@karmaniverous/smoz 0.2.12 → 0.2.14

package/dist/cjs/index.js

@@ -375,6 +375,98 @@ const wrapSerializer = (fn, opts) => {
     });
 };
 
+/**
+ * @module Response shaping helpers for HTTP middleware.
+ *
+ * Shared utilities for detecting and normalising Lambda Proxy response
+ * envelopes, used by both the `after` and `onError` middleware paths.
+ * Also exports dedicated `onError` steps that apply CORS headers and
+ * response shaping after `errorHandler` — necessary because middy v6+
+ * does not re-run the `after` chain on the error path.
+ */
+/**
+ * Detect a shaped Lambda Proxy response.
+ *
+ * A response is "shaped" when it has a numeric `statusCode` property —
+ * the definitive marker of an API-Gateway-style response envelope.
+ * Missing `headers` or `body` are defaulted by {@link shapeResponse}
+ * rather than treated as "unshaped", because `{ statusCode, headers }`
+ * (no body) is a valid Lambda Proxy return value.
+ */
+const isShapedResponse = (v) => typeof v === 'object' &&
+    v !== null &&
+    'statusCode' in v &&
+    typeof v.statusCode === 'number';
+/**
+ * Shape the response into a well-formed Lambda Proxy result.
+ *
+ * Shaped responses (detected via {@link isShapedResponse}) are normalised
+ * in-place — missing `headers` and `body` are defaulted.  Non-shaped
+ * values are wrapped in a `200` envelope.
+ */
+const shapeResponse = (current, contentType) => {
+    let res;
+    if (isShapedResponse(current)) {
+        res = current;
+    }
+    else {
+        res = { statusCode: 200, headers: {}, body: current };
+    }
+    // Default missing fields for shaped responses without body/headers.
+    if (res.body === undefined)
+        res.body = '';
+    if (res.body !== undefined && typeof res.body !== 'string') {
+        try {
+            res.body = JSON.stringify(res.body);
+        }
+        catch {
+            res.body = String(res.body);
+        }
+    }
+    const headers = res.headers ?? {};
+    headers['Content-Type'] = contentType;
+    res.headers = headers;
+    return res;
+};
+/**
+ * Apply CORS headers to error responses.
+ *
+ * middy v6+ does not re-run the `after` chain after `onError` handles an
+ * error, so the regular CORS `after` hook never fires for error responses.
+ * This dedicated `onError` step runs *after* the error handler has set
+ * `request.response`, ensuring CORS headers are present on error responses.
+ */
+const makeOnErrorCors = (opts) => {
+    const cors = httpCors({
+        credentials: true,
+        getOrigin: (o) => o,
+        ...(opts?.cors ?? {}),
+    });
+    return tagStep({
+        onError: async (request) => {
+            if (request.response === undefined)
+                return;
+            if (cors.after)
+                await cors.after(request);
+        },
+    }, 'error-cors');
+};
+/**
+ * Shape error responses into well-formed Lambda Proxy results.
+ *
+ * Mirrors `makeShapeAndContentType` but runs on the `onError` path,
+ * ensuring error responses have proper `statusCode`, `headers`, and
+ * `body` structure even when the `after` chain is skipped.
+ */
+const makeOnErrorShape = (contentType) => tagStep({
+    onError: (request) => {
+        const container = request;
+        if (container.response === undefined)
+            return;
+        container.response = shapeResponse(container.response, contentType);
+    },
+}, 'error-shape');
+
 const makeHead = () => tagStep(shortCircuitHead, 'head');
 const makeHeaderNormalizer = (opts) => tagStep(asApiMiddleware(httpHeaderNormalizer(opts?.headerNormalizer ?? { canonical: true })), 'header-normalizer');
 const makeEventNormalizer = () => tagStep(asApiMiddleware(httpEventNormalizer()), 'event-normalizer');
@@ -529,31 +621,9 @@ const makeCors = (opts) => tagStep(asApiMiddleware(httpCors({
 const makeShapeAndContentType = (contentType) => tagStep({
     after: (request) => {
         const container = request;
-        const current = container.response;
-        if (current === undefined)
+        if (container.response === undefined)
             return;
-        const looksShaped = typeof current === 'object' &&
-            current !== null &&
-            'statusCode' in current &&
-            'headers' in current &&
-            'body' in current;
-        let res;
-        if (looksShaped)
-            res = current;
-        else
-            res = { statusCode: 200, headers: {}, body: current };
-        if (res.body !== undefined && typeof res.body !== 'string') {
