@open-rlb/nestjs-amqp 2.1.0 → 2.2.0

package/schematics/enable-route-discovery/schema.ts

@@ -0,0 +1,16 @@
+export interface EnableRouteDiscoveryOptions {
+  /** Logical service name published for auto-discovery. Prompted when omitted; kebab/snake-normalized. */
+  serviceName?: string;
+  /** Discovery exchange (fanout). Default: 'rlb-route-discovery'. */
+  exchange?: string;
+  /** Queue the gateway syncs from. Default: 'rlb-route-sync'. */
+  queue?: string;
+  /** Publish the route manifest on boot. Default: true. */
+  publishOnBoot?: boolean;
+  /** Also declare the discovery exchange in broker.exchanges. Default: true. */
+  declareExchange?: boolean;
+  /** Update broker.routeDiscovery when it already exists (default: leave it untouched). */
+  overwrite?: boolean;
+  /** Path to config.yaml (default: auto-detected, typically config/config.yaml). */
+  config?: string;
+}

package/schematics/harden-gateway/index.d.ts

@@ -0,0 +1,3 @@
+import { Rule } from '@angular-devkit/schematics';
+import { HardenGatewayOptions } from './schema';
+export declare function main(options: HardenGatewayOptions): Rule;

package/schematics/harden-gateway/index.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = main;
+const yaml_config_util_1 = require("../utils/yaml-config.util");
+function main(options) {
+    return async (tree, context) => {
+        const configPath = (0, yaml_config_util_1.findConfigYaml)(tree, options.config);
+        const { doc, existed } = (0, yaml_config_util_1.readConfigDoc)(tree, configPath);
+        if (!existed)
+            context.logger.info(`[rlb-amqp] ${configPath} not found — creating it.`);
+        const set = (path, value, label) => {
+            const outcome = (0, yaml_config_util_1.setIn)(doc, path, value);
+            const verb = outcome === 'created' ? 'set' : outcome === 'updated' ? 'updated' : 'unchanged';
+            context.logger.info(`[rlb-amqp] ${label}: ${verb}.`);
+        };
+        if (options.maxConcurrentRequests !== undefined)
+            set(['gateway', 'maxConcurrentRequests'], options.maxConcurrentRequests, 'gateway.maxConcurrentRequests');
+        if (options.maxBodyBytes !== undefined)
+            set(['gateway', 'maxBodyBytes'], options.maxBodyBytes, 'gateway.maxBodyBytes');
+        if (options.uploadMaxFileSizeMb !== undefined)
+            set(['gateway', 'upload', 'maxFileSizeMb'], options.uploadMaxFileSizeMb, 'gateway.upload.maxFileSizeMb');
+        if (options.uploadMaxFiles !== undefined)
+            set(['gateway', 'upload', 'maxFiles'], options.uploadMaxFiles, 'gateway.upload.maxFiles');
+        if (options.wsMaxBufferedBytes !== undefined)
+            set(['gateway', 'ws', 'maxBufferedBytes'], options.wsMaxBufferedBytes, 'gateway.ws.maxBufferedBytes');
+        if (options.wsMaxMessageBytes !== undefined)
+            set(['gateway', 'ws', 'maxMessageBytes'], options.wsMaxMessageBytes, 'gateway.ws.maxMessageBytes');
+        if (options.allowedOrigins !== undefined)
