@appsforgood/next-supabase-kit 0.2.1 → 0.4.0

package/examples/next-supabase-installed/audit-output.json

@@ -1,405 +0,0 @@
-{
-  "summary": {
-    "pass": 71,
-    "warn": 5,
-    "fail": 0
-  },
-  "readiness": {
-    "level": "baseline-setup",
-    "summary": "Agent kit setup is valid, but project-specific evidence still needs to replace starter placeholders.",
-    "nextActions": [
-      "Answer product summary, audience, workflows, auth/tenant model, UI direction, value proposition, and quality target with agent-kit setup or by editing .agent-kit/project-context.json.",
-      "Run agent-kit init --activate cursor to generate council subagents from the roster.",
-      "Replace TBD adapter rows with date, owner, evidence, model-selection status, and known limitations for each active IDE.",
-      "Replace TBD/example rows with real project evidence, or document why an item is not applicable before claiming strong or best-practice maturity.",
-      "Add package.json with executable test, lint, and build scripts appropriate to the stack."
-    ]
-  },
-  "findings": [
-    {
-      "level": "pass",
-      "area": "install",
-      "message": "Agent kit installed at version 0.2.1."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "AGENTS.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "AGENT_ROSTER.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "ASSISTANT_ADAPTERS.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "COUNCIL.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "SKILLS.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "SPEC.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "DECISIONS.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "DOCS.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "DESIGN.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "MESSAGING.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "MODEL_ROUTING.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "QUALITY_GATES.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "STYLE_GUIDE.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "SECURITY.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "TESTING.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "LOOP_CODING.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "DEPLOYMENT.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "templates",
-      "message": "UPGRADE.md matches the current bundled template."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "Agent roster matches the schema-backed runtime contract."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "Agent roster contains the required default council agents."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "Agent roster maps default agents to required skills."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "Core-change workflow requires architect-led council handoff."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "Frontend-change workflow requires content-first design, reference-led critique, distinctiveness benchmarking, product-quality scoring, and creative-direction evidence."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "Marketing-copy workflow requires question-led positioning, value proposition, proof, objections, voice, and conversion evidence."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "Agent roster requires auditable handoff evidence."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/agent-roster.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/council-session.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/audit-report.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/audit-report-v2.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/model-routing.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/project-context.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/correction-rules.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/session-event.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/studio-session.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/onboarding-state.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/agentic-level.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/orchestrator.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/runtime-run.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/schemas/runtime-event.schema.json is present and parseable."
-    },
-    {
-      "level": "pass",
-      "area": "orchestrator",
-      "message": ".agent-kit/orchestrator.json is valid and disabled by default."
-    },
