@bymax-one/nest-core 1.3.0 → 1.3.2

package/dist/index.d.cts

@@ -68,6 +68,44 @@ interface OpenApiServerDescriptor {
  * so the consumer's declaration reaches the UI unchanged.
  */
 type OpenApiSecurityScheme = Readonly<Record<string, unknown>>;
+/**
+ * One security requirement: scheme name to the scopes it needs, empty for a
+ * scheme that takes none. An operation's requirements are alternatives — any
+ * one of them satisfies it — so an empty *array* of requirements means the
+ * operation needs no authentication at all, which is how the specification
+ * expresses a public route that overrides a document-level default.
+ */
+type OpenApiSecurityRequirement = Readonly<Record<string, readonly string[]>>;
+/** The HTTP methods an OpenAPI path item can carry an operation under. */
+type OpenApiHttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS' | 'TRACE';
+/**
+ * Addresses one operation in the generated document, as `"<METHOD> <path>"`.
+ *
+ * This format is a documented contract, not an implementation detail: a sibling
+ * library may ship a plain-data map of its own operations keyed this way, so a
+ * consumer spreads it into {@link OpenApiOptions.operationSecurity} instead of
+ * restating which of that library's routes are public. Import the type to get
+ * that map checked at the library's own compile time.
+ *
+ * The method is uppercase, one space separates the two parts, and the path is
+ * written **exactly as it appears in the generated document**: leading slash,
+ * OpenAPI template braces (`/users/{id}`), no trailing slash, and including any
+ * global prefix the application sets. That last part is the one that surprises:
+ * `@nestjs/swagger` includes `app.setGlobalPrefix('api')` in the documented
+ * paths, so the key is `'POST /api/auth/login'` in an application that sets one.
+ * A library shipping such a map should therefore expose a *function* taking the
+ * prefix rather than a frozen constant — the call site is the only place that
+ * knows it.
+ *
+ * @example 'GET /users/{id}'
+ * @example 'POST /api/auth/login'
+ */
+type OpenApiOperationKey = `${OpenApiHttpMethod} /${string}`;
+/**
+ * Per-operation security requirements, keyed by {@link OpenApiOperationKey}.
+ * An empty array marks the operation public, overriding any document default.
+ */
+type OperationSecurityMap = Readonly<Record<OpenApiOperationKey, readonly OpenApiSecurityRequirement[]>>;
 /**
  * OpenAPI document configuration.
  *
@@ -96,10 +134,53 @@ interface OpenApiOptions {
     servers?: readonly OpenApiServerDescriptor[];
     /** Security schemes added to the document's components. Default: `{}`. */
     securitySchemes?: Readonly<Record<string, OpenApiSecurityScheme>>;
+    /**
+     * The requirement every operation carries unless it says otherwise, naming
+     * schemes declared in {@link OpenApiOptions.securitySchemes}. Default: `[]`,
+     * which documents nothing and leaves every operation as it was generated.
+     *
+     * Set this when most of the API is authenticated, and mark the exceptions
+     * public through {@link OpenApiOptions.operationSecurity}. An operation that
+     * already declares its own requirement is never overwritten.
+     *
+     * @example [{ cookieAuth: [] }]
+     */
+    security?: readonly OpenApiSecurityRequirement[];
+    /**
+     * Per-operation overrides of {@link OpenApiOptions.security}, keyed by
+     * {@link OpenApiOperationKey}. An empty array marks that operation public.
+     * Default: `{}`.
+     *
+     * A key matching no operation in the generated document is a configuration
+     * error and fails the document build, naming the keys that do exist. Silence
+     * would be worse: a route renamed out from under a stale key would quietly
+     * inherit the document default and be documented as authenticated when it is
+     * not, or the reverse.
+     *
+     * That check runs only when the document is built. With
+     * {@link OpenApiOptions.enabled} false, or in a production runtime where the
+     * feature is forced off, a stale key is not reported — refusing to boot a
+     * service over a documentation setting it never serves would be the wrong
+     * trade. The cost is that the error waits for an environment that has the
+     * document switched on.
+     *
+     * @example
+     *   {
+     *     'POST /auth/login': [],
+     *     'POST /auth/refresh': [{ refreshCookie: [] }]
+     *   }
+     */
+    operationSecurity?: OperationSecurityMap;
     /**
      * Contribute the schemas this package owns — the error envelope, the health
-     * response, and the pagination shapes — to the document's components.
-     * Default: `true`.
+     * response, and the pagination shapes — to the document's components, and
+     * reference them from the operations that return them: the error envelope as
+     * every operation's `default` response, and the health response on the health
