@polymorphism-tech/morph-spec 4.17.0 → 4.18.0

package/CLAUDE.md

@@ -99,6 +99,42 @@ State lives in `.morph/state.json` in target projects. Phase and outputs are **d
 - **Template helpers** — Handlebars v2.0 helpers: pascalCase, camelCase, snakeCase, kebabCase, pluralize, plus comparison/logic helpers
 - **CLI structure** — Commands are thin wrappers that delegate to `src/core/` or `src/lib/` modules. Keep business logic out of command files.
 
+## Framework Development Guardrails
+
+When modifying framework components, always verify the full scope of related files. A PostToolUse hook (`.claude/hooks/post-tool-use/framework-consistency-guard.js`) will remind you, but you should also proactively check.
+
+### Dependency Matrix
+
+| When you modify... | Also verify... |
+|---------------------|----------------|
+| `framework/agents.json` | squad-templates/*.json, agents-installer.js (tier defaults), advance-phase.js (hardcoded agent lists), doctor.js (REQUIRED_AGENTS), agents-manager.js (validation rules), total_agents/tier counts |
+| `framework/standards/**` | STANDARDS.json (entry exists), agents.json (agents reference the standard), .md file exists at declared path |
+| `framework/hooks/claude-code/**` | hooks-installer.js (MORPH_HOOKS array + MORPH_PERMISSIONS), hook follows fail-open pattern |
+| `framework/skills/**` | phases.json (requiredSkills if phase-bound), skills-installer.js, SKILL.md frontmatter |
+| `framework/phases.json` | advance-phase.js, dispatch-agents.js, output-schema.js (phase mappings) |
+| `framework/templates/**` | REGISTRY.json (template registered) |
+| `src/core/paths/output-schema.js` | Run `npm run generate` to update phase-utils.js and skill markdown blocks |
+
+### Per-Domain Checklists
+
+**Agents** — required fields: tier, title, group, active_phases, reports_to, domains, keywords, validators, standards. If tier 3+: teammate.spawn_prompt. If stack-specific: stacks[]. Update total_agents/tier counts.
+
+**Standards** — STANDARDS.json entry needs: id, name, path, category, subcategory, tags, digest. At least one agent must reference it. If stack-specific: stacks[].
+
+**Hooks** — must be in MORPH_HOOKS array in hooks-installer.js. Must follow fail-open pattern. If needs permissions: add to MORPH_PERMISSIONS.
+
+**Skills** — SKILL.md with valid frontmatter. If phase-bound: in phases.json requiredSkills. If stack-specific: stacks[] frontmatter.
+
+**Phases** — index/folder consistent. requiredSkills reference existing dirs. advance-phase.js handles transitions.
+
+**Templates** — registered in REGISTRY.json. Uses only available Handlebars helpers.
+
+**Output Schema** — always run `npm run generate` after changes.
+
+### Test Coverage
+
+Every `src/**/*.js` file should have a corresponding `test/**/*.test.js`. The consistency hook will warn when a test file is missing.
+
 ## Framework vs Runtime Distinction
 
 - **This repo** (`morph-spec-framework/`) = the CLI tool source code

package/README.md

@@ -3,7 +3,7 @@
 > Spec-driven development framework for multi-stack projects. Turns feature requests into implementation-ready code through structured, AI-orchestrated phases.
 
 **Package:** `@polymorphism-tech/morph-spec`
-**Version:** 4.17.0  
+**Version:** 4.18.0  
 **Requires:** Node.js 18+, Claude Code
 
 ---
@@ -364,4 +364,4 @@ Code generated by morph-spec (contracts, templates, implementation output) belon
 
 ---
 
-*morph-spec v4.17.0 by [Polymorphism Tech](https://polymorphism.tech)*
+*morph-spec v4.18.0 by [Polymorphism Tech](https://polymorphism.tech)*

package/claude-plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "morph-spec",
-  "version": "4.17.0",
+  "version": "4.18.0",
   "displayName": "MORPH-SPEC Framework",
   "description": "Spec-driven development with 38 agents and 8-phase workflow for .NET/Blazor/Next.js/Azure",
   "publisher": "polymorphism-tech",

package/docs/CHEATSHEET.md

@@ -196,4 +196,4 @@ These files are never edited directly. Use CLI commands or `morph-spec update` i
 