+            set(['gateway', 'ws', 'allowedOrigins'], options.allowedOrigins, 'gateway.ws.allowedOrigins');
+        (0, yaml_config_util_1.writeConfigDoc)(tree, configPath, doc);
+        const patchMain = options.patchMain ?? true;
+        if (options.maxBodyBytes !== undefined && patchMain) {
+            patchMainTs(tree, context);
+        }
+        return tree;
+    };
+}
+function patchMainTs(tree, context) {
+    const candidatePaths = ['/src/main.ts', '/app/main.ts', 'src/main.ts', 'app/main.ts'];
+    const mainPath = candidatePaths.find((p) => tree.exists(p)) || findFileInTree(tree, 'main.ts');
+    if (!mainPath) {
+        context.logger.warn('[rlb-amqp] main.ts not found: add the useBodyParser(maxBodyBytes) wiring manually.');
+        return;
+    }
+    let content = tree.read(mainPath).toString('utf-8');
+    if (content.includes('useBodyParser')) {
+        context.logger.info('[rlb-amqp] main.ts already calls useBodyParser — left unchanged.');
+        return;
+    }
+    let importAdds = '';
+    if (!content.includes('ConfigService'))
+        importAdds += "\nimport { ConfigService } from '@nestjs/config';";
+    if (!content.includes('GatewayConfig'))
+        importAdds += "\nimport { GatewayConfig } from '@open-rlb/nestjs-amqp';";
+    if (importAdds) {
+        const pos = findLastImportEndIndex(content);
+        content = content.slice(0, pos) + importAdds + content.slice(pos);
+    }
+    const m = content.match(/const\s+(\w+)\s*=\s*await\s+NestFactory\.create(?:<[^>]*>)?\(\s*[A-Za-z0-9_]+\s*(?:,\s*\{[^}]*\})?\s*\)\s*;?/);
+    if (!m) {
+        context.logger.warn('[rlb-amqp] NestFactory.create() not found in main.ts: add the useBodyParser wiring manually (YAML changes kept).');
+        tree.overwrite(mainPath, content);
+        return;
+    }
+    const app = m[1];
+    const block = `\n\n  const gateway = ${app}.get(ConfigService).get<GatewayConfig>('gateway');\n` +
+        `  if (gateway?.maxBodyBytes) {\n` +
+        `    ${app}.useBodyParser('json', { limit: gateway.maxBodyBytes });\n` +
+        `    ${app}.useBodyParser('urlencoded', { extended: true, limit: gateway.maxBodyBytes });\n` +
+        `  }`;
+    const insertAt = m.index + m[0].length;
+    content = content.slice(0, insertAt) + block + content.slice(insertAt);
+    tree.overwrite(mainPath, content);
+    context.logger.info('[rlb-amqp] main.ts: body-parser limit wiring added.');
+}
+function findLastImportEndIndex(source) {
+    const importRegex = /^import\s+.+from\s+['"][^'"]+['"];?\s*$/gm;
+    let lastEnd = 0;
+    let match;
+    while ((match = importRegex.exec(source)) !== null) {
+        lastEnd = match.index + match[0].length;
+    }
+    return lastEnd;
+}
+function findFileInTree(tree, fileName) {
+    let found;
+    tree.visit((path) => {
+        if (!found && path.endsWith(`/${fileName}`))
+            found = path;
+    });
+    return found;
+}
+//# sourceMappingURL=index.js.map

