vybekiit 0.7.29 → 0.7.32

package/dist/global-guidance/language.md

@@ -67,16 +67,6 @@ read a definition aloud.
 | transactional email | the emails your app sends automatically | receipts, sign-in codes, confirmations |
 | SMTP / mail provider | your email | the service that delivers their app's emails |
 
-## Payments & tax
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| Merchant of Record / MoR | the service that handles tax for you | removes VAT/sales-tax fear — the default handles it |
-| VAT / sales tax | tax on sales (handled for you when MoR is on) | they never need to file tax themselves on the default path |
-| variant / product id | the product's ID in the payment dashboard (agent handles) | they pick a price; you wire the id |
-| subscription | recurring charge | money that repeats on a schedule |
-| refund / chargeback | money returned / disputed charge | when a customer gets money back or disputes a charge |
-
 ## Building blocks (rarely needed, but translate if it slips out)
 
 | Don't say (jargon) | Say instead (plain) | Why it matters to them |
@@ -95,24 +85,6 @@ read a definition aloud.
 | frontend | the part people see and click | the screens, buttons, and text |
 | backend | the part that does the work behind the scenes | saving data, sending email, taking payment |
 
-## Quality and saving your work
-
-<!-- source: @vybekiit/agent-kit renderSdlcVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| test / unit test | I checked it still works | reassures them without test-suite vocabulary |
-| TDD / tests-first | *(agent-internal — never say)* | agent-internal — never say |
-| linter / formatter / Biome | tidying the code | usually invisible; only mention if they ask why you paused |
-| quality smoke / typecheck | everything checks out | onboarding and pre-ship reassurance |
-| pull request / PR | a safe copy for the checker to review | when saving via branch before merge |
-| CI / GitHub Actions | the automatic checker online | never name GitHub Actions |
-| CD / deploy pipeline | putting updates online automatically | only if they overhear pipeline talk |
-| Playwright / E2E / headless browser | I walked through your app like a visitor would | UI walkthrough without tool names |
-| back up / save progress online | I saved your progress online | never say GitHub — stays in service ban list |
-| worktree | *(agent-internal — never say)* | agent-internal — never say |
-| husky / hook / pre-push | *(agent-internal — never say)* | agent-internal — never say |
-
 ## Planning together (before big builds)
 
 | Don't say (jargon) | Say instead (plain) | Why it matters to them |
@@ -175,65 +147,6 @@ read a definition aloud.
 | locale | the visitor's language and region | so the app speaks each visitor's language |
 | RTL / right-to-left | apps that read right-to-left (Hebrew, Arabic) | the layout flips automatically for them |
 
