diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
index c00917e..e8434eb 100644
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "indie-payment-kit",
-  "version": "0.2.0",
-  "description": "One orchestrator that selects, installs, integrates, and sandbox-verifies payment providers for indie products.",
+  "version": "0.3.0",
+  "description": "One orchestrator that integrates official payment Skills into real projects and reports sandbox evidence.",
   "author": {
     "name": "BeatAPI",
     "email": "support@beatapi.io",
diff --git a/README.md b/README.md
index 53059de..abc74b1 100644
--- a/README.md
+++ b/README.md
@@ -1,25 +1,33 @@
 # Indie Payment Kit
 
-One Skill that selects, installs, integrates, and sandbox-verifies payments without sending the
-developer to a second provider Skill.
+One Skill that takes a developer from an existing repository to a payment integration plan, code
+changes, and sandbox evidence without handing the conversation to a second provider Skill.
 
 ```text
-one install -> inspect project -> choose provider -> load official pack internally
-            -> write checkout/webhook/entitlement -> verify sandbox evidence
+install once -> inspect the real project -> choose a provider -> load its official Skill internally
+             -> extend the existing payment domain or add a framework-native adapter
+             -> validate locally -> verify the sandbox flow -> report the evidence state
 ```
 
-Built by [BeatAPI](https://beatapi.io) for independent developers using coding agents.
+Built by [BeatAPI](https://beatapi.io) for developers using coding agents.
 
-## What changed in v0.2
+## v0.3 public beta
 
-- The primary path is orchestration, not official-source handoff.
-- Official Provider Skills remain upstream and are installed only when selected.
-- The user continues talking to `indie-payment-kit`; provider packs are internal dependencies.
-- Project inspection distinguishes Next.js, TanStack Start, Hono, generic Node, HTML with a
-  backend, and static HTML.
-- Static HTML receives a safe Payment Link plan; a trusted backend unlocks verified webhooks and
-  entitlements.
-- Every run ends with evidence states rather than a generic “integrated” claim.
+- Seven provider packs are discovered and installed from provider-maintained Agent Skills: Stripe,
+  Dodo Payments, PayPal, Paddle, Polar, Alipay, and WeChat Pay.
+- Creem is loaded from its official AI-agent Skill documentation until its published Skill exposes
+  a standard Skills CLI entry point.
+- Provider packs install in a temporary directory and are copied to
+  `.indie-payment-kit/packs/`; existing user Skills are never removed.
+- Existing payment modules, routes, SDKs, data layers, and environment-key names are detected before
+  any write plan is created.
+- Mature projects use `extend-existing`; the kit does not generate a second payment domain.
+- New Next.js App Router projects can materialize a one-time-payment sandbox starter for Stripe or
+  Dodo. Subscriptions and other frameworks use agent-guided implementation from the selected
+  official provider pack.
+
+This beta does **not** claim that any provider is `sandbox-verified` or production-ready by default.
+Generated files and successful builds are lower evidence states than a completed sandbox payment.
 
 ## Install
 
@@ -27,38 +35,51 @@ Built by [BeatAPI](https://beatapi.io) for independent developers using coding a
 npx skills add https://github.com/BeatAPI/indie-payment-kit
 ```
 
-Then ask:
+Then ask one question, for example:
 
-- “Use Indie Payment Kit to add Stripe subscriptions to this TanStack project and test them.”
+- “Use Indie Payment Kit to add Stripe credit-pack payments to this TanStack project.”
 - “Connect this Next.js app to Dodo Payments and verify the sandbox webhook.”
-- “Add a safe payment option to this static HTML site.”
-- “Choose and connect both a global and mainland-China payment route.”
+- “Choose a global and mainland-China payment route for this SaaS.”
+- “Review the existing payment module and migrate it without creating a second billing system.”
 
-## Supported project targets
+## Current execution modes
 
-| Target | Integration mode |
+| Project target | Current behavior |
 |---|---|
-| Next.js App Router | Full lifecycle |
-| TanStack Start | Full lifecycle |
-| Hono / Express / Fastify / Node | Full lifecycle |
-| HTML or SPA with an API | Full lifecycle |
-| Static HTML only | Hosted Payment Link; backend required for verified fulfillment |
-
-## Provider coverage
-
-Stripe, PayPal, Dodo Payments, Paddle, Polar, Creem, Alipay, and WeChat Pay remain selectable.
-Stripe and Dodo are the first deep-orchestration targets; support labels remain conservative until
-reproducible sandbox evidence exists.
+| Existing payment implementation | Inspect and extend the existing domain with the selected official provider Skill |
+| Next.js App Router, new project | Stripe/Dodo one-time sandbox starter; other flows are agent-guided |
+| Next.js Pages Router | Agent-guided adaptation into the detected `pages` or `src/pages` tree |
+| TanStack Start | Agent-guided native routes using the official provider pack and existing project conventions |
+| Hono / Express / Fastify / Node | Agent-guided adapter inside the existing server/router structure |
+| HTML or SPA with an API | Frontend checkout entry plus agent-guided server integration |
+| Static HTML only | Hosted Payment Link; no automated entitlement without a trusted server |
+
+“Agent-guided” still means the root Skill owns the task and writes the project changes. It means the
+implementation is derived from the current official provider Skill rather than a maintained canned
+template.
+
+## Provider source policy
+
+Indie Payment Kit does not invent provider APIs. Every route starts from an allowlisted,
+provider-maintained Skill, toolkit, or official AI-agent source recorded in
+`provider-packs.json`. The selected material is loaded internally and remains subject to the
+project's architecture, authorization, secret, and production-mutation rules.
+
+Seven current official sources and their selected entry Skill names were checked on 2026-08-31.
+Installer isolation, integrity matching, and selective copying are covered by local tests; this is
+not a claim that every upstream download was re-executed for this release. Creem remains a manual
+official-Skill source because its current repository is not discoverable through the standard
+Skills CLI.
 
 ## Deterministic tools
 
-Inspect a project without reading secrets:
+Inspect without reading secret values:
 
 ```bash
 npm run inspect -- /path/to/project
 ```
 
-Choose a route:
+Recommend a route and build a framework-aware plan:
 
 ```bash
 npm run recommend -- \
@@ -68,34 +89,46 @@ npm run recommend -- \
   --billing subscription \
   --tax managed \
   --stack tanstack
-```
-
-Build a framework-aware execution plan:
 
-```bash
 npm run plan -- \
   --project /path/to/project \
   --provider dodo \
   --billing subscription
 ```
 
-Inspect a Provider Pack before installation:
+Inspect a provider pack before the approved download:
+
+```bash
+npm run provider-pack -- --provider stripe --billing one-time
+```
+
+Materialization is intentionally narrow:
 
 ```bash
-npm run provider-pack -- --provider stripe --billing subscription
+npm run materialize -- \
+  --project /path/to/new-nextjs-project \
+  --provider stripe \
+  --billing one-time
 ```
 
-The provider-pack command is dry-run by default. The root Skill runs `--install --yes` only after
-the user approves the official source, external download, and repository changes.
+It writes only new Next.js App Router Stripe/Dodo one-time sandbox starters. Existing payment
+domains, subscriptions, TanStack, Hono, Node, and other providers stay in the official-pack-driven
+agent path.
 
-## Safety boundary
+## Safety and evidence boundary
 
 - No default telemetry or credential collection.
-- No `.env` value reads.
-- No browser-side secret keys.
-- No shell interpolation from user-controlled provider names.
-- Sandbox first; live external mutations require fresh confirmation.
-- No claim of merchant approval or successful payment without direct evidence.
+- No `.env` value reads and no browser-side secret keys.
+- External pack downloads and repository writes require an explicit plan confirmation.
+- Product and price identifiers are selected on the trusted server in checked-in starters.
+- The included JSON store is a local sandbox seam, not a production or multi-instance database.
+- Generated checkout routes require `INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT=true` locally and
+  remain disabled when `NODE_ENV=production`; production integrations must add project-native
+  authentication and rate limiting.
+- Live products, webhooks, refunds, subscriptions, and other account mutations require fresh
+  confirmation.
+- Merchant approval, sandbox payment success, and production collection are never inferred from
+  generated code.
 
 ## Verify
 
diff --git a/SECURITY.md b/SECURITY.md
index 4c96054..70c0002 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -7,5 +7,10 @@ payloads in issues, pull requests, fixtures, or examples.
 Report suspected vulnerabilities privately to `support@beatapi.io`. Include a
 minimal reproduction with secrets and personal data removed.
 
+Official provider packs are isolated under `.indie-payment-kit/packs/` and must
+not remain in agent skill discovery directories. Installer npm packages are
+integrity-checked before execution. Project writes reject broad filesystem
+targets and symbolic-link destinations.
+
 This project provides integration guidance and local decision tooling. It does
 not custody funds or provide a hosted payment service.
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index ee95bff..b5f276d 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -30,7 +30,8 @@ a handoff destination.
 | Official pack source and installer | `provider-packs.json` + `provider-pack.mjs` |
 | Project shape and trusted server | `inspect-project.mjs` |
 | Planned files and evidence target | `plan-integration.mjs` |
-| Current API details | Selected official provider pack |
+| Checked-in write templates | `templates/` + `materialize-integration.mjs` |
+| Current API details | Isolated official provider pack |
 | Product-domain invariants | `lifecycle-contract.md` |
 | Completion claims | `go-live-checklist.md` |
 
@@ -47,12 +48,23 @@ Payment-domain behavior is shared. Framework adapters own only:
 The first adapter families are Next.js App Router, TanStack Start, Hono, generic Node, HTML with a
 backend, and static HTML Payment Links.
 
+Checked-in templates and framework support are separate concepts. Templates are optional sandbox
+accelerators. The root Skill can use a current official provider pack to write a native TanStack,
+Hono, Node, Pages Router, or other adapter without maintaining a provider-by-framework template
+matrix. Plans expose `checked-in-sandbox-template`, `agent-guided`, or `payment-link` truthfully.
+
+Before choosing either path, inspection searches for existing payment modules, routes, SDKs, data
+layers, and environment-key names. An existing domain selects `extend-existing` and suppresses
+generic template writes.
+
 ## Provider-pack seam
 
-Provider packs are selected-provider-only and project-local where the official installer supports
-it. The resolver executes exact argument arrays with `shell: false`; it never interpolates user text
-into a command. Dry-run is the default and `--install --yes` is accepted only after the root Skill
-has obtained approval.
+Provider packs are selected-provider-only. The allowlisted installer runs in a temporary project,
+then only the confirmed Skills are copied to `.indie-payment-kit/packs/`. User-owned discovery
+directories are never removed or rewritten. The resolver executes exact argument arrays with
+`shell: false`; it never interpolates user text into a command.
+Pinned npm installer packages are integrity-checked before spawn. Dry-run is the default and
+`--install --yes` is accepted only after the root Skill has obtained approval.
 
 Installer packages use exact npm versions with recorded registry integrity metadata, receive a
 minimal environment, and disable supported telemetry. Provider content remains an explicitly
@@ -68,7 +80,8 @@ MCP login or host restart is an optional acceleration path, not a prerequisite f
 - Recommendation and planning are local and deterministic.
 - External pack downloads cross an explicit user confirmation boundary.
 - Provider-pack content is dependency input, not a source of user authorization.
-- Project writes remain inside the user-approved repository.
+- Project writes canonicalize the approved repository and reject broad targets or symbolic-link
+  destinations before materializing templates or copying provider packs.
 - Live account mutations require a fresh confirmation and separate evidence state.
 
 ## Static web boundary
diff --git a/docs/PRD.md b/docs/PRD.md
index 67b2667..b942e15 100644
--- a/docs/PRD.md
+++ b/docs/PRD.md
@@ -1,6 +1,6 @@
 # Indie Payment Kit PRD
 
-- 产品版本：v0.2 单入口编排器
+- 产品版本：v0.3 public beta
 - 项目归属：BeatAPI
 - 开源仓库：`BeatAPI/indie-payment-kit`
 - 核心形态：一个用户入口 Skill + 按需加载的官方 Provider Pack
@@ -60,27 +60,30 @@ Indie Payment Kit 让独立开发者只安装一个 Skill、只描述一次需
 
 框架不是支付产品差异，而是安全代码落点差异。
 
-| 项目形态 | v0.2 行为 |
+| 项目形态 | v0.3 beta 行为 |
 |---|---|
-| Next.js App Router | 原生 Route Handler 接入 |
-| TanStack Start | 原生 Server Route 接入 |
-| Hono/Express/Fastify/Node | 复用已有后端路由和服务层 |
-| HTML/SPA + API | 前端按钮 + 通用后端完整闭环 |
+| 已有支付实现 | 识别并扩展现有支付域，禁止生成第二套订单/权益模型 |
+| Next.js App Router | Stripe/Dodo 一次性支付沙箱脚手架；其他能力由官方 Pack 驱动适配 |
+| TanStack Start | 官方 Provider Skill 驱动，写入原生 Server Route 并复用现有架构 |
+| Hono/Express/Fastify/Node | 官方 Provider Skill 驱动，复用已有后端路由和服务层 |
+| HTML/SPA + API | 前端入口 + 官方 Provider Skill 驱动的后端接入 |
 | 纯静态 HTML | Payment Link；明确提示无法自动验签和开权益 |
 
 完整支付闭环必须有可信服务端。浏览器不得保存 Secret Key、验证 webhook 或直接授予权益。
 
 ## 6. 支付商范围与能力等级
 
-| 支付商 | 选型 | 内部加载官方源 | 框架编排目标 |
+| 支付商 | 选型 | 内部官方源 | 当前执行方式 |
 |---|---:|---:|---:|
-| Stripe | 是 | 是 | P0 |
-| Dodo Payments | 是 | 是 | P0 |
-| 支付宝 | 是 | 是 | P1 |
-| 微信支付 | 是 | 是 | P1 |
-| PayPal、Paddle、Polar、Creem | 是 | 是 | P2 |
-
-八家可以被推荐，不代表八家已具备同等级沙箱证据。所有输出必须显示能力等级。
+| Stripe | 是 | 可安装官方 Skill | Next.js 一次性脚手架 + Agent 自主适配 |
+| Dodo Payments | 是 | 可安装官方 Skills | Next.js 一次性脚手架 + Agent 自主适配 |
+| 支付宝 | 是 | 可安装官方 Skill | Agent 自主适配 |
+| 微信支付 | 是 | 可安装官方 Skill | Agent 自主适配 |
+| PayPal、Paddle、Polar | 是 | 可安装官方 Skills | Agent 自主适配 |
+| Creem | 是 | 官方 Skill 文档 | Agent 直接读取官方源后适配 |
+
+八家可以被推荐，不代表八家已具备同等级沙箱证据。v0.3 没有任何支付商声明为
+`sandbox-verified`，所有输出必须显示能力等级。
 
 ## 7. P0 需求
 
diff --git a/package-lock.json b/package-lock.json
index 78843d6..d5045d5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "indie-payment-kit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "indie-payment-kit",
-      "version": "0.2.0",
+      "version": "0.3.0",
       "license": "MIT",
       "engines": {
         "node": ">=20"
diff --git a/package.json b/package.json
index d041249..8394aad 100644
--- a/package.json
+++ b/package.json
@@ -1,13 +1,14 @@
 {
   "name": "indie-payment-kit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": true,
-  "description": "One orchestrator that selects, installs, integrates, and sandbox-verifies payment providers for indie products.",
+  "description": "One payment-integration Skill that extends real projects from official provider packs and reports sandbox evidence.",
   "type": "module",
   "scripts": {
     "recommend": "node skills/indie-payment-kit/scripts/recommend.mjs",
     "inspect": "node skills/indie-payment-kit/scripts/inspect-project.mjs",
     "plan": "node skills/indie-payment-kit/scripts/plan-integration.mjs",
+    "materialize": "node skills/indie-payment-kit/scripts/materialize-integration.mjs",
     "provider-pack": "node skills/indie-payment-kit/scripts/provider-pack.mjs",
     "test": "node --test test/*.test.mjs",
     "validate": "node scripts/validate-repo.mjs",
diff --git a/scripts/validate-repo.mjs b/scripts/validate-repo.mjs
index 4521935..f14d46b 100644
--- a/scripts/validate-repo.mjs
+++ b/scripts/validate-repo.mjs
@@ -35,11 +35,14 @@ async function main() {
 
   const packageJson = await readJson('package.json');
   assert(packageJson.version === manifest.version, 'package.json and plugin versions must match.');
+  const packageLock = await readJson('package-lock.json');
+  assert(packageLock.version === packageJson.version, 'package-lock.json and package versions must match.');
+  assert(packageLock.packages?.['']?.version === packageJson.version, 'package-lock root package version must match.');
 
   const skill = await readFile(path.join(skillRoot, 'SKILL.md'), 'utf8');
   assert(skill.startsWith('---\nname: indie-payment-kit\n'), 'Skill frontmatter is missing or invalid.');
   assert(!skill.includes('[TODO:'), 'Skill contains unfinished scaffold placeholders.');
-  assert(skill.includes('Never finish by telling the user to invoke'), 'Skill must preserve the single-entry invariant.');
+  assert(skill.includes('Never tell the user to continue in a provider Skill'), 'Skill must preserve the single-entry invariant.');
 
   const openaiYaml = await readFile(path.join(skillRoot, 'agents', 'openai.yaml'), 'utf8');
   assert(openaiYaml.includes('$indie-payment-kit'), 'Default prompt must mention $indie-payment-kit.');
@@ -66,6 +69,12 @@ async function main() {
   for (const [providerId, pack] of Object.entries(providerPacks.providers)) {
     assert(ids.has(providerId), `Unknown provider pack: ${providerId}`);
     assert(pack.source.startsWith('https://'), `${providerId} provider-pack source must be HTTPS.`);
+    assert(pack.sourceAuthority === 'official-provider', `${providerId} must use a provider-maintained source.`);
+    assert(
+      ['well-known-skills', 'repository-skills', 'official-skill-manual'].includes(pack.sourceType),
+      `${providerId} has an unsupported provider source type.`,
+    );
+    assert(/^\d{4}-\d{2}-\d{2}$/.test(pack.verifiedAt), `${providerId} source verification date is missing.`);
     assert(
       Array.isArray(pack.entrySkills) && pack.entrySkills.every((skill) => /^[a-z0-9][a-z0-9-]*$/.test(skill)),
       `${providerId} contains an unsafe internal Skill name.`,
@@ -75,6 +84,8 @@ async function main() {
       assert(pack.install[0] === 'npx', `${providerId} installer must use the allowlisted npx executable.`);
       assert(!pack.install.some((token) => /[;&|`$\n\r]/.test(token)), `${providerId} installer contains shell control characters.`);
       assert(!pack.install.some((token) => token.includes('@latest')), `${providerId} installer must not use a floating npm latest tag.`);
+      const agentIndex = pack.install.indexOf('--agent');
+      assert(pack.install[agentIndex + 1] === 'codex', `${providerId} staging install must target only the Codex discovery path.`);
       assert(/^sha512-[A-Za-z0-9+/]+=*$/.test(pack.installerIntegrity), `${providerId} installer integrity metadata is missing.`);
     }
   }
diff --git a/skills/indie-payment-kit/SKILL.md b/skills/indie-payment-kit/SKILL.md
index 254da31..23d04a7 100644
--- a/skills/indie-payment-kit/SKILL.md
+++ b/skills/indie-payment-kit/SKILL.md
@@ -1,108 +1,128 @@
 ---
 name: indie-payment-kit
-description: Select, install, implement, test, review, or migrate payment providers for an indie SaaS, API, app, or website through one user-facing workflow. Use for Stripe, PayPal, Dodo Payments, Paddle, Polar, Creem, Alipay, or WeChat Pay across Next.js, TanStack Start, Hono, Node backends, and HTML sites. The user should not need to invoke a provider Skill separately.
