vybekiit 0.4.0 → 0.6.0

package/dist/global-skills/save-data/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: save-data
+description: the app can remember things — save information and read it back later. Use when the builder says something like: save my data; remember this; store info; add a database.
+metadata:
+  vybekiit-generated: buyer-skill-stub
+---
+
+<!-- vybekiit:generated:buyer-skill-stub -->
+
+# Skill: save-data
+
+**Goal:** the app can remember things — save information and read it back later.
+
+**Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
+translate every error · celebrate. You do all the wiring; the builder only pastes a value when asked
+or describes, in plain words, what the app should remember.
+
+> (Under the hood — agent-only) Use `@vybekiit/db`'s `resolveDataProvider()` for every read/write.
+> Follow the platform wrapper for the active `DATA_PROVIDER`:
+> - `supabase` (default) → `platform-skills/supabase-vybekiit.md`
+> - `neon` → `platform-skills/neon-vybekiit.md`
+> - `railway` → `platform-skills/railway-postgres-vybekiit.md`
+> - `firebase` → `platform-skills/firebase-vybekiit.md`
+> - `mongodb` / `aws` → advanced; maintainer docs only
+
+## Steps
+
+1. **Make sure the database is ready.** Run the database tool via `vybekiit doctor`. For MCP-tier providers
+   (Supabase, Neon, Firebase), merge the matching `agent/mcp-*.json` via `agent/mcp-setup.md` and use
+   login-once onboarding. If MCP fails once, run `vybekiit doc-fallback supabase` (or `neon` /
+   `firebase`) and tell the builder you're checking the official setup guide (plain phrase only).
+   Collect any access keys **one at a time** and save them to the secret settings file.
+   **Verify:** the database is reachable (`@vybekiit/db`'s `pingDatabase`).
+
+2. **Agree on what to remember, in plain words.** If no prior `design-my-data` session, run that skill first
+   (or run `vybekiit plan-data-model entities.json` for a single simple entity). Ask what the app
+   should save; turn their answer into a simple data shape yourself.
+   **Verify:** read the shape back in one sentence and get a yes.
+
+3. **Wire saving and reading.** Use `resolveDataProvider()` for insert / get / query / update /
+   remove. Replace the dashboard's placeholder stats marker (`TODO(vybekiit): … — skill: save-data`;
+   grep them) with a real read.
+   **Verify:** the code builds with no errors.
+
+4. **Write a test** that saves a record and reads it back, and keep it green.
+
+5. **Try it for real.** Save something, then read it back in the app.
+   **Verify:** what was saved comes back exactly.
+   🎉 *Celebrate* — the app remembers things now.
+
+## If anything breaks
+
+Run `doctor`. Most issues are a missing access key or the database not reachable yet — fix it for
+them, don't explain the internals.
+
+> ⚠️ (Agent-only) If the app will have scheduled tasks (crons), they must run ≥15 min apart and
+> only during active hours — otherwise a free-tier database never auto-suspends and will exhaust
+> its compute quota, causing the entire app to go down with no way to deploy a fix until the next
+> billing cycle resets the quota.
+
+## Definition of done
+
+The app saves and reads back real data, a passing test covers it, and no save-data markers remain
+(re-grep `TODO(vybekiit)`).
+
+## After completing this skill
+
+Append one entry to `checklist.md` Decision log using `formatChecklistEntry({ from, to, because })`.
+
+If MCP or first debug fails once, run `vybekiit doc-fallback <tech-id>` and tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."*

package/dist/global-skills/sentry-sdk-setup/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: sentry-sdk-setup
+description: Set up Sentry in any language or framework. Detects the user's platform and loads the right SDK skill. Use when asked to add Sentry, install an SDK, or set up error monitoring in a project.
+license: Apache-2.0
+role: router
+---
+
+> [All Skills](../../SKILL_TREE.md)
+
+# Sentry SDK Setup
+
+Set up Sentry error monitoring, tracing, and session replay in any language or framework. This page helps you find the right SDK skill for your project.
+
+## Start Here — Read This Before Doing Anything
+
+**Do not skip this section.** Do not assume which SDK the user needs based on their project files. Do not start installing packages or creating config files until you have confirmed the user's intent.
+
+1. **Detect the platform** from project files (`package.json`, `go.mod`, `requirements.txt`, `Gemfile`, `*.csproj`, `build.gradle`, etc.).
+2. **Tell the user what you found** and which SDK you recommend.
