@bymax-one/nest-core 1.6.6 → 1.6.8

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { Catch, Inject, Optional, Injectable, ConfigurableModuleBuilder, Module, HttpException, Logger, Get, Res, Controller, Req, HttpStatus, UnauthorizedException, NotFoundException } from '@nestjs/common';
+import { Injectable, Inject, Catch, Optional, ConfigurableModuleBuilder, Module, BadRequestException, HttpException, Logger, Get, Res, Controller, Req, HttpStatus, UnauthorizedException, NotFoundException } from '@nestjs/common';
 import { HttpAdapterHost, DiscoveryService, Reflector, BaseExceptionFilter, APP_FILTER, DiscoveryModule } from '@nestjs/core';
 import { createHash, timingSafeEqual } from 'crypto';
 import { AsyncResource } from 'async_hooks';
@@ -16,6 +16,121 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
+// src/core.tokens.ts
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
+var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:correlation-provider"
+);
+var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
+var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-indicators"
+);
+var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-transition-sink"
+);
+var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:unexpected-error-sink"
+);
+var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:metrics-registry"
+);
+var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
+
+// src/envelope/error-codes.ts
+var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
+var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
+var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
+var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
+var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
+var BYMAX_CONFLICT = "BYMAX_CONFLICT";
+var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
+var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
+var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
+var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
+var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
+var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
+var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
+var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
+var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
+var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
+var STATUS_CODES = /* @__PURE__ */ new Map([
+  [400, BYMAX_BAD_REQUEST],
+  [401, BYMAX_UNAUTHORIZED],
+  [403, BYMAX_FORBIDDEN],
+  [404, BYMAX_NOT_FOUND],
+  [409, BYMAX_CONFLICT],
+  [413, BYMAX_PAYLOAD_TOO_LARGE],
+  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
+  [422, BYMAX_UNPROCESSABLE_ENTITY],
+  [429, BYMAX_TOO_MANY_REQUESTS],
+  [500, BYMAX_INTERNAL_ERROR],
+  [501, BYMAX_NOT_IMPLEMENTED],
+  [502, BYMAX_BAD_GATEWAY],
+  [503, BYMAX_SERVICE_UNAVAILABLE],
+  [504, BYMAX_GATEWAY_TIMEOUT]
+]);
+var CLIENT_ERROR_MIN = 400;
+var CLIENT_ERROR_MAX = 500;
+function codeForStatus(status) {
+  const catalogued = STATUS_CODES.get(status);
+  if (catalogued !== void 0) {
+    return catalogued;
+  }
+  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
+    return BYMAX_CLIENT_ERROR;
+  }
+  return BYMAX_INTERNAL_ERROR;
+}
+
+// src/body-depth/body-depth.middleware.ts
+var BODY_TOO_DEEP_MESSAGE = "Request body is nested too deeply";
+function isContainer(node) {
+  if (typeof node !== "object" || node === null) {
+    return false;
+  }
+  const proto = Object.getPrototypeOf(node);
+  return Array.isArray(node) || proto === Object.prototype || proto === null;
+}
+function exceedsDepth(value, maxDepth) {
+  let level = [value];
+  for (let depth = 0; level.length > 0; depth += 1) {
+    const next = [];
+    for (const node of level) {
+      if (isContainer(node)) {
+        if (depth >= maxDepth) {
+          return true;
+        }
+        for (const child of Object.values(node)) {
+          next.push(child);
+        }
+      }
+    }
+    level = next;
+  }
+  return false;
+}
+var BymaxBodyDepthMiddleware = class {
+  constructor(options) {
+    this.options = options;
+  }
+  /**
+   * @param req - The request, whose `body` the parser has already filled.
+   * @param _res - Unused.
+   * @param next - Continues the chain.
+   * @throws BadRequestException When the body is nested too deeply.