-            try {
-                res.body = JSON.stringify(res.body);
-            }
-            catch {
-                res.body = String(res.body);
-            }
-        }
-        const headers = res.headers ?? {};
-        headers['Content-Type'] = contentType;
-        res.headers = headers;
-        request.response = res;
+        container.response = shapeResponse(container.response, contentType);
     },
 }, 'shape');
 const makeSerializer = (contentType, opts) => tagStep(asApiMiddleware(httpResponseSerializer({
@@ -589,7 +659,15 @@ const buildDefaultPhases = (args) => {
         makeShapeAndContentType(contentType),
         makeSerializer(contentType, opts),
     ];
-    const onError = [makeErrorExpose(), makeErrorHandler(opts)];
+    const onError = [
+        makeErrorExpose(),
+        makeErrorHandler(opts),
+        // Post-error-handler processing: middy v6+ does not re-run the after
+        // chain after onError, so CORS and response shaping must happen here.
+        // Shape first so CORS can mutate a well-formed headers object.
+        makeOnErrorShape(contentType),
+        makeOnErrorCors(opts),
+    ];
     return { before, after, onError };
 };
 const buildSafeDefaults = (args) => buildDefaultPhases(args);
@@ -789,14 +867,13 @@ function wrapHandler(functionConfig, business, opts) {
     assertKeysSubset(envConfig.stage.paramsSchema, envConfig.stage.envKeys, 'stage.envKeys');
     return async (event, context) => {
         // Compose typed env schema and parse process.env
-        const all = deriveAllKeys(envConfig.global.envKeys, envConfig.stage.envKeys, (functionConfig.fnEnvKeys ?? []));
+        const all = deriveAllKeys(envConfig.global.envKeys, envConfig.stage.envKeys, functionConfig.fnEnvKeys ?? []);
         const { globalPick, stagePick } = splitKeysBySchema(all, envConfig.global.paramsSchema, envConfig.stage.paramsSchema);
         const envSchema = buildEnvSchema(globalPick, stagePick, envConfig.global.paramsSchema, envConfig.stage.paramsSchema);
         const env = parseTypedEnv(envSchema, process.env);
         const logger = console;
         // Non-HTTP: call business directly
-        const httpTokens = opts?.httpEventTypeTokens ??
-            defaultHttpEventTypeTokens;
+        const httpTokens = opts?.httpEventTypeTokens ?? defaultHttpEventTypeTokens;
         const isHttp = httpTokens.includes(functionConfig.eventType);
         if (!isHttp) {
             return business(event, context, { env, logger });
@@ -859,9 +936,7 @@ const createRegistry = (deps) => {
                 ...(options.basePath ? { basePath: options.basePath } : {}),
                 ...(options.httpContexts ? { httpContexts: options.httpContexts } : {}),
                 ...(options.contentType ? { contentType: options.contentType } : {}),
-                ...(mergedFnEnvKeys.length
-                    ? { fnEnvKeys: mergedFnEnvKeys }
-                    : {}),
+                ...(mergedFnEnvKeys.length ? { fnEnvKeys: mergedFnEnvKeys } : {}),
                 ...(options.eventSchema ? { eventSchema: options.eventSchema } : {}),
                 ...(options.responseSchema
                     ? { responseSchema: options.responseSchema }
@@ -878,9 +953,7 @@ const createRegistry = (deps) => {
                 ...(options.basePath ? { basePath: options.basePath } : {}),
                 ...(options.httpContexts ? { httpContexts: options.httpContexts } : {}),
                 ...(options.contentType ? { contentType: options.contentType } : {}),
-                ...(mergedFnEnvKeys.length
-                    ? { fnEnvKeys: mergedFnEnvKeys }
-                    : {}),
+                ...(mergedFnEnvKeys.length ? { fnEnvKeys: mergedFnEnvKeys } : {}),
                 ...(options.eventSchema ? { eventSchema: options.eventSchema } : {}),
                 ...(options.responseSchema
                     ? { responseSchema: options.responseSchema }
@@ -1047,7 +1120,7 @@ const buildAllServerlessFunctions = (registry, serverless, buildFnEnv) => {
             .split(path.sep)
             .join('/');
         const handler = `${handlerFileRel}.${serverless.defaultHandlerFileExport}`;
-        let events = [];
+        let events;
         try {
             const { method, basePath, contexts } = resolveHttpFromFunctionConfig({
                 functionName: r.functionName,

package/dist/cli/index.cjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 'use strict';
 
