mir-backend-node-nestjslisted

Make It Right (NestJS module). NestJS 11 + TypeScript specific reliability augmentation. Use alongside mir-backend and mir-backend-node when the target stack is NestJS — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: singleton DI scope bleeding request state across users, the full execution-order pipeline (middleware → guards → interceptors → pipes → handler → interceptors → exception filters) and why middleware is not a security boundary on the Fastify adapter, ValidationPipe with whitelist and forbidNonWhitelisted to stop mass assignment, ClassSerializerInterceptor as the outbound allow-list, the Express 5 route-syntax break that NestJS 11 inherits, the TypeScript 7 compiler-API break that stops nest build, and offloading durable work to BullMQ rather than running it in a request. TRIGGER only when the Node backend stack is NestJS — building, reviewing, or debugging a NestJS controller, provider, module, guard, pipe, interceptor, or exception filter, on either the Ex
anantbhandarkar/make-it-right · ★ 15 · API & Backend · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-node-nestjs · Make It Right (NestJS) Bottom tier of the chain: `mir-backend` (generic gates) → `mir-backend-node` (V8/Node event-loop model) → **this** (NestJS library mechanics). Run the gates first; load the Node runtime tier for event-loop and process-model concerns; reach for *this* at Gate 5 (design mechanics), Gate 6 (implementation), and Gate 7 review. **Runtime-level concerns (blocking the event loop, worker_threads, unhandled rejections, stream backpressure, timeouts, heap limits, npm supply chain) live in `mir-backend-node` — not here.** **Stack assumed (npm registry, 13 Aug 2026):** `@nestjs/core@11.1.29` is `latest`. NestJS 12 exists only as `12.0.0-alpha.5` on the `next` tag — a pre-release; do not target it. `engines.node` says `>= 20`, but Node 20 is EOL — run on Node 22 or 24 per the runtime tier. **Run 11.1.24 or newer across every `@nestjs/*` package.** Older 11.1.x patches carry the middleware-bypass CVEs listed in Security. The packages release in lockstep, so mismatched `@nestjs/*` versions in a lockfile are themselves the finding. **Adapter pins, which matter when you audit transitive versions:** `@nestjs/platform-express@11.1.29` pins `express@5.2.1`, `path-to-regexp@8.4.2`, `multer@2.2.0`, `cors@2.8.6` — exact, not caret, so you cannot bump them independently without an override. `@nestjs/platform-fastify@11.1.29` pins `fastify@5.11.0`, `@fastify/cors@11.3.0`, `fastify-plugin@6.0.0`. ## The NestJS footguns AI walks into most ### 1.