vybekiit 0.7.28 → 0.7.29

package/dist/global-skills/vybekiitReferences/web/platform-skills/format-lint-vybekiit.md

@@ -0,0 +1,33 @@
+# Platform wrapper: format + lint (agent-only)
+
+**Agent-only.** Keep the codebase tidy — the builder never runs the linter or formatter.
+
+## When
+
+After every substantive edit; once after first `pnpm install` during onboarding (quality smoke).
+
+## How
+
+```bash
+pnpm format    # biome check --write .
+pnpm lint      # biome check .
+```
+
+Or the full loop:
+
+```bash
+pnpm verify   # format → lint → typecheck → test
+```
+
+Optional agent wrapper: `node scripts/checkQuality.mjs`
+
+## Rules
+
+1. **Never ask the builder** to run lint or format — you do it silently.
+2. Biome **warn** rules (function length, complexity) are soft — fix obvious ones; don't block ship on style warnings unless egregious.
+3. If lint fails on a real error, fix it and re-run. Translate one plain fix if you must mention something to the builder (rare).
+4. **Pre-push only** — buyer templates ship an identical husky **pre-push** hook (not pre-commit). The builder never pushes; the agent does. The hook runs `pnpm verify` before push succeeds.
+
+## Verify
+
+`pnpm lint` exits 0 (warnings OK). Full smoke: `pnpm verify`.

package/dist/global-skills/vybekiitReferences/web/platform-skills/github-vybekiit.md

@@ -0,0 +1,47 @@
+# Platform wrapper: GitHub backup (agent-only)
+
+**Agent-only.** Save the builder's project on GitHub — invoked by buyer skill `back-up-my-code`, not by git jargon.
+
+## Prerequisites
+
+- `gh` CLI installed (`vybekiit doctor` checks this)
+- Builder has a **GitHub account** — `gh` does **not** create accounts. If they don't have one, walk them through signup at github.com one step at a time in plain language.
+
+## Sign in
+
+If doctor reports not signed in:
+
+```bash
+gh auth login --web
+```
+
+Browser opens → builder clicks approve.
+
+## Backup flow
+
+1. `git init` (if no repo yet) — `.gitignore` already ships
+2. Stage all project files (never commit `.env` — it's gitignored)
+3. First commit with a plain message, e.g. "Initial save"
+4. Create **private** repo and push:
+
+```bash
+gh repo create <repo-name> --private --source=. --remote=origin --push
+```
+
+5. Open `https://github.com/<user>/<repo>` and confirm files are there
+6. Give the builder the link in plain words — *"Your project is saved online here."*
+
+## Later saves (PR flow)
+
+For ongoing work after the first backup, use `ship-via-pr-vybekiit.md` — branch, push, wait for the **online checker** on all three operating systems, then merge. The builder hears *"Your latest work is saved and checked."*
+
+## Rules
+
+- Default to **private** repos unless the builder explicitly wants public
+- Never paste secrets into commits or chat
+- Never claim backup worked without verifying on github.com
+- Do not run this in doctor by default — only when the builder asks or after meaningful progress (optional nudge in onboarding)
+
+## Verify
+
+`gh repo view` shows the remote · latest commit visible on GitHub · builder has the URL

package/dist/global-skills/vybekiitReferences/web/platform-skills/i18n-vybekiit.md

@@ -0,0 +1,3 @@
+# i18n-vybekiit
+
+Use `resolve*Provider()` from `@vybekiit/i18n` — see package README and ADR-0012.

package/dist/global-skills/vybekiitReferences/web/platform-skills/jobs-vybekiit.md

@@ -0,0 +1,3 @@
+# jobs-vybekiit
+
+Use `resolve*Provider()` from `@vybekiit/jobs` — see package README and ADR-0012.

package/dist/global-skills/vybekiitReferences/web/platform-skills/kv-vybekiit.md

@@ -0,0 +1,3 @@
+# kv-vybekiit
+
+Use `resolve*Provider()` from `@vybekiit/kv` — see package README and ADR-0012.

package/dist/global-skills/vybekiitReferences/web/platform-skills/lemon-squeezy-vybekiit.md

