Rondavi

A mock-up of the screen, drawn from its layout, palette and typefaces. A build follows the full prompt below.

Start from this screenRead the build prompt

Typefaces

The catalog's own faces. A screen composed into a template is drawn in that template's typefaces.

• InterHeadings: Inter 500, 22px heading
• InterBody: Inter 400, 16px, line-height 1.5

Patterns

• centred mark, heading and tagline
• filled pill email input
• pill primary button
• side-by-side provider pills
• partial globe illustration cropped at the bottom edge
• register link

States it is designed for

• default (primary soft/disabled)
• valid
• sending
• link sent
• error
• rate-limited
• OAuth failure

Who it is for

• indie developers
• small business site owners

Layout

1. centred column ~240px (max 360px): round mark, heading, tagline
2. email pill input
3. primary pill button
4. two provider pills side by side
5. register line
6. decorative globe arc anchored bottom-centre, cropped by the viewport
7. on mobile the globe scales to 120% width and stays behind nothing interactive

Palette

Soft, approachable, simple; analytics without intimidation.

• bg#ffffff
• field#f3f3f5
• text#16161a
• muted#5f5f69
• primary#5b4fd9
• primary-soft#dcd8fb
• link#2f5fd6
• globe#ececef
• globe-label#6a6a74

Every checked pair, measured again

As vibld’s tokens

The palette on the fifteen colour tokens vibld styles a project with, each text colour on the fill it is read on. Marked tokens are solved from the palette, because no swatch held that role at 4.5:1.

• background
• card
• muted
• primary
• secondary
• accent
• destructive *

Type scale

Display

Inter 500, 22px heading

Body

Inter 400, 16px, line-height 1.5

Globe labels 12px 400 (decorative but still legible).

Spacing and imagery

Density: Airy. Grid: 8px; 12px between controls. Container: column 360px max. Radius: full pills for inputs and buttons; 10px on mobile. Shadows: none.

A light grey orthographic globe with a few invented-position country labels, drawn as SVG you create yourself.

Components

• Mark
• AuthHeading with tagline
• PillInput
• PrimaryPill
• ProviderPill ×2
• RegisterLink
• GlobeIllustration

Interactions

• Primary enables on valid email; Enter submits and sends a magic link
• Provider pills start OAuth
• Register switches to sign-up route

Data

• User{id, email}
• Site{id, owner_id, domain}
• Identity{user_id, provider}

Guardrails

Experience

• Keep the globe purely decorative and below the form
• Use a clear disabled-to-enabled transition for the primary
• Keep the tagline to one short line
• Provider pills equal width
• Register link always visible without scrolling on 667px-tall phones

Accessibility

• Globe SVG aria-hidden
• Pill input has a visible label (can be visually hidden but present) and autocomplete=email
• Disabled primary uses aria-disabled with a hint
• Focus rings visible on pill shapes
• Motion paused for reduced motion

Security

• Rate-limit sign-in and code requests per email and IP
• Validate OAuth redirect targets against an allowlist
• Codes and magic links are single-use and expire in 10 minutes
• Use CSRF-safe, PKCE OAuth flows and httpOnly session cookies

Build prompt

The baseline every prompt in the catalog assumes, then this design’s own ten sections, from goal to guardrails.

Copy the baseline and build prompt

### How to use these prompts
Paste an entry's build prompt into your coding agent as the first message. Each prompt names its own stack, tokens and acceptance criteria; the rules below apply to all of them and can be prepended once per project.

### Engineering baseline
- TypeScript strict mode, no `any`, small typed components, feature folders, and one source of truth for design tokens (CSS variables consumed by Tailwind).
- Validate every input with a shared zod schema on the client and again on the server or edge function. Never trust client-side checks alone.
- Show loading, empty and error states for every async view. Surface errors in plain language with a retry, and log details to the console in development only.
- Keep secrets out of the bundle. Only publishable keys (for example a Supabase anon key) belong in client code; service-role keys, API keys and webhooks live in server or edge-function environment variables.

### Data and auth baseline (full-stack entries)
- Enable Row Level Security on every table before inserting data. Default-deny, then add owner-scoped policies (`auth.uid() = user_id`) and explicit role checks for admin views.
- Store roles in a separate table checked by a security-definer function, never in a user-editable profile field.
- Upload files to private storage buckets with size and MIME limits, and serve them through signed URLs.
- Rate-limit public endpoints (forms, auth, AI calls) and add a honeypot field or captcha to anonymous forms.
- Take payments through a hosted checkout and verify webhooks by signature. Never handle raw card data.

### Accessibility and UX baseline
- Target WCAG 2.2 AA: 4.5:1 contrast for normal text and 3:1 for large text, input borders, focus rings and meaningful icons or chart lines. Every palette in this catalog lists its verified pairs; re-check with a contrast tool after any colour change.
- Keep body text at 16px or larger with 1.5 line height, nothing below 12px, no light weights under 24px, and uppercase only for short labels.
- Give every interactive element a visible focus ring, full keyboard support, semantic landmarks, labelled form fields, and alt text on meaningful images.
- Respect `prefers-reduced-motion` for every animation. Give drag-and-drop and carousels keyboard and button alternatives.
- Build mobile-first and test at 375px, 768px and 1280px.