+     * endpoints this package registers. Default: `true`.
+     *
+     * The two halves are one switch because they are one decision. Referencing a
+     * schema this package did not contribute would leave a dangling `$ref`, and a
+     * document that resolves nowhere is worse than one that says less.
      */
     includeCoreSchemas?: boolean;
 }
@@ -221,6 +302,8 @@ interface ResolvedOpenApiOptions {
     version: string;
     servers: readonly OpenApiServerDescriptor[];
     securitySchemes: Readonly<Record<string, OpenApiSecurityScheme>>;
+    security: readonly OpenApiSecurityRequirement[];
+    operationSecurity: OperationSecurityMap;
     includeCoreSchemas: boolean;
 }
 /**
@@ -295,6 +378,43 @@ declare class BymaxCoreModule extends BymaxCoreModuleBase {
  * @fileoverview Dependency-injection tokens for `@bymax-one/nest-core`.
  * Every token is a `Symbol`, so the container never collides with a consumer's
  * string tokens and the public contracts stay explicit at every injection site.
+ *
+ * Every token is minted with `Symbol.for`, never `Symbol()`. This package ships
+ * one bundle per published subpath and the bundler inlines shared modules into
+ * each of them, so this file exists once per bundle at runtime: a `Symbol()`
+ * token would mint a *different* identity in `dist/index.cjs` than in
+ * `dist/openapi/index.cjs`, and a provider registered from the package root
+ * would be unreachable from a subpath that injects "the same" token. That is not
+ * hypothetical — it is the 1.3.0 defect that made `applyBymaxOpenApi` throw on
+ * every consumer boot. `Symbol.for` resolves through the runtime's global symbol
+ * registry, so all copies converge on one identity no matter how many bundles
+ * carry them. The same reasoning keeps the health marker's metadata key a
+ * literal; see `health/health.marker.ts`.
+ *
+ * The registry keys below are therefore part of the package's public contract,
+ * as binding as the export names: changing one is a breaking change even though
+ * no signature moves. They are namespaced with the full npm package name because
+ * the registry is process-global and shared with every other library in the
+ * application — the package name is the one string guaranteed not to collide.
+ *
+ * The keys carry no version, which is a deliberate choice with a consequence
+ * worth stating plainly. Every copy of this package loaded into one process
+ * shares these identities, whatever its version. Within a major that is exactly
+ * what is wanted: two resolved instances of the same major agree on what each
+ * token binds, so sharing one identity is what makes a duplicated install
+ * harmless rather than broken. Across majors it is a hazard: a consumer of one
+ * major would resolve, without complaint, a value registered by another against
+ * a contract it does not know, and fail later on an unexpected shape instead of
+ * immediately on an unresolvable token.
+ *
+ * That hazard is not specific to the options snapshot. Each token below binds
+ * its own contract — the correlation provider, the timing sink, the health
+ * indicator array, the metrics registry, the trace-context reader — and every
+ * one of them is now shared across majors by the same mechanism. So this belongs
+ * on the major-release checklist, not in a comment nobody reads at the right
+ * moment: **a major that changes the contract behind any token here must change
+ * that token's key in the same commit.** Changing a key is already a breaking
+ * change, which is precisely why a major is the only place it can happen.
  * @layer Constants
  */
 /**
@@ -787,4 +907,4 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, type BuildErrorEnvelopeInput, BymaxCoreModule, type BymaxCoreModuleOptions, BymaxExceptionFilter, type EnvelopeOptions, type ErrorDetails, type ErrorEnvelope, type FilterErrorContext, type HealthOptions, type ICorrelationIdProvider, type ITimingSink, type ITraceContextProvider, type MetricsOptions, type OpenApiOptions, type OpenApiSecurityScheme, type OpenApiServerDescriptor, type RequestTimingSample, type ResolvedCoreOptions, type TelemetryOptions, TimingInterceptor, type TimingOptions, type TraceContext, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, type BuildErrorEnvelopeInput, BymaxCoreModule, type BymaxCoreModuleOptions, BymaxExceptionFilter, type EnvelopeOptions, type ErrorDetails, type ErrorEnvelope, type FilterErrorContext, type HealthOptions, type ICorrelationIdProvider, type ITimingSink, type ITraceContextProvider, type MetricsOptions, type OpenApiHttpMethod, type OpenApiOperationKey, type OpenApiOptions, type OpenApiSecurityRequirement, type OpenApiSecurityScheme, type OpenApiServerDescriptor, type OperationSecurityMap, type RequestTimingSample, type ResolvedCoreOptions, type TelemetryOptions, TimingInterceptor, type TimingOptions, type TraceContext, buildErrorEnvelope, codeForStatus };