+   */
+  use(req, _res, next) {
+    if (exceedsDepth(req.body, this.options.bodyDepth.maxDepth)) {
+      throw new BadRequestException({ code: BYMAX_BAD_REQUEST, message: BODY_TOO_DEEP_MESSAGE });
+    }
+    next();
+  }
+};
+BymaxBodyDepthMiddleware = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(BYMAX_CORE_OPTIONS))
+], BymaxBodyDepthMiddleware);
+
 // src/route-defaults.ts
 var DEFAULT_HEALTH_PATH = "health";
 var DEFAULT_METRICS_PATH = "metrics";
@@ -38,6 +153,8 @@ function runtimeEnvironmentName(declared) {
 
 // src/core.options.ts
 var DEFAULT_INDICATOR_TIMEOUT_MS = 5e3;
+var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+var DEFAULT_READINESS_CACHE_MS = 1e3;
 var DEFAULT_OPENAPI_PATH = "docs";
 var DEFAULT_OPENAPI_JSON_PATH = "docs-json";
 var DEFAULT_OPENAPI_TITLE = "API";
@@ -57,17 +174,48 @@ function resolveEnvelope(raw) {
     exposeInternals: raw?.exposeInternals ?? false
   };
 }
+function positiveSafeInteger(name, value, max) {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new Error(`${name} must be a positive safe integer, received ${String(value)}`);
+  }
+  if (max !== void 0 && value > max) {
+    throw new Error(`${name} must be a positive integer of at most ${max}, received ${value}`);
+  }
+  return value;
+}
 function resolveTiming(raw) {
   const enabled = raw?.enabled ?? true;
   const threshold = raw?.slowRequestThresholdMs;
-  return threshold === void 0 ? { enabled } : { enabled, slowRequestThresholdMs: threshold };
+  return threshold === void 0 ? { enabled } : {
+    enabled,
+    slowRequestThresholdMs: positiveSafeInteger("timing.slowRequestThresholdMs", threshold)
+  };
+}
+var DEFAULT_MAX_BODY_DEPTH = 32;
+function resolveBodyDepth(raw) {
+  const maxDepth = positiveSafeInteger(
+    "bodyDepth.maxDepth",
+    raw?.maxDepth ?? DEFAULT_MAX_BODY_DEPTH
+  );
+  return { enabled: raw?.enabled ?? false, maxDepth };
 }
 function resolveHealth(raw) {
+  const readinessCacheMs = raw?.readinessCacheMs ?? DEFAULT_READINESS_CACHE_MS;
+  if (!Number.isSafeInteger(readinessCacheMs) || readinessCacheMs < 0) {
+    throw new Error(
+      `health.readinessCacheMs must be a non-negative safe integer, received ${String(readinessCacheMs)}`
+    );
+  }
   return {
+    readinessCacheMs,
     enabled: raw?.enabled ?? true,
     path: raw?.path ?? DEFAULT_HEALTH_PATH,
     exposeIndicatorErrors: raw?.exposeIndicatorErrors ?? false,
-    indicatorTimeoutMs: raw?.indicatorTimeoutMs ?? DEFAULT_INDICATOR_TIMEOUT_MS,
+    indicatorTimeoutMs: positiveSafeInteger(
+      "health.indicatorTimeoutMs",
+      raw?.indicatorTimeoutMs ?? DEFAULT_INDICATOR_TIMEOUT_MS,
+      MAX_TIMER_DELAY_MS
+    ),
     autoDiscover: raw?.autoDiscover ?? false
   };
 }
@@ -134,6 +282,7 @@ function normalizeCoreOptions(raw) {
   return deepFreeze({
     envelope: resolveEnvelope(raw?.envelope),
     timing: resolveTiming(raw?.timing),
+    bodyDepth: resolveBodyDepth(raw?.bodyDepth),
     health: resolveHealth(raw?.health),
     metrics: resolveMetrics(raw?.metrics),
     openapi: resolveOpenApi(raw?.openapi, raw?.environment),
@@ -146,26 +295,6 @@ function normalizeCoreOptions(raw) {
 }
 normalizeCoreOptions();
 
-// src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
-var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:correlation-provider"
-);
-var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
-var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-indicators"
-);
-var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:health-transition-sink"
