@nestia/core 14.0.0 → 14.0.2

package/lib/decorators/EncryptedBody.d.ts

@@ -3,21 +3,29 @@ import { IRequestBodyValidator } from "../options/IRequestBodyValidator";
  * Encrypted body decorator.
  *
  * `EncryptedBody` is a decorator function getting `application/json` typed data
- * from request body which has been encrypted by AES-128/256 algorithm. Also,
- * `EncryptedBody` validates the request body data type through
- * [typia](https://github.com/samchon/typia) ad the validation speed is maximum
- * 15,000x times faster than `class-validator`.
+ * from request body which has been encrypted by AES-128/192/256 algorithm.
+ * Also, `EncryptedBody` validates the request body data type through
+ * [typia](https://github.com/samchon/typia) using the declared TypeScript
+ * type.
  *
  * For reference, when the request body data is not following the promised type
  * `T`, `BadRequestException` error (status code: 400) would be thrown. Also,
- * `EncryptedRoute` decrypts request body using those options.
+ * This decorator decrypts the request body using these options.
  *
- * - AES-128/256
+ * - AES-128/192/256
  * - CBC mode
  * - PKCS #5 Padding
  * - Base64 Encoding
  *
+ * Successful validator data becomes the decorated argument, including copies
+ * returned by clone validators after decryption and JSON parsing.
+ *
  * @author Jeongho Nam - https://github.com/samchon
  * @returns Parameter decorator
+ * @evidence contracts/common.md#principled-implementation The body must be `text/plain` ciphertext; it is decrypted with the password of the controller or module, the plain text is parsed as JSON and validated by the transformed validator, and a decryption or parse failure becomes a 400 with one fixed message that does not echo the ciphertext and does not tell the two failures apart; a key or initialization vector the cipher itself refuses is the server's configuration, independent of the request, and is thrown as it is.
+ * @evidence contracts/common.md#clear-and-simple-design One parameter decorator composes shared text reading, password lookup and validator resolution; the successfully resolved data becomes the argument without repeating validation or changing decryption error handling.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The algorithm comes from `AesPkcs5` of the fetcher, the same one the client uses, and no key is embedded; a missing password is an error rather than a plain pass-through.
+ * @evidence contracts/common.md#meaningful-documentation The comment describes the protocol and the requirement of a password on the controller or module, and the private decode helper documents why every decryption failure collapses into one response.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Ciphertext parsing, AES decryption and request validation operate on HTTP values, with no native filesystem or subprocess boundary.
  */
 export declare function EncryptedBody<T>(validator?: IRequestBodyValidator<T>): ParameterDecorator;

package/lib/decorators/EncryptedBody.js

@@ -13,7 +13,7 @@ exports.EncryptedBody = EncryptedBody;
 const AesPkcs5_1 = require("@nestia/fetcher/lib/AesPkcs5");
 const common_1 = require("@nestjs/common");
 const Singleton_1 = require("../utils/Singleton");
-const EncryptedConstant_1 = require("./internal/EncryptedConstant");
+const get_encryption_password_1 = require("./internal/get_encryption_password");
 const get_text_body_1 = require("./internal/get_text_body");
 const headers_to_object_1 = require("./internal/headers_to_object");
 const is_media_type_1 = require("./internal/is_media_type");
@@ -22,22 +22,30 @@ const validate_request_body_1 = require("./internal/validate_request_body");
  * Encrypted body decorator.
  *
  * `EncryptedBody` is a decorator function getting `application/json` typed data
- * from request body which has been encrypted by AES-128/256 algorithm. Also,
- * `EncryptedBody` validates the request body data type through
- * [typia](https://github.com/samchon/typia) ad the validation speed is maximum
- * 15,000x times faster than `class-validator`.
+ * from request body which has been encrypted by AES-128/192/256 algorithm.
+ * Also, `EncryptedBody` validates the request body data type through
+ * [typia](https://github.com/samchon/typia) using the declared TypeScript
+ * type.
  *
  * For reference, when the request body data is not following the promised type
  * `T`, `BadRequestException` error (status code: 400) would be thrown. Also,
- * `EncryptedRoute` decrypts request body using those options.
+ * This decorator decrypts the request body using these options.
  *
- * - AES-128/256
+ * - AES-128/192/256
  * - CBC mode
  * - PKCS #5 Padding
  * - Base64 Encoding
  *
+ * Successful validator data becomes the decorated argument, including copies
+ * returned by clone validators after decryption and JSON parsing.
+ *
  * @author Jeongho Nam - https://github.com/samchon
  * @returns Parameter decorator
+ * @evidence contracts/common.md#principled-implementation The body must be `text/plain` ciphertext; it is decrypted with the password of the controller or module, the plain text is parsed as JSON and validated by the transformed validator, and a decryption or parse failure becomes a 400 with one fixed message that does not echo the ciphertext and does not tell the two failures apart; a key or initialization vector the cipher itself refuses is the server's configuration, independent of the request, and is thrown as it is.
+ * @evidence contracts/common.md#clear-and-simple-design One parameter decorator composes shared text reading, password lookup and validator resolution; the successfully resolved data becomes the argument without repeating validation or changing decryption error handling.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The algorithm comes from `AesPkcs5` of the fetcher, the same one the client uses, and no key is embedded; a missing password is an error rather than a plain pass-through.
+ * @evidence contracts/common.md#meaningful-documentation The comment describes the protocol and the requirement of a password on the controller or module, and the private decode helper documents why every decryption failure collapses into one response.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Ciphertext parsing, AES decryption and request validation operate on HTTP values, with no native filesystem or subprocess boundary.
  */
 function EncryptedBody(validator) {
     const checker = (0, validate_request_body_1.validate_request_body)("EncryptedBody")(validator);
@@ -48,7 +56,7 @@ function EncryptedBody(validator) {
                 .getRequest();
             if ((0, is_media_type_1.is_media_type)(request.headers["content-type"], "text/plain") === false)
                 throw new common_1.BadRequestException(`Request body type is not "text/plain".`);
-            const param = Reflect.getMetadata(EncryptedConstant_1.ENCRYPTION_METADATA_KEY, context.getClass());
+            const param = (0, get_encryption_password_1.get_encryption_password)(context.getClass());
             if (!param)
                 throw new Error("Error on nestia.core.EncryptedBody(): no encryption password is given.");
             // GET BODY DATA
@@ -59,10 +67,10 @@ function EncryptedBody(validator) {
                 : param;
             // PARSE AND VALIDATE DATA
             const data = decode(body, password.key, password.iv);
-            const error = checker(data);
-            if (error !== null)
-                throw error;
-            return data;
+            const result = checker.resolve(data);
+            if (!result.success)
+                throw result.error;
+            return result.data;
         });
     })();
 }
@@ -79,9 +87,13 @@ function EncryptedBody(validator) {
  *
  * Both failure modes must therefore collapse into one indistinguishable
  * `BadRequestException` (identical status, message, and body). Only the
- * downstream type validation of an already-parsed body may report its own
- * distinct error, because reaching it requires plaintext the attacker cannot
- * forge without already knowing it.
+ * downstream type validation of an already-parsed body reports its own distinct
+ * error. AES-CBC provides no authentication; collapsing parse and padding
+ * errors does not establish ciphertext authenticity.
+ *
+ * A key or initialization vector the cipher refuses is thrown as it is. It says
+ * nothing about the body, so it opens no oracle, and it is a defect of the
+ * server's configuration that a 400 would blame on the client.
  *
  * @internal
  */
@@ -90,10 +102,21 @@ const decode = (body, key, iv) => {
         return JSON.parse(AesPkcs5_1.AesPkcs5.decrypt(body, key, iv));
     }
     catch (exp) {
-        if (exp instanceof Error)
+        // A password the cipher itself refuses is the server's configuration, which
+        // no request body can influence, so it is no oracle and no client's fault.
+        if (exp instanceof Error && PASSWORD_ERRORS.has(exp.code))
+            throw exp;
+        else if (exp instanceof Error)
             throw new common_1.BadRequestException("Failed to decrypt the request body. Check your body content or encryption password.");
         else
             throw exp;
     }
 };
+/** The error codes of a key or an initialization vector the cipher refuses. */
+const PASSWORD_ERRORS = new Set([
+    "ERR_INVALID_ARG_TYPE",
+    "ERR_CRYPTO_INVALID_IV",
+    "ERR_CRYPTO_INVALID_KEYLEN",
+    "ERR_CRYPTO_UNKNOWN_CIPHER",
+]);
 //# sourceMappingURL=EncryptedBody.js.map