+3. **Wait for confirmation** before reading the skill and proceeding.
+
+Each SDK skill contains its own detection logic, prerequisites, and step-by-step configuration. Trust the skill — read it carefully and follow it. Do not improvise or take shortcuts.
+
+---
+
+## SDK Skills
+
+| Platform | Skill |
+|---|---|
+| Android | [`sentry-android-sdk`](../sentry-android-sdk/SKILL.md) |
+| browser JavaScript | [`sentry-browser-sdk`](../sentry-browser-sdk/SKILL.md) |
+| Cloudflare Workers and Pages | [`sentry-cloudflare-sdk`](../sentry-cloudflare-sdk/SKILL.md) |
+| Apple platforms (iOS, macOS, tvOS, watchOS, visionOS) | [`sentry-cocoa-sdk`](../sentry-cocoa-sdk/SKILL.md) |
+| .NET | [`sentry-dotnet-sdk`](../sentry-dotnet-sdk/SKILL.md) |
+| Elixir | [`sentry-elixir-sdk`](../sentry-elixir-sdk/SKILL.md) |
+| Go | [`sentry-go-sdk`](../sentry-go-sdk/SKILL.md) |
+| NestJS | [`sentry-nestjs-sdk`](../sentry-nestjs-sdk/SKILL.md) |
+| Next.js | [`sentry-nextjs-sdk`](../sentry-nextjs-sdk/SKILL.md) |
+| Node.js, Bun, and Deno | [`sentry-node-sdk`](../sentry-node-sdk/SKILL.md) |
+| PHP | [`sentry-php-sdk`](../sentry-php-sdk/SKILL.md) |
+| Python | [`sentry-python-sdk`](../sentry-python-sdk/SKILL.md) |
+| Flutter and Dart | [`sentry-flutter-sdk`](../sentry-flutter-sdk/SKILL.md) |
+| React Native and Expo | [`sentry-react-native-sdk`](../sentry-react-native-sdk/SKILL.md) |
+| React | [`sentry-react-sdk`](../sentry-react-sdk/SKILL.md) |
+| React Router Framework | [`sentry-react-router-framework-sdk`](../sentry-react-router-framework-sdk/SKILL.md) |
+| TanStack Start React | [`sentry-tanstack-start-sdk`](../sentry-tanstack-start-sdk/SKILL.md) |
+| Ruby | [`sentry-ruby-sdk`](../sentry-ruby-sdk/SKILL.md) |
+| Svelte and SvelteKit | [`sentry-svelte-sdk`](../sentry-svelte-sdk/SKILL.md) |
+
+### Platform Detection Priority
+
+When multiple SDKs could match, prefer the more specific one:
+
+- **Android** (`build.gradle` with android plugin) → `sentry-android-sdk`
+- **Cloudflare** (`wrangler.toml` or `wrangler.jsonc`) → `sentry-cloudflare-sdk` over `sentry-node-sdk`
+- **NestJS** (`@nestjs/core`) → `sentry-nestjs-sdk` over `sentry-node-sdk`
+- **Next.js** → `sentry-nextjs-sdk` over `sentry-react-sdk` or `sentry-node-sdk`
+- **React Router Framework** (`@sentry/react-router` or `@react-router/*`) → `sentry-react-router-framework-sdk` over `sentry-react-sdk`
+- **TanStack Start React** (`@tanstack/react-start`) → `sentry-tanstack-start-sdk` over `sentry-react-sdk`
+- **Flutter** (`pubspec.yaml` with `flutter:` dependency or `sentry_flutter`) → `sentry-flutter-sdk`
+- **React Native** → `sentry-react-native-sdk` over `sentry-react-sdk`
+- **PHP** with Laravel or Symfony → `sentry-php-sdk`
+- **Elixir** (`mix.exs` detected) → `sentry-elixir-sdk`
+- **Node.js / Bun / Deno** without a specific framework → `sentry-node-sdk`
+- **Browser JS** (vanilla, jQuery, static sites) → `sentry-browser-sdk`
+- **No match** → direct user to [Sentry Docs](https://docs.sentry.io/platforms/)
+
+## Quick Lookup
+
+Match your project to a skill by keywords.
