# Phase 1 — Full Audit (Token-Efficient)

## Files Inspected
- `src/app/page.tsx` — Homepage
- `src/app/layout.tsx` — Root layout
- `src/app/products/page.tsx` — Static product listing
- `src/app/shop/[category]/page.tsx` — Dynamic shop page
- `src/app/fitness-planner/page.tsx` — Fitness planner
- `src/app/api/products/route.ts` — Product API
- `src/app/api/categories/route.ts` — Categories API
- `src/app/api/admin/auth/login/route.ts` — Admin login
- `src/app/api/admin/auth/verify/route.ts` — Admin verify
- `src/app/api/admin/config/route.ts` — Site config API
- `src/app/api/admin/audit/route.ts` — Audit API
- `src/app/api/fitness/workout/route.ts` — Workout generator
- `src/app/api/fitness/meals/route.ts` — Meal generator
- `src/app/api/analytics/track/route.ts` — Analytics
- `src/app/api/contact/route.ts` — Contact form
- `src/app/api/orders/route.ts` — Orders
- `src/middleware.ts` — Auth middleware
- `src/lib/db.ts` — Database layer
- `src/lib/auth.ts` — Auth utilities
- `src/lib/password.ts` — Password utilities (DUPLICATE)
- `src/lib/config.ts` — Site config
- `src/lib/email.ts` — Email/SMTP
- `src/components/ProductCard.tsx` — Product card
- `src/components/Providers.tsx` — Context providers
- `src/context/WishlistContext.tsx` — Wishlist
- `src/context/AnalyticsContext.tsx` — Analytics
- `admin/layout.tsx` — Admin layout
- `admin/page.tsx` — Admin dashboard
- `admin/AdminDashboardClient.tsx` — Dashboard client
- `admin/login/page.tsx` — Admin login
- `admin/products/page.tsx` — Product management

## Bugs/Errors
1. **`src/app/products/page.tsx`** — Static hardcoded data, not using DB. Broken links use `#` hrefs.
2. **`src/app/api/orders/route.ts`** — Uses `crypto.randomUUID()` without importing `crypto` (will crash at runtime).
3. **`src/app/api/admin/config/route.ts`** — Auth check is commented out, anyone can modify site config.
4. **`src/app/page.tsx`** — Duplicate `w-full` class on nav element (line 13).
5. **`src/app/fitness-planner/page.tsx`** — `handleOptionSelect` for single-select options auto-advances but also calls `nextStep()` in setTimeout, causing potential double-advance.

## Broken Routes
- `src/app/products/page.tsx` — Bottom nav links all point to `#` (dead links)
- No `/discover` route exists despite being referenced in nav

## Structural Issues
1. **Duplicate admin directories**: `admin/` (root) AND `src/app/admin/` — both serve admin pages
2. **Duplicate auth logic**: `src/lib/auth.ts` has `hashPassword`/`comparePassword` AND `src/lib/password.ts` has identical functions
3. **No modular separation**: All API logic is inline in route handlers, no controllers/services layer
4. **Tight coupling**: DB queries mixed with business logic in route handlers
5. **No SEO infrastructure**: No `robots.txt`, no `sitemap.xml`, minimal metadata

## Security Vulnerabilities
1. **Hardcoded JWT secret fallback**: `'marich-wellness-admin-secret-key-2026'` in both `middleware.ts` and `lib/auth.ts`
2. **No rate limiting** on any API endpoint
3. **Error message exposure**: All API routes return `error.message` directly to client
4. **Admin config API unprotected**: Auth check commented out
5. **No input sanitization** on product CRUD API
6. **SQL injection potential**: Though using parameterized queries, some dynamic SQL construction
7. **OTP in dev mode**: OTP code returned in API response in development

## Scraping Risks
1. **No robots.txt** — crawlers have no guidance
2. **No rate limiting** — automated scrapers can hit APIs freely
3. **Product API** returns all products without pagination limits
4. **Analytics API** accepts unauthenticated writes

## Performance Issues
1. **No lazy loading** on images in shop pages
2. **Inline editor script** (~200 lines) in layout.tsx loads on every page
3. **No caching headers** on API responses
4. **Large inline styles** via dangerouslySetInnerHTML

## Redundant Files
1. `src/lib/password.ts` — Duplicate of functions in `src/lib/auth.ts`
2. `admin/` root directory — Duplicate of `src/app/admin/`
3. `src/app/products/page.tsx` — Static page, superseded by `src/app/shop/[category]/`
4. `Design Templates/` directory — Not used in production
5. `scratch/` directory — Dev scripts, not needed in production
6. Various root-level scripts: `build-pages.js`, `build-ui.js`, `fix-subscribe.js`, `rename.js`, `setup_admin.js`, `setup_db.js`, `universal_seed.js`, `universal_seed.ts`, `update_schema.js`, `update-home.js`

## Modularization Opportunities
1. Move API route logic to `src/lib/services/` (productService, fitnessService, etc.)
2. Create `src/lib/security/` for rate limiting, sanitization, validation middleware
3. Create `src/lib/seo/` for sitemap generation, metadata utilities
4. Consolidate admin into single location
5. Extract shared UI patterns into reusable components

---

# Phase 2 — Modular Plan (Token-Efficient)

## File Structure Improvements
```
src/
├── lib/
│   ├── services/           # Business logic
│   │   ├── productService.ts
│   │   ├── fitnessService.ts
│   │   └── adminService.ts
│   ├── security/           # Security middleware
│   │   ├── rateLimit.ts
│   │   ├── sanitize.ts
│   │   └── validate.ts
│   └── seo/                # SEO utilities
│       ├── sitemap.ts
│       └── metadata.ts
├── middleware.ts           # Keep, enhance with rate limiting
```

## Security Improvements
1. Move JWT secret to env-only (remove fallback)
2. Add rate limiting middleware
3. Uncomment auth check in admin config API
4. Sanitize all API inputs
5. Return generic error messages (not `error.message`)
6. Add robots.txt

## SEO Infrastructure
1. Create `public/robots.txt`
2. Create `src/app/sitemap.xml/route.ts` (dynamic sitemap)
3. Add metadata to all pages
4. Add JSON-LD schema for products

## Performance Plan
1. Remove inline editor script from layout (or lazy-load)
2. Add image lazy loading
3. Clean up redundant files
4. Remove Design Templates/ and scratch/ from production

---

# Phase 3 — Implementation Order (Token-Efficient)

1. **Security first**: Rate limiting, JWT secret, sanitization, error messages
2. **SEO**: robots.txt, sitemap.xml, metadata
3. **Cleanup**: Remove redundant files, consolidate admin
4. **Bug fixes**: Products page, orders API, homepage nav
5. **Modular structure**: Extract services
6. **Admin enhancements**: Product fields, AI SEO generator
7. **Fitness planner fixes**: Logic bugs, stability
8. **Performance**: Lazy loading, remove inline scripts