vybekiit 0.7.28 → 0.7.29

package/dist/global-skills/plan-my-idea/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: plan-my-idea

package/dist/global-skills/publish-app/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/mobile/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: publish-app

package/dist/global-skills/publish-extension/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/extension/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: publish-extension

package/dist/global-skills/reset-password/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: reset-password

package/dist/global-skills/save-data/SKILL.md

@@ -1,19 +1,27 @@
 ---
 name: save-data
-description: "the app can remember things — save information and read it back later. Use when the vibe coder says something like: save my data; remember this; store info; add a database."
+description: "the app can remember things — save information and read it back later. Use when the vibe coder says something like: save my data; remember this; store info; add a database; book my classes; yoga booking."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: save-data
 
+> Agent-only: follow the Persistent features sequence in `.vybekiit/agent/session-bootstrap.md`. Reuse the relevant catalog presets before adding app-owned extensions, and record structural and behavioral evidence separately.
+
 **Goal:** the app can remember things — save information and read it back later.
 
 **Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
-translate every error · celebrate. You do all the wiring; the builder only pastes a value when asked
-or describes, in plain words, what the app should remember.
+translate every error · celebrate. Continue authorized work independently. Infer what needs saving
+from the builder's request; ask only when a missing product decision changes the behavior.
 
 > (Under the hood — agent-only) Use `@vybekiit/db`'s `resolveDataProvider()` for every read/write.
 > Follow the platform wrapper for the active `DATA_PROVIDER`:
@@ -23,29 +31,52 @@ or describes, in plain words, what the app should remember.
 > - `firebase` → `platform-skills/firebase-vybekiit.md`
 > - `mongodb` / `aws` → advanced; maintainer docs only
 
+## Reuse before implementation
+
+For bookings, class schedules, appointments, and cancellations, discover `booking` through
+`vybekiit list-presets`, then apply its prerequisites and migration. Use its atomic reservation and
+cancellation functions through verified server sessions. Add only missing app-specific fields and
+permissions. Do not substitute selling class packs for a request to book classes.
+The business owner is the app admin: authorize schedule changes with `checkAdminAccess` from
+`@/lib/adminAccess` (sign-in emails in `ADMIN_EMAILS`) plus any staff permissions you add. Never
+create an organization for each account that signs in.
+For other requests, select matching presets from the catalog before authoring an extension.
+
 ## Steps
 
 1. **Make sure the database is ready.** Run the database tool via `vybekiit doctor`. For MCP-tier providers
    (Supabase, Neon, Firebase), merge the matching `agent/mcp-*.json` via `agent/mcp-setup.md` and use
    login-once onboarding. If MCP fails once, run `vybekiit doc-fallback supabase` (or `neon` /
    `firebase`) and tell the builder you're checking the official setup guide (plain phrase only).
-   Collect any access keys **one at a time** and save them to the secret settings file.
+   Inspect the selected service's existing CLI or MCP login and exact project before requesting
+   access. Reuse authorized connections and preserve existing projects. Never delete a project to
+   free capacity. Request one manual action only when an actual access blocker remains.
    **Verify:** the database is reachable (`@vybekiit/db`'s `pingDatabase`).
 
-2. **Agree on what to remember, in plain words.** If no prior `design-my-data` session, run that skill first
-   (or run `vybekiit plan-data-model entities.json` for a single simple entity). Ask what the app
-   should save; turn their answer into a simple data shape yourself.
-   **Verify:** read the shape back in one sentence and get a yes.
+2. **Decide what to remember from the request.** Reuse existing data shapes and ownership rules.
+   Use `design-my-data` only when the relationships need further design. Summarize the choice in
+   one sentence and continue unless a missing product decision blocks it.
+   **Verify:** the stored information supports the requested actions and access boundaries.
+
+3. **Write behavior tests before the implementation.** Cover saving and reading, unauthorized
+   access, duplicates, and concurrent writes where business limits apply. Enforce limits at the
+   database or server boundary; a separate count followed by an insert can race.
 
-3. **Wire saving and reading.** Use `resolveDataProvider()` for insert / get / query / update /
-   remove. Replace the dashboard's placeholder stats marker (`TODO(vybekiit): … — skill: save-data`;
+4. **Wire saving and reading.** Use `resolveDataProvider()` for insert / get / query / update /
+   remove. Insert new rows with `id: ''` so the adapter generates the key; preset tables use UUID
+   keys. Replace the dashboard's placeholder stats marker (`TODO(vybekiit): … — skill: save-data`;
    grep them) with a real read.
    **Verify:** the code builds with no errors.
 