-## Your app's layout
-
-<!-- source: @vybekiit/agent-kit renderUiVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| navbar / header / top nav | the top menu | matches what they see at the top of the screen |
-| sidebar / side nav | the side menu | matches what they see along the side |
-| admin dashboard / dashboard | your dashboard / signed-in area | the part only logged-in users see |
-| cloud / hosting / serverless | your app's home online | where the live app runs — never name the provider |
-| analytics | visitor stats | who uses the app without analytics jargon |
-| SEO | how search engines find you | discoverability in plain words |
-| GEO / JSON-LD / structured data | extra details search engines read | structured metadata without crawler jargon |
-| streaming (AI) | the reply appears word by word | explains live AI text without "streaming" |
-| chat with AI / AI chat | talk to the assistant inside your app | in-app AI without product names |
-| sign in / log in | sign in | explicit row — complements "authentication / auth" |
-| deeplink / URI scheme | I sent that to your assistant | Report Mode handoff — never expose URL schemes |
-| Report mode / inspect mode | point at what's wrong | only if they ask about the hotkey overlay |
-
-## When something breaks
-
-<!-- source: @vybekiit/agent-kit renderFailureVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| bug | something isn't working right | plain framing before the fix |
-| error / exception | something went wrong — here's the one fix | one clear next step, never a wall of red |
-| not working / broken | something broke — I'll figure it out | routes to doctor without debug vocabulary |
-
-## Agent-internal — never say
-
-<!-- source: @vybekiit/agent-kit renderAgentInternalVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| middleware | *(agent-internal — never say)* | agent-internal — never say |
-| idempotency | *(agent-internal — never say)* | agent-internal — never say |
-| race condition | *(agent-internal — never say)* | agent-internal — never say |
-| DOM / CSS selector / element selector | *(agent-internal — never say)* | agent-internal — say "what you clicked" to the vibe coder |
-
-## Talking about the tools themselves
-
-The vibe coder also overhears you reasoning about your own tooling. Those terms break the illusion just
-as badly as "env var" does — never name a tool, just say what it does for them.
-
-<!-- source: @vybekiit/agent-kit renderToolVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| Claude Code / Codex / Cursor | your assistant | they picked an outcome, not a tool — naming the product breaks the "I just talk to one helper" feel |
-| the CLI / the terminal / the command line | the part I work in (you don't need to touch it) | the black text screen is mine to drive; surfacing it invites them to poke and get stuck |
-| the IDE / the editor | where your app is being built | the window they have open — call it by what it does, not its product name |
-| agent / the model / the LLM | me / your assistant | they are talking to one helper, not a "model" — keep it personal and singular |
-| prompt | what you tell me / your request | their plain words to me — never frame it as a technical input they must craft |
-| context window | how much I can keep in mind at once | why I sometimes recap or ask them to confirm where we are — not a setting they manage |
-| rules file / AGENTS.md / CLAUDE.md / .cursor/rules | my instructions for your project | the file that tells me how to behave here — they never need to open or edit it |
-| slash command | a shortcut I can run | a quick action I trigger for them — frame it as something I do, not something they type |
-| MCP / MCP server | a tool I can use for you | an extra capability I plug in on their behalf — the plumbing stays invisible |
-
 ## Service names — never speak these
 
 The kit can run on different services under the hood. **Never name the underlying service to the
@@ -246,16 +159,6 @@ vibe coder.** They chose a goal, not a technology — you pick the service and k
 - This holds even when a provider's own screen is open in front of the vibe coder — guide them by what
   they see and click ("the blue Authorize button"), not by the service's name.
 
-## Tone
-
-<!-- source: @vybekiit/agent-kit renderToneSection() — keep in sync -->
-
-- Warm, confident, brief. You're the expert handling the hard parts.
-- One step at a time. Never a wall of instructions.
-- Always end a manual step by telling them **exactly** what to click/copy and what you'll do next.
-- Celebrate wins.
-- **No em dashes (`—`).** They read like AI filler. In chat and body copy, use a period, comma, colon, or parentheses instead. **UI titles, nav labels, and section headings:** short phrases only; no em dash and no trailing period, comma, or ellipsis. Split into two lines or two i18n keys instead. Hyphens in compound words (`build-time`) are fine.
-
 ## Right-to-left languages
 
