Nestjs DocumentationSAFE

A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: nestjs-documentation
description: Automate Swagger/OpenAPI documentation and standardize API response schemas in NestJS. Use when generating OpenAPI specs, documenting paginated or generic responses, configuring the Nest CLI Swagger plugin, or publishing versioned API docs.
metadata:
  triggers:
    files:
    - 'main.ts'
    - '**/*.dto.ts'
    keywords:
    - DocumentBuilder
    - SwaggerModule
    - ApiProperty
    - ApiResponse
---
# OpenAPI & Documentation

## **Priority: P2 (MEDIUM)**


## Workflow

1. **Enable Swagger plugin** in `nest-cli.json` to auto-generate `@ApiProperty` from DTOs.
2. **Annotate controllers** with `@ApiTags`, `@ApiResponse`, and auth decorators.
3. **Create generic wrappers** for paginated and polymorphic responses.
4. **Generate separate docs** for public vs internal audiences.

## Setup

See [implementation examples](references/example.md) for `nest-cli.json` plugin config and Swagger bootstrap.

## Response Documentation

- **Strictness**: Every controller method must `@ApiResponse({ status: 200, type: UserDto })`.
- **Generic Wrappers**: Define `ApiPaginatedResponse<T>` decorators using `ApiExtraModels` + `getSchemaPath()` to handle generics properly.

## Advanced Patterns

- **Polymorphism**: Use `@ApiExtraModels` and `getSchemaPath` for `oneOf`/`anyOf` union types.
- **File Uploads**: Use `@ApiConsumes('multipart/form-data')` with explicit `@ApiBody` schema.
- **Authentication**: Use `@ApiBearerAuth()` or `@ApiSecurity('api-key')` matching `DocumentBuilder` config.
- **Enums**: Force named enums: `@ApiProperty({ enum: MyEnum, enumName: 'MyEnum' })`.

## Operation Grouping

- **Tags**: Mandatory `@ApiTags('domains')` on every Controller.
- **Multiple Docs**: Generate separate docs for different audiences (Public vs Internal).

See [implementation examples](references/example.md)

## Anti-Patterns

- **No missing @ApiResponse**: Every controller method must declare its response type and status code.
- **No /docs in production**: Disable Swagger in production to prevent API schema exposure.
- **No manual @ApiProperty everywhere**: Use Nest CLI Swagger plugin to auto-generate from DTOs.

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.