@bymax-one/nest-core 1.6.2 → 1.6.4

package/CHANGELOG.md

@@ -11,6 +11,132 @@ heading here.
 
 ## [Unreleased]
 
+## [1.6.4] - 2026-10-30
+
+A 5xx envelope no longer carries `details` unless `envelope.exposeInternals` is on, and the
+message of the router's own 404 no longer carries the query string or the credentials of an
+absolute-form target.
+
+**Apply to a derived backend:**
+
+- **`details` is absent from a response with status 500 or above, by default.** The filter used to pass the
+  `details` of any `HttpException` through verbatim, so a library that put a payload fragment
+  there (a cache preview, a query excerpt) published it in the body of a 5xx. The `code` and
+  `message` are unchanged, and so is every 4xx, where `details` is the contract. A backend
+  that read `details` from a 5xx body should log that context where the error is thrown instead.
+  `envelope.exposeInternals` keeps the details, for local debugging only. The filter owns no
+  logger and records nothing about them itself.
+- **The router's 404 `message` names the path, not the URL.** For a request that matches no
+  route, Nest answers `Cannot GET /orders?token=…` with the raw URL. A test or a client that
+  matches that text for a request with a query string now reads `Cannot GET /orders`, and the
+  userinfo of an absolute-form target (`GET http://user:pw@host/orders`) is gone from it too. A
+  `NotFoundException` the application throws is not touched.
+
+### Security
+
+- **The router's 404 `message` no longer carries the query string or credentials.** 1.6.3 took
+  the query out of `path`, "where reset codes and tokens travel", but the `message` of Nest's own
+  404 (`Cannot ${method} ${url}`, built in `@nestjs/core` from the adapter's raw URL) still held
+  it, and held the userinfo of an absolute-form target as well. Both now read
+  `Cannot GET /path`, as `path` does. Only that exact framework message is rewritten, so a
+  message the application wrote, and a domain error's message, stay as written.
+
+- **A server error no longer publishes its `details` by default.** Both the flat `{ code, message, details }`
+  and the nested `{ error: { code, message, details } }` shapes are cut for a status of 500 or
+  above, as is a validation-shaped 5xx, because every mapping rule shares one builder.
+
+- **Development dependencies lifted past four advisories.** `body-parser` 2.4.0
+  (GHSA-27r3-jxmh-p828), `multer` 2.5.0 (GHSA-q7qp-rjg7-q26m) and `qs` 6.16.1
+  (GHSA-6pq8-jhm2-2vcw) are now the only resolved copies, through `pnpm`
+  overrides. `deepmerge` (GHSA-gcqx-w48m-w2h4) has no patched release and is
+  reached only through `jest-config`, so it is ignored in `osv-scanner.toml`
+  until 2027-01-27. All of them sit in the development tree: the package
+  declares no `dependencies`, so none of them reaches a consumer.
+
+### Changed
+
+- Development tooling: `tsup` 9.0.0, `@opentelemetry/context-async-hooks`
+  3.0.0, `@nestjs/common`, `core`, `platform-express`, `platform-fastify` and
+  `testing` 11.2.8, `@opentelemetry/api` 1.10.0 and the CodeQL upload action
+  4.39.1. None of them changes the published JavaScript. With `tsup` 9 the
+  declaration files list type-only exports in a separate `export type { … }`
+  statement instead of inline `type` modifiers; the exported names are the
+  same. `SECURITY.md` and `CONTRIBUTING.md` now match the current release line
+  and the pinned `pnpm`.
+
+### Documentation
+
+- **Support policy.** `SECURITY.md` states that only the latest minor (`1.6.x`)
+  receives security fixes, and that earlier versions are not supported and
+  get no backports: the guidance is to upgrade.
+- **Issue template contact links.** The "Questions and discussion" link is
+  removed from the issue chooser, since the repository has GitHub Discussions
+  turned off. The private security contact stays.
+- **Subpath lists.** `SECURITY.md` and both issue templates name the
+  subpaths, including `./metrics` and `./openapi`, and `SECURITY.md` calls the
+  request-timing component a middleware.
+- **Unknown errors and the logger.** The README no longer says the message and
+  stack of an unknown error are "captured for your logger". They go to the
+  `BYMAX_UNEXPECTED_ERROR_SINK` seam when one is bound, and reach the response
+  only under `envelope.exposeInternals`. It also no longer says the body of that
+  500 carries only the code and the correlation id: it carries the fixed
+  envelope fields and the generic message. The `package.json` description calls
+  the request-timing component a middleware, as the module registers it.
+
+## [1.6.3] - 2026-10-23
+
+The error envelope's `path` carried the query string, and the documented
+recipe for pairing with `@bymax-one/nest-logger` bound nothing.
+
+**Apply to a derived backend:**
+
+- **`path` changes in the response body.** An application that reads `path`
+  from the envelope now gets the request path alone. `/invoices/42?token=x`
+  and `http://host/invoices/42` both now read `/invoices/42`. The query string was never part of the documented
+  contract, and is where reset codes and tokens travel.
+- **The nest-logger correlation recipe changes.** An application that
+  followed the previous README recipe bound
+  `BYMAX_CORRELATION_PROVIDER` to `LogContextService` with `useExisting`, and
+  got no correlation id at all. Replace it with the `useFactory` in the
+  README's "Integration with `@bymax-one/nest-logger`", and make sure
+  nest-logger's request-id middleware is mounted (`applyAccessLog(app)` or
+  `applyRequestIdMiddleware(consumer)`). Without it there is no id to read.
