@appsforgood/next-supabase-kit 0.4.2 → 0.4.3

package/examples/next-supabase-installed/.cursor/skills/deslop/SKILL.md

@@ -38,7 +38,7 @@ Second pass: re-read the rewrite. If the same tell remains, rewrite the paragrap
 
 ## Visual P0s — fail if still on screen
 
-These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
+These are the 2026 flat AI/SaaS chrome cluster (same family as accent-border cards, glow rails, and card soup). One is a smell. Two or more is a reject. A pick-list row or status well with a left stroke is already a fail.
 
 - Purple-to-blue (or indigo) gradient hero, or gradient-clipped headline type
 - Inter / Roboto / default shadcn zinc as the whole identity
@@ -48,6 +48,12 @@ These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
 - Acid green or neon vermilion on near-black used as decoration, not meaning
 - Lucide Sparkles / Zap as the product metaphor
 - Fake dashboard metrics or DiceBear avatars
+- Left accent bars / left-hand borderlines on selected rows, list items, cards, or success/error/warn wells (the “colored stroke on the left edge” pattern)
+- Thick one-sided colored borders, glow rails, neon strokes, or gradient borders used as the main state cue
+
+Selection must use radio/checkbox + light row tint (or weight/space) only. Status wells may use a flat tint fill. No `border-left` accent, no inset bar, no vertical rail as decoration. Keep one accent for the primary CTA, not as a row edge.
+
+**Acceptance fixture:** a pick-list row and a “verified” well must pass with **zero** left border accents. If screenshots show a blue/green/amber left stroke, deslop fails.
 
 Copy does not restyle the page. It lists the P0s from the screenshot and sends them to Design.
 

package/examples/next-supabase-installed/.cursor/skills/frontend-design/SKILL.md

@@ -77,7 +77,9 @@ One family, or two that are obviously different (display vs mono). Inter + syste
 - Mobile (~390): the primary CTA still fits above the fold.
 - Hierarchy from size, weight, and space — not from cards.
 - Landing and marketing pages take a full direction. App chrome (settings, tables) stays quiet and dense.
-- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default).
+- Do not mark selection or severity with a left edge stroke. That pattern reads as default AI/SaaS chrome even on flat full-bleed sheets.
+- Prefer: radio + tint, check + tint, or typography/weight. Keep one accent for the primary CTA, not as a row edge.
+- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default); left selection rails; callouts whose only cue is a thick left border.
 
 ## Motion
 

package/examples/next-supabase-installed/.cursor/skills/planning/SKILL.md

@@ -28,4 +28,4 @@ Owner, extra reviewers, required skills, preserved behavior, and required screen
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.”
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small.

package/examples/next-supabase-installed/.cursor/skills/testing-qa/SKILL.md

@@ -18,6 +18,8 @@ Adding or reviewing tests, smoke checks, or regression coverage.
 - Network failure, empty, and error behavior is covered.
 - Gaps are named when infrastructure is missing.
 
+If the change is App Router, Auth/RLS, or a migration, tests must cover those contracts. This skill does not replace `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`, or `owasp-security-review`. Visual proof of a screen still uses `browser-qa`.
+
 ## Visual proof
 
 User-visible screens also require `browser-qa`. This skill does not replace screenshots. Passing `toBeVisible` is not image review.

package/examples/next-supabase-installed/USER_GUIDE.html

@@ -220,12 +220,15 @@
       }
 
       .rule {
-        border-left: 4px solid var(--safelight);
         padding: 0.7rem 0.9rem;
-        background: #1a1814;
+        background: #23160f;
         margin: 0 0 1.4rem;
       }
 
+      .rule strong {
+        color: var(--safelight);
+      }
+
       .steps {
         display: grid;
         gap: 0.85rem;
@@ -763,6 +766,10 @@ npx agent-kit update</pre>
               <td>QA finished from the diff</td>
               <td>Reject it. Re-run with the good QA prompt.</td>
             </tr>
+            <tr>
+              <td>GitHub shows this page as code</td>
+              <td>Open <code>USER_GUIDE.html</code> in a browser, or run <code>npx agent-kit guide</code>. GitHub does not render the layout.</td>
+            </tr>
             <tr>
               <td><code>doctor</code> fails the guide</td>
               <td>The screenshot fail-closed sentence must stay in <code>USER_GUIDE.md</code> and this page.</td>

package/examples/next-supabase-installed/USER_GUIDE.md

@@ -179,5 +179,6 @@ Pristine files refresh. Local edits win or land in `.agent-kit/conflicts/`. Do n
 | Skill not triggering | Mention the skill name (`browser-qa`) or `@` it in Cursor. |
 | No browser in Copilot / Codex | Use the Playwright commands in `browser-qa`. |
 | QA finished from the diff | Reject it. Re-run with the good QA prompt above. |
+| GitHub shows `USER_GUIDE.html` as code | Open the file in a browser. Run `npx agent-kit guide` to print the path. GitHub does not render the layout. |
 | `doctor` fails USER_GUIDE | The screenshot fail-closed sentence must stay in this file. |
 | Still have `QUALITY_GATES.md` / `COUNCIL.md` | Expected. `update` does not delete them. `doctor` lists leftovers. |

package/examples/next-supabase-installed/skills/deslop/SKILL.md

@@ -38,7 +38,7 @@ Second pass: re-read the rewrite. If the same tell remains, rewrite the paragrap
 
 ## Visual P0s — fail if still on screen
 
-These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
+These are the 2026 flat AI/SaaS chrome cluster (same family as accent-border cards, glow rails, and card soup). One is a smell. Two or more is a reject. A pick-list row or status well with a left stroke is already a fail.
 