-    {
-      "level": "warn",
-      "area": "studio",
-      "message": ".agent-kit/project-context.json is valid but still missing high-value project context.",
-      "remediation": "Answer product summary, audience, workflows, auth/tenant model, UI direction, value proposition, and quality target with agent-kit setup or by editing .agent-kit/project-context.json."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "AGENTS.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "AGENT_ROSTER.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "ASSISTANT_ADAPTERS.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "COUNCIL.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "SKILLS.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "SPEC.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "DECISIONS.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "DOCS.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "DESIGN.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "MESSAGING.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "MODEL_ROUTING.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "QUALITY_GATES.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "STYLE_GUIDE.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "SECURITY.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "TESTING.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "LOOP_CODING.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "DEPLOYMENT.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "docs",
-      "message": "UPGRADE.md exists."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "COUNCIL.md defines council-session handoff evidence."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": ".agent-kit/assistant-adapters is installed."
-    },
-    {
-      "level": "pass",
-      "area": "agents",
-      "message": "ASSISTANT_ADAPTERS.md maps the council roster to tool-specific instruction surfaces."
-    },
-    {
-      "level": "warn",
-      "area": "agents",
-      "message": "Cursor is marked Active but .cursor/agents/planner.md is missing.",
-      "remediation": "Run agent-kit init --activate cursor to generate council subagents from the roster."
-    },
-    {
-      "level": "warn",
-      "area": "models",
-      "message": "ASSISTANT_ADAPTERS.md still has unverified tool-surface rows.",
-      "remediation": "Replace TBD adapter rows with date, owner, evidence, model-selection status, and known limitations for each active IDE."
-    },
-    {
-      "level": "pass",
-      "area": "models",
-      "message": "MODEL_ROUTING.md documents agent model profiles and IDE enforcement limits."
-    },
-    {
-      "level": "pass",
-      "area": "models",
-      "message": "Model routing matches the schema-backed runtime contract."
-    },
-    {
-      "level": "pass",
-      "area": "models",
-      "message": "Model routing maps every default council agent to a profile."
-    },
-    {
-      "level": "pass",
-      "area": "messaging",
-      "message": "MESSAGING.md captures question-led positioning and value-proposition inputs."
-    },
-    {
-      "level": "pass",
-      "area": "messaging",
-      "message": "MESSAGING.md connects claims, proof, objections, and CTA hierarchy."
-    },
-    {
-      "level": "pass",
-      "area": "quality",
-      "message": "QUALITY_GATES.md defines a multi-area best-practice maturity model."
-    },
-    {
-      "level": "pass",
-      "area": "upgrade",
-      "message": "UPGRADE.md defines a reviewable upgrade, migration, audit, and rollback lifecycle."
-    },
-    {
-      "level": "warn",
-      "area": "evidence",
-      "message": "Project evidence docs still contain starter placeholders: COUNCIL.md, SPEC.md, DESIGN.md, MESSAGING.md, SECURITY.md, DEPLOYMENT.md, ASSISTANT_ADAPTERS.md, UPGRADE.md.",
-      "remediation": "Replace TBD/example rows with real project evidence, or document why an item is not applicable before claiming strong or best-practice maturity."
-    },
-    {
-      "level": "warn",
-      "area": "project-reality",
-      "message": "No package.json found to verify test scripts.",
-      "remediation": "Add package.json with executable test, lint, and build scripts appropriate to the stack."
-    },
-    {
-      "level": "pass",
-      "area": "project-reality",
-      "message": "No obvious secret patterns detected in workspace files."
-    },
-    {
-      "level": "pass",
-      "area": "project-reality",
-      "message": ".agent-kit/project-context.json exists."
-    }
-  ]
-}

