@bymax-one/nest-core 1.6.5 → 1.6.7

package/dist/index.cjs

@@ -18,6 +18,114 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
+// src/core.tokens.ts
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
+var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:correlation-provider"
+);
+var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
+var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-indicators"
+);
+var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-transition-sink"
+);
+var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:unexpected-error-sink"
+);
+var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:metrics-registry"
+);
+var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
+
+// src/envelope/error-codes.ts
+var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
+var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
+var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
+var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
+var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
+var BYMAX_CONFLICT = "BYMAX_CONFLICT";
+var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
+var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
+var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
+var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
+var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
+var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
+var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
+var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
+var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
+var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
+var STATUS_CODES = /* @__PURE__ */ new Map([
+  [400, BYMAX_BAD_REQUEST],
+  [401, BYMAX_UNAUTHORIZED],
+  [403, BYMAX_FORBIDDEN],
+  [404, BYMAX_NOT_FOUND],
+  [409, BYMAX_CONFLICT],
+  [413, BYMAX_PAYLOAD_TOO_LARGE],
+  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
+  [422, BYMAX_UNPROCESSABLE_ENTITY],
+  [429, BYMAX_TOO_MANY_REQUESTS],
+  [500, BYMAX_INTERNAL_ERROR],
+  [501, BYMAX_NOT_IMPLEMENTED],
+  [502, BYMAX_BAD_GATEWAY],
+  [503, BYMAX_SERVICE_UNAVAILABLE],
+  [504, BYMAX_GATEWAY_TIMEOUT]
+]);
+var CLIENT_ERROR_MIN = 400;
+var CLIENT_ERROR_MAX = 500;
+function codeForStatus(status) {
+  const catalogued = STATUS_CODES.get(status);
+  if (catalogued !== void 0) {
+    return catalogued;
+  }
+  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
+    return BYMAX_CLIENT_ERROR;
+  }
+  return BYMAX_INTERNAL_ERROR;
+}
+
+// src/body-depth/body-depth.middleware.ts
+var BODY_TOO_DEEP_MESSAGE = "Request body is nested too deeply";
+function exceedsDepth(value, maxDepth) {
+  let level = [value];
+  for (let depth = 0; level.length > 0; depth += 1) {
+    const next = [];
+    for (const node of level) {
+      if (typeof node === "object" && node !== null) {
+        if (depth >= maxDepth) {
+          return true;
+        }
+        for (const child of Object.values(node)) {
+          next.push(child);
+        }
+      }
+    }
+    level = next;
+  }
+  return false;
+}
+exports.BymaxBodyDepthMiddleware = class BymaxBodyDepthMiddleware {
+  constructor(options) {
+    this.options = options;
+  }
+  /**
+   * @param req - The request, whose `body` the parser has already filled.
+   * @param _res - Unused.
+   * @param next - Continues the chain.
+   * @throws BadRequestException When the body is nested too deeply.
+   */
+  use(req, _res, next) {
+    if (exceedsDepth(req.body, this.options.bodyDepth.maxDepth)) {
+      throw new common.BadRequestException({ code: BYMAX_BAD_REQUEST, message: BODY_TOO_DEEP_MESSAGE });
+    }
+    next();
+  }
+};
+exports.BymaxBodyDepthMiddleware = __decorateClass([
+  common.Injectable(),
+  __decorateParam(0, common.Inject(BYMAX_CORE_OPTIONS))
+], exports.BymaxBodyDepthMiddleware);
+
 // src/route-defaults.ts
 var DEFAULT_HEALTH_PATH = "health";
 var DEFAULT_METRICS_PATH = "metrics";
@@ -64,6 +172,16 @@ function resolveTiming(raw) {
   const threshold = raw?.slowRequestThresholdMs;
   return threshold === void 0 ? { enabled } : { enabled, slowRequestThresholdMs: threshold };
 }
+var DEFAULT_MAX_BODY_DEPTH = 32;
+function resolveBodyDepth(raw) {
+  const maxDepth = raw?.maxDepth ?? DEFAULT_MAX_BODY_DEPTH;
+  if (!Number.isSafeInteger(maxDepth) || maxDepth < 1) {
+    throw new Error(
+      `bodyDepth.maxDepth must be a positive safe integer, received ${String(maxDepth)}`
+    );
+  }
+  return { enabled: raw?.enabled ?? false, maxDepth };
+}
 function resolveHealth(raw) {
   return {
     enabled: raw?.enabled ?? true,
@@ -136,6 +254,7 @@ function normalizeCoreOptions(raw) {
   return deepFreeze({
     envelope: resolveEnvelope(raw?.envelope),
     timing: resolveTiming(raw?.timing),
+    bodyDepth: resolveBodyDepth(raw?.bodyDepth),
     health: resolveHealth(raw?.health),
     metrics: resolveMetrics(raw?.metrics),
     openapi: resolveOpenApi(raw?.openapi, raw?.environment),
@@ -148,26 +267,6 @@ function normalizeCoreOptions(raw) {
 }
 normalizeCoreOptions();
 
