BeforeMerge: Fullstack Architecture Review

Code review knowledge base for DRY/SOLID layered architecture in fullstack TypeScript applications. Contains rules across 4 categories — security, performance, architecture, and quality — prioritized by impact. Framework-agnostic principles illustrated with Next.js + Supabase examples.

When to Apply

Reference these rules when:

Reviewing pull requests for fullstack TypeScript projects
Designing or refactoring service/repository layers
Auditing API routes for proper separation of concerns
Building new features following clean architecture principles
Running pre-merge quality checks on layered codebases

Rule Categories by Priority

Priority	Category	Impact	Prefix	Focus
1	Security	CRITICAL	`sec-`	Thin controllers, rate limiting, CSRF, error handling
2	Performance	HIGH	`perf-`	Parallel fetching, minimal client components, streaming
3	Architecture	CRITICAL-MEDIUM	`arch-`	SOLID patterns, dependency direction, layered design
4	Quality	MEDIUM-HIGH	`qual-`	DRY, consistency, logging, discoverability

How to Use

Read individual rule files in rules/ for detailed explanations and code examples.

Each rule contains:

Brief explanation of why it matters
Incorrect code example with explanation
Correct code example with explanation
CWE/OWASP mapping where applicable
References to official documentation

For the complete compiled guide: AGENTS.md

Architecture

Security(4)

Keep API Route Handlers Thin — Delegate to Services

Architecture(7)

Dependency Direction Violation

Quality(5)

Extract Duplicated Logic After Third Occurrence

Performance(4)

Keep 'use client' on the Smallest Possible Leaf Components

Automate Architecture checks on every PR

Validate CSRF Tokens on All State-Changing Requests

Rate Limit Every API Route with Appropriate Buckets

Never Expose Raw Errors or Stack Traces to Clients

Missing Repository Abstraction

Missing Service Layer

Segregate Repository Interfaces by Consumer Need

Build Features Bottom-Up from Domain to Presentation

Domain Entities Must Be Framework-Independent

Missing Factory for Dependency Injection

Extract Duplicated Logic After the Third Occurrence

Use Consistent ServiceResult Type for All Service Returns

Use Scoped Loggers with Structured Context

Search Existing Code Before Creating New Utilities

Prefer Server Components Over useEffect + Fetch for Data Loading

Use Promise.all for Independent Data Fetches

Stream Slow Content with Suspense Boundaries

BeforeMerge: Fullstack Architecture Review

When to Apply

Rule Categories by Priority

How to Use