NestJS 11

Apply the Node.js 24, TypeScript 5.9, and JavaScript ES2026 prompts first. These rules cover NestJS 11 pipes, DTOs, guards, interceptors, authentication, authorization, browser defenses, serialization, transports, errors, and deployment.

DTOs and validation pipes

• Apply a global ValidationPipe({whitelist: true, forbidNonWhitelisted: true}); whitelist alone silently strips properties, while forbidNonWhitelisted rejects them.
• Set forbidUnknownValues: true explicitly and require concrete DTO classes with runtime metadata; NestJS 11's ValidationPipe overrides class-validator with forbidUnknownValues: false unless configured, and skips String, Boolean, Number, Array, and Object metatypes regardless.
• Keep transform: false unless returned DTO instances and path/query primitive coercion are required; DTO validation still calls plainToInstance() internally, so keep DTO constructors and transforms free of side effects.
• Set validateCustomDecorators: true when custom parameter decorators supply untrusted DTOs; ValidationPipe otherwise skips their validation.
• Declare explicit DTO constraints for strings, arrays, nested objects, numbers, enums, and cross-field invariants.
• Keep ownership, roles, tenant, status, price, audit, and server-generated fields out of writable DTOs.
• Validate nested objects with deliberate class and decorator metadata and reject plain unknown subtrees.

Guards and authorization

• Apply authentication and authorization guards globally or at every protected controller, route, resolver, gateway, and handler.