@appsforgood/next-supabase-kit 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.4.2
+
+- Uplift default domain skills so they are playbooks, not checklists: `nextjs-app-router` (App Router, async request APIs, `proxy.ts`), `supabase-auth-rls` (SSR clients, `getUser()`, service role, RLS), `postgres-migrations` (RLS in the same change), `owasp-security-review` (Top 10 mapped onto Actions/RLS/SSRF).
+- Planner’s `planning` skill names which of those skills the owner must run. App engineer must not skip them for a “small” route.
+
+## 0.4.1
+
+- Catch-up release: npm `0.4.0` was the simplify cut; later GitHub work (`deslop`, frontend-design, catalog pointers, leftover `doctor`, HTML user guide) was not on npm.
+- Upgrade `vitest` and `@vitest/coverage-v8` to 4.1.11 so `npm audit --audit-level=moderate` clears GHSA-82fw-gwwq-j7x9. Pin `vite` at 6.4.3 so the bump does not pull Vite 8. This is a devDependency-only gate; the published kit tarball still does not include vitest.
+- Add default `deslop`. Copy always runs it last after `product-copy`.
+- Uplift `frontend-design`: 4-token palettes, kit vs product tokens, and 2026 default-cluster rejects.
+- Planner uses the `planning` skill and names owners; every agent points at `catalog.json` and the USER_GUIDE skill table.
+- `doctor` warns when 0.3 council leftovers (`QUALITY_GATES.md`, `COUNCIL.md`, roster JSON, …) are still present. That is not a failure. `update` still never deletes them.
+- Ship `USER_GUIDE.html` as the charcoal assignment-desk field guide, with desktop and mobile screenshot evidence.
+
 ## 0.4.0
 
 - Simplify the pack to agents, skills, and a user guide. `init` writes `AGENTS.md`, `USER_GUIDE.md`, and native IDE files only.

package/README.md

@@ -10,7 +10,7 @@ QA does not review user-visible work from code alone. A change is not done until
 npx --yes @appsforgood/next-supabase-kit init --activate all
 ```
 
-Then read **[USER_GUIDE.md](USER_GUIDE.md)**. That guide is how you use the pack.
+Then open **[USER_GUIDE.html](USER_GUIDE.html)** (markdown twin: [USER_GUIDE.md](USER_GUIDE.md)). That guide is how you use the pack.
 
 ## What you get
 
@@ -38,4 +38,4 @@ Planner · App engineer · Security · Design · QA · Copy
 
 ## Default skills
 
-planning · nextjs-app-router · supabase-auth-rls · postgres-migrations · owasp-security-review · frontend-design · accessibility-wcag · **browser-qa** · testing-qa · product-copy · ship
+planning · nextjs-app-router · supabase-auth-rls · postgres-migrations · owasp-security-review · frontend-design · accessibility-wcag · **browser-qa** · testing-qa · product-copy · **deslop** · ship

package/UPGRADE.md

@@ -1,5 +1,27 @@
 # Upgrade Guide
 
+## 0.4.2
+
+`0.4.1` is the published simplify catch-up. `0.4.2` rewrites the Next.js and Supabase domain skills. `update` refreshes pristine skill files; local edits win or land in conflicts.
+
+```bash
+npx @appsforgood/next-supabase-kit@0.4.2 update
+npx @appsforgood/next-supabase-kit@0.4.2 doctor
+```
+
+Do not re-init. `update` still never deletes leftover 0.3 council docs.
+
+## 0.4.1
+
+npm `0.4.0` was the simplify cut. `0.4.1` adds `deslop`, the 4-token `frontend-design` skill, catalog pointers on agents, and leftover-0.3 `doctor` warnings. Those leftover warnings are not a failure. `update` still never deletes old council docs.
+
+```bash
+npx @appsforgood/next-supabase-kit@0.4.1 update
+npx @appsforgood/next-supabase-kit@0.4.1 doctor
+```
+
+Do not re-init.
+
 ## 0.4.0
 
 This is a breaking simplify. `init` now writes `AGENTS.md`, `USER_GUIDE.md`, and native IDE agents/skills. It does not install the 17-doc operating system, Studio, or orchestrator files.