菜单
Use for production NestJS API contract work involving OpenAPI/Swagger, DTO validation, versioning, public error envelopes, guards and policy authorization, rate limiting behind proxies, CORS/helmet/cookie hardening, or file upload boundaries.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Use for NestJS production worker and integration tasks involving microservice transports, hybrid apps, queues, scheduled jobs, cache stores, health checks, structured logging, lifecycle events, shutdown hooks, WebSocket gateways, or non-HTTP Nest runtimes.
Use for Next.js 16 Cache Components and runtime rendering work involving `use cache`, `cacheLife`, `cacheTag`, `updateTag`, Suspense, runtime APIs, Partial Prerendering, remote cache, metadata/viewport runtime access, or migration from older route segment caching configs.
Use for real projects that combine a Next.js frontend/BFF with a NestJS API. Covers ownership boundaries, OpenAPI client generation, session and auth propagation, CORS/proxy contracts, Server Component data fetching, shared environment contracts, and split deployment/runtime alignment.
Use for production Next.js platform work involving Docker or standalone output, static export tradeoffs, self-hosting, deployment adapters, Server Actions encryption keys, shared cache coordination, OpenTelemetry instrumentation, multi-zones, multi-tenant routing, or platform capability reviews.
Use for security-sensitive Next.js backend-for-frontend work involving Route Handlers, Proxy, Server Actions, webhooks, callbacks, data access layers, server-only modules, request validation, rate limits, or public API boundaries. Prefer this skill when a Next.js task exposes HTTP endpoints or moves privileged data across server/client boundaries.
Highest-priority for all NestJS-related tasks involving API engineering. Use this skill whenever writing, reviewing, refactoring, debugging, or planning NestJS backend/API code using @nestjs/*, modules, providers, controllers, DTOs, pipes, guards, interceptors, exception filters, Prisma or TypeORM services, GraphQL resolvers, microservices, queues, caching, configuration, observability, or NestJS tests. Prefer this skill over generic Node.js or backend advice for NestJS code.
| name | nestjs-production-api-contracts |
| description | Use for production NestJS API contract work involving OpenAPI/Swagger, DTO validation, versioning, public error envelopes, guards and policy authorization, rate limiting behind proxies, CORS/helmet/cookie hardening, or file upload boundaries. |
Use this skill when a NestJS API must be stable, documented, secure, and safe to expose to clients. Treat controllers as public contracts and services as internal behavior.
Use this skill when:
Start with this file. Load detailed files only when the task needs them:
references/_sections.md
references/api-openapi-contracts.md
references/api-versioning-error-contracts.md
references/security-policy-guards.md
references/security-rate-limit-proxy.md
references/security-http-hardening.md
references/api-file-upload-boundary.md
dataset/api/openapi-contracts/correct.ts
sources/inventory.json
Each rule file includes:
| Priority | Category | Impact | Prefix |
|---|---|---|---|
| 1 | API Contracts | CRITICAL | api- |
| 2 | Security & Authorization | CRITICAL | security- |
| 3 | Operations | HIGH | ops- |
Prefer official NestJS docs and official package docs for @nestjs/swagger, @nestjs/throttler, and HTTP platform behavior. Do not let generated OpenAPI docs drift from actual DTOs and response behavior.