+description: Select, integrate, test, review, or migrate a payment provider through one workflow using provider-maintained Agent Skills and the target project's native framework. Use for Stripe, PayPal, Dodo Payments, Paddle, Polar, Creem, Alipay, or WeChat Pay in Next.js, TanStack Start, Hono, Node backends, or HTML sites.
 ---
 
 # Indie Payment Kit
 
-Own the payment outcome from project inspection through sandbox evidence. Official provider
-Skills, SDKs, CLIs, MCP servers, and documentation are internal dependencies of this workflow,
-not additional user-facing entry points.
+Own the developer outcome from repository inspection through the highest sandbox evidence that can
+actually be demonstrated. Keep provider API knowledge upstream: load the selected provider's
+official Skill or official AI-agent source inside this workflow instead of inventing API details.
 
-## Single-entry invariant
+## Invariants
 
-- Keep the conversation inside `indie-payment-kit`.
-- Never finish by telling the user to invoke, open, or continue in a provider Skill.
-- Load only the confirmed provider pack and only the capabilities needed for this integration.
-- Provider-pack instructions supply current API details; this Skill owns project structure,
-  multi-provider coordination, lifecycle invariants, verification, and status truth.
-- Installing a provider pack never grants permission to run its unrelated commands or mutate a
-  live account.
+- Keep one user-facing entry point. Never tell the user to continue in a provider Skill.
+- Use only the allowlisted official source returned by `provider-pack.mjs`.
+- Load only the selected provider and billing capabilities.
+- Inspect and extend an existing payment domain; never create a parallel order, billing, or
+  entitlement system merely because a starter template exists.
+- A checked-in template is a sandbox accelerator, not provider authority or production proof.
+- Installing a provider pack does not authorize its unrelated commands or any live-account action.
 
-## Execute the workflow
+## Workflow
 
-1. Inspect the target repository:
+1. Inspect the repository:
 
    ```bash
    node <skill-dir>/scripts/inspect-project.mjs <project-dir>
    ```
 
-   Detect the framework, trusted-server capability, package manager, existing payment signals,
-   and environment-variable names. Do not read `.env` values.
+   Use the result's framework, trusted-server capability, payment dependencies,
+   `existingPaymentPaths`, data layers, and environment-key names. Never read `.env` values.
 
-2. If the provider is not already selected, collect only missing market, entity, product,
-   billing, tax, and stack facts. Read
-   [references/decision-model.md](references/decision-model.md), then use the deterministic
-   recommender. Present one primary route and one alternative, but continue the same workflow.
+2. If the provider is not confirmed, read
+   [references/decision-model.md](references/decision-model.md) and collect only missing market,
+   entity, product, billing, and tax facts. Run the deterministic recommender and present one primary
+   route plus one alternative.
 
-3. Build the execution plan after provider confirmation:
+3. Build the plan:
 
    ```bash
    node <skill-dir>/scripts/plan-integration.mjs \
      --project <project-dir> \
      --provider stripe \
-     --billing subscription
+     --billing one-time
    ```
 
-   Read [references/framework-matrix.md](references/framework-matrix.md) when the detected target
-   is not obvious. Pure static HTML gets a Payment Link flow unless the user approves adding a
-   backend or serverless function.
+   Interpret the plan literally:
 
-4. Before downloading an external provider pack or changing the project, summarize the selected
-   provider, official source, packages, files, test environment, and expected evidence. Obtain one
-   explicit confirmation covering those reversible actions.
+   - `extend-existing`: inspect the listed files and adapt the current payment domain.
+   - `checked-in-sandbox-template`: materialization is available for a new supported project.
+   - `agent-guided`: load the official provider pack, then implement in the project's native routes,
+     auth, data, logging, and test conventions.
+   - `payment-link`: static hosting only; no verified fulfillment without a trusted server.
 
-5. Resolve and install the official provider pack internally:
+4. Before downloading a provider pack or changing the repository, show the provider, official
+   source, selected internal Skills, packages, intended files or inspection targets, test mode, and
+   expected evidence. Obtain one explicit confirmation for those reversible actions.
+
+5. Resolve and install the selected official pack internally:
 
    ```bash
    node <skill-dir>/scripts/provider-pack.mjs \
      --provider stripe \
-     --billing subscription
+     --billing one-time
    ```
 
-   After approval, repeat with `--install --yes --project <project-dir>` when an allowlisted
-   installer exists. Read [references/provider-pack-management.md](references/provider-pack-management.md).
-   Then run the resolver with `--locate` to obtain exact installed `SKILL.md` paths. If the host
-   does not refresh its Skill index, read those project-local files directly. Do not send the user
-   to a new conversation.
+   After approval, repeat with `--install --yes --project <project-dir>` when an installer is
+   available. Read [references/provider-pack-management.md](references/provider-pack-management.md).
+   The installer stages provider content outside the user's repository and copies only confirmed
+   Skills to `.indie-payment-kit/packs/`. Read those files directly; do not expose them as additional
+   user-facing Skills.
 
 6. Read [references/orchestration-contract.md](references/orchestration-contract.md) and
-   [references/lifecycle-contract.md](references/lifecycle-contract.md). Use current official
-   provider instructions to implement the planned files inside the user's repository:
+   [references/lifecycle-contract.md](references/lifecycle-contract.md). Use the official pack for
+   current SDK names, payload fields, signatures, events, and provider test procedures. Use the
+   shared lifecycle contract for product-owned orders, references, event receipts, and entitlements.
+
+7. Materialize only when the plan explicitly lists `templateFiles`:
+
+   ```bash
+   node <skill-dir>/scripts/materialize-integration.mjs \
+     --project <project-dir> \
+     --provider stripe \
+     --billing one-time
+   ```
+
+   Current checked-in templates are limited to new Next.js App Router one-time Stripe/Dodo sandbox
+   starters. The included JSON state adapter is sandbox-only. Replace it with the project's durable
+   database before multi-instance or production use, and bind checkout to the project's real user
+   and server-side SKU model. Local checkout is disabled until
+   `INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT=true` and remains hard-disabled when
+   `NODE_ENV=production`; replace that sandbox guard with project-native authentication and rate
+   limiting before production. Do not force materialization for subscriptions, existing payment
+   domains, TanStack, Hono, Node, Pages Router, or other providers; use the agent-guided path.
 
-   - server-side checkout or an explicitly limited static Payment Link;
-   - verified webhook using the unmodified raw request body;
-   - stable local order and provider references;
-   - idempotent event claim and retry-safe processing;
-   - entitlement grant, renewal, cancellation, refund, dispute, and revocation;
-   - environment example keys without credential values;
-   - framework-native tests and a sandbox runbook.
+8. Implement or adapt the remaining project-native code. A trusted-server integration needs:
 
-   Keep provider SDK calls behind a narrow adapter. Reuse the project's existing database, auth,
-   server routing, logging, and test patterns. Do not create a second payment domain if one exists.
+   - server-side checkout with a server-owned product/SKU mapping;
+   - raw-body webhook verification;
+   - stable local orders plus every relevant provider reference;
+   - durable atomic event claims: `succeeded` and actively leased `processing` are duplicate
+     acknowledgements; `failed` and lease-expired `processing` may be retried;
+   - explicit entitlement grant, renewal, cancellation, refund, dispute, and revocation rules;
+   - test/live separation, local tests, and a sandbox runbook.
 
-7. Run local validation before requesting credentials. Report missing key names and where the user
-   should place them; never ask the user to paste secret values into chat. Continue automatically
-   once the configured environment exposes the required keys.
+   Never grant access from a return page. Install only packages in the plan. Preserve the existing
+   auth, routing, database, configuration, and logging patterns.
 
-8. Use sandbox or test mode. Exercise checkout, webhook verification, duplicate delivery, and the
-   entitlement result. When provider credentials or merchant approval are unavailable, complete
-   every local step and stop at the exact missing prerequisite.
+9. Validate locally before requesting credentials. Report missing key names and where they belong;
+   never ask the user to paste secret values into chat. Use sandbox/test mode to exercise checkout,
+   signature rejection, duplicate delivery, successful processing, and the entitlement result.
 
-9. Read [references/go-live-checklist.md](references/go-live-checklist.md). Report the highest
-   evidence state actually demonstrated, changed files, tests run, missing prerequisites, and the
-   next action. “Code written” is not “sandbox payment verified.”
+10. Read [references/go-live-checklist.md](references/go-live-checklist.md). Report the exact
+    evidence state, official source, changed files, tests, missing external prerequisites, and next
+    action. Code written, a successful build, and an opened Checkout page are not a verified payment.
 
 ## Multiple providers
 
-When the user confirms multiple channels, keep one product-owned order and entitlement model and
-add separate provider adapters, checkout routes, webhook endpoints, event identities, and test/live
-configuration. Install and load each provider pack sequentially. Never install all providers just
-because the project supports multiple routes.
+Keep one product-owned order and entitlement model. Add provider adapters, checkout routes, webhook
+event identities, and test/live configuration separately. Load packs sequentially and only after
+each provider is confirmed.
 
 ## Production boundary
 
-Use test mode until the user explicitly asks for production configuration. Immediately before
+Stay in test mode until the user explicitly requests production configuration. Immediately before
 creating live products, webhooks, refunds, subscriptions, or other external mutations, state the
-exact action and obtain confirmation. Never claim merchant approval, production readiness, or a
-successful payment without direct evidence.
+exact action and obtain fresh confirmation. Never claim merchant approval, production readiness, or
+a successful payment without direct evidence.
diff --git a/skills/indie-payment-kit/references/framework-matrix.md b/skills/indie-payment-kit/references/framework-matrix.md
index 0f214cf..fa7fd49 100644
--- a/skills/indie-payment-kit/references/framework-matrix.md
+++ b/skills/indie-payment-kit/references/framework-matrix.md
@@ -3,14 +3,16 @@
 Payment providers expose APIs; frameworks determine where secrets, checkout endpoints, raw webhook
 bodies, and deployment configuration live. Detect both the user interface and the trusted server.
 
-| Detected target | Checkout and webhook placement | Full lifecycle? |
+| Detected target | Checkout and webhook placement | Current execution |
 |---|---|---|
-| Next.js App Router | `app/api/payments/<provider>/**/route.ts` | Yes |
-| TanStack Start | `src/routes/api/payments/<provider>/*.ts` | Yes |
-| Hono | Framework-native routes under the existing server module | Yes |
-| Express/Fastify/Node | Existing router/service conventions | Yes |
-| HTML/SPA + existing API | HTML button plus API checkout/webhook routes | Yes |
-| Static HTML only | Hosted Payment Link and return page | No |
+| Existing payment domain | Existing modules, routes, data, and config | `extend-existing`; no generic writes |
+| Next.js App Router | `app/` or `src/app` payment routes plus `lib/payments` domain files | One-time Stripe/Dodo sandbox starter or agent-guided |
+| Next.js Pages Router | Detected `pages` or `src/pages` API tree | Agent-guided |
+| TanStack Start | `src/routes/api/payments/<provider>/*.ts` | Agent-guided from official provider pack |
+| Hono | Framework-native routes under the existing server module | Agent-guided from official provider pack |
+| Express/Fastify/Node | Existing router/service conventions | Agent-guided from official provider pack |
+| HTML/SPA + existing API | HTML button plus API checkout/webhook routes | Agent-guided from official provider pack |
+| Static HTML only | Hosted Payment Link and return page | Payment Link only |
 
 ## Static HTML rule
 
diff --git a/skills/indie-payment-kit/references/lifecycle-contract.md b/skills/indie-payment-kit/references/lifecycle-contract.md
index 8f257df..16ed79d 100644
--- a/skills/indie-payment-kit/references/lifecycle-contract.md
+++ b/skills/indie-payment-kit/references/lifecycle-contract.md
@@ -37,7 +37,9 @@ licenses, and adaptive pricing belong behind capability checks.
 
 1. A browser redirect never grants paid access by itself.
 2. Raw request bytes are preserved until webhook signature verification ends.
-3. One provider event or transaction cannot grant the same entitlement twice.
+3. One provider event or transaction cannot grant the same entitlement twice. Succeeded events and
+   actively leased processing events are duplicate acknowledgements; failed or lease-expired
+   processing may be retried through an atomic claim.
 4. Recording payment success and granting the entitlement share an atomic or
    safely recoverable boundary.
 5. Refunds, disputes, expirations, and cancellations have explicit entitlement
diff --git a/skills/indie-payment-kit/references/orchestration-contract.md b/skills/indie-payment-kit/references/orchestration-contract.md
index adc89b6..eb9a931 100644
--- a/skills/indie-payment-kit/references/orchestration-contract.md
+++ b/skills/indie-payment-kit/references/orchestration-contract.md
@@ -10,8 +10,10 @@ Developer request
   -> inspect project
   -> choose route and provider
   -> confirm external download and repository writes
-  -> load selected official provider pack internally
-  -> implement in the detected framework
+      -> load selected official provider pack internally
+      -> isolate it away from host skill discovery
+      -> materialize templates when available
+      -> implement remaining files in the detected framework
   -> validate locally
   -> configure sandbox prerequisites
   -> exercise checkout and webhook
diff --git a/skills/indie-payment-kit/references/provider-catalog.json b/skills/indie-payment-kit/references/provider-catalog.json
index d3c0da2..09bf2d4 100644
--- a/skills/indie-payment-kit/references/provider-catalog.json
+++ b/skills/indie-payment-kit/references/provider-catalog.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 2,
-  "verifiedAt": "2026-08-28",
+  "verifiedAt": "2026-08-31",
   "supportStatement": "Selection and single-entry orchestration do not guarantee merchant eligibility, sandbox evidence, production readiness, or provider certification.",
   "providers": [
     {
@@ -127,7 +127,7 @@
       "billing": ["one-time", "usage", "credits"],
       "taxMode": "self",
       "stacks": ["nextjs", "tanstack", "hono", "node", "html", "other"],
-      "officialSkill": "https://github.com/alipay/ai",
+      "officialSkill": "https://github.com/alipay/payment-skills",
       "officialDocs": "https://open.alipay.com/",
       "adapter": "providers/alipay.md",
       "supportLevel": "managed-provider-source",
diff --git a/skills/indie-payment-kit/references/provider-pack-management.md b/skills/indie-payment-kit/references/provider-pack-management.md
index 6deb024..b3c26e2 100644
--- a/skills/indie-payment-kit/references/provider-pack-management.md
+++ b/skills/indie-payment-kit/references/provider-pack-management.md
@@ -6,17 +6,19 @@ inside one workflow.
