vybekiit 0.7.28 → 0.7.32

package/dist/global-skills/onboarding/SKILL.md

@@ -1,15 +1,23 @@
 ---
 name: onboarding
-description: "take the vibe coder from \"I just bought this\" to **their app running and visible in front of. Use when the vibe coder says something like: set up my app; let's start; get me going; just bought."
+description: "take the builder from \"I just bought this\" to their app running and visible in front of them in this one session. Use when the vibe coder says something like: set up my app; let's start; get me going; just bought; hi; help."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: onboarding
 
-**Goal:** take the vibe coder from "I just bought this" to **their app running and visible in front of
+> Agent-only: follow the Persistent features sequence in `.vybekiit/agent/session-bootstrap.md`. Reuse the relevant catalog presets before adding app-owned extensions, and record structural and behavioral evidence separately.
+
+**Goal:** take the builder from "I just bought this" to **their app running and visible in front of
 them** in this one session. This is the keystone — the moment that proves the purchase was worth it.
 
 **Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
@@ -18,30 +26,31 @@ translate every error · celebrate. Decide all technical choices yourself.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the end-user onboarding recipe when the vibe coder wants a first-run wizard (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/OnboardingPage.tsx` export `OnboardingPage` into the buyer app at route `/onboarding`.
-   Recipe id: `onboarding`. Presets: none.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Skip this step if the vibe coder only needs *their* kit setup (steps 1–5 below) and not a product wizard for their users.
-   Also reference `packages/agentKit` `getPageRecipeInstall('onboarding')` / page-recipe-manifest.json.
-   **Verify:** if installed, `/onboarding` builds with practice UI.
-
-1. **Welcome + ask the one thing that matters.**
-   Greet warmly. If the vibe coder already described their app, use that description. Otherwise ask:
+0. **Add the first-run wizard page when the vibe coder wants one for their users.** Run
+   `vybekiit add page-recipe onboarding`. It adds the page at `/onboarding`. Keep every `TODO:` in the
+   page and fill each one in. Skip this step when the vibe coder only needs their own kit setup
+   (steps 1-5 below).
+   **Verify:** if added, `/onboarding` opens and shows practice content.
+
+1. **Welcome, say what VybeKiit is, then ask the one thing that matters.**
+   Greet warmly in plain text with no emojis, then tell them in a few short sentences what they have, in plain words:
+   *"VybeKiit is a ready-made web app with the hard parts already working. It comes with sign-in, payments, a database that remembers your customers' information, emails your app sends, file uploads, visitor stats, alerts when something breaks, more languages, and putting your app online. While we build, you can turn on Report mode and point at anything on screen that looks wrong, and I fix it. You own all of it, and I do the technical work."*
+   Then stop talking about the kit and move on to their idea.
+   If the vibe coder already described their app, use that description. Otherwise ask:
    *"In one sentence, what do you want to build?"* Use their answer to tailor the starter page later.
    Keep the conversation about their idea.
 
-1b. **One-time planning offer** (skip if `.vybekiit/state/planning-intro-seen` exists).
-   Ask: *"Before we start building — want to **think it through together** first? I'll ask one question
-   at a time until we're totally aligned. Or we can jump straight to building."*
-   - **Yes** → run `plan-my-idea.md` with their one-sentence answer as seed; when done, continue to
-     step 2.
-   - **No** → continue to step 2.
-   Create `.vybekiit/state/planning-intro-seen` (any content) so this offer never repeats.
+1b. **Keep the requested goal.** If the builder asked for working behavior, carry that goal
+   through setup and implement it. Offer planning only when they ask to plan or a missing product
+   decision would change the work. Do not replace a booking flow with a personalized headline.
 