@@ -0,0 +1,30 @@
+# Platform wrapper: Lemon Squeezy (default payments)
+
+**Agent-only.** Invoked by buyer skill `setup-payments`.
+
+## Official upstream
+
+- Docs: https://docs.lemonsqueezy.com
+- **Freshness note:** `@lemonsqueezy/lemonsqueezy.js` npm publish is stale (Nov 2024) — no vendor skills.sh repo. Rely on `@vybekiit/payments` adapter + `browser-automation-vybekiit.md`; check https://docs.lemonsqueezy.com/help/changelog before API changes.
+
+## Kit wiring
+
+1. Payments via `@vybekiit/payments` → `resolvePaymentProvider()` (LS when `PAYMENTS_PROVIDER` default)
+2. Dashboard provisioning via `@vybekiit/browser-automation` **`ls` target** (codename fresh-squeezy):
+   - `vybekiit-automate ls standby` — builder signs in only (`$HOME/.ls-chrome-profile`)
+   - `vybekiit-automate ls setup --json --name … --price-cents … --mode test|live --webhook-url …`
+3. Write CLI JSON to `.env`: `LEMONSQUEEZY_API_KEY`, `LEMONSQUEEZY_STORE_ID`, variant ID, webhook secret
+4. Webhook route at `app/api/webhook/route.ts`; fulfillment in `src/lib/fulfillment.ts`
+5. Replace `TODO(vybekiit): … — skill: setup-payments` markers
+
+See also `platform-skills/browser-automation-vybekiit.md` for CLI modes (`--json` vs wizard).
+
+## Verify-before-advance
+
+- Test checkout opens; webhook receives event (test mode OK)
+- Order recorded in database; builder sees success in app
+
+## Selector registry
+
+LS DOM selectors live in `@vybekiit/browser-automation` `targets/lemon-squeezy/selectors/`. If setup throws
+`SelectorMissingError`, update registry from a recorded session (maintainer pass).

package/dist/global-skills/vybekiitReferences/web/platform-skills/mcp-tools-vybekiit.md

