A custom NestJS guard implementing double-submit cookie CSRF protection. It validates the Origin/Referer header against the application origin and checks X-CSRF-Token for state-changing requests. Cookie-authenticated requests require CSRF token validation; header-token-authenticated requests (e.g., for machine-to-machine) bypass CSRF. The guard skips safe HTTP methods and routes marked @Public(). This is a self-contained security pattern that could be extracted into any NestJS application with minimal modification, demonstrating thorough understanding of CSRF attack vectors and HTTP semantics.

A pure-function parser that extracts structured metadata from SKILL.md files using YAML frontmatter. It handles BOM removal, CRLF normalization, multiple alias casing variants (snake, kebab, camel), and falls back gracefully on parse errors. The resulting SkillManifestDocument object contains name, description, whenToUse, allowedTools, bundledResources, skillPrompt, and more. This utility is fully tested, has zero internal dependencies, and solves the recurrent problem of embedding structured metadata in human-readable markdown files—directly reusable in any project that needs to parse frontmatter with custom fields.

A utility for creating Server-Sent Events (SSE) responses in NestJS with Node.js native streams. It sets correct content-type (text/event-stream), handles backpressure via drain events, writes events in standard SSE format, and returns a Promise that resolves on stream finish or rejects on error. It also supports sending an initial JSON payload before streaming begins. This encapsulates the boilerplate of SSE response setup and error handling, and could be reused in any Node.js HTTP framework with minimal adaptation.

A NestJS OnApplicationBootstrap lifecycle listener that instruments HTTP request duration using OpenTelemetry. It creates histograms with explicit bucket boundaries, binds to the meter provider, and terminates HTTP metrics on application shutdown. The instrumentation is decoupled from specific controllers and uses bounded attribute sets. This pattern demonstrates how to integrate OpenTelemetry metrics in a NestJS app without framework coupling, and the registration/binding logic is a reusable template for any Node.js service requiring custom metrics.

Implements a composite configuration provider that chains multiple sources (environment variables, static defaults, role-based overrides) with configurable priority. Each source is a provider implementing a common interface, and the composite merges them sequentially. This allows runtime configuration from diverse origins without each consumer knowing the source. The pattern is self-contained, testable (as evidenced by unit tests), and can be extracted to provide hierarchical configuration in any TypeScript application.