caffeinelabs

Authorization system with role-based access control. Must-have for all apps that manage personal or access-restricted data.

MANDATORY recipe for every Caffeine build that posts to X (Twitter). The ONLY supported path is the `x-client` mops package with OAuth 2.0 PKCE. Hand-rolling `ic.http_request` or `icBooking.http_request` calls to `api.x.com/2/tweets`, `api.x.com/2/oauth2/token`, or any other X endpoint is a FORBIDDEN anti-pattern — it bypasses bearer auth, replication-cost safeguards, and `x-client`'s null-field handling. Load this skill whenever the user, spec, or any prior task mentions tweeting, live-tweeting, posting-to-X, posting-a-status, sharing-to-Twitter, or any equivalent phrasing — and BEFORE writing any code that touches `api.x.com`.

MANDATORY recipe for every Caffeine build that calls OpenAI (ChatGPT, GPT-4o, an LLM, a chatbot, embeddings). The ONLY supported path is the `openai-client` mops package with a canister-side API-key bearer. Hand-rolling `ic.http_request` to `api.openai.com/v1/...` is a FORBIDDEN anti-pattern — it leaks the bearer across replicated outcalls (security + 13× billing impact), bypasses the typed request/response bindings, and forces hand-rolled JSON on a language with poor JSON support. Load this skill whenever the user, spec, or any prior task mentions ChatGPT, GPT (any version), OpenAI, an LLM, a chatbot, or embeddings — and BEFORE writing any code that touches `api.openai.com`.

Core infrastructure providing backend connection configuration, storage client, and React app entry point.

Web-camera support.

Support for organising events/meetings and sending invitations by email.

Send personalised marketing emails to subscribers with an unsubscribe link.

Send an email with multiple to, cc and bcc addresses.

Enhanced multi-migration for Motoko actors. Use when writing migration files, upgrading canister state, changing actor field types, or working with the migrations/ directory and --enhanced-migration flag.

Motoko language reference, mo:core library, and architecture patterns. Use when writing, modifying, or reviewing .mo files, Motoko backend code, or canister logic.

Build the Motoko compiler (moc) and run tests in the motoko repo. Use when the user asks to build, compile, rebuild, run tests, run test-runner, or verify changes to OCaml source files.

Inline actor migration with (with migration = ...). Use when upgrading canister state, changing field types, or writing migration functions without the --enhanced-migration flag.

Manage Motoko projects with the mops CLI — toolchain pinning, dependency management, type-checking, building, and linting. Use when working with mops.toml, mops.lock, running mops commands, adding/removing packages, pinning moc or lintoko versions, checking or building canisters, configuring moc flags, or setting up a new Motoko project.

Test frontend changes end-to-end and deploy to staging for verification. Use when testing frontend PRs, verifying frontend migrations, testing UI changes, or when the user asks to test the frontend before production. Covers automated checks, local dev server testing, staging deployment, and browser-based verification.

Write and debug lintoko lint rules for Motoko using TOML and tree-sitter queries. Use when creating, editing, or reviewing lintoko rule files, when the user mentions lintoko rules or Motoko linting rules, or when writing tree-sitter queries for Motoko code analysis.

Use the `spotify-client` mops package whenever the user asks the canister to look up music catalog data on Spotify (albums, artists, tracks, playlists, search, new releases, genres, markets) or to drive a user's Spotify account (their library, currently-playing track, queue, player controls). The package wraps the Spotify Web API at `https://api.spotify.com/v1` via outbound HTTPS calls.

Use the `twilio-client` mops package for any request involving Twilio messaging — sending SMS / MMS, configuring a Messaging Service, A2P 10DLC brand registration / campaigns, toll-free verification, alpha / channel senders, short codes, link shortening, domain certs, owning / browsing phone numbers, or the Twilio deactivation list. One package covers both halves of Twilio's messaging stack — configuration (Messaging API v1) and delivery (API v2010 Messages) — under one `Config`. Raw `ic.http_request` calls to `messaging.twilio.com` or `api.twilio.com` are the wrong path: they bypass the generated typing, per-operation host routing, and Basic-Auth header construction.