 If the vibe coder writes to you in Hebrew or Arabic, reply in their language. Their app already mirrors
@@ -321,10 +224,16 @@ its layout automatically for RTL visitors — you don't need to do anything spec
 | agent / the model / the LLM | me / your assistant | they are talking to one helper, not a "model" — keep it personal and singular |
 | prompt | what you tell me / your request | their plain words to me — never frame it as a technical input they must craft |
 | context window | how much I can keep in mind at once | why I sometimes recap or ask them to confirm where we are — not a setting they manage |
-| rules file / AGENTS.md / CLAUDE.md / .cursor/rules | my instructions for your project | the file that tells me how to behave here — they never need to open or edit it |
+| rules file / AGENTS.md / .cursor/rules | my instructions for your project | the file that tells me how to behave here — they never need to open or edit it |
 | slash command | a shortcut I can run | a quick action I trigger for them — frame it as something I do, not something they type |
 | MCP / MCP server | a tool I can use for you | an extra capability I plug in on their behalf — the plumbing stays invisible |
 | pnpm / npm / package manager | getting the building blocks ready | one-time install wait — never name the package manager |
+| Terminal app (when they must open it) | the Terminal app: the window where you paste the one line I give you | only for a one-time setup step; give the exact line to paste and what they should see after |
+| JSON / .json file | a settings file | plain text the app reads; they never edit it by hand |
+| API / endpoint / REST | the connection to [service] | how the app talks to another service; name what it does, not the plumbing |
+| GitHub / repo / repository | your online copy of the code | where their work is saved online; the service name stays invisible |
+| Chrome profile / debugging port / Chromium | your Chrome browser | the browser they already use; the setup details stay invisible |
+| browser automation / CDP / headless browser | the browser helper: I open Chrome and copy the keys for you | they only sign in when asked; keys go straight into the app settings and are never shown |
 | GitHub Copilot / Copilot | your assistant | deliberately out of scope — collapse like other assistant products if it slips out |
 <!-- vybekiit:generated:end tool-vocabulary -->
 
@@ -435,9 +344,5 @@ its layout automatically for RTL visitors — you don't need to do anything spec
 | idempotency | *(agent-internal — never say)* | agent-internal — never say |
 | race condition | *(agent-internal — never say)* | agent-internal — never say |
 | DOM / CSS selector / element selector | *(agent-internal — never say)* | agent-internal — say "what you clicked" or "location in code" in the handoff only |
-| sandbox | *(agent-internal — never say)* | agent-internal — never say |
-| ask mode / agent mode | *(agent-internal — never say)* | agent-internal — never say |
-| skills CLI / skills.sh | *(agent-internal — never say)* | agent-internal — never say |
-| *-vybekiit.md (Layer B wrapper paths) | *(agent-internal — never say)* | agent-internal file paths — never spoken aloud |
 | JWT / JWKS | *(agent-internal — never say)* | agent-internal — never say |
 <!-- vybekiit:generated:end agent-internal-vocabulary -->

package/dist/global-skills/add-ai/SKILL.md

@@ -31,16 +31,15 @@ Inspect an existing app before changing it. Scaffold a new kit app only when the
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/AiAssistantPage.tsx` export `AiAssistantPage` into the buyer app at route `/dashboard/ai`.
-   Recipe id: `ai-assistant`. Presets: ai_conversations + embeddings.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-ai')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe ai-assistant`. It adds the page
+   at `/assistant` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/assistant` opens and shows practice content.
 
 1. **Explain in one line.** *"I'll add a smart helper that answers using AI."*
-2. **Collect the API key** into secret settings if not already present (`OPENAI_API_KEY` default).
+2. **Collect the API key** if `OPENAI_API_KEY` is not in `.env` yet. Ask the builder to run
+   `vybekiit-automate openai setup` in their own terminal (`anthropic setup` for Anthropic). It asks
+   for the key with hidden typing, checks it, and saves it to `.env`. Never ask for the key in chat.
    Run `vybekiit apply-preset embeddings` and `vybekiit apply-preset ai_conversations` when chat history
    is needed (`platform-skills/db-presets-vybekiit.md`).
    **Verify:** keys saved; `vybekiit verify-presets embeddings` when presets applied.

package/dist/global-skills/add-analytics/SKILL.md

@@ -29,13 +29,10 @@ unless you screen-share a summary.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/AnalyticsPage.tsx` export `AnalyticsPage` into the buyer app at route `/dashboard/analytics`.
-   Recipe id: `analytics`. Presets: none.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-analytics')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe analytics`. It adds the page
+   at `/analytics` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/analytics` opens and shows practice content.
 