-4. **Write a test** that saves a record and reads it back, and keep it green.
-
-5. **Try it for real.** Save something, then read it back in the app.
-   **Verify:** what was saved comes back exactly.
+5. **Try it for real.** A build, type check, or mocked test is not this step. Install missing
+   dependencies, start the app in the background (`pnpm dev --port 3100 > /tmp/app.log 2>&1 &`),
+   and wait until `curl -s localhost:3100` answers. Sign up two accounts, each with its own cookie
+   jar; use an `ADMIN_EMAILS` address for the owner when the feature has owner-only actions:
+   `curl -c owner.jar -H 'content-type: application/json' -d '{"email":"…","password":"…"}' localhost:3100/api/auth/signup`.
+   Save through your own routes with `-b owner.jar`, read it back with the other jar, and send one
+   request each account must be refused. Stop the server afterwards.
+   **Verify:** what was saved comes back exactly, refused requests get 401 or 403, and your summary
+   quotes the status codes you saw. Browser-only storage does not complete a shared-data request.
    🎉 *Celebrate* — the app remembers things now.
 
 ## If anything breaks
@@ -60,8 +91,9 @@ them, don't explain the internals.
 
 ## Definition of done
 
-The app saves and reads back real data, a passing test covers it, and no save-data markers remain
-(re-grep `TODO(vybekiit)`).
+The running app saves and reads back real data and refuses unauthorized requests, your summary
+quotes those responses, a passing test covers it, and no save-data markers remain (re-grep
+`TODO(vybekiit)`). Tests against mocked data alone do not complete this skill.
 
 ## After completing this skill
 

package/dist/global-skills/setup-email/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: setup-email

package/dist/global-skills/setup-payments/SKILL.md

@@ -1,15 +1,21 @@
 ---
 name: setup-payments
-description: "the builder can take real money. By the end, a test purchase succeeds end-to-end. Use when the vibe coder says something like: add payments; take money; sell something; charge people."
+description: "the requested purchase flow works in practice. A test purchase succeeds end-to-end; accepting real money requires separately verified live setup. Use when the vibe coder says something like: add payments; take money; sell something; charge people."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: setup-payments
 
-**Goal:** the builder can take real money. By the end, a test purchase succeeds end-to-end.
+**Goal:** the requested purchase flow works in practice. A test purchase succeeds end-to-end; accepting real money requires separately verified live setup.
 
 **Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
 translate every error · celebrate. You wire all the code; the builder only signs in once when asked.
@@ -61,9 +67,9 @@ translate every error · celebrate. You wire all the code; the builder only sign
    **Verify:** provider shows webhook connected.
 
 6. **Test a purchase.** Use test mode for a fake purchase.
-   **Verify:** order recorded (webhook success). 🎉 *Celebrate* — they can take money.
+   **Verify:** the provider confirms a test payment, its signed payment message is verified, and the matching order is stored with the expected purchase effect. A local pretend checkout or a configured connection alone does not pass. Celebrate with "The practice payment worked." Never charge real money during testing.
 
-7. **Customize what a purchase does.** Ask what should happen when someone pays. Implement in
+7. **Preserve the requested purchase effect.** Use what the builder already said, such as confirming a class booking. Ask only if the intended effect is still unknown. Implement in
    `src/lib/fulfillment.ts`. Write a quick test and keep it green.
 
 ## If anything breaks

package/dist/global-skills/setup-sms/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: setup-sms

package/dist/global-skills/sign-in-with-email-link/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: sign-in-with-email-link

package/dist/global-skills/sign-in-with-google/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: sign-in-with-google

package/dist/global-skills/sign-in-with-phone/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: sign-in-with-phone

package/dist/global-skills/track-errors/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: track-errors

package/dist/global-skills/update-kit/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: update-kit

package/dist/global-skills/validate-my-idea/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: validate-my-idea

package/dist/global-skills/vybekiit-feedback/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: vybekiit-feedback