package/schematics/harden-gateway/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/schematics/harden-gateway/index.ts"],"names":[],"mappings":";;AASA,oBA+BC;AAvCD,gEAAiG;AAQjG,SAAgB,IAAI,CAAC,OAA6B;IAChD,OAAO,KAAK,EAAE,IAAU,EAAE,OAAyB,EAAE,EAAE;QACrD,MAAM,UAAU,GAAG,IAAA,iCAAc,EAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAA,gCAAa,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,UAAU,2BAA2B,CAAC,CAAC;QAGvF,MAAM,GAAG,GAAG,CAAC,IAAyB,EAAE,KAAc,EAAE,KAAa,EAAE,EAAE;YACvE,MAAM,OAAO,GAAG,IAAA,wBAAK,EAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;YAC7F,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,IAAI,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,SAAS,EAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QAC3J,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;QACvH,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAC;QACxJ,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;QACpI,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;QACpJ,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QAChJ,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAExI,IAAA,iCAAc,EAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAGtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC5C,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,SAAS,EAAE,CAAC;YACpD,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAGD,SAAS,WAAW,CAAC,IAAU,EAAE,OAAyB;IACxD,MAAM,cAAc,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IAGD,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,UAAU,IAAI,mDAAmD,CAAC;IAC1G,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,UAAU,IAAI,0DAA0D,CAAC;IACjH,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CACrB,8GAA8G,CAC/G,CAAC;IACF,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,kHAAkH,CAAC,CAAC;QACxI,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,KAAK,GACT,yBAAyB,GAAG,sDAAsD;QAClF,kCAAkC;QAClC,OAAO,GAAG,4DAA4D;QACtE,OAAO,GAAG,kFAAkF;QAC5F,KAAK,CAAC;IACR,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEvE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;AAC7E,CAAC;AAGD,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,WAAW,GAAG,2CAA2C,CAAC;IAChE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,cAAc,CAAC,IAAU,EAAE,QAAgB;IAClD,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/schematics/harden-gateway/index.spec.ts