@@ -0,0 +1,87 @@
+# Platform wrapper: kit MCP tools
+
+**Agent-only.** Catalog of every first-party MCP tool VybeKiit ships. Read this file locally or load via MCP `get_skill` / `list_platform_skills` (`mcp-tools-vybekiit` / `use-kit-mcp`).
+
+Never name MCP, tool ids, or package paths to the builder. Prefer **search → get** (slim pages, then detail).
+
+## Server
+
+| Server key | Package | Bin | Purpose |
+|------------|---------|-----|---------|
+| `vybekiit` | `@vybekiit/agent-mcp` | `vybekiit-agent-mcp` | Skills, CLI catalog, doctor tools, doc-fallback, browser automations, mirrored UI catalog |
+
+Snippet: `.vybekiit/agent/mcp-agent.json`. Setup: `.vybekiit/agent/mcp-setup.md`.
+Auto-discovered skill: `.agents/skills/use-kit-mcp/SKILL.md`.
+
+## Env
+
+| Variable | Meaning |
+|----------|---------|
+| `VYBEKIIT_PROJECT_ROOT` | Project root for skill reads + automation cwd (default cwd) |
+| `VYBEKIIT_UI_CATALOG_PATH` | Path to `ui-catalog-index.json` |
+| `VYBEKIIT_AUTOMATE_BIN` | Optional absolute path to `vybekiit-automate` |
+
+## Context controls
+
+- Cursor pagination: `limit` / `cursor` / response `nextCursor` + `hasMore` + `total`
+- Prefer slim rows; request full detail only when needed (`fields=slim|full` on UI tools)
+- Automations: `run_automation({ dryRun: true })` before a real browser session
+
+## Tools
+
+| Tool | Description | Required | Optional | When to use |
+|------|-------------|----------|----------|-------------|
+| `search_skills` | Fuzzy-search buyer goals/skills (goal-index SSOT). Paginated slim rows. | query | template, limit, cursor | Before opening skill files; empty query lists all goals for the template. |
+| `get_skill` | Load one skill by goal id or stem (excerpt by default). | id | template, excerptLines | After search_skills picks a row; also loads use-kit-mcp / platform wrappers. |
+| `list_platform_skills` | List/search `.vybekiit/platform-skills/*` wrappers (paginated). | — | query, limit, cursor | Find provider wrappers (stripe, railway, mcp-tools-vybekiit, …). |
+| `search_commands` | Fuzzy-search vybekiit CLI verbs. Returns usage — run via shell, not MCP. | query | limit, cursor | Discover CLI verbs (doctor, create app, automate, …). |
+| `get_command` | Get one CLI command by exact name from the catalog. | name | — | After search_commands when you know the exact verb name. |
+| `search_doctor_tools` | List doctor toolchain entries (`vybekiit doctor --ensure <name>`). Does not run doctor. | query | limit, cursor | Before ensuring CLIs (gh, wrangler, supabase, …). |
+| `search_tech_ids` | Fuzzy-search known tech ids before doc_fallback. | query | limit, cursor | Pick a tech id for official docs after one failed MCP/debug attempt. |
+| `doc_fallback` | Official docs + env key hints. Never name MCP to the builder — use builderMessage. | techId | — | MCP or first debug failed once; same as `vybekiit doc-fallback <tech-id>`. |
+| `search_automations` | Fuzzy-search vybekiit-automate browser verbs (ls, cws, nc, …). Paginated. | query | limit, cursor | Before run_automation; empty query lists the catalog. |
+| `get_automation` | Get one automation by domain (+ command) or id (`ls:setup`). | domain | command | Inspect usage string for a known domain/verb. |
+| `run_automation` | Run vybekiit-automate from any project root (resolves bin). Always --json. Prefer dryRun first. Google redirect_uri_mismatch → domain=google command=oauth with --redirect incl. localhost. | domain, command | args, dryRun, yes, cdp, profile, timeoutMs | Execute browser automations anywhere; OAuth 400 redirect_uri_mismatch; dryRun=true to preview argv only. |
+| `search_ui_components` | Fuzzy-search mirrored UI components. Page envelope; default fields=slim. | query | source, limit, cursor, fields | Find blocks by intent/name; slim first, then get_ui_component. |
+| `get_ui_component` | Get one mirrored component by source namespace + slug. | source, name | — | Full detail after search_ui_components. |
+| `suggest_ui_blend` | Ranked multi-source component suggestions for a natural-language UI intent. | intent | limit | Builder wants a composed look (hero + pricing + marquee, …). |
+| `list_ui_sources` | List mirrored UI source namespaces and component counts. | — | — | See which registries are in the local catalog index. |
+
+## Browser automations (from any folder)
+
+```
+search_automations({ query: "lemon squeezy" })
+run_automation({ domain: "ls", command: "setup", dryRun: true })
+run_automation({ domain: "ls", command: "standby" })
+// Google Error 400 redirect_uri_mismatch / Auth.js localhost — args only, no Console babysitting:
+search_automations({ query: "redirect_uri_mismatch" })
+run_automation({ domain: "google", command: "oauth", args: [
+  "--project=my-app", "--app-name=MyApp", "--support-email=you@gmail.com",
+  "--app-url=https://example.com",
+  "--redirect=https://example.com/api/auth/callback/google",
+  "--redirect=http://localhost:3000/api/auth/callback/google",
+]})
+```
+
+Shell equivalent:
+
+```
+vybekiit-automate catalog --json
+vybekiit-automate ls standby --json --yes
+vybekiit-automate google oauth --project=... --app-name=... --support-email=... --app-url=... --redirect=... --json
+```
+
+## Wire-up (agents)
+
+1. `vybekiit setup` registers the `vybekiit` server once at Claude user scope and refreshes it on every rerun.
+2. Start a new Claude session after setup so Claude can approve and discover the global tools.
+3. Cursor receives project `.cursor/mcp.json` files because its setup path remains project-scoped.
+4. `create app` still ships `@vybekiit/agent-mcp` and `@vybekiit/browser-automation` under `packages/` for owned tooling and other MCP clients.
+5. Doctor may merge provider-specific third-party MCPs only when the project needs them.
+
+## Provider / third-party MCP snippets
+
+Not first-party tools — merge only when the builder uses that provider (see `mcp-setup.md`):
+`mcp-supabase`, `mcp-stripe`, `mcp-paypal`, `mcp-neon`, `mcp-firebase`, `mcp-mongodb`, `mcp-railway-*`, `mcp-twilio-*`, `mcp-sentry`, `mcp-posthog`.
+
+If any MCP fails once → `doc_fallback` / `vybekiit doc-fallback <tech-id>`; tell the builder only the plain stuck phrase.

