@bymax-one/nest-core 1.6.6 → 1.6.7

package/CHANGELOG.md

@@ -11,6 +11,35 @@ heading here.
 
 ## [Unreleased]
 
+## [1.6.7] - 2026-11-12
+
+A patch release. Two floors that every backend re-implemented move into the library; both are additive
+and nothing changes for an application that does not turn them on.
+
+**Apply to a derived backend:** `pnpm up @bymax-one/nest-core`, then replace a local body-depth
+middleware with `bodyDepth: { enabled: true }` and a local helmet, parser and timeout block with
+`await applyHttpFloors(app)` from `@bymax-one/nest-core/http` (add `helmet`). Call it right after
+`applyAccessLog` and before the cookie parser, trusted proxies and `applyBymaxOpenApi`.
+
+### Added
+
+- **`bodyDepth` refuses a request body nested deeper than a limit with a `400`.** A body of about
+  2,000 nested arrays is 4 KB, and the recursion in a validator or transformer overflows the stack
+  on it, so the filter answered `500` for a request that was only malformed, with no credential
+  needed (measured with Nest's `ValidationPipe`). The new `BymaxBodyDepthMiddleware` checks
+  the body Nest's parsers already produced, before the application's validation, and answers
+  `BYMAX_BAD_REQUEST` ("Request body is nested too deeply"). **Off by default** (`enabled: false`,
+  `maxDepth: 32`) because turning it on rejects bodies that are accepted today. Express only; it is
+  not mounted on Fastify, whose middleware runs before the body is parsed.
+- **`applyHttpFloors` in the new `./http` subpath.** One bootstrap call for `helmet` without HSTS
+  (options pass through, `helmet: false` leaves it out), JSON and urlencoded parsers that refuse a
+  compressed body with `415` instead of decompressing it, and the header and request timeouts
+  (15 s and 30 s), enforced within a second: it also sets the server's connection sweep to one
+  second (`connectionsCheckingIntervalMs`), since Node's default of thirty would let a 15 s timeout
+  cut anywhere up to 45 s; it throws when the server is already listening. `helmet` is an optional peer, loaded only when the helper runs. Express only.
+- The root bundle's brotli budget moves from 17.25 to 17.75 KiB for the body-depth code; `./http`
+  has a budget of 1 KiB.
+
 ## [1.6.6] - 2026-11-07
 
 A patch release. The error envelope no longer returns the parser's own text for a request refused before
@@ -1336,4 +1365,5 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.6.4]: https://github.com/bymaxone/nest-core/compare/v1.6.3...v1.6.4
 [1.6.5]: https://github.com/bymaxone/nest-core/compare/v1.6.4...v1.6.5
 [1.6.6]: https://github.com/bymaxone/nest-core/compare/v1.6.5...v1.6.6
-[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.6...HEAD
+[1.6.7]: https://github.com/bymaxone/nest-core/compare/v1.6.6...v1.6.7
+[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.7...HEAD

package/README.md

@@ -126,6 +126,7 @@ never loads its peer, which the release gate asserts against the packed tarball.
 | `./pagination` | `normalizePageQuery`, `buildPageResult`, `normalizeCursorQuery`, `buildCursorResult`, `encodeCursor`, `decodeCursor` and their types — pure functions, no NestJS provider involved                                                                                  |
 | `./health`     | `IHealthIndicator`, `HealthResponse`, the indicator contracts and the `@BymaxHealthIndicator()` marker, so a package that only implements an indicator does not import the module                                                                                   |
 | `./metrics`    | `IMetricsContributor` and the `@BymaxMetricsContributor()` marker, so a package that only publishes metrics imports neither the module nor its DI tokens. The one subpath whose types name `prom-client`, which anyone implementing the contract already depends on |
+| `./http`       | `applyHttpFloors`, the one bootstrap call for the HTTP-level floors: security headers, compressed request bodies refused, and the header and request timeouts — separate so an application that never calls it never loads `helmet`                                 |
 | `./openapi`    | `applyBymaxOpenApi`, the one bootstrap call that builds and mounts the OpenAPI document — separate so an application that never documents its API never loads the code that does                                                                                    |
 
 Each subpath ships ESM and CommonJS with its own `.d.ts` and `.d.cts`, so
@@ -138,13 +139,14 @@ pnpm add @bymax-one/nest-core @nestjs/common @nestjs/core reflect-metadata rxjs
 ```
 
 Add `prom-client` if you enable the metrics feature, `@nestjs/swagger` if you
-enable the OpenAPI feature, and `@opentelemetry/api` if you enable trace
-correlation. All three are optional peer dependencies: none is required, or ever
-loaded, unless you turn its feature on.
+enable the OpenAPI feature, `@opentelemetry/api` if you enable trace
+correlation, and `helmet` if you call `applyHttpFloors`. Each is an optional peer
+dependency: none is required, or ever loaded, unless you turn its feature on.
 
