@authuser/nest 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+This project uses [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-09-03
+
+### Added
+
+- NestJS 12 and Fastify 5 application factory.
+- Secure, minimal and full presets.
+- Secure headers, rate limiting, strict validation and bounded request bodies.
+- Optional OpenAPI JSON and Swagger UI.
+- Optional health endpoint and response compression.
+- TypeScript 7 build and declarations.
+- HTTP QUERY (RFC 10008) support in CORS defaults and integration coverage.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Authuser
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,201 @@
+<div align="center">
+  <h1>@authuser/nest</h1>
+  <p><strong>A secure, fast and batteries-included NestJS foundation on Fastify.</strong></p>
+</div>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@authuser/nest"><img alt="npm" src="https://img.shields.io/npm/v/%40authuser%2Fnest?style=flat-square"></a>
+  <a href="https://www.npmjs.com/package/@authuser/nest"><img alt="downloads" src="https://img.shields.io/npm/dm/%40authuser%2Fnest?style=flat-square"></a>
+  <img alt="Node 20+" src="https://img.shields.io/badge/node-%3E%3D20.11-339933?style=flat-square&logo=node.js&logoColor=white">
+  <img alt="NestJS 12" src="https://img.shields.io/badge/NestJS-12-E0234E?style=flat-square&logo=nestjs&logoColor=white">
+  <img alt="Fastify 5" src="https://img.shields.io/badge/Fastify-5-black?style=flat-square&logo=fastify">
+  <a href="./LICENSE"><img alt="MIT" src="https://img.shields.io/badge/license-MIT-green?style=flat-square"></a>
+</p>
+
+`@authuser/nest` creates a normal `NestFastifyApplication` with careful production
+defaults. It keeps controllers, modules, dependency injection and the rest of Nest
+intact while removing repetitive bootstrap code.
+
+## Why this package?
+
+- One install: Nest, Fastify, validation, security and optional docs are included.
+- Fast path: request logs, compression and Swagger UI are off unless requested.
+- Secure defaults: Helmet, strict DTO validation, bounded bodies, strict CORS and
+  rate limiting.
+- OpenAPI is optional at runtime. Its code is dynamically imported only when enabled.
+- HTTP QUERY (RFC 10008) passes through Nest 12/Fastify 5 and is included in CORS defaults.
+- Native ESM, strict declarations and a TypeScript 7 toolchain.
+- Escape hatch: the result is a regular Nest application and Fastify instance.
+
+## Requirements
+
+- Node.js 20.11 or newer
+- An ESM project is recommended (`"type": "module"`)
+
+## Install
+
+```bash
+npm install @authuser/nest
+```
+
+No peer-dependency checklist is required. Runtime integrations such as
+`@nestjs/swagger`, `class-validator` and the Fastify plugins are dependencies of
+this package.
+
+## Quick start
+
+```ts
+// src/main.ts
+import { createNestApp } from '@authuser/nest';
+import { AppModule } from './app.module.js';
+
+const app = await createNestApp({
+  rootModule: AppModule,
+  appName: 'users-api',
+  preset: 'secure',
+  apiPrefix: 'api',
+  observability: {
+    logger: { level: process.env.LOG_LEVEL ?? 'info' },
+  },
+});
+
+await app.listen({ port: 3000, host: '0.0.0.0' });
+```
+
+That application has Helmet, rate limiting, safe request IDs, strict validation,
+a 1 MiB body limit and graceful shutdown hooks. Cross-origin requests are not
+enabled implicitly.
+
+## Presets
+
+| Preset | Intended use | Enabled by default |
+| --- | --- | --- |
+| `minimal` | Lowest framework overhead | validation and exception filter |
+| `secure` | Public production API (default) | minimal + Helmet + rate limit |
+| `full` | Feature-rich service | secure + compression + health + OpenAPI JSON |
+
+Explicit options always override a preset.
+
+## OpenAPI and Swagger UI
+
+OpenAPI is installed but disabled with `minimal` and `secure`. Enable only the
+machine-readable document:
+
+```ts
+const app = await createNestApp({
+  rootModule: AppModule,
+  openApi: {
+    enabled: true,
+    title: 'Users API',
+    version: '2.0.0',
+    jsonPath: '/openapi.json',
+    bearerAuth: true,
+  },
+});
+```
+
+Swagger UI is a separate opt-in because it adds routes and static assets:
+
+```ts
+openApi: {
+  enabled: process.env.NODE_ENV !== 'production',
+  ui: true,
+  uiPath: '/docs',
+}
+```
+
+For an internet-facing production service, prefer exporting the JSON during CI or
+protecting documentation routes at the gateway.
+
+## Configuration examples
+
+### CORS allowlist
+
+```ts
+security: {
+  cors: {
+    origin: ['https://app.example.com'],
+    credentials: true,
+    methods: ['GET', 'POST', 'PATCH', 'DELETE'],
+  },
+}
+```
+
+### Rate limiting behind a proxy
+
+```ts
+network: { trustProxy: ['127.0.0.1', '10.0.0.0/8'] },
+security: {
+  rateLimit: { max: 300, timeWindow: '1 minute' },
+}
+```
+
+Never enable `trustProxy: true` unless every direct connection comes through a
+trusted proxy; client IPs are used as rate-limit keys.
+
+### Existing Nest + Fastify application
+
+```ts
+import { configureHttpApp } from '@authuser/nest';
+
+await configureHttpApp(app, {
+  preset: 'secure',
+  health: { enabled: true, path: '/healthz' },
+});
+```
+
+Call `configureHttpApp` before `app.init()` or `app.listen()` so Fastify can register
+its plugins and routes.
+
+## Public API
+
+- `createNestApp(options)` / `createHttpApp(options)` — create and configure an app.
+- `configureHttpApp(app, options)` — configure an existing Fastify-based Nest app.
+- `AuthuserModule.forRoot(options)` — expose immutable options through Nest DI.
+- `AUTHUSER_OPTIONS` — injection token for those options.
+- `Public()` and `Roles(...roles)` — metadata helpers for your own guards.
+- `HttpExceptionFilter` — the default safe JSON exception filter.
+
+The decorators intentionally do not provide authentication. Authentication policy
+belongs to the consuming application; pretending otherwise would create a dangerous
+security boundary.
+
+See the [complete option reference](./docs/configuration.md), the
+[security model](./docs/security.md), and the [performance guide](./docs/performance.md).
+
+## Performance notes
+
+Fastify remains a strong fit when Nest's architecture is required. A raw Fastify
+service will be lighter and usually faster because it removes Nest's routing and DI
+overhead; frameworks such as µWebSockets.js can win synthetic throughput tests but
+require a substantially different ecosystem and programming model. Measure the real
+application before trading away Nest maintainability.
+
+For the hottest path, use `preset: 'minimal'`, leave request logging and compression
+off, declare response schemas in Fastify-compatible routes, and benchmark with your
+actual payloads. See [docs/performance.md](./docs/performance.md).
+
+## Migration from `@authuser/nest-fastify-kit`
+
+```diff
+- import { createHttpApp } from '@authuser/nest-fastify-kit';
++ import { createHttpApp } from '@authuser/nest';
+```
+
+The new package targets Nest 12, uses ESM, calls Swagger configuration `openApi`, and
+ships required integrations as normal dependencies. See the
+[migration guide](./docs/migration.md).
+
+## Development
+
+```bash
+npm install
+npm run check
+```
+
+An executable API and an importable Postman collection are available in the
+[`example`](./example) directory.
+
+## License
+
+[MIT](./LICENSE) © Authuser