package/dist/global-skills/vybekiitReferences/web/platform-skills/mongodb-vybekiit.md

@@ -0,0 +1,39 @@
+# Platform wrapper: MongoDB Atlas (agent/maintainer only)
+
+**Agent-only.** Not invoked by buyer `save-data`. Use when `.env` already has `DATA_PROVIDER=mongodb`.
+
+## Official upstream
+
+- Docs: https://www.mongodb.com/docs/
+- Node driver: https://www.mongodb.com/docs/drivers/node/current/
+- Agent skills: https://www.mongodb.com/docs/agent-skills/
+- Skills repo: https://github.com/mongodb/agent-skills
+- MCP overview: https://www.mongodb.com/docs/mcp-server/overview/
+- MCP get started: https://www.mongodb.com/docs/mcp-server/get-started/
+
+## Kit wiring
+
+1. Set `DATA_PROVIDER=mongodb`, `MONGODB_URI` (Atlas SRV connection string), and `MONGODB_DB` (database name)
+2. Data access via `@vybekiit/db` → `resolveDataProvider()` — never direct driver calls in UI
+3. Auth: `better-auth` may use Mongo adapter when configured — see `better-auth-vybekiit.md`
+4. Atlas CLI installed by `vybekiit doctor` when `DATA_PROVIDER=mongodb`
+
+## MCP
+
+Merge `.vybekiit/agent/mcp-mongodb.json` into buyer `.cursor/mcp.json` (see `agent/mcp-setup.md`).
+
+1. Copy `MONGODB_URI` from `.env` into `MDB_MCP_CONNECTION_STRING`
+2. Keep `MDB_MCP_READ_ONLY=true` unless a maintainer explicitly needs write tools
+3. Fallback: `npx mongodb-mcp-server@latest setup` — see official get-started guide
+
+If MCP fails once, run `vybekiit doc-fallback mongodb`.
+
+## Verify-before-advance
+
+- `pingDatabase()` from `@vybekiit/db` succeeds
+- MCP lists collections on the dev cluster (read-only)
+- Never connect MCP to production buyer data without read-only mode
+
+## Never say to builder
+
+MongoDB, NoSQL, collection, document, BSON, Atlas (use plain language from `language.md`)

package/dist/global-skills/vybekiitReferences/web/platform-skills/neon-vybekiit.md

@@ -0,0 +1,33 @@
+# Platform wrapper: Neon (serverless Postgres)
+
+> Agent-only: follow the Persistent features sequence in `.vybekiit/agent/session-bootstrap.md`. Reuse the relevant catalog presets before adding app-owned extensions, and record structural and behavioral evidence separately.
+
+**Agent-only.** Invoked by buyer skills `save-data`, `doctor`, and prerequisites for `add-signin`.
+
+## Official upstream
+
+- Docs index: https://neon.com/docs/llms.txt
+- Quick setup: `npx neonctl@latest init` (maintainer OAuth — not buyer-facing)
+- Agent skills: https://github.com/neondatabase/agent-skills
+
+## Kit wiring
+
+1. Set `DATA_PROVIDER=neon` and `DATABASE_URL` (Neon pooled connection string)
+2. Data access via `@vybekiit/db` → `resolveDataProvider()` — never direct SQL in UI
+3. Auth: `better-auth` uses the same `DATABASE_URL` Postgres binding
+4. Migrations via Neon branching in dev only (never production MCP)
+
+## MCP
+
+Merge `.vybekiit/agent/mcp-neon.json` into buyer `.cursor/mcp.json`. Maintainer adds `Authorization: Bearer $NEON_API_KEY` or uses OAuth via `neonctl init`.
+
+Fallback for clients without Streamable HTTP:
+
+```bash
+npx -y @neondatabase/mcp-server-neon start $NEON_API_KEY
+```
+
+## Verify-before-advance
+
+- `pingNeonDatabase(DATABASE_URL)` or doctor `pingDatabase()` green
+- Neon MCP is **dev/IDE only** — never connect agents to production databases

package/dist/global-skills/vybekiitReferences/web/platform-skills/nextjs-vybekiit.md

