- For TypeScript: Decorate controllers with `@Controller('users')` and methods with `@Get(':id')`, `@Post()`, `@Put(':id')`, `@Delete(':id')` — use `@Param()`, `@Body()`, `@Query()` to extract route params, body, and query strings.
- Use `@Injectable()` services and inject them via constructor DI: `constructor(private readonly userService: UserService)` — never `new` a service inside a class.
- Validate incoming requests with `class-validator` DTOs and `ValidationPipe`: `app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true }))`.
- Throw `NotFoundException`, `BadRequestException`, and `ForbiddenException` from `@nestjs/common` — never send raw error responses from controllers.
- Organize features into modules: `@Module({ imports: [], controllers: [UsersController], providers: [UsersService] })` — one module per domain.
- For TypeScript: Decorate HTTP methods: `@Get(':id')`, `@Post()`, `@Put(':id')`, `@Delete(':id')` — use `@Param('id')`, `@Body()`, `@Query('page')` decorators to bind route parameters.
- Define services with `@Injectable()` and inject via constructor: `constructor(private readonly usersService: UsersService) {}` — NestJS's DI container manages lifecycle.
- Validate all incoming request bodies with `class-validator` DTOs: `class CreateUserDto { @IsEmail() email: string; @MinLength(8) password: string }` — enable globally with `app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }))`.
- Guard routes with `@UseGuards(AuthGuard('jwt'))` and access the authenticated user via `@Request() req` — implement custom guards with `CanActivate` and register them globally with `app.useGlobalGuards()`.
- Use `@Module({ imports: [TypeOrmModule.forFeature([User])], controllers: [UsersController], providers: [UsersService], exports: [UsersService] })` to encapsulate features — export providers that other modules need.
- Throw built-in HTTP exceptions: `throw new NotFoundException('User not found')`, `throw new ConflictException('Email already exists')` — NestJS automatically converts them to the correct HTTP response.