 2. **Set up the tools, then get the preview running.**
-   First run `vybekiit doctor` — it installs the tools the app will need (for the database and for
-   putting the app online) so the vibe coder never configures anything. It may say a tool "isn't signed
+   In an empty folder, use `vybekiit create app --web <destination>` before running project
+   checks. If setup has already written files such as `.env`, preserve them and choose an empty
+   child folder for the scaffold. Do not delete existing files to make the command accept a path.
+   Inspect an existing app and reuse its setup instead of scaffolding over it.
+   Then run `vybekiit doctor` — it installs the tools the app will need (for the database and for
+   putting the app online) so the builder never configures anything. It may say a tool "isn't signed
    in yet" — that's fine for now; sign-in happens later, only when a step needs it (one browser click
    each). Then install the project's building blocks. Check the URL printed by setup and the
    project's running processes. Reuse a preview only after confirming it serves this app.
@@ -56,7 +65,7 @@ translate every error · celebrate. Decide all technical choices yourself.
    **Verify:** the dev server is up with no errors. If it fails → run `doctor`.
 
    > (Agent-only) **Database MCP tier:** Supabase, Neon, and Firebase use login-once MCP configs
-   > (`mcp-supabase.json`, `mcp-neon.json`, `mcp-firebase.json`) — merge via `agent/mcp-setup.md`
+   > (`mcp-supabase.json`, `mcp-neon.json`, `mcp-firebase.json`) — merge via `.vybekiit/agent/mcp-setup.md`
    > (Cursor, Claude Desktop, Codex). MongoDB and AWS are advanced only.
    >
    > **Payment MCP tier:** Stripe and PayPal use `mcp-stripe.json` / `mcp-paypal.json` when
@@ -64,17 +73,24 @@ translate every error · celebrate. Decide all technical choices yourself.
 
 3. **Show them their app.**
    Give them the verified preview link from this run and tell them what they'll see.
-   **Verify:** ask them to confirm they can see the page. Don't continue until they say yes.
-   🎉 *Celebrate* — their app is alive.
+   **Verify:** open the page in a browser yourself. Continue the requested work; ask the builder only if you cannot verify what they see.
+   *Celebrate* — their app is alive.
    Mention Report mode once: *"If something looks wrong, press Option+Shift+R (Alt+Shift+R on
    Windows), click it, tell me what's off — I'll get the details automatically."*
 
 4. **Make it theirs.**
-   Edit the starter page to reflect the one sentence from step 1 (headline + intro). Keep it simple.
-   **Verify:** the preview updated; they confirm it looks like their idea.
+   Implement the requested behavior from step 1 using the existing app. A class-booking request needs a class list and a working booking flow, not only a headline.
+   Necessary capabilities are part of the original request: apply `save-data` for shared information
+   and the matching access skill when needed. Do not offer these as optional next goals while the
+   requested behavior depends on them. Reuse existing authorized connections before asking for access.
+   **Verify:** exercise the requested behavior in the browser, including saved changes after reload
+   and from a second browser when people share information. Test allowed and denied actions and
+   business limits. A successful page load or unrelated passing tests do not prove the feature.
+   Success messages must describe completed actions; do not promise an email without sending one.
+   Explain any actual access blocker and the part still incomplete.
 
 5. **Offer the next goal.**
-   Ask what they want next and route via `goal-index.md`:
+   Only after the original requested behavior passes its checks, ask what they want next and route via `goal-index.md`:
    - take money → `setup-payments`
    - put it online for real → `go-live`
    - let people sign in → `add-signin`
@@ -87,8 +103,9 @@ Stop the steps and run `doctor`. Never show a raw error — say what happened an
 
 ## Definition of done
 
-The vibe coder has seen their own app running and personalized, and knows the next thing they can ask
-for. Save progress for them (don't make them think about it).
+The requested behavior works and has passed its browser and behavior checks, or the exact blocked
+part is recorded as incomplete. A personalized preview alone completes only a preview request.
+Record progress locally. Claim an online backup only after verifying the remote commit.
 