-// src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
-var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:correlation-provider"
-);
-var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
-var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-indicators"
-);
-var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-transition-sink"
-);
-var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:unexpected-error-sink"
-);
-var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:metrics-registry"
-);
-var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
-
 // src/optional-peer.ts
 function isMissingModuleError(cause) {
   const code = cause.code;
@@ -275,52 +374,6 @@ function containRejection(returned, onFailure) {
   }
 }
 
-// src/envelope/error-codes.ts
-var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
-var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
-var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
-var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
-var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
-var BYMAX_CONFLICT = "BYMAX_CONFLICT";
-var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
-var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
-var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
-var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
-var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
-var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
-var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
-var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
-var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
-var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
-var STATUS_CODES = /* @__PURE__ */ new Map([
-  [400, BYMAX_BAD_REQUEST],
-  [401, BYMAX_UNAUTHORIZED],
-  [403, BYMAX_FORBIDDEN],
-  [404, BYMAX_NOT_FOUND],
-  [409, BYMAX_CONFLICT],
-  [413, BYMAX_PAYLOAD_TOO_LARGE],
-  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
-  [422, BYMAX_UNPROCESSABLE_ENTITY],
-  [429, BYMAX_TOO_MANY_REQUESTS],
-  [500, BYMAX_INTERNAL_ERROR],
-  [501, BYMAX_NOT_IMPLEMENTED],
-  [502, BYMAX_BAD_GATEWAY],
-  [503, BYMAX_SERVICE_UNAVAILABLE],
-  [504, BYMAX_GATEWAY_TIMEOUT]
-]);
-var CLIENT_ERROR_MIN = 400;
-var CLIENT_ERROR_MAX = 500;
-function codeForStatus(status) {
-  const catalogued = STATUS_CODES.get(status);
-  if (catalogued !== void 0) {
-    return catalogued;
-  }
-  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
-    return BYMAX_CLIENT_ERROR;
-  }
-  return BYMAX_INTERNAL_ERROR;
-}
-
 // src/envelope/error-envelope.ts
 function buildErrorEnvelope(input) {
   const base = {
@@ -359,6 +412,12 @@ function extractRequestInfo(context) {
 var INTERNAL_ERROR_STATUS = 500;
 var INTERNAL_ERROR_MESSAGE = "Internal server error";
 var VALIDATION_FAILED_MESSAGE = "Validation failed";
+var MALFORMED_REQUEST_MESSAGE = "Malformed request";
+var PRE_ROUTING_MESSAGES = /* @__PURE__ */ new Map([
+  [400, MALFORMED_REQUEST_MESSAGE],
+  [413, "Request entity too large"],
+  [415, "Unsupported media type"]
+]);
 var ABSOLUTE_FORM_PREFIX = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
 function pathOf(url) {
   let target = String(url);
@@ -409,8 +468,9 @@ function resolveExposedClientError(exception) {
   if (typeof status !== "number" || !Number.isInteger(status) || status < CLIENT_ERROR_MIN2 || status >= CLIENT_ERROR_MAX2) {
     return void 0;
   }
+  const fixed = typeof candidate.type === "string" ? PRE_ROUTING_MESSAGES.get(status) : void 0;
   const message = exception instanceof Error ? exception.message : "";
-  return { status, message: message === "" ? INTERNAL_ERROR_MESSAGE : message };
+  return { status, message: fixed ?? (message === "" ? INTERNAL_ERROR_MESSAGE : message) };
 }
 function isValidationResponse(response) {
   return typeof response === "object" && response !== null && "message" in response && Array.isArray(response.message);
@@ -611,6 +671,9 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
         toValidationDetails(response.message)
       );
     }
+    if (status === 400 && readRequestInfo(request).route === UNMATCHED_ROUTE) {
+      return this.toEnvelope(status, codeForStatus(status), MALFORMED_REQUEST_MESSAGE, context);
+    }
     const message = extractHttpMessage(response, exception);
     const rawUrl = String(this.adapterHost.httpAdapter.getRequestUrl(request));
     return this.toEnvelope(
@@ -1687,12 +1750,14 @@ exports.BymaxCoreModule = class BymaxCoreModule extends BymaxCoreModuleBase {
    * @param consumer - Nest's middleware consumer.
    */
   configure(consumer) {
-    if (!this.resolved.timing.enabled) {
-      return;
-    }
     const adapter = this.adapterHost?.httpAdapter;
-    const onFastify = bridgeFastifyRouteMetadata(adapter);
-    consumer.apply(exports.BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    if (this.resolved.timing.enabled) {
+      const onFastify = bridgeFastifyRouteMetadata(adapter);
+      consumer.apply(exports.BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    }
+    if (this.resolved.bodyDepth.enabled && adapter?.getType?.() !== "fastify") {
+      consumer.apply(exports.BymaxBodyDepthMiddleware).forRoutes("/");
+    }
   }
   /**
    * Register the module synchronously. Options are known now, so disabled