 ```bash
 pnpm add prom-client
 pnpm add @opentelemetry/api
+pnpm add helmet
 pnpm add -D @nestjs/swagger
 ```
 
@@ -232,6 +234,28 @@ and the classification table: [Production is a closed door](#production-is-a-clo
 | `enabled`                | `boolean` | `true`  | Applies the request-timing middleware to every route.                          |
 | `slowRequestThresholdMs` | `number`  | unset   | Samples above this duration are flagged `slow: true`. Absent means never slow. |
 
+### `bodyDepth`
+
+| Option     | Type      | Default | Description                                                                                        |
+| ---------- | --------- | ------- | -------------------------------------------------------------------------------------------------- |
+| `enabled`  | `boolean` | `false` | Refuses a request body nested deeper than `maxDepth` with a `400` through the envelope. See below. |
+| `maxDepth` | `number`  | `32`    | The deepest nesting a body may have. A flat object or array is depth 1. A positive safe integer.   |
+
+**Off by default, and worth turning on.** It is off because turning it on rejects bodies that
+are accepted today, and a patch release must not start doing that. Turn it on: a body of about
+2,000 nested arrays is only 4 KB, and the recursion in a validator or transformer
+(`class-validator`, `class-transformer`) overflows the stack on it. The filter then answers
+`500` for a request that was only malformed — measured with Nest's `ValidationPipe` on an
+application route, needing no credential, so it is also a way to make a healthy service look
+broken to a monitor. This package ships no validation of its own, so the limit sits in front of
+yours: the check runs on the body Nest's parsers already produced and answers
+`400 BYMAX_BAD_REQUEST` ("Request body is nested too deeply") before routing, so it protects
+every route, this package's own included, before any pipe runs.
+
+It covers the Express adapter. It does nothing when the application disables Nest's body
+parsers, or parses bodies after module middleware has run, and it is not mounted on Fastify,
+whose middleware runs before the body is parsed.
+
 ### `health`
 
 | Option                  | Type      | Default    | Description                                                                                                             |
@@ -1681,6 +1705,55 @@ same `@Global()`-module pattern is how every pluggable token in this package
 is overridden: `BYMAX_TIMING_SINK` and `BYMAX_HEALTH_INDICATORS` follow it
 identically.
 
+## 🧱 HTTP Floors
+
+`applyHttpFloors` (from `@bymax-one/nest-core/http`) is the HTTP-level protection that every
+backend wants and none should tune per deployment. One call, before `app.listen()`:
+
+```typescript
+import { NestFactory } from '@nestjs/core'
+import { applyHttpFloors } from '@bymax-one/nest-core/http'
+import { AppModule } from './app.module'
+
+async function bootstrap(): Promise<void> {
+  const app = await NestFactory.create(AppModule)
+  await applyHttpFloors(app)
+  await app.listen(3000)
+}
+void bootstrap()
+```
+
+| What               | Default                                                                                                                                                                                                                                |
+| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Security headers   | `helmet()` with `strictTransportSecurity: false` (TLS is normally ended in front of the app, which owns HSTS). Pass `helmet: { ... }` to tune it, for example the CSP of a browser-serving backend, or `helmet: false` to leave it out |
+| Request bodies     | The JSON and urlencoded parsers refuse a compressed body (`Content-Encoding`) with `415` instead of decompressing it, on every route and before routing. Size limits and the extended form syntax keep the parsers' defaults           |
+| `headersTimeoutMs` | `15000`: the longest a client may take to send its complete header block. Node's own default is 60 s, which leaves a header block sent a byte at a time open as a cheap denial of service                                              |
+| `requestTimeoutMs` | `30000`: the longest a single request, headers and body together, may take. Node's default is 5 minutes. Must not be below `headersTimeoutMs`                                                                                          |
+
+`keepAliveTimeout` is left at Node's 5 s: raising it only lengthens idle-socket retention.
+
+Node enforces both timeouts from a sweep over the open connections, not from a timer per
+connection, and the sweep runs every 30 s by default: measured, a 1 s header timeout left a
+dribbled header block open for 30 s. The helper therefore also sets the server's
+`connectionsCheckingInterval` to one second (or the header timeout, if that is shorter), so a
+connection is cut within a second of its timeout expiring. Nest creates the server without
+exposing its options, so this is a property set before `listen()`: Node reads it when the server
+starts listening, and the helper throws if the server is already listening. The sweep walks every
+open connection each time, so a server holding very many sockets can set
+`connectionsCheckingIntervalMs` higher, at the cost of cutting up to that long after the timeout.
+
+**Order is part of the contract.** Call it right after `applyAccessLog` from
+`@bymax-one/nest-logger`, and before everything that reads the request: helmet is mounted first,
+so even a request the body parsers refuse carries the headers, and the parsers are registered
+here so Nest's own defaults, which accept gzip, are not (an application that needs a raw body on a route mounts that parser before calling it). Cookie parsing, the trusted-proxy
+setting and `applyBymaxOpenApi` stay with you and go after it:
+`applyAccessLog` → `applyHttpFloors` → cookie parser → trusted proxies → `applyBymaxOpenApi`.
+
+Express only; on another adapter it throws before applying anything. `helmet` is an optional
+peer, loaded only when the helper runs, and a missing one fails with the install command. An
+unusable timeout (zero, fractional, or a header timeout above the request timeout) throws
+rather than leaving a socket limit switched off.
+
 ## 🏗️ Architecture
 
 ```
@@ -1836,6 +1909,8 @@ the deployment nobody configured is the one most likely to be exposed.
 | Health output       | The response names which indicator is down and nothing more; the reason goes to the logger. `exposeIndicatorErrors` (default `false`) puts it back in the response for debugging |
 | Slow indicators     | Converted to `down` by the aggregator, so a probe cannot hang on one                                                                                                             |
 | Correlation         | Resolved through `BYMAX_CORRELATION_PROVIDER` — the app decides where the id comes from                                                                                          |
+| Body nesting        | Opt-in `bodyDepth` refuses a body nested deeper than `maxDepth` with a `400`, so a few kilobytes of nested arrays cannot overflow a recursive validator into a `500`             |
+| HTTP floors         | `applyHttpFloors`: compressed request bodies refused with `415`, header and request timeouts of 15 s and 30 s, `helmet` headers without HSTS                                     |
 | Request accounting  | Every closed request is counted, including the ones a guard rejected (`401`/`403`/`429`) and the ones that matched no route (`404`), so an attack in progress moves the graph    |
 | Route labels        | Taken from the matched template; an unmatched request records the constant `<unmatched>`, never the requested path, so a scan cannot grow the metric registry without bound      |
 | Pagination cursors  | Opaque, not authenticated; treated as client-supplied input on the way back in                                                                                                   |
@@ -1909,27 +1984,28 @@ in the sections above.
 
