@bymax-one/nest-core 1.6.3 → 1.6.4

package/CHANGELOG.md

@@ -11,6 +11,78 @@ heading here.
 
 ## [Unreleased]
 
+## [1.6.4] - 2026-10-30
+
+A 5xx envelope no longer carries `details` unless `envelope.exposeInternals` is on, and the
+message of the router's own 404 no longer carries the query string or the credentials of an
+absolute-form target.
+
+**Apply to a derived backend:**
+
+- **`details` is absent from a response with status 500 or above, by default.** The filter used to pass the
+  `details` of any `HttpException` through verbatim, so a library that put a payload fragment
+  there (a cache preview, a query excerpt) published it in the body of a 5xx. The `code` and
+  `message` are unchanged, and so is every 4xx, where `details` is the contract. A backend
+  that read `details` from a 5xx body should log that context where the error is thrown instead.
+  `envelope.exposeInternals` keeps the details, for local debugging only. The filter owns no
+  logger and records nothing about them itself.
+- **The router's 404 `message` names the path, not the URL.** For a request that matches no
+  route, Nest answers `Cannot GET /orders?token=…` with the raw URL. A test or a client that
+  matches that text for a request with a query string now reads `Cannot GET /orders`, and the
+  userinfo of an absolute-form target (`GET http://user:pw@host/orders`) is gone from it too. A
+  `NotFoundException` the application throws is not touched.
+
+### Security
+
+- **The router's 404 `message` no longer carries the query string or credentials.** 1.6.3 took
+  the query out of `path`, "where reset codes and tokens travel", but the `message` of Nest's own
+  404 (`Cannot ${method} ${url}`, built in `@nestjs/core` from the adapter's raw URL) still held
+  it, and held the userinfo of an absolute-form target as well. Both now read
+  `Cannot GET /path`, as `path` does. Only that exact framework message is rewritten, so a
+  message the application wrote, and a domain error's message, stay as written.
+
+- **A server error no longer publishes its `details` by default.** Both the flat `{ code, message, details }`
+  and the nested `{ error: { code, message, details } }` shapes are cut for a status of 500 or
+  above, as is a validation-shaped 5xx, because every mapping rule shares one builder.
+
+- **Development dependencies lifted past four advisories.** `body-parser` 2.4.0
+  (GHSA-27r3-jxmh-p828), `multer` 2.5.0 (GHSA-q7qp-rjg7-q26m) and `qs` 6.16.1
+  (GHSA-6pq8-jhm2-2vcw) are now the only resolved copies, through `pnpm`
+  overrides. `deepmerge` (GHSA-gcqx-w48m-w2h4) has no patched release and is
+  reached only through `jest-config`, so it is ignored in `osv-scanner.toml`
+  until 2027-01-27. All of them sit in the development tree: the package
+  declares no `dependencies`, so none of them reaches a consumer.
+
+### Changed
+
+- Development tooling: `tsup` 9.0.0, `@opentelemetry/context-async-hooks`
+  3.0.0, `@nestjs/common`, `core`, `platform-express`, `platform-fastify` and
+  `testing` 11.2.8, `@opentelemetry/api` 1.10.0 and the CodeQL upload action
+  4.39.1. None of them changes the published JavaScript. With `tsup` 9 the
+  declaration files list type-only exports in a separate `export type { … }`
+  statement instead of inline `type` modifiers; the exported names are the
+  same. `SECURITY.md` and `CONTRIBUTING.md` now match the current release line
+  and the pinned `pnpm`.
+
+### Documentation
+
+- **Support policy.** `SECURITY.md` states that only the latest minor (`1.6.x`)
+  receives security fixes, and that earlier versions are not supported and
+  get no backports: the guidance is to upgrade.
+- **Issue template contact links.** The "Questions and discussion" link is
+  removed from the issue chooser, since the repository has GitHub Discussions
+  turned off. The private security contact stays.
+- **Subpath lists.** `SECURITY.md` and both issue templates name the
+  subpaths, including `./metrics` and `./openapi`, and `SECURITY.md` calls the
+  request-timing component a middleware.