@@ -0,0 +1,105 @@
+import { Rule, SchematicContext, Tree } from '@angular-devkit/schematics';
+import { parseDocument } from 'yaml';
+import { main } from './index';
+import { HardenGatewayOptions } from './schema';
+
+/** Factory invoked directly against a Tree (not SchematicTestRunner — ESM `ora`). */
+const ctx = { logger: { info() {}, warn() {}, error() {} } } as unknown as SchematicContext;
+
+async function run(options: HardenGatewayOptions, tree: Tree): Promise<Tree> {
+  const rule = main(options) as Rule;
+  const result = await (rule as (t: Tree, c: SchematicContext) => Promise<Tree>)(tree, ctx);
+  return result || tree;
+}
+
+function read(tree: Tree, path = 'config/config.yaml'): string {
+  return tree.read(path)!.toString('utf-8');
+}
+function doc(tree: Tree) {
+  return parseDocument(read(tree));
+}
+function seedConfig(): Tree {
+  const tree = Tree.empty();
+  tree.create('config/config.yaml', ['# my config', 'gateway:', '  paths: []', ''].join('\n'));
+  return tree;
+}
+const MAIN_TS = [
+  "import { NestFactory } from '@nestjs/core';",
+  "import { AppModule } from './app.module';",
+  '',
+  'async function bootstrap() {',
+  '  const app = await NestFactory.create(AppModule, { rawBody: true });',
+  '  await app.listen(3000);',
+  '}',
+  'bootstrap();',
+  '',
+].join('\n');
+
+describe('harden-gateway schematic', () => {
+  it('sets only the provided limits at the right paths', async () => {
+    const tree = await run(
+      {
+        maxConcurrentRequests: 100,
+        maxBodyBytes: '5mb',
+        uploadMaxFileSizeMb: 10,
+        uploadMaxFiles: 3,
+        wsMaxBufferedBytes: 1048576,
+        wsMaxMessageBytes: 65536,
+        allowedOrigins: ['https://a.example', 'https://b.example'],
+        patchMain: false,
+      },
+      seedConfig(),
+    );
+    const d = doc(tree);
+    expect(Number(d.getIn(['gateway', 'maxConcurrentRequests']))).toBe(100);
+    expect(String(d.getIn(['gateway', 'maxBodyBytes']))).toBe('5mb');
+    expect(Number(d.getIn(['gateway', 'upload', 'maxFileSizeMb']))).toBe(10);
+    expect(Number(d.getIn(['gateway', 'upload', 'maxFiles']))).toBe(3);
+    expect(Number(d.getIn(['gateway', 'ws', 'maxBufferedBytes']))).toBe(1048576);
+    expect(Number(d.getIn(['gateway', 'ws', 'maxMessageBytes']))).toBe(65536);
+    const origins = (d.getIn(['gateway', 'ws', 'allowedOrigins']) as any).items.map((i: any) => String(i));
+    expect(origins).toEqual(['https://a.example', 'https://b.example']);
+    expect(read(tree)).toContain('# my config');
+  });
+
+  it('leaves unrelated keys absent when their option is not passed', async () => {
+    const tree = await run({ maxConcurrentRequests: 50, patchMain: false }, seedConfig());
+    const d = doc(tree);
+    expect(d.hasIn(['gateway', 'maxBodyBytes'])).toBe(false);
+    expect(d.hasIn(['gateway', 'upload'])).toBe(false);
+    expect(d.hasIn(['gateway', 'ws'])).toBe(false);
+  });
+
+  it('patches main.ts once and is idempotent on re-run', async () => {
+    const tree = seedConfig();
+    tree.create('src/main.ts', MAIN_TS);
+
+    await run({ maxBodyBytes: '5mb' }, tree);
+    let mainContent = tree.read('src/main.ts')!.toString('utf-8');
+    expect((mainContent.match(/useBodyParser\('json'/g) || []).length).toBe(1);
+    expect(mainContent).toContain("import { ConfigService } from '@nestjs/config';");
+    expect(mainContent).toContain("import { GatewayConfig } from '@open-rlb/nestjs-amqp';");
+    expect(mainContent).toContain("const gateway = app.get(ConfigService).get<GatewayConfig>('gateway');");
+    // The injected block follows the create statement.
+    expect(mainContent.indexOf('NestFactory.create')).toBeLessThan(mainContent.indexOf('useBodyParser'));
+
+    // Re-run: no duplication.
+    await run({ maxBodyBytes: '5mb' }, tree);
+    mainContent = tree.read('src/main.ts')!.toString('utf-8');
+    expect((mainContent.match(/useBodyParser\('json'/g) || []).length).toBe(1);
+  });
+
+  it('does not touch main.ts when patchMain is false', async () => {
+    const tree = seedConfig();
+    tree.create('src/main.ts', MAIN_TS);
+    await run({ maxBodyBytes: '5mb', patchMain: false }, tree);
+    expect(tree.read('src/main.ts')!.toString('utf-8')).not.toContain('useBodyParser');
+  });
+
+  it('does not patch main.ts when maxBodyBytes is not provided', async () => {
+    const tree = seedConfig();
+    tree.create('src/main.ts', MAIN_TS);
+    await run({ maxConcurrentRequests: 10 }, tree);
+    expect(tree.read('src/main.ts')!.toString('utf-8')).not.toContain('useBodyParser');
+  });
+});