package/dist/authuser.module.d.ts

@@ -0,0 +1,12 @@
+import { type DynamicModule } from '@nestjs/common';
+import type { ConfigureHttpAppOptions } from './types.js';
+export declare const AUTHUSER_OPTIONS: unique symbol;
+export interface AuthuserModuleAsyncOptions {
+    inject?: Array<string | symbol | Function>;
+    useFactory: (...dependencies: never[]) => ConfigureHttpAppOptions | Promise<ConfigureHttpAppOptions>;
+}
+export declare class AuthuserModule {
+    static forRoot(options?: ConfigureHttpAppOptions): DynamicModule;
+    static forRootAsync(options: AuthuserModuleAsyncOptions): DynamicModule;
+}
+//# sourceMappingURL=authuser.module.d.ts.map

package/dist/authuser.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authuser.module.d.ts","sourceRoot":"","sources":["../src/authuser.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,gBAAgB,eAAuC,CAAC;AAErE,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,YAAY,EAAE,KAAK,EAAE,KAAK,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACtG;AAED,qBAEa,cAAc;IACzB,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,uBAA4B,GAAG,aAAa,CAMnE;IAED,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,0BAA0B,GAAG,aAAa,CAOtE;CACF"}

package/dist/authuser.module.js

@@ -0,0 +1,32 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AuthuserModule_1;
+import { Global, Module } from '@nestjs/common';
+export const AUTHUSER_OPTIONS = Symbol.for('@authuser/nest/options');
+let AuthuserModule = AuthuserModule_1 = class AuthuserModule {
+    static forRoot(options = {}) {
+        return {
+            module: AuthuserModule_1,
+            providers: [{ provide: AUTHUSER_OPTIONS, useValue: Object.freeze({ ...options }) }],
+            exports: [AUTHUSER_OPTIONS],
+        };
+    }
+    static forRootAsync(options) {
+        const provider = {
+            provide: AUTHUSER_OPTIONS,
+            inject: options.inject ?? [],
+            useFactory: options.useFactory,
+        };
+        return { module: AuthuserModule_1, providers: [provider], exports: [provider] };
+    }
+};
+AuthuserModule = AuthuserModule_1 = __decorate([
+    Global(),
+    Module({})
+], AuthuserModule);
+export { AuthuserModule };
+//# sourceMappingURL=authuser.module.js.map

package/dist/authuser.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authuser.module.js","sourceRoot":"","sources":["../src/authuser.module.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAqC,MAAM,gBAAgB,CAAC;AAGnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAS9D,IAAM,cAAc,sBAApB,MAAM,cAAc;IAClB,AAAP,MAAM,CAAC,OAAO,CAAC,OAAO,GAA4B,EAAE;QAClD,OAAO;YACL,MAAM,kBAAgB;YACtB,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC;YACnF,OAAO,EAAE,CAAC,gBAAgB,CAAC;SAC5B,CAAC;IACJ,CAAC;IAEM,AAAP,MAAM,CAAC,YAAY,CAAC,OAAmC;QACrD,MAAM,QAAQ,GAAa;YACzB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;QACF,OAAO,EAAE,MAAM,kBAAgB,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChF,CAAC;CACF,CAAA;AAjBY,cAAc;IAF1B,MAAM,EAAE;IACR,MAAM,CAAC,EAAE,CAAC;GACE,cAAc,CAiB1B"}

package/dist/configure-http-app.d.ts

@@ -0,0 +1,4 @@
+import type { NestFastifyApplication } from '@nestjs/platform-fastify';
+import type { ConfigureHttpAppOptions } from './types.js';
+export declare function configureHttpApp(app: NestFastifyApplication, input?: ConfigureHttpAppOptions): Promise<NestFastifyApplication>;
+//# sourceMappingURL=configure-http-app.d.ts.map

package/dist/configure-http-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-http-app.d.ts","sourceRoot":"","sources":["../src/configure-http-app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAKvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,sBAAsB,EAC3B,KAAK,GAAE,uBAA4B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CA2DjC"}