package/dist/index.d.cts

@@ -22,6 +22,25 @@ interface TimingOptions {
     /** Samples above this threshold are flagged as slow. No default (unset). */
     slowRequestThresholdMs?: number;
 }
+/** Request-body nesting limit, applied before the application's own validation runs. */
+interface BodyDepthOptions {
+    /**
+     * Refuse a parsed request body nested deeper than {@link BodyDepthOptions.maxDepth} with a
+     * `400` through the error envelope. Default: `false`.
+     *
+     * Off by default because turning it on rejects bodies that are accepted today. Enable it:
+     * a body of a few thousand nested arrays is only a few kilobytes, and a recursive validator
+     * or transformer overflows the stack on it, so the request is answered `500`, with no
+     * credential needed. The check runs before routing, on the body the parser already produced, so it covers the Express adapter and a body parsed by
+     * Nest's own parsers; it does not cover Fastify.
+     */
+    enabled?: boolean;
+    /**
+     * The deepest nesting a body may have: `[[1]]` is depth 2, a flat object or array is depth 1,
+     * and a scalar is depth 0. Must be a positive safe integer. Default: `32`.
+     */
+    maxDepth?: number;
+}
 /** Liveness and readiness endpoint configuration. */
 interface HealthOptions {
     /** Register the health controller. Default: `true`. */
@@ -267,6 +286,8 @@ interface BymaxCoreModuleOptions {
     envelope?: EnvelopeOptions;
     /** Request-timing middleware. Default: enabled. */
     timing?: TimingOptions;
+    /** Request-body nesting limit. Default: disabled. */
+    bodyDepth?: BodyDepthOptions;
     /** Liveness and readiness endpoints. Default: enabled. */
     health?: HealthOptions;
     /** Prometheus metrics endpoint. Default: disabled. */
@@ -308,6 +329,11 @@ interface ResolvedTimingOptions {
     enabled: boolean;
     slowRequestThresholdMs?: number;
 }
+/** Fully-resolved body-depth options. */
+interface ResolvedBodyDepthOptions {
+    enabled: boolean;
+    maxDepth: number;
+}
 /** Fully-resolved health options. */
 interface ResolvedHealthOptions {
     enabled: boolean;
@@ -365,6 +391,7 @@ interface ResolvedOpenApiOptions {
 interface ResolvedCoreOptions {
     envelope: ResolvedEnvelopeOptions;
     timing: ResolvedTimingOptions;
+    bodyDepth: ResolvedBodyDepthOptions;
     health: ResolvedHealthOptions;
     metrics: ResolvedMetricsOptions;
     openapi: ResolvedOpenApiOptions;
@@ -1115,6 +1142,21 @@ declare class TimingInterceptor implements NestInterceptor {
     private recordSample;
 }
 
