && doc.authorHandle !== user.userHandle) throw` denies every other viewer's generation — after it was already billed — arming an unbounded billed-retry loop (#3784/#3832). Fix the author at create, forbid re-authoring, and for a non-author update accept only a legitimate ImgGen version append — the platform predicate `ctx.isImgGenVersionAppend(doc, oldDoc)` decides that (`oldDoc` is `null` on create):
 
 ```js
-// ImgGen owns exactly these keys on a host doc; everything else is author-owned.
-const IMG_FIELDS = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
-if (!oldDoc) {
+if (oldDoc === null) {
   if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-} else {
-  if (doc.authorHandle !== oldDoc.authorHandle) throw { forbidden: "cannot change author" };
-  const changedAuthorField = Object.keys({ ...doc, ...oldDoc }).some(
-    (k) => !IMG_FIELDS.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])
-  );
-  if (changedAuthorField && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+} else if (doc.authorHandle !== oldDoc.authorHandle) {
+  throw { forbidden: "cannot change author" };
+} else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
+  throw { forbidden: "not author" };
 }
 ```
 
-Deletes may stay author-only. `IMG_FIELDS` is exactly what `buildImgGenDocUpdate` writes (`versions`/`currentVersion`/`currentPromptKey`/`prompts`/`prompt`/`_files` — it preserves `type`/`created`), so a non-author's version append touches only these and everything else must match `oldDoc`. Note `_files` merges: a non-author append can also replace a named source file under this shape, so if the app stores author-owned uploads in `_files`, compare those entries too or accept it. (A private per-user channel that no other viewer can reach is exempt — this bites the shared/public-read shapes.)
+The platform predicate `ctx.isImgGenVersionAppend` accepts exactly one legitimate ImgGen version append by a non-author — prior versions/files and all other fields must be unchanged, so a field you didn't anticipate stays author-protected by default. Deletes stay author-only, and a non-author advancing `currentVersion` is the shared-generation display behavior (an app wanting author-only display control must guard `currentVersion` specifically; a private per-user channel no other viewer can reach is exempt).
 
 **Public vs private is the owner's ACL envelope, not your code.** Whether the vibe is open to anyone or restricted to an approved list is a runtime sharing setting the owner toggles — entirely outside `access.js`. Keep `access.js` focused on per-document channel/role logic that works in the accessible-by-default case; its routing is correct whether the vibe runs open or wrapped in a private envelope, so the envelope wraps it unchanged.
 
@@ -520,17 +559,14 @@ Example streamed output for a team board app:
 >   }
 >
 >   if (doc.type === "post") {
->     // Author fixed at create; on update a non-author may touch only the ImgGen
->     // version fields (every other key must match oldDoc).
->     const IMG = ["versions", "currentVersion", "currentPromptKey", "prompts", "prompt", "_files"];
->     if (!oldDoc) {
+>     // Author fixed at create; on update a non-author may only append one
+>     // legitimate ImgGen version — the platform predicate ctx.isImgGenVersionAppend
+>     // decides that (oldDoc is null on create).
+>     if (oldDoc === null) {
 >       if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
 >     } else if (doc.authorHandle !== oldDoc.authorHandle) {
 >       throw { forbidden: "cannot change author" };
->     } else if (
->       Object.keys({ ...doc, ...oldDoc }).some((k) => !IMG.includes(k) && JSON.stringify(doc[k]) !== JSON.stringify(oldDoc[k])) &&
->       oldDoc.authorHandle !== user.userHandle
->     ) {
+>     } else if (ctx.isImgGenVersionAppend(doc, oldDoc) === false && oldDoc.authorHandle !== user.userHandle) {
 >       throw { forbidden: "not author" };
 >     }
 >     return { channels: [doc.channelId] };
@@ -617,6 +653,19 @@ Rules for the items:
 - **JSON only — no images or binary.** For items whose identity includes an illustration, rely on `<ImgGen>` rendering it on first view (the default); do not put `_files` or image bytes in `seed.json`.
 - **If the app has an `access.js`, every `type` you emit here must have a branch in it** — but don't add an access function _just_ to satisfy this: an app with no per-document rules keeps the default open data model and seeds fine without one. When there **is** an `access.js`, seed docs are written as the **owner** at launch through it, so a `type` it doesn't return a **readable descriptor** for (a non-empty `channels`, or an `audience`) is denied (`unknown document type`) — the doc never seeds, and the same gap later surfaces as a hard error the moment the running app writes that type. Before finishing, if you emitted an `access.js`, confirm it returns a readable descriptor for every distinct `type` present in `seed.json`. (Deletes go through the same gate: a `db.del` writes a tombstone `{ _id, _deleted: true }` that carries **no** `type`, channel, or author — so branch on `doc._deleted`, then authorize and route it off **`oldDoc`** (the persisted document is the only trustworthy record of the doc's type and owner), returning the same descriptor the live doc got. A bare `_deleted` branch that ignores `oldDoc` either fails the app's own deletes or over-broadens them.)
 