+- **Unknown errors and the logger.** The README no longer says the message and
+  stack of an unknown error are "captured for your logger". They go to the
+  `BYMAX_UNEXPECTED_ERROR_SINK` seam when one is bound, and reach the response
+  only under `envelope.exposeInternals`. It also no longer says the body of that
+  500 carries only the code and the correlation id: it carries the fixed
+  envelope fields and the generic message. The `package.json` description calls
+  the request-timing component a middleware, as the module registers it.
+
 ## [1.6.3] - 2026-10-23
 
 The error envelope's `path` carried the query string, and the documented
@@ -1193,4 +1265,5 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.6.1]: https://github.com/bymaxone/nest-core/compare/v1.6.0...v1.6.1
 [1.6.2]: https://github.com/bymaxone/nest-core/compare/v1.6.1...v1.6.2
 [1.6.3]: https://github.com/bymaxone/nest-core/compare/v1.6.2...v1.6.3
-[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.3...HEAD
+[1.6.4]: https://github.com/bymaxone/nest-core/compare/v1.6.3...v1.6.4
+[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.4...HEAD

package/README.md

@@ -69,7 +69,9 @@ never loads its peer, which the release gate asserts against the packed tarball.
 - ✅ **Versioned code catalog** — `BYMAX_NOT_FOUND`, `BYMAX_CONFLICT`, `BYMAX_BAD_GATEWAY`
   and the rest, exported as constants so a client maps a `code` rather than a message string
 - ✅ **Internals stay internal** — an unknown error becomes a generic 500; its message and
-  stack are captured for your logger, and reach the body only under `exposeInternals`
+  stack go to the `BYMAX_UNEXPECTED_ERROR_SINK` seam when you bind one, and reach the body
+  only under `exposeInternals`. A 5xx
+  never carries `details` either, whichever library threw it, unless `exposeInternals` is on
 - ✅ **Correlation id** — resolved through `BYMAX_CORRELATION_PROVIDER`, so the id comes from
   wherever your request context already keeps it
 
@@ -218,10 +220,10 @@ and the classification table: [Production is a closed door](#production-is-a-clo
 
 ### `envelope`
 
-| Option            | Type      | Default | Description                                                                                    |
-| ----------------- | --------- | ------- | ---------------------------------------------------------------------------------------------- |
-| `enabled`         | `boolean` | `true`  | Registers the global exception filter.                                                         |
-| `exposeInternals` | `boolean` | `false` | Includes the original message and stack of unknown errors. Development only, never production. |
+| Option            | Type      | Default | Description                                                                                                                |
+| ----------------- | --------- | ------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `enabled`         | `boolean` | `true`  | Registers the global exception filter.                                                                                     |
+| `exposeInternals` | `boolean` | `false` | Includes the original message and stack of unknown errors, and the `details` of a 5xx. Development only, never production. |
 
 ### `timing`
 
@@ -557,15 +559,29 @@ follows this exact, versioned shape:
 }
 ```
 
-| Field           | Type              | Presence | Notes                                              |
-| --------------- | ----------------- | -------- | -------------------------------------------------- |
-| `statusCode`    | number            | always   | HTTP status.                                       |
-| `code`          | string            | always   | Stable, machine-readable code.                     |
-| `message`       | string            | always   | Human-readable, safe for end users.                |
-| `details`       | array or object   | optional | Structured context, for example validation issues. |
-| `correlationId` | string            | optional | Present when a correlation provider is bound.      |
-| `timestamp`     | string (ISO 8601) | always   | Time the error was formatted.                      |
-| `path`          | string            | always   | Request URL path.                                  |
+| Field           | Type              | Presence | Notes                                                                                              |
+| --------------- | ----------------- | -------- | -------------------------------------------------------------------------------------------------- |
+| `statusCode`    | number            | always   | HTTP status.                                                                                       |
+| `code`          | string            | always   | Stable, machine-readable code.                                                                     |