+
+### Fixed
+
+- **The envelope `path` no longer carries the query string.** Both adapters
+  report the original URL, query included: Express returns `originalUrl`, and
+  Fastify the raw URL. The filter copied that into `path`, which is documented
+  as the request URL path. So a query-string secret reached the client and any
+  log that stores the envelope. An absolute-form target, as a proxy sends it,
+  also carried its scheme, authority and any credentials; only the path is
+  kept now. The `onUnexpectedError` context now receives the same path. The unexpected-error sink already reported the route
+  template and is unaffected.
+- **The nest-logger integration recipe binds what it promises.** It imported
+  `NestLoggerModule`, which does not exist; the module is `BymaxLoggerModule`.
+  It also aliased `LogContextService` with `useExisting`, but that service
+  has no `getCorrelationId()`. The binding was inert, and silently so: the
+  filter treats a failing correlation read as "no id". The README and the
+  specification now adapt the `requestId` key with a factory; the README
+  binds `PinoUnexpectedErrorSink` (nest-logger 1.4.1) beside it. The snippet
+  passed the published-surface gate before only because that gate ignores
+  diagnostics from a peer the fixture does not install.
+- **A thrown value that cannot be described no longer breaks the response.**
+  With `envelope.exposeInternals` on, a value with no prototype, or an `Error`
+  whose `stack` getter throws, threw out of the filter. The internals dump now
+  degrades to a fixed message, and the hooks still run.
+- **The discard warning no longer claims a mismatch for identical entries.**
+  It now says a generated client will not match the library's own types only
+  where the two definitions differ.
+
+### Changed
+
+- **Served component order (since 1.6.1).** Since 1.6.1, a document's own
+  `components.schemas` and `components.parameters` entries are listed before
+  this package's catalogue and before contributed entries. The 1.6.1 entry did
+  not say so. Order in a components map carries no meaning in OpenAPI, but it
+  shows in Swagger UI's model list and in a stored `openapi.json` snapshot.
+
 ## [1.6.2] - 2026-10-22
 
 An unexpected error became `500 BYMAX_INTERNAL_ERROR` and the application had no
@@ -1138,4 +1264,6 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.6.0]: https://github.com/bymaxone/nest-core/compare/v1.5.3...v1.6.0
 [1.6.1]: https://github.com/bymaxone/nest-core/compare/v1.6.0...v1.6.1
 [1.6.2]: https://github.com/bymaxone/nest-core/compare/v1.6.1...v1.6.2
-[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.2...HEAD
+[1.6.3]: https://github.com/bymaxone/nest-core/compare/v1.6.2...v1.6.3
+[1.6.4]: https://github.com/bymaxone/nest-core/compare/v1.6.3...v1.6.4
+[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.4...HEAD

package/README.md

@@ -69,7 +69,9 @@ never loads its peer, which the release gate asserts against the packed tarball.
 - ✅ **Versioned code catalog** — `BYMAX_NOT_FOUND`, `BYMAX_CONFLICT`, `BYMAX_BAD_GATEWAY`
   and the rest, exported as constants so a client maps a `code` rather than a message string
 - ✅ **Internals stay internal** — an unknown error becomes a generic 500; its message and
-  stack are captured for your logger, and reach the body only under `exposeInternals`
+  stack go to the `BYMAX_UNEXPECTED_ERROR_SINK` seam when you bind one, and reach the body
+  only under `exposeInternals`. A 5xx
+  never carries `details` either, whichever library threw it, unless `exposeInternals` is on
 - ✅ **Correlation id** — resolved through `BYMAX_CORRELATION_PROVIDER`, so the id comes from
   wherever your request context already keeps it
 
@@ -218,10 +220,10 @@ and the classification table: [Production is a closed door](#production-is-a-clo
 
 ### `envelope`
 
-| Option            | Type      | Default | Description                                                                                    |
-| ----------------- | --------- | ------- | ---------------------------------------------------------------------------------------------- |
-| `enabled`         | `boolean` | `true`  | Registers the global exception filter.                                                         |
-| `exposeInternals` | `boolean` | `false` | Includes the original message and stack of unknown errors. Development only, never production. |
+| Option            | Type      | Default | Description                                                                                                                |
+| ----------------- | --------- | ------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `enabled`         | `boolean` | `true`  | Registers the global exception filter.                                                                                     |
+| `exposeInternals` | `boolean` | `false` | Includes the original message and stack of unknown errors, and the `details` of a 5xx. Development only, never production. |
 
 ### `timing`
 
@@ -557,15 +559,29 @@ follows this exact, versioned shape:
 }
 ```
 
-| Field           | Type              | Presence | Notes                                              |
-| --------------- | ----------------- | -------- | -------------------------------------------------- |
-| `statusCode`    | number            | always   | HTTP status.                                       |
-| `code`          | string            | always   | Stable, machine-readable code.                     |
-| `message`       | string            | always   | Human-readable, safe for end users.                |
-| `details`       | array or object   | optional | Structured context, for example validation issues. |
-| `correlationId` | string            | optional | Present when a correlation provider is bound.      |
-| `timestamp`     | string (ISO 8601) | always   | Time the error was formatted.                      |
-| `path`          | string            | always   | Request URL path.                                  |
+| Field           | Type              | Presence | Notes                                                                                              |
+| --------------- | ----------------- | -------- | -------------------------------------------------------------------------------------------------- |
+| `statusCode`    | number            | always   | HTTP status.                                                                                       |
+| `code`          | string            | always   | Stable, machine-readable code.                                                                     |
+| `message`       | string            | always   | Human-readable, safe for end users.                                                                |
+| `details`       | array or object   | optional | Structured context, for example validation issues. Absent on a 5xx unless `exposeInternals` is on. |
+| `correlationId` | string            | optional | Present when a correlation provider is bound.                                                      |
+| `timestamp`     | string (ISO 8601) | always   | Time the error was formatted.                                                                      |
+| `path`          | string            | always   | Request URL path, never the query string. The router's own 404 `message` names the same path.      |
+
+**A server error carries no `details` by default.** For a status of 500 or above, the filter omits `details`
+from the body, whichever library threw the `HttpException` and whether it wrote them flat or
+under `error`; the `code` and `message` stay, because they are text the thrower chose for the
+caller. `envelope.exposeInternals` keeps the details, for local debugging only. The filter owns no
+logger and does not record a 5xx's `details` itself, so whatever throws such an error should log
+that context on the server and must not interpolate internal data into its `message`. Client
+errors are unchanged: their details are the contract. The reasoning follows the OWASP
+[Error Handling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html)
+(a generic client response, details logged server side), RFC 9457
+[sections 3.1.4 and 5](https://www.rfc-editor.org/rfc/rfc9457.html) (a problem detail helps the client
+correct the problem rather than debug, and no implementation details leave through the HTTP
+interface), and the NestJS [exception filters](https://docs.nestjs.com/exception-filters) behaviour
+of serializing an `HttpException` response object as the whole body.