 ---
 
-*morph-spec v4.17.0 by Polymorphism Tech*
+*morph-spec v4.18.0 by Polymorphism Tech*

package/docs/QUICKSTART.md

@@ -197,4 +197,4 @@ morph-spec doctor
 
 ---
 
-*morph-spec v4.17.0 by Polymorphism Tech*
+*morph-spec v4.18.0 by Polymorphism Tech*

package/framework/agents/backend/neon-expert.md

@@ -1,6 +1,6 @@
 ---
 name: neon-expert
-description: Neon PostgreSQL & AI Data specialist for connection pooling, RLS policies with Clerk JWT, EF Core migrations, pgvector embeddings, pgrag RAG pipelines, database branching, and scale-to-zero configuration. Use when designing database schemas, implementing Row Level Security, setting up vector search, or managing Neon branches.
+description: Neon PostgreSQL & AI Data specialist for connection pooling, RLS policies with Neon Auth JWT, EF Core migrations, pgvector embeddings, pgrag RAG pipelines, database branching, and scale-to-zero configuration. Use when designing database schemas, implementing Row Level Security, setting up vector search, or managing Neon branches.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep
 stacks:
   - neon
@@ -10,7 +10,7 @@ effort: medium
 
 # Neon PostgreSQL & AI Data Specialist
 
-Expert in Neon serverless Postgres: connection pooling, RLS with Clerk JWT, EF Core migrations, pgvector, pgrag, database branching, and scale-to-zero.
+Expert in Neon serverless Postgres: connection pooling, RLS with Neon Auth JWT, EF Core migrations, pgvector, pgrag, database branching, and scale-to-zero.
 
 > **Ref:** `framework/standards/infrastructure/neon/` — connection pooling, RLS, pgvector, pgrag standards
 
@@ -59,51 +59,33 @@ Transaction mode restricts: `SET`/`RESET`, `LISTEN`/`NOTIFY`, SQL-level prepared
 ALTER TABLE public.documents ENABLE ROW LEVEL SECURITY;
 ```
 
-### RLS with Clerk JWT (Neon Authorize)
+### RLS with Neon Auth JWT
 
-Neon provides `auth.user_id()` via the `pg_session_jwt` extension. It extracts the `sub` claim from the validated JWT automatically.
+Neon provides `auth.user_id()` via the `pg_session_jwt` extension. It extracts the `sub` claim from the validated JWT automatically. Neon Auth issues these JWTs — no external provider needed.
 
 ```sql
 -- User owns the row
 CREATE POLICY "Users can view own documents"
-  ON public.documents FOR SELECT
+  ON public.documents FOR SELECT TO authenticated
   USING (auth.user_id() = user_id);
 
 -- User can insert own rows
 CREATE POLICY "Users can insert own documents"
-  ON public.documents FOR INSERT
+  ON public.documents FOR INSERT TO authenticated
   WITH CHECK (auth.user_id() = user_id);
 
 -- User can update own rows
 CREATE POLICY "Users can update own documents"
-  ON public.documents FOR UPDATE
+  ON public.documents FOR UPDATE TO authenticated
   USING (auth.user_id() = user_id)
   WITH CHECK (auth.user_id() = user_id);
 
