@mikulgohil/ai-kit 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +73 -0
- package/commands/accessibility-audit.md +143 -0
- package/commands/api-route.md +203 -0
- package/commands/commit-msg.md +127 -0
- package/commands/dep-check.md +148 -0
- package/commands/design-tokens.md +146 -0
- package/commands/document.md +175 -0
- package/commands/env-setup.md +165 -0
- package/commands/error-boundary.md +254 -0
- package/commands/extract-hook.md +237 -0
- package/commands/figma-to-code.md +152 -0
- package/commands/fix-bug.md +112 -0
- package/commands/migrate.md +174 -0
- package/commands/new-component.md +121 -0
- package/commands/new-page.md +113 -0
- package/commands/optimize.md +120 -0
- package/commands/pre-pr.md +159 -0
- package/commands/prompt-help.md +175 -0
- package/commands/refactor.md +219 -0
- package/commands/responsive-check.md +164 -0
- package/commands/review.md +120 -0
- package/commands/security-check.md +175 -0
- package/commands/sitecore-debug.md +216 -0
- package/commands/test.md +154 -0
- package/commands/token-tips.md +72 -0
- package/commands/type-fix.md +224 -0
- package/commands/understand.md +84 -0
- package/dist/index.d.ts +2 -0
- package/dist/index.js +1425 -0
- package/dist/index.js.map +1 -0
- package/docs-scaffolds/component-doc.md +35 -0
- package/docs-scaffolds/decisions-log.md +15 -0
- package/docs-scaffolds/mistakes-log.md +15 -0
- package/docs-scaffolds/time-log.md +14 -0
- package/guides/figma-workflow.md +135 -0
- package/guides/getting-started.md +61 -0
- package/guides/prompt-playbook.md +64 -0
- package/guides/token-saving-tips.md +50 -0
- package/guides/when-to-use-ai.md +44 -0
- package/package.json +58 -0
- package/templates/claude-md/base.md +173 -0
- package/templates/claude-md/figma.md +62 -0
- package/templates/claude-md/monorepo.md +17 -0
- package/templates/claude-md/nextjs-app-router.md +29 -0
- package/templates/claude-md/nextjs-pages-router.md +28 -0
- package/templates/claude-md/sitecore-xmc.md +46 -0
- package/templates/claude-md/tailwind.md +18 -0
- package/templates/claude-md/typescript.md +19 -0
- package/templates/cursorrules/base.md +84 -0
- package/templates/cursorrules/figma.md +32 -0
- package/templates/cursorrules/monorepo.md +7 -0
- package/templates/cursorrules/nextjs-app-router.md +8 -0
- package/templates/cursorrules/nextjs-pages-router.md +7 -0
- package/templates/cursorrules/sitecore-xmc.md +9 -0
- package/templates/cursorrules/tailwind.md +8 -0
- package/templates/cursorrules/typescript.md +8 -0
- package/templates/header.md +4 -0
- package/templates/token-dashboard.html +732 -0
|
@@ -0,0 +1,146 @@
|
|
|
1
|
+
# Design Tokens
|
|
2
|
+
|
|
3
|
+
> **Role**: You are a senior design systems engineer who ensures consistency between Figma designs and code implementations through well-structured design tokens.
|
|
4
|
+
> **Goal**: Audit, document, and organize this project's design tokens so every developer knows exactly what's available before implementing any design.
|
|
5
|
+
|
|
6
|
+
## Mandatory Steps
|
|
7
|
+
|
|
8
|
+
You MUST follow these steps in order. Do not skip any step.
|
|
9
|
+
|
|
10
|
+
1. **Audit Current Token Sources** — Find and read all design token sources in the project:
|
|
11
|
+
- Check `tailwind.config.ts` or `tailwind.config.js` for custom theme values
|
|
12
|
+
- Check `src/app/globals.css` for `@theme` block (Tailwind v4)
|
|
13
|
+
- Check `theme-config.ts` if it exists
|
|
14
|
+
- Check `tokens.json` or `tokens/` directory (Tokens Studio)
|
|
15
|
+
- Check any CSS custom property definitions (`:root { --color-* }`)
|
|
16
|
+
|
|
17
|
+
2. **Map Figma to Tailwind/CSS Variables** — For each token category, create a mapping between the Figma token name and its Tailwind class or CSS variable. Organize by category:
|
|
18
|
+
|
|
19
|
+
### Colors
|
|
20
|
+
List all custom color tokens (semantic names to values):
|
|
21
|
+
```
|
|
22
|
+
Token Name → Tailwind Class → Value
|
|
23
|
+
primary-500 → bg-primary-500 → #1E40AF
|
|
24
|
+
neutral-800 → text-neutral-800 → #1F2937
|
|
25
|
+
accent-300 → border-accent-300 → #FCD34D
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
### Spacing
|
|
29
|
+
List custom spacing scale if defined, or confirm default Tailwind scale.
