Built on real apps, not just the docs.
Your agent says the site is live, billing works, passkey sign-in is done and the CRM sent the right email, because nothing threw an error. The App Stack Pack makes it prove each one on Cloudflare Pages, Stripe, Supabase, SureContact and OttoKit before a customer finds what it missed. Its rules come from four web apps we run in production, on WordPress and off it, including the store that sells this pack, and each one says whether it was measured there or read in the vendor’s docs.
$39. Every pack, now and later: $149.
Works with
Fit check
Not sure which pack fits? Find yours in two questions
Every requirement, in detailBehind the curtain
The page you’re reading is a React app on Cloudflare Pages. Nothing sits between the design and the browser: no theme, no block editor, no page builder. Any component library, animation or layout goes in as plain code, and an agent can build it with whatever tools and MCP servers suit the job, not only what a plugin vendor has already made for WordPress.
The store runs on WordPress, because SureCart does. We chose it for selling digital products: order bumps that can offer the bundle when one pack is in the cart, upsells, a customer dashboard for downloads and license keys, and WordPress’s own accounts for customer logins. Checkout, customers and deliveries live in one place.
Each side does what it’s best at, and agents build both. Skills in this pack came from that work. For the store side, see the WordPress Pack.
Sound familiar?
Tap every one you’ve lived through.
Nothing yet? Lucky you.
Why it keeps happening
Cloudflare leaves the pages.dev address indexable, a test-mode price ID doesn’t exist in live mode, Supabase counts a passkey as one factor, and SureContact reads a branch it doesn’t understand as true for everyone. None of it fails a build or raises an error, so the agent reports success and means it.
So you hear about it from someone else: a search console report, a customer who can’t check out on launch day, a two-factor user stuck on a code screen, a subscriber who got another tier’s email. By then it’s in production, and you’re the one tracing it back to a default.
What every page declared
A correct canonical tag, naming its own address as the one to index.
What search console reported
Five pages: “Duplicate, Google chose different canonical than user.” The production pages.dev address sent no noindex header.
The fix
The App Stack Pack is five skills your agent loads: Cloudflare Pages, Stripe billing on Supabase, passkeys on Supabase Auth, SureContact and OttoKit. Each names the silent failures in its part and ships scripts that refuse the mistake before a customer finds it.
The scripts read your Pages headers, Edge Functions and SQL, passkey code, built emails and automation files, and name each defect and where it is.
Every checker’s selftest plants the defects it hunts and must catch them, from 9 cases to 66, with no live service touched.
Each skill opens on the ways its part fails without a message, and says what that silence looks like and what to measure instead.
Proof
Three checkers, run on the fixtures the pack’s own tests use: a headers file written for the wrong subdomain, a billing repo with 12 planted defects, and the passkey code the skill teaches. Every line below is one it printed.
[ Shot 01 ]
pages-noindex-check.mjs --headers _headers
Aimed: host rules for the project name, not its subdomain; must go red
FAIL line 4: https://acme.pages.dev/* is for a different pages.dev subdomain than acme-3xk.pages.dev, so it matches nothing this project serves
FAIL no rule for https://acme-3xk.pages.dev/* setting X-Robots-Tag: noindex. The production alias gets no header from Cloudflare, so it is an indexable copy of the site
4 finding(s). Static only: deploy, then run live mode to see what the edge sends.
Landed where it was aimed // exit 1
[ Shot 02 ]
billing-check.mjs --root …/planted
Aimed: a billing repo with 12 planted defects; must name every one
FAIL price-id supabase/migrations/20260801000000_billing.sql:2 a Stripe price id (price_FAKE123) is written into the database by this SQL. A price id exists in one mode only, so when the functions switch to a live key, anything that uses this one fails. Store a lookup key and resolve the price when the session is created (prices.list with lookup_keys)
12 findings; 17 rule(s) checked, 2 not checked. Static only: it reads the repository, not your Stripe account, your Supabase project or what is deployed.
Landed where it was aimed // exit 1
[ Shot 03 ]
passkey-check.mjs --root …/doc
Aimed: the code the skill teaches; must pass, its one exception printed
-- allowed [aal2-sql] supabase/migrations/20260916000200_refunds.sql:3 "refunds move money, so a PIN-less key must not reach them"
ok uv-flag 2 verifyAuthentication() call(s)
ok aal2-sql 2 SQL statement(s) reading aal
0 finding(s), 1 allowed; 15 rule(s) had something to check, 1 had nothing. Static only: SKILL.md §6 lists what this cannot see.
Landed where it was aimed // exit 0
Run from a fresh unzip of the 1.2.1 download. Indents and column padding trimmed; nothing else changed.