 ### `.` (root)
 
-| Export                                                                                                                                                                                                             | Kind      | Description                                                                                                                                                                                                                                                                                                                                |
-| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `BymaxCoreModule`                                                                                                                                                                                                  | class     | The dynamic module: `forRoot` and `forRootAsync`.                                                                                                                                                                                                                                                                                          |
-| `BymaxCoreModuleOptions`, `EnvelopeOptions`, `TimingOptions`, `HealthOptions`, `MetricsOptions`, `TelemetryOptions`, `OpenApiOptions`, `OpenApiServerDescriptor`, `OpenApiSecurityScheme`, `ResolvedCoreOptions`   | types     | The options surface and its resolved shape.                                                                                                                                                                                                                                                                                                |
-| `OpenApiSecurityRequirement`, `OpenApiHttpMethod`, `OpenApiOperationKey`, `OperationSecurityMap`                                                                                                                   | types     | The operation-key contract a sibling library targets to ship its own security map.                                                                                                                                                                                                                                                         |
-| `OpenApiOperationIdFactory`                                                                                                                                                                                        | type      | Names the operations in the generated document.                                                                                                                                                                                                                                                                                            |
-| `BYMAX_CORE_OPTIONS`, `BYMAX_CORRELATION_PROVIDER`, `BYMAX_TIMING_SINK`, `BYMAX_HEALTH_INDICATORS`, `BYMAX_HEALTH_TRANSITION_SINK`, `BYMAX_UNEXPECTED_ERROR_SINK`, `BYMAX_METRICS_REGISTRY`, `BYMAX_TRACE_CONTEXT` | tokens    | The DI tokens; see the [token table](#-di-tokens).                                                                                                                                                                                                                                                                                         |
-| `IHealthTransitionSink`, `HealthTransition`, `HealthTransitionCause`                                                                                                                                               | types     | The readiness-transition contract; also on `./health`.                                                                                                                                                                                                                                                                                     |
-| `ICorrelationIdProvider`                                                                                                                                                                                           | type      | The correlation-provider contract.                                                                                                                                                                                                                                                                                                         |
-| `ITraceContextProvider`, `TraceContext`                                                                                                                                                                            | types     | The trace-context contract and the identifiers it resolves.                                                                                                                                                                                                                                                                                |
-| `BymaxExceptionFilter`                                                                                                                                                                                             | class     | The envelope exception filter.                                                                                                                                                                                                                                                                                                             |
-| `FilterErrorContext`                                                                                                                                                                                               | type      | The neutral request context passed to the filter's observability seam.                                                                                                                                                                                                                                                                     |
-| `IUnexpectedErrorSink`, `UnexpectedErrorReport`                                                                                                                                                                    | types     | Receives the cause behind each collapsed `500 BYMAX_INTERNAL_ERROR`; see [Recording the cause of a 500](#recording-the-cause-of-a-500).                                                                                                                                                                                                    |
-| `buildErrorEnvelope`                                                                                                                                                                                               | function  | Pure builder assembling an `ErrorEnvelope`.                                                                                                                                                                                                                                                                                                |
-| `ErrorEnvelope`, `ErrorDetails`, `BuildErrorEnvelopeInput`                                                                                                                                                         | types     | The envelope contract and its builder input.                                                                                                                                                                                                                                                                                               |
-| `BymaxTimingMiddleware`                                                                                                                                                                                            | class     | The request-timing middleware, applied to every route when timing is enabled.                                                                                                                                                                                                                                                              |
-| `UNMATCHED_ROUTE`                                                                                                                                                                                                  | constant  | The bounded label recorded when a request matched no route (`<unmatched>`).                                                                                                                                                                                                                                                                |
-| `TimingInterceptor`                                                                                                                                                                                                | class     | **Deprecated, registered nowhere.** `BymaxTimingMiddleware` replaced it as the recorder because guards run before interceptors, so it never saw a request a guard rejected; wiring it by hand next to the middleware records a second sample for every request that reaches a handler. Kept so code that wired it by hand keeps compiling. |
-| `ITimingSink`, `RequestTimingSample`                                                                                                                                                                               | types     | The timing-sink contract and its sample shape.                                                                                                                                                                                                                                                                                             |
-| `BYMAX_BAD_GATEWAY` … `BYMAX_VALIDATION_FAILED`                                                                                                                                                                    | constants | The full error-code catalog (see [Error envelope](#-error-envelope)).                                                                                                                                                                                                                                                                      |
-| `codeForStatus`                                                                                                                                                                                                    | function  | Derives a catalog code from an HTTP status.                                                                                                                                                                                                                                                                                                |
+| Export                                                                                                                                                                                                                               | Kind      | Description                                                                                                                                                                                                                                                                                                                                |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `BymaxCoreModule`                                                                                                                                                                                                                    | class     | The dynamic module: `forRoot` and `forRootAsync`.                                                                                                                                                                                                                                                                                          |
+| `BymaxCoreModuleOptions`, `EnvelopeOptions`, `TimingOptions`, `BodyDepthOptions`, `HealthOptions`, `MetricsOptions`, `TelemetryOptions`, `OpenApiOptions`, `OpenApiServerDescriptor`, `OpenApiSecurityScheme`, `ResolvedCoreOptions` | types     | The options surface and its resolved shape.                                                                                                                                                                                                                                                                                                |
+| `OpenApiSecurityRequirement`, `OpenApiHttpMethod`, `OpenApiOperationKey`, `OperationSecurityMap`                                                                                                                                     | types     | The operation-key contract a sibling library targets to ship its own security map.                                                                                                                                                                                                                                                         |
+| `OpenApiOperationIdFactory`                                                                                                                                                                                                          | type      | Names the operations in the generated document.                                                                                                                                                                                                                                                                                            |
+| `BYMAX_CORE_OPTIONS`, `BYMAX_CORRELATION_PROVIDER`, `BYMAX_TIMING_SINK`, `BYMAX_HEALTH_INDICATORS`, `BYMAX_HEALTH_TRANSITION_SINK`, `BYMAX_UNEXPECTED_ERROR_SINK`, `BYMAX_METRICS_REGISTRY`, `BYMAX_TRACE_CONTEXT`                   | tokens    | The DI tokens; see the [token table](#-di-tokens).                                                                                                                                                                                                                                                                                         |
+| `IHealthTransitionSink`, `HealthTransition`, `HealthTransitionCause`                                                                                                                                                                 | types     | The readiness-transition contract; also on `./health`.                                                                                                                                                                                                                                                                                     |
+| `ICorrelationIdProvider`                                                                                                                                                                                                             | type      | The correlation-provider contract.                                                                                                                                                                                                                                                                                                         |
+| `ITraceContextProvider`, `TraceContext`                                                                                                                                                                                              | types     | The trace-context contract and the identifiers it resolves.                                                                                                                                                                                                                                                                                |
+| `BymaxExceptionFilter`                                                                                                                                                                                                               | class     | The envelope exception filter.                                                                                                                                                                                                                                                                                                             |
+| `FilterErrorContext`                                                                                                                                                                                                                 | type      | The neutral request context passed to the filter's observability seam.                                                                                                                                                                                                                                                                     |
+| `IUnexpectedErrorSink`, `UnexpectedErrorReport`                                                                                                                                                                                      | types     | Receives the cause behind each collapsed `500 BYMAX_INTERNAL_ERROR`; see [Recording the cause of a 500](#recording-the-cause-of-a-500).                                                                                                                                                                                                    |
+| `buildErrorEnvelope`                                                                                                                                                                                                                 | function  | Pure builder assembling an `ErrorEnvelope`.                                                                                                                                                                                                                                                                                                |
+| `ErrorEnvelope`, `ErrorDetails`, `BuildErrorEnvelopeInput`                                                                                                                                                                           | types     | The envelope contract and its builder input.                                                                                                                                                                                                                                                                                               |
+| `BymaxTimingMiddleware`                                                                                                                                                                                                              | class     | The request-timing middleware, applied to every route when timing is enabled.                                                                                                                                                                                                                                                              |
+| `BymaxBodyDepthMiddleware`                                                                                                                                                                                                           | class     | Refuses a body nested deeper than `bodyDepth.maxDepth` with a `400`; applied to every route, after the timing middleware, only when `bodyDepth.enabled` is true.                                                                                                                                                                           |
+| `UNMATCHED_ROUTE`                                                                                                                                                                                                                    | constant  | The bounded label recorded when a request matched no route (`<unmatched>`).                                                                                                                                                                                                                                                                |
+| `TimingInterceptor`                                                                                                                                                                                                                  | class     | **Deprecated, registered nowhere.** `BymaxTimingMiddleware` replaced it as the recorder because guards run before interceptors, so it never saw a request a guard rejected; wiring it by hand next to the middleware records a second sample for every request that reaches a handler. Kept so code that wired it by hand keeps compiling. |
+| `ITimingSink`, `RequestTimingSample`                                                                                                                                                                                                 | types     | The timing-sink contract and its sample shape.                                                                                                                                                                                                                                                                                             |
+| `BYMAX_BAD_GATEWAY` … `BYMAX_VALIDATION_FAILED`                                                                                                                                                                                      | constants | The full error-code catalog (see [Error envelope](#-error-envelope)).                                                                                                                                                                                                                                                                      |
+| `codeForStatus`                                                                                                                                                                                                                      | function  | Derives a catalog code from an HTTP status.                                                                                                                                                                                                                                                                                                |
 
 ### `./pagination`
 
@@ -1963,6 +2039,13 @@ in the sections above.
 | `IMetricsContributor`                | type     | The contract: `registerMetrics(registry)`.                   |
 | `MetricsRegistry`                    | type     | The `prom-client` registry the scrape endpoint serves.       |
 
+### `./http`
+
+| Export                                         | Kind     | Description                                                                             |
+| ---------------------------------------------- | -------- | --------------------------------------------------------------------------------------- |
+| `applyHttpFloors`                              | function | Applies the headers, the body-parser floor and the timeouts; call it before `listen()`. |
+| `HttpFloorsOptions`, `HttpFloorsHelmetOptions` | types    | The `helmet`, `headersTimeoutMs` and `requestTimeoutMs` options.                        |
+
 ### `./openapi`
 
 | Export                                                                                 | Kind                | Description                                                                                       |