-);
-var BYMAX_UNEXPECTED_ERROR_SINK = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:unexpected-error-sink"
-);
-var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
-  "@bymax-one/nest-core:metrics-registry"
-);
-var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
-
 // src/optional-peer.ts
 function isMissingModuleError(cause) {
   const code = cause.code;
@@ -273,52 +402,6 @@ function containRejection(returned, onFailure) {
   }
 }
 
-// src/envelope/error-codes.ts
-var BYMAX_BAD_REQUEST = "BYMAX_BAD_REQUEST";
-var BYMAX_VALIDATION_FAILED = "BYMAX_VALIDATION_FAILED";
-var BYMAX_UNAUTHORIZED = "BYMAX_UNAUTHORIZED";
-var BYMAX_FORBIDDEN = "BYMAX_FORBIDDEN";
-var BYMAX_NOT_FOUND = "BYMAX_NOT_FOUND";
-var BYMAX_CONFLICT = "BYMAX_CONFLICT";
-var BYMAX_PAYLOAD_TOO_LARGE = "BYMAX_PAYLOAD_TOO_LARGE";
-var BYMAX_UNSUPPORTED_MEDIA_TYPE = "BYMAX_UNSUPPORTED_MEDIA_TYPE";
-var BYMAX_UNPROCESSABLE_ENTITY = "BYMAX_UNPROCESSABLE_ENTITY";
-var BYMAX_TOO_MANY_REQUESTS = "BYMAX_TOO_MANY_REQUESTS";
-var BYMAX_CLIENT_ERROR = "BYMAX_CLIENT_ERROR";
-var BYMAX_INTERNAL_ERROR = "BYMAX_INTERNAL_ERROR";
-var BYMAX_NOT_IMPLEMENTED = "BYMAX_NOT_IMPLEMENTED";
-var BYMAX_BAD_GATEWAY = "BYMAX_BAD_GATEWAY";
-var BYMAX_SERVICE_UNAVAILABLE = "BYMAX_SERVICE_UNAVAILABLE";
-var BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
-var STATUS_CODES = /* @__PURE__ */ new Map([
-  [400, BYMAX_BAD_REQUEST],
-  [401, BYMAX_UNAUTHORIZED],
-  [403, BYMAX_FORBIDDEN],
-  [404, BYMAX_NOT_FOUND],
-  [409, BYMAX_CONFLICT],
-  [413, BYMAX_PAYLOAD_TOO_LARGE],
-  [415, BYMAX_UNSUPPORTED_MEDIA_TYPE],
-  [422, BYMAX_UNPROCESSABLE_ENTITY],
-  [429, BYMAX_TOO_MANY_REQUESTS],
-  [500, BYMAX_INTERNAL_ERROR],
-  [501, BYMAX_NOT_IMPLEMENTED],
-  [502, BYMAX_BAD_GATEWAY],
-  [503, BYMAX_SERVICE_UNAVAILABLE],
-  [504, BYMAX_GATEWAY_TIMEOUT]
-]);
-var CLIENT_ERROR_MIN = 400;
-var CLIENT_ERROR_MAX = 500;
-function codeForStatus(status) {
-  const catalogued = STATUS_CODES.get(status);
-  if (catalogued !== void 0) {
-    return catalogued;
-  }
-  if (status >= CLIENT_ERROR_MIN && status < CLIENT_ERROR_MAX) {
-    return BYMAX_CLIENT_ERROR;
-  }
-  return BYMAX_INTERNAL_ERROR;
-}
-
 // src/envelope/error-envelope.ts
 function buildErrorEnvelope(input) {
   const base = {
@@ -791,10 +874,12 @@ function summarizeRejection(reason) {
   }
   return `${message.slice(0, MAX_ERROR_MESSAGE_LENGTH - TRUNCATION_ELLIPSIS.length)}${TRUNCATION_ELLIPSIS}`;
 }
-async function runIndicator(indicator, timeoutMs, exposeErrors) {
+function startTimeout(indicator, timeoutMs) {
+  const controller = new AbortController();
   let timer;
   const timedOut = new Promise((resolve) => {
     timer = setTimeout(() => {
+      controller.abort();
       resolve({
         entry: { name: indicator.name, status: "down", details: { timedOutAfterMs: timeoutMs } },
         isUp: false,
@@ -802,8 +887,12 @@ async function runIndicator(indicator, timeoutMs, exposeErrors) {
       });
     }, timeoutMs);
   });
-  const checked = Promise.resolve().then(() => indicator.check()).then((result) => {
-    const entry = { ...result, name: indicator.name };
+  return { signal: controller.signal, timedOut, clear: () => clearTimeout(timer) };
+}
+async function runIndicator(indicator, timeoutMs, exposeErrors) {
+  const { signal, timedOut, clear } = startTimeout(indicator, timeoutMs);
+  const checked = Promise.resolve().then(() => indicator.check(signal)).then((result) => {
