@appsforgood/next-supabase-kit 0.4.1 → 0.4.3

package/examples/next-supabase-installed/.agent-kit/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 3,
   "packageName": "@appsforgood/next-supabase-kit",
-  "packageVersion": "0.4.1",
+  "packageVersion": "0.4.2",
   "stack": "next-supabase",
   "installedAt": "2026-09-06T01:00:41.569Z",
   "docs": [
@@ -22,34 +22,34 @@
   },
   "assetHashes": {
     "AGENTS.md": "d5b570847e7e283a4603055445d6b8cf87dd6e041305c6a3909fa7cde327db81",
-    "USER_GUIDE.md": "68b025fb9610e9ac40c324e755ce1260fd680e9937e32848ab9d4ba43835c3eb",
+    "USER_GUIDE.md": "0c7c8e543a52503299d7819a9359d4d635f32e3ab6ca0f8eaadf034b26798c32",
     ".cursor/rules/cursor-agent-kit.mdc": "850026beea86067d95925eea15eb447365d6a956e0f7f475ebd7fef89043d44b",
     "CLAUDE.md": "d5095edff182babe5c13717bb16cadcd95569d9e4abd37ceb307bb1448b65557",
     ".cursor/agents/planner.md": "90676313078391848072fd3a4dc24d8479a7911aa8e7f68a38f46b73074aa6d4",
-    ".cursor/agents/app-engineer.md": "c09eee305c0f2175c04ef78d0d0c788638a550565df484bb9ad6a44ae1e8d37c",
+    ".cursor/agents/app-engineer.md": "e37f6a4f03eb4f66021b5a599657468e9cb33d11abd86a83df02fe198e471b12",
     ".cursor/agents/security.md": "d71de67a6c66198c02db47357b9a91d86601659c843835ecb481e9edc651a238",
     ".cursor/agents/design.md": "04277841a61c9b3f0ea970a14319fe7c1c199a6be5483d5e69b65c231f8764f8",
     ".cursor/agents/qa.md": "a4f77a26ee91d0065d5ef9f7a48ebe9f4466b2d17a2d63cb0ffcbc4bc24b9a73",
     ".cursor/agents/copy.md": "11e7df36d16221d71e3290dc5ba07711df7320895ad2215eeebec5afcf43bf21",
-    ".cursor/skills/planning/SKILL.md": "a542c55e76c8e5baa37132451b3dd1c4d49606d233037e0512f82b714603f51a",
-    ".cursor/skills/nextjs-app-router/SKILL.md": "b598aa1f05ed8f0f31fc0d6bd8bb1011566d1164cb4fd5e8df2c0c02deffc532",
-    ".cursor/skills/supabase-auth-rls/SKILL.md": "bdd632edb4f8d824f337fe4a14f306479e81a104d814764b463006b53fe4750a",
-    ".cursor/skills/postgres-migrations/SKILL.md": "1d29ec1f31ebb824a5f4700f08d999b4e4dc9a0aefc7145722b13c6625e85db5",
-    ".cursor/skills/owasp-security-review/SKILL.md": "8141770ea49648728d10e214283a7dce338af4780b66874c58360d9ef7ee4311",
+    ".cursor/skills/planning/SKILL.md": "f4f19899f9feb8a32f614e078791bad915bf4fa41e778e27389495c36166c54d",
+    ".cursor/skills/nextjs-app-router/SKILL.md": "79f5ef6cccf5d675cc8ee6a95dc2e98d86b92b2b60edbc759b7017506d7c9c44",
+    ".cursor/skills/supabase-auth-rls/SKILL.md": "dc449f156b74a59110f5fc49a684ecf061b757a4805b3849b10771a92972f914",
+    ".cursor/skills/postgres-migrations/SKILL.md": "453245cd5b4e3d652fe7e5e84fcfb24e64f26ff5da4fd2309c1692c7e6de763e",
+    ".cursor/skills/owasp-security-review/SKILL.md": "a3bcc4702be5c8d5ca51097671f658030791a24e8c4e4019489b44ffbfece1c5",
     ".cursor/skills/frontend-design/SKILL.md": "2fb0c3a9a637af2c0dda28aef1991ee8f30ef2113f02445d9c7403208578d04f",
     ".cursor/skills/accessibility-wcag/SKILL.md": "1199b4852c2ad9981834a03dcc86edd1f68d8337d25aa13d3c4ad5518343a520",
     ".cursor/skills/browser-qa/SKILL.md": "c04e2fa549d9ef6a7c91280859a6394ac59273e6866d537de879d1f1b5fcff1a",
-    ".cursor/skills/testing-qa/SKILL.md": "1e92f7c33e29747c51548c0d1f58507de53768aa9e9748c3be2809d88bf1dc1f",
+    ".cursor/skills/testing-qa/SKILL.md": "534b9d29f5ca26cba70eb1e037d8da0e414ad0c49159739fedae9dfb4ca6b618",
     ".cursor/skills/product-copy/SKILL.md": "2f1982ac949ed32690046f516dfefa1ca85bfb51318b403822696bd12bb982c4",
     ".cursor/skills/ship/SKILL.md": "ac426092a1868dd1deb01689dc2f5591dbe40acb2fceec559adce41602bb8d6f",
     ".claude/agents/planner.md": "90676313078391848072fd3a4dc24d8479a7911aa8e7f68a38f46b73074aa6d4",
-    ".claude/agents/app-engineer.md": "c09eee305c0f2175c04ef78d0d0c788638a550565df484bb9ad6a44ae1e8d37c",
+    ".claude/agents/app-engineer.md": "e37f6a4f03eb4f66021b5a599657468e9cb33d11abd86a83df02fe198e471b12",
     ".claude/agents/security.md": "d71de67a6c66198c02db47357b9a91d86601659c843835ecb481e9edc651a238",
     ".claude/agents/design.md": "04277841a61c9b3f0ea970a14319fe7c1c199a6be5483d5e69b65c231f8764f8",
     ".claude/agents/qa.md": "a4f77a26ee91d0065d5ef9f7a48ebe9f4466b2d17a2d63cb0ffcbc4bc24b9a73",
     ".claude/agents/copy.md": "11e7df36d16221d71e3290dc5ba07711df7320895ad2215eeebec5afcf43bf21",
     ".codex/agents/planner.toml": "f55f218778ae76942e6c7ea9a159e89dc5c13466b0effa0c43935b29d8182d11",
-    ".codex/agents/app-engineer.toml": "e266f129da9949f0e62128f22d42474f94a47cb81db0a5c20ef5d87e39b894dd",
+    ".codex/agents/app-engineer.toml": "f76f6f9a531974becdd863bfb4a0bf1b6810e966d31b7fb6a4f41f8791a8fb59",
     ".codex/agents/security.toml": "9e202a8125ddce38d84487a59d7c7cd7328acb8c441704f670b8331042be15f0",
     ".codex/agents/design.toml": "6b9114c3ab55db610cc38632939930d966282a427ba0fba4c4c6178f43d10725",
     ".codex/agents/qa.toml": "07f53a37d896203707bcb28d19e5a502194a3276faa387bff3739e8d876af564",
@@ -63,32 +63,32 @@