 -- User can delete own rows
 CREATE POLICY "Users can delete own documents"
-  ON public.documents FOR DELETE
+  ON public.documents FOR DELETE TO authenticated
   USING (auth.user_id() = user_id);
 ```
 
-### Manual JWT extraction (without Neon Authorize)
-
-```sql
--- Extract Clerk user ID from JWT claims manually
-CREATE OR REPLACE FUNCTION public.clerk_user_id()
-RETURNS TEXT AS $$
-  SELECT coalesce(
-    current_setting('request.jwt.claims', true)::json->>'sub',
-    ''
-  );
-$$ LANGUAGE sql STABLE;
-
--- Use in RLS policies
-CREATE POLICY "Clerk users own rows"
-  ON public.documents FOR ALL
-  USING (clerk_user_id = public.clerk_user_id());
-```
-
 ### Team-based access
 
 ```sql
@@ -381,7 +363,7 @@ builder.Services.AddDbContext<AppDbContext>(options =>
 - [ ] Pooled connection (`-pooler` endpoint) used for all application connections
 - [ ] Direct connection used only for migrations and schema changes
 - [ ] RLS enabled on ALL public tables
-- [ ] RLS policies use `auth.user_id()` (Neon Authorize) or manual `clerk_user_id()` function
+- [ ] RLS policies use `auth.user_id()` via `pg_session_jwt` extension
 - [ ] RLS policies cover SELECT, INSERT, UPDATE, DELETE
 - [ ] EF Core migrations use direct connection string
 - [ ] Indexes on all frequently filtered columns

package/framework/agents/integrations/neon-auth.md

@@ -0,0 +1,151 @@
+---
+name: neon-auth
+description: Neon Auth (Better Auth) specialist for authentication flows, session management, Next.js App Router integration, .NET JWT validation, and RLS policy integration. Use when integrating Neon Auth, implementing social login flows, managing user sessions, or protecting routes with Neon Auth middleware.
+allowed-tools: Read, Write, Edit, Bash, Glob, Grep
+stacks:
+  - neon
+color: teal
+effort: medium
+---
+
+# Neon Auth (Better Auth)
+
+Authentication with Neon Auth for Next.js and .NET. SDK: `@neondatabase/auth` (Next.js) / JWT Bearer validation (.NET).
+
+> **Ref:** `framework/standards/backend/integrations/neon-auth/neon-auth.md`
+
+## Setup (Next.js)
+
+```typescript
+// lib/auth/client.ts
+'use client';
+import { createAuthClient } from '@neondatabase/auth/next';
+export const authClient = createAuthClient();
+
+// lib/auth/server.ts
+import { createNeonAuth } from '@neondatabase/auth/next/server';
+export const auth = createNeonAuth({
+  baseUrl: process.env.NEON_AUTH_BASE_URL!,
+  cookies: { secret: process.env.NEON_AUTH_COOKIE_SECRET! },
+});
+
+// app/api/auth/[...path]/route.ts
+import { auth } from '@/lib/auth/server';
+export const { GET, POST } = auth.handler();
+```
+
+## Setup (.NET)
+
+```csharp
+// Program.cs
+builder.Services.AddAuthentication("NeonAuth")
+    .AddJwtBearer("NeonAuth", options =>
+    {
+        options.Authority = builder.Configuration["NeonAuth:BaseUrl"];
+        options.TokenValidationParameters = new()
+        {
+            ValidateIssuer = true,
+            ValidateAudience = false,
+            ValidateLifetime = true,
+            ValidateIssuerSigningKey = true,
+            NameClaimType = "sub"
+        };
+    });
+builder.Services.AddAuthorization();
+app.UseAuthentication();
+app.UseAuthorization();
+```
+
+## Protected Endpoints
+
+```csharp
+// Minimal API
+app.MapGet("/api/profile", (ClaimsPrincipal user) =>
+{
+    var userId = user.FindFirstValue("sub");
+    if (userId is null) return Results.Unauthorized();
+    return Results.Ok(new { UserId = userId });
+}).RequireAuthorization();
+
+// Controller: same pattern with [Authorize] + User.FindFirstValue("sub")
+```
+
+## Next.js Integration
+
+```tsx
+// middleware.ts
+import { auth } from '@/lib/auth/server';
+export default auth.middleware({ loginUrl: '/auth/sign-in' });
+export const config = { matcher: ['/((?!.*\\..*|_next|auth).*)', '/'] };
+
+// Protected page (server)
+import { auth } from '@/lib/auth/server';
+export const dynamic = 'force-dynamic';
+export default async function DashboardPage() {
+  const { data: session } = await auth.getSession();
+  if (!session?.user) redirect('/auth/sign-in');
+  return <Dashboard user={session.user} />;
+}
+
+// Client component
+'use client';
+import { useSession } from '@/lib/auth/client';
+const { data } = useSession();
+const user = data?.user;
+```
+
+## Auth Pages
+
+```tsx
+// Sign in / Sign up — single component
+import { AuthView } from '@neondatabase/auth/react';
+export default function SignInPage() {
+  return <AuthView pathname="sign-in" />;
+}
+```
+
+## OAuth
+
+```typescript
+await authClient.signIn.social({
+  provider: 'google',
+  callbackURL: '/auth/callback',
+});
+```
+
+## RLS Integration
+
+Neon Auth JWTs are validated by the Data API. Use `auth.user_id()` in RLS policies:
+
+```sql
+CREATE POLICY "Users own rows"
+  ON public.documents FOR ALL TO authenticated
+  USING (user_id = auth.user_id());
+```
+
+## Database Schema
+
+Auth data lives in `neon_auth` schema (managed automatically):
+- `neon_auth.user` — profiles
+- `neon_auth.session` — sessions
+- `neon_auth.account` — credentials
+
+Query directly — no webhook sync needed:
+```sql
+SELECT id, email, name FROM neon_auth.user WHERE id = auth.user_id();
+```
+
+## Checklist
+
+- [ ] `NEON_AUTH_BASE_URL` in environment variables
+- [ ] `NEON_AUTH_COOKIE_SECRET` (32+ chars) in environment variables
+- [ ] Auth API route at `app/api/auth/[...path]/route.ts`
+- [ ] `NeonAuthUIProvider` wrapping app in root layout
+- [ ] Middleware protecting private routes
+- [ ] `.NET` JWT Bearer configured with Neon Auth authority
+- [ ] RLS policies using `auth.user_id()`
+- [ ] `force-dynamic` on pages using `auth.getSession()`
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/framework/agents.json