+    const entry = exposeErrors ? { ...result, name: indicator.name } : { name: indicator.name, status: result.status };
     return result.status === "up" ? { entry, isUp: true } : { entry, isUp: false, cause: { kind: "reported-down" } };
   }).catch((reason) => {
     const message = summarizeRejection(reason);
@@ -816,7 +905,7 @@ async function runIndicator(indicator, timeoutMs, exposeErrors) {
   try {
     return await Promise.race([checked, timedOut]);
   } finally {
-    clearTimeout(timer);
+    clear();
   }
 }
 function describeCause(cause) {
@@ -876,6 +965,8 @@ var HealthService = class {
      * Comparing states alone would then let the stale observation win.
      */
     this.probeSequence = 0;
+    /** Set once shutdown begins, after which readiness answers not ready without running anything. */
+    this.draining = false;
   }
   /**
    * Report one check's current state, emitting only when it differs from the
@@ -1048,6 +1139,14 @@ var HealthService = class {
     );
     return this.effectiveIndicators;
   }
+  /**
+   * Stop reporting ready the moment shutdown begins, so a load balancer stops routing here while
+   * the process drains. Nothing cached or in progress is consulted again: every later probe is answered
+   * before either is read.
+   */
+  beforeApplicationShutdown() {
+    this.draining = true;
+  }
   /**
    * Liveness check: the process is up and able to respond. Runs no
    * indicators, so it never depends on the health of anything else.
@@ -1062,9 +1161,33 @@ var HealthService = class {
    * aggregate the results. `status` is `'ok'` only when every indicator
    * reports `up`; an empty indicator list is vacuously `'ok'`.
    *
+   * Probes share the work: one that arrives while a run is in progress awaits it, and for
+   * `health.readinessCacheMs` after it ends the answer is returned without running anything.
+   * The endpoint is usually unauthenticated, so probe volume must not set dependency volume.
+   * Once shutdown has begun the answer is always not ready. The returned object is shared between
+   * callers and must not be mutated.
+   *
+   * @returns The aggregated health response.
+   */
+  checkReadiness() {
+    if (this.draining) {
+      return Promise.resolve({ status: "error", checks: [{ name: "shutdown", status: "down" }] });
+    }
+    const cached = this.cached;
+    if (cached !== void 0 && performance.now() - cached.at < this.options.health.readinessCacheMs) {
+      return Promise.resolve(cached.response);
+    }
+    this.inflight ??= this.runReadiness().finally(() => {
+      this.inflight = void 0;
+    });
+    return this.inflight;
+  }
+  /**
+   * Run every indicator once and record the answer.
+   *
    * @returns The aggregated health response.
    */
-  async checkReadiness() {
+  async runReadiness() {
     const timeoutMs = this.options.health.indicatorTimeoutMs;
     const exposeErrors = this.options.health.exposeIndicatorErrors;
     const seq = ++this.probeSequence;
@@ -1076,7 +1199,9 @@ var HealthService = class {
     }
     const checks = outcomes.map((outcome) => outcome.entry);
     const status = checks.every((check) => check.status === "up") ? "ok" : "error";
-    return { status, checks };
+    const response = { status, checks };
+    this.cached = { at: performance.now(), response };
+    return response;
   }
 };
 HealthService = __decorateClass([
@@ -1695,12 +1820,14 @@ var BymaxCoreModule = class extends BymaxCoreModuleBase {
    * @param consumer - Nest's middleware consumer.
