What problem does it solve? Server Actions are reachable from the public internet via forged requests, yet developers often treat them like internal function calls, skipping authentication, input validation, and rate limiting. This Skill enforces a five-layer trust-boundary checklist so every 'use server' function is secured and observable by default. ## Core Features & Use Cases - Five-layer enforcement: Every action applies auth, Zod ingress validation, rate limiting, observability (trace ID plus hashed Sentry user scope), and a pure service call, in that order. - Canonical skeleton and helper pattern: Provides a copy-ready 40-line action template plus guidance on when to extract a defineAction helper after the pattern repeats. - FormData and return-type discipline: Covers typed payloads versus HTML form actions, safe getAll handling for repeated fields, and discriminated-union results instead of thrown errors. - Use Case: When asked to "add a Server Action for canceling a subscription," the Skill produces an action that verifies the session, validates input with Zod, rate-limits per user, logs with a trace ID, and delegates domain logic to a tested service. ## Quick Start Ask the agent to create a Server Action for a specific mutation, such as "add a Server Action that handles the contact form," and it will scaffold the full five-layer implementation.