 ## After completing this skill
 

package/dist/global-skills/plan-my-idea/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: plan-my-idea
-description: "help the builder figure out exactly what they want **before** you build — so the first. Use when the vibe coder says something like: help me plan; figure out my idea; think it through; marketplace; like airbnb."
+description: "help the builder figure out exactly what they want before you build — so the first version matches their idea instead of your guess. Use when the vibe coder says something like: help me plan; figure out my idea; think it through; marketplace; like airbnb."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: plan-my-idea

package/dist/global-skills/publish-app/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: publish-app
-description: "the builder's app is **in the App Store and Google Play** for anyone to download. This is. Use when the vibe coder says something like: put it online; publish; make it live; ship it; deploy; publish app."
+description: "the builder's app is in the App Store and Google Play for anyone to download. Use when the vibe coder says something like: put it online; publish; make it live; ship it; deploy; publish app."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/mobile/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: publish-app

package/dist/global-skills/publish-extension/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: publish-extension
-description: "the builder's extension is **listed in the Chrome Web Store** for anyone to install. Use when the vibe coder says something like: put it online; publish; make it live; ship it; deploy; chrome store."
+description: "the builder's extension is listed in the Chrome Web Store for anyone to install. Use when the vibe coder says something like: put it online; publish; make it live; ship it; deploy; chrome store."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/extension/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: publish-extension

package/dist/global-skills/resend/SKILL.md

@@ -4,7 +4,7 @@ description: Use when working with the Resend email API — sending transactiona
 license: MIT
 metadata:
     author: resend
-    version: "3.12.0"
+    version: "3.13.0"
     homepage: https://resend.com/agent-skills
     source: https://github.com/resend/resend-skills
     openclaw:
@@ -47,6 +47,7 @@ references:
     - usage.md
     - installation.md
     - fetch-all-templates.mjs
+disable-model-invocation: true
 ---
 
 # Resend

package/dist/global-skills/resend/references/webhooks.md

@@ -65,7 +65,9 @@ The `email.received` payload contains metadata only (sender, recipient, subject,
 |-------|---------|
 | `domain.created` / `updated` / `deleted` | Domain configuration changes |
 | `contact.created` / `updated` / `deleted` | Contact list changes (not from CSV imports) |
+| `contact.topics.updated` | Contact's topic subscriptions change |
 | `suppression.added` / `removed` | Email address added to or removed from the suppression list |
+| `topic.created` / `updated` / `deleted` | Topic created, updated, or deleted |
 
 ## Setup
 

package/dist/global-skills/reset-password/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: reset-password
@@ -20,12 +26,10 @@ translate every error · celebrate.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/AccountSecurityPage.tsx` export `AccountSecurityPage` into the buyer app at route `/settings/security`.
-   Recipe id: `account-security`. Preset: auth-bridge.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('reset-password')` / page-recipe-manifest.json.
-   **Verify:** route builds with practice security UI before provider wiring.
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe account-security`. It adds the page
+   at `/settings/security` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/settings/security` opens and shows practice content.
 
 1. **Confirm sign-in is wired.** Run `add-signin` first if accounts are not set up yet.
    **Verify:** existing sign-in works.

package/dist/global-skills/save-data/SKILL.md

@@ -1,19 +1,27 @@
 ---
 name: save-data
-description: "the app can remember things — save information and read it back later. Use when the vibe coder says something like: save my data; remember this; store info; add a database."
+description: "the app can remember things — save information and read it back later. Use when the vibe coder says something like: save my data; remember this; store info; add a database; book my classes; yoga booking."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: save-data
 
+> Agent-only: follow the Persistent features sequence in `.vybekiit/agent/session-bootstrap.md`. Reuse the relevant catalog presets before adding app-owned extensions, and record structural and behavioral evidence separately.
+
 **Goal:** the app can remember things — save information and read it back later.
 
 **Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
-translate every error · celebrate. You do all the wiring; the builder only pastes a value when asked
-or describes, in plain words, what the app should remember.
+translate every error · celebrate. Continue authorized work independently. Infer what needs saving
+from the builder's request; ask only when a missing product decision changes the behavior.
 
