@rebasepro/agent-skills 0.9.1-canary.fd3754b → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/agent-skills",
-  "version": "0.9.1-canary.fd3754b",
+  "version": "0.10.0",
   "private": false,
   "description": "Bundled AI agent skills for Rebase",
   "type": "module",

package/skills/rebase-admin/SKILL.md

@@ -745,6 +745,36 @@ Views participate in the same navigation group system as collections. Use the `g
 
 ---
 
+## 11. Where the Admin Lives — Mounting Under a URL Prefix
+
+In the default scaffold the frontend **is** the admin panel: `App.tsx` renders `<RebaseAuth>` + `<RebaseAdmin>` + `<RebaseShell>` at the root, so the deployed URL shows the admin directly. There is no separate admin URL — in production one server serves both the API (`/api/*`) and this SPA.
+
+When a project ships its **own product app** as the frontend, the admin is mounted under a prefix (commonly `/admin`) instead. Split the Vite entry by URL so each app is lazy-loaded and product visitors never download the admin bundle:
+
+```tsx
+// frontend/src/main.tsx
+const isAdmin = window.location.pathname.startsWith("/admin");
+const ProductApp = lazy(() => import("./App"));
+const AdminApp = lazy(() => import("./AdminApp"));
+
+if (isAdmin) {
+    // The admin uses useBlocker → needs a DATA router
+    const router = createBrowserRouter([{ path: "/admin/*", element: <AdminApp /> }]);
+    root.render(<RouterProvider router={router} />);
+} else {
+    root.render(<BrowserRouter><ProductApp /></BrowserRouter>);
+}
+```
+
+```tsx
+// frontend/src/AdminApp.tsx — tell the CMS about the prefix
+<RebaseAdmin collections={collections} basePath="/admin" />
+```
+
+> **IMPORTANT FOR AGENTS:** Choose **either** a router `basename="/admin"` **or** `<RebaseAdmin basePath="/admin">` — never both, or the prefix is applied twice. Without either, collection views hang on a spinner because URL⇄collection resolution never matches. `<RebaseAdmin>` requires a **data router** (`createBrowserRouter`) because it uses `useBlocker`.
+
+---
+
 ## Exported Components
 
 The admin package exports the following components (from `@rebasepro/admin`):

package/skills/rebase-api/SKILL.md

@@ -337,11 +337,17 @@ Authorization: Bearer rk_live_abc123...
 
 If an API key lacks the required permission for an operation, a `403 API_KEY_FORBIDDEN` error is returned.
 
