@karmaniverous/smoz 0.2.11 → 0.2.13

package/dist/cjs/index.js

@@ -375,6 +375,98 @@ const wrapSerializer = (fn, opts) => {
     });
 };
 
+/**
+ * @module Response shaping helpers for HTTP middleware.
+ *
+ * Shared utilities for detecting and normalising Lambda Proxy response
+ * envelopes, used by both the `after` and `onError` middleware paths.
+ * Also exports dedicated `onError` steps that apply CORS headers and
+ * response shaping after `errorHandler` — necessary because middy v6+
+ * does not re-run the `after` chain on the error path.
+ */
+/**
+ * Detect a shaped Lambda Proxy response.
+ *
+ * A response is "shaped" when it has a numeric `statusCode` property —
+ * the definitive marker of an API-Gateway-style response envelope.
+ * Missing `headers` or `body` are defaulted by {@link shapeResponse}
+ * rather than treated as "unshaped", because `{ statusCode, headers }`
+ * (no body) is a valid Lambda Proxy return value.
+ */
+const isShapedResponse = (v) => typeof v === 'object' &&
+    v !== null &&
+    'statusCode' in v &&
+    typeof v.statusCode === 'number';
+/**
+ * Shape the response into a well-formed Lambda Proxy result.
+ *
+ * Shaped responses (detected via {@link isShapedResponse}) are normalised
+ * in-place — missing `headers` and `body` are defaulted.  Non-shaped
+ * values are wrapped in a `200` envelope.
+ */
+const shapeResponse = (current, contentType) => {
+    let res;
+    if (isShapedResponse(current)) {
+        res = current;
+    }
+    else {
+        res = { statusCode: 200, headers: {}, body: current };
+    }
+    // Default missing fields for shaped responses without body/headers.
+    if (res.body === undefined)
+        res.body = '';
+    if (res.body !== undefined && typeof res.body !== 'string') {
+        try {
+            res.body = JSON.stringify(res.body);
+        }
+        catch {
+            res.body = String(res.body);
+        }
+    }
+    const headers = res.headers ?? {};
+    headers['Content-Type'] = contentType;
+    res.headers = headers;
+    return res;
+};
+/**
+ * Apply CORS headers to error responses.
+ *
+ * middy v6+ does not re-run the `after` chain after `onError` handles an
+ * error, so the regular CORS `after` hook never fires for error responses.
+ * This dedicated `onError` step runs *after* the error handler has set
+ * `request.response`, ensuring CORS headers are present on error responses.
+ */
+const makeOnErrorCors = (opts) => {
+    const cors = httpCors({
+        credentials: true,
+        getOrigin: (o) => o,
+        ...(opts?.cors ?? {}),
+    });
+    return tagStep({
+        onError: async (request) => {
+            if (request.response === undefined)
+                return;
+            if (cors.after)
+                await cors.after(request);
+        },
+    }, 'error-cors');
+};
+/**
+ * Shape error responses into well-formed Lambda Proxy results.
+ *
+ * Mirrors `makeShapeAndContentType` but runs on the `onError` path,
+ * ensuring error responses have proper `statusCode`, `headers`, and
+ * `body` structure even when the `after` chain is skipped.
+ */
+const makeOnErrorShape = (contentType) => tagStep({
+    onError: (request) => {
+        const container = request;
+        if (container.response === undefined)
+            return;
+        container.response = shapeResponse(container.response, contentType);
+    },
+}, 'error-shape');
+
 const makeHead = () => tagStep(shortCircuitHead, 'head');
 const makeHeaderNormalizer = (opts) => tagStep(asApiMiddleware(httpHeaderNormalizer(opts?.headerNormalizer ?? { canonical: true })), 'header-normalizer');
 const makeEventNormalizer = () => tagStep(asApiMiddleware(httpEventNormalizer()), 'event-normalizer');
@@ -487,6 +579,30 @@ const makeErrorExpose = (logger) => tagStep({
                 /invalid (event|response)/i.test(msg))) {
             maybe.statusCode = 400;
         }
+        // JSON-encode the error message so middy's httpErrorHandler emits
+        // application/json instead of text/plain. Guard against double-encoding
+        // since this step is registered in both the after and onError arrays.
+        try {
+            const parsed = JSON.parse(msg);
+            if (typeof parsed === 'object' &&
+                parsed !== null &&
+                'statusCode' in parsed &&
+                'message' in parsed)
+                return;
+        }
+        catch {
+            // not JSON — proceed with encoding
+        }
+        const statusCode = typeof maybe.statusCode === 'number'
+            ? maybe.statusCode
+            : 500;
+        // Ensure statusCode is set so middy's httpErrorHandler doesn't
+        // discard the message with its fallback replacement.
+        if (typeof maybe.statusCode !== 'number') {
+            maybe.statusCode = statusCode;
+        }
+        const message = msg || 'Internal Server Error';
+        maybe.message = JSON.stringify({ statusCode, message });
     },
 }, 'error-expose');
 const makeErrorHandler = (opts) => tagStep(asApiMiddleware(httpErrorHandler({
@@ -505,31 +621,9 @@ const makeCors = (opts) => tagStep(asApiMiddleware(httpCors({
 const makeShapeAndContentType = (contentType) => tagStep({
     after: (request) => {
         const container = request;
-        const current = container.response;
-        if (current === undefined)
+        if (container.response === undefined)
             return;
-        const looksShaped = typeof current === 'object' &&
-            current !== null &&
-            'statusCode' in current &&
-            'headers' in current &&
-            'body' in current;
-        let res;
-        if (looksShaped)
-            res = current;
-        else
-            res = { statusCode: 200, headers: {}, body: current };
-        if (res.body !== undefined && typeof res.body !== 'string') {
-            try {
-                res.body = JSON.stringify(res.body);
-            }
-            catch {
-                res.body = String(res.body);
-            }
-        }
-        const headers = res.headers ?? {};
-        headers['Content-Type'] = contentType;
-        res.headers = headers;
-        request.response = res;
+        container.response = shapeResponse(container.response, contentType);
     },
 }, 'shape');
 const makeSerializer = (contentType, opts) => tagStep(asApiMiddleware(httpResponseSerializer({
@@ -565,7 +659,15 @@ const buildDefaultPhases = (args) => {
         makeShapeAndContentType(contentType),
         makeSerializer(contentType, opts),
     ];
-    const onError = [makeErrorExpose(), makeErrorHandler(opts)];
+    const onError = [
+        makeErrorExpose(),
+        makeErrorHandler(opts),
+        // Post-error-handler processing: middy v6+ does not re-run the after
+        // chain after onError, so CORS and response shaping must happen here.
+        // Shape first so CORS can mutate a well-formed headers object.
+        makeOnErrorShape(contentType),
+        makeOnErrorCors(opts),
+    ];
     return { before, after, onError };
 };
 const buildSafeDefaults = (args) => buildDefaultPhases(args);