package/dist/http/index.cjs

@@ -0,0 +1,64 @@
+'use strict';
+
+// src/optional-peer.ts
+function isMissingModuleError(cause) {
+  const code = cause.code;
+  return code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND";
+}
+
+// src/http/http.loader.ts
+var MISSING_PEER_MESSAGE = "applyHttpFloors needs the optional peer helmet, which is not installed. Run: pnpm add helmet";
+async function loadHelmet() {
+  try {
+    const loaded = await import('helmet');
+    return loaded.default;
+  } catch (cause) {
+    if (isMissingModuleError(cause)) {
+      throw new Error(MISSING_PEER_MESSAGE, { cause });
+    }
+    throw cause;
+  }
+}
+
+// src/http/http-floors.ts
+var DEFAULT_HEADERS_TIMEOUT_MS = 15e3;
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var DEFAULT_CONNECTIONS_CHECKING_INTERVAL_MS = 1e3;
+function assertPositiveInteger(name, value) {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new Error(`${name} must be a positive integer, received ${String(value)}`);
+  }
+}
+async function applyHttpFloors(app, options = {}) {
+  const headersTimeoutMs = options.headersTimeoutMs ?? DEFAULT_HEADERS_TIMEOUT_MS;
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  assertPositiveInteger("headersTimeoutMs", headersTimeoutMs);
+  assertPositiveInteger("requestTimeoutMs", requestTimeoutMs);
+  if (headersTimeoutMs > requestTimeoutMs) {
+    throw new Error(
+      `headersTimeoutMs (${headersTimeoutMs}) must not exceed requestTimeoutMs (${requestTimeoutMs})`
+    );
+  }
+  const checkingIntervalMs = options.connectionsCheckingIntervalMs ?? Math.min(DEFAULT_CONNECTIONS_CHECKING_INTERVAL_MS, headersTimeoutMs);
+  assertPositiveInteger("connectionsCheckingIntervalMs", checkingIntervalMs);
+  const express = app;
+  if (express.getHttpAdapter().getType?.() !== "express") {
+    throw new Error("applyHttpFloors supports the Express adapter only");
+  }
+  const server = express.getHttpServer();
+  if (server.listening) {
+    throw new Error("applyHttpFloors must run before listen(): the server is already listening");
+  }
+  const given = options.helmet ?? {};
+  if (given !== false) {
+    const helmet = await loadHelmet();
+    express.use(helmet("hsts" in given ? given : { strictTransportSecurity: false, ...given }));
+  }
+  express.useBodyParser("json", { inflate: false });
+  express.useBodyParser("urlencoded", { inflate: false, extended: true });
+  server.headersTimeout = headersTimeoutMs;
+  server.requestTimeout = requestTimeoutMs;
+  server.connectionsCheckingInterval = checkingIntervalMs;
+}
+
+exports.applyHttpFloors = applyHttpFloors;

package/dist/http/index.d.cts

@@ -0,0 +1,59 @@
+import { INestApplication } from '@nestjs/common';
+
+/**
+ * @fileoverview `applyHttpFloors`, the HTTP-level protections every backend wants and none should
+ * tune per deployment: security headers without HSTS, compressed request bodies refused, and
+ * timeouts that bound how long a client may hold a socket, enforced to within a second.
+ *
+ * Order is part of the contract. Call it right after the access log is installed
+ * (`applyAccessLog` from `@bymax-one/nest-logger`) and before anything that reads the request:
+ * helmet is mounted first so even a request the body parsers refuse carries the headers, and the
+ * parsers are registered here so Nest's defaults (which accept gzip) are not. Cookie parsing, the
+ * trusted-proxy setting and OpenAPI stay with the caller and go after this call.
+ *
+ * Express only. `helmet` is an optional peer, loaded when this runs.
+ * @layer Bootstrap
+ */
+
+/** The `helmet()` options object; any option `helmet` accepts. */
+type HttpFloorsHelmetOptions = Readonly<Record<string, unknown>>;
+/** Options for {@link applyHttpFloors}. */
+interface HttpFloorsOptions {
+    /**
+     * Options handed to `helmet()`, over `{ strictTransportSecurity: false }` (TLS is normally
+     * terminated in front of the application, which owns HSTS). A browser-serving backend tunes
+     * `contentSecurityPolicy` here. `false` leaves helmet out entirely.
+     */
+    readonly helmet?: HttpFloorsHelmetOptions | false;
+    /**
+     * Longest a client may take to send its complete header block before the socket is closed.
+     * Positive integer, at most `requestTimeoutMs`. Default: `15000`.
+     */
+    readonly headersTimeoutMs?: number;
+    /**
+     * Longest a single request may take, headers and body together. Positive integer.
+     * Default: `30000`.
+     */
+    readonly requestTimeoutMs?: number;
+    /**
+     * How often the server sweeps its open connections for expired timeouts. Positive integer.
+     * Default: `1000`, or `headersTimeoutMs` when that is shorter. Node enforces both timeouts from
+     * this sweep rather than from a timer per connection, and its own default is `30000`, so a
+     * `headersTimeoutMs` of 15 s would cut anywhere between 15 and 45 s. The sweep walks every open
+     * connection each time, so a server holding very many sockets may set it higher, at the cost
+     * of cutting up to that long after the timeout.
+     */
+    readonly connectionsCheckingIntervalMs?: number;
+}
+/**
+ * Apply the HTTP floors to an Express application. Call it before `app.init()` or `listen`.
+ *
+ * @param app - The Nest application, created on the Express adapter.
+ * @param options - Overrides for the helmet options and the two timeouts.
+ * @throws Error When a timeout is unusable, the application is not on Express, or `helmet` is
+ * needed and not installed. Nothing is applied in those cases.
+ */
+declare function applyHttpFloors(app: INestApplication, options?: HttpFloorsOptions): Promise<void>;
+
+export { applyHttpFloors };
+export type { HttpFloorsHelmetOptions, HttpFloorsOptions };

package/dist/http/index.d.ts

@@ -0,0 +1,59 @@
+import { INestApplication } from '@nestjs/common';
+
+/**
+ * @fileoverview `applyHttpFloors`, the HTTP-level protections every backend wants and none should
+ * tune per deployment: security headers without HSTS, compressed request bodies refused, and
+ * timeouts that bound how long a client may hold a socket, enforced to within a second.
+ *
+ * Order is part of the contract. Call it right after the access log is installed
+ * (`applyAccessLog` from `@bymax-one/nest-logger`) and before anything that reads the request:
+ * helmet is mounted first so even a request the body parsers refuse carries the headers, and the
+ * parsers are registered here so Nest's defaults (which accept gzip) are not. Cookie parsing, the
+ * trusted-proxy setting and OpenAPI stay with the caller and go after this call.
+ *
+ * Express only. `helmet` is an optional peer, loaded when this runs.
+ * @layer Bootstrap
+ */
+
+/** The `helmet()` options object; any option `helmet` accepts. */
+type HttpFloorsHelmetOptions = Readonly<Record<string, unknown>>;
+/** Options for {@link applyHttpFloors}. */
+interface HttpFloorsOptions {
+    /**
+     * Options handed to `helmet()`, over `{ strictTransportSecurity: false }` (TLS is normally
+     * terminated in front of the application, which owns HSTS). A browser-serving backend tunes
+     * `contentSecurityPolicy` here. `false` leaves helmet out entirely.
+     */
+    readonly helmet?: HttpFloorsHelmetOptions | false;
+    /**
+     * Longest a client may take to send its complete header block before the socket is closed.
+     * Positive integer, at most `requestTimeoutMs`. Default: `15000`.
+     */
+    readonly headersTimeoutMs?: number;
+    /**
+     * Longest a single request may take, headers and body together. Positive integer.
+     * Default: `30000`.
+     */
+    readonly requestTimeoutMs?: number;
+    /**
+     * How often the server sweeps its open connections for expired timeouts. Positive integer.
+     * Default: `1000`, or `headersTimeoutMs` when that is shorter. Node enforces both timeouts from
+     * this sweep rather than from a timer per connection, and its own default is `30000`, so a
+     * `headersTimeoutMs` of 15 s would cut anywhere between 15 and 45 s. The sweep walks every open
+     * connection each time, so a server holding very many sockets may set it higher, at the cost
+     * of cutting up to that long after the timeout.
+     */
+    readonly connectionsCheckingIntervalMs?: number;
+}
+/**
+ * Apply the HTTP floors to an Express application. Call it before `app.init()` or `listen`.
+ *
+ * @param app - The Nest application, created on the Express adapter.
+ * @param options - Overrides for the helmet options and the two timeouts.
+ * @throws Error When a timeout is unusable, the application is not on Express, or `helmet` is
+ * needed and not installed. Nothing is applied in those cases.
+ */
+declare function applyHttpFloors(app: INestApplication, options?: HttpFloorsOptions): Promise<void>;
+
+export { applyHttpFloors };
+export type { HttpFloorsHelmetOptions, HttpFloorsOptions };