Who it’s for
One skill per part of the stack. Each teaches your agent the rules and ships scripts that check them on your project.
pages-noindex-check.mjs --selftest
ok the production alias block missing
ok a host-less /* noindex rule
ok live: a custom domain answering noindex fails
32 cases behaved as designed
pages-noindex-check.mjs --selftest
ok the production alias block missing
ok a host-less /* noindex rule
ok live: a custom domain answering noindex fails
32 cases behaved as designed
Every Pages site is also served at a pages.dev address that Cloudflare leaves open to search. Your agent adds the two rules that hide it, proves your domain stays indexable, and learns the redirect, cache and upload rules Pages breaks without a message.
billing-check.mjs --selftest
ok price-id: a price id written into a seed
ok webhook-jwt: no verify_jwt = false anywhere
ok status-check-rejects: the CHECK has no paused and nothing maps it
66 cases behaved as designed
Your plans store Stripe lookup keys instead of price IDs, so the same rows work in test and live mode. The browser names a plan, never a price, and the webhook checks every signature and accepts every status Stripe sends.
passkey-check.mjs --selftest
ok the UV flag test removed [uv-flag]
ok an RLS policy comparing aal inline [aal2-sql]
ok insufficient_aal handling removed from adding a passkey [insufficient-aal]
64 cases behaved as designed
Supabase treats every passkey sign-in as one factor, so two-factor users get a code screen after their fingerprint. The skill makes a verified passkey count as two, updates every check that demands a second factor, and keeps the code where it still belongs.
drip-to-workflow.mjs --selftest
ok payload with one body edited by hand
ok payload with a send cut out of the path
9 cases behaved as designed
The email your subscribers get is the one you approved. Each email series is generated from your built HTML and checked byte for byte before it goes up, forms and webhooks land in the right workspace, and the CRM’s quiet failures are written down.
ottokit-call.mjs --selftest
ok end to end: another server is refused and nothing is saved
ok end to end: no title matches, so it refuses, says the selection may have moved, and calls nothing
36 cases behaved as designed
The automation that runs is the one saved in your project. A call goes through only when the server’s id is the one you recorded and the workspace selected in OttoKit’s web app holds an automation title you named, and the run history you read keeps only that workspace’s automations. Definitions are checked before import and compared with the export after.
Every skill, with its job in one line. Each works on its own, and the SureContact and OttoKit skills point to each other where a webhook hands a contact over.
cloudflare-pages
Every pages.dev address kept out of search, your real domain kept in, checked in the build and live.
stripe-on-supabase
Lookup keys instead of price IDs, secrets kept server-side, and a webhook that verifies and maps every status.
supabase-passkeys
A passkey unlocked by fingerprint, face or PIN counts as two factors, without locking anyone out.
surecontact-integration
Forms, drips and webhooks, with each drip checked byte for byte against your build before it sends.
ottokit-integration
Automations kept as files, checked before import and diffed after, and called only when the server’s id and an automation title you name both match.
One download: five skills for Claude Code, the same instructions to paste into any tool that reads AGENTS.md, the scripts they run, and the harnesses that prove each check can fail.
app-stack/
install.sh copies the five skills into ~/.claude/skills/, or a folder you name with --dir, and moves an existing copy aside with a timestamp instead of overwriting it. Or run claude --plugin-dir on the whole folder to load it as a plugin for one session.
ci/ is the pack’s own test suite: a harness per skill runs its selftests and breaks copies of its scripts to prove each selftest can fail. ci/verify.sh runs all of it, and everything else the pack must survive, in one command.
A check that has never failed is a green light with extra steps. Each checker here ships a selftest that plants the defects it hunts, and each harness breaks a copy of the checker to prove the selftest notices. Run them first, before you trust a clean result.
Run the controls
# with the App Stack Pack unzipped at /path/to/app-stack, and nothing here calls a live servicenode /path/to/app-stack/skills/cloudflare-pages/scripts/pages-noindex-check.mjs --selftest # must report 32 cases behaving as designednode /path/to/app-stack/skills/stripe-on-supabase/scripts/billing-check.mjs --selftest # must report 66 cases behaving as designednode /path/to/app-stack/skills/supabase-passkeys/scripts/passkey-check.mjs --selftest # must report 64 cases behaving as designednode /path/to/app-stack/skills/surecontact-integration/scripts/drip-to-workflow.mjs --selftest # must report 9 cases behaving as designednode /path/to/app-stack/skills/ottokit-integration/scripts/ottokit-definition.mjs --selftest # must report 25 cases behaving as designedbash /path/to/app-stack/ci/verify.sh # runs every harness in the pack and each broken copy must fail its selftestWe call these negative controls: a planted defect the check has to fail on. The selftests plant each checker’s defects, run any live check through a fake fetcher, and must report every case as designed. ci/verify.sh runs the pack’s harnesses, which break copies of the scripts on purpose; each broken copy must fail its own selftest.