package/dist/index.d.ts

@@ -264,7 +264,7 @@ type ConsoleLogger = Pick<Console, 'debug' | 'error' | 'info' | 'log'>;
  */
 
 type ApiMiddleware$1 = MiddlewareObj<APIGatewayProxyEvent, Context>;
-type StepId = 'head' | 'header-normalizer' | 'event-normalizer' | 'content-negotiation' | 'json-body-parser' | 'zod-before' | 'head-finalize' | 'zod-after' | 'error-expose' | 'error-handler' | 'cors' | 'preferred-media' | 'shape' | 'serializer';
+type StepId = 'head' | 'header-normalizer' | 'event-normalizer' | 'content-negotiation' | 'json-body-parser' | 'zod-before' | 'head-finalize' | 'zod-after' | 'error-expose' | 'error-handler' | 'error-cors' | 'error-shape' | 'cors' | 'preferred-media' | 'shape' | 'serializer';
 /** Attach a non-enumerable __id to a middleware step. */
 declare const tagStep: (mw: ApiMiddleware$1, id: StepId) => ApiMiddleware$1;
 /** Retrieve a step's id, if present. */

package/dist/mjs/index.js

@@ -373,6 +373,98 @@ const wrapSerializer = (fn, opts) => {
     });
 };
 
+/**
+ * @module Response shaping helpers for HTTP middleware.
+ *
+ * Shared utilities for detecting and normalising Lambda Proxy response
+ * envelopes, used by both the `after` and `onError` middleware paths.
+ * Also exports dedicated `onError` steps that apply CORS headers and
+ * response shaping after `errorHandler` — necessary because middy v6+
+ * does not re-run the `after` chain on the error path.
+ */
+/**
+ * Detect a shaped Lambda Proxy response.
+ *
+ * A response is "shaped" when it has a numeric `statusCode` property —
+ * the definitive marker of an API-Gateway-style response envelope.
+ * Missing `headers` or `body` are defaulted by {@link shapeResponse}
+ * rather than treated as "unshaped", because `{ statusCode, headers }`
+ * (no body) is a valid Lambda Proxy return value.
+ */
+const isShapedResponse = (v) => typeof v === 'object' &&
+    v !== null &&
+    'statusCode' in v &&
+    typeof v.statusCode === 'number';
+/**
+ * Shape the response into a well-formed Lambda Proxy result.
+ *
+ * Shaped responses (detected via {@link isShapedResponse}) are normalised
+ * in-place — missing `headers` and `body` are defaulted.  Non-shaped
+ * values are wrapped in a `200` envelope.
+ */
+const shapeResponse = (current, contentType) => {
+    let res;
+    if (isShapedResponse(current)) {
+        res = current;
+    }
+    else {
+        res = { statusCode: 200, headers: {}, body: current };
+    }
+    // Default missing fields for shaped responses without body/headers.
+    if (res.body === undefined)
+        res.body = '';
+    if (res.body !== undefined && typeof res.body !== 'string') {
+        try {
+            res.body = JSON.stringify(res.body);
+        }
+        catch {
+            res.body = String(res.body);
+        }
+    }
+    const headers = res.headers ?? {};
+    headers['Content-Type'] = contentType;
+    res.headers = headers;
+    return res;
+};
+/**
+ * Apply CORS headers to error responses.
+ *
+ * middy v6+ does not re-run the `after` chain after `onError` handles an
+ * error, so the regular CORS `after` hook never fires for error responses.
+ * This dedicated `onError` step runs *after* the error handler has set
+ * `request.response`, ensuring CORS headers are present on error responses.
+ */
+const makeOnErrorCors = (opts) => {
+    const cors = httpCors({
+        credentials: true,
+        getOrigin: (o) => o,
+        ...(opts?.cors ?? {}),
+    });
+    return tagStep({
+        onError: async (request) => {
+            if (request.response === undefined)
+                return;
+            if (cors.after)
+                await cors.after(request);
+        },
+    }, 'error-cors');
+};
+/**
+ * Shape error responses into well-formed Lambda Proxy results.
+ *
+ * Mirrors `makeShapeAndContentType` but runs on the `onError` path,
+ * ensuring error responses have proper `statusCode`, `headers`, and
+ * `body` structure even when the `after` chain is skipped.
+ */
+const makeOnErrorShape = (contentType) => tagStep({
+    onError: (request) => {
+        const container = request;
+        if (container.response === undefined)