package/dist/configure-http-app.js

@@ -0,0 +1,64 @@
+import compress from '@fastify/compress';
+import cors from '@fastify/cors';
+import helmet from '@fastify/helmet';
+import rateLimit from '@fastify/rate-limit';
+import { ValidationPipe, VersioningType } from '@nestjs/common';
+import { HttpExceptionFilter } from './http-exception.filter.js';
+import { registerOpenApi } from './openapi.js';
+import { resolveOptions } from './options.js';
+export async function configureHttpApp(app, input = {}) {
+    const options = resolveOptions(input);
+    const fastify = app.getHttpAdapter().getInstance();
+    if (options.security.helmet) {
+        await fastify.register(helmet, {
+            global: true,
+            contentSecurityPolicy: options.security.contentSecurityPolicy,
+        });
+    }
+    if (options.security.cors !== false) {
+        await fastify.register(cors, options.security.cors);
+    }
+    if (options.security.rateLimit !== false && options.security.rateLimit.enabled) {
+        const { enabled: _enabled, ...rateLimitOptions } = options.security.rateLimit;
+        await fastify.register(rateLimit, rateLimitOptions);
+    }
+    if (options.compression.enabled) {
+        await fastify.register(compress, {
+            threshold: options.compression.threshold,
+            encodings: options.compression.encodings,
+        });
+    }
+    if (options.apiPrefix)
+        app.setGlobalPrefix(options.apiPrefix);
+    if (options.versioning) {
+        app.enableVersioning(options.versioning === true
+            ? { type: VersioningType.URI }
+            : options.versioning);
+    }
+    if (options.validation !== false)
+        app.useGlobalPipes(new ValidationPipe(options.validation));
+    app.useGlobalFilters(new HttpExceptionFilter());
+    if (options.shutdownHooks)
+        app.enableShutdownHooks();
+    if (options.observability.responseTimeHeader) {
+        const startTimes = new WeakMap();
+        fastify.addHook('onRequest', async (request) => {
+            startTimes.set(request, process.hrtime.bigint());
+        });
+        fastify.addHook('onSend', async (request, reply, payload) => {
+            const start = startTimes.get(request);
+            if (typeof start === 'bigint') {
+                reply.header('server-timing', `app;dur=${(Number(process.hrtime.bigint() - start) / 1e6).toFixed(2)}`);
+            }
+            return payload;
+        });
+    }
+    if (options.health.enabled) {
+        fastify.get(options.health.path, {
+            config: { rateLimit: false },
+        }, async (_request, reply) => reply.send(options.health.response));
+    }
+    await registerOpenApi(app, fastify, options.openApi);
+    return app;
+}
+//# sourceMappingURL=configure-http-app.js.map

package/dist/configure-http-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-http-app.js","sourceRoot":"","sources":["../src/configure-http-app.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAA2B,EAC3B,KAAK,GAA4B,EAAE;IAEnC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,WAAW,EAAqB,CAAC;IAEtE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7B,MAAM,EAAE,IAAI;YACZ,qBAAqB,EAAE,OAAO,CAAC,QAAQ,CAAC,qBAAqB;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC/E,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9E,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE;YAC/B,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS;YACxC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS;SACzC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,SAAS;QAAE,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI;YAC9C,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE;YAC9B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;QAAE,GAAG,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,gBAAgB,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,aAAa;QAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC;IAErD,IAAI,OAAO,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,OAAO,EAAkB,CAAC;QACjD,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC7C,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;YAC/B,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;SAC7B,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/create-http-app.d.ts

@@ -0,0 +1,6 @@
+import { type NestFastifyApplication } from '@nestjs/platform-fastify';
+import type { CreateHttpAppOptions } from './types.js';
+export declare function createHttpApp(options: CreateHttpAppOptions): Promise<NestFastifyApplication>;
+/** A descriptive alias for new projects. */
+export declare const createNestApp: typeof createHttpApp;
+//# sourceMappingURL=create-http-app.d.ts.map

package/dist/create-http-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-http-app.d.ts","sourceRoot":"","sources":["../src/create-http-app.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAIvD,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA4BlG;AAED,4CAA4C;AAC5C,eAAO,MAAM,aAAa,sBAAgB,CAAC"}

package/dist/create-http-app.js

@@ -0,0 +1,37 @@
+import { randomUUID } from 'node:crypto';
+import { LogController } from 'fastify';
+import { NestFactory } from '@nestjs/core';
+import { FastifyAdapter, } from '@nestjs/platform-fastify';
+import { configureHttpApp } from './configure-http-app.js';
+import { resolveOptions } from './options.js';
+const SAFE_REQUEST_ID = /^[A-Za-z0-9._:-]{1,128}$/;
+export async function createHttpApp(options) {
+    const resolved = resolveOptions(options);
+    const network = options.network ?? {};
+    const adapter = new FastifyAdapter({
+        logger: resolved.observability.logger,
+        logController: new LogController({
+            disableRequestLogging: !resolved.observability.requestLogging,
+        }),
+        trustProxy: network.trustProxy ?? false,
+        bodyLimit: network.bodyLimit ?? 1_048_576,
+        routerOptions: { maxParamLength: network.maxParamLength ?? 100 },
+        connectionTimeout: network.connectionTimeout ?? 0,
+        requestTimeout: network.requestTimeout ?? 0,
+        keepAliveTimeout: network.keepAliveTimeout ?? 72_000,
+        requestIdHeader: 'x-request-id',
+        genReqId: safeRequestId,
+    });
+    const nestOptions = resolved.observability.logger === false
+        ? { ...options.nest, logger: false }
+        : { ...options.nest };
+    const app = await NestFactory.create(options.rootModule, adapter, nestOptions);
+    return configureHttpApp(app, options);
+}
+/** A descriptive alias for new projects. */
+export const createNestApp = createHttpApp;
+function safeRequestId(request) {
+    const incoming = request.headers['x-request-id'];
+    return typeof incoming === 'string' && SAFE_REQUEST_ID.test(incoming) ? incoming : randomUUID();
+}
+//# sourceMappingURL=create-http-app.js.map