-var cliHost = require('@karmaniverous/get-dotenv/cliHost');
+var cli = require('@karmaniverous/get-dotenv/cli');
 var plugins = require('@karmaniverous/get-dotenv/plugins');
+var cliHost = require('@karmaniverous/get-dotenv/cliHost');
 var packageDirectory = require('package-directory');
 var fs = require('node:fs');
 var path = require('node:path');
@@ -1340,138 +1341,135 @@ const runInit = async (root, template = 'default', opts) => {
  * delegates to existing implementations. No business logic here.
  */
 const repoRoot = () => packageDirectory.packageDirectorySync() ?? process.cwd();
-const smozPlugin = () => cliHost.definePlugin({
-    id: 'smoz',
-    setup(cli) {
-        // init
-        cli
-            .command('init')
-            .description('Scaffold a new SMOZ app from a template')
-            .option('-t, --template <name>', 'template name', 'default')
-            .option('-y, --yes', 'assume “example” on conflicts')
-            .option('--no-install', 'do not install dependencies')
-            .option('--install <pm>', 'explicit package manager (npm|pnpm|yarn|bun)')
-            .option('--conflict <policy>', 'overwrite|example|skip|ask')
-            .action(async (opts) => {
-            const root = repoRoot();
-            const template = typeof opts.template === 'string' ? opts.template : 'default';
-            const yes = Boolean(opts.yes);
-            const noInstall = opts.install === undefined &&
-                opts['noInstall'] !== undefined
-                ? Boolean(opts['noInstall'])
-                : Boolean(opts['noInstall']);
-            const pmRaw = opts.install ?? undefined;
-            const conflict = opts.conflict ?? undefined;
-            await runInit(root, template, {
-                ...(yes ? { yes } : {}),
-                ...(noInstall ? { noInstall } : {}),
-                ...(pmRaw ? { install: pmRaw } : {}),
-                ...(conflict ? { conflict } : {}),
-            });
-        });
-        // add
-        cli
-            .command('add')
-            .description('Scaffold a function under app/functions')
-            .argument('<spec>', 'spec: <eventType>/<segments...>/<method>')
-            .action(async (spec) => {
-            const root = repoRoot();
-            if (typeof spec !== 'string' || !spec.trim()) {
-                throw new Error('smoz add: missing <spec> (e.g., rest/foo/get)');
-            }
-            await runAdd(root, spec);
-        });
-        // register
-        cli
-            .command('register')
-            .description('Generate side-effect register files')
-            .action(async () => {
-            const root = repoRoot();
-            await runRegister(root);
-        });
-        // openapi
-        cli
-            .command('openapi')
-            .description('Generate OpenAPI document (app/generated/openapi.json)')
-            .option('-V, --verbose', 'verbose output')
-            .action(async (opts) => {
-            const root = repoRoot();
-            await runOpenapi(root, { verbose: !!opts.verbose });
+const setupSmozCommands = (cli) => {
+    // init
+    cli
+        .command('init')
+        .description('Scaffold a new SMOZ app from a template')
+        .option('-t, --template <name>', 'template name', 'default')
+        .option('-y, --yes', 'assume “example” on conflicts')
+        .option('--no-install', 'do not install dependencies')
+        .option('--install <pm>', 'explicit package manager (npm|pnpm|yarn|bun)')
+        .option('--conflict <policy>', 'overwrite|example|skip|ask')
+        .action(async (opts) => {
+        const root = repoRoot();
+        const template = typeof opts.template === 'string' ? opts.template : 'default';
+        const yes = Boolean(opts.yes);
+        const noInstall = Boolean(opts['noInstall']);
+        const pmRaw = opts.install ?? undefined;
+        const conflict = opts.conflict ?? undefined;
+        await runInit(root, template, {
+            ...(yes ? { yes } : {}),
+            ...(noInstall ? { noInstall } : {}),
+            ...(pmRaw ? { install: pmRaw } : {}),
+            ...(conflict ? { conflict } : {}),
         });
-        // dev
-        cli
-            .command('dev')
-            .description('Dev loop: register/openapi + local backend (inline|offline)')
-            .option('-r, --register', 'run register step (default on)')
-            .option('-R, --no-register', 'disable register step')
-            .option('-o, --openapi', 'run openapi step (default on)')
-            .option('-O, --no-openapi', 'disable openapi step')
-            .option('-l, --local [mode]', 'local mode: inline | offline | false (default inline)')
-            .option('-s, --stage <name>', 'stage name')
-            .option('-p, --port <number>', 'port (0 = random free port)')
-            .option('-V, --verbose', 'verbose output')
-            .action(async (opts) => {
-            const root = repoRoot();
-            // register/openapi defaults (on); explicit negations take precedence.
-            const register = opts.register === true
-                ? true
-                : opts.noRegister
-                    ? false
-                    : true;
-            const openapi = opts.openapi === true
-                ? true
-                : opts.noOpenapi
-                    ? false
-                    : true;
-            // local mode parsing
-            const raw = opts.local;
-            let local = 'inline';
-            if (raw === 'inline' || raw === 'offline')
-                local = raw;
-            else if (raw === true)
-                local = 'inline';
-            else if (raw === 'false')
-                local = false;
-            const port = typeof opts.port === 'string'
-                ? Number(opts.port)
-                : typeof opts.port === 'number'
-                    ? opts.port
-                    : undefined;
-            await runDev(root, {
-                register,
-                openapi,
-                local,
-                ...(typeof opts.stage === 'string' ? { stage: opts.stage } : {}),
-                ...(typeof port === 'number' ? { port } : {}),
-                verbose: !!opts.verbose,
-            });
+    });
+    // add
+    cli
+        .command('add')
+        .description('Scaffold a function under app/functions')
+        .argument('<spec>', 'spec: <eventType>/<segments...>/<method>')
+        .action(async (spec) => {
+        const root = repoRoot();
+        if (typeof spec !== 'string' || !spec.trim()) {
+            throw new Error('smoz add: missing <spec> (e.g., rest/foo/get)');
+        }
+        await runAdd(root, spec);
+    });
+    // register
+    cli
+        .command('register')
+        .description('Generate side-effect register files')
+        .action(async () => {
+        const root = repoRoot();
+        await runRegister(root);
+    });
+    // openapi
+    cli
+        .command('openapi')
+        .description('Generate OpenAPI document (app/generated/openapi.json)')
+        .option('-V, --verbose', 'verbose output')
+        .action(async (opts) => {
+        const root = repoRoot();
+        await runOpenapi(root, { verbose: !!opts.verbose });
+    });
+    // dev
+    cli
+        .command('dev')
+        .description('Dev loop: register/openapi + local backend (inline|offline)')
+        .option('-r, --register', 'run register step (default on)')
+        .option('-R, --no-register', 'disable register step')
+        .option('-o, --openapi', 'run openapi step (default on)')
+        .option('-O, --no-openapi', 'disable openapi step')
+        .option('-l, --local [mode]', 'local mode: inline | offline | false (default inline)')
+        .option('-s, --stage <name>', 'stage name')
+        .option('-p, --port <number>', 'port (0 = random free port)')
+        .option('-V, --verbose', 'verbose output')
+        .action(async (opts) => {
+        const root = repoRoot();
+        // register/openapi defaults (on); explicit negations take precedence.
+        const register = opts.register === true
+            ? true
+            : opts.noRegister
+                ? false
+                : true;
+        const openapi = opts.openapi === true
+            ? true
+            : opts.noOpenapi
+                ? false
+                : true;
+        // local mode parsing
+        const raw = opts.local;
+        let local = 'inline';
+        if (raw === 'inline' || raw === 'offline')
+            local = raw;
+        else if (raw === true)
+            local = 'inline';
+        else if (raw === 'false')
+            local = false;
+        const port = typeof opts.port === 'string'
+            ? Number(opts.port)
+            : typeof opts.port === 'number'
+                ? opts.port
+                : undefined;
+        await runDev(root, {
+            register,
+            openapi,
+            local,
+            ...(typeof opts.stage === 'string' ? { stage: opts.stage } : {}),
+            ...(typeof port === 'number' ? { port } : {}),
+            verbose: !!opts.verbose,
         });
-    },
+    });
+};
+const smozPlugin = () => cliHost.definePlugin({
+    ns: 'smoz',
+    setup: setupSmozCommands,
 });
 