package/dist/http/index.mjs

@@ -0,0 +1,62 @@
+// src/optional-peer.ts
+function isMissingModuleError(cause) {
+  const code = cause.code;
+  return code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND";
+}
+
+// src/http/http.loader.ts
+var MISSING_PEER_MESSAGE = "applyHttpFloors needs the optional peer helmet, which is not installed. Run: pnpm add helmet";
+async function loadHelmet() {
+  try {
+    const loaded = await import('helmet');
+    return loaded.default;
+  } catch (cause) {
+    if (isMissingModuleError(cause)) {
+      throw new Error(MISSING_PEER_MESSAGE, { cause });
+    }
+    throw cause;
+  }
+}
+
+// src/http/http-floors.ts
+var DEFAULT_HEADERS_TIMEOUT_MS = 15e3;
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var DEFAULT_CONNECTIONS_CHECKING_INTERVAL_MS = 1e3;
+function assertPositiveInteger(name, value) {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new Error(`${name} must be a positive integer, received ${String(value)}`);
+  }
+}
+async function applyHttpFloors(app, options = {}) {
+  const headersTimeoutMs = options.headersTimeoutMs ?? DEFAULT_HEADERS_TIMEOUT_MS;
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  assertPositiveInteger("headersTimeoutMs", headersTimeoutMs);
+  assertPositiveInteger("requestTimeoutMs", requestTimeoutMs);
+  if (headersTimeoutMs > requestTimeoutMs) {
+    throw new Error(
+      `headersTimeoutMs (${headersTimeoutMs}) must not exceed requestTimeoutMs (${requestTimeoutMs})`
+    );
+  }
+  const checkingIntervalMs = options.connectionsCheckingIntervalMs ?? Math.min(DEFAULT_CONNECTIONS_CHECKING_INTERVAL_MS, headersTimeoutMs);
+  assertPositiveInteger("connectionsCheckingIntervalMs", checkingIntervalMs);
+  const express = app;
+  if (express.getHttpAdapter().getType?.() !== "express") {
+    throw new Error("applyHttpFloors supports the Express adapter only");
+  }
+  const server = express.getHttpServer();
+  if (server.listening) {
+    throw new Error("applyHttpFloors must run before listen(): the server is already listening");
+  }
+  const given = options.helmet ?? {};
+  if (given !== false) {
+    const helmet = await loadHelmet();
+    express.use(helmet("hsts" in given ? given : { strictTransportSecurity: false, ...given }));
+  }
+  express.useBodyParser("json", { inflate: false });
+  express.useBodyParser("urlencoded", { inflate: false, extended: true });
+  server.headersTimeout = headersTimeoutMs;
+  server.requestTimeout = requestTimeoutMs;
+  server.connectionsCheckingInterval = checkingIntervalMs;
+}
+
+export { applyHttpFloors };

package/dist/index.cjs

@@ -18,6 +18,114 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
+// src/core.tokens.ts
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
+var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:correlation-provider"
+);
+var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
+var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-indicators"
+);
+var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-transition-sink"
+);
+var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:unexpected-error-sink"
+);
+var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:metrics-registry"
+);
+var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
+
+// src/envelope/error-codes.ts
+var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
+var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
+var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
+var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
+var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
+var BYMAX_CONFLICT = "BYMAX_CONFLICT";
+var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
+var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
+var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
+var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
+var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
+var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
+var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
+var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
+var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
+var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
+var STATUS_CODES = /* @__PURE__ */ new Map([
+  [400, BYMAX_BAD_REQUEST],
+  [401, BYMAX_UNAUTHORIZED],
+  [403, BYMAX_FORBIDDEN],
+  [404, BYMAX_NOT_FOUND],
+  [409, BYMAX_CONFLICT],
+  [413, BYMAX_PAYLOAD_TOO_LARGE],
+  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
+  [422, BYMAX_UNPROCESSABLE_ENTITY],
+  [429, BYMAX_TOO_MANY_REQUESTS],
+  [500, BYMAX_INTERNAL_ERROR],
+  [501, BYMAX_NOT_IMPLEMENTED],
+  [502, BYMAX_BAD_GATEWAY],
+  [503, BYMAX_SERVICE_UNAVAILABLE],
+  [504, BYMAX_GATEWAY_TIMEOUT]
+]);
+var CLIENT_ERROR_MIN = 400;
+var CLIENT_ERROR_MAX = 500;
+function codeForStatus(status) {
+  const catalogued = STATUS_CODES.get(status);
+  if (catalogued !== void 0) {
+    return catalogued;
+  }
+  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
+    return BYMAX_CLIENT_ERROR;
+  }
+  return BYMAX_INTERNAL_ERROR;
+}
+
+// src/body-depth/body-depth.middleware.ts
+var BODY_TOO_DEEP_MESSAGE = "Request body is nested too deeply";
+function exceedsDepth(value, maxDepth) {
+  let level = [value];
+  for (let depth = 0; level.length > 0; depth += 1) {
+    const next = [];
+    for (const node of level) {
+      if (typeof node === "object" && node !== null) {
+        if (depth >= maxDepth) {
+          return true;
+        }
+        for (const child of Object.values(node)) {
+          next.push(child);
+        }
+      }
+    }
+    level = next;
+  }
+  return false;
+}
+exports.BymaxBodyDepthMiddleware = class BymaxBodyDepthMiddleware {
+  constructor(options) {
+    this.options = options;
+  }
+  /**
+   * @param req - The request, whose `body` the parser has already filled.
+   * @param _res - Unused.
+   * @param next - Continues the chain.
+   * @throws BadRequestException When the body is nested too deeply.
+   */
+  use(req, _res, next) {
+    if (exceedsDepth(req.body, this.options.bodyDepth.maxDepth)) {
+      throw new common.BadRequestException({ code: BYMAX_BAD_REQUEST, message: BODY_TOO_DEEP_MESSAGE });
+    }
+    next();
+  }
+};
+exports.BymaxBodyDepthMiddleware = __decorateClass([
+  common.Injectable(),
+  __decorateParam(0, common.Inject(BYMAX_CORE_OPTIONS))
+], exports.BymaxBodyDepthMiddleware);
+
 // src/route-defaults.ts
 var DEFAULT_HEALTH_PATH = "health";
 var DEFAULT_METRICS_PATH = "metrics";
@@ -64,6 +172,16 @@ function resolveTiming(raw) {
   const threshold = raw?.slowRequestThresholdMs;
   return threshold === void 0 ? { enabled } : { enabled, slowRequestThresholdMs: threshold };
 }
+var DEFAULT_MAX_BODY_DEPTH = 32;
+function resolveBodyDepth(raw) {
+  const maxDepth = raw?.maxDepth ?? DEFAULT_MAX_BODY_DEPTH;
+  if (!Number.isSafeInteger(maxDepth) || maxDepth < 1) {
+    throw new Error(
+      `bodyDepth.maxDepth must be a positive safe integer, received ${String(maxDepth)}`
+    );
+  }
+  return { enabled: raw?.enabled ?? false, maxDepth };
+}
 function resolveHealth(raw) {
   return {
     enabled: raw?.enabled ?? true,
@@ -136,6 +254,7 @@ function normalizeCoreOptions(raw) {
   return deepFreeze({
     envelope: resolveEnvelope(raw?.envelope),
     timing: resolveTiming(raw?.timing),
+    bodyDepth: resolveBodyDepth(raw?.bodyDepth),
     health: resolveHealth(raw?.health),
     metrics: resolveMetrics(raw?.metrics),
     openapi: resolveOpenApi(raw?.openapi, raw?.environment),
@@ -148,26 +267,6 @@ function normalizeCoreOptions(raw) {
 }
 normalizeCoreOptions();
 