+
+| Keywords | Skill |
+|---|---|
+| android, kotlin, java, jetpack compose | [`sentry-android-sdk`](../sentry-android-sdk/SKILL.md) |
+| browser, vanilla js, javascript, jquery, cdn, wordpress, static site | [`sentry-browser-sdk`](../sentry-browser-sdk/SKILL.md) |
+| cloudflare, cloudflare workers, cloudflare pages, wrangler, durable objects, d1 | [`sentry-cloudflare-sdk`](../sentry-cloudflare-sdk/SKILL.md) |
+| ios, macos, swift, cocoa, tvos, watchos, visionos, swiftui, uikit | [`sentry-cocoa-sdk`](../sentry-cocoa-sdk/SKILL.md) |
+| .net, csharp, c#, asp.net, maui, wpf, winforms, blazor, azure functions | [`sentry-dotnet-sdk`](../sentry-dotnet-sdk/SKILL.md) |
+| go, golang, gin, echo, fiber | [`sentry-go-sdk`](../sentry-go-sdk/SKILL.md) |
+| elixir, phoenix, plug, oban | [`sentry-elixir-sdk`](../sentry-elixir-sdk/SKILL.md) |
+| nestjs, nest | [`sentry-nestjs-sdk`](../sentry-nestjs-sdk/SKILL.md) |
+| nextjs, next.js, next | [`sentry-nextjs-sdk`](../sentry-nextjs-sdk/SKILL.md) |
+| node, nodejs, node.js, bun, deno, express, fastify, koa, hapi | [`sentry-node-sdk`](../sentry-node-sdk/SKILL.md) |
+| php, laravel, symfony | [`sentry-php-sdk`](../sentry-php-sdk/SKILL.md) |
+| python, django, flask, fastapi, celery, starlette | [`sentry-python-sdk`](../sentry-python-sdk/SKILL.md) |
+| flutter, dart, pubspec | [`sentry-flutter-sdk`](../sentry-flutter-sdk/SKILL.md) |
+| react native, expo | [`sentry-react-native-sdk`](../sentry-react-native-sdk/SKILL.md) |
+| react, react router, tanstack, redux, vite | [`sentry-react-sdk`](../sentry-react-sdk/SKILL.md) |
+| react-router framework, @sentry/react-router, @react-router/dev, react-router reveal | [`sentry-react-router-framework-sdk`](../sentry-react-router-framework-sdk/SKILL.md) |
+| tanstack start, tanstack react start, @tanstack/react-start, tanstackstart-react | [`sentry-tanstack-start-sdk`](../sentry-tanstack-start-sdk/SKILL.md) |
+| ruby, rails, sinatra, sidekiq, rack | [`sentry-ruby-sdk`](../sentry-ruby-sdk/SKILL.md) |
+| svelte, sveltekit | [`sentry-svelte-sdk`](../sentry-svelte-sdk/SKILL.md) |
+
+---
+
+## Finding the DSN
+
+If the user doesn't have their DSN, guide them to find it:
+
+1. Open the Sentry project settings page: `https://sentry.io/settings/projects/`
+2. Select the project
+3. Click **"Client Keys (DSN)"** in the left sidebar
+4. Copy the DSN
+
+You can help the user open the page directly:
+```bash
+open https://sentry.io/settings/projects/        # macOS
+xdg-open https://sentry.io/settings/projects/    # Linux
+start https://sentry.io/settings/projects/        # Windows
+```
+
+> **Note:** The DSN is public and safe to include in source code. It is not a secret — it only identifies where to send events.
+
+---
+
+Looking for workflows or feature configuration instead? See the [full Skill Tree](../../SKILL_TREE.md).

package/dist/global-skills/sentry-workflow/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: sentry-workflow
+description: Keep Sentry SDKs up to date. Use when asked to upgrade the Sentry SDK across major versions, migrate SDK versions, or fix deprecated APIs.
+license: Apache-2.0
+role: router
+---
+
+> [All Skills](../../SKILL_TREE.md)
+
+# Sentry Workflows
+
+Keep your Sentry SDK up to date. This page helps you find the right workflow skill for your task.
+
+## Start Here — Read This Before Doing Anything
+
+- If the user mentions **upgrading Sentry, migrating SDK versions, or fixing deprecated APIs** → `sentry-sdk-upgrade`
+
+> Fixing or investigating a production issue? That's the standalone `sentry-debug-issue` skill.
+
+---
+
+## Workflow Skills
+
+| Use when | Skill |
+|---|---|
+| Upgrading the Sentry JavaScript SDK — migration guides, breaking changes, deprecated APIs | [`sentry-sdk-upgrade`](../sentry-sdk-upgrade/SKILL.md) |
+
+Each skill contains its own detection logic, prerequisites, and step-by-step instructions. Trust the skill — read it carefully and follow it. Do not improvise or take shortcuts.
