node-api-rules

What it does and when to use it

Shipwright rules and check commands for Node API (Fastify or Express, Prisma, PostgreSQL, Redis, Socket.io). Use when writing, reviewing or auditing code in a project that uses this stack. FR : règles et commandes de vérification pour API Node (Fastify ou Express, Prisma, PostgreSQL, Redis, Socket.io).

How it works

1. Rules
2. Check commands

---
name: node-api-rules
description: "Shipwright rules and check commands for Node API (Fastify or Express, Prisma, PostgreSQL, Redis, Socket.io). Use when writing, reviewing or auditing code in a project that uses this stack. FR : règles et commandes de vérification pour API Node (Fastify ou Express, Prisma, PostgreSQL, Redis, Socket.io)."
---
<!-- Generated by tools/build.py from the referential YAML. Do not edit by hand. -->

# Node API (Fastify or Express, Prisma, PostgreSQL, Redis, Socket.io)

These rules add to the core build skills of Shipwright.

## Rules

- Validation schema on every route (Fastify JSON schema or Zod): body, params, querystring and relevant headers.
- Security plugins: @fastify/helmet, @fastify/rate-limit, @fastify/cors with an explicit origin list (or helmet, express-rate-limit, cors).
- Socket.io: authenticate on connection, validate every incoming event, rate-limit per socket, Redis adapter as soon as there is more than one instance.
- Prisma: migrations with prisma migrate, never db push in production; $queryRaw only with parameters; prisma.$transaction for related writes.
- Redis: password, local binding, keys with expiry for temporary data.
- Structured logs with pino, no personal data; request ID in every log line.
- /health route that checks database and Redis; SIGTERM handling with clean shutdown.

## Check commands

Used by `/sw:audit`. `{pm}` is the project's package manager, `{url}` the app URL, `{host}` its host name.

| Check | Command | Passes if |
| --- | --- | --- |
| typecheck | `{pm} exec tsc --noEmit` | exit code 0 |
| lint | `{pm} run lint` | exit code 0, no errors |
| test_run | `{pm} test` | exit code 0 |
| e2e | `{pm} run test:e2e` | exit code 0 (API tests against a test database) |
| deps_audit | `{pm} audit --audit-level=high` | no high or critical advisory |
| license_check | `npx --yes license-checker-rseidelsohn --summary --failOn 'GPL;AGPL'` | exit code 0 |
| load_test | `npx --yes autocannon -c 100 -d 30 {url}/health` | 0 errors; then repeat on the 3 busiest routes |

Versions

The database has no other skills named node-api-rules.

Database snapshot: 13.11.2026 · package version 5bb0f8f1ebd0 (SHA-256 digest of the entire package)

Downloads in the last 30 days: 0 · ranking

Report a problem with this skill: harmful content, incorrect descriptions or an author’s removal request.

Similar skills

• 90electron-rules
  Shipwright rules and check commands for Electron (desktop app). Use when writing, reviewing or auditing code in a project that uses this stack. FR : règles et commandes de vérification pour Electron (application de bureau).
• 90tauri-rules
  Shipwright rules and check commands for Tauri (desktop app). Use when writing, reviewing or auditing code in a project that uses this stack. FR : règles et commandes de vérification pour Tauri (application de bureau).
• 90master-developer
  Senior full-stack engineering workflow for Next.js, Node/Express, TypeScript, Prisma/PostgreSQL, Redis and Three.js work. Use when building or changing apps, APIs, bots, portfolios or 3D pages; fixing bugs; reviewing security (OWASP Top 10:2025); hardening, testing or deploying.…
• 100senior-backend
  This skill should be used when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load test APIs". Use for Node.js/Express/Fastify…
• 100senior-backend
  Backend development with Node.js/Express/Fastify and PostgreSQL. Use when designing REST or GraphQL APIs, optimizing database queries, implementing authentication, building microservices, handling migrations, or reviewing backend code.
• 90node-typescript-backend
  Build production Node.js/TypeScript backends (Fastify, NestJS, Express): structure, validation, async, errors, config, testing, performance. Use when writing or reviewing Node/TS services or APIs.