package/model-routing/default-model-routing.json

@@ -1,171 +0,0 @@
-{
-  "schemaVersion": 1,
-  "id": "next-supabase-default-model-routing",
-  "stack": "next-supabase",
-  "reviewedAt": "2026-06-03",
-  "reviewCadence": "Review quarterly or whenever the active IDE/model provider changes model availability.",
-  "principle": "Select model depth by agent responsibility. Keep role behavior in the roster and skills; keep tool-specific model names in dated adapter setup notes.",
-  "profiles": [
-    {
-      "id": "fast-targeted",
-      "label": "Fast Targeted",
-      "intent": "Use for narrow edits, doc cleanup, simple command interpretation, and low-risk repeated checks.",
-      "reasoningEffort": "low",
-      "contextWindow": "medium",
-      "latency": "low",
-      "cost": "low",
-      "preferredFor": ["docs-maintainer", "deployment-observability-engineer"]
-    },
-    {
-      "id": "balanced-reasoning",
-      "label": "Balanced Reasoning",
-      "intent": "Use for planning, normal implementation, review synthesis, and tasks where speed and judgment both matter.",
-      "reasoningEffort": "medium",
-      "contextWindow": "large",
-      "latency": "medium",
-      "cost": "medium",
-      "preferredFor": ["planner", "nextjs-engineer", "qa-engineer"]
-    },
-    {
-      "id": "coding-large-context",
-      "label": "Coding Large Context",
-      "intent": "Use for multi-file Next.js implementation, Server Component boundaries, form flows, and repo-wide code changes.",
-      "reasoningEffort": "medium",
-      "contextWindow": "large",
-      "latency": "medium",
-      "cost": "medium",
-      "preferredFor": ["nextjs-engineer"]
-    },
-    {
-      "id": "deep-reasoning-large-context",
-      "label": "Deep Reasoning Large Context",
-      "intent": "Use for architecture, cross-layer changes, migrations, security-sensitive work, and ambiguous decisions with high blast radius.",
-      "reasoningEffort": "high",
-      "contextWindow": "very-large",
-      "latency": "high",
-      "cost": "high",
-      "preferredFor": ["lead-architect", "security-reviewer", "supabase-postgres-engineer"]
-    },
-    {
-      "id": "creative-vision-large-context",
-      "label": "Creative Vision Large Context",
-      "intent": "Use for frontend creative direction, screenshot critique, content-first design, distinctiveness benchmarking, and product-quality review.",
-      "reasoningEffort": "high",
-      "contextWindow": "large",
-      "latency": "medium",
-      "cost": "medium",
-      "preferredFor": ["frontend-design-lead", "marketing-copy-lead"]
-    }
-  ],
-  "agentRoutes": [
-    {
-      "agentId": "planner",
-      "profileId": "balanced-reasoning",
-      "defaultEffort": "medium",
-      "escalationProfileId": "deep-reasoning-large-context",
-      "notes": "Escalate when the plan changes architecture, auth, data model, release workflow, or public package behavior."
-    },
-    {
-      "agentId": "lead-architect",
-      "profileId": "deep-reasoning-large-context",
-      "defaultEffort": "high",
-      "notes": "Use for core-change council review and cross-layer decisions."
-    },
-    {
-      "agentId": "supabase-postgres-engineer",
-      "profileId": "deep-reasoning-large-context",
-      "defaultEffort": "high",
-      "notes": "Use high reasoning for schema, RLS, migration ordering, rollback, and authorization boundaries."
-    },
-    {
-      "agentId": "nextjs-engineer",
-      "profileId": "coding-large-context",
-      "defaultEffort": "medium",
-      "escalationProfileId": "deep-reasoning-large-context",
-      "notes": "Escalate when server/client boundaries, caching, auth, or data mutation behavior is uncertain."
-    },
-    {
-      "agentId": "frontend-design-lead",
-      "profileId": "creative-vision-large-context",
-      "defaultEffort": "high",
-      "notes": "Use with screenshots, reference sets, content inventory, and product-specific design evidence."
-    },
-    {
-      "agentId": "marketing-copy-lead",
-      "profileId": "creative-vision-large-context",
