@appsforgood/next-supabase-kit 0.3.0 → 0.4.1

package/research/summaries/testing-patterns.md

@@ -1,63 +0,0 @@
-# Testing Patterns
-
-Generated from 55 relevant repository findings.
-
-## Focus Areas
-- testing
-
-## Aggregate Evidence
-- Average normalized focus score: 0.44
-- Repositories considered: 55
-
-## Strongest Repositories For This Topic
-- triggerdotdev/trigger.dev (production-saas) - focus score 5, total 32/45
-- vercel/next.js (official-nextjs) - focus score 5, total 30/45
-- vercel/ai (official-nextjs) - focus score 5, total 29/45
-- thedaviddias/souls-directory (testing-docs-agents) - focus score 5, total 29/45
-- dubinc/dub (production-saas) - focus score 5, total 27/45
-- documenso/documenso (production-saas) - focus score 5, total 27/45
-- vercel/examples (official-nextjs) - focus score 5, total 26/45
-- microsoft/skills (testing-docs-agents) - focus score 5, total 26/45
-- boxyhq/saas-starter-kit (production-saas) - focus score 5, total 25/45
-- zero-one-group/monorepo (testing-docs-agents) - focus score 5, total 22/45
-- ixartz/Next-js-Boilerplate (testing-docs-agents) - focus score 5, total 21/45
-- ixartz/SaaS-Boilerplate (production-saas) - focus score 5, total 19/45
-
-## Repeated Strengths
-- Frontend implementation shows reusable components, states, and design-system signals. (22)
-- Test setup includes meaningful automated and browser-level coverage. (18)
-- Documentation is strong enough for external contributors or agents to onboard. (15)
-- Security posture is explicit through docs, validation, CI, or review tooling. (14)
-
-## Repeated Gaps
-- Supabase RLS/Auth practices are not clearly discoverable. (55)
-- Agent handoff and AI-workflow instructions are not mature. (38)
-- Accessibility signals are weak or absent. (37)
-- Security expectations are implicit or incomplete. (31)
-
-## Source Findings
-- research/findings/boxyhq__saas-starter-kit.md
-- research/findings/connectrpc__examples-es.md
-- research/findings/documenso__documenso.md
-- research/findings/dubinc__dub.md
-- research/findings/ixartz__Next-js-Boilerplate.md
-- research/findings/ixartz__SaaS-Boilerplate.md
-- research/findings/microsoft__skills.md
-- research/findings/thedaviddias__souls-directory.md
-- research/findings/triggerdotdev__trigger.dev.md
-- research/findings/vercel__ai.md
-- research/findings/vercel__examples.md
-- research/findings/vercel__next.js.md
-- research/findings/vercel__swr.md
-- research/findings/zero-one-group__monorepo.md
-- research/findings/formbricks__formbricks.md
-- research/findings/kaje94__menufic.md
-- research/findings/vercel__chatbot.md
-- research/findings/wasp-lang__open-saas.md
-- research/findings/Piebald-AI__tweakcc.md
-- research/findings/antiwork__shortest.md
-- research/findings/brocoders__extensive-react-boilerplate.md
-- research/findings/keyshade-xyz__keyshade.md
-- research/findings/vercel__next-devtools-mcp.md
-- research/findings/zenstackhq__zenstack.md
-- research/findings/LubomirGeorgiev__cloudflare-workers-nextjs-saas-template.md