-// src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
-var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:correlation-provider"
-);
-var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
-var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-indicators"
-);
-var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-transition-sink"
-);
-var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:unexpected-error-sink"
-);
-var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:metrics-registry"
-);
-var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
-
 // src/optional-peer.ts
 function isMissingModuleError(cause) {
   const code = cause.code;
@@ -275,52 +374,6 @@ function containRejection(returned, onFailure) {
   }
 }
 
-// src/envelope/error-codes.ts
-var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
-var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
-var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
-var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
-var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
-var BYMAX_CONFLICT = "BYMAX_CONFLICT";
-var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
-var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
-var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
-var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
-var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
-var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
-var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
-var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
-var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
-var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
-var STATUS_CODES = /* @__PURE__ */ new Map([
-  [400, BYMAX_BAD_REQUEST],
-  [401, BYMAX_UNAUTHORIZED],
-  [403, BYMAX_FORBIDDEN],
-  [404, BYMAX_NOT_FOUND],
-  [409, BYMAX_CONFLICT],
-  [413, BYMAX_PAYLOAD_TOO_LARGE],
-  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
-  [422, BYMAX_UNPROCESSABLE_ENTITY],
-  [429, BYMAX_TOO_MANY_REQUESTS],
-  [500, BYMAX_INTERNAL_ERROR],
-  [501, BYMAX_NOT_IMPLEMENTED],
-  [502, BYMAX_BAD_GATEWAY],
-  [503, BYMAX_SERVICE_UNAVAILABLE],
-  [504, BYMAX_GATEWAY_TIMEOUT]
-]);
-var CLIENT_ERROR_MIN = 400;
-var CLIENT_ERROR_MAX = 500;
-function codeForStatus(status) {
-  const catalogued = STATUS_CODES.get(status);
-  if (catalogued !== void 0) {
-    return catalogued;
-  }
-  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
-    return BYMAX_CLIENT_ERROR;
-  }
-  return BYMAX_INTERNAL_ERROR;
-}
-
 // src/envelope/error-envelope.ts
 function buildErrorEnvelope(input) {
   const base = {
@@ -1697,12 +1750,14 @@ exports.BymaxCoreModule = class BymaxCoreModule extends BymaxCoreModuleBase {
    * @param consumer - Nest's middleware consumer.
    */
   configure(consumer) {
-    if (!this.resolved.timing.enabled) {
-      return;
-    }
     const adapter = this.adapterHost?.httpAdapter;
-    const onFastify = bridgeFastifyRouteMetadata(adapter);
-    consumer.apply(exports.BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    if (this.resolved.timing.enabled) {
+      const onFastify = bridgeFastifyRouteMetadata(adapter);
+      consumer.apply(exports.BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    }
+    if (this.resolved.bodyDepth.enabled && adapter?.getType?.() !== "fastify") {
+      consumer.apply(exports.BymaxBodyDepthMiddleware).forRoutes("/");
+    }
   }
   /**
    * Register the module synchronously. Options are known now, so disabled

package/dist/index.d.cts

@@ -22,6 +22,25 @@ interface TimingOptions {
     /** Samples above this threshold are flagged as slow. No default (unset). */
     slowRequestThresholdMs?: number;
 }
+/** Request-body nesting limit, applied before the application's own validation runs. */
+interface BodyDepthOptions {
+    /**
+     * Refuse a parsed request body nested deeper than {@link BodyDepthOptions.maxDepth} with a
+     * `400` through the error envelope. Default: `false`.
+     *
+     * Off by default because turning it on rejects bodies that are accepted today. Enable it:
+     * a body of a few thousand nested arrays is only a few kilobytes, and a recursive validator
+     * or transformer overflows the stack on it, so the request is answered `500`, with no
+     * credential needed. The check runs before routing, on the body the parser already produced, so it covers the Express adapter and a body parsed by
+     * Nest's own parsers; it does not cover Fastify.
+     */
+    enabled?: boolean;
+    /**
+     * The deepest nesting a body may have: `[[1]]` is depth 2, a flat object or array is depth 1,
+     * and a scalar is depth 0. Must be a positive safe integer. Default: `32`.
+     */
+    maxDepth?: number;
+}
 /** Liveness and readiness endpoint configuration. */
 interface HealthOptions {
     /** Register the health controller. Default: `true`. */
@@ -267,6 +286,8 @@ interface BymaxCoreModuleOptions {
     envelope?: EnvelopeOptions;
     /** Request-timing middleware. Default: enabled. */
     timing?: TimingOptions;
+    /** Request-body nesting limit. Default: disabled. */
+    bodyDepth?: BodyDepthOptions;
     /** Liveness and readiness endpoints. Default: enabled. */
     health?: HealthOptions;
     /** Prometheus metrics endpoint. Default: disabled. */
@@ -308,6 +329,11 @@ interface ResolvedTimingOptions {
     enabled: boolean;
     slowRequestThresholdMs?: number;
 }
+/** Fully-resolved body-depth options. */
+interface ResolvedBodyDepthOptions {
+    enabled: boolean;
+    maxDepth: number;
+}
 /** Fully-resolved health options. */
 interface ResolvedHealthOptions {
     enabled: boolean;
@@ -365,6 +391,7 @@ interface ResolvedOpenApiOptions {
 interface ResolvedCoreOptions {
     envelope: ResolvedEnvelopeOptions;
     timing: ResolvedTimingOptions;
+    bodyDepth: ResolvedBodyDepthOptions;
     health: ResolvedHealthOptions;
     metrics: ResolvedMetricsOptions;
     openapi: ResolvedOpenApiOptions;
@@ -1115,6 +1142,21 @@ declare class TimingInterceptor implements NestInterceptor {
     private recordSample;
 }
 