     ".antigravity/agent-kit/commands/copy.toml": "40ad093163915a9f000bf8344e49c37dc2d735ab404e84430323502af0bf031e",
     ".antigravity/agent-kit/commands/test.toml": "238f3d670c0ecabeab38204fe0a42b32fc5cbdad885b706715f17075c855c9d7",
     ".antigravity/agent-kit/commands/ship.toml": "dfa8a6bc654e7bfbf06ad1af59f122a8b116b84008b5ab9325ce21eba3eab9ef",
-    ".antigravity/runtime-skills/planning/SKILL.md": "a542c55e76c8e5baa37132451b3dd1c4d49606d233037e0512f82b714603f51a",
-    ".antigravity/runtime-skills/nextjs-app-router/SKILL.md": "b598aa1f05ed8f0f31fc0d6bd8bb1011566d1164cb4fd5e8df2c0c02deffc532",
-    ".antigravity/runtime-skills/supabase-auth-rls/SKILL.md": "bdd632edb4f8d824f337fe4a14f306479e81a104d814764b463006b53fe4750a",
-    ".antigravity/runtime-skills/postgres-migrations/SKILL.md": "1d29ec1f31ebb824a5f4700f08d999b4e4dc9a0aefc7145722b13c6625e85db5",
-    ".antigravity/runtime-skills/owasp-security-review/SKILL.md": "8141770ea49648728d10e214283a7dce338af4780b66874c58360d9ef7ee4311",
+    ".antigravity/runtime-skills/planning/SKILL.md": "f4f19899f9feb8a32f614e078791bad915bf4fa41e778e27389495c36166c54d",
+    ".antigravity/runtime-skills/nextjs-app-router/SKILL.md": "79f5ef6cccf5d675cc8ee6a95dc2e98d86b92b2b60edbc759b7017506d7c9c44",
+    ".antigravity/runtime-skills/supabase-auth-rls/SKILL.md": "dc449f156b74a59110f5fc49a684ecf061b757a4805b3849b10771a92972f914",
+    ".antigravity/runtime-skills/postgres-migrations/SKILL.md": "453245cd5b4e3d652fe7e5e84fcfb24e64f26ff5da4fd2309c1692c7e6de763e",
+    ".antigravity/runtime-skills/owasp-security-review/SKILL.md": "a3bcc4702be5c8d5ca51097671f658030791a24e8c4e4019489b44ffbfece1c5",
     ".antigravity/runtime-skills/frontend-design/SKILL.md": "2fb0c3a9a637af2c0dda28aef1991ee8f30ef2113f02445d9c7403208578d04f",
     ".antigravity/runtime-skills/accessibility-wcag/SKILL.md": "1199b4852c2ad9981834a03dcc86edd1f68d8337d25aa13d3c4ad5518343a520",
     ".antigravity/runtime-skills/browser-qa/SKILL.md": "c04e2fa549d9ef6a7c91280859a6394ac59273e6866d537de879d1f1b5fcff1a",
-    ".antigravity/runtime-skills/testing-qa/SKILL.md": "1e92f7c33e29747c51548c0d1f58507de53768aa9e9748c3be2809d88bf1dc1f",
+    ".antigravity/runtime-skills/testing-qa/SKILL.md": "534b9d29f5ca26cba70eb1e037d8da0e414ad0c49159739fedae9dfb4ca6b618",
     ".antigravity/runtime-skills/product-copy/SKILL.md": "2f1982ac949ed32690046f516dfefa1ca85bfb51318b403822696bd12bb982c4",
     ".antigravity/runtime-skills/ship/SKILL.md": "ac426092a1868dd1deb01689dc2f5591dbe40acb2fceec559adce41602bb8d6f",
-    "skills/planning/SKILL.md": "a542c55e76c8e5baa37132451b3dd1c4d49606d233037e0512f82b714603f51a",
-    "skills/nextjs-app-router/SKILL.md": "b598aa1f05ed8f0f31fc0d6bd8bb1011566d1164cb4fd5e8df2c0c02deffc532",
-    "skills/supabase-auth-rls/SKILL.md": "bdd632edb4f8d824f337fe4a14f306479e81a104d814764b463006b53fe4750a",
-    "skills/postgres-migrations/SKILL.md": "1d29ec1f31ebb824a5f4700f08d999b4e4dc9a0aefc7145722b13c6625e85db5",
-    "skills/owasp-security-review/SKILL.md": "8141770ea49648728d10e214283a7dce338af4780b66874c58360d9ef7ee4311",
+    "skills/planning/SKILL.md": "f4f19899f9feb8a32f614e078791bad915bf4fa41e778e27389495c36166c54d",
+    "skills/nextjs-app-router/SKILL.md": "79f5ef6cccf5d675cc8ee6a95dc2e98d86b92b2b60edbc759b7017506d7c9c44",
+    "skills/supabase-auth-rls/SKILL.md": "dc449f156b74a59110f5fc49a684ecf061b757a4805b3849b10771a92972f914",
+    "skills/postgres-migrations/SKILL.md": "453245cd5b4e3d652fe7e5e84fcfb24e64f26ff5da4fd2309c1692c7e6de763e",
+    "skills/owasp-security-review/SKILL.md": "a3bcc4702be5c8d5ca51097671f658030791a24e8c4e4019489b44ffbfece1c5",
     "skills/frontend-design/SKILL.md": "2fb0c3a9a637af2c0dda28aef1991ee8f30ef2113f02445d9c7403208578d04f",
     "skills/accessibility-wcag/SKILL.md": "1199b4852c2ad9981834a03dcc86edd1f68d8337d25aa13d3c4ad5518343a520",
     "skills/browser-qa/SKILL.md": "c04e2fa549d9ef6a7c91280859a6394ac59273e6866d537de879d1f1b5fcff1a",
-    "skills/testing-qa/SKILL.md": "1e92f7c33e29747c51548c0d1f58507de53768aa9e9748c3be2809d88bf1dc1f",
+    "skills/testing-qa/SKILL.md": "534b9d29f5ca26cba70eb1e037d8da0e414ad0c49159739fedae9dfb4ca6b618",
     "skills/product-copy/SKILL.md": "2f1982ac949ed32690046f516dfefa1ca85bfb51318b403822696bd12bb982c4",
     "skills/ship/SKILL.md": "ac426092a1868dd1deb01689dc2f5591dbe40acb2fceec559adce41602bb8d6f",
-    "USER_GUIDE.html": "3ed6388909be27ecbcce1b65499cb7416228ff629fd39c982d8fe382ecc942c6",
+    "USER_GUIDE.html": "7781238feb3e87b2fa539ac7a74a735632542e02c6f3dfed10846246a7bada96",
     ".cursor/skills/deslop/SKILL.md": "ca328ee5d66335639d608059ea9aabef17f70188931d46077dde11583969dea0",
     ".antigravity/runtime-skills/deslop/SKILL.md": "ca328ee5d66335639d608059ea9aabef17f70188931d46077dde11583969dea0",
     "skills/deslop/SKILL.md": "ca328ee5d66335639d608059ea9aabef17f70188931d46077dde11583969dea0"
   },
-  "updatedAt": "2026-09-06T23:40:17.483Z"
+  "updatedAt": "2026-09-09T05:16:37.821Z"
 }