 > (Under the hood — agent-only) Use `@vybekiit/db`'s `resolveDataProvider()` for every read/write.
 > Follow the platform wrapper for the active `DATA_PROVIDER`:
@@ -23,29 +31,55 @@ or describes, in plain words, what the app should remember.
 > - `firebase` → `platform-skills/firebase-vybekiit.md`
 > - `mongodb` / `aws` → advanced; maintainer docs only
 
+## Reuse before implementation
+
+For bookings, class schedules, appointments, and cancellations, discover `booking` through
+`vybekiit list-presets`, then apply its prerequisites and migration. Use its atomic reservation and
+cancellation functions through verified server sessions. Add only missing app-specific fields and
+permissions. Do not substitute selling class packs for a request to book classes.
+The business owner is the app admin: authorize schedule changes with `checkAdminAccess` from
+`@/lib/adminAccess` (sign-in emails in `ADMIN_EMAILS`) plus any staff permissions you add. Never
+create an organization for each account that signs in.
+For other requests, select matching presets from the catalog before authoring an extension.
+
 ## Steps
 
 1. **Make sure the database is ready.** Run the database tool via `vybekiit doctor`. For MCP-tier providers
    (Supabase, Neon, Firebase), merge the matching `agent/mcp-*.json` via `agent/mcp-setup.md` and use
    login-once onboarding. If MCP fails once, run `vybekiit doc-fallback supabase` (or `neon` /
    `firebase`) and tell the builder you're checking the official setup guide (plain phrase only).
-   Collect any access keys **one at a time** and save them to the secret settings file.
+   Inspect the selected service's existing CLI or MCP login and exact project before requesting
+   access. Reuse authorized connections and preserve existing projects. Never delete a project to
+   free capacity. Request one manual action only when an actual access blocker remains.
+   Supabase keys: after `supabase login`, run `vybekiit-automate db setup --json --project-ref=<ref>`.
+   It saves `SUPABASE_URL` and `SUPABASE_ANON_KEY` to `settings.env`, `SUPABASE_SERVICE_ROLE_KEY` to `.env`, and prints
+   only their names.
    **Verify:** the database is reachable (`@vybekiit/db`'s `pingDatabase`).
 
-2. **Agree on what to remember, in plain words.** If no prior `design-my-data` session, run that skill first
-   (or run `vybekiit plan-data-model entities.json` for a single simple entity). Ask what the app
-   should save; turn their answer into a simple data shape yourself.
-   **Verify:** read the shape back in one sentence and get a yes.
+2. **Decide what to remember from the request.** Reuse existing data shapes and ownership rules.
+   Use `design-my-data` only when the relationships need further design. Summarize the choice in
+   one sentence and continue unless a missing product decision blocks it.
+   **Verify:** the stored information supports the requested actions and access boundaries.
+
+3. **Write behavior tests before the implementation.** Cover saving and reading, unauthorized
+   access, duplicates, and concurrent writes where business limits apply. Enforce limits at the
+   database or server boundary; a separate count followed by an insert can race.
 
-3. **Wire saving and reading.** Use `resolveDataProvider()` for insert / get / query / update /
-   remove. Replace the dashboard's placeholder stats marker (`TODO(vybekiit): … — skill: save-data`;
+4. **Wire saving and reading.** Use `resolveDataProvider()` for insert / get / query / update /
+   remove. Insert new rows with `id: ''` so the adapter generates the key; preset tables use UUID
+   keys. Replace the dashboard's placeholder stats marker (`TODO(vybekiit): … — skill: save-data`;
    grep them) with a real read.
    **Verify:** the code builds with no errors.
 
-4. **Write a test** that saves a record and reads it back, and keep it green.
-
-5. **Try it for real.** Save something, then read it back in the app.
-   **Verify:** what was saved comes back exactly.
+5. **Try it for real.** A build, type check, or mocked test is not this step. Install missing
+   dependencies, start the app in the background (`pnpm dev --port 3100 > /tmp/app.log 2>&1 &`),
+   and wait until `curl -s localhost:3100` answers. Sign up two accounts, each with its own cookie
+   jar; use an `ADMIN_EMAILS` address for the owner when the feature has owner-only actions:
+   `curl -c owner.jar -H 'content-type: application/json' -d '{"email":"…","password":"…"}' localhost:3100/api/auth/signup`.
+   Save through your own routes with `-b owner.jar`, read it back with the other jar, and send one
+   request each account must be refused. Stop the server afterwards.
+   **Verify:** what was saved comes back exactly, refused requests get 401 or 403, and your summary
+   quotes the status codes you saw. Browser-only storage does not complete a shared-data request.
    🎉 *Celebrate* — the app remembers things now.
 