+/** Refuses a body nested deeper than `bodyDepth.maxDepth` with a coded `400`. */
+declare class BymaxBodyDepthMiddleware implements NestMiddleware {
+    private readonly options;
+    constructor(options: ResolvedCoreOptions);
+    /**
+     * @param req - The request, whose `body` the parser has already filled.
+     * @param _res - Unused.
+     * @param next - Continues the chain.
+     * @throws BadRequestException When the body is nested too deeply.
+     */
+    use(req: {
+        body?: unknown;
+    }, _res: unknown, next: () => void): void;
+}
+
 /**
  * @fileoverview Neutral request-info accessor for request timing. Reads the
  * HTTP method and the route template off a request without assuming Express or
@@ -1296,5 +1338,5 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
-export type { BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxBodyDepthMiddleware, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export type { BodyDepthOptions, BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };

package/dist/index.d.ts

@@ -22,6 +22,25 @@ interface TimingOptions {
     /** Samples above this threshold are flagged as slow. No default (unset). */
     slowRequestThresholdMs?: number;
 }
+/** Request-body nesting limit, applied before the application's own validation runs. */
+interface BodyDepthOptions {
+    /**
+     * Refuse a parsed request body nested deeper than {@link BodyDepthOptions.maxDepth} with a
+     * `400` through the error envelope. Default: `false`.
+     *
+     * Off by default because turning it on rejects bodies that are accepted today. Enable it:
+     * a body of a few thousand nested arrays is only a few kilobytes, and a recursive validator
+     * or transformer overflows the stack on it, so the request is answered `500`, with no
+     * credential needed. The check runs before routing, on the body the parser already produced, so it covers the Express adapter and a body parsed by
+     * Nest's own parsers; it does not cover Fastify.
+     */
+    enabled?: boolean;
+    /**
+     * The deepest nesting a body may have: `[[1]]` is depth 2, a flat object or array is depth 1,
+     * and a scalar is depth 0. Must be a positive safe integer. Default: `32`.
+     */
+    maxDepth?: number;
+}
 /** Liveness and readiness endpoint configuration. */
 interface HealthOptions {
     /** Register the health controller. Default: `true`. */
@@ -267,6 +286,8 @@ interface BymaxCoreModuleOptions {
     envelope?: EnvelopeOptions;
     /** Request-timing middleware. Default: enabled. */
     timing?: TimingOptions;
+    /** Request-body nesting limit. Default: disabled. */
+    bodyDepth?: BodyDepthOptions;
     /** Liveness and readiness endpoints. Default: enabled. */
     health?: HealthOptions;
     /** Prometheus metrics endpoint. Default: disabled. */
@@ -308,6 +329,11 @@ interface ResolvedTimingOptions {
     enabled: boolean;
     slowRequestThresholdMs?: number;
 }
+/** Fully-resolved body-depth options. */
+interface ResolvedBodyDepthOptions {
+    enabled: boolean;
+    maxDepth: number;
+}
 /** Fully-resolved health options. */
 interface ResolvedHealthOptions {
     enabled: boolean;
@@ -365,6 +391,7 @@ interface ResolvedOpenApiOptions {
 interface ResolvedCoreOptions {
     envelope: ResolvedEnvelopeOptions;
     timing: ResolvedTimingOptions;
+    bodyDepth: ResolvedBodyDepthOptions;
     health: ResolvedHealthOptions;
     metrics: ResolvedMetricsOptions;
     openapi: ResolvedOpenApiOptions;
@@ -1115,6 +1142,21 @@ declare class TimingInterceptor implements NestInterceptor {
     private recordSample;
 }
 
+/** Refuses a body nested deeper than `bodyDepth.maxDepth` with a coded `400`. */
+declare class BymaxBodyDepthMiddleware implements NestMiddleware {
+    private readonly options;
+    constructor(options: ResolvedCoreOptions);
+    /**
+     * @param req - The request, whose `body` the parser has already filled.
+     * @param _res - Unused.
+     * @param next - Continues the chain.
+     * @throws BadRequestException When the body is nested too deeply.
+     */
+    use(req: {
+        body?: unknown;
+    }, _res: unknown, next: () => void): void;
+}
+
 /**
  * @fileoverview Neutral request-info accessor for request timing. Reads the
  * HTTP method and the route template off a request without assuming Express or
@@ -1296,5 +1338,5 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
-export type { BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxBodyDepthMiddleware, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export type { BodyDepthOptions, BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };