opencastle 0.33.9 → 0.34.0

package/src/orchestrator/plugins/sentry/references/performance.md

@@ -0,0 +1,66 @@
+# Sentry Performance Tracing
+
+## Sampling Configuration
+
+```typescript
+Sentry.init({
+  dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+  // Sample 10% of transactions in production
+  tracesSampleRate: process.env.NODE_ENV === 'production' ? 0.1 : 1.0,
+  // Dynamic sampling based on transaction name
+  tracesSampler: (samplingContext) => {
+    if (samplingContext.name?.includes('/health')) return 0; // never sample health checks
+    if (samplingContext.name?.includes('/checkout')) return 0.5;
+    return 0.1;
+  },
+});
+```
+
+## Custom Spans
+
+```typescript
+import * as Sentry from '@sentry/nextjs';
+
+const result = await Sentry.startSpan(
+  { name: 'process-payment', op: 'payment.process' },
+  async (span) => {
+    span.setAttribute('payment.provider', 'stripe');
+    span.setAttribute('payment.amount', amount);
+    return await stripe.charges.create({ /* ... */ });
+  }
+);
+
+// Nested span inside an existing transaction
+await Sentry.startSpan({ name: 'db.query', op: 'db' }, async () => {
+  return await db.select().from(orders).where(eq(orders.id, orderId));
+});
+```
+
+## Distributed Tracing
+
+Sentry propagates trace context automatically via `sentry-trace` and `baggage` HTTP headers when using `fetch` or Node.js `http`. Verify in the trace view that frontend and backend spans are linked under the same trace ID.
+
+For manual header forwarding:
+```typescript
+import * as Sentry from '@sentry/node';
+
+const headers = {};
+Sentry.getActiveSpan()?.toTraceparent() // inject into outgoing request headers
+```
+
+## Core Web Vitals
+
+Captured automatically by the browser SDK — no extra config needed. View in Sentry → Performance → Web Vitals. Configure alerts for regressions:
+- LCP > 2.5s (Largest Contentful Paint)
+- CLS > 0.1 (Cumulative Layout Shift)
+- INP > 200ms (Interaction to Next Paint)
+
+## Sampling Recommendations
+
+| Scenario | `tracesSampleRate` |
+|----------|--------------------|
+| Development | `1.0` |
+| Low-traffic production | `0.2`–`0.5` |
+| High-traffic production | `0.05`–`0.1` |
+| Critical flows (checkout, auth) | Use `tracesSampler` to return `0.5` |
+| Health check / polling routes | Use `tracesSampler` to return `0` |