package/research/summaries/upgrade-lifecycle-patterns.md

@@ -1,26 +0,0 @@
-# Upgrade Lifecycle Patterns
-
-Generated from a focused follow-up pass on upgrade and migration practices in high-signal framework and tooling projects.
-
-## Why This Pass Was Needed
-
-The kit is intended to be reused like an installable package. Initial install, audit, and release gates are not enough unless existing projects can safely adopt future template, agent, schema, and workflow updates.
-
-## Generalized Practices
-
-- Keep a visible upgrade guide with preflight, diff, update, verification, and rollback steps.
-- Separate initial installation from upgrade review.
-- Provide dry-run or diff flows before changing project-owned files.
-- Treat framework upgrades, codemods, schema migrations, and generated types as explicit review items.
-- Require rollback notes and owner/date evidence before claiming an upgrade is complete.
-- Keep local overrides documented so a package update does not silently erase project-specific decisions.
-
-## Promoted Updates
-
-- Added root `UPGRADE.md` for package maintainers.
-- Added installed `templates/next-supabase/UPGRADE.md` for downstream projects.
-- Added `skills/upgrade-maintenance.md`, `checklists/upgrade.md`, and `prompts/upgrade-review.md`.
-- Added audit coverage for upgrade lifecycle evidence.
-- Added tests so upgrade guidance cannot be removed from public package readiness.
-
-Do not copy source, policy wording, or brand systems from reviewed repositories or documentation. Adopt only generalized practices with clear rationale.

package/research/summaries/visual-qa-patterns.md

@@ -1,39 +0,0 @@
-# Visual QA And Regression Patterns
-
-Generated from a focused follow-up review of visual testing and component-state practices after the content-first design hardening pass.
-
-## Why This Pass Was Needed
-
-The kit required desktop/mobile screenshots and screenshot review, but a best-practice repo also needs a repeatable strategy for visual state coverage, baseline approval, and visual regression when UI risk is high.
-
-## Focused Sources Reviewed
-
-- `storybookjs/storybook`: stories act as reusable UI state cases for render, interaction, accessibility, and visual tests.
-- `storybookjs/test-runner`: turns stories into executable tests and supports CI execution against built Storybooks.
-- `storybookjs/design-system`: uses Storybook for component docs and visual QA infrastructure for a shared design system.
-- `chromaui/chromatic-cli` and Chromatic docs: visual testing for Storybook, responsive viewports, PR checks, and baseline review.
-- `argos-ci/argos`: open-source visual testing platform with Playwright, Cypress, and Storybook integrations.
-- `oblador/loki`: open-source visual regression testing for Storybook.
-- Playwright visual comparison docs: `toHaveScreenshot()` and committed baselines, with cautions about deterministic environments.
-
-## Repeated Patterns To Adopt
-
-- Treat stories or screenshot cases as visual state specifications.
-- Capture both reusable component states and critical workflow screens.
-- Cover at least one mobile/narrow viewport and one desktop viewport.
-- Stabilize dynamic content before comparing pixels.
-- Review baseline updates as intentional product changes.
-- Keep semantic, accessibility, keyboard, auth, and data tests separate from visual comparisons.
-- Choose the smallest reliable visual QA tier instead of forcing heavy tooling onto every project.
-
-## Promoted Updates
-
-- Add Visual Regression QA skill.
-- Add visual-regression checklist.
-- Add visual QA planning prompt.
-- Update `TESTING.md` with baseline, strong, and mature visual QA tiers.
-- Require visual QA evidence in frontend workflow outputs.
-- Add audit warnings when testing docs omit visual QA or visual-regression evidence.
-- Update research scanner terms to look for Storybook, `toHaveScreenshot`, Chromatic, Argos, Loki, and visual-regression signals.
-
-Do not adopt a third-party SaaS as a required default. The kit should stay provider-neutral and support manual screenshots, Playwright, Storybook, Chromatic, Argos, Loki, or equivalent evidence depending on project risk.

