Production Readiness Checklist

🚨 MANDATORY - Must Pass Before Module Release

1. Security Requirements

• • NO plaintext credentials in code, comments, or logs
• • NO sensitive data in error messages
• • NO API keys hardcoded anywhere
• • NO passwords visible in any form
• • NO PII in logs or test fixtures
• • All credentials from ConnectionProfile only

2. Error Handling

• • All errors use core error types
• • Error messages are helpful but don't leak sensitive info
• • Only log error messages when wrapping into core errors
• • No stack traces exposed to users
• • Proper HTTP status mapping to core errors

3. Code Quality

• • Build passes with exit code 0
• • All tests pass (unit and integration)
• • No lint errors or warnings
• • No TypeScript errors
• • No use of ! (non-null assertion)
• • All mappers use const output: Type pattern

4. Documentation

• • USERGUIDE.md complete with:
  • • How to obtain credentials
  • • Connection profile structure
  • • Required permissions
  • • Troubleshooting section
• • README.md only if special requirements
• • All operations documented in API spec
• • Examples work correctly

5. API Specification

• • All 12 critical rules followed
• • No root-level servers or security
• • All properties camelCase
• • Pagination using standard patterns
• • All operations from original request implemented

6. Implementation

• • ConnectionState.yml if needed (tokens, sessions)
• • All mappers validate required fields
• • PagedResults uses manual assignment
• • No environment variables used
• • Proper type imports from core packages

7. Testing

• • Integration tests prepared (may fail without creds)
• • Unit tests with sanitized fixtures
• • No skipped tests
• • No .only() in tests
• • Test data sanitized (no PII)
• • Read-only operations tested on production when possible

8. Examples

• • Connection example works
• • At least one operation example works
• • Examples use realistic data
• • Examples don't contain real credentials

🟡 WARNINGS - Should Be Fixed

Performance

• • Reasonable timeout values
• • No unnecessary API calls
• • Efficient pagination handling

Maintenance

• • Clear code structure
• • Consistent naming
• • No commented-out code
• • No console.log statements

🟢 NICE TO HAVE

Developer Experience

• • Helpful error messages
• • Clear function names
• • Logical file organization
• • Consistent patterns

Validation Commands

Run these before marking complete:

# Security check
grep -r "password\|secret\|key\|token" src/ --exclude="*.ts"

# Build validation
npm run clean
npm run build

# Test validation
npm run test
npm run test:integration

# Lint check
npm run lint

# Check for console.log
grep -r "console.log" src/

# Check for non-null assertions
grep -r "!" src/ | grep -v "!=" | grep -v "!=="

# Check for skipped tests
grep -r ".skip\|.only" test/

Sign-off Criteria

✅ Module is ready when:

1. •All mandatory items checked
2. •Build and tests pass
3. •Documentation complete
4. •Examples work
5. •No security issues
6. •No breaking changes to existing operations

Important Reminders

• •Never write to production during testing unless explicitly required
• •Never log sensitive data even in development
• •Always validate inputs before using them
• •Always use core error types never generic Error
• •Always follow the rules even if external API doesn't

Logging Policy

What to log:

• •Error messages when wrapping to core errors

What NOT to log:

• •Request/response bodies
• •Headers with auth info
• •Any credentials
• •User data
• •Debug information
• •Performance metrics

No logging for:

• •Health checks
• •Metrics
• •Debug mode
• •Observability

The module should be silent except for errors.