package/dist/global-skills/vybekiitReferences/backend/AGENTS.md

@@ -0,0 +1,42 @@
+# AGENTS.md — your build agent (read this first)
+
+> **Single source of truth** for Claude Code, Cursor, and Codex — `CLAUDE.md` and `.cursor/rules`
+> point here. You are talking to a non-technical vibe coder.
+
+<!-- vybekiit:generated:start contract -->
+## The contract: Decide + Guide
+
+A request such as "Can people book my classes?" means build the working feature. Inspect the connected provider and run `vybekiit list-presets` before saying the kit lacks the capability. Reuse the booking and organizations presets, add only app-specific behavior, and verify saved bookings and access rules. Read `.vybekiit/agent/session-bootstrap.md` for the persistence workflow. Continue ordinary authorized work without asking the buyer to reconfirm it.
+
+① **One action at a time** — Give the buyer one manual action at a time. Continue authorized work independently, checking each step until the requested work is complete or blocked. Requests to let people book, pay, or join a team mean implement that behavior; do not replace the requested feature with an easier alternative.
+② **Verify before advancing** — Confirm each step actually worked before moving on, so the vibe coder can't get silently stuck. Shared bookings, payments, and team access need real saved information; a preview does not complete them.
+③ **Plain language** — Translate every technical term using language.md — the vibe coder never has to understand or decide.
+④ **Translate errors** — Turn any failure into "what happened + the one thing to do about it" — never paste a raw stack trace.
+⑤ **Celebrate progress** — Celebrate only verified progress. State whether it works locally, in practice, or online.
+⑥ **Record decisions** — After every completing skill, append one entry to checklist.md Decision log via formatChecklistEntry().
+⑦ **Official source fallback** — If MCP or the first debug attempt fails once, run vybekiit doc-fallback and tell the vibe coder the plain stuck phrase only.
+<!-- vybekiit:generated:end contract -->
+
+## How to work
+
+Simple questions need brief answers, without setup or skill searches. Inspect before making
+project-specific claims. Requests for work mean do the work and verify the requested behavior.
+Reuse instructions already loaded in the conversation. Continue authorized work independently;
+one action at a time limits steps the buyer must take. Prefer this project's skills over global
+copies. Do not use helper agents for simple exchanges.
+
+1. **Find the goal.** Buyer goal skills in `.agents/skills/` (also via `.cursor/skills/` and
+   `.claude/skills/`) load automatically from their descriptions — use the matching skill when the
+   vibe coder's intent fits. If nothing fits or you're unsure, fall back to `.vybekiit/agent/goal-index.md`
+   and read the skill in `.vybekiit/skills/`. Also check `.vybekiit/extensions/goal-index.md` when present.
+   Routine edits need no new skill. Consult `platform-skills/extend-capabilities-vybekiit.md`
+   only for a real uncovered integration.
+2. Use CLI planners: `vybekiit plan-readiness`, `vybekiit plan-setup`, `vybekiit plan-data-model`.
+3. Append routes with `vybekiit backend add-route` or CRUD with `vybekiit backend add-crud`.
+
+## Conventions
+
+- MVC layout: `src/routes/`, `src/controllers/`, `src/middleware/`, `src/services/`.
+- Use `@vybekiit/*` packages — never reinvent auth, db, or payments.
+- Secret settings live in `.env` only — never read values aloud in chat.
+- Session cookies are httpOnly; mobile/extension clients use `APP_URL` pointing here.

package/dist/global-skills/vybekiitReferences/backend/agent/goal-index.md

@@ -0,0 +1,17 @@
+# Goal index — route the builder's request to a skill
+
+| The builder says something like… | Use this skill |
+|---|---|
+| "set up my server", "let's start" | `skills/onboarding.md` |
+| "let people sign in" | `skills/wire-auth.md` |
+| "save my data", "add a database" | `skills/wire-database.md` |
+| "add payments" | `skills/wire-payments.md` |
+| "add an api", "new endpoint" | `skills/add-route.md` |
+| "upload files" | `skills/add-upload.md` |
+| "it's broken", "check my server" | `skills/doctor.md` |
+| "send feedback", "report a kit bug", "the kit is confusing" | `skills/vybekiit-feedback.md` |
+| "update the kit" | `skills/update-kit.md` |
+
+<!-- vybekiit:generated:start goal-index-validation -->
+<!-- Goal drift: run `vybekiit check-goals` — non-zero exit means fix goal-index or add skills -->
+<!-- vybekiit:generated:end goal-index-validation -->

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-agent.json

@@ -0,0 +1,12 @@
+{
+  "mcpServers": {
+    "vybekiit": {
+      "command": "node",
+      "args": ["../../packages/agentMcp/dist/bin.js"],
+      "env": {
+        "VYBEKIIT_PROJECT_ROOT": ".",
+        "VYBEKIIT_UI_CATALOG_PATH": ".vybekiit/agent/ui-catalog-index.json"
+      }
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-firebase.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "firebase": {
+      "command": "npx",
+      "args": ["-y", "firebase-tools@latest", "mcp"]
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-mongodb.json

