@b9g/shovel 0.2.20 → 0.2.21

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to Shovel will be documented in this file.
 
+## [0.2.21] - 2026-07-14
+
+### Security
+
+- **Unhandled errors leaked stack traces to clients** — The debug error page renders `error.stack` into the response body, gated on `import.meta.env.MODE !== "production"`. `MODE` was never set at build time, so on platforms with no populated `import.meta.env` (Cloudflare Workers) the check saw `undefined`, concluded "not production", and served stack traces to the public on every unhandled 4xx/5xx. Node and Bun leaked the same way unless `NODE_ENV=production` happened to be set.
+
+  The build now bakes `MODE` into the bundle, and the error-verbosity gates test `MODE === "development"` so an unset mode **fails closed**. The verbose branch is now a build-time constant and gets eliminated from production bundles entirely. Sites deployed to Cloudflare should upgrade. (fixes [#91](https://github.com/bikeshaving/shovel/issues/91), [#100](https://github.com/bikeshaving/shovel/issues/100); [PR #102](https://github.com/bikeshaving/shovel/pull/102))
+
+  **Note:** `@b9g/router` used standalone (outside shovel's bundler) now returns the minimal production error response by default instead of the HTML debug page. Set `MODE=development` to restore verbose errors.
+
 ## [0.2.20] - 2026-07-13
 
 ### Bug Fixes

package/bin/cli.js

@@ -75,7 +75,7 @@ program.command("develop <entrypoint>").description("Start development server wi
   DEFAULTS.WORKERS
 ).option("--platform <name>", "Runtime platform (node, cloudflare, bun)").action(async (entrypoint, options) => {
   checkPlatformReexec(options);
-  const { developCommand } = await import("../src/_chunks/develop-TEIXL4T6.js");
+  const { developCommand } = await import("../src/_chunks/develop-2S2Q2Z6R.js");
   await developCommand(entrypoint, options, config);
 });
 program.command("create [name]").description("Create a new Shovel project").action(async (name) => {
@@ -91,7 +91,7 @@ program.command("build <entrypoint>").description("Build app for production").op
   "Run ServiceWorker lifecycle after build (install or activate, default: activate)"
 ).action(async (entrypoint, options) => {
   checkPlatformReexec(options);
-  const { buildCommand } = await import("../src/_chunks/build-XKWCZG7O.js");
+  const { buildCommand } = await import("../src/_chunks/build-GE2SPTLH.js");
   await buildCommand(entrypoint, options, config);
   process.exit(0);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@b9g/shovel",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "ServiceWorker-first universal deployment platform. Write ServiceWorker apps once, deploy anywhere (Node/Bun/Cloudflare). Registry-based multi-app orchestration.",
   "license": "MIT",
   "repository": {

package/src/_chunks/{build-XKWCZG7O.js → build-GE2SPTLH.js}

@@ -1,7 +1,7 @@
 import {
   ServerBundler,
   loadPlatformModule
-} from "./chunk-LCLYBDUT.js";
+} from "./chunk-TVQDBRFO.js";
 import {
   findProjectRoot,
   findWorkspaceRoot

package/src/_chunks/{chunk-LCLYBDUT.js → chunk-TVQDBRFO.js}

@@ -999,6 +999,10 @@ var ServerBundler = class {
       define: {
         ...platformESBuildConfig.define ?? {},
         ...userBuildConfig?.define ?? {},
+        // Error verbosity keys off MODE. Platforms without a populated
+        // import.meta.env (Cloudflare) would otherwise leave it undefined,
+        // so bake it in — the check then folds away at build time.
+        "import.meta.env.MODE": JSON.stringify(mode),
         __SHOVEL_OUTDIR__: JSON.stringify(outputDir),
         __SHOVEL_GIT__: JSON.stringify(getGitSHA(this.#projectRoot))
       },

package/src/_chunks/{develop-TEIXL4T6.js → develop-2S2Q2Z6R.js}

@@ -1,7 +1,7 @@
 import {
   ServerBundler,
   loadPlatformModule
-} from "./chunk-LCLYBDUT.js";
+} from "./chunk-TVQDBRFO.js";
 import {
   DEFAULTS
 } from "./chunk-2JH5U6L5.js";