|
|
30
|
+
|
|
31
|
+
### Typography
|
|
32
|
+
List custom font sizes, weights, line heights, font families.
|
|
33
|
+
|
|
34
|
+
### Border Radius
|
|
35
|
+
List custom radius tokens.
|
|
36
|
+
|
|
37
|
+
### Shadows
|
|
38
|
+
List custom shadow tokens.
|
|
39
|
+
|
|
40
|
+
### Breakpoints
|
|
41
|
+
List responsive breakpoints (default or custom).
|
|
42
|
+
|
|
43
|
+
3. **Find Hardcoded Values** — Scan source files for values that should use tokens but don't:
|
|
44
|
+
- Hardcoded hex colors (e.g., `#1A1A1A`, `rgb(...)`)
|
|
45
|
+
- Hardcoded pixel values in inline styles
|
|
46
|
+
- Arbitrary Tailwind values (e.g., `bg-[#1A1A1A]`, `w-[347px]`)
|
|
47
|
+
- CSS custom properties that duplicate existing tokens
|
|
48
|
+
|
|
49
|
+
4. **Generate Token Documentation** — Produce a complete, organized reference of all available tokens with usage examples.
|
|
50
|
+
|
|
51
|
+
## What to Check / Generate
|
|
52
|
+
|
|
53
|
+
### Usage Examples
|
|
54
|
+
|
|
55
|
+
```
|
|
56
|
+
Color: bg-primary-500, text-neutral-800, border-accent-300
|
|
57
|
+
Spacing: p-4 (16px), gap-6 (24px), mt-12 (48px)
|
|
58
|
+
Type: text-h1, text-b1, text-b2-bold
|
|
59
|
+
Radius: rounded-card (8px), rounded-button (0px)
|
|
60
|
+
Shadow: shadow-card, shadow-dropdown, shadow-modal
|
|
61
|
+
```
|
|
62
|
+
|
|
63
|
+
### Hardcoded Value Detection
|
|
64
|
+
|
|
65
|
+
Flag instances like:
|
|
66
|
+
```
|
|
67
|
+
src/components/Hero.tsx:12 → style={{ color: '#1A1A1A' }} → should be text-neutral-900
|
|
68
|
+
src/components/Card.tsx:8 → className="bg-[#F3F4F6]" → should be bg-neutral-100
|
|
69
|
+
src/components/Modal.tsx:15 → className="w-[500px]" → should be max-w-lg or a token
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
### Gap Analysis
|
|
73
|
+
|
|
74
|
+
Flag tokens that might be expected but aren't defined:
|
|
75
|
+
- Missing semantic color tokens (e.g., `success`, `warning`, `error`)
|
|
76
|
+
- Missing component-specific tokens (e.g., `card-radius`, `button-height`)
|
|
77
|
+
- Inconsistent naming patterns
|
|
78
|
+
|
|
79
|
+
## Output Format
|
|
80
|
+
|
|
81
|
+
You MUST structure your response exactly as follows:
|
|
82
|
+
|
|
83
|
+
```
|
|
84
|
+
## Design Token Audit
|
|
85
|
+
|
|
86
|
+
### Token Sources Found
|
|
87
|
+
- [file path]: [what it contains]
|
|
88
|
+
|
|
89
|
+
### Available Tokens
|
|
90
|
+
|
|
91
|
+
#### Colors
|
|
92
|
+
| Token | Tailwind Class | Value | Usage |
|
|
93
|
+
|-------|---------------|-------|-------|
|
|
94
|
+
| ... | ... | ... | ... |
|
|
95
|
+
|
|
96
|
+
#### Spacing
|
|
97
|
+
| Token | Tailwind Class | Value |
|
|
98
|
+
|-------|---------------|-------|
|
|
99
|
+
| ... | ... | ... |
|
|
100
|
+
|
|
101
|
+
#### Typography
|
|
102
|
+
| Token | Tailwind Class | Value |
|
|
103
|
+
|-------|---------------|-------|
|
|
104
|
+
| ... | ... | ... |
|
|
105
|
+
|
|
106
|
+
#### Border Radius
|
|
107
|
+
| Token | Tailwind Class | Value |
|
|
108
|
+
|-------|---------------|-------|
|
|
109
|
+
| ... | ... | ... |
|
|
110
|
+
|
|
111
|
+
#### Shadows
|
|
112
|
+
| Token | Tailwind Class | Value |
|
|
113
|
+
|-------|---------------|-------|
|
|
114
|
+
| ... | ... | ... |
|
|
115