@@ -0,0 +1,20 @@
+# Platform wrapper: Next.js (web template)
+
+**Agent-only.** Invoked by generic coding and layout work — not a buyer goal skill.
+
+## Official upstream (prefer over training data)
+
+- Pinned: `.agents/skills/vercel-react-best-practices`, `vercel-composition-patterns`
+- Docs: https://nextjs.org/docs (App Router, Server Components, Route Handlers)
+
+## Kit conventions
+
+- App Router under `app/`; API routes under `app/api/`
+- Use logical spacing (`ms-`, `me-`, `ps-`, `pe-`) for RTL — see `language.md`
+- UI primitives live in `src/components` (shadcn) — use `shadcn-vybekiit.md` and `ui-consistency-vybekiit.md`
+- Business logic stays in `@vybekiit/*` packages, not reinvented in routes
+- Logging: `@/lib/logger` · errors: `@/lib/observability` · hygiene: `code-hygiene-vybekiit.md`
+
+## Verify-before-advance
+
+After structural changes: `pnpm test` + `pnpm build` green before telling the builder it works.

package/dist/global-skills/vybekiitReferences/web/platform-skills/notifications-vybekiit.md

@@ -0,0 +1,3 @@
+# notifications-vybekiit
+
+Use `resolve*Provider()` from `@vybekiit/notifications` — see package README and ADR-0012.

package/dist/global-skills/vybekiitReferences/web/platform-skills/observability-vybekiit.md

@@ -0,0 +1,36 @@
+# Platform wrapper: observability (agent-only)
+
+**Agent-only.** Logging and error tracking wiring — not a buyer goal skill.
+
+## Structured logging
+
+- Import `log` from `src/lib/logger.ts` (wraps `@vybekiit/core` `createLogger`).
+- **Development:** `debug` and `info` print automatically.
+- **Production:** only `warn` and `error` print — no builder configuration needed.
+- Optional override: `LOG_LEVEL` in `.env` (agent-only; never ask the builder to set it).
+- API routes: `const routeLog = log.child({ requestId })` when correlating a request.
+
+```ts
+import { log } from '@/lib/logger';
+
+log.info('Contact form accepted', { email: parsed.data.email });
+log.error('Checkout failed', err);
+```
+
+Never use bare `console.log` in `app/` or `src/` (tests excluded).
+
+## Error tracking
+
+- Buyer skill: `track-errors` — wires `@vybekiit/observability`.
+- Server entry: `instrumentation.ts` calls `resolveObservabilityProvider`.
+- App code: `import { observability } from '@/lib/observability'` then `observability.captureException(err)`.
+- Platform wrapper: `sentry-vybekiit.md` for Sentry dashboard steps.
+
+## Pre-ship checks
+
+```bash
+node scripts/checkNoConsole.mjs
+rg "from '@/lib/logger'" app/api/
+```
+
+See `check-safety` step 6 (code readiness) and `go-live` pre-flight.

package/dist/global-skills/vybekiitReferences/web/platform-skills/paypal-vybekiit.md

@@ -0,0 +1,25 @@
+# Platform wrapper: PayPal (opt-in payments)
+
+**Agent-only.** Invoked by buyer skill `setup-payments` when `PAYMENTS_PROVIDER=paypal`.
+
+## Official upstream
+
+- Docs: https://developer.paypal.com/docs
+- PayPal MCP: https://docs.paypal.ai/developer/tools/ai/mcp-quickstart
+
+## Kit wiring
+
+1. Merge `agent/mcp-paypal.json` into buyer MCP config — see `agent/mcp-setup.md` (Cursor, Claude Desktop, Codex)
+2. Builder completes PayPal OAuth once when MCP prompts (sandbox endpoint by default)
+3. Agent provisions products/invoices via PayPal MCP write tools as needed
+4. Payments via `@vybekiit/payments` → `resolvePaymentProvider()` when `PAYMENTS_PROVIDER=paypal`
+5. Set `PAYPAL_CLIENT_ID`, `PAYPAL_CLIENT_SECRET`, and webhook id in `.env`
+6. Webhook route at `app/api/webhook/route.ts`; fulfillment in `src/lib/fulfillment.ts`
+7. Replace `TODO(vybekiit): … — skill: setup-payments` markers
+8. Switch MCP URL to production (`https://mcp.paypal.com/http`) only after sandbox checkout verified
+
+## Verify-before-advance
+
+- MCP connected; sandbox tool call succeeds
+- Test checkout completes in sandbox; webhook fires
+- Order recorded; builder sees success in app

