@nwire/koa 0.11.1 → 0.12.0

package/dist/http-koa.d.ts

@@ -60,6 +60,20 @@ export interface HttpKoaConfig {
      * middleware running upstream).
      */
     readonly reqId?: boolean;
+    /**
+     * Echo raw thrown `Error.message` to the client for non-typed errors.
+     *
+     * Default `false` — a generic `throw new Error("…")` returns an opaque
+     * `{ code: "internal_error", summary: "Internal error" }` and the real
+     * message is logged server-side only. This is fail-safe: driver errors,
+     * connection strings, and PII attached to a stray throw never reach the
+     * client, in any environment.
+     *
+     * Set `true` in local dev to surface the message for debugging. Typed
+     * `defineError` values always render their own `{ code, summary }`
+     * regardless — those are author-defined and safe to expose.
+     */
+    readonly exposeErrors?: boolean;
     /**
      * Tenant resolver. The dev/test default reads `x-tenant` from the
      * request header — convenient for local multi-tenancy. Production

package/dist/http-koa.js

@@ -62,12 +62,14 @@ export function httpKoa(config = {}) {
             const koa = new Koa();
             koaInstance = koa;
             const isProd = process.env.NODE_ENV === "production";
+            const exposeErrors = config.exposeErrors === true;
             // Top-level error mapper — catches throws from middleware and
-            // unmatched routes. Renders defineError-shaped values with their
-            // {code, status, summary} envelope; in production, generic
-            // (non-NwireError) throws return opaque "internal_error" so a
-            // stray `throw new Error("DB password X")` cannot leak the
-            // message to clients. The real error is always logged.
+            // unmatched routes. Typed `defineError` values render their own
+            // {code, status, summary}. Generic (non-NwireError) throws return an
+            // opaque "internal_error" by default so a stray
+            // `throw new Error("DB password X")` cannot leak the message to
+            // clients — in any environment. `exposeErrors: true` (dev) echoes
+            // the message. The real error is always logged server-side.
             koa.use(async (kctx, next) => {
                 try {
                     await next();
@@ -75,21 +77,18 @@ export function httpKoa(config = {}) {
                 catch (err) {
                     const e = err;
                     const isNwireError = e?.$kind === "error";
-                    const status = typeof e.status === "number" ? e.status : 500;
-                    kctx.status = status;
-                    if (!isNwireError && isProd) {
-                        // Server-side: log the full error so SRE can see it. Client:
-                        // opaque body — no error.message leak.
-                        logger.error?.(`[http-koa] unhandled error: ${e?.message ?? e}`, undefined);
+                    kctx.status = typeof e.status === "number" ? e.status : 500;
+                    if (isNwireError) {
                         kctx.body = {
-                            error: { code: "internal_error", summary: "Internal error" },
+                            error: { code: e.code ?? "internal_error", summary: e.summary ?? "Internal error" },
                         };
                     }
                     else {
+                        logger.error?.(`[http-koa] unhandled error: ${e?.message ?? e}`, undefined);
                         kctx.body = {
                             error: {
-                                code: e.code ?? "internal_error",
-                                summary: e.summary ?? e.message ?? "Internal error",
+                                code: "internal_error",
+                                summary: exposeErrors ? (e.message ?? "Internal error") : "Internal error",
                             },
                         };
                     }
@@ -309,25 +308,26 @@ export function httpKoa(config = {}) {
                         }
                     }
                     catch (err) {
-                        // Generic error envelope. NwireError-shaped values (defineError)
-                        // surface their {code, status, summary}. Other throws — under
-                        // NODE_ENV=production — return opaque "internal_error" so a
-                        // stray `throw new Error("DB password X")` cannot leak the
-                        // message to clients. The real error is always logged.
+                        // Generic error envelope. Typed `defineError` values surface
+                        // their {code, status, summary}. Other throws return an opaque
+                        // "internal_error" by default so a stray
+                        // `throw new Error("DB password X")` cannot leak the message to
+                        // clients — in any environment. `exposeErrors: true` (dev)
+                        // echoes the message. The real error is always logged.
                         const e = err;
                         const isNwireError = e?.$kind === "error";
                         kctx.status = typeof e.status === "number" ? e.status : 500;
-                        if (!isNwireError && isProd) {
-                            logger.error?.(`[http-koa] unhandled error: ${e?.message ?? e}`, undefined);
+                        if (isNwireError) {
                             kctx.body = {
-                                error: { code: "internal_error", summary: "Internal error" },
+                                error: { code: e.code ?? "internal_error", summary: e.summary ?? "Internal error" },
                             };
                         }
                         else {
+                            logger.error?.(`[http-koa] unhandled error: ${e?.message ?? e}`, undefined);
                             kctx.body = {
                                 error: {
-                                    code: e.code ?? "internal_error",
-                                    summary: e.summary ?? e.message ?? "Internal error",
+                                    code: "internal_error",
+                                    summary: exposeErrors ? (e.message ?? "Internal error") : "Internal error",
                                 },
                             };
                         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nwire/koa",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Nwire — Koa-backed HTTP adopter. Consumes wires from @nwire/wires/http and serves them as Koa routes under endpoint lifecycle.",
   "keywords": [
     "adopter",
@@ -33,10 +33,10 @@
     "koa-bodyparser": "^4.4.1",
     "koa-helmet": "^8.0.1",
     "zod": "^4.0.0",
-    "@nwire/container": "0.11.1",
-    "@nwire/endpoint": "0.11.1",
-    "@nwire/logger": "0.11.1",
-    "@nwire/wires": "0.11.1"
+    "@nwire/container": "0.12.0",
+    "@nwire/endpoint": "0.12.0",
+    "@nwire/logger": "0.12.0",
+    "@nwire/wires": "0.12.0"
   },
   "devDependencies": {
     "@asteasolutions/zod-to-openapi": "^8.0.0",
@@ -47,8 +47,8 @@
     "@types/node": "^22.19.9",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18",
-    "@nwire/app": "0.11.1",
-    "@nwire/handler": "0.11.1"
+    "@nwire/app": "0.12.0",
+    "@nwire/handler": "0.12.0"
   },
   "peerDependencies": {
     "@asteasolutions/zod-to-openapi": "^8.0.0"