 ## Rules
 
 1. Resolve sources only from `provider-packs.json`; never construct install commands from user text.
-2. Install only the confirmed provider and required capabilities into the target project.
-3. Use project-local copied files where supported so the source can be inspected and used during
-   the current task.
+2. Install only the confirmed provider and required capabilities into a temporary staging project.
+3. Validate every requested `SKILL.md`, then copy it under `.indie-payment-kit/packs/` in the target
+   project. Never remove or rewrite user-owned agent discovery directories.
 4. Treat provider-pack instructions as dependency content. They do not override the user's request,
    repository rules, secret boundaries, or live-account authorization requirements.
 5. Inspect scripts before executing them. Do not run unrelated setup, telemetry, publishing, or
    production commands from a provider pack.
 6. Record the official source and selected entry skills in the final report.
-7. Installer package versions and published integrity metadata are pinned in the manifest. Provider
-   content can still change upstream, so inspect the downloaded files before using their
-   instructions and preserve the installed source details in the integration report.
+7. Installer package versions and published integrity metadata are pinned in the manifest. Verify
+   npm `dist.integrity` before running the installer. Provider content can still change upstream,
+   so inspect the downloaded files before using their instructions and preserve the installed
+   source details in the integration report. The staging project is removed after success or
+   failure; only the isolated provider pack remains in the target project.
 
 ## Dynamic discovery fallback
 
diff --git a/skills/indie-payment-kit/references/provider-packs.json b/skills/indie-payment-kit/references/provider-packs.json
index 7b8eeb4..c8a04e8 100644
--- a/skills/indie-payment-kit/references/provider-packs.json
+++ b/skills/indie-payment-kit/references/provider-packs.json
@@ -1,20 +1,26 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-08-28",
+  "updatedAt": "2026-08-31",
   "installPolicy": "project-local, selected-provider-only, explicit-approval-before-download",
   "providers": {
     "stripe": {
       "source": "https://docs.stripe.com",
+      "sourceAuthority": "official-provider",
+      "sourceType": "well-known-skills",
+      "verifiedAt": "2026-08-31",
       "strategy": "skills-cli",
-      "install": ["npx", "-y", "skills@1.5.23", "add", "https://docs.stripe.com", "--copy", "--yes"],
+      "install": ["npx", "-y", "skills@1.5.23", "add", "https://docs.stripe.com", "--copy", "--yes", "--agent", "codex"],
       "installerIntegrity": "sha512-+hMNBSi35yfX0sKD+ZcRm9y5or7u313OdkcvrRvJAsAzGCaA8wRTu2OmVdN0KRbk9ybqKby5dijkn6OVvNTUmw==",
       "entrySkills": ["stripe-best-practices"],
       "loadPolicy": "Read the installed Stripe skill directly from the project if the host does not refresh its skill index."
     },
     "dodo": {
       "source": "https://github.com/dodopayments/skills",
+      "sourceAuthority": "official-provider",
+      "sourceType": "repository-skills",
+      "verifiedAt": "2026-08-31",
       "strategy": "skills-cli",
-      "install": ["npx", "-y", "skills@1.5.23", "add", "dodopayments/skills", "--copy", "--yes"],
+      "install": ["npx", "-y", "skills@1.5.23", "add", "dodopayments/skills", "--copy", "--yes", "--agent", "codex"],
       "installerIntegrity": "sha512-+hMNBSi35yfX0sKD+ZcRm9y5or7u313OdkcvrRvJAsAzGCaA8wRTu2OmVdN0KRbk9ybqKby5dijkn6OVvNTUmw==",
       "entrySkills": ["dodo-best-practices", "framework-adapters", "checkout-integration", "webhook-integration", "testing-and-go-live"],
       "capabilitySkills": {
@@ -26,44 +32,67 @@
     },
     "wechat-pay": {
       "source": "https://github.com/wechatpay-apiv3/wechatpay-skills",
+      "sourceAuthority": "official-provider",
+      "sourceType": "repository-skills",
+      "verifiedAt": "2026-08-31",
       "strategy": "skills-cli",
-      "install": ["npx", "-y", "skills@1.5.23", "add", "https://github.com/wechatpay-apiv3/wechatpay-skills", "--copy", "--yes"],
+      "install": ["npx", "-y", "skills@1.5.23", "add", "https://github.com/wechatpay-apiv3/wechatpay-skills", "--copy", "--yes", "--agent", "codex"],
       "installerIntegrity": "sha512-+hMNBSi35yfX0sKD+ZcRm9y5or7u313OdkcvrRvJAsAzGCaA8wRTu2OmVdN0KRbk9ybqKby5dijkn6OVvNTUmw==",
       "entrySkills": ["wechatpay-payment-integration"],
       "loadPolicy": "Use the domestic merchant entry unless the official pack routes the request elsewhere."
     },
     "alipay": {
-      "source": "https://github.com/alipay/ai",
-      "strategy": "official-installer",
-      "install": ["npx", "-y", "@alipay/alipay-aipay@1.6.6", "install"],
-      "installerIntegrity": "sha512-V+kEMiSSvviNHggxQy42OOIv9Bygfc5NNMT9sN4V7mDysqn4/piLooA0NCuGUv5p8S7nnpibgVEmy9TVUk7YDg==",
-      "entrySkills": ["alipay-aipay"],
-      "loadPolicy": "Select merchant collection versus agent payment before running the installer."
+      "source": "https://github.com/alipay/payment-skills",
+      "sourceAuthority": "official-provider",
+      "sourceType": "repository-skills",
+      "verifiedAt": "2026-08-31",
+      "strategy": "skills-cli",
+      "install": ["npx", "-y", "skills@1.5.23", "add", "https://github.com/alipay/payment-skills", "--copy", "--yes", "--agent", "codex"],
+      "installerIntegrity": "sha512-+hMNBSi35yfX0sKD+ZcRm9y5or7u313OdkcvrRvJAsAzGCaA8wRTu2OmVdN0KRbk9ybqKby5dijkn6OVvNTUmw==",
+      "entrySkills": ["alipay-payment-skill"],
+      "loadPolicy": "Load the official payment-processing skill from the isolated pack. Do not run wallet authorization or live payment operations without explicit approval."
     },
     "paypal": {
-      "source": "https://developer.paypal.com/ai-tools/get-started/",
-      "strategy": "official-docs",
-      "install": null,
-      "entrySkills": [],
-      "loadPolicy": "Use the official Agent Toolkit or MCP only when the target host can configure it without losing the current task."
+      "source": "https://github.com/paypal/AI-Toolkit",
+      "sourceAuthority": "official-provider",
+      "sourceType": "repository-skills",
+      "verifiedAt": "2026-08-31",
+      "strategy": "skills-cli",
+      "install": ["npx", "-y", "skills@1.5.23", "add", "https://github.com/paypal/AI-Toolkit", "--copy", "--yes", "--agent", "codex"],
+      "installerIntegrity": "sha512-+hMNBSi35yfX0sKD+ZcRm9y5or7u313OdkcvrRvJAsAzGCaA8wRTu2OmVdN0KRbk9ybqKby5dijkn6OVvNTUmw==",
+      "entrySkills": ["paypal-best-practices"],
+      "loadPolicy": "Load PayPal's official best-practices skill inside this workflow. MCP setup remains optional and requires separate authorization."
     },
     "paddle": {
-      "source": "https://developer.paddle.com/sdks/ai/agent-skills/",
-      "strategy": "official-docs",
-      "install": null,
-      "entrySkills": [],
-      "loadPolicy": "Read the current official agent-skill page and SDK guidance inside the orchestration task."
+      "source": "https://developer.paddle.com/",
+      "sourceAuthority": "official-provider",
+      "sourceType": "well-known-skills",
+      "verifiedAt": "2026-08-31",
+      "strategy": "skills-cli",
+      "install": ["npx", "-y", "skills@1.5.23", "add", "https://developer.paddle.com/", "--copy", "--yes", "--agent", "codex"],
+      "installerIntegrity": "sha512-+hMNBSi35yfX0sKD+ZcRm9y5or7u313OdkcvrRvJAsAzGCaA8wRTu2OmVdN0KRbk9ybqKby5dijkn6OVvNTUmw==",
+      "entrySkills": ["paddle-checkout-web", "paddle-webhooks", "paddle-sandbox-testing"],
+      "capabilitySkills": {
+        "subscription": ["paddle-subscription-sync"]
+      },
+      "loadPolicy": "Load only the official checkout, webhook, sandbox, and selected billing skills. Paddle's maintained examples are currently Next.js-first, so other frameworks remain guided adaptations."
     },
     "polar": {
       "source": "https://github.com/polarsource/skills",
+      "sourceAuthority": "official-provider",
+      "sourceType": "repository-skills",
+      "verifiedAt": "2026-08-31",
       "strategy": "skills-cli",
-      "install": ["npx", "-y", "skills@1.5.23", "add", "polarsource/skills", "--copy", "--yes"],
+      "install": ["npx", "-y", "skills@1.5.23", "add", "https://github.com/polarsource/skills", "--copy", "--yes", "--agent", "codex"],
       "installerIntegrity": "sha512-+hMNBSi35yfX0sKD+ZcRm9y5or7u313OdkcvrRvJAsAzGCaA8wRTu2OmVdN0KRbk9ybqKby5dijkn6OVvNTUmw==",
-      "entrySkills": [],
-      "loadPolicy": "List the current official skills before choosing the minimum required set."
+      "entrySkills": ["polar-integration", "polar-testing"],
+      "loadPolicy": "Load Polar's framework-neutral integration and sandbox-testing skills. Do not install setup or migration skills unless the request needs them."
     },
     "creem": {
       "source": "https://docs.creem.io/code/sdks/ai-agents",
+      "sourceAuthority": "official-provider",
+      "sourceType": "official-skill-manual",
+      "verifiedAt": "2026-08-31",
       "strategy": "official-docs",
       "install": null,
       "entrySkills": [],
diff --git a/skills/indie-payment-kit/references/providers/alipay.md b/skills/indie-payment-kit/references/providers/alipay.md
index 1153207..253ed2d 100644
--- a/skills/indie-payment-kit/references/providers/alipay.md
+++ b/skills/indie-payment-kit/references/providers/alipay.md
@@ -6,10 +6,11 @@ from agent-wallet and HTTP 402 payment products.
 
 ## Internal official provider pack
 
-- Merchant-integration Skills hub: https://github.com/alipay/ai
-- Agent payment Skills: https://github.com/alipay/payment-skills
+- Official payment Skills: https://github.com/alipay/payment-skills
+- Additional integration resources: https://github.com/alipay/ai
 - Open Platform: https://open.alipay.com/
-- Agent-payment installer: `npx -y @alipay/agent-payment@1.0.20 install`
+Load `alipay-payment-skill` into `.indie-payment-kit/packs/`. Do not run wallet authorization or
+live payment operations unless the user explicitly asks and approves the exact action.
 
 Select and load the official merchant-integration Skill inside Indie Payment Kit for website, app,
 mini-program, or service-provider checkout. Use the agent-payment package only when the request
diff --git a/skills/indie-payment-kit/references/providers/polar.md b/skills/indie-payment-kit/references/providers/polar.md
index 10d4a4a..eeca478 100644
--- a/skills/indie-payment-kit/references/providers/polar.md
+++ b/skills/indie-payment-kit/references/providers/polar.md
@@ -8,10 +8,10 @@ its Merchant of Record, benefits, checkout, and customer portal model fit.
 - Official Skills: https://github.com/polarsource/skills
 - Documentation: https://docs.polar.sh/
 
-The official repository includes setup, integration, testing, and migration
-Skills. Load `setup-polar` for a new project, `polar-integration` for
-checkout/portal/webhooks, or `polar-migration` for provider changes without exposing them as
-separate user entry points.
+The official repository includes setup, integration, testing, and migration Skills. The managed
+pack currently allowlists only `polar-integration` and `polar-testing`; add setup or migration
+Skills to the reviewed manifest only when the confirmed request needs them, without exposing them
+as separate user entry points.
 
 ## Confirm before implementation
 
diff --git a/skills/indie-payment-kit/references/providers/stripe.md b/skills/indie-payment-kit/references/providers/stripe.md
index d7856a0..4c8b88c 100644
--- a/skills/indie-payment-kit/references/providers/stripe.md
+++ b/skills/indie-payment-kit/references/providers/stripe.md
@@ -10,7 +10,7 @@ and compliance operations, or needs flexible marketplace/platform primitives.
 - Universal Skills install: `npx skills add https://docs.stripe.com`
 - Codex plugin: `codex plugin add stripe@openai-curated`
 
-Load the current official Stripe Skill/plugin inside Indie Payment Kit for SDK calls, Checkout,
+Load the current official Stripe Skill from `.indie-payment-kit/packs/` for SDK calls, Checkout,
 Billing, Connect, webhook signatures, and account operations. Do not ask the developer to continue
 in Stripe as a separate Skill.
 
diff --git a/skills/indie-payment-kit/references/support-levels.md b/skills/indie-payment-kit/references/support-levels.md
index c19738b..15e46c9 100644
--- a/skills/indie-payment-kit/references/support-levels.md
+++ b/skills/indie-payment-kit/references/support-levels.md
@@ -13,9 +13,16 @@ issues, and user-facing results.
 | `sandbox-verified` | Maintainers executed the documented sandbox lifecycle and saved reproducible tests. |
 | `production-reference` | A public reference implementation has verified production evidence without exposing sensitive data. |
 
-Version `0.2.0` claims `selectable` and `managed-provider-source` for the eight catalog providers.
-Stripe and Dodo additionally claim `orchestrated-preview` across the initial framework matrix.
-No provider claims `sandbox-verified` yet.
+Version `0.3` claims `selectable` for all eight catalog providers. Stripe, Dodo, PayPal, Paddle,
+Polar, Alipay, and WeChat Pay have checked official source and entry-Skill metadata plus locally
+tested installer isolation and selective-copy behavior. This does not claim that every upstream
+download was re-executed for the release. Creem has a provider-maintained AI-agent Skill source that
+is read manually because it is not currently exposed through standard Skills CLI discovery.
+
+Stripe and Dodo additionally claim `orchestrated-preview` for new Next.js App Router one-time
+payment sandbox starters. Subscriptions, existing payment domains, TanStack, Hono, Node, Pages
+Router, and every other provider use the official-pack-driven `agent-guided` execution mode. No
+provider claims `sandbox-verified` yet.