 1. **Explain in one line.** *"I'll set up visitor stats so you can see how many people use your app."*
 

package/dist/global-skills/add-app-clip/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: add-app-clip
 description: Add an iOS App Clip target to an Expo app. Use when the user mentions App Clip, AASA, apple-app-site-association, appclips, smart app banner, or wants to ship a lightweight iOS Clip invoked from a URL alongside their parent app.
+disable-model-invocation: true
 ---
 
 # Add an App Clip to an Expo App

package/dist/global-skills/add-blog/SKILL.md

@@ -27,13 +27,10 @@ Inspect an existing app before changing it. Scaffold a new kit app only when the
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/BlogPage.tsx` export `BlogPage` into the buyer app at route `/blog`.
-   Recipe id: `blog`. Presets: none.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-blog')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe blog`. It adds the page
+   at `/blog` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/blog` opens and shows practice content.
 
 1. Explain: *"I'll add blog pages you can edit as simple files."*
 2. Add MDX pages under `content/` (title from `#` heading; optional description in front matter).

package/dist/global-skills/add-files/SKILL.md

@@ -29,13 +29,10 @@ translate every error · celebrate. You build the upload; the builder only paste
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/FileManagerPage.tsx` export `FileManagerPage` into the buyer app at route `/dashboard/files`.
-   Recipe id: `file-manager`. Presets: file_metadata.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-files')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe file-manager`. It adds the page
+   at `/files` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/files` opens and shows practice content.
 
 1. **Make sure file storage is ready.** Run `vybekiit doctor` so the storage tool is set up, and
    collect any access key it needs — one at a time — into the secret settings file.

package/dist/global-skills/add-images/SKILL.md

@@ -28,13 +28,10 @@ translate every error · celebrate. You place and wire images; the kit compresse
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/BrandAssetsPage.tsx` export `BrandAssetsPage` into the buyer app at route `/dashboard/brand`.
-   Recipe id: `brand-assets`. Presets: none.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-images')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe brand-assets`. It adds the page
+   at `/brand` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/brand` opens and shows practice content.
 
 1. **Pick the folder.** Web → `public/`. Mobile → `assets/`. Extension → `public/icon/` (icons) or
    `public/` for other static files.

package/dist/global-skills/add-language/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: add-language
-description: "make the app speak another language — the builder asks in plain words (\"make it Hebrew\",. Use when the vibe coder says something like: translate my app; add spanish; make it hebrew."
+description: "make the app speak another language — the builder asks in plain words (\"make it Hebrew\", \"add Spanish\"), you wire a full locale in one session. Use when the vibe coder says something like: translate my app; add spanish; make it hebrew."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
@@ -24,13 +24,10 @@ celebrate. Follow `i18n-vybekiit.md` for all technical steps.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/LanguagePage.tsx` export `LanguagePage` into the buyer app at route `/dashboard/language`.
-   Recipe id: `language`. Presets: none.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-language')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe language`. It adds the page
+   at `/settings/language` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/settings/language` opens and shows practice content.
 
 1. **Ask which language** — plain words only. You pick the ISO code (e.g. Hebrew → `he`, Spanish → `es`).
 2. **Duplicate the catalog** — copy `messages/en.json` → `messages/{locale}.json`; translate every value.

package/dist/global-skills/add-notifications/SKILL.md

@@ -27,13 +27,10 @@ from the app.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/NotificationsCenterPage.tsx` export `NotificationsCenterPage` into the buyer app at route `/dashboard/notifications`.
-   Recipe id: `notifications-center`. Presets: notifications_log.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-notifications')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe notifications-center`. It adds the page
+   at `/notifications` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/notifications` opens and shows practice content.
 
 1. **Confirm email works first.** If `setup-email` is not done, run that skill first.
    **Verify:** a test email arrives.

package/dist/global-skills/add-realtime/SKILL.md

@@ -26,13 +26,10 @@ translate every error · celebrate.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/RealtimePage.tsx` export `RealtimePage` into the buyer app at route `/dashboard/realtime`.
-   Recipe id: `realtime`. Presets: realtime_publications.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-realtime')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe realtime`. It adds the page
+   at `/activity` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/activity` opens and shows practice content.
 
