hopeoverture

Adds comprehensive accessibility testing to CI/CD pipelines using axe-core Playwright integration or pa11y-ci. Automatically generates markdown reports for pull requests showing WCAG violations with severity levels, affected elements, and remediation guidance. This skill should be used when implementing accessibility CI checks, adding a11y tests to pipelines, generating accessibility reports, enforcing WCAG compliance, automating accessibility scans, or setting up PR accessibility gates. Trigger terms include a11y ci, accessibility pipeline, wcag ci, axe-core ci, pa11y ci, accessibility reports, a11y automation, accessibility gate, compliance check.

Generate Zod schemas and TypeScript types for forms, API routes, and Server Actions with runtime validation. Use this skill when creating API contracts, validating request/response payloads, generating form schemas, adding input validation to Server Actions or route handlers, or ensuring type safety across client-server boundaries. Trigger terms include zod, schema, validation, API contract, form validation, type inference, runtime validation, parse, safeParse, input validation, request validation, Server Action validation.

This skill should be used when the user requests to audit, check, or generate authentication and authorization protection for Next.js routes, server components, API routes, and server actions. It analyzes existing routes for missing auth checks and generates protection logic based on user roles and permissions. Trigger terms include auth check, route protection, protect routes, secure endpoints, auth middleware, role-based routes, authorization check, api security, server action security, protect pages.

This skill should be used when the user requests to generate, create, or configure Content Security Policy (CSP) headers for Next.js applications to prevent XSS attacks and control resource loading. It analyzes the application to determine appropriate CSP directives and generates configuration via next.config or middleware. Trigger terms include CSP, Content Security Policy, security headers, XSS protection, generate CSP, configure CSP, strict CSP, nonce-based CSP, CSP directives.

Generates comprehensive changelogs from Conventional Commits, maintains CHANGELOG.md files, and scaffolds project documentation like PRD.md or ADR.md. This skill should be used when creating changelogs, generating release notes, maintaining version history, documenting architectural decisions, or scaffolding project requirements documentation. Use for changelog generation, release notes, version documentation, ADR, PRD, or technical documentation.

Validate environment configuration files across local, staging, and production environments. Ensure required secrets, database URLs, API keys, and public variables are properly scoped and set. Use this skill when setting up environments, validating configuration, checking for missing secrets, auditing environment variables, ensuring proper scoping of public vs private vars, or troubleshooting environment issues. Trigger terms include env, environment variables, secrets, configuration, .env file, environment validation, missing variables, config check, NEXT_PUBLIC, env vars, database URL, API keys.

This skill should be used when setting up code quality tooling with ESLint v9 flat config, Prettier formatting, Husky git hooks, lint-staged pre-commit checks, and GitHub Actions CI lint workflow. Apply when initializing linting, adding code formatting, configuring pre-commit hooks, setting up quality gates, or establishing lint CI checks for Next.js or React projects.

Adds feature flag support using LaunchDarkly or JSON-based configuration to toggle features in UI components and Server Actions. This skill should be used when implementing feature flags, feature toggles, progressive rollouts, A/B testing, or gating functionality behind configuration. Use for feature flags, feature toggles, LaunchDarkly integration, progressive rollout, canary releases, or conditional features.

Build out an organization with member hierarchy, internal politics, resources, secret plots, rivals, and operational details. Use when user wants to "flesh out a guild", "expand an organization", or "detail a faction".

Expand a historical era or event with detailed timeline, key figures, artifacts, witnesses still living, and consequences that echo to the present. Use when user wants to "detail this war", "expand this age", or "develop this event's history".

Fill a region with villages, landmarks, encounters, local legends, travel hazards, and points of interest. Use when user wants to "flesh out a region", "populate an area", or "detail a territory".

Deep-dive into a settlement, generating NPCs, shops, taverns, districts, local issues, rumors, and daily life details. Use when user wants to "flesh out a city", "populate a town", or "add NPCs to a settlement".

Generate deep cultural elements for a people, nation, or species - festivals, customs, taboos, cuisine, art, coming-of-age rituals, death rites, and social norms. Use when user wants to "create culture for", "define customs of", or "flesh out traditions".

