Prompts that work

Add sign-in to this app with the MainSDK auth interface. Run `npx mainsdk add auth` if
auth is not in main.yaml. Protect app/api/orders/route.ts with `auth.require(req)` and
scope every query with `db.orders.for(session.user)`. Do not write provider code or put
keys in files. When done, run `npx mainsdk check --json --agent` and fix every finding.
It passes when the output has "passed": true and the exit code is 0.

Add an "invoices" model that belongs to the signed-in user. Use the MainSDK db interface:
read and write only through `db.invoices.for(session.user)`, and pass an idempotencyKey
on every create. Label any personal field in main.yaml under `db.fields.invoices`. Do not
write raw SQL and do not import a database client. Write a test with `@mainsdk/testing`
that proves a second user cannot read the first user's invoice (`MAIN-DATA-0007`). Run
`npx mainsdk check --json --agent`. It passes when "passed": true and the exit code is 0.

Add a "summarise this order" feature using `ai.generate` from mainsdk. Pass `feature:
"order-summary"` and `user`. In main.yaml, set `ai.limits` with a per-user and a total
spend limit so a single user cannot run up the bill, and keep `ai.data` at training: never,
retention: zero. If an app agent makes the call, also pass `agent: "<name>"` and add
`agents.<name>.budget: { spend: $5/day, calls: 500/day }` to main.yaml. Do not import a
provider SDK. Run `npx mainsdk check --json --agent`. It passes when "passed": true and
the exit code is 0; the limits show in `npx mainsdk info`.

Add a support-reply endpoint. Stream the reply to the browser with `ai.stream({ model,
messages, feature: "support-reply", user })`; use the same `ai.limits` spend limits as the
other AI features. For the triage step, call `ai.generate({ model, prompt, feature:
"ticket-triage", user, schema })` with an `s` schema, and use the typed result. Treat
model output as untrusted input: never run it as code or build a query from it. Do not
import a provider SDK. Run `npx mainsdk check --json --agent`. It passes when "passed":
true and the exit code is 0.

Let signed-in users upload a receipt image. Use the MainSDK files interface with the
S3 driver (or Uploadthing, if main.yaml already uses it), key as a `secret:` reference
and a maxSize. Mint the upload target with `files.uploadUrl({ owner, maxSize, types })`
and confirm the upload with `files.complete(ref.id)` from a second route, owner set to the signed-in user. Return
links with `files.url(ref, { for: user, expiresIn: "1h" })`. Do not import a storage SDK
in route code, and do not build an upload store or a public bucket. Run
`npx mainsdk check --json --agent`. It passes when "passed": true and the exit code is 0.

Turn orders.list into an MCP tool for agents. Write it once with `action()` from
mainsdk: name "orders.list", an `intent`, an `s` `input`, `risk: "read"` and `mcp: true`.
Scope the data with `db.orders.for(user)`. In main.yaml add
`mcp.auth: { issuer: auth, scopes: [orders:read], token-ttl: 10m }`. Do not add a
second route that skips the action's checks. Run `npx mainsdk check --json --agent`.
It passes when "passed": true and the exit code is 0.

Add checkout for an order. Use `pay.checkout({ order, amount, currency, successUrl,
cancelUrl })` after `auth.require(req)`; amount is in integer minor units. Put the
provider key and webhook secret in main.yaml as `secret:` references. Handle
`payment.succeeded` with `pay.on()` and send slow work to `jobs.run`. Do not import a
payments SDK and do not read card data. Run `npx mainsdk check --json --agent`.
It passes when "passed": true and the exit code is 0.

Move the monthly report export out of the request. Call `jobs.run("reports.export",
{ userId, month }, { idempotencyKey: "export:<userId>:<month>", retries: 3, backoff:
"exponential" })` from the route and return 202. A retry must never send or write twice.
Do not add a queue library. Run `npx mainsdk check --json --agent`. It passes when
"passed": true and the exit code is 0.

`npx mainsdk check` fails. Run `npx mainsdk check --json --agent`, read each finding's
file and fix, and change the code to satisfy the rule. Run `npx mainsdk explain <code>`
if a fix is unclear. Do not add an exception, lower a severity, edit baseline, delete a
gate or use `raw()` to get around a finding. If the same finding is still open after
three tries, stop and ask me. Re-run the same command. It passes when "passed": true
and the exit code is 0.

Bring this app onto MainSDK with the mainsdk-adopt skill. Run `npx mainsdk adopt scan`,
then `npx mainsdk adopt report` and show me the gaps, secrets first. Run
`npx mainsdk adopt lock` before changing any code. Then migrate one module per branch
and pull request with `npx mainsdk adopt next --module <name>`, starting with secrets.
Keep what the app already runs (a sign-in provider, a database) instead of replacing
it. Never rewrite the whole app in one change. After each module run
`npx mainsdk check --json --agent`; it passes when "passed": true, the exit code is 0
and every locked flow is green. Finish with `npx mainsdk adopt finish`.

npx mainsdk check --json --agent

Goal:    Do exactly what the prompt asks, on MainSDK interfaces only.
Files:   the code the change needs, plus main.yaml to declare what it uses.
Verify:  npx mainsdk check --json --agent   (pass = "passed": true and exit code 0)
Rule:    never weaken a check; never add an exception without an owner and expiry;
         after three unresolved rounds on one finding, stop and ask the developer.
Unknown: a call shape not in the docs or the skill is not yours to invent. Ask.