vybekiit 0.4.0 → 0.6.0

package/dist/global-skills/resend/references/templates.md

@@ -0,0 +1,202 @@
+# Resend Templates
+
+## Overview
+
+Templates are reusable email structures stored on Resend. Define HTML and variables once; reference the template ID or alias when sending.
+
+**Use templates when:** the same structure is reused across many sends, non-engineers need to edit copy without touching code, or you want version history.
+
+**Use inline `html` when:** the structure changes per send, you need more than 50 dynamic variables, or you want tighter rendering control.
+
+## Template Lifecycle
+
+```
+Create (draft) → Publish → Send
+      ↑ edit                 |
+      └─────────────────────┘
+```
+
+Editing a published template creates a new draft — the published version keeps sending until you publish again.
+
+| State | Can send? |
+|-------|-----------|
+| **Draft** | No |
+| **Published** | Yes |
+
+## Variable Syntax
+
+Use **triple mustache** in HTML and subject: `{{{VARIABLE_NAME}}}`
+
+```html
+<!-- ✅ Correct -->
+<p>Hi {{{CUSTOMER_NAME}}}, your order #{{{ORDER_ID}}} has shipped!</p>
+
+<!-- ❌ Wrong — double braces don't render in Resend -->
+<p>Hi {{CUSTOMER_NAME}}</p>
+```
+
+Plain substitution only — no `{{#each}}`, `{{#if}}`, or other Handlebars control flow. Pre-render dynamic lists server-side into a single HTML variable.
+
+Variable key casing is arbitrary (`ORDER_ID`, `orderId`, `order_id` all work) but must be consistent: whatever casing you use in the template definition must match exactly in the send call.
+
+### Variable Definition
+
+```typescript
+{ key: 'ORDER_TOTAL', type: 'number', fallbackValue: 0 }
+{ key: 'CUSTOMER_NAME', type: 'string', fallbackValue: 'Customer' }
+{ key: 'ORDER_ID', type: 'string' }  // no fallbackValue = required at send time
+```
+
+- Variable **with** `fallbackValue` and missing at send → uses fallback, send succeeds
+- Variable **without** `fallbackValue` and missing at send → send **fails** (422)
+
+### Variable Constraints
+
+| Constraint | Limit |
+|------------|-------|
+| Max variables per template | 50 |
+| Key characters | ASCII letters, numbers, underscores only |
+| Key max length | 50 characters |
+| String value max | 2,000 characters |
+| Number value max | 2^53 − 1 |
+
+### Reserved Names
+
+`FIRST_NAME` · `LAST_NAME` · `EMAIL` · `UNSUBSCRIBE_URL` · `RESEND_UNSUBSCRIBE_URL` · `contact` · `this`
+
+These cannot be used as custom variable keys — rename to `USER_FIRST_NAME`, `USER_EMAIL`, etc.
+
+## Sending with a Template
+
+```typescript
+const { data, error } = await resend.emails.send(
+  {
+    from: 'Acme <orders@acme.com>',
+    to: ['customer@example.com'],
+    template: {
+      id: 'order-confirmation',  // alias or auto-generated ID
+      variables: { CUSTOMER_NAME: 'Alice', ORDER_ID: '12345' },
+    },
+  },
+  { idempotencyKey: `order-confirm/${orderId}` }
+);
+```
+
+Cannot combine `template` with `html`, `text`, or `react` — mutually exclusive. `subject` and `from` from the template can be overridden per-send.
+
+## Aliases
+
+An alias is a stable, human-readable slug you set at create time. Pass it in the `id` field anywhere you'd use the auto-generated template ID.