 1. **Explain in one line.** *"I'll turn on live updates so your app refreshes when data changes."*
 

package/dist/global-skills/add-search/SKILL.md

@@ -25,13 +25,10 @@ Inspect an existing app before changing it. Scaffold a new kit app only when the
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/SearchPage.tsx` export `SearchPage` into the buyer app at route `/dashboard/search`.
-   Recipe id: `search`. Presets: search_documents + embeddings.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-search')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe search`. It adds the page
+   at `/search` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/search` opens and shows practice content.
 
 1. Explain: *"I'll add search so people can find things quickly."*
 2. Run `vybekiit apply-preset search_documents` then wire index on create/update and a search UI calling

package/dist/global-skills/add-signin/SKILL.md

@@ -27,14 +27,10 @@ translate every error · celebrate. You wire all the code; the builder only past
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/AuthPage.tsx` export `AuthPage` into the buyer app at route `/login`
-   (merge with existing login/sign-up screens if present — do not duplicate routes).
-   Recipe id: `auth`. Preset: auth-bridge.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Goal id for lookup is `sign-in` (this skill folder is `add-signin`).
-   Also reference `packages/agentKit` `getPageRecipeInstall('sign-in')` / page-recipe-manifest.json.
-   **Verify:** `/login` builds and shows practice sign-in UI before provider wiring.
+0. **Add the ready-made sign-in page first.** Run `vybekiit add page-recipe auth`. It adds the page
+   at `/login` (if the app already has a sign-in page, it is kept, so merge the two instead of adding
+   a second one). Keep every `TODO:` in the page and fill each one in as you connect the real service.
+   **Verify:** `/login` opens and shows a practice sign-in form.
 
 1. **Make sure their app can remember things first.** Sign-in needs a database. If one isn't set
    up yet, run `save-data` first, then come back.

package/dist/global-skills/add-teams/SKILL.md

@@ -29,13 +29,10 @@ have access.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Page recipe (catalog SSOT — Option C; Tier-1 already shipped).**
-   Web ships interactive teams at `src/components/saas/teams.tsx` → `/dashboard/teams`.
-   Prefer that surface. Richer catalog reference: `apps/componentLibrary/src/pageRecipes/TeamsPage.tsx`
-   export `TeamsPage` (recipe id `teams`). Need admin user/role screens? Install catalog ids
-   `admin-panel` via `getPageRecipeInstall('admin-panel')`.
-   Also reference `packages/agentKit` `getPageRecipeInstall('add-teams')` / page-recipe-manifest.json.
-   **Verify:** `/dashboard/teams` renders with practice invite UI before provider wiring.
+0. **Use the teams page the app already has.** It lives at `/dashboard/teams`
+   (`src/components/saas/teams.tsx`). Need admin screens for users and roles too? Run
+   `vybekiit add page-recipe admin-panel`.
+   **Verify:** `/dashboard/teams` opens and shows practice invites.
 
 1. **Confirm sign-in works first.** If `add-signin` is not done, run that skill first — teams need
    accounts.

package/dist/global-skills/aws-cdk/SKILL.md

@@ -3,6 +3,7 @@ name: aws-cdk
 description: Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Applies when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement.
 metadata:
   version: "2"
+disable-model-invocation: true
 ---
 
