Claude Skills by fusebase-dev

Workflow for testing Fusebase API calls interactively using temporary tokens. Use when: 1. You need to verify an API endpoint behavior before writing app code, 2. You want to explore available API responses or schemas, 3. You're unsure how an API endpoint works and need to test it, 4. Debugging API integration issues by making direct calls.

Author, validate, publish, and centrally verify consumer-driven contracts for cross-app API calls. Use when: 1. An app's runtime calls another app via AppApisApi.callAppApi(...), 2. Authoring or editing *.contract.json files, 3. Confirming a provider you depend on still behaves as expected, 4. Checking whether a provider change would break dependent apps.

Guide for adding a backend layer (REST API, WebSockets, cron jobs) to Fusebase Apps apps. Use when: (1) An app needs a server-side API beyond the Dashboard SDK, (2) Adding REST endpoints or WebSocket support, (3) Setting up the backend/ folder structure, (4) Scheduling cron jobs for periodic tasks. The backend is OPTIONAL — only add when the app genuinely requires server-side logic.

Maintain docs/en/business-logic.md in English — human-readable business logic, main user flows, scenarios, and edge cases. Use after domain or workflow code changes, or when revalidating the app during debugging.

Practical guide for building Fusebase Apps apps. Use when: (1) Creating a new app, (2) Setting up project structure, Vite config, or authentication, (3) Building or registering apps, (4) Configuring permissions or public access, (5) Navigating between apps, (6) Fetching user details, (7) Troubleshooting build issues.

Author and run environment-aware Playwright e2e tests for this Fusebase project. Use when: 1. Adding or scaffolding e2e tests (fusebase scaffold --template e2e), 2. Converting a manually verified scenario into a Playwright spec, 3. Running the same test set against dev and prod environments, 4. Wiring test users/fixtures per environment.

Use when drafting a spec/ACs for an app feature, planning or building UI views with filters/search/reports, implementing delete/mutation flows, or reviewing feature work — routes to the cross-project behavioral quality patterns (QP-xx) that recurring consumer-app defects proved necessary (URL reflects view state; deletes define cascade/orphan policy; empty/loading/error states; chevron alignment; double-submit guards...). Patterns become spec ACs by ID and carry copy-ready smoke recipes. Do N...

Guide for implementing client-side routing in Fusebase Apps apps. Use when: 1. Adding routing (React Router) to an app, 2. Fixing broken routes or 404s after deployment, 3. Configuring the router.

Guide for creating and using secrets in Fusebase Apps app backends. Use when: (1) An app backend needs API keys, passwords, or other sensitive config, (2) Creating secrets via the CLI, (3) Accessing secrets at runtime in backend code, (4) Deciding what should be a secret vs. a regular env var.

Guide for managing sidecar containers alongside app backends. Use when: (1) An app backend needs auxiliary services like headless browsers, caches, or other tools, (2) Adding/removing/listing sidecar containers, (3) Configuring sidecar networking, env vars, or resource tiers.

Guidance for visual design, UI and UX in Fusebase-generated apps. Use when building or refining app UIs: pages, components, layouts, forms, feedback states, theming, or accessibility. Ensures consistent, clear, and distinctive interfaces using shadcn/ui.

Use ONLY when a business-logic doc exists — docs/<app>/business-logic-index.md (AI-default retrieval index), docs/<app>/business-logic.md (human narrative), or docs/en/business-logic.md (the app-business-docs canonical for Fusebase CLI teams) — before fixes/improvements that touch business behavior. Treats the documented business logic as a guard layer — the fix must not silently break documented behavior. Pairs with FR-20 zoom-out. If none of these docs exist, this skill does nothing (silent...

Use ONLY when docs/audience.md exists (audiences defined during onboarding) OR the operator explicitly asks to optimize a surface for client-facing vs internal use. Steers app surfaces differently — client-facing = simple/guided/trust-first; internal = robust controls/power-features. If docs/audience.md is absent and the operator did not explicitly request the posture check, this skill does nothing (silent no-op) — do NOT create the file. Not for projects without defined audiences.

Use before commit, deploy, or PR merge, or when operator asks "review this diff" / "is this safe?"; reviews diff vs spec, decisions, maintainability, scope, tests, rollback. Do NOT write or fix code — review only.

Use when writing or editing code, adding/changing comments, or before committing a code diff — delivers FR-22's tripwire + retrieval-pointer comment policy at write time. Do NOT use for prose/doc edits, non-code tickets, or as a review gate (that's `code-review`).

ALWAYS apply — Mode A on operator chat output (visual, concrete, brief), Mode B on internal-artifact writes (dense, tabular, front-loaded). Mandatory at session start, never on-demand; rules stay resident, examples lazy-load from references/.

Use when the operator asks for options, variations, alternatives, product/UI directions, or divergent ideation before a spec or decision is locked. Do NOT use for deterministic edits, post-lock implementation changes, simple bug fixes, or AI Developer invention of new product direction.

Use when debugging an app through `fusebase dev start`, or when you need to inspect browser logs, proxied API traffic, frontend dev server output, or backend output captured by the local CLI. Explains where logs are written and which file to inspect for each symptom. This is for LOCAL DEVELOPMENT only - for deployed apps, use the remote-logs skill instead.