package/dist/create-http-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-http-app.js","sourceRoot":"","sources":["../src/create-http-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,cAAc,GAEf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QACrC,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,qBAAqB,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,cAAc;SAC9D,CAAC;QACF,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;QACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS;QACzC,aAAa,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,GAAG,EAAE;QAChE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC;QACjD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,MAAM;QACpD,eAAe,EAAE,cAAc;QAC/B,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK;QACzD,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAc,EAAE;QAC7C,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAClC,OAAO,CAAC,UAAU,EAClB,OAAO,EACP,WAAW,CACZ,CAAC;IAEF,OAAO,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,SAAS,aAAa,CAAC,OAAwB;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAClG,CAAC"}

package/dist/decorators.d.ts

@@ -0,0 +1,7 @@
+export declare const IS_PUBLIC_KEY = "authuser:isPublic";
+export declare const ROLES_KEY = "authuser:roles";
+/** Marks a handler or controller as public for application-defined guards. */
+export declare const Public: () => MethodDecorator & ClassDecorator;
+/** Attaches required roles for application-defined guards. */
+export declare const Roles: (...roles: string[]) => MethodDecorator & ClassDecorator;
+//# sourceMappingURL=decorators.d.ts.map

package/dist/decorators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.d.ts","sourceRoot":"","sources":["../src/decorators.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C,8EAA8E;AAC9E,eAAO,MAAM,MAAM,QAAO,eAAe,GAAG,cAAkD,CAAC;AAE/F,8DAA8D;AAC9D,eAAO,MAAM,KAAK,aAAc,MAAM,EAAE,KAAG,eAAe,GAAG,cAA+C,CAAC"}

package/dist/decorators.js

@@ -0,0 +1,8 @@
+import { SetMetadata } from '@nestjs/common';
+export const IS_PUBLIC_KEY = 'authuser:isPublic';
+export const ROLES_KEY = 'authuser:roles';
+/** Marks a handler or controller as public for application-defined guards. */
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);
+/** Attaches required roles for application-defined guards. */
+export const Roles = (...roles) => SetMetadata(ROLES_KEY, roles);
+//# sourceMappingURL=decorators.js.map

package/dist/decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../src/decorators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,GAAqC,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAE/F,8DAA8D;AAC9D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAe,EAAoC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC"}

package/dist/http-exception.filter.d.ts

@@ -0,0 +1,5 @@
+import { ArgumentsHost, type ExceptionFilter } from '@nestjs/common';
+export declare class HttpExceptionFilter implements ExceptionFilter {
+    catch(exception: unknown, host: ArgumentsHost): void;
+}
+//# sourceMappingURL=http-exception.filter.d.ts.map

package/dist/http-exception.filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-exception.filter.d.ts","sourceRoot":"","sources":["../src/http-exception.filter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAIb,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAGxB,qBAAa,mBAAoB,YAAW,eAAe;IACzD,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAqBnD;CACF"}

package/dist/http-exception.filter.js

@@ -0,0 +1,43 @@
+import { Catch, HttpException, HttpStatus, } from '@nestjs/common';
+export class HttpExceptionFilter {
+    catch(exception, host) {
+        const context = host.switchToHttp();
+        const reply = context.getResponse();
+        const request = context.getRequest();
+        const httpException = getHttpException(exception);
+        const status = httpException?.getStatus() ?? HttpStatus.INTERNAL_SERVER_ERROR;
+        const response = httpException?.getResponse();
+        const details = typeof response === 'object' && response !== null ? response : {};
+        const message = typeof response === 'string'
+            ? response
+            : getMessage(details) ?? (status === 500 ? 'Internal server error' : 'Request failed');
+        if (status === 500)
+            request.log.error({ err: exception }, 'Unhandled request error');
+        void reply.status(status).send({
+            statusCode: status,
+            error: HttpStatus[status] ?? 'Error',
+            message,
+            requestId: request.id,
+            path: request.url,
+        });
+    }
+}
+Catch()(HttpExceptionFilter);
+function getMessage(value) {
+    return 'message' in value ? value.message : undefined;
+}
+function getHttpException(exception) {
+    if (exception instanceof HttpException)
+        return exception;
+    if (typeof exception !== 'object' || exception === null)
+        return undefined;
+    const candidate = exception;
+    if (typeof candidate.getStatus !== 'function' || typeof candidate.getResponse !== 'function') {
+        return undefined;
+    }
+    const status = candidate.getStatus.call(exception);
+    return Number.isInteger(status) && status >= 400 && status <= 599
+        ? candidate
+        : undefined;
+}
+//# sourceMappingURL=http-exception.filter.js.map

package/dist/http-exception.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-exception.filter.js","sourceRoot":"","sources":["../src/http-exception.filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,EACL,aAAa,EACb,UAAU,GAEX,MAAM,gBAAgB,CAAC;AAGxB,MAAM,OAAO,mBAAmB;IAC9B,KAAK,CAAC,SAAkB,EAAE,IAAmB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAgB,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAkB,CAAC;QACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,aAAa,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,qBAAqB,CAAC;QAC9E,MAAM,QAAQ,GAAG,aAAa,EAAE,WAAW,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,OAAO,GAAG,OAAO,QAAQ,KAAK,QAAQ;YAC1C,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAEzF,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAErF,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC7B,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO;YACpC,OAAO;YACP,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,IAAI,EAAE,OAAO,CAAC,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;CACF;AAED,KAAK,EAAE,CAAC,mBAAmB,CAAC,CAAC;AAE7B,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAOD,SAAS,gBAAgB,CAAC,SAAkB;IAC1C,IAAI,SAAS,YAAY,aAAa;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAE1E,MAAM,SAAS,GAAG,SAAuC,CAAC;IAC1D,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG;QAC/D,CAAC,CAAC,SAA8B;QAChC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+import 'reflect-metadata';
+export { AuthuserModule, AUTHUSER_OPTIONS } from './authuser.module.js';
+export type { AuthuserModuleAsyncOptions } from './authuser.module.js';
+export { configureHttpApp } from './configure-http-app.js';
+export { createHttpApp, createNestApp } from './create-http-app.js';
+export { Public, Roles, IS_PUBLIC_KEY, ROLES_KEY } from './decorators.js';
+export { HttpExceptionFilter } from './http-exception.filter.js';
+export type { CompressionOptions, ConfigureHttpAppOptions, CorsOptions, CreateHttpAppOptions, HealthOptions, NetworkOptions, ObservabilityOptions, OpenApiOptions, RateLimitOptions, SecurityOptions, SecurityPreset, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxE,YAAY,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+import 'reflect-metadata';
+export { AuthuserModule, AUTHUSER_OPTIONS } from './authuser.module.js';
+export { configureHttpApp } from './configure-http-app.js';
+export { createHttpApp, createNestApp } from './create-http-app.js';
+export { Public, Roles, IS_PUBLIC_KEY, ROLES_KEY } from './decorators.js';
+export { HttpExceptionFilter } from './http-exception.filter.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/openapi.d.ts