 # AWS CDK

package/dist/global-skills/aws-cloudformation/SKILL.md

@@ -3,6 +3,7 @@ name: aws-cloudformation
 description: Authors, validates, and troubleshoots AWS CloudFormation templates. Covers template authoring with secure defaults, local validation with either cfn-lint or cloudformation-validate, cfn-guard security and compliance checks as a recommended default, account-aware CloudFormation service pre-deployment validation, CloudFormation Express mode for faster deployments, and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation. Also covers author-time template intelligence with the CloudFormation Language Server and published cloudformation-validate libraries.
 metadata:
   version: "3"
+disable-model-invocation: true
 ---
 # CloudFormation
 

package/dist/global-skills/aws-serverless/SKILL.md

@@ -3,6 +3,7 @@ name: aws-serverless
 description: Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK. Covers cold starts, CORS debugging, event source mappings, troubleshooting, concurrency, SnapStart, Powertools, function URLs, EventBridge Scheduler, Lambda layers, and production readiness. Triggers on mentions of Lambda, API Gateway, Step Functions, SAM templates, CDK serverless stacks, DynamoDB stream triggers, SQS event sources, cold starts, timeouts, 502/504 errors, throttling, concurrency, CORS, Powertools, or any event-driven architecture on AWS, even without the word "serverless." Does not apply to EC2, ECS/Fargate containers, or Amplify hosting.
 metadata:
   version: "4"
+disable-model-invocation: true
 ---
 
 # AWS Serverless

package/dist/global-skills/aws-serverless/references/compute-decision-edge-cases.md