package/rosters/next-supabase-default-council.json

@@ -1,267 +0,0 @@
-{
-  "schemaVersion": 1,
-  "id": "next-supabase-default-council",
-  "stack": "next-supabase",
-  "required": true,
-  "defaultWorkflow": "planning",
-  "principle": "Planner routes work by default; Lead Architect convenes council for core changes before implementation.",
-  "agents": [
-    {
-      "id": "planner",
-      "name": "Planner",
-      "file": ".agent-kit/agents/planner.md",
-      "defaultFor": ["planning", "roadmap", "scope", "ambiguous-request", "handoff"],
-      "skills": ["planning-council", "best-practice-maturity-review", "agent-handoff-tracing", "docs-maintainer", "upgrade-maintenance"],
-      "handsOffTo": ["lead-architect", "frontend-design-lead", "qa-engineer", "docs-maintainer"]
-    },
-    {
-      "id": "lead-architect",
-      "name": "Lead Architect",
-      "file": ".agent-kit/agents/lead-architect.md",
-      "defaultFor": ["core-change", "architecture", "cross-layer-change", "technical-decision"],
-      "skills": [
-        "planning-council",
-        "best-practice-maturity-review",
-        "agent-handoff-tracing",
-        "nextjs-app-router",
-        "supabase-auth-rls",
-        "postgres-migrations",
-        "owasp-security-review",
-        "upgrade-maintenance"
-      ],
-      "handsOffTo": ["supabase-postgres-engineer", "nextjs-engineer", "security-reviewer", "qa-engineer", "docs-maintainer"]
-    },
-    {
-      "id": "supabase-postgres-engineer",
-      "name": "Supabase/Postgres Engineer",
-      "file": ".agent-kit/agents/supabase-postgres-engineer.md",
-      "defaultFor": ["schema", "migration", "rls", "auth", "storage", "sql"],
-      "skills": ["supabase-auth-rls", "postgres-migrations", "owasp-security-review"],
-      "handsOffTo": ["security-reviewer", "qa-engineer", "docs-maintainer", "deployment-observability-engineer"]
-    },
-    {
-      "id": "nextjs-engineer",
-      "name": "Next.js Engineer",
-      "file": ".agent-kit/agents/nextjs-engineer.md",
-      "defaultFor": ["app-router", "server-components", "route-handler", "server-action", "forms", "ui-state"],
-      "skills": ["nextjs-app-router", "content-first-design", "frontend-design-system", "accessibility-wcag", "testing-qa"],
-      "handsOffTo": ["frontend-design-lead", "security-reviewer", "qa-engineer", "docs-maintainer"]
-    },
-    {
-      "id": "frontend-design-lead",
-      "name": "Frontend Design Lead",
-      "file": ".agent-kit/agents/frontend-design-lead.md",
-      "defaultFor": [
-        "brand-content-intake",
-        "creative-direction",
-        "reference-led-critique",
-        "distinctiveness-benchmark",
-        "product-quality-scorecard",
-        "visual-design",
-        "component-system",
-        "visual-regression",
-        "accessibility",
-        "anti-generic-ui",
-        "screenshot-review"
-      ],
-      "skills": [
-        "content-first-design",
-        "reference-led-design-critique",
-        "frontend-distinctiveness-benchmark",
-        "frontend-product-quality-rubric",
-        "frontend-design-system",
-        "ui-improvement-harness",
-        "visual-regression-qa",
-        "accessibility-wcag"
-      ],
-      "handsOffTo": ["marketing-copy-lead", "nextjs-engineer", "qa-engineer", "docs-maintainer"]
-    },
-    {
-      "id": "marketing-copy-lead",
-      "name": "Marketing Copy Lead",
-      "file": ".agent-kit/agents/marketing-copy-lead.md",
-      "defaultFor": [
-        "copy",
-        "copywriting",
-        "marketing",
-        "positioning",
-        "messaging",
-        "value-proposition",
-        "landing-page-copy",
-        "headline",
-        "cta",
-        "conversion",
-        "onboarding-copy",
-        "empty-state-copy",
-        "voice-tone",
-        "pricing-copy"
-      ],
-      "skills": ["positioning-messaging", "conversion-copywriting", "landing-page-copy", "product-voice-tone", "onboarding-empty-state-copy"],