 
 Codes are stable strings under a reserved `BYMAX_` prefix, derived from the
 HTTP status: `BYMAX_NOT_FOUND` for 404, `BYMAX_VALIDATION_FAILED` for the
@@ -1546,27 +1562,67 @@ your samples and your logs.
 
 ## 🔗 Integration with `@bymax-one/nest-logger`
 
-Pairing this package with `@bymax-one/nest-logger` yields correlated logs and
-error responses with one binding and no hard coupling: `LogContextService`
-satisfies `ICorrelationIdProvider` out of the box, so `useExisting` aliases it
-onto the shared token. Bind it from a `@Global()` module of your own so the
-binding is visible outside the module that declares it:
+Pairing this package with `@bymax-one/nest-logger` gives correlated logs and
+error responses without either package importing the other. nest-logger's
+request-id middleware stores the id under the `requestId` key of
+`LogContextService`. That service is not itself an `ICorrelationIdProvider` —
+it has no `getCorrelationId()` — so adapt it with a factory. `useExisting` on
+it binds an object without that method, and the filter then reads no id and
+reports nothing. Bind both tokens from a `@Global()` module of your own so they
+are visible outside the module that declares them:
 
 ```typescript
 import { Global, Module } from '@nestjs/common'
-import { BYMAX_CORRELATION_PROVIDER } from '@bymax-one/nest-core'
-import { LogContextService, NestLoggerModule } from '@bymax-one/nest-logger'
+import { BYMAX_CORRELATION_PROVIDER, BYMAX_UNEXPECTED_ERROR_SINK } from '@bymax-one/nest-core'
+import type { ICorrelationIdProvider } from '@bymax-one/nest-core'
+import {
+  BymaxLoggerModule,
+  LogContextService,
+  PinoUnexpectedErrorSink
+} from '@bymax-one/nest-logger'
 
 @Global()
 @Module({
-  imports: [NestLoggerModule.forRoot()],
-  providers: [{ provide: BYMAX_CORRELATION_PROVIDER, useExisting: LogContextService }],
-  exports: [BYMAX_CORRELATION_PROVIDER]
+  imports: [BymaxLoggerModule.forRoot({ service: { name: 'api', version: '1.0.0' } })],
+  providers: [
+    {
+      provide: BYMAX_CORRELATION_PROVIDER,
+      inject: [LogContextService],
+      useFactory: (context: LogContextService): ICorrelationIdProvider => ({
+        getCorrelationId: () => context.get<string>('requestId')
+      })
+    },
+    { provide: BYMAX_UNEXPECTED_ERROR_SINK, useClass: PinoUnexpectedErrorSink }
+  ],
+  exports: [BYMAX_CORRELATION_PROVIDER, BYMAX_UNEXPECTED_ERROR_SINK]
 })
 export class ObservabilityModule {}
 ```
 
-Every error envelope now carries the same correlation id your logs do. The
+The id exists only once nest-logger's request-id middleware runs, and
+`BymaxLoggerModule` mounts none on its own. Mount it in `main.ts`, or call
+`applyRequestIdMiddleware(consumer)` from a module's `configure()`:
+
+> **Express only.** nest-logger's request-id middleware supports
+> `@nestjs/platform-express`; the Fastify adapter is unsupported, so do not
+> rely on this correlation provider there.
+
+```typescript
+import { NestFactory } from '@nestjs/core'
+import { applyAccessLog } from '@bymax-one/nest-logger'
+import { AppModule } from './app.module'
+
+async function bootstrap(): Promise<void> {
+  const app = await NestFactory.create(AppModule)
+  applyAccessLog(app) // opens the request context that carries `requestId`
+  await app.listen(3000)
+}
+void bootstrap()
+```
+
+Every error envelope now carries the same correlation id your logs do, and the
+cause of every collapsed `500` is logged with it (`PinoUnexpectedErrorSink`
+needs `@bymax-one/nest-logger` 1.4.1 or later). The
 same `@Global()`-module pattern is how every pluggable token in this package
 is overridden: `BYMAX_TIMING_SINK` and `BYMAX_HEALTH_INDICATORS` follow it
 identically.