+
+---
+
+Looking for SDK setup or feature configuration instead? See the [full Skill Tree](../../SKILL_TREE.md).

package/dist/global-skills/setup-email/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: setup-email
+description: the app can send emails — welcome notes, receipts, and sign-in codes. Use when the builder says something like: send emails; email my users; set up email.
+metadata:
+  vybekiit-generated: buyer-skill-stub
+---
+
+<!-- vybekiit:generated:buyer-skill-stub -->
+
+# Skill: setup-email
+
+**Goal:** the app can send emails — welcome notes, receipts, and sign-in codes.
+
+**Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
+translate every error · celebrate. You wire all the sending; the builder only confirms one detail
+when asked.
+
+> (Under the hood — agent-only) Send through `@vybekiit/email`'s `resolveEmailProvider()`. Read
+> `EMAIL_PROVIDER` and follow the matching platform wrapper:
+> - default / `cloudflare` → `platform-skills/cloudflare-email-vybekiit.md`
+> - `resend` → `platform-skills/resend-vybekiit.md`
+> - `ses` → `platform-skills/ses-vybekiit.md`
+> Same skill, whichever is set — never name the service to the builder.
+
+## Steps
+
+<!-- vybekiit:page-recipe-install -->
+0. **Install the page recipe first (catalog SSOT — Option C).**
+   Copy `apps/componentLibrary/src/pageRecipes/EmailNotificationsPage.tsx` export `EmailNotificationsPage` into the buyer app at route `/dashboard/email`.
+   Recipe id: `email-notifications`. Presets: notifications_log.
+   Keep every `TODO:` in the recipe and wire each one after the route renders.
+   Also reference `packages/agentKit` `getPageRecipeInstall('setup-email')` / page-recipe-manifest.json.
+   **Verify:** route builds and shows practice UI before provider wiring.
+
+
+1. **Confirm the one sending detail.** Ask for (or guide them to set up) a verified sender address —
+   the "from" address their app's emails come from. Tell them exactly where to confirm it, then save
+   it to the secret settings file.
+   **Verify:** the sender address is set and confirmed.
+
+2. **Wire sending.** Connect the app's email sending to `resolveEmailProvider()` (see wrapper for
+   provider-specific keys).
+   **Verify:** the code builds with no errors.
+
+3. **Send a test email to the builder.** Send one real email to the builder's own address.
+   **Verify:** ask them to confirm it arrived (check spam too). Don't continue until they say yes.
+   🎉 *Celebrate* — the app can send email now.
+
+4. **Connect it where it's needed.** Hook sending into the right moments — for example, the sign-in
+   code email used by `add-signin`, a welcome email, or a receipt after a purchase.
+   **Verify:** the connected email actually sends in that flow.
+
+5. **Write a test** for the sending path, and keep it green.
+
+## If anything breaks
+
+Run `doctor`. Most issues are an unverified sender address or a missing access key — fix it for
+them, don't explain the internals.
+
+## Definition of done
+
+A test email arrives, email is connected where the app needs it, and a passing test covers the
+sending path.
+
+## After completing this skill
+
+Append one entry to `checklist.md` Decision log using `formatChecklistEntry({ from, to, because })`.
+
+If MCP or first debug fails once, run `vybekiit doc-fallback <tech-id>` and tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."*

package/dist/global-skills/setup-payments/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: setup-payments
+description: the builder can take real money. By the end, a test purchase succeeds end-to-end. Use when the builder says something like: add payments; take money; sell something; charge people.
+metadata:
+  vybekiit-generated: buyer-skill-stub
+---
+
+<!-- vybekiit:generated:buyer-skill-stub -->
+
+# Skill: setup-payments
+
+**Goal:** the builder can take real money. By the end, a test purchase succeeds end-to-end.
+
+**Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
+translate every error · celebrate. You wire all the code; the builder only signs in once when asked.
+
+> Why Lemon Squeezy is the default: it's the "merchant of record", which means **it handles sales
+> tax/VAT for the builder** automatically.
+>
+> (Agent-only) Read `PAYMENTS_PROVIDER` and follow the matching platform wrapper:
+> - default / `lemon-squeezy` → `platform-skills/lemon-squeezy-vybekiit.md`
+> - `stripe` → `platform-skills/stripe-vybekiit.md`
+> - `paypal` → `platform-skills/paypal-vybekiit.md`
+> All paths use `@vybekiit/payments` → `resolvePaymentProvider()`.