-**Admin API keys** — set `"admin": true` when creating a key to grant it the `admin` role. This gives access to all `/api/admin/*` routes (schema, users, other API keys, etc.). Use this for agents, MCP servers, and CI pipelines:
+Beyond collections, the permission list also covers custom functions
+(`"functions"` for all, `"functions/<name>"` for one) and file storage
+(`"storage"`); the global `"*"` wildcard grants all three. API keys do NOT
+bypass RLS: admin keys pass via the built-in admin policies, while non-admin
+keys only see rows a security rule grants to the `service` role or the public.
+
+**Admin API keys** — set `"admin": true` when creating a key to grant it the `admin` role. This gives access to all `/api/admin/*` routes (schema, users, other API keys, etc.) plus cron, backups, and logs. Use this for agents, MCP servers, and CI pipelines:
 
 ```bash
-# CLI
-rebase api-keys create --name "My Agent" --admin
+# CLI (an explicit scope is required: --permissions '<json>' or --full-access)
+rebase api-keys create --name "My Agent" --admin --full-access
 
 # REST
 POST /api/admin/api-keys

package/skills/rebase-auth/SKILL.md

@@ -219,11 +219,48 @@ Twitter uses OAuth 2.0 with PKCE. The client must send `codeVerifier` alongside
 
 ### OAuth Account Linking
 
-When an OAuth user signs in:
-1. If an identity record exists for `(providerId, provider)` → log in that user.
-2. If no identity exists but a user with the same email exists → **link** the provider to the existing account.
+When an OAuth user signs in via `POST /api/auth/{provider}`:
+
+1. If an identity record exists for `(provider, providerId)` → log in that user. The email is not consulted.
+2. If no identity exists but a user with the same email exists:
+   - **The provider asserted `emailVerified: true`** → **link** the provider to the existing account and log in as that user. One account, two sign-in methods.
+   - **The provider did NOT verify the email** → reject with `403 EMAIL_NOT_VERIFIED`. Nothing is created or modified.
 3. If neither exists → create a new user, link the identity, assign `defaultRole`.
 
+> **IMPORTANT FOR AGENTS:** A second account is **never** silently created for
+> an email that already exists. If asked "does signing in with Google create a
+> duplicate user?", the answer is no — it either links (verified) or errors
+> (unverified). This is **not configurable**; there is deliberately no option to
+> auto-link on unverified emails, because that would let anyone who can make a
+> provider emit an address they don't own take over the matching account.
+> Google always asserts `email_verified` for real Google accounts, so linking
+> is the normal path for Google sign-in.
+
+### Linking a Provider to a Signed-In Account
+
+`POST /api/auth/link/{provider}` attaches a provider identity to the **already
+authenticated** account (requires `Authorization: Bearer <token>`). The body is
+the same payload the provider's sign-in route takes, e.g. `{ idToken }`.
+
+This is the escape hatch from an `EMAIL_NOT_VERIFIED` rejection, and the way to
+attach a provider whose email differs from the account's.
+
+Unlike sign-in, linking here does **not** require a verified email and does not
+require the emails to match — on sign-in the provider's email is the only
+evidence tying the identity to an account, whereas here the caller has already
+proven ownership by holding a valid session.
+
+- `409 IDENTITY_ALREADY_LINKED` if that provider identity belongs to another user.
+- Idempotent (`alreadyLinked: true`) if already linked to the caller.
+
+### Adding a Password to a Provider-Only Account
+
+A user who signed up via OAuth has no `passwordHash`:
+
+- `POST /auth/register` with the same email → `409 EMAIL_EXISTS`.
+- `POST /auth/change-password` → `400 INVALID_ACCOUNT` (no existing password to verify).
+- **`forgot-password` → `reset-password` is the supported path.** It re-proves ownership of the address by email, after which the account has both sign-in methods.
+
 ### Custom OAuth Provider
 
 You can register any OAuth provider by implementing the `OAuthProvider<T>` interface:
@@ -468,7 +505,7 @@ By default API keys get the `service` role (data access only). Set `"admin": tru
 
 ```bash
 # CLI — create an admin API key
-rebase api-keys create --name "My Agent" --admin
+rebase api-keys create --name "My Agent" --admin --full-access
 
 # REST
 curl -X POST http://localhost:3000/api/admin/api-keys \
@@ -624,7 +661,7 @@ rebase api-keys list
 rebase api-keys create --name "Read Only" --permissions '[{"collection":"orders","operations":["read"]}]'
 
 # Create an admin key (for agents / MCP / CI)
-rebase api-keys create --name "My Agent" --admin
+rebase api-keys create --name "My Agent" --admin --full-access
 
 # Revoke a key
 rebase api-keys revoke <key-id>
@@ -659,6 +696,7 @@ All auth endpoints are mounted under `/api/auth`. Admin endpoints are under `/ap
 | `PATCH` | `/auth/me` | Required | Update profile. Body: `{ displayName?, photoURL? }`. |
 | `POST` | `/auth/change-password` | Required | Change password. Body: `{ oldPassword, newPassword }`. Invalidates all sessions. |
 | `POST` | `/auth/send-verification` | Required | Send email verification link. Requires email service. |
+| `POST` | `/auth/link/{provider}` | Required | Link an OAuth provider to the current account. Body: the provider's sign-in payload (e.g. `{ idToken }`). `409 IDENTITY_ALREADY_LINKED` if it belongs to another user. |
 | `GET` | `/auth/sessions` | Required | List active sessions (refresh tokens). |
 | `DELETE` | `/auth/sessions` | Required | Revoke all sessions (remote logout). |
 | `DELETE` | `/auth/sessions/:id` | Required | Revoke a specific session. |

package/skills/rebase-backend-postgres/SKILL.md

@@ -95,7 +95,7 @@ const { db, pool, connectionString } = createPostgresDatabaseConnection(
 
 **Signature:**
 
-```typescript
+```typescript no-verify
 function createPostgresDatabaseConnection(
     connectionString: string,
     schema?: Record<string, unknown>,
@@ -120,7 +120,7 @@ const readResources = createReadReplicaConnection(
 