package/lib/decorators/EncryptedBody.js.map

@@ -1 +1 @@
-{"version":3,"file":"EncryptedBody.js","sourceRoot":"","sources":["../../src/decorators/EncryptedBody.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2DAAwD;AACxD,2CAIwB;AAKxB,kDAA+C;AAC/C,oEAAuE;AACvE,4DAAyD;AACzD,oEAAiE;AACjE,4DAAyD;AACzD,4EAAyE;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,uBACE,SAAoC;IAEpC,MAAM,OAAO,GAAG,IAAA,6CAAqB,EAAC,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC;IAClE,OAAO,IAAA,6BAAoB,EAAC,SAAe,aAAa,CACtD,QAAa,EACb,OAAyB;;YAEzB,MAAM,OAAO,GAAqC,OAAO;iBACtD,YAAY,EAAE;iBACd,UAAU,EAAE,CAAC;YAChB,IAAI,IAAA,6BAAa,EAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,KAAK,KAAK;gBACxE,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;YAE1E,MAAM,KAAK,GACT,OAAO,CAAC,WAAW,CAAC,2CAAuB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;YAEJ,gBAAgB;YAChB,MAAM,OAAO,GAAsC,IAAI,qBAAS,CAAC,GAAG,EAAE,CACpE,IAAA,qCAAiB,EAAC,OAAO,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,MAAM,IAAI,GAAW,MAAM,IAAA,6BAAa,EAAC,OAAO,CAAC,CAAC;YAClD,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,UAAU;gBACzB,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;gBAC9D,CAAC,CAAC,KAAK,CAAC;YAEZ,0BAA0B;YAC1B,MAAM,IAAI,GAAQ,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAiB,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,KAAK,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;KAAA,CAAC,EAAE,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAU,EAAW,EAAE;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK;YACtB,MAAM,IAAI,4BAAmB,CAC3B,qFAAqF,CACtF,CAAC;;YACC,MAAM,GAAG,CAAC;IACjB,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"EncryptedBody.js","sourceRoot":"","sources":["../../src/decorators/EncryptedBody.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,2DAAwD;AACxD,2CAIwB;AAKxB,kDAA+C;AAC/C,gFAA6E;AAC7E,4DAAyD;AACzD,oEAAiE;AACjE,4DAAyD;AACzD,4EAAyE;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,uBACE,SAAoC;IAEpC,MAAM,OAAO,GAAG,IAAA,6CAAqB,EAAC,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC;IAClE,OAAO,IAAA,6BAAoB,EAAC,SAAe,aAAa,CACtD,QAAa,EACb,OAAyB;;YAEzB,MAAM,OAAO,GAAqC,OAAO;iBACtD,YAAY,EAAE;iBACd,UAAU,EAAE,CAAC;YAChB,IAAI,IAAA,6BAAa,EAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,KAAK,KAAK;gBACxE,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;YAE1E,MAAM,KAAK,GACT,IAAA,iDAAuB,EAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;YAEJ,gBAAgB;YAChB,MAAM,OAAO,GAAsC,IAAI,qBAAS,CAAC,GAAG,EAAE,CACpE,IAAA,qCAAiB,EAAC,OAAO,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,MAAM,IAAI,GAAW,MAAM,IAAA,6BAAa,EAAC,OAAO,CAAC,CAAC;YAClD,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,UAAU;gBACzB,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;gBAC9D,CAAC,CAAC,KAAK,CAAC;YAEZ,0BAA0B;YAC1B,MAAM,IAAI,GAAQ,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC;YACxC,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;KAAA,CAAC,EAAE,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAU,EAAW,EAAE;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,GAAG,YAAY,KAAK,IAAI,eAAe,CAAC,GAAG,CAAE,GAAW,CAAC,IAAI,CAAC;YAChE,MAAM,GAAG,CAAC;aACP,IAAI,GAAG,YAAY,KAAK;YAC3B,MAAM,IAAI,4BAAmB,CAC3B,qFAAqF,CACtF,CAAC;;YACC,MAAM,GAAG,CAAC;IACjB,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,eAAe,GAAiB,IAAI,GAAG,CAAC;IAC5C,sBAAsB;IACtB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC,CAAC"}

