vybekiit 0.7.34 → 0.7.35

package/dist/global-skills/stripe-best-practices/references/security.md

@@ -18,7 +18,7 @@
 
 ## API keys
 
-Never include keys in source code. Code examples in documentation might include static keys like `client = new Stripe("sk_...")` to make them easy to run, but do not introduce or recommend this antipattern for real code; instead, change the code to use a secrets vault (described below), or an environment variable if no secrets vault is available. Strings matching the regular expression `/[sr]k_live_.*/` in source code are live Stripe API keys. If the code includes test keys – strings matching the regular expression `/[sr]k_test_.*/` – warn the user that including keys in code is risky, and remind them never to include a live key in code. Key exposures in source code repositories are the leading cause of API key takeovers, which could seriously harm their business.
+Never include keys in source code. Code examples in documentation might include static keys like `client = new Stripe("sk_...")` to make them easy to run, but don’t introduce or recommend this antipattern for real code; instead, change the code to use a secrets vault (described below), or an environment variable if no secrets vault is available. Strings matching the regular expression `/[sr]k_live_.*/` in source code are live Stripe API keys. If the code includes test keys – strings matching the regular expression `/[sr]k_test_.*/` – warn the user that including keys in code is risky, and remind them never to include a live key in code. Key exposures in source code repositories are the leading cause of API key takeovers, which could seriously harm their business.
 
 Always advise the user to store secret and restricted API keys in their platform’s secrets vault, never in source code or committed environment files. Platform-specific guidance for popular platforms:
 
@@ -41,7 +41,7 @@ If the code is under version control, help the user set up a pre-commit hook to
 
 Never build API endpoints or error pages that dump environment variables. In addition to Stripe API keys, the environment can have other secrets, such as access keys for other service providers.
 
-**Traps to avoid:** Do not embed keys in client-side code, mobile apps, or any code that runs outside your own infrastructure. Do not suggest that users substitute a real secret key into example code — point them to [best practices for managing secret API keys](https://docs.stripe.com/keys-best-practices.md) instead.
+**Traps to avoid:** Don’t embed keys in client-side code, mobile apps, or any code that runs outside your own infrastructure. Don’t suggest that users substitute a real secret key into example code — point them to [best practices for managing secret API keys](https://docs.stripe.com/keys-best-practices.md) instead.
 
 ## Restricted API keys (RAKs)
 
@@ -52,13 +52,13 @@ Follow the principle of least privilege: give each RAK only the permissions it n
 Preferred migration approach:
 
 1. Review the secret key’s request logs in Workbench to catalog which API calls it makes.
-2. Create a RAK in test mode with matching permissions.
+2. Create a RAK in a sandbox with matching permissions.
 3. Use the [Stripe CLI](https://docs.stripe.com/cli.md)’s `stripe logs tail` command to watch logs.
 4. Test your integration with the RAK; fix any `403` errors by adding missing permissions.
 5. Create the equivalent live-mode RAK and replace the secret key.
 6. Rotate or expire the old secret key once confident.
 
-**Traps to avoid:** Do not default to recommending secret keys. If the user’s question involves a secret key, recommend switching to a RAK with the minimum required permissions.
+**Traps to avoid:** Don’t default to recommending secret keys. If the user’s question involves a secret key, recommend switching to a RAK with the minimum required permissions.
 
 ## IP restrictions
 
@@ -70,7 +70,7 @@ Use a different policy for each key (for example, one policy for production, ano
 
 If a key is exposed or compromised, follow [protecting against compromised API keys](https://support.stripe.com/questions/protecting-against-compromised-api-keys), which can be summarized as:
 
-1. **Roll the key immediately** — go to the [API keys page](https://dashboard.stripe.com/apikeys) and roll or delete the exposed key. Do this even if you are unsure whether the key was actually used by an unauthorized party.
+1. **Roll the key immediately** — go to the [API keys page](https://dashboard.stripe.com/apikeys) and roll or delete the exposed key. Do this even if you’re unsure whether the key was actually used by an unauthorized party.
 2. **Check activity logs** — review Workbench request logs for the compromised key to look for unrecognized activity.
 3. **Contact Stripe support** if you see activity you don’t recognize.
 
@@ -78,7 +78,7 @@ To prepare before an incident: practice rolling keys, audit source code for any
 
 ## Webhook security
 
-Before processing any webhook event, always [verify the webhook signature](https://docs.stripe.com/webhooks.md#verify-events) using Stripe’s webhook signing secret. Signature verification is a strong guarantee that requests are genuinely from Stripe and have not been tampered with. Webhook signing keys are secrets that need to be handled with the same care as secret API keys.
+Before processing any webhook event, always [verify the webhook signature](https://docs.stripe.com/webhooks.md#verify-events) using Stripe’s webhook signing secret. Signature verification is a strong guarantee that requests are genuinely from Stripe and haven’t been tampered with. Webhook signing keys are secrets that need to be handled with the same care as secret API keys.
 
 For defense in depth, also [allowlist Stripe’s IP addresses](https://docs.stripe.com/ips.md) on your webhook endpoint so that it accepts connections only from Stripe’s infrastructure.
 
@@ -86,11 +86,11 @@ For defense in depth, also [allowlist Stripe’s IP addresses](https://docs.stri
 
 Add a `Content-Security-Policy` header to every web app that loads Stripe.js or uses Stripe’s hosted UIs. See [Stripe’s integration security guide](https://docs.stripe.com/security/guide.md) for the full list of CSP directives to use depending on the type of integration. At minimum, include `https://*.stripe.com` in the relevant directives (`script-src`, `frame-src`, `connect-src`), `https://*.link.com` if integrating assets from `link.com`, or both if integrating with Stripe’s embedded crypto onramp. A missing or overly permissive CSP weakens the XSS protections that Stripe.js relies on.
 
-**Traps to avoid:** Do not use `default-src *` or omit CSP headers.
+**Traps to avoid:** Don’t use `default-src *` or omit CSP headers.
 
 ## Mobile and client-side integrations
 
-Do not use production secret or restricted API keys in mobile apps or other client-side code. Client-side code can be extracted and decompiled to extract keys.
+Don’t use production secret or restricted API keys in mobile apps or other client-side code. Client-side code can be extracted and decompiled to extract keys.
 
 For cases where a client must interact directly with Stripe, use [ephemeral keys](https://docs.stripe.com/issuing/elements.md#ephemeral-key-authentication). Ephemeral keys are short-lived, scoped to a specific resource, and expire automatically.
 
@@ -110,7 +110,7 @@ Users can audit which Dashboard team members are using weak 2FA and can require
 
 ## Connect security
 
-**Account type liability:** When using Connect, platform operators bear financial liability for fraud and disputes on Express and Custom connected accounts. Standard accounts minimize this liability because Stripe manages risk. Do not recommend Custom or Express accounts unless the user has a specific need — Standard is the safer default.
+**Account type liability:** When using Connect, platform operators bear financial liability for fraud and disputes on Express and Custom connected accounts. Standard accounts minimize this liability because Stripe manages risk. Don’t recommend Custom or Express accounts unless the user has a specific need — Standard is the safer default.
 
 **Connect onboarding:** Use [Stripe-hosted onboarding](https://docs.stripe.com/connect/onboarding.md) rather than building a custom onboarding flow. Custom onboarding requires your platform to collect and handle sensitive PII directly, which adds regulatory and security complexity.
 

package/dist/global-skills/vybekiitReferences/backend/AGENTS.md

@@ -3,7 +3,7 @@
 > **Single source of truth** for Claude Code, Cursor, and Codex. Claude Code and Codex read this
 > file directly; `.cursor/rules` points here. You are talking to a non-technical vibe coder.
 
-Use the plain words in @language.md whenever you talk to the vibe coder.
+Talk to the vibe coder in plain words: say "secret setting" (not environment variable), "put your app online" (not deploy), "where your app remembers things" (not database), "save a checkpoint" (not commit), and "letting people sign in" (not authentication). Before you use any other technical word with them, look it up in `language.md`.
 