package/dist/index.d.ts

@@ -68,6 +68,44 @@ interface OpenApiServerDescriptor {
  * so the consumer's declaration reaches the UI unchanged.
  */
 type OpenApiSecurityScheme = Readonly<Record<string, unknown>>;
+/**
+ * One security requirement: scheme name to the scopes it needs, empty for a
+ * scheme that takes none. An operation's requirements are alternatives — any
+ * one of them satisfies it — so an empty *array* of requirements means the
+ * operation needs no authentication at all, which is how the specification
+ * expresses a public route that overrides a document-level default.
+ */
+type OpenApiSecurityRequirement = Readonly<Record<string, readonly string[]>>;
+/** The HTTP methods an OpenAPI path item can carry an operation under. */
+type OpenApiHttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS' | 'TRACE';
+/**
+ * Addresses one operation in the generated document, as `"<METHOD> <path>"`.
+ *
+ * This format is a documented contract, not an implementation detail: a sibling
+ * library may ship a plain-data map of its own operations keyed this way, so a
+ * consumer spreads it into {@link OpenApiOptions.operationSecurity} instead of
+ * restating which of that library's routes are public. Import the type to get
+ * that map checked at the library's own compile time.
+ *
+ * The method is uppercase, one space separates the two parts, and the path is
+ * written **exactly as it appears in the generated document**: leading slash,
+ * OpenAPI template braces (`/users/{id}`), no trailing slash, and including any
+ * global prefix the application sets. That last part is the one that surprises:
+ * `@nestjs/swagger` includes `app.setGlobalPrefix('api')` in the documented
+ * paths, so the key is `'POST /api/auth/login'` in an application that sets one.
+ * A library shipping such a map should therefore expose a *function* taking the
+ * prefix rather than a frozen constant — the call site is the only place that
+ * knows it.
+ *
+ * @example 'GET /users/{id}'
+ * @example 'POST /api/auth/login'
+ */
+type OpenApiOperationKey = `${OpenApiHttpMethod} /${string}`;
+/**
+ * Per-operation security requirements, keyed by {@link OpenApiOperationKey}.
+ * An empty array marks the operation public, overriding any document default.
+ */
+type OperationSecurityMap = Readonly<Record<OpenApiOperationKey, readonly OpenApiSecurityRequirement[]>>;
 /**
  * OpenAPI document configuration.
  *
@@ -96,10 +134,53 @@ interface OpenApiOptions {
     servers?: readonly OpenApiServerDescriptor[];
     /** Security schemes added to the document's components. Default: `{}`. */
     securitySchemes?: Readonly<Record<string, OpenApiSecurityScheme>>;
+    /**
+     * The requirement every operation carries unless it says otherwise, naming
+     * schemes declared in {@link OpenApiOptions.securitySchemes}. Default: `[]`,
+     * which documents nothing and leaves every operation as it was generated.
+     *
+     * Set this when most of the API is authenticated, and mark the exceptions
+     * public through {@link OpenApiOptions.operationSecurity}. An operation that
+     * already declares its own requirement is never overwritten.
+     *
+     * @example [{ cookieAuth: [] }]
+     */
+    security?: readonly OpenApiSecurityRequirement[];
+    /**
+     * Per-operation overrides of {@link OpenApiOptions.security}, keyed by
+     * {@link OpenApiOperationKey}. An empty array marks that operation public.
+     * Default: `{}`.
+     *
+     * A key matching no operation in the generated document is a configuration
+     * error and fails the document build, naming the keys that do exist. Silence
+     * would be worse: a route renamed out from under a stale key would quietly
+     * inherit the document default and be documented as authenticated when it is
+     * not, or the reverse.
+     *
+     * That check runs only when the document is built. With
+     * {@link OpenApiOptions.enabled} false, or in a production runtime where the
+     * feature is forced off, a stale key is not reported — refusing to boot a
+     * service over a documentation setting it never serves would be the wrong
+     * trade. The cost is that the error waits for an environment that has the
+     * document switched on.
+     *
+     * @example
+     *   {
+     *     'POST /auth/login': [],
+     *     'POST /auth/refresh': [{ refreshCookie: [] }]
+     *   }
+     */
+    operationSecurity?: OperationSecurityMap;
     /**
      * Contribute the schemas this package owns — the error envelope, the health
-     * response, and the pagination shapes — to the document's components.
-     * Default: `true`.
+     * response, and the pagination shapes — to the document's components, and
+     * reference them from the operations that return them: the error envelope as
+     * every operation's `default` response, and the health response on the health