 
 Do not infer `sandbox-verified` or `production-reference` from the existence of
 an official provider Skill, generated code, a successful build, a checkout page opening, or a
diff --git a/skills/indie-payment-kit/scripts/event-policy.mjs b/skills/indie-payment-kit/scripts/event-policy.mjs
new file mode 100644
index 0000000..77f9f89
--- /dev/null
+++ b/skills/indie-payment-kit/scripts/event-policy.mjs
@@ -0,0 +1,8 @@
+export const DEFAULT_EVENT_LEASE_MS = 5 * 60 * 1000;
+
+export function shouldBeginEvent(receipt, now = Date.now(), leaseMs = DEFAULT_EVENT_LEASE_MS) {
+  if (!receipt || receipt.status === 'failed') return true;
+  if (receipt.status === 'succeeded') return false;
+  const updatedAt = Date.parse(receipt.updatedAt ?? '');
+  return !Number.isFinite(updatedAt) || now - updatedAt >= leaseMs;
+}
diff --git a/skills/indie-payment-kit/scripts/inspect-project.mjs b/skills/indie-payment-kit/scripts/inspect-project.mjs
index c214fb6..ea5d535 100644
--- a/skills/indie-payment-kit/scripts/inspect-project.mjs
+++ b/skills/indie-payment-kit/scripts/inspect-project.mjs
@@ -33,6 +33,36 @@ const paymentSignals = [
   ['wechatpay', 'wechat-pay'],
 ];
 
+const dataLayerPackages = [
+  ['drizzle-orm', 'drizzle'],
+  ['@prisma/client', 'prisma'],
+  ['@supabase/supabase-js', 'supabase'],
+  ['sequelize', 'sequelize'],
+  ['typeorm', 'typeorm'],
+  ['mongoose', 'mongoose'],
+];
+
+const paymentDomainCandidates = [
+  'src/core/payment',
+  'src/modules/payment',
+  'src/routes/api/payment',
+  'src/routes/api/payments',
+  'src/payment',
+  'src/payments',
+  'src/lib/payment',
+  'src/lib/payments',
+  'lib/payment',
+  'lib/payments',
+  'app/api/payment',
+  'app/api/payments',
+  'pages/api/payment',
+  'pages/api/payments',
+  'server/payment',
+  'server/payments',
+  'api/payment',
+  'api/payments',
+];
+
 async function exists(filePath) {
   try {
     await access(filePath);
@@ -68,6 +98,11 @@ export async function inspectProject(inputPath = '.') {
 
   const frameworks = detectFromDependencies(dependencies, frameworkPackages);
   const paymentDependencies = detectFromDependencies(dependencies, paymentSignals);
+  const dataLayers = detectFromDependencies(dependencies, dataLayerPackages);
+  const existingPaymentPaths = [];
+  for (const candidate of paymentDomainCandidates) {
+    if (await exists(path.join(projectDir, candidate))) existingPaymentPaths.push(candidate);
+  }
   const hasRootHtml = await exists(path.join(projectDir, 'index.html'));
   const hasPublicHtml = await exists(path.join(projectDir, 'public', 'index.html'));
   const hasHtml = hasRootHtml || hasPublicHtml;
@@ -90,6 +125,29 @@ export async function inspectProject(inputPath = '.') {
   else if (backendServer) serverCapability = 'backend';
   else if (projectKind === 'static-web') serverCapability = 'external-required';
 
+  let nextAppRoot = null;
+  let nextPagesRoot = null;
+  let nextRouter = 'unknown';
+  if (frameworks.includes('nextjs')) {
+    const hasSrcApp = await exists(path.join(projectDir, 'src', 'app'));
+    const hasApp = await exists(path.join(projectDir, 'app'));
+    const hasSrcPages = await exists(path.join(projectDir, 'src', 'pages'));
+    const hasPages = await exists(path.join(projectDir, 'pages'));
+    if (hasSrcApp) {
+      nextRouter = 'app';
+      nextAppRoot = 'src/app';
+    } else if (hasApp) {
+      nextRouter = 'app';
+      nextAppRoot = 'app';
+    } else if (hasSrcPages || hasPages) {
+      nextRouter = 'pages';
+      nextPagesRoot = hasSrcPages ? 'src/pages' : 'pages';
+    } else {
+      nextRouter = 'app';
+      nextAppRoot = 'app';
+    }
+  }
+
   let integrationTarget = 'other';
   if (frameworks.includes('nextjs')) integrationTarget = 'nextjs';
   else if (frameworks.includes('tanstack')) integrationTarget = 'tanstack';
@@ -121,10 +179,15 @@ export async function inspectProject(inputPath = '.') {
     projectKind,
     serverCapability,
     integrationTarget,
+    nextAppRoot,
+    nextPagesRoot,
+    nextRouter,
     hasHtml,
     serverDirectories,
     suggestedStack: integrationTarget,
     paymentDependencies,
+    existingPaymentPaths,
+    dataLayers,
     safeEnvironmentKeys,
     warnings: [
       ...(packageJson ? [] : ['No package.json found; inspect the project manually.']),
diff --git a/skills/indie-payment-kit/scripts/materialize-integration.mjs b/skills/indie-payment-kit/scripts/materialize-integration.mjs
new file mode 100644
index 0000000..4c7ece7
--- /dev/null
+++ b/skills/indie-payment-kit/scripts/materialize-integration.mjs
@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+
+import { access, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createIntegrationPlan } from './plan-integration.mjs';
+import {
+  assertSafeProjectWritePath,
+  prepareSafeProjectFile,
+  resolveSafeProjectTarget,
+} from './safe-project-path.mjs';
+
+const skillRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+async function exists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function mergeEnvExample(project, keys) {
+  if (!keys.length) return false;
+  const file = await assertSafeProjectWritePath(project, '.env.example');
+  let current = '';
+  try {
+    current = await readFile(file, 'utf8');
+  } catch {
+    current = '';
+  }
+  const missing = keys.filter((key) => !new RegExp(`^${key}=`, 'm').test(current));
+  if (!missing.length) return false;
+  const prefix = current.trim() ? `${current.trim()}\n` : '';
+  await writeFile(
+    await prepareSafeProjectFile(project, '.env.example'),
+    `${prefix}${missing.map((key) => `${key}=`).join('\n')}\n`,
+  );
+  return true;
+}
+
+async function ensureGitignore(project) {
+  const file = await assertSafeProjectWritePath(project, '.gitignore');
+  let current = '';
+  try {
+    current = await readFile(file, 'utf8');
+  } catch {
+    current = '';
+  }
+  if (current.includes('.indie-payment-kit/state.json')) return false;
+  const prefix = current.trim() ? `${current.trim()}\n` : '';
+  await writeFile(
+    await prepareSafeProjectFile(project, '.gitignore'),
+    `${prefix}.indie-payment-kit/state.json\n`,
+  );
+  return true;
+}
+
+export async function materializeIntegration({ project = '.', provider, billing = 'one-time', force = false }) {
+  const projectDir = await resolveSafeProjectTarget(project);
+  const plan = await createIntegrationPlan({ project: projectDir, provider, billing });
+  const written = [];
+  const skipped = [];
+
+  if (plan.implementationMode === 'payment-link' || plan.templateFiles.length === 0) {
+    const reason = plan.integrationApproach === 'extend-existing'
+      ? 'extend-existing'
+      : plan.implementationMode === 'payment-link'
+        ? 'payment-link'
+        : 'agent-guided';
+    return {
+      plan,
+      written,
+      skipped,
+      envUpdated: false,
+      gitignoreUpdated: false,
+      reason,
+    };
+  }
+
+  for (const file of plan.templateFiles) {
+    const destination = await assertSafeProjectWritePath(projectDir, file.to);
+    if (!force && (await exists(destination))) {
+      skipped.push(file.to);
+      continue;
+    }
+    const source = path.join(skillRoot, file.from);
+    const sourceContent = await readFile(source, 'utf8');
+    const content = sourceContent.replaceAll(
+      '__STRIPE_CHECKOUT_MODE__',
+      plan.billing === 'subscription' ? 'subscription' : 'payment',
+    );
+    await writeFile(await prepareSafeProjectFile(projectDir, file.to), content);
+    written.push(file.to);
+  }
+
+  const envUpdated = await mergeEnvExample(projectDir, plan.requiredEnvironmentKeys);
+  const gitignoreUpdated = await ensureGitignore(projectDir);
+
+  return { plan, written, skipped, envUpdated, gitignoreUpdated, reason: 'written' };
+}
+
+function parseArgs(argv) {
+  const result = { project: '.', billing: 'one-time', format: 'markdown', force: false };
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === '--force') {
+      result.force = true;
+      continue;
+    }
+    if (!token.startsWith('--')) throw new Error(`Unexpected argument: ${token}`);
+    const value = argv[index + 1];
+    if (!value || value.startsWith('--')) throw new Error(`Missing value for ${token}`);
+    result[token.slice(2)] = value;
+    index += 1;
+  }
+  if (!result.provider) throw new Error('--provider is required');
+  return result;
+}
+
+function renderMarkdown(result) {
+  return [
+    '# Materialized payment integration',
+    '',
+    `Provider: **${result.plan.provider}**`,
+    `Reason: **${result.reason}**`,
+    '',
+    '## Written',
+    '',
+    ...(result.written.length ? result.written.map((file) => `- ${file}`) : ['- none']),
+    '',
+    '## Skipped existing files',
+    '',
+    ...(result.skipped.length ? result.skipped.map((file) => `- ${file}`) : ['- none']),
+    '',
+    `Environment example updated: ${result.envUpdated ? 'yes' : 'no'}`,
+    `Gitignore updated: ${result.gitignoreUpdated ? 'yes' : 'no'}`,
+    '',
+    result.plan.packagesToInstall.length
+      ? `Install in the target project: ${result.plan.packagesToInstall.join(', ')}`
+      : '',
+    '',
+  ].join('\n');
+}
+
+async function main() {
+  try {
+    const args = parseArgs(process.argv.slice(2));
+    const result = await materializeIntegration(args);
+    process.stdout.write(args.format === 'json' ? `${JSON.stringify(result, null, 2)}\n` : renderMarkdown(result));
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await main();
+}
diff --git a/skills/indie-payment-kit/scripts/plan-integration.mjs b/skills/indie-payment-kit/scripts/plan-integration.mjs
index 6252735..88962a0 100644
--- a/skills/indie-payment-kit/scripts/plan-integration.mjs
+++ b/skills/indie-payment-kit/scripts/plan-integration.mjs
@@ -6,45 +6,104 @@ import { loadProviderPacks, resolveProviderPack } from './provider-pack.mjs';
 
 const providers = ['stripe', 'paypal', 'dodo', 'paddle', 'polar', 'creem', 'alipay', 'wechat-pay'];
 const billingModels = ['one-time', 'subscription', 'usage', 'credits'];
+const templatedProviders = new Set(['stripe', 'dodo']);
 
-const targetFiles = {
-  nextjs: (provider) => [
-    `app/api/payments/${provider}/checkout/route.ts`,
-    `app/api/payments/${provider}/webhook/route.ts`,
-    'app/payment/success/page.tsx',
-    '.env.example',
-  ],
-  tanstack: (provider) => [
-    `src/routes/api/payments/${provider}/checkout.ts`,
-    `src/routes/api/payments/${provider}/webhook.ts`,
-    'src/routes/payment/success.tsx',
-    '.env.example',
-  ],
-  hono: (provider) => [
-    `src/routes/payments/${provider}/checkout.ts`,
-    `src/routes/payments/${provider}/webhook.ts`,
-    '.env.example',
-  ],
-  'generic-node': (provider) => [
-    `src/payments/${provider}/checkout.ts`,
-    `src/payments/${provider}/webhook.ts`,
-    '.env.example',
-  ],
-  'static-html': () => ['index.html'],
-  other: (provider) => [`payments/${provider}.ts`, 'payments/webhook.ts', '.env.example'],
+const providerEnvKeys = {
+  stripe: ['STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET', 'STRIPE_PRICE_ID', 'APP_URL', 'INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT'],
+  dodo: ['DODO_PAYMENTS_API_KEY', 'DODO_PAYMENTS_WEBHOOK_KEY', 'DODO_PAYMENTS_PRODUCT_ID', 'DODO_PAYMENTS_RETURN_URL', 'DODO_PAYMENTS_ENVIRONMENT', 'APP_URL', 'INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT'],
+  paypal: ['PAYPAL_CLIENT_ID', 'PAYPAL_CLIENT_SECRET', 'PAYPAL_WEBHOOK_ID', 'APP_URL'],
+  paddle: ['PADDLE_API_KEY', 'PADDLE_WEBHOOK_SECRET', 'APP_URL'],
+  polar: ['POLAR_ACCESS_TOKEN', 'POLAR_WEBHOOK_SECRET', 'APP_URL'],
+  creem: ['CREEM_API_KEY', 'CREEM_WEBHOOK_SECRET', 'APP_URL'],
+  alipay: ['ALIPAY_APP_ID', 'ALIPAY_PRIVATE_KEY', 'ALIPAY_PUBLIC_KEY', 'APP_URL'],
+  'wechat-pay': ['WECHATPAY_MERCHANT_ID', 'WECHATPAY_PRIVATE_KEY', 'WECHATPAY_API_V3_KEY', 'APP_URL'],
 };
 
-const providerEnvKeys = {
-  stripe: ['STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET'],
-  dodo: ['DODO_PAYMENTS_API_KEY', 'DODO_PAYMENTS_WEBHOOK_KEY', 'DODO_PAYMENTS_RETURN_URL', 'DODO_PAYMENTS_ENVIRONMENT'],
-  paypal: ['PAYPAL_CLIENT_ID', 'PAYPAL_CLIENT_SECRET'],
-  paddle: ['PADDLE_API_KEY', 'PADDLE_WEBHOOK_SECRET'],
-  polar: ['POLAR_ACCESS_TOKEN', 'POLAR_WEBHOOK_SECRET'],
-  creem: ['CREEM_API_KEY', 'CREEM_WEBHOOK_SECRET'],
-  alipay: ['ALIPAY_APP_ID', 'ALIPAY_PRIVATE_KEY', 'ALIPAY_PUBLIC_KEY'],
-  'wechat-pay': ['WECHATPAY_MERCHANT_ID', 'WECHATPAY_PRIVATE_KEY', 'WECHATPAY_API_V3_KEY'],
+const providerPackages = {
+  stripe: ['stripe'],
+  dodo: ['dodopayments', 'standardwebhooks'],
+  paypal: ['@paypal/paypal-server-sdk'],
 };
 
+function paymentLibRoot(inspection) {
+  if (inspection.integrationTarget === 'nextjs' && inspection.nextAppRoot === 'src/app') return 'src/lib/payments';
+  if (inspection.integrationTarget === 'nextjs') return 'lib/payments';
+  if (inspection.integrationTarget === 'tanstack') return 'src/lib/payments';
+  if (inspection.integrationTarget === 'hono' || inspection.integrationTarget === 'generic-node') return 'src/payments';
+  return 'payments';
+}
+
+function plannedFilesFor(inspection, provider) {
+  const libRoot = paymentLibRoot(inspection);
+  const domain = [
+    `${libRoot}/store.ts`,
+    `${libRoot}/orders.ts`,
+    `${libRoot}/events.ts`,
+    `${libRoot}/entitlements.ts`,
+  ];
+
+  if (inspection.integrationTarget === 'nextjs' && inspection.nextRouter === 'pages') {
+    const pagesRoot = inspection.nextPagesRoot ?? 'pages';
+    return [
+      ...domain,
+      `${pagesRoot}/api/payments/${provider}/checkout.ts`,
+      `${pagesRoot}/api/payments/${provider}/webhook.ts`,
+      '.env.example',
+    ];
+  }
+
+  if (inspection.integrationTarget === 'nextjs') {
+    const appRoot = inspection.nextAppRoot ?? 'app';
+    return [
+      ...domain,
+      `${appRoot}/api/payments/${provider}/checkout/route.ts`,
+      `${appRoot}/api/payments/${provider}/webhook/route.ts`,
+      `${appRoot}/payment/success/page.tsx`,
+      '.env.example',
+    ];
+  }
+
+  if (inspection.integrationTarget === 'tanstack') {
+    return [
+      ...domain,
+      `src/routes/api/payments/${provider}/checkout.ts`,
+      `src/routes/api/payments/${provider}/webhook.ts`,
+      'src/routes/payment/success.tsx',
+      '.env.example',
+    ];
+  }
+
+  if (inspection.integrationTarget === 'hono' || inspection.integrationTarget === 'generic-node') {
+    return [
+      ...domain,
+      `src/payments/${provider}/checkout.ts`,
+      `src/payments/${provider}/webhook.ts`,
+      '.env.example',
+    ];
+  }
+
+  if (inspection.integrationTarget === 'static-html') return ['index.html'];
+  return [...domain, `payments/${provider}.ts`, 'payments/webhook.ts', '.env.example'];
+}
+
+function templateFilesFor(inspection, provider, billing) {
+  if (inspection.integrationTarget !== 'nextjs' || inspection.nextRouter === 'pages') return [];
+  if (!templatedProviders.has(provider)) return [];
+  if (billing !== 'one-time') return [];
+
+  const libRoot = paymentLibRoot(inspection);
+  const appRoot = inspection.nextAppRoot ?? 'app';
+  return [
+    { from: 'templates/nextjs/lib/payments/store.ts', to: `${libRoot}/store.ts` },
+    { from: 'templates/nextjs/lib/payments/orders.ts', to: `${libRoot}/orders.ts` },
+    { from: 'templates/nextjs/lib/payments/events.ts', to: `${libRoot}/events.ts` },
+    { from: 'templates/nextjs/lib/payments/entitlements.ts', to: `${libRoot}/entitlements.ts` },
+    { from: `templates/nextjs/${provider}/checkout.route.ts`, to: `${appRoot}/api/payments/${provider}/checkout/route.ts` },
+    { from: `templates/nextjs/${provider}/webhook.route.ts`, to: `${appRoot}/api/payments/${provider}/webhook/route.ts` },
+    { from: 'templates/nextjs/success.page.tsx', to: `${appRoot}/payment/success/page.tsx` },
+  ];
+}
+
 export async function createIntegrationPlan({ project = '.', provider, billing = 'one-time' }) {
   if (!providers.includes(provider)) throw new Error(`Unknown provider: ${provider}`);
   if (!billingModels.includes(billing)) throw new Error(`Invalid billing model: ${billing}`);
@@ -53,25 +112,63 @@ export async function createIntegrationPlan({ project = '.', provider, billing =
   const pack = resolveProviderPack(await loadProviderPacks(), provider, billing);
   const target = inspection.integrationTarget;
   const staticOnly = target === 'static-html' && inspection.serverCapability === 'external-required';
-  const implementationMode = staticOnly ? 'payment-link' : 'full-lifecycle';
-  const files = (targetFiles[target] ?? targetFiles.other)(provider);
+  const hasExistingPaymentDomain = inspection.existingPaymentPaths.length > 0;
+  const integrationApproach = staticOnly
+    ? 'payment-link'
+    : hasExistingPaymentDomain
+      ? 'extend-existing'
+      : 'new-integration';
+  const files = hasExistingPaymentDomain ? [] : plannedFilesFor(inspection, provider);
+  const templateFiles = staticOnly || hasExistingPaymentDomain ? [] : templateFilesFor(inspection, provider, billing);
+  const hasWriteTemplates = templateFiles.length > 0;
+  const implementationMode = staticOnly
+    ? 'payment-link'
+    : hasWriteTemplates
+      ? 'checked-in-sandbox-template'
+      : 'agent-guided';
+  const frameworkExecutionMode = implementationMode;
+  const packageAlreadyPresent = inspection.paymentDependencies.includes(provider);
 
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     project: inspection,
     provider,
     billing,
+    integrationApproach,
     implementationMode,
+    implementationSource: 'official-provider-pack',
+    frameworkExecutionMode,
     providerPack: pack,
+    inspectionTargets: inspection.existingPaymentPaths,
+    detectedEnvironmentKeys: inspection.safeEnvironmentKeys,
     plannedFiles: files,
-    requiredEnvironmentKeys: staticOnly ? [] : providerEnvKeys[provider] ?? [],
+    templateFiles,
+    packagesToInstall: staticOnly || packageAlreadyPresent ? [] : providerPackages[provider] ?? [],
+    requiredEnvironmentKeys: staticOnly || hasExistingPaymentDomain ? [] : providerEnvKeys[provider] ?? [],
     lifecycle: staticOnly
       ? ['hosted checkout or payment link', 'return page', 'explicit warning that webhook and entitlement automation require a backend']
       : ['server-side checkout', 'verified webhook', 'idempotent event claim', 'order state', 'entitlement grant and revocation', 'sandbox verification'],
     evidenceTarget: staticOnly ? 'sandbox-checkout-opened' : 'sandbox-payment-verified',
+    guidedSteps: [
+      `Load only the selected official ${provider} provider pack and follow its current API instructions.`,
+      ...(hasExistingPaymentDomain
+        ? [`Inspect and extend the existing payment domain at: ${inspection.existingPaymentPaths.join(', ')}.`]
+        : []),
+      ...(hasExistingPaymentDomain && inspection.safeEnvironmentKeys.length
+        ? [`Preserve the project's existing payment configuration keys: ${inspection.safeEnvironmentKeys.join(', ')}.`]
+        : []),
+      ...(!staticOnly && !hasWriteTemplates
+        ? [`Implement the ${target} adapter in the project's native routing, auth, data, and test conventions.`]
+        : []),
+      ...(inspection.nextRouter === 'pages'
+        ? ['Adapt the official provider instructions to the detected Pages Router paths; do not write App Router files.']