package/schematics/harden-gateway/index.ts

@@ -0,0 +1,108 @@
+import { Rule, SchematicContext, Tree } from '@angular-devkit/schematics';
+import { findConfigYaml, readConfigDoc, setIn, writeConfigDoc } from '../utils/yaml-config.util';
+import { HardenGatewayOptions } from './schema';
+
+/**
+ * `harden-gateway` — set the gateway growth/DoS limits in config.yaml (only the options you pass)
+ * and, when `maxBodyBytes` is provided, patch main.ts to re-register the JSON/urlencoded body
+ * parsers with that limit (the framework default is ~100kb). Both halves are idempotent.
+ */
+export function main(options: HardenGatewayOptions): Rule {
+  return async (tree: Tree, context: SchematicContext) => {
+    const configPath = findConfigYaml(tree, options.config);
+    const { doc, existed } = readConfigDoc(tree, configPath);
+    if (!existed) context.logger.info(`[rlb-amqp] ${configPath} not found — creating it.`);
+
+    // YAML: set ONLY the limits actually supplied (leave everything else untouched).
+    const set = (path: (string | number)[], value: unknown, label: string) => {
+      const outcome = setIn(doc, path, value);
+      const verb = outcome === 'created' ? 'set' : outcome === 'updated' ? 'updated' : 'unchanged';
+      context.logger.info(`[rlb-amqp] ${label}: ${verb}.`);
+    };
+
+    if (options.maxConcurrentRequests !== undefined) set(['gateway', 'maxConcurrentRequests'], options.maxConcurrentRequests, 'gateway.maxConcurrentRequests');
+    if (options.maxBodyBytes !== undefined) set(['gateway', 'maxBodyBytes'], options.maxBodyBytes, 'gateway.maxBodyBytes');
+    if (options.uploadMaxFileSizeMb !== undefined) set(['gateway', 'upload', 'maxFileSizeMb'], options.uploadMaxFileSizeMb, 'gateway.upload.maxFileSizeMb');
+    if (options.uploadMaxFiles !== undefined) set(['gateway', 'upload', 'maxFiles'], options.uploadMaxFiles, 'gateway.upload.maxFiles');
+    if (options.wsMaxBufferedBytes !== undefined) set(['gateway', 'ws', 'maxBufferedBytes'], options.wsMaxBufferedBytes, 'gateway.ws.maxBufferedBytes');
+    if (options.wsMaxMessageBytes !== undefined) set(['gateway', 'ws', 'maxMessageBytes'], options.wsMaxMessageBytes, 'gateway.ws.maxMessageBytes');
+    if (options.allowedOrigins !== undefined) set(['gateway', 'ws', 'allowedOrigins'], options.allowedOrigins, 'gateway.ws.allowedOrigins');
+
+    writeConfigDoc(tree, configPath, doc);
+
+    // main.ts body-parser patch — only when a body limit is configured AND patching is enabled.
+    const patchMain = options.patchMain ?? true;
+    if (options.maxBodyBytes !== undefined && patchMain) {
+      patchMainTs(tree, context);
+    }
+
+    return tree;
+  };
+}
+
+/** Re-register the JSON/urlencoded body parsers with gateway.maxBodyBytes. Idempotent + no-op when unfindable. */
+function patchMainTs(tree: Tree, context: SchematicContext): void {
+  const candidatePaths = ['/src/main.ts', '/app/main.ts', 'src/main.ts', 'app/main.ts'];
+  const mainPath = candidatePaths.find((p) => tree.exists(p)) || findFileInTree(tree, 'main.ts');
+  if (!mainPath) {
+    context.logger.warn('[rlb-amqp] main.ts not found: add the useBodyParser(maxBodyBytes) wiring manually.');
+    return;
+  }
+
+  let content = tree.read(mainPath)!.toString('utf-8');
+  if (content.includes('useBodyParser')) {
+    context.logger.info('[rlb-amqp] main.ts already calls useBodyParser — left unchanged.');
+    return;
+  }
+
+  // Insert the imports the injected block needs (if missing).
+  let importAdds = '';
+  if (!content.includes('ConfigService')) importAdds += "\nimport { ConfigService } from '@nestjs/config';";
+  if (!content.includes('GatewayConfig')) importAdds += "\nimport { GatewayConfig } from '@open-rlb/nestjs-amqp';";
+  if (importAdds) {
+    const pos = findLastImportEndIndex(content);
+    content = content.slice(0, pos) + importAdds + content.slice(pos);
+  }
+
+  const m = content.match(
+    /const\s+(\w+)\s*=\s*await\s+NestFactory\.create(?:<[^>]*>)?\(\s*[A-Za-z0-9_]+\s*(?:,\s*\{[^}]*\})?\s*\)\s*;?/,
+  );
+  if (!m) {
+    context.logger.warn('[rlb-amqp] NestFactory.create() not found in main.ts: add the useBodyParser wiring manually (YAML changes kept).');
+    tree.overwrite(mainPath, content);
+    return;
+  }
+
+  const app = m[1];
+  const block =
+    `\n\n  const gateway = ${app}.get(ConfigService).get<GatewayConfig>('gateway');\n` +
+    `  if (gateway?.maxBodyBytes) {\n` +
+    `    ${app}.useBodyParser('json', { limit: gateway.maxBodyBytes });\n` +
+    `    ${app}.useBodyParser('urlencoded', { extended: true, limit: gateway.maxBodyBytes });\n` +
+    `  }`;
+  const insertAt = m.index! + m[0].length;
+  content = content.slice(0, insertAt) + block + content.slice(insertAt);
+
+  tree.overwrite(mainPath, content);
+  context.logger.info('[rlb-amqp] main.ts: body-parser limit wiring added.');
+}
+
+/** Local copy (do not import from nest-add): first import-statement end offset. */
+function findLastImportEndIndex(source: string): number {
+  const importRegex = /^import\s+.+from\s+['"][^'"]+['"];?\s*$/gm;
+  let lastEnd = 0;
+  let match: RegExpExecArray | null;
+  while ((match = importRegex.exec(source)) !== null) {
+    lastEnd = match.index + match[0].length;
+  }
+  return lastEnd;
+}
+
+/** Local copy (do not import from nest-add): first file whose path ends with `/<fileName>`. */
+function findFileInTree(tree: Tree, fileName: string): string | undefined {
+  let found: string | undefined;
+  tree.visit((path) => {
+    if (!found && path.endsWith(`/${fileName}`)) found = path;
+  });
+  return found;
+}