 ## If anything breaks
@@ -60,8 +94,9 @@ them, don't explain the internals.
 
 ## Definition of done
 
-The app saves and reads back real data, a passing test covers it, and no save-data markers remain
-(re-grep `TODO(vybekiit)`).
+The running app saves and reads back real data and refuses unauthorized requests, your summary
+quotes those responses, a passing test covers it, and no save-data markers remain (re-grep
+`TODO(vybekiit)`). Tests against mocked data alone do not complete this skill.
 
 ## After completing this skill
 

package/dist/global-skills/sentry-sdk-setup/SKILL.md

@@ -3,6 +3,7 @@ name: sentry-sdk-setup
 description: Set up Sentry in any language or framework. Detects the user's platform and loads the right SDK skill. Use when asked to add Sentry, install an SDK, or set up error monitoring in a project.
 license: Apache-2.0
 role: router
+disable-model-invocation: true
 ---
 
 > [All Skills](../../SKILL_TREE.md)

package/dist/global-skills/sentry-workflow/SKILL.md

@@ -3,6 +3,7 @@ name: sentry-workflow
 description: Keep Sentry SDKs up to date. Use when asked to upgrade the Sentry SDK across major versions, migrate SDK versions, or fix deprecated APIs.
 license: Apache-2.0
 role: router
+disable-model-invocation: true
 ---
 
 > [All Skills](../../SKILL_TREE.md)

package/dist/global-skills/setup-email/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: setup-email
@@ -25,17 +31,16 @@ when asked.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/EmailNotificationsPage.tsx` export `EmailNotificationsPage` into the buyer app at route `/dashboard/email`.
-   Recipe id: `email-notifications`. Presets: notifications_log.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('setup-email')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe email-notifications`. It adds the page
+   at `/settings/notifications` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/settings/notifications` opens and shows practice content.
 
 1. **Confirm the one sending detail.** Ask for (or guide them to set up) a verified sender address —
    the "from" address their app's emails come from. Tell them exactly where to confirm it, then save
-   it to the secret settings file.
+   it to the secret settings file. For the sending key (Resend by default), ask the builder to run
+   `vybekiit-automate resend setup` in their own terminal. It asks for the key with hidden typing,
+   checks it, and saves `RESEND_API_KEY` to `.env`. Never ask for the key in chat.
    **Verify:** the sender address is set and confirmed.
 
 2. **Wire sending.** Connect the app's email sending to `resolveEmailProvider()` (see wrapper for

package/dist/global-skills/setup-payments/SKILL.md

@@ -1,15 +1,21 @@
 ---
 name: setup-payments
-description: "the builder can take real money. By the end, a test purchase succeeds end-to-end. Use when the vibe coder says something like: add payments; take money; sell something; charge people."
+description: "the requested purchase flow works in practice. Use when the vibe coder says something like: add payments; take money; sell something; charge people."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: setup-payments
 
-**Goal:** the builder can take real money. By the end, a test purchase succeeds end-to-end.
+**Goal:** the requested purchase flow works in practice. A test purchase succeeds end-to-end; accepting real money requires separately verified live setup.
 
 **Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
 translate every error · celebrate. You wire all the code; the builder only signs in once when asked.
@@ -26,14 +32,11 @@ translate every error · celebrate. You wire all the code; the builder only sign
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/PricingPage.tsx` export `PricingPage` into the buyer app at route `/pricing`.
-   Recipe id: `pricing`. Presets: orders + webhook_events (apply after provider secrets exist).
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Selling physical/digital goods (not only subscriptions)? Also install catalog ids
-   `commerce-products`, `commerce-cart`, `commerce-checkout` via `getPageRecipeInstall`.
-   Also reference `packages/agentKit` `getPageRecipeInstall('setup-payments')` / page-recipe-manifest.json.
-   **Verify:** `/pricing` builds and shows practice plans before provider wiring.
+0. **Add the ready-made pricing page first.** Run `vybekiit add page-recipe pricing`. It adds the page
+   at `/pricing` and lists any data setup to run next (run that after the payment keys are saved).
+   Selling products, not only plans? Also run `vybekiit add page-recipe product-grid`, then `cart` and
+   `checkout` the same way. Keep every `TODO:` in the pages and fill each one in as you connect payments.
+   **Verify:** `/pricing` opens and shows practice plans.
 