+     * endpoints this package registers. Default: `true`.
+     *
+     * The two halves are one switch because they are one decision. Referencing a
+     * schema this package did not contribute would leave a dangling `$ref`, and a
+     * document that resolves nowhere is worse than one that says less.
      */
     includeCoreSchemas?: boolean;
 }
@@ -221,6 +302,8 @@ interface ResolvedOpenApiOptions {
     version: string;
     servers: readonly OpenApiServerDescriptor[];
     securitySchemes: Readonly<Record<string, OpenApiSecurityScheme>>;
+    security: readonly OpenApiSecurityRequirement[];
+    operationSecurity: OperationSecurityMap;
     includeCoreSchemas: boolean;
 }
 /**
@@ -295,6 +378,43 @@ declare class BymaxCoreModule extends BymaxCoreModuleBase {
  * @fileoverview Dependency-injection tokens for `@bymax-one/nest-core`.
  * Every token is a `Symbol`, so the container never collides with a consumer's
  * string tokens and the public contracts stay explicit at every injection site.
+ *
+ * Every token is minted with `Symbol.for`, never `Symbol()`. This package ships
+ * one bundle per published subpath and the bundler inlines shared modules into
+ * each of them, so this file exists once per bundle at runtime: a `Symbol()`
+ * token would mint a *different* identity in `dist/index.cjs` than in
+ * `dist/openapi/index.cjs`, and a provider registered from the package root
+ * would be unreachable from a subpath that injects "the same" token. That is not
+ * hypothetical — it is the 1.3.0 defect that made `applyBymaxOpenApi` throw on
+ * every consumer boot. `Symbol.for` resolves through the runtime's global symbol
+ * registry, so all copies converge on one identity no matter how many bundles
+ * carry them. The same reasoning keeps the health marker's metadata key a
+ * literal; see `health/health.marker.ts`.
+ *
+ * The registry keys below are therefore part of the package's public contract,
+ * as binding as the export names: changing one is a breaking change even though
+ * no signature moves. They are namespaced with the full npm package name because
+ * the registry is process-global and shared with every other library in the
+ * application — the package name is the one string guaranteed not to collide.
+ *
+ * The keys carry no version, which is a deliberate choice with a consequence
+ * worth stating plainly. Every copy of this package loaded into one process
+ * shares these identities, whatever its version. Within a major that is exactly
+ * what is wanted: two resolved instances of the same major agree on what each
+ * token binds, so sharing one identity is what makes a duplicated install
+ * harmless rather than broken. Across majors it is a hazard: a consumer of one
+ * major would resolve, without complaint, a value registered by another against
+ * a contract it does not know, and fail later on an unexpected shape instead of
+ * immediately on an unresolvable token.
+ *
+ * That hazard is not specific to the options snapshot. Each token below binds
+ * its own contract — the correlation provider, the timing sink, the health
+ * indicator array, the metrics registry, the trace-context reader — and every
+ * one of them is now shared across majors by the same mechanism. So this belongs
+ * on the major-release checklist, not in a comment nobody reads at the right
+ * moment: **a major that changes the contract behind any token here must change
+ * that token's key in the same commit.** Changing a key is already a breaking
+ * change, which is precisely why a major is the only place it can happen.
  * @layer Constants
  */
 /**
@@ -787,4 +907,4 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, type BuildErrorEnvelopeInput, BymaxCoreModule, type BymaxCoreModuleOptions, BymaxExceptionFilter, type EnvelopeOptions, type ErrorDetails, type ErrorEnvelope, type FilterErrorContext, type HealthOptions, type ICorrelationIdProvider, type ITimingSink, type ITraceContextProvider, type MetricsOptions, type OpenApiOptions, type OpenApiSecurityScheme, type OpenApiServerDescriptor, type RequestTimingSample, type ResolvedCoreOptions, type TelemetryOptions, TimingInterceptor, type TimingOptions, type TraceContext, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, type BuildErrorEnvelopeInput, BymaxCoreModule, type BymaxCoreModuleOptions, BymaxExceptionFilter, type EnvelopeOptions, type ErrorDetails, type ErrorEnvelope, type FilterErrorContext, type HealthOptions, type ICorrelationIdProvider, type ITimingSink, type ITraceContextProvider, type MetricsOptions, type OpenApiHttpMethod, type OpenApiOperationKey, type OpenApiOptions, type OpenApiSecurityRequirement, type OpenApiSecurityScheme, type OpenApiServerDescriptor, type OperationSecurityMap, type RequestTimingSample, type ResolvedCoreOptions, type TelemetryOptions, TimingInterceptor, type TimingOptions, type TraceContext, buildErrorEnvelope, codeForStatus };