+| `message`       | string            | always   | Human-readable, safe for end users.                                                                |
+| `details`       | array or object   | optional | Structured context, for example validation issues. Absent on a 5xx unless `exposeInternals` is on. |
+| `correlationId` | string            | optional | Present when a correlation provider is bound.                                                      |
+| `timestamp`     | string (ISO 8601) | always   | Time the error was formatted.                                                                      |
+| `path`          | string            | always   | Request URL path, never the query string. The router's own 404 `message` names the same path.      |
+
+**A server error carries no `details` by default.** For a status of 500 or above, the filter omits `details`
+from the body, whichever library threw the `HttpException` and whether it wrote them flat or
+under `error`; the `code` and `message` stay, because they are text the thrower chose for the
+caller. `envelope.exposeInternals` keeps the details, for local debugging only. The filter owns no
+logger and does not record a 5xx's `details` itself, so whatever throws such an error should log
+that context on the server and must not interpolate internal data into its `message`. Client
+errors are unchanged: their details are the contract. The reasoning follows the OWASP
+[Error Handling Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html)
+(a generic client response, details logged server side), RFC 9457
+[sections 3.1.4 and 5](https://www.rfc-editor.org/rfc/rfc9457.html) (a problem detail helps the client
+correct the problem rather than debug, and no implementation details leave through the HTTP
+interface), and the NestJS [exception filters](https://docs.nestjs.com/exception-filters) behaviour
+of serializing an `HttpException` response object as the whole body.
 
 Codes are stable strings under a reserved `BYMAX_` prefix, derived from the
 HTTP status: `BYMAX_NOT_FOUND` for 404, `BYMAX_VALIDATION_FAILED` for the
@@ -1684,8 +1700,9 @@ disclose.
 ### An error envelope is an exfiltration surface
 
 The filter's job is to make every failure look the same to a client, so an unknown error
-becomes a generic 500 whose body carries the code, the correlation id and nothing else. The
-original message and stack are captured for your logger, not for the response.
+becomes a generic 500 whose body carries the fixed envelope fields and the generic message,
+and not the cause unless `exposeInternals` is on. The original message and stack go to the
+`BYMAX_UNEXPECTED_ERROR_SINK` seam when you bind one.
 `envelope.exposeInternals` puts them in the body and exists for local debugging — its own
 documentation says never to enable it in production, and it defaults to `false`.
 
@@ -1761,7 +1778,7 @@ the deployment nobody configured is the one most likely to be exposed.
 | Layer               | Implementation                                                                                                                                                                   |
 | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Error responses     | One shape for everything; unknown errors become a generic 500                                                                                                                    |
-| Internals           | Message and stack captured for logging, in the body only under `exposeInternals` (default `false`)                                                                               |
+| Internals           | Message and stack handed to the unexpected-error sink when bound, in the body only under `exposeInternals` (default `false`)                                                     |
 | Health output       | The response names which indicator is down and nothing more; the reason goes to the logger. `exposeIndicatorErrors` (default `false`) puts it back in the response for debugging |
 | Slow indicators     | Converted to `down` by the aggregator, so a probe cannot hang on one                                                                                                             |
 | Correlation         | Resolved through `BYMAX_CORRELATION_PROVIDER` — the app decides where the id comes from                                                                                          |
@@ -1777,8 +1794,9 @@ the deployment nobody configured is the one most likely to be exposed.
 
 > [!IMPORTANT]
 > **`exposeInternals` is a debugging switch, not a verbosity setting.** With it on,
-> the body of a 500 carries the original message and stack of whatever failed —
-> including anything a driver, an SDK or a template put in them.
+> the body of a 500 carries the original message and stack of whatever failed, and the
+> `details` of any 5xx `HttpException` — including anything a driver, an SDK or a
+> template put in them.