 **Signature:**
 
-```typescript
+```typescript no-verify
 function createReadReplicaConnection(
     connectionString: string,
     schema?: Record<string, unknown>,
@@ -145,7 +145,7 @@ const directResources = createDirectDatabaseConnection(
 
 **Signature:**
 
-```typescript
+```typescript no-verify
 function createDirectDatabaseConnection(
     connectionString: string,
     schema?: Record<string, unknown>,
@@ -327,12 +327,13 @@ The `initializeRebaseBackend()` coordinator calls bootstrapper methods in this o
 | `auth` | `RebaseAuthConfig \| AuthAdapter` | — | Authentication configuration or external adapter |
 | `storage` | `BackendStorageConfig \| StorageController \| Record<string, ...>` | — | File storage configuration |
 | `history` | `true \| { retention?: number }` | — | Enable entity audit trail. Pass `true` or `{ retention: 90 }` for TTL in days |
-| `defaultSecurityRules` | `SecurityRule[]` | — | Default RLS rules for collections without explicit rules |
 | `enableSwagger` | `boolean` | `true` | Enable OpenAPI/Swagger documentation |
 | `cronPersistence` | `boolean` | `true` | Persist cron execution logs to database |
 | `maxBodySize` | `number` | `10485760` (10MB) | Max request body size in bytes. `0` to disable |
 | `csrf` | `{ origin: string \| string[] \| (origin: string) => boolean }` | — | CSRF protection (opt-in, disabled by default) |
-| `hooks` | `BackendHooks` | — | Backend-level hooks for intercepting admin data |
+| `callbacks` | `CollectionCallbacks` | — | Global lifecycle callbacks applied to every collection, on every data path (REST, realtime, server-side `rebase.data`) |
+| `mode` | `"cms" \| "baas"` | `"cms"` | `baas` derives collections from the live database at boot instead of config files, and turns the schema editor off |
+| `baas` | `BaasOptions` | — | `baas` mode only: `{ unprotectedTables?: "exclude" \| "serve" }`. Default `"exclude"` — a table without RLS has no authorization model, so serving it would hand every row to every logged-in user. `"serve"` overrides, for trusted callers only |
 | `logging` | `{ level?: "error" \| "warn" \| "info" \| "debug" }` | — | Log level configuration |
 