@@ -0,0 +1,12 @@
+{
+  "mcpServers": {
+    "mongodb": {
+      "command": "npx",
+      "args": ["-y", "mongodb-mcp-server@latest"],
+      "env": {
+        "MDB_MCP_CONNECTION_STRING": "",
+        "MDB_MCP_READ_ONLY": "true"
+      }
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-neon.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "neon": {
+      "url": "https://mcp.neon.tech/mcp?readonly=true",
+      "headers": {}
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-paypal.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "paypal": {
+      "command": "npx",
+      "args": ["-y", "mcp-remote", "https://mcp.sandbox.paypal.com/http"]
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-posthog.json

@@ -0,0 +1,17 @@
+{
+  "mcpServers": {
+    "posthog": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "mcp-remote@latest",
+        "https://mcp.posthog.com/mcp",
+        "--header",
+        "Authorization:${POSTHOG_AUTH_HEADER}"
+      ],
+      "env": {
+        "POSTHOG_AUTH_HEADER": "Bearer ${POSTHOG_API_KEY}"
+      }
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-railway-local.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "railway": {
+      "command": "railway",
+      "args": ["mcp"]
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-railway-remote.json

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "railway": {
+      "url": "https://mcp.railway.com"
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-sentry.json

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "sentry": {
+      "url": "https://mcp.sentry.dev/mcp"
+    }
+  }
+}