+
+```typescript
+// Set alias at create time
+await resend.templates.create({
+  name: 'Order Confirmation',   // display-only
+  alias: 'order-confirmation',  // referenceable slug
+  html: '<p>Hi {{{CUSTOMER_NAME}}}</p>',
+});
+
+// Reference by alias — no need to store the generated tmpl_ ID
+template: { id: 'order-confirmation', variables: { CUSTOMER_NAME: 'Alice' } }
+```
+
+## SDK Methods (Node.js)
+
+| Operation | Method |
+|-----------|--------|
+| Create | `resend.templates.create(params)` |
+| Get | `resend.templates.get(id)` |
+| List | `resend.templates.list(params)` |
+| Update | `resend.templates.update(id, params)` |
+| Delete | `resend.templates.remove(id)` ← not `.delete()` |
+| Publish | `resend.templates.publish(id)` |
+| Duplicate | `resend.templates.duplicate(id)` |
+
+### Create Template
+
+**Required:** `name`, `html` (or `react`)
+**Optional:** `alias`, `from`, `subject`, `reply_to`, `text`, `react`, `variables`
+
+```typescript
+const { data, error } = await resend.templates.create({
+  name: 'Order Confirmation',
+  alias: 'order-confirmation',
+  subject: 'Your Order #{{{ORDER_ID}}}',
+  html: '<p>Hi {{{CUSTOMER_NAME}}}, your order #{{{ORDER_ID}}} has shipped!</p>',
+  variables: [
+    { key: 'CUSTOMER_NAME', type: 'string', fallbackValue: 'Customer' },
+    { key: 'ORDER_ID', type: 'string' },
+  ],
+});
+// Returns: { id: 'tmpl_abc123', object: 'template' }
+```
+
+### Chainable Create → Publish
+
+```typescript
+const { data, error } = await resend.templates.create({
+  name: 'Welcome',
+  html: '<p>Hi {{{NAME}}}</p>',
+}).publish();
+// Template is created AND published in one call
+```
+
+### Get, List, Update, Delete
+
+```typescript
+// Get by ID or alias
+await resend.templates.get('tmpl_abc123');
+await resend.templates.get('order-confirmation');  // by alias
+
+// List — cursor-based pagination, max 100 per page
+const { data } = await resend.templates.list({ limit: 100 });
+// data.has_more === true → fetch next page
+await resend.templates.list({ limit: 100, after: data.data[data.data.length - 1].id });
+
+// Update (partial — only provided fields change)
+await resend.templates.update('tmpl_abc123', { name: 'Order Confirmed' });
+
+// Delete
+await resend.templates.remove('tmpl_abc123');  // returns { deleted: true }
+```
+
+See `fetch-all-templates.mjs` for a complete pagination loop.
+
+### Publish
+
+```typescript
+await resend.templates.publish('tmpl_abc123');
+// Template is now live. Publishing is synchronous — no delay needed before sending.
+```
+
+### Duplicate
+
+```typescript
+const { data, error } = await resend.templates.duplicate('tmpl_abc123');
+// Returns: { id: 'tmpl_new456', object: 'template' }
+
+// Chainable — duplicate and publish in one call
+const { data, error } = await resend.templates.duplicate('tmpl_abc123').publish();
+```
+
+Useful for creating variants (e.g., A/B testing subject lines) or bootstrapping new templates from an existing one.
+
+## Version History
+
+Every template maintains full version history. Reverting creates a new draft from a previous version without affecting the published version. Accessible via the Resend dashboard template editor.
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| `{{VAR}}` instead of `{{{VAR}}}` | Triple braces required — double braces don't render variables |
+| Sending with draft template | Call `.publish()` first — draft templates cannot send |
+| Adding delay after create/publish | Publishing is synchronous — send failure has another cause |
+| `{{#each}}` or `{{#if}}` in template HTML | No loop/conditional support — pre-render dynamic lists server-side |
+| `html` + `template` in same send call | Mutually exclusive — remove `html` when using template |
+| Using `FIRST_NAME`, `EMAIL` as variable keys | Reserved — rename to `USER_FIRST_NAME`, `USER_EMAIL` |
+| Variable without fallback missing at send | Add `fallbackValue` or always provide the variable |
+| Calling `.delete()` | SDK method is `.remove()` |
+| Expecting alias = name | `alias` is a separate referenceable slug; `name` is display-only |
+| 60+ variables | Max 50 — pre-render complex content as a single HTML variable |
+| No idempotency key on sends | Template sends use the same endpoint — pass `idempotencyKey` |

package/dist/global-skills/resend/references/topics.md

@@ -0,0 +1,104 @@
+# Topics
+
+Fine-grained subscription preferences — contacts opt in or out per topic. Topics control which contacts receive broadcasts when `topicId` is set.