package/examples/next-supabase-installed/.antigravity/runtime-skills/deslop/SKILL.md

@@ -38,7 +38,7 @@ Second pass: re-read the rewrite. If the same tell remains, rewrite the paragrap
 
 ## Visual P0s — fail if still on screen
 
-These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
+These are the 2026 flat AI/SaaS chrome cluster (same family as accent-border cards, glow rails, and card soup). One is a smell. Two or more is a reject. A pick-list row or status well with a left stroke is already a fail.
 
 - Purple-to-blue (or indigo) gradient hero, or gradient-clipped headline type
 - Inter / Roboto / default shadcn zinc as the whole identity
@@ -48,6 +48,12 @@ These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
 - Acid green or neon vermilion on near-black used as decoration, not meaning
 - Lucide Sparkles / Zap as the product metaphor
 - Fake dashboard metrics or DiceBear avatars
+- Left accent bars / left-hand borderlines on selected rows, list items, cards, or success/error/warn wells (the “colored stroke on the left edge” pattern)
+- Thick one-sided colored borders, glow rails, neon strokes, or gradient borders used as the main state cue
+
+Selection must use radio/checkbox + light row tint (or weight/space) only. Status wells may use a flat tint fill. No `border-left` accent, no inset bar, no vertical rail as decoration. Keep one accent for the primary CTA, not as a row edge.
+
+**Acceptance fixture:** a pick-list row and a “verified” well must pass with **zero** left border accents. If screenshots show a blue/green/amber left stroke, deslop fails.
 