 1. **Explain the plan in one line.** *"I'll connect a payment service so you can charge people. I'll do
    the setup — you'll sign in once when I ask."* (Never name Lemon Squeezy, Stripe, or PayPal.)
@@ -42,15 +45,16 @@ translate every error · celebrate. You wire all the code; the builder only sign
    - Run `vybekiit-automate ls setup --json …` (or wizard mode without `--json`).
    - If Lemon Squeezy shows a sign-in screen, the automation **waits** until the builder completes login in the browser, then continues — no separate standby step required.
    - Optional pre-check: `vybekiit-automate ls standby` opens the dashboard and waits the same way.
-   - Write JSON output to `.env` (`LEMONSQUEEZY_STORE_ID`, variant ID, API key, webhook secret).
-   **Verify:** values saved; product exists in test mode.
+   - The command saves the store, product and key settings straight into the app's `.env` and prints only
+     their names. Never copy key values into the chat.
+   **Verify:** the command lists the saved names; product exists in test mode.
 
 3. **Stripe (opt-in).** Merge `mcp-stripe.json` via `agent/mcp-setup.md`; builder OAuth once.
    Agent creates product/price via Stripe MCP; write restricted API key to `.env`.
    **Verify:** test mode product visible in Stripe dashboard.
 
 4. **PayPal (opt-in).** Merge `mcp-paypal.json` via `agent/mcp-setup.md`; builder OAuth once (sandbox).
-   Agent provisions via PayPal MCP; write client id/secret and webhook id to `.env`.
+   Agent provisions via PayPal MCP; write the client secret to `.env`, the client id and webhook id to `settings.env`.
    **Verify:** sandbox checkout completes.
 
 5. **Connect the automatic payment message (webhook).** Webhook URL is `/api/webhook` on the deployed app
@@ -61,9 +65,9 @@ translate every error · celebrate. You wire all the code; the builder only sign
    **Verify:** provider shows webhook connected.
 
 6. **Test a purchase.** Use test mode for a fake purchase.
-   **Verify:** order recorded (webhook success). 🎉 *Celebrate* — they can take money.
+   **Verify:** the provider confirms a test payment, its signed payment message is verified, and the matching order is stored with the expected purchase effect. A local pretend checkout or a configured connection alone does not pass. Celebrate with "The practice payment worked." Never charge real money during testing.
 
-7. **Customize what a purchase does.** Ask what should happen when someone pays. Implement in
+7. **Preserve the requested purchase effect.** Use what the builder already said, such as confirming a class booking. Ask only if the intended effect is still unknown. Implement in
    `src/lib/fulfillment.ts`. Write a quick test and keep it green.
 
 ## If anything breaks

package/dist/global-skills/setup-sms/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: setup-sms
@@ -21,7 +27,7 @@ metadata:
 1. **Collect Twilio secret settings** through doctor (never ask the builder to type SIDs by hand):
    `TWILIO_ACCOUNT_SID`, `TWILIO_AUTH_TOKEN`, `TWILIO_FROM_NUMBER`. Optional:
    `TWILIO_VERIFY_SERVICE_SID`, `TWILIO_WHATSAPP_FROM`.
-   **Verify:** values saved to `.env`.
+   **Verify:** values saved to `settings.env` and `.env`.
 
