review-guidelines— agent skill

Additional checks for this codebase:

Code Quality

• Prefer type over interface for type definitions
• Use arrow functions (const fn = () =>) over function declarations
• Use #field (ES2022 private) instead of private field (TypeScript)
• No any types — use unknown with type guards
• No index.ts files (except plugin entry points) — use feature-named re-exports
• Explicit .ts extensions on all local imports
• Object params when >2 args: fn({ a, b, c }: { ... })
• Zod namespace import: import * as z from 'zod'
• Import directly from specific files, not through re-exports within a module

Testing

• Use test() not it() for test declarations
• No conditional assertions — assert the condition first
• Test both branches: try/catch, conditionals, fallbacks
• Prefer real dependencies over mocks for module resolution tests
• Organize with describe() blocks

Bun Runtime

• Bun.file() over fs.existsSync() / readFileSync()
• Bun.write() over writeFileSync()
• Bun.\$\cmd\` over child_process.spawn()`
• import.meta.dir over process.cwd()
• Run commands from repo root with bun --cwd packages/<name> — never cd into packages

Monorepo Specifics

• Use relative paths within packages, not workspace aliases
• Cross-package deps must use exact versions (no ^ or ~)
• Only root bun.lock is committed
• Package directory name must match npm name after @youdotcom-oss/

Security

• Never commit secrets, API keys, or tokens
• Check for OWASP top 10, command injection, XSS
• Verify new dependencies for license compliance
• Watch for ReDoS patterns in regex

Breaking Changes

• Flag any changes to public API signatures
• Check for TSDoc @public markers on modified exports
• Verify backward compatibility of Zod schema changes