 ### Auth Configuration (RebaseAuthConfig)
@@ -386,7 +387,8 @@ export const env = loadEnv();
 
 ```typescript
 import dotenv from "dotenv";
-import { loadEnv, z } from "@rebasepro/server";
+import { loadEnv } from "@rebasepro/server";
+import { z } from "zod";
 
 dotenv.config({ path: "../../.env" });
 
@@ -436,9 +438,9 @@ In non-production mode, `loadEnv()` **auto-generates** ephemeral `JWT_SECRET` an
 | `ALLOW_LOCALHOST_IN_PRODUCTION` | No | `false` | Allow localhost URLs in production env vars |
 | `CORS_ORIGINS` | No (⚠ required in prod) | — | Comma-separated allowed origins |
 | `FRONTEND_URL` | No | — | Frontend URL (used for CORS) |
-| `STORAGE_TYPE` | No | `local` | `local` or `s3` |
+| `STORAGE_TYPE` | No | `local` | `local`, `s3`, or `gcs` |
 | `STORAGE_PATH` | No | — | Path for local file storage |
-| `FORCE_LOCAL_STORAGE` | No | `false` | Suppress local storage warning in production |
+| `FORCE_LOCAL_STORAGE` | No | `false` | Allow local storage in production — **the backend refuses to boot without it** |
 | `S3_BUCKET` | No (if s3) | — | S3 bucket name |
 | `S3_REGION` | No | — | S3 region |
 | `S3_ACCESS_KEY_ID` | No (if s3) | — | S3 access key |

package/skills/rebase-basics/SKILL.md

@@ -168,12 +168,28 @@ A BaaS install is `server` + a driver + `client`, with no React in the tree.
 
 | Option | Alias | Description |
 |--------|-------|-------------|
+| `--flavor` | `-f` | `baas` or `cms`. Picks what you get — see below. Prompts when omitted |
+| `--template` | `-t` | Starter template to scaffold from |
 | `--git` | `-g` | Initialize a git repository |
 | `--install` | `-i` | Install dependencies with the detected PM |
 | `--database-url` | — | PostgreSQL connection string (skip prompt) |
 | `--introspect` | — | Auto-introspect the database after init |
 | `--yes` | `-y` | Non-interactive mode (use all defaults) |
 
+#### Flavors
+
+```bash
+rebase init my-api   --flavor baas   # backend/ alone — REST, auth, storage, realtime, backups. No config files, no UI, no React
+rebase init my-app   --flavor cms    # config/ + backend/ + frontend/ — BaaS plus the admin panel (default)
+```
+
+`baas` introspects the collections from the database at boot rather than reading
+config files, so there is nothing to declare and nothing to keep in sync. It
+serves only tables with `ENABLE ROW LEVEL SECURITY` — a table without RLS has no
+authorization model, so serving it would hand every row to every logged-in user.
+
+`dev`, `build` and `start` detect a missing `frontend/` and run backend-only.
+
 ```bash
 # Interactive mode
 rebase init my-app
@@ -392,7 +408,7 @@ When `extend` is provided, the base `rebaseEnvSchema` is merged (`.merge()`) wit
 | `DB_POOL_CONNECT_TIMEOUT` | `string` → `number` | `"10000"` | No | Pool connect timeout (ms) |
 | `STORAGE_TYPE` | `"local" \| "s3" \| "gcs"` | `"local"` | No | File storage backend type |
 | `STORAGE_PATH` | `string` | — | No | Local storage directory path |
-| `FORCE_LOCAL_STORAGE` | `"true" \| "false"` | — | No | Force local storage even in production |
+| `FORCE_LOCAL_STORAGE` | `"true" \| "false"` | — | No | Allow local storage in production — **the backend refuses to boot without it**, since the container filesystem loses uploads on restart |
 | `S3_BUCKET` | `string` | — | When S3 | S3 bucket name |
 | `S3_REGION` | `string` | — | When S3 | S3 region |
 | `S3_ACCESS_KEY_ID` | `string` | — | When S3 | S3 access key |
@@ -436,6 +452,7 @@ import { initializeRebaseBackend, RebaseBackendConfig } from "@rebasepro/server"
 |----------|------|---------|-------------|
 | `server` | `Server` (Node `http.Server`) | — | **Required.** The HTTP server instance |
 | `app` | `Hono<HonoEnv>` | — | **Required.** The Hono application instance |
+| `mode` | `"cms" \| "baas"` | `"cms"` | How much of Rebase to run. `cms` takes collections from `collections`/`collectionsDir`; `baas` takes no collection config at all and derives them from the live database at boot, so every RLS-protected table is served with nothing to define. The schema editor is off in `baas` — it exists to write collection files back to disk. Both serve the same control plane (auth, storage, realtime, backups, cron, functions, OpenAPI); neither serves the admin SPA, which is the application's call via `serveSPA` |
 | `collections` | `CollectionConfig[]` | `[]` | Inline collection definitions |
 | `collectionsDir` | `string` | — | Directory to auto-discover collection files (used if `collections` is empty) |
 | `basePath` | `string` | `"/api"` | Base path for all API routes |
@@ -445,14 +462,16 @@ import { initializeRebaseBackend, RebaseBackendConfig } from "@rebasepro/server"
 | `auth` | `RebaseAuthConfig \| AuthAdapter` | — | Authentication config or pluggable adapter |
 | `storage` | `BackendStorageConfig \| StorageController \| Record<string, ...>` | — | File storage configuration. Supports `"local"`, `"s3"`, and `"gcs"` (GCS/Firebase Storage) backends. Use `Record<string, StorageController>` for multi-backend setups with named sources |
 | `history` | `unknown` | — | Entity history/audit-log configuration |
-| `defaultSecurityRules` | `SecurityRule[]` | — | Default RLS rules for collections without their own |
 | `enableSwagger` | `boolean` | `true` | Enable OpenAPI spec at `/api/docs` and Swagger UI at `/api/swagger` (dev only) |
 | `functionsDir` | `string` | — | Directory for auto-discovered custom function handlers |
 | `cronsDir` | `string` | — | Directory for auto-discovered cron job handlers |
 | `cronPersistence` | `boolean` | `true` | Persist cron job execution logs to the database |
 | `maxBodySize` | `number` | `10485760` (10 MB) | Max request body size in bytes. Set `0` to disable |
 | `csrf` | `{ origin: string \| string[] \| ((origin: string) => boolean) }` | — | CSRF protection (opt-in, disabled by default) |
-| `hooks` | `BackendHooks` | — | Backend-level hooks for intercepting admin data at the API boundary |
+| `callbacks` | `CollectionCallbacks` | — | Global lifecycle callbacks applied to every collection. Same type as per-collection `callbacks`, and fires on **every** data path (REST, realtime/WebSocket, server-side `rebase.data`). Order: global → collection → property |
+| `baas` | `BaasOptions` | — | `baas` mode only: `{ unprotectedTables?: "exclude" \| "serve" }`. Default `"exclude"` — a table with RLS disabled carries no authorization model, and every authenticated request runs as `rebase_user`, so serving one hands every row to every logged-in user. Excluded tables are logged with the SQL to protect them. `"serve"` serves them anyway; only sensible when every caller is already trusted |
+| `schemaEditor` | `boolean` | — | Force the schema-editor routes on or off. Defaults to enabled when `collectionsDir` is set, outside production, in `cms` mode |
+| `storageSources` | `StorageSourceDefinition[]` | — | Named storage backends for multi-source setups. Each has a `key` that collection properties point at via `StorageConfig.storageSource` |
 | `logging` | `{ level?: "error" \| "warn" \| "info" \| "debug" }` | `"info"` | Log level configuration |
 