 
 ---
 

package/dist/health/index.d.cts

@@ -94,4 +94,5 @@ interface HealthResponse {
     checks: HealthCheckEntry[];
 }
 
-export { BYMAX_HEALTH_INDICATOR_METADATA, BymaxHealthIndicator, type HealthCheckEntry, type HealthIndicatorResult, type HealthResponse, type IHealthIndicator };
+export { BYMAX_HEALTH_INDICATOR_METADATA, BymaxHealthIndicator };
+export type { HealthCheckEntry, HealthIndicatorResult, HealthResponse, IHealthIndicator };

package/dist/health/index.d.ts

@@ -94,4 +94,5 @@ interface HealthResponse {
     checks: HealthCheckEntry[];
 }
 
-export { BYMAX_HEALTH_INDICATOR_METADATA, BymaxHealthIndicator, type HealthCheckEntry, type HealthIndicatorResult, type HealthResponse, type IHealthIndicator };
+export { BYMAX_HEALTH_INDICATOR_METADATA, BymaxHealthIndicator };
+export type { HealthCheckEntry, HealthIndicatorResult, HealthResponse, IHealthIndicator };

package/dist/index.cjs

@@ -533,7 +533,7 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
    */
   buildEnvelope(exception, context, request) {
     if (exception instanceof common.HttpException) {
-      return this.mapHttpException(exception, context);
+      return this.mapHttpException(exception, context, request);
     }
     const exposed = resolveExposedClientError(exception);
     if (exposed !== void 0) {
@@ -580,15 +580,16 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
   }
   /**
    * Map an `HttpException` to the envelope. A domain error passes its own code,
-   * message and details through, whether it wrote them flat on the response or
-   * nested under `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED`
-   * with structured details; everything else derives its code from the status.
+   * message and details through (a 5xx's details are withheld by default in
+   * `toEnvelope`), whether it wrote them flat on the response or nested under
+   * `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED` with
+   * structured details; everything else derives its code from the status.
    *
    * @param exception - The HTTP exception to format.
    * @param context - The neutral request context.
    * @returns The formatted envelope.
    */
-  mapHttpException(exception, context) {
+  mapHttpException(exception, context, request) {
     const status = exception.getStatus();
     const response = exception.getResponse();
     const carrier = resolveErrorCarrier(response);
@@ -610,10 +611,12 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
         toValidationDetails(response.message)
       );
     }
+    const message = extractHttpMessage(response, exception);
+    const rawUrl = String(this.adapterHost.httpAdapter.getRequestUrl(request));
     return this.toEnvelope(
       status,
       codeForStatus(status),
-      extractHttpMessage(response, exception),
+      message === `Cannot ${context.method} ${rawUrl}` ? `Cannot ${context.method} ${context.path}` : message,
       context
     );
   }
@@ -638,7 +641,8 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
   }
   /**
    * Assemble the envelope through the pure builder, threading the shared clock
-   * and omitting absent optional details.
+   * and omitting absent optional details. A server-error status carries none
+   * unless `exposeInternals` is on, whichever mapping rule produced them.
    *
    * @param statusCode - HTTP status for the envelope.
    * @param code - Stable machine-readable code.
@@ -648,13 +652,14 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
    * @returns The formatted envelope.
    */
   toEnvelope(statusCode, code, message, context, details) {
+    const withheld = statusCode >= CLIENT_ERROR_MAX2 && !this.options.envelope.exposeInternals;
     return buildErrorEnvelope({
       statusCode,
       code,
       message,
       path: context.path,
       now: this.now,
-      ...details !== void 0 ? { details } : {},
+      ...details !== void 0 && !withheld ? { details } : {},
       // Stryker disable next-line ConditionalExpression: equivalent — the always-spread form hands the builder `correlationId: undefined`, and `buildErrorEnvelope` re-guards `input.correlationId !== undefined` and omits an undefined value, so the emitted envelope is byte-for-byte identical whether or not a correlation id is present.
       ...context.correlationId !== void 0 ? { correlationId: context.correlationId } : {},
       // Gated separately from the context above: the trace id reaches the

package/dist/index.d.cts

@@ -10,7 +10,8 @@ interface EnvelopeOptions {
     enabled?: boolean;
     /**
      * Include the original message and stack of unknown errors in the envelope
-     * details. Never enable in production. Default: `false`.