+
+## SDK Methods
+
+### Node.js
+
+| Operation | Method |
+|-----------|--------|
+| Create | `resend.topics.create(params)` |
+| Get | `resend.topics.get(id)` |
+| List | `resend.topics.list()` — no pagination params |
+| Update | `resend.topics.update(params)` |
+| Delete | `resend.topics.remove(id)` — not `.delete()` |
+
+### Python
+
+| Operation | Method |
+|-----------|--------|
+| Create | `resend.Topics.create(params)` |
+| Get | `resend.Topics.get(id)` |
+| List | `resend.Topics.list()` |
+| Update | `resend.Topics.update(params)` |
+| Delete | `resend.Topics.remove(id)` |
+
+## Create Topic
+
+```typescript
+const { data, error } = await resend.topics.create({
+  name: 'Product Updates',
+  defaultSubscription: 'opt_in',  // REQUIRED: "opt_in" or "opt_out"
+  description: 'New features and releases',
+  visibility: 'public',  // "public" or "private" (default: "private")
+});
+
+if (error) {
+  console.error(error);
+  return;
+}
+
+console.log(data.id); // topic_xxxxxxxx
+```
+
+## Update Topic
+
+`defaultSubscription` is **immutable** after creation. Only `name`, `description`, and `visibility` can be updated.
+
+```typescript
+const { data, error } = await resend.topics.update({
+  id: 'topic_xxx',
+  name: 'Product News',
+  visibility: 'public',
+});
+```
+
+## Managing Contact Subscriptions
+
+Update a contact's topic subscriptions via the contacts sub-resource:
+
+```typescript
+await resend.contacts.topics.update({
+  id: 'cont_xxx',
+  topics: [
+    { id: 'topic_xxx', subscription: 'opt_in' },
+    { id: 'topic_yyy', subscription: 'opt_out' },
+  ],
+});
+```
+
+## Using Topics with Broadcasts
+
+Pass `topicId` when creating a broadcast — only contacts subscribed to that topic receive it:
+
+```typescript
+await resend.broadcasts.create({
+  name: 'Feature Launch',
+  segmentId: 'seg_xxx',
+  topicId: 'topic_xxx',
+  from: 'updates@acme.com',
+  subject: 'New Feature Launch',
+  html: '<p>Check it out!</p>',
+});
+```
+
+## Constraints
+
+| Constraint | Limit |
+|------------|-------|
+| Name max length | 50 characters |
+| Description max length | 200 characters |
+| `defaultSubscription` | `"opt_in"` or `"opt_out"` — immutable after create |
+| `visibility` | `"public"` (shown on preference page) or `"private"` (default) |
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| Omitting `defaultSubscription` on create | Required — must be `"opt_in"` or `"opt_out"` |
+| Trying to change `defaultSubscription` | Immutable after creation — delete and recreate with new value |
+| Calling `.delete()` | SDK method is `.remove()` |
+| `visibility: "hidden"` | Not a valid value — use `"private"` |
+| Expecting `list()` to accept pagination | `topics.list()` takes no params — returns all topics |
+| Broadcast without `topicId` | Goes to all contacts in segment regardless of topic preferences |

package/dist/global-skills/resend/references/webhooks.md

@@ -0,0 +1,317 @@
+# Webhooks
+
+Receive real-time notifications when email events occur (delivered, bounced, opened, received, etc.).
+
+## When to Use Webhooks
+
+- Track delivery status in your database
+- Remove bounced addresses from mailing lists
+- Trigger follow-up actions when emails are opened/clicked
+- Process inbound emails (`email.received`)
+- Create alerts for failures or complaints
+- Build custom analytics dashboards
+
+## Event Types
+
+### Email Delivery Events
+
+| Event | Trigger | Use Case |
+|-------|---------|----------|
+| `email.sent` | API request successful, delivery attempted | Confirm email accepted |
+| `email.delivered` | Email reached recipient's mail server | Confirm successful delivery |
+| `email.bounced` | Mail server permanently rejected (hard bounce) | Remove from list, alert user |
+| `email.complained` | Recipient marked as spam | Unsubscribe, review content |
+| `email.opened` | Recipient opened email | Track engagement |
+| `email.clicked` | Recipient clicked a link | Track engagement |
+| `email.delivery_delayed` | Temporary delivery issue (soft bounce) | Monitor, may resolve automatically |
+| `email.failed` | Send error (invalid recipient, quota, etc.) | Debug, alert |
+
+### Inbound Email Events
+
+| Event | Trigger | Use Case |
+|-------|---------|----------|
+| `email.received` | Email received at your inbound domain | Process incoming email, auto-reply, forward |
+
+The `email.received` payload contains metadata only (sender, recipient, subject, attachment list) — not the email body. Call `resend.emails.receiving.get()` to retrieve the body content. See [receiving.md](receiving.md) for full details.