package/src/orchestrator/plugins/sentry/references/sdk-setup.md

@@ -0,0 +1,108 @@
+# Sentry SDK Setup
+
+## Next.js (recommended: wizard)
+
+```bash
+npx @sentry/wizard@latest -i nextjs
+```
+
+The wizard creates three init files and patches `next.config.ts` automatically.
+
+### Manual init files
+
+**`instrumentation-client.ts`** (browser):
+```typescript
+import * as Sentry from '@sentry/nextjs';
+Sentry.init({
+  dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+  tracesSampleRate: 0.1,
+  sendDefaultPii: true,
+  replaysSessionSampleRate: 0.1,
+  replaysOnErrorSampleRate: 1.0,
+  integrations: [Sentry.replayIntegration()],
+});
+```
+
+**`sentry.server.config.ts`** (Node.js server):
+```typescript
+import * as Sentry from '@sentry/nextjs';
+Sentry.init({
+  dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+  tracesSampleRate: 0.1,
+  sendDefaultPii: true,
+});
+```
+
+**`sentry.edge.config.ts`** (edge runtime):
+```typescript
+import * as Sentry from '@sentry/nextjs';
+Sentry.init({
+  dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
+  tracesSampleRate: 0.1,
+});
+```
+
+**`next.config.ts`**:
+```typescript
+import { withSentryConfig } from '@sentry/nextjs';
+const nextConfig = { /* your config */ };
+export default withSentryConfig(nextConfig, {
+  org: 'your-org',
+  project: 'your-project',
+  tunnelRoute: '/monitoring',
+  sourcemaps: { disable: false },
+});
+```
+
+## React (Vite / CRA)
+
+```typescript
+// main.tsx
+import * as Sentry from '@sentry/react';
+Sentry.init({
+  dsn: import.meta.env.VITE_SENTRY_DSN,
+  integrations: [Sentry.browserTracingIntegration(), Sentry.replayIntegration()],
+  tracesSampleRate: 0.1,
+  replaysOnErrorSampleRate: 1.0,
+});
+```
+
+## Node.js / Express
+
+```typescript
+// instrument.ts — import BEFORE any other module
+import * as Sentry from '@sentry/node';
+Sentry.init({
+  dsn: process.env.SENTRY_DSN,
+  tracesSampleRate: 0.1,
+});
+```
+
+```typescript
+// index.ts
+import './instrument';
+import express from 'express';
+// ... app setup
+app.use(Sentry.expressErrorHandler()); // must be last error-handling middleware
+```
+
+## Key Config Options
+
+| Option | Purpose |
+|--------|---------|
+| `dsn` | Project DSN — safe for client-side |
+| `tracesSampleRate` | 0–1 fraction of transactions to sample |
+| `sendDefaultPii` | Capture IP, user agent, authenticated user |
+| `environment` | `production` / `staging` — filters in Sentry UI |
+| `release` | Version string for suspect commits |
+| `tunnelRoute` | Proxy path to avoid ad-blockers |
+| `debug` | Log Sentry internals (dev only) |
+
+## Environment Variables
+
+| Variable | Required by |
+|----------|------------|
+| `NEXT_PUBLIC_SENTRY_DSN` | Browser + server init |
+| `SENTRY_AUTH_TOKEN` | Source map upload (CI + local build) |
+| `SENTRY_ORG` | `withSentryConfig` / CLI |
+| `SENTRY_PROJECT` | `withSentryConfig` / CLI |