package/lib/decorators/EncryptedController.d.ts

@@ -3,7 +3,7 @@ import { IEncryptionPassword } from "@nestia/fetcher";
  * Encrypted controller.
  *
  * `EncryptedController` is an extension of the {@link nest.Controller} class
- * decorator function who configures encryption password of the AES-128/256
+ * decorator function who configures encryption password of the AES-128/192/256
  * algorithm. The encryption algorithm and password would be used by
  * {@link EncryptedRoute} and {@link EncryptedBody} to encrypt the request and
  * response body of the HTTP protocol.
@@ -24,5 +24,10 @@ import { IEncryptionPassword } from "@nestia/fetcher";
  * @param path Path of the HTTP request
  * @param password Encryption password or its getter function
  * @returns Class decorator
+ * @evidence contracts/common.md#principled-implementation The decorator stores the password as metadata on the class and then applies Nest's `Controller(path)`, so the encrypted decorators can find the password by reading the class.
+ * @evidence contracts/common.md#clear-and-simple-design One decorator that composes a metadata write with the standard decorator.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts It uses Nest's public `Controller` decorator and the reflect metadata API.
+ * @evidence contracts/common.md#meaningful-documentation The comment states the password forms and the encrypted decorators it enables.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Controller paths are HTTP routing metadata and passwords are in-memory values; neither is a native filesystem path.
  */
 export declare function EncryptedController(path: string, password: IEncryptionPassword | IEncryptionPassword.Closure): ClassDecorator;

package/lib/decorators/EncryptedController.js

@@ -7,7 +7,7 @@ const EncryptedConstant_1 = require("./internal/EncryptedConstant");
  * Encrypted controller.
  *
  * `EncryptedController` is an extension of the {@link nest.Controller} class
- * decorator function who configures encryption password of the AES-128/256
+ * decorator function who configures encryption password of the AES-128/192/256
  * algorithm. The encryption algorithm and password would be used by
  * {@link EncryptedRoute} and {@link EncryptedBody} to encrypt the request and
  * response body of the HTTP protocol.
@@ -28,10 +28,15 @@ const EncryptedConstant_1 = require("./internal/EncryptedConstant");
  * @param path Path of the HTTP request
  * @param password Encryption password or its getter function
  * @returns Class decorator
+ * @evidence contracts/common.md#principled-implementation The decorator stores the password as metadata on the class and then applies Nest's `Controller(path)`, so the encrypted decorators can find the password by reading the class.
+ * @evidence contracts/common.md#clear-and-simple-design One decorator that composes a metadata write with the standard decorator.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts It uses Nest's public `Controller` decorator and the reflect metadata API.
+ * @evidence contracts/common.md#meaningful-documentation The comment states the password forms and the encrypted decorators it enables.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Controller paths are HTTP routing metadata and passwords are in-memory values; neither is a native filesystem path.
  */
 function EncryptedController(path, password) {
     return function (target) {
-        Reflect.defineMetadata(EncryptedConstant_1.ENCRYPTION_METADATA_KEY, password, target);
+        Reflect.defineMetadata(EncryptedConstant_1.ENCRYPTION_CONTROLLER_METADATA_KEY, password, target);
         (0, common_1.Controller)(path)(target);
     };
 }

package/lib/decorators/EncryptedController.js.map

@@ -1 +1 @@
-{"version":3,"file":"EncryptedController.js","sourceRoot":"","sources":["../../src/decorators/EncryptedController.ts"],"names":[],"mappings":";;;AACA,2CAA4C;AAE5C,oEAAuE;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,6BACE,IAAY,EACZ,QAA2D;IAE3D,OAAO,UAAU,MAAW;QAC1B,OAAO,CAAC,cAAc,CAAC,2CAAuB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,IAAA,mBAAU,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"EncryptedController.js","sourceRoot":"","sources":["../../src/decorators/EncryptedController.ts"],"names":[],"mappings":";;;AACA,2CAA4C;AAE5C,oEAAkF;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,6BACE,IAAY,EACZ,QAA2D;IAE3D,OAAO,UAAU,MAAW;QAC1B,OAAO,CAAC,cAAc,CACpB,sDAAkC,EAClC,QAAQ,EACR,MAAM,CACP,CAAC;QACF,IAAA,mBAAU,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/lib/decorators/EncryptedModule.d.ts

@@ -4,16 +4,20 @@ import { Module } from "@nestjs/common";
  * Encrypted module.
  *
  * `EncryptedModule` is an extension of the {@link Module} class decorator
- * function who configures encryption password of the AES-128/256 algorithm. The
- * encryption algorithm and password would be used by {@link EncryptedRoute} and
- * {@link EncryptedBody} to encrypt the request and response bod of the HTTP
+ * function who configures encryption password of the AES-128/192/256 algorithm.
+ * The encryption algorithm and password would be used by {@link EncryptedRoute}
+ * and {@link EncryptedBody} to encrypt the request and response bod of the HTTP
  * protocol.
  *
  * By using this `EncryptedModule` decorator function, all of the
  * {@link Controller controllers} configured in the _metadata_ would be
- * automatically changed to the {@link EncryptedController} with the _password_.
- * If there're some original {@link EncryptedController} decorated classes in the
- * _metadata_, their encryption password would be kept.
+ * automatically changed to the {@link EncryptedController} with the _password_,
+ * and so would the controllers of every module it imports: module classes,
+ * dynamic modules (`{ module, imports, controllers }`), `forwardRef()`s, and
+ * promises of them, however deep and even when cyclic. If there're some
+ * original {@link EncryptedController} decorated classes in the _metadata_,
+ * their encryption password would be kept, as would a subclass's that inherits
+ * one.
  *
  * Therefore, if you're planning to place original {@link EncryptedController}
  * decorated classes in the _metadata_, I hope them to have different encryption
@@ -29,8 +33,23 @@ import { Module } from "@nestjs/common";
  * @param metadata Module configuration metadata
  * @param password Encryption password or its getter function
  * @returns Class decorator
+ * @evidence contracts/common.md#principled-implementation A visited set breaks import cycles, the controllers of each visited module get the password as metadata, asynchronous modules are awaited through the same promise Nest awaits, and a forward reference is resolved once its class exists.
+ * @evidence contracts/common.md#clear-and-simple-design One decorator whose traversal is a private function; the dynamic-module helper is in the merged namespace.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The traversal uses the public metadata keys of Nest modules; no module name is special-cased.
+ * @evidence contracts/common.md#meaningful-documentation The comment states which module shapes are followed.
+ * @evidence contracts/portability.md#os-neutral-implementation The decorator traverses Nest module metadata in memory; its dynamic helper delegates native paths and file-URL imports to load_controllers instead of composing platform-specific import strings.
  */
 export declare function EncryptedModule(metadata: Parameters<typeof Module>[0], password: IEncryptionPassword.Closure): ClassDecorator;
+/**
+ * Helpers of {@link EncryptedModule}, namely `dynamic`, which builds an
+ * encrypted module from controller paths.
+ *
+ * @evidence contracts/common.md#principled-implementation `dynamic` loads the controllers with the shared loader, wraps an object password into a closure, and returns a class decorated by `EncryptedModule`.
+ * @evidence contracts/common.md#clear-and-simple-design One function that reuses the loader and the decorator.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Paths and password are caller input.
+ * @evidence contracts/common.md#meaningful-documentation The comment documents the path forms and the password argument.
+ * @evidence contracts/portability.md#os-neutral-implementation The decorator traverses Nest module metadata in memory; its dynamic helper delegates native paths and file-URL imports to load_controllers instead of composing platform-specific import strings.
+ */
 export declare namespace EncryptedModule {
     /**
      * Dynamic encrypted module.