+            return;
+        container.response = shapeResponse(container.response, contentType);
+    },
+}, 'error-shape');
+
 const makeHead = () => tagStep(shortCircuitHead, 'head');
 const makeHeaderNormalizer = (opts) => tagStep(asApiMiddleware(httpHeaderNormalizer(opts?.headerNormalizer ?? { canonical: true })), 'header-normalizer');
 const makeEventNormalizer = () => tagStep(asApiMiddleware(httpEventNormalizer()), 'event-normalizer');
@@ -485,6 +577,30 @@ const makeErrorExpose = (logger) => tagStep({
                 /invalid (event|response)/i.test(msg))) {
             maybe.statusCode = 400;
         }
+        // JSON-encode the error message so middy's httpErrorHandler emits
+        // application/json instead of text/plain. Guard against double-encoding
+        // since this step is registered in both the after and onError arrays.
+        try {
+            const parsed = JSON.parse(msg);
+            if (typeof parsed === 'object' &&
+                parsed !== null &&
+                'statusCode' in parsed &&
+                'message' in parsed)
+                return;
+        }
+        catch {
+            // not JSON — proceed with encoding
+        }
+        const statusCode = typeof maybe.statusCode === 'number'
+            ? maybe.statusCode
+            : 500;
+        // Ensure statusCode is set so middy's httpErrorHandler doesn't
+        // discard the message with its fallback replacement.
+        if (typeof maybe.statusCode !== 'number') {
+            maybe.statusCode = statusCode;
+        }
+        const message = msg || 'Internal Server Error';
+        maybe.message = JSON.stringify({ statusCode, message });
     },
 }, 'error-expose');
 const makeErrorHandler = (opts) => tagStep(asApiMiddleware(httpErrorHandler({
@@ -503,31 +619,9 @@ const makeCors = (opts) => tagStep(asApiMiddleware(httpCors({
 const makeShapeAndContentType = (contentType) => tagStep({
     after: (request) => {
         const container = request;
-        const current = container.response;
-        if (current === undefined)
+        if (container.response === undefined)
             return;
-        const looksShaped = typeof current === 'object' &&
-            current !== null &&
-            'statusCode' in current &&
-            'headers' in current &&
-            'body' in current;
-        let res;
-        if (looksShaped)
-            res = current;
-        else
-            res = { statusCode: 200, headers: {}, body: current };
-        if (res.body !== undefined && typeof res.body !== 'string') {
-            try {
-                res.body = JSON.stringify(res.body);
-            }
-            catch {
-                res.body = String(res.body);
-            }
-        }
-        const headers = res.headers ?? {};
-        headers['Content-Type'] = contentType;
-        res.headers = headers;
-        request.response = res;
+        container.response = shapeResponse(container.response, contentType);
     },
 }, 'shape');
 const makeSerializer = (contentType, opts) => tagStep(asApiMiddleware(httpResponseSerializer({
@@ -563,7 +657,15 @@ const buildDefaultPhases = (args) => {
         makeShapeAndContentType(contentType),
         makeSerializer(contentType, opts),
     ];
-    const onError = [makeErrorExpose(), makeErrorHandler(opts)];
+    const onError = [
+        makeErrorExpose(),
+        makeErrorHandler(opts),
+        // Post-error-handler processing: middy v6+ does not re-run the after
+        // chain after onError, so CORS and response shaping must happen here.
+        // Shape first so CORS can mutate a well-formed headers object.
+        makeOnErrorShape(contentType),
+        makeOnErrorCors(opts),
+    ];
     return { before, after, onError };
 };
 const buildSafeDefaults = (args) => buildDefaultPhases(args);

package/package.json

@@ -184,7 +184,7 @@
     "templates:lint": "eslint --fix -c templates/default/eslint.config.ts \"templates/default/**/*.{ts,tsx,js,jsx}\" \"templates/default/eslint.config.ts\""
   },
   "type": "module",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "volta": {
     "node": "22.19.0"
   }