 <!-- vybekiit:generated:start contract -->
 ## The contract: Decide + Guide

package/dist/global-skills/vybekiitReferences/backend/agent/goal-routes.json

@@ -17,6 +17,18 @@
         "what is this",
         "what can you do",
         "where do i start"
+      ],
+      "stems": [
+        "מאיפה מתחילים",
+        "מאיפה להתחיל",
+        "רק קניתי",
+        "מה אתה יודע לעשות",
+        "с чего начать",
+        "что ты умеешь",
+        "только что купил",
+        "من أين أبدأ",
+        "ماذا تستطيع",
+        "اشتريت للتو"
       ]
     },
     {
@@ -29,7 +41,21 @@
         "marketplace",
         "like airbnb"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "לתכנן",
+        "הרעיון שלי",
+        "מרקטפלייס",
+        "כמו airbnb",
+        "спланир",
+        "мою идею",
+        "маркетплейс",
+        "как airbnb",
+        "خطط",
+        "فكرتي",
+        "سوق إلكتروني",
+        "مثل airbnb"
+      ]
     },
     {
       "skill": "wire-payments",
@@ -41,7 +67,29 @@
         "charge people",
         "wire payments"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "תשלום",
+        "תשלומים",
+        "סליקה",
+        "לגבות כסף",
+        "לגבות תשלום",
+        "לקבל כסף",
+        "למכור",
+        "оплат",
+        "платеж",
+        "платёж",
+        "принимать деньги",
+        "продавать",
+        "دفع",
+        "مدفوعات",
+        "استلام المال",
+        "أبيع",
+        "البيع",
+        "לחבר תשלומים",
+        "подключить оплату",
+        "ربط الدفع"
+      ]
     },
     {
       "skill": "go-live",
@@ -53,7 +101,24 @@
         "ship it",
         "deploy"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "לאוויר",
+        "באוויר",
+        "להעלות את האתר",
+        "לפרסם את האתר",
+        "אונליין",
+        "דיפלוי",
+        "опубликовать",
+        "запустить сайт",
+        "выложить",
+        "задеплоить",
+        "деплой",
+        "انشر",
+        "نشر الموقع",
+        "على الإنترنت",
+        "أطلق الموقع"
+      ]
     },
     {
       "skill": "wire-auth",
@@ -65,7 +130,29 @@
         "add users",
         "wire auth"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "התחברות",
+        "להתחבר",
+        "הרשמה",
+        "להירשם",
+        "נרשם",
+        "יצירת חשבון",
+        "להוסיף משתמשים",
+        "войти",
+        "вход",
+        "логин",
+        "регистрац",
+        "зарегистр",
+        "аккаунт",
+        "تسجيل الدخول",
+        "إنشاء حساب",
+        "تسجيل حساب",
+        "التسجيل",
+        "לחבר אימות",
+        "подключить авторизацию",
+        "ربط المصادقة"
+      ]
     },
     {
       "skill": "reset-password",
@@ -76,7 +163,21 @@
         "lost password",
         "change password email"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "שכחתי סיסמה",
+        "שכחתי את הסיסמה",
+        "איפוס סיסמה",
+        "לאפס סיסמה",
+        "שחזור סיסמה",
+        "забыл пароль",
+        "сбросить пароль",
+        "сброс пароля",
+        "восстановить пароль",
+        "نسيت كلمة المرور",
+        "إعادة تعيين كلمة المرور",
+        "استعادة كلمة المرور"
+      ]
     },
     {
       "skill": "sign-in-with-email-link",
@@ -87,7 +188,19 @@
         "sign in without password",
         "passwordless email"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "קישור קסם",
+        "קישור במייל",
+        "בלי סיסמה",
+        "ללא סיסמה",
+        "волшебная ссылка",
+        "ссылка на почту",
+        "без пароля",
+        "رابط سحري",
+        "رابط عبر البريد",
+        "بدون كلمة مرور"
+      ]
     },
     {
       "skill": "sign-in-with-phone",
@@ -98,7 +211,20 @@
         "sms login",
         "phone number login"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "התחברות עם טלפון",
+        "כניסה עם טלפון",
+        "קוד לטלפון",
+        "קוד בסמס",
+        "вход по телефону",
+        "войти по номеру",
+        "код по смс",
+        "код в смс",
+        "تسجيل الدخول بالهاتف",
+        "الدخول برقم الهاتف",
+        "رمز عبر الرسائل"
+      ]
     },
     {
       "skill": "setup-sms",
@@ -110,7 +236,20 @@
         "whatsapp messages",
         "send texts"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "סמס",
+        "הודעות טקסט",
+        "וואטסאפ",
+        "ווטסאפ",
+        "смс",
+        "текстовые сообщения",
+        "ватсап",
+        "вотсап",
+        "رسائل نصية",
+        "رسالة نصية",
+        "واتساب"
+      ]
     },
     {
       "skill": "wire-database",
@@ -130,7 +269,36 @@
         "student accessibility",
         "wire database"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "לשמור",
+        "שמירת נתונים",
+        "מסד נתונים",
+        "בסיס נתונים",
+        "תורים",
+        "קביעת תור",
+        "לקבוע תור",
+        "הזמנות",
+        "לבטל הזמנה",
+        "שיעורים",
+        "сохранить данные",
+        "база данных",
+        "базу данных",
+        "бронирован",
+        "запись на",
+        "расписани",