Use before creating, expanding, or revising any AI-consumed documentation artifact (spec, decisions, tasks, verification-gate, handoff, backlog, problem-catalog, product/business-logic docs, project-internal skills). Classifies whether a persistent doc is needed, which tier applies, and how to minimize context cost. Operationalizes FR-23 — documentation budget. Prevents duplicate rationale, narrative padding, and docs created merely because a template exists. Do NOT use for operator chat, sou...

Canonical low-level Fusebase file upload lifecycle and file API guide. Use it when implementing temp -> stored -> display URL flows or building file descriptors for downstream apps.

Use ONLY when the operator runs "/find-wasted-code" (or explicitly asks to "scan the repo for dead-end tool calls / broken links / missing helpers / footgun configs / silent push-through"). Statically scans THIS repo for friction footguns and writes a tracked report to docs/wasted-code/report.md. Manual-trigger ONLY — do NOT auto-invoke; the skill carries disable-model-invocation and no hook wires it. Read-only except the one report write. Findings are review candidates, never auto-fixes. Do ...

Use when the operator runs "/find-wasted-effort" or asks about "wasted effort", "ceremony overhead", "process overhead", "outcome-neutral steps", "are our gate stops worth it", "is the Full lane overkill here", or wants the process-per-outcome sibling of /token-waste-audit. Audits Flow ARTIFACTS ON DISK (gate reports, deploy reports, handoffs, approval artifacts, git log, prevents: annotations) for ceremony that bought no safety outcome — distinct axis from token-waste-audit (tokens-per-rule,...

Complete guide for using the Fusebase CLI (fusebase) tool to initialize, develop, and deploy Fusebase Apps apps. Use when: 1. Initializing new Fusebase Apps projects, 2. Creating or configuring apps, 3. Running apps locally or deploying them 4. Setting up app permissions for dashboards.

How to use MCP for working with FuseBase Project Dashboards during LLM development. Use when: 1. Discovering dashboards, views, and schema via MCP; 2. Reading or updating dashboard data; 3. Working with relations, filters, templates, and child tables; 4. Understanding dashboard/view structure before SDK runtime code; 5. Working with system managed databases — Companies, Deals, Meetings (CRM, pipeline, B2B accounts, seeding demo rows, alias-only discovery).

Use when the operator asks "is Fusebase Flow healthy", "check Fusebase Flow", "did fusebase update break anything", "Fusebase Flow status", "restore Fusebase Flow", or asks whether Fusebase CLI and Fusebase Flow agent files conflict. Runs the read-only health engine, reports layer verdicts (`HEALTHY`, `CLI_LAYER_DRIFT`, `CLI_VERSION_UNSUPPORTED`, `FLOW_LAYER_DRIFT`, `SHARED_MERGE_DRIFT`, `PARTIAL_UPGRADE`, `PUBLISHER_PACKAGING_DRIFT`, `EXCEPTION_IN_EFFECT`, `PARTIAL_UNVERIFIED`, `BROKEN`), an...

How to use MCP for Fusebase Gate. Use when: working with gate contracts, tokens, org user listing, health, or generated MCP tools and prompts.

How to develop apps that interact with Fusebase portals where they are embedded. Use when a task requires showing data based on the current parent portal or listing portal pages where the current app is embedded.

Use when something worked before and is now broken (a regression), or the operator asks "when did this break", "find the commit that caused X", "it used to work", "compare to a previous version". Locates where a regression entered by comparing commits / bisecting history. Do NOT use for net-new bugs that never worked, for routine rollback (workflows/git-discipline.md), or as a substitute for reproduce-before-fix (FR-10).

General Git workflow for generated apps: safe local commits, clean history, and rollback guidance. Includes strict debug/deploy traceability section when git-debug-commits flag is enabled.

Required patterns for auth and session errors in Fusebase Apps: AppTokenValidationError (401) on platform tokens, and backend session probes (/api/account/me) for SaaS apps with httpOnly cookies. Use when implementing auth error handling, AuthExpiredModal, session bootstrap on load, or global API error handlers.

Use when a coding session is getting long, before stopping complex implementation/migration/debugging work, when the operator says "prepare a handoff" / "hand this off" / "continue in a new chat" / "/handoff", or when a long autonomous run needs continuity (Mode run-ledger, announced in chat) — archives the superseded restart state to docs/tmp/handoff/archive/ (paper trail), then writes the active state to docs/tmp/handoff.md so a fresh AI session resumes from the exact current point without ...

Use after spec is drafted to plan implementation; produces decisions, tasks, verification-gate, and implementer handoff. Do NOT write code, do NOT lock decisions on operator's behalf, do NOT run before spec exists.

Build an app-owned account UI — your own sign-up/login form and your own password setup and reset — instead of handing users to platform auth pages and platform emails. Use when the app invites people in (addOrgUser / createAppMagicLink) and they must end up with a password they chose: the invitee sets it inside your form (needsInitialPassword + setFusebaseInitialPassword) and signs in with loginFusebaseUser, no 'Trying to reset your password?' email in the middle.