+        : []),
+      ...(!pack.installAvailable
+        ? ['Read the provider-maintained Skill or official documentation directly inside this workflow.']
+        : []),
+    ],
     blockers: [
       ...(staticOnly ? ['No trusted server was detected. Add a backend/serverless function for verified lifecycle automation.'] : []),
-      ...pack.installAvailable ? [] : ['No universal provider-pack installer is declared; the orchestrator must use the current official docs/toolkit directly.'],
     ],
   };
 }
@@ -99,11 +196,19 @@ function renderMarkdown(plan) {
     `Project kind: **${plan.project.projectKind}**`,
     `Server capability: **${plan.project.serverCapability}**`,
     `Implementation mode: **${plan.implementationMode}**`,
+    `Integration approach: **${plan.integrationApproach}**`,
+    `Framework execution: **${plan.frameworkExecutionMode}**`,
     '',
+    ...(plan.inspectionTargets.length
+      ? ['## Existing payment domain', '', ...plan.inspectionTargets.map((file) => `- ${file}`), '']
+      : []),
     '## Planned files',
     '',
     ...plan.plannedFiles.map((file) => `- ${file}`),
     '',
+    ...(plan.templateFiles.length
+      ? ['## Write templates', '', ...plan.templateFiles.map((file) => `- ${file.from} -> ${file.to}`), '']
+      : []),
     '## Lifecycle',
     '',
     ...plan.lifecycle.map((item) => `- ${item}`),
@@ -112,6 +217,10 @@ function renderMarkdown(plan) {
     '',
     ...plan.requiredEnvironmentKeys.map((key) => `- ${key}`),
     '',
+    '## Guided implementation steps',
+    '',
+    ...plan.guidedSteps.map((step) => `- ${step}`),
+    '',
     `Evidence target: **${plan.evidenceTarget}**`,
     ...(plan.blockers.length ? ['', '## Current blockers', '', ...plan.blockers.map((item) => `- ${item}`)] : []),
     '',
diff --git a/skills/indie-payment-kit/scripts/provider-pack.mjs b/skills/indie-payment-kit/scripts/provider-pack.mjs
index ab195dc..72bba01 100644
--- a/skills/indie-payment-kit/scripts/provider-pack.mjs
+++ b/skills/indie-payment-kit/scripts/provider-pack.mjs
@@ -1,17 +1,39 @@
 #!/usr/bin/env node
 
-import { access, readFile, realpath, stat } from 'node:fs/promises';
-import { homedir } from 'node:os';
+import { access, cp, lstat, mkdtemp, readFile, readdir, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
+import {
+  assertSafeProjectWritePath,
+  prepareSafeProjectDirectory,
+  resolveSafeProjectTarget,
+} from './safe-project-path.mjs';
 
 const manifestUrl = new URL('../references/provider-packs.json', import.meta.url);
+export const PACK_ROOT_SEGMENTS = ['.indie-payment-kit', 'packs'];
+const DISCOVERY_ROOTS = ['.agents/skills', '.codex/skills', '.claude/skills', '.cursor/skills', '.github/skills', '.gemini/skills'];
 
 export async function loadProviderPacks() {
   return JSON.parse(await readFile(manifestUrl, 'utf8'));
 }
 
+export function extractPinnedNpmPackage(installCommand) {
+  if (!Array.isArray(installCommand)) return null;
+  return (
+    installCommand.find(
+      (token) =>
+        token !== 'npx' &&
+        token !== '-y' &&
+        typeof token === 'string' &&
+        !token.startsWith('-') &&
+        !/^https?:/i.test(token) &&
+        /@.+\d/.test(token),
+    ) ?? null
+  );
+}
+
 export function resolveProviderPack(manifest, provider, billing = 'one-time') {
   const pack = manifest.providers[provider];
   if (!pack) throw new Error(`Unknown provider pack: ${provider}`);
@@ -33,8 +55,10 @@ export function resolveProviderPack(manifest, provider, billing = 'one-time') {
     if (!entrySkills.includes(skill)) entrySkills.push(skill);
   }
 
-  const installCommand = pack.install ? [...pack.install] : null;
-  if (installCommand && pack.strategy === 'skills-cli' && entrySkills.length > 0) {
+  const skillsCliNeedsNames = pack.strategy === 'skills-cli';
+  const canInstall = Array.isArray(pack.install) && (!skillsCliNeedsNames || entrySkills.length > 0);
+  const installCommand = canInstall ? [...pack.install] : null;
+  if (installCommand && skillsCliNeedsNames) {
     installCommand.push('--skill', ...entrySkills);
   }
 
@@ -42,13 +66,18 @@ export function resolveProviderPack(manifest, provider, billing = 'one-time') {
     provider,
     billing,
     source: pack.source,
+    sourceAuthority: pack.sourceAuthority,
+    sourceType: pack.sourceType,
+    verifiedAt: pack.verifiedAt,
     strategy: pack.strategy,
-    installAvailable: Array.isArray(pack.install),
+    installAvailable: Boolean(installCommand),
     installCommand,
     installerIntegrity: pack.installerIntegrity ?? null,
+    pinnedNpmPackage: extractPinnedNpmPackage(installCommand),
     entrySkills,
     loadPolicy: pack.loadPolicy,
     userEntryPoint: false,
+    isolatedRoot: PACK_ROOT_SEGMENTS.join('/'),
   };
 }
 
@@ -61,12 +90,21 @@ async function exists(filePath) {
   }
 }
 
+export function packRoot(project) {
+  return path.join(path.resolve(project), ...PACK_ROOT_SEGMENTS);
+}
+
 export async function locateInstalledEntrySkills(project, entrySkills) {
-  const projectDir = path.resolve(project);
-  const roots = ['.agents/skills', '.codex/skills', '.claude/skills', '.cursor/skills', '.github/skills', '.gemini/skills'];
+  const projectDir = await realpath(path.resolve(project));
+  const isolatedRoot = packRoot(projectDir);
   const matches = [];
   for (const skill of entrySkills) {
-    for (const root of roots) {
+    const isolated = path.join(isolatedRoot, skill, 'SKILL.md');
+    if (await exists(isolated)) {
+      matches.push(isolated);
+      continue;
+    }
+    for (const root of DISCOVERY_ROOTS) {
       const skillFile = path.join(projectDir, root, skill, 'SKILL.md');
       if (await exists(skillFile)) matches.push(skillFile);
     }
@@ -74,14 +112,55 @@ export async function locateInstalledEntrySkills(project, entrySkills) {
   return [...new Set(matches)];
 }
 
-export async function resolveSafeInstallTarget(project) {
-  const resolved = await realpath(path.resolve(project));
-  const information = await stat(resolved);
-  if (!information.isDirectory()) throw new Error('Provider packs can only be installed into a project directory.');
-  if (resolved === path.parse(resolved).root || resolved === homedir()) {
-    throw new Error('Refusing to install a provider pack into a broad system or home directory. Choose the project directory explicitly.');
+async function assertRegularProviderPackTree(root, current = root) {
+  const information = await lstat(current);
+  const relative = path.relative(root, current) || '.';
+  if (information.isSymbolicLink()) {
+    throw new Error(`Provider pack contains a symbolic link: ${relative}`);
+  }
+  if (information.isFile()) return;
+  if (!information.isDirectory()) {
+    throw new Error(`Provider pack contains an unsupported filesystem entry: ${relative}`);
+  }
+
+  for (const entry of await readdir(current)) {
+    await assertRegularProviderPackTree(root, path.join(current, entry));
   }
-  return resolved;
+}
+
+export async function isolateProviderPacks(project, entrySkills, { sourceProject = project } = {}) {
+  const projectDir = await resolveSafeProjectTarget(project);
+  const sourceDir = path.resolve(sourceProject);
+  const isolatedRoot = packRoot(projectDir);
+  await prepareSafeProjectDirectory(projectDir, PACK_ROOT_SEGMENTS.join('/'));
+  const isolated = [];
+
+  for (const skill of entrySkills) {
+    const relativeDestination = path.join(...PACK_ROOT_SEGMENTS, skill);
+    await assertSafeProjectWritePath(projectDir, relativeDestination);
+    const destination = path.join(isolatedRoot, skill);
+    const destinationSkill = path.join(destination, 'SKILL.md');
+    const sources = [];
+    for (const root of DISCOVERY_ROOTS) {
+      const skillDir = path.join(sourceDir, root, skill);
+      if (await exists(path.join(skillDir, 'SKILL.md'))) sources.push(skillDir);
+    }
+
+    if (sources[0]) {
+      await assertRegularProviderPackTree(sources[0]);
+      await cp(sources[0], destination, { recursive: true, force: true });
+      await assertRegularProviderPackTree(destination);
+      await assertSafeProjectWritePath(projectDir, path.join(relativeDestination, 'SKILL.md'));
+    }
+
+    if (await exists(destinationSkill)) isolated.push(destinationSkill);
+  }
+
+  return isolated;
+}
+
+export async function resolveSafeInstallTarget(project) {
+  return await resolveSafeProjectTarget(project);
 }
 
 function parseArgs(argv) {
@@ -114,6 +193,7 @@ function renderMarkdown(pack) {
     `Strategy: ${pack.strategy}`,
     `Install available: ${pack.installAvailable ? 'yes' : 'no'}`,
     `Internal entry skills: ${pack.entrySkills.length ? pack.entrySkills.join(', ') : 'current official docs/toolkit'}`,
+    `Isolated pack root: ${pack.isolatedRoot}`,
     `User-facing entry point: indie-payment-kit only`,
     '',
     pack.installCommand ? `Planned command: ${pack.installCommand.join(' ')}` : 'No universal installer is currently declared.',
@@ -139,7 +219,42 @@ export function buildInstallerEnvironment(source = process.env) {
   return environment;
 }
 
-async function runInstall(command, cwd) {
+export async function readNpmIntegrity(spec) {
+  const environment = buildInstallerEnvironment();
+  return await new Promise((resolve, reject) => {
+    const child = spawn('npm', ['view', spec, 'dist.integrity'], {
+      env: environment,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: false,
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk;
+    });
+    child.once('error', reject);
+    child.once('exit', (code, signal) => {
+      if (code === 0) resolve(stdout.trim());
+      else reject(new Error(stderr.trim() || `npm view exited with ${signal ? `signal ${signal}` : `code ${code}`}.`));
+    });
+  });
+}
+
+export async function assertInstallerIntegrity(spec, expected, { readIntegrity = readNpmIntegrity } = {}) {
+  if (!spec) throw new Error('Missing pinned npm package for installer integrity verification.');
+  if (!expected) throw new Error(`Missing installer integrity metadata for ${spec}.`);
+  const actual = await readIntegrity(spec);
+  if (actual !== expected) {
+    throw new Error(`Installer integrity mismatch for ${spec}.`);
+  }
+}
+
+async function runInstall(command, cwd, integrity) {
+  const spec = extractPinnedNpmPackage(command);
+  if (integrity) await assertInstallerIntegrity(spec, integrity);
   const environment = buildInstallerEnvironment();
 
   await new Promise((resolve, reject) => {
@@ -157,6 +272,31 @@ async function runInstall(command, cwd) {
   });
 }
 
+export async function installProviderPack({ project, pack, runInstaller = runInstall }) {
+  if (!pack.installCommand) {
+    throw new Error(`${pack.provider} does not have a declared universal provider-pack installer.`);
+  }
+
+  const projectDir = await resolveSafeInstallTarget(project);
+  const staging = await mkdtemp(path.join(tmpdir(), 'indie-payment-kit-pack-'));
+  try {
+    await writeFile(
+      path.join(staging, 'package.json'),
+      '{"name":"indie-payment-kit-provider-stage","private":true}\n',
+    );
+    await runInstaller(pack.installCommand, staging, pack.installerIntegrity);
+    const discovered = await locateInstalledEntrySkills(staging, pack.entrySkills);
+    const found = new Set(discovered.map((item) => path.basename(path.dirname(item))));
+    const missing = pack.entrySkills.filter((skill) => !found.has(skill));
+    if (missing.length) {
+      throw new Error(`Official provider pack did not contain required Skills: ${missing.join(', ')}`);
+    }
+    return await isolateProviderPacks(projectDir, pack.entrySkills, { sourceProject: staging });
+  } finally {
+    await rm(staging, { recursive: true, force: true });
+  }
+}
+
 async function main() {
   try {
     const args = parseArgs(process.argv.slice(2));
@@ -164,9 +304,9 @@ async function main() {
     if (args.install) {
       if (!args.yes) throw new Error('--install requires --yes after the user has approved the external download.');
       if (!pack.installCommand) throw new Error(`${pack.provider} does not have a declared universal provider-pack installer.`);
-      await runInstall(pack.installCommand, await resolveSafeInstallTarget(args.project));
+      pack.installedSkillPaths = await installProviderPack({ project: args.project, pack });
     }
-    if (args.install || args.locate) {
+    if (!args.install && args.locate) {
       pack.installedSkillPaths = await locateInstalledEntrySkills(args.project, pack.entrySkills);
     }
     process.stdout.write(args.format === 'json' ? `${JSON.stringify(pack, null, 2)}\n` : renderMarkdown(pack));
diff --git a/skills/indie-payment-kit/scripts/safe-project-path.mjs b/skills/indie-payment-kit/scripts/safe-project-path.mjs
new file mode 100644
index 0000000..e8b9a0e
--- /dev/null
+++ b/skills/indie-payment-kit/scripts/safe-project-path.mjs
@@ -0,0 +1,72 @@
+import { lstat, mkdir, realpath, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+
+export async function resolveSafeProjectTarget(project) {
+  const resolved = await realpath(path.resolve(project));
+  const information = await stat(resolved);
+  if (!information.isDirectory()) throw new Error('Project writes require an existing project directory.');
+
+  let resolvedHome = path.resolve(homedir());
+  try {
+    resolvedHome = await realpath(resolvedHome);
+  } catch {
+    // Keep the resolved lexical home path when the platform cannot canonicalize it.