package/schematics/harden-gateway/schema.d.ts

@@ -0,0 +1,11 @@
+export interface HardenGatewayOptions {
+    maxConcurrentRequests?: number;
+    maxBodyBytes?: string | number;
+    uploadMaxFileSizeMb?: number;
+    uploadMaxFiles?: number;
+    wsMaxBufferedBytes?: number;
+    wsMaxMessageBytes?: number;
+    allowedOrigins?: string[];
+    patchMain?: boolean;
+    config?: string;
+}

package/schematics/harden-gateway/schema.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=schema.js.map

package/schematics/harden-gateway/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/schematics/harden-gateway/schema.ts"],"names":[],"mappings":""}

package/schematics/harden-gateway/schema.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "$id": "SchematicsRlbAmqpHardenGateway",
+  "title": "Add gateway hardening limits (config.yaml + optional main.ts body-parser patch)",
+  "type": "object",
+  "properties": {
+    "maxConcurrentRequests": {
+      "type": "number",
+      "description": "gateway.maxConcurrentRequests — global in-flight request cap."
+    },
+    "maxBodyBytes": {
+      "type": ["string", "number"],
+      "description": "gateway.maxBodyBytes — non-multipart body limit (e.g. '5mb'). Also drives the main.ts patch."
+    },
+    "uploadMaxFileSizeMb": {
+      "type": "number",
+      "description": "gateway.upload.maxFileSizeMb — per-file multipart limit."
+    },
+    "uploadMaxFiles": {
+      "type": "number",
+      "description": "gateway.upload.maxFiles — max files per multipart request."
+    },
+    "wsMaxBufferedBytes": {
+      "type": "number",
+      "description": "gateway.ws.maxBufferedBytes — per-socket outbound backpressure cap."
+    },
+    "wsMaxMessageBytes": {
+      "type": "number",
+      "description": "gateway.ws.maxMessageBytes — inbound WS frame limit."
+    },
+    "allowedOrigins": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "gateway.ws.allowedOrigins — CORS allow-list for the WS upgrade."
+    },
+    "patchMain": {
+      "type": "boolean",
+      "default": true,
+      "description": "Also patch main.ts to re-register the body parsers with maxBodyBytes."
+    },
+    "config": {
+      "type": "string",
+      "description": "Path to config.yaml (default: auto-detected)."
+    }
+  },
+  "required": []
+}

package/schematics/harden-gateway/schema.ts

@@ -0,0 +1,20 @@
+export interface HardenGatewayOptions {
+  /** gateway.maxConcurrentRequests — global in-flight request cap. */
+  maxConcurrentRequests?: number;
+  /** gateway.maxBodyBytes — non-multipart body limit (e.g. '5mb'). Also drives the main.ts patch. */
+  maxBodyBytes?: string | number;
+  /** gateway.upload.maxFileSizeMb — per-file multipart limit. */
+  uploadMaxFileSizeMb?: number;
+  /** gateway.upload.maxFiles — max files per multipart request. */
+  uploadMaxFiles?: number;
+  /** gateway.ws.maxBufferedBytes — per-socket outbound backpressure cap. */
+  wsMaxBufferedBytes?: number;
+  /** gateway.ws.maxMessageBytes — inbound WS frame limit. */
+  wsMaxMessageBytes?: number;
+  /** gateway.ws.allowedOrigins — CORS allow-list for the WS upgrade. */
+  allowedOrigins?: string[];
+  /** Also patch main.ts to re-register the body parsers with maxBodyBytes. Default: true. */
+  patchMain?: boolean;
+  /** Path to config.yaml (default: auto-detected, typically config/config.yaml). */
+  config?: string;
+}