 Copy does not restyle the page. It lists the P0s from the screenshot and sends them to Design.
 

package/examples/next-supabase-installed/.antigravity/runtime-skills/frontend-design/SKILL.md

@@ -77,7 +77,9 @@ One family, or two that are obviously different (display vs mono). Inter + syste
 - Mobile (~390): the primary CTA still fits above the fold.
 - Hierarchy from size, weight, and space — not from cards.
 - Landing and marketing pages take a full direction. App chrome (settings, tables) stays quiet and dense.
-- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default).
+- Do not mark selection or severity with a left edge stroke. That pattern reads as default AI/SaaS chrome even on flat full-bleed sheets.
+- Prefer: radio + tint, check + tint, or typography/weight. Keep one accent for the primary CTA, not as a row edge.
+- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default); left selection rails; callouts whose only cue is a thick left border.
 
 ## Motion
 

package/examples/next-supabase-installed/.antigravity/runtime-skills/nextjs-app-router/SKILL.md

@@ -1,23 +1,43 @@
 ---
 name: nextjs-app-router
-description: Use for Next.js App Router, Server Components, Client Components, Route Handlers, Server Actions, caching, forms, and metadata.
+description: Use for Next.js App Router — Server vs Client, Server Actions, Route Handlers, async params/cookies, caching, and proxy.ts. Smoke the changed route in the browser.
 ---
 
 # Next.js App Router
 
+Scan 2026-09-09 (structure only, no bodies copied): Next.js App Router docs, Next.js 16 async request APIs and `proxy.ts` rename. This pack’s auth is **Supabase**, not a marketplace auth vendor.
+
 ## Use when
 
-Routes, layouts, Server Components, Client Components, Server Actions, Route Handlers, data loading, caching, or revalidation.
+`app/` routes, layouts, Server Components, Client Components, Server Actions, Route Handlers, `params` / `searchParams`, `cookies()` / `headers()`, caching, or request interception (`proxy.ts` / legacy `middleware.ts`).
+
+## Do
+
+1. Read the existing `app/` tree and match its conventions (`src/app` vs `app`).
+2. Keep the work on the **server** unless the browser must hold state, events, or Web APIs.
+3. Put mutations in Server Actions (forms) or Route Handlers (HTTP). Validate every input.
+4. After a user-visible change, open the running route before handing to QA.
 
 ## Checks
 
-- Server Components are the default. Client Components are only for browser-only behavior.
-- Secrets never enter client bundles.
-- User-specific data is not stored in shared caches.
-- Route params, query params, forms, and API bodies are validated.
-- Loading, error, empty, and success states exist.
-- Authorization is enforced on the server and in RLS, not only in the UI.
+- Server Components are the default. `"use client"` is only for browser-only behavior (event handlers, local state, browser APIs).
+- Secrets, service-role keys, and privileged fetches never enter a Client Component or a client bundle.
+- `cookies()`, `headers()`, `params`, and `searchParams` are **awaited** (Next.js 15+/16).
+- Navigation uses `next/navigation`, not `next/router`. Metadata uses `metadata` / `generateMetadata`, not `next/head`.
+- Pages Router APIs (`getServerSideProps`, `getStaticProps`, `pages/api`) stay out of new work.
+- Next.js 16 request interception lives in `proxy.ts` (`proxy()`). If the repo still has `middleware.ts`, migrate or document why it stays.
+- User-specific data is not stored in a shared/public cache. Tag invalidation uses the current two-argument `revalidateTag` API when tags are used.
+- Route params, query strings, form fields, and JSON bodies are validated with a schema. Do not trust the URL or the client.
+- `loading.tsx`, `error.tsx`, empty, and success exist for the changed route when the user can wait or fail.
+- Authorization is enforced on the server **and** in RLS (`supabase-auth-rls`). Hiding a button is not access control.
+
+## Reject
+
+- “It’s a Client Component so we can use hooks” when the data could load on the server.
+- Importing `@supabase/supabase-js` with the service-role key in a file that has `"use client"`.
+- Switching this pack to Clerk / Auth0 / NextAuth as the default. Auth here is Supabase.
+- Shipping a route from the diff without opening it.
 
 ## Done when
 
-The server/client boundary is explicit and the changed route can be opened in the browser.
+The server/client boundary is explicit, failure paths are named, and the changed route was opened in the running app. User-visible work then goes to QA with `browser-qa`.

package/examples/next-supabase-installed/.antigravity/runtime-skills/owasp-security-review/SKILL.md

@@ -1,23 +1,45 @@
 ---
 name: owasp-security-review
-description: Use when reviewing auth, APIs, Server Actions, uploads, webhooks, dependencies, secrets, or data mutations.
+description: Use when reviewing auth, Server Actions, Route Handlers, uploads, webhooks, SSRF, secrets, or data mutations in a Next.js + Supabase app.
 ---
 
 # OWASP Security Review
 
+Scan 2026-09-09: OWASP Top 10 mapped onto this pack (App Router + Supabase). Pair with `supabase-auth-rls`. Do not treat a UI walkthrough as access control.
+
 ## Use when
 
-Auth, APIs, Server Actions, external fetches, uploads, webhooks, dependencies, or mutations.
+Auth, RLS, Server Actions, Route Handlers, uploads, webhooks, server-side `fetch`, new dependencies, or any mutation.
 