 > **IMPORTANT FOR AGENTS:** `maxBodySize` applies to all API routes under `basePath`. Storage upload routes have their **own** limit derived from the storage config's `maxFileSize` property (default: 50 MB), which overrides the global limit.
@@ -554,15 +573,37 @@ await initializeRebaseBackend({
     // Single backend: { type: "local" | "s3" | "gcs" }
     // Multi-backend: Record<string, StorageController> with named sources
     storage: { type: env.STORAGE_TYPE },
-    defaultSecurityRules: [
-        { operation: "select", access: "public" },
-        { operations: ["insert", "update", "delete"], roles: ["admin"] },
-    ],
 });
 
 console.log(`Server running at http://localhost:${env.PORT}`);
 ```
 
+## Default security rules live with the collections, not here
+
+`defaultSecurityRules` is **not** a `RebaseBackendConfig` option. Declare it in
+`config/collections/index.ts`, beside the collections it applies to:
+
+```typescript
+// config/collections/index.ts
+import type { SecurityRule } from "@rebasepro/types";
+
+export const defaultSecurityRules: SecurityRule[] = [
+    { operation: "select", access: "public" },
+    { operations: ["insert", "update", "delete"], roles: ["admin"] }
+];
+```
+
+Any collection in that directory that declares no `securityRules` inherits these;
+one that declares its own keeps them; one with neither is **locked by default**
+(admin-only).
+
+It belongs there because `db push` generates the Postgres policies — the only
+thing that actually enforces access — from the collection *files*, and never sees
+the running server. A default on the backend config could never reach the
+database while reading exactly like an authorization setting. In `baas` mode there
+are no collection files and no `db push`, so the database's own RLS is the whole
+model and there is nothing to default.
+
 # The `rebase` Singleton
 
 After `initializeRebaseBackend()` completes, a server-side singleton is available:

package/skills/rebase-collections/SKILL.md

@@ -495,7 +495,7 @@ validation: {
 
 Maps store nested objects as `JSONB` in PostgreSQL. They can define their own inner properties schema.
 
-```typescript
+```typescript no-verify
 address: {
     name: "Address",
     type: "map",
@@ -663,7 +663,7 @@ Every property supports a `validation` object with these common options:
 
 Use the `enum` property on `string` or `number` types to define picklist options:
 
-```typescript
+```typescript no-verify
 status: {
     name: "Status",
     type: "string",
@@ -687,7 +687,7 @@ Each `EnumValueConfig` entry supports:
 
 `EnumValues` can also be a `Record<string, string | EnumValueConfig>` for simpler definitions:
 
-```typescript
+```typescript no-verify
 enum: {
     draft: "Draft",
     published: { label: "Published", color: "green" }

package/skills/rebase-deployment/SKILL.md

@@ -38,6 +38,36 @@ rebase deploy
 rebase deploy --env dev
 ```
 