package/dist/index.mjs

@@ -15,6 +15,10 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
+// src/route-defaults.ts
+var DEFAULT_HEALTH_PATH = "health";
+var DEFAULT_METRICS_PATH = "metrics";
+
 // src/runtime.environment.ts
 var NON_PRODUCTION_ENVIRONMENTS = /* @__PURE__ */ new Set(["development", "test"]);
 function isProductionRuntime(value = process.env["NODE_ENV"]) {
@@ -25,9 +29,7 @@ function isProductionRuntime(value = process.env["NODE_ENV"]) {
 }
 
 // src/core.options.ts
-var DEFAULT_HEALTH_PATH = "health";
 var DEFAULT_INDICATOR_TIMEOUT_MS = 5e3;
-var DEFAULT_METRICS_PATH = "metrics";
 var DEFAULT_OPENAPI_PATH = "docs";
 var DEFAULT_OPENAPI_JSON_PATH = "docs-json";
 var DEFAULT_OPENAPI_TITLE = "API";
@@ -103,6 +105,11 @@ function resolveOpenApi(raw) {
     // consumer-owned nested objects, and the deep-freeze below would otherwise
     // reach into them.
     securitySchemes: structuredClone(raw?.securitySchemes ?? {}),
+    // Cloned for the same reason as the schemes above: both are consumer-owned
+    // nested structures, and the deep-freeze applied to the snapshot would
+    // otherwise reach into objects the consumer still holds a reference to.
+    security: structuredClone(raw?.security ?? []),
+    operationSecurity: structuredClone(raw?.operationSecurity ?? {}),
     includeCoreSchemas: raw?.includeCoreSchemas ?? true
   };
 }
@@ -125,12 +132,18 @@ function normalizeCoreOptions(raw) {
 normalizeCoreOptions();
 
 // src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CORE_OPTIONS");
-var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol("BYMAX_CORRELATION_PROVIDER");
-var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol("BYMAX_TIMING_SINK");
-var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol("BYMAX_HEALTH_INDICATORS");
-var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol("BYMAX_METRICS_REGISTRY");
-var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol("BYMAX_TRACE_CONTEXT");
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
+var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:correlation-provider"
+);
+var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
+var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-indicators"
+);
+var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:metrics-registry"
+);
+var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
 
 // src/optional-peer.ts
 function isMissingModuleError(cause) {
@@ -199,7 +212,7 @@ async function resolveTraceContextProvider(options) {
 var DEFAULT_MONOTONIC_CLOCK = {
   now: () => performance.now()
 };
-var BYMAX_TIMING_CLOCK = /* @__PURE__ */ Symbol("BYMAX_TIMING_CLOCK");
+var BYMAX_TIMING_CLOCK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-clock");
 
 // src/defaults.providers.ts
 var NoopCorrelationIdProvider = class {