-      "defaultEffort": "high",
-      "escalationProfileId": "deep-reasoning-large-context",
-      "notes": "Use for positioning, value proposition, conversion copy, voice/tone, proof review, and public-facing copy handoff."
-    },
-    {
-      "agentId": "security-reviewer",
-      "profileId": "deep-reasoning-large-context",
-      "defaultEffort": "high",
-      "notes": "Use high reasoning for OWASP, IDOR, SSRF, injection, broken auth, dependency, secret, and release-risk review."
-    },
-    {
-      "agentId": "qa-engineer",
-      "profileId": "balanced-reasoning",
-      "defaultEffort": "medium",
-      "escalationProfileId": "deep-reasoning-large-context",
-      "notes": "Escalate for flaky tests, concurrency, auth flows, visual regression, or hard-to-reproduce bugs."
-    },
-    {
-      "agentId": "docs-maintainer",
-      "profileId": "fast-targeted",
-      "defaultEffort": "low",
-      "escalationProfileId": "balanced-reasoning",
-      "notes": "Use balanced reasoning when docs encode decisions, migration order, or security-sensitive setup."
-    },
-    {
-      "agentId": "deployment-observability-engineer",
-      "profileId": "fast-targeted",
-      "defaultEffort": "low",
-      "escalationProfileId": "balanced-reasoning",
-      "notes": "Escalate for release gates, rollback paths, env var review, logs, or production incidents."
-    }
-  ],
-  "toolSurfaces": [
-    {
-      "tool": "Codex",
-      "instructionSurface": "AGENTS.md, .codex/config.toml, and optional .codex/agents/*.toml custom agents",
-      "modelSelection": "Default model in config.toml, temporary /model or --model selection, and optional custom-agent model/model_reasoning_effort fields",
-      "enforcement": "partial",
-      "adapter": ".agent-kit/assistant-adapters/model-selection/codex-config.example.toml"
-    },
-    {
-      "tool": "Claude Code",
-      "instructionSurface": "CLAUDE.md and .claude/agents/*.md project subagents",
-      "modelSelection": "Subagent frontmatter can document or select model where supported by the installed Claude Code version",
-      "enforcement": "partial",
-      "adapter": ".agent-kit/assistant-adapters/model-selection/claude-code-subagents-with-models.md"
-    },
-    {
-      "tool": "Cursor",
-      "instructionSurface": ".cursor/rules/*.mdc",
-      "modelSelection": "Use Cursor model picker or team setting; project rules advise which profile to pick but do not force the picker",
-      "enforcement": "advisory",
-      "adapter": ".agent-kit/assistant-adapters/model-selection/cursor-model-selection.mdc"
-    },
-    {
-      "tool": "GitHub Copilot",
-      "instructionSurface": ".github/copilot-instructions.md and .github/instructions/*.instructions.md",
-      "modelSelection": "Use Copilot chat or coding-agent model selection where available; repo instructions advise but do not force model selection",
-      "enforcement": "advisory",
-      "adapter": ".agent-kit/assistant-adapters/model-selection/github-copilot-model-selection.md"
-    },
-    {
-      "tool": "Antigravity",
-      "instructionSurface": ".antigravity/agent-kit/plugin.json, .antigravity/agent-kit/commands/*.toml, and .antigravity/runtime-skills/*/SKILL.md",
-      "modelSelection": "Use Antigravity runtime or workspace model controls where available; native commands advise Agent Kit model profiles but do not force provider selection",
-      "enforcement": "advisory",
-      "adapter": ".agent-kit/assistant-adapters/antigravity.md"
-    }
-  ],
-  "updatePolicy": [
-    "Treat model names as dated recommendations, not permanent product truth.",
-    "Do not store API keys, tokens, billing data, or private model entitlement notes in model-routing files.",
-    "When model availability changes, update adapter examples, MODEL_ROUTING.md, DECISIONS.md, and audit tests in the same change.",
-    "If an IDE cannot enforce per-agent model choice, record that limitation in ASSISTANT_ADAPTERS.md instead of pretending the package can force it."
-  ]
-}

