Code → PRD
Reverse-engineer any frontend, backend, or fullstack codebase into a complete Product Requirements Document (PRD). Analyzes routes, components, models, APIs, and user interactions to produce business-readable documentation detailed enough for engineers or AI agents to fully reconstruct every page and endpoint.
codebase_analyzer.py for scanning, prd_scaffolder.py for directory generation# Analyze a project and generate PRD skeleton
python3 scripts/codebase_analyzer.py /path/to/project -o analysis.json
python3 scripts/prd_scaffolder.py analysis.json -o prd/ -n "My App"
# Or use the slash command
/code-to-prd /path/to/project
/code-to-prd ./src
# → Scans components, routes, API calls, state management
# → Generates prd/ with per-page docs, enum dictionary, API inventory
/code-to-prd ./myproject
# → Detects Django via manage.py, scans urls.py, views.py, models.py
# → Documents endpoints, model schemas, admin config, permissions
/code-to-prd .
# → Analyzes both app/ pages and api/ routes
# → Generates unified PRD covering UI pages and API endpoints
You are a senior product analyst and technical architect. Your job is to read a frontend codebase, understand every page's business purpose, and produce a complete PRD in product-manager-friendly language.
Your document must describe functionality in non-technical language while omitting zero business details.
| Stack | Frameworks |
|---|---|
| Frontend | React, Vue, Angular, Svelte, Next.js (App/Pages Router), Nuxt, SvelteKit, Remix, Astro |
| Backend | NestJS, Express, Fastify, Django, Django REST Framework, FastAPI, Flask |
| Fullstack | Next.js (API routes + pages), Nuxt (server/ + pages/), Django (views + templates) |
For backend-only projects, the "page" concept maps to API resource groups or admin views. The same 3-phase workflow applies — routes become endpoints, components become controllers/views, and interactions become request/response flows.
Build global context before diving into pages.
Scan the root directory and understand organization:
Frontend directories:
- Pages/routes (pages/, views/, routes/, app/, src/pages/)
- Components (components/, modules/)
- Route config (router.ts, routes.ts, App.tsx route definitions)
- API/service layer (services/, api/, requests/)
- State management (store/, models/, context/)
- i18n files (locales/, i18n/) — field display names often live here
Backend directories (NestJS):
- Modules (src/modules/, src/*.module.ts)
- Controllers (*.controller.ts) — route handlers
- Services (*.service.ts) — business logic
- DTOs (dto/, *.dto.ts) — request/response shapes
- Entities (entities/, *.entity.ts) — database models
- Guards/pipes/interceptors — auth, validation, transformation
Backend directories (Django):
- Apps (*/apps.py, */views.py, */models.py, */urls.py)
- URL config (urls.py, */urls.py)
- Views (views.py, viewsets.py) — route handlers
- Models (models.py) — database schema
- Serializers (serializers.py) — request/response shapes
- Forms (forms.py) — validation and field definitions
- Templates (templates/) — server-rendered pages
- Admin (admin.py) — admin panel configuration
Identify framework from package.json (Node.js frameworks) or project files (manage.py for Django, requirements.txt/pyproject.toml for Python). Routing, component patterns, and state management differ significantly across frameworks — identification enables accurate parsing.
Extract all pages from route config into a complete page inventory:
| Field | Description |
|---|---|
| Route path | e.g. /user/list, /order/:id |
| Page title | From route config, breadcrumbs, or page component |
| Module / menu level | Where it sits in navigation |
| Component file path | Source file(s) implementing this page |
For file-system routing (Next.js, Nuxt), infer from directory structure.
For backend projects, the page inventory becomes an endpoint/resource inventory:
| Field | Description |
|---|---|
| Endpoint path | e.g. /api/users, /api/orders/:id |
| HTTP method | GET, POST, PUT, DELETE, PATCH |
| Controller/view | Source file handling this route |
| Module/app | Which NestJS module or Django app owns it |
| Auth required | Whether authentication/permissions are needed |
For NestJS: extract from @Controller + @Get/@Post/@Put/@Delete decorators.
For Django: extract from urls.py → urlpatterns and viewsets.py → router registrations.
