Yewbranch

A mock-up of the screen, drawn from its layout, palette and typefaces. A build follows the full prompt below.

Start from this screenRead the build prompt

Typefaces

The catalog's own faces. A screen composed into a template is drawn in that template's typefaces.

• Source Sans 3Headings: Source Sans 3 600, 17px section headings; callout title 16px 600
• Source Sans 3Body: Source Sans 3 400 16px / 1.5

Patterns

• getting-started popover anchored under project header
• dismissible info callout
• protocol toggle (HTTPS/SSH)
• terminal code blocks with copy buttons
• install-method tabs
• section dividers with small headings
• status pill in project header

States it is designed for

• Project building: status pill 'Building' with spinner; popover still usable
• Build failed: red status pill and link to logs
• User without write access: Git section explains fork/duplicate instead of push
• Clipboard blocked: select-all fallback
• Popover dismissed: not shown again for this project

Who it is for

• developers publishing demos
• ML researchers sharing a static page
• students new to Git

Layout

1. Project header: small product mark, owner / project breadcrumb with copy icon, like button with count, green 'Running' status pill; right: tabs (App, Files, Community, Settings), overflow menu, avatar
2. Page body: the default static page preview card (partially covered)
3. Popover (420px, anchored top-left, radius 12px, shadow): tinted callout with emoji-free rocket icon, title and help text with docs link, close button
4. Section 'Using Git': HTTPS/SSH pill toggle and a hint about using an access token; comment + command code block with copy
5. Install tabs (script, package manager, two Python runners); code blocks for install and download
6. 'Modify locally, then commit and push' paragraph with code block
7. Section 'Using the web UI': quote-style line linking to edit the index file
8. Below 640px the popover becomes a bottom sheet at full width

Palette

Friendly-technical, like a helpful README that pops open exactly where you need it.

• canvas#ffffff
• surface#ffffff
• code-bg#f6f7f9
• text#1f2328
• muted#646b75
• comment#6b7280
• callout-bg#eef0ff
• callout-text#3b36c9
• status-text#1a7a42
• status-bg#ecfaf1
• border#e4e6ea
• focus#3b5bdb

Every checked pair, measured again

As vibld’s tokens

The palette on the fifteen colour tokens vibld styles a project with, each text colour on the fill it is read on. Marked tokens are solved from the palette, because no swatch held that role at 4.5:1.

• background
• card
• muted
• primary
• secondary
• accent
• destructive *

Type scale

Display

Source Sans 3 600, 17px section headings; callout title 16px 600

Body

Source Sans 3 400 16px / 1.5

Code in JetBrains Mono 14px / 1.6; comments italic in muted grey. Similar to the observed humanist sans and monospace pairing.

Spacing and imagery

Medium density; 4px base; popover padding 16px; code blocks 12px padding, 8px radius; pills 6px radius; popover radius 12px, shadow 0 12px 32px rgba(15,23,42,.14).

No imagery; tiny coloured icons in tabs; code blocks are the visual texture.

Components

• ProjectHeader with breadcrumb, copy, like, StatusPill
• ProjectTabs
• GettingStartedPopover
• InfoCallout (dismiss)
• ProtocolToggle
• CodeBlock with copy and comment lines
• InstallTabs
• WebEditLink
• Toast

Interactions

• Protocol toggle rewrites the clone URL in place
• Install tabs swap the install command; choice remembered
• Copy buttons copy only the command lines (not comments) and show a check for 2s
• Close hides the popover; a 'Setup guide' link in the overflow menu brings it back
• Long lines scroll horizontally inside code blocks, never wrap mid-token

Data

• Project{id, owner, name, sdk (static|app), visibility (public|private), status (building|running|failed), likes}
• SetupPrefs{user_id, protocol (https|ssh), installer (script|package|py_a|py_b), dismissed_projects[]}

