# Nest Desk

> Check one NestJS feature against production patterns. Paste its files - module, controller, service, DTOs, guards,
> main.ts, each under a "// file: path" line - and the browser reads them the way Nest does: every @Module (imports,
> controllers, providers, exports, forwardRef, dynamic modules such as TypeOrmModule.forFeature, APP_* providers), every
> constructor injection resolved across the pasted modules (with the message Nest prints when one cannot be
> resolved), circular module imports, exports nothing provides, the global ValidationPipe and its options, every request
> DTO and its class-validator decorators, every route with its guards, roles, pipes and what it returns. Metered runs
> review the feature against the skill and rewrite its files; the page re-scans every rewrite. Built on the SkillSafe
> skill @affaan-m/nestjs-patterns, from affaan-m/everything-claude-code (MIT), by Affaan Mustafa. NestJS is a project by
> Kamil Mysliwiec and contributors; Nest Desk is not affiliated with or endorsed by it.

https://nest-desk.skillsafe.ai/

## What is free
- The dependency-injection graph: modules, imports, providers, exports and every constructor injection with what resolves it - or the finding "Nest can't resolve dependencies of the X (A, ?). Please make sure that the argument B at index [1] is available in the M context." and the page's fix (the module to import, the export to add, the forFeature entity).
- Circular module imports and circular providers without forwardRef(), exports a module neither provides nor imports, controllers and providers declared in no module, exports no importing module injects.
- The validation surface: no global ValidationPipe, or one missing whitelist, forbidNonWhitelisted or transform (with the exact replacement); request bodies typed as interfaces, type aliases or any; DTOs with no class-validator decorator; DTO fields without one; nested objects without ValidateNested and Type; numeric parameters that arrive as strings; id parameters without a parse pipe.
- What leaves the service: routes that return an ORM entity carrying a password hash, a token or a secret (followed through the service method and the repository call); persistence injected straight into a controller.
- Guards and config: write routes with no guard while others are guarded, roles no guard reads, untyped request objects, secrets written into the code, ConfigModule loaded without validation, feature code reading the environment directly, plain Errors for expected cases, a bootstrap without ClassSerializerInterceptor or an exception filter, tests that do not reuse the production pipe, cross-cutting pieces outside common/.
- Every finding has an id (F1, F2, ...), a severity (error, warning, note), the file and line, the evidence and the page's value. Also: the route table (method, path, handler, guards, roles, pipes, body, validated), the skill's checklist by kind, what the paste cannot show, a findings CSV, a routes CSV, a generated supertest e2e test that sends an unknown property to each validated write route and expects a 400, and everything as JSON.

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (review or rewrite), `feature`, `code` (the files under their // file: lines), `note` (the team's note, or a sentence), `carry` (rewrite: the review as sentences; otherwise a sentence) and `facts` (the page's reading).
- `review` replies with `summary`, `verdicts` (one per page finding: id, confirmed or cleared, why), `extra` (issues the scan cannot compute: id X1..., a checklist kind, file, issue, fix), `unseen` (what the paste cannot show, by kind: bootstrap, root-module, unpasted-module, unpasted-class, tests, runtime), `fixes` (order, ids, file, change, why) and `caveats`.
- `rewrite` replies with `summary`, `files` (every file whole: path, content), `changes` (ids, file, what), `kept` (findings left as they are, with why) and `caveats`.
The page holds every reply to its reading: a review gives each finding exactly one verdict, never clears a finding the page computes from the code without a reason it is flagged for, names every gap of the paste and orders fixes that cover every confirmed error and warning; a rewrite is put back together and re-scanned - a dropped file, class or route, a claimed fix that still fires, a finding left without a word and a finding the rewrite introduces are all flagged.

## Links
- API tutorial: https://nest-desk.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@affaan-m/nestjs-patterns