@bymax-one/nest-core 1.6.5 → 1.6.6

package/CHANGELOG.md

@@ -11,6 +11,27 @@ heading here.
 
 ## [Unreleased]
 
+## [1.6.6] - 2026-11-07
+
+A patch release. The error envelope no longer returns the parser's own text for a request refused before
+routing; see Fixed.
+
+**Apply to a derived backend:** `pnpm up @bymax-one/nest-core`. A client that matched on those
+message strings must match `code` instead. A middleware that throws a plain `BadRequestException`
+before routing now answers `Malformed request` with the same 400; to keep its message, throw it with
+a `code` (`new HttpException({ code: 'TENANT_REQUIRED', message }, 400)`).
+
+### Fixed
+
+- **A request refused before routing no longer has the parser's own text returned.** The message of
+  a body-parser, router or decoding refusal quotes the request: V8's JSON excerpt (on a login body
+  with a missing value it ends in the password's last characters), a charset or content-encoding
+  header value, or the path. The status is unchanged and the envelope keeps its shape, but the
+  message is now fixed per status. It is chosen from the error's own `type` (the body pipeline's
+  refusals carry one) or, for the `SyntaxError` and `URIError` that Nest rewrites into a plain
+  `BadRequestException`, from a 400 raised while the request matched no route. Not covered: Fastify,
+  whose body errors take another path and were not measured here.
+
 ## [1.6.5] - 2026-10-31
 
 A documentation release. The compiled JavaScript is byte-identical to `1.6.4`: what changes in the
@@ -1314,4 +1335,5 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.6.3]: https://github.com/bymaxone/nest-core/compare/v1.6.2...v1.6.3
 [1.6.4]: https://github.com/bymaxone/nest-core/compare/v1.6.3...v1.6.4
 [1.6.5]: https://github.com/bymaxone/nest-core/compare/v1.6.4...v1.6.5
-[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.5...HEAD
+[1.6.6]: https://github.com/bymaxone/nest-core/compare/v1.6.5...v1.6.6
+[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.6.6...HEAD

package/README.md

@@ -639,6 +639,12 @@ marks itself `expose: true` with a `4xx` status, which is the `http-errors`
 convention Node's body pipeline follows. Nothing in the application failed, so
 it is not routed through the unexpected-error seam either.
 
+The message of such a refusal is fixed per status — `Malformed request` (400),
+`Request entity too large` (413), `Unsupported media type` (415) — because the
+parser's own text quotes the request: a JSON excerpt, a header value, the path.
+A `BadRequestException` a middleware throws before routing gets the same 400
+message; throw it with a `code` to keep its own. Fastify is not covered.
+
 **An error that carries no such marking is a 500, including when a client
 caused it.** The clearest case is depth: a body of a few kilobytes nested
 thousands of levels deep overflows the stack during validation and surfaces as

package/dist/index.cjs

@@ -359,6 +359,12 @@ function extractRequestInfo(context) {
 var INTERNAL_ERROR_STATUS = 500;
 var INTERNAL_ERROR_MESSAGE = "Internal server error";
 var VALIDATION_FAILED_MESSAGE = "Validation failed";
+var MALFORMED_REQUEST_MESSAGE = "Malformed request";
+var PRE_ROUTING_MESSAGES = /* @__PURE__ */ new Map([
+  [400, MALFORMED_REQUEST_MESSAGE],
+  [413, "Request entity too large"],
+  [415, "Unsupported media type"]
+]);
 var ABSOLUTE_FORM_PREFIX = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
 function pathOf(url) {
   let target = String(url);
@@ -409,8 +415,9 @@ function resolveExposedClientError(exception) {
   if (typeof status !== "number" || !Number.isInteger(status) || status < CLIENT_ERROR_MIN2 || status >= CLIENT_ERROR_MAX2) {
     return void 0;
   }
+  const fixed = typeof candidate.type === "string" ? PRE_ROUTING_MESSAGES.get(status) : void 0;
   const message = exception instanceof Error ? exception.message : "";
-  return { status, message: message === "" ? INTERNAL_ERROR_MESSAGE : message };
+  return { status, message: fixed ?? (message === "" ? INTERNAL_ERROR_MESSAGE : message) };
 }
 function isValidationResponse(response) {
   return typeof response === "object" && response !== null && "message" in response && Array.isArray(response.message);
@@ -611,6 +618,9 @@ exports.BymaxExceptionFilter = class BymaxExceptionFilter {
         toValidationDetails(response.message)
       );
     }
+    if (status === 400 && readRequestInfo(request).route === UNMATCHED_ROUTE) {
+      return this.toEnvelope(status, codeForStatus(status), MALFORMED_REQUEST_MESSAGE, context);
+    }
     const message = extractHttpMessage(response, exception);
     const rawUrl = String(this.adapterHost.httpAdapter.getRequestUrl(request));
     return this.toEnvelope(

package/dist/index.mjs

@@ -357,6 +357,12 @@ function extractRequestInfo(context) {
 var INTERNAL_ERROR_STATUS = 500;
 var INTERNAL_ERROR_MESSAGE = "Internal server error";
 var VALIDATION_FAILED_MESSAGE = "Validation failed";
+var MALFORMED_REQUEST_MESSAGE = "Malformed request";
+var PRE_ROUTING_MESSAGES = /* @__PURE__ */ new Map([
+  [400, MALFORMED_REQUEST_MESSAGE],
+  [413, "Request entity too large"],
+  [415, "Unsupported media type"]
+]);
 var ABSOLUTE_FORM_PREFIX = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
 function pathOf(url) {
   let target = String(url);
@@ -407,8 +413,9 @@ function resolveExposedClientError(exception) {
   if (typeof status !== "number" || !Number.isInteger(status) || status < CLIENT_ERROR_MIN2 || status >= CLIENT_ERROR_MAX2) {
     return void 0;
   }
+  const fixed = typeof candidate.type === "string" ? PRE_ROUTING_MESSAGES.get(status) : void 0;
   const message = exception instanceof Error ? exception.message : "";
-  return { status, message: message === "" ? INTERNAL_ERROR_MESSAGE : message };
+  return { status, message: fixed ?? (message === "" ? INTERNAL_ERROR_MESSAGE : message) };
 }
 function isValidationResponse(response) {
   return typeof response === "object" && response !== null && "message" in response && Array.isArray(response.message);
@@ -609,6 +616,9 @@ var BymaxExceptionFilter = class {
         toValidationDetails(response.message)
       );
     }
+    if (status === 400 && readRequestInfo(request).route === UNMATCHED_ROUTE) {
+      return this.toEnvelope(status, codeForStatus(status), MALFORMED_REQUEST_MESSAGE, context);
+    }
     const message = extractHttpMessage(response, exception);
     const rawUrl = String(this.adapterHost.httpAdapter.getRequestUrl(request));
     return this.toEnvelope(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-core",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing middleware, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",