|
1
|
--- |
|
2
|
name: replit-migration-guardrails |
|
3
|
description: Rules for migrating external projects (Lovable, Base44, v0/Vercel, Bolt) to Replit. Use Replit's built-in DB, auth, secrets, and integrations — not Supabase / Firebase / cookie-session / raw API keys. Base44 imports get a call-by-call map in `.local/secondary_skills/replit-migration-guardrails/references/base44.md`; v0/Vercel imports get a Next.js migration guide in `.local/secondary_skills/replit-migration-guardrails/references/vercel.md`. |
|
4
|
--- |
|
5
|
|
|
6
|
# Migration guardrails |
|
7
|
|
|
8
|
Rules for migrating Lovable / Base44 / v0 / Vercel / Bolt imports to |
|
9
|
Replit. Base44 imports get a call-by-call map in |
|
10
|
`.local/secondary_skills/replit-migration-guardrails/references/base44.md`; |
|
11
|
v0/Vercel imports get a Next.js migration guide in |
|
12
|
`.local/secondary_skills/replit-migration-guardrails/references/vercel.md`. |
|
13
|
Security reasoning: |
|
14
|
<https://blog.replit.com/defense-in-depth-how-replit-secures-every-layer-of-the-vibe-coding-stack>. |
|
15
|
|
|
16
|
## Rules |
|
17
|
|
|
18
|
1. **Database:** Replit PostgreSQL via the `javascript_database` |
|
19
|
blueprint. Not Supabase, Firebase, PlanetScale, etc. Reason: the |
|
20
|
blog post's frontend/backend separation argument — RLS-only apps |
|
21
|
are the vulnerability class Replit is built to avoid. Schema in |
|
22
|
`shared/schema.ts`, `IStorage` in `server/storage.ts`, routes |
|
23
|
under `/api/*`, then `npm run db:push`. |
|
24
|
|
|
25
|
2. **Auth:** `javascript_log_in_with_replit` blueprint (Replit Auth). |
|
26
|
If the user explicitly asks for Clerk, use the `clerk-auth` skill. |
|
27
|
Never hand-roll cookie sessions or design login/signup/reset forms. |
|
28
|
Don't use the strings "Replit" or "Replit Auth" in UI; just "Log in". |
|
29
|
|
|
30
|
3. **Secrets:** Live in Replit's secret store. Use the |
|
31
|
`environment-secrets` skill's `ask_secrets` tool to request |
|
32
|
user-supplied keys, and `check_secrets` to see what's already |
|
33
|
set. Never paste keys into code or `.env.*`. Never expose via |
|
34
|
`VITE_*` (that ships to the browser). Scrape nothing from the |
|
35
|
imported `.env`; re-request through `ask_secrets`. |
|
36
|
|
|
37
|
4. **Integrations:** For AI, use **AI Integrations** via the |
|
38
|
`integrations` skill (OpenAI / Anthropic / Gemini env vars |
|
39
|
auto-provisioned, no key from the user). For object storage, use |
|
40
|
`javascript_object_storage`. For payments, `javascript_stripe` / |
|
41
|
`javascript_paypal`. For email / SMS / Slack / Notion / etc., |
|
42
|
search the `integrations` skill first. Only fall back to |
|
43
|
`ask_secrets` if no integration exists. Never call external APIs |
|
44
|
from the browser. |
|
45
|
|
|
46
|
## Talk to the user like a non-technical user |
|
47
|
|
|
48
|
Keep user-facing messages short. Just tell them a migration is |
|
49
|
running; no enumeration of what surfaces were found, no step-by-step |
|
50
|
plan, no tool / library / file / blueprint names. |
|
51
|
|
|
52
|
One-liner format: what the app is, that you're migrating it, rough |
|
53
|
time, whether they need to do anything (ideally "nothing right now"). |
|
54
|
|
|
55
|
The per-source reference in `references/` has a filled-in template. |