+
+## Steps
+
+<!-- vybekiit:page-recipe-install -->
+0. **Install the page recipe first (catalog SSOT — Option C).**
+   Copy `apps/componentLibrary/src/pageRecipes/PricingPage.tsx` export `PricingPage` into the buyer app at route `/pricing`.
+   Recipe id: `pricing`. Presets: orders + webhook_events (apply after provider secrets exist).
+   Keep every `TODO:` in the recipe and wire each one after the route renders.
+   Selling physical/digital goods (not only subscriptions)? Also install catalog ids
+   `commerce-products`, `commerce-cart`, `commerce-checkout` via `getPageRecipeInstall`.
+   Also reference `packages/agentKit` `getPageRecipeInstall('setup-payments')` / page-recipe-manifest.json.
+   **Verify:** `/pricing` builds and shows practice plans before provider wiring.
+
+1. **Explain the plan in one line.** *"I'll connect a payment service so you can charge people. I'll do
+   the setup — you'll sign in once when I ask."* (Never name Lemon Squeezy, Stripe, or PayPal.)
+
+2. **Lemon Squeezy (default) — sign-in only.**
+   - Run `vybekiit-automate ls standby` (or wizard mode without `--json`).
+   - Builder signs in at the payment dashboard (only manual step).
+   - Builder says *"I'm in, proceed"*.
+   - Run `vybekiit-automate ls setup --json` with name, price, mode, webhook URL from the conversation.
+   - Write JSON output to `.env` (`LEMONSQUEEZY_STORE_ID`, variant ID, API key, webhook secret).
+   **Verify:** values saved; product exists in test mode.
+
+3. **Stripe (opt-in).** Merge `mcp-stripe.json` via `agent/mcp-setup.md`; builder OAuth once.
+   Agent creates product/price via Stripe MCP; write restricted API key to `.env`.
+   **Verify:** test mode product visible in Stripe dashboard.
+
+4. **PayPal (opt-in).** Merge `mcp-paypal.json` via `agent/mcp-setup.md`; builder OAuth once (sandbox).
+   Agent provisions via PayPal MCP; write client id/secret and webhook id to `.env`.
+   **Verify:** sandbox checkout completes.
+
+5. **Connect the automatic payment message (webhook).** Webhook URL is `/api/webhook` on the deployed app
+   (`app/api/webhook/route.ts` → `src/lib/fulfillment.ts`). For LS, `ls setup` configures this when given
+   `--webhook-url`.
+   **Apply DB presets:** run `vybekiit apply-preset orders` and `vybekiit apply-preset webhook_events`
+   (see `platform-skills/db-presets-vybekiit.md`). **Verify:** `vybekiit verify-presets orders webhook_events`.
+   **Verify:** provider shows webhook connected.
+
+6. **Test a purchase.** Use test mode for a fake purchase.
+   **Verify:** order recorded (webhook success). 🎉 *Celebrate* — they can take money.
+
+7. **Customize what a purchase does.** Ask what should happen when someone pays. Implement in
+   `src/lib/fulfillment.ts`. Write a quick test and keep it green.
+
+## If anything breaks
+
+Run `doctor`. Common cause: webhook secret mismatch or values with extra spaces — fix it for them.
+
+## Definition of done
+
+A test purchase completes and does the right thing, with secrets saved and a passing test covering the flow.
+
+## After completing this skill
+
+Append one entry to `checklist.md` Decision log using `formatChecklistEntry({ from, to, because })`.
+
+If MCP or first debug fails once, run `vybekiit doc-fallback <tech-id>` and tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."*

package/dist/global-skills/setup-sms/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: setup-sms
+description: text messages (and optional WhatsApp) work for sign-in codes and alerts. Use when the builder says something like: set up sms; text messages; twilio; whatsapp messages; send texts.
+metadata:
+  vybekiit-generated: buyer-skill-stub
+---
+
+<!-- vybekiit:generated:buyer-skill-stub -->
+
+# Skill: setup-sms
+
+**Goal:** text messages (and optional WhatsApp) work for sign-in codes and alerts.
+
+**Contract:** one action at a time · verify-before-advance · plain language · translate errors · celebrate.
+
+> (Agent-only) Merge `mcp-twilio-docs.json` and optionally `mcp-twilio-alpha.json`. Env keys in
+> `.env.example` with `# Docs:` links. Provider: `@vybekiit/notifications` Twilio adapter.