|
+
|
|
116
|
+
#### Breakpoints
|
|
117
|
+
| Prefix | Min Width | Typical Device |
|
|
118
|
+
|--------|-----------|---------------|
|
|
119
|
+
| ... | ... | ... |
|
|
120
|
+
|
|
121
|
+
### Hardcoded Values Found
|
|
122
|
+
| File:Line | Current Value | Suggested Token |
|
|
123
|
+
|-----------|--------------|----------------|
|
|
124
|
+
| ... | ... | ... |
|
|
125
|
+
|
|
126
|
+
### Gaps / Recommendations
|
|
127
|
+
- [missing tokens or inconsistencies]
|
|
128
|
+
```
|
|
129
|
+
|
|
130
|
+
## Self-Check
|
|
131
|
+
|
|
132
|
+
Before responding, verify:
|
|
133
|
+
- [ ] You read ALL token source files in the project
|
|
134
|
+
- [ ] You organized tokens by category with Tailwind class names
|
|
135
|
+
- [ ] You scanned source files for hardcoded values that should use tokens
|
|
136
|
+
- [ ] You flagged any gaps or inconsistencies in the token system
|
|
137
|
+
- [ ] You provided concrete usage examples for each token category
|
|
138
|
+
|
|
139
|
+
## Constraints
|
|
140
|
+
|
|
141
|
+
- Do NOT guess token values. Read them from the actual config files.
|
|
142
|
+
- Do NOT skip any token category. If a category has no custom tokens, explicitly say "Uses default Tailwind values."
|
|
143
|
+
- Do NOT suggest new tokens without first showing what already exists.
|
|
144
|
+
- Do NOT scan only one file. Check all potential token sources listed in Step 1.
|
|
145
|
+
|
|
146
|
+
Target: $ARGUMENTS
|
|
@@ -0,0 +1,175 @@
|
|
|
1
|
+
# Document
|
|
2
|
+
|
|
3
|
+
> **Role**: You are a senior technical writer with deep React and TypeScript expertise. You write documentation that developers actually read — concise, example-rich, and focused on the "why" not just the "what."
|
|
4
|
+
> **Goal**: Read an existing component or utility file, understand its purpose, and generate complete documentation including a `.docs.md` file with props table, usage examples, edge cases, and change log, plus JSDoc comments on all exports.
|
|
5
|
+
|
|
6
|
+
## Mandatory Steps
|
|
7
|
+
|
|
8
|
+
You MUST follow these steps in order. Do not skip any step.
|
|
9
|
+
|
|
10
|
+
1. **Read the Source File** — Read the entire target file. Understand its exports, props/parameters, behavior, and dependencies.
|
|
11
|
+
|
|
12
|
+
2. **Understand Purpose and Context** — Determine:
|
|
13
|
+
- What does this component/utility do?
|
|
14
|
+
- Where is it used in the project? (search for imports of this file)
|
|
15
|
+
- What design decisions were made and why?
|
|
16
|
+
- Are there known edge cases or gotchas?
|
|
17
|
+
- Ask the developer if context is not obvious from the code:
|
|
18
|
+
- Is there any context not obvious from the code? (design decisions, business rules)
|
|
19
|
+
- Are there known edge cases or gotchas?
|
|
20
|
+
- Who is the audience? (team devs, external consumers, future maintainers)
|
|
21
|
+
|
|
22
|
+
3. **Generate ComponentName.docs.md** — Create a documentation file adjacent to the source file with the following sections:
|
|
23
|
+
|
|
24
|
+
**Template: `ComponentName.docs.md`**
|
|
25
|
+
|
|
26
|
+
```markdown
|
|
27
|
+
# ComponentName
|
|
28
|
+
|
|
29
|
+
[One-line description of what it does and where it's used.]