package/lib/decorators/EncryptedModule.js

@@ -55,16 +55,20 @@ const load_controller_1 = require("./internal/load_controller");
  * Encrypted module.
  *
  * `EncryptedModule` is an extension of the {@link Module} class decorator
- * function who configures encryption password of the AES-128/256 algorithm. The
- * encryption algorithm and password would be used by {@link EncryptedRoute} and
- * {@link EncryptedBody} to encrypt the request and response bod of the HTTP
+ * function who configures encryption password of the AES-128/192/256 algorithm.
+ * The encryption algorithm and password would be used by {@link EncryptedRoute}
+ * and {@link EncryptedBody} to encrypt the request and response bod of the HTTP
  * protocol.
  *
  * By using this `EncryptedModule` decorator function, all of the
  * {@link Controller controllers} configured in the _metadata_ would be
- * automatically changed to the {@link EncryptedController} with the _password_.
- * If there're some original {@link EncryptedController} decorated classes in the
- * _metadata_, their encryption password would be kept.
+ * automatically changed to the {@link EncryptedController} with the _password_,
+ * and so would the controllers of every module it imports: module classes,
+ * dynamic modules (`{ module, imports, controllers }`), `forwardRef()`s, and
+ * promises of them, however deep and even when cyclic. If there're some
+ * original {@link EncryptedController} decorated classes in the _metadata_,
+ * their encryption password would be kept, as would a subclass's that inherits
+ * one.
  *
  * Therefore, if you're planning to place original {@link EncryptedController}
  * decorated classes in the _metadata_, I hope them to have different encryption
@@ -80,6 +84,11 @@ const load_controller_1 = require("./internal/load_controller");
  * @param metadata Module configuration metadata
  * @param password Encryption password or its getter function
  * @returns Class decorator
+ * @evidence contracts/common.md#principled-implementation A visited set breaks import cycles, the controllers of each visited module get the password as metadata, asynchronous modules are awaited through the same promise Nest awaits, and a forward reference is resolved once its class exists.
+ * @evidence contracts/common.md#clear-and-simple-design One decorator whose traversal is a private function; the dynamic-module helper is in the merged namespace.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The traversal uses the public metadata keys of Nest modules; no module name is special-cased.
+ * @evidence contracts/common.md#meaningful-documentation The comment states which module shapes are followed.
+ * @evidence contracts/portability.md#os-neutral-implementation The decorator traverses Nest module metadata in memory; its dynamic helper delegates native paths and file-URL imports to load_controllers instead of composing platform-specific import strings.
  */
 function EncryptedModule(metadata, password) {
     return function (target) {
@@ -87,6 +96,16 @@ function EncryptedModule(metadata, password) {
         iterate(password)(target);
     };
 }
+/**
+ * Helpers of {@link EncryptedModule}, namely `dynamic`, which builds an
+ * encrypted module from controller paths.
+ *
+ * @evidence contracts/common.md#principled-implementation `dynamic` loads the controllers with the shared loader, wraps an object password into a closure, and returns a class decorated by `EncryptedModule`.
+ * @evidence contracts/common.md#clear-and-simple-design One function that reuses the loader and the decorator.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Paths and password are caller input.
+ * @evidence contracts/common.md#meaningful-documentation The comment documents the path forms and the password argument.
+ * @evidence contracts/portability.md#os-neutral-implementation The decorator traverses Nest module metadata in memory; its dynamic helper delegates native paths and file-URL imports to load_controllers instead of composing platform-specific import strings.
+ */
 (function (EncryptedModule) {
     /**
      * Dynamic encrypted module.
@@ -128,17 +147,67 @@ function EncryptedModule(metadata, password) {
     }
     EncryptedModule.dynamic = dynamic;
 })(EncryptedModule || (exports.EncryptedModule = EncryptedModule = {}));
-/** @internal */
-const iterate = (password) => (modulo) => {
-    const imports = Reflect.getMetadata("imports", modulo);
-    if (Array.isArray(imports))
-        for (const imp of imports)
-            if (typeof imp === "function")
-                iterate(password)(imp);
-    const controllers = Reflect.getMetadata("controllers", modulo);
-    if (Array.isArray(controllers))
-        for (const c of controllers)
-            if (typeof c === "function")
-                Reflect.defineMetadata(EncryptedConstant_1.ENCRYPTION_METADATA_KEY, password, c);
+/**
+ * Gives every controller the module reaches the module's password: those of the
+ * module itself and of each import, whether a module class, a dynamic module
+ * (its `module`, and its own `imports` and `controllers`), a `forwardRef()`, or
+ * a promise of one. Each module is visited once, so a cyclic import graph
+ * terminates.
+ *
+ * @internal
+ */
+const iterate = (password) => {
+    const visited = new Set();
+    const controllers = (list) => {
+        if (Array.isArray(list))
+            for (const c of list)
+                if (typeof c === "function")
+                    Reflect.defineMetadata(EncryptedConstant_1.ENCRYPTION_METADATA_KEY, password, c);
+    };
+    const imports = (list) => {
+        if (Array.isArray(list))
+            for (const imp of list)
+                visit(imp);
+    };
+    const visit = (input) => {
+        if (typeof input !== "function" &&
+            (typeof input !== "object" || input === null))
+            return;
+        if (visited.has(input))
+            return;
+        visited.add(input);
+        if (typeof input === "function") {
+            imports(Reflect.getMetadata("imports", input));
+            controllers(Reflect.getMetadata("controllers", input));
+        }
+        else if (typeof input.then === "function")
+            // an asynchronous dynamic module; NestJS awaits the same promise while
+            // scanning, after this callback, registered first, has run
+            input.then(visit, () => { });
+        else if (typeof input.forwardRef === "function") {
+            // the class a forward reference names may not be defined yet while the
+            // decorators run; it is once the synchronous module graph has loaded
+            const resolve = () => {
+                try {
+                    return input.forwardRef();
+                }
+                catch (_a) {
+                    return undefined;
+                }
+            };
+            const target = resolve();
+            if (target !== undefined)
+                visit(target);
+            else
+                void Promise.resolve().then(() => visit(resolve()));
+        }
+        else {
+            const dynamic = input;
+            visit(dynamic.module);
+            imports(dynamic.imports);
+            controllers(dynamic.controllers);
+        }
+    };
+    return visit;
 };
 //# sourceMappingURL=EncryptedModule.js.map