-      "handsOffTo": ["frontend-design-lead", "nextjs-engineer", "qa-engineer", "docs-maintainer"]
-    },
-    {
-      "id": "security-reviewer",
-      "name": "Security Reviewer",
-      "file": ".agent-kit/agents/security-reviewer.md",
-      "defaultFor": ["security-review", "auth-boundary", "data-mutation", "external-call", "dependency", "secret"],
-      "skills": ["owasp-security-review", "supabase-auth-rls", "postgres-migrations"],
-      "handsOffTo": ["lead-architect", "qa-engineer", "docs-maintainer", "deployment-observability-engineer"]
-    },
-    {
-      "id": "qa-engineer",
-      "name": "QA Engineer",
-      "file": ".agent-kit/agents/qa-engineer.md",
-      "defaultFor": ["testing", "regression", "smoke", "acceptance-evidence", "test", "review", "code-review"],
-      "skills": ["testing-qa", "best-practice-maturity-review", "visual-regression-qa", "accessibility-wcag"],
-      "handsOffTo": ["docs-maintainer", "deployment-observability-engineer"]
-    },
-    {
-      "id": "docs-maintainer",
-      "name": "Documentation Maintainer",
-      "file": ".agent-kit/agents/docs-maintainer.md",
-      "defaultFor": ["docs", "decisions", "spec", "style-guide", "roadmap", "upgrade-evidence"],
-      "skills": ["docs-maintainer", "planning-council", "best-practice-maturity-review", "agent-handoff-tracing", "upgrade-maintenance"],
-      "handsOffTo": ["deployment-observability-engineer"]
-    },
-    {
-      "id": "deployment-observability-engineer",
-      "name": "Deployment/Observability Engineer",
-      "file": ".agent-kit/agents/deployment-observability-engineer.md",
-      "defaultFor": ["release", "deployment", "environment", "logs", "rollback", "monitoring"],
-      "skills": ["deployment-observability", "testing-qa", "upgrade-maintenance"],
-      "handsOffTo": ["qa-engineer", "docs-maintainer"]
-    }
-  ],
-  "workflows": [
-    {
-      "id": "planning",
-      "triggers": ["plan", "roadmap", "phase", "scope", "spec", "specification", "acceptance criteria", "what should we do", "break this down"],
-      "sequence": ["planner", "lead-architect", "qa-engineer", "docs-maintainer"],
-      "council": ["planner", "lead-architect"],
-      "requiredOutputs": ["phased checklist", "maturity target", "affected layers", "preserved capabilities", "verification plan", "docs impact"]
-    },
-    {
-      "id": "core-change",
-      "triggers": [
-        "schema",
-        "auth",
-        "rls",
-        "api",
-        "route handler",
-        "server action",
-        "dependency",
-        "upgrade",
-        "release workflow",
-        "package behavior",
-        "cross-layer"
-      ],
-      "sequence": [
-        "planner",
-        "lead-architect",
-        "supabase-postgres-engineer",
-        "nextjs-engineer",
-        "security-reviewer",
-        "qa-engineer",
-        "docs-maintainer",
-        "deployment-observability-engineer"
-      ],
-      "council": ["lead-architect", "security-reviewer", "qa-engineer", "docs-maintainer"],
-      "requiredOutputs": [
-        "architecture decision",
-        "maturity evidence",
-        "security review",
-        "test evidence",
-        "doc updates",
-        "upgrade evidence when applicable",
-        "release or rollback notes"
-      ]
-    },
-    {
-      "id": "frontend-change",
-      "triggers": ["screen", "component", "layout", "design", "responsive", "accessibility", "screenshot", "ui audit", "ui polish", "browser qa"],
-      "sequence": ["planner", "frontend-design-lead", "marketing-copy-lead", "nextjs-engineer", "qa-engineer", "docs-maintainer"],
-      "council": ["frontend-design-lead", "marketing-copy-lead", "qa-engineer"],
-      "requiredOutputs": [
-        "brand/content intake",
-        "copy/value-proposition brief when public-facing or conversion-facing",
-        "creative-direction rationale",
-        "reference-set evidence",
-        "distinctiveness benchmark",
-        "design critique verdict",
-        "frontend product-quality scorecard",