 /**
  * SMOZ CLI — plugin-first host built on get-dotenv.
  *
- * - Build a GetDotenvCli host, install included plugins (cmd/batch/aws),
- *   and install the SMOZ command plugin (init/add/register/openapi/dev).
- * - Resolve dotenv context once, then parse argv.
+ * - Create the supported GetDotenv CLI runner so root options, resolution hooks,
+ *   and plugin installation stay aligned with the get-dotenv host API.
+ * - Install included plugins (cmd/batch/aws) and the SMOZ command plugin
+ *   (init/add/register/openapi/dev).
  */
-const main = async () => {
-    const cli = new cliHost.GetDotenvCli('smoz');
-    await cli.brand({
-        importMetaUrl: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)),
-        description: 'SMOZ CLI',
-    });
-    cli
-        .attachRootOptions()
-        .use(smozPlugin())
-        .use(plugins.awsPlugin())
-        .use(plugins.cmdPlugin({
-        asDefault: true,
-        optionAlias: '-c, --cmd <command...>',
-    }))
-        .use(plugins.batchPlugin())
-        .passOptions();
-    await cli.parseAsync();
-};
+const main = cli.createCli({
+    alias: 'smoz',
+    compose: (cli) => {
+        const setupResult = smozPlugin().setup(cli);
+        if (setupResult !== undefined) {
+            throw new Error('smozPlugin root setup must remain synchronous.');
+        }
+        return cli
+            .use(plugins.awsPlugin())
+            .use(plugins.cmdPlugin({
+            asDefault: true,
+            optionAlias: '-c, --cmd <command...>',
+        }))
+            .use(plugins.batchPlugin());
+    },
+});
 void main();