 2. **Set `NOTIFICATIONS_PROVIDER=twilio`.**
    **Verify:** `resolveNotificationsProvider()` does not throw.

package/dist/global-skills/sign-in-with-email-link/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: sign-in-with-email-link
@@ -18,12 +24,10 @@ metadata:
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install / extend the auth page recipe first (catalog SSOT — Option C).**
-   Copy or extend `apps/componentLibrary/src/pageRecipes/AuthPage.tsx` export `AuthPage` at route `/login`
-   with a "Email me a link" path. Recipe id: `auth`. Preset: auth-bridge.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('sign-in-with-email-link')` / page-recipe-manifest.json.
-   **Verify:** `/login` shows a practice magic-link entry before provider wiring.
+0. **Add the ready-made sign-in page first.** Run `vybekiit add page-recipe auth`. It adds the page
+   at `/login` (if the app already has a sign-in page, it is kept). Then add an "Email me a link" option to it.
+   Keep every `TODO:` in the page and fill each one in as you connect the real service.
+   **Verify:** `/login` opens and shows an "Email me a link" option with practice content.
 
 1. **Confirm sign-in + email are wired** (`add-signin`, `setup-email` when going live).
    **Verify:** email OTP or password sign-in already works.

package/dist/global-skills/sign-in-with-google/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: sign-in-with-google
-description: "people can tap **Continue with Google** — one button that signs them in **or** creates. Use when the vibe coder says something like: sign in with google; continue with google."
+description: "people can tap Continue with Google — one button that signs them in or creates their account. Use when the vibe coder says something like: sign in with google; continue with google."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: sign-in-with-google
@@ -22,14 +28,12 @@ needs it.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install / extend the auth page recipe first (catalog SSOT — Option C).**
-   Copy or extend `apps/componentLibrary/src/pageRecipes/AuthPage.tsx` export `AuthPage` at route `/login`
-   with a **Continue with Google** button. Recipe id: `auth`. Preset: auth-bridge.
-   Legal pages when needed: `TermsOfServicePage` → `/terms`, `PrivacyPolicyPage` → `/privacy`
-   from the page-recipe manifest (group `legal`).
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('sign-in-with-google')` / page-recipe-manifest.json.
-   **Verify:** `/login` shows practice Google button before provider wiring.
+0. **Add the ready-made sign-in page first.** Run `vybekiit add page-recipe auth`. It adds the page
+   at `/login` (if the app already has a sign-in page, it is kept). Then add a "Continue with Google" button to it.
+   Keep every `TODO:` in the page and fill each one in as you connect the real service.
+   Need terms and privacy pages for Google? Run `vybekiit add page-recipe terms-of-service` and
+   `vybekiit add page-recipe privacy-policy` (they add `/terms` and `/privacy`).
+   **Verify:** `/login` opens and shows a practice "Continue with Google" button.
 
 1. **Make sure the basics exist.** Database (`save-data`) and base sign-in (`add-signin`) must work
    first — Google builds on top.
@@ -39,10 +43,13 @@ needs it.
    If it says "not signed in yet," walk the builder through the one command it prints.
    **Verify:** doctor reports gcloud ready.
 
-3. **Create the Google login for your app.** Use `gcloud` to create a **Web application** OAuth client.
-   Write `GOOGLE_OAUTH_CLIENT_ID`, `GOOGLE_OAUTH_CLIENT_SECRET`, and `GOOGLE_OAUTH_REDIRECT_URI`
-   to `.env`. Never ask the builder to open the Google Cloud console.
-   **Verify:** all three values are non-empty in `.env`.
+3. **Create the Google login for your app.** Run `vybekiit-automate google oauth --json` with
+   `--project=<gcloud-project-id>`, `--app-name=<app-name>`, `--support-email=<builder-email>`,
+   `--app-url=<app-url>` and `--redirect=<app-url>/api/auth/callback/google`. It creates (or fixes) the
+   Web login client and saves `GOOGLE_OAUTH_CLIENT_ID` to `settings.env` and
+   `GOOGLE_OAUTH_CLIENT_SECRET` to `.env`, printing only their names. If Google asks to sign in, the builder signs in once in the
+   browser it opens. Never ask the builder to open the Google Cloud console.
+   **Verify:** both names are listed as saved and are non-empty.
 
 4. **Enable Google on the sign-in handler.** Follow `platform-skills/better-auth-vybekiit.md` — add
    the Google social provider to the auth route. One flow handles sign-in and sign-up.