@@ -1644,8 +1700,9 @@ disclose.
 ### An error envelope is an exfiltration surface
 
 The filter's job is to make every failure look the same to a client, so an unknown error
-becomes a generic 500 whose body carries the code, the correlation id and nothing else. The
-original message and stack are captured for your logger, not for the response.
+becomes a generic 500 whose body carries the fixed envelope fields and the generic message,
+and not the cause unless `exposeInternals` is on. The original message and stack go to the
+`BYMAX_UNEXPECTED_ERROR_SINK` seam when you bind one.
 `envelope.exposeInternals` puts them in the body and exists for local debugging — its own
 documentation says never to enable it in production, and it defaults to `false`.
 
@@ -1721,7 +1778,7 @@ the deployment nobody configured is the one most likely to be exposed.
 | Layer               | Implementation                                                                                                                                                                   |
 | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Error responses     | One shape for everything; unknown errors become a generic 500                                                                                                                    |
-| Internals           | Message and stack captured for logging, in the body only under `exposeInternals` (default `false`)                                                                               |
+| Internals           | Message and stack handed to the unexpected-error sink when bound, in the body only under `exposeInternals` (default `false`)                                                     |
 | Health output       | The response names which indicator is down and nothing more; the reason goes to the logger. `exposeIndicatorErrors` (default `false`) puts it back in the response for debugging |
 | Slow indicators     | Converted to `down` by the aggregator, so a probe cannot hang on one                                                                                                             |
 | Correlation         | Resolved through `BYMAX_CORRELATION_PROVIDER` — the app decides where the id comes from                                                                                          |
@@ -1737,8 +1794,9 @@ the deployment nobody configured is the one most likely to be exposed.
 
 > [!IMPORTANT]
 > **`exposeInternals` is a debugging switch, not a verbosity setting.** With it on,
-> the body of a 500 carries the original message and stack of whatever failed —
-> including anything a driver, an SDK or a template put in them.
+> the body of a 500 carries the original message and stack of whatever failed, and the
+> `details` of any 5xx `HttpException` — including anything a driver, an SDK or a
+> template put in them.
 
 ---
 

package/dist/health/index.d.cts

@@ -94,4 +94,5 @@ interface HealthResponse {
     checks: HealthCheckEntry[];
 }
 
-export { BYMAX_HEALTH_INDICATOR_METADATA, BymaxHealthIndicator, type HealthCheckEntry, type HealthIndicatorResult, type HealthResponse, type IHealthIndicator };
+export { BYMAX_HEALTH_INDICATOR_METADATA, BymaxHealthIndicator };
+export type { HealthCheckEntry, HealthIndicatorResult, HealthResponse, IHealthIndicator };

package/dist/health/index.d.ts

@@ -94,4 +94,5 @@ interface HealthResponse {
     checks: HealthCheckEntry[];
 }
 
-export { BYMAX_HEALTH_INDICATOR_METADATA, BymaxHealthIndicator, type HealthCheckEntry, type HealthIndicatorResult, type HealthResponse, type IHealthIndicator };
+export { BYMAX_HEALTH_INDICATOR_METADATA, BymaxHealthIndicator };
+export type { HealthCheckEntry, HealthIndicatorResult, HealthResponse, IHealthIndicator };

package/dist/index.cjs

@@ -359,6 +359,19 @@ function extractRequestInfo(context) {
 var INTERNAL_ERROR_STATUS = 500;
 var INTERNAL_ERROR_MESSAGE = "Internal server error";
 var VALIDATION_FAILED_MESSAGE = "Validation failed";
+var ABSOLUTE_FORM_PREFIX = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
+function pathOf(url) {
+  let target = String(url);
+  const prefix = ABSOLUTE_FORM_PREFIX.exec(target);
+  if (prefix !== null) {
+    const afterScheme = target.slice(prefix[0].length);
+    const authorityEnd = afterScheme.search(/[/?#]/);
+    target = authorityEnd === -1 ? "" : afterScheme.slice(authorityEnd);
+  }
+  const pathEnd = target.search(/[?#]/);
+  const path = pathEnd === -1 ? target : target.slice(0, pathEnd);
+  return path === "" ? "/" : path;
+}
 function resolveErrorCarrier(response) {
   if (typeof response !== "object" || response === null) {
     return void 0;
@@ -420,11 +433,16 @@ function extractHttpMessage(response, exception, carrier) {
   }
   return exception.message;
 }
+var UNREPRESENTABLE_MESSAGE = "Unrepresentable thrown value";
 function buildInternalDetails(exception) {
-  if (exception instanceof Error) {
-    return exception.stack !== void 0 ? { message: exception.message, stack: exception.stack } : { message: exception.message };
+  try {
+    if (exception instanceof Error) {
+      return exception.stack !== void 0 ? { message: exception.message, stack: exception.stack } : { message: exception.message };
+    }
+    return { message: String(exception) };
+  } catch {
+    return { message: UNREPRESENTABLE_MESSAGE };
   }
-  return { message: String(exception) };
 }
 exports.BymaxExceptionFilter = class BymaxExceptionFilter {
   /**
@@ -496,7 +514,7 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
     const traceId = this.readAnnotation(() => this.traceContext.getTraceContext()?.traceId);
     const context = {
       method: String(httpAdapter.getRequestMethod(request)),
-      path: String(httpAdapter.getRequestUrl(request)),
+      path: pathOf(httpAdapter.getRequestUrl(request)),
       ...correlationId !== void 0 ? { correlationId } : {},
       ...traceId !== void 0 ? { traceId } : {}
     };
@@ -515,7 +533,7 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
    */
   buildEnvelope(exception, context, request) {
     if (exception instanceof common.HttpException) {
-      return this.mapHttpException(exception, context);
+      return this.mapHttpException(exception, context, request);
     }
     const exposed = resolveExposedClientError(exception);
     if (exposed !== void 0) {
@@ -562,15 +580,16 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
   }
   /**
    * Map an `HttpException` to the envelope. A domain error passes its own code,
-   * message and details through, whether it wrote them flat on the response or
-   * nested under `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED`
-   * with structured details; everything else derives its code from the status.
