| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 0 | 3 | 2 | 0% |
| Commands | 0 | 1 | 3 | 0% |
| Section tags | 0 | 2 | 2 | 0% |
What each file covers
Sections
0 shared · 3 only in A · 2 only in B- − Agent setup
- − Common tasks
- − Reference
- + API Service
- + API Service Conventions
Commands
0 shared · 1 only in A · 3 only in B- − pnpm install
- + pnpm start:api:dev
- + npm run lint:openapi
- + npm run migration -- ./migrations/<path>.ts
Section tags
0 shared · 2 only in A · 2 only in B- − setup
- − agent-behaviour
- + code-style
- + api
Line diff
novuhq/novu · .deepsec/AGENTS.md
@@ −1 @@
1# Agent setup
2
3This is a deepsec scanning workspace. Each registered project has its
4own setup prompt at `data/<id>/SETUP.md` — open the relevant one when
5asked to set a project up.
6
7## Common tasks
8
9- **Set up a project for scanning**: read `data/<id>/SETUP.md` and
10 follow it (read `node_modules/deepsec/SKILL.md`, then fill
11 `data/<id>/INFO.md` from the target codebase).
12- **Add a new project**: run `deepsec init-project <root>` — it
13 scaffolds `data/<id>/` and prints/writes the setup prompt for the
14 new project.
15- **Write a custom matcher** (only after a real true-positive shows you
16 a pattern worth keeping): read
17 `node_modules/deepsec/dist/docs/writing-matchers.md`.
18
19## Reference
20
21The deepsec skill is at `node_modules/deepsec/SKILL.md` (after
22`pnpm install`). The full docs ship at
23`node_modules/deepsec/dist/docs/`.
24
novuhq/novu · .cursor/rules/api.mdc
@@ +1 @@
1---
2description: Rules for working in the API service (NestJS backend)
3globs: apps/api/**/*
4alwaysApply: false
5---
6
7## API Service
8
9**Stack:** NestJS + Express · MongoDB (via `libs/dal`) · Redis + Bull · ClickHouse (analytics/traces) · Clerk or Better Auth · `@nestjs/swagger`
10
11**Run:** `pnpm start:api:dev` — port 3000, OpenAPI at `http://localhost:3000/openapi`
12
13**Tests/lint:** see testing.mdc
14
15**Key directories:**
16```
17apps/api/src/app/ # Route controllers and modules
18apps/api/src/ee/ # Enterprise-only features
19apps/api/migrations/ # MongoDB migrations
20apps/api/migrations/clickhouse-migrations/ # ClickHouse schema migrations
21```
22
23---
24
25### API Service Conventions
26
27**Controllers**
28- Every protected route must use `@RequireAuthentication()`.
29- Routes accessible via user API keys or the official SDK must also use `@ExternalApiAccessible`.
30- Routes accessible via Clerk OAuth (DCR) access tokens must also use `@OAuthAccessible`.
31- Controller method names follow: `getEntityName`, `listEntityName`, `createEntityName`, `updateEntityName`, `deleteEntityName`.
32- List endpoints must support pagination and use `@SdkUsePagination`.
33- Group SDK endpoints with `@SdkGroupName` using `.` as the subresource separator (e.g., `Subscribers.Notifications`).
34
35**Use-cases (CQRS)**
36- Business logic lives in use-case classes, not controllers.
37- Use-cases receive a typed command/query and return a typed result via `execute(command)`.
38- Never put database queries directly in controllers.
39
40**Database**
41- Always use `libs/dal` repositories for all queries; see dal-repository.mdc for enforcement rules.
42
43**OpenAPI**
44- Every endpoint must have `@ApiOperation`, `@ApiResponse`, and `@ApiTags` decorators.
45- Validate with `npm run lint:openapi` (run with API started) before submitting a PR.
46
47**Migrations**
48- Place migration scripts in `apps/api/migrations/<change-description>/<change-action>.ts`.
49- Run via `npm run migration -- ./migrations/<path>.ts`.
50- Never rename existing migration scripts — they are referenced in user-facing docs.
51
52**Canonical example:** @apps/api/src/app/tenant/tenant.controller.ts
53
@@ −1 +1 @@
1−# Agent setup
1+---
2+description: Rules for working in the API service (NestJS backend)
3+globs: apps/api/**/*
4+alwaysApply: false
5+---
26
3−This is a deepsec scanning workspace. Each registered project has its
4−own setup prompt at `data/<id>/SETUP.md` — open the relevant one when
5−asked to set a project up.
7+## API Service
68
7−## Common tasks
9+**Stack:** NestJS + Express · MongoDB (via `libs/dal`) · Redis + Bull · ClickHouse (analytics/traces) · Clerk or Better Auth · `@nestjs/swagger`
810
9−- **Set up a project for scanning**: read `data/<id>/SETUP.md` and
10− follow it (read `node_modules/deepsec/SKILL.md`, then fill
11− `data/<id>/INFO.md` from the target codebase).
12−- **Add a new project**: run `deepsec init-project <root>` — it
13− scaffolds `data/<id>/` and prints/writes the setup prompt for the
14− new project.
15−- **Write a custom matcher** (only after a real true-positive shows you
16− a pattern worth keeping): read
17− `node_modules/deepsec/dist/docs/writing-matchers.md`.
11+**Run:** `pnpm start:api:dev` — port 3000, OpenAPI at `http://localhost:3000/openapi`
1812
19−## Reference
13+**Tests/lint:** see testing.mdc
2014
21−The deepsec skill is at `node_modules/deepsec/SKILL.md` (after
22−`pnpm install`). The full docs ship at
23−`node_modules/deepsec/dist/docs/`.
15+**Key directories:**
16+```
17+apps/api/src/app/ # Route controllers and modules
18+apps/api/src/ee/ # Enterprise-only features
19+apps/api/migrations/ # MongoDB migrations
20+apps/api/migrations/clickhouse-migrations/ # ClickHouse schema migrations
21+```
22+
23+---
24+
25+### API Service Conventions
26+
27+**Controllers**
28+- Every protected route must use `@RequireAuthentication()`.
29+- Routes accessible via user API keys or the official SDK must also use `@ExternalApiAccessible`.
30+- Routes accessible via Clerk OAuth (DCR) access tokens must also use `@OAuthAccessible`.
31+- Controller method names follow: `getEntityName`, `listEntityName`, `createEntityName`, `updateEntityName`, `deleteEntityName`.
32+- List endpoints must support pagination and use `@SdkUsePagination`.
33+- Group SDK endpoints with `@SdkGroupName` using `.` as the subresource separator (e.g., `Subscribers.Notifications`).
34+
35+**Use-cases (CQRS)**
36+- Business logic lives in use-case classes, not controllers.
37+- Use-cases receive a typed command/query and return a typed result via `execute(command)`.
38+- Never put database queries directly in controllers.
39+
40+**Database**
41+- Always use `libs/dal` repositories for all queries; see dal-repository.mdc for enforcement rules.
42+
43+**OpenAPI**
44+- Every endpoint must have `@ApiOperation`, `@ApiResponse`, and `@ApiTags` decorators.
45+- Validate with `npm run lint:openapi` (run with API started) before submitting a PR.
46+
47+**Migrations**
48+- Place migration scripts in `apps/api/migrations/<change-description>/<change-action>.ts`.
49+- Run via `npm run migration -- ./migrations/<path>.ts`.
50+- Never rename existing migration scripts — they are referenced in user-facing docs.
51+
52+**Canonical example:** @apps/api/src/app/tenant/tenant.controller.ts
2453