@@ -0,0 +1,5 @@
+import type { NestFastifyApplication } from '@nestjs/platform-fastify';
+import type { FastifyInstance } from 'fastify';
+import type { ResolvedOptions } from './options.js';
+export declare function registerOpenApi(app: NestFastifyApplication, fastify: FastifyInstance, options: ResolvedOptions['openApi']): Promise<void>;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,wBAAsB,eAAe,CACnC,GAAG,EAAE,sBAAsB,EAC3B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC,CA+Bf"}

package/dist/openapi.js

@@ -0,0 +1,31 @@
+export async function registerOpenApi(app, fastify, options) {
+    if (!options.enabled)
+        return;
+    const { DocumentBuilder, SwaggerModule } = await import('@nestjs/swagger');
+    let builder = new DocumentBuilder()
+        .setTitle(options.title)
+        .setDescription(options.description)
+        .setVersion(options.version);
+    if (options.bearerAuth)
+        builder = builder.addBearerAuth();
+    const document = SwaggerModule.createDocument(app, builder.build());
+    if (options.json) {
+        fastify.get(options.jsonPath, async (_request, reply) => reply.send(document));
+    }
+    if (options.ui) {
+        const { default: swagger } = await import('@fastify/swagger');
+        const { default: swaggerUi } = await import('@fastify/swagger-ui');
+        await fastify.register(swagger, {
+            mode: 'static',
+            // Nest and Fastify publish structurally compatible but distinct OpenAPI types.
+            specification: { document: document },
+        });
+        await fastify.register(swaggerUi, {
+            routePrefix: options.uiPath,
+            uiConfig: { docExpansion: 'list', deepLinking: true, spec: document },
+            staticCSP: true,
+            transformStaticCSP: (header) => header,
+        });
+    }
+}
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAA2B,EAC3B,OAAwB,EACxB,OAAmC;IAEnC,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO;IAE7B,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3E,IAAI,OAAO,GAAG,IAAI,eAAe,EAAE;SAChC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;SACvB,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;SACnC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAEpE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC9D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE;YAC9B,IAAI,EAAE,QAAQ;YACd,+EAA+E;YAC/E,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAiB,EAAE;SAC/C,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;YAChC,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;YACrE,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;SACvC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/options.d.ts

@@ -0,0 +1,21 @@
+import type { CompressionOptions, ConfigureHttpAppOptions, CorsOptions, HealthOptions, OpenApiOptions, RateLimitOptions, SecurityPreset } from './types.js';
+export interface ResolvedOptions {
+    appName: string;
+    preset: SecurityPreset;
+    apiPrefix?: string;
+    versioning: ConfigureHttpAppOptions['versioning'];
+    validation: ConfigureHttpAppOptions['validation'];
+    security: {
+        helmet: boolean;
+        contentSecurityPolicy: boolean;
+        cors: false | CorsOptions;
+        rateLimit: false | (Required<Pick<RateLimitOptions, 'enabled' | 'max' | 'timeWindow' | 'ban'>> & RateLimitOptions);
+    };
+    compression: Required<CompressionOptions>;
+    openApi: Required<OpenApiOptions>;
+    health: Required<HealthOptions>;
+    observability: Required<NonNullable<ConfigureHttpAppOptions['observability']>>;
+    shutdownHooks: boolean;
+}
+export declare function resolveOptions(options: ConfigureHttpAppOptions): ResolvedOptions;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAClD,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAClD,QAAQ,EAAE;QACR,MAAM,EAAE,OAAO,CAAC;QAChB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,WAAW,CAAC;QAC1B,SAAS,EAAE,KAAK,IAAG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,KAAK,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,GAAG,gBAAgB,CAAA,CAAC;KAClH,CAAC;IACF,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC1C,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAChC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC/E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,uBAAuB,GAAG,eAAe,CA+EhF"}