    */
   configure(consumer) {
-    if (!this.resolved.timing.enabled) {
-      return;
-    }
     const adapter = this.adapterHost?.httpAdapter;
-    const onFastify = bridgeFastifyRouteMetadata(adapter);
-    consumer.apply(BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    if (this.resolved.timing.enabled) {
+      const onFastify = bridgeFastifyRouteMetadata(adapter);
+      consumer.apply(BymaxTimingMiddleware).forRoutes(onFastify ? "{*splat}" : "/");
+    }
+    if (this.resolved.bodyDepth.enabled && adapter?.getType?.() !== "fastify") {
+      consumer.apply(BymaxBodyDepthMiddleware).forRoutes("/");
+    }
   }
   /**
    * Register the module synchronously. Options are known now, so disabled
@@ -1892,4 +2019,4 @@ TimingInterceptor = __decorateClass([
   __decorateParam(3, Inject(BYMAX_TRACE_CONTEXT))
 ], TimingInterceptor);
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxBodyDepthMiddleware, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-core",
-  "version": "1.6.6",
+  "version": "1.6.8",
   "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing middleware, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -63,6 +63,16 @@
         "default": "./dist/metrics/index.cjs"
       }
     },
+    "./http": {
+      "import": {
+        "types": "./dist/http/index.d.ts",
+        "default": "./dist/http/index.mjs"
+      },
+      "require": {
+        "types": "./dist/http/index.d.cts",
+        "default": "./dist/http/index.cjs"
+      }
+    },
     "./openapi": {
       "import": {
         "types": "./dist/openapi/index.d.ts",
@@ -77,6 +87,7 @@
   },
   "scripts": {
     "build": "pnpm clean && tsup",
+    "check:file-length": "node scripts/check-file-length.mjs",
     "check:exports": "attw --pack . --profile strict",
     "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
@@ -94,8 +105,8 @@
     "size": "node scripts/check-size.mjs",
     "test": "jest",
     "test:cov": "jest --coverage",
-    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
-    "test:e2e": "jest --config jest.e2e.config.ts",
+    "test:cov:all": "node --experimental-vm-modules --disable-warning=ExperimentalWarning node_modules/jest/bin/jest.js --config jest.coverage.config.ts --coverage",
+    "test:e2e": "node --experimental-vm-modules --disable-warning=ExperimentalWarning node_modules/jest/bin/jest.js --config jest.e2e.config.ts",
     "test:watch": "jest --watch",
     "typecheck": "tsc --noEmit"
   },
@@ -113,6 +124,7 @@
     "@nestjs/core": "^11.1.18",
     "@nestjs/swagger": "^11.0.0",
     "@opentelemetry/api": "^1.9.0",
+    "helmet": "^8.0.0",
     "prom-client": "^15.0.0",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.0.0"
@@ -124,6 +136,9 @@
     "@opentelemetry/api": {
       "optional": true
     },
+    "helmet": {
+      "optional": true
+    },
     "prom-client": {
       "optional": true
     }
@@ -150,6 +165,8 @@
     "@types/supertest": "^7.2.0",
     "@typescript-eslint/eslint-plugin": "^8.59.3",
     "@typescript-eslint/parser": "^8.59.3",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
@@ -158,6 +175,7 @@
     "eslint-plugin-security": "^4.0.0",
     "fastify": "^5.12.5",
     "globals": "^17.6.0",
+    "helmet": "^8.3.0",
     "husky": "^9.1.7",
     "jest": "^30.4.2",
     "lint-staged": "^17.2.0",
@@ -182,6 +200,7 @@
     "metrics",
     "openapi",
     "swagger",
+    "helmet",
     "opentelemetry",
     "tracing",
     "typescript"
@@ -209,6 +228,9 @@
       ],
       "metrics": [
         "./dist/metrics/index.d.cts"
+      ],
+      "http": [
+        "./dist/http/index.d.cts"
       ]
     }
   }