nestjs-modular-monolith

Structure each bounded context as an NX library with four Clean Architecture layers: domain, application, infrastructure, and presentation. Each module gets its own NestJS Module class with explicit imports and exports, and cross-module communication happens only through domain events.

Use CQRS only when a module has genuinely distinct read and write patterns, such as read-heavy workloads needing optimized queries. The default approach is simple injectable services; upgrade to command and query handlers only when complexity justifies it.

Use Passport with JWT when you need full control over authentication flows or have existing Passport infrastructure. Use Better Auth when you want built-in social login, session management, and two-factor authentication with less boilerplate via the @thallesp/nestjs-better-auth adapter.

Modules communicate exclusively through domain events defined in a shared contracts library, never through direct service imports. Use an in-memory publisher for development and Kafka, SQS, or Redis publishers for production, swapped via dependency injection.

Avoid it for simple CRUD APIs with fewer than ten endpoints, prototypes where speed matters more than structure, and microservices-first architectures. Standard NestJS defaults are sufficient for small applications without complex domain boundaries.

Prefix every entity with its module name, use plain ID fields instead of Prisma relations across modules, and run the included validate-isolation.sh script. It detects duplicate model names, cross-module imports, shared mutable state, and synchronous cross-module calls.