package/dist/global-skills/vybekiitReferences/web/platform-skills/planning-vybekiit.md

@@ -0,0 +1,59 @@
+# planning-vybekiit.md — agent-only planning mechanics
+
+Used by `plan-my-idea.md`. The builder never sees this file or its vocabulary.
+
+## CONTEXT.md format
+
+Single context at repo root (`CONTEXT.md`). Create lazily when the first term resolves.
+
+```md
+# {App name or domain}
+
+{One or two sentences: what this app is and who it's for.}
+
+## Language
+
+**{Canonical term}**:
+{A one or two sentence definition of what it IS, not what it does.}
+_Avoid_: alias1, alias2
+```
+
+### Rules
+
+- **Be opinionated.** Pick one canonical word; list alternatives under `_Avoid_`.
+- **Keep definitions tight.** One or two sentences max.
+- **App-specific only.** No general programming terms (API, timeout, cache, component).
+- **Group under subheadings** when clusters emerge (e.g. `## People`, `## Money`).
+- **Update inline** during the session — never batch at the end.
+- **No implementation details** in `CONTEXT.md` — glossary only, not a spec.
+
+### No ADRs for buyers
+
+Do not create `docs/adr/` or decision-record files. Capture agreed language in `CONTEXT.md` only.
+
+## During a planning session
+
+### Challenge against the glossary
+
+When the builder uses a term that conflicts with `CONTEXT.md`, reconcile immediately: *"Last time we
+said X means … — is that still right?"*
+
+### Sharpen fuzzy language
+
+When they say "account", "user", "order", "save" without precision, propose a canonical term and ask
+which they mean.
+
+### Cross-reference with code
+
+When they state how something works, check the code. If it contradicts them, surface it plainly and
+ask which is right before continuing.
+
+### Concrete scenarios
+
+Once the shape emerges, invent one realistic edge-case scenario (*"Sarah tries to… what happens?"*) to
+expose gaps before building.
+
+## After planning
+
+Reference `CONTEXT.md` during later feature work so wording stays consistent. Do not overwrite buyer
+entries during `update-kit` sync — `CONTEXT.md` is buyer-owned.

package/dist/global-skills/vybekiitReferences/web/platform-skills/playwright-vybekiit.md

@@ -0,0 +1,42 @@
+# Platform wrapper: Playwright UI tests (agent-only)
+
+**Agent-only.** Walk through the app like a visitor — the builder hears *"I checked it on screen"*, not Playwright.
+
+## When
+
+Before calling a page done (web/extension with UI); in pre-push when `PLAYWRIGHT_ENABLED=true`; on CI (ubuntu job).
+
+## Configure (`.env`)
+
+```env
+PLAYWRIGHT_ENABLED="true"      # turn on locally
+PLAYWRIGHT_HEADLESS="true"     # false to watch the browser
+PLAYWRIGHT_BASE_URL="http://localhost:3000"
+```
+
+## Install browsers (once per machine)
+
+```bash
+pnpm exec playwright install chromium
+```
+
+Doctor/onboarding: agent runs this silently when enabling UI walkthrough tests.
+
+## Run
+
+```bash
+pnpm test:e2e
+# or: PLAYWRIGHT_ENABLED=true pnpm test:e2e
+```
+
+Pre-push runs `pnpm test:e2e` automatically when `PLAYWRIGHT_ENABLED=true`.
+
+## Rules
+
+1. Never say "Playwright", "E2E", or "headless" to the builder — use `language.md`.
+2. Fix failing walkthrough tests before telling the builder the page works.
+3. Keep smoke tests short — one happy path per critical screen.
+
+## Verify
+
+`pnpm test:e2e` green with dev server reachable at `PLAYWRIGHT_BASE_URL`.