+  }
+
+  if (resolved === path.parse(resolved).root || resolved === resolvedHome) {
+    throw new Error('Refusing to write into a broad system or home directory. Choose the project directory explicitly.');
+  }
+  return resolved;
+}
+
+export function resolveProjectRelativePath(project, relativePath) {
+  if (!relativePath || path.isAbsolute(relativePath)) {
+    throw new Error('Project write paths must be non-empty relative paths.');
+  }
+
+  const projectDir = path.resolve(project);
+  const destination = path.resolve(projectDir, relativePath);
+  const relative = path.relative(projectDir, destination);
+  if (relative === '' || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    throw new Error(`Refusing to write outside the project: ${relativePath}`);
+  }
+  return destination;
+}
+
+export async function assertSafeProjectWritePath(project, relativePath) {
+  const projectDir = path.resolve(project);
+  const destination = resolveProjectRelativePath(projectDir, relativePath);
+  const segments = path.relative(projectDir, destination).split(path.sep);
+  let current = projectDir;
+
+  for (const segment of segments) {
+    current = path.join(current, segment);
+    try {
+      const information = await lstat(current);
+      if (information.isSymbolicLink()) {
+        throw new Error(`Refusing to follow a symbolic link during a project write: ${path.relative(projectDir, current)}`);
+      }
+    } catch (error) {
+      if (error?.code === 'ENOENT') break;
+      throw error;
+    }
+  }
+
+  return destination;
+}
+
+export async function prepareSafeProjectDirectory(project, relativePath) {
+  const destination = await assertSafeProjectWritePath(project, relativePath);
+  await mkdir(destination, { recursive: true });
+  await assertSafeProjectWritePath(project, relativePath);
+  return destination;
+}
+
+export async function prepareSafeProjectFile(project, relativePath) {
+  const destination = await assertSafeProjectWritePath(project, relativePath);
+  const parent = path.dirname(relativePath);
+  if (parent !== '.') await prepareSafeProjectDirectory(project, parent);
+  await assertSafeProjectWritePath(project, relativePath);
+  return destination;
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/dodo/checkout.route.ts b/skills/indie-payment-kit/templates/nextjs/dodo/checkout.route.ts
new file mode 100644
index 0000000..f26f06d
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/dodo/checkout.route.ts
@@ -0,0 +1,46 @@
+import { NextResponse } from 'next/server';
+import DodoPayments from 'dodopayments';
+import { attachProviderRef, createOrder } from '@/lib/payments/orders';
+
+export const runtime = 'nodejs';
+
+export async function POST() {
+  if (
+    process.env.NODE_ENV === 'production' ||
+    process.env.INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT !== 'true'
+  ) {
+    return NextResponse.json(
+      { error: 'Sandbox checkout is disabled. Add project authentication and rate limiting before production.' },
+      { status: 503 },
+    );
+  }
+
+  const apiKey = process.env.DODO_PAYMENTS_API_KEY;
+  const appUrl = process.env.APP_URL ?? process.env.NEXT_PUBLIC_APP_URL ?? process.env.DODO_PAYMENTS_RETURN_URL;
+  const productId = process.env.DODO_PAYMENTS_PRODUCT_ID;
+  if (!apiKey || !appUrl || !productId) {
+    return NextResponse.json({ error: 'Missing Dodo API key, APP_URL, or productId' }, { status: 500 });
+  }
+
+  const order = await createOrder({
+    provider: 'dodo',
+    sku: String(productId),
+  });
+
+  const client = new DodoPayments({
+    bearerToken: apiKey,
+    environment: process.env.DODO_PAYMENTS_ENVIRONMENT === 'live' ? 'live_mode' : 'test_mode',
+  });
+
+  const session = await client.checkoutSessions.create({
+    product_cart: [{ product_id: String(productId), quantity: 1 }],
+    return_url: `${appUrl}/payment/success?order=${order.id}`,
+    metadata: { orderId: order.id, sku: String(productId) },
+  });
+
+  await attachProviderRef(order.id, session.session_id ?? session.id);
+  return NextResponse.json({
+    url: session.checkout_url ?? session.url,
+    orderId: order.id,
+  });
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/dodo/webhook.route.ts b/skills/indie-payment-kit/templates/nextjs/dodo/webhook.route.ts
new file mode 100644
index 0000000..fba20c3
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/dodo/webhook.route.ts
@@ -0,0 +1,80 @@
+import { NextResponse } from 'next/server';
+import { Webhook } from 'standardwebhooks';
+import { grantEntitlement, revokeEntitlement } from '@/lib/payments/entitlements';
+import { beginEvent, completeEvent, failEvent } from '@/lib/payments/events';
+import { attachProviderRef, findOrderById, findOrderByProviderRef, updateOrderStatus } from '@/lib/payments/orders';
+
+export const runtime = 'nodejs';
+
+type DodoEvent = {
+  type?: string;
+  data?: {
+    payment_id?: string;
+    subscription_id?: string;
+    customer_id?: string;
+    metadata?: { orderId?: string; sku?: string };
+    total_amount?: number;
+    currency?: string;
+  };
+};
+
+export async function POST(request: Request) {
+  const webhookKey = process.env.DODO_PAYMENTS_WEBHOOK_KEY;
+  if (!webhookKey) {
+    return NextResponse.json({ error: 'Missing DODO_PAYMENTS_WEBHOOK_KEY' }, { status: 500 });
+  }
+
+  const raw = await request.text();
+  const webhook = new Webhook(webhookKey);
+  try {
+    webhook.verify(raw, {
+      'webhook-id': request.headers.get('webhook-id') ?? '',
+      'webhook-signature': request.headers.get('webhook-signature') ?? '',
+      'webhook-timestamp': request.headers.get('webhook-timestamp') ?? '',
+    });
+  } catch {
+    return NextResponse.json({ error: 'Invalid Dodo webhook signature' }, { status: 400 });
+  }
+
+  const event = JSON.parse(raw) as DodoEvent;
+  const eventId = request.headers.get('webhook-id') ?? raw;
+  if (!(await beginEvent('dodo', eventId))) {
+    return NextResponse.json({ received: true, duplicate: true });
+  }
+
+  try {
+    const payload = event.data ?? {};
+    const orderId = payload.metadata?.orderId;
+    const sku = payload.metadata?.sku ?? 'default';
+    const order = orderId
+      ? await findOrderById(orderId)
+      : await findOrderByProviderRef('dodo', payload.payment_id ?? payload.subscription_id ?? '');
+    const customerId = payload.customer_id ?? order?.id ?? 'unknown';
+
+    if (event.type === 'payment.succeeded' && order) {
+      if (payload.payment_id) await attachProviderRef(order.id, payload.payment_id);
+      await updateOrderStatus(order.id, 'paid', {
+        amount: payload.total_amount ?? order.amount,
+        currency: payload.currency ?? order.currency,
+        customerId,
+        sku,
+      });
+      await grantEntitlement(customerId, sku, order.id);
+    }
+
+    if ((event.type === 'refund.succeeded' || event.type === 'dispute.opened') && order?.customerId) {
+      await updateOrderStatus(order.id, 'refunded');
+      await revokeEntitlement(order.customerId, order.sku ?? sku);
+    }
+
+    if ((event.type === 'payment.failed' || event.type === 'payment.cancelled') && order) {
+      await updateOrderStatus(order.id, event.type === 'payment.failed' ? 'failed' : 'canceled');
+    }
+
+    await completeEvent('dodo', eventId);
+    return NextResponse.json({ received: true });
+  } catch (error) {
+    await failEvent('dodo', eventId, error);
+    return NextResponse.json({ error: 'Dodo event processing failed' }, { status: 500 });
+  }
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/lib/payments/entitlements.ts b/skills/indie-payment-kit/templates/nextjs/lib/payments/entitlements.ts
new file mode 100644
index 0000000..ba06c3b
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/lib/payments/entitlements.ts
@@ -0,0 +1,31 @@
+import { loadState, saveState, type Entitlement } from './store';
+
+export async function grantEntitlement(customerId: string, sku: string, sourceOrderId: string | null): Promise<Entitlement> {
+  const state = await loadState();
+  const now = new Date().toISOString();
+  let entitlement = state.entitlements.find((item) => item.customerId === customerId && item.sku === sku);
+  if (!entitlement) {
+    entitlement = { customerId, sku, active: true, sourceOrderId, updatedAt: now };
+    state.entitlements.push(entitlement);
+  } else {
+    entitlement.active = true;
+    entitlement.sourceOrderId = sourceOrderId;
+    entitlement.updatedAt = now;
+  }
+  await saveState(state);
+  return entitlement;
+}
+
+export async function revokeEntitlement(customerId: string, sku: string): Promise<void> {
+  const state = await loadState();
+  const entitlement = state.entitlements.find((item) => item.customerId === customerId && item.sku === sku);
+  if (!entitlement) return;
+  entitlement.active = false;
+  entitlement.updatedAt = new Date().toISOString();
+  await saveState(state);
+}
+
+export async function hasEntitlement(customerId: string, sku: string): Promise<boolean> {
+  const state = await loadState();
+  return Boolean(state.entitlements.find((item) => item.customerId === customerId && item.sku === sku && item.active));
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/lib/payments/events.ts b/skills/indie-payment-kit/templates/nextjs/lib/payments/events.ts
new file mode 100644
index 0000000..e2eb44c
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/lib/payments/events.ts
@@ -0,0 +1,44 @@
+import { loadState, saveState } from './store';
+
+export type EventStatus = 'processing' | 'succeeded' | 'failed';
+const PROCESSING_LEASE_MS = 5 * 60 * 1000;
+
+export async function beginEvent(provider: string, eventId: string): Promise<boolean> {
+  const state = await loadState();
+  const receipt = state.events.find((event) => event.provider === provider && event.eventId === eventId);
+  if (receipt?.status === 'succeeded') return false;
+  if (receipt?.status === 'processing') {
+    const updatedAt = Date.parse(receipt.updatedAt);
+    if (Number.isFinite(updatedAt) && Date.now() - updatedAt < PROCESSING_LEASE_MS) return false;
+  }
+  const now = new Date().toISOString();
+  if (receipt) {
+    receipt.status = 'processing';
+    receipt.attempts += 1;
+    receipt.error = null;
+    receipt.updatedAt = now;
+  } else {
+    state.events.push({ provider, eventId, status: 'processing', attempts: 1, error: null, updatedAt: now });
+  }
+  await saveState(state);
+  return true;
+}
+
+async function finishEvent(provider: string, eventId: string, status: EventStatus, error: string | null) {
+  const state = await loadState();
+  const receipt = state.events.find((event) => event.provider === provider && event.eventId === eventId);
+  if (!receipt) throw new Error(`Missing event receipt for ${provider}:${eventId}`);
+  receipt.status = status;
+  receipt.error = error;
+  receipt.updatedAt = new Date().toISOString();
+  await saveState(state);
+}
+
+export async function completeEvent(provider: string, eventId: string): Promise<void> {
+  await finishEvent(provider, eventId, 'succeeded', null);
+}
+
+export async function failEvent(provider: string, eventId: string, error: unknown): Promise<void> {
+  const message = error instanceof Error ? error.message : String(error);
+  await finishEvent(provider, eventId, 'failed', message);
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/lib/payments/orders.ts b/skills/indie-payment-kit/templates/nextjs/lib/payments/orders.ts
new file mode 100644
index 0000000..e137a69
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/lib/payments/orders.ts
@@ -0,0 +1,63 @@
+import { randomUUID } from 'node:crypto';
+import { loadState, saveState, type Order, type OrderStatus } from './store';
+
+export async function createOrder(input: {
+  provider: string;
+  amount?: number;
+  currency?: string;
+  customerId?: string | null;
+  sku?: string | null;
+}): Promise<Order> {
+  const now = new Date().toISOString();
+  const order: Order = {
+    id: randomUUID(),
+    provider: input.provider,
+    providerRefs: [],
+    amount: input.amount ?? 0,
+    currency: input.currency ?? 'usd',
+    status: 'pending',
+    customerId: input.customerId ?? null,
+    sku: input.sku ?? null,
+    createdAt: now,
+    updatedAt: now,
+  };
+  const state = await loadState();
+  state.orders.push(order);
+  await saveState(state);
+  return order;
+}
+
+export async function attachProviderRef(orderId: string, providerRef: string): Promise<Order | null> {
+  const state = await loadState();
+  const order = state.orders.find((item) => item.id === orderId);
+  if (!order) return null;
+  if (!order.providerRefs.includes(providerRef)) order.providerRefs.push(providerRef);
+  order.updatedAt = new Date().toISOString();
+  await saveState(state);
+  return order;
+}
+
+export async function findOrderById(orderId: string): Promise<Order | null> {
+  const state = await loadState();
+  return state.orders.find((item) => item.id === orderId) ?? null;
+}
+
+export async function findOrderByProviderRef(provider: string, providerRef: string): Promise<Order | null> {
+  const state = await loadState();
+  return state.orders.find((item) => item.provider === provider && item.providerRefs.includes(providerRef)) ?? null;
+}
+
+export async function updateOrderStatus(
+  orderId: string,
+  status: OrderStatus,
+  extras: Partial<Pick<Order, 'amount' | 'currency' | 'customerId' | 'sku'>> = {},
+): Promise<Order | null> {
+  const state = await loadState();
+  const order = state.orders.find((item) => item.id === orderId);
+  if (!order) return null;
+  order.status = status;
+  Object.assign(order, extras);
+  order.updatedAt = new Date().toISOString();
+  await saveState(state);
+  return order;
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/lib/payments/store.ts b/skills/indie-payment-kit/templates/nextjs/lib/payments/store.ts
new file mode 100644
index 0000000..7e0186c
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/lib/payments/store.ts
@@ -0,0 +1,68 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+export type OrderStatus = 'created' | 'pending' | 'paid' | 'refunded' | 'canceled' | 'failed';
+
+export type Order = {
+  id: string;
+  provider: string;
+  providerRefs: string[];
+  amount: number;
+  currency: string;
+  status: OrderStatus;
+  customerId: string | null;
+  sku: string | null;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type Entitlement = {
+  customerId: string;
+  sku: string;
+  active: boolean;
+  sourceOrderId: string | null;
+  updatedAt: string;
+};
+
+export type EventStatus = 'processing' | 'succeeded' | 'failed';
+
+export type EventReceipt = {
+  provider: string;
+  eventId: string;
+  status: EventStatus;
+  attempts: number;
+  error: string | null;
+  updatedAt: string;
+};
+
+export type PaymentState = {
+  orders: Order[];
+  events: EventReceipt[];
+  entitlements: Entitlement[];
+};
+
+// Sandbox scaffold only. Replace this file with the project's durable database adapter before
+// production or multi-instance testing. The generated webhook state machine is intentionally kept
+// behind loadState/saveState so an agent can replace this adapter without rewriting provider routes.