Generate economic systems including trade routes, resource nodes, merchant guilds, black markets, price variations, and commercial relationships. Use when user wants to add "trade routes", "economy", "commerce", or "merchant networks" to a world.

Generate political systems including alliance webs, active conflicts, treaties, succession crises, and power brokers. Use when user wants to add "political intrigue", "alliances", "faction conflict", or "power dynamics" to a world.

Generate adventure hooks, quest lines, and story seeds tied to existing world entities. Creates bounties, mysteries, faction missions, and personal quests. Use when user wants "quest ideas", "adventure hooks", "story seeds", or "mission board" content.

Add authentication and authorization to routes, Server Actions, and API endpoints using Supabase Auth. Use when user needs "protect [route]", "add authentication", "require login", "add RBAC", "implement login/logout", or mentions auth, permissions, OAuth, API keys. Provides patterns for protected routes, Server Action auth checks, role-based access control (5 roles), OAuth providers (Google, GitHub), email verification, password strength, account lockout, and API key authentication. Do NOT use when building new features (use worldcrafter-feature-builder which can add auth), database-only changes (use worldcrafter-database-setup for RLS policies), routes without auth (use worldcrafter-route-creator), or testing only (use worldcrafter-test-generator).

Create database tables with Prisma ORM, migrations, and RLS policies. Use when user needs "create database table", "add [model] model", "set up RLS", "create migration", "store data in database", or "design schema". Generates Prisma models with proper naming conventions, creates migrations, sets up Row-Level Security policies, and syncs test database. Includes WorldCrafter patterns for relationships, tags, comments, activity logs, versions, world membership, collections, wiki pages, and bookmarks. Typically the FIRST skill for new features. Do NOT use for UI/forms (use worldcrafter-feature-builder), simple routes (use worldcrafter-route-creator), tests only (use worldcrafter-test-generator), or auth logic only (use worldcrafter-auth-guard).

Build complete features with Server Actions, forms, Zod validation, database CRUD operations, and comprehensive tests. Use when user requests "add a feature", "build a [feature]", "create [feature] with forms", or needs end-to-end implementation with validation and testing. Scaffolds pages, actions, schemas, loading/error states, and unit/integration/E2E tests. Supports multi-step wizards, image uploads, markdown editing, custom JSON attributes, and relationship management. Do NOT use for simple static pages (use worldcrafter-route-creator), database-only changes (use worldcrafter-database-setup), testing existing code (use worldcrafter-test-generator), or auth-only additions (use worldcrafter-auth-guard).

Scaffold Next.js App Router routes for simple pages without forms or complex logic. Use when user needs "create a page", "add route", "add about/contact/terms page", "create API endpoint", "add layout", or mentions SSE/webhooks. Generates page, layout, loading, error, and not-found files with boilerplate. Best for static content, read-only pages, and API endpoints (REST, SSE, webhooks). Do NOT use for forms with validation (use worldcrafter-feature-builder), complete features with database (use worldcrafter-feature-builder), database-only changes (use worldcrafter-database-setup), or comprehensive testing (use worldcrafter-test-generator).

Meta-skill for selecting correct WorldCrafter skill. Use when unclear which skill to use, request maps to multiple skills, need to orchestrate skills, user asks for guidance, or ambiguous requests need clarification. Provides decision trees and trigger matching for feature-builder (complete features with forms), database-setup (tables/migrations/RLS), test-generator (add tests), route-creator (simple pages/APIs), auth-guard (authentication/authorization), ai-assistant (AI generation/suggestions/consistency), visualization (maps/timelines/graphs), and chatgpt-setup (MCP integration). Do NOT use when request clearly maps to one skill or trigger phrases clearly indicate specific skill.

Generate comprehensive tests following three-layer pyramid - unit (Vitest), integration (real database), E2E (Playwright). Use when user needs "add tests", "improve coverage", "test [feature]", "write E2E tests", "generate test factory", or mentions testing auth, forms, database, AI features, visualizations, real-time collaboration, performance, accessibility, or import/export. Provides templates and patterns for 80%+ coverage including AI mocking, chart testing, WebSocket testing, and Page Object Models. Do NOT use when building new features (use worldcrafter-feature-builder which includes tests), database-only changes (use worldcrafter-database-setup), or simple routes (use worldcrafter-route-creator).