# AGENTS.md — NestJS

Drop this in your repository root and symlink CLAUDE.md to it:

    ln -s AGENTS.md CLAUDE.md

Then delete every line that is not true of YOUR repository, and add the
corrections you have had to make to an agent twice. Under 100 lines is the
target — every line competes for attention with every other line.

From NestJS at https://learn-nestjs.com/ai/ — free to use, MIT.

---

NestJS 11, TypeScript strict, Prisma, pnpm.

## Commands
- Dev:   `pnpm start:dev`
- Test:  `pnpm test`      (unit only, must stay under 10s)
- E2E:   `pnpm test:e2e`
- Check: `pnpm check`     (lint + tsc --noEmit + unit tests)

## Generating code
Use the CLI: `nest g resource <name>`. Do not hand-write module,
controller and service files.

## Structure
- Controllers are one line per method: parse, delegate, return.
- Business logic and database access live in services.
- DTOs in dto/, one class per operation, validated with class-validator.
- Never inject PrismaService (or a repository) into a controller.

## Security (non-negotiable)
- The auth guard is registered globally via APP_GUARD. Opt out with
  @Public(), never opt in with @UseGuards() per route.
- ValidationPipe runs with { whitelist: true, transform: true }.
- Never spread a DTO into a Prisma update. Pick fields explicitly.
- @Exclude() on every secret field of every entity, with
  ClassSerializerInterceptor registered.
- Ownership checks live in the service, beside the query. Return 404, not
  403, for resources the caller may not see.
- Nested DTOs need @Type(() => Child) or validation silently does nothing.

## Landmines
- Migrations: write them, never run them. A human runs migrations.