Yonder Code

A mock-up of the screen, drawn from its layout, palette and typefaces. A build follows the full prompt below.

Start from this screenRead the build prompt

Typefaces

The catalog's own faces. A screen composed into a template is drawn in that template's typefaces.

• InterHeadings: Inter 600, 18px card title
• InterBody: Inter 400 16px / 1.5; secondary lines 14px

Patterns

• six-box one-time code input
• editable email line with pencil icon
• resend countdown link
• dark full-width continue button
• auth card footer strip
• oversized pixel-grid brand illustration behind card

States it is designed for

• Empty
• Partially filled
• Submitting (button spinner, inputs disabled)
• Invalid code with error text and boxes outlined red
• Expired code: message with resend
• Too many attempts: locked for 10 minutes with countdown
• Resent: toast
• Success: redirect to welcome

Who it is for

• new sign-ups to an AI automation platform
• team admins creating accounts

Layout

1. Top-left logo mark and wordmark
2. Left two-thirds: large decorative pixel-grid illustration (green squares fading to light) on a faint dotted canvas
3. Right: auth card (360px, radius 14px) with title, instruction, email with edit icon, six code boxes, resend line with countdown, dark Continue button with arrow; bottom strip in grey with 'Secured by' text and an auth-provider mark
4. Mobile: illustration hidden (or reduced to a faint top band), card centred full width

Palette

Playful-precise: a bold pixel brand mark gives personality while the form stays minimal and serious.

• canvas#fbfbfb
• surface#ffffff
• footer-strip#f4f4f4
• text#171717
• muted#646464
• input-border#8a8a8a
• primary#2a2826
• on-primary#ffffff
• pixel-green#22a33a
• pixel-green-light#a8dfb0
• error#c53030
• focus#1f8a32

Every checked pair, measured again

As vibld’s tokens

The palette on the fifteen colour tokens vibld styles a project with, each text colour on the fill it is read on.

• background
• card
• muted
• primary
• secondary
• accent
• destructive

Type scale

Display

Inter 600, 18px card title

Body

Inter 400 16px / 1.5; secondary lines 14px

Code digits in JetBrains Mono 500 20px. Similar to the observed grotesk.

Spacing and imagery

Compact card on an expansive canvas; 4px base; card padding 24px; code boxes 44x48px with 8px gap; radius 14px card, 8px boxes and button; card shadow 0 10px 30px rgba(0,0,0,.08).

Generated pixel-grid artwork of an abstract asterisk-like mark built from small squares in a green gradient; purely decorative; no photos.

Components

• LogoMark
• PixelArtBackdrop
• AuthCard
• EmailWithEdit
• OtpInput (6 boxes)
• ResendCountdown
• ContinueButton
• SecuredByFooter

Interactions

• Typing auto-advances; Backspace moves back; pasting a 6-digit code fills all boxes
• Continue enables when 6 digits present; auto-submits on the sixth digit
• Pencil icon opens a small inline field to change the email and resend
• Resend link shows '(27)' countdown, becomes active at 0
• Wrong code shakes the boxes 200ms and shows error text

Data

• User{id, email, email_verified}
• OtpChallenge{id, user_id, code_hash, expires_at, attempts, consumed_at}

Guardrails

Experience

• Support paste and SMS/email autofill (autocomplete='one-time-code')
• Show the email with an edit affordance right under the instruction
• Countdown visible before resend is possible
• Error copy says what to do next, not just 'invalid'
• Illustration never overlaps or reduces contrast of the card

Accessibility

• Code input is one logical field: a group with a label, each box labelled 'Digit N of 6', or a single input visually split
• Errors linked via aria-describedby and announced
• Pixel art is aria-hidden
• Focus ring 2px #1f8a32 on boxes and buttons
• Countdown not announced every second; announce only when resend becomes available

Security

• Store only a hash of the code; expire after 10 minutes; single use
• Limit attempts (5) then lock; rate-limit resends per user and IP
• Constant-time comparison on the server
• Changing email re-validates format and ownership before sending

Build prompt

The baseline every prompt in the catalog assumes, then this design’s own ten sections, from goal to guardrails.

Copy the baseline and build prompt

### How to use these prompts
Paste an entry's build prompt into your coding agent as the first message. Each prompt names its own stack, tokens and acceptance criteria; the rules below apply to all of them and can be prepended once per project.

### Engineering baseline
- TypeScript strict mode, no `any`, small typed components, feature folders, and one source of truth for design tokens (CSS variables consumed by Tailwind).
- Validate every input with a shared zod schema on the client and again on the server or edge function. Never trust client-side checks alone.
- Show loading, empty and error states for every async view. Surface errors in plain language with a retry, and log details to the console in development only.
- Keep secrets out of the bundle. Only publishable keys (for example a Supabase anon key) belong in client code; service-role keys, API keys and webhooks live in server or edge-function environment variables.

### Data and auth baseline (full-stack entries)
- Enable Row Level Security on every table before inserting data. Default-deny, then add owner-scoped policies (`auth.uid() = user_id`) and explicit role checks for admin views.
- Store roles in a separate table checked by a security-definer function, never in a user-editable profile field.
- Upload files to private storage buckets with size and MIME limits, and serve them through signed URLs.
- Rate-limit public endpoints (forms, auth, AI calls) and add a honeypot field or captcha to anonymous forms.
- Take payments through a hosted checkout and verify webhooks by signature. Never handle raw card data.