+     * details, and keep the `details` of a 5xx `HttpException`, which are
+     * otherwise withheld from the body. Never enable in production. Default: `false`.
      */
     exposeInternals?: boolean;
 }
@@ -839,9 +840,10 @@ declare class BymaxExceptionFilter implements ExceptionFilter {
     private reportUnexpected;
     /**
      * Map an `HttpException` to the envelope. A domain error passes its own code,
-     * message and details through, whether it wrote them flat on the response or
-     * nested under `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED`
-     * with structured details; everything else derives its code from the status.
+     * message and details through (a 5xx's details are withheld by default in
+     * `toEnvelope`), whether it wrote them flat on the response or nested under
+     * `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED` with
+     * structured details; everything else derives its code from the status.
      *
      * @param exception - The HTTP exception to format.
      * @param context - The neutral request context.
@@ -860,7 +862,8 @@ declare class BymaxExceptionFilter implements ExceptionFilter {
     private mapUnknown;
     /**
      * Assemble the envelope through the pure builder, threading the shared clock
-     * and omitting absent optional details.
+     * and omitting absent optional details. A server-error status carries none
+     * unless `exposeInternals` is on, whichever mapping rule produced them.
      *
      * @param statusCode - HTTP status for the envelope.
      * @param code - Stable machine-readable code.
@@ -1293,4 +1296,5 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, type BuildErrorEnvelopeInput, BymaxCoreModule, type BymaxCoreModuleOptions, BymaxExceptionFilter, BymaxTimingMiddleware, type EnvelopeOptions, type ErrorDetails, type ErrorEnvelope, type FilterErrorContext, type HealthOptions, type ICorrelationIdProvider, type ITimingSink, type ITraceContextProvider, type IUnexpectedErrorSink, type MetricsOptions, type OpenApiHttpMethod, type OpenApiOperationIdFactory, type OpenApiOperationKey, type OpenApiOptions, type OpenApiSecurityRequirement, type OpenApiSecurityScheme, type OpenApiServerDescriptor, type OperationSecurityMap, type RequestTimingSample, type ResolvedCoreOptions, type TelemetryOptions, TimingInterceptor, type TimingOptions, type TraceContext, UNMATCHED_ROUTE, type UnexpectedErrorReport, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export type { BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };

package/dist/index.d.ts

@@ -10,7 +10,8 @@ interface EnvelopeOptions {
     enabled?: boolean;
     /**
      * Include the original message and stack of unknown errors in the envelope
-     * details. Never enable in production. Default: `false`.
+     * details, and keep the `details` of a 5xx `HttpException`, which are
+     * otherwise withheld from the body. Never enable in production. Default: `false`.
      */
     exposeInternals?: boolean;
 }
@@ -839,9 +840,10 @@ declare class BymaxExceptionFilter implements ExceptionFilter {
     private reportUnexpected;
     /**
      * Map an `HttpException` to the envelope. A domain error passes its own code,
-     * message and details through, whether it wrote them flat on the response or
-     * nested under `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED`
-     * with structured details; everything else derives its code from the status.
+     * message and details through (a 5xx's details are withheld by default in
+     * `toEnvelope`), whether it wrote them flat on the response or nested under
+     * `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED` with
+     * structured details; everything else derives its code from the status.
      *
      * @param exception - The HTTP exception to format.
      * @param context - The neutral request context.
@@ -860,7 +862,8 @@ declare class BymaxExceptionFilter implements ExceptionFilter {
     private mapUnknown;
     /**
      * Assemble the envelope through the pure builder, threading the shared clock
-     * and omitting absent optional details.
+     * and omitting absent optional details. A server-error status carries none
+     * unless `exposeInternals` is on, whichever mapping rule produced them.
      *
      * @param statusCode - HTTP status for the envelope.
      * @param code - Stable machine-readable code.