package/lib/decorators/EncryptedModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"EncryptedModule.js","sourceRoot":"","sources":["../../src/decorators/EncryptedModule.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,2CAAwC;AAGxC,oEAAuE;AACvE,gEAA8D;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,yBACE,QAAsC,EACtC,QAAqC;IAErC,OAAO,UAAU,MAAW;QAC1B,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED,WAAiB,eAAe;IAC9B;;;;;;;;;;;;OAYG;IACH,SAAsB,OAAO;6DAC3B,IAAmE,EACnE,QAA2D,EAC3D,OAAO,GAAsD,EAAE,EAC/D,QAAkB;YAElB,mBAAmB;YACnB,MAAM,WAAW,GAAsB,MAAM,IAAA,kCAAgB,EAC3D,IAAI,EACJ,QAAQ,CACT,CAAC;YAEF,0BAA0B;gBAKpB,YAAY;wCAJjB,eAAe,iCACT,OAAO,KAAE,WAAW,KACzB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CACzD;;;;;;;;;oBACD,6KAAqB;;;oBAAf,uDAAY;;;;YAClB,OAAO,YAAY,CAAC;QACtB,CAAC;KAAA;IAnBqB,gBAAA,OAAO,UAmB5B,CAAA;AACH,CAAC,EAlCgB,eAAe,aAVhB,eAAe,GAUd,eAAe,QAkC/B;AAED,gBAAgB;AAChB,MAAM,OAAO,GACX,CAAC,QAAqC,EAAE,EAAE,CAC1C,CAAC,MAAW,EAAQ,EAAE;IACpB,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,OAAO;YACvB,IAAI,OAAO,GAAG,KAAK,UAAU;gBAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,WAAW;YACzB,IAAI,OAAO,CAAC,KAAK,UAAU;gBACzB,OAAO,CAAC,cAAc,CAAC,2CAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC,CAAC"}
+{"version":3,"file":"EncryptedModule.js","sourceRoot":"","sources":["../../src/decorators/EncryptedModule.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,2CAAwC;AAGxC,oEAAuE;AACvE,gEAA8D;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,yBACE,QAAsC,EACtC,QAAqC;IAErC,OAAO,UAAU,MAAW;QAC1B,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,WAAiB,eAAe;IAC9B;;;;;;;;;;;;OAYG;IACH,SAAsB,OAAO;6DAC3B,IAAmE,EACnE,QAA2D,EAC3D,OAAO,GAAsD,EAAE,EAC/D,QAAkB;YAElB,mBAAmB;YACnB,MAAM,WAAW,GAAsB,MAAM,IAAA,kCAAgB,EAC3D,IAAI,EACJ,QAAQ,CACT,CAAC;YAEF,0BAA0B;gBAKpB,YAAY;wCAJjB,eAAe,iCACT,OAAO,KAAE,WAAW,KACzB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CACzD;;;;;;;;;oBACD,6KAAqB;;;oBAAf,uDAAY;;;;YAClB,OAAO,YAAY,CAAC;QACtB,CAAC;KAAA;IAnBqB,gBAAA,OAAO,UAmB5B,CAAA;AACH,CAAC,EAlCgB,eAAe,aApBhB,eAAe,GAoBd,eAAe,QAkC/B;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,CAAC,QAAqC,EAAE,EAAE;IACxD,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,CAAC,IAAa,EAAQ,EAAE;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,IAAI;gBAClB,IAAI,OAAO,CAAC,KAAK,UAAU;oBACzB,OAAO,CAAC,cAAc,CAAC,2CAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,IAAa,EAAQ,EAAE;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAc,EAAQ,EAAE;QACrC,IACE,OAAO,KAAK,KAAK,UAAU;YAC3B,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;YAE7C,OAAO;QACT,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnB,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,OAAQ,KAA8B,CAAC,IAAI,KAAK,UAAU;YACnE,uEAAuE;YACvE,2DAA2D;YAC1D,KAA8B,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;aACnD,IAAI,OAAQ,KAA2B,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,OAAO,GAAG,GAAY,EAAE;gBAC5B,IAAI,CAAC;oBACH,OAAQ,KAA2B,CAAC,UAAU,EAAE,CAAC;gBACnD,CAAC;2BAAO,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC;YACF,MAAM,MAAM,GAAY,OAAO,EAAE,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,CAAC,CAAC;;gBACnC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,KAIf,CAAC;YACF,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzB,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/lib/decorators/EncryptedRoute.d.ts