The check that has never failed is the one to distrust.
The skills are plain text files your agent reads. The scripts are single Node files with no dependencies, and they run on your computer.
claude --plugin-dir /path/to/app-stackThe written skills need nothing at all. The scripts need Node 18 or newer and nothing else: no packages, no browser. billing-check.mjs also uses git when your project is a repository, and says what it assumed when it is not.
Plain, commented JavaScript, nothing minified into a blob. A pack that says “don’t trust a report you can’t read” has to be readable itself.
App Stack Pack
$39.
Please don't resell it or share it outside your company.
All-Access Bundle
Spotter Round, the Agent Setup Pack, the Email Pack, the WordPress Pack, the App Stack Pack and the Campaign Tracker Pack, plus every pack added after them, each with every future version.
Spotter Round if an agent writes your web pages: it proves the work before and after it ships. The Agent Setup Pack if you use more than one agent or more than one tool, or hand agents API keys. The Email Pack if you send HTML email. The WordPress Pack if you build on WordPress with Bricks. The App Stack Pack if you build web apps on Cloudflare Pages, Supabase or Stripe, or use SureContact or OttoKit on any site, WordPress included. The Campaign Tracker Pack if you run ads and want short links, leads, purchases and cost per lead tracked from the server, on any site behind Cloudflare. The All-Access Bundle is every pack, now and later, for less than the six together.
Yes. The skills are plain text files and the checks are plain Node scripts, so any agent can run them. Claude Code loads the skills from its skills folder. Codex, Cursor and the rest take a skill pasted into your repository's AGENTS.md, and Gemini CLI reads that file once its settings name it.
No. Each skill works on its own: the Pages skill needs only Cloudflare Pages, the billing skill assumes Stripe with Supabase Edge Functions, and the passkey skill assumes Supabase Auth. The SureContact and OttoKit skills work with any stack, WordPress included. If you have Spotter Round, its checks verify the pages the app serves.
Each does what it’s best at. The marketing pages need design freedom, so they’re a React app on Cloudflare Pages with no theme or page builder in the way. The store needs a proven engine for digital products, and SureCart, which runs inside WordPress, brings checkout, customer accounts, downloads and upsells into one place. Several skills in this pack came from building both.
No. billing-check.mjs reads your repository, env files included, makes no request, and names a secret it finds only by kind and length. passkey-check.mjs reads files too; only its live mode sends a key, the anon or publishable one from a variable you name, to your own Supabase project, and it refuses a secret key. pages-noindex-check.mjs sends no credential of its own.
The static checks say so at the end of every report. The billing check reads the repository, not your Stripe account, your Supabase project or what is deployed. The passkey check can’t see whether a device verified its user: the server never records it, so no tool can. Each SKILL.md lists the rest.
No telemetry, no license check, nothing phoning home. The Pages checker fetches your own hosts, named by you or listed by your own wrangler login; for that listing, npx fetches wrangler from the npm registry unless your project or your machine already has it. The passkey checker’s live mode makes two requests to your own Supabase project. surecontact-call.mjs calls the one tool you name, with a key you supply. ottokit-call.mjs does the same after reading the server’s id and its automation titles from that server, to check the server and the workspace. The image guard requests each image in your built email. Everything else reads files, and nothing sends a credential anywhere but its own vendor.
Numbered downloads with a list of what changed. Every future version of the App Stack Pack is included at no charge, so you never pay for a new version, and you are never forced to update.
Yes — that's what it's for. One company covers every project that company delivers.
Fourteen days, no questions. A product about checking things that argued with you over a refund would be a poor advertisement for itself.
Sold separately
Each pack is sold on its own and ships its own checks, the same way this one does.
The layout, the pixels, the speed and the live deploy: your agent’s work, proven before it says it’s done.
One set of rules, proven to reach every coding agent, several agents on one project without landing work on each other's branches, and API keys handed over without entering the chat.
HTML email that survives real inboxes, dark mode and all, sent by Postmark, SureContact or anything else, and every Supabase Auth email from one generator.
Bricks 2.4 and later, Automatic.css and SureCart: the WordPress stack, proven rather than assumed, and sign-in screens on brand, including the Fortress security plugin’s two-factor pages.
Campaign tracking set up the same way for every client: short links from a Google Sheet, first-touch UTM tags without cookies, leads and purchases sent to Meta from the server, and cost per lead in one sheet.
Every pack, now and later: web pages, several agents, email, WordPress, web apps and campaign tracking.
The six separately: $234