-        "domain-specific UI rationale",
-        "UI detector findings and severity",
-        "UI command workflow applied when polishing or auditing",
-        "visual QA evidence",
-        "state coverage",
-        "accessibility checks",
-        "desktop/mobile verification",
-        "authenticated screen evidence when applicable"
-      ]
-    },
-    {
-      "id": "marketing-copy",
-      "triggers": [
-        "copy",
-        "copywriting",
-        "marketing",
-        "positioning",
-        "messaging",
-        "value prop",
-        "value proposition",
-        "landing page",
-        "headline",
-        "cta",
-        "conversion",
-        "onboarding",
-        "empty state",
-        "pricing"
-      ],
-      "sequence": ["planner", "marketing-copy-lead", "frontend-design-lead", "qa-engineer", "docs-maintainer"],
-      "council": ["marketing-copy-lead", "frontend-design-lead"],
-      "requiredOutputs": [
-        "discovery questions answered or explicitly marked unknown",
-        "audience and segment assumptions",
-        "problem, pain, desired outcome, and value proposition",
-        "differentiators, proof points, objections, and counter-messaging",
-        "voice/tone guidance",
-        "page or flow copy inventory",
-        "CTA and conversion hypothesis",
-        "handoff notes for design and implementation"
-      ]
-    },
-    {
-      "id": "testing",
-      "triggers": ["test", "tests", "unit test", "regression test", "smoke test", "playwright", "acceptance test"],
-      "sequence": ["qa-engineer", "docs-maintainer"],
-      "council": ["qa-engineer"],
-      "requiredOutputs": ["test plan", "commands run", "pass/fail summary", "coverage gaps", "skipped-test rationale"]
-    },
-    {
-      "id": "code-review",
-      "triggers": ["review", "code review", "pre-merge", "pr review", "merge review"],
-      "sequence": ["qa-engineer", "security-reviewer", "docs-maintainer"],
-      "council": ["qa-engineer", "security-reviewer"],
-      "requiredOutputs": ["reviewed scope", "findings by severity", "required fixes", "security notes when applicable", "merge recommendation"]
-    },
-    {
-      "id": "security-review",
-      "triggers": ["security", "owasp", "secret", "token", "permission", "ssrf", "idor", "dependency"],
-      "sequence": ["planner", "security-reviewer", "lead-architect", "qa-engineer", "docs-maintainer"],
-      "council": ["security-reviewer", "lead-architect"],
-      "requiredOutputs": ["finding severity", "attack path", "mitigation", "verification evidence"]
-    }
-  ],
-  "handoffRules": [
-    "Each agent must state its decision, risk, and required next handoff before passing work on.",
-    "Planner must classify meaningful work against QUALITY_GATES.md as baseline, strong, or best-practice before completion is claimed.",
-    "Meaningful multi-agent work must record council-session evidence in COUNCIL.md or a structured record that follows .agent-kit/schemas/council-session.schema.json.",
-    "Planner starts planning and ambiguous requests by default.",
-    "Lead Architect must review core changes before implementation.",
-    "Frontend Design Lead must record reference-set evidence, anti-references, a design critique verdict, a distinctiveness benchmark, a frontend product-quality scorecard, UI detector severity findings, and desktop/mobile screenshot evidence before accepting significant frontend work.",
-    "Marketing Copy Lead must ask discovery questions and record audience, pain, outcome, value proposition, proof, objections, voice/tone, and conversion goal before accepting public-facing or conversion-facing copy.",
-    "Security Reviewer must review auth, data mutation, external-call, dependency, secret, and release-risk changes.",
-    "QA Engineer must verify behavior changes before completion.",
-    "Documentation Maintainer must update living markdown when behavior, architecture, release, or standards change."
-  ]
-}