package/src/orchestrator/plugins/stripe/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: stripe-payments
+description: "Stripe payment integration patterns, Checkout Sessions, billing/subscriptions, Connect platforms, and API best practices. Use when building, modifying, or reviewing any Stripe integration — including accepting payments, building marketplaces, setting up subscriptions, or implementing secure key handling."
+---
+
+# Stripe Payments
+
+Latest Stripe API version: **2026-03-25.dahlia**. Always use the latest API version and SDK unless the user specifies otherwise.
+
+## Integration Routing
+
+| Building… | Recommended API | Reference |
+|---|---|---|
+| One-time payments | Checkout Sessions | `references/api-patterns.md` — Payments |
+| Custom payment form with embedded UI | Checkout Sessions + Payment Element | `references/api-patterns.md` — Payments |
+| Saving a payment method for later | Setup Intents | `references/api-patterns.md` — Payments |
+| Connect platform or marketplace | Accounts v2 (`/v2/core/accounts`) | `references/api-patterns.md` — Connect |
+| Subscriptions or recurring billing | Billing APIs + Checkout Sessions | `references/api-patterns.md` — Billing |
+| Embedded financial accounts / banking | v2 Financial Accounts | `references/api-patterns.md` — Treasury |
+| Security (key management, RAKs, webhooks, OAuth, 2FA, Connect liability) | See security reference | `references/api-patterns.md` — Security |
+
+Read the relevant reference section before answering any integration question or writing code.
+
+## Critical Rules
+
+**API Selection**
+- Use Checkout Sessions API (`checkout.sessions.create`) for on-session payments — supports one-time payments and subscriptions
+- Use PaymentIntents API for off-session payments or when modeling checkout state independently
+- Only use Checkout Sessions, PaymentIntents, SetupIntents, or higher-level solutions (Invoicing, Payment Links, subscription APIs)
+- Never use the Charges API — migrate to Checkout Sessions or PaymentIntents
+- Don't use the Sources API — use Setup Intents instead
+
+**Integration Surfaces (in order of preference)**
+1. Payment Links — no-code, best for simple products
+2. Checkout — Stripe-hosted or embedded form, best for most web apps
+3. Payment Element — embedded UI component for advanced customization; back it with Checkout Sessions API via `ui_mode: 'custom'` over raw PaymentIntents when possible
+
+**API Keys & Security**
+- Use restricted API keys (RAKs, prefix `rk_`) instead of secret keys (prefix `sk_`) wherever possible — follow least privilege
+- Never use secret keys or RAKs in client-side code or mobile apps
+- Always verify webhook signatures using Stripe's webhook signing secret
+- Always use the `state` parameter in Connect OAuth flows
+
+**Connect Platforms**
+- For new Connect platforms, always use the Accounts v2 API (`POST /v2/core/accounts`)
+- Don't use legacy `type` parameter (`type: 'express'`, `type: 'custom'`, `type: 'standard'`) for new platforms
+- Configure accounts using `controller` properties instead of legacy account types
+- Use Stripe-hosted onboarding rather than custom onboarding flows
+
+**Billing**
+- Don't use the deprecated `plan` object — use Prices instead
+- Combine Billing APIs with Stripe Checkout for the payment frontend
+- Recommend Customer Portal for self-service subscription management
+
+## Checkout Session Pattern
+
+```typescript
+import Stripe from 'stripe';
+
+const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
+  apiVersion: '2026-03-25.dahlia',
+});
+
+const session = await stripe.checkout.sessions.create({
+  mode: 'payment', // For subscriptions, change to 'subscription' and use a recurring price
+  line_items: [{
+    price: 'price_xxx',
+    quantity: 1,
+  }],
+  success_url: 'https://example.com/success?session_id={CHECKOUT_SESSION_ID}',
+  cancel_url: 'https://example.com/cancel',
+});
+```
+
+## Webhook Handling
+
+```typescript
+import Stripe from 'stripe';
+
+const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
+  apiVersion: '2026-03-25.dahlia',
+});
+
+export async function POST(request: Request) {
+  const body = await request.text();
+  const signature = request.headers.get('stripe-signature');
+
+  if (!signature || !process.env.STRIPE_WEBHOOK_SECRET) {
+    return new Response('Missing signature', { status: 400 });
+  }
+
+  try {
+    const event = stripe.webhooks.constructEvent(
+      body,
+      signature,
+      process.env.STRIPE_WEBHOOK_SECRET
+    );
+
+    switch (event.type) {
+      case 'checkout.session.completed':
+        // Handle successful checkout
+        break;
+      case 'invoice.paid':
+        // Handle successful invoice payment
+        break;
+      case 'customer.subscription.deleted':
+        // Handle subscription cancellation
+        break;
+    }
+
+    return new Response('OK', { status: 200 });
+  } catch (err) {
+    console.error('Webhook verification failed', (err as Error).message);
+    return new Response('Invalid signature', { status: 400 });
+  }
+}
+```
+
+## Key Documentation
+
+- [Integration Options](https://docs.stripe.com/payments/payment-methods/integration-options) — Start here when designing any integration
+- [API Tour](https://docs.stripe.com/payments-api/tour) — Overview of Stripe's API surface
+- [Go Live Checklist](https://docs.stripe.com/get-started/checklist/go-live) — Review before launching
+
+## Reference Files
+
+- `references/api-patterns.md` — Payments, Billing, Connect, Treasury, and Security patterns
+- `references/upgrade-guide.md` — Upgrading Stripe API versions and SDKs
+- `references/projects-setup.md` — Setting up Stripe Projects CLI
+
+## Quick Workflow: Add payments to an app
+1. Install the Stripe SDK: `npm install stripe @stripe/stripe-js`
+2. Create products and prices in the Stripe Dashboard or via the API
+3. Create a Checkout Session from your backend and redirect the customer — verify the session URL is returned before redirecting
+4. Set up a webhook endpoint and handle `checkout.session.completed` to fulfill the order
+5. Verify webhook signatures and test with `stripe listen --forward-to localhost:3000/api/webhooks`
+   - **If verification fails:** confirm `STRIPE_WEBHOOK_SECRET` matches your endpoint's signing secret → restart `stripe listen` → retry the event
+   - **If events aren't arriving:** check the endpoint URL is reachable and the route returns 200 for valid events