+
+## Steps
+
+1. **Collect Twilio secret settings** through doctor (never ask the builder to type SIDs by hand):
+   `TWILIO_ACCOUNT_SID`, `TWILIO_AUTH_TOKEN`, `TWILIO_FROM_NUMBER`. Optional:
+   `TWILIO_VERIFY_SERVICE_SID`, `TWILIO_WHATSAPP_FROM`.
+   **Verify:** values saved to `.env`.
+
+2. **Set `NOTIFICATIONS_PROVIDER=twilio`.**
+   **Verify:** `resolveNotificationsProvider()` does not throw.
+
+3. **Merge Twilio MCP snippets** per `mcp-setup.md` for your assistant client.
+   **Verify:** docs MCP connects, or on failure run `vybekiit doc-fallback twilio`.
+
+4. **Send a test code** via `sign-in-with-phone` or a smoke call to Verify/Messaging API.
+   **Verify:** message received or practice code `000000` works locally.
+
+5. **Append checklist entry** (SMS provider wired).
+
+## If MCP or first debug fails once
+
+Run `vybekiit doc-fallback twilio` (JSON with official URLs). Tell the builder:
+*"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a
+moment."*
+
+## Definition of done
+
+Twilio env filled; notifications provider resolves; test send works; checklist updated.
+
+## After completing this skill
+
+Append one entry to `checklist.md` Decision log using `formatChecklistEntry({ from, to, because })`.
+
+If MCP or first debug fails once, run `vybekiit doc-fallback <tech-id>` and tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."*

package/dist/global-skills/sign-in-with-email-link/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: sign-in-with-email-link
+description: people can sign in with a one-click email link (no password). Use when the builder says something like: magic link; email link sign in; sign in without password; passwordless email.
+metadata:
+  vybekiit-generated: buyer-skill-stub
+---
+
+<!-- vybekiit:generated:buyer-skill-stub -->
+
+# Skill: sign-in-with-email-link
+
+**Goal:** people can sign in with a one-click email link (no password).
+
+**Contract:** one action at a time · verify-before-advance · plain language · translate errors · celebrate.
+
+> (Agent-only) Routes: `POST /api/auth/magic-link`, `POST /api/auth/magic-link/verify`.
+
+## Steps
+
+<!-- vybekiit:page-recipe-install -->
+0. **Install / extend the auth page recipe first (catalog SSOT — Option C).**
+   Copy or extend `apps/componentLibrary/src/pageRecipes/AuthPage.tsx` export `AuthPage` at route `/login`
+   with a "Email me a link" path. Recipe id: `auth`. Preset: auth-bridge.
+   Keep every `TODO:` in the recipe and wire each one after the route renders.
+   Also reference `packages/agentKit` `getPageRecipeInstall('sign-in-with-email-link')` / page-recipe-manifest.json.
+   **Verify:** `/login` shows a practice magic-link entry before provider wiring.
+
+1. **Confirm sign-in + email are wired** (`add-signin`, `setup-email` when going live).
+   **Verify:** email OTP or password sign-in already works.
+
+2. **Add "Email me a link"** on the login screen → `POST /api/auth/magic-link` with `{ email }`.
+   **Verify:** practice mode succeeds.
+
+3. **Handle the return link** → `POST /api/auth/magic-link/verify` with `{ token }`. Local dev token:
+   `local-magic-token`.
+   **Verify:** lands on dashboard signed in.
+
+4. **Append checklist entry** (magic link sign-in enabled).
+
+## If anything breaks
+
+Run `vybekiit doc-fallback better-auth` on first MCP/debug failure; use the plain stuck phrase from
+`formatBuilderStuckMessage()` — never say MCP to the builder.
+
+## Definition of done
+
+Request link → verify → dashboard; checklist updated.
+
+## After completing this skill
+
+Append one entry to `checklist.md` Decision log using `formatChecklistEntry({ from, to, because })`.
+
+If MCP or first debug fails once, run `vybekiit doc-fallback <tech-id>` and tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."*

package/dist/global-skills/sign-in-with-google/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: sign-in-with-google
+description: people can tap **Continue with Google** — one button that signs them in **or** creates. Use when the builder says something like: sign in with google; continue with google.
+metadata:
+  vybekiit-generated: buyer-skill-stub
+---
+
+<!-- vybekiit:generated:buyer-skill-stub -->
+
+# Skill: sign-in-with-google
+
+**Goal:** people can tap **Continue with Google** — one button that signs them in **or** creates
+their account. By the end, new and returning users both reach the dashboard.