package/runtime-skills/README.md

@@ -1,7 +0,0 @@
-# Runtime Skills
-
-These portable `SKILL.md` wrappers are for runtimes that discover skills by directory.
-
-Canonical skill content remains in `skills/*.md` and installed project copies under `.agent-kit/skills/*.md`. Runtime wrappers must point back to the canonical skill file instead of forking the workflow.
-
-When a canonical skill changes, update the matching wrapper description only if the trigger behavior changes.

package/runtime-skills/accessibility-wcag/SKILL.md

@@ -1,8 +0,0 @@
----
-name: accessibility-wcag
-description: Use for WCAG 2.1 AA review of forms, navigation, modals, menus, tables, dashboards, and custom interactions.
----
-
-Canonical workflow: read `skills/accessibility-wcag.md` or `.agent-kit/skills/accessibility-wcag.md`.
-
-Apply semantic HTML first, ARIA only when needed, keyboard navigation, focus states, and WCAG 2.1 AA color contrast. Record accessibility evidence with `agent-kit session output` when the work changes user-facing UI.

package/runtime-skills/agent-handoff-tracing/SKILL.md

@@ -1,8 +0,0 @@
----
-name: agent-handoff-tracing
-description: Use for meaningful multi-agent work where decisions, risks, handoffs, outputs, and verification must survive the chat.
----
-
-Canonical workflow: read `skills/agent-handoff-tracing.md` or `.agent-kit/skills/agent-handoff-tracing.md`.
-
-Select the roster workflow, read project context and corrections, record decisions/handoffs/required outputs with `agent-kit session ...`, then run `agent-kit session render`.

package/runtime-skills/best-practice-maturity-review/SKILL.md

@@ -1,8 +0,0 @@
----
-name: best-practice-maturity-review
-description: Use for setup audits, release readiness, dogfood reviews, roadmap checkpoints, and best-practice maturity claims.
----
-
-Canonical workflow: read `skills/best-practice-maturity-review.md` or `.agent-kit/skills/best-practice-maturity-review.md`.
-
-Use `QUALITY_GATES.md` to name the target level and require evidence for each affected area. Treat missing evidence as incomplete, not as a passing caveat.

package/runtime-skills/content-first-design/SKILL.md

@@ -1,8 +0,0 @@
----
-name: content-first-design
-description: Use before designing or changing user-facing product screens, dashboards, tools, marketplaces, content experiences, or AI workflow UIs.
----
-
-Canonical workflow: read `skills/content-first-design.md` or `.agent-kit/skills/content-first-design.md`.
-
-Capture audience, user needs, product category, content inventory, brand constraints, creative options, and non-goals before implementation starts.

package/runtime-skills/conversion-copywriting/SKILL.md

@@ -1,8 +0,0 @@
----
-name: conversion-copywriting
-description: Use for public-facing or conversion-facing headlines, CTAs, onboarding, pricing, landing pages, and UX copy.
----
-
-Canonical workflow: read `skills/conversion-copywriting.md` or `.agent-kit/skills/conversion-copywriting.md`.
-
-Use `MESSAGING.md` for audience, pain, desired outcome, proof, objections, voice, and conversion goal. Mark unsupported claims as assumptions.

package/runtime-skills/deployment-observability/SKILL.md

@@ -1,8 +0,0 @@
----
-name: deployment-observability
-description: Use for release readiness, environment variables, migration order, logs, monitoring, rollback, and post-release verification.
----
-
-Canonical workflow: read `skills/deployment-observability.md` or `.agent-kit/skills/deployment-observability.md`.
-
-Confirm deployment prerequisites, observable failures, release order, verification commands, and rollback guidance before shipping.

package/runtime-skills/docs-maintainer/SKILL.md

@@ -1,8 +0,0 @@
----
-name: docs-maintainer
-description: Use after significant architecture, behavior, release, security, adapter, or workflow changes that affect living docs.
----
-
-Canonical workflow: read `skills/docs-maintainer.md` or `.agent-kit/skills/docs-maintainer.md`.
-
-Update `SPEC.md`, `DECISIONS.md`, `DOCS.md`, `QUALITY_GATES.md`, `TESTING.md`, `UPGRADE.md`, and related docs so another engineer or agent can continue safely.

package/runtime-skills/frontend-design-system/SKILL.md

@@ -1,8 +0,0 @@
----
-name: frontend-design-system
-description: Use for user-facing screens and components that need design tokens, component states, responsiveness, accessibility, and anti-generic UI review.
----
-
-Canonical workflow: read `skills/frontend-design-system.md` or `.agent-kit/skills/frontend-design-system.md`.
-
-Require real content, task-first hierarchy, component states, accessibility, mobile behavior, and visual QA evidence before accepting significant frontend work.