+/** Refuses a body nested deeper than `bodyDepth.maxDepth` with a coded `400`. */
+declare class BymaxBodyDepthMiddleware implements NestMiddleware {
+    private readonly options;
+    constructor(options: ResolvedCoreOptions);
+    /**
+     * @param req - The request, whose `body` the parser has already filled.
+     * @param _res - Unused.
+     * @param next - Continues the chain.
+     * @throws BadRequestException When the body is nested too deeply.
+     */
+    use(req: {
+        body?: unknown;
+    }, _res: unknown, next: () => void): void;
+}
+
 /**
  * @fileoverview Neutral request-info accessor for request timing. Reads the
  * HTTP method and the route template off a request without assuming Express or
@@ -1296,5 +1338,5 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
-export type { BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxBodyDepthMiddleware, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export type { BodyDepthOptions, BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };

package/dist/index.d.ts

@@ -22,6 +22,25 @@ interface TimingOptions {
     /** Samples above this threshold are flagged as slow. No default (unset). */
     slowRequestThresholdMs?: number;
 }
+/** Request-body nesting limit, applied before the application's own validation runs. */
+interface BodyDepthOptions {
+    /**
+     * Refuse a parsed request body nested deeper than {@link BodyDepthOptions.maxDepth} with a
+     * `400` through the error envelope. Default: `false`.
+     *
+     * Off by default because turning it on rejects bodies that are accepted today. Enable it:
+     * a body of a few thousand nested arrays is only a few kilobytes, and a recursive validator
+     * or transformer overflows the stack on it, so the request is answered `500`, with no
+     * credential needed. The check runs before routing, on the body the parser already produced, so it covers the Express adapter and a body parsed by
+     * Nest's own parsers; it does not cover Fastify.
+     */
+    enabled?: boolean;
+    /**
+     * The deepest nesting a body may have: `[[1]]` is depth 2, a flat object or array is depth 1,
+     * and a scalar is depth 0. Must be a positive safe integer. Default: `32`.
+     */
+    maxDepth?: number;
+}
 /** Liveness and readiness endpoint configuration. */
 interface HealthOptions {
     /** Register the health controller. Default: `true`. */
@@ -267,6 +286,8 @@ interface BymaxCoreModuleOptions {
     envelope?: EnvelopeOptions;
     /** Request-timing middleware. Default: enabled. */
     timing?: TimingOptions;
+    /** Request-body nesting limit. Default: disabled. */
+    bodyDepth?: BodyDepthOptions;
     /** Liveness and readiness endpoints. Default: enabled. */
     health?: HealthOptions;
     /** Prometheus metrics endpoint. Default: disabled. */
@@ -308,6 +329,11 @@ interface ResolvedTimingOptions {
     enabled: boolean;
     slowRequestThresholdMs?: number;
 }
+/** Fully-resolved body-depth options. */
+interface ResolvedBodyDepthOptions {
+    enabled: boolean;
+    maxDepth: number;
+}
 /** Fully-resolved health options. */
 interface ResolvedHealthOptions {
     enabled: boolean;
@@ -365,6 +391,7 @@ interface ResolvedOpenApiOptions {
 interface ResolvedCoreOptions {
     envelope: ResolvedEnvelopeOptions;
     timing: ResolvedTimingOptions;
+    bodyDepth: ResolvedBodyDepthOptions;
     health: ResolvedHealthOptions;
     metrics: ResolvedMetricsOptions;
     openapi: ResolvedOpenApiOptions;
@@ -1115,6 +1142,21 @@ declare class TimingInterceptor implements NestInterceptor {
     private recordSample;
 }
 
+/** Refuses a body nested deeper than `bodyDepth.maxDepth` with a coded `400`. */
+declare class BymaxBodyDepthMiddleware implements NestMiddleware {
+    private readonly options;
+    constructor(options: ResolvedCoreOptions);
+    /**
+     * @param req - The request, whose `body` the parser has already filled.
+     * @param _res - Unused.
+     * @param next - Continues the chain.
+     * @throws BadRequestException When the body is nested too deeply.
+     */
+    use(req: {
+        body?: unknown;
+    }, _res: unknown, next: () => void): void;
+}
+
 /**
  * @fileoverview Neutral request-info accessor for request timing. Reads the
  * HTTP method and the route template off a request without assuming Express or
@@ -1296,5 +1338,5 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
-export type { BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxBodyDepthMiddleware, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export type { BodyDepthOptions, BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { Catch, Inject, Optional, Injectable, ConfigurableModuleBuilder, Module, HttpException, Logger, Get, Res, Controller, Req, HttpStatus, UnauthorizedException, NotFoundException } from '@nestjs/common';
+import { Injectable, Inject, Catch, Optional, ConfigurableModuleBuilder, Module, BadRequestException, HttpException, Logger, Get, Res, Controller, Req, HttpStatus, UnauthorizedException, NotFoundException } from '@nestjs/common';
 import { HttpAdapterHost, DiscoveryService, Reflector, BaseExceptionFilter, APP_FILTER, DiscoveryModule } from '@nestjs/core';
 import { createHash, timingSafeEqual } from 'crypto';
 import { AsyncResource } from 'async_hooks';
@@ -16,6 +16,114 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
+// src/core.tokens.ts
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
+var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:correlation-provider"
+);
+var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
+var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-indicators"
+);
+var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-transition-sink"
+);
+var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:unexpected-error-sink"
+);
+var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:metrics-registry"
+);
+var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
+
+// src/envelope/error-codes.ts
+var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
+var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
+var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
+var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
+var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
+var BYMAX_CONFLICT = "BYMAX_CONFLICT";
+var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
+var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
+var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
+var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
+var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
+var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
+var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
+var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
+var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
+var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
+var STATUS_CODES = /* @__PURE__ */ new Map([
+  [400, BYMAX_BAD_REQUEST],
+  [401, BYMAX_UNAUTHORIZED],
+  [403, BYMAX_FORBIDDEN],
+  [404, BYMAX_NOT_FOUND],
+  [409, BYMAX_CONFLICT],
+  [413, BYMAX_PAYLOAD_TOO_LARGE],
+  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
+  [422, BYMAX_UNPROCESSABLE_ENTITY],
+  [429, BYMAX_TOO_MANY_REQUESTS],
+  [500, BYMAX_INTERNAL_ERROR],
+  [501, BYMAX_NOT_IMPLEMENTED],
+  [502, BYMAX_BAD_GATEWAY],
+  [503, BYMAX_SERVICE_UNAVAILABLE],
+  [504, BYMAX_GATEWAY_TIMEOUT]
+]);
+var CLIENT_ERROR_MIN = 400;
+var CLIENT_ERROR_MAX = 500;
+function codeForStatus(status) {
+  const catalogued = STATUS_CODES.get(status);
+  if (catalogued !== void 0) {
+    return catalogued;
+  }
+  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
+    return BYMAX_CLIENT_ERROR;
+  }
+  return BYMAX_INTERNAL_ERROR;
+}
+
+// src/body-depth/body-depth.middleware.ts
+var BODY_TOO_DEEP_MESSAGE = "Request body is nested too deeply";
+function exceedsDepth(value, maxDepth) {
+  let level = [value];
+  for (let depth = 0; level.length > 0; depth += 1) {
+    const next = [];
+    for (const node of level) {
+      if (typeof node === "object" && node !== null) {
+        if (depth >= maxDepth) {
+          return true;
+        }
+        for (const child of Object.values(node)) {
+          next.push(child);
+        }
+      }
+    }
+    level = next;
+  }
+  return false;
+}
+var BymaxBodyDepthMiddleware = class {
+  constructor(options) {
+    this.options = options;
+  }
+  /**
+   * @param req - The request, whose `body` the parser has already filled.
+   * @param _res - Unused.
+   * @param next - Continues the chain.
+   * @throws BadRequestException When the body is nested too deeply.
+   */
+  use(req, _res, next) {
+    if (exceedsDepth(req.body, this.options.bodyDepth.maxDepth)) {
+      throw new BadRequestException({ code: BYMAX_BAD_REQUEST, message: BODY_TOO_DEEP_MESSAGE });
+    }
+    next();
+  }
+};
+BymaxBodyDepthMiddleware = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(BYMAX_CORE_OPTIONS))
+], BymaxBodyDepthMiddleware);
+
 // src/route-defaults.ts
 var DEFAULT_HEALTH_PATH = "health";
 var DEFAULT_METRICS_PATH = "metrics";
@@ -62,6 +170,16 @@ function resolveTiming(raw) {
   const threshold = raw?.slowRequestThresholdMs;
   return threshold === void 0 ? { enabled } : { enabled, slowRequestThresholdMs: threshold };
 }
+var DEFAULT_MAX_BODY_DEPTH = 32;
+function resolveBodyDepth(raw) {
+  const maxDepth = raw?.maxDepth ?? DEFAULT_MAX_BODY_DEPTH;
+  if (!Number.isSafeInteger(maxDepth) || maxDepth < 1) {
+    throw new Error(
+      `bodyDepth.maxDepth must be a positive safe integer, received ${String(maxDepth)}`
+    );
+  }
+  return { enabled: raw?.enabled ?? false, maxDepth };
+}
 function resolveHealth(raw) {
   return {
     enabled: raw?.enabled ?? true,
@@ -134,6 +252,7 @@ function normalizeCoreOptions(raw) {
   return deepFreeze({
     envelope: resolveEnvelope(raw?.envelope),
     timing: resolveTiming(raw?.timing),
+    bodyDepth: resolveBodyDepth(raw?.bodyDepth),
     health: resolveHealth(raw?.health),
     metrics: resolveMetrics(raw?.metrics),
     openapi: resolveOpenApi(raw?.openapi, raw?.environment),
@@ -146,26 +265,6 @@ function normalizeCoreOptions(raw) {
 }
 normalizeCoreOptions();
 