package/dist/index.d.ts

@@ -264,7 +264,7 @@ type ConsoleLogger = Pick<Console, 'debug' | 'error' | 'info' | 'log'>;
  */
 
 type ApiMiddleware$1 = MiddlewareObj<APIGatewayProxyEvent, Context>;
-type StepId = 'head' | 'header-normalizer' | 'event-normalizer' | 'content-negotiation' | 'json-body-parser' | 'zod-before' | 'head-finalize' | 'zod-after' | 'error-expose' | 'error-handler' | 'cors' | 'preferred-media' | 'shape' | 'serializer';
+type StepId = 'head' | 'header-normalizer' | 'event-normalizer' | 'content-negotiation' | 'json-body-parser' | 'zod-before' | 'head-finalize' | 'zod-after' | 'error-expose' | 'error-handler' | 'error-cors' | 'error-shape' | 'cors' | 'preferred-media' | 'shape' | 'serializer';
 /** Attach a non-enumerable __id to a middleware step. */
 declare const tagStep: (mw: ApiMiddleware$1, id: StepId) => ApiMiddleware$1;
 /** Retrieve a step's id, if present. */

package/dist/mjs/cli/inline-server.js

@@ -190,8 +190,7 @@ const loadHandlers = async (root, app) => {
         if (typeof handler !== 'function')
             continue;
         for (const evt of def.events) {
-            const httpEvt = evt
-                .http;
+            const httpEvt = evt.http;
             const method = (httpEvt?.method ?? '').toUpperCase();
             const pattern = '/' + (httpEvt?.path ?? '').replace(/^\/+/, '');
             if (!method || !pattern)

package/dist/mjs/index.js

@@ -373,6 +373,98 @@ const wrapSerializer = (fn, opts) => {
     });
 };
 