package/src/orchestrator/plugins/stripe/config.ts

@@ -0,0 +1,43 @@
+import type { PluginConfig } from '../types.js';
+
+export const config: PluginConfig = {
+  id: 'stripe',
+  name: 'Stripe',
+  category: 'tech',
+  subCategory: 'payments',
+  label: 'Stripe',
+  hint: 'Payments, billing, and financial infrastructure',
+  skillName: 'stripe-payments',
+  mcpServerKey: 'Stripe',
+  mcpConfig: {
+    type: 'http',
+    url: 'https://mcp.stripe.com',
+  },
+  authType: 'oauth',
+  envVars: [],
+  agentToolMap: {
+    'developer': [
+      'create_customer', 'list_customers', 'create_product', 'create_price',
+      'list_products', 'list_prices', 'create_payment_link',
+      'create_checkout_session', 'create_invoice', 'create_invoice_item',
+      'finalize_invoice', 'list_invoices', 'create_refund',
+      'list_payment_intents', 'search_stripe_documentation',
+    ],
+    'database-engineer': [
+      'list_customers', 'list_products', 'list_prices',
+      'list_invoices', 'list_subscriptions', 'list_payment_intents',
+      'search_stripe_resources', 'fetch_stripe_resources',
+    ],
+    'security-expert': [
+      'get_stripe_account_info', 'retrieve_balance',
+      'list_disputes', 'search_stripe_documentation',
+    ],
+    'devops-expert': [
+      'get_stripe_account_info', 'retrieve_balance',
+      'search_stripe_documentation',
+    ],
+  },
+  docsUrl: 'https://www.opencastle.dev/docs/plugins#stripe',
+  officialDocs: 'https://docs.stripe.com/',
+  mcpPackage: undefined,
+};