package/dist/options.js

@@ -0,0 +1,84 @@
+export function resolveOptions(options) {
+    const preset = options.preset ?? 'secure';
+    const isSecure = preset !== 'minimal';
+    const isFull = preset === 'full';
+    const security = options.security ?? {};
+    const rateLimitInput = security.rateLimit === false ? false : security.rateLimit ?? {};
+    const compressionInput = typeof options.compression === 'object' ? options.compression : {};
+    const openApiInput = typeof options.openApi === 'object' ? options.openApi : {};
+    const healthInput = typeof options.health === 'object' ? options.health : {};
+    const resolved = {
+        appName: options.appName ?? 'nest-api',
+        preset,
+        versioning: options.versioning ?? false,
+        validation: options.validation === undefined
+            ? { whitelist: true, forbidNonWhitelisted: true, transform: false }
+            : options.validation,
+        security: {
+            helmet: security.helmet ?? isSecure,
+            contentSecurityPolicy: security.contentSecurityPolicy ?? true,
+            cors: security.cors === undefined || security.cors === false
+                ? false
+                : {
+                    ...security.cors,
+                    origin: security.cors.origin ?? false,
+                    methods: security.cors.methods ?? [
+                        'GET',
+                        'HEAD',
+                        'POST',
+                        'PUT',
+                        'PATCH',
+                        'DELETE',
+                        'OPTIONS',
+                        'QUERY',
+                    ],
+                    optionsSuccessStatus: security.cors.optionsSuccessStatus ?? 204,
+                    strictPreflight: security.cors.strictPreflight ?? true,
+                },
+            rateLimit: rateLimitInput === false
+                ? false
+                : {
+                    ...rateLimitInput,
+                    enabled: rateLimitInput.enabled ?? isSecure,
+                    max: rateLimitInput.max ?? 100,
+                    timeWindow: rateLimitInput.timeWindow ?? '1 minute',
+                    ban: rateLimitInput.ban ?? -1,
+                },
+        },
+        compression: {
+            enabled: typeof options.compression === 'boolean' ? options.compression : compressionInput.enabled ?? isFull,
+            threshold: compressionInput.threshold ?? 1024,
+            encodings: compressionInput.encodings ?? ['br', 'gzip', 'deflate'],
+        },
+        openApi: {
+            enabled: typeof options.openApi === 'boolean' ? options.openApi : openApiInput.enabled ?? isFull,
+            title: openApiInput.title ?? options.appName ?? 'Nest API',
+            description: openApiInput.description ?? '',
+            version: openApiInput.version ?? '1.0.0',
+            json: openApiInput.json ?? true,
+            jsonPath: normalizePath(openApiInput.jsonPath ?? '/openapi.json'),
+            ui: openApiInput.ui ?? false,
+            uiPath: normalizePath(openApiInput.uiPath ?? '/docs'),
+            bearerAuth: openApiInput.bearerAuth ?? false,
+        },
+        health: {
+            enabled: typeof options.health === 'boolean' ? options.health : healthInput.enabled ?? isFull,
+            path: normalizePath(healthInput.path ?? '/health'),
+            response: healthInput.response ?? { status: 'ok' },
+        },
+        observability: {
+            logger: options.observability?.logger ?? true,
+            requestLogging: options.observability?.requestLogging ?? false,
+            responseTimeHeader: options.observability?.responseTimeHeader ?? false,
+        },
+        shutdownHooks: options.shutdownHooks ?? true,
+    };
+    if (options.apiPrefix !== undefined)
+        resolved.apiPrefix = options.apiPrefix.replace(/^\/+|\/+$/g, '');
+    return resolved;
+}
+function normalizePath(path) {
+    const normalized = `/${path}`.replace(/\/+/g, '/').replace(/\/$/, '');
+    return normalized || '/';
+}
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AA6BA,MAAM,UAAU,cAAc,CAAC,OAAgC;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;IACvF,MAAM,gBAAgB,GAAG,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7E,MAAM,QAAQ,GAAoB;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,UAAU;QACtC,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;QACvC,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;YACnE,CAAC,CAAC,OAAO,CAAC,UAAU;QACtB,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ;YACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,IAAI,IAAI;YAC7D,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK;gBAC1D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC;oBACE,GAAG,QAAQ,CAAC,IAAI;oBAChB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK;oBACrC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,IAAI;wBAChC,KAAK;wBACL,MAAM;wBACN,MAAM;wBACN,KAAK;wBACL,OAAO;wBACP,QAAQ;wBACR,SAAS;wBACT,OAAO;qBACR;oBACD,oBAAoB,EAAE,QAAQ,CAAC,IAAI,CAAC,oBAAoB,IAAI,GAAG;oBAC/D,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI;iBACvD;YACL,SAAS,EAAE,cAAc,KAAK,KAAK;gBACjC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC;oBACE,GAAG,cAAc;oBACjB,OAAO,EAAE,cAAc,CAAC,OAAO,IAAI,QAAQ;oBAC3C,GAAG,EAAE,cAAc,CAAC,GAAG,IAAI,GAAG;oBAC9B,UAAU,EAAE,cAAc,CAAC,UAAU,IAAI,UAAU;oBACnD,GAAG,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;iBAC9B;SACN;QACD,WAAW,EAAE;YACX,OAAO,EAAE,OAAO,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,IAAI,MAAM;YAC5G,SAAS,EAAE,gBAAgB,CAAC,SAAS,IAAI,IAAI;YAC7C,SAAS,EAAE,gBAAgB,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC;SACnE;QACD,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM;YAChG,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,UAAU;YAC1D,WAAW,EAAE,YAAY,CAAC,WAAW,IAAI,EAAE;YAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,OAAO;YACxC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,IAAI;YAC/B,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,QAAQ,IAAI,eAAe,CAAC;YACjE,EAAE,EAAE,YAAY,CAAC,EAAE,IAAI,KAAK;YAC5B,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC;YACrD,UAAU,EAAE,YAAY,CAAC,UAAU,IAAI,KAAK;SAC7C;QACD,MAAM,EAAE;YACN,OAAO,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM;YAC7F,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI,IAAI,SAAS,CAAC;YAClD,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;SACnD;QACD,aAAa,EAAE;YACb,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,IAAI,IAAI;YAC7C,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,cAAc,IAAI,KAAK;YAC9D,kBAAkB,EAAE,OAAO,CAAC,aAAa,EAAE,kBAAkB,IAAI,KAAK;SACvE;QACD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;KAC7C,CAAC;IAEF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACtG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,UAAU,IAAI,GAAG,CAAC;AAC3B,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,88 @@
+import type { LoggerOptions } from 'pino';
+import type { Type, ValidationPipeOptions, VersioningOptions } from '@nestjs/common';
+import type { NestApplicationOptions } from '@nestjs/common/interfaces/nest-application-options.interface';
+import type { FastifyRequest } from 'fastify';
+export type SecurityPreset = 'minimal' | 'secure' | 'full';
+export interface CorsOptions {
+    /** No cross-origin requests are allowed by default. */
+    origin?: boolean | string | RegExp | Array<string | RegExp>;
+    credentials?: boolean;
+    methods?: string[];
+    allowedHeaders?: string[];
+    exposedHeaders?: string[];
+    maxAge?: number;
+    /** Status returned for a successful preflight. HTTP 204 is the default. */
+    optionsSuccessStatus?: number;
+    strictPreflight?: boolean;
+}
+export interface RateLimitOptions {
+    enabled?: boolean;
+    max?: number;
+    timeWindow?: number | string;
+    ban?: number;
+    allowList?: string[];
+    keyGenerator?: (request: FastifyRequest) => string;
+}
+export interface SecurityOptions {
+    helmet?: boolean;
+    /** Helmet Content-Security-Policy. Enabled by default. */
+    contentSecurityPolicy?: boolean;
+    cors?: false | CorsOptions;
+    rateLimit?: false | RateLimitOptions;
+}
+export interface CompressionOptions {
+    enabled?: boolean;
+    threshold?: number;
+    encodings?: Array<'br' | 'gzip' | 'deflate' | 'identity'>;
+}
+export interface OpenApiOptions {
+    enabled?: boolean;
+    title?: string;
+    description?: string;
+    version?: string;
+    /** Serve the generated OpenAPI document. Set false to generate only. */
+    json?: boolean;
+    jsonPath?: string;
+    /** Swagger UI is opt-in and disabled by default. */
+    ui?: boolean;
+    uiPath?: string;
+    bearerAuth?: boolean;
+}
+export interface HealthOptions {
+    enabled?: boolean;
+    path?: string;
+    response?: Readonly<Record<string, unknown>>;
+}
+export interface ObservabilityOptions {
+    /** Fastify/Pino logging. False removes request logging overhead. */
+    logger?: boolean | LoggerOptions;
+    requestLogging?: boolean;
+    responseTimeHeader?: boolean;
+}
+export interface NetworkOptions {
+    trustProxy?: boolean | string | string[];
+    bodyLimit?: number;
+    maxParamLength?: number;
+    connectionTimeout?: number;
+    requestTimeout?: number;
+    keepAliveTimeout?: number;
+}
+export interface ConfigureHttpAppOptions {
+    appName?: string;
+    preset?: SecurityPreset;
+    apiPrefix?: string;
+    versioning?: boolean | VersioningOptions;
+    validation?: false | ValidationPipeOptions;
+    security?: SecurityOptions;
+    compression?: boolean | CompressionOptions;
+    openApi?: boolean | OpenApiOptions;
+    health?: boolean | HealthOptions;
+    observability?: ObservabilityOptions;
+    shutdownHooks?: boolean;
+}
+export interface CreateHttpAppOptions extends ConfigureHttpAppOptions {
+    rootModule: Type<unknown>;
+    network?: NetworkOptions;
+    nest?: Omit<NestApplicationOptions, 'logger'>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAC5D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,IAAI,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC;IAC3B,SAAS,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACjC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACzC,UAAU,CAAC,EAAE,KAAK,GAAG,qBAAqB,CAAC;IAC3C,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,GAAG,kBAAkB,CAAC;IAC3C,OAAO,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IACnC,MAAM,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACjC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,oBAAqB,SAAQ,uBAAuB;IACnE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,IAAI,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;CAC/C"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/docs/configuration.md