+   * message and details through (a 5xx's details are withheld by default in
+   * `toEnvelope`), whether it wrote them flat on the response or nested under
+   * `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED` with
+   * structured details; everything else derives its code from the status.
    *
    * @param exception - The HTTP exception to format.
    * @param context - The neutral request context.
    * @returns The formatted envelope.
    */
-  mapHttpException(exception, context) {
+  mapHttpException(exception, context, request) {
     const status = exception.getStatus();
     const response = exception.getResponse();
     const carrier = resolveErrorCarrier(response);
@@ -592,10 +611,12 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
         toValidationDetails(response.message)
       );
     }
+    const message = extractHttpMessage(response, exception);
+    const rawUrl = String(this.adapterHost.httpAdapter.getRequestUrl(request));
     return this.toEnvelope(
       status,
       codeForStatus(status),
-      extractHttpMessage(response, exception),
+      message === `Cannot ${context.method} ${rawUrl}` ? `Cannot ${context.method} ${context.path}` : message,
       context
     );
   }
@@ -620,7 +641,8 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
   }
   /**
    * Assemble the envelope through the pure builder, threading the shared clock
-   * and omitting absent optional details.
+   * and omitting absent optional details. A server-error status carries none
+   * unless `exposeInternals` is on, whichever mapping rule produced them.
    *
    * @param statusCode - HTTP status for the envelope.
    * @param code - Stable machine-readable code.
@@ -630,13 +652,14 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
    * @returns The formatted envelope.
    */
   toEnvelope(statusCode, code, message, context, details) {
+    const withheld = statusCode >= CLIENT_ERROR_MAX2 && !this.options.envelope.exposeInternals;
     return buildErrorEnvelope({
       statusCode,
       code,
       message,
       path: context.path,
       now: this.now,
-      ...details !== void 0 ? { details } : {},
+      ...details !== void 0 && !withheld ? { details } : {},
       // Stryker disable next-line ConditionalExpression: equivalent — the always-spread form hands the builder `correlationId: undefined`, and `buildErrorEnvelope` re-guards `input.correlationId !== undefined` and omits an undefined value, so the emitted envelope is byte-for-byte identical whether or not a correlation id is present.
       ...context.correlationId !== void 0 ? { correlationId: context.correlationId } : {},
       // Gated separately from the context above: the trace id reaches the

package/dist/index.d.cts

@@ -10,7 +10,8 @@ interface EnvelopeOptions {
     enabled?: boolean;
     /**
      * Include the original message and stack of unknown errors in the envelope
-     * details. Never enable in production. Default: `false`.
+     * details, and keep the `details` of a 5xx `HttpException`, which are
+     * otherwise withheld from the body. Never enable in production. Default: `false`.
      */
     exposeInternals?: boolean;
 }
@@ -839,9 +840,10 @@ declare class BymaxExceptionFilter implements ExceptionFilter {
     private reportUnexpected;
     /**
      * Map an `HttpException` to the envelope. A domain error passes its own code,
-     * message and details through, whether it wrote them flat on the response or
-     * nested under `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED`
-     * with structured details; everything else derives its code from the status.
+     * message and details through (a 5xx's details are withheld by default in
+     * `toEnvelope`), whether it wrote them flat on the response or nested under
+     * `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED` with
+     * structured details; everything else derives its code from the status.
      *
      * @param exception - The HTTP exception to format.
      * @param context - The neutral request context.
@@ -860,7 +862,8 @@ declare class BymaxExceptionFilter implements ExceptionFilter {
     private mapUnknown;
     /**
      * Assemble the envelope through the pure builder, threading the shared clock
-     * and omitting absent optional details.
+     * and omitting absent optional details. A server-error status carries none
+     * unless `exposeInternals` is on, whichever mapping rule produced them.
      *
      * @param statusCode - HTTP status for the envelope.
      * @param code - Stable machine-readable code.
@@ -1293,4 +1296,5 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, type BuildErrorEnvelopeInput, BymaxCoreModule, type BymaxCoreModuleOptions, BymaxExceptionFilter, BymaxTimingMiddleware, type EnvelopeOptions, type ErrorDetails, type ErrorEnvelope, type FilterErrorContext, type HealthOptions, type ICorrelationIdProvider, type ITimingSink, type ITraceContextProvider, type IUnexpectedErrorSink, type MetricsOptions, type OpenApiHttpMethod, type OpenApiOperationIdFactory, type OpenApiOperationKey, type OpenApiOptions, type OpenApiSecurityRequirement, type OpenApiSecurityScheme, type OpenApiServerDescriptor, type OperationSecurityMap, type RequestTimingSample, type ResolvedCoreOptions, type TelemetryOptions, TimingInterceptor, type TimingOptions, type TraceContext, UNMATCHED_ROUTE, type UnexpectedErrorReport, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export type { BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };

package/dist/index.d.ts

@@ -10,7 +10,8 @@ interface EnvelopeOptions {
     enabled?: boolean;
     /**
      * Include the original message and stack of unknown errors in the envelope
-     * details. Never enable in production. Default: `false`.
