NestJS 12

Apply the Node.js 24, TypeScript 6.0, and JavaScript ES2026 prompts first. These rules cover NestJS 12.

DTOs and validation pipes

• For class-based DTOs, apply a global ValidationPipe({whitelist: true, forbidNonWhitelisted: true}); whitelist alone silently strips properties, while forbidNonWhitelisted rejects them.
• Set forbidUnknownValues: true explicitly and require concrete DTO classes with runtime metadata; NestJS 12's ValidationPipe overrides class-validator with forbidUnknownValues: false unless configured, so bare objects and undecorated values are not rejected on that basis.
• Keep ValidationPipe's transform: false unless returning DTO instances and primitive coercion are required; when enabled, Nest converts path/query strings to annotated primitive types. DTO construction and class-transformer transformations still run internally with transform: false.
• Declare explicit DTO constraints for strings, arrays, nested objects, numbers, enums, and cross-field invariants.
• Keep ownership, roles, tenant, status, price, audit, and server-generated fields out of writable DTOs.
• Validate nested objects with deliberate class and decorator metadata and reject plain unknown subtrees.
• Register StandardSchemaValidationPipe when using route parameter schema options; decorators alone do not validate, and inputs without schemas pass through. Keep its transform: true default when relying on schema coercion or property stripping.
• Enable validateCustomDecorators: true on either validation pipe when custom parameter decorators return untrusted