 ## Checks
 
-- Broken access control and IDOR are tested.
-- Inputs are validated with safe schemas.
-- Outputs are encoded; secrets are not logged or bundled.
-- SSRF risk is addressed for server-side fetches.
-- Dependencies are reviewed for known critical CVEs.
-- Errors are explicit without leaking internals.
+Map each change to a concrete control. Skip rows that do not apply; do not skip access control when data is involved.
+
+| Risk | In this pack |
+| --- | --- |
+| Broken access control / IDOR | RLS + server checks. Object IDs in params/body cannot reach another user’s row. |
+| Cryptographic failures | No secrets in git, logs, or client bundles. Service role is server-only. |
+| Injection | Schema-validate inputs. Parameterized queries / Supabase client. No string-built SQL. |
+| Insecure design | Abuse case named (anon, other user, stolen cookie, replayed action). |
+| Misconfiguration | CORS, env, debug flags, Storage public/private. |
+| Vulnerable components | New deps reviewed; no known critical CVE waved through. |
+| Auth failures | Login, logout, refresh, denied. `getUser()` on the server. |
+| Integrity | Lockfile + CI. No postinstall scripts from untrusted packages. |
+| Logging | Privileged actions log without tokens, cookies, or PII dumps. |
+| SSRF | Server `fetch` / webhook URLs are allowlisted or parsed; no user-controlled hostname to cloud metadata. |
+
+## Server Actions And Route Handlers
+
+- Every mutation validates origin/input. Do not trust hidden form fields for `user_id` or `role`.
+- CSRF: cookie-session apps use SameSite and origin checks on state-changing POST.
+- File uploads: type, size, and Storage policy. Do not serve user files from a privileged bucket via a guessable path.
+
+## Reject
+
+- “RLS is enabled” without a policy that names the owner or tenant.
+- Findings with no severity, no affected behavior, and no fix.
+- Closing a user-visible auth bug from the SQL file alone (needs `browser-qa` for login/denied).
 
 ## Done when
 
-Each finding has severity, affected behavior, and a concrete fix. User-visible auth failures were seen in the browser.
+Each finding has severity, affected behavior, and a concrete fix. Access control is in Postgres or the server, not only the UI. User-visible auth failures were seen in the browser.

package/examples/next-supabase-installed/.antigravity/runtime-skills/planning/SKILL.md

@@ -11,15 +11,21 @@ Planning, roadmaps, “what should we do,” or any request that needs an owner.
 
 ## Steps
 
-1. Read enough of the repo to name affected routes and data.
+1. Read enough of the repo to name affected routes, tables, and auth boundaries.
 2. Pick one owner: `app-engineer`, `security`, `design`, `qa`, or `copy`.
-3. Add Security for auth/data/secrets, Design for UI, QA for behavior/UI, Copy for public words.
-4. If the change is user-visible, list the desktop and mobile screenshots QA must capture.
+3. Name the skill that owner must run first:
+   - App engineer: `nextjs-app-router` and, if data/auth, `supabase-auth-rls` / `postgres-migrations`
+   - Security: `owasp-security-review` + `supabase-auth-rls`
+   - Design: `frontend-design`
+   - QA: `browser-qa` (screens) and `testing-qa` (commands)
+   - Copy: `product-copy` then `deslop` last
+4. Add extra reviewers: Security for auth/data/secrets, Design for UI, QA for behavior/UI, Copy for public words.
+5. If the change is user-visible, list the desktop and mobile screenshots QA must capture.
 
 ## Done when
 
-Owner, extra reviewers, preserved behavior, and required screenshots are explicit. No product code was written.
+Owner, extra reviewers, required skills, preserved behavior, and required screenshots are explicit. No product code was written.
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role.
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small.

package/examples/next-supabase-installed/.antigravity/runtime-skills/postgres-migrations/SKILL.md

@@ -1,21 +1,39 @@
 ---
 name: postgres-migrations
-description: Use for schema changes, migrations, constraints, indexes, and rollback risk.
+description: Use for schema, constraints, indexes, RLS in the same change, generated types, and rollback risk.
 ---
 
 # Postgres Migrations
 
+Scan 2026-09-09 (structure only, no bodies copied): Supabase migration + RLS docs. Pair every user-data table with `supabase-auth-rls`.
+
 ## Use when
 
-Creating or changing tables, constraints, indexes, functions, triggers, or seed data.
+Creating or changing tables, columns, constraints, indexes, functions, triggers, views, or seed data.
+
+## Do
+
+1. Name the migration, the tables, and whether existing rows must keep working.
+2. Prefer additive changes. Destructive steps need an explicit rollback (or an expand/contract plan).
+3. If the table holds user or tenant data, **RLS lands in this change**, not a later ticket.
+4. Refresh generated DB types after the schema change.
 
