rzyfront/vendix-backend-api
skills/vendix-backend-api/SKILL.md
Vendix backend API endpoint patterns: flat namespaced controllers, DTO-first request validation, ResponseService helpers, pagination responses, and service/controller responsibilities. Trigger: When creating API endpoints.
$ install --global
skillsauthnpx skillsauth add rzyfront/vendix vendix-backend-apiInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 16, 2026, 5:03 AM131.6s1 file scanned
SKILL.md
- name:
- vendix-backend-api
- description:
- >
- Vendix backend API endpoint patterns:
- flat namespaced controllers, DTO-first request
- responsibilities. Trigger:
- When creating API endpoints.
- license:
- MIT
- author:
- rzyfront
- version:
- 2.0
- scope:
- [root]
- auto_invoke:
- Creating API endpoints
Vendix Backend API
Source of Truth
- Controllers under
apps/backend/src/domains/**/**/*.controller.ts apps/backend/src/common/responses/response.service.tsapps/backend/src/common/errors/apps/backend/src/main.ts
Routing Pattern
Current controllers use flat namespaced prefixes such as:
store/...organization/...superadmin/...public/...
Do not document old domains/:domain_id/... route patterns unless you are explicitly working with legacy code.
Controller Rules
- Controllers stay thin: params/query/body DTOs, decorators/guards, one call into a service.
- Services own business logic and Prisma access.
- Use DTOs with global
ValidationPiperather than ad-hoc parsing. - Use
VendixHttpException/ErrorCodeswhen standardized domain errors exist.
ResponseService
ResponseService currently exposes helpers including:
success(data, message?, meta?)paginated(data, total, page, limit, message?)noContent(message?)created(data, message?)updated(data, message?)deleted(message?)
Use the helper that matches the intent rather than always falling back to success().
Pagination Pattern
Paginated services typically return raw data + total + page + limit inputs to the controller/response helper, not a nested { data, meta } structure for ResponseService.paginated().
Related Skills
vendix-backendvendix-validationvendix-error-handlingvendix-backend-auth
Related Skills
rzyfront/mobile-dev
development
VerifiedTrustedCommunity
Mobile app development rules for Vendix Expo/React Native project. Trigger: When editing, creating, or modifying any file under apps/mobile, or when developing mobile-specific features.
5SKILL.mdUpdated May 29, 2026
rzyfront/vendix-subscription-gate
development
VerifiedTrustedCommunity
Feature gating by store subscription state: global store write guard, AI feature gate, Redis feature resolution, quota consumption, frontend paywall interceptor, banner, and subscription UI states. Trigger: When adding feature gates, paywalls, subscription-based access control, protecting store write operations, AI feature gates, or rollout flags.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-saas-billing
testing
VerifiedTrustedCommunity
SaaS subscription billing for Vendix stores: plan pricing, invoices, Wompi platform payments, manual payments, partner commissions, payouts, proration, and dunning. Trigger: When creating SaaS invoices, working with partner rev-share, margin/surcharge pricing, invoice sequence allocation, partner payout batches, subscription payments, manual payments, or dunning flows.
5SKILL.mdUpdated May 16, 2026
rzyfront/vendix-redis-quota
development
VerifiedTrustedCommunity
Periodic quota counters with Redis, UTC period keys, Lua-based idempotent AI quota consumption, request-id deduplication, and post-success consumption. Trigger: When building quota counters, enforcing monthly/daily feature caps, or reusing AI quota patterns for uploads, emails, exports, or rate-limited features.
5SKILL.mdUpdated May 16, 2026