Rhombra

A mock-up of the screen, drawn from its layout, palette and typefaces. A build follows the full prompt below.

Start from this screenRead the build prompt

Typefaces

The catalog's own faces. A screen composed into a template is drawn in that template's typefaces.

• InterHeadings: Inter 300, 28px 'Sign in' heading (light weight only at this size)
• InterBody: Inter 400, 16px, line-height 1.5

Patterns

• full-black page with soft vertical light beams
• wordmark top-left and docs button top-right
• stacked full-width provider buttons
• 'or continue using email' divider
• muted full-width submit
• consent line with underlined links

States it is designed for

• default
• invalid email
• sending
• link sent with resend timer
• link expired on callback
• OAuth error
• rate-limited

Who it is for

• backend developers
• platform engineers

Layout

1. top bar: wordmark left, outlined 'Documentation' button right
2. centred column ~230px (max 380px): 'Sign in' heading, 'New here? Create account' line
3. two provider buttons stacked
4. divider with text
5. email label and input
6. submit button
7. consent text
8. background: black with blurred vertical beams near the top edges; beams hidden on mobile

Palette

Moody, premium, developer-cool; a spotlight on a single task.

• bg#050505
• surface#161616
• text#f2f2f2
• muted#9a9a9a
• border#6b6b6b
• submit#8a8a8a
• submit-text#0a0a0a
• focus#e6e6e6
• beam#2a2a2a

Every checked pair, measured again

As vibld’s tokens

The palette on the fifteen colour tokens vibld styles a project with, each text colour on the fill it is read on. Marked tokens are solved from the palette, because no swatch held that role at 4.5:1.

• background
• card
• muted
• primary *
• secondary
• accent
• destructive *

Type scale

Display

Inter 300, 28px 'Sign in' heading (light weight only at this size)

Body

Inter 400, 16px, line-height 1.5

Buttons 15px 600; consent 13px with underlined links; nothing below 12px.

Spacing and imagery

Density: Airy. Grid: 8px; 12px between stacked buttons. Container: column 380px max. Radius: 6px buttons and inputs. Shadows: None; borders define controls.

CSS-only blurred gradient beams; provider glyphs in monochrome white.

Components

• TopBar (wordmark, Documentation button)
• BeamBackdrop
• ProviderButton ×2
• TextDivider
• EmailForm
• SubmitButton
• ConsentText

Interactions

• Provider buttons start OAuth
• Email submit sends a magic link and swaps the form for a 'Check your inbox' panel
• Documentation opens docs in a new tab
• Enter submits

Data

• User{id, email}
• Identity{user_id, provider (code-host|oauth-a|email)}
• Workspace{id, owner_id, name}

Guardrails

Experience

• Keep the create-account link beside the heading
• Show consent text right under the submit
• Make the email submit clearly a button despite muted tone
• Confirm link sent without revealing whether the account exists
• Keep the docs link available pre-login

Accessibility

• Light 300 weight only for the 28px heading
• All text on black ≥4.5:1; placeholders too
• Focus ring light grey 2px with offset
• Beams aria-hidden and paused under reduced motion
• Consent links underlined, not colour-only

Security

• Rate-limit sign-in and code requests per email and IP
• Validate OAuth redirect targets against an allowlist
• Codes and magic links are single-use and expire in 10 minutes
• Use CSRF-safe, PKCE OAuth flows and httpOnly session cookies

Build prompt

The baseline every prompt in the catalog assumes, then this design’s own ten sections, from goal to guardrails.

Copy the baseline and build prompt

### How to use these prompts
Paste an entry's build prompt into your coding agent as the first message. Each prompt names its own stack, tokens and acceptance criteria; the rules below apply to all of them and can be prepended once per project.

### Engineering baseline
- TypeScript strict mode, no `any`, small typed components, feature folders, and one source of truth for design tokens (CSS variables consumed by Tailwind).
- Validate every input with a shared zod schema on the client and again on the server or edge function. Never trust client-side checks alone.
- Show loading, empty and error states for every async view. Surface errors in plain language with a retry, and log details to the console in development only.
- Keep secrets out of the bundle. Only publishable keys (for example a Supabase anon key) belong in client code; service-role keys, API keys and webhooks live in server or edge-function environment variables.

### Data and auth baseline (full-stack entries)
- Enable Row Level Security on every table before inserting data. Default-deny, then add owner-scoped policies (`auth.uid() = user_id`) and explicit role checks for admin views.
- Store roles in a separate table checked by a security-definer function, never in a user-editable profile field.
- Upload files to private storage buckets with size and MIME limits, and serve them through signed URLs.
- Rate-limit public endpoints (forms, auth, AI calls) and add a honeypot field or captcha to anonymous forms.
- Take payments through a hosted checkout and verify webhooks by signature. Never handle raw card data.

### Accessibility and UX baseline
- Target WCAG 2.2 AA: 4.5:1 contrast for normal text and 3:1 for large text, input borders, focus rings and meaningful icons or chart lines. Every palette in this catalog lists its verified pairs; re-check with a contrast tool after any colour change.
- Keep body text at 16px or larger with 1.5 line height, nothing below 12px, no light weights under 24px, and uppercase only for short labels.
- Give every interactive element a visible focus ring, full keyboard support, semantic landmarks, labelled form fields, and alt text on meaningful images.
- Respect `prefers-reduced-motion` for every animation. Give drag-and-drop and carousels keyboard and button alternatives.
- Build mobile-first and test at 375px, 768px and 1280px.