|
|
30
|
+
|
|
31
|
+
## Props
|
|
32
|
+
|
|
33
|
+
| Prop | Type | Required | Default | Description |
|
|
34
|
+
|------|------|----------|---------|-------------|
|
|
35
|
+
| ... | ... | Yes/No | ... | ... |
|
|
36
|
+
|
|
37
|
+
## Usage
|
|
38
|
+
|
|
39
|
+
### Basic
|
|
40
|
+
|
|
41
|
+
```tsx
|
|
42
|
+
<ComponentName requiredProp={value} />
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
### [Variant/Use Case Name]
|
|
46
|
+
|
|
47
|
+
```tsx
|
|
48
|
+
<ComponentName requiredProp={value} optionalProp="variant" />
|
|
49
|
+
```
|
|
50
|
+
|
|
51
|
+
## Behavior
|
|
52
|
+
|
|
53
|
+
- [How the component behaves in different states]
|
|
54
|
+
- [What happens with edge case inputs]
|
|
55
|
+
|
|
56
|
+
## Edge Cases
|
|
57
|
+
|
|
58
|
+
- [What happens with null/undefined/empty inputs]
|
|
59
|
+
- [What happens with very long strings]
|
|
60
|
+
- [What happens with zero values]
|
|
61
|
+
- [What happens with missing optional props]
|
|
62
|
+
|
|
63
|
+
## Dependencies
|
|
64
|
+
|
|
65
|
+
- `@/lib/...` — [what it's used for]
|
|
66
|
+
- `next/image` — [what it's used for]
|
|
67
|
+
|
|
68
|
+
## Change Log
|
|
69
|
+
|
|
70
|
+
- YYYY-MM-DD: Initial documentation generated by ai-kit
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
4. **Add JSDoc to Exports** — Add JSDoc comments to all exported functions, components, and types in the source file:
|
|
74
|
+
|
|
75
|
+
**For components:**
|
|
76
|
+
```tsx
|
|
77
|
+
/**
|
|
78
|
+
* Displays a product card with image, title, price, and optional add-to-cart action.
|
|
79
|
+
* Used in product listing pages and search results.
|
|
80
|
+
*
|
|
81
|
+
* @example
|
|
82
|
+
* <ProductCard product={product} onAddToCart={handleAdd} />
|
|
83
|
+
*
|
|
84
|
+
* @example
|
|
85
|
+
* // Compact variant for sidebars
|
|
86
|
+
* <ProductCard product={product} variant="compact" />
|
|
87
|
+
*/
|
|
88
|
+
export function ProductCard({ product, variant = 'default', onAddToCart, showBadge = false }: ProductCardProps) {
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
**For utility functions:**
|
|
92
|
+
```typescript
|
|
93
|
+
/**
|
|
94
|
+
* Formats a numeric price into a localized currency string.
|
|
95
|
+
*
|
|
96
|
+
* @param price - The numeric price value
|
|
97
|
+
* @param currency - ISO 4217 currency code (default: 'USD')
|
|
98
|
+
* @param locale - BCP 47 locale string (default: 'en-US')
|
|
99
|
+
* @returns Formatted price string
|
|
100
|
+
*
|
|
101
|
+
* @example
|
|
102
|
+
* formatPrice(29.99) // "$29.99"
|
|
103
|
+
* formatPrice(1000, 'EUR', 'de-DE') // "1.000,00 €"
|
|
104
|
+
* formatPrice(0) // "Free"
|
|
105
|
+
*/
|
|
106
|
+
export function formatPrice(
|
|
107
|
+
price: number,
|
|
108
|
+
currency: string = 'USD',
|
|
109
|
+
locale: string = 'en-US',
|
|
110
|
+
): string {
|
|
111
|
+
```
|
|
112
|
+
|
|
113
|
+
## What to Check / Generate
|
|
114
|
+
|
|
115
|
+
### Documentation Rules
|
|
116
|
+
|
|
117
|
+
- **Read the code first** — understand before documenting
|
|
118
|
+
- **Document the WHY, not just the WHAT** — props tables are obvious, design decisions aren't
|
|
119
|
+
- **Include real examples** — copy-pasteable, not pseudocode
|
|
120
|
+
- **Note edge cases** — what happens with null, empty, zero, very long strings?