package/runtime-skills/frontend-distinctiveness-benchmark/SKILL.md

@@ -1,8 +0,0 @@
----
-name: frontend-distinctiveness-benchmark
-description: Use when significant frontend work risks looking interchangeable with a generic AI-generated product.
----
-
-Canonical workflow: read `skills/frontend-distinctiveness-benchmark.md` or `.agent-kit/skills/frontend-distinctiveness-benchmark.md`.
-
-Prove first-screen specificity, product nouns, data shapes, real actions, source-safe references, asset provenance, important states, and desktop/mobile evidence.

package/runtime-skills/frontend-product-quality-rubric/SKILL.md

@@ -1,8 +0,0 @@
----
-name: frontend-product-quality-rubric
-description: Use to score significant frontend work for user fit, content specificity, visual identity, IA, states, accessibility, and source safety.
----
-
-Canonical workflow: read `skills/frontend-product-quality-rubric.md` or `.agent-kit/skills/frontend-product-quality-rubric.md`.
-
-Reject critical zeroes, require at least `10/14` for acceptance, and require higher evidence for best-practice frontend claims.

package/runtime-skills/landing-page-copy/SKILL.md

@@ -1,8 +0,0 @@
----
-name: landing-page-copy
-description: Use for landing-page headlines, subheads, proof, objections, CTAs, and conversion copy.
----
-
-Canonical workflow: read `skills/landing-page-copy.md` or `.agent-kit/skills/landing-page-copy.md`.
-
-Tie copy to audience, problem, outcome, differentiator, proof, objections, and one clear primary CTA. Avoid generic SaaS claims.

package/runtime-skills/nextjs-app-router/SKILL.md

@@ -1,8 +0,0 @@
----
-name: nextjs-app-router
-description: Use for Next.js App Router, Server Components, Client Components, Route Handlers, Server Actions, caching, forms, and metadata.
----
-
-Canonical workflow: read `skills/nextjs-app-router.md` or `.agent-kit/skills/nextjs-app-router.md`.
-
-Keep server/client boundaries explicit, preserve auth context, protect secrets from client bundles, and handle loading, error, empty, and success states.

package/runtime-skills/onboarding-empty-state-copy/SKILL.md

@@ -1,8 +0,0 @@
----
-name: onboarding-empty-state-copy
-description: Use for onboarding copy, first-run states, empty states, setup prompts, and guided user flows.
----
-
-Canonical workflow: read `skills/onboarding-empty-state-copy.md` or `.agent-kit/skills/onboarding-empty-state-copy.md`.
-
-Use product-specific nouns and actions, reduce cognitive load, avoid unsupported claims, and align copy with `MESSAGING.md`.

package/runtime-skills/owasp-security-review/SKILL.md

@@ -1,8 +0,0 @@
----
-name: owasp-security-review
-description: Use for auth, API routes, Server Actions, external fetches, file uploads, webhooks, dependencies, and data mutations.
----
-
-Canonical workflow: read `skills/owasp-security-review.md` or `.agent-kit/skills/owasp-security-review.md`.
-
-Review broken access control, IDOR, injection, SSRF, misconfiguration, vulnerable dependencies, secret handling, validation, encoding, and safe errors.

package/runtime-skills/planning-council/SKILL.md

@@ -1,8 +0,0 @@
----
-name: planning-council
-description: Use for planning, roadmaps, ambiguous feature requests, core architecture changes, auth/data work, release work, and multi-agent routing.
----
-
-Canonical workflow: read `skills/planning-council.md` or `.agent-kit/skills/planning-council.md`.
-
-Classify the request, select the roster workflow, name the maturity target, map affected layers, preserve contracts, assign handoffs, and record evidence.