package/src/orchestrator/plugins/stripe/references/api-patterns.md

@@ -0,0 +1,57 @@
+# Stripe API Patterns Reference
+
+## Payments
+
+Use the Checkout Sessions API (`checkout.sessions.create`) for on-session payments. It supports one-time payments and subscriptions and handles taxes, discounts, shipping, and adaptive pricing automatically.
+
+Use the PaymentIntents API for off-session payments, or when the merchant needs to model checkout state independently.
+
+**Integration surfaces** (in order of preference):
+1. Payment Links — No-code. Best for simple products.
+2. Checkout — Stripe-hosted or embedded form. Best for most web apps.
+3. Payment Element — Embedded UI component for advanced customization. Back it with the Checkout Sessions API via `ui_mode: 'custom'`.
+
+**Don't recommend:** legacy Card Element, Payment Element in card-only mode, Charges API, Sources API, Tokens API.
+
+**Payment method saving:** Use the Setup Intents API. Don't use the Sources API.
+
+**Dynamic payment methods:** Enable in the Dashboard rather than passing specific `payment_method_types`. Stripe automatically selects based on the customer's location.
+
+## Billing / Subscriptions
+
+If the user has a recurring revenue model (subscriptions, usage-based billing, seat-based pricing), use the Billing APIs instead of manual PaymentIntent renewal loops.
+
+Combine Billing APIs with Stripe Checkout (`mode: 'subscription'`). Use Customer Portal for self-service management (upgrades, downgrades, cancellation, payment method updates).
+
+Don't use the deprecated `plan` object — use Prices instead.
+
+## Connect / Platforms
+
+For new Connect platforms, use the Accounts v2 API (`POST /v2/core/accounts`). Don't use the legacy `type` parameter.
+
+Configure accounts using `controller` properties:
+
+| Property | Controls |
+|---|---|
+| `controller.losses.payments` | Who is liable for negative balances |
+| `controller.fees.payer` | Who pays Stripe fees |
+| `controller.stripe_dashboard.type` | Dashboard access (`full`, `express`, `none`) |
+| `controller.requirement_collection` | Who collects onboarding requirements |
+
+Charge types: use destination charges for most platforms. Don't mix charge types.
+
+## Treasury / Financial Accounts
+
+For embedded financial accounts, use the v2 Financial Accounts API (`POST /v2/core/vault/financial_accounts`). Required for new integrations. Don't use the v1 Treasury API for new integrations.
+
+## Security
+
+**API keys:** Store in a secrets vault, not in source code. Use restricted API keys (RAKs, prefix `rk_`) instead of secret keys (prefix `sk_`) wherever possible.
+
+**Webhooks:** Always verify webhook signatures. Allowlist Stripe's IP addresses on webhook endpoints for defense in depth.
+
+**Client-side:** Never use production secret keys or RAKs in mobile apps or other client-side code. Use ephemeral keys for direct client-Stripe interaction.
+
+**Connect OAuth:** Always use the `state` parameter to protect against CSRF attacks.
+
+**Incident response:** If a key is exposed, roll it immediately via the API keys page, check activity logs, and contact Stripe support if unrecognized activity is found.

package/src/orchestrator/plugins/stripe/references/projects-setup.md

@@ -0,0 +1,30 @@
+# Stripe Projects Setup
+
+Guide for initializing Stripe Projects repositories and configuring the Projects CLI for local development.
+
+## Installation
+
+```bash
+# macOS (Homebrew)
+brew install stripe/stripe-cli/stripe && stripe plugin install projects
+
+# Verify installation
+stripe projects --version
+```
+
+For other platforms, see the [Stripe CLI install docs](https://docs.stripe.com/stripe-cli/install).
+
+## Getting Started
+
+1. Run `stripe projects init` in your target directory — common stacks include `next`, `rails`, `python`
+2. Follow the interactive prompts to select your stack and configure the project
+3. Verify setup succeeded:
+   - `stripe-project.json` exists in the project root
+   - A `.stripe/` directory with local skills was created
+   - Run the local dev command shown in init output (e.g., `npm run dev`) to confirm the stack works
+
+If `stripe projects init` fails: verify `stripe projects --version` works, check you're logged in with `stripe login`, and ensure you have write permissions in the target directory.
+
+## Next Steps
+
+After init, prefer the local project skills it creates — they contain project-specific patterns and configurations. For full documentation, see the [Stripe Projects docs](https://docs.stripe.com/projects).