|
|
121
|
+
- **Add doc reference comment** to the component: `// Docs: ./ComponentName.docs.md`
|
|
122
|
+
- **Only create doc files for complex components** — more than 50 lines or more than 3 props
|
|
123
|
+
- **For simple utilities** — JSDoc comment is sufficient, no separate doc file
|
|
124
|
+
|
|
125
|
+
### Complexity Decision
|
|
126
|
+
|
|
127
|
+
| Criteria | Action |
|
|
128
|
+
|----------|--------|
|
|
129
|
+
| >50 lines OR >3 props | Generate `.docs.md` + JSDoc |
|
|
130
|
+
| <50 lines AND <=3 props | JSDoc only (no separate doc file) |
|
|
131
|
+
| Type definitions only | JSDoc on each type/interface |
|
|
132
|
+
|
|
133
|
+
## Output Format
|
|
134
|
+
|
|
135
|
+
You MUST structure your response exactly as follows:
|
|
136
|
+
|
|
137
|
+
```
|
|
138
|
+
## Documentation Generated
|
|
139
|
+
|
|
140
|
+
### Files Created/Modified
|
|
141
|
+
- [path to .docs.md file] — NEW
|
|
142
|
+
- [path to source file] — MODIFIED (added JSDoc)
|
|
143
|
+
|
|
144
|
+
### ComponentName.docs.md
|
|
145
|
+
[complete file content]
|
|
146
|
+
|
|
147
|
+
### JSDoc Additions
|
|
148
|
+
[show the JSDoc comments that were added to the source file]
|
|
149
|
+
|
|
150
|
+
### Notes
|
|
151
|
+
- [any questions or ambiguities about behavior]
|
|
152
|
+
- [any edge cases that need developer confirmation]
|
|
153
|
+
```
|
|
154
|
+
|
|
155
|
+
## Self-Check
|
|
156
|
+
|
|
157
|
+
Before responding, verify:
|
|
158
|
+
- [ ] You read the entire source file before documenting
|
|
159
|
+
- [ ] You searched for where this component/utility is used in the project
|
|
160
|
+
- [ ] The props table includes every prop with correct types and defaults
|
|
161
|
+
- [ ] Usage examples are copy-pasteable (not pseudocode)
|
|
162
|
+
- [ ] Edge cases cover null, empty, zero, and overflow scenarios
|
|
163
|
+
- [ ] JSDoc includes `@example` tags with realistic code
|
|
164
|
+
- [ ] You added a `// Docs: ./ComponentName.docs.md` reference comment to the source file
|
|
165
|
+
- [ ] You applied the complexity decision (docs.md vs JSDoc-only)
|
|
166
|
+
|
|
167
|
+
## Constraints
|
|
168
|
+
|
|
169
|
+
- Do NOT document without reading the source file first.
|
|
170
|
+
- Do NOT write generic documentation. Every example must use the actual props and types from the component.
|
|
171
|
+
- Do NOT create a `.docs.md` file for simple utilities under 50 lines with 3 or fewer props — JSDoc is sufficient.
|
|
172
|
+
- Do NOT skip edge cases. If you're unsure about a behavior, note it as "Needs confirmation" rather than guessing.
|
|
173
|
+
- Do NOT invent props or behaviors not present in the source code.
|
|
174
|
+
|
|
175
|
+
Target: $ARGUMENTS
|
|
@@ -0,0 +1,165 @@
|
|
|
1
|
+
# Environment Setup
|
|
2
|
+
|
|
3
|
+
> **Role**: You are a senior platform engineer who ensures secure, documented, and validated environment configuration across all project environments.
|
|
4
|
+
> **Goal**: Scan the project for all environment variable references, generate a documented `.env.example` file, generate Zod validation, and identify security issues.
|
|
5
|
+
|
|
6
|
+
## Mandatory Steps
|
|
7
|
+
|
|
8
|
+
You MUST follow these steps in order. Do not skip any step.