+
+### Bounce Types
+
+| Type | Event | Action |
+|------|-------|--------|
+| **Hard bounce (Permanent)** | `email.bounced` | Remove address immediately — never retry |
+| **Soft bounce (Transient)** | `email.delivery_delayed` | Monitor — Resend retries automatically |
+| **Undetermined** | `email.bounced` | Treat as hard bounce if repeated |
+
+**Hard bounces** (`email.bounced`) are permanent failures. The address is invalid and will never accept mail. Continuing to send to hard-bounced addresses destroys your sender reputation.
+
+| Subtype | Cause |
+|---------|-------|
+| General | Recipient's email provider sent a hard bounce |
+| NoEmail | Address doesn't exist or couldn't be determined |
+
+**Soft bounces** (`email.delivery_delayed`) are temporary issues. Resend automatically retries these. If delivery ultimately fails after retries, you'll receive an `email.bounced` event.
+
+| Subtype | Cause | May Resolve If... |
+|---------|-------|-------------------|
+| General | Temporary rejection | Underlying issue clears |
+| MailboxFull | Recipient's inbox at capacity | Recipient frees space |
+| MessageTooLarge | Exceeds provider size limit | You reduce message size |
+| ContentRejected | Contains disallowed content | You modify content |
+| AttachmentRejected | Attachment type/size rejected | You modify attachment |
+
+### Other Events
+
+| Event | Trigger |
+|-------|---------|
+| `domain.created` / `updated` / `deleted` | Domain configuration changes |
+| `contact.created` / `updated` / `deleted` | Contact list changes (not from CSV imports) |
+
+## Setup
+
+1. **Create endpoint** — POST endpoint that returns HTTP 200
+2. **Add webhook** — In Resend dashboard (resend.com/webhooks), add your URL and select events
+3. **Verify signatures** — **REQUIRED** — See [Signature Verification](#signature-verification)
+4. **Test locally** — Use ngrok, Tailscale Funnel, or similar for local development
+
+### Create Webhook via API
+
+**Prefer the API** to create webhooks programmatically instead of using the dashboard. This is faster, less error-prone, and gives you the signing secret directly in the response.
+
+#### Node.js
+
+```typescript
+import { Resend } from 'resend';
+
+const resend = new Resend(process.env.RESEND_API_KEY);
+
+const { data, error } = await resend.webhooks.create({
+  endpoint: 'https://example.com/webhook',
+  events: ['email.delivered', 'email.bounced', 'email.received'],
+});
+
+if (error) {
+  console.error('Failed to create webhook:', error);
+  throw error;
+}
+
+// IMPORTANT: Store the signing secret — you need it to verify incoming webhooks
+console.log('Webhook created:', data.id);
+console.log('Signing secret:', data.signing_secret); // whsec_xxxxxxxxxx
+```
+
+#### Python
+
+```python
+import resend
+
+resend.api_key = 're_xxxxxxxxx'
+
+webhook = resend.Webhooks.create(params={
+    "endpoint": "https://example.com/webhook",
+    "events": ["email.delivered", "email.bounced", "email.received"],
+})
+
+print(f"Webhook created: {webhook['id']}")
+print(f"Signing secret: {webhook['signing_secret']}")
+```
+
+#### cURL
+
+```bash
+curl -X POST 'https://api.resend.com/webhooks' \
+  -H 'Authorization: Bearer re_xxxxxxxxx' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "endpoint": "https://example.com/webhook",
+    "events": ["email.delivered", "email.bounced", "email.received"]
+  }'
+
+# Response:
+# {
+#   "object": "webhook",
+#   "id": "4dd369bc-aa82-4ff3-97de-514ae3000ee0",
+#   "signing_secret": "whsec_xxxxxxxxxx"
+# }
+```
+
+The `signing_secret` is only returned once when you create the webhook. Store it as `RESEND_WEBHOOK_SECRET` immediately.