package/profiles/admin-app.md

@@ -1,17 +0,0 @@
-# Admin App Compatibility Profile
-
-Use for internal operations consoles, support tools, moderation systems, and analytics back offices.
-
-## Required Emphasis
-
-- Least-privilege admin access, audit logs, impersonation controls, and destructive-action review.
-- RLS and server-side authorization for admin-only data and actions.
-- Clear stale-data, partial-data, rate-limit, and permission-denied states.
-- Smoke tests for admin login, core queue processing, audit logging, and access control.
-
-## Agent Handoff
-
-- Architect owns admin boundaries and workflow invariants.
-- Supabase/Postgres engineer owns policy bypass strategy, audit tables, and queue schema.
-- Security reviewer owns privilege escalation, logging integrity, service-role use, and secrets.
-- Frontend design lead owns dense scanning, filters, bulk actions, and safe destructive flows.

package/profiles/content-app.md

@@ -1,17 +0,0 @@
-# Content App Compatibility Profile
-
-Use for publishing systems, editorial workflows, knowledge bases, newsletters, and media apps.
-
-## Required Emphasis
-
-- Content lifecycle, author/editor roles, source attribution, publishing permissions, and moderation.
-- RLS policies for drafts, private notes, scheduled content, and editorial-only metadata.
-- Empty, unavailable-source, failed-import, scheduled, published, and archived states.
-- Smoke tests for content creation, review, publish, rollback, and reader access.
-
-## Agent Handoff
-
-- Architect owns content model, lifecycle, and public/private boundaries.
-- Supabase/Postgres engineer owns versioning, indexing, search, and RLS policies.
-- Security reviewer owns stored content safety, upload handling, SSRF, and admin boundaries.
-- Frontend design lead owns reading rhythm, editorial status, attribution, and mobile presentation.

package/profiles/marketplace.md

@@ -1,17 +0,0 @@
-# Marketplace Compatibility Profile
-
-Use for buyer/seller products, listings, bookings, services, and transaction workflows.
-
-## Required Emphasis
-
-- Role separation for buyer, seller, admin, and support staff.
-- Listing ownership, transaction authorization, disputes, fraud controls, and moderation.
-- RLS policies for private messages, offers, orders, payments, and seller-only data.
-- Smoke tests for search, listing creation, inquiry/order flow, and role-specific access.
-
-## Agent Handoff
-
-- Architect owns role model and transaction lifecycle.
-- Supabase/Postgres engineer owns listing, order, message, and policy design.
-- Security reviewer owns IDOR, file upload, payment/webhook validation, and abuse paths.
-- Frontend design lead owns comparison UX, trust signals, availability states, and mobile search.

package/profiles/saas.md

@@ -1,17 +0,0 @@
-# SaaS Compatibility Profile
-
-Use for subscription products, team workspaces, and account-based apps.
-
-## Required Emphasis
-
-- Tenant isolation, role-based access, team membership, billing state, and usage limits.
-- RLS policies for tenant-owned data and user-owned preferences.
-- Trial, upgrade, downgrade, cancellation, and past-due UX.
-- Smoke tests for signup, login, workspace creation, billing gates, and primary workflow.
-
-## Agent Handoff
-
-- Architect owns tenant boundaries and subscription model.
-- Supabase/Postgres engineer owns membership schema, RLS, migrations, and seed data.
-- Security reviewer owns IDOR, service-role isolation, webhook validation, and dependency exposure.
-- Frontend design lead owns density, state coverage, and non-generic product surfaces.

package/profiles/stack-next-firebase.md

@@ -1,25 +0,0 @@
-# Stack Profile: Next.js And Firebase
-
-Use this profile when adapting the kit to projects using Next.js with Firebase Auth, Firestore, Realtime Database, Storage, Cloud Functions, or Firebase Hosting.
-
-## Replace Supabase-Specific Checks
-
-- Replace Supabase RLS policy review with Firestore/Realtime Database security rules review.
-- Replace service-role guidance with Firebase Admin SDK server-only guidance.
-- Replace Postgres migration checks with Firebase rules, indexes, emulator fixtures, and data-shape validation.
-- Keep OWASP, SSR, secrets, accessibility, testing, deployment, and living-docs requirements.
-
-## Required Evidence
-
-- Firebase security rules are versioned and tested.
-- Client SDK usage cannot access admin-only data.
-- Admin SDK credentials are server-only and never bundled.
-- Emulator or integration tests cover auth, rules, and primary data writes.
-- Storage rules cover uploads, reads, ownership, content type, and size.
-
-## Agent Handoff
-
-- Architect owns auth model, tenancy, and data boundaries.
-- Firebase engineer owns rules, indexes, emulator tests, functions, and storage.
-- Security reviewer owns privilege escalation, IDOR, file uploads, secrets, and dependency exposure.
-- Frontend design lead owns task-first UX, states, accessibility, and screenshot review.