@@ -4,22 +4,26 @@ import { TypedRoute } from "./TypedRoute";
  * Encrypted router decorator functions.
  *
  * `EncryptedRoute` is a module containing router decorator functions which
- * encrypts response body data through AES-128/256 encryption. Furthermore, they
- * can boost up JSON string conversion speed about 50x times faster than
- * `class-transformer`, even type safe through
- * [typia](https://github.com/samchon/typia).
+ * encrypts response body data through AES-128/192/256 encryption after
+ * serializing it with a [typia](https://github.com/samchon/typia) function
+ * generated from the declared return type.
  *
- * For reference, if you try to invalid data that is not following the promised
- * type `T`, 500 internal server error would be thrown. Also, as
- * `EncryptedRoute` composes JSON string through `typia.assertStringify<T>()`
- * function, it is not possible to modify response data through interceptors.
+ * The default assert serializer rejects a response outside the declared type
+ * with a 500 error. The configured stringify mode chooses the validation policy
+ * before encryption; `validate.log` logs failures and serializes the original
+ * value. Interceptors running afterwards receive ciphertext.
  *
- * - AES-128/256
+ * - AES-128/192/256
  * - CBC mode
  * - PKCS #5 Padding
  * - Base64 Encoding
  *
  * @author Jeongho Nam - https://github.com/samchon
+ * @evidence contracts/common.md#principled-implementation Each route method decorates Nest's router decorator with an interceptor that serializes the value as the transform chose, encrypts it with the password of the controller or module, and answers `text/plain` on success only, so an error keeps its own JSON type.
+ * @evidence contracts/common.md#clear-and-simple-design One generator function creates the five HTTP-method decorators, and the interceptor and the router table are module-private.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The password lookup and the serializer come from shared modules; the loop after the namespace copies the marker properties of typia's stringify functions onto the five decorators as the transform expects, which mutates only these exported functions.
+ * @evidence contracts/common.md#meaningful-documentation The comment documents the decorator family and its password requirement.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Route paths and serialized ciphertext are HTTP protocol values; response interception does not access native files or launch a process.
  */
 export declare namespace EncryptedRoute {
     /**
@@ -34,7 +38,7 @@ export declare namespace EncryptedRoute {
         <T>(path: string | string[], stringify?: IResponseBodyStringifier<T> | null): MethodDecorator;
     };
     /**
-     * Encrypted router decorator function for the GET method.
+     * Encrypted router decorator function for the POST method.
      *
      * @param paths Path(s) of the HTTP request
      * @returns Method decorator
@@ -83,7 +87,7 @@ export declare namespace EncryptedRoute {
      * If you've configured the transformation option to `validate.log` in the
      * `tsconfig.json` file, then the error log information of the response
      * validation failure would be logged through this function instead of
-     * throwing the 400 bad request error.
+     * throwing the 500 internal server error.
      *
      * By the way, be careful. If you've configured the response transformation
      * option to be `validate.log`, client may get wrong response data. Therefore,
@@ -91,6 +95,11 @@ export declare namespace EncryptedRoute {
      *
      * @default console.log
      * @param func Logger function
+     * @evidence contracts/common.md#principled-implementation It stores the logger in `TypedRoute`, which owns the single logger both route families use.
+     * @evidence contracts/common.md#clear-and-simple-design A one-line delegation, so the logger has one owner.
+     * @evidence contracts/common.md#prohibited-implementation-shortcuts It changes only the logger variable.
+     * @evidence contracts/common.md#meaningful-documentation The comment states which validate mode uses the logger.
+     * @evidenceExclude contracts/portability.md#os-neutral-implementation Route paths and serialized ciphertext are HTTP protocol values; response interception does not access native files or launch a process.
      */
     function setValidateErrorLogger(func: (log: IValidateErrorLog) => void): void;
     export import IValidateErrorLog = TypedRoute.IValidateErrorLog;