+
+### Webhook Management (List, Get, Update, Delete)
+
+| Operation | Node.js | Python |
+|-----------|---------|--------|
+| List | `resend.webhooks.list()` | `resend.Webhooks.list()` |
+| Get | `resend.webhooks.get(id)` | `resend.Webhooks.get(id)` |
+| Update | `resend.webhooks.update(id, params)` | `resend.Webhooks.update(params)` — `webhook_id` inside params |
+| Delete | `resend.webhooks.remove(id)` | `resend.Webhooks.remove(id)` |
+
+```typescript
+// List all webhooks
+const { data: webhooks, error: listError } = await resend.webhooks.list();
+
+// Update endpoint URL or subscribed events
+const { data: updated, error: updateError } = await resend.webhooks.update(
+  '4dd369bc-aa82-4ff3-97de-514ae3000ee0',
+  {
+    endpoint: 'https://new-domain.com/webhook',
+    events: ['email.delivered', 'email.bounced'],
+  }
+);
+
+// Delete a webhook
+const { data: deleted, error: deleteError } = await resend.webhooks.remove('4dd369bc-aa82-4ff3-97de-514ae3000ee0');
+```
+
+**Key gotchas:**
+- `signing_secret` is only in the create response — `get` does not return it
+- Update can change `endpoint` and `events` — partial updates supported
+- Use `.remove()` not `.delete()` in the Node.js SDK
+
+## Signature Verification
+
+**Verify webhook signatures on every request.** Without verification, anyone can send fake webhooks to your endpoint.
+
+### Why Verification Matters
+
+- Webhooks are unauthenticated HTTP POST requests
+- Anyone who knows your endpoint URL can send fake events
+- Verification ensures the webhook genuinely came from Resend
+- Unique signatures prevent re-use of old payloads
+
+### Required Headers
+
+Every webhook includes these headers for verification:
+
+| Header | Purpose |
+|--------|---------|
+| `svix-id` | Unique message identifier |
+| `svix-timestamp` | Unix timestamp when sent |
+| `svix-signature` | Cryptographic signature |
+
+### Get Your Webhook Secret
+
+Find your signing secret in the Resend dashboard:
+1. Go to resend.com/webhooks
+2. Click on your webhook
+3. Copy the signing secret (starts with `whsec_`)
+
+Store it securely as `RESEND_WEBHOOK_SECRET` environment variable.
+
+### Using Resend SDK (Recommended)
+
+Example using Next.js:
+
+```typescript
+import { Resend } from 'resend';
+import { NextRequest, NextResponse } from 'next/server';
+
+const resend = new Resend(process.env.RESEND_API_KEY);
+
+export async function POST(req: NextRequest) {
+  try {
+    // Important: Use raw body, not parsed JSON
+    const payload = await req.text();
+
+    // Throws an error if the webhook is invalid
+    const event = resend.webhooks.verify({
+      payload,
+      headers: {
+        'svix-id': req.headers.get('svix-id'),
+        'svix-timestamp': req.headers.get('svix-timestamp'),
+        'svix-signature': req.headers.get('svix-signature'),
+      },
+      secret: process.env.RESEND_WEBHOOK_SECRET,
+    });
+
+    switch (event.type) {
+      case 'email.delivered':
+        // Update database with delivery status
+        break;
+      case 'email.bounced':
+        // Hard bounce — remove from mailing list immediately
+        break;
+      case 'email.complained':
+        // Spam complaint — unsubscribe and flag
+        break;
+      case 'email.received':
+        // Inbound email — retrieve body and process
+        const { data: email } = await resend.emails.receiving.get(event.data.email_id);
+        break;
+      default:
+        break;
+    }
+
+    return new NextResponse('OK', { status: 200 });
+  } catch (error) {
+    console.error('Webhook verification failed:', error);
+    return new NextResponse('Invalid signature', { status: 400 });
+  }
+}
+```
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| Not verifying signatures | **Always verify** — unverified webhooks can't be trusted |
+| Using parsed JSON body | Use raw request body — JSON parsing breaks signature |
+| Using `express.json()` middleware | Use `express.raw()` for webhook routes |
+| Hardcoding webhook secret | Store in environment variable |
+| Returning non-200 status for valid webhooks | Return 200 OK to acknowledge receipt |
+
+## Retry Schedule
+
+If your endpoint doesn't return HTTP 200, Resend retries with exponential backoff:
+
+| Attempt | Delay After Failure |
+|---------|---------------------|
+| 1 | Immediate |
+| 2 | 5 seconds |
+| 3 | 5 minutes |
+| 4 | 30 minutes |
+| 5 | 2 hours |
+| 6 | 5 hours |
+| 7 | 10 hours |
+
+**Tip:** Always return 200 quickly, then process asynchronously if needed. You can manually replay failed webhooks from the dashboard.