@@ -0,0 +1,72 @@
+# Configuration reference
+
+All settings are optional except `rootModule` when using `createNestApp`.
+
+## Application
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `rootModule` | required | Root Nest module. |
+| `appName` | `nest-api` | Name used by generated OpenAPI metadata. |
+| `preset` | `secure` | `minimal`, `secure`, or `full`. |
+| `apiPrefix` | none | Global prefix without a leading slash. |
+| `versioning` | `false` | `true` for URI versioning, or Nest versioning options. |
+| `shutdownHooks` | `true` | Enable Nest shutdown signal hooks. |
+| `validation` | strict defaults | `false` or Nest `ValidationPipeOptions`. |
+| `nest` | `{}` | Extra `NestApplicationOptions` except logger. |
+
+Default validation uses `whitelist: true`, `forbidNonWhitelisted: true`, and
+`transform: false`. Transformation is off because implicit coercion costs work and
+can hide unexpected input. Enable it explicitly when DTO conversion is required.
+
+## Network
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `network.bodyLimit` | `1048576` | Maximum body in bytes. |
+| `network.maxParamLength` | `100` | Maximum route parameter length. |
+| `network.trustProxy` | `false` | Fastify trusted-proxy policy. |
+| `network.keepAliveTimeout` | `72000` | Keep-alive timeout in milliseconds. |
+| `network.connectionTimeout` | `0` | Socket inactivity timeout. |
+| `network.requestTimeout` | `0` | Incoming request timeout. Configure a finite value at the edge. |
+
+## Security
+
+`security.helmet` and `security.rateLimit` are enabled by secure/full presets.
+CORS remains disabled unless an explicit configuration is supplied.
+When enabled, the default advertised methods are GET, HEAD, POST, PUT, PATCH,
+DELETE, OPTIONS and QUERY. Successful browser preflights return HTTP 204 by default;
+`optionsSuccessStatus` can change this for a legacy client that requires 200.
+
+Rate-limit defaults are 100 requests per minute per client IP. Available settings
+include `max`, `timeWindow`, `ban`, `allowList`, and `keyGenerator`.
+
+## Compression
+
+Compression is enabled by the full preset only. The default threshold is 1024 bytes
+and encodings are Brotli, gzip and deflate. Compression can increase CPU usage and
+can amplify secrets reflected beside attacker-controlled data, so enable it for
+known payloads rather than automatically for every API.
+
+## OpenAPI
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `enabled` | full preset only | Generate an OpenAPI document. |
+| `json` | `true` | Serve the document. |
+| `jsonPath` | `/openapi.json` | JSON endpoint. |
+| `ui` | `false` | Serve Swagger UI. |
+| `uiPath` | `/docs` | UI route prefix. |
+| `bearerAuth` | `false` | Add a bearer security scheme. |
+
+Set `openApi: false` to guarantee the documentation integration is never loaded.
+
+## Health and observability
+
+The full preset serves `{ "status": "ok" }` at `/health`. This is a liveness probe,
+not a dependency-readiness check. Supply a custom response or implement a Nest
+controller for deeper readiness logic.
+
+Fastify's Pino logger is enabled, while per-request logging is disabled to reduce
+noise and overhead. Enable it with `observability.requestLogging`. The optional
+`responseTimeHeader` emits a standards-compatible `Server-Timing` value.