+        "отменить бронь",
+        "حفظ البيانات",
+        "قاعدة بيانات",
+        "حجز",
+        "حجوزات",
+        "مواعيد",
+        "موعد",
+        "جدول الحصص",
+        "לחבר מסד נתונים",
+        "подключить базу",
+        "ربط قاعدة البيانات"
+      ]
     },
     {
       "skill": "design-my-data",
@@ -140,7 +308,19 @@
         "what data do i need",
         "what should my app remember"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "לתכנן את הנתונים",
+        "מבנה נתונים",
+        "אילו נתונים",
+        "מה האפליקציה צריכה לזכור",
+        "структура данных",
+        "какие данные",
+        "спроектировать базу",
+        "تصميم قاعدة البيانات",
+        "ما البيانات",
+        "هيكل البيانات"
+      ]
     },
     {
       "skill": "add-upload",
@@ -151,7 +331,24 @@
         "attachments",
         "file upload endpoint"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "העלאת קבצים",
+        "להעלות קבצים",
+        "קבצים",
+        "קובץ",
+        "загрузить файл",
+        "загрузка файлов",
+        "файл",
+        "вложени",
+        "رفع ملفات",
+        "ملفات",
+        "ملف",
+        "مرفقات",
+        "נקודת קצה להעלאה",
+        "эндпоинт загрузки",
+        "نقطة رفع الملفات"
+      ]
     },
     {
       "skill": "wire-email",
@@ -162,7 +359,23 @@
         "set up email",
         "wire email"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "מייל",
+        "אימייל",
+        "דואר אלקטרוני",
+        "письма",
+        "письмо",
+        "почту",
+        "рассылк",
+        "بريد إلكتروني",
+        "البريد",
+        "إيميل",
+        "ايميل",
+        "לחבר מייל",
+        "подключить почту",
+        "ربط البريد"
+      ]
     },
     {
       "skill": "vybekiit-feedback",
@@ -173,7 +386,20 @@
         "suggest a kit improvement",
         "the kit is confusing"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "משוב",
+        "באג בקיט",
+        "הקיט מבלבל",
+        "הצעה לשיפור",
+        "отзыв о ките",
+        "ошибка в ките",
+        "кит запутан",
+        "предложить улучшение",
+        "خطأ في الكيت",
+        "الكيت محير",
+        "اقتراح تحسين"
+      ]
     },
     {
       "skill": "doctor",
@@ -184,7 +410,24 @@
         "get an error",
         "check my app"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "לא עובד",
+        "שבור",
+        "נשבר",
+        "שגיאה",
+        "תקלה",
+        "תבדוק את האפליקציה",
+        "не работает",
+        "сломал",
+        "ошибк",
+        "проверь приложение",
+        "لا يعمل",
+        "معطل",
+        "خطأ",
+        "مشكلة",
+        "افحص التطبيق"
+      ]
     },
     {
       "skill": "update-kit",
@@ -194,7 +437,19 @@
         "get the latest",
         "upgrade"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "לעדכן את הקיט",
+        "עדכון הקיט",
+        "הגרסה האחרונה",
+        "לשדרג",
+        "обновить кит",
+        "обновление кита",
+        "последнюю версию",
+        "تحديث الكيت",
+        "آخر إصدار",
+        "ترقية"
+      ]
     },
     {
       "skill": "harden",
@@ -204,7 +459,19 @@
         "make it safe",
         "protect from abuse"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "לאבטח",
+        "אבטחה",
+        "הגנה מפני",
+        "ניצול לרעה",
+        "защитить от",
+        "злоупотреблен",
+        "безопасност",
+        "حماية",
+        "إساءة الاستخدام",
+        "تأمين"
+      ]
     },
     {
       "skill": "add-route",
@@ -214,7 +481,17 @@
         "add api",
         "new route"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "נקודת קצה",
+        "ראוט חדש",
+        "נתיב חדש",
+        "эндпоинт",
+        "новый маршрут",
+        "новый роут",
+        "نقطة نهاية",
+        "مسار جديد"
+      ]
     },
     {
       "skill": "add-crud",
@@ -223,7 +500,15 @@
         "crud",
         "create read update delete"
       ],
-      "wholeRequestPhrases": []
+      "wholeRequestPhrases": [],
+      "stems": [
+        "יצירה עריכה ומחיקה",
+        "הוספה עריכה ומחיקה",
+        "создание редактирование удаление",
+        "создать изменить удалить",
+        "إضافة وتعديل وحذف",
+        "إنشاء وتعديل وحذف"
+      ]
     }
   ]
 }

package/dist/global-skills/vybekiitReferences/extension/AGENTS.md

@@ -6,7 +6,7 @@
 > Single source of truth. Claude Code and Codex read this file directly; `.cursor/rules/vybekiit.mdc` points here;
 > `.cursor/rules/patterns.mdc` summarizes code conventions (not SSOT).
 
-Use the plain words in @language.md whenever you talk to the vibe coder.
+Talk to the vibe coder in plain words: say "secret setting" (not environment variable), "put your app online" (not deploy), "where your app remembers things" (not database), "save a checkpoint" (not commit), and "letting people sign in" (not authentication). Before you use any other technical word with them, look it up in `language.md`.
 
 ## This is a browser extension — it talks to your backend