+const stateFile = path.join(process.cwd(), '.indie-payment-kit', 'state.json');
+
+export async function loadState(): Promise<PaymentState> {
+  try {
+    const parsed = JSON.parse(await readFile(stateFile, 'utf8')) as Partial<PaymentState>;
+    return {
+      orders: Array.isArray(parsed.orders) ? parsed.orders : [],
+      events: Array.isArray(parsed.events) ? parsed.events.filter((event) => typeof event !== 'string') : [],
+      entitlements: Array.isArray(parsed.entitlements) ? parsed.entitlements : [],
+    };
+  } catch (error) {
+    if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT') {
+      return { orders: [], events: [], entitlements: [] };
+    }
+    throw error;
+  }
+}
+
+export async function saveState(state: PaymentState): Promise<void> {
+  await mkdir(path.dirname(stateFile), { recursive: true });
+  await writeFile(stateFile, `${JSON.stringify(state, null, 2)}\n`);
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/stripe/checkout.route.ts b/skills/indie-payment-kit/templates/nextjs/stripe/checkout.route.ts
new file mode 100644
index 0000000..711253c
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/stripe/checkout.route.ts
@@ -0,0 +1,51 @@
+import { NextResponse } from 'next/server';
+import Stripe from 'stripe';
+import { attachProviderRef, createOrder } from '@/lib/payments/orders';
+
+export const runtime = 'nodejs';
+
+export async function POST() {
+  if (
+    process.env.NODE_ENV === 'production' ||
+    process.env.INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT !== 'true'
+  ) {
+    return NextResponse.json(
+      { error: 'Sandbox checkout is disabled. Add project authentication and rate limiting before production.' },
+      { status: 503 },
+    );
+  }
+
+  const secret = process.env.STRIPE_SECRET_KEY;
+  const appUrl = process.env.APP_URL ?? process.env.NEXT_PUBLIC_APP_URL;
+  if (!secret || !appUrl) {
+    return NextResponse.json({ error: 'Missing STRIPE_SECRET_KEY or APP_URL' }, { status: 500 });
+  }
+
+  const priceId = process.env.STRIPE_PRICE_ID;
+  if (!priceId) {
+    return NextResponse.json({ error: 'Missing priceId' }, { status: 400 });
+  }
+
+  const mode = '__STRIPE_CHECKOUT_MODE__';
+  const order = await createOrder({
+    provider: 'stripe',
+    sku: priceId,
+  });
+
+  const stripe = new Stripe(secret);
+  const session = await stripe.checkout.sessions.create({
+    mode,
+    line_items: [{ price: priceId, quantity: 1 }],
+    success_url: `${appUrl}/payment/success?order=${order.id}`,
+    cancel_url: `${appUrl}/payment/success?order=${order.id}&canceled=1`,
+    client_reference_id: order.id,
+    metadata: { orderId: order.id, sku: priceId },
+  });
+
+  if (!session.id || !session.url) {
+    return NextResponse.json({ error: 'Stripe checkout session was not created' }, { status: 502 });
+  }
+
+  await attachProviderRef(order.id, session.id);
+  return NextResponse.json({ url: session.url, orderId: order.id });
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/stripe/webhook.route.ts b/skills/indie-payment-kit/templates/nextjs/stripe/webhook.route.ts
new file mode 100644
index 0000000..cb19381
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/stripe/webhook.route.ts
@@ -0,0 +1,80 @@
+import { NextResponse } from 'next/server';
+import Stripe from 'stripe';
+import { grantEntitlement, revokeEntitlement } from '@/lib/payments/entitlements';
+import { beginEvent, completeEvent, failEvent } from '@/lib/payments/events';
+import { attachProviderRef, findOrderById, findOrderByProviderRef, updateOrderStatus } from '@/lib/payments/orders';
+
+export const runtime = 'nodejs';
+
+function customerIdFrom(value: unknown, fallback: string): string {
+  if (typeof value === 'string' && value.length > 0) return value;
+  return fallback;
+}
+
+export async function POST(request: Request) {
+  const secret = process.env.STRIPE_SECRET_KEY;
+  const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
+  const signature = request.headers.get('stripe-signature');
+  if (!secret || !webhookSecret || !signature) {
+    return NextResponse.json({ error: 'Missing Stripe webhook configuration' }, { status: 500 });
+  }
+
+  const raw = await request.text();
+  const stripe = new Stripe(secret);
+
+  let event: Stripe.Event;
+  try {
+    event = stripe.webhooks.constructEvent(raw, signature, webhookSecret);
+  } catch {
+    return NextResponse.json({ error: 'Invalid Stripe signature' }, { status: 400 });
+  }
+
+  if (!(await beginEvent('stripe', event.id))) {
+    return NextResponse.json({ received: true, duplicate: true });
+  }
+
+  try {
+    if (event.type === 'checkout.session.completed' || event.type === 'checkout.session.async_payment_succeeded') {
+      const session = event.data.object as Stripe.Checkout.Session;
+      const orderId = session.client_reference_id ?? session.metadata?.orderId;
+      const order = orderId
+        ? await findOrderById(orderId)
+        : await findOrderByProviderRef('stripe', session.id);
+      if (order && session.payment_status === 'paid') {
+        if (typeof session.payment_intent === 'string') {
+          await attachProviderRef(order.id, session.payment_intent);
+        }
+        const sku = session.metadata?.sku ?? order.sku ?? 'default';
+        const customerId = customerIdFrom(session.customer ?? session.customer_email, order.id);
+        await updateOrderStatus(order.id, 'paid', {
+          amount: session.amount_total ?? order.amount,
+          currency: session.currency ?? order.currency,
+          customerId,
+          sku,
+        });
+        await grantEntitlement(customerId, sku, order.id);
+      }
+    }
+
+    if (event.type === 'checkout.session.async_payment_failed') {
+      const session = event.data.object as Stripe.Checkout.Session;
+      const orderId = session.client_reference_id ?? session.metadata?.orderId;
+      if (orderId) await updateOrderStatus(orderId, 'failed');
+    }
+
+    if (event.type === 'charge.refunded' || event.type === 'charge.dispute.created') {
+      const charge = event.data.object as Stripe.Charge;
+      const order = await findOrderByProviderRef('stripe', String(charge.payment_intent ?? ''));
+      if (order?.customerId && order.sku) {
+        await updateOrderStatus(order.id, 'refunded');
+        await revokeEntitlement(order.customerId, order.sku);
+      }
+    }
+
+    await completeEvent('stripe', event.id);
+    return NextResponse.json({ received: true });
+  } catch (error) {
+    await failEvent('stripe', event.id, error);
+    return NextResponse.json({ error: 'Stripe event processing failed' }, { status: 500 });
+  }
+}
diff --git a/skills/indie-payment-kit/templates/nextjs/success.page.tsx b/skills/indie-payment-kit/templates/nextjs/success.page.tsx
new file mode 100644
index 0000000..82581c6
--- /dev/null
+++ b/skills/indie-payment-kit/templates/nextjs/success.page.tsx
@@ -0,0 +1,20 @@
+export const dynamic = 'force-dynamic';
+
+export default async function PaymentSuccessPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ order?: string; canceled?: string }>;
+}) {
+  const params = await searchParams;
+  const canceled = params.canceled === '1';
+
+  return (
+    <main>
+      <h1>{canceled ? 'Payment canceled' : 'Payment submitted'}</h1>
+      <p>
+        Access is granted only after a verified webhook, not by this page.
+        {params.order ? ` Order ${params.order} is being confirmed.` : ''}
+      </p>
+    </main>
+  );
+}
diff --git a/test/event-policy.test.mjs b/test/event-policy.test.mjs
new file mode 100644
index 0000000..8da6d4b
--- /dev/null
+++ b/test/event-policy.test.mjs
@@ -0,0 +1,56 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  DEFAULT_EVENT_LEASE_MS,
+  shouldBeginEvent,
+} from '../skills/indie-payment-kit/scripts/event-policy.mjs';
+
+const eventsTemplate = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../skills/indie-payment-kit/templates/nextjs/lib/payments/events.ts',
+);
+
+test('succeeded and actively processing receipts are duplicates', () => {
+  const now = Date.parse('2026-08-31T08:00:00.000Z');
+  assert.equal(DEFAULT_EVENT_LEASE_MS, 5 * 60 * 1000);
+  assert.equal(shouldBeginEvent(undefined), true);
+  assert.equal(shouldBeginEvent({ status: 'failed' }), true);
+  assert.equal(shouldBeginEvent({ status: 'processing', updatedAt: '2026-08-31T07:59:00.000Z' }, now), false);
+  assert.equal(shouldBeginEvent({ status: 'succeeded' }), false);
+});
+
+test('interrupted processing can be retried after its lease expires', () => {
+  const receipts = new Map();
+  let now = Date.parse('2026-08-31T08:00:00.000Z');
+
+  function begin(id) {
+    const receipt = receipts.get(id);
+    if (!shouldBeginEvent(receipt, now)) return false;
+    receipts.set(id, {
+      status: 'processing',
+      attempts: (receipt?.attempts ?? 0) + 1,
+      updatedAt: new Date(now).toISOString(),
+    });
+    return true;
+  }
+
+  assert.equal(begin('evt_1'), true);
+  assert.equal(begin('evt_1'), false);
+  now += DEFAULT_EVENT_LEASE_MS;
+  assert.equal(begin('evt_1'), true);
+  receipts.set('evt_1', { status: 'failed', attempts: 2 });
+  assert.equal(begin('evt_1'), true);
+  receipts.set('evt_1', { status: 'succeeded', attempts: 3 });
+  assert.equal(begin('evt_1'), false);
+});
+
+test('Next.js event template matches the retry policy', async () => {
+  const source = await readFile(eventsTemplate, 'utf8');
+  assert.match(source, /receipt\?\.status === 'succeeded'/);
+  assert.match(source, /receipt\?\.status === 'processing'/);
+  assert.match(source, /const PROCESSING_LEASE_MS = 5 \* 60 \* 1000/);
+});
diff --git a/test/inspect-project.test.mjs b/test/inspect-project.test.mjs
index 7b593dc..d6cc3f9 100644
--- a/test/inspect-project.test.mjs
+++ b/test/inspect-project.test.mjs
@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtemp, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
@@ -45,6 +45,29 @@ test('inspector distinguishes static HTML from a trusted server', async () => {
   assert.ok(result.warnings.some((warning) => warning.includes('trusted backend')));
 });
 
+test('inspector detects Next.js src/app', async () => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-src-app-'));
+  await writeFile(path.join(directory, 'package.json'), JSON.stringify({ dependencies: { next: '15.0.0' } }));
+  await mkdir(path.join(directory, 'src', 'app'), { recursive: true });
+
+  const result = await inspectProject(directory);
+  assert.equal(result.integrationTarget, 'nextjs');
+  assert.equal(result.nextRouter, 'app');
+  assert.equal(result.nextAppRoot, 'src/app');
+});
+
+test('inspector detects Next.js Pages Router', async () => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-pages-'));
+  await writeFile(path.join(directory, 'package.json'), JSON.stringify({ dependencies: { next: '15.0.0' } }));
+  await mkdir(path.join(directory, 'src', 'pages'), { recursive: true });
+  await writeFile(path.join(directory, 'src', 'pages', 'index.js'), 'export default function Home() { return null }');
+
+  const result = await inspectProject(directory);
+  assert.equal(result.nextRouter, 'pages');
+  assert.equal(result.nextAppRoot, null);
+  assert.equal(result.nextPagesRoot, 'src/pages');
+});
+
 test('inspector recognizes HTML backed by Express', async () => {
   const directory = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-express-'));
   await writeFile(path.join(directory, 'index.html'), '<button>Buy</button>');
@@ -55,3 +78,34 @@ test('inspector recognizes HTML backed by Express', async () => {
   assert.equal(result.serverCapability, 'backend');
   assert.equal(result.integrationTarget, 'generic-node');
 });
+
+test('inspector finds an existing payment domain and data layer before planning writes', async () => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-existing-'));
+  await writeFile(
+    path.join(directory, 'package.json'),
+    JSON.stringify({
+      dependencies: {
+        '@tanstack/react-start': '1.0.0',
+        'drizzle-orm': '0.44.0',
+        stripe: '18.0.0',
+      },
+    }),
+  );
+  for (const filename of [
+    'src/core/payment/index.ts',
+    'src/modules/payment/service.ts',
+    'src/routes/api/payment/checkout.ts',
+  ]) {
+    const file = path.join(directory, filename);
+    await mkdir(path.dirname(file), { recursive: true });
+    await writeFile(file, 'export {};\n');
+  }
+
+  const result = await inspectProject(directory);
+  assert.deepEqual(result.existingPaymentPaths, [
+    'src/core/payment',
+    'src/modules/payment',
+    'src/routes/api/payment',
+  ]);
+  assert.deepEqual(result.dataLayers, ['drizzle']);
+});
diff --git a/test/materialize-integration.test.mjs b/test/materialize-integration.test.mjs
new file mode 100644
index 0000000..3b9b128
--- /dev/null
+++ b/test/materialize-integration.test.mjs
@@ -0,0 +1,112 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { access, mkdir, mkdtemp, readFile, symlink, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { materializeIntegration } from '../skills/indie-payment-kit/scripts/materialize-integration.mjs';
+
+test('materialize writes Next.js Stripe domain and route files', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-write-'));
+  await writeFile(path.join(project, 'package.json'), JSON.stringify({ dependencies: { next: '15.0.0' } }));
+  await mkdir(path.join(project, 'app'), { recursive: true });
+
+  const result = await materializeIntegration({ project, provider: 'stripe', billing: 'one-time' });
+  assert.equal(result.reason, 'written');
+  assert.ok(result.written.includes('lib/payments/orders.ts'));
+  assert.ok(result.written.includes('app/api/payments/stripe/webhook/route.ts'));
+  const webhook = await readFile(path.join(project, 'app/api/payments/stripe/webhook/route.ts'), 'utf8');
+  assert.match(webhook, /constructEvent/);
+  assert.match(webhook, /beginEvent/);
+  assert.match(webhook, /completeEvent/);
+  assert.match(webhook, /failEvent/);
+  assert.doesNotMatch(webhook, /claimEvent/);
+  assert.match(webhook, /session\.payment_intent/);
+  assert.match(webhook, /attachProviderRef/);
+  const events = await readFile(path.join(project, 'lib/payments/events.ts'), 'utf8');
+  assert.match(events, /'processing' \| 'succeeded' \| 'failed'/);
+  assert.match(events, /receipt\?\.status === 'succeeded'/);
+  assert.doesNotMatch(events, /status === 'processing'\) return false/);
+  const store = await readFile(path.join(project, 'lib/payments/store.ts'), 'utf8');
+  assert.match(store, /sandbox scaffold/i);
+  assert.match(store, /ENOENT/);
+  const checkout = await readFile(path.join(project, 'app/api/payments/stripe/checkout/route.ts'), 'utf8');
+  assert.match(checkout, /const mode = 'payment'/);
+  assert.doesNotMatch(checkout, /body\.priceId/);
+  assert.match(checkout, /process\.env\.STRIPE_PRICE_ID/);
+  assert.match(checkout, /INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT/);
+  assert.match(checkout, /NODE_ENV === 'production'/);
+  assert.ok(checkout.indexOf('INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT') < checkout.indexOf('await createOrder'));
+  const gitignore = await readFile(path.join(project, '.gitignore'), 'utf8');
+  assert.match(gitignore, /\.indie-payment-kit\/state\.json/);
+  const env = await readFile(path.join(project, '.env.example'), 'utf8');
+  assert.match(env, /STRIPE_WEBHOOK_SECRET=/);
+  assert.match(env, /INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT=/);
+});
+
+test('materialize keeps Dodo product selection on the trusted server', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-dodo-write-'));
+  await writeFile(path.join(project, 'package.json'), JSON.stringify({ dependencies: { next: '15.0.0' } }));
+  await mkdir(path.join(project, 'app'), { recursive: true });
+
+  await materializeIntegration({ project, provider: 'dodo', billing: 'one-time' });
+  const checkout = await readFile(path.join(project, 'app/api/payments/dodo/checkout/route.ts'), 'utf8');
+  assert.doesNotMatch(checkout, /request\.json/);
+  assert.match(checkout, /process\.env\.DODO_PAYMENTS_PRODUCT_ID/);
+  assert.match(checkout, /INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT/);
+  assert.match(checkout, /NODE_ENV === 'production'/);
+  assert.ok(checkout.indexOf('INDIE_PAYMENT_KIT_ENABLE_SANDBOX_CHECKOUT') < checkout.indexOf('await createOrder'));
+  const webhook = await readFile(path.join(project, 'app/api/payments/dodo/webhook/route.ts'), 'utf8');
+  assert.match(webhook, /refund\.succeeded/);
+  assert.doesNotMatch(webhook, /payment\.refunded/);
+});
+
+test('materialize refuses to overlay an existing payment directory', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-skip-'));