+
+## IP Allowlist
+
+If your firewall requires allowlisting, webhooks come from:
+
+```
+44.228.126.217
+50.112.21.217
+52.24.126.164
+54.148.139.208
+```
+
+IPv6: `2600:1f24:64:8000::/52`
+
+## Local Development
+
+Use tunneling tools to test webhooks locally:
+
+```bash
+# Tailscale Funnel (recommended — permanent URL)
+sudo tailscale funnel 3000
+
+# ngrok
+ngrok http 3000
+# Then use the tunnel URL in Resend dashboard
+```
+
+## Event Payload Example
+
+```json
+{
+  "type": "email.delivered",
+  "created_at": "2024-01-15T12:00:00.000Z",
+  "data": {
+    "email_id": "ae2014de-c168-4c61-8267-70d2662a1ce1",
+    "from": "Acme <noreply@acme.com>",
+    "to": ["delivered@resend.dev"],
+    "subject": "Welcome to Acme"
+  }
+}
+```

package/dist/global-skills/reset-password/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: reset-password
+description: people who forgot their password can get a reset link and set a new one. Use when the builder says something like: forgot password; reset password; lost password; change password email.
+metadata:
+  vybekiit-generated: buyer-skill-stub
+---
+
+<!-- vybekiit:generated:buyer-skill-stub -->
+
+# Skill: reset-password
+
+**Goal:** people who forgot their password can get a reset link and set a new one.
+
+**Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
+translate every error · celebrate.
+
+> (Agent-only) Routes: `POST /api/auth/forgot-password`, `POST /api/auth/reset-password` (web) or
+> backend `/auth/forgot-password`, `/auth/reset-password`. Uses `resolveAuthProvider()` reset methods.
+
+## Steps
+
+<!-- vybekiit:page-recipe-install -->
+0. **Install the page recipe first (catalog SSOT — Option C).**
+   Copy `apps/componentLibrary/src/pageRecipes/AccountSecurityPage.tsx` export `AccountSecurityPage` into the buyer app at route `/settings/security`.
+   Recipe id: `account-security`. Preset: auth-bridge.
+   Keep every `TODO:` in the recipe and wire each one after the route renders.
+   Also reference `packages/agentKit` `getPageRecipeInstall('reset-password')` / page-recipe-manifest.json.
+   **Verify:** route builds with practice security UI before provider wiring.
+
+1. **Confirm sign-in is wired.** Run `add-signin` first if accounts are not set up yet.
+   **Verify:** existing sign-in works.
+
+2. **Wire the forgot-password screen** to `POST /api/auth/forgot-password` with `{ email }`.
+   **Verify:** practice mode returns success without real mail.
+
+3. **Wire the reset screen** (link with token) to `POST /api/auth/reset-password` with
+   `{ token, newPassword }`. On success, land signed in on the dashboard.
+   **Verify:** local dev accepts token `local-reset-token`.
+
+4. **When going live:** ensure email delivery is configured (`setup-email`) so reset links send.
+   **Verify:** real inbox receives the link.
+
+5. **Append checklist entry** via `formatChecklistEntry` (password reset flow enabled).
+
+## If anything breaks
+
+Run `doctor`. If MCP or Twilio/email tools fail once, run `vybekiit doc-fallback better-auth` and
+tell the builder: *"I'm double-checking the official setup guide for this — hang tight, I'll have
+the next step in a moment."*
+
+## Definition of done
+
+Forgot → reset → signed in works in practice mode; checklist updated.
+
+## After completing this skill
+
+Append one entry to `checklist.md` Decision log using `formatChecklistEntry({ from, to, because })`.
+
+If MCP or first debug fails once, run `vybekiit doc-fallback <tech-id>` and tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."*