package/runtime-skills/positioning-messaging/SKILL.md

@@ -1,8 +0,0 @@
----
-name: positioning-messaging
-description: Use for audience, pain, outcome, alternatives, differentiator, proof, objections, voice, and conversion strategy.
----
-
-Canonical workflow: read `skills/positioning-messaging.md` or `.agent-kit/skills/positioning-messaging.md`.
-
-Update `MESSAGING.md`, ask only high-impact discovery questions, and connect every public claim to real proof or an explicit assumption.

package/runtime-skills/postgres-migrations/SKILL.md

@@ -1,8 +0,0 @@
----
-name: postgres-migrations
-description: Use for schema changes, constraints, indexes, SQL functions, triggers, seed data, data migrations, and rollback planning.
----
-
-Canonical workflow: read `skills/postgres-migrations.md` or `.agent-kit/skills/postgres-migrations.md`.
-
-Order migrations, protect integrity with constraints, add indexes for access patterns, and document rollback or retry guidance.

package/runtime-skills/product-voice-tone/SKILL.md

@@ -1,8 +0,0 @@
----
-name: product-voice-tone
-description: Use for product voice, tone, microcopy, onboarding language, CTA style, and consistent UX copy.
----
-
-Canonical workflow: read `skills/product-voice-tone.md` or `.agent-kit/skills/product-voice-tone.md`.
-
-Keep voice grounded in product facts, audience needs, proof, objections, and `MESSAGING.md`; avoid generic AI-looking language.

package/runtime-skills/reference-led-design-critique/SKILL.md

@@ -1,8 +0,0 @@
----
-name: reference-led-design-critique
-description: Use before accepting significant frontend work that needs references, anti-references, source safety, and design critique.
----
-
-Canonical workflow: read `skills/reference-led-design-critique.md` or `.agent-kit/skills/reference-led-design-critique.md`.
-
-Use references for lessons without copying protected source design, brand identity, copy, or assets. Record critique verdict and required changes.

package/runtime-skills/supabase-auth-rls/SKILL.md

@@ -1,8 +0,0 @@
----
-name: supabase-auth-rls
-description: Use for Supabase Auth, SSR clients, sessions, middleware, RLS policies, Storage policies, and service-role usage.
----
-
-Canonical workflow: read `skills/supabase-auth-rls.md` or `.agent-kit/skills/supabase-auth-rls.md`.
-
-Enforce authorization in RLS, keep service-role keys server-only, test session refresh and redirects, and prevent IDOR at the SQL boundary.

package/runtime-skills/testing-qa/SKILL.md

@@ -1,8 +0,0 @@
----
-name: testing-qa
-description: Use for unit tests, regression tests, smoke checks, Playwright coverage, visual QA, and acceptance evidence.
----
-
-Canonical workflow: read `skills/testing-qa.md` or `.agent-kit/skills/testing-qa.md`.
-
-Cover core logic, preserved behavior, critical paths, auth/data mutations, network failures, empty/error states, and explicitly document gaps.

package/runtime-skills/ui-improvement-harness/SKILL.md

@@ -1,12 +0,0 @@
----
-name: ui-improvement-harness
-description: Use when running repeatable UI audit, polish, layout cleanup, responsive cleanup, accessibility, screenshot critique, visual distinctiveness, or live browser QA workflows.
----
-
-# UI Improvement Harness Runtime Skill
-
-Canonical workflow: `skills/ui-improvement-harness.md`.
-
-Installed-project canonical workflow: `.agent-kit/skills/ui-improvement-harness.md`.
-
-Use the canonical skill before accepting meaningful UI polish, audit, screenshot review, or browser iteration work. Runtime wrappers must not fork the detector, rubric, or command policy.

package/runtime-skills/upgrade-maintenance/SKILL.md

@@ -1,8 +0,0 @@
----
-name: upgrade-maintenance
-description: Use for Agent Kit, Next.js, Supabase, UI library, testing tool, release workflow, adapter, and dependency upgrades.
----
-
-Canonical workflow: read `skills/upgrade-maintenance.md` or `.agent-kit/skills/upgrade-maintenance.md`.
-
-Run `agent-kit diff`, preserve overrides, review conflicts, check release notes/migrations/codemods, run audit, and record rollback evidence.