Update default backend API URL and documentation

Author: snipextt

packages/bench-cli/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@wacht/bench",
-    "version": "0.1.4",
+    "version": "0.1.5",
     "description": "CLI for Wacht Bench, the AI development workbench for Wacht.",
     "type": "module",
     "bin": {

skills/wacht-backend-js/SKILL.md

@@ -51,28 +51,29 @@ Required docs:
 
 ### Client Setup
 
-The default client lazy-initializes from `WACHT_API_KEY` (and optional `WACHT_BACKEND_API_URL`) the first time any SDK function runs. No setup call is needed in the common case:
+The default client lazy-initializes from `WACHT_API_KEY` and uses `https://api.wacht.dev` the first time any SDK function runs. No setup call is needed in the common case:
 
 ```ts
 import { users } from '@wacht/backend';
 
 const response = await users.listUsers({ limit: 20 });
 ```
 
-Call `initClient()` only when you need to override the env defaults (e.g. injecting a custom `fetch` for Cloudflare Workers, or pointing at a non-default base URL):
+Call `initClient()` only when you need to inject runtime-specific options such as a custom `fetch` for Cloudflare Workers:
 
 ```ts
 import { initClient, users } from '@wacht/backend';
 
 initClient({
   apiKey: env.WACHT_API_KEY,
-  baseUrl: env.WACHT_BACKEND_API_URL,
   fetch: env.fetch.bind(env),
 });
 
 await users.listUsers({ limit: 20 });
 ```
 
+Do not set `WACHT_BACKEND_API_URL` from a deployment `backend_host`/`fapi.trywacht.xyz` value. That host is for deployment frontend/runtime traffic, not the backend SDK API.
+
 ### Request Auth
 
 ```ts

skills/wacht-setup/SKILL.md

@@ -107,9 +107,10 @@ Required env:
 
 ```bash
 WACHT_API_KEY=sk_test_…                        # sk_live_… on production deployments
-WACHT_BACKEND_API_URL=https://...
 ```
 
+Do not add `WACHT_BACKEND_API_URL` for normal setup. The backend SDK defaults to `https://api.wacht.dev`; deployment `backend_host`/`fapi.trywacht.xyz` is not the backend SDK API URL.
+
 ### Rust
 
 Before editing `Cargo.toml`, fetch `/sdks/rust/getting-started` through Wacht Docs MCP and copy the current `wacht` crate version from that page.

skills/wacht-setup/references/framework-detection.md

@@ -50,10 +50,6 @@ Server-only API key:
 WACHT_API_KEY=sk_live_xxx
 ```
 
-Backend URL override, when needed:
-
-```bash
-WACHT_BACKEND_API_URL=https://...
-```
+Do not add `WACHT_BACKEND_API_URL` for normal setup. The backend SDK defaults to `https://api.wacht.dev`; deployment `backend_host`/`fapi.trywacht.xyz` is not the backend SDK API URL.
 
 Never use a secret key in a public env variable.

skills/wacht/SKILL.md

@@ -54,6 +54,14 @@ Required docs:
 - Cite the Wacht docs pages used when explaining important choices.
 - Run the validation commands from the specialized skill before finishing.
 
+## Source of Truth for Customer-Facing Code
+
+When the code you write will be read or run by a customer (their app, their `.env`, demo material, hand-off snippets, blog/launch content), the **skill text and Wacht Docs MCP are the source of truth**. Source-code grep is for internal/contributor work only.
+
+Why this matters: the SDK source exports advanced/internal knobs as normal-looking public options. Reading the source and pattern-matching "public option = customer env var" leaks plumbing into customer DX. The skills and docs are the curated public surface — anything not mentioned there should stay out of customer-facing files (`.env.example`, README, integration code).
+
+If a knob is missing from the skill but you think a customer needs it, that is a signal to ask the user — not a signal to invent the env var.
+
 ## Cross-Skill Safety Rules
 
 | Risk | Rule |
@@ -62,4 +70,5 @@ Required docs:
 | Client-only auth | Client auth state is UX only; protected reads and mutations need server enforcement. |
 | Tenant leakage | Organization/workspace scoped features must enforce tenancy server-side. |
 | Stale docs | Use Wacht Docs MCP or local checked-in docs before relying on remembered SDK behavior. |
+| Source-grep bias | For customer-facing code, skills + Docs MCP only. Do not grep `wacht/node/src`, `wacht/react/src`, etc. as a primary reference. |
 | Over-editing | Make the smallest integration change that satisfies the user request. |