 ## Checks
 
-- Migrations are additive or have an explicit rollback path.
-- Constraints protect integrity; indexes match real query paths.
-- RLS is planned in the same change when the table holds user or tenant data.
-- Generated types are refreshed after schema changes.
+- Constraints protect integrity (PK, FK, unique, `NOT NULL` where the product requires it).
+- Indexes match real `WHERE` / join paths, not speculative columns.
+- `ENABLE ROW LEVEL SECURITY` + policies ship with the table when it is user-owned, tenant-owned, or privileged.
+- `GRANT` is not a substitute for RLS. Revoking grants from `anon` / `authenticated` without policies is still incomplete if the service role is exposed.
+- Functions that run as definer are listed and justified. Prefer invoker + RLS.
+- Seed data does not insert other users’ rows as the current user.
+- Migration order is safe on a non-empty database (backfill before `NOT NULL`, rename in steps).
+
+## Reject
+
+- “We’ll add RLS after launch.”
+- Dropping a column or table in the same release that still reads it, with no expand/contract.
+- Editing production by hand instead of a numbered migration.
 
 ## Done when
 
-Migration order and rollback risk are named. User data is not left unprotected.
+Migration order and rollback risk are named. User data is not left unprotected. Types used by the app match the new schema.

package/examples/next-supabase-installed/.antigravity/runtime-skills/supabase-auth-rls/SKILL.md

@@ -1,23 +1,55 @@
 ---
 name: supabase-auth-rls
-description: Use for Supabase Auth, SSR clients, middleware, sessions, Row Level Security, Storage policies, and service-role usage.
+description: Use for Supabase Auth, SSR clients, session refresh, RLS, Storage policies, and keeping the service role server-only. UI checks are not authorization.
 ---
 
 # Supabase Auth And RLS
 
+Scan 2026-09-09 (structure only, no bodies copied): Supabase SSR Auth, RLS, and Storage policy docs. Do not replace this pack with a non-Supabase auth vendor.
+
 ## Use when
 
-Supabase Auth, SSR clients, middleware, sessions, tables, policies, Storage, or service-role operations.
+Supabase Auth, cookie/SSR clients, `proxy.ts` / middleware session refresh, RLS, Storage, service-role usage, or any table that stores user or tenant data.
+
+## Do
+
+1. Name the table or bucket and who may read or write a row.
+2. Use the **anon/user SSR client** in user requests. Use the **service role** only in a server-only module that never imports into Client Components.
+3. Enable RLS and write policies in the **same change** as the table (`postgres-migrations`).
+4. Prove a negative: another user (or anon) cannot read or write the row.
+
+## Clients
+
+| Client | Where | Key |
+| --- | --- | --- |
+| Browser / `'use client'` | Components that must talk to Supabase in the browser | `NEXT_PUBLIC_SUPABASE_ANON_KEY` only |
+| SSR / Server Components / Actions / Route Handlers | Cookie session, `createServerClient` | Anon key + cookies |
+| Service role | Server-only jobs, webhooks, migrations | `SUPABASE_SERVICE_ROLE_KEY` — never `NEXT_PUBLIC_` |
+
+Auth decisions use `getUser()` (or equivalent server verification), not a client-trusted `getSession()` JWT.
+
+If the app intercepts requests, refresh the session there (`proxy.ts` or existing `middleware.ts`) so Server Components see a current user.
+
+## RLS And Storage
+
+- `ENABLE ROW LEVEL SECURITY` on every user-owned, tenant-owned, or privileged table.
+- Policies name ownership (`auth.uid()`) and tenant boundaries. An “authenticated” role is not ownership.
+- Storage buckets have explicit policies. A private bucket with a public URL is a finding.
+- Privileged bypass (service role, `security definer`) is listed, server-only, and as narrow as the job.
 
 ## Checks
 
-- RLS is enabled on user-owned and tenant-owned tables.
-- Policies enforce ownership and tenant boundaries.
-- Service-role keys stay server-only.
-- Auth middleware refreshes sessions safely.
-- Storage buckets have explicit policies.
-- IDOR is considered and tested at the policy boundary.
+- IDOR is tested at the **policy** (and server) boundary: object IDs in the URL or body cannot reach another user’s row.
+- Login, logout, expired session, and denied are exercised when those states exist. User-visible ones need `browser-qa`.
+- `.env.example` documents public anon URL/key placeholders only. Service role stays unnamed in client files.
+
+## Reject
+
+- “The button is hidden, so they cannot hit the API.”
+- RLS deferred to a follow-up PR while the table is already queryable.
+- Service role in `NEXT_PUBLIC_*`, in a Client Component, or in a file imported by one.
+- Trusting `user_id` from the request body instead of `auth.uid()`.
 
 ## Done when
 
-A table that stores user data cannot be read or written across users without a failing policy. UI checks are not treated as authorization.
+A second user (or anon) cannot read or write the protected row. UI checks are not treated as authorization. Hand user-visible auth states to QA with `browser-qa`.

package/examples/next-supabase-installed/.antigravity/runtime-skills/testing-qa/SKILL.md

@@ -14,14 +14,16 @@ Adding or reviewing tests, smoke checks, or regression coverage.
 - Core logic has unit tests.
 - Preserved behavior has regression tests.
 - Critical flows have Playwright or equivalent smoke tests.
-- Auth and mutation paths are prioritized.
+- Auth, RLS, and mutation paths are prioritized (other-user / anon cannot pass).
 - Network failure, empty, and error behavior is covered.
 - Gaps are named when infrastructure is missing.
 