+     * details, and keep the `details` of a 5xx `HttpException`, which are
+     * otherwise withheld from the body. Never enable in production. Default: `false`.
      */
     exposeInternals?: boolean;
 }
@@ -839,9 +840,10 @@ declare class BymaxExceptionFilter implements ExceptionFilter {
     private reportUnexpected;
     /**
      * Map an `HttpException` to the envelope. A domain error passes its own code,
-     * message and details through, whether it wrote them flat on the response or
-     * nested under `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED`
-     * with structured details; everything else derives its code from the status.
+     * message and details through (a 5xx's details are withheld by default in
+     * `toEnvelope`), whether it wrote them flat on the response or nested under
+     * `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED` with
+     * structured details; everything else derives its code from the status.
      *
      * @param exception - The HTTP exception to format.
      * @param context - The neutral request context.
@@ -860,7 +862,8 @@ declare class BymaxExceptionFilter implements ExceptionFilter {
     private mapUnknown;
     /**
      * Assemble the envelope through the pure builder, threading the shared clock
-     * and omitting absent optional details.
+     * and omitting absent optional details. A server-error status carries none
+     * unless `exposeInternals` is on, whichever mapping rule produced them.
      *
      * @param statusCode - HTTP status for the envelope.
      * @param code - Stable machine-readable code.
@@ -1293,4 +1296,5 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, type BuildErrorEnvelopeInput, BymaxCoreModule, type BymaxCoreModuleOptions, BymaxExceptionFilter, BymaxTimingMiddleware, type EnvelopeOptions, type ErrorDetails, type ErrorEnvelope, type FilterErrorContext, type HealthOptions, type ICorrelationIdProvider, type ITimingSink, type ITraceContextProvider, type IUnexpectedErrorSink, type MetricsOptions, type OpenApiHttpMethod, type OpenApiOperationIdFactory, type OpenApiOperationKey, type OpenApiOptions, type OpenApiSecurityRequirement, type OpenApiSecurityScheme, type OpenApiServerDescriptor, type OperationSecurityMap, type RequestTimingSample, type ResolvedCoreOptions, type TelemetryOptions, TimingInterceptor, type TimingOptions, type TraceContext, UNMATCHED_ROUTE, type UnexpectedErrorReport, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export type { BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };

package/dist/index.mjs

@@ -357,6 +357,19 @@ function extractRequestInfo(context) {
 var INTERNAL_ERROR_STATUS = 500;
 var INTERNAL_ERROR_MESSAGE = "Internal server error";
 var VALIDATION_FAILED_MESSAGE = "Validation failed";
+var ABSOLUTE_FORM_PREFIX = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
+function pathOf(url) {
+  let target = String(url);
+  const prefix = ABSOLUTE_FORM_PREFIX.exec(target);
+  if (prefix !== null) {
+    const afterScheme = target.slice(prefix[0].length);
+    const authorityEnd = afterScheme.search(/[/?#]/);
+    target = authorityEnd === -1 ? "" : afterScheme.slice(authorityEnd);
+  }
+  const pathEnd = target.search(/[?#]/);
+  const path = pathEnd === -1 ? target : target.slice(0, pathEnd);
+  return path === "" ? "/" : path;
+}
 function resolveErrorCarrier(response) {
   if (typeof response !== "object" || response === null) {
     return void 0;
@@ -418,11 +431,16 @@ function extractHttpMessage(response, exception, carrier) {
   }
   return exception.message;
 }
+var UNREPRESENTABLE_MESSAGE = "Unrepresentable thrown value";
 function buildInternalDetails(exception) {
-  if (exception instanceof Error) {
-    return exception.stack !== void 0 ? { message: exception.message, stack: exception.stack } : { message: exception.message };
+  try {
+    if (exception instanceof Error) {
+      return exception.stack !== void 0 ? { message: exception.message, stack: exception.stack } : { message: exception.message };
+    }
+    return { message: String(exception) };
+  } catch {
+    return { message: UNREPRESENTABLE_MESSAGE };
   }
-  return { message: String(exception) };
 }
 var BymaxExceptionFilter = class {
   /**
@@ -494,7 +512,7 @@ var BymaxExceptionFilter = class {
     const traceId = this.readAnnotation(() => this.traceContext.getTraceContext()?.traceId);
     const context = {
       method: String(httpAdapter.getRequestMethod(request)),
-      path: String(httpAdapter.getRequestUrl(request)),
+      path: pathOf(httpAdapter.getRequestUrl(request)),
       ...correlationId !== void 0 ? { correlationId } : {},
       ...traceId !== void 0 ? { traceId } : {}
     };
@@ -513,7 +531,7 @@ var BymaxExceptionFilter = class {
    */
   buildEnvelope(exception, context, request) {
     if (exception instanceof HttpException) {
-      return this.mapHttpException(exception, context);
+      return this.mapHttpException(exception, context, request);
     }
     const exposed = resolveExposedClientError(exception);
     if (exposed !== void 0) {
@@ -560,15 +578,16 @@ var BymaxExceptionFilter = class {
   }
   /**
    * Map an `HttpException` to the envelope. A domain error passes its own code,
-   * message and details through, whether it wrote them flat on the response or
-   * nested under `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED`
-   * with structured details; everything else derives its code from the status.