 - Purple-to-blue (or indigo) gradient hero, or gradient-clipped headline type
 - Inter / Roboto / default shadcn zinc as the whole identity
@@ -48,6 +48,12 @@ These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
 - Acid green or neon vermilion on near-black used as decoration, not meaning
 - Lucide Sparkles / Zap as the product metaphor
 - Fake dashboard metrics or DiceBear avatars
+- Left accent bars / left-hand borderlines on selected rows, list items, cards, or success/error/warn wells (the “colored stroke on the left edge” pattern)
+- Thick one-sided colored borders, glow rails, neon strokes, or gradient borders used as the main state cue
+
+Selection must use radio/checkbox + light row tint (or weight/space) only. Status wells may use a flat tint fill. No `border-left` accent, no inset bar, no vertical rail as decoration. Keep one accent for the primary CTA, not as a row edge.
+
+**Acceptance fixture:** a pick-list row and a “verified” well must pass with **zero** left border accents. If screenshots show a blue/green/amber left stroke, deslop fails.
 
 Copy does not restyle the page. It lists the P0s from the screenshot and sends them to Design.
 

package/examples/next-supabase-installed/skills/frontend-design/SKILL.md

@@ -77,7 +77,9 @@ One family, or two that are obviously different (display vs mono). Inter + syste
 - Mobile (~390): the primary CTA still fits above the fold.
 - Hierarchy from size, weight, and space — not from cards.
 - Landing and marketing pages take a full direction. App chrome (settings, tables) stays quiet and dense.
-- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default).
+- Do not mark selection or severity with a left edge stroke. That pattern reads as default AI/SaaS chrome even on flat full-bleed sheets.
+- Prefer: radio + tint, check + tint, or typography/weight. Keep one accent for the primary CTA, not as a row edge.
+- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default); left selection rails; callouts whose only cue is a thick left border.
 
 ## Motion
 

package/examples/next-supabase-installed/skills/planning/SKILL.md

@@ -28,4 +28,4 @@ Owner, extra reviewers, required skills, preserved behavior, and required screen
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.”
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small.

package/examples/next-supabase-installed/skills/testing-qa/SKILL.md

@@ -18,6 +18,8 @@ Adding or reviewing tests, smoke checks, or regression coverage.
 - Network failure, empty, and error behavior is covered.
 - Gaps are named when infrastructure is missing.
 
+If the change is App Router, Auth/RLS, or a migration, tests must cover those contracts. This skill does not replace `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`, or `owasp-security-review`. Visual proof of a screen still uses `browser-qa`.
+
 ## Visual proof
 
 User-visible screens also require `browser-qa`. This skill does not replace screenshots. Passing `toBeVisible` is not image review.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsforgood/next-supabase-kit",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Agents, skills, and a user guide for Next.js and Supabase projects. QA reviews screenshots, not code alone.",
   "type": "module",
   "repository": {

package/skills/deslop/SKILL.md

@@ -38,7 +38,7 @@ Second pass: re-read the rewrite. If the same tell remains, rewrite the paragrap
 
 ## Visual P0s — fail if still on screen
 
-These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
+These are the 2026 flat AI/SaaS chrome cluster (same family as accent-border cards, glow rails, and card soup). One is a smell. Two or more is a reject. A pick-list row or status well with a left stroke is already a fail.
 
 - Purple-to-blue (or indigo) gradient hero, or gradient-clipped headline type
 - Inter / Roboto / default shadcn zinc as the whole identity
@@ -48,6 +48,12 @@ These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
 - Acid green or neon vermilion on near-black used as decoration, not meaning
 - Lucide Sparkles / Zap as the product metaphor
 - Fake dashboard metrics or DiceBear avatars
+- Left accent bars / left-hand borderlines on selected rows, list items, cards, or success/error/warn wells (the “colored stroke on the left edge” pattern)
+- Thick one-sided colored borders, glow rails, neon strokes, or gradient borders used as the main state cue
+
+Selection must use radio/checkbox + light row tint (or weight/space) only. Status wells may use a flat tint fill. No `border-left` accent, no inset bar, no vertical rail as decoration. Keep one accent for the primary CTA, not as a row edge.
+
+**Acceptance fixture:** a pick-list row and a “verified” well must pass with **zero** left border accents. If screenshots show a blue/green/amber left stroke, deslop fails.
 
 Copy does not restyle the page. It lists the P0s from the screenshot and sends them to Design.
 

package/skills/frontend-design/SKILL.md

@@ -77,7 +77,9 @@ One family, or two that are obviously different (display vs mono). Inter + syste
 - Mobile (~390): the primary CTA still fits above the fold.
 - Hierarchy from size, weight, and space — not from cards.
 - Landing and marketing pages take a full direction. App chrome (settings, tables) stays quiet and dense.
-- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default).
+- Do not mark selection or severity with a left edge stroke. That pattern reads as default AI/SaaS chrome even on flat full-bleed sheets.
+- Prefer: radio + tint, check + tint, or typography/weight. Keep one accent for the primary CTA, not as a row edge.
+- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default); left selection rails; callouts whose only cue is a thick left border.
 
 ## Motion
 

package/skills/planning/SKILL.md

@@ -28,4 +28,4 @@ Owner, extra reviewers, required skills, preserved behavior, and required screen
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.”
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small.

package/skills/testing-qa/SKILL.md

@@ -18,6 +18,8 @@ Adding or reviewing tests, smoke checks, or regression coverage.
 - Network failure, empty, and error behavior is covered.
 - Gaps are named when infrastructure is missing.
 
+If the change is App Router, Auth/RLS, or a migration, tests must cover those contracts. This skill does not replace `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`, or `owasp-security-review`. Visual proof of a screen still uses `browser-qa`.
+
 ## Visual proof
 
 User-visible screens also require `browser-qa`. This skill does not replace screenshots. Passing `toBeVisible` is not image review.