package/src/orchestrator/plugins/stripe/references/upgrade-guide.md

@@ -0,0 +1,105 @@
+# Stripe Upgrade Guide
+
+Version-specific guidance for upgrading Stripe API versions and SDKs.
+
+The latest Stripe API version is **2026-03-25.dahlia**. Use this version when upgrading unless a different target is specified.
+
+Review the [API Changelog](https://docs.stripe.com/changelog) for all changes between your current and target versions before starting.
+
+## Pinning the API Version
+
+Always specify the API version explicitly:
+
+```javascript
+const stripe = require('stripe')('sk_test_xxx', {
+  apiVersion: '2026-03-25.dahlia',
+});
+```
+
+For strongly-typed languages (Java, Go, .NET), update the SDK package version instead of overriding — the API version is fixed to the SDK release.
+
+## Stripe.js & Mobile SDKs
+
+Stripe.js uses an evergreen model with biannual major releases. Each version auto-pairs with its API version — no override possible.
+
+```html
+<script src="https://js.stripe.com/dahlia/stripe.js"></script>
+```
+
+Mobile SDKs (iOS, Android, React Native) work with any backend API version unless docs specify otherwise. Update via your package manager.
+
+## Handling Breaking Changes
+
+Search the codebase for removed/renamed fields listed in the changelog before making any SDK or version changes.
+
+```typescript
+// 2022-11-15: charges no longer expanded on PaymentIntent
+// Before:
+const charge = paymentIntent.charges.data[0];
+// After: retrieve via latest_charge
+const charge = await stripe.charges.retrieve(paymentIntent.latest_charge as string);
+```
+
+Key patterns:
+- Field renames/removals → update all call sites
+- Nested expansion changes → switch to explicit `.retrieve()` calls
+- List endpoint changes → switch to auto-pagination methods
+
+## Version-Specific Breaking Changes
+
+### PaymentIntent.charges Removal (2022-11-15)
+
+```typescript
+// Before:
+const charge = paymentIntent.charges.data[0];
+// After: retrieve via latest_charge
+const charge = await stripe.charges.retrieve(paymentIntent.latest_charge as string);
+```
+
+### Invoice.lines Auto-Pagination (2023-08-16)
+
+```typescript
+// Before:
+const lines = invoice.lines.data;
+// After:
+const lines = await stripe.invoices.listLineItems(invoice.id, { limit: 100 });
+```
+
+## Webhook Migration
+
+When event payloads change between versions, update handlers to match the new schema.
+
+```typescript
+// Before (pre-2023-08-16): amount on charge object
+const amount = event.data.object.amount;
+// After: amount_captured replaces amount in some flows
+const amount = event.data.object.amount_captured ?? event.data.object.amount;
+```
+
+Test webhook changes:
+```bash
+stripe trigger checkout.session.completed --api-version 2026-03-25.dahlia
+```
+
+## Upgrade Checklist
+
+1. Review the [API Changelog](https://docs.stripe.com/changelog) and [Upgrades Guide](https://docs.stripe.com/upgrades) for changes between versions
+2. Update server-side SDK package version
+3. Update the `apiVersion` parameter in your Stripe client initialization
+4. Search codebase for removed/renamed fields and update all call sites
+5. **Run test suite** — verify all Stripe-related tests pass before proceeding
+6. Update webhook handlers to handle new event structures
+7. **Verify webhook payloads** — send test events with `stripe trigger <event>` and confirm your handlers process them correctly
+8. Update Stripe.js and mobile SDK versions if needed
+9. Test against the new API version using the `Stripe-Version` header before promoting to default:
+   ```bash
+   curl https://api.stripe.com/v1/customers \
+     -u sk_test_xxx: \
+     -H "Stripe-Version: 2026-03-25.dahlia"
+   ```
+10. Store Stripe object IDs in databases that accommodate up to 255 characters (case-sensitive collation)
+
+## Key Documentation
+
+- [API Changelog](https://docs.stripe.com/changelog) — Complete list of version changes
+- [Upgrades Guide](https://docs.stripe.com/upgrades) — SDK-specific upgrade details

package/src/orchestrator/plugins/types.ts

@@ -13,7 +13,7 @@ export interface PluginConfig {
   category: 'tech' | 'team';
 
   /** Sub-category for grouping */
-  subCategory: 'cms' | 'database' | 'deployment' | 'framework' | 'codebase-tool' | 'task-management' | 'knowledge-management' | 'notifications' | 'testing' | 'e2e-testing' | 'design' | 'email';
+  subCategory: 'cms' | 'database' | 'deployment' | 'framework' | 'codebase-tool' | 'task-management' | 'knowledge-management' | 'notifications' | 'testing' | 'e2e-testing' | 'design' | 'email' | 'payments' | 'observability';
 