+### What a Cloud Deployment Serves
+
+`rebase deploy` ships **one container** per project, served at `https://<project>.apps.rebase.pro`. That container runs your backend, which handles:
+
+- **`/api/*`** — the data API, auth, realtime, storage
+- **everything else** — your built `frontend/` as a static SPA (via `serveSPA()`, see below)
+
+There is **no separate admin URL** — the admin panel is part of your frontend, so where it appears depends on what your frontend is:
+
+| Project type | What the root URL shows | Where the admin is |
+|--------------|------------------------|--------------------|
+| Default scaffold (`rebase init`, cms flavor) | The admin panel itself (login / bootstrap) | `/` — the frontend **is** the admin |
+| Custom product frontend | Your product app | Wherever you mount it — commonly `/admin` (see below) |
+| Backend-only (`--flavor backend`) | Nothing (API only) | Not deployed |
+
+> **IMPORTANT FOR AGENTS:** On the **first visit** to a freshly deployed project's admin, Rebase shows the bootstrap screen ("Create your admin account"). The earliest-registered account receives admin privileges — the project owner should claim it immediately after deploying. Never fill this form on the user's behalf.
+
+**Mounting the admin at `/admin` alongside a product app** — a single Vite entry can serve both, split by URL, so visitors never download the admin bundle:
+
+```tsx
+// frontend/src/main.tsx
+const isAdmin = window.location.pathname.startsWith("/admin");
+const ProductApp = lazy(() => import("./App"));
+const AdminApp = lazy(() => import("./AdminApp")); // renders <RebaseAdmin basePath="/admin" .../>
+
+// route "/admin/*" → AdminApp, everything else → ProductApp
+```
+
+Set **either** a router `basename="/admin"` **or** `<RebaseAdmin basePath="/admin">` — not both, or the prefix is applied twice.
+
 ---
 
 ## Docker (Self-Hosted)
@@ -318,7 +348,8 @@ Use the `extend` option to add your own typed env variables on top of the base R
 
 ```typescript
 import dotenv from "dotenv";
-import { loadEnv, z } from "@rebasepro/server";
+import { loadEnv } from "@rebasepro/server";
+import { z } from "zod";
 
 dotenv.config({ path: "../../.env" });
 
@@ -369,11 +400,16 @@ All variables recognized by the base `rebaseEnvSchema`:
 | `DATABASE_READ_URL` | `string` (URL) | No | — | Read replica database URL |
 | `STORAGE_TYPE` | `enum` | No | `"local"` | `"local"`, `"s3"`, or `"gcs"` |
 | `STORAGE_PATH` | `string` | No | — | Local file storage directory |
-| `FORCE_LOCAL_STORAGE` | `optionalBoolString` | No | `undefined` → `false` | Suppress local-storage-in-production warning |
+| `FORCE_LOCAL_STORAGE` | `optionalBoolString` | No | `undefined` → `false` | Allow `STORAGE_TYPE=local` in production — **the backend refuses to boot without it** |
 | `S3_BUCKET` | `string` | If S3 | — | S3 bucket name |
 | `S3_REGION` | `string` | No | — | S3 region |
 | `S3_ACCESS_KEY_ID` | `string` | If S3 | — | S3 access key |
 | `S3_SECRET_ACCESS_KEY` | `string` | If S3 | — | S3 secret key |
+| `GCS_BUCKET` | `string` | If GCS | — | GCS bucket name |
+| `GCS_PROJECT_ID` | `string` | No | — | GCP project (auto-detected from credentials) |
+| `GCS_KEY_FILENAME` | `string` | No | — | Service-account key file; omit on GKE (Workload Identity/ADC) |
+
+> **Deploying with `STORAGE_TYPE=local` fails to boot in production.** Local storage is the container filesystem, so uploads are destroyed on the next restart — silently, with no error at write or read time. Set `STORAGE_TYPE=s3`/`gcs`, or `FORCE_LOCAL_STORAGE=true` if a durable volume really is mounted at `STORAGE_PATH`. A crashed rollout is recoverable; lost user files are not.
 | `S3_ENDPOINT` | `string` (URL) | No | — | Custom S3 endpoint (MinIO, R2) |
 | `S3_FORCE_PATH_STYLE` | `optionalBoolString` | No | `undefined` → `false` | Use path-style S3 URLs (required for MinIO) |
 | `GCS_BUCKET` | `string` | If GCS | — | Google Cloud Storage bucket name |

package/skills/rebase-design-language/SKILL.md

@@ -50,8 +50,8 @@ import {
     Avatar, SearchBar, ErrorBoundary,
     // Utilities
     cls, defaultBorderMixin, cardMixin, cardClickableMixin, paperMixin,
-    // Icons (all from @rebasepro/ui)
-    AddIcon, DeleteIcon
+    // Icons (all from @rebasepro/ui, under their lucide names)
+    PlusIcon, Trash2Icon
 } from "@rebasepro/ui";
 ```
 