+
+**Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
+translate every error · celebrate. You wire all the code; the builder only approves when a step
+needs it.
+
+> (Under the hood — agent-only) Web uses better-auth Google social provider. Mobile and extension
+> send a Google token to your backend verifier endpoint — see their platform skills.
+
+## Steps
+
+<!-- vybekiit:page-recipe-install -->
+0. **Install / extend the auth page recipe first (catalog SSOT — Option C).**
+   Copy or extend `apps/componentLibrary/src/pageRecipes/AuthPage.tsx` export `AuthPage` at route `/login`
+   with a **Continue with Google** button. Recipe id: `auth`. Preset: auth-bridge.
+   Legal pages when needed: `TermsOfServicePage` → `/terms`, `PrivacyPolicyPage` → `/privacy`
+   from the page-recipe manifest (group `legal`).
+   Keep every `TODO:` in the recipe and wire each one after the route renders.
+   Also reference `packages/agentKit` `getPageRecipeInstall('sign-in-with-google')` / page-recipe-manifest.json.
+   **Verify:** `/login` shows practice Google button before provider wiring.
+
+1. **Make sure the basics exist.** Database (`save-data`) and base sign-in (`add-signin`) must work
+   first — Google builds on top.
+   **Verify:** a real email/password account can sign up and reach the dashboard.
+
+2. **Set up the tools.** Run `vybekiit doctor` — it installs `gcloud` and checks you're signed in.
+   If it says "not signed in yet," walk the builder through the one command it prints.
+   **Verify:** doctor reports gcloud ready.
+
+3. **Create the Google login for your app.** Use `gcloud` to create a **Web application** OAuth client.
+   Write `GOOGLE_OAUTH_CLIENT_ID`, `GOOGLE_OAUTH_CLIENT_SECRET`, and `GOOGLE_OAUTH_REDIRECT_URI`
+   to `.env`. Never ask the builder to open the Google Cloud console.
+   **Verify:** all three values are non-empty in `.env`.
+
+4. **Enable Google on the sign-in handler.** Follow `platform-skills/better-auth-vybekiit.md` — add
+   the Google social provider to the auth route. One flow handles sign-in and sign-up.
+   **Verify:** the app builds; the Google button appears on login.
+
+5. **Add the token verifier for phone + extension.** Extend the auth API so mobile (`expo-auth-session`)
+   and extension (`chrome.identity`) can POST a Google ID token and receive a session. Same user
+   record for all platforms.
+   **Verify:** a test token exchange returns a session (or a clear error when misconfigured).
+
+6. **Try it for real.** Sign in with Google on the web — new account and returning user both work.
+   🎉 *Celebrate* — people can now use Google in one tap.
+
+## Definition of done
+
+Continue with Google works on web (sign-in and sign-up); backend verifier exists for mobile/extension;
+`GOOGLE_OAUTH_*` populated; doctor green on gcloud.
+
+## After completing this skill
+
+Append one entry to `checklist.md` Decision log using `formatChecklistEntry({ from, to, because })`.
+
+If MCP or first debug fails once, run `vybekiit doc-fallback <tech-id>` and tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."*

package/dist/global-skills/sign-in-with-phone/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: sign-in-with-phone
+description: people can sign in with a text message code. Use when the builder says something like: sign in with phone; text me a code; sms login; phone number login.
+metadata:
+  vybekiit-generated: buyer-skill-stub
+---
+
+<!-- vybekiit:generated:buyer-skill-stub -->
+
+# Skill: sign-in-with-phone
+
+**Goal:** people can sign in with a text message code.
+
+**Contract:** one action at a time · verify-before-advance · plain language · translate errors · celebrate.
+
+> (Agent-only) Routes: `POST /api/auth/send-sms-code`, `POST /api/auth/verify-sms-code`. Twilio via
+> `@vybekiit/auth` + `@vybekiit/notifications`.
+
+## Steps
+
+<!-- vybekiit:page-recipe-install -->
+0. **Install / extend the auth page recipe first (catalog SSOT — Option C).**
+   Copy or extend `apps/componentLibrary/src/pageRecipes/AuthPage.tsx` export `AuthPage` at route `/login`
+   with phone + code UI. Recipe id: `auth`. Preset: auth-bridge.
+   Keep every `TODO:` in the recipe and wire each one after the route renders.