+If the change is App Router, Auth/RLS, or a migration, tests must cover those contracts. This skill does not replace `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`, or `owasp-security-review`. Visual proof of a screen still uses `browser-qa`.
+
 ## Visual proof
 
-User-visible screens also require `browser-qa`. This skill does not replace screenshots.
+User-visible screens also require `browser-qa`. This skill does not replace screenshots. Passing `toBeVisible` is not image review.
 
 ## Done when
 
-Commands run, results, and residual gaps are listed.
+Commands run, results, and residual gaps are listed. RLS/auth tests fail closed when another user can read the row.

package/examples/next-supabase-installed/.claude/agents/app-engineer.md

@@ -23,6 +23,8 @@ Code-only “it should work” is incomplete for anything the user can see or cl
 
 `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`.
 
+Run those skills. Do not treat a small route, form, or table as exempt.
+
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
 ## Handoff

package/examples/next-supabase-installed/.codex/agents/app-engineer.toml

@@ -28,6 +28,8 @@ Code-only “it should work” is incomplete for anything the user can see or cl
 
 `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`.
 
+Run those skills. Do not treat a small route, form, or table as exempt.
+
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
 ## Handoff

package/examples/next-supabase-installed/.cursor/agents/app-engineer.md

@@ -23,6 +23,8 @@ Code-only “it should work” is incomplete for anything the user can see or cl
 
 `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`.
 
+Run those skills. Do not treat a small route, form, or table as exempt.
+
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
 ## Handoff

package/examples/next-supabase-installed/.cursor/skills/deslop/SKILL.md

@@ -38,7 +38,7 @@ Second pass: re-read the rewrite. If the same tell remains, rewrite the paragrap
 
 ## Visual P0s — fail if still on screen
 
-These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
+These are the 2026 flat AI/SaaS chrome cluster (same family as accent-border cards, glow rails, and card soup). One is a smell. Two or more is a reject. A pick-list row or status well with a left stroke is already a fail.
 
 - Purple-to-blue (or indigo) gradient hero, or gradient-clipped headline type
 - Inter / Roboto / default shadcn zinc as the whole identity
@@ -48,6 +48,12 @@ These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
 - Acid green or neon vermilion on near-black used as decoration, not meaning
 - Lucide Sparkles / Zap as the product metaphor
 - Fake dashboard metrics or DiceBear avatars
+- Left accent bars / left-hand borderlines on selected rows, list items, cards, or success/error/warn wells (the “colored stroke on the left edge” pattern)
+- Thick one-sided colored borders, glow rails, neon strokes, or gradient borders used as the main state cue
+
+Selection must use radio/checkbox + light row tint (or weight/space) only. Status wells may use a flat tint fill. No `border-left` accent, no inset bar, no vertical rail as decoration. Keep one accent for the primary CTA, not as a row edge.
+
+**Acceptance fixture:** a pick-list row and a “verified” well must pass with **zero** left border accents. If screenshots show a blue/green/amber left stroke, deslop fails.
 
 Copy does not restyle the page. It lists the P0s from the screenshot and sends them to Design.
 

package/examples/next-supabase-installed/.cursor/skills/frontend-design/SKILL.md

@@ -77,7 +77,9 @@ One family, or two that are obviously different (display vs mono). Inter + syste
 - Mobile (~390): the primary CTA still fits above the fold.
 - Hierarchy from size, weight, and space — not from cards.
 - Landing and marketing pages take a full direction. App chrome (settings, tables) stays quiet and dense.
-- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default).
+- Do not mark selection or severity with a left edge stroke. That pattern reads as default AI/SaaS chrome even on flat full-bleed sheets.
+- Prefer: radio + tint, check + tint, or typography/weight. Keep one accent for the primary CTA, not as a row edge.
+- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default); left selection rails; callouts whose only cue is a thick left border.
 
 ## Motion
 

package/examples/next-supabase-installed/.cursor/skills/nextjs-app-router/SKILL.md

@@ -1,23 +1,43 @@
 ---
 name: nextjs-app-router
-description: Use for Next.js App Router, Server Components, Client Components, Route Handlers, Server Actions, caching, forms, and metadata.
+description: Use for Next.js App Router — Server vs Client, Server Actions, Route Handlers, async params/cookies, caching, and proxy.ts. Smoke the changed route in the browser.
 ---
 
 # Next.js App Router
 
+Scan 2026-09-09 (structure only, no bodies copied): Next.js App Router docs, Next.js 16 async request APIs and `proxy.ts` rename. This pack’s auth is **Supabase**, not a marketplace auth vendor.
+
 ## Use when
 
-Routes, layouts, Server Components, Client Components, Server Actions, Route Handlers, data loading, caching, or revalidation.
+`app/` routes, layouts, Server Components, Client Components, Server Actions, Route Handlers, `params` / `searchParams`, `cookies()` / `headers()`, caching, or request interception (`proxy.ts` / legacy `middleware.ts`).
+
+## Do
+
+1. Read the existing `app/` tree and match its conventions (`src/app` vs `app`).
+2. Keep the work on the **server** unless the browser must hold state, events, or Web APIs.
+3. Put mutations in Server Actions (forms) or Route Handlers (HTTP). Validate every input.
+4. After a user-visible change, open the running route before handing to QA.
 