Before analyzing individual pages, capture:
These will be referenced throughout page/endpoint analysis.
Analyze every page in the inventory. Each page produces its own Markdown file.
For each page, answer:
For form pages, list every field:
| Field Name | Type | Required | Default | Validation | Business Description |
|---|---|---|---|---|---|
| Username | Text input | Yes | — | Max 20 chars | System login account |
For table/list pages, list:
Field name extraction priority:
placeholder / label / title propsDescribe as "user action → system response":
[Action] User clicks "Create"
[Response] Modal opens with form fields: ...
[Validation] Name required, phone format check
[API] POST /api/user/create with form data
[Success] Toast "Created successfully", close modal, refresh list
[Failure] Show API error message
Cover all interaction types:
Case 1: API is integrated (real HTTP calls in code)
| API Name | Method | Path | Trigger | Key Params | Notes |
|---|---|---|---|---|---|
| Get users | GET | /api/user/list | Load, search | page, size, keyword | Paginated |
Case 2: API not integrated (mock/hardcoded data)
When the page uses mock data, hardcoded fixtures, setTimeout simulations, or Promise.resolve() stubs — the API isn't real yet. Reverse-engineer the required API spec from page functionality and data shape.
For each needed API, document:
Detection signals:
setTimeout / Promise.resolve() returning data → mock*.mock.* files → mockaxios, fetch, service layer) with real paths → integrated__mocks__ directory → mockCreate prd/ in project root (or user-specified directory):
prd/
├── README.md # System overview
├── pages/
│ ├── 01-user-mgmt-list.md # One file per page
│ ├── 02-user-mgmt-detail.md
│ ├── 03-order-mgmt-list.md
│ └── ...
└── appendix/
├── enum-dictionary.md # All enums, status codes, type mappings
├── page-relationships.md # Navigation map between pages
└── api-inventory.md # Complete API reference
# [System Name] — Product Requirements Document
## System Overview
[2-3 paragraphs: what the system does, business context, primary users]
## Module Overview
| Module | Pages | Core Functionality |
|--------|-------|--------------------|
| User Management | User list, User detail, Role mgmt | CRUD users, assign roles and permissions |
## Page Inventory
| # | Page Name | Route | Module | Doc Link |
|---|-----------|-------|--------|----------|
| 1 | User List | /user/list | User Mgmt | [→](./pages/01-user-mgmt-list.md) |
## Global Notes
### Permission Model
[Summarize auth/role system if present in code]
### Common Interaction Patterns
[Global rules: all deletes require confirmation, lists default to created_at desc, etc.]
# [Page Name]
> **Route:** `/xxx/xxx`
> **Module:** [Module name]
> **Generated:** [Date]
## Overview
[2-3 sentences: core function and use case]
## Layout
[Region breakdown — text description or ASCII diagram]
## Fields
### [Region: e.g. "Search Filters"]
| Field | Type | Required | Options / Enum | Default | Notes |
|-------|------|----------|---------------|---------|-------|
### [Region: e.g. "Data Table"]
| Column | Format | Sortable | Filterable | Notes |
|--------|--------|----------|-----------|-------|
### [Region: e.g. "Actions"]
| Button | Visibility Condition | Behavior |
|--------|---------------------|----------|
## Interactions
### Page Load
[What happens on mount]
### [Scenario: e.g. "Search"]
- **Trigger:** [User action]
- **Behavior:** [System response]
- **Special rules:** [If any]
### [Scenario: e.g. "Create"]
- **Trigger:** ...
- **Modal/drawer content:** [Fields and logic inside]
- **Validation:** ...
- **On success:** ...
## API Dependencies
| API | Method | Path | Trigger | Notes |
|-----|--------|------|---------|-------|
| ... | ... | ... | ... | ... |
## Page Relationships
- **From:** [Source pages + params]
- **To:** [Target pages + params]
- **Data coupling:** [Cross-page refresh triggers]
## Business Rules
[Anything that doesn't fit above]
Don't write "calls useState to manage loading state." Write "search button shows a spinner to prevent duplicate submissions."
Don't write "useEffect fetches on mount." Write "page automatically loads the first page of results on open."