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-setup.md

@@ -0,0 +1,131 @@
+
+## Agent skill (read locally or via MCP)
+
+- Auto-discovered: `.agents/skills/use-kit-mcp/SKILL.md`
+- Platform wrapper: `.vybekiit/platform-skills/mcp-tools-vybekiit.md`
+- Via MCP (when `vybekiit` server is connected): `search_skills({ query: "mcp tools" })` then `get_skill({ id: "use-kit-mcp" })` or `list_platform_skills({ query: "mcp" })`
+
+# MCP setup — Cursor, Claude Desktop, Codex (agent-only)
+
+Merge provider snippets from `.vybekiit/agent/mcp-*.json` into the buyer's AI client config. **Preserve existing servers** — never replace the whole file.
+
+## Cursor
+
+**Config:** project `.cursor/mcp.json` or global `~/.cursor/mcp.json`
+
+1. Open the config file (create with `{ "mcpServers": {} }` if missing).
+2. Merge each needed fragment's `mcpServers` block into the top-level `mcpServers` object.
+3. Restart Cursor or open **Settings → Tools & MCP** and confirm each server is connected.
+
+## Claude Desktop
+
+**Config (macOS):** `~/Library/Application Support/Claude/claude_desktop_config.json`
+
+Same JSON shape as Cursor — merge `mcpServers` entries from the snippets below. Restart Claude Desktop after saving.
+
+## Codex
+
+**Config:** `~/.codex/config.toml` or project `.codex/config.toml` (trusted projects only)
+
+Use `codex mcp add` interactively, or add TOML tables manually:
+
+### HTTP MCP (Stripe, Supabase, Neon)
+
+```toml
+[mcp_servers.stripe]
+url = "https://mcp.stripe.com"
+
+[mcp_servers.supabase]
+url = "https://mcp.supabase.com/mcp"
+
+[mcp_servers.neon]
+url = "https://mcp.neon.tech/mcp?readonly=true"
+```
+
+### Stdio bridge (PayPal remote)
+
+PayPal uses `mcp-remote` because the hosted server requires streamable HTTP via a local bridge:
+
+```toml
+[mcp_servers.paypal]
+command = "npx"
+args = ["-y", "mcp-remote", "https://mcp.sandbox.paypal.com/http"]
+```
+
+Production PayPal: replace sandbox URL with `https://mcp.paypal.com/http`.
+
+### Stdio (Firebase, MongoDB)
+
+```toml
+[mcp_servers.firebase]
+command = "npx"
+args = ["-y", "firebase-tools@latest", "mcp"]
+
+[mcp_servers.mongodb]
+command = "npx"
+args = ["-y", "mongodb-mcp-server@latest"]
+
+[mcp_servers.mongodb.env]
+MDB_MCP_CONNECTION_STRING = "<copy from MONGODB_URI in .env>"
+MDB_MCP_READ_ONLY = "true"
+```
+
+Restart Codex after changes. Run `/mcp` in a session to verify tools are listed.
+
+## Provider snippets (merge one or more)
+
+| When | File | Upstream docs |
+|------|------|---------------|
+| VybeKiit agent surface (skills, CLI, doctor, doc-fallback) | `mcp-agent.json` | Local `@vybekiit/agent-mcp` — always merge first |
+| Default data (`DATA_PROVIDER=supabase`) | `mcp-supabase.json` | https://supabase.com/docs/guides/ai-tools/mcp |
+| Stripe payments | `mcp-stripe.json` | https://docs.stripe.com/mcp |
+| PayPal payments | `mcp-paypal.json` | https://docs.paypal.ai/developer/tools/ai/mcp-quickstart |
+| Neon data | `mcp-neon.json` | https://neon.tech/docs/ai/neon-mcp-server |
+| Firebase data | `mcp-firebase.json` | Firebase MCP via `firebase-tools mcp` |
+| Twilio SMS / Verify | `mcp-twilio-docs.json` | https://mcp.twilio.com/docs |
+| Twilio API (optional alpha) | `mcp-twilio-alpha.json` | `@twilio-alpha/mcp` stdio bridge |
+| Sentry error alerts | `mcp-sentry.json` | https://mcp.sentry.dev/mcp |
+| PostHog analytics / flags | `mcp-posthog.json` | https://mcp.posthog.com/mcp |
+| Advanced data (`DATA_PROVIDER=mongodb`, **agent/maintainer only**) | `mcp-mongodb.json` | https://www.mongodb.com/docs/mcp-server/get-started/ |
+| Railway stack (`HOSTING_PROVIDER=railway` and/or `DATA_PROVIDER=railway`) | `mcp-railway-local.json` | https://docs.railway.com/ai/mcp-server |
+| Railway remote MCP (OAuth, no local CLI state) | `mcp-railway-remote.json` | https://docs.railway.com/ai/mcp-server |
+
+**Railway MCP — when to use which**
+
+- **Local** (`mcp-railway-local.json`): repo-linked deploys, `railway up`, variables, logs — shares CLI login. Preferred when `railway` is installed and authed (doctor runs `railway setup agent -y`).
+- **Remote** (`mcp-railway-remote.json`): OAuth at `mcp.railway.com` — project/service discovery, redeploys, `railway-agent` for multi-step ops. Use when local CLI context is unavailable.
+
+### MCP failure → official docs
+
+If an MCP server fails to connect or a tool call errors **once**, do not retry blindly:
+
+1. Run `vybekiit doc-fallback <tech-id>` (e.g. `twilio`, `supabase`, `stripe`).
+2. Follow the returned official URLs and env key hints.
+3. Tell the builder only: *"I'm double-checking the official setup guide for this — hang tight, I'll have the next step in a moment."* Never say MCP, stack trace, or provider jargon aloud.
+
+See `.vybekiit/agent/tech-references.md` for the full id → docs map.
+
+### Supabase optional query params
+
+Append to the URL for tighter scope (recommended for real data):
+
+- `?project_ref=<ref>` — limit to one project
+- `?read_only=true` — Postgres read-only user
+- Combined: `https://mcp.supabase.com/mcp?project_ref=abc123&read_only=true`
+
+OAuth login happens on first use — no PAT required for interactive clients.
+
+### PayPal OAuth
+
+First tool call opens PayPal login in the browser. Use sandbox endpoint until checkout is verified, then switch to production URL in config.
+
+## Advanced (CI / local only)
+
+- **PayPal local:** `npx -y @paypal/mcp --tools=all` with `PAYPAL_ACCESS_TOKEN` — see PayPal MCP quickstart
+- **Supabase CI:** PAT in `Authorization` header — see Supabase MCP security docs
+
+Never connect MCP to production buyer data without `read_only=true` or a dev branch.
+
+### MongoDB (agent/maintainer only)
+
+When `.env` has `DATA_PROVIDER=mongodb`, merge `mcp-mongodb.json` and copy `MONGODB_URI` into `MDB_MCP_CONNECTION_STRING`. Keep `MDB_MCP_READ_ONLY=true` unless a maintainer explicitly needs write tools.

package/dist/global-skills/vybekiitReferences/backend/agent/mcp-supabase.json

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "supabase": {
+      "url": "https://mcp.supabase.com/mcp"
+    }
+  }
+}