@@ -1293,4 +1296,5 @@ declare const BYMAX_GATEWAY_TIMEOUT = "BYMAX_GATEWAY_TIMEOUT";
  */
 declare function codeForStatus(status: number): string;
 
-export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, type BuildErrorEnvelopeInput, BymaxCoreModule, type BymaxCoreModuleOptions, BymaxExceptionFilter, BymaxTimingMiddleware, type EnvelopeOptions, type ErrorDetails, type ErrorEnvelope, type FilterErrorContext, type HealthOptions, type ICorrelationIdProvider, type ITimingSink, type ITraceContextProvider, type IUnexpectedErrorSink, type MetricsOptions, type OpenApiHttpMethod, type OpenApiOperationIdFactory, type OpenApiOperationKey, type OpenApiOptions, type OpenApiSecurityRequirement, type OpenApiSecurityScheme, type OpenApiServerDescriptor, type OperationSecurityMap, type RequestTimingSample, type ResolvedCoreOptions, type TelemetryOptions, TimingInterceptor, type TimingOptions, type TraceContext, UNMATCHED_ROUTE, type UnexpectedErrorReport, buildErrorEnvelope, codeForStatus };
+export { BYMAX_BAD_GATEWAY, BYMAX_BAD_REQUEST, BYMAX_CLIENT_ERROR, BYMAX_CONFLICT, BYMAX_CORE_OPTIONS, BYMAX_CORRELATION_PROVIDER, BYMAX_FORBIDDEN, BYMAX_GATEWAY_TIMEOUT, BYMAX_HEALTH_INDICATORS, BYMAX_HEALTH_TRANSITION_SINK, BYMAX_INTERNAL_ERROR, BYMAX_METRICS_REGISTRY, BYMAX_NOT_FOUND, BYMAX_NOT_IMPLEMENTED, BYMAX_PAYLOAD_TOO_LARGE, BYMAX_SERVICE_UNAVAILABLE, BYMAX_TIMING_SINK, BYMAX_TOO_MANY_REQUESTS, BYMAX_TRACE_CONTEXT, BYMAX_UNAUTHORIZED, BYMAX_UNEXPECTED_ERROR_SINK, BYMAX_UNPROCESSABLE_ENTITY, BYMAX_UNSUPPORTED_MEDIA_TYPE, BYMAX_VALIDATION_FAILED, BymaxCoreModule, BymaxExceptionFilter, BymaxTimingMiddleware, TimingInterceptor, UNMATCHED_ROUTE, buildErrorEnvelope, codeForStatus };
+export type { BuildErrorEnvelopeInput, BymaxCoreModuleOptions, EnvelopeOptions, ErrorDetails, ErrorEnvelope, FilterErrorContext, HealthOptions, ICorrelationIdProvider, ITimingSink, ITraceContextProvider, IUnexpectedErrorSink, MetricsOptions, OpenApiHttpMethod, OpenApiOperationIdFactory, OpenApiOperationKey, OpenApiOptions, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServerDescriptor, OperationSecurityMap, RequestTimingSample, ResolvedCoreOptions, TelemetryOptions, TimingOptions, TraceContext, UnexpectedErrorReport };

package/dist/index.mjs

@@ -531,7 +531,7 @@ var BymaxExceptionFilter = class {
    */
   buildEnvelope(exception, context, request) {
     if (exception instanceof HttpException) {
-      return this.mapHttpException(exception, context);
+      return this.mapHttpException(exception, context, request);
     }
     const exposed = resolveExposedClientError(exception);
     if (exposed !== void 0) {
@@ -578,15 +578,16 @@ var BymaxExceptionFilter = class {
   }
   /**
    * Map an `HttpException` to the envelope. A domain error passes its own code,
-   * message and details through, whether it wrote them flat on the response or
-   * nested under `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED`
-   * with structured details; everything else derives its code from the status.
+   * message and details through (a 5xx's details are withheld by default in
+   * `toEnvelope`), whether it wrote them flat on the response or nested under
+   * `error`; the validation shape becomes `BYMAX_VALIDATION_FAILED` with
+   * structured details; everything else derives its code from the status.