### Content guardrails
- Use original copy, fictional sample data and placeholder or licensed imagery. Do not reuse another product's name, logo, screenshots or marketing text.
- Label demo testimonials and metrics as samples. Collect the minimum personal data the feature needs.

### SaaS screen baseline
- Design every screen for its full set of states: first-run empty, loading skeleton, partial data, error with retry, permission-denied, and success feedback. Each entry lists the states its screen needs.
- Keep destructive actions (delete, revoke, downgrade, remove member) behind a confirmation that names the object, and prefer undo over a second dialog where the action is reversible.
- Enforce authorisation on the server for every action a screen exposes. Hiding a button is not access control; check the role again in the API or RLS policy.
- Never show secrets (API keys, tokens) in full after creation. Show them once, then mask them, and offer rotate and revoke.
- Keep the app shell (navigation, workspace switcher, account menu) consistent across screens, and preserve filters, sort and scroll position when the user navigates back.

### Goal
Build **Rondavi**, the login page of a lightweight web analytics product: centred mark, heading and tagline, email pill, primary pill, two provider pills and a decorative globe at the bottom. Build sign-in, register and link-sent states.

### Stack
React 18 + TypeScript + Vite, Tailwind CSS, shadcn/ui on Radix primitives and lucide-react icons. TanStack Query for server state, react-hook-form + zod for every form, date-fns for relative times. Supabase for Auth, Postgres with row-level security and Edge Functions for anything that needs a secret. Supabase Auth for magic links and OAuth.

### Pages & layout
1. **/login**: mark, 'Log in to Rondavi', tagline, email input, 'Continue with email', two provider pills, register line, globe.
2. **/register**: same with 'Create your account'.
3. **Link sent** state.

### Design system
- Colors: `--bg: #ffffff` (page), `--field: #f3f3f5` (input and provider pills), `--text: #16161a` (primary text), `--muted: #5f5f69` (tagline and placeholder), `--primary: #5b4fd9` (primary button (enabled)), `--primary-soft: #dcd8fb` (disabled primary), `--link: #2f5fd6` (Register link), `--globe: #ececef` (globe fill), `--globe-label: #6a6a74` (country labels).
- Fonts: Inter 500, 22px heading for headings; Inter 400, 16px, line-height 1.5 for body. Globe labels 12px 400 (decorative but still legible).
- Spacing: Airy. 8px; 12px between controls. Container: column 360px max.
- Radius: full pills for inputs and buttons; 10px on mobile.
- Shadows: none.
- Motion: Globe rotates very slowly (60s) and stops under reduced motion; primary transitions from soft to solid when email is valid.

### Components & interactions
GlobeIllustration is an SVG circle with land shapes in light grey and 6-8 small labels; crop it by positioning it partly off-screen.

- Primary enables on valid email; Enter submits and sends a magic link
- Provider pills start OAuth
- Register switches to sign-up route

### Data & state
Supabase Auth; after sign-up redirect to an 'Add your first site' stub.

Entities: `User{id, email}`; `Site{id, owner_id, domain}`; `Identity{user_id, provider}`.

States to build and show in a dev-only state switcher:
- default (primary soft/disabled)
- valid
- sending
- link sent
- error
- rate-limited
- OAuth failure

### Accessibility
- Globe SVG aria-hidden
- Pill input has a visible label (can be visually hidden but present) and autocomplete=email
- Disabled primary uses aria-disabled with a hint
- Focus rings visible on pill shapes
- Motion paused for reduced motion
Verified contrast: body text: #16161a on #ffffff = 18.04:1; tagline: #5f5f69 on #ffffff = 6.31:1; placeholder in field: #5f5f69 on #f3f3f5 = 5.69:1; primary label (enabled): #ffffff on #5b4fd9 = 5.89:1; link: #2f5fd6 on #ffffff = 5.63:1; focus ring: #5b4fd9 on #ffffff = 5.89:1; globe labels: #6a6a74 on #ececef = 4.54:1.

### Security
- Rate-limit sign-in and code requests per email and IP
- Validate OAuth redirect targets against an allowlist
- Codes and magic links are single-use and expire in 10 minutes
- Use CSRF-safe, PKCE OAuth flows and httpOnly session cookies
RLS: `sites` select/insert/update/delete where owner_id = auth.uid().

### Performance & SEO
Inline the globe SVG (<15KB); no web fonts beyond Inter subset; title and description.

### Guardrails
- Keep the globe purely decorative and below the form
- Use a clear disabled-to-enabled transition for the primary
- Keep the tagline to one short line
- Provider pills equal width
- Register link always visible without scrolling on 667px-tall phones
- Write fresh, generic copy and invented sample data; no real brands, logos, product names or people.
- Keep components small and typed (no `any`); surface every error visibly with a way to recover.

Acceptance criteria:
- Magic link and both providers work
- Primary only enables for valid email
- Globe never overlaps controls
- Contrast passes
- Reduced motion honoured

Open the builderAll templatesThis palette on its own