+/**
+ * @module Response shaping helpers for HTTP middleware.
+ *
+ * Shared utilities for detecting and normalising Lambda Proxy response
+ * envelopes, used by both the `after` and `onError` middleware paths.
+ * Also exports dedicated `onError` steps that apply CORS headers and
+ * response shaping after `errorHandler` — necessary because middy v6+
+ * does not re-run the `after` chain on the error path.
+ */
+/**
+ * Detect a shaped Lambda Proxy response.
+ *
+ * A response is "shaped" when it has a numeric `statusCode` property —
+ * the definitive marker of an API-Gateway-style response envelope.
+ * Missing `headers` or `body` are defaulted by {@link shapeResponse}
+ * rather than treated as "unshaped", because `{ statusCode, headers }`
+ * (no body) is a valid Lambda Proxy return value.
+ */
+const isShapedResponse = (v) => typeof v === 'object' &&
+    v !== null &&
+    'statusCode' in v &&
+    typeof v.statusCode === 'number';
+/**
+ * Shape the response into a well-formed Lambda Proxy result.
+ *
+ * Shaped responses (detected via {@link isShapedResponse}) are normalised
+ * in-place — missing `headers` and `body` are defaulted.  Non-shaped
+ * values are wrapped in a `200` envelope.
+ */
+const shapeResponse = (current, contentType) => {
+    let res;
+    if (isShapedResponse(current)) {
+        res = current;
+    }
+    else {
+        res = { statusCode: 200, headers: {}, body: current };
+    }
+    // Default missing fields for shaped responses without body/headers.
+    if (res.body === undefined)
+        res.body = '';
+    if (res.body !== undefined && typeof res.body !== 'string') {
+        try {
+            res.body = JSON.stringify(res.body);
+        }
+        catch {
+            res.body = String(res.body);
+        }
+    }
+    const headers = res.headers ?? {};
+    headers['Content-Type'] = contentType;
+    res.headers = headers;
+    return res;
+};
+/**
+ * Apply CORS headers to error responses.
+ *
+ * middy v6+ does not re-run the `after` chain after `onError` handles an
+ * error, so the regular CORS `after` hook never fires for error responses.
+ * This dedicated `onError` step runs *after* the error handler has set
+ * `request.response`, ensuring CORS headers are present on error responses.
+ */
+const makeOnErrorCors = (opts) => {
+    const cors = httpCors({
+        credentials: true,
+        getOrigin: (o) => o,
+        ...(opts?.cors ?? {}),
+    });
+    return tagStep({
+        onError: async (request) => {
+            if (request.response === undefined)
+                return;
+            if (cors.after)
+                await cors.after(request);
+        },
+    }, 'error-cors');
+};
+/**
+ * Shape error responses into well-formed Lambda Proxy results.
+ *
+ * Mirrors `makeShapeAndContentType` but runs on the `onError` path,
+ * ensuring error responses have proper `statusCode`, `headers`, and
+ * `body` structure even when the `after` chain is skipped.
+ */
+const makeOnErrorShape = (contentType) => tagStep({
+    onError: (request) => {
+        const container = request;
+        if (container.response === undefined)
+            return;
+        container.response = shapeResponse(container.response, contentType);
+    },
+}, 'error-shape');
+
 const makeHead = () => tagStep(shortCircuitHead, 'head');
 const makeHeaderNormalizer = (opts) => tagStep(asApiMiddleware(httpHeaderNormalizer(opts?.headerNormalizer ?? { canonical: true })), 'header-normalizer');
 const makeEventNormalizer = () => tagStep(asApiMiddleware(httpEventNormalizer()), 'event-normalizer');
@@ -527,31 +619,9 @@ const makeCors = (opts) => tagStep(asApiMiddleware(httpCors({
 const makeShapeAndContentType = (contentType) => tagStep({
     after: (request) => {
         const container = request;
-        const current = container.response;
-        if (current === undefined)
+        if (container.response === undefined)
             return;
-        const looksShaped = typeof current === 'object' &&
-            current !== null &&
-            'statusCode' in current &&
-            'headers' in current &&
-            'body' in current;
-        let res;
-        if (looksShaped)
-            res = current;
-        else
-            res = { statusCode: 200, headers: {}, body: current };
-        if (res.body !== undefined && typeof res.body !== 'string') {