package/lib/decorators/EncryptedRoute.js

@@ -10,7 +10,7 @@ const operators_1 = require("rxjs/operators");
 const typia_1 = __importDefault(require("typia"));
 const Singleton_1 = require("../utils/Singleton");
 const TypedRoute_1 = require("./TypedRoute");
-const EncryptedConstant_1 = require("./internal/EncryptedConstant");
+const get_encryption_password_1 = require("./internal/get_encryption_password");
 const get_path_and_stringify_1 = require("./internal/get_path_and_stringify");
 const headers_to_object_1 = require("./internal/headers_to_object");
 const route_error_1 = require("./internal/route_error");
@@ -18,22 +18,26 @@ const route_error_1 = require("./internal/route_error");
  * Encrypted router decorator functions.
  *
  * `EncryptedRoute` is a module containing router decorator functions which
- * encrypts response body data through AES-128/256 encryption. Furthermore, they
- * can boost up JSON string conversion speed about 50x times faster than
- * `class-transformer`, even type safe through
- * [typia](https://github.com/samchon/typia).
+ * encrypts response body data through AES-128/192/256 encryption after
+ * serializing it with a [typia](https://github.com/samchon/typia) function
+ * generated from the declared return type.
  *
- * For reference, if you try to invalid data that is not following the promised
- * type `T`, 500 internal server error would be thrown. Also, as
- * `EncryptedRoute` composes JSON string through `typia.assertStringify<T>()`
- * function, it is not possible to modify response data through interceptors.
+ * The default assert serializer rejects a response outside the declared type
+ * with a 500 error. The configured stringify mode chooses the validation policy
+ * before encryption; `validate.log` logs failures and serializes the original
+ * value. Interceptors running afterwards receive ciphertext.
  *
- * - AES-128/256
+ * - AES-128/192/256
  * - CBC mode
  * - PKCS #5 Padding
  * - Base64 Encoding
  *
  * @author Jeongho Nam - https://github.com/samchon
+ * @evidence contracts/common.md#principled-implementation Each route method decorates Nest's router decorator with an interceptor that serializes the value as the transform chose, encrypts it with the password of the controller or module, and answers `text/plain` on success only, so an error keeps its own JSON type.
+ * @evidence contracts/common.md#clear-and-simple-design One generator function creates the five HTTP-method decorators, and the interceptor and the router table are module-private.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The password lookup and the serializer come from shared modules; the loop after the namespace copies the marker properties of typia's stringify functions onto the five decorators as the transform expects, which mutates only these exported functions.
+ * @evidence contracts/common.md#meaningful-documentation The comment documents the decorator family and its password requirement.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation Route paths and serialized ciphertext are HTTP protocol values; response interception does not access native files or launch a process.
  */
 var EncryptedRoute;
 (function (EncryptedRoute) {
@@ -45,7 +49,7 @@ var EncryptedRoute;
      */
     EncryptedRoute.Get = Generator("Get");
     /**
-     * Encrypted router decorator function for the GET method.
+     * Encrypted router decorator function for the POST method.
      *
      * @param paths Path(s) of the HTTP request
      * @returns Method decorator
@@ -78,7 +82,7 @@ var EncryptedRoute;
      * If you've configured the transformation option to `validate.log` in the
      * `tsconfig.json` file, then the error log information of the response
      * validation failure would be logged through this function instead of
-     * throwing the 400 bad request error.
+     * throwing the 500 internal server error.
      *
      * By the way, be careful. If you've configured the response transformation
      * option to be `validate.log`, client may get wrong response data. Therefore,
@@ -86,6 +90,11 @@ var EncryptedRoute;
      *
      * @default console.log
      * @param func Logger function
+     * @evidence contracts/common.md#principled-implementation It stores the logger in `TypedRoute`, which owns the single logger both route families use.
+     * @evidence contracts/common.md#clear-and-simple-design A one-line delegation, so the logger has one owner.
+     * @evidence contracts/common.md#prohibited-implementation-shortcuts It changes only the logger variable.
+     * @evidence contracts/common.md#meaningful-documentation The comment states which validate mode uses the logger.
+     * @evidenceExclude contracts/portability.md#os-neutral-implementation Route paths and serialized ciphertext are HTTP protocol values; response interception does not access native files or launch a process.
      */
     function setValidateErrorLogger(func) {
         TypedRoute_1.TypedRoute.setValidateErrorLogger(func);
@@ -124,7 +133,7 @@ class EncryptedRouteInterceptor {
     intercept(context, next) {
         const http = context.switchToHttp();
         return next.handle().pipe((0, operators_1.map)((value) => {
-            const param = Reflect.getMetadata(EncryptedConstant_1.ENCRYPTION_METADATA_KEY, context.getClass());
+            const param = (0, get_encryption_password_1.get_encryption_password)(context.getClass());
             if (!param)
                 throw new Error(`Error on EncryptedRoute.${this.method}(): no password found.`);
             const request = http.getRequest();
@@ -139,6 +148,11 @@ class EncryptedRouteInterceptor {
                 : param;
             if (body === undefined)
                 return body;
+            // the ciphertext is text/plain, as the document declares; set on the
+            // success path alone, so an error keeps its JSON body's type (Express
+            // would otherwise send a string as text/html)
+            const response = http.getResponse();
+            response.header("Content-Type", "text/plain");
             return AesPkcs5_1.AesPkcs5.encrypt(body, password.key, password.iv);
         }), (0, operators_1.catchError)((err) => (0, route_error_1.route_error)(http.getRequest(), err)));
     }