Use at Specify to classify a ticket Full vs Lightweight after bounded read-only diagnosis, and whenever a change looks ordinary / reversible / low-risk ("small fix", "tweak", "hotfix", "drop pretty-printing", "bump a constant"). Operationalizes FR-21 — ceremony proportional to objective risk. Defines mechanical and semantic assessment, the change-note artifact, one-pass build→verify→deploy, and objective promotion. Sensitive or cross-cutting triggers take the Full lane; an initially unknown c...

Use when launching any long or silent work that could hang — your own probe/script/deploy/fetch-loop/browser-automation, a sub-agent, or a workflow — or when the operator says "the background task hangs", "the agent sits idle", "it never resumes", "is it still running?", or a turn ended waiting on something that never came back. Delivers FR-27's never-launch-bare protocol: bounded/watchdog wrapper, in-turn completion, or BLOCKED-AT return; how to diagnose a suspected hang by activity not 0-by...

Guide on creating connections to third-party services and integrating them into apps. Use when a user requests functionality involving communication with third-party services

After Fusebase Gate MCP tool sessions, produce a concise debug-oriented summary — what went smoothly, what did not, and actionable improvements to fusebase-gate skills, prompts, or MCP server behavior. Prioritize isolated SQL/NoSQL store flows.

Use when planning tasks that touch big source files, when an edit would push a file past the module-size ceiling, when the pre-commit module-size ratchet warns or blocks, or when generating policies/module-size-baseline.txt. Operationalizes FR-25 — module-size ratchet (ceiling default 800; over-ceiling files may shrink, never grow; extraction along a responsibility seam is in-scope, not scope creep). Do NOT use for docs/markdown size (FR-23 owns docs), to force decomposition of an existing mo...

Use when docs/north-star.md exists (the project has been onboarded) OR the operator explicitly asks to check/apply the North Star — steer every task, decision, and fix toward the project's locked vision and flag drift away from it. On the absence path it is a silent no-op by default, with ONE narrow sanctioned output: a single one-time onboarding offer (D5, at most once, only when the operator is clearly doing project work) — so a matcher may load it there for that offer alone. It never creat...

Use when a multi-slice phase has been implemented and the operator wants an independent audit of ALL slices before sign-off, or asks to "audit the phase", "review all slices", "independent check". Spawns a fresh sub-agent that examines every slice against the spec. Do NOT use for a single-diff review (use code-review), for security-only review (use security-permissions-review), or before a phase is implemented.

Use when planning how to structure a product — deciding whether to build one large app or several focused apps. Gives generic decomposition guidance always (reliability + token economy), and steers to the specific app breakdown when docs/<app>/product.md defines one. Do NOT use for single-file edits or for app-internal component structure.

Use when starting a new app and the operator wants product documentation designed before code, OR docs/<app>/product.md exists. Ingests operator research and the North Star, then designs per-app product docs that planning builds from. If no product.md exists and the operator did not ask to create one, this skill does nothing (silent no-op) — do NOT auto-create. Not for mid-implementation edits.

Use when the operator types /product-owner, asks to activate Product Owner, start a Product Owner or PO session, or searches /product in Codex for Fusebase Flow project management. Do NOT use for implementing code; route implementation to the AI Developer role.

Use when the operator wants to set up / optimize THIS project for their vision — onboard the project, capture the North Star, define audience, or run the discovery interview. Triggers on "/onboard", "onboard my project", "set up my project", "capture my vision", "set my north star". Product-Owner-owned. Creates project artifacts (docs/north-star.md, fills AGENTS project-values). Do NOT use for ordinary ticket work, for writing application code, or to auto-run on install — it is operator-trigg...

Use ONLY when verification passed AND operator explicitly says "prepare deploy" / "draft deploy" / "ship it"; drafts deploy handoff, captures deploy hash + probes + smoke, advises spec DRAFT→DONE flip. Do NOT auto-invoke; operator triggers explicitly.

Use when debugging a deployed app backend. Explains how to fetch build logs and runtime logs using the `fusebase remote-logs` command. Only applicable to apps with a backend/ folder. For local development, use dev-debug-logs skill instead.

Use on first Fusebase Flow install, opening an unfamiliar repo, or after major restructuring; produces durable context map (commands, structure, protected paths, risky boundaries). Do NOT use for routine ticket investigation.

Use when operator starts a new ticket ("ship X", "build Y", "add feature", "fix workflow") and no spec exists; produces spec, clarify questions, acceptance criteria. Do NOT use for code edits, mid-flight reorgs, or after a spec is locked.

ALWAYS load at session start; mandatory, never on-demand. After self-attesting, Read references/<role>.md for your role (Product Owner / AI Developer / Architect / Deploy phase) — don't-list + refusal phrasing. Shared-protocol prohibitions and FR-24 digest stay resident; bodies load from references/shared-protocols.md.

Use when changes touch auth, permissions, secrets, env files, deploy config, external messages, data export/import, production DB writes, or customer-visible behavior; surfaces sensitive-path findings + approval-required list. Do NOT use as general code review.