+   * message and details through (a 5xx's details are withheld by default in
+   * `toEnvelope`), whether it wrote them flat on the response or nested under
+   * `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED` with
+   * structured details; everything else derives its code from the status.
    *
    * @param exception - The HTTP exception to format.
    * @param context - The neutral request context.
    * @returns The formatted envelope.
    */
-  mapHttpException(exception, context) {
+  mapHttpException(exception, context, request) {
     const status = exception.getStatus();
     const response = exception.getResponse();
     const carrier = resolveErrorCarrier(response);
@@ -590,10 +609,12 @@ var BymaxExceptionFilter = class {
         toValidationDetails(response.message)
       );
     }
+    const message = extractHttpMessage(response, exception);
+    const rawUrl = String(this.adapterHost.httpAdapter.getRequestUrl(request));
     return this.toEnvelope(
       status,
       codeForStatus(status),
-      extractHttpMessage(response, exception),
+      message === `Cannot ${context.method} ${rawUrl}` ? `Cannot ${context.method} ${context.path}` : message,
       context
     );
   }
@@ -618,7 +639,8 @@ var BymaxExceptionFilter = class {
   }
   /**
    * Assemble the envelope through the pure builder, threading the shared clock
-   * and omitting absent optional details.
+   * and omitting absent optional details. A server-error status carries none
+   * unless `exposeInternals` is on, whichever mapping rule produced them.
    *
    * @param statusCode - HTTP status for the envelope.
    * @param code - Stable machine-readable code.
@@ -628,13 +650,14 @@ var BymaxExceptionFilter = class {
    * @returns The formatted envelope.
    */
   toEnvelope(statusCode, code, message, context, details) {
+    const withheld = statusCode >= CLIENT_ERROR_MAX2 && !this.options.envelope.exposeInternals;
     return buildErrorEnvelope({
       statusCode,
       code,
       message,
       path: context.path,
       now: this.now,
-      ...details !== void 0 ? { details } : {},
+      ...details !== void 0 && !withheld ? { details } : {},
       // Stryker disable next-line ConditionalExpression: equivalent — the always-spread form hands the builder `correlationId: undefined`, and `buildErrorEnvelope` re-guards `input.correlationId !== undefined` and omits an undefined value, so the emitted envelope is byte-for-byte identical whether or not a correlation id is present.
       ...context.correlationId !== void 0 ? { correlationId: context.correlationId } : {},
       // Gated separately from the context above: the trace id reaches the

package/dist/metrics/index.d.cts

@@ -54,4 +54,5 @@ declare const BYMAX_METRICS_CONTRIBUTOR_METADATA = "bymax-one:metrics-contributo
  */
 declare function BymaxMetricsContributor(): CustomDecorator<string>;
 
-export { BYMAX_METRICS_CONTRIBUTOR_METADATA, BymaxMetricsContributor, type IMetricsContributor, type MetricsRegistry };
+export { BYMAX_METRICS_CONTRIBUTOR_METADATA, BymaxMetricsContributor };
+export type { IMetricsContributor, MetricsRegistry };

package/dist/metrics/index.d.ts

@@ -54,4 +54,5 @@ declare const BYMAX_METRICS_CONTRIBUTOR_METADATA = "bymax-one:metrics-contributo
  */
 declare function BymaxMetricsContributor(): CustomDecorator<string>;
 
-export { BYMAX_METRICS_CONTRIBUTOR_METADATA, BymaxMetricsContributor, type IMetricsContributor, type MetricsRegistry };
+export { BYMAX_METRICS_CONTRIBUTOR_METADATA, BymaxMetricsContributor };
+export type { IMetricsContributor, MetricsRegistry };

package/dist/openapi/index.cjs

@@ -737,7 +737,7 @@ function warnDiscardedComponents(logger, discarded) {
   const elided = discarded.length - MAX_WARNED_OPERATIONS;
   const listed = discarded.slice(0, MAX_WARNED_OPERATIONS).map(({ contributor, member, name }) => `${contributor} -> ${member}.${name}`).join(", ");
   logger.warn(
-    `the served OpenAPI document already defines ${discarded.length} component entry(ies) a library also contributes: ${listed}${elided > 0 ? `, and ${elided} more` : ""}. The contributed version is not served, so a client generated from this document will not match that library's own types. What holds the name may be the application's own declaration, a core schema under openapi.includeCoreSchemas, or a contributor that sorted earlier \u2014 read the document before deciding what to remove.`
+    `the served OpenAPI document already defines ${discarded.length} component entry(ies) a library also contributes: ${listed}${elided > 0 ? `, and ${elided} more` : ""}. The contributed version is not served, so where the two differ a client generated from this document will not match that library's own types. What holds the name may be the application's own declaration, a core schema under openapi.includeCoreSchemas, or a contributor that sorted earlier \u2014 read the document before deciding what to remove.`
   );
 }
 function buildConfig(builder, options) {

package/dist/openapi/index.d.cts

@@ -240,4 +240,5 @@ interface OpenApiMountOutcome {
  */