@@ -162,7 +162,7 @@
         "role": "Backend Squad Leader",
         "icon": "⚙️",
         "triggers": ".NET/C# backend, VSA architecture, EF Core, API design, backend squad coordination",
-        "spawn_prompt": "You are the Backend Squad Leader. Coordinate backend specialists and own VSA architecture, API design, and .NET/C# standards.\n\nWorkflow:\n1. Read `.morph/state.json` and spec.md for backend requirements\n2. Produce VSA Blueprint: entity fields, operations (slices), routes, error types, validation rules\n3. Delegate to squad: ef-modeler, hangfire-orchestrator, ms-agent-expert, neon-expert, vector-search-expert, asaas-financial, clerk-auth, resend-email\n\nRefer to the Domain Knowledge section below for IHandler, Result<T>, Scrutor, IApiEndpoint patterns and code templates."
+        "spawn_prompt": "You are the Backend Squad Leader. Coordinate backend specialists and own VSA architecture, API design, and .NET/C# standards.\n\nWorkflow:\n1. Read `.morph/state.json` and spec.md for backend requirements\n2. Produce VSA Blueprint: entity fields, operations (slices), routes, error types, validation rules\n3. Delegate to squad: ef-modeler, hangfire-orchestrator, ms-agent-expert, neon-expert, vector-search-expert, asaas-financial, neon-auth, resend-email\n\nRefer to the Domain Knowledge section below for IHandler, Result<T>, Scrutor, IApiEndpoint patterns and code templates."
       }
     },
     "infra-architect": {
@@ -441,7 +441,7 @@
         "role": "Neon PostgreSQL & AI Data Specialist",
         "icon": "\uD83D\uDC18",
         "triggers": "database setup, pgvector, pgrag, vector search, embeddings, Neon branching, RAG pipeline, Semantic Kernel vector store, neonctl",
-        "spawn_prompt": "You are the Neon PostgreSQL & AI Data Specialist. Implement database schemas, RLS policies, pgvector embeddings, pgrag RAG pipelines, and manage Neon branches.\n\nWorkflow:\n1. Read spec.md for database, vector search, and RAG requirements\n2. Review architecture from dotnet-senior for entity and schema design\n3. ALWAYS use the pooled connection (-pooler endpoint) for application code — direct connections only for EF Core migrations\n4. Implement RLS policies using auth.user_id() (Neon Authorize) with Clerk JWT\n5. Set up pgvector with HNSW indexes and tune maintenance_work_mem before index creation\n6. For RAG pipelines, use pgrag extensions (rag, rag_bge_small_en_v15, rag_jina_reranker_v1_tiny_en) for chunking, embedding, search, and reranking entirely in SQL\n7. Create database branches for PR previews (--schema-only) and run schema-diff before merging\n8. Configure connection retry logic for scale-to-zero cold starts\n\nCRITICAL: Two connection strings — pooled for application, direct for migrations. Never use direct connections in application code.\n\nRefer to the Domain Knowledge section below for connection pooling, RLS patterns, pgvector setup, pgrag pipeline, branching strategy, and scale-to-zero configuration."