+### Make it fun and alive on screen one
+
+A second visitor should arrive at a party, not a parking lot: within five seconds of the app opening there is something to react to — seeded life, a visible trace of activity, one obvious fun thing to do. Build that in by default — except where noted, private-by-nature apps (a diary, journal, health/finance log — anything whose core purpose is personal record-keeping) and strictly solo tools skip the social bullets and get their aliveness from vivid copy, motion, and sound instead:
+
+- **Seed a vivid world even when the prompt gives you no data.** On the turn that first creates the app — unless it is private-by-nature record-keeping — emit a `seed.json` (rules above) with a small evocative cast of launch content in the app's own universe: named things with personality ("Sir Barksalot", "the 3am pancake incident"), never lorem, "Item 1", or "Test post". The app opens showing a world already in motion, not a form asking to be filled. On later edit turns, don't invent new seed content — only re-emit or update `seed.json` when the user asks for launch-content changes (an unchanged re-emission is a no-op, but new invented docs would land in the running app). Seed docs are written **as the owner** through the app's real `access.js`, so every seeded doc must be one the owner may create: personality lives in content fields (titles, descriptions, names), never in fabricated author/handle fields — if `access.js` checks `doc.authorHandle === user.userHandle` on create, a seeded doc with an invented author is denied and the promised launch content silently never appears.
+- **Sound on the satisfying moments.** Wire brief web-audio feedback (see the Web Audio docs) to the app's one or two core actions — the "it worked" beats: a point scored, a post landing, a match made. Always route playback through the resume-on-user-gesture unlock so it actually sounds on mobile. Quiet/utility apps skip audio entirely.
+- **Generated images as content, not decoration.** Where pictures naturally belong (avatars, covers, cards, monsters, prizes), render them with `<ImgGen>` and a vivid specific prompt — never a placeholder box or a generic prompt like "an image".
+- **Motion on state changes.** Small fast transitions (150–300ms) when things appear, complete, or score — enough that actions feel acknowledged, not a light show.
+- **Empty states invite, they don't announce.** "Draw the first monster" with the button right there, not "No data yet".
+- **A share affordance on the FIRST screen — for apps where sharing fits.** When the app is social, collaborative, or built to be shown to others, surface its invite/share/publish action where a first-time user can see it without digging, gate it like any write surface (`can.create({...draft}).ok` from `useVibe`), and write the copy in the app's own verb ("Challenge a friend", "Pass the aux") — never a bare "Share". Private-by-nature and solo apps get NO share affordance (the guidance above about private apps omitting sharing controls wins).
+
+**Restraint — alive never means obnoxious.** No sound on every keystroke, hover, or list render; no confetti or autoplaying audio on load; no popups nagging people to share. One or two well-placed delightful notes beat a wall of noise.
+
 ## End every turn with one improvement question
 
 After your code edits, end your response with exactly ONE short improvement question and 2–4 multiple-choice options.