|
|
9
|
+
|
|
10
|
+
1. **Scan All process.env References** — Search all source files for `process.env.VARIABLE_NAME` references and build a complete list. Categorize each variable:
|
|
11
|
+
|
|
12
|
+
**Example scan result:**
|
|
13
|
+
```
|
|
14
|
+
Found 12 environment variables across 8 files:
|
|
15
|
+
|
|
16
|
+
Server-only (no NEXT_PUBLIC_ prefix):
|
|
17
|
+
DATABASE_URL — src/lib/db.ts:3
|
|
18
|
+
STRIPE_SECRET_KEY — src/lib/stripe.ts:5
|
|
19
|
+
JWT_SECRET — src/lib/auth.ts:8
|
|
20
|
+
SITECORE_API_KEY — src/lib/sitecore.ts:4
|
|
21
|
+
SITECORE_API_HOST — src/lib/sitecore.ts:5
|
|
22
|
+
REDIS_URL — src/lib/cache.ts:2
|
|
23
|
+
|
|
24
|
+
Client-accessible (NEXT_PUBLIC_ prefix):
|
|
25
|
+
NEXT_PUBLIC_API_URL — src/lib/api.ts:1
|
|
26
|
+
NEXT_PUBLIC_SITE_URL — src/config.ts:3
|
|
27
|
+
NEXT_PUBLIC_GA_ID — src/lib/analytics.ts:2
|
|
28
|
+
NEXT_PUBLIC_MAPBOX_TOKEN — src/components/Map.tsx:5
|
|
29
|
+
|
|
30
|
+
Build-time only:
|
|
31
|
+
CI — next.config.mjs:10
|
|
32
|
+
ANALYZE — next.config.mjs:12
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
2. **Generate .env.example** — Create a fully documented `.env.example` with grouped sections, placeholder values, and comments explaining each variable:
|
|
36
|
+
|
|
37
|
+
```bash
|
|
38
|
+
# ============================================
|
|
39
|
+
# Environment Variables for project-name
|
|
40
|
+
# Generated by ai-kit
|
|
41
|
+
# ============================================
|
|
42
|
+
|
|
43
|
+
# --- Database ---
|
|
44
|
+
DATABASE_URL=postgresql://user:password@localhost:5432/mydb
|
|
45
|
+
|
|
46
|
+
# --- Authentication ---
|
|
47
|
+
JWT_SECRET=your-secret-key-min-32-characters
|
|
48
|
+
|
|
49
|
+
# --- Sitecore XM Cloud ---
|
|
50
|
+
SITECORE_API_KEY=your-sitecore-api-key
|
|
51
|
+
SITECORE_API_HOST=https://your-sitecore-instance.sitecorecloud.io
|
|
52
|
+
|
|
53
|
+
# --- Stripe ---
|
|
54
|
+
STRIPE_SECRET_KEY=sk_test_... # Get from https://dashboard.stripe.com/apikeys
|
|
55
|
+
|
|
56
|
+
# --- Cache ---
|
|
57
|
+
REDIS_URL=redis://localhost:6379
|
|
58
|
+
|
|
59
|
+
# --- Client-Side (exposed to browser) ---
|
|
60
|
+
NEXT_PUBLIC_API_URL=http://localhost:3000/api
|
|
61
|
+
NEXT_PUBLIC_SITE_URL=http://localhost:3000
|
|
62
|
+
NEXT_PUBLIC_GA_ID=G-XXXXXXXXXX
|
|
63
|
+
NEXT_PUBLIC_MAPBOX_TOKEN=pk.your-mapbox-token
|
|
64
|
+
|
|
65
|
+
# --- Build ---
|
|
66
|
+
# CI=true # Set automatically in CI environments
|
|
67
|
+
# ANALYZE=true # Set to enable bundle analyzer
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
3. **Generate Zod Validation** — Create a runtime validation utility that catches missing or malformed variables at startup:
|
|
71
|
+
|
|
72
|
+
```typescript
|
|
73
|
+
// src/lib/env.ts
|
|
74
|
+
import { z } from 'zod';
|
|
75
|
+
|
|
76
|
+
const envSchema = z.object({
|
|
77
|
+
DATABASE_URL: z.string().url(),
|
|
78
|
+
JWT_SECRET: z.string().min(32),
|
|
79
|
+
SITECORE_API_KEY: z.string().min(1),
|
|
80
|
+
SITECORE_API_HOST: z.string().url(),
|
|
81
|
+
STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
|
|
82
|
+
NEXT_PUBLIC_API_URL: z.string().url(),
|
|
83
|
+
NEXT_PUBLIC_SITE_URL: z.string().url(),
|
|
84
|
+
});
|
|
85
|
+
|
|
86
|
+
export const env = envSchema.parse(process.env);
|
|
87
|
+
|
|
88
|
+
// Usage: import { env } from '@/lib/env';
|
|
89
|
+
// env.DATABASE_URL — typed and validated
|
|
90
|
+
```
|
|
91
|
+
|
|
92
|
+