+        "spawn_prompt": "You are the Neon PostgreSQL & AI Data Specialist. Implement database schemas, RLS policies, pgvector embeddings, pgrag RAG pipelines, and manage Neon branches.\n\nWorkflow:\n1. Read spec.md for database, vector search, and RAG requirements\n2. Review architecture from dotnet-senior for entity and schema design\n3. ALWAYS use the pooled connection (-pooler endpoint) for application code — direct connections only for EF Core migrations\n4. Implement RLS policies using auth.user_id() via pg_session_jwt with Neon Auth JWT\n5. Set up pgvector with HNSW indexes and tune maintenance_work_mem before index creation\n6. For RAG pipelines, use pgrag extensions (rag, rag_bge_small_en_v15, rag_jina_reranker_v1_tiny_en) for chunking, embedding, search, and reranking entirely in SQL\n7. Create database branches for PR previews (--schema-only) and run schema-diff before merging\n8. Configure connection retry logic for scale-to-zero cold starts\n\nCRITICAL: Two connection strings — pooled for application, direct for migrations. Never use direct connections in application code.\n\nRefer to the Domain Knowledge section below for connection pooling, RLS patterns, pgvector setup, pgrag pipeline, branching strategy, and scale-to-zero configuration."
       }
     },
     "vector-search-expert": {
@@ -521,11 +521,11 @@
         "spawn_prompt": "You are the Payment Integration Specialist (Asaas/Brazil). Implement PIX, Boleto, Credit Card, and subscription billing.\n\nNever hardcode API keys. Follow contract-compliance patterns.\n\nRefer to the Domain Knowledge section below for Asaas SDK patterns, webhook handling, and payment flow examples."
       }
     },
-    "clerk-auth": {
+    "neon-auth": {
       "color": "teal",
       "tier": 3,
-      "title": "Auth SaaS Integration Specialist",
-      "stacks": ["clerk"],
+      "title": "Neon Auth Integration Specialist",
+      "stacks": ["neon"],
       "group": "backend",
       "active_phases": [
         "design",
@@ -536,21 +536,29 @@
         "integration-auth"
       ],
       "keywords": [
-        "clerk",
-        "clerk auth",
+        "neon auth",
+        "better auth",
+        "authentication",
         "add auth",
         "implement auth",
         "login",
         "signup",
-        "oauth"
+        "oauth",
+        "session management",
+        "neon_auth schema"
       ],
       "validators": [],
-      "standards": [],
+      "standards": [
+        {
+          "id": "neon-auth",
+          "scope": "neon"
+        }
+      ],
       "teammate": {
-        "role": "Auth SaaS Integration Specialist",
+        "role": "Neon Auth Integration Specialist",
         "icon": "🔐",
-        "triggers": "Clerk authentication, login/signup flows, OAuth, session management",
-        "spawn_prompt": "You are the Auth SaaS Integration Specialist (Clerk). Implement authentication flows and session management with Next.js App Router.\n\nRefer to the Domain Knowledge section below for Clerk SDK patterns, middleware configuration, and webhook handling."
+        "triggers": "Neon Auth, authentication, login/signup flows, OAuth, session management, Better Auth",
+        "spawn_prompt": "You are the Neon Auth Integration Specialist. Implement authentication flows using Neon Auth (Better Auth) with @neondatabase/auth SDK for Next.js and JWT Bearer validation for .NET.\n\nRefer to the Domain Knowledge section below for SDK setup, auth pages, middleware protection, RLS integration, and .NET JWT configuration."
       }
     },
     "resend-email": {
@@ -1101,7 +1109,7 @@
         "neon-expert",
         "vector-search-expert",
         "asaas-financial",
-        "clerk-auth",
+        "neon-auth",
         "resend-email"
       ],
       "domains": [

