Cursor rule

1---
2description: "PR review themes — API docs, compatibility, errors, security, tests (CDA SDK)"
3alwaysApply: true
4---
5 
6# Code review checklist (CDA JavaScript SDK)
7 
8Apply when reviewing changes to the **`contentstack`** npm package (Content Delivery API client).
9 
10## Public API & documentation
11 
12- **JSDoc** updated for new or changed public methods/classes (params, return shape, examples), matching style in `src/core/contentstack.js` / `src/core/stack.js`.
13- **`index.d.ts`** updated when TypeScript consumers would see different signatures or new exports.
14 
15## Backward compatibility
16 
17- Avoid breaking changes to exported function signatures, option objects, or default behavior without a major version rationale.
18- If behavior changes, ensure **callers inside `src/`** and tests reflect the new contract.
19 
20## Errors & safety
21 
22- HTTP failures should continue to reject with a predictable shape from **`src/core/lib/request.js`** where applicable (**`error_message`**, **`error_code`**, **`errors`**, **`status`**, **`statusText`**).
23- Do not log full **delivery_token**, **preview_token**, **management_token**, or **api_key** values.
24- Respect **null/undefined** edge cases for optional API fields.
25 
26## Dependencies & supply chain
27 
28- New **dependencies** should be justified (size, maintenance, license).
29- Lockfile and **`package.json`** version bumps should be minimal and reviewable.
30 
31## Tests
32 
33- **Jest** tests for new logic or regressions under **`test/`** (JS and/or **`test/typescript/`** as appropriate).
34- Live stack tests must remain compatible with **`test/config.js`** env requirements; document new env needs in **`test/README.md`** or comments near the harness — never commit credentials.
35 
36## Security & privacy
37 
38- No hardcoded credentials; no accidental exposure of customer content in logs or error messages.
39