package/dist/global-skills/vybekiitReferences/web/platform-skills/railway-postgres-vybekiit.md

@@ -0,0 +1,24 @@
+# Platform wrapper: Railway Postgres (coupled stack data)
+
+> Agent-only: follow the Persistent features sequence in `.vybekiit/agent/session-bootstrap.md`. Reuse the relevant catalog presets before adding app-owned extensions, and record structural and behavioral evidence separately.
+
+**Agent-only.** Invoked by buyer skills `save-data`, `doctor`, and prerequisites for `add-signin` when `DATA_PROVIDER=railway`.
+
+## Official upstream
+
+- Docs: https://docs.railway.com/databases/postgresql
+- Agent skill: `use-railway` in `.agents/skills/`
+- MCP: `mcp-railway-local.json` (variables, provisioning) or `mcp-railway-remote.json` (OAuth)
+
+## Kit wiring
+
+1. Set `DATA_PROVIDER=railway` with `HOSTING_PROVIDER=railway` (coupled stack — same Railway project)
+2. Provision Postgres plugin in the linked Railway project via MCP or CLI
+3. Pull `DATABASE_URL` from Railway variables into `.env`
+4. Data access via `@vybekiit/db` → `resolveDataProvider()` — never direct SQL in UI
+5. Auth: `better-auth` uses the same `DATABASE_URL` Postgres binding
+
+## Verify-before-advance
+
+- `pingRailwayDatabase(DATABASE_URL)` or doctor `pingDatabase()` green
+- Railway MCP connected for variable reads in dev/IDE only

package/dist/global-skills/vybekiitReferences/web/platform-skills/react-patterns-vybekiit.md

@@ -0,0 +1,45 @@
+# Platform wrapper: React patterns (agent-only)
+
+**Agent-only.** Kit primitives and soft limits — the builder never hears "props" limits or "split the component."
+
+## Kit primitives (required)
+
+| Concern | Use | Never |
+|---|---|---|
+| Server / API data | TanStack Query via `@vybekiit/client-state` (`useQuery`, `useMutation`) | Raw `fetch` + `useState` for server records |
+| Async UI state | `useAsync` from `@/hooks/use-async` | Hand-rolled fetch for data that belongs in query cache |
+| User / session | `useUser` from `@/hooks/use-user` | Duplicate session logic in pages |
+| Client-only prefs | `useStorage` from `@/hooks/use-storage` | Zustand/MMKV for server data |
+| Toasts | `useToast` from `@/hooks/use-toast` | `alert()` or ad-hoc snackbars |
+| Forms | `FormField` + zod at submit boundary | Inline validation scattered in JSX |
+
+Read `client-state-vybekiit.md` and `src/hooks/README.md` before adding hooks.
+
+## Soft limits (agent + Biome warn)
+
+| Rule | Target | Enforcement |
+|---|---|---|
+| Function body length | ~5 lines ideal; split if longer | Agent convention + Biome warn |
+| Component props | ~5 max; use composition or a small options object | Agent convention |
+| Folders | See `src/README.md` | Required |
+
+## Forms
+
+- Use `FormField` for labels, errors, and inputs.
+- Validate with zod **once** at submit — not on every keystroke unless UX requires it.
+- API routes validate again with zod at the boundary.
+
+## Folders
+
+```
+app/                 routes + API (Next.js App Router)
+src/components/ui/   kit primitives — do not duplicate
+src/components/    app-specific composed UI
+src/hooks/           shared React hooks (see README)
+src/lib/             headless clients + utils (see README)
+```
+
+## Verify
+
+- New screens use kit hooks · forms use `FormField` · no duplicate helpers in `src/lib/`
+- `pnpm test` green after changes

package/dist/global-skills/vybekiitReferences/web/platform-skills/realtime-vybekiit.md

@@ -0,0 +1,3 @@
+# realtime-vybekiit
+
+Use `resolve*Provider()` from `@vybekiit/realtime` — see package README and ADR-0012.