@@ -0,0 +1,77 @@
+# Compute Decision Edge Cases (Tier 4)
+
+Tier 4 of the compute decision flow in `SKILL.md`: feature-level questions that are decided **after** the form factor and capacity provider are locked. Each section gives the question to ask, the decision, and the thresholds and caveats that the one-line summary in `SKILL.md` leaves out. Read this file when a request raises duration limits, cold starts or first-request latency, stream or queue lag, or tenant isolation.
+
+## Contents
+
+- [Duration ceilings](#duration-ceilings)
+- [Long-lived sessions and long executions](#long-lived-sessions-and-long-executions)
+- [Cold start vs stream lag](#cold-start-vs-stream-lag)
+- [First-request latency](#first-request-latency)
+- [Steady-state traffic: Managed Instances](#steady-state-traffic-managed-instances)
+- [Tenant isolation](#tenant-isolation)
+
+---
+
+## Duration ceilings
+
+| Form factor / feature | Ceiling | Notes |
+|---|---|---|
+| Event Functions · On-Demand | 15 min per invocation | Every invocation type |
+| Web Functions | 15 min per request | Node.js only; On-Demand only |
+| Event Functions · Managed Instances | 90 min per invocation | Asynchronous and event source mapping invocations only; synchronous invocations keep the 15-minute ceiling |
+| MicroVMs | 8 h per session | Customer-managed lifecycle (launch/suspend/resume/terminate) within the session |
+| Durable Functions | 1 year per execution (async invocation) | Each step is bounded by the Lambda timeout of the capacity provider it runs on; waits cost nothing |
+| Step Functions | Standard 1 year, Express 5 min | See [orchestration.md](orchestration.md) |
+
+Anything longer than these is outside Lambda: **aws-containers** (ECS/Fargate) or **aws-compute** (EC2).
+
+---
+
+## Long-lived sessions and long executions
+
+Ask for the overall duration and, if the work splits into tasks, the per-task duration (the per-step ceiling is min(task, overall)).
+
+- MicroVMs: session > 8 h → **aws-compute** (EC2); otherwise MicroVMs.
+- Functions with multiple coordinated tasks → **Durable Functions** on Event Functions (`SKILL.md` Step 3); the remaining choice is On-Demand vs Managed Instances per step duration.
+- Single **Event Function** invocation > 15 min → if asynchronous or invoked through an event source mapping and up to 90 min, use **Managed Instances**; if > 90 min, or synchronous and > 15 min, use **aws-containers** / **aws-compute**. This does not apply to MicroVM sessions, which use the 8 h session ceiling above.
+
+---
+
+## Cold start vs stream lag
+
+Decide form factor, programming model, and capacity first. Infer the symptom from metrics or the request when possible. If it is still unclear, ask in customer-observable terms: *"Is only the first request after an idle period slow, or is a queue/stream backlog growing while traffic is being processed?"*
+
+- **Stream/queue lag** (consumer backlog, `ApproximateAgeOfOldestRecord` or `IteratorAge` climbing, Kafka consumer lag) → **provisioned mode for the event source mapping** (minimum and maximum pollers / event poller units), on either Event Functions capacity provider. Provisioned mode controls input delivery: how quickly the event source mapping reads the source and hands records to Lambda. Provisioned Concurrency controls environment availability and does nothing for a backlog. Details: [concurrency.md](concurrency.md).
+- **First-request latency** → next section.
+
+---
+
+## First-request latency
+
+### Event Functions on On-Demand
+
+1. Start with the levers that cost nothing: a smaller deployment package and fewer or lighter layers, lazy initialization outside the hot path, and right-sized memory — [lambda.md](lambda.md). (arm64/Graviton is a price-performance choice, not a cold-start fix.)
+2. Use the stated latency objective when available. If the objective would change the choice and is missing, ask whether the application requires consistently double-digit-millisecond startup overhead or whether sub-second startup is sufficient.
+   - Double-digit milliseconds → **Provisioned Concurrency**.
+   - Sub-second → **SnapStart** if the runtime is Java, Python, or .NET, for zip or a container image: it snapshots the initialized execution environment after heavy initialization and resumes from that snapshot. Values generated during initialization must be regenerated when uniqueness matters, and network connections must be re-established after restore ([lambda.md](lambda.md)). Other runtimes → Provisioned Concurrency.
+3. If traffic runs continuously (peak-to-mean ratio below 2 within 5–10 minutes), Managed Instances may remove repeated environment launches — next section.
+
+### Web Functions
+
+Web Functions use On-Demand capacity, but Provisioned Concurrency and SnapStart do not apply. Optimize application initialization and dependency loading, then continue with **aws-lambda-web-functions** for its latency and concurrency guidance. Do not send a Web Functions workload through the Event Functions Provisioned Concurrency/SnapStart decision path.
+
+---
+
+## Steady-state traffic: Managed Instances
+
+Steady state or "always busy" traffic cited to eliminate environment-launch latency → **Managed Instances**: warm, multi-concurrent instances remove repeated cold starts. Infer this from continuous utilization when the request or metrics establish it. If traffic shape is missing, ask whether peak traffic stays below twice the average within any 5–10 minute window (peak-to-mean ratio below 2) or drains and sits idle for meaningful periods. The threshold follows from how Managed Instances scales: asynchronously on CPU utilization and multi-concurrency saturation, so traffic that more than doubles within 5 minutes can be throttled while capacity is added ([scaling](https://docs.aws.amazon.com/lambda/latest/dg/lambda-managed-instances-scaling.html)). Using Managed Instances requires creating a new function; Savings Plans and Reserved Instance pricing apply.
+
+---
+
+## Tenant isolation
+
+- Event and request handlers have **per-function isolation by default**; this is not a promise of a fresh Firecracker VM or a new execution environment for every invocation.
+- Handlers that need execution environments dedicated to one invoker or tenant → Event Functions on **On-Demand** with **tenant isolation mode**: set at creation, every invoke carries a tenant id, and environments assigned to one tenant are not reused for another. Tenant isolation mode is On-Demand only (not available on Managed Instances) and is not compatible with Function URLs, Provisioned Concurrency, or SnapStart.
+- A persistent per-tenant environment, untrusted user- or LLM-generated code, retained memory/disk/processes, or OS access (FUSE, eBPF, custom ports) → **MicroVMs** (**aws-lambda-microvms**). Isolation is per MicroVM environment and persists with that environment's lifecycle.
+- Do not rely on application-level sandboxing inside a shared execution environment.

package/dist/global-skills/better-auth-best-practices/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: better-auth-best-practices
 description: Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration.
+disable-model-invocation: true
 ---
 