+  await writeFile(path.join(project, 'package.json'), JSON.stringify({ dependencies: { next: '15.0.0' } }));
+  await mkdir(path.join(project, 'lib', 'payments'), { recursive: true });
+  await writeFile(path.join(project, 'lib/payments/orders.ts'), 'export const existing = true;\n');
+
+  const first = await materializeIntegration({ project, provider: 'stripe', billing: 'one-time' });
+  assert.equal(first.reason, 'extend-existing');
+  assert.deepEqual(first.written, []);
+  const kept = await readFile(path.join(project, 'lib/payments/orders.ts'), 'utf8');
+  assert.match(kept, /existing/);
+});
+
+test('materialize leaves mature payment domains untouched for agent-guided extension', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-existing-write-'));
+  await writeFile(
+    path.join(project, 'package.json'),
+    JSON.stringify({ dependencies: { '@tanstack/react-start': '1.0.0', stripe: '18.0.0' } }),
+  );
+  await mkdir(path.join(project, 'src', 'core', 'payment'), { recursive: true });
+  await writeFile(path.join(project, 'src', 'core', 'payment', 'index.ts'), 'export const existing = true;\n');
+
+  const result = await materializeIntegration({ project, provider: 'stripe', billing: 'credits' });
+  assert.equal(result.reason, 'extend-existing');
+  assert.deepEqual(result.written, []);
+  assert.equal(result.envUpdated, false);
+  assert.equal(result.gitignoreUpdated, false);
+});
+
+test('materialize rejects symlinked destinations instead of writing outside the project', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-write-link-'));
+  const outside = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-write-link-outside-'));
+  await writeFile(path.join(project, 'package.json'), JSON.stringify({ dependencies: { next: '15.0.0' } }));
+  await mkdir(path.join(project, 'app'), { recursive: true });
+  await symlink(outside, path.join(project, 'lib'));
+
+  await assert.rejects(
+    () => materializeIntegration({ project, provider: 'stripe', billing: 'one-time' }),
+    /symbolic link/,
+  );
+  await assert.rejects(() => access(path.join(outside, 'payments', 'store.ts')));
+});
+
+test('materialize rejects broad filesystem targets before inspection or writes', async () => {
+  await assert.rejects(
+    () => materializeIntegration({ project: '/', provider: 'stripe', billing: 'one-time' }),
+    /broad system or home directory/,
+  );
+});
diff --git a/test/plan-integration.test.mjs b/test/plan-integration.test.mjs
index 4530b6f..2c7d8fd 100644
--- a/test/plan-integration.test.mjs
+++ b/test/plan-integration.test.mjs
@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtemp, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
@@ -17,7 +17,8 @@ test('TanStack plan keeps the user in one workflow and targets server routes', a
   const plan = await createIntegrationPlan({ project, provider: 'dodo', billing: 'subscription' });
 
   assert.equal(plan.project.integrationTarget, 'tanstack');
-  assert.equal(plan.implementationMode, 'full-lifecycle');
+  assert.equal(plan.implementationMode, 'agent-guided');
+  assert.equal(plan.frameworkExecutionMode, 'agent-guided');
   assert.ok(plan.plannedFiles.includes('src/routes/api/payments/dodo/checkout.ts'));
   assert.ok(plan.lifecycle.includes('sandbox verification'));
   assert.equal(plan.providerPack.userEntryPoint, false);
@@ -29,9 +30,38 @@ test('Next.js plan targets App Router payment routes', async () => {
 
   assert.equal(plan.project.integrationTarget, 'nextjs');
   assert.ok(plan.plannedFiles.includes('app/api/payments/stripe/webhook/route.ts'));
+  assert.ok(plan.plannedFiles.includes('lib/payments/orders.ts'));
+  assert.ok(plan.plannedFiles.includes('lib/payments/entitlements.ts'));
+  assert.ok(plan.templateFiles.some((file) => file.to === 'app/api/payments/stripe/checkout/route.ts'));
+  assert.equal(plan.implementationMode, 'checked-in-sandbox-template');
   assert.equal(plan.evidenceTarget, 'sandbox-payment-verified');
 });
 
+test('Next.js src/app plans write into src/app and src/lib', async () => {
+  const project = await projectWithPackage({ next: '15.0.0' });
+  await mkdir(path.join(project, 'src', 'app'), { recursive: true });
+  const plan = await createIntegrationPlan({ project, provider: 'dodo', billing: 'subscription' });
+
+  assert.equal(plan.project.nextAppRoot, 'src/app');
+  assert.ok(plan.plannedFiles.includes('src/app/api/payments/dodo/webhook/route.ts'));
+  assert.ok(plan.plannedFiles.includes('src/lib/payments/entitlements.ts'));
+  assert.equal(plan.templateFiles.length, 0);
+  assert.equal(plan.frameworkExecutionMode, 'agent-guided');
+  assert.ok(plan.guidedSteps.some((step) => step.includes('official dodo provider pack')));
+});
+
+test('Next.js Pages Router plans do not write App Router files', async () => {
+  const project = await projectWithPackage({ next: '15.0.0' });
+  await mkdir(path.join(project, 'src', 'pages'), { recursive: true });
+  const plan = await createIntegrationPlan({ project, provider: 'stripe', billing: 'one-time' });
+
+  assert.equal(plan.project.nextRouter, 'pages');
+  assert.ok(plan.plannedFiles.includes('src/pages/api/payments/stripe/webhook.ts'));
+  assert.equal(plan.templateFiles.length, 0);
+  assert.equal(plan.frameworkExecutionMode, 'agent-guided');
+  assert.ok(plan.guidedSteps.some((step) => step.includes('Pages Router')));
+});
+
 test('static HTML plan refuses to pretend a browser-only project has a full lifecycle', async () => {
   const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-static-'));
   await writeFile(path.join(project, 'index.html'), '<button>Buy</button>');
@@ -44,3 +74,25 @@ test('static HTML plan refuses to pretend a browser-only project has a full life
   assert.deepEqual(plan.requiredEnvironmentKeys, []);
   assert.deepEqual(plan.plannedFiles, ['index.html']);
 });
+
+test('existing payment domains are extended through the official pack instead of duplicated', async () => {
+  const project = await projectWithPackage({
+    '@tanstack/react-start': '1.0.0',
+    'drizzle-orm': '0.44.0',
+    stripe: '18.0.0',
+  });
+  await mkdir(path.join(project, 'src', 'core', 'payment'), { recursive: true });
+  await mkdir(path.join(project, 'src', 'modules', 'payment'), { recursive: true });
+
+  const plan = await createIntegrationPlan({ project, provider: 'stripe', billing: 'credits' });
+  assert.equal(plan.integrationApproach, 'extend-existing');
+  assert.equal(plan.implementationSource, 'official-provider-pack');
+  assert.equal(plan.frameworkExecutionMode, 'agent-guided');
+  assert.deepEqual(plan.inspectionTargets, ['src/core/payment', 'src/modules/payment']);
+  assert.deepEqual(plan.plannedFiles, []);
+  assert.deepEqual(plan.templateFiles, []);
+  assert.deepEqual(plan.packagesToInstall, []);
+  assert.deepEqual(plan.requiredEnvironmentKeys, []);
+  assert.ok(plan.guidedSteps.some((step) => step.includes('existing payment domain')));
+  assert.equal(plan.blockers.some((blocker) => blocker.includes('No checked-in write templates')), false);
+});
diff --git a/test/provider-pack.test.mjs b/test/provider-pack.test.mjs
index 6bd8955..c6ba4d3 100644
--- a/test/provider-pack.test.mjs
+++ b/test/provider-pack.test.mjs
@@ -1,11 +1,15 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
+import { access, mkdtemp, mkdir, readFile, realpath, symlink, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
 import {
+  assertInstallerIntegrity,
   buildInstallerEnvironment,
+  extractPinnedNpmPackage,
+  installProviderPack,
+  isolateProviderPacks,
   loadProviderPacks,
   locateInstalledEntrySkills,
   resolveProviderPack,
@@ -16,14 +20,48 @@ test('provider-pack manifest covers all catalog providers with one internal user
   const manifest = await loadProviderPacks();
   assert.equal(Object.keys(manifest.providers).length, 8);
 
+  for (const pack of Object.values(manifest.providers)) {
+    assert.equal(pack.sourceAuthority, 'official-provider');
+    assert.match(pack.verifiedAt, /^\d{4}-\d{2}-\d{2}$/);
+  }
+
   const stripe = resolveProviderPack(manifest, 'stripe', 'subscription');
   assert.equal(stripe.installAvailable, true);
   assert.equal(stripe.installCommand[0], 'npx');
   assert.equal(stripe.installCommand[2], 'skills@1.5.23');
+  const agentIndex = stripe.installCommand.indexOf('--agent');
+  assert.equal(stripe.installCommand[agentIndex + 1], 'codex');
   assert.match(stripe.installerIntegrity, /^sha512-/);
   assert.equal(stripe.userEntryPoint, false);
 });
 
+test('provider packs use currently discoverable official skills without invented entry names', async () => {
+  const manifest = await loadProviderPacks();
+
+  const alipay = resolveProviderPack(manifest, 'alipay', 'one-time');
+  assert.equal(alipay.source, 'https://github.com/alipay/payment-skills');
+  assert.deepEqual(alipay.entrySkills, ['alipay-payment-skill']);
+  assert.equal(alipay.installAvailable, true);
+
+  const paypal = resolveProviderPack(manifest, 'paypal', 'subscription');
+  assert.deepEqual(paypal.entrySkills, ['paypal-best-practices']);
+  assert.equal(paypal.installAvailable, true);
+
+  const paddle = resolveProviderPack(manifest, 'paddle', 'subscription');
+  assert.ok(paddle.entrySkills.includes('paddle-checkout-web'));
+  assert.ok(paddle.entrySkills.includes('paddle-webhooks'));
+  assert.ok(paddle.entrySkills.includes('paddle-subscription-sync'));
+  assert.equal(paddle.installAvailable, true);
+
+  const polar = resolveProviderPack(manifest, 'polar', 'subscription');
+  assert.deepEqual(polar.entrySkills, ['polar-integration', 'polar-testing']);
+  assert.equal(polar.installAvailable, true);
+
+  const creem = resolveProviderPack(manifest, 'creem', 'subscription');
+  assert.equal(creem.installAvailable, false);
+  assert.equal(creem.sourceType, 'official-skill-manual');
+});
+
 test('installed provider entry skills can be located without a host index refresh', async () => {
   const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-pack-'));
   const skillDirectory = path.join(project, '.agents', 'skills', 'checkout-integration');
@@ -31,7 +69,7 @@ test('installed provider entry skills can be located without a host index refres
   await writeFile(path.join(skillDirectory, 'SKILL.md'), '# Checkout');
 
   const paths = await locateInstalledEntrySkills(project, ['checkout-integration']);
-  assert.deepEqual(paths, [path.join(skillDirectory, 'SKILL.md')]);
+  assert.deepEqual(paths, [path.join(await realpath(project), '.agents', 'skills', 'checkout-integration', 'SKILL.md')]);
 });
 
 test('Dodo pack adds only the billing capability needed by the plan', async () => {
@@ -45,10 +83,107 @@ test('Dodo pack adds only the billing capability needed by the plan', async () =
 });
 
 test('providers without a universal installer remain usable through official sources', async () => {
-  const pack = resolveProviderPack(await loadProviderPacks(), 'paypal', 'one-time');
+  const pack = resolveProviderPack(await loadProviderPacks(), 'creem', 'one-time');
   assert.equal(pack.installAvailable, false);
   assert.equal(pack.installCommand, null);
   assert.equal(pack.strategy, 'official-docs');
+  assert.equal(pack.sourceType, 'official-skill-manual');
+});
+
+test('Polar does not install an unbounded skill dump', async () => {
+  const pack = resolveProviderPack(await loadProviderPacks(), 'polar', 'subscription');
+  assert.equal(pack.installAvailable, true);
+  assert.deepEqual(pack.entrySkills, ['polar-integration', 'polar-testing']);
+  assert.equal(pack.installCommand.includes('polar-setup'), false);
+  assert.equal(pack.installCommand.includes('polar-migrate'), false);
+});
+
+test('installer commands pin and can verify npm package integrity', async () => {
+  const pack = resolveProviderPack(await loadProviderPacks(), 'stripe', 'one-time');
+  assert.equal(extractPinnedNpmPackage(pack.installCommand), 'skills@1.5.23');
+  await assertInstallerIntegrity('skills@1.5.23', pack.installerIntegrity, {
+    readIntegrity: async () => pack.installerIntegrity,
+  });
+  await assert.rejects(
+    () => assertInstallerIntegrity('skills@1.5.23', pack.installerIntegrity, { readIntegrity: async () => 'sha512-other' }),
+    /integrity mismatch/,
+  );
+});
+
+test('provider packs are copied from staging without deleting user-owned skills', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-isolate-'));
+  const staging = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-stage-'));
+  const userSkill = path.join(project, '.agents', 'skills', 'stripe-best-practices');
+  const stagedSkill = path.join(staging, '.agents', 'skills', 'stripe-best-practices');
+  await mkdir(userSkill, { recursive: true });
+  await mkdir(stagedSkill, { recursive: true });
+  await writeFile(path.join(userSkill, 'SKILL.md'), '# User Stripe\n');
+  await writeFile(path.join(stagedSkill, 'SKILL.md'), '# Official Stripe\n');
+
+  const isolated = await isolateProviderPacks(project, ['stripe-best-practices'], { sourceProject: staging });
+  const expected = path.join(await realpath(project), '.indie-payment-kit', 'packs', 'stripe-best-practices', 'SKILL.md');
+  assert.deepEqual(isolated, [expected]);
+  assert.equal(await locateInstalledEntrySkills(project, ['stripe-best-practices']).then((paths) => paths[0]), expected);
+  assert.equal(await readFile(path.join(userSkill, 'SKILL.md'), 'utf8'), '# User Stripe\n');
+  assert.equal(await readFile(expected, 'utf8'), '# Official Stripe\n');
+});
+
+test('provider pack isolation rejects repository symlinks instead of writing outside the project', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-pack-link-'));
+  const staging = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-pack-link-stage-'));
+  const outside = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-pack-link-outside-'));
+  const stagedSkill = path.join(staging, '.agents', 'skills', 'stripe-best-practices');
+  await mkdir(stagedSkill, { recursive: true });
+  await writeFile(path.join(stagedSkill, 'SKILL.md'), '# Official Stripe\n');
+  await symlink(outside, path.join(project, '.indie-payment-kit'));
+
+  await assert.rejects(
+    () => isolateProviderPacks(project, ['stripe-best-practices'], { sourceProject: staging }),
+    /symbolic link/,
+  );
+  await assert.rejects(() => access(path.join(outside, 'packs', 'stripe-best-practices', 'SKILL.md')));
+});
+
+test('provider pack isolation rejects nested symlinks from staged provider content', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-pack-nested-link-'));
+  const staging = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-pack-nested-link-stage-'));
+  const outside = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-pack-nested-link-outside-'));
+  const stagedSkill = path.join(staging, '.agents', 'skills', 'stripe-best-practices');
+  await mkdir(path.join(stagedSkill, 'references'), { recursive: true });
+  await writeFile(path.join(stagedSkill, 'SKILL.md'), '# Official Stripe\n');
+  await writeFile(path.join(outside, 'secret.md'), 'not provider-pack content\n');
+  await symlink(path.join(outside, 'secret.md'), path.join(stagedSkill, 'references', 'unsafe.md'));
+
+  await assert.rejects(
+    () => isolateProviderPacks(project, ['stripe-best-practices'], { sourceProject: staging }),
+    /contains a symbolic link/,
+  );
+  await assert.rejects(
+    () => access(path.join(project, '.indie-payment-kit', 'packs', 'stripe-best-practices', 'SKILL.md')),
+  );
+});
+
+test('provider installer runs outside the user project and publishes only isolated skills', async () => {
+  const project = await mkdtemp(path.join(os.tmpdir(), 'indie-payment-kit-install-'));
+  const pack = resolveProviderPack(await loadProviderPacks(), 'stripe', 'one-time');
+  let installerDirectory = null;
+
+  const installed = await installProviderPack({
+    project,
+    pack,
+    runInstaller: async (_command, cwd) => {
+      installerDirectory = cwd;
+      await access(path.join(cwd, 'package.json'));
+      const skill = path.join(cwd, '.agents', 'skills', 'stripe-best-practices');
+      await mkdir(skill, { recursive: true });
+      await writeFile(path.join(skill, 'SKILL.md'), '# Staged Stripe\n');
+    },
+  });
+
+  assert.notEqual(installerDirectory, project);
+  assert.equal(installed.length, 1);
+  assert.ok(installed[0].endsWith('/.indie-payment-kit/packs/stripe-best-practices/SKILL.md'));
+  await assert.rejects(() => access(path.join(project, '.agents', 'skills', 'stripe-best-practices', 'SKILL.md')));
 });
 
 test('unknown provider names cannot influence an install command', async () => {