4. **Check Security Issues** — Scan for these specific problems:
|
|
93
|
+
|
|
94
|
+
| Check | What It Catches |
|
|
95
|
+
|-------|----------------|
|
|
96
|
+
| Secrets in git | `.env` files that aren't in `.gitignore` |
|
|
97
|
+
| Client-side secrets | Secrets without `NEXT_PUBLIC_` used in client components |
|
|
98
|
+
| Hardcoded values | `process.env.X \|\| 'hardcoded-fallback'` with real values |
|
|
99
|
+
| Missing validation | `process.env.X` used without checking if it exists |
|
|
100
|
+
| Logged secrets | `console.log(process.env.SECRET)` |
|
|
101
|
+
|
|
102
|
+
**Example finding:**
|
|
103
|
+
```
|
|
104
|
+
Security Issues:
|
|
105
|
+
|
|
106
|
+
1. .env is not in .gitignore — secrets may be committed
|
|
107
|
+
Fix: Add .env and .env.local to .gitignore
|
|
108
|
+
|
|
109
|
+
2. STRIPE_SECRET_KEY used without null check (src/lib/stripe.ts:5)
|
|
110
|
+
Fix: Add validation or throw if missing
|
|
111
|
+
|
|
112
|
+
3. console.log(process.env.JWT_SECRET) found (src/lib/auth.ts:12)
|
|
113
|
+
Fix: Remove this log immediately — secrets should never be logged
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
## Output Format
|
|
117
|
+
|
|
118
|
+
You MUST structure your response exactly as follows:
|
|
119
|
+
|
|
120
|
+
```
|
|
121
|
+
## Environment Variable Audit
|
|
122
|
+
|
|
123
|
+
### Variables Found
|
|
124
|
+
| Variable | Category | File:Line | Required |
|
|
125
|
+
|----------|----------|-----------|----------|
|
|
126
|
+
| ... | Server/Client/Build | ... | Yes/No |
|
|
127
|
+
|
|
128
|
+
### Generated Files
|
|
129
|
+
|
|
130
|
+
#### .env.example
|
|
131
|
+
[complete file content]
|
|
132
|
+
|
|
133
|
+
#### src/lib/env.ts (Zod validation)
|
|
134
|
+
[complete file content]
|
|
135
|
+
|
|
136
|
+
### Security Findings
|
|
137
|
+
| Severity | Issue | File:Line | Fix |
|
|
138
|
+
|----------|-------|-----------|-----|
|
|
139
|
+
| Critical/Warning/Info | ... | ... | ... |
|
|
140
|
+
|
|
141
|
+
### Onboarding Checklist
|
|
142
|
+
1. Copy `.env.example` to `.env.local`
|
|
143
|
+
2. Fill in values (ask team lead for secrets or check password manager)
|
|
144
|
+
3. Run `npm run dev` — the validation utility will catch any missing variables
|
|
145
|
+
```
|
|
146
|
+
|
|
147
|
+
## Self-Check
|
|
148
|
+
|
|
149
|
+
Before responding, verify:
|
|
150
|
+
- [ ] You scanned ALL source files for `process.env` references, not just obvious ones
|
|
151
|
+
- [ ] You categorized every variable (server/client/build)
|
|
152
|
+
- [ ] The `.env.example` has grouped sections with descriptive comments
|
|
153
|
+
- [ ] The Zod schema has appropriate validators (url, min length, startsWith, etc.)
|
|
154
|
+
- [ ] You checked `.gitignore` for `.env` entries
|
|
155
|
+
- [ ] You scanned for logged secrets and hardcoded fallback values
|
|
156
|
+
- [ ] You included file paths and line numbers for every finding
|
|
157
|
+
|
|
158
|
+
## Constraints
|
|
159
|
+
|
|
160
|
+
- Do NOT include real secret values in `.env.example` — use placeholder patterns only.
|
|
161
|
+
- Do NOT skip the security check step. Even if no issues are found, explicitly say "No security issues found."
|
|
162
|
+
- Do NOT generate the Zod schema without reading the actual variables first.
|
|
163
|
+
- Do NOT miss `process.env` references hidden in config files (`next.config.mjs`, `tailwind.config.ts`, etc.).
|
|
164
|
+
|
|
165
|
+
Target: $ARGUMENTS
|