package/dist/global-skills/vybekiitReferences/web/platform-skills/registrar-vybekiit.md

@@ -0,0 +1,36 @@
+# Platform wrapper: registrar credential setup
+
+**Agent-only.** Browser automation for Namecheap and GoDaddy API key onboarding when the builder's domain is at that registrar and nameserver automation is desired.
+
+## When to use
+
+During `buy-domain`, if Namecheap or GoDaddy secret settings are missing and the builder registered their domain there, run credential setup before Cloudflare nameserver delegation.
+
+## Commands
+
+Chrome with CDP on port 9222 and the target profile (see `browser-automation-vybekiit.md`).
+
+```bash
+# Namecheap — Profile → Tools → API Access
+vybekiit-automate nc standby --json
+vybekiit-automate nc setup --json
+vybekiit-automate nc setup --json --sandbox   # sandbox API
+
+# GoDaddy — developer.godaddy.com/keys (OTE by default)
+vybekiit-automate gd standby --json
+vybekiit-automate gd setup --json
+vybekiit-automate gd setup --json --production
+vybekiit-automate gd setup --json --name=vybekiit
+```
+
+On success, write the returned `env` keys to `.env`, then run `vybekiit doctor` to confirm.
+
+## Rules
+
+- Builder **signs in only**; agent runs setup and verification.
+- Never say "Namecheap API", "GoDaddy Developer", or "whitelist IP" to the builder — use plain language from `language.md`.
+- Nameserver updates use `@vybekiit/deploy` REST after credentials exist — not browser automation.
+
+## Package
+
+`@vybekiit/browser-automation` — ADR-0021.

package/dist/global-skills/vybekiitReferences/web/platform-skills/resend-vybekiit.md

@@ -0,0 +1,20 @@
+# Platform wrapper: Resend (opt-in email)
+
+**Agent-only.** Invoked by buyer skill `setup-email` when `EMAIL_PROVIDER=resend`.
+
+## Official upstream
+
+- Docs: https://resend.com/docs
+- Pinned skills: `.agents/skills/resend/SKILL.md`, `.agents/skills/email-best-practices/SKILL.md`
+
+## Kit wiring
+
+1. Email via `@vybekiit/email` → `resolveEmailProvider()` when `EMAIL_PROVIDER=resend`
+2. Set `RESEND_API_KEY` and verified sender in `.env`
+3. Wire sending through the provider interface; hook into sign-in codes, welcome, receipts as needed
+4. Replace any `TODO(vybekiit): … — skill: setup-email` markers
+
+## Verify-before-advance
+
+- Send test email to builder; confirm arrival (check spam)
+- Connected flow sends in the skill's target moment

package/dist/global-skills/vybekiitReferences/web/platform-skills/responsive-vybekiit.md

@@ -0,0 +1,27 @@
+# Platform wrapper: responsive layout (agent-only)
+
+**Agent-only.** Mobile-first web layout — the builder hears "looks good on phone and desktop," not breakpoints.
+
+## Mobile-first
+
+- Base styles = phone (narrow). Scale up with `sm:` / `md:` / `lg:`.
+- Default page padding: `px-4 md:px-6`
+- Max content width: `max-w-lg mx-auto` (forms/auth) or `max-w-6xl` (marketing/dashboard)
+- Touch targets: kit `Button` sizes `default` or `lg` — never tiny custom tap areas
+
+## RTL
+
+Complements logical properties in `AGENTS.md` — use `ms-`/`me-`/`ps-`/`pe-`/`start-`/`end-`, not `left`/`right`.
+
+## Before calling a page done
+
+Preview at **375px** width in dev tools. Fix overflow, cramped buttons, and unreadable text before showing the builder.
+
+## Also read
+
+- `ui-consistency-vybekiit.md` — primitives and spacing tokens
+- `shadcn-vybekiit.md` — layout blocks from the UI catalog
+
+## Verify
+
+Page usable at 375px and desktop without horizontal scroll on main content.

package/dist/global-skills/vybekiitReferences/web/platform-skills/search-vybekiit.md

@@ -0,0 +1,3 @@
+# search-vybekiit
+
+Use `resolve*Provider()` from `@vybekiit/search` — see package README and ADR-0012.