 declare function applyBymaxOpenApi(app: INestApplication): Promise<OpenApiMountOutcome>;
 
-export { BYMAX_OPENAPI_CONTRACT_VERSION, BYMAX_OPENAPI_CONTRIBUTOR_METADATA, BymaxOpenApiContributor, type DiscardedComponent, type IOpenApiContributor, type OpenApiFragment, type OpenApiFragmentObject, type OpenApiHandlerKey, type OpenApiMountOutcome, type OpenApiSkipReason, applyBymaxOpenApi };
+export { BYMAX_OPENAPI_CONTRACT_VERSION, BYMAX_OPENAPI_CONTRIBUTOR_METADATA, BymaxOpenApiContributor, applyBymaxOpenApi };
+export type { DiscardedComponent, IOpenApiContributor, OpenApiFragment, OpenApiFragmentObject, OpenApiHandlerKey, OpenApiMountOutcome, OpenApiSkipReason };

package/dist/openapi/index.d.ts

@@ -240,4 +240,5 @@ interface OpenApiMountOutcome {
  */
 declare function applyBymaxOpenApi(app: INestApplication): Promise<OpenApiMountOutcome>;
 
-export { BYMAX_OPENAPI_CONTRACT_VERSION, BYMAX_OPENAPI_CONTRIBUTOR_METADATA, BymaxOpenApiContributor, type DiscardedComponent, type IOpenApiContributor, type OpenApiFragment, type OpenApiFragmentObject, type OpenApiHandlerKey, type OpenApiMountOutcome, type OpenApiSkipReason, applyBymaxOpenApi };
+export { BYMAX_OPENAPI_CONTRACT_VERSION, BYMAX_OPENAPI_CONTRIBUTOR_METADATA, BymaxOpenApiContributor, applyBymaxOpenApi };
+export type { DiscardedComponent, IOpenApiContributor, OpenApiFragment, OpenApiFragmentObject, OpenApiHandlerKey, OpenApiMountOutcome, OpenApiSkipReason };

package/dist/openapi/index.mjs

@@ -735,7 +735,7 @@ function warnDiscardedComponents(logger, discarded) {
   const elided = discarded.length - MAX_WARNED_OPERATIONS;
   const listed = discarded.slice(0, MAX_WARNED_OPERATIONS).map(({ contributor, member, name }) => `${contributor} -> ${member}.${name}`).join(", ");
   logger.warn(
-    `the served OpenAPI document already defines ${discarded.length} component entry(ies) a library also contributes: ${listed}${elided > 0 ? `, and ${elided} more` : ""}. The contributed version is not served, so a client generated from this document will not match that library's own types. What holds the name may be the application's own declaration, a core schema under openapi.includeCoreSchemas, or a contributor that sorted earlier \u2014 read the document before deciding what to remove.`
+    `the served OpenAPI document already defines ${discarded.length} component entry(ies) a library also contributes: ${listed}${elided > 0 ? `, and ${elided} more` : ""}. The contributed version is not served, so where the two differ a client generated from this document will not match that library's own types. What holds the name may be the application's own declaration, a core schema under openapi.includeCoreSchemas, or a contributor that sorted earlier \u2014 read the document before deciding what to remove.`
   );
 }
 function buildConfig(builder, options) {

package/dist/pagination/index.d.cts

@@ -175,4 +175,5 @@ declare function normalizeCursorQuery(raw: {
  */
 declare function buildCursorResult<T>(items: T[], limit: number, toCursor: (lastItem: T) => Record<string, string | number>): CursorResult<T>;
 
-export { type CursorQuery, type CursorResult, type PageMeta, type PageQuery, type PageResult, buildCursorResult, buildPageResult, decodeCursor, encodeCursor, normalizeCursorQuery, normalizePageQuery };
+export { buildCursorResult, buildPageResult, decodeCursor, encodeCursor, normalizeCursorQuery, normalizePageQuery };
+export type { CursorQuery, CursorResult, PageMeta, PageQuery, PageResult };

package/dist/pagination/index.d.ts

@@ -175,4 +175,5 @@ declare function normalizeCursorQuery(raw: {
  */
 declare function buildCursorResult<T>(items: T[], limit: number, toCursor: (lastItem: T) => Record<string, string | number>): CursorResult<T>;
 
-export { type CursorQuery, type CursorResult, type PageMeta, type PageQuery, type PageResult, buildCursorResult, buildPageResult, decodeCursor, encodeCursor, normalizeCursorQuery, normalizePageQuery };
+export { buildCursorResult, buildPageResult, decodeCursor, encodeCursor, normalizeCursorQuery, normalizePageQuery };
+export type { CursorQuery, CursorResult, PageMeta, PageQuery, PageResult };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bymax-one/nest-core",
-  "version": "1.6.2",
-  "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing interceptor, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
+  "version": "1.6.4",
+  "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing middleware, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
   "homepage": "https://github.com/bymaxone/nest-core#readme",
@@ -140,7 +140,7 @@
     "@nestjs/swagger": "^11.4.6",
     "@nestjs/testing": "^11.1.20",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/context-async-hooks": "^2.10.0",
+    "@opentelemetry/context-async-hooks": "^3.0.0",
     "@stryker-mutator/core": "^9",
     "@stryker-mutator/jest-runner": "^9",
     "@stryker-mutator/typescript-checker": "^9",
@@ -168,7 +168,7 @@
     "supertest": "^7.2.2",
     "ts-jest": "^29.4.9",
     "ts-node": "^10.9.2",
-    "tsup": "^8.5.1",
+    "tsup": "^9.0.0",
     "typescript": "^5.9.3"
   },
   "keywords": [