skills/vendix-monorepo-workspaces/SKILL.md
Monorepo workspaces, dependency placement, Docker, and CI/CD patterns for Vendix. Trigger: When installing dependencies, modifying package.json, adding/removing workspaces, creating Dockerfiles, or configuring CI/CD.
npx skillsauth add rzyfront/vendix vendix-monorepo-workspacesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Use this skill for npm workspaces, dependency placement, app package boundaries, Docker build contexts, and CI/CD commands. Architecture ownership belongs to vendix-core.
| Workspace | Path | Notes |
| --- | --- | --- |
| Backend | apps/backend | NestJS API with its own dependencies and Dockerfiles |
| Frontend web | apps/frontend | Angular app with its own dependencies and Dockerfiles |
| Mobile | apps/mobile | Expo/React Native app with its own dependencies |
| Shared types | libs/shared-types | Local package consumed by apps, e.g. @vendix/shared-types |
Root package.json orchestrates scripts and workspaces. Production/runtime dependencies should normally live in the workspace that imports them. Root dependencies should be treated as exceptions and reviewed before adding more; the current repo already has at least one root runtime exception, so do not assume dependencies is empty.
apps/mobile.# Install all workspaces from root
npm install
# Install in a specific workspace
npm install <package> -w apps/frontend
npm install <package> -w apps/backend
npm install <package> -w apps/mobile
# Run workspace scripts
npm run start -w apps/frontend
npm run start:dev -w apps/backend
npm run start -w apps/mobile
# Root orchestration scripts
npm run dev
npm run mobile:start
npm run mobile:ios
npm run mobile:android
Do not run production build commands unless the human explicitly requests production verification; use buildcheck-dev for normal development verification.
apps/backend/Dockerfile.dev and apps/frontend/Dockerfile.dev./app/node_modules.Current compose services include db, redis, backend, frontend, nginx, and docker-cleanup.
# Start development services
docker compose up -d
# Rebuild services after Dockerfile/package changes
docker compose up --build -d
# Stop services
docker compose down
Prefer the root docker scripts already present in package.json when useful: docker:up, docker:rebuild, docker:down, docker:down-v.
Use buildcheck-dev for log-based verification after development changes.
When adding a workspace:
apps/ or libs/ so root workspaces detect it.package.json with accurate dependencies.When removing a workspace:
npm install from root to update the lockfile.package.json did not gain unnecessary production dependencies.docker-compose.yml../skills/skill-sync/assets/sync.sh and ./skills/setup.sh --sync after skill metadata changes.vendix-core - Architecture map and app boundariesbuildcheck-dev - Development verificationvendix-zoneless-signals - Frontend web build-sensitive patternsdevelopment
Mobile app development rules for Vendix Expo/React Native project. Trigger: When editing, creating, or modifying any file under apps/mobile, or when developing mobile-specific features.
development
Feature gating by store subscription state: global store write guard, AI feature gate, Redis feature resolution, quota consumption, frontend paywall interceptor, banner, and subscription UI states. Trigger: When adding feature gates, paywalls, subscription-based access control, protecting store write operations, AI feature gates, or rollout flags.
testing
SaaS subscription billing for Vendix stores: plan pricing, invoices, Wompi platform payments, manual payments, partner commissions, payouts, proration, and dunning. Trigger: When creating SaaS invoices, working with partner rev-share, margin/surcharge pricing, invoice sequence allocation, partner payout batches, subscription payments, manual payments, or dunning flows.
development
Periodic quota counters with Redis, UTC period keys, Lua-based idempotent AI quota consumption, request-id deduplication, and post-success consumption. Trigger: When building quota counters, enforcing monthly/daily feature caps, or reusing AI quota patterns for uploads, emails, exports, or rate-limited features.