Guardrails

Experience

• Put the two paths (Git or web editor) in that order with clear headings
• Show real, copyable commands with the user's owner/project already filled in
• Mention the token requirement right beside the clone command
• Copy should exclude comment lines so pasted commands run cleanly
• Keep the popover dismissible and recoverable

Accessibility

• Popover is a non-modal dialog with a labelled heading and a close button; Escape closes and focus returns to the trigger
• Code blocks are focusable regions with aria-label naming the command's purpose
• Protocol toggle and install tabs use ARIA tabs/radiogroup with arrow keys
• Comment text in code meets 4.5:1 on the code background
• Links inside prose are underlined

Security

• Never embed a token in displayed commands; tell users to paste one when prompted
• RLS: projects writable only by owners/collaborators; setup_prefs owner-only
• Escape owner and project names when interpolating into commands
• Rate-limit project creation

Build prompt

The baseline every prompt in the catalog assumes, then this design’s own ten sections, from goal to guardrails.

Copy the baseline and build prompt

### How to use these prompts
Paste an entry's build prompt into your coding agent as the first message. Each prompt names its own stack, tokens and acceptance criteria; the rules below apply to all of them and can be prepended once per project.

### Engineering baseline
- TypeScript strict mode, no `any`, small typed components, feature folders, and one source of truth for design tokens (CSS variables consumed by Tailwind).
- Validate every input with a shared zod schema on the client and again on the server or edge function. Never trust client-side checks alone.
- Show loading, empty and error states for every async view. Surface errors in plain language with a retry, and log details to the console in development only.
- Keep secrets out of the bundle. Only publishable keys (for example a Supabase anon key) belong in client code; service-role keys, API keys and webhooks live in server or edge-function environment variables.

### Data and auth baseline (full-stack entries)
- Enable Row Level Security on every table before inserting data. Default-deny, then add owner-scoped policies (`auth.uid() = user_id`) and explicit role checks for admin views.
- Store roles in a separate table checked by a security-definer function, never in a user-editable profile field.
- Upload files to private storage buckets with size and MIME limits, and serve them through signed URLs.
- Rate-limit public endpoints (forms, auth, AI calls) and add a honeypot field or captcha to anonymous forms.
- Take payments through a hosted checkout and verify webhooks by signature. Never handle raw card data.

### Accessibility and UX baseline
- Target WCAG 2.2 AA: 4.5:1 contrast for normal text and 3:1 for large text, input borders, focus rings and meaningful icons or chart lines. Every palette in this catalog lists its verified pairs; re-check with a contrast tool after any colour change.
- Keep body text at 16px or larger with 1.5 line height, nothing below 12px, no light weights under 24px, and uppercase only for short labels.
- Give every interactive element a visible focus ring, full keyboard support, semantic landmarks, labelled form fields, and alt text on meaningful images.
- Respect `prefers-reduced-motion` for every animation. Give drag-and-drop and carousels keyboard and button alternatives.
- Build mobile-first and test at 375px, 768px and 1280px.

### Content guardrails
- Use original copy, fictional sample data and placeholder or licensed imagery. Do not reuse another product's name, logo, screenshots or marketing text.
- Label demo testimonials and metrics as samples. Collect the minimum personal data the feature needs.

### SaaS screen baseline
- Design every screen for its full set of states: first-run empty, loading skeleton, partial data, error with retry, permission-denied, and success feedback. Each entry lists the states its screen needs.
- Keep destructive actions (delete, revoke, downgrade, remove member) behind a confirmation that names the object, and prefer undo over a second dialog where the action is reversible.
- Enforce authorisation on the server for every action a screen exposes. Hiding a button is not access control; check the role again in the API or RLS policy.
- Never show secrets (API keys, tokens) in full after creation. Show them once, then mask them, and offer rotate and revoke.
- Keep the app shell (navigation, workspace switcher, account menu) consistent across screens, and preserve filters, sort and scroll position when the user navigates back.