   /** Label shown in the `npx opencastle init` multiselect */
   label: string;

package/src/orchestrator/skills/backbone-scaffolding/EXAMPLES.md

@@ -8,7 +8,7 @@
   "description": "Scaffold monorepo with backbone CLI",
   "agent": "developer",
   "complexity": 2,
-  "prompt": "Scaffold the project monorepo using the backbone CLI. Ensure Node.js >= 22.5.0 is available. Run: `npx @monkilabs/backbone my-project` and select the following options when prompted:\n- Monorepo: Turborepo\n- Framework: Next.js\n- Backend: Supabase\n- CMS: Sanity\n- Testing: Playwright\n- Deployment: Vercel\n- Mobile: None\n- Packages: Email Library, LLM Library\n\nAfter scaffolding completes, run `npm install` in the generated `my-project/` directory. Then run `npx turbo build` and verify it exits 0.",
+  "prompt": "Scaffold the project monorepo using the backbone CLI. Ensure Node.js >= 22.5.0 is available. Run: `npx @monkilabs/backbone my-project` and select the following options when prompted:\n- Monorepo: Turborepo\n- Framework: Next.js\n- Backend: Supabase\n- CMS: Sanity\n- Testing: Playwright\n- Deployment: Vercel\n- Mobile: None\n- Packages: Email Library, LLM Library\n- Payments: Stripe\n- Observability: Sentry\n\nAfter scaffolding completes, run `npm install` in the generated `my-project/` directory. Then run `npx turbo build` and verify it exits 0.",
   "files": ["my-project/"]
 }
 ```

package/src/orchestrator/skills/backbone-scaffolding/SKILL.md

@@ -18,27 +18,31 @@ Backbone is **interactive** — it uses `@clack/prompts` to ask a series of ques
 
 1. **Monorepo tool** — `nx` or `turborepo`
 2. **Framework** — `nextjs` or `astro`
-3. **Backend** — `convex`, `supabase`, `prisma`, or `none`
+3. **Backend** — `convex`, `supabase`, `prisma`, or `drizzle`
 4. **CMS** — `sanity`, `contentful`, `strapi`, or `none`
 5. **E2E Testing** — `playwright` or `cypress`
-6. **Deployment** — `vercel`, `netlify`, or `none`
-7. **Mobile** — `ionic` or `none` *(only shown for non-Astro frameworks)*
+6. **Deployment** — `vercel`, `netlify`, `cloudflare`, `coolify`, or `none`
+7. **Mobile** — `ionic`, `expo`, or `none` *(only shown for non-Astro frameworks)*
 8. **Packages** — multi-select: `uiLib`, `emailLib`, `llmLib`
+9. **Payments** — `stripe` or `none`
+10. **Observability** — `sentry` or `none`
 
 ## CLI Options & Constraints
 
-| Category    | Choices                                   | Notes                                    |
-|-------------|-------------------------------------------|------------------------------------------|
-| Monorepo    | `nx`, `turborepo`                         | Required                                 |
-| Framework   | `nextjs`, `astro`                         | Required                                 |
-| Backend     | `convex`, `supabase`, `prisma`            | ⛔ `convex` incompatible with `astro`    |
-| CMS         | `sanity`, `contentful`, `strapi`, `none`  | Optional                                 |
-| E2E Testing | `playwright`, `cypress`                   | Required                                 |
-| Deployment  | `vercel`, `netlify`, `none`               | Optional                                 |
-| Mobile      | `ionic`, `none`                           | ⛔ `ionic` incompatible with `astro`     |
-| Packages    | `uiLib`, `emailLib`, `llmLib`             | Multi-select; ⛔ `uiLib` incompatible with `astro` |
-
-**Astro constraint:** `astro` requires React-free options — never combine with `convex`, `ionic`, or `uiLib`.
+| Category      | Choices                                          | Notes                                    |
+|---------------|--------------------------------------------------|------------------------------------------|
+| Monorepo      | `nx`, `turborepo`                                | Required                                 |