Include technical details only when they directly affect product behavior: API paths (engineers need them), validation rules (affect UX), permission conditions (affect visibility).
Code contains logic PMs may not realize exists:
When code defines enums (status codes, type codes, role types), list every value and its meaning. These are often scattered across constants files, component valueEnum configs, or API response mappers.
If a field or logic's business meaning can't be determined from code (e.g. abbreviated variable names, overly complex conditionals), mark it [TBC] and explain what you observed and why you're uncertain. Never fabricate business meaning.
Each page's Markdown should be standalone — reading just that file gives complete understanding. Use relative links when referencing other pages or appendix entries.
| Page Type | Focus Areas |
|---|---|
| List / Table | Search conditions, columns, row actions, pagination, bulk ops |
| Form / Create-Edit | Every field, validation, interdependencies, post-submit behavior |
| Detail / View | Displayed info, tab/section organization, available actions |
| Modal / Drawer | Describe as part of triggering page — not a separate file. But fully document content |
| Dashboard | Data cards, charts, metrics meaning, filter dimensions, refresh frequency |
| Endpoint Type | Focus Areas |
|---|---|
| CRUD resource | All fields (from DTO/serializer), validation rules, permissions, pagination, filtering, sorting |
| Auth endpoints | Login/register flow, token format, refresh logic, password reset, OAuth providers |
| File upload | Accepted types, size limits, storage destination, processing pipeline |
| Webhook / event | Trigger conditions, payload shape, retry policy, idempotency |
| Background job | Trigger, schedule, input/output, failure handling, monitoring |
| Admin views (Django) | Registered models, list_display, search_fields, filters, inline models, custom actions |
Large projects (>15 pages): Work in batches of 3-5 pages per module. Complete system overview + page inventory first. Output each batch for user review before proceeding.
Small projects (≤15 pages): Complete all analysis in one pass.
| Pitfall | Fix |
|---|---|
| Using component names as page names | UserManagementTable → "User Management List" |
| Skipping modals and drawers | They contain critical business logic — document fully |
| Missing i18n field names | Check translation files, not just component JSX |
| Ignoring dynamic route params | /order/:id = page requires an order ID to load |
| Forgetting permission controls | Document which roles see which buttons/pages |
| Assuming all APIs are real | Check for mock data patterns before documenting endpoints |
| Skipping Django admin customization | admin.py often contains critical business rules (list filters, custom actions, inlines) |
| Missing NestJS guards/pipes | @UseGuards, @UsePipes contain auth and validation logic that affects behavior |
| Ignoring database constraints | Model field constraints (unique, max_length, choices) are validation rules for the PRD |
| Overlooking middleware | Auth middleware, rate limiters, and CORS config define system-wide behavior |
| Script | Purpose | Usage |
|---|---|---|
scripts/codebase_analyzer.py |
Scan codebase → extract routes, APIs, models, enums, structure | python3 codebase_analyzer.py /path/to/project |
scripts/prd_scaffolder.py |
Generate PRD directory skeleton from analysis JSON | python3 prd_scaffolder.py analysis.json |
Recommended workflow:
# 1. Analyze the project (JSON output — works for frontend, backend, or fullstack)
python3 scripts/codebase_analyzer.py /path/to/project -o analysis.json
# 2. Review the analysis (markdown summary)
python3 scripts/codebase_analyzer.py /path/to/project -f markdown
# 3. Scaffold the PRD directory with stubs
python3 scripts/prd_scaffolder.py analysis.json -o prd/ -n "My App"
# 4. Fill in TODO sections page-by-page using the SKILL.md workflow
Both scripts are stdlib-only — no pip install needed.
| File | Contents |
|---|---|
references/prd-quality-checklist.md |
Validation checklist for completeness, accuracy, readability |
references/framework-patterns.md |
Framework-specific patterns for routes, state, APIs, forms, permissions |
This skill was inspired by code-to-prd by @lihanglogan, who proposed the original concept and methodology in PR #368. The core three-phase workflow (global scan → page-by-page analysis → structured document generation) originated from that work. This version was rebuilt from scratch in English with added tooling (analysis scripts, scaffolder, framework reference, quality checklist).