package/lib/decorators/EncryptedRoute.js.map

@@ -1 +1 @@
-{"version":3,"file":"EncryptedRoute.js","sourceRoot":"","sources":["../../src/decorators/EncryptedRoute.ts"],"names":[],"mappings":";;;;;;AACA,2DAAwD;AACxD,2CAWwB;AAGxB,8CAAiD;AACjD,kDAA0B;AAG1B,kDAA+C;AAC/C,6CAA0C;AAC1C,oEAAuE;AACvE,8EAA2E;AAC3E,oEAAiE;AACjE,wDAAqD;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,IAAiB,cAAc,CAsF9B;AAtFD,WAAiB,cAAc;IAC7B;;;;;OAKG;IACU,kBAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC;;;;;OAKG;IACU,mBAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtC;;;;;OAKG;IACU,oBAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAExC;;;;;OAKG;IACU,kBAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC;;;;;OAKG;IACU,qBAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE1C;;;;;;;;;;;;;;OAcG;IACH,SAAgB,sBAAsB,CACpC,IAAsC;QAEtC,uBAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAJe,eAAA,sBAAsB,yBAIrC,CAAA;IAID,gBAAgB;IAChB,SAAS,SAAS,CAAC,MAAmD;QAUpE,SAAS,KAAK,CAAC,GAAG,IAAW;YAC3B,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,IAAA,+CAAsB,EAC9C,GAAG,EAAE,CAAC,uBAAU,CAAC,QAAQ,CAC1B,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvC,OAAO,IAAA,wBAAe,EACpB,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EACrB,IAAA,wBAAe,EAAC,IAAI,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EAtFgB,cAAc,aAAd,cAAc,GAAd,cAAc,QAsF9B;AAED,KAAK,MAAM,MAAM,IAAI;IACnB,eAAK,CAAC,IAAI,CAAC,WAAW;IACtB,eAAK,CAAC,IAAI,CAAC,eAAe;IAC1B,eAAK,CAAC,IAAI,CAAC,iBAAiB;IAC5B,eAAK,CAAC,IAAI,CAAC,SAAS;CACrB;IACC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI;YACjB,cAAc,CAAC,GAAG;YAClB,cAAc,CAAC,MAAM;YACrB,cAAc,CAAC,IAAI;YACnB,cAAc,CAAC,GAAG;YAClB,cAAc,CAAC,KAAK;SACrB;YACE,IAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAEjC,gBAAgB;AAChB,MAAM,yBAAyB;IAC7B,YACmB,MAAc,EACd,SAIN;sBALM,MAAM;yBACN,SAAS;IAKzB,CAAC;IAEG,SAAS,CAAC,OAAyB,EAAE,IAAiB;QAC3D,MAAM,IAAI,GAAsB,OAAO,CAAC,YAAY,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CACvB,IAAA,eAAG,EAAC,CAAC,KAAK,EAAE,EAAE;YACZ,MAAM,KAAK,GAGK,OAAO,CAAC,WAAW,CACjC,2CAAuB,EACvB,OAAO,CAAC,QAAQ,EAAE,CACnB,CAAC;YACF,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,MAAM,wBAAwB,CAC/D,CAAC;YAEJ,MAAM,OAAO,GAAoB,IAAI,CAAC,UAAU,EAAE,CAAC;YACnD,MAAM,OAAO,GAAsC,IAAI,qBAAS,CAAC,GAAG,EAAE,CACpE,IAAA,qCAAiB,EAAC,OAAO,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,MAAM,IAAI,GAAuB,IAAI,CAAC,SAAS,CAC7C,KAAK,EACL,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,GAAG,CACZ,CAAC;YACF,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,UAAU;gBACzB,CAAC,CAAC,KAAK,CAAC;oBACJ,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE;oBACtB,IAAI;oBACJ,SAAS,EAAE,QAAQ;iBACpB,CAAC;gBACJ,CAAC,CAAC,KAAK,CAAC;YAEZ,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,mBAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,EACF,IAAA,sBAAU,EAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,yBAAW,EAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC,CACzD,CAAC;IACJ,CAAC;CACF;AAED,gBAAgB;AAChB,MAAM,OAAO,GAAG;IACd,GAAG,EAAH,YAAG;IACH,IAAI,EAAJ,aAAI;IACJ,GAAG,EAAH,YAAG;IACH,KAAK,EAAL,cAAK;IACL,MAAM,EAAN,eAAM;CACP,CAAC"}
+{"version":3,"file":"EncryptedRoute.js","sourceRoot":"","sources":["../../src/decorators/EncryptedRoute.ts"],"names":[],"mappings":";;;;;;AACA,2DAAwD;AACxD,2CAWwB;AAGxB,8CAAiD;AACjD,kDAA0B;AAG1B,kDAA+C;AAC/C,6CAA0C;AAC1C,gFAA6E;AAC7E,8EAA2E;AAC3E,oEAAiE;AACjE,wDAAqD;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,IAAiB,cAAc,CA2F9B;AA3FD,WAAiB,cAAc;IAC7B;;;;;OAKG;IACU,kBAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC;;;;;OAKG;IACU,mBAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtC;;;;;OAKG;IACU,oBAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAExC;;;;;OAKG;IACU,kBAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC;;;;;OAKG;IACU,qBAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAgB,sBAAsB,CACpC,IAAsC;QAEtC,uBAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAJe,eAAA,sBAAsB,yBAIrC,CAAA;IAID,gBAAgB;IAChB,SAAS,SAAS,CAAC,MAAmD;QAUpE,SAAS,KAAK,CAAC,GAAG,IAAW;YAC3B,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,IAAA,+CAAsB,EAC9C,GAAG,EAAE,CAAC,uBAAU,CAAC,QAAQ,CAC1B,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvC,OAAO,IAAA,wBAAe,EACpB,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EACrB,IAAA,wBAAe,EAAC,IAAI,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EA3FgB,cAAc,aAAd,cAAc,GAAd,cAAc,QA2F9B;AAED,KAAK,MAAM,MAAM,IAAI;IACnB,eAAK,CAAC,IAAI,CAAC,WAAW;IACtB,eAAK,CAAC,IAAI,CAAC,eAAe;IAC1B,eAAK,CAAC,IAAI,CAAC,iBAAiB;IAC5B,eAAK,CAAC,IAAI,CAAC,SAAS;CACrB;IACC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI;YACjB,cAAc,CAAC,GAAG;YAClB,cAAc,CAAC,MAAM;YACrB,cAAc,CAAC,IAAI;YACnB,cAAc,CAAC,GAAG;YAClB,cAAc,CAAC,KAAK;SACrB;YACE,IAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAEjC,gBAAgB;AAChB,MAAM,yBAAyB;IAC7B,YACmB,MAAc,EACd,SAIN;sBALM,MAAM;yBACN,SAAS;IAKzB,CAAC;IAEG,SAAS,CAAC,OAAyB,EAAE,IAAiB;QAC3D,MAAM,IAAI,GAAsB,OAAO,CAAC,YAAY,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CACvB,IAAA,eAAG,EAAC,CAAC,KAAK,EAAE,EAAE;YACZ,MAAM,KAAK,GAGK,IAAA,iDAAuB,EAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,MAAM,wBAAwB,CAC/D,CAAC;YAEJ,MAAM,OAAO,GAAoB,IAAI,CAAC,UAAU,EAAE,CAAC;YACnD,MAAM,OAAO,GAAsC,IAAI,qBAAS,CAAC,GAAG,EAAE,CACpE,IAAA,qCAAiB,EAAC,OAAO,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,MAAM,IAAI,GAAuB,IAAI,CAAC,SAAS,CAC7C,KAAK,EACL,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,GAAG,CACZ,CAAC;YACF,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,UAAU;gBACzB,CAAC,CAAC,KAAK,CAAC;oBACJ,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE;oBACtB,IAAI;oBACJ,SAAS,EAAE,QAAQ;iBACpB,CAAC;gBACJ,CAAC,CAAC,KAAK,CAAC;YAEZ,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,qEAAqE;YACrE,sEAAsE;YACtE,8CAA8C;YAC9C,MAAM,QAAQ,GAAqB,IAAI,CAAC,WAAW,EAAE,CAAC;YACtD,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;YAC9C,OAAO,mBAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,EACF,IAAA,sBAAU,EAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,yBAAW,EAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC,CACzD,CAAC;IACJ,CAAC;CACF;AAED,gBAAgB;AAChB,MAAM,OAAO,GAAG;IACd,GAAG,EAAH,YAAG;IACH,IAAI,EAAJ,aAAI;IACJ,GAAG,EAAH,YAAG;IACH,KAAK,EAAL,cAAK;IACL,MAAM,EAAN,eAAM;CACP,CAAC"}

package/lib/decorators/HumanRoute.d.ts

@@ -11,5 +11,10 @@
  *
  * @author Jeongho Nam - https://github.com/samchon
  * @returns Method decorator
+ * @evidence contracts/common.md#principled-implementation The decorator marks the operation with the `x-samchon-human` extension through `SwaggerCustomizer`, so the generated document carries the mark without another metadata path.
+ * @evidence contracts/common.md#clear-and-simple-design One call to the customizer.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The extension name is the documented contract of the generated document.
+ * @evidence contracts/common.md#meaningful-documentation The comment states that a marked API is left out of the LLM function calling schema.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation The OpenAPI extension is an in-memory document property and has no native path or process representation.
  */
 export declare function HumanRoute(): MethodDecorator;