-            try {
-                res.body = JSON.stringify(res.body);
-            }
-            catch {
-                res.body = String(res.body);
-            }
-        }
-        const headers = res.headers ?? {};
-        headers['Content-Type'] = contentType;
-        res.headers = headers;
-        request.response = res;
+        container.response = shapeResponse(container.response, contentType);
     },
 }, 'shape');
 const makeSerializer = (contentType, opts) => tagStep(asApiMiddleware(httpResponseSerializer({
@@ -587,7 +657,15 @@ const buildDefaultPhases = (args) => {
         makeShapeAndContentType(contentType),
         makeSerializer(contentType, opts),
     ];
-    const onError = [makeErrorExpose(), makeErrorHandler(opts)];
+    const onError = [
+        makeErrorExpose(),
+        makeErrorHandler(opts),
+        // Post-error-handler processing: middy v6+ does not re-run the after
+        // chain after onError, so CORS and response shaping must happen here.
+        // Shape first so CORS can mutate a well-formed headers object.
+        makeOnErrorShape(contentType),
+        makeOnErrorCors(opts),
+    ];
     return { before, after, onError };
 };
 const buildSafeDefaults = (args) => buildDefaultPhases(args);
@@ -787,14 +865,13 @@ function wrapHandler(functionConfig, business, opts) {
     assertKeysSubset(envConfig.stage.paramsSchema, envConfig.stage.envKeys, 'stage.envKeys');
     return async (event, context) => {
         // Compose typed env schema and parse process.env
-        const all = deriveAllKeys(envConfig.global.envKeys, envConfig.stage.envKeys, (functionConfig.fnEnvKeys ?? []));
+        const all = deriveAllKeys(envConfig.global.envKeys, envConfig.stage.envKeys, functionConfig.fnEnvKeys ?? []);
         const { globalPick, stagePick } = splitKeysBySchema(all, envConfig.global.paramsSchema, envConfig.stage.paramsSchema);
         const envSchema = buildEnvSchema(globalPick, stagePick, envConfig.global.paramsSchema, envConfig.stage.paramsSchema);
         const env = parseTypedEnv(envSchema, process.env);
         const logger = console;
         // Non-HTTP: call business directly
-        const httpTokens = opts?.httpEventTypeTokens ??
-            defaultHttpEventTypeTokens;
+        const httpTokens = opts?.httpEventTypeTokens ?? defaultHttpEventTypeTokens;
         const isHttp = httpTokens.includes(functionConfig.eventType);
         if (!isHttp) {
             return business(event, context, { env, logger });
@@ -857,9 +934,7 @@ const createRegistry = (deps) => {
                 ...(options.basePath ? { basePath: options.basePath } : {}),
                 ...(options.httpContexts ? { httpContexts: options.httpContexts } : {}),
                 ...(options.contentType ? { contentType: options.contentType } : {}),
-                ...(mergedFnEnvKeys.length
-                    ? { fnEnvKeys: mergedFnEnvKeys }
-                    : {}),
+                ...(mergedFnEnvKeys.length ? { fnEnvKeys: mergedFnEnvKeys } : {}),
                 ...(options.eventSchema ? { eventSchema: options.eventSchema } : {}),
                 ...(options.responseSchema
                     ? { responseSchema: options.responseSchema }
@@ -876,9 +951,7 @@ const createRegistry = (deps) => {
                 ...(options.basePath ? { basePath: options.basePath } : {}),
                 ...(options.httpContexts ? { httpContexts: options.httpContexts } : {}),
                 ...(options.contentType ? { contentType: options.contentType } : {}),
-                ...(mergedFnEnvKeys.length
-                    ? { fnEnvKeys: mergedFnEnvKeys }
-                    : {}),
+                ...(mergedFnEnvKeys.length ? { fnEnvKeys: mergedFnEnvKeys } : {}),
                 ...(options.eventSchema ? { eventSchema: options.eventSchema } : {}),
                 ...(options.responseSchema
                     ? { responseSchema: options.responseSchema }
@@ -1045,7 +1118,7 @@ const buildAllServerlessFunctions = (registry, serverless, buildFnEnv) => {
             .split(sep)
             .join('/');
         const handler = `${handlerFileRel}.${serverless.defaultHandlerFileExport}`;
-        let events = [];
+        let events;
         try {
             const { method, basePath, contexts } = resolveHttpFromFunctionConfig({
                 functionName: r.functionName,