    *
    * @param exception - The HTTP exception to format.
    * @param context - The neutral request context.
    * @returns The formatted envelope.
    */
-  mapHttpException(exception, context) {
+  mapHttpException(exception, context, request) {
     const status = exception.getStatus();
     const response = exception.getResponse();
     const carrier = resolveErrorCarrier(response);
@@ -608,10 +609,12 @@ var BymaxExceptionFilter = class {
         toValidationDetails(response.message)
       );
     }
+    const message = extractHttpMessage(response, exception);
+    const rawUrl = String(this.adapterHost.httpAdapter.getRequestUrl(request));
     return this.toEnvelope(
       status,
       codeForStatus(status),
-      extractHttpMessage(response, exception),
+      message === `Cannot ${context.method} ${rawUrl}` ? `Cannot ${context.method} ${context.path}` : message,
       context
     );
   }
@@ -636,7 +639,8 @@ var BymaxExceptionFilter = class {
   }
   /**
    * Assemble the envelope through the pure builder, threading the shared clock
-   * and omitting absent optional details.
+   * and omitting absent optional details. A server-error status carries none
+   * unless `exposeInternals` is on, whichever mapping rule produced them.
    *
    * @param statusCode - HTTP status for the envelope.
    * @param code - Stable machine-readable code.
@@ -646,13 +650,14 @@ var BymaxExceptionFilter = class {
    * @returns The formatted envelope.
    */
   toEnvelope(statusCode, code, message, context, details) {
+    const withheld = statusCode >= CLIENT_ERROR_MAX2 && !this.options.envelope.exposeInternals;
     return buildErrorEnvelope({
       statusCode,
       code,
       message,
       path: context.path,
       now: this.now,
-      ...details !== void 0 ? { details } : {},
+      ...details !== void 0 && !withheld ? { details } : {},
       // Stryker disable next-line ConditionalExpression: equivalent — the always-spread form hands the builder `correlationId: undefined`, and `buildErrorEnvelope` re-guards `input.correlationId !== undefined` and omits an undefined value, so the emitted envelope is byte-for-byte identical whether or not a correlation id is present.
       ...context.correlationId !== void 0 ? { correlationId: context.correlationId } : {},
       // Gated separately from the context above: the trace id reaches the

package/dist/metrics/index.d.cts

@@ -54,4 +54,5 @@ declare const BYMAX_METRICS_CONTRIBUTOR_METADATA = "bymax-one:metrics-contributo
  */
 declare function BymaxMetricsContributor(): CustomDecorator<string>;
 
-export { BYMAX_METRICS_CONTRIBUTOR_METADATA, BymaxMetricsContributor, type IMetricsContributor, type MetricsRegistry };
+export { BYMAX_METRICS_CONTRIBUTOR_METADATA, BymaxMetricsContributor };
+export type { IMetricsContributor, MetricsRegistry };

package/dist/metrics/index.d.ts

@@ -54,4 +54,5 @@ declare const BYMAX_METRICS_CONTRIBUTOR_METADATA = "bymax-one:metrics-contributo
  */
 declare function BymaxMetricsContributor(): CustomDecorator<string>;
 
-export { BYMAX_METRICS_CONTRIBUTOR_METADATA, BymaxMetricsContributor, type IMetricsContributor, type MetricsRegistry };
+export { BYMAX_METRICS_CONTRIBUTOR_METADATA, BymaxMetricsContributor };
+export type { IMetricsContributor, MetricsRegistry };

package/dist/openapi/index.d.cts

@@ -240,4 +240,5 @@ interface OpenApiMountOutcome {
  */
 declare function applyBymaxOpenApi(app: INestApplication): Promise<OpenApiMountOutcome>;
 