### Accessibility and UX baseline
- Target WCAG 2.2 AA: 4.5:1 contrast for normal text and 3:1 for large text, input borders, focus rings and meaningful icons or chart lines. Every palette in this catalog lists its verified pairs; re-check with a contrast tool after any colour change.
- Keep body text at 16px or larger with 1.5 line height, nothing below 12px, no light weights under 24px, and uppercase only for short labels.
- Give every interactive element a visible focus ring, full keyboard support, semantic landmarks, labelled form fields, and alt text on meaningful images.
- Respect `prefers-reduced-motion` for every animation. Give drag-and-drop and carousels keyboard and button alternatives.
- Build mobile-first and test at 375px, 768px and 1280px.

### Content guardrails
- Use original copy, fictional sample data and placeholder or licensed imagery. Do not reuse another product's name, logo, screenshots or marketing text.
- Label demo testimonials and metrics as samples. Collect the minimum personal data the feature needs.

### SaaS screen baseline
- Design every screen for its full set of states: first-run empty, loading skeleton, partial data, error with retry, permission-denied, and success feedback. Each entry lists the states its screen needs.
- Keep destructive actions (delete, revoke, downgrade, remove member) behind a confirmation that names the object, and prefer undo over a second dialog where the action is reversible.
- Enforce authorisation on the server for every action a screen exposes. Hiding a button is not access control; check the role again in the API or RLS policy.
- Never show secrets (API keys, tokens) in full after creation. Show them once, then mask them, and offer rotate and revoke.
- Keep the app shell (navigation, workspace switcher, account menu) consistent across screens, and preserve filters, sort and scroll position when the user navigates back.

### Goal
Build **Yonder Code**, the email verification step of an AI automation platform: a six-digit code card beside a large decorative pixel-grid rendering of the brand mark.

### Stack
React 18 + TypeScript + Vite, Tailwind CSS, shadcn/ui (InputOTP pattern), lucide-react, react-hook-form + zod. Supabase Auth OTP email verification.

### Pages & layout
1. **Canvas**: #fbfbfb with a faint 8px dot grid; logo top-left.
2. **Backdrop art**: left two-thirds, an abstract multi-armed mark made of small green squares (SVG generated in code), fading to light at the edges.
3. **Auth card** (right, vertically centred, 360px): title 'Verify your email', instruction line, email with pencil button, six code boxes, 'Didn't get a code? Resend (27)', dark 'Continue' button with small arrow, grey bottom strip 'Secured by your auth provider'.
4. Mobile: art hidden, card centred.

### Design system
- Colors: `--canvas: #fbfbfb`, `--surface: #ffffff`, `--footer-strip: #f4f4f4`, `--text: #171717`, `--muted: #646464`, `--input-border: #8a8a8a`, `--primary: #2a2826`, `--on-primary: #ffffff`, `--pixel-green: #22a33a`, `--pixel-green-light: #a8dfb0`, `--error: #c53030`, `--focus: #1f8a32`.
- Fonts: Inter 400/600; body 16px/1.5; title 18px; JetBrains Mono 500 20px digits.
- Spacing: 4px base; card padding 24px; box gap 8px.
- Radius: 14px card, 8px boxes/button.
- Shadows: card 0 10px 30px rgba(0,0,0,.08).
- Motion: error shake 200ms; digit fill pop 100ms; reduced motion replaces shake with outline only.

### Components & interactions
OtpInput (auto-advance, paste, backspace, autocomplete one-time-code), EmailWithEdit (inline change + resend), ResendCountdown, ContinueButton (disabled until complete, busy), ErrorText, LockoutNotice, SecuredByFooter, PixelArtBackdrop (generated, aria-hidden).
The OTP input should be a single hidden input with six visual slots (the pattern avoids screen readers reading six separate fields) and must handle: paste of codes with spaces or dashes (strip them), typing a non-digit (ignore, gentle shake), arrow keys between slots, and Home/End. The pencil-edit flow replaces the email line with an inline field plus Save/Cancel; saving sends a new code and restarts the countdown. The footer strip keeps a neutral 'Secured by your auth provider' line with a small lock icon; do not add a third-party logo.

### Data & state
Auth user plus `otp_challenges(id, user_id, code_hash, expires_at, attempts, consumed_at)` managed only by Edge Functions. Form state in react-hook-form with zod schema `^[0-9]{6}$`. Mock mode accepts 123456.
Form state: `code` (string), `status` ('idle' | 'submitting' | 'error' | 'locked'), `resendAt` (timestamp). The countdown derives from `resendAt` so refreshes stay honest. Server returns typed error codes (`invalid`, `expired`, `locked`) which map to copy in one table.

### Accessibility
Grouped, labelled code input with error association; announced errors; decorative art hidden; strong focus rings; countdown announced only at completion; card text never sits on the artwork.
Verified contrast: body text: #171717 on #ffffff = 17.93:1; muted instruction: #646464 on #ffffff = 5.92:1; footer strip text: #646464 on #f4f4f4 = 5.38:1; button label: #ffffff on #2a2826 = 14.69:1; code box border: #8a8a8a on #ffffff = 3.45:1; error text: #c53030 on #ffffff = 5.47:1; focus ring: #1f8a32 on #ffffff = 4.43:1.

### Security
Hash codes, 10-minute expiry, single use, 5 attempts then lockout, resend rate limits, constant-time comparison, RLS: no client access to `otp_challenges`.

### Performance & SEO
Generate the pixel art as a lightweight inline SVG or canvas once; no large images. Auth routes noindex.

### Guardrails
- Original abstract pixel mark; no real logos.
- Never reveal the correct code or whether an email exists.
- Acceptance criteria: (1) paste fills all boxes; (2) wrong/expired/locked states render; (3) resend countdown enforced server-side; (4) email edit resends; (5) keyboard and screen reader complete the flow.

Open the builderAll templatesThis palette on its own