package/framework/rules/neon-auth-standards.md

@@ -0,0 +1,13 @@
+---
+paths:
+  - "**/Auth/**"
+  - "**/auth/**"
+  - "**/Identity/**"
+  - "**/neon-auth/**"
+stacks:
+  - neon
+---
+
+# Neon Auth Standards
+
+@.morph/framework/standards/backend/integrations/neon-auth/neon-auth.md

package/framework/rules/neon-standards.md

@@ -14,6 +14,7 @@ stacks:
 @.morph/framework/standards/infrastructure/neon/neon-pgvector.md
 @.morph/framework/standards/infrastructure/neon/neon-pgrag.md
 @.morph/framework/standards/infrastructure/neon/neon-semantic-kernel.md
+@.morph/framework/standards/backend/integrations/neon-auth/neon-auth.md
 
 ## SQL Templates
 

package/framework/skills/level-0-meta/morph-agent-teams/SKILL.md

@@ -67,7 +67,7 @@ allowed-tools: Read, Bash, Glob, Grep, Edit, Write, AskUserQuestion
    - Testing teammate (unit + integration)
 
 4. **Research & Standards Validation (Phases 0-3)**
-   - Investigate multiple integration options (Clerk vs Neon Auth vs custom)
+   - Investigate multiple integration options (Neon Auth vs custom JWT vs Passkeys)
    - Compare UI patterns (shadcn/ui component composition strategies)
    - Validate architecture patterns (CQRS vs simple Repository)
 
@@ -195,8 +195,8 @@ morph-spec state set scheduled-reports phase implement
 ```
 Create an agent team to decide on the authentication architecture.
 Spawn 3 debate teammates:
-- Pro-Clerk: Argue for Clerk.com (ease of use, modern UI, MFA built-in)
-- Pro-Neon-Auth: Argue for PostgreSQL RLS with Neon (integrated with existing DB, Row Level Security)
+- Pro-Neon-Auth: Argue for Neon Auth (database-native, no external deps, branch isolation, Better Auth)
+- Pro-NextAuth: Argue for NextAuth.js (flexible providers, community ecosystem, self-hosted)
 - Pro-Custom: Argue for custom JWT + Passkeys (full control, no vendor lock-in)
 
 Have them debate, challenge each other's assumptions, and document pros/cons.

package/framework/skills/level-0-meta/morph-frontend-review/SKILL.md

@@ -10,7 +10,7 @@ allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion,
   mcp__playwright__browser_navigate, mcp__playwright__browser_resize,
   mcp__playwright__browser_take_screenshot, mcp__playwright__browser_snapshot,
   mcp__playwright__browser_evaluate, mcp__playwright__browser_console_messages
-cliVersion: "4.8.19"
+cliVersion: "4.18.0"
 stacks:
   - nextjs
 ---

package/framework/skills/level-0-meta/morph-init/SKILL.md

@@ -101,7 +101,7 @@ Gather evidence to build a stack map. Run these in parallel:
 
 | Tool | Pattern | Signal |
 |------|---------|--------|
-| `Glob` | `**/package.json` | Detect next, neon, clerk, stripe in deps |
+| `Glob` | `**/package.json` | Detect next, neon, @neondatabase/auth, stripe in deps |
 | `Glob` | `**/*.csproj` | .NET projects at any depth |
 | `Glob` | `**/next.config.{js,ts,mjs}` | Next.js in any subdirectory |
 | `Glob` | `**/components.json` | shadcn/ui |
@@ -115,14 +115,14 @@ Gather evidence to build a stack map. Run these in parallel:
 | `Read` | `.env.example` | Env vars reveal integrations |
 | `Read` | `README.md` | Existing project description |
 | `Grep` | `@neondatabase/serverless` | Neon dep in any package.json |
-| `Grep` | `clerk\|auth0\|nextauth` | Auth provider |
+| `Grep` | `@neondatabase/auth\|auth0\|nextauth` | Auth provider |
 | `Grep` | `stripe\|asaas` | Payment provider |
 
 Read each found `package.json` for dependency names. Build an **evidence map**:
 
