rzyfront/vendix-app-architecture
skills/vendix-app-architecture/SKILL.md
Vendix app environments, public/private web apps, mobile app boundary, and domain/app type resolution. Trigger: When asking about different apps, environments (VENDIX_ADMIN, ORG_ADMIN, STORE_ADMIN, STORE_ECOMMERCE), mobile boundaries, or domain logic.
$ install --global
skillsauthnpx skillsauth add rzyfront/vendix vendix-app-architectureInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 16, 2026, 5:03 AM141.3s1 file scanned
SKILL.md
- name:
- vendix-app-architecture
- description:
- >
- Trigger:
- When asking about different apps, environments (VENDIX_ADMIN, ORG_ADMIN, STORE_ADMIN, STORE_ECOMMERCE), mobile boundaries, or domain logic.
- license:
- Apache-2.0
- author:
- rzyfront
- version:
- 1.0
- scope:
- [root]
Vendix App Architecture
Purpose
Use this skill to understand Vendix app environments and app boundaries. Detailed settings, panel UI, tenant context, and frontend implementation rules live in their specialized skills.
App Map
| App Area | Path | Technology | Scope |
| --- | --- | --- | --- |
| Frontend web | apps/frontend | Angular 20 | Public landing/ecommerce and private admin panels |
| Mobile app | apps/mobile | Expo/React Native | Native/mobile app boundary; detailed mobile skills are a knowledge gap |
| Backend API | apps/backend | NestJS + Prisma | Domain resolution, auth, tenancy, APIs |
Web App Environments
AppType is the canonical app environment concept for the Angular web app. It is synchronized with backend app_type_enum and used by domain_settings.app_type, user_settings.app_type, and frontend app config.
| AppType | Access | User | Typical Route |
| --- | --- | --- | --- |
| VENDIX_LANDING | Public | SaaS visitors | / |
| VENDIX_ADMIN | Private | Vendix super admin | /super-admin/* |
| ORG_LANDING | Public | Organization visitors | / on org domain |
| ORG_ADMIN | Private | Organization owner/admin | /admin/* |
| STORE_LANDING | Public | Store visitors | / on store domain |
| STORE_ADMIN | Private | Store staff/admin | /admin/* |
| STORE_ECOMMERCE | Public/customer | Store customers | /, catalog, cart, checkout |
AppEnvironment exists as a compatibility alias for AppType; prefer AppType in new code.
Domain Resolution
- Frontend web resolves host/app context through
AppConfigServiceand backend domain resolution. app_typedetermines which app environment loads.domain_typeis legacy/categorization and must not be treated as the primary app selector.- Authenticated users may have
user_settings.app_typeto select or restore their preferred admin environment.
Ownership Boundaries
| Concern | Owning Skill |
| --- | --- |
| store_settings / organization_settings structure | vendix-settings-system |
| Branding and settings source of truth | vendix-settings-system / vendix-frontend-theme |
| Sidebar/module visibility through panel_ui | vendix-panel-ui |
| Backend request tenant context | vendix-multi-tenant-context |
| Scoped Prisma access | vendix-prisma-scopes |
| Angular web Signals/Zoneless patterns | vendix-zoneless-signals |
| Expo/React Native implementation | Knowledge gap until mobile-specific skills are created |
Public vs Private Rules
- Public web apps do not require staff/admin JWT for page access, though customer auth may apply to account/checkout features.
- Private admin apps require authentication and role/permission enforcement.
panel_uicontrols visible menu modules only; it is not backend authorization.- Backend permissions and guards remain the source of enforcement for protected operations.
Mobile Boundary
apps/mobile is a real Expo/React Native workspace. Existing frontend web skills describe responsive web behavior, not native mobile behavior. When planning mobile work, mark missing guidance as a knowledge gap and propose a focused mobile skill before standardizing patterns.
Related Skills
vendix-core- Repository-wide architecture mapvendix-settings-system- Settings and branding persistencevendix-panel-ui- Admin module visibilityvendix-multi-tenant-context- Backend tenant contextvendix-zoneless-signals- Angular web implementation rules
Related Skills
rzyfront/mobile-dev
development
VerifiedTrustedCommunity
Mobile app development rules for Vendix Expo/React Native project. Trigger: When editing, creating, or modifying any file under apps/mobile, or when developing mobile-specific features.
5SKILL.mdUpdated May 29, 2026
rzyfront/vendix-subscription-gate
development
VerifiedTrustedCommunity
Feature gating by store subscription state: global store write guard, AI feature gate, Redis feature resolution, quota consumption, frontend paywall interceptor, banner, and subscription UI states. Trigger: When adding feature gates, paywalls, subscription-based access control, protecting store write operations, AI feature gates, or rollout flags.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-saas-billing
testing
VerifiedTrustedCommunity
SaaS subscription billing for Vendix stores: plan pricing, invoices, Wompi platform payments, manual payments, partner commissions, payouts, proration, and dunning. Trigger: When creating SaaS invoices, working with partner rev-share, margin/surcharge pricing, invoice sequence allocation, partner payout batches, subscription payments, manual payments, or dunning flows.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-redis-quota
development
VerifiedTrustedCommunity
Periodic quota counters with Redis, UTC period keys, Lua-based idempotent AI quota consumption, request-id deduplication, and post-success consumption. Trigger: When building quota counters, enforcing monthly/daily feature caps, or reusing AI quota patterns for uploads, emails, exports, or rate-limited features.
5SKILL.mdUpdated May 16, 2026