+   Also reference `packages/agentKit` `getPageRecipeInstall('sign-in-with-phone')` / page-recipe-manifest.json.
+   **Verify:** `/login` shows practice phone sign-in UI before provider wiring.
+
+1. **Run `setup-sms` first** if Twilio secret settings are not filled in.
+   **Verify:** `NOTIFICATIONS_PROVIDER=twilio` and Twilio keys in `.env`.
+
+2. **Add phone + code UI** on login → send code, then verify.
+   **Verify:** practice mode accepts code `000000` with empty Twilio settings.
+
+3. **Try a real number** when Twilio is configured.
+   **Verify:** SMS arrives and code signs the user in.
+
+4. **Append checklist entry** (phone sign-in enabled).
+
+## If anything breaks
+
+Run `vybekiit doc-fallback twilio` once; tell the builder you're checking the official setup guide
+(plain phrase only).
+
+## Definition of done
+
+Send code → verify → dashboard; checklist updated.
+
+## After completing this skill
+
+Append one entry to `checklist.md` Decision log using `formatChecklistEntry({ from, to, because })`.
+
+If MCP or first debug fails once, run `vybekiit doc-fallback <tech-id>` and tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."*

package/dist/global-skills/stripe-best-practices/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: stripe-best-practices
+description: >-
+  Guides Stripe integration decisions — API selection (Checkout Sessions vs
+  PaymentIntents), Connect platform setup (Accounts v2, controller properties),
+  billing/subscriptions, Treasury financial accounts, integration surfaces
+  (Checkout, Payment Element), migrating from deprecated Stripe APIs, and
+  security best practices (API key management, restricted keys, webhooks,
+  OAuth). Use when building, modifying, or reviewing any Stripe integration —
+  including accepting payments, building marketplaces, integrating Stripe,
+  processing payments, setting up subscriptions, creating connected accounts, or
+  implementing secure key handling.
+
+---
+
+Latest Stripe API version: **2026-06-24.dahlia**. Always use the latest API version and SDK unless the user specifies otherwise.
+
+If you do not have a Stripe account, you can call a CLI command to generate working API keys with no registration required. You can install the Stripe CLI (`npm i -g @stripe/cli`) and run the command `stripe sandbox create` to get started.
+
+API key default: Always recommend a [restricted API key (RAK)](https://docs.stripe.com/keys/restricted-api-keys.md) (`rk_` prefix) over a secret key (`sk_` prefix).
+
+## Integration routing
+
+| Building… | Recommended API | Details |
+| --- | --- | --- |
+| One-time payments | Checkout Sessions | <references/payments.md> |
+| Custom payment form with embedded UI | Checkout Sessions + Payment Element | <references/payments.md> |
+| Saving a payment method for later | Setup Intents | <references/payments.md> |
+| Connect platform or marketplace | Accounts v2 (`/v2/core/accounts`) | <references/connect.md> |
+| Usage-based billing (new integration) | Metronome | <references/billing.md> |
+| Subscriptions or recurring billing | Billing APIs + Checkout Sessions | <references/billing.md> |
+| Sales tax, VAT, or GST compliance | Stripe Tax + Registrations API | <references/tax.md> |
+| Embedded financial accounts / banking | v2 Financial Accounts | <references/treasury.md> |
+| Security (key management, RAKs, webhooks, OAuth, 2FA, Connect liability) | See security reference | <references/security.md> |
+
+Read the relevant reference file before answering any integration question or writing code.
+
+## Critical rules
+
+- *Never include `payment_method_types` in any Stripe API call*, with one exception: Terminal (in-person payments) integrations must pass `payment_method_types: ['card_present']` on the PaymentIntent. For all other integrations, omit this parameter entirely to enable dynamic payment methods, which enables you to configure payment method settings from the Dashboard and dynamically display the most relevant eligible payment methods to each customer to maximize conversion. To customize which payment methods you accept, use [`payment_method_configurations`](https://docs.stripe.com/payments/payment-method-configurations.md) or `excluded_payment_method_types` instead of `payment_method_types`.
+
+## Key documentation
+
+When the user’s request does not clearly fit a single domain above, consult:
+
+- [Integration Options](https://docs.stripe.com/payments/payment-methods/integration-options.md) — Start here when designing any integration.
+- [API Tour](https://docs.stripe.com/payments-api/tour.md) — Overview of Stripe’s API surface.
+- [Go Live Checklist](https://docs.stripe.com/get-started/checklist/go-live.md) — Review before launching.