 ```
 stack:             [nextjs, dotnet, ...]
-integrations:      [neon, docker, clerk, ...]
+integrations:      [neon, docker, neon-auth, ...]
 uiLibrary:         shadcn | null
 monorepo:          true | false
 frontendPath:      src/frontend (if monorepo)
@@ -326,7 +326,7 @@ Read `.morph/config/config.json` and merge into `project`:
     "stack": "[stacks joined with +, e.g. nextjs+dotnet]",
     "architecture": "[monorepo | single-stack | detected pattern]",
     "uiLibrary": "[detected or null]",
-    "integrations": ["neon", "docker", "clerk"],
+    "integrations": ["neon", "docker", "neon-auth"],
     "frontendPath": "[path if monorepo, else omit]",
     "backendPath": "[path if monorepo, else omit]"
   }

package/framework/skills/level-1-workflows/morph-phase-codebase-analysis/SKILL.md

@@ -3,7 +3,7 @@ name: morph-phase-codebase-analysis
 description: MORPH-SPEC Design sub-phase that analyzes existing codebase and database schema, producing schema-analysis.md with real column names, types, relationships, and field mismatches. Use at the start of Design phase before generating contracts.cs to prevent incorrect field names or types.
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.17.0"
+cliVersion: "4.18.0"
 ---
 
 # MORPH Codebase Analysis - Design Sub-phase

package/framework/skills/level-1-workflows/morph-phase-design/SKILL.md

@@ -4,7 +4,7 @@ description: MORPH-SPEC Phase 2 (Design). Schema-first interactive design: reads
 argument-hint: "[feature-name]"
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Agent
-cliVersion: "4.17.0"
+cliVersion: "4.18.0"
 ---
 
 # MORPH Design — Phase 2

package/framework/skills/level-1-workflows/morph-phase-implement/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[feature-name]"
 context: fork
 agent: general-purpose
 user-invocable: false
-cliVersion: "4.17.0"
+cliVersion: "4.18.0"
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Agent
 ---
 

package/framework/skills/level-1-workflows/morph-phase-plan/SKILL.md

@@ -4,7 +4,7 @@ description: MORPH-SPEC Phase 3 (Plan). Generates a detailed implementation plan
 argument-hint: "[feature-name]"
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.17.0"
+cliVersion: "4.18.0"
 ---
 
 # MORPH Plan — Phase 3

package/framework/skills/level-1-workflows/morph-phase-tasks/SKILL.md

@@ -4,7 +4,7 @@ description: MORPH-SPEC Phase 4 (Tasks). Breaks approved spec into bottom-up ord
 argument-hint: "[feature-name]"
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.17.0"
+cliVersion: "4.18.0"
 ---
 
