Compose the vike-* extensions instead of hand-rolling auth/data/UI

[suleimansh]

The framework currently makes the agent hand-roll everything from scratch (its own Prisma data layer, session auth, validation, rate-limiting, CSRF, admin CRUD UI). The vike-page-builder persona says "prefer composing existing vike-* extensions" but the framework gives the agent zero concrete knowledge of those extensions, and data-modeler points at raw Prisma — so the agent ignores the advice and reinvents the wheel.

Evidence (first full-scope live run, "a blog with posts, comments, admin")

It scaffolded ~30 files, then the production-grade loop spent 5 passes finding: missing cookie flags, no CSRF, no rate limiting, timing-attack-vulnerable password compare, no session cleanup, missing logout. The generated login was also broken. Every one of those is something vike-auth already solves correctly.

Why compose instead of generate

• Faster: install + wire a few extensions vs. generate and debug 30 files.
• Better/safer: auth/sessions/CSRF are hardened library code, not fresh AI output. The broken login and the security blockers would not exist.
• Kills the over-polish churn: the loop churns because it reviews freshly-generated hand-rolled code and always finds a flaw. If the hard parts are library code, there is far less surface to pick at. So this also addresses the "loop runs too many passes" complaint, at the root.

This is the "Stem Vision": extensions are composable, already-hardened building blocks the AI assembles (vike-auth owns users/sessions, vike-data owns schema->data layer, vike-view generates admin UI from schema).

Mechanism (tractable)

Same lever that switched the agent to Prisma (#181): persona / skills framing. Teach the agent the extensions as concrete knowledge:

• What each vike-* extension is, its install command, and its wiring conventions.
• Point data-modeler at vike-data (over/instead of raw Prisma) and add a vike-auth-aware auth persona.
• Package this as skills (@gemstack/ai-skills) so the knowledge is versioned per extension.

The agent still runs as a black box; we only change the system-prompt framing it gets.

Phasing (only teach whats shipped)

• Now: vike-auth + vike-data core (built/merged). Biggest immediate win: auth + data layer stop being hand-rolled.
• Later: vike-view (schema->admin/CRUD UI) once it ships (epic is in progress) - that removes the most hand-written UI. vike-notifications / vike-storage as needed.

Acceptance

• For a blog-style app, the agent composes vike-auth (working login + sessions) and a vike-data data layer instead of writing its own, and the production-grade loop no longer surfaces the auth/session/CSRF blockers above.

Part of #110. Surfaced by the first live full-scope run; connects the framework to the vike-* substrate. Related: #185 (existing-project support), the over-polish loop finding (this supersedes the pure loop-tuning fix).

[suleimansh]

Result: composing vike-data layers, measured across 3 live runs

Ran the same "build a blog with posts, comments, and an admin page" prompt through the framework three times:

1. Before the from-scratch fixes → empty Vike "Welcome" page. The agent stalled on unpublished universal-orm; the loop just reported "no app exists."
2. Hand-rolled (Prisma + own auth) → a real blog, but it burned time on Prisma 7 config/adapter/migrations and hand-rolled auth (broken login). The loop was flooded with auth/session/cookie/DB security blockers.
3. Composed (vike-auth + universal-orm) → no ORM install, no migrations, no hand-rolled auth. Textbook db.js (defineSchema / createRepository / getAdapter) + a +guard on pageContext.user. The whole auth/session/DB security category vanished from the loop; only app-level concerns remained (validation, pagination, features).

Finding: each composed vike-data layer removes a whole category of work and a category of bugs/security holes, because the hardened extension owns that surface. Fewer files, safer defaults, a shorter production-grade loop. The framework's quality ceiling rises with every layer it composes.

Plan: compose the layers incrementally, one per issue, measuring the demo each time

• vike-auth + universal-orm (auth + data) — proven above
• real-DB persistence (drizzle + pglite) — completes the foundation: both ride one adapter, and auth without persistence is a toy (memory resets on restart) ← next
• vike-themes — theming / polish
• vike-rbac — authorization (who can edit)
• vike-crud / vike-admin — schema-driven admin CRUD (deletes the hand-built edit/list pages)

[suleimansh]

The "now" phase is done (PR #188, merged):

• vike-auth-composer persona: agent composes login/sessions/CSRF instead of hand-rolling.
• vike-data-modeler persona: domain data on the universal-orm data layer, no ORM install.
• Persistence (Compose layer: real-DB persistence (drizzle + pglite) — accounts + data survive restart #187): opt-in memory->drizzle+pglite one-adapter swap, so accounts + data survive a restart.

Remaining for this epic is the "later" phase: teach vike-view (schema->admin/CRUD UI) once it ships. That is blocked on vike-view being built (vike-data#374), so leaving this open as the tracker.

[suleimansh]

The vike-* UI stack the agent should compose (verified deps, bottom -> top)

For the "later" UI-composition persona, here is the real layering. Solid = package dependency; "styled by" / "composes" = runtime/guard relationship, not a hard dep.

• vike-themes — styling tokens / CSS vars. Base.
• vike-blocks — render primitives (list/table/form/button/...). Styled by vike-themes. dep @vike-data/kit.
• vike-layouts — layouts; deps vike-blocks. Likely FOLDS INTO vike-blocks later (view-blocks already support layouts), so treat it as optional/transitional.
• vike-actions — named, guarded server actions referenced from serializable config. deps vike-blocks + vike-auth; COMPOSES vike-rbac for guards (can / hasRole / requirePermission).
• vike-crud — schema -> CRUD screens (list / record / form). deps vike-blocks + (some) vike-actions. This is the renamed vike-view (rename shipped, closes #509). defineView is gone: general pages = definePage, CRUD = crud({ table }).
• vike-admin — full admin panel preset. deps vike-crud (+ vike-blocks).

Identity axis (already taught in PR #188's auth persona): vike-auth (users/sessions) with vike-rbac (roles/permissions) layered on it.

So the UI-compose story = the agent builds admin/CRUD screens with vike-crud (drop vike-admin on top for a whole-DB panel), rendered by vike-blocks/vike-themes, mutated by vike-actions guarded via vike-rbac + the owner contract — all on the ONE universal-orm adapter that PR #188 made persistable. Hand-writing CRUD UI is exactly what this replaces.

Next: file the vike-crud-composer persona as the child that delivers this layer.