 ## Checks
 
-- Server Components are the default. Client Components are only for browser-only behavior.
-- Secrets never enter client bundles.
-- User-specific data is not stored in shared caches.
-- Route params, query params, forms, and API bodies are validated.
-- Loading, error, empty, and success states exist.
-- Authorization is enforced on the server and in RLS, not only in the UI.
+- Server Components are the default. `"use client"` is only for browser-only behavior (event handlers, local state, browser APIs).
+- Secrets, service-role keys, and privileged fetches never enter a Client Component or a client bundle.
+- `cookies()`, `headers()`, `params`, and `searchParams` are **awaited** (Next.js 15+/16).
+- Navigation uses `next/navigation`, not `next/router`. Metadata uses `metadata` / `generateMetadata`, not `next/head`.
+- Pages Router APIs (`getServerSideProps`, `getStaticProps`, `pages/api`) stay out of new work.
+- Next.js 16 request interception lives in `proxy.ts` (`proxy()`). If the repo still has `middleware.ts`, migrate or document why it stays.
+- User-specific data is not stored in a shared/public cache. Tag invalidation uses the current two-argument `revalidateTag` API when tags are used.
+- Route params, query strings, form fields, and JSON bodies are validated with a schema. Do not trust the URL or the client.
+- `loading.tsx`, `error.tsx`, empty, and success exist for the changed route when the user can wait or fail.
+- Authorization is enforced on the server **and** in RLS (`supabase-auth-rls`). Hiding a button is not access control.
+
+## Reject
+
+- “It’s a Client Component so we can use hooks” when the data could load on the server.
+- Importing `@supabase/supabase-js` with the service-role key in a file that has `"use client"`.
+- Switching this pack to Clerk / Auth0 / NextAuth as the default. Auth here is Supabase.
+- Shipping a route from the diff without opening it.
 
 ## Done when
 
-The server/client boundary is explicit and the changed route can be opened in the browser.
+The server/client boundary is explicit, failure paths are named, and the changed route was opened in the running app. User-visible work then goes to QA with `browser-qa`.

package/examples/next-supabase-installed/.cursor/skills/owasp-security-review/SKILL.md

@@ -1,23 +1,45 @@
 ---
 name: owasp-security-review
-description: Use when reviewing auth, APIs, Server Actions, uploads, webhooks, dependencies, secrets, or data mutations.
+description: Use when reviewing auth, Server Actions, Route Handlers, uploads, webhooks, SSRF, secrets, or data mutations in a Next.js + Supabase app.
 ---
 
 # OWASP Security Review
 
+Scan 2026-09-09: OWASP Top 10 mapped onto this pack (App Router + Supabase). Pair with `supabase-auth-rls`. Do not treat a UI walkthrough as access control.
+
 ## Use when
 
-Auth, APIs, Server Actions, external fetches, uploads, webhooks, dependencies, or mutations.
+Auth, RLS, Server Actions, Route Handlers, uploads, webhooks, server-side `fetch`, new dependencies, or any mutation.
 
 ## Checks
 
-- Broken access control and IDOR are tested.
-- Inputs are validated with safe schemas.
-- Outputs are encoded; secrets are not logged or bundled.
-- SSRF risk is addressed for server-side fetches.
-- Dependencies are reviewed for known critical CVEs.
-- Errors are explicit without leaking internals.
+Map each change to a concrete control. Skip rows that do not apply; do not skip access control when data is involved.
+
+| Risk | In this pack |
+| --- | --- |
+| Broken access control / IDOR | RLS + server checks. Object IDs in params/body cannot reach another user’s row. |
+| Cryptographic failures | No secrets in git, logs, or client bundles. Service role is server-only. |
+| Injection | Schema-validate inputs. Parameterized queries / Supabase client. No string-built SQL. |
+| Insecure design | Abuse case named (anon, other user, stolen cookie, replayed action). |
+| Misconfiguration | CORS, env, debug flags, Storage public/private. |
+| Vulnerable components | New deps reviewed; no known critical CVE waved through. |
+| Auth failures | Login, logout, refresh, denied. `getUser()` on the server. |
+| Integrity | Lockfile + CI. No postinstall scripts from untrusted packages. |
+| Logging | Privileged actions log without tokens, cookies, or PII dumps. |
+| SSRF | Server `fetch` / webhook URLs are allowlisted or parsed; no user-controlled hostname to cloud metadata. |
+
+## Server Actions And Route Handlers
+
+- Every mutation validates origin/input. Do not trust hidden form fields for `user_id` or `role`.
+- CSRF: cookie-session apps use SameSite and origin checks on state-changing POST.
+- File uploads: type, size, and Storage policy. Do not serve user files from a privileged bucket via a guessable path.
+
+## Reject
+
+- “RLS is enabled” without a policy that names the owner or tenant.
+- Findings with no severity, no affected behavior, and no fix.
+- Closing a user-visible auth bug from the SQL file alone (needs `browser-qa` for login/denied).
 
 ## Done when
 
-Each finding has severity, affected behavior, and a concrete fix. User-visible auth failures were seen in the browser.
+Each finding has severity, affected behavior, and a concrete fix. Access control is in Postgres or the server, not only the UI. User-visible auth failures were seen in the browser.