-// src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
-var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:correlation-provider"
-);
-var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
-var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-indicators"
-);
-var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-transition-sink"
-);
-var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:unexpected-error-sink"
-);
-var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:metrics-registry"
-);
-var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
-
 // src/optional-peer.ts
 function isMissingModuleError(cause) {
   const code = cause.code;
@@ -273,52 +372,6 @@ function containRejection(returned, onFailure) {
   }
 }
 
-// src/envelope/error-codes.ts
-var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
-var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
-var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
-var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
-var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
-var BYMAX_CONFLICT = "BYMAX_CONFLICT";
-var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
-var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
-var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
-var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
-var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
-var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
-var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
-var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
-var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
-var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
-var STATUS_CODES = /* @__PURE__ */ new Map([
-  [400, BYMAX_BAD_REQUEST],
-  [401, BYMAX_UNAUTHORIZED],
-  [403, BYMAX_FORBIDDEN],
-  [404, BYMAX_NOT_FOUND],
-  [409, BYMAX_CONFLICT],
-  [413, BYMAX_PAYLOAD_TOO_LARGE],
-  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
-  [422, BYMAX_UNPROCESSABLE_ENTITY],
-  [429, BYMAX_TOO_MANY_REQUESTS],
-  [500, BYMAX_INTERNAL_ERROR],
-  [501, BYMAX_NOT_IMPLEMENTED],
-  [502, BYMAX_BAD_GATEWAY],
-  [503, BYMAX_SERVICE_UNAVAILABLE],
-  [504, BYMAX_GATEWAY_TIMEOUT]
-]);
-var CLIENT_ERROR_MIN = 400;
-var CLIENT_ERROR_MAX = 500;
-function codeForStatus(status) {
-  const catalogued = STATUS_CODES.get(status);
-  if (catalogued !== void 0) {
-    return catalogued;
-  }
-  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
-    return BYMAX_CLIENT_ERROR;
-  }
-  return BYMAX_INTERNAL_ERROR;
-}
-
 // src/envelope/error-envelope.ts
 function buildErrorEnvelope(input) {
   const base = {
@@ -1695,12 +1748,14 @@ var BymaxCoreModule = class extends BymaxCoreModuleBase {
    * @param consumer - Nest's middleware consumer.
    */
   configure(consumer) {
-    if (!this.resolved.timing.enabled) {
-      return;
-    }
     const adapter = this.adapterHost?.httpAdapter;
-    const onFastify = bridgeFastifyRouteMetadata(adapter);
-    consumer.apply(BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    if (this.resolved.timing.enabled) {
+      const onFastify = bridgeFastifyRouteMetadata(adapter);
+      consumer.apply(BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    }
+    if (this.resolved.bodyDepth.enabled && adapter?.getType?.() !== "fastify") {
+      consumer.apply(BymaxBodyDepthMiddleware).forRoutes("/");
+    }
   }
   /**
    * Register the module synchronously. Options are known now, so disabled
@@ -1892,4 +1947,4 @@ TimingInterceptor = __decorateClass([
   __decorateParam(3, Inject(BYMAX_TRACE_CONTEXT))
 ], TimingInterceptor);
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxBodyDepthMiddleware, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-core",
-  "version": "1.6.6",
+  "version": "1.6.7",
   "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing middleware, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -63,6 +63,16 @@
         "default": "./dist/metrics/index.cjs"
       }
     },
+    "./http": {
+      "import": {
+        "types": "./dist/http/index.d.ts",
+        "default": "./dist/http/index.mjs"
+      },
+      "require": {
+        "types": "./dist/http/index.d.cts",
+        "default": "./dist/http/index.cjs"
+      }
+    },
     "./openapi": {
       "import": {
         "types": "./dist/openapi/index.d.ts",
@@ -77,6 +87,7 @@
   },
   "scripts": {
     "build": "pnpm clean && tsup",
+    "check:file-length": "node scripts/check-file-length.mjs",
     "check:exports": "attw --pack . --profile strict",
     "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
@@ -94,8 +105,8 @@
     "size": "node scripts/check-size.mjs",
     "test": "jest",
     "test:cov": "jest --coverage",
-    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
-    "test:e2e": "jest --config jest.e2e.config.ts",
+    "test:cov:all": "node --experimental-vm-modules --disable-warning=ExperimentalWarning node_modules/jest/bin/jest.js --config jest.coverage.config.ts --coverage",
+    "test:e2e": "node --experimental-vm-modules --disable-warning=ExperimentalWarning node_modules/jest/bin/jest.js --config jest.e2e.config.ts",
     "test:watch": "jest --watch",
     "typecheck": "tsc --noEmit"
   },
@@ -113,6 +124,7 @@
     "@nestjs/core": "^11.1.18",
     "@nestjs/swagger": "^11.0.0",
     "@opentelemetry/api": "^1.9.0",
+    "helmet": "^8.0.0",
     "prom-client": "^15.0.0",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.0.0"
@@ -124,6 +136,9 @@
     "@opentelemetry/api": {
       "optional": true
     },
+    "helmet": {
+      "optional": true
+    },
     "prom-client": {
       "optional": true
     }
@@ -150,6 +165,8 @@
     "@types/supertest": "^7.2.0",
     "@typescript-eslint/eslint-plugin": "^8.59.3",
     "@typescript-eslint/parser": "^8.59.3",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
@@ -158,6 +175,7 @@
     "eslint-plugin-security": "^4.0.0",
     "fastify": "^5.12.5",
     "globals": "^17.6.0",
+    "helmet": "^8.3.0",
     "husky": "^9.1.7",
     "jest": "^30.4.2",
     "lint-staged": "^17.2.0",
@@ -182,6 +200,7 @@
     "metrics",
     "openapi",
     "swagger",
+    "helmet",
     "opentelemetry",
     "tracing",
     "typescript"
@@ -209,6 +228,9 @@
       ],
       "metrics": [
         "./dist/metrics/index.d.cts"
+      ],
+      "http": [
+        "./dist/http/index.d.cts"
       ]
     }
   }