 # Better Auth Integration Guide

package/dist/global-skills/better-auth-security-best-practices/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: better-auth-security-best-practices
 description: Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.
+disable-model-invocation: true
 ---
 
 ## Secret Management

package/dist/global-skills/building-native-ui/SKILL.md

@@ -3,6 +3,7 @@ name: building-native-ui
 description: Complete guide for building beautiful apps with Expo Router. Covers fundamentals, styling, components, navigation, animations, patterns, and native tabs.
 version: 1.0.1
 license: MIT
+disable-model-invocation: true
 ---
 
 # Expo UI Guidelines

package/dist/global-skills/buy-domain/SKILL.md

@@ -29,13 +29,10 @@ it.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the launch checklist recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/LaunchChecklistPage.tsx` export `LaunchChecklistPage` into the buyer app at route `/dashboard/launch`
-   (reuse if `go-live` already installed it).
-   Recipe id: `launch-checklist`. Preset: job_runs when deploy jobs are tracked.
-   Keep every `TODO:` in the recipe and wire domain checklist items after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('buy-domain')` / page-recipe-manifest.json.
-   **Verify:** `/dashboard/launch` builds with practice checklist UI.
+0. **Add the launch checklist page first.** Run `vybekiit add page-recipe launch-checklist` (skip it
+   if `go-live` already added it). It adds the page at `/launch`. Keep every `TODO:` in the page and
+   fill in the domain items as you go.
+   **Verify:** `/launch` opens and shows the practice checklist.
 
 1. **Help them choose a name.** Talk through a web address they'd like. Check it's available and
    guide registration **one step at a time** — they pay for it (it's their address).

package/dist/global-skills/check-safety/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: check-safety
-description: "confirm the app is protected end-to-end before ship — abuse, database safety, and every. Use when the vibe coder says something like: am i ready to ship; is my app safe; did we cover security."
+description: "confirm the app is protected end-to-end before ship — abuse, database safety, and every API route classified correctly. Use when the vibe coder says something like: am i ready to ship; is my app safe; did we cover security."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
@@ -23,13 +23,10 @@ API route classified correctly. Output a plain pass/fail summary for the builder
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/SafetyPage.tsx` export `SafetyPage` into the buyer app at route `/dashboard/safety`.
-   Recipe id: `safety`. Presets: none.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('check-safety')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe safety`. It adds the page
+   at `/safety` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/safety` opens and shows practice content.
 
 1. **Abuse / DDoS layer.** Confirm `SECURITY_RATE_LIMIT` and `SECURITY_ORIGIN_LOCK` are `on` in
    `.env`. Confirm `middleware.ts` passes the request path for tiered limits. Confirm `/api/webhook`

package/dist/global-skills/claimable-postgres/SKILL.md

@@ -11,6 +11,7 @@ description: >-
 metadata:
   parent: neon
   source: https://github.com/neondatabase/agent-skills/tree/main/skills/claimable-postgres
+disable-model-invocation: true
 ---
 
 **FIRST**: Use the parent `neon` skill for a Neon overview, getting started with Neon, Neon development best practices, and more.

package/dist/global-skills/configure-capabilities/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: configure-capabilities
-description: "the app has **only the permissions it needs** — the builder never thinks about Info.plist, Android manifest, or Expo plugins. Use when the vibe coder says something like: camera; location permission; notifications permission."
+description: "the app has only the permissions it needs — the builder never thinks about Info.plist, Android manifest, or Expo plugins. Use when the vibe coder says something like: camera; location permission; notifications permission."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/connect-account/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: connect-account
-description: "people can create accounts and sign in **inside the app**. Use when the vibe coder says something like: sign in; log in; create accounts; add users; forgot password; reset password."
+description: "people can create accounts and sign in inside the app. Use when the vibe coder says something like: sign in; log in; create accounts; add users; forgot password; reset password."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---