-export { BYMAX_OPENAPI_CONTRACT_VERSION, BYMAX_OPENAPI_CONTRIBUTOR_METADATA, BymaxOpenApiContributor, type DiscardedComponent, type IOpenApiContributor, type OpenApiFragment, type OpenApiFragmentObject, type OpenApiHandlerKey, type OpenApiMountOutcome, type OpenApiSkipReason, applyBymaxOpenApi };
+export { BYMAX_OPENAPI_CONTRACT_VERSION, BYMAX_OPENAPI_CONTRIBUTOR_METADATA, BymaxOpenApiContributor, applyBymaxOpenApi };
+export type { DiscardedComponent, IOpenApiContributor, OpenApiFragment, OpenApiFragmentObject, OpenApiHandlerKey, OpenApiMountOutcome, OpenApiSkipReason };

package/dist/openapi/index.d.ts

@@ -240,4 +240,5 @@ interface OpenApiMountOutcome {
  */
 declare function applyBymaxOpenApi(app: INestApplication): Promise<OpenApiMountOutcome>;
 
-export { BYMAX_OPENAPI_CONTRACT_VERSION, BYMAX_OPENAPI_CONTRIBUTOR_METADATA, BymaxOpenApiContributor, type DiscardedComponent, type IOpenApiContributor, type OpenApiFragment, type OpenApiFragmentObject, type OpenApiHandlerKey, type OpenApiMountOutcome, type OpenApiSkipReason, applyBymaxOpenApi };
+export { BYMAX_OPENAPI_CONTRACT_VERSION, BYMAX_OPENAPI_CONTRIBUTOR_METADATA, BymaxOpenApiContributor, applyBymaxOpenApi };
+export type { DiscardedComponent, IOpenApiContributor, OpenApiFragment, OpenApiFragmentObject, OpenApiHandlerKey, OpenApiMountOutcome, OpenApiSkipReason };

package/dist/pagination/index.d.cts

@@ -175,4 +175,5 @@ declare function normalizeCursorQuery(raw: {
  */
 declare function buildCursorResult<T>(items: T[], limit: number, toCursor: (lastItem: T) => Record<string, string | number>): CursorResult<T>;
 
-export { type CursorQuery, type CursorResult, type PageMeta, type PageQuery, type PageResult, buildCursorResult, buildPageResult, decodeCursor, encodeCursor, normalizeCursorQuery, normalizePageQuery };
+export { buildCursorResult, buildPageResult, decodeCursor, encodeCursor, normalizeCursorQuery, normalizePageQuery };
+export type { CursorQuery, CursorResult, PageMeta, PageQuery, PageResult };

package/dist/pagination/index.d.ts

@@ -175,4 +175,5 @@ declare function normalizeCursorQuery(raw: {
  */
 declare function buildCursorResult<T>(items: T[], limit: number, toCursor: (lastItem: T) => Record<string, string | number>): CursorResult<T>;
 
-export { type CursorQuery, type CursorResult, type PageMeta, type PageQuery, type PageResult, buildCursorResult, buildPageResult, decodeCursor, encodeCursor, normalizeCursorQuery, normalizePageQuery };
+export { buildCursorResult, buildPageResult, decodeCursor, encodeCursor, normalizeCursorQuery, normalizePageQuery };
+export type { CursorQuery, CursorResult, PageMeta, PageQuery, PageResult };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bymax-one/nest-core",
-  "version": "1.6.3",
-  "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing interceptor, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
+  "version": "1.6.4",
+  "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing middleware, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
   "homepage": "https://github.com/bymaxone/nest-core#readme",
@@ -140,7 +140,7 @@
     "@nestjs/swagger": "^11.4.6",
     "@nestjs/testing": "^11.1.20",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/context-async-hooks": "^2.10.0",
+    "@opentelemetry/context-async-hooks": "^3.0.0",
     "@stryker-mutator/core": "^9",
     "@stryker-mutator/jest-runner": "^9",
     "@stryker-mutator/typescript-checker": "^9",
@@ -168,7 +168,7 @@
     "supertest": "^7.2.2",
     "ts-jest": "^29.4.9",
     "ts-node": "^10.9.2",
-    "tsup": "^8.5.1",
+    "tsup": "^9.0.0",
     "typescript": "^5.9.3"
   },
   "keywords": [