 # MORPH Tasks — Phase 4

package/framework/skills/level-1-workflows/morph-phase-uiux/SKILL.md

@@ -4,7 +4,7 @@ description: MORPH-SPEC Phase 2 (UI/UX). Creates design-system.md, mockups.md, c
 argument-hint: "[feature-name]"
 user-invocable: false
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.17.0"
+cliVersion: "4.18.0"
 ---
 
 # MORPH UI/UX Design - Phase 2

package/framework/skills/level-1-workflows/morph-scope-escalation/SKILL.md

@@ -4,7 +4,7 @@ description: Guided workflow for mid-implementation scope escalation — analyze
 user-invocable: true
 argument-hint: "[feature-name]"
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
-cliVersion: "4.17.0"
+cliVersion: "4.18.0"
 ---
 
 # Scope Escalation Workflow

package/framework/standards/STANDARDS.json

@@ -356,30 +356,34 @@
       ]
     },
     {
-      "id": "backend-integrations-clerk-clerk-auth",
-      "name": "clerk auth",
-      "path": "backend/integrations/clerk/clerk-auth.md",
+      "id": "backend-integrations-neon-auth-neon-auth",
+      "name": "neon auth",
+      "path": "backend/integrations/neon-auth/neon-auth.md",
       "category": "backend",
       "subcategory": "integrations",
       "tags": [
         "backend",
         "integrations",
-        "clerk"
+        "neon-auth",
+        "better-auth"
       ],
       "aliases": [
-        "clerk",
+        "neon auth",
+        "better auth",
         "authentication",
         "OAuth",
         "JWT",
         "session management"
       ],
       "anchors": {
-        "setup": "#clerk-setup",
-        "middleware": "#auth-middleware"
+        "setup": "#installation--setup",
+        "middleware": "#route-protection-middleware",
+        "dotnet": "#net-backend-integration",
+        "rls": "#row-level-security-integration"
       },
-      "digest": "Add ClerkMiddleware to ASP.NET pipeline. Access userId via User.GetClerkUserId(). Configure allowed redirect URLs in Clerk dashboard. Use [Authorize] for protected endpoints. Never store passwords — Clerk manages credentials. Sync Clerk users to local DB on first login.",
+      "digest": "Use @neondatabase/auth SDK for Next.js. Auth data lives in neon_auth schema — no external provider, no webhooks. Server: createNeonAuth() with NEON_AUTH_BASE_URL + NEON_AUTH_COOKIE_SECRET. Client: createAuthClient(). Pages: AuthView component. Protection: auth.middleware(). .NET: JWT Bearer with Neon Auth authority, NameClaimType=sub. RLS: auth.user_id() via pg_session_jwt.",
       "stacks": [
-        "dotnet"
+        "neon"
       ]
     },
     {

package/framework/standards/backend/database/postgresql/database.md

@@ -68,7 +68,7 @@ alter table public.profiles enable row level security;
 ```sql
 create policy "Users can view own profile"
   on public.profiles for select
-  using (auth.uid() = user_id);
+  using (auth.user_id() = user_id);
 ```
 
 #### User can update own profile
@@ -76,8 +76,8 @@ create policy "Users can view own profile"
 ```sql
 create policy "Users can update own profile"
   on public.profiles for update
-  using (auth.uid() = user_id)
-  with check (auth.uid() = user_id);
+  using (auth.user_id() = user_id)
+  with check (auth.user_id() = user_id);
 ```
 
 #### User can insert own profile
@@ -85,7 +85,7 @@ create policy "Users can update own profile"
 ```sql
 create policy "Users can insert own profile"
   on public.profiles for insert
-  with check (auth.uid() = user_id);
+  with check (auth.user_id() = user_id);
 ```
 
 #### Admin can do anything
@@ -96,7 +96,7 @@ create policy "Admins have full access"
   using (
     exists (
       select 1 from public.user_roles
-      where user_id = auth.uid() and role = 'admin'
+      where user_id = auth.user_id() and role = 'admin'
     )
   );
 ```