+| Framework     | `nextjs`, `astro`                                | Required                                 |
+| Backend       | `convex`, `supabase`, `prisma`, `drizzle`        | ⛔ `convex` incompatible with `astro`    |
+| CMS           | `sanity`, `contentful`, `strapi`, `none`         | Optional                                 |
+| E2E Testing   | `playwright`, `cypress`                          | Required                                 |
+| Deployment    | `vercel`, `netlify`, `cloudflare`, `coolify`, `none` | Optional                             |
+| Mobile        | `ionic`, `expo`, `none`                          | ⛔ `ionic` and `expo` incompatible with `astro` |
+| Packages      | `uiLib`, `emailLib`, `llmLib`                    | Multi-select; ⛔ `uiLib` incompatible with `astro` |
+| Payments      | `stripe`, `none`                                 | Optional                                 |
+| Observability | `sentry`, `none`                                 | Optional                                 |
+
+**Astro constraint:** `astro` requires React-free options — never combine with `convex`, `ionic`, `expo`, or `uiLib`.
 
 ## OpenCastle TechTool → Backbone Mapping
 
@@ -47,6 +51,12 @@ Most TechTool names map 1:1 to backbone prompt choices (e.g. `nextjs` → select
 | TechTool | Backbone mapping | Notes |
 |----------|-----------------|-------|
 | `resend` | Select `emailLib` in Packages prompt | Only non-obvious mapping |
+| `drizzle` | Select `drizzle` in Backend prompt | Direct 1:1 mapping |
+| `cloudflare` | Select `cloudflare` in Deployment prompt | Direct 1:1 mapping |
+| `coolify` | Select `coolify` in Deployment prompt | Direct 1:1 mapping |
+| `expo` | Select `expo` in Mobile prompt | Direct 1:1 mapping; incompatible with `astro` |
+| `stripe` | Select `stripe` in Payments prompt | Direct 1:1 mapping |
+| `sentry` | Select `sentry` in Observability prompt | Direct 1:1 mapping |
 | `vitest` | — | Always included automatically |
 | `figma`, `chrome-devtools` | — | Not handled by backbone; configure separately |
 
@@ -58,14 +68,17 @@ After backbone runs, the output directory contains:
 <project-name>/
   apps/
     web/          # Next.js or Astro application
-    mobile/       # (if ionic selected)
+    mobile/       # (if ionic or expo selected)
   packages/
     ui/           # (if uiLib selected) shared React component library
     email/        # (if emailLib selected) Resend/React Email package
     llm/          # (if llmLib selected) LLM integration package
+    stripe/       # (if stripe selected) Stripe client + webhook handler
   backend/
     convex/       # (if convex selected)
     supabase/     # (if supabase selected)
+    prisma/       # (if prisma selected)
+    drizzle/      # (if drizzle selected) schema, config, migrations
   e2e/            # Playwright or Cypress tests
   .github/
     workflows/    # GitHub Actions CI pipelines (always included)
@@ -73,6 +86,9 @@ After backbone runs, the output directory contains:
   tsconfig.base.json        # Always included
   package.json              # Monorepo root package.json
   turbo.json / nx.json      # Monorepo tool config
+  wrangler.toml             # (if cloudflare selected)
+  Dockerfile                # (if coolify selected)
+  sentry.*.config.ts        # (if sentry selected) in apps/web/
 ```
 
 **Always included regardless of options:** Vitest configuration, GitHub Actions CI workflows, root `tsconfig.base.json`, ESLint, Prettier.

package/src/orchestrator/plugins/convex/REFERENCE.md

@@ -1,9 +0,0 @@
-> Parent: [SKILL.md](./SKILL.md)
-
-Last Updated: 2026-03-31
-
-Reference: Convex patterns and safety checks
-
-- Schema migration checklist and `npx convex deploy` notes
-- Query/mutation examples with `returns` validators
-- Backup/rollback using `npx convex export` / `npx convex import`