production-ready

Production Ready

Orchestrate production-readiness setup for web applications.

When to Prompt

Ask user about production readiness when they request to build:

• A web application or API without specifying "demo", "prototype", or "quick"
• Something they'll "deploy" or "launch"
• Anything described as "real", "actual", or for "users"

Prompt example:

Would you like this to be production-ready? This includes:

• Authentication with protected routes
• Observability (tracing, metrics)
• Security hardening
• Structured logging
• Performance testing setup

I can set these up as we build, or you can add them later.

If user says yes, apply the workflow below.

Production Readiness Workflow

1. Framework Detection

Detect or ask for the framework:

• Next.js - Look for next.config.js, app/ or pages/
• Express - Look for express in package.json
• Go - Look for go.mod
• React SPA - Look for vite.config.js or CRA setup

2. Backend/Database Selection

Ask if not specified:

What database/backend will you use?

• Supabase (recommended for full-stack)
• PostgreSQL with Prisma
• MongoDB
• Other

If Supabase selected → Use Supabase Auth instead of framework-specific auth.

3. Apply Component Skills

Apply each skill in order:

Step 1: Authentication (auth skill)

• Set up auth provider based on framework + backend
• Configure protected routes
• Generate auth middleware
• Create .env.example for auth secrets

Step 2: Security (security skill)

• Run dependency audit
• Apply security headers
• Add rate limiting
• Add input validation patterns

Step 3: Observability (observability skill)

Ask user:

Which observability provider would you prefer?

• OpenTelemetry (vendor-neutral, recommended)
• Datadog
• New Relic
• Dynatrace

Then:

• Install and configure SDK
• Add automatic instrumentation
• Set up custom spans for key operations
• Configure metrics

Step 4: Logging (logging skill)

• Set up structured JSON logging
• Configure log levels
• Add request context propagation
• Redact sensitive data