package/package.json

@@ -13,64 +13,63 @@
     "url": "https://github.com/karmaniverous/smoz/issues"
   },
   "dependencies": {
-    "@karmaniverous/get-dotenv": "^5.2.6",
-    "@middy/core": "^6.4.5",
-    "@middy/http-content-negotiation": "^6.4.5",
-    "@middy/http-cors": "^6.4.5",
-    "@middy/http-error-handler": "^6.4.5",
-    "@middy/http-event-normalizer": "^6.4.5",
-    "@middy/http-header-normalizer": "^6.4.5",
-    "@middy/http-json-body-parser": "^6.4.5",
-    "@middy/http-response-serializer": "^6.4.5",
+    "@karmaniverous/get-dotenv": "^7.0.11",
+    "@middy/core": "^7.7.0",
+    "@middy/http-content-negotiation": "^7.7.0",
+    "@middy/http-cors": "^7.7.0",
+    "@middy/http-error-handler": "^7.7.0",
+    "@middy/http-event-normalizer": "^7.7.0",
+    "@middy/http-header-normalizer": "^7.7.0",
+    "@middy/http-json-body-parser": "^7.7.0",
+    "@middy/http-response-serializer": "^7.7.0",
     "aws-lambda": "^1.0.7",
-    "chokidar": "^4.0.3",
+    "chokidar": "^5.0.0",
     "http-errors": "^2.0.1",
-    "package-directory": "^8.1.0",
+    "package-directory": "^8.2.0",
     "radash": "^12.1.1",
-    "zod": "^4.1.13"
+    "zod": "^4.4.3"
   },
   "description": "John Galt Services back end.",
   "devDependencies": {
-    "@dotenvx/dotenvx": "^1.51.1",
-    "@eslint/js": "^9.39.1",
+    "@dotenvx/dotenvx": "^2.10.0",
+    "@eslint/js": "^10.0.1",
     "@rollup/plugin-alias": "^6.0.0",
     "@rollup/plugin-typescript": "^12.3.0",
-    "@serverless/typescript": "^4.23.0",
-    "@types/aws-lambda": "^8.10.159",
+    "@serverless/typescript": "^4.30.0",
+    "@types/aws-lambda": "^8.10.162",
     "@types/fs-extra": "^11.0.4",
     "@types/http-errors": "^2.0.5",
-    "@types/node": "^24",
-    "@types/serverless": "^3.12.27",
-    "@vitest/coverage-v8": "^4.0.13",
-    "auto-changelog": "^2.5.0",
-    "eslint": "^9.39.1",
+    "@types/node": "^26",
+    "@types/serverless": "^3.12.28",
+    "@vitest/coverage-v8": "^4.1.10",
+    "auto-changelog": "^2.6.0",
+    "eslint": "^10.7.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.4",
-    "eslint-plugin-simple-import-sort": "^12.1.1",
-    "fs-extra": "^11.3.2",
-    "knip": "^5.70.2",
-    "lefthook": "^2.0.4",
-    "prettier": "^3.6.2",
-    "release-it": "^19.0.6",
-    "rimraf": "^6.1.2",
-    "rollup": "^4.53.3",
-    "rollup-plugin-dts": "^6.2.3",
-    "serverless": "^4.25.0",
+    "eslint-plugin-prettier": "^5.5.6",
+    "eslint-plugin-simple-import-sort": "^13.0.0",
+    "fs-extra": "^11.3.6",
+    "knip": "^6.27.0",
+    "lefthook": "^2.1.10",
+    "prettier": "^3.9.5",
+    "release-it": "^20.2.1",
+    "rimraf": "^6.1.3",
+    "rollup": "^4.62.2",
+    "rollup-plugin-dts": "^6.4.1",
+    "serverless": "^4.39.0",
     "serverless-apigateway-log-retention": "^1.1.0",
     "serverless-deployment-bucket": "^1.6.0",
-    "serverless-domain-manager": "^8.0.0",
-    "serverless-offline": "^14.4.0",
+    "serverless-domain-manager": "^10.2.0",
+    "serverless-offline": "^14.7.4",
     "serverless-plugin-common-excludes": "^4.0.0",
-    "tsx": "^4.20.6",
-    "typedoc": "^0.28.14",
-    "typedoc-plugin-mdn-links": "^5.0.10",
+    "tsx": "^4.23.1",
+    "typedoc": "^0.28.20",
+    "typedoc-plugin-mdn-links": "^5.1.1",
     "typedoc-plugin-replace-text": "^4.2.0",
     "typedoc-plugin-zod": "^1.4.3",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.48.0",
-    "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^4.0.13",
-    "zod-openapi": "^5.4.3"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.64.0",
+    "vitest": "^4.1.10",
+    "zod-openapi": "^6.0.0"
   },
   "engines": {
     "node": ">=22.19.0"
@@ -184,7 +183,7 @@
     "templates:lint": "eslint --fix -c templates/default/eslint.config.ts \"templates/default/**/*.{ts,tsx,js,jsx}\" \"templates/default/eslint.config.ts\""
   },
   "type": "module",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "volta": {
     "node": "22.19.0"
   }