package/docs/migration.md

@@ -0,0 +1,22 @@
+# Migration from `@authuser/nest-fastify-kit`
+
+## Requirements
+
+- Upgrade the service to Node 20.11 or newer.
+- Upgrade Nest packages to version 12.
+- Use ESM-compatible imports and include `.js` on relative imports in NodeNext output.
+
+## API changes
+
+The application factory keeps its old `createHttpApp` name and also exports
+`createNestApp`. Replace `docs` with `openApi`; replace `network` and security values
+using the typed option reference.
+
+The package no longer supplies an authentication guard with implied behavior.
+`Public` and `Roles` remain metadata decorators and must be consumed by an explicit
+application guard.
+
+Swagger, validation packages and Nest/Fastify runtime packages are installed as
+dependencies. Remove redundant direct declarations only after confirming the app
+does not import those packages itself and that your package manager deduplicates a
+single compatible Nest version.

package/docs/performance.md

@@ -0,0 +1,25 @@
+# Performance guide
+
+There is no universal requests-per-second number: controller work, payload shape,
+logging, validation, database latency, TLS and hardware dominate realistic results.
+
+## Recommended sequence
+
+1. Start with `preset: 'secure'` and production-shaped traffic.
+2. Benchmark latency percentiles and CPU, not only average throughput.
+3. Disable features one at a time to locate actual cost.
+4. Add Fastify JSON response schemas on hot routes to gain compiled serialization.
+5. Run multiple Node processes or containers; keep one event loop per CPU allocation.
+6. Load-test through the same proxy and TLS path used in production.
+
+Request logging is disabled by default. Compression is full-preset only because it
+trades bandwidth for CPU. OpenAPI generation happens at startup, and its modules are
+not imported when disabled.
+
+## Choosing a lower-level stack
+
+If profiling shows Nest itself is the bottleneck, raw Fastify is the closest smaller
+step and preserves its plugin/schema ecosystem. A specialized HTTP engine can achieve
+higher synthetic throughput, but moving away from Nest changes adapters, middleware,
+testing and operational conventions. Make that decision from an application benchmark,
+not a hello-world ranking.

package/docs/security.md

@@ -0,0 +1,31 @@
+# Security model
+
+The secure preset establishes a baseline, not a complete application security model.
+
+## Included controls
+
+- Helmet security headers with Content Security Policy.
+- Strict DTO property allowlisting.
+- A one MiB default request-body limit.
+- Rate limiting by client IP.
+- Request IDs restricted to 128 safe characters before log propagation.
+- Generic internal errors; unexpected exceptions are logged server-side only.
+- CORS disabled until an allowlist is configured.
+
+## Application responsibilities
+
+- Authenticate requests and authorize every sensitive operation.
+- Validate business rules, uploaded files and non-HTTP input.
+- Configure trusted proxies exactly; a wrong value allows IP spoofing.
+- Store secrets outside source control and rotate them.
+- Apply endpoint-specific rate limits for login and recovery flows.
+- Use TLS at the load balancer or application edge.
+- Keep Node and dependencies patched and review `npm audit` output.
+- Avoid exposing Swagger UI and detailed readiness data publicly.
+
+`Public()` and `Roles()` only attach metadata. They do nothing until an application
+guard reads that metadata and enforces the intended policy.
+
+## Reporting
+
+Follow the private disclosure instructions in [SECURITY.md](../SECURITY.md).

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@authuser/nest",
+  "version": "0.1.0",
+  "description": "Secure, high-performance NestJS foundation powered by Fastify",
+  "keywords": [
+    "nestjs",
+    "fastify",
+    "openapi",
+    "swagger",
+    "security",
+    "typescript"
+  ],
+  "license": "MIT",
+  "author": "Authuser",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "docs",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20.11"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "clean": "rimraf dist coverage",
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "prepack": "npm run clean && npm run build",
+    "check": "npm run typecheck && npm test && npm run build && npm pack --dry-run"
+  },
+  "dependencies": {
+    "@fastify/compress": "^9.2.0",
+    "@fastify/cors": "^11.3.0",
+    "@fastify/helmet": "^13.1.1",
+    "@fastify/rate-limit": "^11.2.0",
+    "@fastify/swagger": "^9.8.1",
+    "@fastify/swagger-ui": "^6.1.1",
+    "@nestjs/common": "^12.0.1",
+    "@nestjs/core": "^12.0.1",
+    "@nestjs/platform-fastify": "^12.0.1",
+    "@nestjs/swagger": "^12.0.1",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
+    "fastify": "^5.12.1",
+    "pino": "^10.3.1",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.2"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "@vitest/coverage-v8": "^4.0.0",
+    "rimraf": "^6.0.0",
+    "typescript": "^7.0.2",
+    "vitest": "^4.0.0"
+  },
+  "directories": {
+    "doc": "docs",
+    "test": "test"
+  }
+}