### Goal
Build **Yewbranch**, the getting-started popover that appears after a user creates a new static web project on a code hosting hub. It explains two ways to change the site: clone-edit-push with Git and the CLI, or edit the index file in the browser.

### Stack
React 18 + TypeScript + Vite, Tailwind CSS, shadcn/ui (Radix Popover, Tabs, ToggleGroup), lucide-react, TanStack Query, zod. Supabase Auth + Postgres for projects and per-user setup preferences.

### Pages & layout
1. **Project header**: product mark, `owner / project` breadcrumb with copy icon, like button + count, status pill; tabs App / Files / Community / Settings, overflow menu, avatar.
2. **App tab body**: static preview card saying the project is live and editable.
3. **Popover** anchored under the header (420px): callout with rocket icon, title 'Your new static project is ready', help line with docs link, close; 'Using Git' section (HTTPS/SSH toggle, token hint, clone code block); install tabs (Script, Package manager, Python runner A, Python runner B) with code block; download block; 'Modify locally, then commit and push' block; 'Using the web UI' line.
4. Under 640px the popover becomes a bottom sheet.

### Design system
- Colors: `--canvas: #ffffff`, `--surface: #ffffff`, `--code-bg: #f6f7f9`, `--text: #1f2328`, `--muted: #646b75`, `--comment: #6b7280`, `--callout-bg: #eef0ff`, `--callout-text: #3b36c9`, `--status-text: #1a7a42`, `--status-bg: #ecfaf1`, `--border: #e4e6ea`, `--focus: #3b5bdb`.
- Fonts: Source Sans 3 400/600, 16px/1.5; JetBrains Mono 14px/1.6 for code.
- Spacing: 4px scale; 16px popover padding; 12px between blocks; section headings with a hairline rule to the right.
- Radius: 12px popover, 8px code blocks, 6px pills/tabs.
- Shadows: popover 0 12px 32px rgba(15,23,42,.14).
- Motion: popover scales from 98% and fades 150ms; copy icon swaps to check 150ms.

### Components & interactions
ProjectHeader, StatusPill (building/running/failed), ProjectTabs, GettingStartedPopover, InfoCallout, ProtocolToggle, InstallTabs, CodeBlock (comment styling, copy commands only, horizontal scroll), WebEditLink, OverflowMenu item 'Setup guide'.

### Data & state
Tables `projects(id, owner, name, sdk, visibility, status, likes)`, `setup_prefs(user_id, protocol, installer, dismissed_projects uuid[])`. Commands are built by a pure function from owner, project, protocol and installer, unit-tested for escaping. Seed one freshly created static project in 'running' state and one in 'building'.

### Accessibility
Non-modal dialog semantics, labelled code regions, tabs with arrow keys, underlined links, readable comment colour, and focus returns to the trigger on close. Nothing is conveyed by the status pill colour alone.
Verified contrast: body text: #1f2328 on #ffffff = 15.8:1; muted text: #646b75 on #ffffff = 5.38:1; code text on code bg: #1f2328 on #f6f7f9 = 14.74:1; code comment on code bg: #6b7280 on #f6f7f9 = 4.51:1; callout text: #3b36c9 on #eef0ff = 7.25:1; status pill text: #1a7a42 on #ecfaf1 = 4.99:1; focus ring: #3b5bdb on #ffffff = 5.67:1.

### Security
RLS on `projects` (owner/collaborator write, public read if visibility = public) and `setup_prefs` (owner-only). No tokens rendered in commands. Escape and validate owner/project slugs. Rate-limit creation.

### Performance & SEO
Popover code-split; commands computed synchronously. Public project pages can be indexed; settings and popover content are client-only.

### Guardrails
- Invented owner and project names; generic CLI name.
- Never show secrets in code blocks.
- Acceptance criteria: (1) toggles rewrite commands correctly; (2) copy excludes comments; (3) dismiss persists per project and can be reopened; (4) no-write-access users see fork guidance; (5) popover works at 390px as a sheet.

Open the builderAll templatesThis palette on its own