@@ -202,7 +202,7 @@ The typography scale is compact and uses semibold weights for headings — desig
 
 ### Typography Anti-Patterns
 
-```tsx
+```tsx no-verify
 // ❌ NEVER: Gradient text on headings
 <Typography className="bg-gradient-to-r from-violet-600 to-cyan-500 bg-clip-text text-transparent">
 
@@ -270,7 +270,7 @@ The `Card` component from `@rebasepro/ui` automatically applies `cardMixin` and,
 // cardClickableMixin = "hover:bg-surface-50 dark:hover:bg-surface-800 cursor-pointer transition-colors duration-150"
 ```
 
-```tsx
+```tsx no-verify
 // ✅ CORRECT: Using Card component
 <Card className="p-4">
     <Typography variant="subtitle1">Title</Typography>
@@ -407,7 +407,7 @@ The `Button` component accepts these variants and colors. Buttons use `rounded-l
 
 ### Button Anti-Patterns
 
-```tsx
+```tsx no-verify
 // ❌ NEVER: Casting variant to bypass types
 <Button variant={"standard" as any}>
 
@@ -432,7 +432,7 @@ The `Button` component accepts these variants and colors. Buttons use `rounded-l
 
 ### Use the `Alert` Component
 
-```tsx
+```tsx no-verify
 // ✅ CORRECT
 <Alert color="success" size="small">Lead captured successfully!</Alert>
 <Alert color="error">Could not load dashboard statistics.</Alert>
@@ -508,7 +508,7 @@ When displaying numeric KPIs, use plain muted icons (matching NavigationCard)
 
 ### Metric Card Anti-Patterns
 
-```tsx
+```tsx no-verify
 // ❌ NEVER: Gradient icon backgrounds
 <div className="p-4 bg-gradient-to-br from-blue-500 to-indigo-600 text-white rounded-2xl shadow-lg shadow-blue-500/20">
 
@@ -555,7 +555,7 @@ For larger content sections (like a table, form, or embedded panel), use `Paper`
 
 ### Panel Anti-Patterns
 
-```tsx
+```tsx no-verify
 // ❌ WRONG: Custom panel styling
 <div className="p-6 rounded-2xl border bg-white dark:bg-surface-900/50 backdrop-blur-md shadow-sm">
 

package/skills/rebase-email/SKILL.md

@@ -217,7 +217,7 @@ import {
 
 #### getPasswordResetTemplate
 
-```typescript
+```typescript no-verify
 function getPasswordResetTemplate(
     resetUrl: string,
     user: { email: string; displayName?: string | null },
@@ -229,7 +229,7 @@ The template includes a "Reset Password" button linking to `resetUrl`, a plain-t
 
 #### getEmailVerificationTemplate
 
-```typescript
+```typescript no-verify
 function getEmailVerificationTemplate(
     verifyUrl: string,
     user: { email: string; displayName?: string | null },
@@ -241,7 +241,7 @@ The template includes a "Verify Email Address" button linking to `verifyUrl`.
 
 #### getUserInvitationTemplate
 
-```typescript
+```typescript no-verify
 function getUserInvitationTemplate(
     setPasswordUrl: string,
     user: { email: string; displayName?: string | null },
@@ -253,7 +253,7 @@ Sent when an admin creates a user via `POST /api/admin/users` without specifying
 
 #### getWelcomeEmailTemplate
 
-```typescript
+```typescript no-verify
 function getWelcomeEmailTemplate(
     user: { email: string; displayName?: string | null },
     appName?: string,   // default: "Rebase"