### Content guardrails
- Use original copy, fictional sample data and placeholder or licensed imagery. Do not reuse another product's name, logo, screenshots or marketing text.
- Label demo testimonials and metrics as samples. Collect the minimum personal data the feature needs.

### SaaS screen baseline
- Design every screen for its full set of states: first-run empty, loading skeleton, partial data, error with retry, permission-denied, and success feedback. Each entry lists the states its screen needs.
- Keep destructive actions (delete, revoke, downgrade, remove member) behind a confirmation that names the object, and prefer undo over a second dialog where the action is reversible.
- Enforce authorisation on the server for every action a screen exposes. Hiding a button is not access control; check the role again in the API or RLS policy.
- Never show secrets (API keys, tokens) in full after creation. Show them once, then mask them, and offer rotate and revoke.
- Keep the app shell (navigation, workspace switcher, account menu) consistent across screens, and preserve filters, sort and scroll position when the user navigates back.

### Goal
Build **Rhombra**, a dark sign-in page for a developer tool: black canvas with soft light beams, two provider buttons, an email magic-link option and consent text. Build sign-in, sign-up and the link-sent state.

### Stack
React 18 + TypeScript + Vite, Tailwind CSS, shadcn/ui on Radix primitives and lucide-react icons. TanStack Query for server state, react-hook-form + zod for every form, date-fns for relative times. Supabase for Auth, Postgres with row-level security and Edge Functions for anything that needs a secret. Supabase Auth for OAuth and magic links.

### Pages & layout
1. **/sign-in**: top bar; heading and create-account line; two provider buttons; divider 'or continue with email'; email field; 'Sign in with email' button; consent.
2. **/sign-up**: same with 'Create account'.
3. **Link sent** panel and **/auth/callback** errors.

### Design system
- Colors: `--bg: #050505` (page), `--surface: #161616` (provider buttons and input), `--text: #f2f2f2` (primary text), `--muted: #9a9a9a` (secondary text), `--border: #6b6b6b` (button and input borders), `--submit: #8a8a8a` (email submit fill), `--submit-text: #0a0a0a` (submit label), `--focus: #e6e6e6` (focus ring), `--beam: #2a2a2a` (decorative beams).
- Fonts: Inter 300, 28px 'Sign in' heading (light weight only at this size) for headings; Inter 400, 16px, line-height 1.5 for body. Buttons 15px 600; consent 13px with underlined links; nothing below 12px.
- Spacing: Airy. 8px; 12px between stacked buttons. Container: column 380px max.
- Radius: 6px buttons and inputs.
- Shadows: None; borders define controls.
- Motion: Beams drift slowly (20s loop) and stop under reduced motion; buttons brighten border on hover.

### Components & interactions
ProviderButton: full-width #161616 button with a 1px border and a white glyph plus label. SubmitButton: muted grey fill with near-black label to keep the email path secondary.

- Provider buttons start OAuth
- Email submit sends a magic link and swaps the form for a 'Check your inbox' panel
- Documentation opens docs in a new tab
- Enter submits

### Data & state
Supabase Auth; after first sign-in create a default workspace via a database trigger.

Entities: `User{id, email}`; `Identity{user_id, provider (code-host|oauth-a|email)}`; `Workspace{id, owner_id, name}`.

States to build and show in a dev-only state switcher:
- default
- invalid email
- sending
- link sent with resend timer
- link expired on callback
- OAuth error
- rate-limited

### Accessibility
- Light 300 weight only for the 28px heading
- All text on black ≥4.5:1; placeholders too
- Focus ring light grey 2px with offset
- Beams aria-hidden and paused under reduced motion
- Consent links underlined, not colour-only
Verified contrast: body text: #f2f2f2 on #050505 = 18.21:1; muted text: #9a9a9a on #050505 = 7.24:1; text on surface: #f2f2f2 on #161616 = 16.16:1; submit label: #0a0a0a on #8a8a8a = 5.73:1; input border: #6b6b6b on #050505 = 3.82:1; focus ring: #e6e6e6 on #050505 = 16.33:1; muted on surface (placeholder): #9a9a9a on #161616 = 6.43:1.

### Security
- Rate-limit sign-in and code requests per email and IP
- Validate OAuth redirect targets against an allowlist
- Codes and magic links are single-use and expire in 10 minutes
- Use CSRF-safe, PKCE OAuth flows and httpOnly session cookies
RLS: `workspaces` select/update where owner_id = auth.uid(); no client access to auth logs.

### Performance & SEO
Beams are pure CSS gradients (no images); under 50KB JS; title and description; indexable sign-in only.

### Guardrails
- Keep the create-account link beside the heading
- Show consent text right under the submit
- Make the email submit clearly a button despite muted tone
- Confirm link sent without revealing whether the account exists
- Keep the docs link available pre-login
- Write fresh, generic copy and invented sample data; no real brands, logos, product names or people.
- Keep components small and typed (no `any`); surface every error visibly with a way to recover.

Acceptance criteria:
- Both providers and magic link work
- All contrast pairs pass on black
- Reduced motion stops beams
- Link-sent state doesn't leak account existence
- Workspace created on first login

Open the builderAll templatesThis palette on its own